summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Avoid multiply defining OIDs in tests/gssapiTom Yu2012-09-141-6/+6
| | | | | | Declarations of gss_OID_desc mech_krb5, etc. in tests/gssapi/common.h can result in multiple definitions when the test programs are linked. Prefix the declarations with "extern" to prevent this.
* Remove osa_adb_rename_dbGreg Hudson2012-09-132-51/+0
| | | | | This function wasn't used anywhere. Also remove the declaration for osa_adb_close_policy(), which doesn't exist.
* Tidy up GSSAPI test programsGreg Hudson2012-09-1321-2186/+937
| | | | | | | | Factor out some common functions used by multiple test programs. Use a common argument format for importing names (p:princname, h:hostbasedname, or u:username) and adjust the Python tests to match it. Use more consistent conventions in test programs and fix some coding style issues. Normalize how the test programs are built.
* Improve LEASHAUTOINIT descriptionBen Kaduk2012-09-121-1/+1
| | | | | | | | | | | | | | This installer option determines whether the -autoinit argument is passed to the MIT Kerberos executable. On startup, if this argument is passed, and if there are no tickets in the default cache, and if no useful tickets can be imported from the LSA cache, MIT Kerberos will open the get ticket dialog and prompt for a password; this option does not appear to have any other effect. ticket: 7357 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Fix typo in util/support/Makefile.inGreg Hudson2012-09-121-1/+1
|
* Test the inconsistent locking fix and svc unavailNicolas Williams2012-09-122-0/+40
| | | | | | Test the fix for https://bugzilla.redhat.com/show_bug.cgi?id=586032 . Also test that krb5kdc can return svc unavailable
* Fix lock inconsistency in ctx_unlock()Nicolas Williams2012-09-121-4/+8
| | | | | | | | | | | | | | | | | | | | | The lock inconsistency fixed here is quite possibly the same as described in https://bugzilla.redhat.com/show_bug.cgi?id=586032 . The problem is that ctx_unlock() fails to unlock the principal DB if it fails to unlock the policy DB, and this happens when ctx_lock() fails to lock the policy DB (likely because the caller is racing against a kdb5_util load, which will be using a "permanent" lock, meaning that the lock file will be unlinked after acquiring the lock). The fix is to perform both unlock operations *then* handle any errors that either or both might have returned. Additionally, we don't really need or want to use non-blocking locks, and we certainly don't want to sleep(1) in krb5kdc (possibly several times, as there was a loop over this) when either of the principal or policy DB is locked. Some callers still request non-blocking locks, and ctx_lock() still honors this. ticket: 7360 (new)
* Use blocking locks in krb5kdc and libkadm5srvNicolas Williams2012-09-122-35/+19
| | | | | | | | | | We don't really need or want to use non-blocking locks, and we certainly don't want to sleep(1) in krb5kdc (possibly several times, as there was a loop over this) when either of the principal or policy DB is locked. Some callers still request non-blocking locks, and ctx_lock() still honors this. ticket: 7359 (new)
* Map CANTLOCK_DB to SVC_UNAVAILABLE in krb5kdcNicolas Williams2012-09-122-0/+8
| | | | | | | | | | | | | | The KDC should not return KRB5KRB_ERR_GENERIC (KRB_ERR_GENERIC) when the KDB plugin returns KRB5_KDB_CANTLOCK_DB: it should return KRB5KDC_ERR_SVC_UNAVAILABLE (KDC_ERR_SVC_UNAVAILABLE) instead. This allows clients to immediately fallback onto other KDCs. When we switch to using blocking locks in the db2 KDB backend we'll very rarely hit this code path, perhaps only when racing against a kdb5_util load. Other KDB backends might still return KRB5_KDB_CANTLOCK_DB often enough that this change is desirable. ticket: 7358 (new)
* Unregister error message key on library unloadBen Kaduk2012-09-121-0/+1
| | | | | | | | | | | | | | | Revision fcdd2de1 added the K5_KEY_GSS_KRB5_ERROR_MESSAGE key, and registered it in the gssapi library initialization routine, but did not unregister it in the libary finalization routine. When the library is unloaded and reloaded in the same process, this leads to an assertion failure, since we check that destructors_set[keynum] is zero (no destructor set) when registering a key in util/support/threads.c. Unregister the key on library cleanup to resolve the error. ticket: 7353 target_version: 1.10.4 tags: pullup
* make dependGreg Hudson2012-09-124-0/+70
|
* Do not retrieve zero-length credsBen Kaduk2012-09-111-2/+4
| | | | | | | | | | | In the MSLSA cache, if we get back a zero-length ticket, don't accept it as success; continue on to try and get an acceptable ticket. ticket: 7349 (new) subject: SapGUI sometimes crashes on new session with MSLSA cache target_version: 1.10.4 tags: pullup
* Add new api to Sphinx doc; doc introduced versionZhanna Tsitkov2012-09-111-1/+9
|
* Add tests for GSS cred export and importGreg Hudson2012-09-113-4/+272
| | | | ticket: 7354
* Add SPNEGO support for GSS cred export and importGreg Hudson2012-09-112-1/+51
| | | | ticket: 7354
* Add krb5 support for GSS cred export and importGreg Hudson2012-09-115-0/+1117
| | | | | | | Using the new internal JSON support to implement serialization and unserialization of krb5 GSS credentials. ticket: 7354
* Introduce gss_export_cred and gss_import_credGreg Hudson2012-09-117-0/+316
| | | | | | | | Add gss_export_cred and gss_import_cred mechglue functions to serialize and unserialize GSSAPI credential handles. Mechanism implementations and tests will follow. ticket: 7354 (new)
* Add internal JSON encoding and decoding supportGreg Hudson2012-09-116-2/+1435
| | | | Add JSON support based loosely on Heimdal's heimbase code.
* Add internal base64 encoding and decoding supportGreg Hudson2012-09-114-3/+318
| | | | Add base64 support based on Heimdal's libroken base64 code.
* Add responder feature for initial cred exchangesNathaniel McCallum2012-09-1113-6/+594
| | | | | | | | | | | | | | | | | | | | | | | Add new APIs: * krb5_get_init_creds_opt_set_responder * krb5_responder_get_challenge * krb5_responder_list_questions * krb5_responder_set_answer If a caller sets a responder, it will be invoked after preauth modules have had a chance to review their incoming padata but before they produce outgoing padata. The responder will be presented a set of questions with optional challenges. The responder should then answer all questions it knows how to handle. Both the answers and the challenges are printable UTF-8 and may contain encoded, structured data specific to the question asked. Add two new callbacks and one optional method to the clpreauth interface. The new method (prep_questions) allows modules to ask questions by setting them in the responder context using one of the new callbacks (ask_responder_question). The other new callback (get_responder_answer) is used by the process method to read the answers to the questions asked. ticket: 7355 (new)
* Add cred store functions to gssapi32.defGreg Hudson2012-09-101-0/+4
| | | | | | | 25ee704e83c2c63d4b5ecd12ea31c1979239041e added three new public GSSAPI functions; add them to the DLL export file. ticket: 7217
* Add zapfreestr() helper to k5-int.hGreg Hudson2012-09-101-0/+10
| | | | | | Since zapfree(str, strlen(str)) won't work for possibly-null values of str, add a helper zapfreestr() which only calls strlen() if the string value is non-null.
* Removed unused leash help fileGreg Hudson2012-09-091-0/+0
| | | | | | | | | | | The file 'checkbox blank.png' is unneeded and contains a space in the name, unnecessarily interfering with running find | xargs over the source tree. Remove it. ticket: 7352 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Define SED in util/verto/Makefile.inGreg Hudson2012-09-061-0/+1
| | | | | | | When the rules from util/k5ev/Makefile.in were moved to util/verto/Makefile.in, the rule to make rename.h was broken on non-gmake makes because the definition of SED wasn't carried over. Define it now.
* Add asn1c test vectors for alg-agility typesGreg Hudson2012-09-064-2/+404
| | | | | | | | | For the test-vectors target in tests/asn.1, add ASN.1 modules from RFC 4556 and draft-ietf-krb-wg-pkinit-alg-agility-06.txt, and output test encodings for PrincipalName, KRB5PrincipalName, OtherInfo, and PkinitSuppPubInfo. In the alg-agility module, AuthPack and DHRepInfo are renamed, as asn1c otherwise rejects them as conflicting with the RFC 4556 definitions.
* Avoid libdl dependencies in bundled libvertoGreg Hudson2012-09-0425-340/+68
| | | | | | | | | | | | | | The upstream libverto depends on dynamic loading and in particular on dladdr(), which is not universal. To avoid this dependency, stub out support for module loading (by replacing module.c) and instead integrate the k5ev module directly into the bundled verto library. This change removes the need to link, include, and invoke libverto differently depending on whether we're using the bundled library; we can always just link with -lverto and call verto_default(). bigredbutton: whitespace ticket: 7351 (new)
* Update bundled libverto to 0.2.5Greg Hudson2012-09-037-63/+363
|
* Try harder not to use clock_gettime in verto-k5evGreg Hudson2012-09-031-1/+2
| | | | | | | | | | | | We already define EV_USE_REALTIME to 0 to avoid the use of clock_gettime() (to avoid depending on librt). But in some build environments libev can detect support for a monotonic clock, which also results in using clock_gettime(). Define EV_USE_MONOTONIC to 0 as well to prevent this. ticket: 7350 (new) target_version: 1.10.4 tags: pullup
* Use separate components for shortcutsBen Kaduk2012-08-312-9/+23
| | | | | | | | | | | | | | | | | Since the Start Menu and Desktop are different folders, we should use different components for the shortcuts in those folders, given that components operate at directory granularity. Take the opportunity to use the newer style for installing shortcuts and registry keys, and make the names more descriptive. Increment the buildlevel to ensure new files are installed. ticket: 7348 (new) subject: Use more meaningfully named registry keys for shortcuts queue: kfw target_version: 1.10.4 tags: pullup
* Add support for GSS_C_NT_COMPOSITE_EXPORTLuke Howard2012-08-317-62/+78
| | | | ticket: 7347 (new)
* Support kdc_timesync offsets in memory ccacheNate Rosenblum2012-08-311-0/+22
| | | | | | | | | | | | | When using v4 file credentials caches, client clock skew offsets obtained when running with the kdc_timesync option set are persisted in the ccache. This allows the offsets to be used across separate contexts, e.g. when obtaining credentials using krb5 interfaces and subsequently importing those credentials for use in gssapi. This patch adds similar support for memory credentials caches. [ghudson@mit.edu: Minor style corrections.] ticket: 7346 (new)
* Fix memory leak in gss_add_credGreg Hudson2012-08-301-0/+3
| | | | | The most recent commit to g_acquire_cred.c allocates an OID set to pass to the mech, but never releases it. Fix that.
* Do not emit debug printfs under NODEBUGBen Kaduk2012-08-291-0/+2
| | | | | | | | | | | | | | These printfs spew to the console when command-line utilities such as 'klist' and 'aklog' are run, reducing usability. These printfs can also cause application hangs. On a multiprocessor machine, when PuTTY and the ccapiserver are running on different CPUs, PuTTY appears to deadlock with three concurrent threads inside cci_debug_printf(). ticket: 7342 (new) target_version: 1.10.4 tags: pullup
* Fix KfW startup shortcut installationKevin Wasserman2012-08-292-8/+5
| | | | | | | | | Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7341 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Clean out dead code from ccapiKevin Wasserman2012-08-292-39/+0
| | | | | | | | Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7237 target_version: 1.10.4 tags: pullup
* Fix KfW thread-local storage allocation issuesKevin Wasserman2012-08-292-12/+23
| | | | | | | | | | | | Allocate thread-local storage on demand; don't rely on the DLL_THREAD_ATTACH case in DllMain() since pre-existing threads will never execute that code. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7340 (new) target_version: 1.10.4 tags: pullup
* Improve error translation for CCAPIv3 routinesBen Kaduk2012-08-291-8/+9
| | | | | | | | | We can't mix the KRB5 and CC error constants; standardize on the CC ones and translate appropriately. ticket: 7339 (new) target_version: 1.10.4 tags: pullup
* Replace NIM with "MIT Kerberos" in installer textKevin Wasserman2012-08-291-3/+3
| | | | | | | | | Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7338 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Kill running processes on upgrades/uninstallsBen Kaduk2012-08-291-2/+18
| | | | | | | | | | | | | | | | | | The InstallValidate action of the windows installer will bring up a dialog informing us that some currently running processes must be terminated before installation may proceed, and offers to do so, but does not actually kill the processes. We have our own code to kill running processes which did not execute, for two reasons: it was sequenced after InstallValidate, and we did not have a current list of processes to look for. Add the right processes to look for and kill, and use our own process-killing code since it actually works. ticket: 7343 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Make finding 32-bit libs easierBen Kaduk2012-08-292-1/+16
| | | | | | | | | | | | | | Our 64-bit installer provides 32-bit libraries as well as 64-bit libraries, but not all 32-bit applications (e.g., PuTTY, Pidgin) are able to locate them in C:\Program Files\MIT\Kerberos . Including an InstallDir key under the Wow6432Node tree lets them work out-of-the-box; while here set all the registry keys in this component in the compatibility tree, for consistency. ticket: 7337 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Add version info for ccapi dllKevin Wasserman2012-08-292-2/+18
| | | | | | | | | | | | | | | | Without version info, this library would not get installed during an upgrade scenario, causing the MIT Kerberos application to crash on startup. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> [kaduk@mit.edu: add motivation to commit message] ticket: 7336 (new) subject: Fix KfW crash on startup after upgrade queue: kfw target_version: 1.10.4 tags: pullup
* Upgrade 64-bit KfW installationsBen Kaduk2012-08-291-2/+7
| | | | | | | | | | | We use separate UpgradeCodes for 32- and 64-bit installers, so we must check for both of them when seeing if we are upgrading an old/existing installation. ticket: 7335 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Upgrade from KfW betas, tooBen Kaduk2012-08-291-1/+1
| | | | | | | | | | | | | | | | | | | | Instead of using 3.9.9 as a conditional for the maximum version to upgrade from, just use the current version. This seems to pick up beta tags properly (so we can upgrade from, e.g., beta 6 to beta 7 using the installer's upgrade tools), and is future-proof. Note that a 64-bit installer will not pick up an existing 32-bit install (or vice versa), but there does not seem to be infrastructure to deal with this situation easily. Also, "downgrading" by running an older installer with a newer version already installed will cause both versions to be simultaneously installed; only do this if you know what you're doing. ticket: 7334 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Fix kfw message box titlesKevin Wasserman2012-08-292-2/+2
| | | | | | | | | | | "MIT Kerberos", not "Leash32" Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7333 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Fix window close issuesKevin Wasserman2012-08-291-5/+1
| | | | | | | | | | | | Stop filtering out SC_CLOSE. 'X' button works more reliably, also alt-F4. Remove minimize box from style. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7332 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Refresh ticket display immediately after renewKevin Wasserman2012-08-291-0/+2
| | | | | | | | | | | | Set the CLeashApp::m_bUpdateDisplay flag to cause the display to update on the next WM_IDLE message to the main thread. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7331 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Update KfW installer graphicsKevin Wasserman2012-08-292-0/+0
| | | | | | | | | | | Replace dogheads with the new 'K'. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7330 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Avoid a crash when attempting to change passwordBenjamin Kaduk2012-08-291-1/+1
| | | | | | | | | | | | | In some cases we could keep stack garbage in a local pointer variable until the cleanup at the end of the function wherein krb5_free_context() would choke on the invalid non-NULL value. Initialize to zero to avoid the issue (should be written as NULL but stick to the prevailing style). ticket: 7329 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Rename old krb5.ini files awayBenjamin Kaduk2012-08-292-1/+15
| | | | | | | | | | | | | | | | | We want to always use a new krb5.ini (and our search order guarantees that we will), but users might be confused if there is still a file named krb5.ini in the old location which is now non-functional. However, it is rude to unconditionally delete the old file which may potentially be the only copy a user has of their local changes. Instead, rename the old file to a non-functioning name that indicates it is no longer being used, so that it may be consulted if needed. Only attempt the rename if we found an existing krb5.ini, and ignore errors since this is not a critical part of the installation. ticket: 7328 (new) queue: kfw target_version: 1.10.4 tags: pullup
* Add domain_realm mappings to the athena krb5.iniKevin Wasserman2012-08-291-0/+8
| | | | | | | | | | | | | | These seem to be the only bits from the krb5.ini shipped with older versions of KfW that remain useful. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> [kaduk@mit.edu: add motivation to commit message] ticket: 7327 (new) queue: kfw target_version: 1.10.4 tags: pullup
generated by cgit (git 2.34.1) at 2025-09-28 21:34:13 +0000