Ben Kaduk [Thu, 27 Sep 2012 16:46:26 +0000 (12:46 -0400)]
Make kinit smarter about using keytabs
Previously, we would happily accept -i or -t name and do nothing
with it, if -k was not given. If the user is passing -i or -t, they
clearly want to use a keytab, so do so (but print a warning).
While here, enforce that only one of -t and -i is given.
Greg Hudson [Sun, 11 Nov 2012 03:08:39 +0000 (22:08 -0500)]
Add automated tests for LDAP KDB module
Add new tests kdbtest.c and t_kdb.py. Together these exercise most of
the code in the LDAP back end. kdbtest is also run against the DB2
module, which is mostly redundant with other tests, but does exercise
the lockout logic a little more thoroughly than t_lockout.py can.
To test the LDAP back end, we look for slapd and ldapadd binaries in
the path. The system slapd is sometimes constrained by AppArmor or
the like, which we can typically work around by making a copy of the
binary. slapd detaches before listening on its server socket (this
got better in 2.4.27 but still isn't perfect), so we unfortunately
have to use a one-second sleep in the slapd setup.
Ben Kaduk [Wed, 14 Nov 2012 22:09:23 +0000 (17:09 -0500)]
Rebuild krb5.conf.man for default enctypes
Now that the Camellia enctypes are in the default lists for
permitted_enctypes, default_tkt_enctypes, and default_tgs_enctypes,
regenerate the man page to reflect that change.
Greg Hudson [Wed, 14 Nov 2012 21:49:33 +0000 (16:49 -0500)]
Add Camellia enctypes to default enctype lists
Add camellia256-cts-cmas and camellia128-cts-cmac to the default
permitted_enctypes, default_tkt_enctypes, and default_tgs_enctypes
lists, to simplify deployment of Camellia. The new enctypes still
aren't on supported_enctypes, so won't be in the set of long-term keys
for principals without administrator intervention.
Ben Kaduk [Wed, 17 Oct 2012 00:11:14 +0000 (20:11 -0400)]
Make glue for building PDFs
sphinx-build's latex output engine creates a subdirectory with
various latex files, and a Makefile. The generated Makefile assumes
gmake, which we do not. The logic needed in this makefile is rather
simple, so we just include it in src/doc/Makefile.in, even if we
do need a rather complicated shell expression to work in the subdirectory.
Greg Hudson [Tue, 13 Nov 2012 03:08:05 +0000 (22:08 -0500)]
Make kdb5_util dump work with LDAP again
The LDAP module doesn't support locking. There's code to ignore this
in load but not in dump. dump used to only lock for iprop dumps, but
now locks all the time after e65a16d898f3a686525e83661f4fd86c76e27bbf
(#7384), causing it to fail with LDAP.
Tom Yu [Thu, 1 Nov 2012 21:47:06 +0000 (17:47 -0400)]
Update Camellia feature description
Remove the potentially misleading "experimental" annotation on the
description of the Camellia encryption feature. Also update the I-D
version to match the IESG-approved version.
Greg Hudson [Thu, 25 Oct 2012 16:51:17 +0000 (12:51 -0400)]
Always rebuild rst_composite in src/doc
Avoid using "rst_composite" as the target name for building the
rst_composite directory, since we can't give it proper dependencies.
Instead use the target name "composite", which (like "html", "clean",
etc.) doesn't correspond to the name of a file or directory created by
the build rules.
Greg Hudson [Wed, 24 Oct 2012 16:06:01 +0000 (12:06 -0400)]
Don't save empty cc_config_out in ccache
Add an internal json function to make it easier to detect if an object
is empty, and use it to avoid creating a ccache config entry for
preauth module config data if there isn't any to save.
Greg Hudson [Tue, 23 Oct 2012 17:16:44 +0000 (13:16 -0400)]
Alter responder function signature for consistency
For the responder callback signature, put the closure argument just
after the context, and use KRB5_CALLCONV. These changes make the
signature consistent with most other libkrb5 callbacks.
Greg Hudson [Sun, 21 Oct 2012 23:46:16 +0000 (19:46 -0400)]
Add dependencies for some test programs
Some recently added test programs under lib/krb5 didn't have their
source files added to the appropriate Makefile.in variables, and
weren't getting dependencies as a result.
Greg Hudson [Fri, 19 Oct 2012 16:39:04 +0000 (12:39 -0400)]
Improve C style checking
* Avoid space-before-paren false positives on some function pointer
declarations by checking the identifier for simple type names.
* Check for space before close parenthesis.
* Check (carefully) for asymmetric spaces around binary operators.
* Handle nesting when checking for 2+ line flow control bodies.
* Check for asymmetric bracing around else statements.
* Save the vendor name of the token we used to create the challenge.
* If we saved the name of a token vendor previously, prune out any
tokeninfos which contain different vendor names.
Greg Hudson [Thu, 18 Oct 2012 17:11:28 +0000 (13:11 -0400)]
Fix sam2 client preauth after salt changes
Commit bc096a77ffdab283d77c2e0fc1fdd15b9f77eb41 altered the internal
contracts relating to salts, but neglected to adjust the sam2 preauth
code to match. Do that now.
* Keep track of the names of client identities when we load them.
* Store the client identity we just used when we create or retry a
client request.
* If we read a client identity from the configuration, treat it like the
KDC does: pick the "this is it, there is no other" logic branch.
* Read a "pa_config_data" item from an in_ccache, if provided, and add a
callback which client preauth plugins can use to retrieve a string
value from it that's keyed by a string.
* Add a callback which client preauth plugins can use to provide string
key/value pairs to be stored in the ccache.
* Moves the definition of (struct krb5_clpreauth_rock_st) from k5-int.h
to init_creds_ctx.h to try to reduce the number of files that will
need to include k5-json.h to understand k5_json_value.
Ben Kaduk [Wed, 17 Oct 2012 15:37:01 +0000 (11:37 -0400)]
Remove install-oldman
The old man pages are gone, so we can't install them anymore.
Also clean up install and install-unix targets that were installing
the old man pages by hand.
Nalin Dahyabhai [Mon, 1 Oct 2012 22:51:06 +0000 (18:51 -0400)]
Test in_ccache and pa_types functionality
* Add a krb5int_build_conf_principals() function to allow our get/set
code to directly prune out duplicate config entries.
* Verify that when we specify a pa_type, it affects whether or not we
will use a particular preauth plugin.
* Verify that we correctly save the KDC's preauth type number, that we
tried to answer, to the out_ccache.
* When producing preauth data, keep track of the type of padata in the
KDC's list of acceptable types which prompted the module to produce
padata.
* After obtaining credentials, store that value as a "pa_type"
configuration item in the out_ccache.
* Read that allowed preauth type from an in_ccache, if possible.
* If we have an allowed preauth type, only call "real" modules that
handle that value when filling in responder items and producing a
client request.
Add a krb5_get_init_creds_opt_set_in_ccache() function. An input
ccache may hold configuration data which the client libraries can
use to influence their decisions.
Greg Hudson [Tue, 16 Oct 2012 20:23:49 +0000 (16:23 -0400)]
Avoid bit shifting in krb5.h constants
Our traditional practice is to use hex integer literals for flag bits.
Bit shifting can be dangerous because shifting into the sign bit is
undefined. Convert existing bit shift expressions to hex literals.
Tom Yu [Sat, 22 Sep 2012 00:49:29 +0000 (20:49 -0400)]
Clean up domain->realm referrals
Clean up domain->realm referrals by breaking prep_reprocess_tgs_req()
into smaller functions. Give the resulting functions more descriptive
names. Also delete an unnecessary and almost exact copy of
krb5_get_host_realm().
Tom Yu [Fri, 21 Sep 2012 19:32:20 +0000 (15:32 -0400)]
Refactor process_tgs_req() service princ search
The service principal database entry search logic in process_tgs_req()
was excessively complex, containing questionable uses of "goto", along
with deeply nested control flow. Refactor it into smaller functions.
Tom Yu [Fri, 14 Sep 2012 00:19:59 +0000 (20:19 -0400)]
Refactor validate_tgs_request()
Break validate_tgs_request() into smaller functions. Collect related
checks into helper functions. As a result, some invalid requests with
multiple problems can produce different error messages. This is
probably not a problem for most situations.
Tom Yu [Wed, 12 Sep 2012 21:19:24 +0000 (17:19 -0400)]
Move add_to_transited to a separate file
add_to_transited() is fairly large, and also fairly independent of the
other contents of kdc_util.c. Move it into kdc_transit.c. Also
simplifies the building of rtest by removing dependencies that
kdc_util.c previously needed to satisfy undefined symbols.
Tom Yu [Sat, 8 Sep 2012 00:18:41 +0000 (20:18 -0400)]
Eliminate some KDC globals
Make kdc_active_realm a local variable in every function that needs
it. Pass it around in various state structures as needed. Keep the
macros that reference its members remain for now.
Tom Yu [Wed, 18 Jul 2012 18:54:29 +0000 (14:54 -0400)]
Don't use kdc_active_realm in kdc/rtest.c
Too many parts of the KDC rely on the global variable
kdc_active_realm. rtest.c doesn't actually need any of the
KDC-specific information that's avaiable through kdc_active_realm, so
delete references to it.
Tom Yu [Thu, 20 Sep 2012 19:35:56 +0000 (15:35 -0400)]
Enforce TGS principals having 2 components
RFC 4120 section 7.3 says that TGS principal names have two
components. Make krb5_is_tgs_principal() and is_cross_tgs_principal()
enforce this constraint. Code elsewhere in the KDC already checks for
two components anyway.
Ben Kaduk [Mon, 15 Oct 2012 17:50:58 +0000 (13:50 -0400)]
Remove stale implement document
As with the texinfo implementor's guide, it is sufficiently stale
so as to be untrustworthy without verification.
Content of this nature should live on k5wiki.kerberos.org.
Ben Kaduk [Mon, 15 Oct 2012 17:38:05 +0000 (13:38 -0400)]
Remove the last vestiges of the texinfo docs
We needed these last stragglers to build the NOTICE file at the
root of the tree, but we now generate a notice.txt from reST.
Man pages have been generated from reST for some time now, we no
longer need scripts to turn them into HTML and ps, as those can
be generated directly from the reST source.
The Makefile only existed to serve the texinfo builds, so it goes
away, too. (The tgz target appears to have been broken since 1996.)
Ben Kaduk [Mon, 15 Oct 2012 21:47:33 +0000 (17:47 -0400)]
Make rules for building NOTICE from RST
Sphinx-build wants to scan over all the sources in the source dir,
and its text output engine does not handle the spanning row cells
used in some of our fancy tables, so it will crash if we attempt
to generate text output from our full suite of documents.
We could work around this by attempting to just compile the one
source file as an additional argument to sphinx-build, but this
seems to insist on producing an index.txt as well as a notice.txt.
Furthermore, we cannot use the same conf.py as in rst_composite because
the paths substitutions are not available with just the minimal
contents of rst_notice. Make a copy and remove the irrelevant parts,
for now, changing only the master_doc field as appropriate.
For the HTML build, we use the standard |copy| macro from isonum.txt
to get the unicode copyright symbol glyph, but for ASCII output we
prefer to just use the literal "(C)".
Ben Kaduk [Fri, 12 Oct 2012 21:12:55 +0000 (17:12 -0400)]
Add notice.rst
To replace the texinfo sources previously used to generate NOTICE.
When compiled to HTML, compares well against the original NOTICE;
use notice.rst in mitK5license.rst instead of using a literal
include of the old NOTICE file.
Ben Kaduk [Fri, 12 Oct 2012 16:42:10 +0000 (12:42 -0400)]
Remove texinfo implementors guide
It is sufficiently old and unloved that nothing in it should be
taken as truth without independent verification.
Content of this nature should live on k5wiki.kerberos.org
in the future.
Ben Kaduk [Fri, 12 Oct 2012 15:36:38 +0000 (11:36 -0400)]
Disconnect the texinfo users guide from the build
Its content has been migrated to or superseded by the krb_users
reST documentation.
The texinfo document attempted to have a general introduction to
Kerberos, but it is not quite suitable for the target audience
of the user's guide and will be rewritten.
A few portions of the texinfo document are simply no longer relevant
and do not need to be migrated. In particular:
The krb5-appl utilities are out of scope for this document, as they
have been moved to a separate repository. Coverage of ksu may be
brought back at a later time, though.
The Kerberos Glossary will be expanded and handled separately.
Greg Hudson [Mon, 15 Oct 2012 18:07:09 +0000 (14:07 -0400)]
Bump libkdb5 API and DAL versions
We made two sets of incompatible changes to the DAL and libkdb5 API
during development for 1.11 (master key list simplification and policy
extensions), so increment the appropriate version numbers.
Greg Hudson [Mon, 15 Oct 2012 17:11:18 +0000 (13:11 -0400)]
Wait for correct message in t_iprop.py
The message "Got incremental updates from the master" precedes
actually replaying the updates on the slave. Instead look for
"Incremental updates:" (the statistics message), which happens just
after the updates are replayed.
Also, we don't need to import time now that we're not sleeping.
When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as hex-escaped
versions of themselves if any are found.
projects / thirdparty / krb5.git / log
