rearrange the code a bit to make it more clear that the logic is
correct.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10830 dc483132-0cff-0310-8789-dd5450dbe970

don't free the returned ctype array

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10829 dc483132-0cff-0310-8789-dd5450dbe970

rearrange a structure to match the comments

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10828 dc483132-0cff-0310-8789-dd5450dbe970

nastybad fencepost error if the input size is [60,63] mod 64

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10827 dc483132-0cff-0310-8789-dd5450dbe970

there is code in the tree (notably, the admin server code) which uses
globals to set the keytab which will be used by gssapi.  this is
gross, and we need a better answer.  However, even that didn't work if
there was an env var or krb5.conf variable, since those override
krb5_defkeyname.  Add a new global, krb5_overridekeyname, which really
does override all the other keytab locators.  While I'm at it, make the buffer overflow checks sane.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10823 dc483132-0cff-0310-8789-dd5450dbe970

fix a typo
don't return conf_state if the pointer is NULL

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10822 dc483132-0cff-0310-8789-dd5450dbe970

don't free the tokens before returning them

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10821 dc483132-0cff-0310-8789-dd5450dbe970

the ints are 32-bit, not 16-bit.  keep enough space

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10820 dc483132-0cff-0310-8789-dd5450dbe970

don't assume a nul-terminated client string.  just print out the
number of chars received.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10815 dc483132-0cff-0310-8789-dd5450dbe970

 - don't add the final NUL to a command-line string
 - read_file() was dealing improperly with incomplete reads.  Since
only normal files are really supported, and incomplete reads are
impossible with normal files, rip the incorrect incomplete read code
out.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10814 dc483132-0cff-0310-8789-dd5450dbe970

 - make the tmsglen size check not a strict inequality, since the old
cksumtypes can return padded data.
 - plug a memory leak
 - reorder some stuff for clarity

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10813 dc483132-0cff-0310-8789-dd5450dbe970

don't stomp the minor status when a call to another gss function
returns an error

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10812 dc483132-0cff-0310-8789-dd5450dbe970

remove the input bounds check
fix the stupid brainos.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10811 dc483132-0cff-0310-8789-dd5450dbe970

make krb5_c_keyed_checksum_types() prototype conform with reality

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10781 dc483132-0cff-0310-8789-dd5450dbe970

misc fixes

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10780 dc483132-0cff-0310-8789-dd5450dbe970

add function to free checksum contents, as filled in by
krb5_c_make_checksum.  (Should this be in libcrypto?)

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10779 dc483132-0cff-0310-8789-dd5450dbe970

don't call the nonexistent hash functions for a keyed hash

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10778 dc483132-0cff-0310-8789-dd5450dbe970

have the function allocate space, and add a free function

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10777 dc483132-0cff-0310-8789-dd5450dbe970

add code to implement a new krb5 v2 gssapi mechanism.
this implementation is complete and functional, but the draft
spec and the code do not yet completely match.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10776 dc483132-0cff-0310-8789-dd5450dbe970

add util_ctxsetup

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10771 dc483132-0cff-0310-8789-dd5450dbe970

Return G_WRONG_TOKID if the passed-in token id is different from the
id in the token.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10770 dc483132-0cff-0310-8789-dd5450dbe970

add new error codes

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10769 dc483132-0cff-0310-8789-dd5450dbe970

 - print the token as ascii if the first chars are printable or whitespace
 - don't leak an fd per accept

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10768 dc483132-0cff-0310-8789-dd5450dbe970

changes to make kadmind4 build again

* kadm_ser_wrap.c (kadm_ser_init): Remove references to
  master_encblock, as it's no longer needed in the new crypto API,
  adjusting kdb calls accordingly.  Also punt calls to use_enctype,
  process_key, etc.

* admin_server.c (clear_secrets): Remove references to
master_encblock, due to new crypto API.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10767 dc483132-0cff-0310-8789-dd5450dbe970

Update major versions of libraries depending on libkrb5.
Also, fix typo in tf_util.c that prevents krb524init from working
and include test for sa_len so localaddr works on NetBSD.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10766 dc483132-0cff-0310-8789-dd5450dbe970

update changes from mainline 980730

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10759 dc483132-0cff-0310-8789-dd5450dbe970

Fix login so that it will properly handle forwarded creds;
it didn't destroy the ccache, so that copying into the new ccache failed.  Also,
it didn't try to convert forwarded creds.
Remove marc's debugging printf in krlogin.c

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10751 dc483132-0cff-0310-8789-dd5450dbe970

remove a debugging printf which got checked in by accident

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10749 dc483132-0cff-0310-8789-dd5450dbe970

typo

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10748 dc483132-0cff-0310-8789-dd5450dbe970

don't skip a ks_tuple unless the enctype and salttype both match
something prior in the list.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10747 dc483132-0cff-0310-8789-dd5450dbe970

fix the new crypto api stuff I missed before

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10746 dc483132-0cff-0310-8789-dd5450dbe970

for keyed hashes, verify that the key enctype is compatible

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10745 dc483132-0cff-0310-8789-dd5450dbe970

add etype field to cksum records for keyed cksums

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10744 dc483132-0cff-0310-8789-dd5450dbe970

add krb5_c_num_keyed_checksum_types, krb5_c_keyed_checksum_types functions
add keyusages for krb5 gssapi v2

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10743 dc483132-0cff-0310-8789-dd5450dbe970

new file

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10742 dc483132-0cff-0310-8789-dd5450dbe970

add keyed_checksum_types.c

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10741 dc483132-0cff-0310-8789-dd5450dbe970

convert to new crypto api

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10740 dc483132-0cff-0310-8789-dd5450dbe970

typo fix

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10739 dc483132-0cff-0310-8789-dd5450dbe970

Add kvno

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10738 dc483132-0cff-0310-8789-dd5450dbe970

add a new app to acquire a ticket for a service and print out the kvno

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10735 dc483132-0cff-0310-8789-dd5450dbe970

add kvno directory

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10734 dc483132-0cff-0310-8789-dd5450dbe970

convert gssapi to new crypto api

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10733 dc483132-0cff-0310-8789-dd5450dbe970

typo

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10732 dc483132-0cff-0310-8789-dd5450dbe970

typo

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10719 dc483132-0cff-0310-8789-dd5450dbe970

incorrect use of static string return.  penalty 10 megabytes

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10718 dc483132-0cff-0310-8789-dd5450dbe970

merge mainline as of roughly 7/20 onto the branch

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10717 dc483132-0cff-0310-8789-dd5450dbe970

in the alloced case, the confounder and hash were incorrectly copied
to the output.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10716 dc483132-0cff-0310-8789-dd5450dbe970

fix the length sanity check.  the data returned could be padded

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10715 dc483132-0cff-0310-8789-dd5450dbe970

initial test stub for krb5_nfold

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10708 dc483132-0cff-0310-8789-dd5450dbe970

remove stuff no longer needed from the old crypto library

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10707 dc483132-0cff-0310-8789-dd5450dbe970

update file list

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10706 dc483132-0cff-0310-8789-dd5450dbe970

raw encryption decryption, checksum, and string-to-key implementation

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10705 dc483132-0cff-0310-8789-dd5450dbe970

old-style des encryption decryption, checksum, and string-to-key implementation

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10704 dc483132-0cff-0310-8789-dd5450dbe970

remove stuff no longer needed from the old crypto library

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10703 dc483132-0cff-0310-8789-dd5450dbe970

update file list

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10702 dc483132-0cff-0310-8789-dd5450dbe970

descbc, krb-specific des-md4 and md5 keyed hash providers

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10701 dc483132-0cff-0310-8789-dd5450dbe970

crc32, md4, md5, sha1 hash providers

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10700 dc483132-0cff-0310-8789-dd5450dbe970

des and des3 encryption providers

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10699 dc483132-0cff-0310-8789-dd5450dbe970

generic derived key encryption, decryption, and checksum implementation

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10698 dc483132-0cff-0310-8789-dd5450dbe970

stop making calls to the krb5 api.  the dir should be standalone

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10697 dc483132-0cff-0310-8789-dd5450dbe970

update afsstring2key not to use eblock; the enctype is now implied by
the key

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10696 dc483132-0cff-0310-8789-dd5450dbe970

remove stuff no longer needed from the old crypto library

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10695 dc483132-0cff-0310-8789-dd5450dbe970

update api not to use eblock; the enctype is now implied by the key

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10694 dc483132-0cff-0310-8789-dd5450dbe970

update file list

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10693 dc483132-0cff-0310-8789-dd5450dbe970

include prototype for mit_crc32

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10692 dc483132-0cff-0310-8789-dd5450dbe970

crc32 hash implementation (from old crypto lib)

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10691 dc483132-0cff-0310-8789-dd5450dbe970

update file list

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10690 dc483132-0cff-0310-8789-dd5450dbe970

update file and directory list

the configure options for enabling and disabling etypes and cksumtypes
are now gone.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10689 dc483132-0cff-0310-8789-dd5450dbe970

update file and directory list

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10688 dc483132-0cff-0310-8789-dd5450dbe970

remove stuff no longer needed from the old crypto library

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10687 dc483132-0cff-0310-8789-dd5450dbe970

glue to implement the old api on top of the new one

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10686 dc483132-0cff-0310-8789-dd5450dbe970

cksumtype table

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10685 dc483132-0cff-0310-8789-dd5450dbe970

enctype table

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10684 dc483132-0cff-0310-8789-dd5450dbe970

hmac keyed hash generator algorithm

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10683 dc483132-0cff-0310-8789-dd5450dbe970

n-fold algorithm for string-to-key and key derivation

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10682 dc483132-0cff-0310-8789-dd5450dbe970

implementations for the new crypto api exported functions

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10681 dc483132-0cff-0310-8789-dd5450dbe970

sha1 hash implementation (from old crypto/sha dir)

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10680 dc483132-0cff-0310-8789-dd5450dbe970

kdc/do_as_req.c, kdc/do_tgs_req.c, kdc/kdc_preauth.c,
lib/kdb/decrypt_key.c, lib/kdb/encrypt_key.c, kdc/kdc_util.c,
kdc/kerberos_v4.c, kdc/main.c, lib/kadm5/srv/server_kdb.c,
lib/krb5/krb/decrypt_tk.c, lib/krb5/krb/decode_kdc.c,
lib/krb5/krb/encode_kdc.c, lib/krb5/krb/encrypt_tk.c,
lib/krb5/krb/gen_seqnum.c, lib/krb5/krb/gen_subkey.c,
lib/krb5/krb/gic_pwd.c, lib/krb5/krb/in_tkt_pwd.c,
lib/krb5/krb/kdc_rep_dc.c, lib/krb5/krb/mk_cred.c,
lib/krb5/krb/mk_priv.c, lib/krb5/krb/mk_rep.c,
lib/krb5/krb/mk_req_ext.c, lib/krb5/krb/mk_safe.c,
lib/krb5/krb/preauth.c, lib/krb5/krb/preauth2.c,
lib/krb5/krb/rd_cred.c, lib/krb5/krb/rd_priv.c, lib/krb5/krb/rd_rep.c,
lib/krb5/krb/rd_safe.c, lib/krb5/krb/send_tgs.c,
lib/krb5/krb/auth_con.c, lib/krb5/krb/auth_con.h,
lib/krb5/krb/rd_req_dec.c, lib/krb5/krb/ser_actx.c:
convert to the new api.  This also includes specifying the
keyusage where needed.

this file is really ugly, because the SAM code wants to use
raw crypto.  this all needs to be tested.  There were also
existing memory leaks, some of which I probably missed.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10679 dc483132-0cff-0310-8789-dd5450dbe970

add c_ustime.c.  this was in the crypto library, but it didn't
belong there.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10678 dc483132-0cff-0310-8789-dd5450dbe970

add a list of permitted enctypes to the auth_context for
rd_req to check, and create accessor functions for this list.

kdc/do_as_req.c, kdc/do_tgs_req.c, kdc/kdc_preauth.c,
lib/kdb/decrypt_key.c, lib/kdb/encrypt_key.c, kdc/kdc_util.c,
kdc/kerberos_v4.c, kdc/main.c, lib/kadm5/srv/server_kdb.c,
lib/krb5/krb/decrypt_tk.c, lib/krb5/krb/decode_kdc.c,
lib/krb5/krb/encode_kdc.c, lib/krb5/krb/encrypt_tk.c,
lib/krb5/krb/gen_seqnum.c, lib/krb5/krb/gen_subkey.c,
lib/krb5/krb/gic_pwd.c, lib/krb5/krb/in_tkt_pwd.c,
lib/krb5/krb/kdc_rep_dc.c, lib/krb5/krb/mk_cred.c,
lib/krb5/krb/mk_priv.c, lib/krb5/krb/mk_rep.c,
lib/krb5/krb/mk_req_ext.c, lib/krb5/krb/mk_safe.c,
lib/krb5/krb/preauth.c, lib/krb5/krb/preauth2.c,
lib/krb5/krb/rd_cred.c, lib/krb5/krb/rd_priv.c, lib/krb5/krb/rd_rep.c,
lib/krb5/krb/rd_safe.c, lib/krb5/krb/send_tgs.c,
lib/krb5/krb/auth_con.c, lib/krb5/krb/auth_con.h,
lib/krb5/krb/rd_req_dec.c, lib/krb5/krb/ser_actx.c:
convert to the new api.  This also includes specifying the
keyusage where needed.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10677 dc483132-0cff-0310-8789-dd5450dbe970

add enc_helper.c.  This provides a wrapper around the
conventional way the library encrypts and wraps encoded asn.1
structures, so the code isn't repeated in a dozen places.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10676 dc483132-0cff-0310-8789-dd5450dbe970

make the v4 compat random key code use the krb5 crypto
interface, instead of the des implementation internals.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10675 dc483132-0cff-0310-8789-dd5450dbe970

kdc/do_as_req.c, kdc/do_tgs_req.c, kdc/kdc_preauth.c,
lib/kdb/decrypt_key.c, lib/kdb/encrypt_key.c, kdc/kdc_util.c,
kdc/kerberos_v4.c, kdc/main.c, lib/kadm5/srv/server_kdb.c,
lib/krb5/krb/decrypt_tk.c, lib/krb5/krb/decode_kdc.c,
lib/krb5/krb/encode_kdc.c, lib/krb5/krb/encrypt_tk.c,
lib/krb5/krb/gen_seqnum.c, lib/krb5/krb/gen_subkey.c,
lib/krb5/krb/gic_pwd.c, lib/krb5/krb/in_tkt_pwd.c,
lib/krb5/krb/kdc_rep_dc.c, lib/krb5/krb/mk_cred.c,
lib/krb5/krb/mk_priv.c, lib/krb5/krb/mk_rep.c,
lib/krb5/krb/mk_req_ext.c, lib/krb5/krb/mk_safe.c,
lib/krb5/krb/preauth.c, lib/krb5/krb/preauth2.c,
lib/krb5/krb/rd_cred.c, lib/krb5/krb/rd_priv.c, lib/krb5/krb/rd_rep.c,
lib/krb5/krb/rd_safe.c, lib/krb5/krb/send_tgs.c,
lib/krb5/krb/auth_con.c, lib/krb5/krb/auth_con.h,
lib/krb5/krb/rd_req_dec.c, lib/krb5/krb/ser_actx.c:
convert to the new api.  This also includes specifying the
keyusage where needed.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10674 dc483132-0cff-0310-8789-dd5450dbe970

kdc/do_as_req.c, kdc/do_tgs_req.c, kdc/kdc_preauth.c,
lib/kdb/decrypt_key.c, lib/kdb/encrypt_key.c, kdc/kdc_util.c,
kdc/kerberos_v4.c, kdc/main.c, lib/kadm5/srv/server_kdb.c,
lib/krb5/krb/decrypt_tk.c, lib/krb5/krb/decode_kdc.c,
lib/krb5/krb/encode_kdc.c, lib/krb5/krb/encrypt_tk.c,
lib/krb5/krb/gen_seqnum.c, lib/krb5/krb/gen_subkey.c,
lib/krb5/krb/gic_pwd.c, lib/krb5/krb/in_tkt_pwd.c,
lib/krb5/krb/kdc_rep_dc.c, lib/krb5/krb/mk_cred.c,
lib/krb5/krb/mk_priv.c, lib/krb5/krb/mk_rep.c,
lib/krb5/krb/mk_req_ext.c, lib/krb5/krb/mk_safe.c,
lib/krb5/krb/preauth.c, lib/krb5/krb/preauth2.c,
lib/krb5/krb/rd_cred.c, lib/krb5/krb/rd_priv.c, lib/krb5/krb/rd_rep.c,
lib/krb5/krb/rd_safe.c, lib/krb5/krb/send_tgs.c,
lib/krb5/krb/auth_con.c, lib/krb5/krb/auth_con.h,
lib/krb5/krb/rd_req_dec.c, lib/krb5/krb/ser_actx.c:
convert to the new api.  This also includes specifying the
keyusage where needed.

include/k5-int.h, kdc/do_tgs_req.c:
add using_subkey variable to krb5_encode_kdc_rep, for choosing
the keyusage

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10673 dc483132-0cff-0310-8789-dd5450dbe970

include/krb5/kdb.h, kdc/extern.h, lib/kdb/decrypt_key.c,
lib/kdb/encrypt_key.c, lib/kdb/fetch_mkey.c,
lib/kdb/kdb_db2.c, lib/kdb/kdb_db2.h, include/krb5/kdb_dbc.h,
lib/kdb/kdb_dbm.c, lib/kdb/keytab.c, lib/kdb/verify_mky.c,
lib/kadm5/srv/svr_principal.c, lib/kdb/kdb_cpw.c:
change or remove all the places krb5_encrypt_block was used
(this is mostly relevant to kdb manipulations).  It was
usually used to specify an enctype (which is now implied by
the keyblock), or to store or pass in a processed key (now the
api just takes a key directly, so these structures and
functions do, too).  The kdb key manuipulation functions also
need to be made to use the new api.

lib/kadm5/srv/svr_principal.c, lib/kdb/kdb_cpw.c, lib/kdb/kdb_xdr.c:
remove the special knowledge of ENCTYPE string-to-key
equivalances.  the crypto api has a function for this now.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10672 dc483132-0cff-0310-8789-dd5450dbe970

include/krb5/kdb.h, kdc/extern.h, lib/kdb/decrypt_key.c,
lib/kdb/encrypt_key.c, lib/kdb/fetch_mkey.c,
lib/kdb/kdb_db2.c, lib/kdb/kdb_db2.h, include/krb5/kdb_dbc.h,
lib/kdb/kdb_dbm.c, lib/kdb/keytab.c, lib/kdb/verify_mky.c,
lib/kadm5/srv/svr_principal.c, lib/kdb/kdb_cpw.c:
change or remove all the places krb5_encrypt_block was used
(this is mostly relevant to kdb manipulations).  It was
usually used to specify an enctype (which is now implied by
the keyblock), or to store or pass in a processed key (now the
api just takes a key directly, so these structures and
functions do, too).  The kdb key manuipulation functions also
need to be made to use the new api.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10671 dc483132-0cff-0310-8789-dd5450dbe970

make etype_string use krb5_enctype_to_string

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10670 dc483132-0cff-0310-8789-dd5450dbe970

make the acl file contain etypes, and use that in the
authorization process.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10669 dc483132-0cff-0310-8789-dd5450dbe970

this was in libcrypto, but it didn't belong there.  move it here

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10668 dc483132-0cff-0310-8789-dd5450dbe970

remove enctype and cksumtype string converstions.  They're in the
crypto library now, since the information drops right into the
enctype table.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10667 dc483132-0cff-0310-8789-dd5450dbe970

ifdef the whole file out, since it's not used anywhere.  it
should probably be deleted, but I'm not sure about
backward-compatibility issues yet.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10666 dc483132-0cff-0310-8789-dd5450dbe970

kdc/do_as_req.c, kdc/do_tgs_req.c, kdc/kdc_preauth.c,
lib/kdb/decrypt_key.c, lib/kdb/encrypt_key.c, kdc/kdc_util.c,
kdc/kerberos_v4.c, kdc/main.c, lib/kadm5/srv/server_kdb.c,
lib/krb5/krb/decrypt_tk.c, lib/krb5/krb/decode_kdc.c,
lib/krb5/krb/encode_kdc.c, lib/krb5/krb/encrypt_tk.c,
lib/krb5/krb/gen_seqnum.c, lib/krb5/krb/gen_subkey.c,
lib/krb5/krb/gic_pwd.c, lib/krb5/krb/in_tkt_pwd.c,
lib/krb5/krb/kdc_rep_dc.c, lib/krb5/krb/mk_cred.c,
lib/krb5/krb/mk_priv.c, lib/krb5/krb/mk_rep.c,
lib/krb5/krb/mk_req_ext.c, lib/krb5/krb/mk_safe.c,
lib/krb5/krb/preauth.c, lib/krb5/krb/preauth2.c,
lib/krb5/krb/rd_cred.c, lib/krb5/krb/rd_priv.c, lib/krb5/krb/rd_rep.c,
lib/krb5/krb/rd_safe.c, lib/krb5/krb/send_tgs.c,
lib/krb5/krb/auth_con.c, lib/krb5/krb/auth_con.h,
lib/krb5/krb/rd_req_dec.c, lib/krb5/krb/ser_actx.c:
convert to the new api.  This also includes specifying the
keyusage where needed.

don't encode the encblock, because it's not there anymore.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10665 dc483132-0cff-0310-8789-dd5450dbe970

kdc/do_as_req.c, kdc/do_tgs_req.c, kdc/kdc_preauth.c,
lib/kdb/decrypt_key.c, lib/kdb/encrypt_key.c, kdc/kdc_util.c,
kdc/kerberos_v4.c, kdc/main.c, lib/kadm5/srv/server_kdb.c,
lib/krb5/krb/decrypt_tk.c, lib/krb5/krb/decode_kdc.c,
lib/krb5/krb/encode_kdc.c, lib/krb5/krb/encrypt_tk.c,
lib/krb5/krb/gen_seqnum.c, lib/krb5/krb/gen_subkey.c,
lib/krb5/krb/gic_pwd.c, lib/krb5/krb/in_tkt_pwd.c,
lib/krb5/krb/kdc_rep_dc.c, lib/krb5/krb/mk_cred.c,
lib/krb5/krb/mk_priv.c, lib/krb5/krb/mk_rep.c,
lib/krb5/krb/mk_req_ext.c, lib/krb5/krb/mk_safe.c,
lib/krb5/krb/preauth.c, lib/krb5/krb/preauth2.c,
lib/krb5/krb/rd_cred.c, lib/krb5/krb/rd_priv.c, lib/krb5/krb/rd_rep.c,
lib/krb5/krb/rd_safe.c, lib/krb5/krb/send_tgs.c,
lib/krb5/krb/auth_con.c, lib/krb5/krb/auth_con.h,
lib/krb5/krb/rd_req_dec.c, lib/krb5/krb/ser_actx.c:
convert to the new api.  This also includes specifying the
keyusage where needed.

check the auth_context permit-all flag and permitted_enctypes
list, and reject the request if the policy check fails.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10664 dc483132-0cff-0310-8789-dd5450dbe970

add code to initialize the prng.  It's not great, but can be
improved, and the prng is reseeded when new keys are
processed.

read permitted_enctypes from the krb5.conf file, and provide
accessor functions for it.  Make the various etype list
parsers share code as a side effect.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10663 dc483132-0cff-0310-8789-dd5450dbe970

add krb5_get_{validat,renew}ed_creds functions, which are part
of the new init_creds api.  The prototypes were already in,
krb5.hin but there was no implementing code.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10662 dc483132-0cff-0310-8789-dd5450dbe970

Add a new error code for "Encryption type not permitted"

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10661 dc483132-0cff-0310-8789-dd5450dbe970

interoperation testing against heimdal revealed a bug.  if
extra fields are present in a SEQUENCE, they are not ignored
and skipped.  This caused the decoder to get out of sync.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10660 dc483132-0cff-0310-8789-dd5450dbe970

kdc/do_as_req.c, kdc/do_tgs_req.c, kdc/kdc_preauth.c,
lib/kdb/decrypt_key.c, lib/kdb/encrypt_key.c, kdc/kdc_util.c,
kdc/kerberos_v4.c, kdc/main.c, lib/kadm5/srv/server_kdb.c,
lib/krb5/krb/decrypt_tk.c, lib/krb5/krb/decode_kdc.c,
lib/krb5/krb/encode_kdc.c, lib/krb5/krb/encrypt_tk.c,
lib/krb5/krb/gen_seqnum.c, lib/krb5/krb/gen_subkey.c,
lib/krb5/krb/gic_pwd.c, lib/krb5/krb/in_tkt_pwd.c,
lib/krb5/krb/kdc_rep_dc.c, lib/krb5/krb/mk_cred.c,
lib/krb5/krb/mk_priv.c, lib/krb5/krb/mk_rep.c,
lib/krb5/krb/mk_req_ext.c, lib/krb5/krb/mk_safe.c,
lib/krb5/krb/preauth.c, lib/krb5/krb/preauth2.c,
lib/krb5/krb/rd_cred.c, lib/krb5/krb/rd_priv.c, lib/krb5/krb/rd_rep.c,
lib/krb5/krb/rd_safe.c, lib/krb5/krb/send_tgs.c,
lib/krb5/krb/auth_con.c, lib/krb5/krb/auth_con.h,
lib/krb5/krb/rd_req_dec.c, lib/krb5/krb/ser_actx.c:
convert to the new api.  This also includes specifying the
keyusage where needed.

this file is really ugly, because the SAM code wants to use
raw crypto.  this all needs to be tested.  There were also
existing memory leaks, some of which I probably missed.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10659 dc483132-0cff-0310-8789-dd5450dbe970

lib/kadm5/srv/svr_principal.c, lib/kdb/kdb_cpw.c, lib/kdb/kdb_xdr.c:
remove the special knowledge of ENCTYPE string-to-key
equivalances.  the crypto api has a function for this now.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10658 dc483132-0cff-0310-8789-dd5450dbe970

add krb5_keyusage typedef

change krb5_encrypt_block so that backward source compatibility
will work without depending on a type which no longer exists

add new ENCTYPEs

add prototypes for new crypto api

add KEYUSAGE values

add new AUTH_CONTEXT flag to turn off permitted_enctypes checking

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/marc-3des@10657 dc483132-0cff-0310-8789-dd5450dbe970