Ken Raeburn [Sat, 4 May 1996 00:17:55 +0000 (00:17 +0000)]
* get_creds.c (krb5_get_credentials_core): new function. Common part of
krb5_get_credentials and krb5_get_credentials_validate. Some formerly local
variables are now arguments.
(krb5_get_credentials): same as before, but calls _core to do some of the work.
(krb5_get_credentials_validate): uses krb5_get_cred_from_kdc_validate and only
stores the returned credential in the cache, instead of storing all of them.
* gc_frm_kdc.c (krb5_get_cred_from_kdc_opt): new function. Same body as
krb5_get_cred_from_kdc, but takes one new argument, kdcopts, and combines it
with the other kdc options when calling krb5_get_cred_via_tkt. This is static
and only called by
(krb5_get_cred_from_kdc): a wrapper that provides the same function it did
before, and
(krb5_get_cred_from_kdc_validate): a wrapper that passes KDC_OPT_VALIDATE, so
that kinit can use it.
We'll probably need another one for renewing tickets as well.
* rd_req_dec.c (krb5_rd_req_decoded_opt): new function. Same body as
krb5_rd_req_decoded, but takes one new argument, check_valid_flag, to determine
whether or not to check if the "invalid flag" is set in the ticket. Also made
static, so that it is only called via:
(krb5_rd_req_decoded): wrapper for krb5_rd_req_decoded_opt that specifies the
"invalid flag" gets checked, and
(krb5_rd_req_decoded_anyflag): wrapper for krb5_rd_req_decoded_opt that
specifies that the "invalid flag" doesn't get checked. (This version is only
called from kdc_util.c:kdc_process_tgs_req.)
* str_conv.c (krb5_string_to_timestamp): double check that strptime at least
parsed *some* of the string, avoid degenerate cases from GNU libc strptime.
Theodore Tso [Fri, 3 May 1996 21:03:00 +0000 (21:03 +0000)]
Add code to support appropriate behavior when the input credentials is
NULL (i.e., the default credential). We use the default credential
for the "default mechanism", which is the first mechanism registered
with the library.
Ken Raeburn [Thu, 2 May 1996 01:22:45 +0000 (01:22 +0000)]
cygnus merge:
* configure.in: Fix typo in Apr 16 HP-UX change.
* state.c (envvarok): nuke all KRB5* environment variables, not just the
previously selected ones.
* telnetd.c (telnet -> doit): moved SIGTTOU handler before the first thing
which would cause the terminal driver to get upset.
* sys_term.c (line): Remove initialization silliness. The non-GNUC method was
Just Wrong, do it the other way always.
(Xline): Specify length, not contents.
* termio-tn.c (readstream_termio): new file, provides isolated version of
M_IOCTL handling for systems where termio and termios can't be compiled
together.
* termios-tn.c (readstream_termios): new file, provides isolated version of
M_IOCTL handling for systems where termio and termios can't be compiled
together.
* telnetd.c (readstream): use readstream_termios and readstream_termio to
handle getmsg with M_IOCTL.
Ken Raeburn [Wed, 1 May 1996 03:17:43 +0000 (03:17 +0000)]
Merge with Cygnus sources, changes from Mark Eichin, Marc Horowitz, Chris
Provenzano and me:
* Makefile.in (install): Install correct set of man pages, and check for
failures.
* kshd.M, klogind.M: Renamed from kr*.M versions.
* login.M: New file. Man page for login with some description of new features.
* rlogin.M: Remove references to using program with target hostname as argv[0].
* rsh.M: Ditto. Also document -f, -F, -x options.
* login.c: Massive changes. Split much functionality out of main and into
separate file sections: terminal flag settings, Kerberos 4 and 5 support, UNIX
password support, mail check, signal handler handling, some other support
routines. Revamp controlling tty and process group handling. For AFS
configuration, use setpag and run aklog. Try validating password using krb5.
Always set tty flags, not just for rlogin session. When validating tickets,
treat an existing key file that doesn't contain the key we think we want
(possibly because DNS was spoofed) as an error condition.
* Makefile.in (LOGINLIBS): List libkrb524.a here.
(LIBOBJS): Not here.
(login.krb5): Reverse the order of LIBOBJS and LOGINLIBS.
* configure.in: Check for --with-afs. Add AFS libs and define SETPAG if
supplied.
* login.c (KRB5_GET_TICKETS, KRB4_GET_TICKETS, KRB_RUN_AKLOG): new macros
selecting single signon options. krb5.conf profile support for control over
authentication options, above the compile time selection.
(conf_affirmative): new function, recognize yes/no in profile value.
(login_get_kconf): new function, look for all [login] flags and set them in
appropriate globals (via login_conf_set array.)
(main, sleepexit, destroy_tickets): Check the new login_* flags.
(main): rename KRB4_USE_524 to KRB4_CONVERT.
* configure.in: Added checks for tcsetpgrp, tcgetpgrp, setpgid.
* krlogind.c (control): Use tcgetpgrp if it's available.
* loginpaths.h (RPATH, LPATH, LPATH_root): Define HP/UX 9.04 versions,
conditionalized on __hpux and !hpux.
* login.c and configure.in: instead of checking _IBMR2 and __sgi__, write
configure tests to check for the existence of /etc/environment and
/etc/TIMEZONE files, respectively.
* forward.c (rd_and_store_for_creds) : If chown fails then only pass failure
back if owner is different than intended owner. This is to make rsh.exp test
work without requiring root privlidges.
* login.c (main): Don't set TERM to an empty value.
(stypeof) [__hpux]: Return null if unknown.
* krlogin.c (catchild): remove hp/ux kludge because of aclocal.m4 fix.
(speeds): test __hpux for hpux speed list.
(main): test __hpux for use of FIOSSAIOSTAT and FIOSSAIOOWN
(USE_TERMIO): test __hpux for bsdtty/ptyio headers.
* krlogind.c: test __hpux for bsdtty/ptyio headers.
(doit): test __hpux for use of setpgrp2.
* krcp.c (main): test __hpux as well for remsh vs. rsh.
* krcp.c (des_write): Make sure the buffer for the encrypted data is large
enough. Only return an error in malloc fails.
* krsh.c (main): Always turn on anyport -A option.
* krlogind.c (ptsname): Declare if it's going to be used.
* krshd.c (main): Use basename of argv[0] for progname.
* login.c (dofork): On linux, TIOCNOTTY causes us to die on a SIGHUP, so don't
even try it.
Ken Raeburn [Tue, 30 Apr 1996 23:17:33 +0000 (23:17 +0000)]
* Makefile.in (libkrb5.$(STEXT)): Set a variable with or without "--force" and
use it, instead of duplicating the rest of the code. Use LIBDONE as list to
process, so berk_db will be skipped when not in use. Check exit status of
LIBUPDATE invocation. Remove library before creating as workaround for
libupdate bug.
Ken Raeburn [Tue, 30 Apr 1996 22:25:26 +0000 (22:25 +0000)]
* t_ser.c (stuff): New variable.
(ser_acontext_test, ser_eblock_test, ser_cksum_test): Use it, instead of
assuming it's valid to treat &FUNCTION as a data pointer.
* conv_princ.c (sconv_list): Now const.
(krb5_*_conv_principal): Use pointer to const for it.
Tue Apr 23 19:39:59 1996 Mark Eichin <eichin@cygnus.com>
* get_creds.c (krb5_get_credentials): this isn't the kernel, so don't return
negative errno values.
Fix Windows definition of PROVIDE_DES_CBC_RAW so that the raw DES
cryptosystem is properly included. Removed Macintosh definitions of
PROVIDE_* since that is done in mac/libaries/KerberosHeaders.h.
Richard Basch [Mon, 22 Apr 1996 00:35:52 +0000 (00:35 +0000)]
One could not specify -c in inetd.conf, because of the
variable initialization; initialization has been corrected to
allow either checksumming or ignoring the checksum.
Richard Basch [Sun, 21 Apr 1996 16:55:40 +0000 (16:55 +0000)]
* krshd.c: If checksumming is required & ALWAYS_V5_KUSEROK is
defined, incorrect messages were being displayed for V4 clients.
Additionally, various errors were not being displayed with the
trailing newline.
Sam Hartman [Sun, 21 Apr 1996 07:06:50 +0000 (07:06 +0000)]
* Remove documentation of how krlogind gets its command line options
from its name, because it doesn't any more. Same for kshd.
* Document and implement -i option to ignore checksums. Restore
default mode to accept and process checksums if provided.
* Bring back the warning about only using -c with Kerberos5. The
documentation (both install.texi and the man pages) clearly state that
the -c option shouldnot be used in conjunction with Kerberos4, so warn
users if they try.
Fix the expect string so that it doesn't assume that the client is
using its fully qualified domain name as its local hostname. We now
check to make sure that FTP banner contains $localhostname, plus
optional characters (which can be the domainname depending on the
system.)
configure.in (LOGINLIBS): Remove DECLARE_SYS_ERRLIST since it's no
longer necessary.
krcp.c (verifydir, allocbuf, rsource, source, sink): Don't use
sys_errlist[]; just call error_message() instead, since we depend on
com_err anyway.
krshd.c (recvauth):
krlogind.c (recvauth): Don't actually check the checksum unless it is
required. Old (pre-beta 5) clients sent a checksum of random garbage
(such as their pid) which is impossible to actually check on the
server side. (Grad student stupidity strikes again.)
(fatalperror): Don't use sys_errlist[] to get the right error
message; just depend on com_err instead, since we're using it anyway.
krshd.c (doit):
krlogind.c (do_krb_login): Fix logic so that if checksums are
required, and the checksum is valid, don't syslog the stupid warning
message about "Checksums are only required for v5 clients...."
Ken Raeburn [Wed, 17 Apr 1996 02:11:22 +0000 (02:11 +0000)]
* dump-utmp.c: New file. Not automatically used by anything, but may be useful
for examining utmp/wtmp files when comparing behavior against system software.
* update_utmp.c (pty_update_utmp): Always use id "cons" for console. For
HP-UX, omit "kl" prefix. Reindent for readability.
* update_wtmp.c (ptyint_update_wtmp): For HP-UX, copy ut_id and ut_type from
input utmp structure. Reindent for readability.
Wed Mar 27 21:14:33 1996 Marc Horowitz <marc@mit.edu>
* init_slave.c (pty_initialize_slave): Spurious signal stuff which did nothing
deleted.
Sam Hartman [Tue, 16 Apr 1996 18:19:13 +0000 (18:19 +0000)]
* Changes to not use streams on HPUX
* Changes to abort the session if telnetd receives certain options
such as environment or DISPLAY options before authentication and
encryption is negotiated or not negotiated.
Sam Hartman [Tue, 16 Apr 1996 18:16:07 +0000 (18:16 +0000)]
Changes so HPUX doesn't use streams. This
may break on HPUX10 depending on how you should get the name of the pts side
of /dev/ptym/clone. I don't have an HPUX10 system
to test on.
Richard Basch [Sat, 13 Apr 1996 01:30:50 +0000 (01:30 +0000)]
Renamed the functions to be preceded with krb5_ (I ran into a naming
conflict with the standard MD5 library calls in another application,
and this version has non-standard calling arguments.)
Fix wrapper macros so they don't try to dereference a function pointer
as a data value. This doesn't work if you're using hpux cc, since
functions are aligned on 2-byte boundaries, but data has to be
accessed on 4-byte boundaries. Accessing a function as a data value
isn't ANSI C portable anyway. :-) Wrapper macros now take a function
pointer, and check to see if the function pointer is non-NULL, instead
of taking a (*funptr), and seeing if the function when treated as data
object is non-NULL.
Marc Horowitz [Fri, 12 Apr 1996 00:40:24 +0000 (00:40 +0000)]
Integrated OpenVision's changes into the most recent MIT code. This
revision is what I'd call the easy stuff. Some more controversial
stuff remains to be done, which is why I'm doing a checkin now.
Return GSS_S_CRED_UNAVAIL on if krb5_cc_set_flags() returns an error,
since that's the call that will return an error if the credentials
files doesn't exist.
Richard Basch [Thu, 11 Apr 1996 04:26:22 +0000 (04:26 +0000)]
* kcmd.c: Cleaned up whitespace and removed commented & unused cruft
* krlogind.c, krshd.c: Allow the recvauth routine to find any key
in the keytab for which the user is trying to login. The host may
be known as many names. Additionally, for krlogind, clean up the
error handling for bad authentication (potential null dereference
and a misleading message because of the wrong authentication system
being used)
Richard Basch [Thu, 11 Apr 1996 00:32:22 +0000 (00:32 +0000)]
* rd_svc_key.c (read_service_key): First try to read the V4
service key from the V4 srvtab, and if it fails, try the keytab.
A * instance will be translated into the default instance component
(usually the FQDN of the local hostname).
rd_req_dec.c (krb5_rd_req_decoded): Move code which validated the
ticket times to krb5_validate_times.
valid_times.c (krb5_validate_times): New function which determines
whether or not the ticket times are valid.
mk_req_ext.c (krb5_mk_req_extended): Call krb5_validate_time() to
determine whether or not the ticket in passed-in credentials is valid.
If it isn't, return an error right away.
Fix #define of PROVIDE_DES_CBC_RAW so that the mac implementation
actually exported the raw DES encryption system (needed for GSSAPI).
Also added defines for the triple-DES encryption systems.
Mark Eichin [Tue, 9 Apr 1996 22:57:14 +0000 (22:57 +0000)]
preauth.c: add SAM support
str_conv.c: add AFS3 support
init_ctx.c: add processing for default_tkt_enctypes, matching
default_tgs_enctypes but client-side (so as not to hard code it,
since hard coded values are usually wrong :-)
projects / thirdparty / krb5.git / log
