Mark Eichin [Sat, 27 Jan 1996 06:06:22 +0000 (06:06 +0000)]
* kuserok.c: use HAVE_SETEUID and HAVE_SETRESUID to figure out how
to emulate seteuid instead of assuming hpux.
* configure.in: test for seteuid as well; fold some tests into a
single AC_HAVE_FUNCS.
Mark Eichin [Sat, 27 Jan 1996 05:55:04 +0000 (05:55 +0000)]
* network.c (setup_network): strtol is good enough for port
number, and sunos doesn't have strtoul (and nothing else in the
tree uses it.)
(add_port): use proper old-style definition.
Sam Hartman [Fri, 26 Jan 1996 05:22:37 +0000 (05:22 +0000)]
Convert the kvno to a char before writing it out. (The previous code
tried, but casting from (int *) to (char *) is not the same as casting
from int to char.
Sam Hartman [Thu, 25 Jan 1996 20:06:28 +0000 (20:06 +0000)]
* cnv_tkt_skey.c (krb524_convert_tkt_skey): Take both a v5 and v4
service key. Use the v5 service key to decrypt the v5 ticket, and
the v4 service key to encrypt the v4 ticket.
* krb524d.c (do_connection): Use a separate v5 and v4 service key
so that if the KDC chooses to encrypt the v5 ticket in something
besides ENCTYPE_DES_CBC_CRC, we don't lose. Also, make sure we
free keyblock contents and tickets on error.
(lookup_service_key): Pass enctype to kdc_get_server_key
(kdc_get_server_key): Only try for v4 salt if the enctype is
DES_CRC. Take enctype as an argument. This creates a problem
if the server key has a normal and v4 salt of ENCTYPE_DES_CBC_CRC
but I can't think of a good answer to this.
* k524init.c (main): Use crc32 not md5.
Wed Jan 24 20:05:47 1996 Sam Hartman <hartmans@tertius.mit.edu>
* krb524d.c (kdc_get_server_key): Try to find a v4 salt type key,
else try any des_crc32 key, else fail.
(do_connection): Lookup a crc32 key not an md5 key.
(init_master): Handle reading kdc profile.
Sam Hartman [Thu, 25 Jan 1996 20:04:58 +0000 (20:04 +0000)]
get_creds.c: Only match on enctype if in_creds.keyblock
has non-null enctype. (I.E. implement as documented)
gc_via_tkt.c: If the in_creds.keyblock.enctype !=0 then don't call
send_tgs with a null ktypes paramater; instead, explicitally allow only
increds.keyblock.enctype.
Sam Hartman [Thu, 25 Jan 1996 20:01:45 +0000 (20:01 +0000)]
Previously, ktype_match only made sure that the enctype was valid
and in the set of default tgs enctypes.
Now, if matching on keytype, do an exact match, else
use ktype_reasonable (renamed ktype_match) to make
sure the ticket is in the default tgs enctypes.
Tom Yu [Thu, 25 Jan 1996 01:57:37 +0000 (01:57 +0000)]
No change from prior revision, just corrected log message:
* gssapi.h: Added definition of NPROTOTYPE to dtrt with Ultrix,
etc. Also added special case for Ultrix (limited
prototype support).
Sam Hartman [Wed, 24 Jan 1996 08:56:24 +0000 (08:56 +0000)]
* Add checksum support to klogind making sure encrypted authenticators
cannot be replayed against unencrypted connections.
* Updated checksumming in kshd to be compatible with klogind so they
use the same client code. CVS:
* Fixed Makefile to install kshd and klogind not kr*d
* Updated option process in krlogind and kshd per messages to c.p.k.
Ezra Peisach [Mon, 22 Jan 1996 22:35:33 +0000 (22:35 +0000)]
Move the prototype checking code from include/krb5/configure.in into
KRB5_CHECK_PROTOS.
This is for applications that wish to use KRB5_PROTOTYPE, are not STDC,
do not want to include k5-int.h but need to know if prototypes work on
the system.
Ezra Peisach [Mon, 22 Jan 1996 13:10:40 +0000 (13:10 +0000)]
* configure.in: Add in WITH_ANAME_DB and WITH_KDB_DB so that top
level configure --help lists options.
* aclocal.m4 (CHECK_DB): Fix m4 quoting to allow for the autoconf
rules to insert the required CPP determination rules
automatically.
(WITH_ANAME_DB): Add missing comma. Fix up spacing so
configure --help looks pretty.
Richard Basch [Mon, 22 Jan 1996 04:52:28 +0000 (04:52 +0000)]
Fixed three problems in the database rename function:
1. Added a missing call to krb5_dbm_db_end_update to ensure the lock file
timestamp is updated.
2. Corrected the test for a valid lock file handle to be >=0 not non-zero.
3. Use the lock file of the target name, since the source will shortly
disappear and another process may already be checking for the lock
file of the target. (For example, a kdb5_edit db load will use
a temporary name and rename the db to the proper name when it is
done, and krb5kdc will be testing for the target lock file.)
Richard Basch [Mon, 22 Jan 1996 04:37:00 +0000 (04:37 +0000)]
* aclocal.m4
Added several macros and restructures to allow for testing of
which dbm type to use and to override with
--with-kdb-db=DBM
--with-aname-db=DBM
Added USE_ANAME macro to specify a module requires the aname db.
USE_KDB5_LIBRARIES now checks the --with-kdb-* flags.
Tom Yu [Mon, 22 Jan 1996 04:34:09 +0000 (04:34 +0000)]
* gc_via_tkt.c (krb5_kdcrep2creds): Set is_skey so get_creds won't
break trying to match is_skey in the ccache. This way we
won't end up with many copies of user-to-user tickets.
Sam Hartman [Sat, 20 Jan 1996 00:55:45 +0000 (00:55 +0000)]
In the client, construct a checksum from the command line
and remote user and encode them in the authenticator. In the daemon,
if a checksum is present, verify it.
This change *should* make it possible to use rsh in a secure
fassion provided that you always use a client that has
checksumming.
If you do not use encrypted rsh, then the command line cannot be
spoofed,
but the standard input and output can still be spoofed.
Sam Hartman [Fri, 19 Jan 1996 01:33:08 +0000 (01:33 +0000)]
Mainline utmp and login cleanups from hartmans_pty_utmp:
* Fix utmp handling on Solaris for wtmpx records
* Replace krlogin's SIGURG handler with a call to select squashing Solaris ctrl-c bug
* Fix utmp on systems without pututline so ttyslot is only used when it works
Sam Hartman [Tue, 16 Jan 1996 19:40:56 +0000 (19:40 +0000)]
Fix handling so that the username is only written out to wtmpx logout records;
I know of no systems that write out usernames in DEAD_PROCESS records
in wtmp, but can special case them in update_wtmp if they are found.
Sam Hartman [Mon, 15 Jan 1996 20:37:32 +0000 (20:37 +0000)]
Short term, this is notes on what the interfaces to various libpty functions do. Long term, I may end up writing something more formal to go into doc. If that happens, it is likely that this README will be removed or replaced with a README explaining how to break libpty out of the Kerberos distribution and get configure to be happy
Mark Eichin [Mon, 15 Jan 1996 07:38:46 +0000 (07:38 +0000)]
* aclocal.m4 (WITH_DBM_LNAME): add --with-dbm-lname for callers of
an_to_ln routines that have USE_DBM_LNAME set.
* aclocal.m4 (WITH_DBM_KDB): avoid duplicating --with-dbm code all
over the place.
(from CNS. Eventually they need to be referenced a bunch of places, but
for now gssftp uses the former so I have an excuse to drop them in...)
Mark Eichin [Sun, 14 Jan 1996 08:33:16 +0000 (08:33 +0000)]
Cygnus implementation of GSSAPI-based ftp client and server.
See README.gssftp for history and details.
Bugs, comments to <eichin@cygnus.com>. Be sure to forward any changes
made at MIT as well.
Theodore Tso [Thu, 11 Jan 1996 04:06:02 +0000 (04:06 +0000)]
scc.h (KRB5_SCC_DEFAULT_VNO): Remove KRB5_SCC_DEFAULT_VNO; now set in
init_ctx.c.
scc_maybe.c (krb5_scc_open_file):
scc_gennew.c (krb5_scc_generate_new): Use context->scc_default_format
to determine the credentials ccache type.
scc_read.c (krb5_scc_read_keyblock): If reading in a version 3
credentials cache, ignore the second enctype stored in the ccache;
just read it into a dummy variable.
Theodore Tso [Thu, 11 Jan 1996 03:14:46 +0000 (03:14 +0000)]
kcmd.c (getport): Clear the sin structure to be zero. (From Doug Engbert.)
krsh.c (main): Added code to default port to 544 if service not found.
(From Doug Engbert.)
krlogin.c (main): Added code to default port to 543 or 2105 if service
not found. (From Doug Engbert.)
login.c (main): Save KRB5CCNAME environment variable, which may have
been set by forward.c. Add code for SGI to set environment for its
/etc/TIMEZONE (untested). Don't print MOTD twice on Suns, added
#ifdef NO_MOTD. (Patches from Doug Engbert).
Theodore Tso [Thu, 11 Jan 1996 02:27:35 +0000 (02:27 +0000)]
krbconfig.c, Makefile.in: Removed krbconfig.c; it contained global
variables which are no longer used.
recvauth.c: Removed the global extern of krb5_kdc_default_options,
which wasn't being used anyway.
mk_req.c (krb5_mk_req): Replace use of krb5_kdc_default_options with
context->kdc_default_options.
gc_frm_kdc.c: Remove the global extern of krb5_kdc_req_sumtype, which
wasn't being used anymore anyway.
send_tgs.c (krb5_send_tgs_basic): Remove use of the global variable
krb5_kdc_req_sumtype, and use the kdc_req_sumtype in the context
structure instead.
projects / thirdparty / krb5.git / log
