Richard Basch [Tue, 5 Dec 1995 03:13:14 +0000 (03:13 +0000)]
Moved most string-type conversion routines from libkadm to libkrb5 to
reduce the dependencies on libkadm and for better support of multiple
encryption type lookup in krb5.conf.
Theodore Tso [Fri, 1 Dec 1995 22:35:35 +0000 (22:35 +0000)]
Applied patch from Scott Schwartz <schwartz@galapagos.cse.psu.edu>
Under SunOS, and maybe other systems, there is a a problem with
krlogind.c and a similar problem with login.c as distributed with
K5.5.
The bug is that rlogind forks a child but retains a controlling tty.
If the child is in the same process group as the parent, which is will
if you don't use a job control shell (chsh /bin/rc), keyboard signals
will kill the daemon. telnetd dissociates itself properly, but then
login.krb5 waits for the shell to finish, but login.krb5 has the same
ctty as the shell and is in the same process group, so it has the same
problem.
In BSD you used to be able to give up your ctty at will, but SunOS
seems to have setsid as the only mechanism to perform that action, and
setsid can only succeed in limited circumstances. Rlogind ought to be
fixed to behave more like telnetd, but independent of that, login.krb5
needs to be patched if kerberos is to work properly under SunOS.
Theodore Tso [Fri, 1 Dec 1995 22:15:32 +0000 (22:15 +0000)]
In case of permission problems, don't unlink the old replay cache;
make it a hard (repeatable) error. This also reduces the chance we
accidentally delete valuable data.
Richard Basch [Fri, 1 Dec 1995 19:21:07 +0000 (19:21 +0000)]
Corrected algorithm description at beginning.
Fold input into 168 bits and then expand the result to include odd parity,
so as to avoid potentially weakening the key.
Tom Yu [Mon, 27 Nov 1995 00:37:13 +0000 (00:37 +0000)]
* k5-int.h: Ultrix is broken. Hacked around by redefining the
typedefs of preauth_obtain_data_proc and
preauth_process_proc to be pointers to the functions
rather than the functions themselves. Also made some
things KRB5_NPROTOTYPE.
Tom Yu [Mon, 27 Nov 1995 00:36:33 +0000 (00:36 +0000)]
* preauth.c: Ultrix is broken. Prototype obtain_enc_ts_padata()
and process_pw_salt() explicitly rather than using the
typedef in k5-int.h becaus that typedef is to a function
pointer now.
Theodore Tso [Sat, 18 Nov 1995 03:39:15 +0000 (03:39 +0000)]
get_in_tkt.c (decrypt_as_reply):
preauth.c (process_pw_salt): When fetching the key to decrypting the
encrypted kdc reply, use the etype associated with the etype
reply, not the etype associated with the included ticket.
encode_kdc.c: Remove eblock argument from krb5_encode_kdc_rep;
set the eblock type from the client_key's enctype.
Mark Eichin [Thu, 16 Nov 1995 03:08:18 +0000 (03:08 +0000)]
* *.c (*): initialize lock_arg to a copy of a static
(thus zero) struct flock, to avoid panic'ing sunos 4.1.4.
If you call fcntl F_SETLKW with l_type == F_UNLCK and l_xxx == 15
(GRANT_LOCK_FLAG) you'll panic sunos 4.1.4 with
assertion failed: ld->l_xxx != GRANT_LOCK_FLAG, file: ../../ufs/ufs_lockf.c, line: 995
Since automatic structs like these have random values in uninitialized
fields, we initialize from a static struct (since using memset in this
case is abhorrent, and naming l_xxx is non POSIX.)
Theodore Tso [Tue, 14 Nov 1995 00:47:37 +0000 (00:47 +0000)]
* kdc_util.h: Added new prototypes for return_padata() and check_padata()
* kdc_preauth.c (return_padata): New function which calls out to each preauth
type to see if it is necessary to return preauth data or not.
(return_pw_salt): New function responsible for returning the
KRB5_PW_SALT preauth information.
* do_as_req.c (process_as_req): Move creation of the PW_SALT
preauthentication step into kdc_preauth.c. Call return_pdata()
which is responsible for all padata info which is returned by
the KDC in the KRB_AS_REP message.
Theodore Tso [Mon, 13 Nov 1995 18:01:26 +0000 (18:01 +0000)]
* preauth.c (krb5_process_padata): Added generalized processing for
preauth information which is returned by the KDC. This should be
general enough to support the AFS3_SALT preauth type, the SNK4
preauth type, and the public-key mods to Kerberos.
(process_pw_salt): New function for processing the KRB5_PW_SALT
preauthentication type.
* get_in_tkt.c (decrypt_as_reply): Removed temporary kludge for
processing the PW_SALT preauth type; that's now done in preauth.c
(krb5_get_in_tkt): Call krb5_process_padata with new arguments so that
the preauth code can set the decryption_key if necessary.
Theodore Tso [Mon, 13 Nov 1995 17:57:00 +0000 (17:57 +0000)]
Added typedef for krb5_preauth_proces_proc, and changed the prototype
of krb5_process_padata() to take additional arguments for returning
the decryption key to use for decrypting the as_reply, as well as
passing in the decrypt_proc procedure in case some preauth types want
to call decrypt_proc themselves.
Mark Eichin [Mon, 13 Nov 1995 01:41:07 +0000 (01:41 +0000)]
* def_realm.c (krb5_get_default_realm): check for PROF_NO_PROFILE
and return KRB5_CONFIG_CANTOPEN instead of BADFORMAT so that the
user in the end knows what is going on.
Mark Eichin [Mon, 13 Nov 1995 01:40:31 +0000 (01:40 +0000)]
* g_cnffile.c (krb__get_srvtabname): new function, looks up
[libdefaults]krb4_srvtab for use where KEYFILE used to be.
* g_cnffile.c (krb__v5_get_file): new function, looks up argument
in [libdefaults] and tries to open it as a filename. Returns
filehandle (or NULL, if fopen failed.)
(krb__get_cnffile, krb__get_realmsfile): use krb__v5_get_file to
look up "krb4_config" or "krb4_realms" respectively. Also add
$KRB_REALMS override for realms file.
Mark Eichin [Mon, 13 Nov 1995 01:39:39 +0000 (01:39 +0000)]
* conv_creds.c (krb524_convert_creds_kdc): loop through all of the
addresses returned by krb5_locate_kdc, don't just try the first one.
* krb524d.c (do_connection): check for particular failures of
decode_krb5_ticket, as well as for messages that are one int long
(which will eliminate our own error replies.)
Mark Eichin [Mon, 13 Nov 1995 01:26:12 +0000 (01:26 +0000)]
* forward.c: set KRB5_DEFAULT_LIFE to 10 hours, not 8.
* forward.c (rd_and_store_for_creds): construct correct cache name
for forwarded tickets (based on tty name if available) and drop it
into the environment so login notices it.
Theodore Tso [Thu, 9 Nov 1995 05:04:28 +0000 (05:04 +0000)]
* get_in_tkt.c (krb5_get_in_tkt): Remove the etype_info argument from
the call to krb5_obtain_padata.
* preauth.c (krb5_obtain_padata): Use the PADATA_ETYPE_INFO preauth,
if it exists, to determine which salt type to use when encrypting the
preauthentication data. Remove the etype_info argument.
Theodore Tso [Thu, 9 Nov 1995 01:05:57 +0000 (01:05 +0000)]
* krb5_encode_test.c (main): In case of an error in the encoding
routines, exit. Otherwise, calling the print routines will often
lead to a coredump.
* ktest.c (ktest_make_sample_etype_info): Set etype.length to -1 to
mean that the optional salt string is missing. (This is change in
the convention used by the ASN.1 encoder and decoder for this ASN.1
structure.)
Theodore Tso [Thu, 9 Nov 1995 01:03:32 +0000 (01:03 +0000)]
* asn1_k_decode.c (asn1_decode_etype_info_entry): If the optional
salt element is not present, set etype.length to -1.
* asn1_k_encode.c (asn1_encode_etype_info_entry): When encoding
the etype_info_entry structure, use length == -1 to mean
that the optional salt structure should not be sent. (It
used to be if length == -1.)
Theodore Tso [Wed, 8 Nov 1995 08:03:31 +0000 (08:03 +0000)]
* kdc_util.c (): Added new helper functions
dbentry_has_key_for_enctype(), dbentry_supports_enctype(), and
select_session_keytype().
* kdc_preauth.c: Added support for the ENC_TIMESTAMP preauthentication
scheme.
* do_tgs_req.c (process_tgs_req): Fixed the keytype/enctype selection
criteria for the server key, and the ticket session key.
* do_as_req.c (process_as_req): Added calls to the kdc preauthentication
verification routines. Fixed the keytype/enctype selection
criteria for the client key, the server key, and the ticket
session key.
* main.c (finish_realm): Make sure all parts of the realm structure are
freed properly.
(main): Free the kcontext krb5_context.
Theodore Tso [Wed, 8 Nov 1995 07:52:57 +0000 (07:52 +0000)]
* encrypt_tk.c (cleanup_scratch): Changed interface to no longer require
an eblock; we can use our own and figure out the enctype
from the passed-in key.
* get_in_tkt.c (krb5_get_in_tkt): Added calls to krb5_obtain_padata().
* preauth.c: Completely restructured file to support preauthentication.
projects / thirdparty / krb5.git / log
