Tom Yu [Sat, 4 Aug 2007 00:02:42 +0000 (00:02 +0000)]
krb5_fcc_generate_new() doesn't work with mkstemp()
If mkstemp() is available, the new ccache file gets created but the
subsequent open(O_CREAT|O_EXCL) call fails because the file was
already created by mkstemp(). Apply patch from Apple to keep the file
descriptor open.
ticket: new
tags: pullup
target_version: 1.6.3
component: krb5-libs
Tom Yu [Fri, 3 Aug 2007 21:16:19 +0000 (21:16 +0000)]
Based on Apple's patch, during the referrals loop, check to see if the
session key enctype of a returned credential for the final service is
among the enctypes explicitly selected by the application, and retry
with old_use_conf_ktypes if it is not.
Jeffrey Altman [Fri, 3 Aug 2007 13:22:23 +0000 (13:22 +0000)]
NIM: apply does not update saved values of general identities cfg page
The general identities configuration panel failed to update the saved values
of the DefaultMonitor, DefaultAllowAutoRenew, and DefaultSticky options after
the "Apply" button was pressed. This resulted in the subsequent value changed
states being incorrect.
Kevin Coffman [Wed, 1 Aug 2007 22:09:13 +0000 (22:09 +0000)]
Add PKINIT support
Pull up PKINIT support onto the trunk.
Changes from the version in branch users/coffman/pkinit are:
- Update the preauth plugin interface version to avoid
conflict with any existing plugins.
- Add a pkcs11.h locally to the pkinit code rather than
depending on opensc being installed.
Ken Raeburn [Fri, 27 Jul 2007 04:39:21 +0000 (04:39 +0000)]
Debugged version of patch worked up with Luke
Adds a callback to krb5int_sendto to examine the response and indicate
whether to quit the loop or not. For sendto_kdc, keep going if the
returned error is "service unavailable". Updated all other callers to
pass a null function pointer, which means to always break out of the
loop on any response (the old behavior).
Ken Raeburn [Fri, 20 Jul 2007 08:51:58 +0000 (08:51 +0000)]
Pull out code for looking up the current time, comparing the offset of
a supplied timestamp against the configured maximum clock skew, and
possibly generating an error message, into a separate routine.
Ken Raeburn [Thu, 12 Jul 2007 23:33:25 +0000 (23:33 +0000)]
Avoid use of unchecked sprintf in libraries. Use asprintf if the
output buffer is allocated according to the size of data to be
written, or snprintf otherwise.
Ken Raeburn [Wed, 4 Jul 2007 05:46:24 +0000 (05:46 +0000)]
gss krb5 mech enhanced error messages
Save detailed error messages (usually from the krb5 library) in
per-thread storage, mapping each error code to the most recently
produced message for it. Return the message from display_status.
Currently not implemented for a few cases where the krb5 mechanism
returns a minor status code of 0, or another value different from the
libkrb5 error code.
Other functions are available to store a generic string or formatted
message, but aren't used much at present.
Tested with these errors in context establishment:
* missing ccache (libkrb5 shows pathname if FILE: type)
* missing keytab (libkrb5 shows pathname if FILE: type)
* server principal unknown (libkrb5 shows server principal)
Ken Raeburn [Wed, 4 Jul 2007 04:06:54 +0000 (04:06 +0000)]
Perl code for generating "map" routines from a common template with
supplied type info.
* ktemplate.pm: Code for parsing a command line and writing out a
supplied template with substitutions.
* gen-map.pl: Parameter info and template for "map" type.
Ken Raeburn [Fri, 29 Jun 2007 02:37:57 +0000 (02:37 +0000)]
Check for error indication from localtime.
In a few cases this means changing internal function signatures to
allow for passing back the error indication up the call stack.
Thanks to Domagoj Babic for pointing out the possible null pointer
dereferences that would result if localtime fails.
Ken Raeburn [Fri, 29 Jun 2007 02:32:02 +0000 (02:32 +0000)]
Define a localtime_r wrapper around localtime if the system doesn't
provide localtime_r, instead of handling it in-line. Check for error
indication from localtime_r. Call localtime_r only once instead of
each time around the loop.
Ken Raeburn [Fri, 29 Jun 2007 01:01:24 +0000 (01:01 +0000)]
Attach format attributes to declarations of various message-formatting
routines under gcc. In a couple of routines, hard-code the preference
for using the vsnprintf paths instead of list-of-int-arguments hacks
now that we're assuming vsnprintf is available in other places.
Ken Raeburn [Thu, 28 Jun 2007 23:36:51 +0000 (23:36 +0000)]
Check for null pointer returns when allocating storage.
Clean up some memory leaks in out-of-memory error paths.
Use strdup and asprintf when appropriate.
Ken Raeburn [Wed, 27 Jun 2007 23:43:04 +0000 (23:43 +0000)]
For Win32 environment, define CAN_COPY_VA_LIST, and define an inline
version of vsnprintf using the MS versions. (Apparently no need for
plain snprintf just yet.)
Ken Raeburn [Tue, 26 Jun 2007 22:58:46 +0000 (22:58 +0000)]
* v4rcp.c (kstream_write): Allocate buffer space if it hasn't been
allocated, in the encrypting case, even if outlen is zero. While I
don't believe this can ever happen, it requires careful examination of
lots of code paths to figure it out. This change doesn't fix a
serious bug, but makes the analysis simple. Also, don't bother with
separate code paths for malloc vs realloc depending on the previous
values; we can just use realloc always.
Thanks to Domagoj Babic for pointing out the (false but
understandable) null-pointer problem.
Jeffrey Altman [Fri, 22 Jun 2007 19:03:57 +0000 (19:03 +0000)]
1. Use the debug CRT versions of the memory allocation functions in
util\perfstat.c. These functions allow associating file and line
numbers with each allocation.
2. Perform a heap verification periodically to check for heap
corruption in the debug build when using util\perfstat.c to manage
memory allocations.
3. Change wcscmp() to _wcscmp() for compatibility in util\perfstat.h
Jeffrey Altman [Fri, 22 Jun 2007 19:00:27 +0000 (19:00 +0000)]
Be more aggressive about forcing the new credentials dialog to the
top.
Many applications call GSSAPI functions from the main GUI thread.
Doing so blocks the window message pump for that application. When
the GSSAPI call results in the new credentials dialog being displayed,
it will be unable to bring itself to the top and grab the user input
focus because the foreground window is not responding. This patch
makes the new credentials window a top-most window at creation time
that results in it being created at the top of the Z-order. It can
then flash the window to indicate that it requires user attention.
Jeffrey Altman [Fri, 22 Jun 2007 18:59:35 +0000 (18:59 +0000)]
If the new credentials window is in the advanced mode and the user
tries to switch back to basic mode, we should set the active panel to
the identity selector before switching since the basic mode only
supports the identity selector panel.
Jeffrey Altman [Fri, 22 Jun 2007 18:58:09 +0000 (18:58 +0000)]
Don't assume that WM_DESTROY is the last message to be received by a
window. Since the child windows are still alive and kicking by the
time the parent receives WM_DESTROY, it's still possible to receive
other messages after WM_DESTROY.
If we free any window specific data when handling WM_DESTROY, we
should reset the window data field as well, and check if we have a
valid pointer when retrieving the window data field later.
Jeffrey Altman [Fri, 22 Jun 2007 18:54:49 +0000 (18:54 +0000)]
. Fix formatting in kherr.c
2. The FormatMessage() call needs special handling for 64 bit
platforms. Add a compile time check for now until we figure out
what to do.
3. Remove unused code from kherr.c.
4. Correct bad references to typedefs. kherr_severity and
kherr_suggestion were sometimes referenced as 'enum kherr_severity'
and 'enum kherr_suggestion' even though they are typedefs.
Jeffrey Altman [Fri, 22 Jun 2007 18:53:45 +0000 (18:53 +0000)]
Add new notification flags KHERR_CTX_NEWCHILD, KHERR_CTX_FOLDCHILD,
KHERR_CTX_PROGRESS for listeners of error context events to enable
them to listen for child context events and progress updates.
Jeffrey Altman [Fri, 22 Jun 2007 18:51:34 +0000 (18:51 +0000)]
Each error context in NIM can maintain a progress counter to indicate
the progress of the operation. The progress counter for a context
that contains child contexts should be computed by adding the progress
counters of its children. This update corrects the behavior of
kherr_get_progress() and kherr_get_progress_i() to take child contexts
into account.
In addition, since the progress counter of a context now depend on the
progress counters of its children, kherr_set_progress() will send
progress change notifications for any parent context as well.
Jeffrey Altman [Fri, 22 Jun 2007 18:47:16 +0000 (18:47 +0000)]
All exports in nidmgr32.dll are declared as __declspec(dllexport)
using the KHMEXP macro in the header files. However, since the same
header files are used to declare imports when building applications
and plug-ins that use nidmgr32.dll, the KHMEXP macro should switch to
__declspec(import) so that the relevant import table entries are
created.
To make this switch, the source files that go into nidmgr32.dll are
compiled with the special macro _NIMLIB_ defined that indicates that
the KHMEXP should expand to __declspec(dllexport). In the absence of
this macro, KHMEXP will expand to __declspec(dllimport).
projects / thirdparty / krb5.git / log
