Ken Raeburn [Thu, 19 Dec 2002 01:56:45 +0000 (01:56 +0000)]
* api.2/init-v2.exp (test150, test151, test153): Don't try to set KRB5CCNAME;
only the fact that it wasn't being done correctly prevented it from causing
test failures.
* lib/lib.t (kinit): If kinit reports a problem initializing the credentials
cache, raise an error.
Tom Yu [Sat, 14 Dec 2002 04:10:42 +0000 (04:10 +0000)]
* ad_print.c, g_in_tkt.c, g_pw_in_tkt.c, kadm_net.c, klog.c:
* kuserok.c, log.c, memcache.c, netread.c, netwrite.c:
* password_to_key.c, recvauth.c, stime.c, tkt_string.c:
Change _WINDOWS to _WIN32 in many places. Update copyright
notices. Remove _WINDOWS handling completely in a few places
where it's not needed.
Tom Yu [Thu, 12 Dec 2002 21:25:51 +0000 (21:25 +0000)]
More KfM merge work
Create new file FSp-glue.c including KfM functions that had previously
been scattered through various other files.
Port RealmsConfig-glue.c from KfM, including old Unix-ish krb4
configuration code as fallback. Remove other files containing old
realm/config file support.
Add KRB5_CALLCONV to krb_get_in_tkt_creds.
Fix various functions to take const char* as arguments now that
tkt_string() returns const.
Assorted minor cleanup.
Implement krb_get_err_text in terms of com_err. Implement gross
kludge to force krb_err_txt to remain in sync with com_err.
Tom Yu [Thu, 12 Dec 2002 21:10:55 +0000 (21:10 +0000)]
Fix depend rules to keep state about whether verification of various
things succeeded. Change some double colons to single colons. Add a
new depend-dependencies target to allow Makefile.in to specify things
that must be built for depend to work.
Tom Yu [Sat, 7 Dec 2002 04:14:07 +0000 (04:14 +0000)]
Fix some KRB5_CALLCONV botches that were causing trouble for Windows build
Update send_to_kdc() to use various krb5 internals to talk to the krb4
KDC. Add a new internal function to optionally return the local
address used to talk to the KDC. Many changes to lib/krb5/os to
support this. Fix bug in krb5int_sendto() that prevented correct UDP
length from being returned. Update callers of internal locate_* and
sendto_* functions.
Ken Raeburn [Sat, 7 Dec 2002 03:37:24 +0000 (03:37 +0000)]
Checkpoint first step of merge.
Moved per-file data into a separate object from the profile handle.
Dropped some old MacOS 9 code.
* prof_int.h: Include Mac OS X versions of header files if appropriate. Only
include prof_err.h if profile.h doesn't define ERROR_TABLE_BASE_prof.
(struct _prf_data_t): Move most of contents of _prf_file_t here. Add reference
count.
(prf_data_t): New typedef.
(struct _prf_file_t): Include an array of one _prf_data_t structure.
* prof_file.c (profile_open_file): Fill in "data" field. Drop some old Mac
specific code.
(profile_flush_file_data): Renamed from profile_flush_file, now takes
prf_data_t argument.
(profile_flush_file_data): Likewise.
(profile_free_file): Now calls profile_free_file_data.
(profile_free_file_data): New function, with most of old profile_free_file
code.
* prof_init.c (profile_init_path): Removed old Mac version.
(profile_ser_size, profile_ser_externalize): Get file data from new "data"
field.
* prof_set.c (rw_setup, profile_update_relation, profile_clear_relation,
profile_rename_section, profile_add_relation): Likewise.
* prof_tree.c (profile_node_iterator): Likewise.
* test_profile.c (do_batchmode): Likewise.
* prof_int.h (profile_flush_file): Now a macro.
* prof_err.et (PROF_MAGIC_FILE_DATA): New error code value.
Sam Hartman [Fri, 6 Dec 2002 01:02:13 +0000 (01:02 +0000)]
2002-12-05 Sam Hartman <hartmans@mit.edu>
* util_token.c (g_verify_token_header g_make_token_header):
Accept -1 to mean that no token type is expected; the token type
is purely an RFC 1964 artifact and is not used in other mechanisms
such as SPNEGO.
Ezra Peisach [Fri, 15 Nov 2002 16:12:20 +0000 (16:12 +0000)]
* accept_sec_context.c (krb5_gss_accept_sec_context): Use unsigned
lengths for arguments to g_token_size and g_make_token_header.
* export_name.c (krb5_gss_export_name): Change local length
variable to unsigned.
* k5unseal.c (kg_unseal_v1): Seqnum variable changed from
krb5_int32 to krb5_ui_4.
* k5seal.c (make_seal_token_v1): Change seqnum argument to
krb5_ui_4 from krb5_int32 to match krb5_gss_ctx_id_rec struct.
* gssapiP_krb5.h, util_crypt.c, util_seqnum.c: kg_make_seq_num(),
kg_get_seq_num() changed to use krb5_ui_4 for sequence
numbers. kg_encrypt(), kg_decrypt() length argument now unsigned.
Ken Raeburn [Fri, 15 Nov 2002 01:20:28 +0000 (01:20 +0000)]
Better cleanup; reduce filename conflict
* Makefile.in (unit-test-ok): Depend only on unit-test-body.
(unit-test-body): Remove krb5cc_rpc_test_* on entry and on successful exit. On
error exit, let the trap handler do all the cleanup. Incorporate old
unit-test-setup commands.
(unit-test-setup, unit-test-cleanup): Targets deleted.
* lib/helpers.exp (start_client, wait_client): Set KRB5CCNAME to something in
the current directory.
Ezra Peisach [Thu, 14 Nov 2002 04:43:25 +0000 (04:43 +0000)]
Invoke autoconf/autoreconf with the option --localdir or --include depending
on if pre/post autoconf 2.54. In 2.55 --localdir has been removed and replaced
with --include which was introduced in 2.53.
Ken Raeburn [Wed, 13 Nov 2002 02:05:16 +0000 (02:05 +0000)]
Better type and bounds checking:
* fake-addrinfo.h [NEED_FAKE_GETADDRINFO]: Include errno.h.
(fake_getnameinfo): Check that socklen_t size arguments are positive and fit in
size_t; return EAI_SYSTEM/EINVAL if not. Use the size_t variants when calling
string functions.
Work around another AIX bug:
[_AIX]: Define NUMERIC_SERVICE_BROKEN.
[NUMERIC_SERVICE_BROKEN]: Include ctype.h and stdlib.h.
(getaddrinfo) [NUMERIC_SERVICE_BROKEN]: If the service name is a numeric
string, save its value and the socket type, pass a null pointer to the real
getaddrinfo, and patch the returned results.
Ken Raeburn [Mon, 11 Nov 2002 20:23:43 +0000 (20:23 +0000)]
* Makefile.in (unit-test-body): Set RPC_TEST_SRVTAB based on process-id. Set
trap handler to delete it before returning an exit status.
(unit-test-cleanup): Don't delete files here.
Tom Yu [Sat, 9 Nov 2002 01:39:45 +0000 (01:39 +0000)]
tests/dejagnu leaks ptys
* default.exp: Add (disabled) debugging code for catching leaking
ptys. expect eof from the correct spawn_ids when killing kdc and
kadmind to avoid leaking ptys.
Tom Yu [Thu, 7 Nov 2002 22:43:46 +0000 (22:43 +0000)]
rpc unit tests can fail due to race condition
The rpc unit tests can fail in fullrun.exp due to a failure to drain
output from the server in expire.exp. This commit works around the
problem by calling flush_server, but a real synchronization method
should probably be implemented, perhaps by having the server log when
a client disconnects.
* rpc_test.0/expire.exp (overlap): Add another call to
flush_server to make a race condition a little less likely. There
really should be better synchronization, as this test suite is
just full of race conditions waiting to happen.
Tom Yu [Thu, 7 Nov 2002 21:40:15 +0000 (21:40 +0000)]
Thanks, patch applied
* svr_principal.c (kadm5_setkey_principal_3): Apply patch from
Emily Ratliff to allow n_ks_tuple to be zero, which is the case if
being called from kadmind answering a client's setkey_principal
request.
Ezra Peisach [Thu, 7 Nov 2002 20:09:02 +0000 (20:09 +0000)]
* asn1_k_encode.c (asn1_encode_sam_challenge_2): Test for error
returned from asn1buf_insert_oxtetstring and cleanup strctures
properly.
* asn1_k_decode.c (asn1_decode_sam_challenge_2_body): Change
sequence_of/end_sequence_of to use
sequence_of_no_tagvars/end_sequence_of_no_tagravs to avoid
shadowing variables.
Tom Yu [Tue, 5 Nov 2002 04:52:24 +0000 (04:52 +0000)]
New Makefile variable RPATH_FLAG, possibly used even when we're not
building shared libs. TCL_MAYBE_RPATH gets used to account for
linking a shared tcl lib when we're not building shared libs.
Ken Hornstein [Sun, 3 Nov 2002 20:31:33 +0000 (20:31 +0000)]
Calling convention for krb5int_c_combine_keys does not match prototype
The Windows calling convention for krb5int_c_combine_keys does not match the
prototype in k5-int.h. I missed this during the initial commit since I
neglected to test out the build of this code on Windows.
Ken Raeburn [Thu, 31 Oct 2002 22:54:00 +0000 (22:54 +0000)]
* k5-int.h (krb5_ser_handle): Now points to const.
(krb5_kt_dfl_ops): Now const.
(struct _krb5_kt_ops): Field serializer now points to const krb5_ser_entry
instead of void.
* krb5.hin (struct _krb5_kt): Field ops now points to const.
* kt_file.c (krb5_ktf_ops, krb5_ktf_writable_ops): Now const. Drop cast of
serializer entry initializer.
(fopen_mode_rbplus, fopen_mode_rb): Now const.
* kt_srvtab.c (krb5_kts_ops): Now const.
* ktbase.c (krb5_ktf_ops, krb5_kts_ops): Update declarations.
(struct krb5_kt_typelist): Field ops now points to const.
Ken Raeburn [Wed, 30 Oct 2002 23:07:23 +0000 (23:07 +0000)]
* start_servers_local: If $USER isn't set, use $LOGNAME. If ovsec_kadm_srv_tcl
invocation to do some initialization fails, exit rather than continuing.
Ken Hornstein [Wed, 30 Oct 2002 18:41:24 +0000 (18:41 +0000)]
Wrong ASN.1 definition and padata type for new hardware preauth
It turned out that early in the development cycle, one of our developers
picked the "next" PADATA type in krb5.hin, and we said, "We've got to
fix that when we get the real one assigned" ... and we never did. Noticed
by Ezra Peisach.
Also, the definition for sam-pk-for-sad was changed to OCTET STRING from
EncryptionKey in the draft and the code, but we never updated the ASN.1
definition. Also noticed by Ezra Peisach.
Ken Raeburn [Mon, 28 Oct 2002 22:11:57 +0000 (22:11 +0000)]
* localaddr.c (print_addr) [TEST]: Don't mix size_t and socklen_t, just assume
socklen macro will return a socklen_t value. Cast buffer size to socklen_t in
getnameinfo call.
Sam Hartman [Mon, 28 Oct 2002 02:28:41 +0000 (02:28 +0000)]
Don't include trailing null in the transited encoding produced by the KDC.
Other routines do not expect the null to be included in the length so
policy checks fail. Also, sending the null over the wire is wrong.
Ken Hornstein [Thu, 24 Oct 2002 06:49:59 +0000 (06:49 +0000)]
Client code lacks support for draft-ietf-krb-wg-kerberos-sam-01.txt
This widely-spread commit implements support for the so-called "new"
hardware preauth protocol, defined in the IETF internet-draft
draft-ietf-krb-wg-kerberos-sam-01.txt. Note that this code is client-side
only.
Ken Hornstein [Wed, 23 Oct 2002 20:08:04 +0000 (20:08 +0000)]
gic_pwd doesn't support password expiration notification via last_req hint
In kerberos-clarifications, a new last-req type (6) has been specified
that indicates when a principal's password will expire. This code implements
support for this last-req type. Note that the intent is that the last-req
type will only be included by the KDC when the time until password expiration
reaches some threshold (e.g, one week), so this code will display the
password expiration anytime the last-req type is included.
projects / thirdparty / krb5.git / log
