Age | Commit message (Collapse) | Author | Files | Lines |
|
Add the krb5_get_etype_info() API, which sends an initial ticket
request to the KDC and extracts an enctype, salt, and s2kparams value
from the first KDC reply. This function will help ktutil use the
correct salt and s2kparams when creating keytabs.
[ghudson@mit.edu: renamed API to krb5_get_etype_info() and adjusted
behavior]
ticket: 8587
|
|
ticket: 8738 (new)
|
|
If gss_add_cred() is called with no input_cred_handle, it creates a
new credential with one element. At the end of the function, use the
created credential as the output container, rather than creating a
second one and leaking the first.
Add a test program for gss_add_cred() and run it.
ticket: 8729
tags: pullup
target_version: 1.16-next
target_version: 1.15-next
|
|
|
|
|
|
|
|
[ghudson@mit.edu: also remove t_sha256, which was removed in commit
c438227afd763997c131339c1476f61d1628a20d when t_sha2 was added]
|
|
ksetpwd was added in commit ec50322c3076ab4517fb4fb5cc3a931f6adb4f20
but is not installed as it was "not of release quality yet." It has
not materially improved since then, and under current policy we do not
include unfinished code in the tree, so remove it.
|
|
Add a test program for krb5int_validate_times() covering cases before
and across the y2038 boundary. Add a GSSAPI test program to exercise
lifetime queries, and tests using it in t_gssapi.py for ticket end
times after y2038. Add a new test script t_y2038.py which only runs
on platforms with 64-bit time_t to exercise end-user operations across
and after y2038. Add an LDAP test case to test storage of post-y2038
timestamps.
ticket: 8352
|
|
Where we convert between UTF-8 and UCS-2 (RC4 string-to-key and PAC
client info), use UTF-16 instead of UCS-2. Add a test program for
the conversion functions.
ticket: 8577 (new)
|
|
Replace references to Apple OS X with the updated OS name "macOS"
where applicable.
|
|
Add a test harness which interleaves calls for multiple initial creds
contexts using the same library context. Add a test case to
t_preauth.py using the new harness and the test preauth module to
verify that modreq pointers are correctly tracked.
ticket: 7877
|
|
In k5test.py, add the optional keyword argument "expected_msg" to
methods that run commands, to make it easier to look for substrings in
the command output. Add the optional keyword "expected_trace" to run
the command with KRB5_TRACE enabled and look for an ordered series of
substrings in the trace output.
|
|
Add cmocka unit tests for the KDC lookaside cache.
|
|
Add a regression test for the preceding bugfix. This test uses btree
database files with known contents and byte orders with short keys and
overflow data items.
ticket: 8485
|
|
Prior to the fix for #8139, forwarded TGTs obtained across a krbtgt
re-key could fail if the preferred krbtgt enctype changed, because
krb5_c_verify_checksum() returns an bad-enctype error due to the
mismatched checksum. Add a test case for this scenario, using a new
test harness program which obtains a forwarded TGT.
|
|
|
|
Make is_string_numeric() visible outside of parse_host_string.c as
k5_is_string_numeric() so it can be tested. Make
k5_parse_host_string() return an error when address begins with ':',
for consistency with APR's apr_parse_addr_port().
[ghudson@mit.edu: squashed three commits; added t_parse_host_string to
.gitignore and clean rule; clarified commit message]
|
|
|
|
Add some missing files to .gitignore, EXTRADEPSRCS, and clean rules.
|
|
[ghudson@mit.edu: simplify test harness]
ticket: 8425
|
|
ticket: 8415
|
|
[ghudson@mit.edu: style changes]
ticket: 8386
|
|
|
|
It is a good idea to have a fairly complete .gitignore file. It is
helpful for devs to know just what shouldn't end up in the repo, as
well as preventing accidental commits and even random trash ending up
in master.
Many of the files here added from the Github gitignore project
found here:
https://github.com/github/gitignore
|
|
Add some OS specific files and Eclipse project files, as well as the
top level build directory because it is recommended in the wiki to
perform your build inside of it. Also ignore the autom4te.cache
directory.
[tlyu@mit.edu: minor commit message edits]
|
|
In src/tests, rename t_init_creds.c and t_localauth.c to icred.c and
localauth.c for consistency with the other C test programs in that
directory.
|
|
Modify adata.c to handle CAMMAC containers and display auth
indicators. Modify the test preauth module to transmit a list of
indicators (specified by a gic opt) from the clpreauth module to the
kdcpreauth module and assert them to the KDC. Add a new s4u2proxy
test harness in src/tests which can be used to exercise S4U2Proxy
without going through GSSAPI, using a second ccache containing an
existing evidence ticket.
Add tests to t_authdata.py to exercise a variety of ticket issuing
scenarios and verify that the correct auth indicators appear in each
ticket.
ticket: 8157
|
|
Create a new test harness etinfo.c which can display etype-info2
information in KDC responses. Use it to test the etype-info results
in preauth_required error e-data and AS-REP padata.
ticket: 8199
|
|
RFC 2743 states that gss_inquire_context() must always return flags,
locally_initiated, and open even if a context is not yet fully
established. Additionally, a partially established context may also
return mech_type.
Previously, the krb5 mech raised an error for inquire_context on
partially completed contexts. It now follows the rules layed out in
RFC 2743.
Add a new test program to verify that gss_inquire_context() works
correctly on both in-progress and established contexts.
[ghudson@mit.edu: minor style changes and commit message edits]
ticket: 8025
|
|
ticket: 6938
|
|
Add a new test script t_authdata.py and a C harness adata.c to test
KDC authdata handling logic. KDB module authdata is not currently
tested.
|
|
Add a new test program t_pcontok to exercise
gss_process_context_token, and run it from t_gssapi.py.
ticket: 8055
|
|
Rename hpux10.exports to hpux.exports. In the HP-UX section of
shlib.conf, remove '+s' because it just specifies a default, add a
MAKE_SHLIB_COMMAND, and set SHLIBEXT based on the host CPU.
[ghudson@mit.edu: squashed commits, condensed commit message]
ticket: 7990 (new)
target_version: 1.13
tags: pullup
|
|
ticket: 7949
|
|
krb5int_c_combine_keys is used only by SAM-2 preauth with neither the
send-encrypted-sad nor use-sad-as-key flags, so it isn't covered by
any automated function tests. Add some unit tests to make sure that
it works and returns the expected results for two randomly generated
test vectors.
ticket: 7914
target_version: 1.12.2
tags: pullup
|
|
Add a new ccache test program t_marshal.c which verifies the new
marshalling functions and also the FILE ccache type against the
expected representations of the ccache header, default principal, and
credentials.
|
|
When krb5_rd_req cannot decrypt a ticket, try to produce the most
helpful diagnostic we can, and return an error code which corresponds
to the most applicable Kerberos protocol error. Add a trace log
containing the error message for ticket decryption failures, in case
the application server does not log it.
Add new tests to cover krb5_rd_req error messages and adjust existing
tests to match the new messages. Also adjust svc_auth_gssapi.c to
look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC.
ticket: 7232
|
|
ticket: 7872
|
|
Don't delete gssapi_krb5.h now that it is not generated.
[ghudson@mit.edu: also remove from generate-files-mac rule and from
.gitignore]
|
|
Add a unit test program named t_ulog. Make it map a ulog file, set up
header state where kdb_last_sno is the last serial number, and then
add an empty update. Check that the result is a ulog header with one
update at serial number 1.
ticket: 7839
|
|
Remove the GNATS-based krb5-send-pr script and replace it with a
script that instructs users to send email.
ticket: 7840 (new)
|
|
Add a test program which compares gss_pseudo_random outputs against
expected values for each enctype.
|
|
This test program isn't completely proof against the kind of mistakes
we've made with krb5_copy_context in the past, but it at least
exercises krb5_copy_context and can detect some kinds of bugs.
ticket: 7807
|
|
A few test programs didn't make it into .gitignore, OBJS, or
EXTRADEPSRCS.
|
|
|
|
|
|
Create a test module, program, and script to exercise the
krb5_aname_to_localname and krb5_k5userok functions as well as the
localauth pluggable interface.
ticket: 7583
|
|
Add a new pluggable interface for local authorization, and replace the
existing krb5_aname_to_localname and krb5_kuserok implementations with
implementations based on the pluggable interface.
ticket: 7583 (new)
|
|
ticket: 7585
|