| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
[ghudson@mit.edu: style adjustments]
bigredbutton: whitespace
|
|
The profile library has two deconstructors, profile_release() and
profile_abandon(). profile_release() flushes in-memory changes to
backing files, while profile_abandon() does not. If a krb5_context
profile contains in-memory changes, they were copied from a profile
supplied to krb5_init_context_profile(), and the caller can decide
whether to flush them.
As profile_copy() is now a public function, remove the include of
prof_int.h and the associated LOCALINCLUDES setting in Makefile.in.
ticket: 9121 (new)
|
|
Add NDR marshalling functions for S4U_DELEGATION_INFO PAC buffers.
[ghudson@mit.edu: added safety checks; made minor style changes;
edited commit message]
|
|
Remove the fortuna and device PRNG modules and PRNG modularity, and
move the prng_os implementation into prng.c. Remove the crypto_mod.h
requirement to implement failure-free AES256 and SHA256. Deprecate
krb5_c_random_add_entropy() and krb5_c_random_os_entropy() and remove
their call sites. Deprecate and ignore the -W (weak random) option to
kadmind and kdb5_util create, and stop using it in the test suite.
ticket: 9032 (new)
|
|
Select an output credential cache using similar logic to kinit. Do
not require the target cache to be initialized.
Try to use the per-thread cache set by gss_krb5_ccache_name() if no
output cache was specified via a cred store.
When the destination is a collection, honor the default_cred flag by
switching the primary cache to the selected output cache. When the
destination is not a collection, ignore the default_cred flag.
(Previously the default_cred flag was mandatory for gss_store_cred()
even though it is an advisory flag, and ignored for
gss_store_cred_into() even if no ccache was specified in the cred
store.)
Honor the overwrite_cred flag by refusing to replace an initialized
cache if it is not set. Stop using gss_acquire_cred() for this
purpose as it could go out and fetch credentials from a client keytab.
Perform atomic replacement of the target cache when possible, using
krb5_cc_move().
Add a test harness for calling gss_store_cred() or
gss_store_cred_into() and a suite of tests. Fix a broken trace log
message for krb5_cc_move() and update the expected trace logs for an
existing t_credstore.py test.
ticket: 8010
|
|
|
|
Of the remaining test scripts, kprop.exp has a corresponding Python
script, and standalone.exp is covered by t_general.py, t_dump.py,
t_keytab.py, and t_pkinit.py.
|
|
Move pkinit-certs, proxy-certs, and t_inetd.c from tests/dejagnu to
tests and repoint references at the new locations.
|
|
|
|
Commit d160bc733a3dbeb6d84f4e175234ff18738d9f66 (ticket 7045) added a
new thread key K5_KEY_GSS_SPNEGO_STATUS and registered it in SPNEGO
library initialization, but neglected to unregister it in
finalization. As a result, loading, unloading, and reloading
libgssapi_krb5 could throw an assertion failure if libkrb5support
remained loaded. Unregister the key in SPNEGO finalization and add a
test case.
Reported and investigated by Adam Dabrowski.
ticket: 8614
tags: pullup
target_version: 1.18-next
target_version: 1.17-next
|
|
tests/resolve is no longer used after the previous commit.
|
|
[ghudson@mit.edu: adjusted test program to output channel-bound state
instead of optionally enforcing it; adjusted tests to check program
output; split out tests into separate Python script; made cosmetic
changes]
ticket: 8900
|
|
Replace the dejagnu RPC test framework with a short Python script to
do the same tests as fullrun.exp and gsserr.exp. Modify the server
test program to facilitate use by k5test.py.
expire.exp, together with a comment in the client test program, was
designed to test a libdb2 btree bug via the gssrpc server-side
authentication code. That code was subsequently changed not to use
libdb2, before it was merged into the main krb5 tree (in revision 1.23
of svc_auth_gssapi.c, according to the changelog removed in commit
2a43d772be1e45faa8e488d436b6e867371563fb). Remove the comment and do
not replace that test sequence.
|
|
In adata.c, look up the server in the keytab by ticket->server (which
has the canonicalized realm), to allow testing of cross-realm RBCD
(although unused for now).
In s4u2proxy.c, set KRB5_GC_CANONICALIZE to support RBCD, and add an
authdata request option. Add an s4u2self test harness with authdata
request option.
[ghudson@mit.edu: minor code simplifications; edited commit message]
ticket: 8866
|
|
Add a mock NegoEx-only GSS module, a test program which establishes a
SPNEGO context, and a Python script to exercise a variety of NegoEx
negotiation scenarios.
ticket: 8851
|
|
Add a new replay cache type using a hash-based file format.
ticket: 8786
|
|
This method of combining keys was specified by
draft-ietf-krb-wg-kerberos-sam for DES and 3DES enctypes, and is
otherwise unused. Remove it.
[ghudson@mit.edu: rewrote commit message]
ticket: 8812
|
|
Single-DES removal brings us closer to compliance with RFC 6649.
Single-DES was disabled by default starting in release 1.8, and
user-visible deprecation warnings were issued starting in release
1.17.
ticket: 8808
|
|
|
|
Instead of requiring the caller to set up a persistent replay cache
for KRB-PRIV/KRB-SAFE/KRB-CRED messages produced in DO_TIME auth
contexts, use an in-memory replay cache.
Update the API documentation for the affected functions and correct
some inaccuracies.
ticket: 8785 (new)
|
|
Add a k5_memrcache type which can efficiently detect replayed tags
without any persistence or inteprocess sharing. Also add unit tests.
|
|
Add the krb5_get_etype_info() API, which sends an initial ticket
request to the KDC and extracts an enctype, salt, and s2kparams value
from the first KDC reply. This function will help ktutil use the
correct salt and s2kparams when creating keytabs.
[ghudson@mit.edu: renamed API to krb5_get_etype_info() and adjusted
behavior]
ticket: 8587
|
|
ticket: 8738 (new)
|
|
If gss_add_cred() is called with no input_cred_handle, it creates a
new credential with one element. At the end of the function, use the
created credential as the output container, rather than creating a
second one and leaking the first.
Add a test program for gss_add_cred() and run it.
ticket: 8729
tags: pullup
target_version: 1.16-next
target_version: 1.15-next
|
|
|
|
|
|
|
|
[ghudson@mit.edu: also remove t_sha256, which was removed in commit
c438227afd763997c131339c1476f61d1628a20d when t_sha2 was added]
|
|
ksetpwd was added in commit ec50322c3076ab4517fb4fb5cc3a931f6adb4f20
but is not installed as it was "not of release quality yet." It has
not materially improved since then, and under current policy we do not
include unfinished code in the tree, so remove it.
|
|
Add a test program for krb5int_validate_times() covering cases before
and across the y2038 boundary. Add a GSSAPI test program to exercise
lifetime queries, and tests using it in t_gssapi.py for ticket end
times after y2038. Add a new test script t_y2038.py which only runs
on platforms with 64-bit time_t to exercise end-user operations across
and after y2038. Add an LDAP test case to test storage of post-y2038
timestamps.
ticket: 8352
|
|
Where we convert between UTF-8 and UCS-2 (RC4 string-to-key and PAC
client info), use UTF-16 instead of UCS-2. Add a test program for
the conversion functions.
ticket: 8577 (new)
|
|
Replace references to Apple OS X with the updated OS name "macOS"
where applicable.
|
|
Add a test harness which interleaves calls for multiple initial creds
contexts using the same library context. Add a test case to
t_preauth.py using the new harness and the test preauth module to
verify that modreq pointers are correctly tracked.
ticket: 7877
|
|
In k5test.py, add the optional keyword argument "expected_msg" to
methods that run commands, to make it easier to look for substrings in
the command output. Add the optional keyword "expected_trace" to run
the command with KRB5_TRACE enabled and look for an ordered series of
substrings in the trace output.
|
|
Add cmocka unit tests for the KDC lookaside cache.
|
|
Add a regression test for the preceding bugfix. This test uses btree
database files with known contents and byte orders with short keys and
overflow data items.
ticket: 8485
|
|
Prior to the fix for #8139, forwarded TGTs obtained across a krbtgt
re-key could fail if the preferred krbtgt enctype changed, because
krb5_c_verify_checksum() returns an bad-enctype error due to the
mismatched checksum. Add a test case for this scenario, using a new
test harness program which obtains a forwarded TGT.
|
|
|
|
Make is_string_numeric() visible outside of parse_host_string.c as
k5_is_string_numeric() so it can be tested. Make
k5_parse_host_string() return an error when address begins with ':',
for consistency with APR's apr_parse_addr_port().
[ghudson@mit.edu: squashed three commits; added t_parse_host_string to
.gitignore and clean rule; clarified commit message]
|
|
|
|
Add some missing files to .gitignore, EXTRADEPSRCS, and clean rules.
|
|
[ghudson@mit.edu: simplify test harness]
ticket: 8425
|
|
ticket: 8415
|
|
[ghudson@mit.edu: style changes]
ticket: 8386
|
|
|
|
It is a good idea to have a fairly complete .gitignore file. It is
helpful for devs to know just what shouldn't end up in the repo, as
well as preventing accidental commits and even random trash ending up
in master.
Many of the files here added from the Github gitignore project
found here:
https://github.com/github/gitignore
|
|
Add some OS specific files and Eclipse project files, as well as the
top level build directory because it is recommended in the wiki to
perform your build inside of it. Also ignore the autom4te.cache
directory.
[tlyu@mit.edu: minor commit message edits]
|
|
In src/tests, rename t_init_creds.c and t_localauth.c to icred.c and
localauth.c for consistency with the other C test programs in that
directory.
|
|
Modify adata.c to handle CAMMAC containers and display auth
indicators. Modify the test preauth module to transmit a list of
indicators (specified by a gic opt) from the clpreauth module to the
kdcpreauth module and assert them to the KDC. Add a new s4u2proxy
test harness in src/tests which can be used to exercise S4U2Proxy
without going through GSSAPI, using a second ccache containing an
existing evidence ticket.
Add tests to t_authdata.py to exercise a variety of ticket issuing
scenarios and verify that the correct auth indicators appear in each
ticket.
ticket: 8157
|
|
Create a new test harness etinfo.c which can display etype-info2
information in KDC responses. Use it to test the etype-info results
in preauth_required error e-data and AS-REP padata.
ticket: 8199
|
