aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-07-08Changed return types of the plugin related functions per "Plugin support ↵pluginsZhanna Tsitkov15-122/+105
improvements" Project Proposal review. Introduced plugin_version and removed plugin_id config attr. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24177 dc483132-0cff-0310-8789-dd5450dbe970
2010-06-30Renamed factory into loader.Zhanna Tsitkov30-291/+282
Example of plugin section in krb5.conf after renaming: PQ_DYN = { plugin_api = plugin_pwd_qlty plugin_loader_name = plugin_dyn_loader plugin_loader_type = dynamic plugin_name = plugin_pwd_qlty_DYN plugin_loader_path = /var/tsitkova/Sources/pl/src/plugin_dynamic/libplugin_dynamic.so plugin_type = service plugin_id = 33 } git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24155 dc483132-0cff-0310-8789-dd5450dbe970
2010-06-30Remove set_plugin_manager_instance API. Minor cleaning around plugin_idZhanna Tsitkov9-38/+24
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24154 dc483132-0cff-0310-8789-dd5450dbe970
2010-06-30Renamed pl_handle into pl_manager in krb5_context structureZhanna Tsitkov6-42/+17
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24150 dc483132-0cff-0310-8789-dd5450dbe970
2010-06-28Added facilities to handle dynamic pluginsZhanna Tsitkov14-20/+294
For the purpose of demonstration, a new plugin pwd_qlty_DYN was created. The new section in krb5.conf for dynamic plugins looks as follows plugin_list = PQ_DYN PQ_DYN = { plugin_api = plugin_pwd_qlty plugin_factory_name = plugin_dyn_factory plugin_factory_type = dynamic plugin_name = plugin_pwd_qlty_DYN plugin_factory_path = /var/tsitkova/Sources/pl/src/plugin_dynamic/libplugin_dynamic.so plugin_id = 33 } The test appl is server_misc.c. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24149 dc483132-0cff-0310-8789-dd5450dbe970
2010-06-14Added facilities to handle multiple impls of the same static plugins. It is ↵Zhanna Tsitkov26-107/+641
based on plugin_id As a proof of the concept, the password quality validation plugins were considered. So, the following happens: In the krb5.conf we indicate that we potentially want two pwd quality plugins: plugin_pwd_qlty_krb (native MIT kerb code extracted from server_mics.c) and plugin_pwd_qlty_X (bogus,as a matter of fact, almost identical to plugin_pwd_qlty_krb impl). In the caller, i.e. in passwd_check of lib/kadm5/srv/server_misc.c, we call KRB and X impl's and verify the pwd against both of the policies: plugin_manager_get_service(srv_handle->context->pl_handle, "plugin_pwd_qlty", PWD_QLTY_KRB); plugin_manager_get_service(srv_handle->context->pl_handle, "plugin_pwd_qlty", PWD_QLTY_X); (It is proof of the concept.) git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24135 dc483132-0cff-0310-8789-dd5450dbe970
2010-06-03To prevent crash in case when conf file does not know about pwd_qlty pluginZhanna Tsitkov8-79/+71
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24116 dc483132-0cff-0310-8789-dd5450dbe970
2010-05-28Introduced a new static plugin - password quality validator. It is based on ↵Zhanna Tsitkov23-170/+366
the old/existing built-in pwd verification functionality. ( for proof of the concept and demonstration purposes) git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24108 dc483132-0cff-0310-8789-dd5450dbe970
2010-05-26Implementation of yarrow prng as a plugin requires the vast majority of the ↵Zhanna Tsitkov62-550/+381
routines in crypto lib to have a krb5_context as an argument. (This is needed to pass ref to pl_handle.) Unfortunately, it is not the case for the current state of crypto lib. Introducing krb5_context is a very invasive change and might be unsuitable for 1.9 release. So, yarrow is moved from plugins to crypto/krb and is treated as built-in functionality again. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24104 dc483132-0cff-0310-8789-dd5450dbe970
2010-05-21Added missing filesZhanna Tsitkov2-0/+183
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24080 dc483132-0cff-0310-8789-dd5450dbe970
2010-05-21Moving pl handle into krb5_context. Part IIZhanna Tsitkov32-108/+116
KDC side works. kinit needs to be linked with old libs to work. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24079 dc483132-0cff-0310-8789-dd5450dbe970
2010-05-19Moved plugin handle initialization from lib init into krb5_ctx.Zhanna Tsitkov14-65/+160
At the moment we do not have "default" plugin configuration => needed to update come krb5 config files for "make check" tests to work. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@24064 dc483132-0cff-0310-8789-dd5450dbe970
2010-05-07Changed the type of "void *data" to " manager_data * data" in plugin_manager.Zhanna Tsitkov4-11/+32
Also, made path to yaml config file conditional in krb5_libinit.c git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23975 dc483132-0cff-0310-8789-dd5450dbe970
2010-05-07Support plugin configuration in krb5 config format.Zhanna Tsitkov8-19/+231
Example of plugin section in krb5.conf: [plugins] plugin_prng = { plugin_factory_name = plugin_default_factory plugin_factory_type = static plugin_name = plugin_yarrow_prng plugin_type = service } plugin_pa = { plugin_factory_name = plugin_default_factory plugin_factory_type = static plugin_name = plugin_encrypted_challenge_pa plugin_type = service } git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23974 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-29Build libs/tests with libencrypted_challenge.aZhanna Tsitkov3-4/+23
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23949 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-22Add omitted in r23923 filesZhanna Tsitkov8-0/+755
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23924 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-22For the experiment and as a proof of the concept, implement ↵Zhanna Tsitkov7-4/+12
preauth/encrypted_challenge server side as a new plugin under the new arch. This commit is for plugin implementation and initialization only. Next step is to invoke the code in kdc. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23923 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-21Moved plugin initialization into krb5int_lib_init from the applications. (It ↵Zhanna Tsitkov16-76/+86
is still needed in the appl, e.g. t_prng, where krb5 lib is not initialized). Make check works until it reaches ./t_gssapi.py git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23915 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-14renamed factory_handle typeZhanna Tsitkov5-12/+12
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23904 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-14Add missing filesZhanna Tsitkov4-4/+267
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23903 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-14New plugin architecture code - first draft.Zhanna Tsitkov59-243/+1283
This design provides the following advantages: 1. Simple and clear additions of new plugin APIs and new implementations of the existing plugins 2. Handle both static and dynamic plugins 3. Handle two types of plugins: Listener and Service 4. Uniform way to supply parameters for plugin configuration 5. Possible versioning of configuration 6. Potentially, configuration file may contain hash values for the library validity verification 7. Tables of functions are created during make. It was tested by implementing yarrow as PRNG plugin. (There is also a bogus plugin_prng_os implementation which uses system rand calls just for the demonstration purpose) t_prng and all other tests in crypto_tests work (need to run "make check" from crypto_tests dir) This particular version suggests using plugin configuration file in yaml format. It can be alternated by hardcoded or any other configuration. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23902 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-13Branch for new plugin architecture workTom Yu0-0/+0
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23889 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-13Branch to host a new plugins architecture workZhanna Tsitkov0-0/+0
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/plugins@23887 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-08Remove krb5int_send_tgs(); it is unused as of r23358Greg Hudson3-90/+3
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23881 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-08Add krb5_cc_dup() to make it possible to copy ccache handlesGreg Hudson2-0/+13
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23874 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-08Assume lstat in Unix code, specifically clients/ksu/ccache.c. Fix badGreg Hudson2-101/+93
indentation caused by an #ifdef HAVE_LSTAT block. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23870 dc483132-0cff-0310-8789-dd5450dbe970
2010-04-04In testrealm.py, add ksu and kvno to the list of build directoriesGreg Hudson1-1/+3
containing programs. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23858 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-29Fix backwards flag output in krb5_init_creds_step()Greg Hudson1-2/+2
krb5_init_creds_step() is taken from Heimdal, which sets *flags to 1 for "continue" and 0 for "stop". Unfortunately, we got it backwards in 1.8; fix it for 1.8.1. ticket: 6693 tags: pullup target_version: 1.8.1 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23844 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-27Always pass -W option to kdb5_util create in testingKen Raeburn4-5/+5
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23838 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-26In gc_frm_kdc.c, rename cur_kdc to cur_realm and nxt_kdc to nxt_realm,Greg Hudson1-67/+70
to make it easier to distinguish them from cur_tgt and nxt_tgt. Make similar name changes to lst_kdc and kdc_list, as well as the function find_nxt_kdc(). No functional changes. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23837 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-25Straighten the if-ladder in encrypted challenge's process_preauth,Greg Hudson1-7/+6
making it clearer that control drops through if one of the first couple of steps fails. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23836 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-23Apply patch from Arlene Berry to not use freed memory inTom Yu1-1/+2
gss_import_sec_context in some error paths. ticket: 6678 target_version: 1.8.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23834 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-23MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGOTom Yu1-22/+16
The SPNEGO implementation in krb5-1.7 and later could crash due to assertion failure when receiving some sorts of invalid GSS-API tokens. ticket: 6690 target_version: 1.8.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23832 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-23Include t_spengno.o in list of OBJS so make clean will removeEzra Peisach1-1/+1
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23831 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-23krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSXTom Yu2-11/+13
Move krb5_typed_data to krb5.hin from k5-int-pkinit.h because krb5int_fast_process_error was assuming that it was safe to cast it to krb5_pa_data. It's not safe to do the cast on 64-bit MacOSX because krb5.hin uses #pragma pack on that platform. ticket: 6689 target_version: 1.8.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23829 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-20Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512Greg Hudson1-1/+1
KRB5_AUTHDATA_SIGNTICKET, originally a Heimdal authorization data type, was used to implement PAC-less constrained delegation in krb5 1.8. Unfortunately, it was found that Microsoft was using 142 for other purposes, which could result in a ticket issued by an MIT or Heimdal KDC being rejected by a Windows Server 2008 R2 application server. Because KRB5_AUTHDATA_SIGNTICKET is only used to communicate among a realm's KDCs, it is relatively easy to change the number, so MIT and Heimdal are both migrating to a new number. This change will cause a transitional interoperability issue when a realm mixes MIT krb5 1.8 (or Heimdal 1.3.1) KDCs with MIT krb5 1.8.1 (or Heimdal 1.3.2) KDCs, but only for constrained delegation evidence tickets. ticket: 6687 target_version: 1.8.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23821 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-19Document the ticket_lifetime libdefaults setting (which was added inGreg Hudson2-7/+9
r16656, #2656). Based on a patch from nalin@redhat.com. ticket: 6680 target_version: 1.8.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23820 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-18Fix the kpasswd fallback from the ccache principal name to theGreg Hudson1-7/+11
username in the case where the ccache doesn't exist. ticket: 6683 target_version: 1.8.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23819 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-18Include int-proto.h in mk_req_ext.c for krb5int_validate_timesGreg Hudson1-0/+1
declaration. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23818 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-18UntabifyKen Raeburn1-6/+6
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23817 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-18Copyright noticeKen Raeburn1-1/+29
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23816 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-17When checking for KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT, don'tGreg Hudson1-1/+1
dereference options if it's NULL. ticket: 6681 target_version: 1.8.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23815 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-17Add more verbosity when the -V option to kinit is specified. Based onGreg Hudson1-0/+21
a patch from Jeff Blaine <jblaine@kickflop.net>. ticket: 6684 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23814 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-17Fix the Python version check to use constructs available in olderGreg Hudson1-10/+4
versions of Python. (python --version was added in 2.5.) git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23813 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-17Add a version check to the Python test, so that we don't try to runGreg Hudson1-2/+11
k5test in Python 2.3 or below. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23812 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-17Merge users/raeburn/branches/network-mergeKen Raeburn20-2066/+473
Re-integrates the forked versions of network.c in kdc and kadmin/server. Server-specific initialization and SIGHUP-reset code is moved into other source files; the more generic network-servicing code is merged and moved into apputils library already used by both programs. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23811 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-16handle NT_SRV_INST in service principal referralsTom Yu1-0/+1
Handle NT_SRV_INST in service principal cross-realm referrals, as Windows apparently uses that instead of NT_SRV_HST for at least some service principals. ticket: 6685 target_version: 1.8.1 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23810 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-15Set up KRB5_RUN_ENV for pytests, so that Python-based tests can runTom Yu3-2/+7
without first running "make install". git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23805 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-11Lazy history key creationGreg Hudson2-60/+37
Create kadmin/history lazily when we need it (i.e. when a password is changed on a principal with a policy) instead of whenever we open the database. Allows kadmin.local to be used as a read-only tool on non- kadmin-conformant database back ends such as the Samba bridge. ticket: 6679 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23799 dc483132-0cff-0310-8789-dd5450dbe970
2010-03-10Use KRB5_CONF_ macros instead of strings in the source file for profile ↵Zhanna Tsitkov2-6/+8
config attributes "default" and "logging" git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23798 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit v1.1 at 2024-08-01 07:15:20 +0000