aboutsummaryrefslogtreecommitdiff
path: root/src/include/krb5
AgeCommit message (Collapse)AuthorFilesLines
2016-06-17Add CAMMAC handling to the authdata frameworkMatt Rogers1-1/+2
Handle CAMMAC contained authdata similarly to KDC-issued authdata, where it is verified before passing to the import function. [ghudson@mit.edu: fix memory leak and reduce copying in extract_cammac()] ticket: 8425
2016-04-27Add krb5_get_init_creds_opt_set_pac_request()Andreas Schneider1-0/+20
Add a new public function to set a PAC request option for an AS request. [ghudson@mit.edu: simplified code; made signature conform to Heimdal function; expanded on doxygen comment; added new function to API reference; changed code to send encoded KERB-PA-PAC-REQUEST instead of a single octet] ticket: 7985
2016-04-06Amend KDC hook documentationGreg Hudson1-19/+27
In the Doxygen comments for the new APIs and types, include @version tags indicating that they are new in 1.15, and put @param declarations just after the brief message for consistency with other comments. ticket: 8386
2016-03-24Add documentation for krb5_error_codeSarah Day1-1/+7
ticket: 8387 (new) target_version: 1.14-next tags: pullup
2016-03-23Add KDC pre-send and post-receive KDC hooksAndreas Schneider1-0/+104
Add two new APIs, krb5_set_kdc_send_hook() and krb5_set_kdc_recv_hook(), which can be used to inspect and override messages sent to KDCs. [ghudson@mit.edu: style and documentation changes] ticket: 8386 (new)
2016-03-09Allow zero cksumtype in krb5_k_verify_checksum()Greg Hudson1-4/+8
A checksum type of 0 means to use the mandatory checksum type in krb5_k_make_checksum(), krb5_k_make_checksum_iov(), and krb5_k_verify_checksum_iov(). Extend this meaning to krb5_k_verify_checksum() for the checksum type in the krb5_checksum argument. This change also applies to krb5_c_verify_checksum(). Add code to t_cksums.c to test checksum verification, including with checksum type 0 for applicable test cases. ticket: 8375 (new)
2015-10-07Accept new passwords as const char pointersAndreas Schneider1-5/+6
In krb5_change_password(), krb5_set_password(), and krb5_set_password_using_ccache(), accept the new password as a const char * instead of a char *. Propagate this change to the necessary internal functions. [ghudson@mit.edu: commit message rewrite] ticket: 8269 (new) target_version: 1.14 tags: pullup
2015-08-26Add secure cookie supportGreg Hudson2-0/+23
Remove the existing support for creating trivial cookies. Add new functions to fast_util.c for reading and generating secure cookies. Add new kdcpreauth callbacks "get_cookie" and "set_cookie" to allow preauth mechs to retrieve and set cookie values. Based on a patch by Nathaniel McCallum. ticket: 8233 (new)
2015-08-11Fix new doxygen parameter listsGreg Hudson1-3/+3
Use [out] instead of [in] for the output parameters of krb5_c_prfplus() and krb5_c_derive_prfplus(). Also use "out" instead of "output" for krb5_c_derive_prfplus() to match the parameter name in the definition. ticket: 8228
2015-08-09Add krb5_c_prfplus() and krb5_c_derive_prfplus()Nathaniel McCallum1-0/+42
This commit permits the external use of the RFC 6113 PRF+ function. It also adds a function to derive a key from an input key and string using PRF+. [ghudson@mit.edu: adjust style; avoid new C99isms; use string2data(), empty_data(), and alloc_data() where appropriate; add some explanatory comments; edit docstrings and commit message] ticket: 8228 (new)
2015-07-22Add kdcpreauth callback for auth indicatorsGreg Hudson1-0/+6
Add a new kdcpreauth callback add_auth_indicator, which adds an authentication indicator string. This commit doesn't do anything with the asserted authentication indicators; they are tracked in the auth_indicators field of struct as_req_state to be used later. ticket: 8157
2015-07-22Add constants for CAMMAC and auth-indicatorGreg Hudson1-0/+3
ticket: 8157
2015-07-08Add client_keyblock kdcpreauth callbackGreg Hudson1-1/+14
Add a new kdcpreauth callback which gets the selected client key. This callback can be used by preauth mechs which need to use the singular reply key in a challenge sent by the KDC, now that we send only one etype-info entry in PREAUTH_REQUIRED errors. ticket: 8200 (new)
2015-07-06Add rename method to kadm5_hookGreg Hudson1-0/+11
Bump the minor version of the kadm5_hook interface to 2 and add a rename method. Invoke the rename method in kadm5_rename_principal() like we do for other libkadm5srv operations. Partly based on a patch from John Hascall. ticket: 8171
2015-06-15Rename krbtgt variable in KDC codeGreg Hudson1-2/+3
In a TGS request, the header ticket server is usually a local or cross-realm TGS principal, but for ticket modification requests it doesn't have to be. Similarly, the server for an AS request is usually a krbtgt principal, but in some cases it is not. Since the KDC code must consider all possibilities, avoid using the name "krbtgt" for entries which aren't necessarily TGTs. In process_tgs_req(), rename krbtgt to header_server and tgskey to header_key. In handle_authdata(), rename the parameters similarly and pass NULL from process_as_req() for the header_server and header_key parameters; the code which uses those parameters is adjusted to match. In validate_transit_path(), rename krbtgt to header_srv. Do not change the semantics of the sign_authdata DAL method at this time, but more accurately document the krbtgt and krbtgt_key parameters.
2015-06-15Use new KDC authdata interface in kdc_authdata.cGreg Hudson1-113/+0
Remove the server authdata interface declarations from authdata.h and the code to load and invoke old KDC authdata modules. Add code to load and invoke authdata modules using the new kdcauthdata pluggable interface.
2015-06-15Add declarations for new KDC authdata interfaceGreg Hudson1-0/+128
Add a pluggable interface for KDC authdata using the current plugin infrastructure, mirroring the KDC functionality of authdata_plugin.h. Like the old interface, this one isn't yet public.
2015-01-26Fix const correctness on krb5_c_fx_cf2_simple()Nathaniel McCallum1-2/+2
libk5crypto functions generally use "const krb5_keyblock *" for input keyblocks. Do this in krb5_c_fx_cf2_simple() for caller convenience. [ghudson@mit.edu: expanded commit message] ticket: 8062 (new)
2014-12-07Add new error message wrapping APIsNicolas Williams1-0/+79
Add four new public APIs for wrapping error messages: krb5_prepend_error_message, krb5_vprepend_error_message, krb5_wrap_error_message, and krb5_vwrap_error_message. The first two functions are from Heimdal and allow a prefix to be added to the existing message for a code. The latter two functions also allow the code to be changed. [ghudson@mit.edu: rename krb5_prepend_error_message2 to krb5_wrap_error_message; clarify doxygen comments and put them in the proper form; implement krb5_prepend_error_message in terms of krb5_wrap_error_message; fix leak and null context handling in krb5_wrap_error_message; rewrite commit message] ticket: 8046 (new)
2014-11-03Remove KRB5_TC_OPENCLOSE handling in FILE ccacheGreg Hudson1-1/+1
Stop processing the KRB5_TC_OPENCLOSE flag in cc_file.c; always reopen the file instead. This will be replaced with more efficient cursor handling. Also remove some unused KRB5_TC_OPENCLOSE macros in scc.h.
2014-10-14Fix typo in doc for krb5_get_init_creds_keytab()Tom Yu1-1/+1
ticket: 7880 target_version: 1.13.1 tags: pullup
2014-02-26Assume <stdint.h> and fixed-width typesGreg Hudson1-24/+6
Make unconditional use of <stdint.h> and fixed-width types such as uint32_t. k5-plugin.h doesn't use any special integer types, so remove the conditional include block there. Nothing uses INT64_FMT/UINT64_FMT, so leave those out of k5-platform.h for now.
2013-11-22Improve default ccache name API documentationGreg Hudson1-6/+25
Document the lifetime and caching behavior of the krb5_cc_default_name() return value. Document that krb5_cc_set_default_name() may be called with NULL to purge the cached value. Correct a typo in the krb5_cc_default() summary and explicitly reference krb5_cc_default_name(). ticket: 7775 (new) target_version: 1.12 tags: pullup
2013-10-04KDC Audit infrastructure and plugin implementationZhanna Tsitkov1-0/+270
Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
2013-09-18Correct comments in ccselect_plugin.hZhanna Tsitkov1-3/+3
Some text mistakenly referred to password quality plugin.
2013-08-15Add hostrealm pluggable interface definitionGreg Hudson1-0/+135
ticket: 7687 (new)
2013-07-17Add non-JSON APIs for PKINIT responder itemsNalin Dahyabhai1-0/+59
Add wrappers for the JSON-oriented APIs for PKINIT responder items, modeled after the API we provide for OTP items: * krb5_responder_pkinit_get_challenge() returns the list of identities for which we need PINs * krb5_responder_pkinit_challenge_free() frees the structure that was returned by krb5_responder_pkinit_get_challenge() * krb5_responder_pkinit_set_answer() sets the answer to the PIN for one of the identities [ghudson@mit.edu: style cleanup; added comment pointing to main body of PKINIT module] ticket: 7680
2013-07-17Pass PKINIT identity prompts to the responder cbNalin Dahyabhai1-0/+44
Use the list of deferred identity prompts and warnings, which we have after calling pkinit_identity_initialize(), to build a list of questions to supply to responder callbacks. Before calling pkinit_identity_prompt() to actually load identities that are protected, save any passwords and PINs which a responder callback may have supplied. Because pkinit_client_prep_questions() can be called multiple times, and we don't want to try to load all of our identities each of those times, take some steps to ensure that we only call pkinit_identity_initialize() and pkinit_identity_prompt() once per request. ticket: 7680
2013-05-22Clarify krb5_rd_req documentationGreg Hudson1-9/+19
For the user-to-user case, document that callers should pass a server principal to krb5_rd_req. For the keytab case, more accurately document which keytab keys are tried against the ticket. ticket: 7641 (new) target_version: 1.11.3 tags: pullup
2013-05-03Add kdcpreauth callback to check for client keysGreg Hudson1-0/+8
Add a new have_client_keys callback to the kdcpreauth interface, allowing modules to efficiently check whether the client DB entry has any keys matching the request enctypes. ticket: 7630
2013-04-18Add a few comments to `PADATA types` in krb5.hinZhanna Tsitkov1-27/+28
Mostly, based on http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml
2013-04-18Use macro for IANA assigned PA-AS-CHECKSUM numberZhanna Tsitkov1-0/+1
Replace numeric value '132' by the macro KRB5_PADATA_AS_CHECKSUM in preauth plugin.
2013-04-01Add krb5_kt_dup API and use it in two placesGreg Hudson1-0/+15
Add an API to duplicate keytab handles, mirroring krb5_cc_dup. Use it to simplify the krb5 GSS acquire_cred code. ticket: 7599 (new)
2013-03-25Replace "First introduced" with concise "New"Zhanna Tsitkov1-37/+37
2013-03-11Remove stray include in localauth_plugin.hGreg Hudson1-1/+0
This unnecessary include was causing build failures on some systems by making libkrb5 sources depend on gssapi.h.
2013-03-09Add localauth pluggable interfaceGreg Hudson1-0/+139
Add a new pluggable interface for local authorization, and replace the existing krb5_aname_to_localname and krb5_kuserok implementations with implementations based on the pluggable interface. ticket: 7583 (new)
2013-02-27Add krb5_free_enctypes APIGreg Hudson1-0/+13
Rename krb5_free_ktypes to krb5_free_enctypes and add it to the public API. ticket: 7584
2013-01-14Correct typo in krb5_responder_context_st descrZhanna Tsitkov1-3/+4
responder_get_challenge() meant to be krb5_responder_get_challenge()
2013-01-11Flesh out responder context doxygen markupGreg Hudson1-0/+30
2013-01-11Use [out] more sparingly in doxygen markupGreg Hudson1-107/+107
In krb5.hin doxygen markup, only use [out] or [in,out] when a function changes the entire value of what the parameter points to, not when the function mutates a larger object (especially an abstract object). Also remove a couple of incorrect [in] annotations, change a few parameter descriptions to be more consistent, and fix one typo.
2013-01-11Better doxygen markup for RESPONDER_QUESTION_OTPZhanna Tsitkov1-21/+23
Doxygen and, consequently, Sphinx gets confused with the KRB5_RESPONDER_QUESTION_OTP comment layout. Also, mark the output parameter of krb5_responder_set_answer().
2012-12-19Make clpreauth flags function optionalGreg Hudson1-3/+5
With one exception (KRB5_PADATA_PKINIT_KX), every padata type processed by a clpreauth module is now a real preauthentication type. Reduce the amount of boilerplate required for a clpreauth module by making the flags method optional if all of the preauth types advertised by the module are real.
2012-12-19Separate clpreauth and kdcpreauth interfacesGreg Hudson3-597/+678
Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
2012-12-11Update comments for RFC 3244 kpasswd extensionsBen Kaduk1-3/+4
Remove the inaccurate comments "unused" and replace them with more useful representations of what they mean. ticket: 7490 (new) tags: pullup target_version: 1.11
2012-11-30Document key usage assigned number conflictZhanna Tsitkov1-11/+10
Document the fact that the key usage type 26 is used by both KBKRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST and KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST, while 27 - by KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY and KRB5_KEYUSAGE_PA_SAM_RESPONSE. Also, since KRB5_KEYUSAGE_PA_REFERRAL is not actually used in MIT Kerberos code and is not defined in the latest referrals draft (http://tools.ietf.org/html/draft-ietf-krb-wg-kerberos-referrals-15) mark it as "unused". ticket: 7474 tags: pullup target_version: 1.11
2012-11-27Update doxygen markup in krb5.hinBen Kaduk1-20/+20
A few places were using the standard C /* comment */ form, but this is rendered poorly by doxygen through to our Sphinx bridge. Use the special /**< comment */ form to get doxygen-specific behavior. If the standard C comment form is used, the full comment (including start and end markers) is included in the value of the macro, and Sphinx then tries to treat the end of the comment as the start of inline markup with no corresponding end-string, which is a warning. Using the doxygen form of the comment, the contents of the comment are put in a separate paragraph block, which is inserted in the body of the generated RST document. The markup for krb5_rd_priv() had a line that ended with an @c markup statement without a symbol following it. This confused doxygen into not parsing any more of the comment. The beginning of the next line is a macro identifier with markup to auto-linkify it. In RST, it is not possible to have a link and a terminal font on the same text, so removing the @c is the appropriate fix. There are also eleven deprecated functions which are replaced by the krb5_c_* family of functions. However, referring to this class of functions as the "krb5_c_" class of functions results in Sphinx attempting to interpret this statement as a link to a label elsewhere in the document, and no such label exists. To avoid this warning, use "krb5_c_*" to refer to the class of functions, which is arguably more correct anyways. ticket: 7447 tags: pullup target_version: 1.11
2012-11-27Make krb5_trace_info a typedefBen Kaduk1-5/+11
Our doxygen-to-sphinx documentation bridge only processes typedefs and not structure definitions, since we almost universally use typedefs for our data structures. krb5_trace_info is the sole exception, so bring it into the fold. While here, flesh out the comment a bit more. ticket: 7447 tags: pullup target_version: 1.11
2012-11-26Document krb5_get_init_creds_opt_set_in_ccacheZhanna Tsitkov1-0/+2
More specifically, document that this new API was first introduced in 1.11 ticket: 7460
2012-11-20Reword krb5_unparse_name_ext doxygen markupGreg Hudson1-5/+6
Avoid using asterix characters in the documentation for krb5_unparse_ext_name, since they get intepreted as markdown punctuation when translated to RST. ticket: 7452 (new) target_version: 1.11 tags: pullup
2012-11-16Add Doxygen markup for Camellia enctype constantsGreg Hudson1-4/+4
An RFC number has been assigned for the Camellia draft. Add Doxygen markup to the enctype and cksumtype constants pointing to the informational RFC.
generated by cgit v1.1 at 2024-08-02 22:51:13 +0000