aboutsummaryrefslogtreecommitdiff
path: root/src/kdc
AgeCommit message (Collapse)AuthorFilesLines
2003-05-24make-depend updatesKen Raeburn1-34/+34
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15490 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-24When generating etype_info2 for DES style keys, use s2kparams toSam Hartman2-10/+37
communicate the type if the key has afs3 salt. If such s2kparams are received by the client, use the afs string2key function to process the key. Ticket: 1512 Tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15489 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-23Memory leak in kdc etype_info2 preauthEzra Peisach2-2/+14
* kdc_preauth.c (return_etype_info2): After encoding the etype_info2 and copying the pointers to the pa_data, free the krb5_data pointer. Ticket: new Target_Version: 1.3 Tags: pickup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15483 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-22Log transited checkd not done as info not errorSam Hartman2-1/+3
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15468 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-22Provide an explicit list of options not to be allowed in AS requestsSam Hartman2-5/+10
rather than disallowing all unknown options. Ticket: 1202 Tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15467 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-14Allow the KDC to return bad integrity errors to the client on preauthSam Hartman2-0/+5
failure. This will be translated by the client into password incorrect. Ticket: 1488 Target_Version: 1.3 Tags: pullup Component: krb5-kdc git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15439 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-12* IMplement etype_info in KDC. If the request contains any newSam Hartman2-4/+139
enctypes (currently AES but anything not explicitly listed as old) then only etype_info2 is sent back in response. Send back etype_info2 all the time. Also send back etype_info2 to provide salt and s2kparams with AS reply not just for preauth errors. * Expose interface for getting string2key with parameters (previously implemented but not exported) * IN the client (at least for get_init_creds interface) prfer etype_info2 to etype_info and pw_salt. Pass s2kparams and use string2key_with_params. Ticket: 1454 Status: open Target_Version: 1.3 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15412 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-10Rename the local_subkey and remote_subkey fields in the auth_contextTom Yu2-2/+7
to send_subkey and recv_subkey, respectively. Add new APIs to query and set these fields. Change the behavior of mk_req_ext, rd_req_dec, and rd_rep to set both subkeys. Applications wanting to set unidirectional subkeys may still do so by saving the values of subkeys and doing overrides. Cause mk_cred, mk_priv, and mk_safe to never use the recv_subkey. Cause rd_cred, rd_priv, and rd_safe to never use the send_subkey. ticket: 1415 status: open tags: pullup target_version: 1.3 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15407 dc483132-0cff-0310-8789-dd5450dbe970
2003-05-07Reorganize kdc_preauth enctype handlingSam Hartman2-39/+81
Patch from Sun to reorganize and better abstract kdc_preauth.c's enctype info handling. This will make it easier to implement etype_info2 so I'm committing it. Ticket: new Target_Version: 1.3 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15400 dc483132-0cff-0310-8789-dd5450dbe970
2003-04-09etype info handling infinite loopSam Hartman2-2/+9
If a request contains no des-cbc-crc enctype bumt des-cbc-crc or des-cbc-md5 existis in the database then an infinite loop is created. Fix etype info handling to avoid this. ticket: new Tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15332 dc483132-0cff-0310-8789-dd5450dbe970
2003-04-01Red Hat's krb5_princ_size fixesKen Raeburn3-3/+12
ticket: 1397 status: open tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15312 dc483132-0cff-0310-8789-dd5450dbe970
2003-03-28 * kdc_preauth.c (verify_enc_timestamp): Save decryption error, inTom Yu2-1/+20
case we get NO_MATCHING_KEY later. This allows us to log a more sane error if an incorrect password is used for encrypting the enc-timestamp preauth. ticket: 1324 status: open target_version: 1.3 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15306 dc483132-0cff-0310-8789-dd5450dbe970
2003-03-17Disable krb4 cross-realm in krb524d and krb5kdc. Provide an option toSam Hartman4-46/+106
reenable (-X) which prints a warning that you are creating a security hole. Remove support for generating krb4 tickets encrypted using 3DES service keys as it is insecure. They are still accepted however. The KDc is much more strict about accepting only tickets that it would have issued in the current configuration. In particular if the KDC would choose some enctype for writing a TGT, other enctypes will not be accepted when using a TGT. Ticket: 1385 Target_Version: 1.3 Tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15286 dc483132-0cff-0310-8789-dd5450dbe970
2003-03-06use kdb keytab for kadmindTom Yu2-1/+5
kadmind previously required a file-based keytab to support its use of gssapi. For ease of administration, a kdb-based keytab would be beneficial. This commit includes changes to the kdb library to support this goal, as well as actual changes in the kadmind itself. ticket: new git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15237 dc483132-0cff-0310-8789-dd5450dbe970
2003-03-05* configure.in: Default to --disable-fakekaKen Raeburn2-1/+5
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15221 dc483132-0cff-0310-8789-dd5450dbe970
2003-02-21Fix typo that caused infinite loop in previous patchSam Hartman2-1/+6
Ticket: 1006 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15195 dc483132-0cff-0310-8789-dd5450dbe970
2003-02-15The client sorts the enctype list returned by etype_info orderingSam Hartman2-1/+26
enctypes that it requested or that are similar to ones it requested first. The KDC only includes enctypes in etype_info if they were requested by the client. ticket: 1006 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15191 dc483132-0cff-0310-8789-dd5450dbe970
2003-02-06Sorry, forgot this ChangeLog on the last commitKen Hornstein1-0/+5
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15161 dc483132-0cff-0310-8789-dd5450dbe970
2003-02-06This is the integration of "fakeka" (a program to emulate a kaserver)Ken Hornstein3-1/+1411
into the MIT distribution. It's compilation is enabled with --enable-fakeka. ticket: 1281 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15158 dc483132-0cff-0310-8789-dd5450dbe970
2003-02-04disable krb4 by defaultSam Hartman3-2/+9
By default, we disable krb4 in the KDC. This means that -4 none is the default mode. Krb4 is reenabled for the dejagnu tests. ticket: new Tags: enhancement git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15149 dc483132-0cff-0310-8789-dd5450dbe970
2003-01-21Timestamp preauth should return clock skew errorsSam Hartman2-1/+13
When the user supplies the correct password, but has a timestamp that is out of bounds, the server should reply with a clock skew error rather than a preauth required error. ticket: new Tags: enhancement git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15130 dc483132-0cff-0310-8789-dd5450dbe970
2003-01-12 * kdc_util.h, replay.c, main.c: Pass global krb5_context toEzra Peisach4-7/+13
kdc_free_lookaside() instead of per realm one - which has been freed by time invoked. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15113 dc483132-0cff-0310-8789-dd5450dbe970
2003-01-03 * main.c: On exit, free more allocated memory, including:Ezra Peisach6-4/+55
realm_tcp_ports data, kdc_realmlist, close the replay cache, and free the lookaside cache. * network.c (FREE_SET_DATA): Do not free a NULL pointer. * replay.c, kdc_util.h: Add kdc_free_lookaside() to clear the lookaside cache on shutdown - to search for memory leaks. * rtest.c (main): Do not allocate or free a NULL pointer. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15080 dc483132-0cff-0310-8789-dd5450dbe970
2002-12-30* kerberos_v4.c (process_v4): Use a temporary variable for the current timeKen Raeburn2-1/+9
instead of an incorrect pointer cast. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15072 dc483132-0cff-0310-8789-dd5450dbe970
2002-12-23Replace dependencies on generated krb524 and krb4 headers withTom Yu1-1/+1
variables, to allow correct behavior when krb4 is disabled. ticket: 1276 owner: tlyu git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15070 dc483132-0cff-0310-8789-dd5450dbe970
2002-12-12More KfM merge workTom Yu2-1/+6
Create new file FSp-glue.c including KfM functions that had previously been scattered through various other files. Port RealmsConfig-glue.c from KfM, including old Unix-ish krb4 configuration code as fallback. Remove other files containing old realm/config file support. Add KRB5_CALLCONV to krb_get_in_tkt_creds. Fix various functions to take const char* as arguments now that tkt_string() returns const. Assorted minor cleanup. Implement krb_get_err_text in terms of com_err. Implement gross kludge to force krb_err_txt to remain in sync with com_err. ticket: 1189 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15046 dc483132-0cff-0310-8789-dd5450dbe970
2002-11-27Merge more KfM krb4 thingsTom Yu3-2/+15
Implement *_in_tkt_creds, mk_req_creds, and rd_req_int functions. Implement KfM krb4 kadm password changing, mostly by pulling in the client side of the kadm library into the krb4 library. Do some more header file cleanup of des.h and krb.h. Remove some ancient krb4 dead weight. Some Mac-specific functionality still needs to be merged. ticket: 1189 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15014 dc483132-0cff-0310-8789-dd5450dbe970
2002-11-04 * do_as_req.c (process_as_req): Fix previous patch; it caused anTom Yu2-1/+7
uninitialized pointer to be dereferenced under certain error conditions. ticket: 1206 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14964 dc483132-0cff-0310-8789-dd5450dbe970
2002-10-28Don't include trailing null in the transited encoding produced by the KDC.Sam Hartman2-2/+6
Other routines do not expect the null to be included in the length so policy checks fail. Also, sending the null over the wire is wrong. ticket: 1230 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14940 dc483132-0cff-0310-8789-dd5450dbe970
2002-10-06 * do_as_req.c (process_as_req): Apply fix from Kevin Coffman toTom Yu2-1/+9
avoid leaking padata. ticket: 1206 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14910 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-27Limit the number of TCP connections that will be handled at one time.Ken Raeburn2-55/+82
Remove some debugging calls. * network.c (struct connection): New field start_time. (tcp_data_counter, max_tcp_data_connections): New variables. (kill_tcp_connection): New function. (process_tcp_connection): Use it. Log reason for rejecting connection if the requested buffer size is too large. (accept_tcp_connection): If there are too many TCP connections already, shut down the oldest one. (setup_network, listen_and_process, process_tcp_connection, service_conn): Delete debugging code. (process_packet): Use socklen_t where appropriate. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14903 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-19updated dependenciesKen Raeburn1-2/+3
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14889 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-19* network.c: Include sys/filio.h if availableKen Raeburn2-0/+6
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14888 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-19Add TCP support to the KDC, turned off by default, and using separateKen Raeburn4-145/+864
config file entries to indicate port numbers. Checkpointing a working version; debug code needs cleanup, doc needs writing. ticket: 1175 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14885 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-19* main.c (DEFAULT_KDC_PORTLIST): Define as DEFAULT_KDC_UDP_PORTLISTKen Raeburn2-0/+6
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14880 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-15 * kerberos_v4.c (check_princ): Call strftime() with correct numberTom Yu2-1/+7
of arguments. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14869 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-15* kerberos_v4.c: Always include stdarg.h, not varargs.h.Ken Raeburn2-44/+14
(v4_klog): Always declare and define stdarg version. (krb4_stime): Deleted. (check_princ): Use strftime instead. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14865 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-13* kerberos_v4.c (kerb_get_principal): Include kvno when logging failure to findKen Raeburn2-5/+10
a key. (v4_klog): Include explicit do-nothing default case in switch statement. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14849 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-13* main.c (initialize_realms): Include replay cache name in error if it can't ↵Ken Raeburn2-1/+7
be initialized git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14848 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-11protoizeKen Raeburn12-292/+131
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14841 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-11Try a little harder to avoid returning e-text that says "Generic error (seeKen Raeburn3-25/+31
e-text)" for out-of-range codes where we haven't explicitly decided to return a vague error message. * do_as_req.c (prepare_error_as): New argument, the error message text as determined *before* possibly replacing the error code with "generic error". (process_as_req): Fill it in based on 'status', or the error message corresponding to the error code to be returned. * do_tgs_req.c (prepare_error_tgs): New argument, the error message text as determined *before* possibly replacing the error code with "generic error". (process_tgs_req): Fill it in based on 'status', or the error message corresponding to the error code to be returned. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14835 dc483132-0cff-0310-8789-dd5450dbe970
2002-09-10* network.c (process_packet): Call inet_ntop directly.Ken Raeburn4-122/+12
* sock2p.c: Deleted. * Makefile.in (SRCS, OBJS): Drop it. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14834 dc483132-0cff-0310-8789-dd5450dbe970
2002-08-29update dependenciesKen Raeburn1-12/+20
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14791 dc483132-0cff-0310-8789-dd5450dbe970
2002-08-29Ignore a bunch of files generated by building in the source tree, excludingKen Raeburn1-0/+5
those covered by CVSROOT/cvsignore patterns. Static UNIX build only, at the moment, may need updates for other configurations. (Second try; this time, deal with the cases where "cvs add"/"cvs ci" choked on previously deleted versions numbered 5.x.) git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14785 dc483132-0cff-0310-8789-dd5450dbe970
2002-08-23Change $(S)=>/ and $(U)=>.. globallyKen Raeburn2-1/+5
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14761 dc483132-0cff-0310-8789-dd5450dbe970
2002-08-15 * kerberos_v4.c: For consistency, check for both DISALLOW_ALL_TIXTom Yu2-1/+29
and DISALLOW_SVR when looking up services. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14726 dc483132-0cff-0310-8789-dd5450dbe970
2002-08-08* network.c (setup_port): Ignore AF_LINK addresses. Log address family numberKen Raeburn2-1/+11
if unrecognized. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14687 dc483132-0cff-0310-8789-dd5450dbe970
2002-07-06network.c (setup_port): Enable ipv6Ken Raeburn2-3/+2
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14611 dc483132-0cff-0310-8789-dd5450dbe970
2002-07-05update depsKen Raeburn1-4/+7
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14608 dc483132-0cff-0310-8789-dd5450dbe970
2002-07-05* network.c: Include fake-addrinfo.hKen Raeburn2-0/+3
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@14604 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit v1.1 at 2024-09-08 18:31:20 +0000