r23456: Update Samba4 to current lorikeet-heimdal.
authorAndrew Bartlett <abartlet@samba.org>
Wed, 13 Jun 2007 05:44:24 +0000 (05:44 +0000)
committerGerald (Jerry) Carter <jerry@samba.org>
Wed, 10 Oct 2007 19:53:18 +0000 (14:53 -0500)
Andrew Bartlett
(This used to be commit ae0f81ab235c72cceb120bcdeb051a483cf3cc4f)

454 files changed:
source4/heimdal/kdc/524.c
source4/heimdal/kdc/default_config.c
source4/heimdal/kdc/digest.c
source4/heimdal/kdc/headers.h
source4/heimdal/kdc/kaserver.c
source4/heimdal/kdc/kdc-private.h
source4/heimdal/kdc/kdc-protos.h
source4/heimdal/kdc/kdc.h
source4/heimdal/kdc/kdc_locl.h
source4/heimdal/kdc/kerberos4.c
source4/heimdal/kdc/kerberos5.c
source4/heimdal/kdc/krb5tgs.c
source4/heimdal/kdc/kx509.c
source4/heimdal/kdc/log.c
source4/heimdal/kdc/misc.c
source4/heimdal/kdc/pkinit.c
source4/heimdal/kdc/process.c
source4/heimdal/kdc/rx.h
source4/heimdal/kdc/windc.c
source4/heimdal/kdc/windc_plugin.h
source4/heimdal/kuser/kinit.c
source4/heimdal/kuser/kuser_locl.h
source4/heimdal/lib/asn1/CMS.asn1
source4/heimdal/lib/asn1/asn1-common.h
source4/heimdal/lib/asn1/asn1_err.et
source4/heimdal/lib/asn1/asn1_gen.c
source4/heimdal/lib/asn1/asn1_queue.h
source4/heimdal/lib/asn1/canthandle.asn1
source4/heimdal/lib/asn1/der.c
source4/heimdal/lib/asn1/der.h
source4/heimdal/lib/asn1/der_copy.c
source4/heimdal/lib/asn1/der_format.c
source4/heimdal/lib/asn1/der_free.c
source4/heimdal/lib/asn1/der_get.c
source4/heimdal/lib/asn1/der_length.c
source4/heimdal/lib/asn1/der_locl.h
source4/heimdal/lib/asn1/der_put.c
source4/heimdal/lib/asn1/digest.asn1
source4/heimdal/lib/asn1/extra.c
source4/heimdal/lib/asn1/gen.c
source4/heimdal/lib/asn1/gen_copy.c
source4/heimdal/lib/asn1/gen_decode.c
source4/heimdal/lib/asn1/gen_encode.c
source4/heimdal/lib/asn1/gen_free.c
source4/heimdal/lib/asn1/gen_glue.c
source4/heimdal/lib/asn1/gen_length.c
source4/heimdal/lib/asn1/gen_locl.h
source4/heimdal/lib/asn1/gen_seq.c
source4/heimdal/lib/asn1/hash.c
source4/heimdal/lib/asn1/hash.h
source4/heimdal/lib/asn1/k5.asn1
source4/heimdal/lib/asn1/kx509.asn1
source4/heimdal/lib/asn1/lex.c
source4/heimdal/lib/asn1/lex.h
source4/heimdal/lib/asn1/libasn1.h
source4/heimdal/lib/asn1/main.c
source4/heimdal/lib/asn1/parse.c
source4/heimdal/lib/asn1/parse.h
source4/heimdal/lib/asn1/pkcs12.asn1
source4/heimdal/lib/asn1/pkcs8.asn1
source4/heimdal/lib/asn1/pkcs9.asn1
source4/heimdal/lib/asn1/pkinit.asn1
source4/heimdal/lib/asn1/rfc2459.asn1
source4/heimdal/lib/asn1/symbol.c
source4/heimdal/lib/asn1/symbol.h
source4/heimdal/lib/asn1/test.asn1
source4/heimdal/lib/asn1/timegm.c
source4/heimdal/lib/com_err/com_err.c
source4/heimdal/lib/com_err/com_err.h
source4/heimdal/lib/com_err/com_right.h
source4/heimdal/lib/com_err/compile_et.c
source4/heimdal/lib/com_err/compile_et.h
source4/heimdal/lib/com_err/error.c
source4/heimdal/lib/com_err/lex.c
source4/heimdal/lib/com_err/lex.h
source4/heimdal/lib/com_err/parse.c
source4/heimdal/lib/com_err/parse.h
source4/heimdal/lib/gssapi/gssapi/gssapi.h
source4/heimdal/lib/gssapi/gssapi/gssapi_krb5.h
source4/heimdal/lib/gssapi/gssapi/gssapi_spnego.h
source4/heimdal/lib/gssapi/gssapi_mech.h
source4/heimdal/lib/gssapi/krb5/8003.c
source4/heimdal/lib/gssapi/krb5/accept_sec_context.c
source4/heimdal/lib/gssapi/krb5/acquire_cred.c
source4/heimdal/lib/gssapi/krb5/add_cred.c
source4/heimdal/lib/gssapi/krb5/add_oid_set_member.c [deleted file]
source4/heimdal/lib/gssapi/krb5/arcfour.c
source4/heimdal/lib/gssapi/krb5/canonicalize_name.c
source4/heimdal/lib/gssapi/krb5/cfx.c
source4/heimdal/lib/gssapi/krb5/cfx.h
source4/heimdal/lib/gssapi/krb5/compare_name.c
source4/heimdal/lib/gssapi/krb5/compat.c
source4/heimdal/lib/gssapi/krb5/context_time.c
source4/heimdal/lib/gssapi/krb5/copy_ccache.c
source4/heimdal/lib/gssapi/krb5/create_emtpy_oid_set.c [deleted file]
source4/heimdal/lib/gssapi/krb5/decapsulate.c
source4/heimdal/lib/gssapi/krb5/delete_sec_context.c
source4/heimdal/lib/gssapi/krb5/display_name.c
source4/heimdal/lib/gssapi/krb5/display_status.c
source4/heimdal/lib/gssapi/krb5/duplicate_name.c
source4/heimdal/lib/gssapi/krb5/encapsulate.c
source4/heimdal/lib/gssapi/krb5/export_name.c
source4/heimdal/lib/gssapi/krb5/export_sec_context.c
source4/heimdal/lib/gssapi/krb5/external.c
source4/heimdal/lib/gssapi/krb5/get_mic.c
source4/heimdal/lib/gssapi/krb5/gkrb5_err.et
source4/heimdal/lib/gssapi/krb5/gsskrb5-private.h
source4/heimdal/lib/gssapi/krb5/gsskrb5_locl.h
source4/heimdal/lib/gssapi/krb5/import_name.c
source4/heimdal/lib/gssapi/krb5/import_sec_context.c
source4/heimdal/lib/gssapi/krb5/indicate_mechs.c
source4/heimdal/lib/gssapi/krb5/init.c
source4/heimdal/lib/gssapi/krb5/init_sec_context.c
source4/heimdal/lib/gssapi/krb5/inquire_context.c
source4/heimdal/lib/gssapi/krb5/inquire_cred.c
source4/heimdal/lib/gssapi/krb5/inquire_cred_by_mech.c
source4/heimdal/lib/gssapi/krb5/inquire_cred_by_oid.c
source4/heimdal/lib/gssapi/krb5/inquire_mechs_for_name.c
source4/heimdal/lib/gssapi/krb5/inquire_names_for_mech.c
source4/heimdal/lib/gssapi/krb5/inquire_sec_context_by_oid.c
source4/heimdal/lib/gssapi/krb5/prf.c [new file with mode: 0644]
source4/heimdal/lib/gssapi/krb5/process_context_token.c
source4/heimdal/lib/gssapi/krb5/release_buffer.c
source4/heimdal/lib/gssapi/krb5/release_cred.c
source4/heimdal/lib/gssapi/krb5/release_name.c
source4/heimdal/lib/gssapi/krb5/release_oid_set.c [deleted file]
source4/heimdal/lib/gssapi/krb5/sequence.c
source4/heimdal/lib/gssapi/krb5/set_cred_option.c
source4/heimdal/lib/gssapi/krb5/set_sec_context_option.c
source4/heimdal/lib/gssapi/krb5/unwrap.c
source4/heimdal/lib/gssapi/krb5/verify_mic.c
source4/heimdal/lib/gssapi/krb5/wrap.c
source4/heimdal/lib/gssapi/mech/context.c [new file with mode: 0644]
source4/heimdal/lib/gssapi/mech/context.h
source4/heimdal/lib/gssapi/mech/cred.h
source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c
source4/heimdal/lib/gssapi/mech/gss_add_cred.c
source4/heimdal/lib/gssapi/mech/gss_add_oid_set_member.c
source4/heimdal/lib/gssapi/mech/gss_buffer_set.c
source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c
source4/heimdal/lib/gssapi/mech/gss_compare_name.c
source4/heimdal/lib/gssapi/mech/gss_context_time.c
source4/heimdal/lib/gssapi/mech/gss_create_empty_oid_set.c
source4/heimdal/lib/gssapi/mech/gss_decapsulate_token.c
source4/heimdal/lib/gssapi/mech/gss_delete_sec_context.c
source4/heimdal/lib/gssapi/mech/gss_display_name.c
source4/heimdal/lib/gssapi/mech/gss_display_status.c
source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
source4/heimdal/lib/gssapi/mech/gss_duplicate_oid.c
source4/heimdal/lib/gssapi/mech/gss_encapsulate_token.c
source4/heimdal/lib/gssapi/mech/gss_export_name.c
source4/heimdal/lib/gssapi/mech/gss_export_sec_context.c
source4/heimdal/lib/gssapi/mech/gss_get_mic.c
source4/heimdal/lib/gssapi/mech/gss_import_name.c
source4/heimdal/lib/gssapi/mech/gss_import_sec_context.c
source4/heimdal/lib/gssapi/mech/gss_indicate_mechs.c
source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c
source4/heimdal/lib/gssapi/mech/gss_inquire_context.c
source4/heimdal/lib/gssapi/mech/gss_inquire_cred.c
source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_oid.c
source4/heimdal/lib/gssapi/mech/gss_inquire_mechs_for_name.c
source4/heimdal/lib/gssapi/mech/gss_inquire_names_for_mech.c
source4/heimdal/lib/gssapi/mech/gss_inquire_sec_context_by_oid.c
source4/heimdal/lib/gssapi/mech/gss_krb5.c
source4/heimdal/lib/gssapi/mech/gss_mech_switch.c
source4/heimdal/lib/gssapi/mech/gss_names.c
source4/heimdal/lib/gssapi/mech/gss_oid_equal.c
source4/heimdal/lib/gssapi/mech/gss_oid_to_str.c [moved from source4/heimdal/lib/gssapi/krb5/test_oid_set_member.c with 72% similarity]
source4/heimdal/lib/gssapi/mech/gss_process_context_token.c
source4/heimdal/lib/gssapi/mech/gss_release_buffer.c
source4/heimdal/lib/gssapi/mech/gss_release_cred.c
source4/heimdal/lib/gssapi/mech/gss_release_name.c
source4/heimdal/lib/gssapi/mech/gss_release_oid.c
source4/heimdal/lib/gssapi/mech/gss_release_oid_set.c
source4/heimdal/lib/gssapi/mech/gss_seal.c
source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
source4/heimdal/lib/gssapi/mech/gss_set_sec_context_option.c
source4/heimdal/lib/gssapi/mech/gss_sign.c
source4/heimdal/lib/gssapi/mech/gss_test_oid_set_member.c
source4/heimdal/lib/gssapi/mech/gss_unseal.c
source4/heimdal/lib/gssapi/mech/gss_unwrap.c
source4/heimdal/lib/gssapi/mech/gss_utils.c
source4/heimdal/lib/gssapi/mech/gss_verify.c
source4/heimdal/lib/gssapi/mech/gss_verify_mic.c
source4/heimdal/lib/gssapi/mech/gss_wrap.c
source4/heimdal/lib/gssapi/mech/gss_wrap_size_limit.c
source4/heimdal/lib/gssapi/mech/gssapi.asn1
source4/heimdal/lib/gssapi/mech/mech_locl.h
source4/heimdal/lib/gssapi/mech/mech_switch.h
source4/heimdal/lib/gssapi/mech/name.h
source4/heimdal/lib/gssapi/mech/utils.h
source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
source4/heimdal/lib/gssapi/spnego/compat.c
source4/heimdal/lib/gssapi/spnego/context_stubs.c
source4/heimdal/lib/gssapi/spnego/cred_stubs.c
source4/heimdal/lib/gssapi/spnego/external.c
source4/heimdal/lib/gssapi/spnego/init_sec_context.c
source4/heimdal/lib/gssapi/spnego/spnego.asn1
source4/heimdal/lib/gssapi/spnego/spnego_locl.h
source4/heimdal/lib/hcrypto/aes.c [moved from source4/heimdal/lib/des/aes.c with 98% similarity]
source4/heimdal/lib/hcrypto/aes.h [moved from source4/heimdal/lib/des/aes.h with 97% similarity]
source4/heimdal/lib/hcrypto/bn.c [moved from source4/heimdal/lib/des/bn.c with 99% similarity]
source4/heimdal/lib/hcrypto/bn.h [moved from source4/heimdal/lib/des/bn.h with 98% similarity]
source4/heimdal/lib/hcrypto/des-tables.h [moved from source4/heimdal/lib/des/des-tables.h with 100% similarity]
source4/heimdal/lib/hcrypto/des.c [moved from source4/heimdal/lib/des/des.c with 99% similarity]
source4/heimdal/lib/hcrypto/des.h [moved from source4/heimdal/lib/des/des.h with 98% similarity]
source4/heimdal/lib/hcrypto/dh-imath.c [moved from source4/heimdal/lib/des/dh-imath.c with 98% similarity]
source4/heimdal/lib/hcrypto/dh.c [moved from source4/heimdal/lib/des/dh.c with 98% similarity]
source4/heimdal/lib/hcrypto/dh.h [moved from source4/heimdal/lib/des/dh.h with 98% similarity]
source4/heimdal/lib/hcrypto/dsa.c [moved from source4/heimdal/lib/des/dsa.c with 98% similarity]
source4/heimdal/lib/hcrypto/dsa.h [moved from source4/heimdal/lib/des/dsa.h with 98% similarity]
source4/heimdal/lib/hcrypto/engine.c [moved from source4/heimdal/lib/des/engine.c with 93% similarity]
source4/heimdal/lib/hcrypto/engine.h [moved from source4/heimdal/lib/des/engine.h with 98% similarity]
source4/heimdal/lib/hcrypto/evp.c [moved from source4/heimdal/lib/des/evp.c with 100% similarity]
source4/heimdal/lib/hcrypto/evp.h [moved from source4/heimdal/lib/des/evp.h with 99% similarity]
source4/heimdal/lib/hcrypto/hash.h [moved from source4/heimdal/lib/des/hash.h with 97% similarity]
source4/heimdal/lib/hcrypto/hmac.c [moved from source4/heimdal/lib/des/hmac.c with 100% similarity]
source4/heimdal/lib/hcrypto/hmac.h [moved from source4/heimdal/lib/des/hmac.h with 98% similarity]
source4/heimdal/lib/hcrypto/imath/LICENSE [moved from source4/heimdal/lib/des/imath/LICENSE with 100% similarity]
source4/heimdal/lib/hcrypto/imath/imath.c [moved from source4/heimdal/lib/des/imath/imath.c with 96% similarity]
source4/heimdal/lib/hcrypto/imath/imath.h [moved from source4/heimdal/lib/des/imath/imath.h with 98% similarity]
source4/heimdal/lib/hcrypto/imath/iprime.c [moved from source4/heimdal/lib/des/imath/iprime.c with 99% similarity]
source4/heimdal/lib/hcrypto/imath/iprime.h [moved from source4/heimdal/lib/des/imath/iprime.h with 96% similarity]
source4/heimdal/lib/hcrypto/md2.c [moved from source4/heimdal/lib/des/md2.c with 98% similarity]
source4/heimdal/lib/hcrypto/md2.h [moved from source4/heimdal/lib/des/md2.h with 97% similarity]
source4/heimdal/lib/hcrypto/md4.c [moved from source4/heimdal/lib/des/md4.c with 99% similarity]
source4/heimdal/lib/hcrypto/md4.h [moved from source4/heimdal/lib/des/md4.h with 97% similarity]
source4/heimdal/lib/hcrypto/md5.c [moved from source4/heimdal/lib/des/md5.c with 99% similarity]
source4/heimdal/lib/hcrypto/md5.h [moved from source4/heimdal/lib/des/md5.h with 97% similarity]
source4/heimdal/lib/hcrypto/pkcs12.c [moved from source4/heimdal/lib/des/pkcs12.c with 93% similarity]
source4/heimdal/lib/hcrypto/pkcs12.h [moved from source4/heimdal/lib/des/pkcs12.h with 97% similarity]
source4/heimdal/lib/hcrypto/pkcs5.c [moved from source4/heimdal/lib/des/pkcs5.c with 98% similarity]
source4/heimdal/lib/hcrypto/rand-egd.c [new file with mode: 0644]
source4/heimdal/lib/hcrypto/rand-fortuna.c [new file with mode: 0644]
source4/heimdal/lib/hcrypto/rand-unix.c [moved from source4/heimdal/lib/des/rand-unix.c with 95% similarity]
source4/heimdal/lib/hcrypto/rand.c [moved from source4/heimdal/lib/des/rand.c with 58% similarity]
source4/heimdal/lib/hcrypto/rand.h [moved from source4/heimdal/lib/des/rand.h with 86% similarity]
source4/heimdal/lib/hcrypto/randi.h [moved from source4/heimdal/lib/gssapi/gssapi.h with 83% similarity]
source4/heimdal/lib/hcrypto/rc2.c [moved from source4/heimdal/lib/des/rc2.c with 99% similarity]
source4/heimdal/lib/hcrypto/rc2.h [moved from source4/heimdal/lib/des/rc2.h with 97% similarity]
source4/heimdal/lib/hcrypto/rc4.c [moved from source4/heimdal/lib/des/rc4.c with 97% similarity]
source4/heimdal/lib/hcrypto/rc4.h [moved from source4/heimdal/lib/des/rc4.h with 97% similarity]
source4/heimdal/lib/hcrypto/resource.h [moved from source4/heimdal/lib/des/resource.h with 100% similarity]
source4/heimdal/lib/hcrypto/rijndael-alg-fst.c [moved from source4/heimdal/lib/des/rijndael-alg-fst.c with 99% similarity]
source4/heimdal/lib/hcrypto/rijndael-alg-fst.h [moved from source4/heimdal/lib/des/rijndael-alg-fst.h with 100% similarity]
source4/heimdal/lib/hcrypto/rnd_keys.c [moved from source4/heimdal/lib/des/rnd_keys.c with 99% similarity]
source4/heimdal/lib/hcrypto/rsa-imath.c [moved from source4/heimdal/lib/des/rsa-imath.c with 99% similarity]
source4/heimdal/lib/hcrypto/rsa.c [moved from source4/heimdal/lib/des/rsa.c with 97% similarity]
source4/heimdal/lib/hcrypto/rsa.h [moved from source4/heimdal/lib/des/rsa.h with 99% similarity]
source4/heimdal/lib/hcrypto/sha.c [moved from source4/heimdal/lib/des/sha.c with 99% similarity]
source4/heimdal/lib/hcrypto/sha.h [moved from source4/heimdal/lib/des/sha.h with 97% similarity]
source4/heimdal/lib/hcrypto/sha256.c [moved from source4/heimdal/lib/des/sha256.c with 99% similarity]
source4/heimdal/lib/hcrypto/ui.c [moved from source4/heimdal/lib/des/ui.c with 98% similarity]
source4/heimdal/lib/hcrypto/ui.h [moved from source4/heimdal/lib/des/ui.h with 97% similarity]
source4/heimdal/lib/hdb/db.c
source4/heimdal/lib/hdb/ext.c
source4/heimdal/lib/hdb/hdb-protos.h
source4/heimdal/lib/hdb/hdb.asn1
source4/heimdal/lib/hdb/hdb.c
source4/heimdal/lib/hdb/hdb.h
source4/heimdal/lib/hdb/hdb_err.et
source4/heimdal/lib/hdb/hdb_locl.h
source4/heimdal/lib/hdb/keys.c
source4/heimdal/lib/hdb/keytab.c
source4/heimdal/lib/hdb/mkey.c
source4/heimdal/lib/hdb/ndbm.c
source4/heimdal/lib/hx509/ca.c
source4/heimdal/lib/hx509/cert.c
source4/heimdal/lib/hx509/cms.c
source4/heimdal/lib/hx509/collector.c
source4/heimdal/lib/hx509/crmf.asn1
source4/heimdal/lib/hx509/crypto.c
source4/heimdal/lib/hx509/env.c [new file with mode: 0644]
source4/heimdal/lib/hx509/error.c
source4/heimdal/lib/hx509/file.c
source4/heimdal/lib/hx509/hx509-private.h
source4/heimdal/lib/hx509/hx509-protos.h
source4/heimdal/lib/hx509/hx509.h
source4/heimdal/lib/hx509/hx509_err.et
source4/heimdal/lib/hx509/hx_locl.h
source4/heimdal/lib/hx509/keyset.c
source4/heimdal/lib/hx509/ks_dir.c
source4/heimdal/lib/hx509/ks_file.c
source4/heimdal/lib/hx509/ks_keychain.c [new file with mode: 0644]
source4/heimdal/lib/hx509/ks_mem.c
source4/heimdal/lib/hx509/ks_null.c
source4/heimdal/lib/hx509/ks_p11.c
source4/heimdal/lib/hx509/ks_p12.c
source4/heimdal/lib/hx509/lock.c
source4/heimdal/lib/hx509/name.c
source4/heimdal/lib/hx509/ocsp.asn1
source4/heimdal/lib/hx509/peer.c
source4/heimdal/lib/hx509/pkcs10.asn1
source4/heimdal/lib/hx509/print.c
source4/heimdal/lib/hx509/req.c
source4/heimdal/lib/hx509/revoke.c
source4/heimdal/lib/hx509/test_name.c
source4/heimdal/lib/krb5/acache.c
source4/heimdal/lib/krb5/add_et_list.c
source4/heimdal/lib/krb5/addr_families.c
source4/heimdal/lib/krb5/appdefault.c
source4/heimdal/lib/krb5/asn1_glue.c
source4/heimdal/lib/krb5/auth_context.c
source4/heimdal/lib/krb5/build_ap_req.c
source4/heimdal/lib/krb5/build_auth.c
source4/heimdal/lib/krb5/cache.c
source4/heimdal/lib/krb5/changepw.c
source4/heimdal/lib/krb5/codec.c
source4/heimdal/lib/krb5/config_file.c
source4/heimdal/lib/krb5/config_file_netinfo.c
source4/heimdal/lib/krb5/constants.c
source4/heimdal/lib/krb5/context.c
source4/heimdal/lib/krb5/convert_creds.c
source4/heimdal/lib/krb5/copy_host_realm.c
source4/heimdal/lib/krb5/crc.c
source4/heimdal/lib/krb5/creds.c
source4/heimdal/lib/krb5/crypto.c
source4/heimdal/lib/krb5/data.c
source4/heimdal/lib/krb5/eai_to_heim_errno.c
source4/heimdal/lib/krb5/error_string.c
source4/heimdal/lib/krb5/expand_hostname.c
source4/heimdal/lib/krb5/fcache.c
source4/heimdal/lib/krb5/free.c
source4/heimdal/lib/krb5/free_host_realm.c
source4/heimdal/lib/krb5/generate_seq_number.c
source4/heimdal/lib/krb5/generate_subkey.c
source4/heimdal/lib/krb5/get_cred.c
source4/heimdal/lib/krb5/get_default_principal.c
source4/heimdal/lib/krb5/get_default_realm.c
source4/heimdal/lib/krb5/get_for_creds.c
source4/heimdal/lib/krb5/get_host_realm.c
source4/heimdal/lib/krb5/get_in_tkt.c
source4/heimdal/lib/krb5/get_in_tkt_with_keytab.c
source4/heimdal/lib/krb5/get_port.c
source4/heimdal/lib/krb5/heim_err.et
source4/heimdal/lib/krb5/heim_threads.h
source4/heimdal/lib/krb5/init_creds.c
source4/heimdal/lib/krb5/init_creds_pw.c
source4/heimdal/lib/krb5/k524_err.et
source4/heimdal/lib/krb5/kcm.c
source4/heimdal/lib/krb5/keyblock.c
source4/heimdal/lib/krb5/keytab.c
source4/heimdal/lib/krb5/keytab_any.c
source4/heimdal/lib/krb5/keytab_file.c
source4/heimdal/lib/krb5/keytab_keyfile.c
source4/heimdal/lib/krb5/keytab_krb4.c
source4/heimdal/lib/krb5/keytab_memory.c
source4/heimdal/lib/krb5/krb5-private.h
source4/heimdal/lib/krb5/krb5-protos.h
source4/heimdal/lib/krb5/krb5-v4compat.h
source4/heimdal/lib/krb5/krb5.h
source4/heimdal/lib/krb5/krb5_ccapi.h
source4/heimdal/lib/krb5/krb5_err.et
source4/heimdal/lib/krb5/krb5_locl.h
source4/heimdal/lib/krb5/krbhst.c
source4/heimdal/lib/krb5/locate_plugin.h
source4/heimdal/lib/krb5/log.c
source4/heimdal/lib/krb5/mcache.c
source4/heimdal/lib/krb5/misc.c
source4/heimdal/lib/krb5/mit_glue.c
source4/heimdal/lib/krb5/mk_error.c
source4/heimdal/lib/krb5/mk_priv.c
source4/heimdal/lib/krb5/mk_rep.c
source4/heimdal/lib/krb5/mk_req.c
source4/heimdal/lib/krb5/mk_req_ext.c
source4/heimdal/lib/krb5/n-fold.c
source4/heimdal/lib/krb5/pac.c
source4/heimdal/lib/krb5/padata.c
source4/heimdal/lib/krb5/pkinit.c
source4/heimdal/lib/krb5/plugin.c
source4/heimdal/lib/krb5/principal.c
source4/heimdal/lib/krb5/prompter_posix.c
source4/heimdal/lib/krb5/rd_cred.c
source4/heimdal/lib/krb5/rd_error.c
source4/heimdal/lib/krb5/rd_priv.c
source4/heimdal/lib/krb5/rd_rep.c
source4/heimdal/lib/krb5/rd_req.c
source4/heimdal/lib/krb5/replay.c
source4/heimdal/lib/krb5/send_to_kdc.c
source4/heimdal/lib/krb5/set_default_realm.c
source4/heimdal/lib/krb5/store.c
source4/heimdal/lib/krb5/store_emem.c
source4/heimdal/lib/krb5/store_fd.c
source4/heimdal/lib/krb5/store_mem.c
source4/heimdal/lib/krb5/ticket.c
source4/heimdal/lib/krb5/time.c
source4/heimdal/lib/krb5/transited.c
source4/heimdal/lib/krb5/v4_glue.c
source4/heimdal/lib/krb5/version.c
source4/heimdal/lib/krb5/warn.c
source4/heimdal/lib/ntlm/heimntlm-protos.h
source4/heimdal/lib/ntlm/heimntlm.h
source4/heimdal/lib/ntlm/ntlm.c
source4/heimdal/lib/roken/base64.c
source4/heimdal/lib/roken/base64.h
source4/heimdal/lib/roken/bswap.c
source4/heimdal/lib/roken/closefrom.c
source4/heimdal/lib/roken/copyhostent.c
source4/heimdal/lib/roken/dumpdata.c
source4/heimdal/lib/roken/ecalloc.c
source4/heimdal/lib/roken/emalloc.c
source4/heimdal/lib/roken/erealloc.c
source4/heimdal/lib/roken/estrdup.c
source4/heimdal/lib/roken/freeaddrinfo.c
source4/heimdal/lib/roken/freehostent.c
source4/heimdal/lib/roken/gai_strerror.c
source4/heimdal/lib/roken/get_window_size.c
source4/heimdal/lib/roken/getaddrinfo.c
source4/heimdal/lib/roken/getarg.c
source4/heimdal/lib/roken/getarg.h
source4/heimdal/lib/roken/getipnodebyaddr.c
source4/heimdal/lib/roken/getipnodebyname.c
source4/heimdal/lib/roken/getnameinfo.c
source4/heimdal/lib/roken/getprogname.c
source4/heimdal/lib/roken/h_errno.c
source4/heimdal/lib/roken/hex.c
source4/heimdal/lib/roken/hex.h
source4/heimdal/lib/roken/hostent_find_fqdn.c
source4/heimdal/lib/roken/inet_aton.c
source4/heimdal/lib/roken/inet_ntop.c
source4/heimdal/lib/roken/inet_pton.c
source4/heimdal/lib/roken/issuid.c
source4/heimdal/lib/roken/net_read.c
source4/heimdal/lib/roken/net_write.c
source4/heimdal/lib/roken/parse_bytes.h
source4/heimdal/lib/roken/parse_time.c
source4/heimdal/lib/roken/parse_time.h
source4/heimdal/lib/roken/parse_units.c
source4/heimdal/lib/roken/parse_units.h
source4/heimdal/lib/roken/resolve.c
source4/heimdal/lib/roken/resolve.h
source4/heimdal/lib/roken/roken-common.h
source4/heimdal/lib/roken/roken_gethostby.c
source4/heimdal/lib/roken/rtbl.c [new file with mode: 0644]
source4/heimdal/lib/roken/rtbl.h [new file with mode: 0644]
source4/heimdal/lib/roken/setprogname.c
source4/heimdal/lib/roken/signal.c
source4/heimdal/lib/roken/simple_exec.c
source4/heimdal/lib/roken/socket.c
source4/heimdal/lib/roken/strcollect.c
source4/heimdal/lib/roken/strlwr.c
source4/heimdal/lib/roken/strpool.c
source4/heimdal/lib/roken/strsep.c
source4/heimdal/lib/roken/strsep_copy.c
source4/heimdal/lib/roken/strupr.c
source4/heimdal/lib/roken/vis.c
source4/heimdal/lib/vers/print_version.c
source4/heimdal_build/asn1_deps.pl
source4/heimdal_build/config.mk
source4/heimdal_build/hcrypto-deps.pl
source4/kdc/kdc.c
source4/static_deps.mk

index 56c12efd6003641f06548da559169c27673e0cc6..3e4ad292537b4622577bd61f11e9c21940fdbde0 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: 524.c,v 1.40 2006/10/06 17:06:30 lha Exp $");
+RCSID("$Id: 524.c 18270 2006-10-06 17:06:30Z lha $");
 
 #include <krb5-v4compat.h>
 
 
 #include <krb5-v4compat.h>
 
index 2352020d86c06a56bc23b252169cd7b774c80850..c28bd424ead197893793630326674b54791922b1 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  *
  * All rights reserved. 
  * (Royal Institute of Technology, Stockholm, Sweden). 
  *
  * All rights reserved. 
  */
 
 #include "kdc_locl.h"
  */
 
 #include "kdc_locl.h"
+#include <getarg.h>
+#include <parse_bytes.h>
 
 
-int require_preauth = -1; /* 1 == require preauth for all principals */
+RCSID("$Id: default_config.c 20532 2007-04-23 07:46:57Z lha $");
 
 
-const char *trpolicy_str;
 
 
-int disable_des = -1;
-int enable_v4 = -1;
-int enable_kaserver = -1;
-int enable_524 = -1;
-int enable_v4_cross_realm = -1;
-int detach_from_console = -1;
-
-char *v4_realm;
-
-/* 
- * Setup some of the defaults for the KDC configuration.
- * 
- * Note: Caller must also fill in:
- * - db
- * - num_db
- * - logf
- *
-*/
-
-void
-krb5_kdc_default_config(krb5_kdc_configuration *config)
-{
-    memset(config, 0, sizeof(*config));
-    config->require_preauth = TRUE;
-    config->kdc_warn_pwexpire = 0;
-    config->encode_as_rep_as_tgs_rep = FALSE; /* bug compatibility */
-    config->check_ticket_addresses = TRUE;
-    config->allow_null_ticket_addresses = TRUE;
-    config->allow_anonymous = FALSE;
-    config->trpolicy = TRPOLICY_ALWAYS_CHECK;
-    config->enable_v4 = FALSE;
-    config->enable_kaserver = FALSE;
-    config->enable_524 = FALSE; /* overriden by enable_v4 in configure()) */
-    config->enable_v4_cross_realm = FALSE;
-    config->enable_pkinit = FALSE;
-    config->enable_pkinit_princ_in_cert = TRUE;
-    config->db = NULL;
-    config->num_db = 0;
-    config->logf = NULL;
-}
-
-
-/* 
- * Setup some valudes for the KDC configuration, from the config file
- * 
- * Note: Caller must also fill in:
- * - db
- * - num_db
- * - logf
- *
-*/
-
-void krb5_kdc_configure(krb5_context context, krb5_kdc_configuration *config)
+int
+krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
 {
 {
-    const char *p;
-    if(require_preauth == -1) {
-       config->require_preauth = krb5_config_get_bool_default(context, NULL, 
-                                                              config->require_preauth,
-                                                              "kdc", 
-                                                              "require-preauth", NULL);
-    } else {
-       config->require_preauth = require_preauth;
-    }
+    krb5_kdc_configuration *c;
 
 
-    if(enable_v4 == -1) {
-       config->enable_v4 = krb5_config_get_bool_default(context, NULL, 
-                                                        config->enable_v4, 
-                                                        "kdc", 
-                                                        "enable-kerberos4", 
-                                                        NULL);
-    } else {
-       config->enable_v4 = enable_v4;
+    c = calloc(1, sizeof(*c));
+    if (c == NULL) {
+       krb5_set_error_string(context, "malloc: out of memory");
+       return ENOMEM;
     }
 
     }
 
-    if(enable_v4_cross_realm == -1) {
-       config->enable_v4_cross_realm =
-           krb5_config_get_bool_default(context, NULL,
-                                        config->enable_v4_cross_realm, 
-                                        "kdc", 
-                                        "enable-kerberos4-cross-realm",
-                                        NULL);
-    } else {
-       config->enable_v4_cross_realm = enable_v4_cross_realm;
-    }
-
-    if(enable_524 == -1) {
-       config->enable_524 = krb5_config_get_bool_default(context, NULL, 
-                                                         config->enable_v4, 
-                                                         "kdc", "enable-524", 
-                                                         NULL);
-    } else {
-       config->enable_524 = enable_524;
-    }
-
-    config->enable_digest = 
+    c->require_preauth = TRUE;
+    c->kdc_warn_pwexpire = 0;
+    c->encode_as_rep_as_tgs_rep = FALSE;
+    c->check_ticket_addresses = TRUE;
+    c->allow_null_ticket_addresses = TRUE;
+    c->allow_anonymous = FALSE;
+    c->trpolicy = TRPOLICY_ALWAYS_CHECK;
+    c->enable_v4 = FALSE;
+    c->enable_kaserver = FALSE;
+    c->enable_524 = FALSE;
+    c->enable_v4_cross_realm = FALSE;
+    c->enable_pkinit = FALSE;
+    c->enable_pkinit_princ_in_cert = TRUE;
+    c->db = NULL;
+    c->num_db = 0;
+    c->logf = NULL;
+
+    c->require_preauth =
        krb5_config_get_bool_default(context, NULL, 
        krb5_config_get_bool_default(context, NULL, 
-                                    FALSE, 
-                                    "kdc", 
-                                    "enable-digest", NULL);
+                                    c->require_preauth,
+                                    "kdc", "require-preauth", NULL);
+    c->enable_v4 = 
+       krb5_config_get_bool_default(context, NULL, 
+                                    c->enable_v4, 
+                                    "kdc", "enable-kerberos4", NULL);
+    c->enable_v4_cross_realm =
+       krb5_config_get_bool_default(context, NULL,
+                                    c->enable_v4_cross_realm, 
+                                    "kdc",
+                                    "enable-kerberos4-cross-realm", NULL);
+    c->enable_524 =
+       krb5_config_get_bool_default(context, NULL, 
+                                    c->enable_v4, 
+                                    "kdc", "enable-524", NULL);
+    c->enable_digest = 
+       krb5_config_get_bool_default(context, NULL, 
+                                    FALSE,
+                                    "kdc", "enable-digest", NULL);
 
     {
        const char *digests;
 
     {
        const char *digests;
@@ -146,46 +97,57 @@ void krb5_kdc_configure(krb5_context context, krb5_kdc_configuration *config)
                                         "digests_allowed", NULL);
        if (digests == NULL)
            digests = "ntlm-v2";
                                         "digests_allowed", NULL);
        if (digests == NULL)
            digests = "ntlm-v2";
-       config->digests_allowed = parse_flags(digests,
-                                             _kdc_digestunits,
-                                             0);
-       if (config->digests_allowed == -1) {
-           kdc_log(context, config, 0,
+       c->digests_allowed = parse_flags(digests,_kdc_digestunits, 0);
+       if (c->digests_allowed == -1) {
+           kdc_log(context, c, 0,
                    "unparsable digest units (%s), turning off digest",
                    digests);
                    "unparsable digest units (%s), turning off digest",
                    digests);
-           config->enable_digest = 0;
-       } else if (config->digests_allowed == 0) {
-           kdc_log(context, config, 0,
+           c->enable_digest = 0;
+       } else if (c->digests_allowed == 0) {
+           kdc_log(context, c, 0,
                    "no digest enable, turning digest off",
                    digests);
                    "no digest enable, turning digest off",
                    digests);
-           config->enable_digest = 0;
+           c->enable_digest = 0;
        }
     }
 
        }
     }
 
-    config->enable_kx509 = 
+    c->enable_kx509 = 
        krb5_config_get_bool_default(context, NULL, 
                                     FALSE, 
        krb5_config_get_bool_default(context, NULL, 
                                     FALSE, 
-                                    "kdc", 
-                                    "enable-kx509", NULL);
+                                    "kdc", "enable-kx509", NULL);
+
+    if (c->enable_kx509) {
+       c->kx509_template =
+           krb5_config_get_string(context, NULL, 
+                                  "kdc", "kx509_template", NULL);
+       c->kx509_ca =
+           krb5_config_get_string(context, NULL, 
+                                  "kdc", "kx509_ca", NULL);
+       if (c->kx509_ca == NULL || c->kx509_template == NULL) {
+           kdc_log(context, c, 0,
+                   "missing kx509 configuration, turning off");
+           c->enable_kx509 = FALSE;
+       }
+    }
 
 
-    config->check_ticket_addresses = 
+    c->check_ticket_addresses = 
        krb5_config_get_bool_default(context, NULL, 
        krb5_config_get_bool_default(context, NULL, 
-                                    config->check_ticket_addresses, 
+                                    c->check_ticket_addresses, 
                                     "kdc", 
                                     "check-ticket-addresses", NULL);
                                     "kdc", 
                                     "check-ticket-addresses", NULL);
-    config->allow_null_ticket_addresses = 
+    c->allow_null_ticket_addresses = 
        krb5_config_get_bool_default(context, NULL, 
        krb5_config_get_bool_default(context, NULL, 
-                                    config->allow_null_ticket_addresses, 
+                                    c->allow_null_ticket_addresses, 
                                     "kdc", 
                                     "allow-null-ticket-addresses", NULL);
 
                                     "kdc", 
                                     "allow-null-ticket-addresses", NULL);
 
-    config->allow_anonymous = 
+    c->allow_anonymous = 
        krb5_config_get_bool_default(context, NULL, 
        krb5_config_get_bool_default(context, NULL, 
-                                    config->allow_anonymous,
+                                    c->allow_anonymous,
                                     "kdc", 
                                     "allow-anonymous", NULL);
 
                                     "kdc", 
                                     "allow-anonymous", NULL);
 
-    config->max_datagram_reply_length =
+    c->max_datagram_reply_length =
        krb5_config_get_int_default(context, 
                                    NULL, 
                                    1400,
        krb5_config_get_int_default(context, 
                                    NULL, 
                                    1400,
@@ -193,178 +155,124 @@ void krb5_kdc_configure(krb5_context context, krb5_kdc_configuration *config)
                                    "max-kdc-datagram-reply-length",
                                    NULL);
 
                                    "max-kdc-datagram-reply-length",
                                    NULL);
 
-    trpolicy_str = 
-       krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc", 
-                                      "transited-policy", NULL);
-    if(strcasecmp(trpolicy_str, "always-check") == 0) {
-       config->trpolicy = TRPOLICY_ALWAYS_CHECK;
-    } else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) {
-       config->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
-    } else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) {
-       config->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
-    } else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) { 
-       /* default */
-    } else {
-       kdc_log(context, config, 
-               0, "unknown transited-policy: %s, reverting to default (always-check)", 
-               trpolicy_str);
+    {
+       const char *trpolicy_str;
+
+       trpolicy_str = 
+           krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc", 
+                                          "transited-policy", NULL);
+       if(strcasecmp(trpolicy_str, "always-check") == 0) {
+           c->trpolicy = TRPOLICY_ALWAYS_CHECK;
+       } else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) {
+           c->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
+       } else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) {
+           c->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
+       } else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) { 
+           /* default */
+       } else {
+           kdc_log(context, c, 0,
+                   "unknown transited-policy: %s, "
+                   "reverting to default (always-check)", 
+                   trpolicy_str);
+       }
     }
     }
-       
-    if (krb5_config_get_string(context, NULL, "kdc", 
-                              "enforce-transited-policy", NULL))
-       krb5_errx(context, 1, "enforce-transited-policy deprecated, "
-                 "use [kdc]transited-policy instead");
 
 
-    if(v4_realm == NULL){
+    {
+       const char *p;
        p = krb5_config_get_string (context, NULL, 
                                    "kdc",
                                    "v4-realm",
                                    NULL);
        if(p != NULL) {
        p = krb5_config_get_string (context, NULL, 
                                    "kdc",
                                    "v4-realm",
                                    NULL);
        if(p != NULL) {
-           config->v4_realm = strdup(p);
-           if (config->v4_realm == NULL)
+           c->v4_realm = strdup(p);
+           if (c->v4_realm == NULL)
                krb5_errx(context, 1, "out of memory");
        } else {
                krb5_errx(context, 1, "out of memory");
        } else {
-           config->v4_realm = NULL;
+           c->v4_realm = NULL;
        }
        }
-    } else {
-       config->v4_realm = v4_realm;
     }
 
     }
 
-    if (enable_kaserver == -1) {
-       config->enable_kaserver = 
-           krb5_config_get_bool_default(context, 
-                                        NULL, 
-                                        config->enable_kaserver,
-                                        "kdc",
-                                        "enable-kaserver",
-                                        NULL);
-    } else {
-       config->enable_kaserver = enable_kaserver;
-    }
+    c->enable_kaserver = 
+       krb5_config_get_bool_default(context, 
+                                    NULL, 
+                                    c->enable_kaserver,
+                                    "kdc", "enable-kaserver", NULL);
 
 
-    config->encode_as_rep_as_tgs_rep =
+
+    c->encode_as_rep_as_tgs_rep =
        krb5_config_get_bool_default(context, NULL, 
        krb5_config_get_bool_default(context, NULL, 
-                                    config->encode_as_rep_as_tgs_rep, 
+                                    c->encode_as_rep_as_tgs_rep, 
                                     "kdc", 
                                     "kdc", 
-                                    "encode_as_rep_as_tgs_rep", 
-                                    NULL);
-
-    config->kdc_warn_pwexpire =
+                                    "encode_as_rep_as_tgs_rep", NULL);
+    
+    c->kdc_warn_pwexpire =
        krb5_config_get_time_default (context, NULL,
        krb5_config_get_time_default (context, NULL,
-                                     config->kdc_warn_pwexpire,
-                                     "kdc",
-                                     "kdc_warn_pwexpire",
-                                     NULL);
+                                     c->kdc_warn_pwexpire,
+                                     "kdc", "kdc_warn_pwexpire", NULL);
 
 
-    if(detach_from_console == -1) 
-       detach_from_console = krb5_config_get_bool_default(context, NULL, 
-                                                          DETACH_IS_DEFAULT,
-                                                          "kdc",
-                                                          "detach", NULL);
 
 #ifdef PKINIT
 
 #ifdef PKINIT
-    config->enable_pkinit = 
+    c->enable_pkinit = 
        krb5_config_get_bool_default(context, 
                                     NULL, 
        krb5_config_get_bool_default(context, 
                                     NULL, 
-                                    config->enable_pkinit,
+                                    c->enable_pkinit,
                                     "kdc",
                                     "enable-pkinit",
                                     NULL);
                                     "kdc",
                                     "enable-pkinit",
                                     NULL);
-    if (config->enable_pkinit) {
+    if (c->enable_pkinit) {
        const char *user_id, *anchors, *ocsp_file;
        char **pool_list, **revoke_list;
 
        const char *user_id, *anchors, *ocsp_file;
        char **pool_list, **revoke_list;
 
-       user_id = krb5_config_get_string(context, NULL,
-                                        "kdc",
-                                        "pkinit_identity",
-                                        NULL);
+       user_id = 
+           krb5_config_get_string(context, NULL,
+                                  "kdc", "pkinit_identity", NULL);
        if (user_id == NULL)
            krb5_errx(context, 1, "pkinit enabled but no identity");
 
        anchors = krb5_config_get_string(context, NULL,
        if (user_id == NULL)
            krb5_errx(context, 1, "pkinit enabled but no identity");
 
        anchors = krb5_config_get_string(context, NULL,
-                                        "kdc",
-                                        "pkinit_anchors",
-                                        NULL);
+                                        "kdc", "pkinit_anchors", NULL);
        if (anchors == NULL)
            krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
 
        if (anchors == NULL)
            krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
 
-       pool_list = krb5_config_get_strings(context, NULL,
-                                           "kdc",
-                                           "pkinit_pool",
-                                           NULL);
+       pool_list =
+           krb5_config_get_strings(context, NULL,
+                                   "kdc", "pkinit_pool", NULL);
 
 
-       revoke_list = krb5_config_get_strings(context, NULL,
-                                             "kdc",
-                                             "pkinit_revoke",
-                                             NULL);
+       revoke_list =
+           krb5_config_get_strings(context, NULL,
+                                   "kdc", "pkinit_revoke", NULL);
 
        ocsp_file = 
            krb5_config_get_string(context, NULL,
 
        ocsp_file = 
            krb5_config_get_string(context, NULL,
-                                  "kdc",
-                                  "pkinit_kdc_ocsp",
-                                  NULL);
+                                  "kdc", "pkinit_kdc_ocsp", NULL);
        if (ocsp_file) {
        if (ocsp_file) {
-           config->pkinit_kdc_ocsp_file = strdup(ocsp_file);
-           if (config->pkinit_kdc_ocsp_file == NULL)
+           c->pkinit_kdc_ocsp_file = strdup(ocsp_file);
+           if (c->pkinit_kdc_ocsp_file == NULL)
                krb5_errx(context, 1, "out of memory");
        }
                krb5_errx(context, 1, "out of memory");
        }
-       _kdc_pk_initialize(context, config, user_id, anchors, 
+
+       _kdc_pk_initialize(context, c, user_id, anchors, 
                           pool_list, revoke_list);
 
        krb5_config_free_strings(pool_list);
        krb5_config_free_strings(revoke_list);
 
                           pool_list, revoke_list);
 
        krb5_config_free_strings(pool_list);
        krb5_config_free_strings(revoke_list);
 
-       config->enable_pkinit_princ_in_cert = 
-           krb5_config_get_bool_default(context, 
-                                        NULL,
-                                        config->enable_pkinit_princ_in_cert,
+       c->enable_pkinit_princ_in_cert = 
+           krb5_config_get_bool_default(context, NULL,
+                                        c->enable_pkinit_princ_in_cert,
                                         "kdc",
                                         "pkinit_principal_in_certificate",
                                         NULL);
     }
 
                                         "kdc",
                                         "pkinit_principal_in_certificate",
                                         NULL);
     }
 
-    config->pkinit_dh_min_bits =
-       krb5_config_get_int_default(context, 
-                                   NULL, 
+    c->pkinit_dh_min_bits =
+       krb5_config_get_int_default(context, NULL, 
                                    0,
                                    0,
-                                   "kdc",
-                                   "pkinit_dh_min_bits",
-                                   NULL);
+                                   "kdc", "pkinit_dh_min_bits", NULL);
 
 #endif
 
 
 #endif
 
-    if(config->v4_realm == NULL && (config->enable_kaserver || config->enable_v4)){
-#ifdef KRB4
-       config->v4_realm = malloc(40); /* REALM_SZ */
-       if (config->v4_realm == NULL)
-           krb5_errx(context, 1, "out of memory");
-       krb_get_lrealm(config->v4_realm, 1);
-#else
-       krb5_errx(context, 1, "No Kerberos 4 realm configured");
-#endif
-    }
-    if(disable_des == -1)
-       disable_des = krb5_config_get_bool_default(context, NULL, 
-                                                  FALSE,
-                                                  "kdc",
-                                                  "disable-des", NULL);
-    if(disable_des) {
-       krb5_enctype_disable(context, ETYPE_DES_CBC_CRC);
-       krb5_enctype_disable(context, ETYPE_DES_CBC_MD4);
-       krb5_enctype_disable(context, ETYPE_DES_CBC_MD5);
-       krb5_enctype_disable(context, ETYPE_DES_CBC_NONE);
-       krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE);
-       krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE);
-
-       kdc_log(context, config, 
-               0, "DES was disabled, turned off Kerberos V4, 524 "
-               "and kaserver");
-       config->enable_v4 = 0;
-       config->enable_524 = 0;
-       config->enable_kaserver = 0;
-    }
+    *config = c;
 
 
-    _kdc_windc_init(context);
+    return 0;
 }
 }
-
index 2c012a2ead53c1f43ef0d448a88f539f5f3db869..811ab639f1c2da78552a33511fb8a316631d9d13 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -34,8 +34,9 @@
 #include "kdc_locl.h"
 #include <hex.h>
 
 #include "kdc_locl.h"
 #include <hex.h>
 
-RCSID("$Id: digest.c,v 1.19 2006/12/28 17:03:51 lha Exp $");
+RCSID("$Id: digest.c 20877 2007-06-04 04:07:26Z lha $");
 
 
+#define MS_CHAP_V2     0x20
 #define CHAP_MD5       0x10
 #define DIGEST_MD5     0x08
 #define NTLM_V2                0x04
 #define CHAP_MD5       0x10
 #define DIGEST_MD5     0x08
 #define NTLM_V2                0x04
@@ -43,6 +44,7 @@ RCSID("$Id: digest.c,v 1.19 2006/12/28 17:03:51 lha Exp $");
 #define NTLM_V1                0x01
 
 const struct units _kdc_digestunits[] = {
 #define NTLM_V1                0x01
 
 const struct units _kdc_digestunits[] = {
+       {"ms-chap-v2",          1U << 5},
        {"chap-md5",            1U << 4},
        {"digest-md5",          1U << 3},
        {"ntlm-v2",             1U << 2},
        {"chap-md5",            1U << 4},
        {"digest-md5",          1U << 3},
        {"ntlm-v2",             1U << 2},
@@ -135,6 +137,25 @@ fill_targetinfo(krb5_context context,
 }
 
 
 }
 
 
+static const unsigned char ms_chap_v2_magic1[39] = {
+    0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
+    0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
+    0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
+    0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74
+};
+static const unsigned char ms_chap_v2_magic2[41] = {
+    0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
+    0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
+    0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
+    0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
+    0x6E
+};
+static const unsigned char ms_rfc3079_magic1[27] = {
+    0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
+    0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
+    0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79
+};
+
 /*
  *
  */
 /*
  *
  */
@@ -382,11 +403,6 @@ _kdc_do_digest(krb5_context context,
                goto out;
            }
 
                goto out;
            }
 
-           ret = krb5_store_stringz(sp, *r.u.initReply.identifier);
-           if (ret) {
-               krb5_clear_error_string(context);
-               goto out;
-           }
        } else
            r.u.initReply.identifier = NULL;
 
        } else
            r.u.initReply.identifier = NULL;
 
@@ -461,13 +477,7 @@ _kdc_do_digest(krb5_context context,
        }
 
        krb5_store_stringz(sp, ireq.u.digestRequest.serverNonce);
        }
 
        krb5_store_stringz(sp, ireq.u.digestRequest.serverNonce);
-       if (ireq.u.digestRequest.identifier) {
-           ret = krb5_store_stringz(sp, *ireq.u.digestRequest.identifier);
-           if (ret) {
-               krb5_clear_error_string(context);
-               goto out;
-           }
-       }
+
        if (ireq.u.digestRequest.hostname) {
            ret = krb5_store_stringz(sp, *ireq.u.digestRequest.hostname);
            if (ret) {
        if (ireq.u.digestRequest.hostname) {
            ret = krb5_store_stringz(sp, *ireq.u.digestRequest.hostname);
            if (ret) {
@@ -587,6 +597,7 @@ _kdc_do_digest(krb5_context context,
        if (strcasecmp(ireq.u.digestRequest.type, "CHAP") == 0) {
            MD5_CTX ctx;
            unsigned char md[MD5_DIGEST_LENGTH];
        if (strcasecmp(ireq.u.digestRequest.type, "CHAP") == 0) {
            MD5_CTX ctx;
            unsigned char md[MD5_DIGEST_LENGTH];
+           char *mdx;
            char id;
 
            if ((config->digests_allowed & CHAP_MD5) == 0) {
            char id;
 
            if ((config->digests_allowed & CHAP_MD5) == 0) {
@@ -613,16 +624,30 @@ _kdc_do_digest(krb5_context context,
            MD5_Update(&ctx, serverNonce.data, serverNonce.length);
            MD5_Final(md, &ctx);
 
            MD5_Update(&ctx, serverNonce.data, serverNonce.length);
            MD5_Final(md, &ctx);
 
-           r.element = choice_DigestRepInner_response;
-           hex_encode(md, sizeof(md), &r.u.response.responseData);
-           if (r.u.response.responseData == NULL) {
+           hex_encode(md, sizeof(md), &mdx);
+           if (mdx == NULL) {
                krb5_clear_error_string(context);
                ret = ENOMEM;
                goto out;
            }
                krb5_clear_error_string(context);
                ret = ENOMEM;
                goto out;
            }
+
+           r.element = choice_DigestRepInner_response;
+
+           ret = strcasecmp(mdx, ireq.u.digestRequest.responseData);
+           free(mdx);
+           if (ret == 0) {
+               r.u.response.success = TRUE;
+           } else {
+               kdc_log(context, config, 0, 
+                       "CHAP reply mismatch for %s",
+                       ireq.u.digestRequest.username);
+               r.u.response.success = FALSE;
+           }
+
        } else if (strcasecmp(ireq.u.digestRequest.type, "SASL-DIGEST-MD5") == 0) {
            MD5_CTX ctx;
            unsigned char md[MD5_DIGEST_LENGTH];
        } else if (strcasecmp(ireq.u.digestRequest.type, "SASL-DIGEST-MD5") == 0) {
            MD5_CTX ctx;
            unsigned char md[MD5_DIGEST_LENGTH];
+           char *mdx;
            char *A1, *A2;
 
            if ((config->digests_allowed & DIGEST_MD5) == 0) {
            char *A1, *A2;
 
            if ((config->digests_allowed & DIGEST_MD5) == 0) {
@@ -709,21 +734,212 @@ _kdc_do_digest(krb5_context context,
 
            MD5_Final(md, &ctx);
 
 
            MD5_Final(md, &ctx);
 
-           r.element = choice_DigestRepInner_response;
-           hex_encode(md, sizeof(md), &r.u.response.responseData);
-
            free(A1);
            free(A2);
 
            free(A1);
            free(A2);
 
-           if (r.u.response.responseData == NULL) {
-               krb5_set_error_string(context, "out of memory");
+           hex_encode(md, sizeof(md), &mdx);
+           if (mdx == NULL) {
+               krb5_clear_error_string(context);
+               ret = ENOMEM;
+               goto out;
+           }
+
+           r.element = choice_DigestRepInner_response;
+           ret = strcasecmp(mdx, ireq.u.digestRequest.responseData);
+           free(mdx);
+           if (ret == 0) {
+               r.u.response.success = TRUE;
+           } else {
+               kdc_log(context, config, 0, 
+                       "DIGEST-MD5 reply mismatch for %s",
+                       ireq.u.digestRequest.username);
+               r.u.response.success = FALSE;
+           }
+
+       } else if (strcasecmp(ireq.u.digestRequest.type, "MS-CHAP-V2") == 0) {
+           unsigned char md[SHA_DIGEST_LENGTH], challange[SHA_DIGEST_LENGTH];
+           char *mdx;
+           const char *username;
+           struct ntlm_buf answer;
+           Key *key = NULL;
+           SHA_CTX ctx;
+
+           if ((config->digests_allowed & MS_CHAP_V2) == 0) {
+               kdc_log(context, config, 0, "MS-CHAP-V2 not allowed");
+               goto out;
+           }
+
+           if (ireq.u.digestRequest.clientNonce == NULL)  {
+               krb5_set_error_string(context, 
+                                     "MS-CHAP-V2 clientNonce missing");
+               ret = EINVAL;
+               goto out;
+           }       
+           if (serverNonce.length != 16) {
+               krb5_set_error_string(context, 
+                                     "MS-CHAP-V2 serverNonce wrong length");
+               ret = EINVAL;
+               goto out;
+           }
+
+           /* strip of the domain component */
+           username = strchr(ireq.u.digestRequest.username, '\\');
+           if (username == NULL)
+               username = ireq.u.digestRequest.username;
+           else
+               username++;
+
+           /* ChallangeHash */
+           SHA1_Init(&ctx);
+           {
+               ssize_t ssize;
+               krb5_data clientNonce;
+               
+               clientNonce.length = strlen(*ireq.u.digestRequest.clientNonce);
+               clientNonce.data = malloc(clientNonce.length);
+               if (clientNonce.data == NULL) {
+                   ret = ENOMEM;
+                   krb5_set_error_string(context, "out of memory");
+                   goto out;
+               }
+
+               ssize = hex_decode(*ireq.u.digestRequest.clientNonce, 
+                                  clientNonce.data, clientNonce.length);
+               if (ssize != 16) {
+                   krb5_set_error_string(context, 
+                                         "Failed to decode clientNonce");
+                   ret = ENOMEM;
+                   goto out;
+               }
+               SHA1_Update(&ctx, clientNonce.data, ssize);
+               free(clientNonce.data);
+           }
+           SHA1_Update(&ctx, serverNonce.data, serverNonce.length);
+           SHA1_Update(&ctx, username, strlen(username));
+           SHA1_Final(challange, &ctx);
+
+           /* NtPasswordHash */
+           ret = krb5_parse_name(context, username, &clientprincipal);
+           if (ret)
+               goto out;
+           
+           ret = _kdc_db_fetch(context, config, clientprincipal,
+                               HDB_F_GET_CLIENT, NULL, &user);
+           krb5_free_principal(context, clientprincipal);
+           if (ret) {
+               krb5_set_error_string(context, 
+                                     "MS-CHAP-V2 user %s not in database",
+                                     username);
+               goto out;
+           }
+
+           ret = hdb_enctype2key(context, &user->entry, 
+                                 ETYPE_ARCFOUR_HMAC_MD5, &key);
+           if (ret) {
+               krb5_set_error_string(context, 
+                                     "MS-CHAP-V2 missing arcfour key %s",
+                                     username);
+               goto out;
+           }
+
+           /* ChallengeResponse */
+           ret = heim_ntlm_calculate_ntlm1(key->key.keyvalue.data,
+                                           key->key.keyvalue.length,
+                                           challange, &answer);
+           if (ret) {
+               krb5_set_error_string(context, "NTLM missing arcfour key");
+               goto out;
+           }
+           
+           hex_encode(answer.data, answer.length, &mdx);
+           if (mdx == NULL) {
+               free(answer.data);
+               krb5_clear_error_string(context);
                ret = ENOMEM;
                goto out;
            }
 
                ret = ENOMEM;
                goto out;
            }
 
+           r.element = choice_DigestRepInner_response;
+           ret = strcasecmp(mdx, ireq.u.digestRequest.responseData);
+           free(mdx);
+           if (ret == 0) {
+               r.u.response.success = TRUE;
+           } else {
+               kdc_log(context, config, 0, 
+                       "MS-CHAP-V2 reply mismatch for %s",
+                       ireq.u.digestRequest.username);
+               r.u.response.success = FALSE;
+           }
+
+           if (r.u.response.success) {
+               unsigned char hashhash[MD4_DIGEST_LENGTH];
+
+               /* hashhash */
+               {
+                   MD4_CTX hctx;
+
+                   MD4_Init(&hctx);
+                   MD4_Update(&hctx, key->key.keyvalue.data, 
+                              key->key.keyvalue.length);
+                   MD4_Final(hashhash, &hctx);
+               }
+
+               /* GenerateAuthenticatorResponse */
+               SHA1_Init(&ctx);
+               SHA1_Update(&ctx, hashhash, sizeof(hashhash));
+               SHA1_Update(&ctx, answer.data, answer.length);
+               SHA1_Update(&ctx, ms_chap_v2_magic1,sizeof(ms_chap_v2_magic1));
+               SHA1_Final(md, &ctx);
+
+               SHA1_Init(&ctx);
+               SHA1_Update(&ctx, md, sizeof(md));
+               SHA1_Update(&ctx, challange, 8);
+               SHA1_Update(&ctx, ms_chap_v2_magic2, sizeof(ms_chap_v2_magic2));
+               SHA1_Final(md, &ctx);
+
+               r.u.response.rsp = calloc(1, sizeof(*r.u.response.rsp));
+               if (r.u.response.rsp == NULL) {
+                   free(answer.data);
+                   krb5_clear_error_string(context);
+                   ret = ENOMEM;
+                   goto out;
+               }
+
+               hex_encode(md, sizeof(md), r.u.response.rsp);
+               if (r.u.response.rsp == NULL) {
+                   free(answer.data);
+                   krb5_clear_error_string(context);
+                   ret = ENOMEM;
+                   goto out;
+               }
+
+               /* get_master, rfc 3079 3.4 */
+               SHA1_Init(&ctx);
+               SHA1_Update(&ctx, hashhash, 16); /* md4(hash) */
+               SHA1_Update(&ctx, answer.data, answer.length);
+               SHA1_Update(&ctx, ms_rfc3079_magic1, sizeof(ms_rfc3079_magic1));
+               SHA1_Final(md, &ctx);
+
+               free(answer.data);
+
+               r.u.response.session_key = 
+                   calloc(1, sizeof(*r.u.response.session_key));
+               if (r.u.response.session_key == NULL) {
+                   krb5_clear_error_string(context);
+                   ret = ENOMEM;
+                   goto out;
+               }
+
+               ret = krb5_data_copy(r.u.response.session_key, md, 16);
+               if (ret) {
+                   krb5_clear_error_string(context);
+                   goto out;
+               }
+           }
+
        } else {
            r.element = choice_DigestRepInner_error;
        } else {
            r.element = choice_DigestRepInner_error;
-           asprintf(&r.u.error.reason, "unsupported digest type %s", 
+           asprintf(&r.u.error.reason, "Unsupported digest type %s", 
                     ireq.u.digestRequest.type);
            if (r.u.error.reason == NULL) {
                krb5_set_error_string(context, "out of memory");
                     ireq.u.digestRequest.type);
            if (r.u.error.reason == NULL) {
                krb5_set_error_string(context, "out of memory");
@@ -745,7 +961,6 @@ _kdc_do_digest(krb5_context context,
            goto out;
        }
 
            goto out;
        }
 
-
        r.element = choice_DigestRepInner_ntlmInitReply;
 
        r.u.ntlmInitReply.flags = NTLM_NEG_UNICODE;
        r.element = choice_DigestRepInner_ntlmInitReply;
 
        r.u.ntlmInitReply.flags = NTLM_NEG_UNICODE;
@@ -766,12 +981,12 @@ _kdc_do_digest(krb5_context context,
            NTLM_NEG_TARGET_DOMAIN |
            NTLM_ENC_128;
 
            NTLM_NEG_TARGET_DOMAIN |
            NTLM_ENC_128;
 
-#define ALL \
-       NTLM_NEG_SIGN| \
-       NTLM_NEG_SEAL| \
-       NTLM_NEG_ALWAYS_SIGN| \
-       NTLM_NEG_NTLM2_SESSION| \
-       NTLM_NEG_KEYEX
+#define ALL                                    \
+       NTLM_NEG_SIGN|                          \
+           NTLM_NEG_SEAL|                      \
+           NTLM_NEG_ALWAYS_SIGN|               \
+           NTLM_NEG_NTLM2_SESSION|             \
+           NTLM_NEG_KEYEX
 
        r.u.ntlmInitReply.flags |= (ireq.u.ntlmInit.flags & (ALL));
 
 
        r.u.ntlmInitReply.flags |= (ireq.u.ntlmInit.flags & (ALL));
 
@@ -989,6 +1204,7 @@ _kdc_do_digest(krb5_context context,
                
                if ((config->digests_allowed & NTLM_V1_SESSION) == 0) {
                    kdc_log(context, config, 0, "NTLM v1-session not allowed");
                
                if ((config->digests_allowed & NTLM_V1_SESSION) == 0) {
                    kdc_log(context, config, 0, "NTLM v1-session not allowed");
+                   ret = EINVAL;
                    goto out;
                }
 
                    goto out;
                }
 
@@ -1048,6 +1264,7 @@ _kdc_do_digest(krb5_context context,
                krb5_set_error_string(context,
                                      "NTLM client failed to neg key "
                                      "exchange but still sent key");
                krb5_set_error_string(context,
                                      "NTLM client failed to neg key "
                                      "exchange but still sent key");
+               ret = EINVAL;
                goto out;
            }
            
                goto out;
            }
            
index 56ddc8090b64b1a7b6a3e94b67158fcf017f3f89..64f6b6e438cb60e3555df677b8ada4042249ea0c 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /* 
  */
 
 /* 
- * $Id: headers.h,v 1.22 2007/01/04 00:15:34 lha Exp $ 
+ * $Id: headers.h 19658 2007-01-04 00:15:34Z lha $ 
  */
 
 #ifndef __HEADERS_H__
  */
 
 #ifndef __HEADERS_H__
index ac282717ed0c3988e0da5010abb9a6a2ffb4b884..deb32e1019954daff756f1cad50ad2cb9b31a7b4 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: kaserver.c,v 1.36 2006/08/23 11:43:44 lha Exp $");
+RCSID("$Id: kaserver.c 17904 2006-08-23 11:45:16Z lha $");
 
 #include <krb5-v4compat.h>
 #include <rx.h>
 
 #include <krb5-v4compat.h>
 #include <rx.h>
index d896bd10e9988be4c3800a9657aadf2d8c632943..030be9ae58baeabc2717d43acb642d99c58d1e01 100644 (file)
@@ -149,9 +149,9 @@ _kdc_find_etype (
        Key **/*ret_key*/,
        krb5_enctype */*ret_etype*/);
 
        Key **/*ret_key*/,
        krb5_enctype */*ret_etype*/);
 
-PA_DATA*
+const PA_DATA*
 _kdc_find_padata (
 _kdc_find_padata (
-       KDC_REQ */*req*/,
+       const KDC_REQ */*req*/,
        int */*start*/,
        int /*type*/);
 
        int */*start*/,
        int /*type*/);
 
@@ -249,8 +249,8 @@ krb5_error_code
 _kdc_pk_rd_padata (
        krb5_context /*context*/,
        krb5_kdc_configuration */*config*/,
 _kdc_pk_rd_padata (
        krb5_context /*context*/,
        krb5_kdc_configuration */*config*/,
-       KDC_REQ */*req*/,
-       PA_DATA */*pa*/,
+       const KDC_REQ */*req*/,
+       const PA_DATA */*pa*/,
        pk_client_params **/*ret_params*/);
 
 krb5_error_code
        pk_client_params **/*ret_params*/);
 
 krb5_error_code
@@ -283,7 +283,4 @@ _kdc_windc_client_access (
        struct hdb_entry_ex */*client*/,
        KDC_REQ */*req*/);
 
        struct hdb_entry_ex */*client*/,
        KDC_REQ */*req*/);
 
-krb5_error_code
-_kdc_windc_init (krb5_context /*context*/);
-
 #endif /* __kdc_private_h__ */
 #endif /* __kdc_private_h__ */
index 69bc871b01dd30ebacdd5443edfeb340a6f1d290..f7df365eb2aa9503f2178da17cc56723a3050010 100644 (file)
@@ -37,8 +37,10 @@ kdc_openlog (
        krb5_context /*context*/,
        krb5_kdc_configuration */*config*/);
 
        krb5_context /*context*/,
        krb5_kdc_configuration */*config*/);
 
-void
-krb5_kdc_default_config (krb5_kdc_configuration */*config*/);
+int
+krb5_kdc_get_config (
+       krb5_context /*context*/,
+       krb5_kdc_configuration **/*config*/);
 
 int
 krb5_kdc_process_krb5_request (
 
 int
 krb5_kdc_process_krb5_request (
@@ -63,6 +65,21 @@ krb5_kdc_process_request (
        struct sockaddr */*addr*/,
        int /*datagram_reply*/);
 
        struct sockaddr */*addr*/,
        int /*datagram_reply*/);
 
+int
+krb5_kdc_save_request (
+       krb5_context /*context*/,
+       const char */*fn*/,
+       const unsigned char */*buf*/,
+       size_t /*len*/,
+       const krb5_data */*reply*/,
+       const struct sockaddr */*sa*/);
+
+void
+krb5_kdc_update_time (struct timeval */*tv*/);
+
+krb5_error_code
+krb5_kdc_windc_init (krb5_context /*context*/);
+
 #ifdef __cplusplus
 }
 #endif
 #ifdef __cplusplus
 }
 #endif
index ea9eb7125e504d86b02463082f2afb5723c53429..eb24b4ee97012dad0ef50f801763d1d7c7cf1df4 100644 (file)
@@ -35,7 +35,7 @@
  */
 
 /* 
  */
 
 /* 
- * $Id: kdc.h,v 1.11 2006/12/28 21:06:56 lha Exp $ 
+ * $Id: kdc.h 19907 2007-01-14 23:10:24Z lha $ 
  */
 
 #ifndef __KDC_H__
  */
 
 #ifndef __KDC_H__
@@ -86,6 +86,8 @@ typedef struct krb5_kdc_configuration {
     size_t max_datagram_reply_length;
 
     int enable_kx509;
     size_t max_datagram_reply_length;
 
     int enable_kx509;
+    const char *kx509_template;
+    const char *kx509_ca;
 
 } krb5_kdc_configuration;
 
 
 } krb5_kdc_configuration;
 
index ae3b6584a570b91ff015cfcdfeb91dacd81330c8..fdbdf271defa233a161caf75256e03828517a977 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /* 
  */
 
 /* 
- * $Id: kdc_locl.h,v 1.76 2006/12/26 17:18:14 lha Exp $ 
+ * $Id: kdc_locl.h 20954 2007-06-07 03:30:15Z lha $ 
  */
 
 #ifndef __KDC_LOCL_H__
  */
 
 #ifndef __KDC_LOCL_H__
@@ -46,6 +46,7 @@ typedef struct pk_client_params pk_client_params;
 
 extern sig_atomic_t exit_flag;
 extern size_t max_request;
 
 extern sig_atomic_t exit_flag;
 extern size_t max_request;
+extern const char *request_log;
 extern const char *port_str;
 extern krb5_addresses explicit_addresses;
 
 extern const char *port_str;
 extern krb5_addresses explicit_addresses;
 
@@ -55,18 +56,6 @@ extern int enable_http;
 
 extern int detach_from_console;
 
 
 extern int detach_from_console;
 
-extern int require_preauth; /* 1 == require preauth for all principals */
-
-extern const char *trpolicy_str;
-
-extern int disable_des;
-extern int enable_v4;
-extern int enable_kaserver;
-extern int enable_524;
-extern int enable_v4_cross_realm;
-
-extern char *v4_realm;
-
 extern const struct units _kdc_digestunits[];
 
 #define _PATH_KDC_CONF         HDB_DB_DIR "/kdc.conf"
 extern const struct units _kdc_digestunits[];
 
 #define _PATH_KDC_CONF         HDB_DB_DIR "/kdc.conf"
@@ -81,6 +70,4 @@ loop(krb5_context context, krb5_kdc_configuration *config);
 krb5_kdc_configuration *
 configure(krb5_context context, int argc, char **argv);
 
 krb5_kdc_configuration *
 configure(krb5_context context, int argc, char **argv);
 
-void krb5_kdc_configure(krb5_context context, krb5_kdc_configuration *config);
-
 #endif /* __KDC_LOCL_H__ */
 #endif /* __KDC_LOCL_H__ */
index 97e98d86ad3ae931b7a4da7f56e66e05a4618a3a..3c76bb99b22a24fb6bdeede9ca77fde3af14f4c2 100644 (file)
@@ -35,7 +35,7 @@
 
 #include <krb5-v4compat.h>
 
 
 #include <krb5-v4compat.h>
 
-RCSID("$Id: kerberos4.c,v 1.63 2006/10/08 13:43:27 lha Exp $");
+RCSID("$Id: kerberos4.c 18349 2006-10-08 13:43:52Z lha $");
 
 #ifndef swap32
 static uint32_t
 
 #ifndef swap32
 static uint32_t
index bb0fda89e7693b5b9672faa38327529d8df82566..e34938447a263eb2479d01cbed4916a85186d647 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: kerberos5.c,v 1.231 2007/01/04 13:27:27 lha Exp $");
+RCSID("$Id: kerberos5.c 21040 2007-06-10 06:20:59Z lha $");
 
 #define MAX_TIME ((time_t)((1U << 31) - 1))
 
 
 #define MAX_TIME ((time_t)((1U << 31) - 1))
 
@@ -70,9 +70,12 @@ set_salt_padata (METHOD_DATA *md, Salt *salt)
     }
 }
 
     }
 }
 
-PA_DATA*
-_kdc_find_padata(KDC_REQ *req, int *start, int type)
+const PA_DATA*
+_kdc_find_padata(const KDC_REQ *req, int *start, int type)
 {
 {
+    if (req->padata == NULL)
+       return NULL;
+
     while(*start < req->padata->len){
        (*start)++;
        if(req->padata->val[*start - 1].padata_type == type)
     while(*start < req->padata->len){
        (*start)++;
        if(req->padata->val[*start - 1].padata_type == type)
@@ -431,7 +434,8 @@ get_pa_etype_info(krb5_context context,
        ret = krb5_unparse_name(context, client->principal, &name);
        if (ret)
            name = rk_UNCONST("<unparse_name failed>");
        ret = krb5_unparse_name(context, client->principal, &name);
        if (ret)
            name = rk_UNCONST("<unparse_name failed>");
-       kdc_log(context, config, 0, "internal error in get_pa_etype_info(%s): %d != %d", 
+       kdc_log(context, config, 0, 
+               "internal error in get_pa_etype_info(%s): %d != %d", 
                name, n, pa.len);
        if (ret == 0)
            free(name);
                name, n, pa.len);
        if (ret == 0)
            free(name);
@@ -689,11 +693,11 @@ log_as_req(krb5_context context,
     }
     
     {
     }
     
     {
-       char _str[128];
+       char fixedstr[128];
        unparse_flags(KDCOptions2int(b->kdc_options), asn1_KDCOptions_units(), 
        unparse_flags(KDCOptions2int(b->kdc_options), asn1_KDCOptions_units(), 
-                     _str, sizeof(_str));
-       if(*_str)
-           kdc_log(context, config, 2, "Requested flags: %s", _str);
+                     fixedstr, sizeof(fixedstr));
+       if(*fixedstr)
+           kdc_log(context, config, 2, "Requested flags: %s", fixedstr);
     }
 }
 
     }
 }
 
@@ -870,7 +874,7 @@ send_pac_p(krb5_context context, KDC_REQ *req)
 {
     krb5_error_code ret;
     PA_PAC_REQUEST pacreq;
 {
     krb5_error_code ret;
     PA_PAC_REQUEST pacreq;
-    PA_DATA *pa;
+    const PA_DATA *pa;
     int i = 0;
     
     pa = _kdc_find_padata(req, &i, KRB5_PADATA_PA_PAC_REQUEST);
     int i = 0;
     
     pa = _kdc_find_padata(req, &i, KRB5_PADATA_PA_PAC_REQUEST);
@@ -909,32 +913,37 @@ _kdc_as_rep(krb5_context context,
     KDCOptions f = b->kdc_options;
     hdb_entry_ex *client = NULL, *server = NULL;
     krb5_enctype cetype, setype, sessionetype;
     KDCOptions f = b->kdc_options;
     hdb_entry_ex *client = NULL, *server = NULL;
     krb5_enctype cetype, setype, sessionetype;
+    krb5_data e_data;
     EncTicketPart et;
     EncKDCRepPart ek;
     krb5_principal client_princ = NULL, server_princ = NULL;
     char *client_name = NULL, *server_name = NULL;
     krb5_error_code ret = 0;
     const char *e_text = NULL;
     EncTicketPart et;
     EncKDCRepPart ek;
     krb5_principal client_princ = NULL, server_princ = NULL;
     char *client_name = NULL, *server_name = NULL;
     krb5_error_code ret = 0;
     const char *e_text = NULL;
-    krb5_data e_data;
     krb5_crypto crypto;
     Key *ckey, *skey;
     EncryptionKey *reply_key;
     krb5_crypto crypto;
     Key *ckey, *skey;
     EncryptionKey *reply_key;
+    int flags = 0;
 #ifdef PKINIT
     pk_client_params *pkp = NULL;
 #endif
 
     memset(&rep, 0, sizeof(rep));
 #ifdef PKINIT
     pk_client_params *pkp = NULL;
 #endif
 
     memset(&rep, 0, sizeof(rep));
-    memset(&e_data, 0, sizeof(e_data));
+    krb5_data_zero(&e_data);
+
+    if (f.canonicalize)
+       flags |= HDB_F_CANON;
 
     if(b->sname == NULL){
        ret = KRB5KRB_ERR_GENERIC;
        e_text = "No server in request";
     } else{
 
     if(b->sname == NULL){
        ret = KRB5KRB_ERR_GENERIC;
        e_text = "No server in request";
     } else{
-       _krb5_principalname2krb5_principal (context,
-                                           &server_princ,
-                                           *(b->sname),
-                                           b->realm);
-       ret = krb5_unparse_name(context, server_princ, &server_name);
+       ret = _krb5_principalname2krb5_principal (context,
+                                                 &server_princ,
+                                                 *(b->sname),
+                                                 b->realm);
+       if (ret == 0)
+           ret = krb5_unparse_name(context, server_princ, &server_name);
     }
     if (ret) {
        kdc_log(context, config, 0, 
     }
     if (ret) {
        kdc_log(context, config, 0, 
@@ -946,10 +955,26 @@ _kdc_as_rep(krb5_context context,
        ret = KRB5KRB_ERR_GENERIC;
        e_text = "No client in request";
     } else {
        ret = KRB5KRB_ERR_GENERIC;
        e_text = "No client in request";
     } else {
-       _krb5_principalname2krb5_principal (context,
-                                           &client_princ,
-                                           *(b->cname),
-                                           b->realm);
+
+       if (b->cname->name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
+           if (b->cname->name_string.len != 1) {
+               kdc_log(context, config, 0,
+                       "AS-REQ malformed canon request from %s", from);
+               ret = KRB5_PARSE_MALFORMED;
+               goto out;
+           }
+           ret = krb5_parse_name(context, b->cname->name_string.val[0],
+                                 &client_princ);
+           if (ret)
+               goto out;
+       } else {
+           ret = _krb5_principalname2krb5_principal (context,
+                                                     &client_princ,
+                                                     *(b->cname),
+                                                     b->realm);
+           if (ret)
+               goto out;
+       }
        ret = krb5_unparse_name(context, client_princ, &client_name);
     }
     if (ret) {
        ret = krb5_unparse_name(context, client_princ, &client_name);
     }
     if (ret) {
@@ -962,7 +987,7 @@ _kdc_as_rep(krb5_context context,
            client_name, from, server_name);
 
     ret = _kdc_db_fetch(context, config, client_princ, 
            client_name, from, server_name);
 
     ret = _kdc_db_fetch(context, config, client_princ, 
-                       HDB_F_GET_CLIENT, NULL, &client);
+                       HDB_F_GET_CLIENT | flags, NULL, &client);
     if(ret){
        kdc_log(context, config, 0, "UNKNOWN -- %s: %s", client_name,
                krb5_get_err_text(context, ret));
     if(ret){
        kdc_log(context, config, 0, "UNKNOWN -- %s: %s", client_name,
                krb5_get_err_text(context, ret));
@@ -996,7 +1021,7 @@ _kdc_as_rep(krb5_context context,
 
     if(req->padata){
        int i;
 
     if(req->padata){
        int i;
-       PA_DATA *pa;
+       const PA_DATA *pa;
        int found_pa = 0;
 
        log_patypes(context, config, req->padata);
        int found_pa = 0;
 
        log_patypes(context, config, req->padata);
@@ -1041,7 +1066,7 @@ _kdc_as_rep(krb5_context context,
 
                kdc_log(context, config, 0, "%s", e_text);
                pkp = NULL;
 
                kdc_log(context, config, 0, "%s", e_text);
                pkp = NULL;
-               goto ts_enc;
+               goto out;
            }
            found_pa = 1;
            et.flags.pre_authent = 1;
            }
            found_pa = 1;
            et.flags.pre_authent = 1;
@@ -1169,6 +1194,8 @@ _kdc_as_rep(krb5_context context,
                        (unsigned)abs(kdc_time - p.patimestamp), 
                        context->max_skew,
                        client_name);
                        (unsigned)abs(kdc_time - p.patimestamp), 
                        context->max_skew,
                        client_name);
+#if 1
+               /* This code is from samba, needs testing */
                /* 
                 * the following is needed to make windows clients
                 * to retry using the timestamp in the error message
                /* 
                 * the following is needed to make windows clients
                 * to retry using the timestamp in the error message
@@ -1177,6 +1204,9 @@ _kdc_as_rep(krb5_context context,
                 * is present...
                 */
                e_text = NULL;
                 * is present...
                 */
                e_text = NULL;
+#else
+               e_text = "Too large time skew";
+#endif
                goto out;
            }
            et.flags.pre_authent = 1;
                goto out;
            }
            et.flags.pre_authent = 1;
@@ -1227,6 +1257,12 @@ _kdc_as_rep(krb5_context context,
        pa->padata_type         = KRB5_PADATA_PK_AS_REQ;
        pa->padata_value.length = 0;
        pa->padata_value.data   = NULL;
        pa->padata_type         = KRB5_PADATA_PK_AS_REQ;
        pa->padata_value.length = 0;
        pa->padata_value.data   = NULL;
+
+       ret = realloc_method_data(&method_data);
+       pa = &method_data.val[method_data.len-1];
+       pa->padata_type         = KRB5_PADATA_PK_AS_REQ_WIN;
+       pa->padata_value.length = 0;
+       pa->padata_value.data   = NULL;
 #endif
 
        /* 
 #endif
 
        /* 
@@ -1253,12 +1289,12 @@ _kdc_as_rep(krb5_context context,
        e_data.data   = buf;
        e_data.length = len;
        e_text ="Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ",
        e_data.data   = buf;
        e_data.length = len;
        e_text ="Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ",
+
        ret = KRB5KDC_ERR_PREAUTH_REQUIRED;
 
        kdc_log(context, config, 0,
                "No preauth found, returning PREAUTH-REQUIRED -- %s",
                client_name);
        ret = KRB5KDC_ERR_PREAUTH_REQUIRED;
 
        kdc_log(context, config, 0,
                "No preauth found, returning PREAUTH-REQUIRED -- %s",
                client_name);
-
        goto out;
     }
     
        goto out;
     }
     
@@ -1283,45 +1319,57 @@ _kdc_as_rep(krb5_context context,
     if(ret)
        goto out;
 
     if(ret)
        goto out;
 
+    /* 
+     * Select a session enctype from the list of the crypto systems
+     * supported enctype, is supported by the client and is one of the
+     * enctype of the enctype of the krbtgt.
+     *
+     * The later is used as a hint what enctype all KDC are supporting
+     * to make sure a newer version of KDC wont generate a session
+     * enctype that and older version of a KDC in the same realm can't
+     * decrypt.
+     *
+     * But if the KDC admin is paranoid and doesn't want to have "no
+     * the best" enctypes on the krbtgt, lets save the best pick from
+     * the client list and hope that that will work for any other
+     * KDCs.
+     */
     {
        const krb5_enctype *p;
     {
        const krb5_enctype *p;
-       int i, j, y;
+       krb5_enctype clientbest = ETYPE_NULL;
+       int i, j;
 
        p = krb5_kerberos_enctypes(context);
 
        sessionetype = ETYPE_NULL;
 
        for (i = 0; p[i] != ETYPE_NULL && sessionetype == ETYPE_NULL; i++) {
 
        p = krb5_kerberos_enctypes(context);
 
        sessionetype = ETYPE_NULL;
 
        for (i = 0; p[i] != ETYPE_NULL && sessionetype == ETYPE_NULL; i++) {
-           /* check it's valid */
            if (krb5_enctype_valid(context, p[i]) != 0)
                continue;
 
            if (krb5_enctype_valid(context, p[i]) != 0)
                continue;
 
-           /* check if the client supports it */
            for (j = 0; j < b->etype.len && sessionetype == ETYPE_NULL; j++) {
            for (j = 0; j < b->etype.len && sessionetype == ETYPE_NULL; j++) {
-               if (p[i] == b->etype.val[j]) {
-                   /*
-                    * if the server (krbtgt) has explicit etypes,
-                    * check if it also supports it
-                    */
-                   if (server->entry.etypes) {
-                       for (y = 0; y < server->entry.etypes->len; y++) {
-                           if (p[i] == server->entry.etypes->val[y]) {
-                               sessionetype = p[i];
-                               break;
-                           }
-                       }
-                   } else {
-                       sessionetype = p[i];
-                       break;
-                   }
-               }
+               Key *dummy;
+               /* check with client */
+               if (p[i] != b->etype.val[j])
+                   continue; 
+               /* save best of union of { client, crypto system } */
+               if (clientbest == ETYPE_NULL)
+                   clientbest = p[i];
+               /* check with krbtgt */
+               ret = hdb_enctype2key(context, &server->entry, p[i], &dummy);
+               if (ret) 
+                   continue;
+               sessionetype = p[i];
            }
        }
            }
        }
-       if (sessionetype == ETYPE_NULL) {
-           kdc_log(context, config, 0, 
+       /* if krbtgt had no shared keys with client, pick clients best */
+       if (clientbest != ETYPE_NULL && sessionetype == ETYPE_NULL) {
+           sessionetype = clientbest;
+       } else if (sessionetype == ETYPE_NULL) {
+           kdc_log(context, config, 0,
                    "Client (%s) from %s has no common enctypes with KDC"
                    "Client (%s) from %s has no common enctypes with KDC"
-                   "to use for the session key",
-                   client_name, from);
+                   "to use for the session key", 
+                   client_name, from); 
            goto out;
        }
     }
            goto out;
        }
     }
@@ -1534,6 +1582,58 @@ _kdc_as_rep(krb5_context context,
 
     set_salt_padata (rep.padata, ckey->salt);
 
 
     set_salt_padata (rep.padata, ckey->salt);
 
+    /* Add signing of alias referral */
+    if (f.canonicalize) {
+       PA_ClientCanonicalized canon;
+       krb5_data data;
+       PA_DATA pa;
+       krb5_crypto crypto;
+       size_t len;
+
+       memset(&canon, 0, sizeof(canon));
+
+       canon.names.requested_name = *b->cname;
+       canon.names.real_name = client->entry.principal->name;
+
+       ASN1_MALLOC_ENCODE(PA_ClientCanonicalizedNames, data.data, data.length,
+                          &canon.names, &len, ret);
+       if (ret) 
+           goto out;
+       if (data.length != len)
+           krb5_abortx(context, "internal asn.1 error");
+
+       /* sign using "returned session key" */
+       ret = krb5_crypto_init(context, &et.key, 0, &crypto);
+       if (ret) {
+           free(data.data);
+           goto out;
+       }
+
+       ret = krb5_create_checksum(context, crypto, 
+                                  KRB5_KU_CANONICALIZED_NAMES, 0,
+                                  data.data, data.length,
+                                  &canon.canon_checksum);
+       free(data.data);
+       krb5_crypto_destroy(context, crypto);
+       if (ret)
+           goto out;
+         
+       ASN1_MALLOC_ENCODE(PA_ClientCanonicalized, data.data, data.length,
+                          &canon, &len, ret);
+       free_Checksum(&canon.canon_checksum);
+       if (ret) 
+           goto out;
+       if (data.length != len)
+           krb5_abortx(context, "internal asn.1 error");
+
+       pa.padata_type = KRB5_PADATA_CLIENT_CANONICALIZED;
+       pa.padata_value = data;
+       ret = add_METHOD_DATA(rep.padata, &pa);
+       free(data.data);
+       if (ret)
+           goto out;
+    }
+
     if (rep.padata->len == 0) {
        free(rep.padata);
        rep.padata = NULL;
     if (rep.padata->len == 0) {
        free(rep.padata);
        rep.padata = NULL;
index a056839e5f3751a5a7034b429b34e89389b422cd..02cd92de2e3cb17f059ba31bc271ebf946d1b14c 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: krb5tgs.c,v 1.25 2007/01/04 12:49:45 lha Exp $");
+RCSID("$Id: krb5tgs.c 21041 2007-06-10 06:21:12Z lha $");
 
 /*
  * return the realm of a krbtgt-ticket or NULL
 
 /*
  * return the realm of a krbtgt-ticket or NULL
@@ -656,7 +656,7 @@ tgs_make_reply(krb5_context context,
               KDC_REQ_BODY *b, 
               krb5_const_principal tgt_name,
               const EncTicketPart *tgt, 
               KDC_REQ_BODY *b, 
               krb5_const_principal tgt_name,
               const EncTicketPart *tgt, 
-              const EncryptionKey *ekey,
+              const EncryptionKey *serverkey,
               const krb5_keyblock *sessionkey,
               krb5_kvno kvno,
               AuthorizationData *auth_data,
               const krb5_keyblock *sessionkey,
               krb5_kvno kvno,
               AuthorizationData *auth_data,
@@ -883,7 +883,7 @@ tgs_make_reply(krb5_context context,
     ret = _kdc_encode_reply(context, config, 
                            &rep, &et, &ek, et.key.keytype,
                            kvno, 
     ret = _kdc_encode_reply(context, config, 
                            &rep, &et, &ek, et.key.keytype,
                            kvno, 
-                           ekey, 0, &tgt->key, e_text, reply);
+                           serverkey, 0, &tgt->key, e_text, reply);
 out:
     free_TGS_REP(&rep);
     free_TransitedEncoding(&et.transited);
 out:
     free_TGS_REP(&rep);
     free_TransitedEncoding(&et.transited);
@@ -1010,7 +1010,7 @@ static krb5_error_code
 tgs_parse_request(krb5_context context, 
                  krb5_kdc_configuration *config,
                  KDC_REQ_BODY *b,
 tgs_parse_request(krb5_context context, 
                  krb5_kdc_configuration *config,
                  KDC_REQ_BODY *b,
-                 PA_DATA *tgs_req,
+                 const PA_DATA *tgs_req,
                  hdb_entry_ex **krbtgt,
                  krb5_enctype *krbtgt_etype,
                  krb5_ticket **ticket,
                  hdb_entry_ex **krbtgt,
                  krb5_enctype *krbtgt_etype,
                  krb5_ticket **ticket,
@@ -1258,6 +1258,7 @@ tgs_build_reply(krb5_context context,
     krb5_keyblock sessionkey;
     krb5_kvno kvno;
     krb5_data rspac;
     krb5_keyblock sessionkey;
     krb5_kvno kvno;
     krb5_data rspac;
+    int cross_realm = 0;
 
     PrincipalName *s;
     Realm r;
 
     PrincipalName *s;
     Realm r;
@@ -1421,6 +1422,8 @@ server_lookup:
        
        kdc_log(context, config, 1, "Client not found in database: %s: %s",
                cpn, krb5_get_err_text(context, ret));
        
        kdc_log(context, config, 1, "Client not found in database: %s: %s",
                cpn, krb5_get_err_text(context, ret));
+
+       cross_realm = 1;
     }
     
     /*
     }
     
     /*
@@ -1707,21 +1710,25 @@ server_lookup:
     /* check PAC if there is one */
     {
        Key *tkey;
     /* check PAC if there is one */
     {
        Key *tkey;
+       krb5_keyblock *tgtkey = NULL;
 
 
-       ret = hdb_enctype2key(context, &krbtgt->entry, 
-                             krbtgt_etype, &tkey);
-       if(ret) {
-           kdc_log(context, config, 0,
-                   "Failed to find key for krbtgt PAC check");
-           goto out;
+       if (!cross_realm) {
+           ret = hdb_enctype2key(context, &krbtgt->entry, 
+                                 krbtgt_etype, &tkey);
+           if(ret) {
+               kdc_log(context, config, 0,
+                       "Failed to find key for krbtgt PAC check");
+               goto out;
+           }
+           tgtkey = &tkey->key;
        }
 
        ret = check_PAC(context, config, client_principal, 
        }
 
        ret = check_PAC(context, config, client_principal, 
-                       client, server, ekey, &tkey->key, 
+                       client, server, ekey, tgtkey,
                        tgt, &rspac, &require_signedpath);
        if (ret) {
            kdc_log(context, config, 0,
                        tgt, &rspac, &require_signedpath);
        if (ret) {
            kdc_log(context, config, 0,
-                   "check_PAC check failed for %s (%s) from %s with %s",
+                   "Verify PAC failed for %s (%s) from %s with %s",
                    spn, cpn, from, krb5_get_err_text(context, ret));
            goto out;
        }
                    spn, cpn, from, krb5_get_err_text(context, ret));
            goto out;
        }
@@ -1804,7 +1811,7 @@ _kdc_tgs_rep(krb5_context context,
     AuthorizationData *auth_data = NULL;
     krb5_error_code ret;
     int i = 0;
     AuthorizationData *auth_data = NULL;
     krb5_error_code ret;
     int i = 0;
-    PA_DATA *tgs_req = NULL;
+    const PA_DATA *tgs_req;
 
     hdb_entry_ex *krbtgt = NULL;
     krb5_ticket *ticket = NULL;
 
     hdb_entry_ex *krbtgt = NULL;
     krb5_ticket *ticket = NULL;
index d817338f731decafb2afe3d7e5ababddc30b46b6..8414ecb4b2a2b5abf7c2fa9d895b47719268230d 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
 
 #include "kdc_locl.h"
 #include <hex.h>
 
 #include "kdc_locl.h"
 #include <hex.h>
+#include <rfc2459_asn1.h>
+#include <hx509.h>
 
 
-RCSID("$Id: kx509.c,v 1.1 2006/12/28 21:03:53 lha Exp $");
+RCSID("$Id: kx509.c 19992 2007-01-20 09:06:18Z lha $");
 
 /*
  *
 
 /*
  *
@@ -140,72 +142,146 @@ build_certificate(krb5_context context,
                  krb5_principal principal,
                  krb5_data *certificate)
 {
                  krb5_principal principal,
                  krb5_data *certificate)
 {
-    /* XXX write code here to generate certificates */
-    FILE *in, *out;
-    krb5_error_code ret;
-    const char *program;
-    char *str, *strkey;
-    char tstr[64];
-    pid_t pid;
+    hx509_context hxctx = NULL;
+    hx509_ca_tbs tbs = NULL;
+    hx509_env env = NULL;
+    hx509_cert cert = NULL;
+    hx509_cert signer = NULL;
+    int ret;
+
+    if (krb5_principal_get_comp_string(context, principal, 1) != NULL) {
+       kdc_log(context, config, 0, "Principal is not a user");
+       return EINVAL;
+    }
 
 
-    snprintf(tstr, sizeof(tstr), "%lu", (unsigned long)endtime);
+    ret = hx509_context_init(&hxctx);
+    if (ret)
+       goto out;
 
 
-    ret = base64_encode(key->data, key->length, &strkey);
-    if (ret < 0) {
-       krb5_set_error_string(context, "failed to base64 encode key");
-       return ENOMEM;
-    }
+    ret = hx509_env_init(hxctx, &env);
+    if (ret)
+       goto out;
 
 
-    program = krb5_config_get_string(context,
-                                    NULL,
-                                    "kdc",
-                                    "kx509_cert_program",
-                                    NULL);
-    if (program == NULL) {
-       free(strkey);
-       krb5_set_error_string(context, "no certificate program configured");
-       return ENOENT;
-    }
+    ret = hx509_env_add(hxctx, env, "principal-name", 
+                       krb5_principal_get_comp_string(context, principal, 0));
+    if (ret)
+       goto out;
 
 
-    ret = krb5_unparse_name(context, principal, &str);
-    if (ret) {
-       free(strkey);
-       return ret;
+    {
+       hx509_certs certs;
+       hx509_query *q;
+
+       ret = hx509_certs_init(hxctx, config->kx509_ca, 0,
+                              NULL, &certs);
+       if (ret) {
+           kdc_log(context, config, 0, "Failed to load CA %s",
+                   config->kx509_ca);
+           goto out;
+       }
+       ret = hx509_query_alloc(hxctx, &q);
+       if (ret) {
+           hx509_certs_free(&certs);
+           goto out;
+       }
+
+       hx509_query_match_option(q, HX509_QUERY_OPTION_PRIVATE_KEY);
+       hx509_query_match_option(q, HX509_QUERY_OPTION_KU_KEYCERTSIGN);
+
+       ret = hx509_certs_find(hxctx, certs, q, &signer);
+       hx509_query_free(hxctx, q);
+       hx509_certs_free(&certs);
+       if (ret) {
+           kdc_log(context, config, 0, "Failed to find a CA in %s",
+                   config->kx509_ca);
+           goto out;
+       }
     }
 
     }
 
-    pid = pipe_execv(&in, &out, NULL, program, str, tstr, NULL);
-    free(str);
-    if (pid <= 0) {
-       free(strkey);
-       krb5_set_error_string(context, 
-                             "Failed to run the cert program %s",
-                             program);
-       return ret;
+    ret = hx509_ca_tbs_init(hxctx, &tbs);
+    if (ret)
+       goto out;
+
+    {
+       SubjectPublicKeyInfo spki;
+       heim_any any;
+
+       memset(&spki, 0, sizeof(spki));
+
+       spki.subjectPublicKey.data = key->data;
+       spki.subjectPublicKey.length = key->length * 8;
+
+       ret = der_copy_oid(oid_id_pkcs1_rsaEncryption(), 
+                          &spki.algorithm.algorithm);
+
+       any.data = "\x05\x00";
+       any.length = 2;
+       spki.algorithm.parameters = &any;
+
+       ret = hx509_ca_tbs_set_spki(hxctx, tbs, &spki);
+       der_free_oid(&spki.algorithm.algorithm);
+       if (ret)
+           goto out;
     }
     }
-    fprintf(in, "%s\n", strkey);
-    fclose(in);
-    free(strkey);
 
     {
 
     {
-       unsigned buf[1024 * 10];
-       size_t len;
+       hx509_certs certs;
+       hx509_cert template;
 
 
-       len = fread(buf, 1, sizeof(buf), out);
-       fclose(out);
-       if(len == 0) {
-           krb5_set_error_string(context, 
-                                 "Certificate program returned no data");
-           return KRB5KDC_ERR_PREAUTH_FAILED;
+       ret = hx509_certs_init(hxctx, config->kx509_template, 0,
+                              NULL, &certs);
+       if (ret) {
+           kdc_log(context, config, 0, "Failed to load template %s",
+                   config->kx509_template);
+           goto out;
        }
        }
-       ret = krb5_data_copy(certificate, buf, len);
+       ret = hx509_get_one_cert(hxctx, certs, &template);
+       hx509_certs_free(&certs);
        if (ret) {
        if (ret) {
-           krb5_set_error_string(context, "Failed To copy certificate");
-           return ret;
+           kdc_log(context, config, 0, "Failed to find template in %s",
+                   config->kx509_template);
+           goto out;
        }
        }
+       ret = hx509_ca_tbs_set_template(hxctx, tbs, 
+                                       HX509_CA_TEMPLATE_SUBJECT|
+                                       HX509_CA_TEMPLATE_KU|
+                                       HX509_CA_TEMPLATE_EKU,
+                                       template);
+       hx509_cert_free(template);
+       if (ret)
+           goto out;
     }
     }
-    kill(pid, SIGKILL);
-    waitpid(pid, NULL, 0);
+
+    hx509_ca_tbs_set_notAfter(hxctx, tbs, endtime);
+
+    hx509_ca_tbs_subject_expand(hxctx, tbs, env);
+    hx509_env_free(&env);
+
+    ret = hx509_ca_sign(hxctx, tbs, signer, &cert);
+    hx509_cert_free(signer);
+    if (ret)
+       goto out;
+
+    hx509_ca_tbs_free(&tbs);
+
+    ret = hx509_cert_binary(hxctx, cert, certificate);
+    hx509_cert_free(cert);
+    if (ret)
+       goto out;
+                     
+    hx509_context_free(&hxctx);
+
     return 0;
     return 0;
+out:
+    if (env)
+       hx509_env_free(&env);
+    if (tbs)
+       hx509_ca_tbs_free(&tbs);
+    if (signer)
+       hx509_cert_free(signer);
+    if (hxctx)
+       hx509_context_free(&hxctx);
+    krb5_set_error_string(context, "cert creation failed");
+    return ret;
 }
 
 /*
 }
 
 /*
@@ -299,6 +375,20 @@ _kdc_do_kx509(krb5_context context,
     if (ret)
        goto out;
 
     if (ret)
        goto out;
 
+    /* Verify that the key is encoded RSA key */
+    {
+       RSAPublicKey key;
+       size_t size;
+
+       ret = decode_RSAPublicKey(req->pk_key.data, req->pk_key.length,
+                                 &key, &size);
+       if (ret)
+           goto out;
+       free_RSAPublicKey(&key);
+       if (size != req->pk_key.length)
+           ;
+    }
+
     ALLOC(rep.certificate);
     if (rep.certificate == NULL)
        goto out;
     ALLOC(rep.certificate);
     if (rep.certificate == NULL)
        goto out;
index c316b0c5f88b0856827b547135d8b7efb47f9b74..977b1c9476015f3bd41a557cf57b74ef546eebc7 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "kdc_locl.h"
  */
 
 #include "kdc_locl.h"
-RCSID("$Id: log.c,v 1.16 2005/06/30 01:52:48 lha Exp $");
+RCSID("$Id: log.c 15532 2005-06-30 01:54:49Z lha $");
 
 void
 kdc_openlog(krb5_context context, 
 
 void
 kdc_openlog(krb5_context context, 
index b511e1a7a8d39a575ff8abec7ebad541bb0ae14a..ebf28735996a08c782af748133a62a09fa29fde3 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: misc.c,v 1.32 2006/08/28 14:41:49 lha Exp $");
+RCSID("$Id: misc.c 17951 2006-08-28 14:41:49Z lha $");
 
 struct timeval _kdc_now;
 
 
 struct timeval _kdc_now;
 
index 418a38d0307ab2b3969332c0cdf3b5725e20e9eb..bf62f879db7719eb18132d6a7cf0055bc3076a75 100755 (executable)
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: pkinit.c,v 1.86 2007/01/04 12:54:09 lha Exp $");
+RCSID("$Id: pkinit.c 21039 2007-06-10 06:20:31Z lha $");
 
 #ifdef PKINIT
 
 
 #ifdef PKINIT
 
@@ -97,7 +97,7 @@ static struct {
 static krb5_error_code
 pk_check_pkauthenticator_win2k(krb5_context context,
                               PKAuthenticator_Win2k *a,
 static krb5_error_code
 pk_check_pkauthenticator_win2k(krb5_context context,
                               PKAuthenticator_Win2k *a,
-                              KDC_REQ *req)
+                              const KDC_REQ *req)
 {
     krb5_timestamp now;
 
 {
     krb5_timestamp now;
 
@@ -114,7 +114,7 @@ pk_check_pkauthenticator_win2k(krb5_context context,
 static krb5_error_code
 pk_check_pkauthenticator(krb5_context context,
                         PKAuthenticator *a,
 static krb5_error_code
 pk_check_pkauthenticator(krb5_context context,
                         PKAuthenticator *a,
-                        KDC_REQ *req)
+                        const KDC_REQ *req)
 {
     u_char *buf = NULL;
     size_t buf_size;
 {
     u_char *buf = NULL;
     size_t buf_size;
@@ -365,8 +365,8 @@ get_dh_param(krb5_context context,
 krb5_error_code
 _kdc_pk_rd_padata(krb5_context context,
                  krb5_kdc_configuration *config,
 krb5_error_code
 _kdc_pk_rd_padata(krb5_context context,
                  krb5_kdc_configuration *config,
-                 KDC_REQ *req,
-                 PA_DATA *pa,
+                 const KDC_REQ *req,
+                 const PA_DATA *pa,
                  pk_client_params **ret_params)
 {
     pk_client_params *client_params;
                  pk_client_params **ret_params)
 {
     pk_client_params *client_params;
@@ -375,7 +375,6 @@ _kdc_pk_rd_padata(krb5_context context,
     krb5_data eContent = { 0, NULL };
     krb5_data signed_content = { 0, NULL };
     const char *type = "unknown type";
     krb5_data eContent = { 0, NULL };
     krb5_data signed_content = { 0, NULL };
     const char *type = "unknown type";
-    const heim_oid *pa_contentType;
     int have_data = 0;
 
     *ret_params = NULL;
     int have_data = 0;
 
     *ret_params = NULL;
@@ -385,6 +384,8 @@ _kdc_pk_rd_padata(krb5_context context,
        return 0;
     }
 
        return 0;
     }
 
+    hx509_verify_set_time(kdc_identity->verify_ctx, _kdc_now.tv_sec);
+
     client_params = calloc(1, sizeof(*client_params));
     if (client_params == NULL) {
        krb5_clear_error_string(context);
     client_params = calloc(1, sizeof(*client_params));
     if (client_params == NULL) {
        krb5_clear_error_string(context);
@@ -396,7 +397,6 @@ _kdc_pk_rd_padata(krb5_context context,
        PA_PK_AS_REQ_Win2k r;
 
        type = "PK-INIT-Win2k";
        PA_PK_AS_REQ_Win2k r;
 
        type = "PK-INIT-Win2k";
-       pa_contentType = oid_id_pkcs7_data();
 
        ret = decode_PA_PK_AS_REQ_Win2k(pa->padata_value.data,
                                        pa->padata_value.length,
 
        ret = decode_PA_PK_AS_REQ_Win2k(pa->padata_value.data,
                                        pa->padata_value.length,
@@ -422,7 +422,6 @@ _kdc_pk_rd_padata(krb5_context context,
        PA_PK_AS_REQ r;
 
        type = "PK-INIT-IETF";
        PA_PK_AS_REQ r;
 
        type = "PK-INIT-IETF";
-       pa_contentType = oid_id_pkauthdata();
 
        ret = decode_PA_PK_AS_REQ(pa->padata_value.data,
                                  pa->padata_value.length,
 
        ret = decode_PA_PK_AS_REQ(pa->padata_value.data,
                                  pa->padata_value.length,
@@ -467,7 +466,7 @@ _kdc_pk_rd_padata(krb5_context context,
                                                   edi->val[i].issuerAndSerialNumber->length,
                                                   &iasn,
                                                   &size);
                                                   edi->val[i].issuerAndSerialNumber->length,
                                                   &iasn,
                                                   &size);
-               if (ret || size != 0) {
+               if (ret) {
                    hx509_query_free(kdc_identity->hx509ctx, q);
                    continue;
                }
                    hx509_query_free(kdc_identity->hx509ctx, q);
                    continue;
                }
@@ -527,6 +526,7 @@ _kdc_pk_rd_padata(krb5_context context,
                                      kdc_identity->verify_ctx,
                                      signed_content.data,
                                      signed_content.length,
                                      kdc_identity->verify_ctx,
                                      signed_content.data,
                                      signed_content.length,
+                                     NULL,
                                      kdc_identity->certpool,
                                      &eContentType,
                                      &eContent,
                                      kdc_identity->certpool,
                                      &eContentType,
                                      &eContent,
@@ -547,7 +547,9 @@ _kdc_pk_rd_padata(krb5_context context,
     }
 
     /* Signature is correct, now verify the signed message */
     }
 
     /* Signature is correct, now verify the signed message */
-    if (der_heim_oid_cmp(&eContentType, pa_contentType)) {
+    if (der_heim_oid_cmp(&eContentType, oid_id_pkcs7_data()) != 0 &&
+       der_heim_oid_cmp(&eContentType, oid_id_pkauthdata()) != 0)
+    {
        krb5_set_error_string(context, "got wrong oid for pkauthdata");
        ret = KRB5_BADMSGTYPE;
        goto out;
        krb5_set_error_string(context, "got wrong oid for pkauthdata");
        ret = KRB5_BADMSGTYPE;
        goto out;
@@ -639,6 +641,8 @@ _kdc_pk_rd_padata(krb5_context context,
     kdc_log(context, config, 0, "PK-INIT request of type %s", type);
 
 out:
     kdc_log(context, config, 0, "PK-INIT request of type %s", type);
 
 out:
+    if (ret)
+       krb5_warn(context, ret, "PKINIT");
 
     if (signed_content.data)
        free(signed_content.data);
 
     if (signed_content.data)
        free(signed_content.data);
@@ -678,18 +682,41 @@ pk_mk_pa_reply_enckey(krb5_context context,
                      krb5_keyblock *reply_key,
                      ContentInfo *content_info)
 {
                      krb5_keyblock *reply_key,
                      ContentInfo *content_info)
 {
+    const heim_oid *envelopedAlg = NULL, *sdAlg = NULL;
     krb5_error_code ret;
     krb5_data buf, signed_data;
     size_t size;
     krb5_error_code ret;
     krb5_data buf, signed_data;
     size_t size;
+    int do_win2k = 0;
 
     krb5_data_zero(&buf);
     krb5_data_zero(&signed_data);
 
 
     krb5_data_zero(&buf);
     krb5_data_zero(&signed_data);
 
+    /*
+     * If the message client is a win2k-type but it send pa data
+     * 09-binding it expects a IETF (checksum) reply so there can be
+     * no replay attacks.
+     */
+
     switch (client_params->type) {
     case PKINIT_COMPAT_WIN2K: {
     switch (client_params->type) {
     case PKINIT_COMPAT_WIN2K: {
+       int i = 0;
+       if (_kdc_find_padata(req, &i, KRB5_PADATA_PK_AS_09_BINDING) == NULL)
+           do_win2k = 1;
+       break;
+    }
+    case PKINIT_COMPAT_27:
+       break;
+    default:
+       krb5_abortx(context, "internal pkinit error");
+    }      
+
+    if (do_win2k) {
        ReplyKeyPack_Win2k kp;
        memset(&kp, 0, sizeof(kp));
 
        ReplyKeyPack_Win2k kp;
        memset(&kp, 0, sizeof(kp));
 
+       envelopedAlg = oid_id_rsadsi_des_ede3_cbc();
+       sdAlg = oid_id_pkcs7_data();
+
        ret = copy_EncryptionKey(reply_key, &kp.replyKey);
        if (ret) {
            krb5_clear_error_string(context);
        ret = copy_EncryptionKey(reply_key, &kp.replyKey);
        if (ret) {
            krb5_clear_error_string(context);
@@ -701,13 +728,13 @@ pk_mk_pa_reply_enckey(krb5_context context,
                           buf.data, buf.length,
                           &kp, &size,ret);
        free_ReplyKeyPack_Win2k(&kp);
                           buf.data, buf.length,
                           &kp, &size,ret);
        free_ReplyKeyPack_Win2k(&kp);
-       break;
-    }
-    case PKINIT_COMPAT_27: {
+    } else {
        krb5_crypto ascrypto;
        ReplyKeyPack kp;
        memset(&kp, 0, sizeof(kp));
 
        krb5_crypto ascrypto;
        ReplyKeyPack kp;
        memset(&kp, 0, sizeof(kp));
 
+       sdAlg = oid_id_pkrkeydata();
+
        ret = copy_EncryptionKey(reply_key, &kp.replyKey);
        if (ret) {
            krb5_clear_error_string(context);
        ret = copy_EncryptionKey(reply_key, &kp.replyKey);
        if (ret) {
            krb5_clear_error_string(context);
@@ -735,10 +762,6 @@ pk_mk_pa_reply_enckey(krb5_context context,
        }
        ASN1_MALLOC_ENCODE(ReplyKeyPack, buf.data, buf.length, &kp, &size,ret);
        free_ReplyKeyPack(&kp);
        }
        ASN1_MALLOC_ENCODE(ReplyKeyPack, buf.data, buf.length, &kp, &size,ret);
        free_ReplyKeyPack(&kp);
-       break;
-    }
-    default:
-       krb5_abortx(context, "internal pkinit error");
     }
     if (ret) {
        krb5_set_error_string(context, "ASN.1 encoding of ReplyKeyPack "
     }
     if (ret) {
        krb5_set_error_string(context, "ASN.1 encoding of ReplyKeyPack "
@@ -768,7 +791,8 @@ pk_mk_pa_reply_enckey(krb5_context context,
            goto out;
        
        ret = hx509_cms_create_signed_1(kdc_identity->hx509ctx,
            goto out;
        
        ret = hx509_cms_create_signed_1(kdc_identity->hx509ctx,
-                                       oid_id_pkrkeydata(),
+                                       0,
+                                       sdAlg,
                                        buf.data,
                                        buf.length,
                                        NULL,
                                        buf.data,
                                        buf.length,
                                        NULL,
@@ -784,9 +808,21 @@ pk_mk_pa_reply_enckey(krb5_context context,
     if (ret) 
        goto out;
 
     if (ret) 
        goto out;
 
+    if (client_params->type == PKINIT_COMPAT_WIN2K) {
+       ret = hx509_cms_wrap_ContentInfo(oid_id_pkcs7_signedData(),
+                                        &signed_data,
+                                        &buf);
+       if (ret)
+           goto out;
+       krb5_data_free(&signed_data);
+       signed_data = buf;
+    }
+
     ret = hx509_cms_envelope_1(kdc_identity->hx509ctx,
     ret = hx509_cms_envelope_1(kdc_identity->hx509ctx,
+                              0,
                               client_params->cert,
                               client_params->cert,
-                              signed_data.data, signed_data.length, NULL,
+                              signed_data.data, signed_data.length, 
+                              envelopedAlg,
                               oid_id_pkcs7_signedData(), &buf);
     if (ret)
        goto out;
                               oid_id_pkcs7_signedData(), &buf);
     if (ret)
        goto out;
@@ -881,6 +917,7 @@ pk_mk_pa_reply_dh(krb5_context context,
            goto out;
        
        ret = hx509_cms_create_signed_1(kdc_identity->hx509ctx,
            goto out;
        
        ret = hx509_cms_create_signed_1(kdc_identity->hx509ctx,
+                                       0,
                                        oid_id_pkdhkeydata(),
                                        buf.data,
                                        buf.length,
                                        oid_id_pkdhkeydata(),
                                        buf.data,
                                        buf.length,
@@ -1125,6 +1162,7 @@ _kdc_pk_mk_pa_reply(krb5_context context,
            krb5_data_free(&ocsp.data);
 
            ocsp.expire = 0;
            krb5_data_free(&ocsp.data);
 
            ocsp.expire = 0;
+           ocsp.next_update = kdc_time + 60 * 5;
 
            fd = open(config->pkinit_kdc_ocsp_file, O_RDONLY);
            if (fd < 0) {
 
            fd = open(config->pkinit_kdc_ocsp_file, O_RDONLY);
            if (fd < 0) {
@@ -1168,11 +1206,13 @@ _kdc_pk_mk_pa_reply(krb5_context context,
                        "PK-INIT failed to verify ocsp data %d", ret);
                krb5_data_free(&ocsp.data);
                ocsp.expire = 0;
                        "PK-INIT failed to verify ocsp data %d", ret);
                krb5_data_free(&ocsp.data);
                ocsp.expire = 0;
-           } else if (ocsp.expire > 180)
+           } else if (ocsp.expire > 180) {
                ocsp.expire -= 180; /* refetch the ocsp before it expire */
                ocsp.expire -= 180; /* refetch the ocsp before it expire */
-           
+               ocsp.next_update = ocsp.expire;
+           } else {
+               ocsp.next_update = kdc_time;
+           }
        out_ocsp:
        out_ocsp:
-           ocsp.next_update = kdc_time + 3600;
            ret = 0;
        }
 
            ret = 0;
        }
 
@@ -1199,10 +1239,10 @@ out:
 }
 
 static int
 }
 
 static int
-pk_principal_from_X509(krb5_context context, 
-                      krb5_kdc_configuration *config,
-                      hx509_cert client_cert, 
-                      krb5_const_principal match)
+match_rfc_san(krb5_context context, 
+             krb5_kdc_configuration *config,
+             hx509_cert client_cert, 
+             krb5_const_principal match)
 {
     hx509_octet_string_list list;
     int ret, i, found = 0;
 {
     hx509_octet_string_list list;
     int ret, i, found = 0;
@@ -1254,6 +1294,68 @@ out:
     return 0;
 }
 
     return 0;
 }
 
+static int
+match_ms_upn_san(krb5_context context, 
+                krb5_kdc_configuration *config,
+                hx509_cert client_cert, 
+                krb5_const_principal match)
+{
+    hx509_octet_string_list list;
+    krb5_principal principal = NULL;
+    int ret, found = 0;
+    MS_UPN_SAN upn;
+    size_t size;
+
+    memset(&list, 0 , sizeof(list));
+
+    ret = hx509_cert_find_subjectAltName_otherName(client_cert,
+                                                  oid_id_pkinit_ms_san(),
+                                                  &list);
+    if (ret)
+       goto out;
+
+    if (list.len != 1) {
+       kdc_log(context, config, 0,
+               "More then one PK-INIT MS UPN SAN");
+       goto out;
+    }
+
+    ret = decode_MS_UPN_SAN(list.val[0].data, list.val[0].length, &upn, &size);
+    if (ret) {
+       kdc_log(context, config, 0, "Decode of MS-UPN-SAN failed");
+       goto out;
+    }
+
+    kdc_log(context, config, 0, "found MS UPN SAN: %s", upn);
+
+    ret = krb5_parse_name(context, upn, &principal);
+    free_MS_UPN_SAN(&upn);
+    if (ret) {
+       kdc_log(context, config, 0, "Failed to parse principal in MS UPN SAN");
+       goto out;
+    }
+
+    /* 
+     * This is very wrong, but will do for now, should really and a
+     * plugin to the windc layer to very this ACL.
+    */
+    strupr(principal->realm);
+
+    if (krb5_principal_compare(context, principal, match) == TRUE)
+       found = 1;
+
+out:
+    if (principal)
+       krb5_free_principal(context, principal);
+    hx509_free_octet_string_list(&list);    
+    if (ret)
+       return ret;
+
+    if (!found)
+       return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
+
+    return 0;
+}
 
 krb5_error_code
 _kdc_pk_check_client(krb5_context context,
 
 krb5_error_code
 _kdc_pk_check_client(krb5_context context,
@@ -1283,14 +1385,22 @@ _kdc_pk_check_client(krb5_context context,
            *subject_name);
 
     if (config->enable_pkinit_princ_in_cert) {
            *subject_name);
 
     if (config->enable_pkinit_princ_in_cert) {
-       ret = pk_principal_from_X509(context, config, 
-                                    client_params->cert,
-                                    client->entry.principal);
+       ret = match_rfc_san(context, config,
+                           client_params->cert,
+                           client->entry.principal);
        if (ret == 0) {
            kdc_log(context, config, 5,
                    "Found matching PK-INIT SAN in certificate");
            return 0;
        }
        if (ret == 0) {
            kdc_log(context, config, 5,
                    "Found matching PK-INIT SAN in certificate");
            return 0;
        }
+       ret = match_ms_upn_san(context, config,
+                              client_params->cert,
+                              client->entry.principal);
+       if (ret == 0) {
+           kdc_log(context, config, 5,
+                   "Found matching MS UPN SAN in certificate");
+           return 0;
+       }
     }
 
     ret = hdb_entry_get_pkinit_acl(&client->entry, &acl);
     }
 
     ret = hdb_entry_get_pkinit_acl(&client->entry, &acl);
@@ -1330,10 +1440,17 @@ _kdc_pk_check_client(krb5_context context,
        return 0;
     }
 
        return 0;
     }
 
+    krb5_set_error_string(context,
+                         "PKINIT no matching principals for %s",
+                         *subject_name);
+
+    kdc_log(context, config, 5,
+           "PKINIT no matching principals for %s",
+           *subject_name);
+
     free(*subject_name);
     *subject_name = NULL;
 
     free(*subject_name);
     *subject_name = NULL;
 
-    krb5_set_error_string(context, "PKINIT no matching principals");
     return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
 }
 
     return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
 }
 
@@ -1396,7 +1513,56 @@ _kdc_add_inital_verified_cas(krb5_context context,
     return ret;
 }
 
     return ret;
 }
 
+/*
+ *
+ */
 
 
+static void
+load_mappings(krb5_context context, const char *fn)
+{
+    krb5_error_code ret;
+    char buf[1024];
+    unsigned long lineno = 0;
+    FILE *f;
+
+    f = fopen(fn, "r");
+    if (f == NULL)
+       return;
+
+    while (fgets(buf, sizeof(buf), f) != NULL) {
+       char *subject_name, *p;
+    
+       buf[strcspn(buf, "\n")] = '\0';
+       lineno++;
+
+       p = buf + strspn(buf, " \t");
+
+       if (*p == '#' || *p == '\0')
+           continue;
+
+       subject_name = strchr(p, ':');
+       if (subject_name == NULL) {
+           krb5_warnx(context, "pkinit mapping file line %lu "
+                      "missing \":\" :%s",
+                      lineno, buf);
+           continue;
+       }
+       *subject_name++ = '\0';
+
+       ret = add_principal_mapping(context, p, subject_name);
+       if (ret) {
+           krb5_warn(context, ret, "failed to add line %lu \":\" :%s\n",
+                     lineno, buf);
+           continue;
+       }
+    } 
+
+    fclose(f);
+}
+                  
+/*
+ *
+ */
 
 krb5_error_code
 _kdc_pk_initialize(krb5_context context,
 
 krb5_error_code
 _kdc_pk_initialize(krb5_context context,
@@ -1408,9 +1574,6 @@ _kdc_pk_initialize(krb5_context context,
 {
     const char *file; 
     krb5_error_code ret;
 {
     const char *file; 
     krb5_error_code ret;
-    char buf[1024];
-    unsigned long lineno = 0;
-    FILE *f;
 
     file = krb5_config_get_string(context, NULL,
                                  "libdefaults", "moduli", NULL);
 
     file = krb5_config_get_string(context, NULL,
                                  "libdefaults", "moduli", NULL);
@@ -1481,41 +1644,8 @@ _kdc_pk_initialize(krb5_context context,
                                          "kdc",
                                          "pkinit_mappings_file",
                                          NULL);
                                          "kdc",
                                          "pkinit_mappings_file",
                                          NULL);
-    f = fopen(file, "r");
-    if (f == NULL) {
-       krb5_warnx(context, "PKINIT: failed to load mappings file %s", file);
-       return 0;
-    }
-
-    while (fgets(buf, sizeof(buf), f) != NULL) {
-       char *subject_name, *p;
-    
-       buf[strcspn(buf, "\n")] = '\0';
-       lineno++;
-
-       p = buf + strspn(buf, " \t");
-
-       if (*p == '#' || *p == '\0')
-           continue;
 
 
-       subject_name = strchr(p, ':');
-       if (subject_name == NULL) {
-           krb5_warnx(context, "pkinit mapping file line %lu "
-                      "missing \":\" :%s",
-                      lineno, buf);
-           continue;
-       }
-       *subject_name++ = '\0';
-
-       ret = add_principal_mapping(context, p, subject_name);
-       if (ret) {
-           krb5_warn(context, ret, "failed to add line %lu \":\" :%s\n",
-                     lineno, buf);
-           continue;
-       }
-    } 
-
-    fclose(f);
+    load_mappings(context, file);
 
     return 0;
 }
 
     return 0;
 }
index a64efaa05ddd216d7898fa7170ff0fa8b265dbe7..1d0a01a215d10caa162ca62a6e1a4b4c55d6368e 100644 (file)
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: process.c,v 1.7 2006/12/28 21:09:35 lha Exp $");
+RCSID("$Id: process.c 20959 2007-06-07 04:46:06Z lha $");
+
+/*
+ *
+ */
+
+void
+krb5_kdc_update_time(struct timeval *tv)
+{
+    if (tv == NULL)
+       gettimeofday(&_kdc_now, NULL);
+    else
+       _kdc_now = *tv;
+}
 
 /*
  * handle the request in `buf, len', from `addr' (or `from' as a string),
 
 /*
  * handle the request in `buf, len', from `addr' (or `from' as a string),
@@ -59,7 +72,6 @@ krb5_kdc_process_request(krb5_context context,
     krb5_error_code ret;
     size_t i;
 
     krb5_error_code ret;
     size_t i;
 
-    gettimeofday(&_kdc_now, NULL);
     if(decode_AS_REQ(buf, len, &req, &i) == 0){
        krb5_data req_buffer;
 
     if(decode_AS_REQ(buf, len, &req, &i) == 0){
        krb5_data req_buffer;
 
@@ -121,7 +133,6 @@ krb5_kdc_process_krb5_request(krb5_context context,
     krb5_error_code ret;
     size_t i;
 
     krb5_error_code ret;
     size_t i;
 
-    gettimeofday(&_kdc_now, NULL);
     if(decode_AS_REQ(buf, len, &req, &i) == 0){
        krb5_data req_buffer;
 
     if(decode_AS_REQ(buf, len, &req, &i) == 0){
        krb5_data req_buffer;
 
@@ -139,3 +150,70 @@ krb5_kdc_process_krb5_request(krb5_context context,
     }
     return -1;
 }
     }
     return -1;
 }
+
+/*
+ *
+ */
+
+int
+krb5_kdc_save_request(krb5_context context, 
+                     const char *fn,
+                     const unsigned char *buf,
+                     size_t len,
+                     const krb5_data *reply,
+                     const struct sockaddr *sa)
+{
+    krb5_storage *sp;
+    krb5_address a;
+    int fd, ret;
+    uint32_t t;
+    krb5_data d;
+
+    memset(&a, 0, sizeof(a));
+
+    d.data = rk_UNCONST(buf);
+    d.length = len;
+    t = _kdc_now.tv_sec;
+
+    fd = open(fn, O_WRONLY|O_CREAT|O_APPEND, 0600);
+    if (fd < 0) {
+       krb5_set_error_string(context, "Failed to open: %s", fn);
+       return errno;
+    }
+    
+    sp = krb5_storage_from_fd(fd);
+    close(fd);
+    if (sp == NULL) {
+       krb5_set_error_string(context, "Storage failed to open fd");
+       return ENOMEM;
+    }
+
+    ret = krb5_sockaddr2address(context, sa, &a);
+    if (ret)
+       goto out;
+
+    krb5_store_uint32(sp, 1);
+    krb5_store_uint32(sp, t);
+    krb5_store_address(sp, a);
+    krb5_store_data(sp, d);
+    {
+       Der_class cl;
+       Der_type ty;
+       unsigned int tag;
+       ret = der_get_tag (reply->data, reply->length,
+                          &cl, &ty, &tag, NULL);
+       if (ret) {
+           krb5_store_uint32(sp, 0xffffffff);
+           krb5_store_uint32(sp, 0xffffffff);
+       } else {
+           krb5_store_uint32(sp, MAKE_TAG(cl, ty, 0));
+           krb5_store_uint32(sp, tag);
+       }
+    }
+
+    krb5_free_address(context, &a);
+out:
+    krb5_storage_free(sp);
+
+    return 0;
+}
index 370e33732f4acc98090a8a1db8ae37cb768fa680..18806d79dae694a4371b899a78743440e7ba6d70 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: rx.h,v 1.5 2006/05/05 10:51:10 lha Exp $ */
+/* $Id: rx.h 17447 2006-05-05 10:52:01Z lha $ */
 
 #ifndef __RX_H__
 #define __RX_H__
 
 #ifndef __RX_H__
 #define __RX_H__
index 41e4ad1bbc8f967ebbf82acc33a33654e3ce8de7..395ab7343284667ab7119def32d9cf1ff5e38dae 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
 
 #include "kdc_locl.h"
 
-RCSID("$Id: windc.c,v 1.3 2007/01/04 11:10:06 lha Exp $");
+RCSID("$Id: windc.c 20559 2007-04-24 16:00:07Z lha $");
 
 static krb5plugin_windc_ftable *windcft;
 static void *windcctx;
 
 static krb5plugin_windc_ftable *windcft;
 static void *windcctx;
@@ -43,7 +43,7 @@ static void *windcctx;
  */
 
 krb5_error_code
  */
 
 krb5_error_code
-_kdc_windc_init(krb5_context context)
+krb5_kdc_windc_init(krb5_context context)
 {
     struct krb5_plugin *list = NULL, *e;
     krb5_error_code ret;
 {
     struct krb5_plugin *list = NULL, *e;
     krb5_error_code ret;
@@ -91,10 +91,11 @@ _kdc_pac_verify(krb5_context context,
                krb5_pac *pac)
 {
     if (windcft == NULL) {
                krb5_pac *pac)
 {
     if (windcft == NULL) {
-       krb5_set_error_string(context, "Can't verify WINDC, no function");
+       krb5_set_error_string(context, "Can't verify PAC, no function");
        return EINVAL;
     }
        return EINVAL;
     }
-    return (windcft->pac_verify)(windcctx, context, client_principal, client, server, pac);
+    return (windcft->pac_verify)(windcctx, context, 
+                                client_principal, client, server, pac);
 }
 
 krb5_error_code
 }
 
 krb5_error_code
index a3b7534480a649d0a93f58d620614bcedd708c1c..ec480cf950c667414e0e392da0e5607a530c2b59 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: windc_plugin.h,v 1.2 2007/01/04 11:13:51 lha Exp $ */
+/* $Id: windc_plugin.h 19798 2007-01-10 15:24:51Z lha $ */
 
 #ifndef HEIMDAL_KRB5_PAC_PLUGIN_H
 #define HEIMDAL_KRB5_PAC_PLUGIN_H 1
 
 #ifndef HEIMDAL_KRB5_PAC_PLUGIN_H
 #define HEIMDAL_KRB5_PAC_PLUGIN_H 1
@@ -58,7 +58,9 @@ typedef krb5_error_code
 typedef krb5_error_code 
 (*krb5plugin_windc_pac_verify)(void *, krb5_context,
                               const krb5_principal,
 typedef krb5_error_code 
 (*krb5plugin_windc_pac_verify)(void *, krb5_context,
                               const krb5_principal,
-                              struct hdb_entry_ex *,  struct hdb_entry_ex *, krb5_pac *);
+                              struct hdb_entry_ex *, 
+                              struct hdb_entry_ex *,
+                              krb5_pac *);
 
 typedef krb5_error_code 
 (*krb5plugin_windc_client_access)(
 
 typedef krb5_error_code 
 (*krb5plugin_windc_client_access)(
index 667e0963b012cf841c7b99382bfad2db60d3129a..29a9bdd5c725742753f41085a4a943b28a8f4e18 100644 (file)
  */
 
 #include "kuser_locl.h"
  */
 
 #include "kuser_locl.h"
-RCSID("$Id: kinit.c,v 1.141 2006/12/12 16:35:41 lha Exp $");
+RCSID("$Id: kinit.c 20517 2007-04-22 10:42:26Z lha $");
 
 
-#ifndef KRB4
 #include "krb5-v4compat.h"
 #include "krb5-v4compat.h"
-#endif
 
 struct krb5_pk_identity;
 struct krb5_pk_cert;
 
 struct krb5_pk_identity;
 struct krb5_pk_cert;
@@ -46,6 +44,7 @@ struct krb5_dh_moduli;
 struct krb5_plugin;
 enum plugin_type;
 #include "krb5-private.h"
 struct krb5_plugin;
 enum plugin_type;
 #include "krb5-private.h"
+#include "heimntlm.h"
 
 int forwardable_flag   = -1;
 int proxiable_flag     = -1;
 
 int forwardable_flag   = -1;
 int proxiable_flag     = -1;
@@ -74,6 +73,8 @@ char *password_file   = NULL;
 char *pk_user_id       = NULL;
 char *pk_x509_anchors  = NULL;
 int pk_use_enckey      = 0;
 char *pk_user_id       = NULL;
 char *pk_x509_anchors  = NULL;
 int pk_use_enckey      = 0;
+static int canonicalize_flag = 0;
+static char *ntlm_domain;
 
 static char *krb4_cc_name;
 
 
 static char *krb4_cc_name;
 
@@ -153,18 +154,21 @@ static struct getargs args[] = {
     { "password-file", 0,   arg_string, &password_file,
       "read the password from a file" },
 
     { "password-file", 0,   arg_string, &password_file,
       "read the password from a file" },
 
+    { "canonicalize",0,   arg_flag, &canonicalize_flag,
+      "canonicalize client principal" },
 #ifdef PKINIT
 #ifdef PKINIT
-    {  "pk-user",      'C',    arg_string,     &pk_user_id,
-       "principal's public/private/certificate identifier",
-       "id" },
-
-    {  "x509-anchors", 'D',  arg_string, &pk_x509_anchors,
-       "directory with CA certificates", "directory" },
+    { "pk-user",       'C',    arg_string,     &pk_user_id,
+      "principal's public/private/certificate identifier", "id" },
 
 
-    {  "pk-use-enckey",        0,  arg_flag, &pk_use_enckey,
-       "Use RSA encrypted reply (instead of DH)" },
+    { "x509-anchors",  'D',  arg_string, &pk_x509_anchors,
+      "directory with CA certificates", "directory" },
 
 
+    { "pk-use-enckey", 0,  arg_flag, &pk_use_enckey,
+      "Use RSA encrypted reply (instead of DH)" },
 #endif
 #endif
+    { "ntlm-domain",   0,  arg_string, &ntlm_domain,
+      "NTLM domain", "domain" },
+
     { "version",       0,   arg_flag, &version_flag },
     { "help",          0,   arg_flag, &help_flag }
 };
     { "version",       0,   arg_flag, &version_flag },
     { "help",          0,   arg_flag, &help_flag }
 };
@@ -179,130 +183,6 @@ usage (int ret)
     exit (ret);
 }
 
     exit (ret);
 }
 
-#ifdef KRB4
-/* for when the KDC tells us it's a v4 one, we try to talk that */
-
-static int
-key_to_key(const char *user,
-          char *instance,
-          const char *realm,
-          const void *arg,
-          des_cblock *key)
-{
-    memcpy(key, arg, sizeof(des_cblock));
-    return 0;
-}
-
-static int
-do_v4_fallback (krb5_context context,
-               const krb5_principal principal,
-               int lifetime,
-               int use_srvtab, const char *srvtab_str,
-               const char *passwd)
-{
-    int ret;
-    krb_principal princ;
-    des_cblock key;
-    krb5_error_code kret;
-
-    if (lifetime == 0)
-       lifetime = DEFAULT_TKT_LIFE;
-    else
-       lifetime = krb_time_to_life (0, lifetime);
-
-    kret = krb5_524_conv_principal (context, principal,
-                                   princ.name,
-                                   princ.instance,
-                                   princ.realm);
-    if (kret) {
-       krb5_warn (context, kret, "krb5_524_conv_principal");
-       return 1;
-    }
-
-    if (use_srvtab || srvtab_str) {
-       if (srvtab_str == NULL)
-           srvtab_str = KEYFILE;
-
-       ret = read_service_key (princ.name, princ.instance, princ.realm,
-                               0, srvtab_str, (char *)&key);
-       if (ret) {
-           warnx ("read_service_key %s: %s", srvtab_str,
-                  krb_get_err_text (ret));
-           return 1;
-       }
-       ret = krb_get_in_tkt (princ.name, princ.instance, princ.realm,
-                             KRB_TICKET_GRANTING_TICKET, princ.realm,
-                             lifetime, key_to_key, NULL, key);
-    } else {
-       ret = krb_get_pw_in_tkt(princ.name, princ.instance, princ.realm, 
-                               KRB_TICKET_GRANTING_TICKET, princ.realm, 
-                               lifetime, passwd);
-    }
-    memset (key, 0, sizeof(key));
-    if (ret) {
-       warnx ("%s", krb_get_err_text(ret));
-       return 1;
-    }
-    if (do_afslog && k_hasafs()) {
-       if ((ret = krb_afslog(NULL, NULL)) != 0 && ret != KDC_PR_UNKNOWN) {
-           if(ret > 0)
-               warnx ("%s", krb_get_err_text(ret));
-           else
-               warnx ("failed to store AFS token");
-       }
-    }
-    return 0;
-}
-
-
-/*
- * the special version of get_default_principal that takes v4 into account
- */
-
-static krb5_error_code
-kinit_get_default_principal (krb5_context context,
-                            krb5_principal *princ)
-{
-    krb5_error_code ret;
-    krb5_ccache id;
-    krb_principal v4_princ;
-    int kret;
-
-    ret = krb5_cc_default (context, &id);
-    if (ret == 0) {
-       ret = krb5_cc_get_principal (context, id, princ);
-       krb5_cc_close (context, id);
-       if (ret == 0)
-           return 0;
-    }
-
-    kret = krb_get_tf_fullname (tkt_string(),
-                               v4_princ.name,
-                               v4_princ.instance,
-                               v4_princ.realm);
-    if (kret == KSUCCESS) {
-       ret = krb5_425_conv_principal (context,
-                                      v4_princ.name,
-                                      v4_princ.instance,
-                                      v4_princ.realm,
-                                      princ);
-       if (ret == 0)
-           return 0;
-    }
-    return krb5_get_default_principal (context, princ);
-}
-
-#else /* !KRB4 */
-
-static krb5_error_code
-kinit_get_default_principal (krb5_context context,
-                            krb5_principal *princ)
-{
-    return krb5_get_default_principal (context, princ);
-}
-
-#endif /* !KRB4 */
-
 static krb5_error_code
 get_server(krb5_context context,
           krb5_principal client,
 static krb5_error_code
 get_server(krb5_context context,
           krb5_principal client,
@@ -456,6 +336,39 @@ out:
     return ret;
 }
 
     return ret;
 }
 
+static krb5_error_code
+store_ntlmkey(krb5_context context, krb5_ccache id, 
+             const char *domain, krb5_const_principal client,
+             struct ntlm_buf *buf)
+{
+    krb5_error_code ret;
+    krb5_creds cred;
+    
+    memset(&cred, 0, sizeof(cred));
+
+    ret = krb5_make_principal(context, &cred.server,
+                             krb5_principal_get_realm(context, client),
+                             "@ntlm-key", domain, NULL);
+    if (ret)
+       goto out;
+    ret = krb5_copy_principal(context, client, &cred.client);
+    if (ret)
+       goto out;
+    
+    cred.times.authtime = time(NULL);
+    cred.times.endtime = time(NULL) + 3600 * 24 * 30; /* XXX */
+    cred.session.keytype = ENCTYPE_ARCFOUR_HMAC_MD5;
+    ret = krb5_data_copy(&cred.session.keyvalue, buf->data, buf->length);
+    if (ret)
+       goto out;
+
+    ret = krb5_cc_store_cred(context, id, &cred);
+
+out:
+    krb5_free_cred_contents (context, &cred);
+    return 0;
+}
+
 static krb5_error_code
 get_new_tickets(krb5_context context, 
                krb5_principal principal,
 static krb5_error_code
 get_new_tickets(krb5_context context, 
                krb5_principal principal,
@@ -471,7 +384,9 @@ get_new_tickets(krb5_context context,
     krb5_deltat renew = 0;
     char *renewstr = NULL;
     krb5_enctype *enctype = NULL;
     krb5_deltat renew = 0;
     char *renewstr = NULL;
     krb5_enctype *enctype = NULL;
+    struct ntlm_buf ntlmkey;
 
 
+    memset(&ntlmkey, 0, sizeof(ntlmkey));
     passwd[0] = '\0';
 
     if (password_file) {
     passwd[0] = '\0';
 
     if (password_file) {
@@ -500,8 +415,8 @@ get_new_tickets(krb5_context context,
     if (ret)
        krb5_err(context, 1, ret, "krb5_get_init_creds_opt_alloc");
     
     if (ret)
        krb5_err(context, 1, ret, "krb5_get_init_creds_opt_alloc");
     
-    krb5_get_init_creds_opt_set_default_flags(context, "kinit", 
-                                             /* XXX */principal->realm, opt);
+    krb5_get_init_creds_opt_set_default_flags(context, "kinit",
+       krb5_principal_get_realm(context, principal), opt);
 
     if(forwardable_flag != -1)
        krb5_get_init_creds_opt_set_forwardable (opt, forwardable_flag);
 
     if(forwardable_flag != -1)
        krb5_get_init_creds_opt_set_forwardable (opt, forwardable_flag);
@@ -512,6 +427,8 @@ get_new_tickets(krb5_context context,
     if (pac_flag != -1)
        krb5_get_init_creds_opt_set_pac_request(context, opt, 
                                                pac_flag ? TRUE : FALSE);
     if (pac_flag != -1)
        krb5_get_init_creds_opt_set_pac_request(context, opt, 
                                                pac_flag ? TRUE : FALSE);
+    if (canonicalize_flag)
+       krb5_get_init_creds_opt_set_canonicalize(context, opt, TRUE);
     if (pk_user_id) {
        ret = krb5_get_init_creds_opt_set_pkinit(context, opt,
                                                 principal,
     if (pk_user_id) {
        ret = krb5_get_init_creds_opt_set_pkinit(context, opt,
                                                 principal,
@@ -629,19 +546,8 @@ get_new_tickets(krb5_context context,
                                            opt);
     }
     krb5_get_init_creds_opt_free(context, opt);
                                            opt);
     }
     krb5_get_init_creds_opt_free(context, opt);
-#ifdef KRB4
-    if (ret == KRB5KRB_AP_ERR_V4_REPLY || ret == KRB5_KDC_UNREACH) {
-       int exit_val;
-
-       exit_val = do_v4_fallback (context, principal, ticket_life,
-                                  use_keytab, keytab_str, passwd);
-       get_v4_tgt = 0;
-       do_afslog  = 0;
-       memset(passwd, 0, sizeof(passwd));
-       if (exit_val == 0 || ret == KRB5KRB_AP_ERR_V4_REPLY)
-           return exit_val;
-    }
-#endif
+    if (ntlm_domain && passwd[0])
+       heim_ntlm_nt_key(passwd, &ntlmkey);
     memset(passwd, 0, sizeof(passwd));
 
     switch(ret){
     memset(passwd, 0, sizeof(passwd));
 
     switch(ret){
@@ -651,8 +557,12 @@ get_new_tickets(krb5_context context,
        exit(1);
     case KRB5KRB_AP_ERR_BAD_INTEGRITY:
     case KRB5KRB_AP_ERR_MODIFIED:
        exit(1);
     case KRB5KRB_AP_ERR_BAD_INTEGRITY:
     case KRB5KRB_AP_ERR_MODIFIED:
+    case KRB5KDC_ERR_PREAUTH_FAILED:
        krb5_errx(context, 1, "Password incorrect");
        break;
        krb5_errx(context, 1, "Password incorrect");
        break;
+    case KRB5KRB_AP_ERR_V4_REPLY:
+       krb5_errx(context, 1, "Looks like a Kerberos 4 reply");
+       break;
     default:
        krb5_err(context, 1, ret, "krb5_get_init_creds");
     }
     default:
        krb5_err(context, 1, ret, "krb5_get_init_creds");
     }
@@ -685,6 +595,9 @@ get_new_tickets(krb5_context context,
 
     krb5_free_cred_contents (context, &cred);
 
 
     krb5_free_cred_contents (context, &cred);
 
+    if (ntlm_domain && ntlmkey.data)
+       store_ntlmkey(context, ccache, ntlm_domain, principal, &ntlmkey);
+
     if (enctype)
        free(enctype);
 
     if (enctype)
        free(enctype);
 
@@ -774,6 +687,7 @@ main (int argc, char **argv)
     krb5_principal principal;
     int optidx = 0;
     krb5_deltat ticket_life = 0;
     krb5_principal principal;
     int optidx = 0;
     krb5_deltat ticket_life = 0;
+    int parseflags = 0;
 
     setprogname (argv[0]);
     
 
     setprogname (argv[0]);
     
@@ -797,12 +711,15 @@ main (int argc, char **argv)
     argc -= optidx;
     argv += optidx;
 
     argc -= optidx;
     argv += optidx;
 
+    if (canonicalize_flag)
+       parseflags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
+
     if (argv[0]) {
     if (argv[0]) {
-       ret = krb5_parse_name (context, argv[0], &principal);
+       ret = krb5_parse_name_flags (context, argv[0], parseflags, &principal);
        if (ret)
            krb5_err (context, 1, ret, "krb5_parse_name");
     } else {
        if (ret)
            krb5_err (context, 1, ret, "krb5_parse_name");
     } else {
-       ret = kinit_get_default_principal (context, &principal);
+       ret = krb5_get_default_principal (context, &principal);
        if (ret)
            krb5_err (context, 1, ret, "krb5_get_default_principal");
     }
        if (ret)
            krb5_err (context, 1, ret, "krb5_get_default_principal");
     }
index 06403cbe67e03f9aaa6c6cb65478d941b577ce6e..36ea01a9a59f391e30596eff2025c0ef787ba52d 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: kuser_locl.h,v 1.13 2003/01/21 14:13:51 nectar Exp $ */
+/* $Id: kuser_locl.h 20458 2007-04-19 20:41:27Z lha $ */
 
 #ifndef __KUSER_LOCL_H__
 #define __KUSER_LOCL_H__
 
 #ifndef __KUSER_LOCL_H__
 #define __KUSER_LOCL_H__
@@ -75,9 +75,6 @@
 #include <err.h>
 #include <krb5.h>
 
 #include <err.h>
 #include <krb5.h>
 
-#ifdef KRB4
-#include <krb.h>
-#endif
 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
 #include <sys/ioctl.h>
 #endif
 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
 #include <sys/ioctl.h>
 #endif
index ce43c2cd02f944f1941c93e4f4a2c2f5c303276e..685f0b1898313f9d03399a949590c499468058d7 100644 (file)
@@ -1,5 +1,5 @@
 -- From RFC 3369 --
 -- From RFC 3369 --
--- $Id: CMS.asn1,v 1.5 2006/09/07 12:20:42 lha Exp $ --
+-- $Id: CMS.asn1 18054 2006-09-07 12:20:42Z lha $ --
 
 CMS DEFINITIONS ::= BEGIN
 
 
 CMS DEFINITIONS ::= BEGIN
 
index 5f09cd6794650750cdc658c03c07e4de4e659365..15c4a09cd0d0725492c3ab9f155508a363dfe1ab 100644 (file)
@@ -1,4 +1,4 @@
-/* $Id: asn1-common.h,v 1.7 2006/12/28 17:14:10 lha Exp $ */
+/* $Id: asn1-common.h 19539 2006-12-28 17:15:05Z lha $ */
 
 #include <stddef.h>
 #include <time.h>
 
 #include <stddef.h>
 #include <time.h>
index 938b8eb988d98f496a638bcbdd8bbe289c09e646..67af1a44fc3b9977d418ae8817913187867a0096 100644 (file)
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: asn1_err.et,v 1.6 2006/10/24 14:11:20 lha Exp $"
+id "$Id: asn1_err.et 20010 2007-01-20 21:52:27Z lha $"
 
 error_table asn1
 prefix ASN1
 
 error_table asn1
 prefix ASN1
@@ -18,4 +18,5 @@ error_code BAD_LENGTH,                "ASN.1 length doesn't match expected value"
 error_code BAD_FORMAT,         "ASN.1 badly-formatted encoding"
 error_code PARSE_ERROR,                "ASN.1 parse error"
 error_code EXTRA_DATA,         "ASN.1 extra data past end of end structure"
 error_code BAD_FORMAT,         "ASN.1 badly-formatted encoding"
 error_code PARSE_ERROR,                "ASN.1 parse error"
 error_code EXTRA_DATA,         "ASN.1 extra data past end of end structure"
+error_code BAD_CHARACTER,      "ASN.1 invalid character in string"
 end
 end
index 5dc0ba2e2d399e8a54a29ad128878a5738b3bce1..65b382e6daf0bf3eabcaf50c8bf942cde819246f 100644 (file)
@@ -40,7 +40,7 @@
 #include <hex.h>
 #include <err.h>
 
 #include <hex.h>
 #include <err.h>
 
-RCSID("$Id: asn1_gen.c,v 1.4 2006/01/30 15:06:03 lha Exp $");
+RCSID("$Id: asn1_gen.c 16666 2006-01-30 15:06:03Z lha $");
 
 static int
 doit(const char *fn)
 
 static int
 doit(const char *fn)
index 2874b35f6a31ce8ff506652092f655a05e97ad6d..3659b3859d0d0a77c60b79e37587140cfdf13f1b 100644 (file)
@@ -1,5 +1,5 @@
 /*     $NetBSD: queue.h,v 1.38 2004/04/18 14:12:05 lukem Exp $ */
 /*     $NetBSD: queue.h,v 1.38 2004/04/18 14:12:05 lukem Exp $ */
-/*     $Id: asn1_queue.h,v 1.2 2005/07/12 06:27:15 lha Exp $ */
+/*     $Id: asn1_queue.h 15617 2005-07-12 06:27:42Z lha $ */
 
 /*
  * Copyright (c) 1991, 1993
 
 /*
  * Copyright (c) 1991, 1993
index 057f571bac7191c899f798ea30e912031020f762..edb8375ee35c38b20d967ad87c0096976250639c 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: canthandle.asn1,v 1.6 2006/01/18 19:12:33 lha Exp $ --
+-- $Id: canthandle.asn1 16593 2006-01-18 19:12:33Z lha $ --
 
 CANTHANDLE DEFINITIONS ::= BEGIN
 
 
 CANTHANDLE DEFINITIONS ::= BEGIN
 
index 687b38112145623951b02331aaa751a7d3b49404..c7b911b8d6c82cc8601c187c0df32436d20bf804 100644 (file)
@@ -38,7 +38,7 @@
 #include <getarg.h>
 #include <err.h>
 
 #include <getarg.h>
 #include <err.h>
 
-RCSID("$Id: der.c,v 1.2 2005/07/12 06:27:19 lha Exp $");
+RCSID("$Id: der.c 15617 2005-07-12 06:27:42Z lha $");
 
 
 static const char *class_names[] = {
 
 
 static const char *class_names[] = {
index b0170e35fe534bc1a5f76ae48c41deb81216e299..13e39320d4ecdcb910eacd604a110b175579c385 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: der.h,v 1.36 2006/10/14 05:16:08 lha Exp $ */
+/* $Id: der.h 18437 2006-10-14 05:16:08Z lha $ */
 
 #ifndef __DER_H__
 #define __DER_H__
 
 #ifndef __DER_H__
 #define __DER_H__
index 15e7b817a04ba4d9ef0eb47f283371548303ce41..04c4531ca5782224b2a25d638ebe13d1745b0aa9 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
 
 #include "der_locl.h"
 
-RCSID("$Id: der_copy.c,v 1.17 2006/12/28 17:14:17 lha Exp $");
+RCSID("$Id: der_copy.c 19539 2006-12-28 17:15:05Z lha $");
 
 int
 der_copy_general_string (const heim_general_string *from, 
 
 int
 der_copy_general_string (const heim_general_string *from, 
index 32cf23cb39b665e98e4e7805e7b588389dcd2d0b..6908bddcc26ea7e40101130bb9bea3efdca7b64b 100644 (file)
@@ -34,7 +34,7 @@
 #include "der_locl.h"
 #include <hex.h>
 
 #include "der_locl.h"
 #include <hex.h>
 
-RCSID("$Id: der_format.c,v 1.8 2006/11/27 10:32:21 lha Exp $");
+RCSID("$Id: der_format.c 20861 2007-06-03 20:18:29Z lha $");
 
 int
 der_parse_hex_heim_integer (const char *p, heim_integer *data)
 
 int
 der_parse_hex_heim_integer (const char *p, heim_integer *data)
@@ -51,7 +51,7 @@ der_parse_hex_heim_integer (const char *p, heim_integer *data)
     }
 
     len = strlen(p);
     }
 
     len = strlen(p);
-    if (len < 0) {
+    if (len <= 0) {
        data->data = NULL;
        data->length = 0;
        return EINVAL;
        data->data = NULL;
        data->length = 0;
        return EINVAL;
@@ -74,7 +74,7 @@ der_parse_hex_heim_integer (const char *p, heim_integer *data)
 
     {
        unsigned char *q = data->data;
 
     {
        unsigned char *q = data->data;
-       while(*q == 0 && len > 0) {
+       while(len > 0 && *q == 0) {
            q++;
            len--;
        }
            q++;
            len--;
        }
index 6827486d9f7720d44b5955d889e83760982746f7..851cb1d40775f8b5ad9218cb1f5e195815f021dd 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
 
 #include "der_locl.h"
 
-RCSID("$Id: der_free.c,v 1.14 2006/12/28 17:14:21 lha Exp $");
+RCSID("$Id: der_free.c 19539 2006-12-28 17:15:05Z lha $");
 
 void
 der_free_general_string (heim_general_string *str)
 
 void
 der_free_general_string (heim_general_string *str)
index a1ed23f10bce13f4300ef8f237dbf8c9a0566b9e..3022435b336497b9e4a414f8aa6978cb14ca6d69 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
 
 #include "der_locl.h"
 
-RCSID("$Id: der_get.c,v 1.51 2006/12/28 17:14:25 lha Exp $");
+RCSID("$Id: der_get.c 20570 2007-04-27 14:06:27Z lha $");
 
 #include <version.h>
 
 
 #include <version.h>
 
@@ -135,8 +135,21 @@ int
 der_get_general_string (const unsigned char *p, size_t len, 
                        heim_general_string *str, size_t *size)
 {
 der_get_general_string (const unsigned char *p, size_t len, 
                        heim_general_string *str, size_t *size)
 {
+    const unsigned char *p1;
     char *s;
 
     char *s;
 
+    p1 = memchr(p, 0, len);
+    if (p1 != NULL) {
+       /* 
+        * Allow trailing NULs. We allow this since MIT Kerberos sends
+        * an strings in the NEED_PREAUTH case that includes a
+        * trailing NUL.
+        */
+       while (p1 - p < len && *p1 == '\0')
+           p1++;
+       if (p1 - p != len)
+           return ASN1_BAD_CHARACTER;
+    }
     if (len > len + 1)
        return ASN1_BAD_LENGTH;
 
     if (len > len + 1)
        return ASN1_BAD_LENGTH;
 
@@ -180,6 +193,8 @@ der_get_bmp_string (const unsigned char *p, size_t len,
     if (len & 1)
        return ASN1_BAD_FORMAT;
     data->length = len / 2;
     if (len & 1)
        return ASN1_BAD_FORMAT;
     data->length = len / 2;
+    if (data->length > UINT_MAX/sizeof(data->data[0]))
+       return ERANGE;
     data->data = malloc(data->length * sizeof(data->data[0]));
     if (data->data == NULL && data->length != 0)
        return ENOMEM;
     data->data = malloc(data->length * sizeof(data->data[0]));
     if (data->data == NULL && data->length != 0)
        return ENOMEM;
@@ -202,6 +217,8 @@ der_get_universal_string (const unsigned char *p, size_t len,
     if (len & 3)
        return ASN1_BAD_FORMAT;
     data->length = len / 4;
     if (len & 3)
        return ASN1_BAD_FORMAT;
     data->length = len / 4;
+    if (data->length > UINT_MAX/sizeof(data->data[0]))
+       return ERANGE;
     data->data = malloc(data->length * sizeof(data->data[0]));
     if (data->data == NULL && data->length != 0)
        return ENOMEM;
     data->data = malloc(data->length * sizeof(data->data[0]));
     if (data->data == NULL && data->length != 0)
        return ENOMEM;
@@ -366,7 +383,7 @@ int
 der_get_oid (const unsigned char *p, size_t len,
             heim_oid *data, size_t *size)
 {
 der_get_oid (const unsigned char *p, size_t len,
             heim_oid *data, size_t *size)
 {
-    int n;
+    size_t n;
     size_t oldlen = len;
 
     if (len < 1)
     size_t oldlen = len;
 
     if (len < 1)
@@ -375,7 +392,10 @@ der_get_oid (const unsigned char *p, size_t len,
     if (len > len + 1)
        return ASN1_BAD_LENGTH;
 
     if (len > len + 1)
        return ASN1_BAD_LENGTH;
 
-    data->components = malloc((len + 1) * sizeof(*data->components));
+    if (len + 1 > UINT_MAX/sizeof(data->components[0]))
+       return ERANGE;
+
+    data->components = malloc((len + 1) * sizeof(data->components[0]));
     if (data->components == NULL)
        return ENOMEM;
     data->components[0] = (*p) / 40;
     if (data->components == NULL)
        return ENOMEM;
     data->components[0] = (*p) / 40;
index 93cabe466c1e6cc05883feb050b15f6bfc0dc60e..a7f8f593a20e115aa692376af9eca8665838fb9a 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
 
 #include "der_locl.h"
 
-RCSID("$Id: der_length.c,v 1.20 2006/12/28 17:14:28 lha Exp $");
+RCSID("$Id: der_length.c 19539 2006-12-28 17:15:05Z lha $");
 
 size_t
 _heim_len_unsigned (unsigned val)
 
 size_t
 _heim_len_unsigned (unsigned val)
index 1a87aaaee996e1b61fa259858fca54b3d3e07c0e..5b97557d74a3c5cced0691ef87613c70324975c4 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: der_locl.h,v 1.8 2006/10/19 16:24:02 lha Exp $ */
+/* $Id: der_locl.h 18608 2006-10-19 16:24:02Z lha $ */
 
 #ifndef __DER_LOCL_H__
 #define __DER_LOCL_H__
 
 #ifndef __DER_LOCL_H__
 #define __DER_LOCL_H__
index 9ed8f21906e76f1987ca8be10ebff7de850ebddd..1fdbfe1305d6df8562e62cdd50d0142bba21c482 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
 
 #include "der_locl.h"
 
-RCSID("$Id: der_put.c,v 1.34 2006/12/28 17:14:33 lha Exp $");
+RCSID("$Id: der_put.c 19539 2006-12-28 17:15:05Z lha $");
 
 /*
  * All encoding functions take a pointer `p' to first position in
 
 /*
  * All encoding functions take a pointer `p' to first position in
index 92bfb232343a5162bc39a3a2f75669582ba7cd16..17341863c66b080ad49301dd73d939733604fd3e 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: digest.asn1,v 1.10 2006/12/15 19:13:39 lha Exp $
+-- $Id: digest.asn1 20138 2007-02-02 21:08:24Z lha $
 
 DIGEST DEFINITIONS ::=
 BEGIN
 
 DIGEST DEFINITIONS ::=
 BEGIN
@@ -25,6 +25,7 @@ DigestRequest ::= SEQUENCE  {
     type               UTF8String, -- http, sasl-md5, chap, cram-md5 --
     digest             UTF8String, -- http:md5/md5-sess sasl:clear/int/conf --
     username           UTF8String, -- username user used
     type               UTF8String, -- http, sasl-md5, chap, cram-md5 --
     digest             UTF8String, -- http:md5/md5-sess sasl:clear/int/conf --
     username           UTF8String, -- username user used
+    responseData       UTF8String, -- client response
     authid             [0] UTF8String OPTIONAL,
     authentication-user        [1] Principal OPTIONAL, -- principal to get key from
     realm              [2] UTF8String OPTIONAL,
     authid             [0] UTF8String OPTIONAL,
     authentication-user        [1] Principal OPTIONAL, -- principal to get key from
     realm              [2] UTF8String OPTIONAL,
@@ -48,14 +49,14 @@ DigestError ::= SEQUENCE {
 }
 
 DigestResponse ::= SEQUENCE  {
 }
 
 DigestResponse ::= SEQUENCE  {
-    responseData       UTF8String,
+    success            BOOLEAN,
     rsp                        [0] UTF8String OPTIONAL,
     tickets            [1] SEQUENCE OF OCTET STRING OPTIONAL,
     channel            [2] SEQUENCE {
        cb-type         UTF8String,
        cb-binding      UTF8String
     } OPTIONAL,
     rsp                        [0] UTF8String OPTIONAL,
     tickets            [1] SEQUENCE OF OCTET STRING OPTIONAL,
     channel            [2] SEQUENCE {
        cb-type         UTF8String,
        cb-binding      UTF8String
     } OPTIONAL,
-    hash-a1            [3] OCTET STRING OPTIONAL
+    session-key                [3] OCTET STRING OPTIONAL
 }
 
 NTLMInit ::= SEQUENCE {
 }
 
 NTLMInit ::= SEQUENCE {
index 4f70f191df23de21b5c9ae96140948e39dde064a..e29a4378785132242736841d1790e4169cb2813c 100644 (file)
@@ -34,7 +34,7 @@
 #include "der_locl.h"
 #include "heim_asn1.h"
 
 #include "der_locl.h"
 #include "heim_asn1.h"
 
-RCSID("$Id: extra.c,v 1.6 2006/01/31 09:44:54 lha Exp $");
+RCSID("$Id: extra.c 16672 2006-01-31 09:44:54Z lha $");
 
 int
 encode_heim_any(unsigned char *p, size_t len, 
 
 int
 encode_heim_any(unsigned char *p, size_t len, 
index 3bb9022be85db9338c7eab7f832394df861512b3..cc1a3056def8a56e370aae83495b053e1234e267 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen.c,v 1.70 2006/12/28 17:14:37 lha Exp $");
+RCSID("$Id: gen.c 20670 2007-05-11 00:39:41Z lha $");
 
 FILE *headerfile, *codefile, *logfile;
 
 
 FILE *headerfile, *codefile, *logfile;
 
@@ -167,6 +167,7 @@ init_generate (const char *filename, const char *base)
          "    }                                                          \\\n"
          "  } while (0)\n\n",
          headerfile);
          "    }                                                          \\\n"
          "  } while (0)\n\n",
          headerfile);
+    fprintf (headerfile, "struct units;\n\n");
     fprintf (headerfile, "#endif\n\n");
     asprintf(&fn, "%s_files", base);
     if (fn == NULL)
     fprintf (headerfile, "#endif\n\n");
     asprintf(&fn, "%s_files", base);
     if (fn == NULL)
index 95646d0a3c8f70e8819e63dd0107dde4557593e0..abf11859d5f495cd75dbdb50208fc8871af26bc6 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_copy.c,v 1.19 2006/12/28 17:14:42 lha Exp $");
+RCSID("$Id: gen_copy.c 19539 2006-12-28 17:15:05Z lha $");
 
 static int used_fail;
 
 
 static int used_fail;
 
index 19ddbb46db67f1fc46cfbd7087873c685b4d5ffc..7ebef6cdceb75d274cf6d5d37ee454550e8bb068 100644 (file)
@@ -34,7 +34,7 @@
 #include "gen_locl.h"
 #include "lex.h"
 
 #include "gen_locl.h"
 #include "lex.h"
 
-RCSID("$Id: gen_decode.c,v 1.32 2006/12/29 17:30:32 lha Exp $");
+RCSID("$Id: gen_decode.c 19572 2006-12-29 17:30:32Z lha $");
 
 static void
 decode_primitive (const char *typename, const char *name, const char *forwstr)
 
 static void
 decode_primitive (const char *typename, const char *name, const char *forwstr)
index bc2aff86e5dd085c4ce9da8aa43b1cdb05645d77..b5337b1c430104e3e71b2b103ed86a5a351d2f18 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_encode.c,v 1.22 2006/12/29 17:30:03 lha Exp $");
+RCSID("$Id: gen_encode.c 19572 2006-12-29 17:30:32Z lha $");
 
 static void
 encode_primitive (const char *typename, const char *name)
 
 static void
 encode_primitive (const char *typename, const char *name)
index 26e02e39dd4937ff73880649d8f9e4f3e070eadd..d667c5d31aad674111eb02c3018c4438e84e9863 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_free.c,v 1.17 2006/12/28 17:14:54 lha Exp $");
+RCSID("$Id: gen_free.c 19539 2006-12-28 17:15:05Z lha $");
 
 static void
 free_primitive (const char *typename, const char *name)
 
 static void
 free_primitive (const char *typename, const char *name)
index 2f3e283ad63c0f64821b61c2a963decb2e588d04..8d8bd152a3b70f3fbd685dc33ae5ee4700727d86 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_glue.c,v 1.9 2005/07/12 06:27:29 lha Exp $");
+RCSID("$Id: gen_glue.c 15617 2005-07-12 06:27:42Z lha $");
 
 static void
 generate_2int (const Type *t, const char *gen_name)
 
 static void
 generate_2int (const Type *t, const char *gen_name)
index 7f9dc7257b98f9f2efcf3073271ef0b9e6916600..a1f7cc66444e84dd99378ba5872e018803a820ce 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_length.c,v 1.22 2006/12/28 17:14:57 lha Exp $");
+RCSID("$Id: gen_length.c 19539 2006-12-28 17:15:05Z lha $");
 
 static void
 length_primitive (const char *typename,
 
 static void
 length_primitive (const char *typename,
index c9ea714c5f7f0a3f8e4213869891c2b1ad5c0d27..8cd4dbad5a84a2727188d0534a508f166f1d6d73 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: gen_locl.h,v 1.14 2006/09/05 12:29:18 lha Exp $ */
+/* $Id: gen_locl.h 18008 2006-09-05 12:29:18Z lha $ */
 
 #ifndef __GEN_LOCL_H__
 #define __GEN_LOCL_H__
 
 #ifndef __GEN_LOCL_H__
 #define __GEN_LOCL_H__
index fa3813fd61158248d5894bba219e01ed28289964..54776752c2e3eaa0ac412658f8731ee087cfe489 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: gen_seq.c,v 1.4 2006/10/04 10:18:10 lha Exp $");
+RCSID("$Id: gen_seq.c 20561 2007-04-24 16:14:30Z lha $");
 
 void
 generate_type_seq (const Symbol *s)
 
 void
 generate_type_seq (const Symbol *s)
@@ -111,7 +111,7 @@ generate_type_seq (const Symbol *s)
             "\t\tsizeof(data->val[0]) * data->len);\n"
             /* resize but don't care about failures since it doesn't matter */
             "ptr = realloc(data->val, data->len * sizeof(data->val[0]));\n"
             "\t\tsizeof(data->val[0]) * data->len);\n"
             /* resize but don't care about failures since it doesn't matter */
             "ptr = realloc(data->val, data->len * sizeof(data->val[0]));\n"
-            "if (ptr) data->val = ptr;\n"
+            "if (ptr != NULL || data->len == 0) data->val = ptr;\n"
             "return 0;\n",
             subname);
 
             "return 0;\n",
             subname);
 
index f03d6b856bbad486ad7a112d895e40ce98cd67e5..eeb6b6d63dc9eef3829412c52dbb68a03eaee8f0 100644 (file)
@@ -37,7 +37,7 @@
 
 #include "gen_locl.h"
 
 
 #include "gen_locl.h"
 
-RCSID("$Id: hash.c,v 1.11 2006/04/07 22:16:00 lha Exp $");
+RCSID("$Id: hash.c 17016 2006-04-07 22:16:00Z lha $");
 
 static Hashentry *_search(Hashtab * htab,      /* The hash table */
                          void *ptr);   /* And key */
 
 static Hashentry *_search(Hashtab * htab,      /* The hash table */
                          void *ptr);   /* And key */
index b54e10234a74d79012434a1096c3ee125ac8bf74..10d8ce99b0b5b983465f2698fdeda34496a94e4a 100644 (file)
@@ -35,7 +35,7 @@
  * hash.h. Header file for hash table functions
  */
 
  * hash.h. Header file for hash table functions
  */
 
-/* $Id: hash.h,v 1.3 1999/12/02 17:05:02 joda Exp $ */
+/* $Id: hash.h 7464 1999-12-02 17:05:13Z joda $ */
 
 struct hashentry {             /* Entry in bucket */
      struct hashentry **prev;
 
 struct hashentry {             /* Entry in bucket */
      struct hashentry **prev;
index a86df38a999175a06c88bfdfcf37d0586ff5db10..0c7021f87f42e469276debac220d808e6b4b8fed 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: k5.asn1,v 1.51 2006/11/21 05:17:47 lha Exp $
+-- $Id: k5.asn1 21004 2007-06-08 01:53:10Z lha $
 
 KERBEROS5 DEFINITIONS ::=
 BEGIN
 
 KERBEROS5 DEFINITIONS ::=
 BEGIN
@@ -59,6 +59,7 @@ PADATA-TYPE ::= INTEGER {
        KRB5-PADATA-PA-PK-OCSP-RESPONSE(18),
        KRB5-PADATA-ETYPE-INFO2(19),
        KRB5-PADATA-USE-SPECIFIED-KVNO(20),
        KRB5-PADATA-PA-PK-OCSP-RESPONSE(18),
        KRB5-PADATA-ETYPE-INFO2(19),
        KRB5-PADATA-USE-SPECIFIED-KVNO(20),
+       KRB5-PADATA-SVR-REFERRAL-INFO(20), --- old ms referral number
        KRB5-PADATA-SAM-REDIRECT(21), -- (sam/otp)
        KRB5-PADATA-GET-FROM-TYPED-DATA(22),
        KRB5-PADATA-SAM-ETYPE-INFO(23),
        KRB5-PADATA-SAM-REDIRECT(21), -- (sam/otp)
        KRB5-PADATA-GET-FROM-TYPED-DATA(22),
        KRB5-PADATA-SAM-ETYPE-INFO(23),
@@ -71,10 +72,11 @@ PADATA-TYPE ::= INTEGER {
        KRB5-PADATA-TD-REQ-SEQ(108),            -- INTEGER
        KRB5-PADATA-PA-PAC-REQUEST(128),        -- jbrezak@exchange.microsoft.com
        KRB5-PADATA-S4U2SELF(129),
        KRB5-PADATA-TD-REQ-SEQ(108),            -- INTEGER
        KRB5-PADATA-PA-PAC-REQUEST(128),        -- jbrezak@exchange.microsoft.com
        KRB5-PADATA-S4U2SELF(129),
-       KRB5-PADATA-PK-AS-09-BINDING(132)       -- client send this to 
+       KRB5-PADATA-PK-AS-09-BINDING(132),      -- client send this to 
                                                -- tell KDC that is supports 
                                                -- the asCheckSum in the
                                                --  PK-AS-REP
                                                -- tell KDC that is supports 
                                                -- the asCheckSum in the
                                                --  PK-AS-REP
+       KRB5-PADATA-CLIENT-CANONICALIZED(133)   -- 
 }
 
 AUTHDATA-TYPE ::= INTEGER {
 }
 
 AUTHDATA-TYPE ::= INTEGER {
@@ -229,6 +231,7 @@ KDCOptions ::= BIT STRING {
        unused11(11),
        request-anonymous(14),
        canonicalize(15),
        unused11(11),
        request-anonymous(14),
        canonicalize(15),
+       constrained-delegation(16), -- ms extension
        disable-transited-check(26),
        renewable-ok(27),
        enc-tkt-in-skey(28),
        disable-transited-check(26),
        renewable-ok(27),
        enc-tkt-in-skey(28),
@@ -409,7 +412,8 @@ EncKDCRepPart ::= SEQUENCE {
        renew-till[8]           KerberosTime OPTIONAL,
        srealm[9]               Realm,
        sname[10]               PrincipalName,
        renew-till[8]           KerberosTime OPTIONAL,
        srealm[9]               Realm,
        sname[10]               PrincipalName,
-       caddr[11]               HostAddresses OPTIONAL
+       caddr[11]               HostAddresses OPTIONAL,
+       encrypted-pa-data[12]   METHOD-DATA OPTIONAL
 }
 
 EncASRepPart ::= [APPLICATION 25] EncKDCRepPart
 }
 
 EncASRepPart ::= [APPLICATION 25] EncKDCRepPart
@@ -624,6 +628,27 @@ KRB5SignedPath ::= SEQUENCE {
        delegated[2]    KRB5SignedPathPrincipals OPTIONAL
 }
 
        delegated[2]    KRB5SignedPathPrincipals OPTIONAL
 }
 
+PA-ClientCanonicalizedNames ::= SEQUENCE{
+       requested-name [0] PrincipalName,
+       real-name      [1] PrincipalName
+}
+
+PA-ClientCanonicalized ::= SEQUENCE {
+       names          [0] PA-ClientCanonicalizedNames,
+       canon-checksum [1] Checksum
+}
+
+AD-LoginAlias ::= SEQUENCE { -- ad-type number TBD --
+       login-alias  [0] PrincipalName,
+       checksum     [1] Checksum
+}
+
+-- old ms referral
+PA-SvrReferralData ::= SEQUENCE {
+       referred-name   [1] PrincipalName OPTIONAL,
+       referred-realm  [0] Realm
+}
+
 END
 
 -- etags -r '/\([A-Za-z][-A-Za-z0-9]*\).*::=/\1/' k5.asn1
 END
 
 -- etags -r '/\([A-Za-z][-A-Za-z0-9]*\).*::=/\1/' k5.asn1
index 9706b061c37f7ac9fadc95dbc771d74b634d4015..fc6a696dab3a8c242cd81102196431d28bf2289b 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: kx509.asn1,v 1.1 2006/12/28 21:05:23 lha Exp $
+-- $Id: kx509.asn1 19546 2006-12-28 21:05:23Z lha $
 
 KX509 DEFINITIONS ::=
 BEGIN
 
 KX509 DEFINITIONS ::=
 BEGIN
index 10b4d65a7e3655b965847af870d53696ad86200a..d628e4696f5d7caf68d2fcc4aa105bc6d2d122fe 100644 (file)
@@ -1,31 +1,92 @@
-/* A lexical scanner generated by flex*/
 
 
-/* Scanner skeleton version:
- * $Header: /home/daffy/u0/vern/flex/RCS/flex.skl,v 2.91 96/09/10 16:58:48 vern Exp $
- */
+#line 3 "lex.c"
+
+#define  YY_INT_ALIGNED short int
+
+/* A lexical scanner generated by flex */
 
 #define FLEX_SCANNER
 #define YY_FLEX_MAJOR_VERSION 2
 #define YY_FLEX_MINOR_VERSION 5
 
 #define FLEX_SCANNER
 #define YY_FLEX_MAJOR_VERSION 2
 #define YY_FLEX_MINOR_VERSION 5
+#define YY_FLEX_SUBMINOR_VERSION 33
+#if YY_FLEX_SUBMINOR_VERSION > 0
+#define FLEX_BETA
+#endif
 
 
+/* First, we deal with  platform-specific or compiler-specific issues. */
+
+/* begin standard C headers. */
 #include <stdio.h>
 #include <stdio.h>
-#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <stdlib.h>
 
 
+/* end standard C headers. */
 
 
-/* cfront 1.2 defines "c_plusplus" instead of "__cplusplus" */
-#ifdef c_plusplus
-#ifndef __cplusplus
-#define __cplusplus
-#endif
+/* flex integer type definitions */
+
+#ifndef FLEXINT_H
+#define FLEXINT_H
+
+/* C99 systems have <inttypes.h>. Non-C99 systems may or may not. */
+
+#if __STDC_VERSION__ >= 199901L
+
+/* C99 says to define __STDC_LIMIT_MACROS before including stdint.h,
+ * if you want the limit (max/min) macros for int types. 
+ */
+#ifndef __STDC_LIMIT_MACROS
+#define __STDC_LIMIT_MACROS 1
 #endif
 
 #endif
 
+#include <inttypes.h>
+typedef int8_t flex_int8_t;
+typedef uint8_t flex_uint8_t;
+typedef int16_t flex_int16_t;
+typedef uint16_t flex_uint16_t;
+typedef int32_t flex_int32_t;
+typedef uint32_t flex_uint32_t;
+#else
+typedef signed char flex_int8_t;
+typedef short int flex_int16_t;
+typedef int flex_int32_t;
+typedef unsigned char flex_uint8_t; 
+typedef unsigned short int flex_uint16_t;
+typedef unsigned int flex_uint32_t;
+#endif /* ! C99 */
 
 
-#ifdef __cplusplus
+/* Limits of integral types. */
+#ifndef INT8_MIN
+#define INT8_MIN               (-128)
+#endif
+#ifndef INT16_MIN
+#define INT16_MIN              (-32767-1)
+#endif
+#ifndef INT32_MIN
+#define INT32_MIN              (-2147483647-1)
+#endif
+#ifndef INT8_MAX
+#define INT8_MAX               (127)
+#endif
+#ifndef INT16_MAX
+#define INT16_MAX              (32767)
+#endif
+#ifndef INT32_MAX
+#define INT32_MAX              (2147483647)
+#endif
+#ifndef UINT8_MAX
+#define UINT8_MAX              (255U)
+#endif
+#ifndef UINT16_MAX
+#define UINT16_MAX             (65535U)
+#endif
+#ifndef UINT32_MAX
+#define UINT32_MAX             (4294967295U)
+#endif
 
 
-#include <stdlib.h>
+#endif /* ! FLEXINT_H */
 
 
-/* Use prototypes in function declarations. */
-#define YY_USE_PROTOS
+#ifdef __cplusplus
 
 /* The "const" storage-class-modifier is valid. */
 #define YY_USE_CONST
 
 /* The "const" storage-class-modifier is valid. */
 #define YY_USE_CONST
 
 #if __STDC__
 
 
 #if __STDC__
 
-#define YY_USE_PROTOS
 #define YY_USE_CONST
 
 #endif /* __STDC__ */
 #endif /* ! __cplusplus */
 
 #define YY_USE_CONST
 
 #endif /* __STDC__ */
 #endif /* ! __cplusplus */
 
-#ifdef __TURBOC__
- #pragma warn -rch
- #pragma warn -use
-#include <io.h>
-#include <stdlib.h>
-#define YY_USE_CONST
-#define YY_USE_PROTOS
-#endif
-
 #ifdef YY_USE_CONST
 #define yyconst const
 #else
 #define yyconst
 #endif
 
 #ifdef YY_USE_CONST
 #define yyconst const
 #else
 #define yyconst
 #endif
 
-
-#ifdef YY_USE_PROTOS
-#define YY_PROTO(proto) proto
-#else
-#define YY_PROTO(proto) ()
-#endif
-
 /* Returned upon end-of-file. */
 #define YY_NULL 0
 
 /* Returned upon end-of-file. */
 #define YY_NULL 0
 
  * but we do it the disgusting crufty way forced on us by the ()-less
  * definition of BEGIN.
  */
  * but we do it the disgusting crufty way forced on us by the ()-less
  * definition of BEGIN.
  */
-#define BEGIN yy_start = 1 + 2 *
+#define BEGIN (yy_start) = 1 + 2 *
 
 /* Translate the current start state into a value that can be later handed
  * to BEGIN to return to the state.  The YYSTATE alias is for lex
  * compatibility.
  */
 
 /* Translate the current start state into a value that can be later handed
  * to BEGIN to return to the state.  The YYSTATE alias is for lex
  * compatibility.
  */
-#define YY_START ((yy_start - 1) / 2)
+#define YY_START (((yy_start) - 1) / 2)
 #define YYSTATE YY_START
 
 /* Action number for EOF rule of a given start state. */
 #define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1)
 
 /* Special action meaning "start processing a new file". */
 #define YYSTATE YY_START
 
 /* Action number for EOF rule of a given start state. */
 #define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1)
 
 /* Special action meaning "start processing a new file". */
-#define YY_NEW_FILE yyrestart( yyin )
+#define YY_NEW_FILE yyrestart(yyin  )
 
 #define YY_END_OF_BUFFER_CHAR 0
 
 /* Size of default input buffer. */
 
 #define YY_END_OF_BUFFER_CHAR 0
 
 /* Size of default input buffer. */
+#ifndef YY_BUF_SIZE
 #define YY_BUF_SIZE 16384
 #define YY_BUF_SIZE 16384
+#endif
 
 
+/* The state buf must be large enough to hold one state per character in the main buffer.
+ */
+#define YY_STATE_BUF_SIZE   ((YY_BUF_SIZE + 2) * sizeof(yy_state_type))
+
+#ifndef YY_TYPEDEF_YY_BUFFER_STATE
+#define YY_TYPEDEF_YY_BUFFER_STATE
 typedef struct yy_buffer_state *YY_BUFFER_STATE;
 typedef struct yy_buffer_state *YY_BUFFER_STATE;
+#endif
 
 extern int yyleng;
 
 extern int yyleng;
+
 extern FILE *yyin, *yyout;
 
 #define EOB_ACT_CONTINUE_SCAN 0
 #define EOB_ACT_END_OF_FILE 1
 #define EOB_ACT_LAST_MATCH 2
 
 extern FILE *yyin, *yyout;
 
 #define EOB_ACT_CONTINUE_SCAN 0
 #define EOB_ACT_END_OF_FILE 1
 #define EOB_ACT_LAST_MATCH 2
 
-/* The funky do-while in the following #define is used to turn the definition
- * int a single C statement (which needs a semi-colon terminator).  This
- * avoids problems with code like:
- *
- *     if ( condition_holds )
- *             yyless( 5 );
- *     else
- *             do_something_else();
- *
- * Prior to using the do-while the compiler would get upset at the
- * "else" because it interpreted the "if" statement as being all
- * done when it reached the ';' after the yyless() call.
- */
-
-/* Return all but the first 'n' matched characters back to the input stream. */
-
+    #define YY_LESS_LINENO(n)
+    
+/* Return all but the first "n" matched characters back to the input stream. */
 #define yyless(n) \
        do \
                { \
                /* Undo effects of setting up yytext. */ \
 #define yyless(n) \
        do \
                { \
                /* Undo effects of setting up yytext. */ \
-               *yy_cp = yy_hold_char; \
+        int yyless_macro_arg = (n); \
+        YY_LESS_LINENO(yyless_macro_arg);\
+               *yy_cp = (yy_hold_char); \
                YY_RESTORE_YY_MORE_OFFSET \
                YY_RESTORE_YY_MORE_OFFSET \
-               yy_c_buf_p = yy_cp = yy_bp + n - YY_MORE_ADJ; \
+               (yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \
                YY_DO_BEFORE_ACTION; /* set up yytext again */ \
                } \
        while ( 0 )
 
                YY_DO_BEFORE_ACTION; /* set up yytext again */ \
                } \
        while ( 0 )
 
-#define unput(c) yyunput( c, yytext_ptr )
-
-/* Some routines like yy_flex_realloc() are emitted as static but are
-   not called by all lexers. This generates warnings in some compilers,
-   notably GCC. Arrange to suppress these. */
-#ifdef __GNUC__
-#define YY_MAY_BE_UNUSED __attribute__((unused))
-#else
-#define YY_MAY_BE_UNUSED
-#endif
+#define unput(c) yyunput( c, (yytext_ptr)  )
 
 /* The following is because we cannot portably get our hands on size_t
  * (without autoconf's help, which isn't available because we want
  * flex-generated scanners to compile on their own).
  */
 
 /* The following is because we cannot portably get our hands on size_t
  * (without autoconf's help, which isn't available because we want
  * flex-generated scanners to compile on their own).
  */
-typedef unsigned int yy_size_t;
 
 
+#ifndef YY_TYPEDEF_YY_SIZE_T
+#define YY_TYPEDEF_YY_SIZE_T
+typedef unsigned int yy_size_t;
+#endif
 
 
+#ifndef YY_STRUCT_YY_BUFFER_STATE
+#define YY_STRUCT_YY_BUFFER_STATE
 struct yy_buffer_state
        {
        FILE *yy_input_file;
 struct yy_buffer_state
        {
        FILE *yy_input_file;
@@ -186,12 +225,16 @@ struct yy_buffer_state
         */
        int yy_at_bol;
 
         */
        int yy_at_bol;
 
+    int yy_bs_lineno; /**< The line count. */
+    int yy_bs_column; /**< The column count. */
+    
        /* Whether to try to fill the input buffer when we reach the
         * end of it.
         */
        int yy_fill_buffer;
 
        int yy_buffer_status;
        /* Whether to try to fill the input buffer when we reach the
         * end of it.
         */
        int yy_fill_buffer;
 
        int yy_buffer_status;
+
 #define YY_BUFFER_NEW 0
 #define YY_BUFFER_NORMAL 1
        /* When an EOF's been seen but there's still some text to process
 #define YY_BUFFER_NEW 0
 #define YY_BUFFER_NORMAL 1
        /* When an EOF's been seen but there's still some text to process
@@ -205,28 +248,38 @@ struct yy_buffer_state
         * just pointing yyin at a new input file.
         */
 #define YY_BUFFER_EOF_PENDING 2
         * just pointing yyin at a new input file.
         */
 #define YY_BUFFER_EOF_PENDING 2
+
        };
        };
+#endif /* !YY_STRUCT_YY_BUFFER_STATE */
 
 
-static YY_BUFFER_STATE yy_current_buffer = 0;
+/* Stack of input buffers. */
+static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */
+static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */
+static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */
 
 /* We provide macros for accessing buffer states in case in the
  * future we want to put the buffer states in a more general
  * "scanner state".
 
 /* We provide macros for accessing buffer states in case in the
  * future we want to put the buffer states in a more general
  * "scanner state".
+ *
+ * Returns the top of the stack, or NULL.
  */
  */
-#define YY_CURRENT_BUFFER yy_current_buffer
+#define YY_CURRENT_BUFFER ( (yy_buffer_stack) \
+                          ? (yy_buffer_stack)[(yy_buffer_stack_top)] \
+                          : NULL)
 
 
+/* Same as previous macro, but useful when we know that the buffer stack is not
+ * NULL or when we need an lvalue. For internal use only.
+ */
+#define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)]
 
 /* yy_hold_char holds the character lost when yytext is formed. */
 static char yy_hold_char;
 
 /* yy_hold_char holds the character lost when yytext is formed. */
 static char yy_hold_char;
-
 static int yy_n_chars;         /* number of characters read into yy_ch_buf */
 static int yy_n_chars;         /* number of characters read into yy_ch_buf */
-
-
 int yyleng;
 
 /* Points to current character in buffer. */
 static char *yy_c_buf_p = (char *) 0;
 int yyleng;
 
 /* Points to current character in buffer. */
 static char *yy_c_buf_p = (char *) 0;
-static int yy_init = 1;                /* whether we need to initialize */
+static int yy_init = 0;                /* whether we need to initialize */
 static int yy_start = 0;       /* start state number */
 
 /* Flag which is used to allow yywrap()'s to do buffer switches
 static int yy_start = 0;       /* start state number */
 
 /* Flag which is used to allow yywrap()'s to do buffer switches
@@ -234,66 +287,92 @@ static int yy_start = 0;  /* start state number */
  */
 static int yy_did_buffer_switch_on_eof;
 
  */
 static int yy_did_buffer_switch_on_eof;
 
-void yyrestart YY_PROTO(( FILE *input_file ));
+void yyrestart (FILE *input_file  );
+void yy_switch_to_buffer (YY_BUFFER_STATE new_buffer  );
+YY_BUFFER_STATE yy_create_buffer (FILE *file,int size  );
+void yy_delete_buffer (YY_BUFFER_STATE b  );
+void yy_flush_buffer (YY_BUFFER_STATE b  );
+void yypush_buffer_state (YY_BUFFER_STATE new_buffer  );
+void yypop_buffer_state (void );
+
+static void yyensure_buffer_stack (void );
+static void yy_load_buffer_state (void );
+static void yy_init_buffer (YY_BUFFER_STATE b,FILE *file  );
 
 
-void yy_switch_to_buffer YY_PROTO(( YY_BUFFER_STATE new_buffer ));
-void yy_load_buffer_state YY_PROTO(( void ));
-YY_BUFFER_STATE yy_create_buffer YY_PROTO(( FILE *file, int size ));
-void yy_delete_buffer YY_PROTO(( YY_BUFFER_STATE b ));
-void yy_init_buffer YY_PROTO(( YY_BUFFER_STATE b, FILE *file ));
-void yy_flush_buffer YY_PROTO(( YY_BUFFER_STATE b ));
-#define YY_FLUSH_BUFFER yy_flush_buffer( yy_current_buffer )
+#define YY_FLUSH_BUFFER yy_flush_buffer(YY_CURRENT_BUFFER )
 
 
-YY_BUFFER_STATE yy_scan_buffer YY_PROTO(( char *base, yy_size_t size ));
-YY_BUFFER_STATE yy_scan_string YY_PROTO(( yyconst char *yy_str ));
-YY_BUFFER_STATE yy_scan_bytes YY_PROTO(( yyconst char *bytes, int len ));
+YY_BUFFER_STATE yy_scan_buffer (char *base,yy_size_t size  );
+YY_BUFFER_STATE yy_scan_string (yyconst char *yy_str  );
+YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,int len  );
 
 
-static void *yy_flex_alloc YY_PROTO(( yy_size_t ));
-static void *yy_flex_realloc YY_PROTO(( void *, yy_size_t )) YY_MAY_BE_UNUSED;
-static void yy_flex_free YY_PROTO(( void * ));
+void *yyalloc (yy_size_t  );
+void *yyrealloc (void *,yy_size_t  );
+void yyfree (void *  );
 
 #define yy_new_buffer yy_create_buffer
 
 #define yy_set_interactive(is_interactive) \
        { \
 
 #define yy_new_buffer yy_create_buffer
 
 #define yy_set_interactive(is_interactive) \
        { \
-       if ( ! yy_current_buffer ) \
-               yy_current_buffer = yy_create_buffer( yyin, YY_BUF_SIZE ); \
-       yy_current_buffer->yy_is_interactive = is_interactive; \
+       if ( ! YY_CURRENT_BUFFER ){ \
+        yyensure_buffer_stack (); \
+               YY_CURRENT_BUFFER_LVALUE =    \
+            yy_create_buffer(yyin,YY_BUF_SIZE ); \
+       } \
+       YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \
        }
 
 #define yy_set_bol(at_bol) \
        { \
        }
 
 #define yy_set_bol(at_bol) \
        { \
-       if ( ! yy_current_buffer ) \
-               yy_current_buffer = yy_create_buffer( yyin, YY_BUF_SIZE ); \
-       yy_current_buffer->yy_at_bol = at_bol; \
+       if ( ! YY_CURRENT_BUFFER ){\
+        yyensure_buffer_stack (); \
+               YY_CURRENT_BUFFER_LVALUE =    \
+            yy_create_buffer(yyin,YY_BUF_SIZE ); \
+       } \
+       YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \
        }
 
        }
 
-#define YY_AT_BOL() (yy_current_buffer->yy_at_bol)
+#define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol)
+
+/* Begin user sect3 */
 
 typedef unsigned char YY_CHAR;
 
 typedef unsigned char YY_CHAR;
+
 FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0;
 FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0;
+
 typedef int yy_state_type;
 typedef int yy_state_type;
+
+extern int yylineno;
+
+int yylineno = 1;
+
 extern char *yytext;
 #define yytext_ptr yytext
 
 extern char *yytext;
 #define yytext_ptr yytext
 
-static yy_state_type yy_get_previous_state YY_PROTO(( void ));
-static yy_state_type yy_try_NUL_trans YY_PROTO(( yy_state_type current_state ));
-static int yy_get_next_buffer YY_PROTO(( void ));
-static void yy_fatal_error YY_PROTO(( yyconst char msg[] ));
+static yy_state_type yy_get_previous_state (void );
+static yy_state_type yy_try_NUL_trans (yy_state_type current_state  );
+static int yy_get_next_buffer (void );
+static void yy_fatal_error (yyconst char msg[]  );
 
 /* Done after the current pattern has been matched and before the
  * corresponding action - sets up yytext.
  */
 #define YY_DO_BEFORE_ACTION \
 
 /* Done after the current pattern has been matched and before the
  * corresponding action - sets up yytext.
  */
 #define YY_DO_BEFORE_ACTION \
-       yytext_ptr = yy_bp; \
-       yyleng = (int) (yy_cp - yy_bp); \
-       yy_hold_char = *yy_cp; \
+       (yytext_ptr) = yy_bp; \
+       yyleng = (size_t) (yy_cp - yy_bp); \
+       (yy_hold_char) = *yy_cp; \
        *yy_cp = '\0'; \
        *yy_cp = '\0'; \
-       yy_c_buf_p = yy_cp;
+       (yy_c_buf_p) = yy_cp;
 
 #define YY_NUM_RULES 95
 #define YY_END_OF_BUFFER 96
 
 #define YY_NUM_RULES 95
 #define YY_END_OF_BUFFER 96
-static yyconst short int yy_accept[568] =
+/* This struct is not used in this scanner,
+   but its presence is necessary. */
+struct yy_trans_info
+       {
+       flex_int32_t yy_verify;
+       flex_int32_t yy_nxt;
+       };
+static yyconst flex_int16_t yy_accept[568] =
     {   0,
         0,    0,   96,   94,   90,   91,   87,   81,   81,   94,
        94,   88,   88,   94,   89,   89,   89,   89,   89,   89,
     {   0,
         0,    0,   96,   94,   90,   91,   87,   81,   81,   94,
        94,   88,   88,   94,   89,   89,   89,   89,   89,   89,
@@ -359,7 +438,7 @@ static yyconst short int yy_accept[568] =
        32,   89,   59,   70,   77,   53,    0
     } ;
 
        32,   89,   59,   70,   77,   53,    0
     } ;
 
-static yyconst int yy_ec[256] =
+static yyconst flex_int32_t yy_ec[256] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    2,    3,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    2,    3,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -391,7 +470,7 @@ static yyconst int yy_ec[256] =
         1,    1,    1,    1,    1
     } ;
 
         1,    1,    1,    1,    1
     } ;
 
-static yyconst int yy_meta[70] =
+static yyconst flex_int32_t yy_meta[70] =
     {   0,
         1,    1,    1,    1,    1,    1,    2,    1,    1,    3,
         3,    3,    3,    3,    3,    3,    1,    1,    3,    3,
     {   0,
         1,    1,    1,    1,    1,    1,    2,    1,    1,    3,
         3,    3,    3,    3,    3,    3,    1,    1,    3,    3,
@@ -402,7 +481,7 @@ static yyconst int yy_meta[70] =
         2,    2,    2,    2,    2,    2,    2,    2,    2
     } ;
 
         2,    2,    2,    2,    2,    2,    2,    2,    2
     } ;
 
-static yyconst short int yy_base[570] =
+static yyconst flex_int16_t yy_base[570] =
     {   0,
         0,    0,  636,  637,  637,  637,  637,  637,   63,  627,
       628,   70,   77,  616,   74,   72,   76,  609,   65,   81,
     {   0,
         0,    0,  636,  637,  637,  637,  637,  637,   63,  627,
       628,   70,   77,  616,   74,   72,   76,  609,   65,   81,
@@ -468,7 +547,7 @@ static yyconst short int yy_base[570] =
         0,  101,    0,    0,    0,    0,  637,  223,   69
     } ;
 
         0,  101,    0,    0,    0,    0,  637,  223,   69
     } ;
 
-static yyconst short int yy_def[570] =
+static yyconst flex_int16_t yy_def[570] =
     {   0,
       567,    1,  567,  567,  567,  567,  567,  567,  567,  567,
       567,  567,  567,  567,  568,  568,  568,  568,  568,  568,
     {   0,
       567,    1,  567,  567,  567,  567,  567,  567,  567,  567,
       567,  567,  567,  567,  568,  568,  568,  568,  568,  568,
@@ -534,7 +613,7 @@ static yyconst short int yy_def[570] =
       568,  568,  568,  568,  568,  568,    0,  567,  567
     } ;
 
       568,  568,  568,  568,  568,  568,    0,  567,  567
     } ;
 
-static yyconst short int yy_nxt[707] =
+static yyconst flex_int16_t yy_nxt[707] =
     {   0,
         4,    5,    6,    7,    8,    4,    9,   10,   11,   12,
        13,   13,   13,   13,   13,   13,   14,    4,   15,   16,
     {   0,
         4,    5,    6,    7,    8,    4,    9,   10,   11,   12,
        13,   13,   13,   13,   13,   13,   14,    4,   15,   16,
@@ -616,7 +695,7 @@ static yyconst short int yy_nxt[707] =
       567,  567,  567,  567,  567,  567
     } ;
 
       567,  567,  567,  567,  567,  567
     } ;
 
-static yyconst short int yy_chk[707] =
+static yyconst flex_int16_t yy_chk[707] =
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
     {   0,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
         1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
@@ -701,6 +780,9 @@ static yyconst short int yy_chk[707] =
 static yy_state_type yy_last_accepting_state;
 static char *yy_last_accepting_cpos;
 
 static yy_state_type yy_last_accepting_state;
 static char *yy_last_accepting_cpos;
 
+extern int yy_flex_debug;
+int yy_flex_debug = 0;
+
 /* The intent behind this definition is that it'll catch
  * any uses of REJECT which flex missed.
  */
 /* The intent behind this definition is that it'll catch
  * any uses of REJECT which flex missed.
  */
@@ -710,7 +792,6 @@ static char *yy_last_accepting_cpos;
 #define YY_RESTORE_YY_MORE_OFFSET
 char *yytext;
 #line 1 "lex.l"
 #define YY_RESTORE_YY_MORE_OFFSET
 char *yytext;
 #line 1 "lex.l"
-#define INITIAL 0
 #line 2 "lex.l"
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
 #line 2 "lex.l"
 /*
  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
@@ -745,7 +826,7 @@ char *yytext;
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: lex.l,v 1.31 2006/10/21 11:57:22 lha Exp $ */
+/* $Id: lex.l 18738 2006-10-21 11:57:22Z lha $ */
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
@@ -770,7 +851,23 @@ static unsigned lineno = 1;
 static void unterminated(const char *, unsigned);
 
 /* This is for broken old lexes (solaris 10 and hpux) */
 static void unterminated(const char *, unsigned);
 
 /* This is for broken old lexes (solaris 10 and hpux) */
-#line 774 "lex.c"
+#line 855 "lex.c"
+
+#define INITIAL 0
+
+#ifndef YY_NO_UNISTD_H
+/* Special case for "unistd.h", since it is non-ANSI. We include it way
+ * down here because we want the user's section 1 to have been scanned first.
+ * The user has a chance to override it with an option.
+ */
+#include <unistd.h>
+#endif
+
+#ifndef YY_EXTRA_TYPE
+#define YY_EXTRA_TYPE void *
+#endif
+
+static int yy_init_globals (void );
 
 /* Macros after this point can all be overridden by user definitions in
  * section 1.
 
 /* Macros after this point can all be overridden by user definitions in
  * section 1.
@@ -778,65 +875,30 @@ static void unterminated(const char *, unsigned);
 
 #ifndef YY_SKIP_YYWRAP
 #ifdef __cplusplus
 
 #ifndef YY_SKIP_YYWRAP
 #ifdef __cplusplus
-extern "C" int yywrap YY_PROTO(( void ));
+extern "C" int yywrap (void );
 #else
 #else
-extern int yywrap YY_PROTO(( void ));
+extern int yywrap (void );
 #endif
 #endif
 
 #endif
 #endif
 
-#ifndef YY_NO_UNPUT
-static void yyunput YY_PROTO(( int c, char *buf_ptr ));
-#endif
-
+    static void yyunput (int c,char *buf_ptr  );
+    
 #ifndef yytext_ptr
 #ifndef yytext_ptr
-static void yy_flex_strncpy YY_PROTO(( char *, yyconst char *, int ));
+static void yy_flex_strncpy (char *,yyconst char *,int );
 #endif
 
 #ifdef YY_NEED_STRLEN
 #endif
 
 #ifdef YY_NEED_STRLEN
-static int yy_flex_strlen YY_PROTO(( yyconst char * ));
+static int yy_flex_strlen (yyconst char * );
 #endif
 
 #ifndef YY_NO_INPUT
 #endif
 
 #ifndef YY_NO_INPUT
-#ifdef __cplusplus
-static int yyinput YY_PROTO(( void ));
-#else
-static int input YY_PROTO(( void ));
-#endif
-#endif
-
-#if YY_STACK_USED
-static int yy_start_stack_ptr = 0;
-static int yy_start_stack_depth = 0;
-static int *yy_start_stack = 0;
-#ifndef YY_NO_PUSH_STATE
-static void yy_push_state YY_PROTO(( int new_state ));
-#endif
-#ifndef YY_NO_POP_STATE
-static void yy_pop_state YY_PROTO(( void ));
-#endif
-#ifndef YY_NO_TOP_STATE
-static int yy_top_state YY_PROTO(( void ));
-#endif
 
 
+#ifdef __cplusplus
+static int yyinput (void );
 #else
 #else
-#define YY_NO_PUSH_STATE 1
-#define YY_NO_POP_STATE 1
-#define YY_NO_TOP_STATE 1
+static int input (void );
 #endif
 
 #endif
 
-#ifdef YY_MALLOC_DECL
-YY_MALLOC_DECL
-#else
-#if __STDC__
-#ifndef __cplusplus
-#include <stdlib.h>
-#endif
-#else
-/* Just try to get by without declaring the routines.  This will fail
- * miserably on non-ANSI systems for which sizeof(size_t) != sizeof(int)
- * or sizeof(void*) != sizeof(int).
- */
-#endif
 #endif
 
 /* Amount of stuff to slurp up with each read. */
 #endif
 
 /* Amount of stuff to slurp up with each read. */
@@ -845,7 +907,6 @@ YY_MALLOC_DECL
 #endif
 
 /* Copy whatever the last rule matched to the standard output. */
 #endif
 
 /* Copy whatever the last rule matched to the standard output. */
-
 #ifndef ECHO
 /* This used to be an fputs(), but since the string might contain NUL's,
  * we now use fwrite().
 #ifndef ECHO
 /* This used to be an fputs(), but since the string might contain NUL's,
  * we now use fwrite().
@@ -858,9 +919,10 @@ YY_MALLOC_DECL
  */
 #ifndef YY_INPUT
 #define YY_INPUT(buf,result,max_size) \
  */
 #ifndef YY_INPUT
 #define YY_INPUT(buf,result,max_size) \
-       if ( yy_current_buffer->yy_is_interactive ) \
+       if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \
                { \
                { \
-               int c = '*', n; \
+               int c = '*'; \
+               size_t n; \
                for ( n = 0; n < max_size && \
                             (c = getc( yyin )) != EOF && c != '\n'; ++n ) \
                        buf[n] = (char) c; \
                for ( n = 0; n < max_size && \
                             (c = getc( yyin )) != EOF && c != '\n'; ++n ) \
                        buf[n] = (char) c; \
@@ -870,9 +932,22 @@ YY_MALLOC_DECL
                        YY_FATAL_ERROR( "input in flex scanner failed" ); \
                result = n; \
                } \
                        YY_FATAL_ERROR( "input in flex scanner failed" ); \
                result = n; \
                } \
-       else if ( ((result = fread( buf, 1, max_size, yyin )) == 0) \
-                 && ferror( yyin ) ) \
-               YY_FATAL_ERROR( "input in flex scanner failed" );
+       else \
+               { \
+               errno=0; \
+               while ( (result = fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \
+                       { \
+                       if( errno != EINTR) \
+                               { \
+                               YY_FATAL_ERROR( "input in flex scanner failed" ); \
+                               break; \
+                               } \
+                       errno=0; \
+                       clearerr(yyin); \
+                       } \
+               }\
+\
+
 #endif
 
 /* No semi-colon after return; correct usage is to write "yyterminate();" -
 #endif
 
 /* No semi-colon after return; correct usage is to write "yyterminate();" -
@@ -893,12 +968,18 @@ YY_MALLOC_DECL
 #define YY_FATAL_ERROR(msg) yy_fatal_error( msg )
 #endif
 
 #define YY_FATAL_ERROR(msg) yy_fatal_error( msg )
 #endif
 
+/* end tables serialization structures and prototypes */
+
 /* Default declaration of generated scanner - a define so the user can
  * easily add parameters.
  */
 #ifndef YY_DECL
 /* Default declaration of generated scanner - a define so the user can
  * easily add parameters.
  */
 #ifndef YY_DECL
-#define YY_DECL int yylex YY_PROTO(( void ))
-#endif
+#define YY_DECL_IS_OURS 1
+
+extern int yylex (void);
+
+#define YY_DECL int yylex (void)
+#endif /* !YY_DECL */
 
 /* Code executed at the beginning of each rule, after yytext and yyleng
  * have been set up.
 
 /* Code executed at the beginning of each rule, after yytext and yyleng
  * have been set up.
@@ -915,26 +996,28 @@ YY_MALLOC_DECL
 #define YY_RULE_SETUP \
        YY_USER_ACTION
 
 #define YY_RULE_SETUP \
        YY_USER_ACTION
 
+/** The main scanner function which does all the work.
+ */
 YY_DECL
 YY_DECL
-       {
+{
        register yy_state_type yy_current_state;
        register yy_state_type yy_current_state;
-       register char *yy_cp = NULL, *yy_bp = NULL;
+       register char *yy_cp, *yy_bp;
        register int yy_act;
        register int yy_act;
-
+    
 #line 68 "lex.l"
 
 #line 68 "lex.l"
 
-#line 927 "lex.c"
+#line 1010 "lex.c"
 
 
-       if ( yy_init )
+       if ( !(yy_init) )
                {
                {
-               yy_init = 0;
+               (yy_init) = 1;
 
 #ifdef YY_USER_INIT
                YY_USER_INIT;
 #endif
 
 
 #ifdef YY_USER_INIT
                YY_USER_INIT;
 #endif
 
-               if ( ! yy_start )
-                       yy_start = 1;   /* first start state */
+               if ( ! (yy_start) )
+                       (yy_start) = 1; /* first start state */
 
                if ( ! yyin )
                        yyin = stdin;
 
                if ( ! yyin )
                        yyin = stdin;
@@ -942,34 +1025,36 @@ YY_DECL
                if ( ! yyout )
                        yyout = stdout;
 
                if ( ! yyout )
                        yyout = stdout;
 
-               if ( ! yy_current_buffer )
-                       yy_current_buffer =
-                               yy_create_buffer( yyin, YY_BUF_SIZE );
+               if ( ! YY_CURRENT_BUFFER ) {
+                       yyensure_buffer_stack ();
+                       YY_CURRENT_BUFFER_LVALUE =
+                               yy_create_buffer(yyin,YY_BUF_SIZE );
+               }
 
 
-               yy_load_buffer_state();
+               yy_load_buffer_state( );
                }
 
        while ( 1 )             /* loops until end-of-file is reached */
                {
                }
 
        while ( 1 )             /* loops until end-of-file is reached */
                {
-               yy_cp = yy_c_buf_p;
+               yy_cp = (yy_c_buf_p);
 
                /* Support of yytext. */
 
                /* Support of yytext. */
-               *yy_cp = yy_hold_char;
+               *yy_cp = (yy_hold_char);
 
                /* yy_bp points to the position in yy_ch_buf of the start of
                 * the current run.
                 */
                yy_bp = yy_cp;
 
 
                /* yy_bp points to the position in yy_ch_buf of the start of
                 * the current run.
                 */
                yy_bp = yy_cp;
 
-               yy_current_state = yy_start;
+               yy_current_state = (yy_start);
 yy_match:
                do
                        {
                        register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)];
                        if ( yy_accept[yy_current_state] )
                                {
 yy_match:
                do
                        {
                        register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)];
                        if ( yy_accept[yy_current_state] )
                                {
-                               yy_last_accepting_state = yy_current_state;
-                               yy_last_accepting_cpos = yy_cp;
+                               (yy_last_accepting_state) = yy_current_state;
+                               (yy_last_accepting_cpos) = yy_cp;
                                }
                        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                                {
                                }
                        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                                {
@@ -986,24 +1071,22 @@ yy_find_action:
                yy_act = yy_accept[yy_current_state];
                if ( yy_act == 0 )
                        { /* have to back up */
                yy_act = yy_accept[yy_current_state];
                if ( yy_act == 0 )
                        { /* have to back up */
-                       yy_cp = yy_last_accepting_cpos;
-                       yy_current_state = yy_last_accepting_state;
+                       yy_cp = (yy_last_accepting_cpos);
+                       yy_current_state = (yy_last_accepting_state);
                        yy_act = yy_accept[yy_current_state];
                        }
 
                YY_DO_BEFORE_ACTION;
 
                        yy_act = yy_accept[yy_current_state];
                        }
 
                YY_DO_BEFORE_ACTION;
 
-
 do_action:     /* This label is used only to access EOF actions. */
 
 do_action:     /* This label is used only to access EOF actions. */
 
-
                switch ( yy_act )
        { /* beginning of action switch */
                        case 0: /* must back up */
                        /* undo the effects of YY_DO_BEFORE_ACTION */
                switch ( yy_act )
        { /* beginning of action switch */
                        case 0: /* must back up */
                        /* undo the effects of YY_DO_BEFORE_ACTION */
-                       *yy_cp = yy_hold_char;
-                       yy_cp = yy_last_accepting_cpos;
-                       yy_current_state = yy_last_accepting_state;
+                       *yy_cp = (yy_hold_char);
+                       yy_cp = (yy_last_accepting_cpos);
+                       yy_current_state = (yy_last_accepting_state);
                        goto yy_find_action;
 
 case 1:
                        goto yy_find_action;
 
 case 1:
@@ -1567,6 +1650,7 @@ YY_RULE_SETUP
 ;
        YY_BREAK
 case 91:
 ;
        YY_BREAK
 case 91:
+/* rule 91 can match eol */
 YY_RULE_SETUP
 #line 270 "lex.l"
 { ++lineno; }
 YY_RULE_SETUP
 #line 270 "lex.l"
 { ++lineno; }
@@ -1591,33 +1675,33 @@ YY_RULE_SETUP
 #line 274 "lex.l"
 ECHO;
        YY_BREAK
 #line 274 "lex.l"
 ECHO;
        YY_BREAK
-#line 1595 "lex.c"
+#line 1679 "lex.c"
 case YY_STATE_EOF(INITIAL):
        yyterminate();
 
        case YY_END_OF_BUFFER:
                {
                /* Amount of text matched not including the EOB char. */
 case YY_STATE_EOF(INITIAL):
        yyterminate();
 
        case YY_END_OF_BUFFER:
                {
                /* Amount of text matched not including the EOB char. */
-               int yy_amount_of_matched_text = (int) (yy_cp - yytext_ptr) - 1;
+               int yy_amount_of_matched_text = (int) (yy_cp - (yytext_ptr)) - 1;
 
                /* Undo the effects of YY_DO_BEFORE_ACTION. */
 
                /* Undo the effects of YY_DO_BEFORE_ACTION. */
-               *yy_cp = yy_hold_char;
+               *yy_cp = (yy_hold_char);
                YY_RESTORE_YY_MORE_OFFSET
 
                YY_RESTORE_YY_MORE_OFFSET
 
-               if ( yy_current_buffer->yy_buffer_status == YY_BUFFER_NEW )
+               if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW )
                        {
                        /* We're scanning a new file or input source.  It's
                         * possible that this happened because the user
                         * just pointed yyin at a new source and called
                         * yylex().  If so, then we have to assure
                        {
                        /* We're scanning a new file or input source.  It's
                         * possible that this happened because the user
                         * just pointed yyin at a new source and called
                         * yylex().  If so, then we have to assure
-                        * consistency between yy_current_buffer and our
+                        * consistency between YY_CURRENT_BUFFER and our
                         * globals.  Here is the right place to do so, because
                         * this is the first action (other than possibly a
                         * back-up) that will match for the new input source.
                         */
                         * globals.  Here is the right place to do so, because
                         * this is the first action (other than possibly a
                         * back-up) that will match for the new input source.
                         */
-                       yy_n_chars = yy_current_buffer->yy_n_chars;
-                       yy_current_buffer->yy_input_file = yyin;
-                       yy_current_buffer->yy_buffer_status = YY_BUFFER_NORMAL;
+                       (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars;
+                       YY_CURRENT_BUFFER_LVALUE->yy_input_file = yyin;
+                       YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL;
                        }
 
                /* Note that here we test for yy_c_buf_p "<=" to the position
                        }
 
                /* Note that here we test for yy_c_buf_p "<=" to the position
@@ -1627,13 +1711,13 @@ case YY_STATE_EOF(INITIAL):
                 * end-of-buffer state).  Contrast this with the test
                 * in input().
                 */
                 * end-of-buffer state).  Contrast this with the test
                 * in input().
                 */
-               if ( yy_c_buf_p <= &yy_current_buffer->yy_ch_buf[yy_n_chars] )
+               if ( (yy_c_buf_p) <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] )
                        { /* This was really a NUL. */
                        yy_state_type yy_next_state;
 
                        { /* This was really a NUL. */
                        yy_state_type yy_next_state;
 
-                       yy_c_buf_p = yytext_ptr + yy_amount_of_matched_text;
+                       (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text;
 
 
-                       yy_current_state = yy_get_previous_state();
+                       yy_current_state = yy_get_previous_state(  );
 
                        /* Okay, we're now positioned to make the NUL
                         * transition.  We couldn't have
 
                        /* Okay, we're now positioned to make the NUL
                         * transition.  We couldn't have
@@ -1646,30 +1730,30 @@ case YY_STATE_EOF(INITIAL):
 
                        yy_next_state = yy_try_NUL_trans( yy_current_state );
 
 
                        yy_next_state = yy_try_NUL_trans( yy_current_state );
 
-                       yy_bp = yytext_ptr + YY_MORE_ADJ;
+                       yy_bp = (yytext_ptr) + YY_MORE_ADJ;
 
                        if ( yy_next_state )
                                {
                                /* Consume the NUL. */
 
                        if ( yy_next_state )
                                {
                                /* Consume the NUL. */
-                               yy_cp = ++yy_c_buf_p;
+                               yy_cp = ++(yy_c_buf_p);
                                yy_current_state = yy_next_state;
                                goto yy_match;
                                }
 
                        else
                                {
                                yy_current_state = yy_next_state;
                                goto yy_match;
                                }
 
                        else
                                {
-                               yy_cp = yy_c_buf_p;
+                               yy_cp = (yy_c_buf_p);
                                goto yy_find_action;
                                }
                        }
 
                                goto yy_find_action;
                                }
                        }
 
-               else switch ( yy_get_next_buffer() )
+               else switch ( yy_get_next_buffer(  ) )
                        {
                        case EOB_ACT_END_OF_FILE:
                                {
                        {
                        case EOB_ACT_END_OF_FILE:
                                {
-                               yy_did_buffer_switch_on_eof = 0;
+                               (yy_did_buffer_switch_on_eof) = 0;
 
 
-                               if ( yywrap() )
+                               if ( yywrap( ) )
                                        {
                                        /* Note: because we've taken care in
                                         * yy_get_next_buffer() to have set up
                                        {
                                        /* Note: because we've taken care in
                                         * yy_get_next_buffer() to have set up
@@ -1680,7 +1764,7 @@ case YY_STATE_EOF(INITIAL):
                                         * YY_NULL, it'll still work - another
                                         * YY_NULL will get returned.
                                         */
                                         * YY_NULL, it'll still work - another
                                         * YY_NULL will get returned.
                                         */
-                                       yy_c_buf_p = yytext_ptr + YY_MORE_ADJ;
+                                       (yy_c_buf_p) = (yytext_ptr) + YY_MORE_ADJ;
 
                                        yy_act = YY_STATE_EOF(YY_START);
                                        goto do_action;
 
                                        yy_act = YY_STATE_EOF(YY_START);
                                        goto do_action;
@@ -1688,30 +1772,30 @@ case YY_STATE_EOF(INITIAL):
 
                                else
                                        {
 
                                else
                                        {
-                                       if ( ! yy_did_buffer_switch_on_eof )
+                                       if ( ! (yy_did_buffer_switch_on_eof) )
                                                YY_NEW_FILE;
                                        }
                                break;
                                }
 
                        case EOB_ACT_CONTINUE_SCAN:
                                                YY_NEW_FILE;
                                        }
                                break;
                                }
 
                        case EOB_ACT_CONTINUE_SCAN:
-                               yy_c_buf_p =
-                                       yytext_ptr + yy_amount_of_matched_text;
+                               (yy_c_buf_p) =
+                                       (yytext_ptr) + yy_amount_of_matched_text;
 
 
-                               yy_current_state = yy_get_previous_state();
+                               yy_current_state = yy_get_previous_state(  );
 
 
-                               yy_cp = yy_c_buf_p;
-                               yy_bp = yytext_ptr + YY_MORE_ADJ;
+                               yy_cp = (yy_c_buf_p);
+                               yy_bp = (yytext_ptr) + YY_MORE_ADJ;
                                goto yy_match;
 
                        case EOB_ACT_LAST_MATCH:
                                goto yy_match;
 
                        case EOB_ACT_LAST_MATCH:
-                               yy_c_buf_p =
-                               &yy_current_buffer->yy_ch_buf[yy_n_chars];
+                               (yy_c_buf_p) =
+                               &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)];
 
 
-                               yy_current_state = yy_get_previous_state();
+                               yy_current_state = yy_get_previous_state(  );
 
 
-                               yy_cp = yy_c_buf_p;
-                               yy_bp = yytext_ptr + YY_MORE_ADJ;
+                               yy_cp = (yy_c_buf_p);
+                               yy_bp = (yytext_ptr) + YY_MORE_ADJ;
                                goto yy_find_action;
                        }
                break;
                                goto yy_find_action;
                        }
                break;
@@ -1722,8 +1806,7 @@ case YY_STATE_EOF(INITIAL):
                        "fatal flex scanner internal error--no action found" );
        } /* end of action switch */
                } /* end of scanning one token */
                        "fatal flex scanner internal error--no action found" );
        } /* end of action switch */
                } /* end of scanning one token */
-       } /* end of yylex */
-
+} /* end of yylex */
 
 /* yy_get_next_buffer - try to read in a new buffer
  *
 
 /* yy_get_next_buffer - try to read in a new buffer
  *
@@ -1732,21 +1815,20 @@ case YY_STATE_EOF(INITIAL):
  *     EOB_ACT_CONTINUE_SCAN - continue scanning from current position
  *     EOB_ACT_END_OF_FILE - end of file
  */
  *     EOB_ACT_CONTINUE_SCAN - continue scanning from current position
  *     EOB_ACT_END_OF_FILE - end of file
  */
-
-static int yy_get_next_buffer()
-       {
-       register char *dest = yy_current_buffer->yy_ch_buf;
-       register char *source = yytext_ptr;
+static int yy_get_next_buffer (void)
+{
+       register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf;
+       register char *source = (yytext_ptr);
        register int number_to_move, i;
        int ret_val;
 
        register int number_to_move, i;
        int ret_val;
 
-       if ( yy_c_buf_p > &yy_current_buffer->yy_ch_buf[yy_n_chars + 1] )
+       if ( (yy_c_buf_p) > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] )
                YY_FATAL_ERROR(
                "fatal flex scanner internal error--end of buffer missed" );
 
                YY_FATAL_ERROR(
                "fatal flex scanner internal error--end of buffer missed" );
 
-       if ( yy_current_buffer->yy_fill_buffer == 0 )
+       if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 )
                { /* Don't try to fill the buffer, so this is an EOF. */
                { /* Don't try to fill the buffer, so this is an EOF. */
-               if ( yy_c_buf_p - yytext_ptr - YY_MORE_ADJ == 1 )
+               if ( (yy_c_buf_p) - (yytext_ptr) - YY_MORE_ADJ == 1 )
                        {
                        /* We matched a single character, the EOB, so
                         * treat this as a final EOF.
                        {
                        /* We matched a single character, the EOB, so
                         * treat this as a final EOF.
@@ -1766,34 +1848,30 @@ static int yy_get_next_buffer()
        /* Try to read more data. */
 
        /* First move last chars to start of buffer. */
        /* Try to read more data. */
 
        /* First move last chars to start of buffer. */
-       number_to_move = (int) (yy_c_buf_p - yytext_ptr) - 1;
+       number_to_move = (int) ((yy_c_buf_p) - (yytext_ptr)) - 1;
 
        for ( i = 0; i < number_to_move; ++i )
                *(dest++) = *(source++);
 
 
        for ( i = 0; i < number_to_move; ++i )
                *(dest++) = *(source++);
 
-       if ( yy_current_buffer->yy_buffer_status == YY_BUFFER_EOF_PENDING )
+       if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING )
                /* don't do the read, it's not guaranteed to return an EOF,
                 * just force an EOF
                 */
                /* don't do the read, it's not guaranteed to return an EOF,
                 * just force an EOF
                 */
-               yy_current_buffer->yy_n_chars = yy_n_chars = 0;
+               YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = 0;
 
        else
                {
 
        else
                {
-               int num_to_read =
-                       yy_current_buffer->yy_buf_size - number_to_move - 1;
+                       int num_to_read =
+                       YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1;
 
                while ( num_to_read <= 0 )
                        { /* Not enough room in the buffer - grow it. */
 
                while ( num_to_read <= 0 )
                        { /* Not enough room in the buffer - grow it. */
-#ifdef YY_USES_REJECT
-                       YY_FATAL_ERROR(
-"input buffer overflow, can't enlarge buffer because scanner uses REJECT" );
-#else
 
                        /* just a shorter name for the current buffer */
 
                        /* just a shorter name for the current buffer */
-                       YY_BUFFER_STATE b = yy_current_buffer;
+                       YY_BUFFER_STATE b = YY_CURRENT_BUFFER;
 
                        int yy_c_buf_p_offset =
 
                        int yy_c_buf_p_offset =
-                               (int) (yy_c_buf_p - b->yy_ch_buf);
+                               (int) ((yy_c_buf_p) - b->yy_ch_buf);
 
                        if ( b->yy_is_our_buffer )
                                {
 
                        if ( b->yy_is_our_buffer )
                                {
@@ -1806,8 +1884,7 @@ static int yy_get_next_buffer()
 
                                b->yy_ch_buf = (char *)
                                        /* Include room in for 2 EOB chars. */
 
                                b->yy_ch_buf = (char *)
                                        /* Include room in for 2 EOB chars. */
-                                       yy_flex_realloc( (void *) b->yy_ch_buf,
-                                                        b->yy_buf_size + 2 );
+                                       yyrealloc((void *) b->yy_ch_buf,b->yy_buf_size + 2  );
                                }
                        else
                                /* Can't grow it, we don't own it. */
                                }
                        else
                                /* Can't grow it, we don't own it. */
@@ -1817,35 +1894,35 @@ static int yy_get_next_buffer()
                                YY_FATAL_ERROR(
                                "fatal error - scanner input buffer overflow" );
 
                                YY_FATAL_ERROR(
                                "fatal error - scanner input buffer overflow" );
 
-                       yy_c_buf_p = &b->yy_ch_buf[yy_c_buf_p_offset];
+                       (yy_c_buf_p) = &b->yy_ch_buf[yy_c_buf_p_offset];
 
 
-                       num_to_read = yy_current_buffer->yy_buf_size -
+                       num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size -
                                                number_to_move - 1;
                                                number_to_move - 1;
-#endif
+
                        }
 
                if ( num_to_read > YY_READ_BUF_SIZE )
                        num_to_read = YY_READ_BUF_SIZE;
 
                /* Read in more data. */
                        }
 
                if ( num_to_read > YY_READ_BUF_SIZE )
                        num_to_read = YY_READ_BUF_SIZE;
 
                /* Read in more data. */
-               YY_INPUT( (&yy_current_buffer->yy_ch_buf[number_to_move]),
-                       yy_n_chars, num_to_read );
+               YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]),
+                       (yy_n_chars), num_to_read );
 
 
-               yy_current_buffer->yy_n_chars = yy_n_chars;
+               YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
                }
 
                }
 
-       if ( yy_n_chars == 0 )
+       if ( (yy_n_chars) == 0 )
                {
                if ( number_to_move == YY_MORE_ADJ )
                        {
                        ret_val = EOB_ACT_END_OF_FILE;
                {
                if ( number_to_move == YY_MORE_ADJ )
                        {
                        ret_val = EOB_ACT_END_OF_FILE;
-                       yyrestart( yyin );
+                       yyrestart(yyin  );
                        }
 
                else
                        {
                        ret_val = EOB_ACT_LAST_MATCH;
                        }
 
                else
                        {
                        ret_val = EOB_ACT_LAST_MATCH;
-                       yy_current_buffer->yy_buffer_status =
+                       YY_CURRENT_BUFFER_LVALUE->yy_buffer_status =
                                YY_BUFFER_EOF_PENDING;
                        }
                }
                                YY_BUFFER_EOF_PENDING;
                        }
                }
@@ -1853,32 +1930,31 @@ static int yy_get_next_buffer()
        else
                ret_val = EOB_ACT_CONTINUE_SCAN;
 
        else
                ret_val = EOB_ACT_CONTINUE_SCAN;
 
-       yy_n_chars += number_to_move;
-       yy_current_buffer->yy_ch_buf[yy_n_chars] = YY_END_OF_BUFFER_CHAR;
-       yy_current_buffer->yy_ch_buf[yy_n_chars + 1] = YY_END_OF_BUFFER_CHAR;
+       (yy_n_chars) += number_to_move;
+       YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] = YY_END_OF_BUFFER_CHAR;
+       YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] = YY_END_OF_BUFFER_CHAR;
 
 
-       yytext_ptr = &yy_current_buffer->yy_ch_buf[0];
+       (yytext_ptr) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0];
 
        return ret_val;
 
        return ret_val;
-       }
-
+}
 
 /* yy_get_previous_state - get the state just before the EOB char was reached */
 
 
 /* yy_get_previous_state - get the state just before the EOB char was reached */
 
-static yy_state_type yy_get_previous_state()
-       {
+    static yy_state_type yy_get_previous_state (void)
+{
        register yy_state_type yy_current_state;
        register char *yy_cp;
        register yy_state_type yy_current_state;
        register char *yy_cp;
+    
+       yy_current_state = (yy_start);
 
 
-       yy_current_state = yy_start;
-
-       for ( yy_cp = yytext_ptr + YY_MORE_ADJ; yy_cp < yy_c_buf_p; ++yy_cp )
+       for ( yy_cp = (yytext_ptr) + YY_MORE_ADJ; yy_cp < (yy_c_buf_p); ++yy_cp )
                {
                register YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1);
                if ( yy_accept[yy_current_state] )
                        {
                {
                register YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1);
                if ( yy_accept[yy_current_state] )
                        {
-                       yy_last_accepting_state = yy_current_state;
-                       yy_last_accepting_cpos = yy_cp;
+                       (yy_last_accepting_state) = yy_current_state;
+                       (yy_last_accepting_cpos) = yy_cp;
                        }
                while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                        {
                        }
                while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                        {
@@ -1890,30 +1966,23 @@ static yy_state_type yy_get_previous_state()
                }
 
        return yy_current_state;
                }
 
        return yy_current_state;
-       }
-
+}
 
 /* yy_try_NUL_trans - try to make a transition on the NUL character
  *
  * synopsis
  *     next_state = yy_try_NUL_trans( current_state );
  */
 
 /* yy_try_NUL_trans - try to make a transition on the NUL character
  *
  * synopsis
  *     next_state = yy_try_NUL_trans( current_state );
  */
-
-#ifdef YY_USE_PROTOS
-static yy_state_type yy_try_NUL_trans( yy_state_type yy_current_state )
-#else
-static yy_state_type yy_try_NUL_trans( yy_current_state )
-yy_state_type yy_current_state;
-#endif
-       {
+    static yy_state_type yy_try_NUL_trans  (yy_state_type yy_current_state )
+{
        register int yy_is_jam;
        register int yy_is_jam;
-       register char *yy_cp = yy_c_buf_p;
+       register char *yy_cp = (yy_c_buf_p);
 
        register YY_CHAR yy_c = 1;
        if ( yy_accept[yy_current_state] )
                {
 
        register YY_CHAR yy_c = 1;
        if ( yy_accept[yy_current_state] )
                {
-               yy_last_accepting_state = yy_current_state;
-               yy_last_accepting_cpos = yy_cp;
+               (yy_last_accepting_state) = yy_current_state;
+               (yy_last_accepting_cpos) = yy_cp;
                }
        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                {
                }
        while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                {
@@ -1925,81 +1994,73 @@ yy_state_type yy_current_state;
        yy_is_jam = (yy_current_state == 567);
 
        return yy_is_jam ? 0 : yy_current_state;
        yy_is_jam = (yy_current_state == 567);
 
        return yy_is_jam ? 0 : yy_current_state;
-       }
-
+}
 
 
-#ifndef YY_NO_UNPUT
-#ifdef YY_USE_PROTOS
-static void yyunput( int c, register char *yy_bp )
-#else
-static void yyunput( c, yy_bp )
-int c;
-register char *yy_bp;
-#endif
-       {
-       register char *yy_cp = yy_c_buf_p;
+    static void yyunput (int c, register char * yy_bp )
+{
+       register char *yy_cp;
+    
+    yy_cp = (yy_c_buf_p);
 
        /* undo effects of setting up yytext */
 
        /* undo effects of setting up yytext */
-       *yy_cp = yy_hold_char;
+       *yy_cp = (yy_hold_char);
 
 
-       if ( yy_cp < yy_current_buffer->yy_ch_buf + 2 )
+       if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 )
                { /* need to shift things up to make room */
                /* +2 for EOB chars. */
                { /* need to shift things up to make room */
                /* +2 for EOB chars. */
-               register int number_to_move = yy_n_chars + 2;
-               register char *dest = &yy_current_buffer->yy_ch_buf[
-                                       yy_current_buffer->yy_buf_size + 2];
+               register int number_to_move = (yy_n_chars) + 2;
+               register char *dest = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[
+                                       YY_CURRENT_BUFFER_LVALUE->yy_buf_size + 2];
                register char *source =
                register char *source =
-                               &yy_current_buffer->yy_ch_buf[number_to_move];
+                               &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move];
 
 
-               while ( source > yy_current_buffer->yy_ch_buf )
+               while ( source > YY_CURRENT_BUFFER_LVALUE->yy_ch_buf )
                        *--dest = *--source;
 
                yy_cp += (int) (dest - source);
                yy_bp += (int) (dest - source);
                        *--dest = *--source;
 
                yy_cp += (int) (dest - source);
                yy_bp += (int) (dest - source);
-               yy_current_buffer->yy_n_chars =
-                       yy_n_chars = yy_current_buffer->yy_buf_size;
+               YY_CURRENT_BUFFER_LVALUE->yy_n_chars =
+                       (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_buf_size;
 
 
-               if ( yy_cp < yy_current_buffer->yy_ch_buf + 2 )
+               if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 )
                        YY_FATAL_ERROR( "flex scanner push-back overflow" );
                }
 
        *--yy_cp = (char) c;
 
                        YY_FATAL_ERROR( "flex scanner push-back overflow" );
                }
 
        *--yy_cp = (char) c;
 
-
-       yytext_ptr = yy_bp;
-       yy_hold_char = *yy_cp;
-       yy_c_buf_p = yy_cp;
-       }
-#endif /* ifndef YY_NO_UNPUT */
-
+       (yytext_ptr) = yy_bp;
+       (yy_hold_char) = *yy_cp;
+       (yy_c_buf_p) = yy_cp;
+}
 
 #ifndef YY_NO_INPUT
 #ifdef __cplusplus
 
 #ifndef YY_NO_INPUT
 #ifdef __cplusplus
-static int yyinput()
+    static int yyinput (void)
 #else
 #else
-static int input()
+    static int input  (void)
 #endif
 #endif
-       {
-       int c;
 
 
-       *yy_c_buf_p = yy_hold_char;
+{
+       int c;
+    
+       *(yy_c_buf_p) = (yy_hold_char);
 
 
-       if ( *yy_c_buf_p == YY_END_OF_BUFFER_CHAR )
+       if ( *(yy_c_buf_p) == YY_END_OF_BUFFER_CHAR )
                {
                /* yy_c_buf_p now points to the character we want to return.
                 * If this occurs *before* the EOB characters, then it's a
                 * valid NUL; if not, then we've hit the end of the buffer.
                 */
                {
                /* yy_c_buf_p now points to the character we want to return.
                 * If this occurs *before* the EOB characters, then it's a
                 * valid NUL; if not, then we've hit the end of the buffer.
                 */
-               if ( yy_c_buf_p < &yy_current_buffer->yy_ch_buf[yy_n_chars] )
+               if ( (yy_c_buf_p) < &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] )
                        /* This was really a NUL. */
                        /* This was really a NUL. */
-                       *yy_c_buf_p = '\0';
+                       *(yy_c_buf_p) = '\0';
 
                else
                        { /* need more input */
 
                else
                        { /* need more input */
-                       int offset = yy_c_buf_p - yytext_ptr;
-                       ++yy_c_buf_p;
+                       int offset = (yy_c_buf_p) - (yytext_ptr);
+                       ++(yy_c_buf_p);
 
 
-                       switch ( yy_get_next_buffer() )
+                       switch ( yy_get_next_buffer(  ) )
                                {
                                case EOB_ACT_LAST_MATCH:
                                        /* This happens because yy_g_n_b()
                                {
                                case EOB_ACT_LAST_MATCH:
                                        /* This happens because yy_g_n_b()
@@ -2013,16 +2074,16 @@ static int input()
                                         */
 
                                        /* Reset buffer status. */
                                         */
 
                                        /* Reset buffer status. */
-                                       yyrestart( yyin );
+                                       yyrestart(yyin );
 
 
-                                       /* fall through */
+                                       /*FALLTHROUGH*/
 
                                case EOB_ACT_END_OF_FILE:
                                        {
 
                                case EOB_ACT_END_OF_FILE:
                                        {
-                                       if ( yywrap() )
+                                       if ( yywrap( ) )
                                                return EOF;
 
                                                return EOF;
 
-                                       if ( ! yy_did_buffer_switch_on_eof )
+                                       if ( ! (yy_did_buffer_switch_on_eof) )
                                                YY_NEW_FILE;
 #ifdef __cplusplus
                                        return yyinput();
                                                YY_NEW_FILE;
 #ifdef __cplusplus
                                        return yyinput();
@@ -2032,90 +2093,92 @@ static int input()
                                        }
 
                                case EOB_ACT_CONTINUE_SCAN:
                                        }
 
                                case EOB_ACT_CONTINUE_SCAN:
-                                       yy_c_buf_p = yytext_ptr + offset;
+                                       (yy_c_buf_p) = (yytext_ptr) + offset;
                                        break;
                                }
                        }
                }
 
                                        break;
                                }
                        }
                }
 
-       c = *(unsigned char *) yy_c_buf_p;      /* cast for 8-bit char's */
-       *yy_c_buf_p = '\0';     /* preserve yytext */
-       yy_hold_char = *++yy_c_buf_p;
-
+       c = *(unsigned char *) (yy_c_buf_p);    /* cast for 8-bit char's */
+       *(yy_c_buf_p) = '\0';   /* preserve yytext */
+       (yy_hold_char) = *++(yy_c_buf_p);
 
        return c;
 
        return c;
-       }
-#endif /* YY_NO_INPUT */
-
-#ifdef YY_USE_PROTOS
-void yyrestart( FILE *input_file )
-#else
-void yyrestart( input_file )
-FILE *input_file;
-#endif
-       {
-       if ( ! yy_current_buffer )
-               yy_current_buffer = yy_create_buffer( yyin, YY_BUF_SIZE );
+}
+#endif /* ifndef YY_NO_INPUT */
 
 
-       yy_init_buffer( yy_current_buffer, input_file );
-       yy_load_buffer_state();
+/** Immediately switch to a different input stream.
+ * @param input_file A readable stream.
+ * 
+ * @note This function does not reset the start condition to @c INITIAL .
+ */
+    void yyrestart  (FILE * input_file )
+{
+    
+       if ( ! YY_CURRENT_BUFFER ){
+        yyensure_buffer_stack ();
+               YY_CURRENT_BUFFER_LVALUE =
+            yy_create_buffer(yyin,YY_BUF_SIZE );
        }
 
        }
 
+       yy_init_buffer(YY_CURRENT_BUFFER,input_file );
+       yy_load_buffer_state( );
+}
 
 
-#ifdef YY_USE_PROTOS
-void yy_switch_to_buffer( YY_BUFFER_STATE new_buffer )
-#else
-void yy_switch_to_buffer( new_buffer )
-YY_BUFFER_STATE new_buffer;
-#endif
-       {
-       if ( yy_current_buffer == new_buffer )
+/** Switch to a different input buffer.
+ * @param new_buffer The new input buffer.
+ * 
+ */
+    void yy_switch_to_buffer  (YY_BUFFER_STATE  new_buffer )
+{
+    
+       /* TODO. We should be able to replace this entire function body
+        * with
+        *              yypop_buffer_state();
+        *              yypush_buffer_state(new_buffer);
+     */
+       yyensure_buffer_stack ();
+       if ( YY_CURRENT_BUFFER == new_buffer )
                return;
 
                return;
 
-       if ( yy_current_buffer )
+       if ( YY_CURRENT_BUFFER )
                {
                /* Flush out information for old buffer. */
                {
                /* Flush out information for old buffer. */
-               *yy_c_buf_p = yy_hold_char;
-               yy_current_buffer->yy_buf_pos = yy_c_buf_p;
-               yy_current_buffer->yy_n_chars = yy_n_chars;
+               *(yy_c_buf_p) = (yy_hold_char);
+               YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p);
+               YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
                }
 
                }
 
-       yy_current_buffer = new_buffer;
-       yy_load_buffer_state();
+       YY_CURRENT_BUFFER_LVALUE = new_buffer;
+       yy_load_buffer_state( );
 
        /* We don't actually know whether we did this switch during
         * EOF (yywrap()) processing, but the only time this flag
         * is looked at is after yywrap() is called, so it's safe
         * to go ahead and always set it.
         */
 
        /* We don't actually know whether we did this switch during
         * EOF (yywrap()) processing, but the only time this flag
         * is looked at is after yywrap() is called, so it's safe
         * to go ahead and always set it.
         */
-       yy_did_buffer_switch_on_eof = 1;
-       }
-
-
-#ifdef YY_USE_PROTOS
-void yy_load_buffer_state( void )
-#else
-void yy_load_buffer_state()
-#endif
-       {
-       yy_n_chars = yy_current_buffer->yy_n_chars;
-       yytext_ptr = yy_c_buf_p = yy_current_buffer->yy_buf_pos;
-       yyin = yy_current_buffer->yy_input_file;
-       yy_hold_char = *yy_c_buf_p;
-       }
+       (yy_did_buffer_switch_on_eof) = 1;
+}
 
 
+static void yy_load_buffer_state  (void)
+{
+       (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars;
+       (yytext_ptr) = (yy_c_buf_p) = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos;
+       yyin = YY_CURRENT_BUFFER_LVALUE->yy_input_file;
+       (yy_hold_char) = *(yy_c_buf_p);
+}
 
 
-#ifdef YY_USE_PROTOS
-YY_BUFFER_STATE yy_create_buffer( FILE *file, int size )
-#else
-YY_BUFFER_STATE yy_create_buffer( file, size )
-FILE *file;
-int size;
-#endif
-       {
+/** Allocate and initialize an input buffer state.
+ * @param file A readable stream.
+ * @param size The character buffer size in bytes. When in doubt, use @c YY_BUF_SIZE.
+ * 
+ * @return the allocated buffer state.
+ */
+    YY_BUFFER_STATE yy_create_buffer  (FILE * file, int  size )
+{
        YY_BUFFER_STATE b;
        YY_BUFFER_STATE b;
-
-       b = (YY_BUFFER_STATE) yy_flex_alloc( sizeof( struct yy_buffer_state ) );
+    
+       b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state )  );
        if ( ! b )
                YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );
 
        if ( ! b )
                YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );
 
@@ -2124,75 +2187,75 @@ int size;
        /* yy_ch_buf has to be 2 characters longer than the size given because
         * we need to put in 2 end-of-buffer characters.
         */
        /* yy_ch_buf has to be 2 characters longer than the size given because
         * we need to put in 2 end-of-buffer characters.
         */
-       b->yy_ch_buf = (char *) yy_flex_alloc( b->yy_buf_size + 2 );
+       b->yy_ch_buf = (char *) yyalloc(b->yy_buf_size + 2  );
        if ( ! b->yy_ch_buf )
                YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );
 
        b->yy_is_our_buffer = 1;
 
        if ( ! b->yy_ch_buf )
                YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );
 
        b->yy_is_our_buffer = 1;
 
-       yy_init_buffer( b, file );
+       yy_init_buffer(b,file );
 
        return b;
 
        return b;
-       }
-
+}
 
 
-#ifdef YY_USE_PROTOS
-void yy_delete_buffer( YY_BUFFER_STATE b )
-#else
-void yy_delete_buffer( b )
-YY_BUFFER_STATE b;
-#endif
-       {
+/** Destroy the buffer.
+ * @param b a buffer created with yy_create_buffer()
+ * 
+ */
+    void yy_delete_buffer (YY_BUFFER_STATE  b )
+{
+    
        if ( ! b )
                return;
 
        if ( ! b )
                return;
 
-       if ( b == yy_current_buffer )
-               yy_current_buffer = (YY_BUFFER_STATE) 0;
+       if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */
+               YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0;
 
        if ( b->yy_is_our_buffer )
 
        if ( b->yy_is_our_buffer )
-               yy_flex_free( (void *) b->yy_ch_buf );
+               yyfree((void *) b->yy_ch_buf  );
 
 
-       yy_flex_free( (void *) b );
-       }
-
-
-
-#ifdef YY_USE_PROTOS
-void yy_init_buffer( YY_BUFFER_STATE b, FILE *file )
-#else
-void yy_init_buffer( b, file )
-YY_BUFFER_STATE b;
-FILE *file;
-#endif
+       yyfree((void *) b  );
+}
 
 
+#ifndef __cplusplus
+extern int isatty (int );
+#endif /* __cplusplus */
+    
+/* Initializes or reinitializes a buffer.
+ * This function is sometimes called more than once on the same buffer,
+ * such as during a yyrestart() or at EOF.
+ */
+    static void yy_init_buffer  (YY_BUFFER_STATE  b, FILE * file )
 
 
-       {
-       yy_flush_buffer( b );
+{
+       int oerrno = errno;
+    
+       yy_flush_buffer(b );
 
        b->yy_input_file = file;
        b->yy_fill_buffer = 1;
 
 
        b->yy_input_file = file;
        b->yy_fill_buffer = 1;
 
-#if YY_ALWAYS_INTERACTIVE
-       b->yy_is_interactive = 1;
-#else
-#if YY_NEVER_INTERACTIVE
-       b->yy_is_interactive = 0;
-#else
-       b->yy_is_interactive = file ? (isatty( fileno(file) ) > 0) : 0;
-#endif
-#endif
-       }
-
-
-#ifdef YY_USE_PROTOS
-void yy_flush_buffer( YY_BUFFER_STATE b )
-#else
-void yy_flush_buffer( b )
-YY_BUFFER_STATE b;
-#endif
+    /* If b is the current buffer, then yy_init_buffer was _probably_
+     * called from yyrestart() or through yy_get_next_buffer.
+     * In that case, we don't want to reset the lineno or column.
+     */
+    if (b != YY_CURRENT_BUFFER){
+        b->yy_bs_lineno = 1;
+        b->yy_bs_column = 0;
+    }
+
+        b->yy_is_interactive = file ? (isatty( fileno(file) ) > 0) : 0;
+    
+       errno = oerrno;
+}
 
 
-       {
-       if ( ! b )
+/** Discard all buffered characters. On the next scan, YY_INPUT will be called.
+ * @param b the buffer state to be flushed, usually @c YY_CURRENT_BUFFER.
+ * 
+ */
+    void yy_flush_buffer (YY_BUFFER_STATE  b )
+{
+       if ( ! b )
                return;
 
        b->yy_n_chars = 0;
                return;
 
        b->yy_n_chars = 0;
@@ -2209,29 +2272,121 @@ YY_BUFFER_STATE b;
        b->yy_at_bol = 1;
        b->yy_buffer_status = YY_BUFFER_NEW;
 
        b->yy_at_bol = 1;
        b->yy_buffer_status = YY_BUFFER_NEW;
 
-       if ( b == yy_current_buffer )
-               yy_load_buffer_state();
+       if ( b == YY_CURRENT_BUFFER )
+               yy_load_buffer_state( );
+}
+
+/** Pushes the new state onto the stack. The new state becomes
+ *  the current state. This function will allocate the stack
+ *  if necessary.
+ *  @param new_buffer The new state.
+ *  
+ */
+void yypush_buffer_state (YY_BUFFER_STATE new_buffer )
+{
+       if (new_buffer == NULL)
+               return;
+
+       yyensure_buffer_stack();
+
+       /* This block is copied from yy_switch_to_buffer. */
+       if ( YY_CURRENT_BUFFER )
+               {
+               /* Flush out information for old buffer. */
+               *(yy_c_buf_p) = (yy_hold_char);
+               YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p);
+               YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
+               }
+
+       /* Only push if top exists. Otherwise, replace top. */
+       if (YY_CURRENT_BUFFER)
+               (yy_buffer_stack_top)++;
+       YY_CURRENT_BUFFER_LVALUE = new_buffer;
+
+       /* copied from yy_switch_to_buffer. */
+       yy_load_buffer_state( );
+       (yy_did_buffer_switch_on_eof) = 1;
+}
+
+/** Removes and deletes the top of the stack, if present.
+ *  The next element becomes the new top.
+ *  
+ */
+void yypop_buffer_state (void)
+{
+       if (!YY_CURRENT_BUFFER)
+               return;
+
+       yy_delete_buffer(YY_CURRENT_BUFFER );
+       YY_CURRENT_BUFFER_LVALUE = NULL;
+       if ((yy_buffer_stack_top) > 0)
+               --(yy_buffer_stack_top);
+
+       if (YY_CURRENT_BUFFER) {
+               yy_load_buffer_state( );
+               (yy_did_buffer_switch_on_eof) = 1;
        }
        }
+}
 
 
+/* Allocates the stack if it does not exist.
+ *  Guarantees space for at least one push.
+ */
+static void yyensure_buffer_stack (void)
+{
+       int num_to_alloc;
+    
+       if (!(yy_buffer_stack)) {
+
+               /* First allocation is just for 2 elements, since we don't know if this
+                * scanner will even need a stack. We use 2 instead of 1 to avoid an
+                * immediate realloc on the next call.
+         */
+               num_to_alloc = 1;
+               (yy_buffer_stack) = (struct yy_buffer_state**)yyalloc
+                                                               (num_to_alloc * sizeof(struct yy_buffer_state*)
+                                                               );
+               
+               memset((yy_buffer_stack), 0, num_to_alloc * sizeof(struct yy_buffer_state*));
+                               
+               (yy_buffer_stack_max) = num_to_alloc;
+               (yy_buffer_stack_top) = 0;
+               return;
+       }
 
 
-#ifndef YY_NO_SCAN_BUFFER
-#ifdef YY_USE_PROTOS
-YY_BUFFER_STATE yy_scan_buffer( char *base, yy_size_t size )
-#else
-YY_BUFFER_STATE yy_scan_buffer( base, size )
-char *base;
-yy_size_t size;
-#endif
-       {
-       YY_BUFFER_STATE b;
+       if ((yy_buffer_stack_top) >= ((yy_buffer_stack_max)) - 1){
 
 
+               /* Increase the buffer to prepare for a possible push. */
+               int grow_size = 8 /* arbitrary grow size */;
+
+               num_to_alloc = (yy_buffer_stack_max) + grow_size;
+               (yy_buffer_stack) = (struct yy_buffer_state**)yyrealloc
+                                                               ((yy_buffer_stack),
+                                                               num_to_alloc * sizeof(struct yy_buffer_state*)
+                                                               );
+
+               /* zero only the new slots.*/
+               memset((yy_buffer_stack) + (yy_buffer_stack_max), 0, grow_size * sizeof(struct yy_buffer_state*));
+               (yy_buffer_stack_max) = num_to_alloc;
+       }
+}
+
+/** Setup the input buffer state to scan directly from a user-specified character buffer.
+ * @param base the character buffer
+ * @param size the size in bytes of the character buffer
+ * 
+ * @return the newly allocated buffer state object. 
+ */
+YY_BUFFER_STATE yy_scan_buffer  (char * base, yy_size_t  size )
+{
+       YY_BUFFER_STATE b;
+    
        if ( size < 2 ||
             base[size-2] != YY_END_OF_BUFFER_CHAR ||
             base[size-1] != YY_END_OF_BUFFER_CHAR )
                /* They forgot to leave room for the EOB's. */
                return 0;
 
        if ( size < 2 ||
             base[size-2] != YY_END_OF_BUFFER_CHAR ||
             base[size-1] != YY_END_OF_BUFFER_CHAR )
                /* They forgot to leave room for the EOB's. */
                return 0;
 
-       b = (YY_BUFFER_STATE) yy_flex_alloc( sizeof( struct yy_buffer_state ) );
+       b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state )  );
        if ( ! b )
                YY_FATAL_ERROR( "out of dynamic memory in yy_scan_buffer()" );
 
        if ( ! b )
                YY_FATAL_ERROR( "out of dynamic memory in yy_scan_buffer()" );
 
@@ -2245,56 +2400,51 @@ yy_size_t size;
        b->yy_fill_buffer = 0;
        b->yy_buffer_status = YY_BUFFER_NEW;
 
        b->yy_fill_buffer = 0;
        b->yy_buffer_status = YY_BUFFER_NEW;
 
-       yy_switch_to_buffer( b );
+       yy_switch_to_buffer( );
 
        return b;
 
        return b;
-       }
-#endif
-
-
-#ifndef YY_NO_SCAN_STRING
-#ifdef YY_USE_PROTOS
-YY_BUFFER_STATE yy_scan_string( yyconst char *yy_str )
-#else
-YY_BUFFER_STATE yy_scan_string( yy_str )
-yyconst char *yy_str;
-#endif
-       {
-       int len;
-       for ( len = 0; yy_str[len]; ++len )
-               ;
-
-       return yy_scan_bytes( yy_str, len );
-       }
-#endif
+}
 
 
+/** Setup the input buffer state to scan a string. The next call to yylex() will
+ * scan from a @e copy of @a str.
+ * @param str a NUL-terminated string to scan
+ * 
+ * @return the newly allocated buffer state object.
+ * @note If you want to scan bytes that may contain NUL values, then use
+ *       yy_scan_bytes() instead.
+ */
+YY_BUFFER_STATE yy_scan_string (yyconst char * yystr )
+{
+    
+       return yy_scan_bytes(yystr,strlen(yystr) );
+}
 
 
-#ifndef YY_NO_SCAN_BYTES
-#ifdef YY_USE_PROTOS
-YY_BUFFER_STATE yy_scan_bytes( yyconst char *bytes, int len )
-#else
-YY_BUFFER_STATE yy_scan_bytes( bytes, len )
-yyconst char *bytes;
-int len;
-#endif
-       {
+/** Setup the input buffer state to scan the given bytes. The next call to yylex() will
+ * scan from a @e copy of @a bytes.
+ * @param bytes the byte buffer to scan
+ * @param len the number of bytes in the buffer pointed to by @a bytes.
+ * 
+ * @return the newly allocated buffer state object.
+ */
+YY_BUFFER_STATE yy_scan_bytes  (yyconst char * yybytes, int  _yybytes_len )
+{
        YY_BUFFER_STATE b;
        char *buf;
        yy_size_t n;
        int i;
        YY_BUFFER_STATE b;
        char *buf;
        yy_size_t n;
        int i;
-
+    
        /* Get memory for full buffer, including space for trailing EOB's. */
        /* Get memory for full buffer, including space for trailing EOB's. */
-       n = len + 2;
-       buf = (char *) yy_flex_alloc( n );
+       n = _yybytes_len + 2;
+       buf = (char *) yyalloc(n  );
        if ( ! buf )
                YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" );
 
        if ( ! buf )
                YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" );
 
-       for ( i = 0; i < len; ++i )
-               buf[i] = bytes[i];
+       for ( i = 0; i < _yybytes_len; ++i )
+               buf[i] = yybytes[i];
 
 
-       buf[len] = buf[len+1] = YY_END_OF_BUFFER_CHAR;
+       buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR;
 
 
-       b = yy_scan_buffer( buf, n );
+       b = yy_scan_buffer(buf,n );
        if ( ! b )
                YY_FATAL_ERROR( "bad buffer in yy_scan_bytes()" );
 
        if ( ! b )
                YY_FATAL_ERROR( "bad buffer in yy_scan_bytes()" );
 
@@ -2304,148 +2454,196 @@ int len;
        b->yy_is_our_buffer = 1;
 
        return b;
        b->yy_is_our_buffer = 1;
 
        return b;
-       }
+}
+
+#ifndef YY_EXIT_FAILURE
+#define YY_EXIT_FAILURE 2
 #endif
 
 #endif
 
+static void yy_fatal_error (yyconst char* msg )
+{
+       (void) fprintf( stderr, "%s\n", msg );
+       exit( YY_EXIT_FAILURE );
+}
+
+/* Redefine yyless() so it works in section 3 code. */
 
 
-#ifndef YY_NO_PUSH_STATE
-#ifdef YY_USE_PROTOS
-static void yy_push_state( int new_state )
-#else
-static void yy_push_state( new_state )
-int new_state;
-#endif
-       {
-       if ( yy_start_stack_ptr >= yy_start_stack_depth )
-               {
-               yy_size_t new_size;
+#undef yyless
+#define yyless(n) \
+       do \
+               { \
+               /* Undo effects of setting up yytext. */ \
+        int yyless_macro_arg = (n); \
+        YY_LESS_LINENO(yyless_macro_arg);\
+               yytext[yyleng] = (yy_hold_char); \
+               (yy_c_buf_p) = yytext + yyless_macro_arg; \
+               (yy_hold_char) = *(yy_c_buf_p); \
+               *(yy_c_buf_p) = '\0'; \
+               yyleng = yyless_macro_arg; \
+               } \
+       while ( 0 )
 
 
-               yy_start_stack_depth += YY_START_STACK_INCR;
-               new_size = yy_start_stack_depth * sizeof( int );
+/* Accessor  methods (get/set functions) to struct members. */
 
 
-               if ( ! yy_start_stack )
-                       yy_start_stack = (int *) yy_flex_alloc( new_size );
+/** Get the current line number.
+ * 
+ */
+int yyget_lineno  (void)
+{
+        
+    return yylineno;
+}
 
 
-               else
-                       yy_start_stack = (int *) yy_flex_realloc(
-                                       (void *) yy_start_stack, new_size );
+/** Get the input stream.
+ * 
+ */
+FILE *yyget_in  (void)
+{
+        return yyin;
+}
 
 
-               if ( ! yy_start_stack )
-                       YY_FATAL_ERROR(
-                       "out of memory expanding start-condition stack" );
-               }
+/** Get the output stream.
+ * 
+ */
+FILE *yyget_out  (void)
+{
+        return yyout;
+}
 
 
-       yy_start_stack[yy_start_stack_ptr++] = YY_START;
+/** Get the length of the current token.
+ * 
+ */
+int yyget_leng  (void)
+{
+        return yyleng;
+}
 
 
-       BEGIN(new_state);
-       }
-#endif
+/** Get the current token.
+ * 
+ */
 
 
+char *yyget_text  (void)
+{
+        return yytext;
+}
 
 
-#ifndef YY_NO_POP_STATE
-static void yy_pop_state()
-       {
-       if ( --yy_start_stack_ptr < 0 )
-               YY_FATAL_ERROR( "start-condition stack underflow" );
+/** Set the current line number.
+ * @param line_number
+ * 
+ */
+void yyset_lineno (int  line_number )
+{
+    
+    yylineno = line_number;
+}
 
 
-       BEGIN(yy_start_stack[yy_start_stack_ptr]);
-       }
-#endif
+/** Set the input stream. This does not discard the current
+ * input buffer.
+ * @param in_str A readable stream.
+ * 
+ * @see yy_switch_to_buffer
+ */
+void yyset_in (FILE *  in_str )
+{
+        yyin = in_str ;
+}
 
 
+void yyset_out (FILE *  out_str )
+{
+        yyout = out_str ;
+}
 
 
-#ifndef YY_NO_TOP_STATE
-static int yy_top_state()
-       {
-       return yy_start_stack[yy_start_stack_ptr - 1];
-       }
-#endif
+int yyget_debug  (void)
+{
+        return yy_flex_debug;
+}
 
 
-#ifndef YY_EXIT_FAILURE
-#define YY_EXIT_FAILURE 2
-#endif
+void yyset_debug (int  bdebug )
+{
+        yy_flex_debug = bdebug ;
+}
 
 
-#ifdef YY_USE_PROTOS
-static void yy_fatal_error( yyconst char msg[] )
+static int yy_init_globals (void)
+{
+        /* Initialization is the same as for the non-reentrant scanner.
+     * This function is called from yylex_destroy(), so don't allocate here.
+     */
+
+    (yy_buffer_stack) = 0;
+    (yy_buffer_stack_top) = 0;
+    (yy_buffer_stack_max) = 0;
+    (yy_c_buf_p) = (char *) 0;
+    (yy_init) = 0;
+    (yy_start) = 0;
+
+/* Defined in main.c */
+#ifdef YY_STDINIT
+    yyin = stdin;
+    yyout = stdout;
 #else
 #else
-static void yy_fatal_error( msg )
-char msg[];
+    yyin = (FILE *) 0;
+    yyout = (FILE *) 0;
 #endif
 #endif
-       {
-       (void) fprintf( stderr, "%s\n", msg );
-       exit( YY_EXIT_FAILURE );
-       }
 
 
+    /* For future reference: Set errno on error, since we are called by
+     * yylex_init()
+     */
+    return 0;
+}
 
 
+/* yylex_destroy is for both reentrant and non-reentrant scanners. */
+int yylex_destroy  (void)
+{
+    
+    /* Pop the buffer stack, destroying each element. */
+       while(YY_CURRENT_BUFFER){
+               yy_delete_buffer(YY_CURRENT_BUFFER  );
+               YY_CURRENT_BUFFER_LVALUE = NULL;
+               yypop_buffer_state();
+       }
 
 
-/* Redefine yyless() so it works in section 3 code. */
+       /* Destroy the stack itself. */
+       yyfree((yy_buffer_stack) );
+       (yy_buffer_stack) = NULL;
 
 
-#undef yyless
-#define yyless(n) \
-       do \
-               { \
-               /* Undo effects of setting up yytext. */ \
-               yytext[yyleng] = yy_hold_char; \
-               yy_c_buf_p = yytext + n; \
-               yy_hold_char = *yy_c_buf_p; \
-               *yy_c_buf_p = '\0'; \
-               yyleng = n; \
-               } \
-       while ( 0 )
+    /* Reset the globals. This is important in a non-reentrant scanner so the next time
+     * yylex() is called, initialization will occur. */
+    yy_init_globals( );
 
 
+    return 0;
+}
 
 
-/* Internal utility routines. */
+/*
+ * Internal utility routines.
+ */
 
 #ifndef yytext_ptr
 
 #ifndef yytext_ptr
-#ifdef YY_USE_PROTOS
-static void yy_flex_strncpy( char *s1, yyconst char *s2, int n )
-#else
-static void yy_flex_strncpy( s1, s2, n )
-char *s1;
-yyconst char *s2;
-int n;
-#endif
-       {
+static void yy_flex_strncpy (char* s1, yyconst char * s2, int n )
+{
        register int i;
        for ( i = 0; i < n; ++i )
                s1[i] = s2[i];
        register int i;
        for ( i = 0; i < n; ++i )
                s1[i] = s2[i];
-       }
+}
 #endif
 
 #ifdef YY_NEED_STRLEN
 #endif
 
 #ifdef YY_NEED_STRLEN
-#ifdef YY_USE_PROTOS
-static int yy_flex_strlen( yyconst char *s )
-#else
-static int yy_flex_strlen( s )
-yyconst char *s;
-#endif
-       {
+static int yy_flex_strlen (yyconst char * s )
+{
        register int n;
        for ( n = 0; s[n]; ++n )
                ;
 
        return n;
        register int n;
        for ( n = 0; s[n]; ++n )
                ;
 
        return n;
-       }
+}
 #endif
 
 #endif
 
-
-#ifdef YY_USE_PROTOS
-static void *yy_flex_alloc( yy_size_t size )
-#else
-static void *yy_flex_alloc( size )
-yy_size_t size;
-#endif
-       {
+void *yyalloc (yy_size_t  size )
+{
        return (void *) malloc( size );
        return (void *) malloc( size );
-       }
+}
 
 
-#ifdef YY_USE_PROTOS
-static void *yy_flex_realloc( void *ptr, yy_size_t size )
-#else
-static void *yy_flex_realloc( ptr, size )
-void *ptr;
-yy_size_t size;
-#endif
-       {
+void *yyrealloc  (void * ptr, yy_size_t  size )
+{
        /* The cast to (char *) in the following accommodates both
         * implementations that use char* generic pointers, and those
         * that use void* generic pointers.  It works with the latter
        /* The cast to (char *) in the following accommodates both
         * implementations that use char* generic pointers, and those
         * that use void* generic pointers.  It works with the latter
@@ -2454,28 +2652,19 @@ yy_size_t size;
         * as though doing an assignment.
         */
        return (void *) realloc( (char *) ptr, size );
         * as though doing an assignment.
         */
        return (void *) realloc( (char *) ptr, size );
-       }
+}
 
 
-#ifdef YY_USE_PROTOS
-static void yy_flex_free( void *ptr )
-#else
-static void yy_flex_free( ptr )
-void *ptr;
-#endif
-       {
-       free( ptr );
-       }
+void yyfree (void * ptr )
+{
+       free( (char *) ptr );   /* see yyrealloc() for (char *) cast */
+}
+
+#define YYTABLES_NAME "yytables"
 
 
-#if YY_MAIN
-int main()
-       {
-       yylex();
-       return 0;
-       }
-#endif
 #line 274 "lex.l"
 
 
 #line 274 "lex.l"
 
 
+
 #ifndef yywrap /* XXX */
 int
 yywrap () 
 #ifndef yywrap /* XXX */
 int
 yywrap () 
@@ -2501,3 +2690,4 @@ unterminated(const char *type, unsigned start_lineno)
 {
     error_message("unterminated %s, possibly started on line %d\n", type, start_lineno);
 }
 {
     error_message("unterminated %s, possibly started on line %d\n", type, start_lineno);
 }
+
index 2d9e6745c5a611b9f21d24e2e697dc999d0adc5a..7aececf6d7a02cfbe0db41a48d4977b3e5113048 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: lex.h,v 1.6 2005/07/12 06:27:33 lha Exp $ */
+/* $Id: lex.h 15617 2005-07-12 06:27:42Z lha $ */
 
 #include <roken.h>
 
 
 #include <roken.h>
 
index 8ccde9a36a96f619b9d2fc9380ed1723d577752d..64f554f2c89b89aed3eb5f8c565301de0f6ff4a8 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: libasn1.h,v 1.11 2005/07/12 06:27:34 lha Exp $ */
+/* $Id: libasn1.h 15617 2005-07-12 06:27:42Z lha $ */
 
 #ifndef __LIBASN1_H__
 #define __LIBASN1_H__
 
 #ifndef __LIBASN1_H__
 #define __LIBASN1_H__
index bba79b1e4e2f4c3ff3aa5b75be5cba532636debe..3b4a8122cadab684784b0d1c0d6a6dc40a74ef68 100644 (file)
@@ -35,7 +35,7 @@
 #include <getarg.h>
 #include "lex.h"
 
 #include <getarg.h>
 #include "lex.h"
 
-RCSID("$Id: main.c,v 1.16 2006/09/05 12:27:29 lha Exp $");
+RCSID("$Id: main.c 20858 2007-06-03 18:56:41Z lha $");
 
 extern FILE *yyin;
 
 
 extern FILE *yyin;
 
@@ -127,5 +127,7 @@ main(int argc, char **argv)
     if(ret != 0 || error_flag != 0)
        exit(1);
     close_generate ();
     if(ret != 0 || error_flag != 0)
        exit(1);
     close_generate ();
+    if (argc != optidx)
+       fclose(yyin);
     return 0;
 }
     return 0;
 }
index affe4f2a9c685ec7d8e182b9d745459143c317c1..31361c749232454575141110d62f98636eff590f 100644 (file)
 
 
 /* Copy the first part of user declarations.  */
 
 
 /* Copy the first part of user declarations.  */
-#line 36 "heimdal/lib/asn1/parse.y"
+#line 36 "parse.y"
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #include "gen_locl.h"
 #include "der.h"
 
 #include "gen_locl.h"
 #include "der.h"
 
-RCSID("$Id: parse.y,v 1.29 2006/12/28 17:15:02 lha Exp $");
+RCSID("$Id: parse.y 19539 2006-12-28 17:15:05Z lha $");
 
 static Type *new_type (Typetype t);
 static struct constraint_spec *new_constraint_spec(enum ctype);
 
 static Type *new_type (Typetype t);
 static struct constraint_spec *new_constraint_spec(enum ctype);
@@ -280,7 +280,7 @@ struct string_list {
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
-# define YYDEBUG 0
+# define YYDEBUG 1
 #endif
 
 /* Enabling verbose error messages.  */
 #endif
 
 /* Enabling verbose error messages.  */
@@ -298,7 +298,7 @@ struct string_list {
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 65 "heimdal/lib/asn1/parse.y"
+#line 65 "parse.y"
 {
     int constant;
     struct value *value;
 {
     int constant;
     struct value *value;
@@ -314,7 +314,7 @@ typedef union YYSTYPE
     struct constraint_spec *constraint_spec;
 }
 /* Line 187 of yacc.c.  */
     struct constraint_spec *constraint_spec;
 }
 /* Line 187 of yacc.c.  */
-#line 318 "heimdal/lib/asn1/parse.y"
+#line 318 "parse.c"
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
@@ -327,7 +327,7 @@ typedef union YYSTYPE
 
 
 /* Line 216 of yacc.c.  */
 
 
 /* Line 216 of yacc.c.  */
-#line 331 "heimdal/lib/asn1/parse.y"
+#line 331 "parse.c"
 
 #ifdef short
 # undef short
 
 #ifdef short
 # undef short
@@ -1750,29 +1750,29 @@ yyreduce:
   switch (yyn)
     {
         case 2:
   switch (yyn)
     {
         case 2:
-#line 233 "heimdal/lib/asn1/parse.y"
+#line 233 "parse.y"
     {
                        checkundefined();
                }
     break;
 
   case 4:
     {
                        checkundefined();
                }
     break;
 
   case 4:
-#line 240 "heimdal/lib/asn1/parse.y"
+#line 240 "parse.y"
     { error_message("implicit tagging is not supported"); }
     break;
 
   case 5:
     { error_message("implicit tagging is not supported"); }
     break;
 
   case 5:
-#line 242 "heimdal/lib/asn1/parse.y"
+#line 242 "parse.y"
     { error_message("automatic tagging is not supported"); }
     break;
 
   case 7:
     { error_message("automatic tagging is not supported"); }
     break;
 
   case 7:
-#line 247 "heimdal/lib/asn1/parse.y"
+#line 247 "parse.y"
     { error_message("no extensibility options supported"); }
     break;
 
   case 17:
     { error_message("no extensibility options supported"); }
     break;
 
   case 17:
-#line 268 "heimdal/lib/asn1/parse.y"
+#line 268 "parse.y"
     { 
                    struct string_list *sl;
                    for(sl = (yyvsp[(1) - (4)].sl); sl != NULL; sl = sl->next) {
     { 
                    struct string_list *sl;
                    for(sl = (yyvsp[(1) - (4)].sl); sl != NULL; sl = sl->next) {
@@ -1784,7 +1784,7 @@ yyreduce:
     break;
 
   case 22:
     break;
 
   case 22:
-#line 287 "heimdal/lib/asn1/parse.y"
+#line 287 "parse.y"
     {
                    (yyval.sl) = emalloc(sizeof(*(yyval.sl)));
                    (yyval.sl)->string = (yyvsp[(1) - (3)].name);
     {
                    (yyval.sl) = emalloc(sizeof(*(yyval.sl)));
                    (yyval.sl)->string = (yyvsp[(1) - (3)].name);
@@ -1793,7 +1793,7 @@ yyreduce:
     break;
 
   case 23:
     break;
 
   case 23:
-#line 293 "heimdal/lib/asn1/parse.y"
+#line 293 "parse.y"
     {
                    (yyval.sl) = emalloc(sizeof(*(yyval.sl)));
                    (yyval.sl)->string = (yyvsp[(1) - (1)].name);
     {
                    (yyval.sl) = emalloc(sizeof(*(yyval.sl)));
                    (yyval.sl)->string = (yyvsp[(1) - (1)].name);
@@ -1802,7 +1802,7 @@ yyreduce:
     break;
 
   case 24:
     break;
 
   case 24:
-#line 301 "heimdal/lib/asn1/parse.y"
+#line 301 "parse.y"
     {
                    Symbol *s = addsym ((yyvsp[(1) - (3)].name));
                    s->stype = Stype;
     {
                    Symbol *s = addsym ((yyvsp[(1) - (3)].name));
                    s->stype = Stype;
@@ -1813,7 +1813,7 @@ yyreduce:
     break;
 
   case 42:
     break;
 
   case 42:
-#line 332 "heimdal/lib/asn1/parse.y"
+#line 332 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_Boolean, 
                                     TE_EXPLICIT, new_type(TBoolean));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_Boolean, 
                                     TE_EXPLICIT, new_type(TBoolean));
@@ -1821,7 +1821,7 @@ yyreduce:
     break;
 
   case 43:
     break;
 
   case 43:
-#line 339 "heimdal/lib/asn1/parse.y"
+#line 339 "parse.y"
     {
                        if((yyvsp[(2) - (5)].value)->type != integervalue || 
                           (yyvsp[(4) - (5)].value)->type != integervalue)
     {
                        if((yyvsp[(2) - (5)].value)->type != integervalue || 
                           (yyvsp[(4) - (5)].value)->type != integervalue)
@@ -1832,7 +1832,7 @@ yyreduce:
     break;
 
   case 44:
     break;
 
   case 44:
-#line 349 "heimdal/lib/asn1/parse.y"
+#line 349 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_Integer, 
                                     TE_EXPLICIT, new_type(TInteger));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_Integer, 
                                     TE_EXPLICIT, new_type(TInteger));
@@ -1840,7 +1840,7 @@ yyreduce:
     break;
 
   case 45:
     break;
 
   case 45:
-#line 354 "heimdal/lib/asn1/parse.y"
+#line 354 "parse.y"
     {
                        (yyval.type) = new_type(TInteger);
                        (yyval.type)->range = emalloc(sizeof(*(yyval.type)->range));
     {
                        (yyval.type) = new_type(TInteger);
                        (yyval.type)->range = emalloc(sizeof(*(yyval.type)->range));
@@ -1850,7 +1850,7 @@ yyreduce:
     break;
 
   case 46:
     break;
 
   case 46:
-#line 361 "heimdal/lib/asn1/parse.y"
+#line 361 "parse.y"
     {
                  (yyval.type) = new_type(TInteger);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
     {
                  (yyval.type) = new_type(TInteger);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
@@ -1859,7 +1859,7 @@ yyreduce:
     break;
 
   case 47:
     break;
 
   case 47:
-#line 369 "heimdal/lib/asn1/parse.y"
+#line 369 "parse.y"
     {
                        (yyval.members) = emalloc(sizeof(*(yyval.members)));
                        ASN1_TAILQ_INIT((yyval.members));
     {
                        (yyval.members) = emalloc(sizeof(*(yyval.members)));
                        ASN1_TAILQ_INIT((yyval.members));
@@ -1868,7 +1868,7 @@ yyreduce:
     break;
 
   case 48:
     break;
 
   case 48:
-#line 375 "heimdal/lib/asn1/parse.y"
+#line 375 "parse.y"
     {
                        ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members);
                        (yyval.members) = (yyvsp[(1) - (3)].members);
     {
                        ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members);
                        (yyval.members) = (yyvsp[(1) - (3)].members);
@@ -1876,12 +1876,12 @@ yyreduce:
     break;
 
   case 49:
     break;
 
   case 49:
-#line 380 "heimdal/lib/asn1/parse.y"
+#line 380 "parse.y"
     { (yyval.members) = (yyvsp[(1) - (3)].members); }
     break;
 
   case 50:
     { (yyval.members) = (yyvsp[(1) - (3)].members); }
     break;
 
   case 50:
-#line 384 "heimdal/lib/asn1/parse.y"
+#line 384 "parse.y"
     {
                        (yyval.member) = emalloc(sizeof(*(yyval.member)));
                        (yyval.member)->name = (yyvsp[(1) - (4)].name);
     {
                        (yyval.member) = emalloc(sizeof(*(yyval.member)));
                        (yyval.member)->name = (yyvsp[(1) - (4)].name);
@@ -1895,7 +1895,7 @@ yyreduce:
     break;
 
   case 51:
     break;
 
   case 51:
-#line 397 "heimdal/lib/asn1/parse.y"
+#line 397 "parse.y"
     {
                  (yyval.type) = new_type(TInteger);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
     {
                  (yyval.type) = new_type(TInteger);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
@@ -1904,7 +1904,7 @@ yyreduce:
     break;
 
   case 53:
     break;
 
   case 53:
-#line 408 "heimdal/lib/asn1/parse.y"
+#line 408 "parse.y"
     {
                  (yyval.type) = new_type(TBitString);
                  (yyval.type)->members = emalloc(sizeof(*(yyval.type)->members));
     {
                  (yyval.type) = new_type(TBitString);
                  (yyval.type)->members = emalloc(sizeof(*(yyval.type)->members));
@@ -1914,7 +1914,7 @@ yyreduce:
     break;
 
   case 54:
     break;
 
   case 54:
-#line 415 "heimdal/lib/asn1/parse.y"
+#line 415 "parse.y"
     {
                  (yyval.type) = new_type(TBitString);
                  (yyval.type)->members = (yyvsp[(4) - (5)].members);
     {
                  (yyval.type) = new_type(TBitString);
                  (yyval.type)->members = (yyvsp[(4) - (5)].members);
@@ -1923,7 +1923,7 @@ yyreduce:
     break;
 
   case 55:
     break;
 
   case 55:
-#line 423 "heimdal/lib/asn1/parse.y"
+#line 423 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_OID, 
                                     TE_EXPLICIT, new_type(TOID));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_OID, 
                                     TE_EXPLICIT, new_type(TOID));
@@ -1931,7 +1931,7 @@ yyreduce:
     break;
 
   case 56:
     break;
 
   case 56:
-#line 429 "heimdal/lib/asn1/parse.y"
+#line 429 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_OctetString, 
                                     TE_EXPLICIT, new_type(TOctetString));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_OctetString, 
                                     TE_EXPLICIT, new_type(TOctetString));
@@ -1939,7 +1939,7 @@ yyreduce:
     break;
 
   case 57:
     break;
 
   case 57:
-#line 436 "heimdal/lib/asn1/parse.y"
+#line 436 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_Null, 
                                     TE_EXPLICIT, new_type(TNull));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_Null, 
                                     TE_EXPLICIT, new_type(TNull));
@@ -1947,7 +1947,7 @@ yyreduce:
     break;
 
   case 58:
     break;
 
   case 58:
-#line 443 "heimdal/lib/asn1/parse.y"
+#line 443 "parse.y"
     {
                  (yyval.type) = new_type(TSequence);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
     {
                  (yyval.type) = new_type(TSequence);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
@@ -1956,7 +1956,7 @@ yyreduce:
     break;
 
   case 59:
     break;
 
   case 59:
-#line 449 "heimdal/lib/asn1/parse.y"
+#line 449 "parse.y"
     {
                  (yyval.type) = new_type(TSequence);
                  (yyval.type)->members = NULL;
     {
                  (yyval.type) = new_type(TSequence);
                  (yyval.type)->members = NULL;
@@ -1965,7 +1965,7 @@ yyreduce:
     break;
 
   case 60:
     break;
 
   case 60:
-#line 457 "heimdal/lib/asn1/parse.y"
+#line 457 "parse.y"
     {
                  (yyval.type) = new_type(TSequenceOf);
                  (yyval.type)->subtype = (yyvsp[(3) - (3)].type);
     {
                  (yyval.type) = new_type(TSequenceOf);
                  (yyval.type)->subtype = (yyvsp[(3) - (3)].type);
@@ -1974,7 +1974,7 @@ yyreduce:
     break;
 
   case 61:
     break;
 
   case 61:
-#line 465 "heimdal/lib/asn1/parse.y"
+#line 465 "parse.y"
     {
                  (yyval.type) = new_type(TSet);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
     {
                  (yyval.type) = new_type(TSet);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
@@ -1983,7 +1983,7 @@ yyreduce:
     break;
 
   case 62:
     break;
 
   case 62:
-#line 471 "heimdal/lib/asn1/parse.y"
+#line 471 "parse.y"
     {
                  (yyval.type) = new_type(TSet);
                  (yyval.type)->members = NULL;
     {
                  (yyval.type) = new_type(TSet);
                  (yyval.type)->members = NULL;
@@ -1992,7 +1992,7 @@ yyreduce:
     break;
 
   case 63:
     break;
 
   case 63:
-#line 479 "heimdal/lib/asn1/parse.y"
+#line 479 "parse.y"
     {
                  (yyval.type) = new_type(TSetOf);
                  (yyval.type)->subtype = (yyvsp[(3) - (3)].type);
     {
                  (yyval.type) = new_type(TSetOf);
                  (yyval.type)->subtype = (yyvsp[(3) - (3)].type);
@@ -2001,7 +2001,7 @@ yyreduce:
     break;
 
   case 64:
     break;
 
   case 64:
-#line 487 "heimdal/lib/asn1/parse.y"
+#line 487 "parse.y"
     {
                  (yyval.type) = new_type(TChoice);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
     {
                  (yyval.type) = new_type(TChoice);
                  (yyval.type)->members = (yyvsp[(3) - (4)].members);
@@ -2009,7 +2009,7 @@ yyreduce:
     break;
 
   case 67:
     break;
 
   case 67:
-#line 498 "heimdal/lib/asn1/parse.y"
+#line 498 "parse.y"
     {
                  Symbol *s = addsym((yyvsp[(1) - (1)].name));
                  (yyval.type) = new_type(TType);
     {
                  Symbol *s = addsym((yyvsp[(1) - (1)].name));
                  (yyval.type) = new_type(TType);
@@ -2021,7 +2021,7 @@ yyreduce:
     break;
 
   case 68:
     break;
 
   case 68:
-#line 509 "heimdal/lib/asn1/parse.y"
+#line 509 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralizedTime, 
                                     TE_EXPLICIT, new_type(TGeneralizedTime));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralizedTime, 
                                     TE_EXPLICIT, new_type(TGeneralizedTime));
@@ -2029,7 +2029,7 @@ yyreduce:
     break;
 
   case 69:
     break;
 
   case 69:
-#line 514 "heimdal/lib/asn1/parse.y"
+#line 514 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTCTime, 
                                     TE_EXPLICIT, new_type(TUTCTime));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTCTime, 
                                     TE_EXPLICIT, new_type(TUTCTime));
@@ -2037,7 +2037,7 @@ yyreduce:
     break;
 
   case 70:
     break;
 
   case 70:
-#line 521 "heimdal/lib/asn1/parse.y"
+#line 521 "parse.y"
     {
                    /* if (Constraint.type == contentConstrant) {
                       assert(Constraint.u.constraint.type == octetstring|bitstring-w/o-NamedBitList); // remember to check type reference too
     {
                    /* if (Constraint.type == contentConstrant) {
                       assert(Constraint.u.constraint.type == octetstring|bitstring-w/o-NamedBitList); // remember to check type reference too
@@ -2053,14 +2053,14 @@ yyreduce:
     break;
 
   case 71:
     break;
 
   case 71:
-#line 537 "heimdal/lib/asn1/parse.y"
+#line 537 "parse.y"
     {
                    (yyval.constraint_spec) = (yyvsp[(2) - (3)].constraint_spec);
                }
     break;
 
   case 75:
     {
                    (yyval.constraint_spec) = (yyvsp[(2) - (3)].constraint_spec);
                }
     break;
 
   case 75:
-#line 550 "heimdal/lib/asn1/parse.y"
+#line 550 "parse.y"
     {
                    (yyval.constraint_spec) = new_constraint_spec(CT_CONTENTS);
                    (yyval.constraint_spec)->u.content.type = (yyvsp[(2) - (2)].type);
     {
                    (yyval.constraint_spec) = new_constraint_spec(CT_CONTENTS);
                    (yyval.constraint_spec)->u.content.type = (yyvsp[(2) - (2)].type);
@@ -2069,7 +2069,7 @@ yyreduce:
     break;
 
   case 76:
     break;
 
   case 76:
-#line 556 "heimdal/lib/asn1/parse.y"
+#line 556 "parse.y"
     {
                    if ((yyvsp[(3) - (3)].value)->type != objectidentifiervalue)
                        error_message("Non-OID used in ENCODED BY constraint");
     {
                    if ((yyvsp[(3) - (3)].value)->type != objectidentifiervalue)
                        error_message("Non-OID used in ENCODED BY constraint");
@@ -2080,7 +2080,7 @@ yyreduce:
     break;
 
   case 77:
     break;
 
   case 77:
-#line 564 "heimdal/lib/asn1/parse.y"
+#line 564 "parse.y"
     {
                    if ((yyvsp[(5) - (5)].value)->type != objectidentifiervalue)
                        error_message("Non-OID used in ENCODED BY constraint");
     {
                    if ((yyvsp[(5) - (5)].value)->type != objectidentifiervalue)
                        error_message("Non-OID used in ENCODED BY constraint");
@@ -2091,14 +2091,14 @@ yyreduce:
     break;
 
   case 78:
     break;
 
   case 78:
-#line 574 "heimdal/lib/asn1/parse.y"
+#line 574 "parse.y"
     {
                    (yyval.constraint_spec) = new_constraint_spec(CT_USER);
                }
     break;
 
   case 79:
     {
                    (yyval.constraint_spec) = new_constraint_spec(CT_USER);
                }
     break;
 
   case 79:
-#line 580 "heimdal/lib/asn1/parse.y"
+#line 580 "parse.y"
     {
                        (yyval.type) = new_type(TTag);
                        (yyval.type)->tag = (yyvsp[(1) - (3)].tag);
     {
                        (yyval.type) = new_type(TTag);
                        (yyval.type)->tag = (yyvsp[(1) - (3)].tag);
@@ -2112,7 +2112,7 @@ yyreduce:
     break;
 
   case 80:
     break;
 
   case 80:
-#line 593 "heimdal/lib/asn1/parse.y"
+#line 593 "parse.y"
     {
                        (yyval.tag).tagclass = (yyvsp[(2) - (4)].constant);
                        (yyval.tag).tagvalue = (yyvsp[(3) - (4)].constant);
     {
                        (yyval.tag).tagclass = (yyvsp[(2) - (4)].constant);
                        (yyval.tag).tagvalue = (yyvsp[(3) - (4)].constant);
@@ -2121,56 +2121,56 @@ yyreduce:
     break;
 
   case 81:
     break;
 
   case 81:
-#line 601 "heimdal/lib/asn1/parse.y"
+#line 601 "parse.y"
     {
                        (yyval.constant) = ASN1_C_CONTEXT;
                }
     break;
 
   case 82:
     {
                        (yyval.constant) = ASN1_C_CONTEXT;
                }
     break;
 
   case 82:
-#line 605 "heimdal/lib/asn1/parse.y"
+#line 605 "parse.y"
     {
                        (yyval.constant) = ASN1_C_UNIV;
                }
     break;
 
   case 83:
     {
                        (yyval.constant) = ASN1_C_UNIV;
                }
     break;
 
   case 83:
-#line 609 "heimdal/lib/asn1/parse.y"
+#line 609 "parse.y"
     {
                        (yyval.constant) = ASN1_C_APPL;
                }
     break;
 
   case 84:
     {
                        (yyval.constant) = ASN1_C_APPL;
                }
     break;
 
   case 84:
-#line 613 "heimdal/lib/asn1/parse.y"
+#line 613 "parse.y"
     {
                        (yyval.constant) = ASN1_C_PRIVATE;
                }
     break;
 
   case 85:
     {
                        (yyval.constant) = ASN1_C_PRIVATE;
                }
     break;
 
   case 85:
-#line 619 "heimdal/lib/asn1/parse.y"
+#line 619 "parse.y"
     {
                        (yyval.constant) = TE_EXPLICIT;
                }
     break;
 
   case 86:
     {
                        (yyval.constant) = TE_EXPLICIT;
                }
     break;
 
   case 86:
-#line 623 "heimdal/lib/asn1/parse.y"
+#line 623 "parse.y"
     {
                        (yyval.constant) = TE_EXPLICIT;
                }
     break;
 
   case 87:
     {
                        (yyval.constant) = TE_EXPLICIT;
                }
     break;
 
   case 87:
-#line 627 "heimdal/lib/asn1/parse.y"
+#line 627 "parse.y"
     {
                        (yyval.constant) = TE_IMPLICIT;
                }
     break;
 
   case 88:
     {
                        (yyval.constant) = TE_IMPLICIT;
                }
     break;
 
   case 88:
-#line 634 "heimdal/lib/asn1/parse.y"
+#line 634 "parse.y"
     {
                        Symbol *s;
                        s = addsym ((yyvsp[(1) - (4)].name));
     {
                        Symbol *s;
                        s = addsym ((yyvsp[(1) - (4)].name));
@@ -2182,7 +2182,7 @@ yyreduce:
     break;
 
   case 90:
     break;
 
   case 90:
-#line 648 "heimdal/lib/asn1/parse.y"
+#line 648 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralString, 
                                     TE_EXPLICIT, new_type(TGeneralString));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralString, 
                                     TE_EXPLICIT, new_type(TGeneralString));
@@ -2190,7 +2190,7 @@ yyreduce:
     break;
 
   case 91:
     break;
 
   case 91:
-#line 653 "heimdal/lib/asn1/parse.y"
+#line 653 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTF8String, 
                                     TE_EXPLICIT, new_type(TUTF8String));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTF8String, 
                                     TE_EXPLICIT, new_type(TUTF8String));
@@ -2198,7 +2198,7 @@ yyreduce:
     break;
 
   case 92:
     break;
 
   case 92:
-#line 658 "heimdal/lib/asn1/parse.y"
+#line 658 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_PrintableString, 
                                     TE_EXPLICIT, new_type(TPrintableString));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_PrintableString, 
                                     TE_EXPLICIT, new_type(TPrintableString));
@@ -2206,7 +2206,7 @@ yyreduce:
     break;
 
   case 93:
     break;
 
   case 93:
-#line 663 "heimdal/lib/asn1/parse.y"
+#line 663 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_VisibleString, 
                                     TE_EXPLICIT, new_type(TVisibleString));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_VisibleString, 
                                     TE_EXPLICIT, new_type(TVisibleString));
@@ -2214,7 +2214,7 @@ yyreduce:
     break;
 
   case 94:
     break;
 
   case 94:
-#line 668 "heimdal/lib/asn1/parse.y"
+#line 668 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_IA5String, 
                                     TE_EXPLICIT, new_type(TIA5String));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_IA5String, 
                                     TE_EXPLICIT, new_type(TIA5String));
@@ -2222,7 +2222,7 @@ yyreduce:
     break;
 
   case 95:
     break;
 
   case 95:
-#line 673 "heimdal/lib/asn1/parse.y"
+#line 673 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_BMPString, 
                                     TE_EXPLICIT, new_type(TBMPString));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_BMPString, 
                                     TE_EXPLICIT, new_type(TBMPString));
@@ -2230,7 +2230,7 @@ yyreduce:
     break;
 
   case 96:
     break;
 
   case 96:
-#line 678 "heimdal/lib/asn1/parse.y"
+#line 678 "parse.y"
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_UniversalString, 
                                     TE_EXPLICIT, new_type(TUniversalString));
     {
                        (yyval.type) = new_tag(ASN1_C_UNIV, UT_UniversalString, 
                                     TE_EXPLICIT, new_type(TUniversalString));
@@ -2238,7 +2238,7 @@ yyreduce:
     break;
 
   case 97:
     break;
 
   case 97:
-#line 686 "heimdal/lib/asn1/parse.y"
+#line 686 "parse.y"
     {
                        (yyval.members) = emalloc(sizeof(*(yyval.members)));
                        ASN1_TAILQ_INIT((yyval.members));
     {
                        (yyval.members) = emalloc(sizeof(*(yyval.members)));
                        ASN1_TAILQ_INIT((yyval.members));
@@ -2247,7 +2247,7 @@ yyreduce:
     break;
 
   case 98:
     break;
 
   case 98:
-#line 692 "heimdal/lib/asn1/parse.y"
+#line 692 "parse.y"
     {
                        ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members);
                        (yyval.members) = (yyvsp[(1) - (3)].members);
     {
                        ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members);
                        (yyval.members) = (yyvsp[(1) - (3)].members);
@@ -2255,7 +2255,7 @@ yyreduce:
     break;
 
   case 99:
     break;
 
   case 99:
-#line 697 "heimdal/lib/asn1/parse.y"
+#line 697 "parse.y"
     {
                        struct member *m = ecalloc(1, sizeof(*m));
                        m->name = estrdup("...");
     {
                        struct member *m = ecalloc(1, sizeof(*m));
                        m->name = estrdup("...");
@@ -2267,7 +2267,7 @@ yyreduce:
     break;
 
   case 100:
     break;
 
   case 100:
-#line 708 "heimdal/lib/asn1/parse.y"
+#line 708 "parse.y"
     {
                  (yyval.member) = emalloc(sizeof(*(yyval.member)));
                  (yyval.member)->name = (yyvsp[(1) - (2)].name);
     {
                  (yyval.member) = emalloc(sizeof(*(yyval.member)));
                  (yyval.member)->name = (yyvsp[(1) - (2)].name);
@@ -2279,7 +2279,7 @@ yyreduce:
     break;
 
   case 101:
     break;
 
   case 101:
-#line 719 "heimdal/lib/asn1/parse.y"
+#line 719 "parse.y"
     {
                        (yyval.member) = (yyvsp[(1) - (1)].member);
                        (yyval.member)->optional = 0;
     {
                        (yyval.member) = (yyvsp[(1) - (1)].member);
                        (yyval.member)->optional = 0;
@@ -2288,7 +2288,7 @@ yyreduce:
     break;
 
   case 102:
     break;
 
   case 102:
-#line 725 "heimdal/lib/asn1/parse.y"
+#line 725 "parse.y"
     {
                        (yyval.member) = (yyvsp[(1) - (2)].member);
                        (yyval.member)->optional = 1;
     {
                        (yyval.member) = (yyvsp[(1) - (2)].member);
                        (yyval.member)->optional = 1;
@@ -2297,7 +2297,7 @@ yyreduce:
     break;
 
   case 103:
     break;
 
   case 103:
-#line 731 "heimdal/lib/asn1/parse.y"
+#line 731 "parse.y"
     {
                        (yyval.member) = (yyvsp[(1) - (3)].member);
                        (yyval.member)->optional = 0;
     {
                        (yyval.member) = (yyvsp[(1) - (3)].member);
                        (yyval.member)->optional = 0;
@@ -2306,7 +2306,7 @@ yyreduce:
     break;
 
   case 104:
     break;
 
   case 104:
-#line 739 "heimdal/lib/asn1/parse.y"
+#line 739 "parse.y"
     {
                        (yyval.members) = emalloc(sizeof(*(yyval.members)));
                        ASN1_TAILQ_INIT((yyval.members));
     {
                        (yyval.members) = emalloc(sizeof(*(yyval.members)));
                        ASN1_TAILQ_INIT((yyval.members));
@@ -2315,7 +2315,7 @@ yyreduce:
     break;
 
   case 105:
     break;
 
   case 105:
-#line 745 "heimdal/lib/asn1/parse.y"
+#line 745 "parse.y"
     {
                        ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members);
                        (yyval.members) = (yyvsp[(1) - (3)].members);
     {
                        ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members);
                        (yyval.members) = (yyvsp[(1) - (3)].members);
@@ -2323,7 +2323,7 @@ yyreduce:
     break;
 
   case 106:
     break;
 
   case 106:
-#line 752 "heimdal/lib/asn1/parse.y"
+#line 752 "parse.y"
     {
                  (yyval.member) = emalloc(sizeof(*(yyval.member)));
                  (yyval.member)->name = (yyvsp[(1) - (4)].name);
     {
                  (yyval.member) = emalloc(sizeof(*(yyval.member)));
                  (yyval.member)->name = (yyvsp[(1) - (4)].name);
@@ -2337,26 +2337,26 @@ yyreduce:
     break;
 
   case 108:
     break;
 
   case 108:
-#line 765 "heimdal/lib/asn1/parse.y"
+#line 765 "parse.y"
     { (yyval.objid) = NULL; }
     break;
 
   case 109:
     { (yyval.objid) = NULL; }
     break;
 
   case 109:
-#line 769 "heimdal/lib/asn1/parse.y"
+#line 769 "parse.y"
     {
                        (yyval.objid) = (yyvsp[(2) - (3)].objid);
                }
     break;
 
   case 110:
     {
                        (yyval.objid) = (yyvsp[(2) - (3)].objid);
                }
     break;
 
   case 110:
-#line 775 "heimdal/lib/asn1/parse.y"
+#line 775 "parse.y"
     {
                        (yyval.objid) = NULL;
                }
     break;
 
   case 111:
     {
                        (yyval.objid) = NULL;
                }
     break;
 
   case 111:
-#line 779 "heimdal/lib/asn1/parse.y"
+#line 779 "parse.y"
     {
                        if ((yyvsp[(2) - (2)].objid)) {
                                (yyval.objid) = (yyvsp[(2) - (2)].objid);
     {
                        if ((yyvsp[(2) - (2)].objid)) {
                                (yyval.objid) = (yyvsp[(2) - (2)].objid);
@@ -2368,14 +2368,14 @@ yyreduce:
     break;
 
   case 112:
     break;
 
   case 112:
-#line 790 "heimdal/lib/asn1/parse.y"
+#line 790 "parse.y"
     {
                        (yyval.objid) = new_objid((yyvsp[(1) - (4)].name), (yyvsp[(3) - (4)].constant));
                }
     break;
 
   case 113:
     {
                        (yyval.objid) = new_objid((yyvsp[(1) - (4)].name), (yyvsp[(3) - (4)].constant));
                }
     break;
 
   case 113:
-#line 794 "heimdal/lib/asn1/parse.y"
+#line 794 "parse.y"
     {
                    Symbol *s = addsym((yyvsp[(1) - (1)].name));
                    if(s->stype != SValue ||
     {
                    Symbol *s = addsym((yyvsp[(1) - (1)].name));
                    if(s->stype != SValue ||
@@ -2389,14 +2389,14 @@ yyreduce:
     break;
 
   case 114:
     break;
 
   case 114:
-#line 805 "heimdal/lib/asn1/parse.y"
+#line 805 "parse.y"
     {
                    (yyval.objid) = new_objid(NULL, (yyvsp[(1) - (1)].constant));
                }
     break;
 
   case 124:
     {
                    (yyval.objid) = new_objid(NULL, (yyvsp[(1) - (1)].constant));
                }
     break;
 
   case 124:
-#line 828 "heimdal/lib/asn1/parse.y"
+#line 828 "parse.y"
     {
                        Symbol *s = addsym((yyvsp[(1) - (1)].name));
                        if(s->stype != SValue)
     {
                        Symbol *s = addsym((yyvsp[(1) - (1)].name));
                        if(s->stype != SValue)
@@ -2408,7 +2408,7 @@ yyreduce:
     break;
 
   case 125:
     break;
 
   case 125:
-#line 839 "heimdal/lib/asn1/parse.y"
+#line 839 "parse.y"
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = stringvalue;
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = stringvalue;
@@ -2417,7 +2417,7 @@ yyreduce:
     break;
 
   case 126:
     break;
 
   case 126:
-#line 847 "heimdal/lib/asn1/parse.y"
+#line 847 "parse.y"
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = booleanvalue;
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = booleanvalue;
@@ -2426,7 +2426,7 @@ yyreduce:
     break;
 
   case 127:
     break;
 
   case 127:
-#line 853 "heimdal/lib/asn1/parse.y"
+#line 853 "parse.y"
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = booleanvalue;
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = booleanvalue;
@@ -2435,7 +2435,7 @@ yyreduce:
     break;
 
   case 128:
     break;
 
   case 128:
-#line 861 "heimdal/lib/asn1/parse.y"
+#line 861 "parse.y"
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = integervalue;
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = integervalue;
@@ -2444,13 +2444,13 @@ yyreduce:
     break;
 
   case 130:
     break;
 
   case 130:
-#line 872 "heimdal/lib/asn1/parse.y"
+#line 872 "parse.y"
     {
                }
     break;
 
   case 131:
     {
                }
     break;
 
   case 131:
-#line 877 "heimdal/lib/asn1/parse.y"
+#line 877 "parse.y"
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = objectidentifiervalue;
     {
                        (yyval.value) = emalloc(sizeof(*(yyval.value)));
                        (yyval.value)->type = objectidentifiervalue;
@@ -2460,7 +2460,7 @@ yyreduce:
 
 
 /* Line 1267 of yacc.c.  */
 
 
 /* Line 1267 of yacc.c.  */
-#line 2464 "heimdal/lib/asn1/parse.y"
+#line 2464 "parse.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -2674,7 +2674,7 @@ yyreturn:
 }
 
 
 }
 
 
-#line 884 "heimdal/lib/asn1/parse.y"
+#line 884 "parse.y"
 
 
 void
 
 
 void
index 868bb2543a13329e9b2dd23006fafa86c2f10d04..a2a9a3a335278a9dda9d879174cb75113cb32c76 100644 (file)
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 65 "heimdal/lib/asn1/parse.y"
+#line 65 "parse.y"
 {
     int constant;
     struct value *value;
 {
     int constant;
     struct value *value;
@@ -238,7 +238,7 @@ typedef union YYSTYPE
     struct constraint_spec *constraint_spec;
 }
 /* Line 1489 of yacc.c.  */
     struct constraint_spec *constraint_spec;
 }
 /* Line 1489 of yacc.c.  */
-#line 242 "heimdal/lib/asn1/parse.y"
+#line 242 "parse.h"
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
index ff512e8255189e8dd6881f34689b0778d26843ba..37fe03e58e8a13d8cb5656d7ccbc361096ec73ff 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: pkcs12.asn1,v 1.3 2005/07/23 11:07:39 lha Exp $ --
+-- $Id: pkcs12.asn1 15715 2005-07-23 11:08:47Z lha $ --
 
 PKCS12 DEFINITIONS ::=
 
 
 PKCS12 DEFINITIONS ::=
 
index dc52511bf4aa21fb2748ed94dff30671a634c5c0..911e727c708583f3283b401d74af42d94e93266e 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: pkcs8.asn1,v 1.3 2005/09/13 19:41:29 lha Exp $ --
+-- $Id: pkcs8.asn1 16060 2005-09-13 19:41:29Z lha $ --
 
 PKCS8 DEFINITIONS ::=
 
 
 PKCS8 DEFINITIONS ::=
 
index e6df32f65d2ec3cd3f38e2759956422459a83d0f..d985e91f3c03ae02ad59e00f5d379cbab619b4af 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: pkcs9.asn1,v 1.5 2006/04/24 08:59:10 lha Exp $ --
+-- $Id: pkcs9.asn1 17202 2006-04-24 08:59:10Z lha $ --
 
 PKCS9 DEFINITIONS ::=
 
 
 PKCS9 DEFINITIONS ::=
 
index 56d661167770d682e0a73973b06b372e6f183d51..e89a7217af5f9737726b5dfd3237c317e6bac5a2 100644 (file)
@@ -21,9 +21,15 @@ id-pkinit-san        OBJECT IDENTIFIER ::=
   { iso(1) org(3) dod(6) internet(1) security(5) kerberosv5(2)
     x509-sanan(2) }
 
   { iso(1) org(3) dod(6) internet(1) security(5) kerberosv5(2)
     x509-sanan(2) }
 
+id-pkinit-ms-eku OBJECT IDENTIFIER ::=
+  { iso(1) org(3) dod(6) internet(1) private(4) 
+    enterprise(1) microsoft(311) 20 2 2 }
+
 id-pkinit-ms-san OBJECT IDENTIFIER ::=
 id-pkinit-ms-san OBJECT IDENTIFIER ::=
-  { iso(1) org(3) dod(6) internet(1) foo1(4) 
-    foo2(1) foo3(311) foo4(20) foo5(2) foo6(3) }
+  { iso(1) org(3) dod(6) internet(1) private(4) 
+    enterprise(1) microsoft(311) 20 2 3 }
+
+MS-UPN-SAN ::= UTF8String
 
 pa-pk-as-req INTEGER ::=                  16
 pa-pk-as-rep INTEGER ::=                  17
 
 pa-pk-as-req INTEGER ::=                  16
 pa-pk-as-rep INTEGER ::=                  17
index 430674a5ee8c79644737f325e5d0297941e9f508..71f197eba7734ebfee8ef1e969b6dd9845a9d0f6 100644 (file)
@@ -87,6 +87,7 @@ id-at-serialNumber            OBJECT IDENTIFIER ::= { id-x520-at 5 }
 id-at-countryName              OBJECT IDENTIFIER ::= { id-x520-at 6 }
 id-at-localityName             OBJECT IDENTIFIER ::= { id-x520-at 7 }
 id-at-stateOrProvinceName      OBJECT IDENTIFIER ::= { id-x520-at 8 }
 id-at-countryName              OBJECT IDENTIFIER ::= { id-x520-at 6 }
 id-at-localityName             OBJECT IDENTIFIER ::= { id-x520-at 7 }
 id-at-stateOrProvinceName      OBJECT IDENTIFIER ::= { id-x520-at 8 }
+id-at-streetAddress            OBJECT IDENTIFIER ::= { id-x520-at 9 }
 id-at-organizationName         OBJECT IDENTIFIER ::= { id-x520-at 10 }
 id-at-organizationalUnitName   OBJECT IDENTIFIER ::= { id-x520-at 11 }
 id-at-name                     OBJECT IDENTIFIER ::= { id-x520-at 41 }
 id-at-organizationName         OBJECT IDENTIFIER ::= { id-x520-at 10 }
 id-at-organizationalUnitName   OBJECT IDENTIFIER ::= { id-x520-at 11 }
 id-at-name                     OBJECT IDENTIFIER ::= { id-x520-at 41 }
@@ -306,6 +307,32 @@ id-x509-ce-invalidityDate OBJECT IDENTIFIER ::= { id-x509-ce 24 }
 id-x509-ce-certificateIssuer   OBJECT IDENTIFIER ::= { id-x509-ce 29 }
 id-x509-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::=  { id-x509-ce 54 }
 
 id-x509-ce-certificateIssuer   OBJECT IDENTIFIER ::= { id-x509-ce 29 }
 id-x509-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::=  { id-x509-ce 54 }
 
+DistributionPointReasonFlags ::= BIT STRING {
+       unused                  (0),
+       keyCompromise           (1),
+       cACompromise            (2),
+       affiliationChanged      (3),
+       superseded              (4),
+       cessationOfOperation    (5),
+       certificateHold         (6),
+       privilegeWithdrawn      (7),
+       aACompromise            (8)
+}
+
+DistributionPointName ::= CHOICE {
+       fullName                [0]     IMPLICIT -- GeneralNames --  SEQUENCE -- SIZE (1..MAX) -- OF GeneralName,
+       nameRelativeToCRLIssuer [1]     RelativeDistinguishedName
+}
+
+DistributionPoint ::= SEQUENCE {
+       distributionPoint       [0]     IMPLICIT heim_any -- DistributionPointName -- OPTIONAL,
+       reasons                 [1]     IMPLICIT heim_any -- DistributionPointReasonFlags -- OPTIONAL,
+       cRLIssuer               [2]     IMPLICIT heim_any -- GeneralNames -- OPTIONAL
+}
+
+CRLDistributionPoints ::= SEQUENCE -- SIZE (1..MAX) -- OF DistributionPoint
+
+
 -- rfc3279
 
 DSASigValue  ::=  SEQUENCE {
 -- rfc3279
 
 DSASigValue  ::=  SEQUENCE {
@@ -406,10 +433,13 @@ CRLReason ::= ENUMERATED {
        aACompromise           (10)
 }
 
        aACompromise           (10)
 }
 
+PKIXXmppAddr ::= UTF8String
+
 id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
             dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
 
 id-pkix-on OBJECT IDENTIFIER ::= { id-pkix 8 }
 id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
             dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
 
 id-pkix-on OBJECT IDENTIFIER ::= { id-pkix 8 }
+id-pkix-on-xmppAddr OBJECT IDENTIFIER ::= { id-pkix-on 5 }
 id-pkix-on-dnsSRV OBJECT IDENTIFIER ::= { id-pkix-on 7 }
 
 id-pkix-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
 id-pkix-on-dnsSRV OBJECT IDENTIFIER ::= { id-pkix-on 7 }
 
 id-pkix-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
@@ -441,4 +471,25 @@ ProxyCertInfo ::= SEQUENCE {
        proxyPolicy             ProxyPolicy
 }
 
        proxyPolicy             ProxyPolicy
 }
 
+--- U.S. Federal PKI Common Policy Framework
+-- Card Authentication key
+id-uspkicommon-card-id OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 6 }
+id-uspkicommon-piv-interim OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 9 1 }
+
+--- Netscape extentions
+
+id-netscape OBJECT IDENTIFIER ::= 
+    { joint-iso-itu-t(2) country(16) us(840) organization(1) netscape(113730) }
+id-netscape-cert-comment OBJECT IDENTIFIER ::= { id-netscape 1 13 }
+
+--- MS extentions
+
+id-ms-cert-enroll-domaincontroller OBJECT IDENTIFIER ::= 
+    { 1 3 6 1 4 1 311 20 2 }
+
+id-ms-client-authentication OBJECT IDENTIFIER ::= 
+ { 1 3 6 1 5 5 7 3 2 }
+
+-- DER:1e:20:00:44:00:6f:00:6d:00:61:00:69:00:6e:00:43:00:6f:00:6e:00:74:00:72:00:6f:00:6c:00:6c:00:65:00:72
+
 END
 END
index a4e1ed48848c92a3aa1f56c1f09d8e5e534f1a7c..9407915c19b72c973b519b192c0c877ca3a45490 100644 (file)
@@ -34,7 +34,7 @@
 #include "gen_locl.h"
 #include "lex.h"
 
 #include "gen_locl.h"
 #include "lex.h"
 
-RCSID("$Id: symbol.c,v 1.10 2005/07/12 06:27:39 lha Exp $");
+RCSID("$Id: symbol.c 15617 2005-07-12 06:27:42Z lha $");
 
 static Hashtab *htab;
 
 
 static Hashtab *htab;
 
index 436bd043a18a8c43e2e9ae6290f8e4484aa15f7b..d07caf55904283c88977c574b4f1659d03e44d1e 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: symbol.h,v 1.14 2006/12/28 17:15:05 lha Exp $ */
+/* $Id: symbol.h 19539 2006-12-28 17:15:05Z lha $ */
 
 #ifndef _SYMBOL_H
 #define _SYMBOL_H
 
 #ifndef _SYMBOL_H
 #define _SYMBOL_H
index 1a1179bc301f22655545312519ce9b4085076377..98b507a4da655bf8372ed3245480553ca48b86f2 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: test.asn1,v 1.9 2006/09/05 14:00:44 lha Exp $ --
+-- $Id: test.asn1 18013 2006-09-05 14:00:44Z lha $ --
 
 TEST DEFINITIONS ::=
 
 
 TEST DEFINITIONS ::=
 
index 86df58d7008de2ceaa5ef26b200a0a304ec8b202..a6776458cf9a9ec57c9052543c9d5d68926eaf89 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "der_locl.h"
 
 
 #include "der_locl.h"
 
-RCSID("$Id: timegm.c,v 1.11 2006/10/19 16:19:32 lha Exp $");
+RCSID("$Id: timegm.c 18607 2006-10-19 16:19:32Z lha $");
 
 static int
 is_leap(unsigned y)
 
 static int
 is_leap(unsigned y)
index 0462fdcc030721b770b8b35ab2788896f0ad2ae8..faf4294cdd8f6bc65c76015d6016ba7f030dc0eb 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: com_err.c,v 1.19 2005/04/24 19:42:39 lha Exp $");
+RCSID("$Id: com_err.c 14930 2005-04-24 19:43:06Z lha $");
 #endif
 #include <stdio.h>
 #include <stdlib.h>
 #endif
 #include <stdio.h>
 #include <stdlib.h>
index fe7441108a3dc8d236ec871818bfe35895a05a47..bdd764f7e982b7082f73ee1aa2664c05e9db5450 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: com_err.h,v 1.11 2005/07/07 14:58:07 lha Exp $ */
+/* $Id: com_err.h 15566 2005-07-07 14:58:07Z lha $ */
 
 /* MIT compatible com_err library */
 
 
 /* MIT compatible com_err library */
 
index 7e7d342e2c2cbbdec6d20d11b83319b0bb2bfc5d..4d929da866b33617b60561ee353f76590465f3a5 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: com_right.h,v 1.12 2005/02/03 08:43:01 lha Exp $ */
+/* $Id: com_right.h 14551 2005-02-03 08:45:13Z lha $ */
 
 #ifndef __COM_RIGHT_H__
 #define __COM_RIGHT_H__
 
 #ifndef __COM_RIGHT_H__
 #define __COM_RIGHT_H__
index 1b472d8e0fd8a916495ba9cebdbae1a12173bb31..105765482265b10bf76d754e2607af7a525e6f8e 100644 (file)
@@ -35,7 +35,7 @@
 #include "compile_et.h"
 #include <getarg.h>
 
 #include "compile_et.h"
 #include <getarg.h>
 
-RCSID("$Id: compile_et.c,v 1.19 2005/06/16 19:21:00 lha Exp $");
+RCSID("$Id: compile_et.c 15426 2005-06-16 19:21:42Z lha $");
 
 #include <roken.h>
 #include <err.h>
 
 #include <roken.h>
 #include <err.h>
index 6da8c59322cf7a90d27c5be171137124236991d7..1c7de5a08b69134082ea9f13b31afb88a28a5180 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: compile_et.h,v 1.8 2005/06/16 19:21:26 lha Exp $ */
+/* $Id: compile_et.h 15426 2005-06-16 19:21:42Z lha $ */
 
 #ifndef __COMPILE_ET_H__
 #define __COMPILE_ET_H__
 
 #ifndef __COMPILE_ET_H__
 #define __COMPILE_ET_H__
index b22f25b41a284930f7a216fa2e6f5bfbb3cf8951..051078025c563a40688e6e7f43422c40db398f04 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: error.c,v 1.15 2001/02/28 20:00:13 joda Exp $");
+RCSID("$Id: error.c 9724 2001-02-28 20:00:13Z joda $");
 #endif
 #include <stdio.h>
 #include <stdlib.h>
 #endif
 #include <stdio.h>
 #include <stdlib.h>
index 4697d0a3fd64c23110eddb561dee22f07e84e351..c5af2ead5c47715437a061beda9b2167e30c7e31 100644 (file)
@@ -1,6 +1,5 @@
-#include "config.h"
 
 
-#line 3 "lex.yy.c"
+#line 3 "lex.c"
 
 #define  YY_INT_ALIGNED short int
 
 
 #define  YY_INT_ALIGNED short int
 
@@ -524,7 +523,7 @@ char *yytext;
 #include "parse.h"
 #include "lex.h"
 
 #include "parse.h"
 #include "lex.h"
 
-RCSID("$Id: lex.l,v 1.8 2005/05/16 08:52:54 lha Exp $");
+RCSID("$Id: lex.l 15143 2005-05-16 08:52:54Z lha $");
 
 static unsigned lineno = 1;
 static int getstring(void);
 
 static unsigned lineno = 1;
 static int getstring(void);
@@ -533,7 +532,7 @@ static int getstring(void);
 
 #undef ECHO
 
 
 #undef ECHO
 
-#line 536 "lex.yy.c"
+#line 536 "lex.c"
 
 #define INITIAL 0
 
 
 #define INITIAL 0
 
@@ -688,7 +687,7 @@ YY_DECL
     
 #line 59 "lex.l"
 
     
 #line 59 "lex.l"
 
-#line 691 "lex.yy.c"
+#line 691 "lex.c"
 
        if ( !(yy_init) )
                {
 
        if ( !(yy_init) )
                {
@@ -852,7 +851,7 @@ YY_RULE_SETUP
 #line 75 "lex.l"
 ECHO;
        YY_BREAK
 #line 75 "lex.l"
 ECHO;
        YY_BREAK
-#line 855 "lex.yy.c"
+#line 855 "lex.c"
 case YY_STATE_EOF(INITIAL):
        yyterminate();
 
 case YY_STATE_EOF(INITIAL):
        yyterminate();
 
@@ -1083,7 +1082,7 @@ static int yy_get_next_buffer (void)
 
                /* Read in more data. */
                YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]),
 
                /* Read in more data. */
                YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]),
-                       (yy_n_chars), (size_t) num_to_read );
+                       (yy_n_chars), num_to_read );
 
                YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
                }
 
                YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
                }
@@ -1584,7 +1583,7 @@ YY_BUFFER_STATE yy_scan_buffer  (char * base, yy_size_t  size )
 
 /** Setup the input buffer state to scan a string. The next call to yylex() will
  * scan from a @e copy of @a str.
 
 /** Setup the input buffer state to scan a string. The next call to yylex() will
  * scan from a @e copy of @a str.
- * @param yystr a NUL-terminated string to scan
+ * @param str a NUL-terminated string to scan
  * 
  * @return the newly allocated buffer state object.
  * @note If you want to scan bytes that may contain NUL values, then use
  * 
  * @return the newly allocated buffer state object.
  * @note If you want to scan bytes that may contain NUL values, then use
index 9912bf4f0943a3c2edbd2b2b2c8ff8286a1c3bfb..89f0387655f4744cfdbf461eb3210eee0ed70ca1 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: lex.h,v 1.1 2000/06/22 00:42:52 assar Exp $ */
+/* $Id: lex.h 8451 2000-06-22 00:42:52Z assar $ */
 
 void error_message (const char *, ...)
 __attribute__ ((format (printf, 1, 2)));
 
 void error_message (const char *, ...)
 __attribute__ ((format (printf, 1, 2)));
index 9fb19b33ce9b29fa15ffb2642b295684ea6b49a3..4bacb721ca112acfb3bab591a2ece14f16737d4b 100644 (file)
@@ -90,7 +90,7 @@
 
 
 /* Copy the first part of user declarations.  */
 
 
 /* Copy the first part of user declarations.  */
-#line 1 "./heimdal/lib/com_err/parse.y"
+#line 1 "parse.y"
 
 /*
  * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan
 
 /*
  * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan
 #include "compile_et.h"
 #include "lex.h"
 
 #include "compile_et.h"
 #include "lex.h"
 
-RCSID("$Id: parse.y,v 1.15 2005/06/16 19:21:42 lha Exp $");
+RCSID("$Id: parse.y 15426 2005-06-16 19:21:42Z lha $");
 
 void yyerror (char *s);
 static long name2number(const char *str);
 
 void yyerror (char *s);
 static long name2number(const char *str);
@@ -163,13 +163,13 @@ extern char *yytext;
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 53 "./heimdal/lib/com_err/parse.y"
+#line 53 "parse.y"
 {
   char *string;
   int number;
 }
 /* Line 187 of yacc.c.  */
 {
   char *string;
   int number;
 }
 /* Line 187 of yacc.c.  */
-#line 173 "./heimdal/lib/com_err/parse.y"
+#line 173 "parse.c"
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
@@ -182,7 +182,7 @@ typedef union YYSTYPE
 
 
 /* Line 216 of yacc.c.  */
 
 
 /* Line 216 of yacc.c.  */
-#line 186 "./heimdal/lib/com_err/parse.y"
+#line 186 "parse.c"
 
 #ifdef short
 # undef short
 
 #ifdef short
 # undef short
@@ -1381,14 +1381,14 @@ yyreduce:
   switch (yyn)
     {
         case 6:
   switch (yyn)
     {
         case 6:
-#line 73 "./heimdal/lib/com_err/parse.y"
+#line 73 "parse.y"
     {
                    id_str = (yyvsp[(2) - (2)].string);
                }
     break;
 
   case 7:
     {
                    id_str = (yyvsp[(2) - (2)].string);
                }
     break;
 
   case 7:
-#line 79 "./heimdal/lib/com_err/parse.y"
+#line 79 "parse.y"
     {
                    base_id = name2number((yyvsp[(2) - (2)].string));
                    strlcpy(name, (yyvsp[(2) - (2)].string), sizeof(name));
     {
                    base_id = name2number((yyvsp[(2) - (2)].string));
                    strlcpy(name, (yyvsp[(2) - (2)].string), sizeof(name));
@@ -1397,7 +1397,7 @@ yyreduce:
     break;
 
   case 8:
     break;
 
   case 8:
-#line 85 "./heimdal/lib/com_err/parse.y"
+#line 85 "parse.y"
     {
                    base_id = name2number((yyvsp[(2) - (3)].string));
                    strlcpy(name, (yyvsp[(3) - (3)].string), sizeof(name));
     {
                    base_id = name2number((yyvsp[(2) - (3)].string));
                    strlcpy(name, (yyvsp[(3) - (3)].string), sizeof(name));
@@ -1407,14 +1407,14 @@ yyreduce:
     break;
 
   case 11:
     break;
 
   case 11:
-#line 98 "./heimdal/lib/com_err/parse.y"
+#line 98 "parse.y"
     {
                        number = (yyvsp[(2) - (2)].number);
                }
     break;
 
   case 12:
     {
                        number = (yyvsp[(2) - (2)].number);
                }
     break;
 
   case 12:
-#line 102 "./heimdal/lib/com_err/parse.y"
+#line 102 "parse.y"
     {
                    free(prefix);
                    asprintf (&prefix, "%s_", (yyvsp[(2) - (2)].string));
     {
                    free(prefix);
                    asprintf (&prefix, "%s_", (yyvsp[(2) - (2)].string));
@@ -1425,7 +1425,7 @@ yyreduce:
     break;
 
   case 13:
     break;
 
   case 13:
-#line 110 "./heimdal/lib/com_err/parse.y"
+#line 110 "parse.y"
     {
                    prefix = realloc(prefix, 1);
                    if (prefix == NULL)
     {
                    prefix = realloc(prefix, 1);
                    if (prefix == NULL)
@@ -1435,7 +1435,7 @@ yyreduce:
     break;
 
   case 14:
     break;
 
   case 14:
-#line 117 "./heimdal/lib/com_err/parse.y"
+#line 117 "parse.y"
     {
                    struct error_code *ec = malloc(sizeof(*ec));
                    
     {
                    struct error_code *ec = malloc(sizeof(*ec));
                    
@@ -1458,7 +1458,7 @@ yyreduce:
     break;
 
   case 15:
     break;
 
   case 15:
-#line 137 "./heimdal/lib/com_err/parse.y"
+#line 137 "parse.y"
     {
                        YYACCEPT;
                }
     {
                        YYACCEPT;
                }
@@ -1466,7 +1466,7 @@ yyreduce:
 
 
 /* Line 1267 of yacc.c.  */
 
 
 /* Line 1267 of yacc.c.  */
-#line 1470 "./heimdal/lib/com_err/parse.y"
+#line 1470 "parse.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -1680,7 +1680,7 @@ yyreturn:
 }
 
 
 }
 
 
-#line 142 "./heimdal/lib/com_err/parse.y"
+#line 142 "parse.y"
 
 
 static long
 
 
 static long
index cb1d09276cfc95aff1c2686b3d6fa17557ef67bc..4c9681ff34f5aaa6e6a84c5b39285fcd5feb2a20 100644 (file)
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 53 "./heimdal/lib/com_err/parse.y"
+#line 53 "parse.y"
 {
   char *string;
   int number;
 }
 /* Line 1489 of yacc.c.  */
 {
   char *string;
   int number;
 }
 /* Line 1489 of yacc.c.  */
-#line 74 "./heimdal/lib/com_err/parse.y"
+#line 74 "parse.h"
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
        YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
index 8077aeb2239c26227e1933e2fc9c7d7d11cff63f..fbc638c48fca41dd47fcd1de525cc875c02a0bee 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: gssapi.h,v 1.7 2006/12/15 20:02:54 lha Exp $ */
+/* $Id: gssapi.h 21004 2007-06-08 01:53:10Z lha $ */
 
 #ifndef GSSAPI_GSSAPI_H_
 #define GSSAPI_GSSAPI_H_
 
 #ifndef GSSAPI_GSSAPI_H_
 #define GSSAPI_GSSAPI_H_
@@ -714,6 +714,23 @@ gss_inquire_cred_by_oid(OM_uint32 *minor_status,
                        const gss_OID desired_object,
                        gss_buffer_set_t *data_set);
 
                        const gss_OID desired_object,
                        gss_buffer_set_t *data_set);
 
+/*
+ * RFC 4401
+ */
+
+#define GSS_C_PRF_KEY_FULL 0
+#define GSS_C_PRF_KEY_PARTIAL 1
+
+OM_uint32
+gss_pseudo_random
+       (OM_uint32 *minor_status,
+        gss_ctx_id_t context,
+        int prf_key,
+        const gss_buffer_t prf_in,
+        ssize_t desired_output_len,
+        gss_buffer_t prf_out
+       );
+
 /*
  * The following routines are obsolete variants of gss_get_mic,
  * gss_verify_mic, gss_wrap and gss_unwrap.  They should be
 /*
  * The following routines are obsolete variants of gss_get_mic,
  * gss_verify_mic, gss_wrap and gss_unwrap.  They should be
index ecd90a665600c638a4f6ab8fa43805a146e716a9..cca529fe26ff5c9e1f43f9a34e436728ce7f24b7 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: gssapi_krb5.h,v 1.17 2006/11/10 01:05:34 lha Exp $ */
+/* $Id: gssapi_krb5.h 20385 2007-04-18 08:51:32Z lha $ */
 
 #ifndef GSSAPI_KRB5_H_
 #define GSSAPI_KRB5_H_
 
 #ifndef GSSAPI_KRB5_H_
 #define GSSAPI_KRB5_H_
@@ -65,6 +65,7 @@ extern gss_OID GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X;
 extern gss_OID GSS_KRB5_SET_DNS_CANONICALIZE_X;
 extern gss_OID GSS_KRB5_SEND_TO_KDC_X;
 extern gss_OID GSS_KRB5_SET_DEFAULT_REALM_X;
 extern gss_OID GSS_KRB5_SET_DNS_CANONICALIZE_X;
 extern gss_OID GSS_KRB5_SEND_TO_KDC_X;
 extern gss_OID GSS_KRB5_SET_DEFAULT_REALM_X;
+extern gss_OID GSS_KRB5_CCACHE_NAME_X;
 /* Extensions inquire context */
 extern gss_OID GSS_KRB5_GET_TKT_FLAGS_X;
 extern gss_OID GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X;
 /* Extensions inquire context */
 extern gss_OID GSS_KRB5_GET_TKT_FLAGS_X;
 extern gss_OID GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_X;
index 0a856e39aa9809ca1750550b0d4e866993122542..fbb7906369be50221110eae6588a5d3cfac23f14 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: gssapi_spnego.h,v 1.1 2006/10/07 22:26:21 lha Exp $ */
+/* $Id: gssapi_spnego.h 18335 2006-10-07 22:26:21Z lha $ */
 
 #ifndef GSSAPI_SPNEGO_H_
 #define GSSAPI_SPNEGO_H_
 
 #ifndef GSSAPI_SPNEGO_H_
 #define GSSAPI_SPNEGO_H_
index 2bb5ecedf50687bf26f3e7b35dfa3e74813a6c8d..403990ad47a1d68087bdb873feda43585d3af38d 100644 (file)
@@ -298,6 +298,15 @@ typedef OM_uint32 _gss_set_cred_option (
              );
 
 
              );
 
 
+typedef OM_uint32 _gss_pseudo_random(
+              OM_uint32 *minor_status,
+              gss_ctx_id_t context,
+              int prf_key,
+              const gss_buffer_t prf_in,
+              ssize_t desired_output_len,
+              gss_buffer_t prf_out
+              );
+
 #define GMI_VERSION 1
 
 typedef struct gssapi_mech_interface_desc {
 #define GMI_VERSION 1
 
 typedef struct gssapi_mech_interface_desc {
@@ -337,6 +346,7 @@ typedef struct gssapi_mech_interface_desc {
        _gss_inquire_cred_by_oid        *gm_inquire_cred_by_oid;
        _gss_set_sec_context_option     *gm_set_sec_context_option;
        _gss_set_cred_option            *gm_set_cred_option;
        _gss_inquire_cred_by_oid        *gm_inquire_cred_by_oid;
        _gss_set_sec_context_option     *gm_set_sec_context_option;
        _gss_set_cred_option            *gm_set_cred_option;
+       _gss_pseudo_random              *gm_pseudo_random;
 } gssapi_mech_interface_desc, *gssapi_mech_interface;
 
 gssapi_mech_interface
 } gssapi_mech_interface_desc, *gssapi_mech_interface;
 
 gssapi_mech_interface
index 0123f67e0953b10873638230b1e2a9d5e93792fc..619cbf97fcbdb841511df5558a25fb395feec1b6 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: 8003.c,v 1.20 2006/10/07 22:13:51 lha Exp $");
+RCSID("$Id: 8003.c 18334 2006-10-07 22:16:04Z lha $");
 
 krb5_error_code
 _gsskrb5_encode_om_uint32(OM_uint32 n, u_char *p)
 
 krb5_error_code
 _gsskrb5_encode_om_uint32(OM_uint32 n, u_char *p)
index 434fbee352e7a010630faadf4132c638fbb8163a..73b93ceba4c6bb472c546afd52981bcf13051173 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: accept_sec_context.c,v 1.66 2006/11/13 18:00:54 lha Exp $");
+RCSID("$Id: accept_sec_context.c 20199 2007-02-07 22:36:39Z lha $");
 
 HEIMDAL_MUTEX gssapi_keytab_mutex = HEIMDAL_MUTEX_INITIALIZER;
 krb5_keytab _gsskrb5_keytab;
 
 HEIMDAL_MUTEX gssapi_keytab_mutex = HEIMDAL_MUTEX_INITIALIZER;
 krb5_keytab _gsskrb5_keytab;
@@ -187,6 +187,7 @@ gsskrb5_accept_delegated_token
 
 out:
     if (ccache) {
 
 out:
     if (ccache) {
+       /* Don't destroy the default cred cache */
        if (delegated_cred_handle == NULL)
            krb5_cc_close(context, ccache);
        else
        if (delegated_cred_handle == NULL)
            krb5_cc_close(context, ccache);
        else
index e811a99a8bea6e8020768e41c3c3619b3304ea84..42b57cdadddc16efe951620fa909566d79235585 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: acquire_cred.c,v 1.33 2006/11/20 18:09:30 lha Exp $");
+RCSID("$Id: acquire_cred.c 20688 2007-05-17 18:44:31Z lha $");
 
 OM_uint32
 __gsskrb5_ccache_lifetime(OM_uint32 *minor_status,
 
 OM_uint32
 __gsskrb5_ccache_lifetime(OM_uint32 *minor_status,
@@ -301,8 +301,8 @@ OM_uint32 _gsskrb5_acquire_cred
     if (desired_mechs) {
        int present = 0;
 
     if (desired_mechs) {
        int present = 0;
 
-       ret = _gsskrb5_test_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
-                                          desired_mechs, &present); 
+       ret = gss_test_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
+                                     desired_mechs, &present); 
        if (ret)
            return ret;
        if (!present) {
        if (ret)
            return ret;
        if (!present) {
@@ -352,16 +352,16 @@ OM_uint32 _gsskrb5_acquire_cred
            return (ret);
        }
     }
            return (ret);
        }
     }
-    ret = _gsskrb5_create_empty_oid_set(minor_status, &handle->mechanisms);
+    ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
     if (ret == GSS_S_COMPLETE)
     if (ret == GSS_S_COMPLETE)
-       ret = _gsskrb5_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
-                                         &handle->mechanisms);
+       ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
+                                    &handle->mechanisms);
     if (ret == GSS_S_COMPLETE)
        ret = _gsskrb5_inquire_cred(minor_status, (gss_cred_id_t)handle, 
                                    NULL, time_rec, NULL, actual_mechs);
     if (ret != GSS_S_COMPLETE) {
        if (handle->mechanisms != NULL)
     if (ret == GSS_S_COMPLETE)
        ret = _gsskrb5_inquire_cred(minor_status, (gss_cred_id_t)handle, 
                                    NULL, time_rec, NULL, actual_mechs);
     if (ret != GSS_S_COMPLETE) {
        if (handle->mechanisms != NULL)
-           _gsskrb5_release_oid_set(NULL, &handle->mechanisms);
+           gss_release_oid_set(NULL, &handle->mechanisms);
        HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
        krb5_free_principal(context, handle->principal);
        free(handle);
        HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
        krb5_free_principal(context, handle->principal);
        free(handle);
index 3b0272af80050628ba2063d5f019fe8bf6bf5f9d..9a1045a889f630b3e5a7cfdcafdb421667c94691 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: add_cred.c,v 1.10 2006/11/13 18:01:01 lha Exp $");
+RCSID("$Id: add_cred.c 20688 2007-05-17 18:44:31Z lha $");
 
 OM_uint32 _gsskrb5_add_cred (
      OM_uint32           *minor_status,
 
 OM_uint32 _gsskrb5_add_cred (
      OM_uint32           *minor_status,
@@ -204,12 +204,12 @@ OM_uint32 _gsskrb5_add_cred (
                }           
            }
        }
                }           
            }
        }
-       ret = _gsskrb5_create_empty_oid_set(minor_status, &handle->mechanisms);
+       ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
        if (ret)
            goto failure;
 
        if (ret)
            goto failure;
 
-       ret = _gsskrb5_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
-                                         &handle->mechanisms);
+       ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
+                                    &handle->mechanisms);
        if (ret)
            goto failure;
     }
        if (ret)
            goto failure;
     }
@@ -243,7 +243,7 @@ OM_uint32 _gsskrb5_add_cred (
        if (handle->ccache)
            krb5_cc_destroy(context, handle->ccache);
        if (handle->mechanisms)
        if (handle->ccache)
            krb5_cc_destroy(context, handle->ccache);
        if (handle->mechanisms)
-           _gsskrb5_release_oid_set(NULL, &handle->mechanisms);
+           gss_release_oid_set(NULL, &handle->mechanisms);
        free(handle);
     }
     if (output_cred_handle)
        free(handle);
     }
     if (output_cred_handle)
diff --git a/source4/heimdal/lib/gssapi/krb5/add_oid_set_member.c b/source4/heimdal/lib/gssapi/krb5/add_oid_set_member.c
deleted file mode 100644 (file)
index b0ec2c6..0000000
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden). 
- * All rights reserved. 
- *
- * Redistribution and use in source and binary forms, with or without 
- * modification, are permitted provided that the following conditions 
- * are met: 
- *
- * 1. Redistributions of source code must retain the above copyright 
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright 
- *    notice, this list of conditions and the following disclaimer in the 
- *    documentation and/or other materials provided with the distribution. 
- *
- * 3. Neither the name of the Institute nor the names of its contributors 
- *    may be used to endorse or promote products derived from this software 
- *    without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
- * SUCH DAMAGE. 
- */
-
-#include "krb5/gsskrb5_locl.h"
-
-RCSID("$Id: add_oid_set_member.c,v 1.10 2006/10/07 22:14:00 lha Exp $");
-
-OM_uint32 _gsskrb5_add_oid_set_member (
-            OM_uint32 * minor_status,
-            const gss_OID member_oid,
-            gss_OID_set * oid_set
-           )
-{
-  gss_OID tmp;
-  size_t n;
-  OM_uint32 res;
-  int present;
-
-  res = _gsskrb5_test_oid_set_member(minor_status, member_oid, 
-                                    *oid_set, &present);
-  if (res != GSS_S_COMPLETE)
-    return res;
-
-  if (present) {
-    *minor_status = 0;
-    return GSS_S_COMPLETE;
-  }
-
-  n = (*oid_set)->count + 1;
-  tmp = realloc ((*oid_set)->elements, n * sizeof(gss_OID_desc));
-  if (tmp == NULL) {
-    *minor_status = ENOMEM;
-    return GSS_S_FAILURE;
-  }
-  (*oid_set)->elements = tmp;
-  (*oid_set)->count = n;
-  (*oid_set)->elements[n-1] = *member_oid;
-  *minor_status = 0;
-  return GSS_S_COMPLETE;
-}
index d1bdbb641ff64bf8c0a1ef079b26ad4df95b5047..032da36ebc86a4dfd33d08cdd3ab4f0c24dfe122 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: arcfour.c,v 1.31 2006/11/13 18:01:08 lha Exp $");
+RCSID("$Id: arcfour.c 19031 2006-11-13 18:02:57Z lha $");
 
 /*
  * Implements draft-brezak-win2k-krb-rc4-hmac-04.txt
 
 /*
  * Implements draft-brezak-win2k-krb-rc4-hmac-04.txt
index f69300b590b2c19aa788b2829726e759c8dda413..c1744abd3becbc207a81b65cede3edb09d970426 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: canonicalize_name.c,v 1.4 2006/10/07 22:14:08 lha Exp $");
+RCSID("$Id: canonicalize_name.c 18334 2006-10-07 22:16:04Z lha $");
 
 OM_uint32 _gsskrb5_canonicalize_name (
             OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_canonicalize_name (
             OM_uint32 * minor_status,
index e75fe5da9d83e69d3ea1518d691042b4c227985a..6452f802ab84be5bc7a9431d15cc135a3e9bca2f 100755 (executable)
@@ -32,7 +32,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: cfx.c,v 1.25 2006/11/13 18:01:14 lha Exp $");
+RCSID("$Id: cfx.c 19031 2006-11-13 18:02:57Z lha $");
 
 /*
  * Implementation of draft-ietf-krb-wg-gssapi-cfx-06.txt
 
 /*
  * Implementation of draft-ietf-krb-wg-gssapi-cfx-06.txt
index ce021aa09934755254517ca26bac7adb4abc0d8c..672704a8418dd98fb8bd551f30d424634f6bf469 100755 (executable)
@@ -30,7 +30,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: cfx.h,v 1.8 2006/11/13 18:01:17 lha Exp $ */
+/* $Id: cfx.h 19031 2006-11-13 18:02:57Z lha $ */
 
 #ifndef GSSAPI_CFX_H_
 #define GSSAPI_CFX_H_ 1
 
 #ifndef GSSAPI_CFX_H_
 #define GSSAPI_CFX_H_ 1
index 6b537468df5e486a919d5aa2465aab9b3c4c7be7..3f3b59d11621b8432b97f2737895b7de23c0c37e 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: compare_name.c,v 1.8 2006/11/13 18:01:20 lha Exp $");
+RCSID("$Id: compare_name.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_compare_name
            (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_compare_name
            (OM_uint32 * minor_status,
index 3e64df03dbe8d04163ce2d7bb75ca1442b3c5d6a..a0f075621a4991032f820a62a248405d3562c3cb 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: compat.c,v 1.14 2006/11/13 18:01:23 lha Exp $");
+RCSID("$Id: compat.c 19031 2006-11-13 18:02:57Z lha $");
 
 
 static krb5_error_code
 
 
 static krb5_error_code
index 9012dd0b7f6356f71bddedbf4832006b4476ef33..b57ac7854e69394175fdb379ca09f507063ff544 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: context_time.c,v 1.14 2006/11/13 18:01:26 lha Exp $");
+RCSID("$Id: context_time.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32
 _gsskrb5_lifetime_left(OM_uint32 *minor_status, 
 
 OM_uint32
 _gsskrb5_lifetime_left(OM_uint32 *minor_status, 
index 4387a4e6ef21b526e56e515098d7d0dc9099219a..66d797c19933f0def47c3014b2e06dfde7487592 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: copy_ccache.c,v 1.17 2006/11/13 18:01:29 lha Exp $");
+RCSID("$Id: copy_ccache.c 20688 2007-05-17 18:44:31Z lha $");
 
 #if 0
 OM_uint32
 
 #if 0
 OM_uint32
@@ -166,10 +166,10 @@ _gsskrb5_import_cred(OM_uint32 *minor_status,
 
 
     if (id || keytab) {
 
 
     if (id || keytab) {
-       ret = _gsskrb5_create_empty_oid_set(minor_status, &handle->mechanisms);
+       ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
        if (ret == GSS_S_COMPLETE)
        if (ret == GSS_S_COMPLETE)
-           ret = _gsskrb5_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
-                                             &handle->mechanisms);
+           ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
+                                        &handle->mechanisms);
        if (ret != GSS_S_COMPLETE) {
            kret = *minor_status;
            goto out;
        if (ret != GSS_S_COMPLETE) {
            kret = *minor_status;
            goto out;
@@ -181,6 +181,11 @@ _gsskrb5_import_cred(OM_uint32 *minor_status,
     return GSS_S_COMPLETE;
 
 out:
     return GSS_S_COMPLETE;
 
 out:
+    gss_release_oid_set(minor_status, &handle->mechanisms);
+    if (handle->ccache)
+       krb5_cc_close(context, handle->ccache);
+    if (handle->keytab)
+       krb5_kt_close(context, handle->keytab);
     if (handle->principal)
        krb5_free_principal(context, handle->principal);
     HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
     if (handle->principal)
        krb5_free_principal(context, handle->principal);
     HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
diff --git a/source4/heimdal/lib/gssapi/krb5/create_emtpy_oid_set.c b/source4/heimdal/lib/gssapi/krb5/create_emtpy_oid_set.c
deleted file mode 100644 (file)
index 5509951..0000000
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden). 
- * All rights reserved. 
- *
- * Redistribution and use in source and binary forms, with or without 
- * modification, are permitted provided that the following conditions 
- * are met: 
- *
- * 1. Redistributions of source code must retain the above copyright 
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright 
- *    notice, this list of conditions and the following disclaimer in the 
- *    documentation and/or other materials provided with the distribution. 
- *
- * 3. Neither the name of the Institute nor the names of its contributors 
- *    may be used to endorse or promote products derived from this software 
- *    without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
- * SUCH DAMAGE. 
- */
-
-#include "krb5/gsskrb5_locl.h"
-
-RCSID("$Id: create_emtpy_oid_set.c,v 1.7 2006/10/07 22:14:24 lha Exp $");
-
-OM_uint32 _gsskrb5_create_empty_oid_set (
-            OM_uint32 * minor_status,
-            gss_OID_set * oid_set
-           )
-{
-  *oid_set = malloc(sizeof(**oid_set));
-  if (*oid_set == NULL) {
-    *minor_status = ENOMEM;
-    return GSS_S_FAILURE;
-  }
-  (*oid_set)->count = 0;
-  (*oid_set)->elements = NULL;
-  *minor_status = 0;
-  return GSS_S_COMPLETE;
-}
index eadec1ef03c03420e32b33fcb4498ca74b6c4334..39176faff44242ca9a9fdc401b938dc9181eea88 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: decapsulate.c,v 1.16 2006/10/07 22:14:26 lha Exp $");
+RCSID("$Id: decapsulate.c 18334 2006-10-07 22:16:04Z lha $");
 
 /*
  * return the length of the mechanism in token or -1
 
 /*
  * return the length of the mechanism in token or -1
index c7f2ee262d00f3822368591f15aa97b69647dc9a..abad98655026a2199ce208ca286868d1009608d7 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: delete_sec_context.c,v 1.20 2006/11/13 18:01:32 lha Exp $");
+RCSID("$Id: delete_sec_context.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32
 _gsskrb5_delete_sec_context(OM_uint32 * minor_status,
 
 OM_uint32
 _gsskrb5_delete_sec_context(OM_uint32 * minor_status,
index 4956c2d77f4ad8cf770a595471eba807ba5d0bea..93fac8d67b57d01185b1852eda4ec78f009d5d74 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: display_name.c,v 1.13 2006/11/13 18:01:36 lha Exp $");
+RCSID("$Id: display_name.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_display_name
            (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_display_name
            (OM_uint32 * minor_status,
index b0155a7fdfd07fca2996a11e6481d08b067c65f8..c0192522a72a42e3ae75ae0d104beec2db6b68dc 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: display_status.c,v 1.17 2006/11/13 18:01:38 lha Exp $");
+RCSID("$Id: display_status.c 19031 2006-11-13 18:02:57Z lha $");
 
 static const char *
 calling_error(OM_uint32 v)
 
 static const char *
 calling_error(OM_uint32 v)
index 8375257180dfed4c01fd7acc0ae32d724de46680..7337f1ab72b885db80b552f0954955aa56eb3cb0 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: duplicate_name.c,v 1.11 2006/11/13 18:01:42 lha Exp $");
+RCSID("$Id: duplicate_name.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_duplicate_name (
             OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_duplicate_name (
             OM_uint32 * minor_status,
index a015a95103d8e574e8d020b79968d9ab3a6ae250..58dcb5c9c4b241896b5ee8beff0a7349416a1d4c 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: encapsulate.c,v 1.12 2006/10/14 10:02:56 lha Exp $");
+RCSID("$Id: encapsulate.c 18459 2006-10-14 10:12:16Z lha $");
 
 void
 _gssapi_encap_length (size_t data_len,
 
 void
 _gssapi_encap_length (size_t data_len,
index 646fdafb7c4a950b2cc7acfcb7713bbec15ca240..efa45a2638bfac1e0f13e0d382183ceb1a3280eb 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: export_name.c,v 1.9 2006/11/13 18:01:50 lha Exp $");
+RCSID("$Id: export_name.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_export_name
            (OM_uint32  * minor_status,
 
 OM_uint32 _gsskrb5_export_name
            (OM_uint32  * minor_status,
index ffa671a4a14684a209e4aa15ee56fb593928a842..00218617a07b0fb479feccfdceff0c82d5f94bab 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: export_sec_context.c,v 1.12 2006/11/13 18:01:55 lha Exp $");
+RCSID("$Id: export_sec_context.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32
 _gsskrb5_export_sec_context (
 
 OM_uint32
 _gsskrb5_export_sec_context (
index bf7f64cf20e605ac96fb8ff629a27e6376c2be81..d4c1bc4db299d00d0a346ba9b3a322f1824d14dc 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5/gsskrb5_locl.h"
 #include <gssapi_mech.h>
 
 #include "krb5/gsskrb5_locl.h"
 #include <gssapi_mech.h>
 
-RCSID("$Id: external.c,v 1.23 2006/11/13 18:01:57 lha Exp $");
+RCSID("$Id: external.c 20386 2007-04-18 08:52:08Z lha $");
 
 /*
  * The implementation must reserve static storage for a
 
 /*
  * The implementation must reserve static storage for a
@@ -358,6 +358,11 @@ static gss_OID_desc gss_krb5_set_default_realm_x_desc =
 
 gss_OID GSS_KRB5_SET_DEFAULT_REALM_X = &gss_krb5_set_default_realm_x_desc;
 
 
 gss_OID GSS_KRB5_SET_DEFAULT_REALM_X = &gss_krb5_set_default_realm_x_desc;
 
+/* 1.2.752.43.13.16 */
+static gss_OID_desc gss_krb5_ccache_name_x_desc =
+{6, rk_UNCONST("\x2a\x85\x70\x2b\x0d\x10")};
+
+gss_OID GSS_KRB5_CCACHE_NAME_X = &gss_krb5_ccache_name_x_desc;
 
 /* 1.2.752.43.14.1 */
 static gss_OID_desc gss_sasl_digest_md5_mechanism_desc =
 
 /* 1.2.752.43.14.1 */
 static gss_OID_desc gss_sasl_digest_md5_mechanism_desc =
@@ -411,7 +416,8 @@ static gssapi_mech_interface_desc krb5_mech = {
     _gsskrb5_inquire_sec_context_by_oid,
     _gsskrb5_inquire_cred_by_oid,
     _gsskrb5_set_sec_context_option,
     _gsskrb5_inquire_sec_context_by_oid,
     _gsskrb5_inquire_cred_by_oid,
     _gsskrb5_set_sec_context_option,
-    _gsskrb5_set_cred_option
+    _gsskrb5_set_cred_option,
+    _gsskrb5_pseudo_random
 };
 
 gssapi_mech_interface
 };
 
 gssapi_mech_interface
index 790c9b616633f4f4353169ab8d1b6ff48e955a44..133481ffe17369834488ac8e651f54ca1a619700 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: get_mic.c,v 1.35 2006/11/13 18:02:00 lha Exp $");
+RCSID("$Id: get_mic.c 19031 2006-11-13 18:02:57Z lha $");
 
 static OM_uint32
 mic_des
 
 static OM_uint32
 mic_des
index 97e98c5e1e51553d15a985af3e4081f254b74bd0..dbfdbdf2f122669e53bf2c81b4b5fc26a75039d5 100644 (file)
@@ -2,7 +2,7 @@
 # extended gss krb5 error messages
 #
 
 # extended gss krb5 error messages
 #
 
-id "$Id: gkrb5_err.et,v 1.1 2006/11/09 23:52:17 lha Exp $"
+id "$Id: gkrb5_err.et 20049 2007-01-24 00:14:24Z lha $"
 
 error_table gk5
 
 
 error_table gk5
 
@@ -28,3 +28,4 @@ error_code KG_CONTEXT_ESTABLISHED, "Context is already fully established"
 error_code KG_BAD_SIGN_TYPE, "Unknown signature type in token"
 error_code KG_BAD_LENGTH, "Invalid field length in token"
 error_code KG_CTX_INCOMPLETE, "Attempt to use incomplete security context"
 error_code KG_BAD_SIGN_TYPE, "Unknown signature type in token"
 error_code KG_BAD_LENGTH, "Invalid field length in token"
 error_code KG_CTX_INCOMPLETE, "Attempt to use incomplete security context"
+error_code KG_INPUT_TOO_LONG, "Input too long"
index 15bd5c77daea48aa041cd304f14f0022fca1c8a7..c2239f1346258876f6db00427f46b8d033fa6c53 100644 (file)
@@ -239,12 +239,6 @@ _gsskrb5_add_cred (
        OM_uint32 */*initiator_time_rec*/,
        OM_uint32 */*acceptor_time_rec*/);
 
        OM_uint32 */*initiator_time_rec*/,
        OM_uint32 */*acceptor_time_rec*/);
 
-OM_uint32
-_gsskrb5_add_oid_set_member (
-        OM_uint32 * /*minor_status*/,
-       const gss_OID /*member_oid*/,
-       gss_OID_set * oid_set );
-
 OM_uint32
 _gsskrb5_canonicalize_name (
         OM_uint32 * /*minor_status*/,
 OM_uint32
 _gsskrb5_canonicalize_name (
         OM_uint32 * /*minor_status*/,
@@ -284,11 +278,6 @@ _gsskrb5_create_ctx (
        const gss_channel_bindings_t /*input_chan_bindings*/,
        enum gss_ctx_id_t_state /*state*/);
 
        const gss_channel_bindings_t /*input_chan_bindings*/,
        enum gss_ctx_id_t_state /*state*/);
 
-OM_uint32
-_gsskrb5_create_empty_oid_set (
-        OM_uint32 * /*minor_status*/,
-       gss_OID_set * oid_set );
-
 OM_uint32
 _gsskrb5_decapsulate (
        OM_uint32 */*minor_status*/,
 OM_uint32
 _gsskrb5_decapsulate (
        OM_uint32 */*minor_status*/,
@@ -520,6 +509,15 @@ _gsskrb5_process_context_token (
        const gss_ctx_id_t /*context_handle*/,
        const gss_buffer_t token_buffer );
 
        const gss_ctx_id_t /*context_handle*/,
        const gss_buffer_t token_buffer );
 
+OM_uint32
+_gsskrb5_pseudo_random (
+       OM_uint32 */*minor_status*/,
+       gss_ctx_id_t /*context_handle*/,
+       int /*prf_key*/,
+       const gss_buffer_t /*prf_in*/,
+       ssize_t /*desired_output_len*/,
+       gss_buffer_t /*prf_out*/);
+
 OM_uint32
 _gsskrb5_register_acceptor_identity (const char */*identity*/);
 
 OM_uint32
 _gsskrb5_register_acceptor_identity (const char */*identity*/);
 
@@ -538,11 +536,6 @@ _gsskrb5_release_name (
        OM_uint32 * /*minor_status*/,
        gss_name_t * input_name );
 
        OM_uint32 * /*minor_status*/,
        gss_name_t * input_name );
 
-OM_uint32
-_gsskrb5_release_oid_set (
-       OM_uint32 * /*minor_status*/,
-       gss_OID_set * set );
-
 OM_uint32
 _gsskrb5_seal (
        OM_uint32 * /*minor_status*/,
 OM_uint32
 _gsskrb5_seal (
        OM_uint32 * /*minor_status*/,
@@ -580,13 +573,6 @@ _gsskrb5_sign (
        gss_buffer_t /*message_buffer*/,
        gss_buffer_t message_token );
 
        gss_buffer_t /*message_buffer*/,
        gss_buffer_t message_token );
 
-OM_uint32
-_gsskrb5_test_oid_set_member (
-       OM_uint32 * /*minor_status*/,
-       const gss_OID /*member*/,
-       const gss_OID_set /*set*/,
-       int * present );
-
 OM_uint32
 _gsskrb5_unseal (
        OM_uint32 * /*minor_status*/,
 OM_uint32
 _gsskrb5_unseal (
        OM_uint32 * /*minor_status*/,
index 1983a9b8e4dd042e25ce040a8a0270725c6d92e8..6ffb6070352fc85c512375fd3509645f76c6a209 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: gsskrb5_locl.h,v 1.9 2006/11/13 18:02:03 lha Exp $ */
+/* $Id: gsskrb5_locl.h 20324 2007-04-12 16:46:01Z lha $ */
 
 #ifndef GSSKRB5_LOCL_H
 #define GSSKRB5_LOCL_H
 
 #ifndef GSSKRB5_LOCL_H
 #define GSSKRB5_LOCL_H
@@ -92,6 +92,7 @@ typedef struct {
   gss_OID_set mechanisms;
   struct krb5_ccache_data *ccache;
   HEIMDAL_MUTEX cred_id_mutex;
   gss_OID_set mechanisms;
   struct krb5_ccache_data *ccache;
   HEIMDAL_MUTEX cred_id_mutex;
+  krb5_enctype *enctypes;
 } *gsskrb5_cred;
 
 typedef struct Principal *gsskrb5_name;
 } *gsskrb5_cred;
 
 typedef struct Principal *gsskrb5_name;
index 15311b461496fc1025a50351ae66cf570d7e5272..bf31db923256a345df76246fbffb02d44e76354a 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: import_name.c,v 1.18 2006/11/13 18:02:06 lha Exp $");
+RCSID("$Id: import_name.c 19031 2006-11-13 18:02:57Z lha $");
 
 static OM_uint32
 parse_krb5_name (OM_uint32 *minor_status,
 
 static OM_uint32
 parse_krb5_name (OM_uint32 *minor_status,
index bbdc1d36d0c12d00e8f39ff9311b64103d143dec..3300036a81b32dcbce5cb8cfa2b0c249f5318f70 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: import_sec_context.c,v 1.18 2006/11/13 18:02:09 lha Exp $");
+RCSID("$Id: import_sec_context.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32
 _gsskrb5_import_sec_context (
 
 OM_uint32
 _gsskrb5_import_sec_context (
index 3827533219c827c7202702a78570f78a392260a7..eb886c24d347e4cf9e608a37866a21c4edb0d542 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: indicate_mechs.c,v 1.9 2006/10/07 22:14:56 lha Exp $");
+RCSID("$Id: indicate_mechs.c 20688 2007-05-17 18:44:31Z lha $");
 
 OM_uint32 _gsskrb5_indicate_mechs
            (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_indicate_mechs
            (OM_uint32 * minor_status,
@@ -42,14 +42,13 @@ OM_uint32 _gsskrb5_indicate_mechs
 {
   OM_uint32 ret, junk;
 
 {
   OM_uint32 ret, junk;
 
-  ret = _gsskrb5_create_empty_oid_set(minor_status, mech_set);
+  ret = gss_create_empty_oid_set(minor_status, mech_set);
   if (ret)
       return ret;
 
   if (ret)
       return ret;
 
-  ret = _gsskrb5_add_oid_set_member(minor_status,
-                                   GSS_KRB5_MECHANISM, mech_set);
+  ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, mech_set);
   if (ret) {
   if (ret) {
-      _gsskrb5_release_oid_set(&junk, mech_set);
+      gss_release_oid_set(&junk, mech_set);
       return ret;
   }
 
       return ret;
   }
 
index 3eece8e08642a2cf85901a085fee8204ad60b6e1..3bbdcc8ff1a2b2859d81de834951ded8128a2f36 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: init.c,v 1.10 2006/11/13 18:02:12 lha Exp $");
+RCSID("$Id: init.c 19031 2006-11-13 18:02:57Z lha $");
 
 static HEIMDAL_MUTEX context_mutex = HEIMDAL_MUTEX_INITIALIZER;
 static int created_key;
 
 static HEIMDAL_MUTEX context_mutex = HEIMDAL_MUTEX_INITIALIZER;
 static int created_key;
index d5f183b0baab1cb8bfe0bff66fdb90bc09468172..4d1ae0daa9f9042236e472b248a256a554f8bf9b 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: init_sec_context.c,v 1.75 2006/12/13 10:33:20 lha Exp $");
+RCSID("$Id: init_sec_context.c 20326 2007-04-12 16:49:57Z lha $");
 
 /*
  * copy the addresses from `input_chan_bindings' (if any) to
 
 /*
  * copy the addresses from `input_chan_bindings' (if any) to
@@ -391,6 +391,20 @@ init_auth
        goto failure;
 
 
        goto failure;
 
 
+    /*
+     * This is hideous glue for (NFS) clients that wants to limit the
+     * available enctypes to what it can support (encryption in
+     * kernel). If there is no enctypes selected for this credential,
+     * reset it to the default set of enctypes.
+     */
+    {
+       krb5_enctype *enctypes = NULL;
+
+       if (initiator_cred_handle && initiator_cred_handle->enctypes)
+           enctypes = initiator_cred_handle->enctypes;
+       krb5_set_default_in_tkt_etypes(context, enctypes);
+    }
+
     ret = gsskrb5_get_creds(minor_status,
                            context,
                            ccache,
     ret = gsskrb5_get_creds(minor_status,
                            context,
                            ccache,
@@ -476,11 +490,8 @@ init_auth
     if (req_flags & GSS_C_EXTENDED_ERROR_FLAG)
        flags |= GSS_C_EXTENDED_ERROR_FLAG;
 
     if (req_flags & GSS_C_EXTENDED_ERROR_FLAG)
        flags |= GSS_C_EXTENDED_ERROR_FLAG;
 
-    if (req_flags & GSS_C_CONF_FLAG)
-       flags |= GSS_C_CONF_FLAG;
-    if (req_flags & GSS_C_INTEG_FLAG)
-       flags |= GSS_C_INTEG_FLAG;
-
+    flags |= GSS_C_CONF_FLAG;
+    flags |= GSS_C_INTEG_FLAG;
     flags |= GSS_C_TRANS_FLAG;
     
     if (ret_flags)
     flags |= GSS_C_TRANS_FLAG;
     
     if (ret_flags)
index bdaa01b108680eb9b3d66933db2073bc834912e8..41430568b0056e847c0cc304676d8cc812f8ba3c 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: inquire_context.c,v 1.11 2006/11/13 18:02:18 lha Exp $");
+RCSID("$Id: inquire_context.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_inquire_context (
     OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_inquire_context (
     OM_uint32 * minor_status,
index 74018559a0b671389d91e03dbe65118815f1dff5..47bf71e686ff7639167bb2cf8aea2d69d375d545 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: inquire_cred.c,v 1.13 2006/11/13 18:02:21 lha Exp $");
+RCSID("$Id: inquire_cred.c 20688 2007-05-17 18:44:31Z lha $");
 
 OM_uint32 _gsskrb5_inquire_cred
 (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_inquire_cred
 (OM_uint32 * minor_status,
@@ -80,7 +80,7 @@ OM_uint32 _gsskrb5_inquire_cred
                                    NULL,
                                    NULL);
        if (ret == GSS_S_COMPLETE)
                                    NULL,
                                    NULL);
        if (ret == GSS_S_COMPLETE)
-           acred = (gsskrb5_cred)aqcred_init;
+           icred = (gsskrb5_cred)aqcred_init;
 
        if (icred == NULL && acred == NULL) {
            *minor_status = 0;
 
        if (icred == NULL && acred == NULL) {
            *minor_status = 0;
@@ -98,7 +98,7 @@ OM_uint32 _gsskrb5_inquire_cred
        if (icred && icred->principal != NULL) {
            gss_name_t name;
            
        if (icred && icred->principal != NULL) {
            gss_name_t name;
            
-           if (acred)
+           if (acred && acred->principal)
                name = (gss_name_t)acred->principal;
            else
                name = (gss_name_t)icred->principal;
                name = (gss_name_t)acred->principal;
            else
                name = (gss_name_t)icred->principal;
@@ -152,17 +152,17 @@ OM_uint32 _gsskrb5_inquire_cred
     }
 
     if (mechanisms != NULL) {
     }
 
     if (mechanisms != NULL) {
-        ret = _gsskrb5_create_empty_oid_set(minor_status, mechanisms);
+        ret = gss_create_empty_oid_set(minor_status, mechanisms);
         if (ret)
            goto out;
        if (acred)
         if (ret)
            goto out;
        if (acred)
-           ret = _gsskrb5_add_oid_set_member(minor_status,
-                                             &acred->mechanisms->elements[0],
-                                             mechanisms);
+           ret = gss_add_oid_set_member(minor_status,
+                                        &acred->mechanisms->elements[0],
+                                        mechanisms);
        if (ret == GSS_S_COMPLETE && icred)
        if (ret == GSS_S_COMPLETE && icred)
-           ret = _gsskrb5_add_oid_set_member(minor_status,
-                                             &icred->mechanisms->elements[0],
-                                             mechanisms);
+           ret = gss_add_oid_set_member(minor_status,
+                                        &icred->mechanisms->elements[0],
+                                        mechanisms);
         if (ret)
            goto out;
     }
         if (ret)
            goto out;
     }
index 954a5e3119c7b6a69009953fa90c3d0bf943588d..a8af2145bea8aa8ab7ae09f63c1abadb14090b13 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2003 Kungliga Tekniska Högskolan
+ * Copyright (c) 2003, 2006, 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: inquire_cred_by_mech.c,v 1.4 2006/10/07 22:15:08 lha Exp $");
+RCSID("$Id: inquire_cred_by_mech.c 20634 2007-05-09 15:33:01Z lha $");
 
 OM_uint32 _gsskrb5_inquire_cred_by_mech (
     OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_inquire_cred_by_mech (
     OM_uint32 * minor_status,
@@ -45,39 +45,32 @@ OM_uint32 _gsskrb5_inquire_cred_by_mech (
        gss_cred_usage_t * cred_usage
     )
 {
        gss_cred_usage_t * cred_usage
     )
 {
-    OM_uint32 ret;
+    gss_cred_usage_t usage;
+    OM_uint32 maj_stat;
     OM_uint32 lifetime;
 
     OM_uint32 lifetime;
 
-    if (gss_oid_equal(mech_type, GSS_C_NO_OID) == 0 &&
-       gss_oid_equal(mech_type, GSS_KRB5_MECHANISM) == 0) {
-       *minor_status = EINVAL;
-       return GSS_S_BAD_MECH;
-    }    
+    maj_stat = 
+       _gsskrb5_inquire_cred (minor_status, cred_handle,
+                              name, &lifetime, &usage, NULL);
+    if (maj_stat)
+       return maj_stat;
 
 
-    ret = _gsskrb5_inquire_cred (minor_status,
-                                cred_handle,
-                                name,
-                                &lifetime,
-                                cred_usage,
-                                NULL);
-    
-    if (ret == 0 && cred_handle != GSS_C_NO_CREDENTIAL) {
-       gsskrb5_cred cred = (gsskrb5_cred)cred_handle;
-       gss_cred_usage_t usage;
-
-       HEIMDAL_MUTEX_lock(&cred->cred_id_mutex);
-       usage = cred->usage;
-       HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
-
-       if (initiator_lifetime) {
-           if (usage == GSS_C_INITIATE || usage == GSS_C_BOTH)
-               *initiator_lifetime = lifetime;
-       }
-       if (acceptor_lifetime) {
-           if (usage == GSS_C_ACCEPT || usage == GSS_C_BOTH)
-               *acceptor_lifetime = lifetime;
-       }
+    if (initiator_lifetime) {
+       if (usage == GSS_C_INITIATE || usage == GSS_C_BOTH)
+           *initiator_lifetime = lifetime;
+       else
+           *initiator_lifetime = 0;
     }
     }
+   
+    if (acceptor_lifetime) {
+       if (usage == GSS_C_ACCEPT || usage == GSS_C_BOTH)
+           *acceptor_lifetime = lifetime;
+       else
+           *acceptor_lifetime = 0;
+    }
+
+    if (cred_usage)
+       *cred_usage = usage;
 
 
-    return ret;
+    return GSS_S_COMPLETE;
 }
 }
index 1a36896019ff3727f7b14d5c5411a457091fe74f..da50b11d934ad307514cf3195fe6460bfb2edef4 100644 (file)
@@ -32,7 +32,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: inquire_cred_by_oid.c,v 1.5 2006/11/13 18:02:24 lha Exp $");
+RCSID("$Id: inquire_cred_by_oid.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_inquire_cred_by_oid
           (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_inquire_cred_by_oid
           (OM_uint32 * minor_status,
index 5c1f082f458b0e8412698a9d3cf33b9019369c24..0ce051f19c0c9856c893e6d7e47f26166e25f33c 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: inquire_mechs_for_name.c,v 1.3 2006/10/07 22:15:13 lha Exp $");
+RCSID("$Id: inquire_mechs_for_name.c 20688 2007-05-17 18:44:31Z lha $");
 
 OM_uint32 _gsskrb5_inquire_mechs_for_name (
             OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_inquire_mechs_for_name (
             OM_uint32 * minor_status,
@@ -43,15 +43,15 @@ OM_uint32 _gsskrb5_inquire_mechs_for_name (
 {
     OM_uint32 ret;
 
 {
     OM_uint32 ret;
 
-    ret = _gsskrb5_create_empty_oid_set(minor_status, mech_types);
+    ret = gss_create_empty_oid_set(minor_status, mech_types);
     if (ret)
        return ret;
 
     if (ret)
        return ret;
 
-    ret = _gsskrb5_add_oid_set_member(minor_status,
-                                     GSS_KRB5_MECHANISM,
-                                     mech_types);
+    ret = gss_add_oid_set_member(minor_status,
+                                GSS_KRB5_MECHANISM,
+                                mech_types);
     if (ret)
     if (ret)
-       _gsskrb5_release_oid_set(NULL, mech_types);
+       gss_release_oid_set(NULL, mech_types);
 
     return ret;
 }
 
     return ret;
 }
index 5d8aefab1c14dc47a15520ef22c0ee53495c51ad..64abd3c34a9fd7c218fd27b47a35d18f1d2d89d4 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: inquire_names_for_mech.c,v 1.3 2006/10/07 22:15:15 lha Exp $");
+RCSID("$Id: inquire_names_for_mech.c 20688 2007-05-17 18:44:31Z lha $");
 
 
 static gss_OID *name_list[] = {
 
 
 static gss_OID *name_list[] = {
@@ -61,20 +61,20 @@ OM_uint32 _gsskrb5_inquire_names_for_mech (
        return GSS_S_BAD_MECH;
     }
 
        return GSS_S_BAD_MECH;
     }
 
-    ret = _gsskrb5_create_empty_oid_set(minor_status, name_types);
+    ret = gss_create_empty_oid_set(minor_status, name_types);
     if (ret != GSS_S_COMPLETE)
        return ret;
     
     for (i = 0; name_list[i] != NULL; i++) {
     if (ret != GSS_S_COMPLETE)
        return ret;
     
     for (i = 0; name_list[i] != NULL; i++) {
-       ret = _gsskrb5_add_oid_set_member(minor_status, 
-                                         *(name_list[i]),
-                                         name_types);
+       ret = gss_add_oid_set_member(minor_status, 
+                                    *(name_list[i]),
+                                    name_types);
        if (ret != GSS_S_COMPLETE)
            break;
     }
 
     if (ret != GSS_S_COMPLETE)
        if (ret != GSS_S_COMPLETE)
            break;
     }
 
     if (ret != GSS_S_COMPLETE)
-       _gsskrb5_release_oid_set(NULL, name_types);
+       gss_release_oid_set(NULL, name_types);
        
     return GSS_S_COMPLETE;
 }
        
     return GSS_S_COMPLETE;
 }
index 97e86a95c7b4f95387fc80eb69a1f42a66900ff4..5ca7536e6a39a38403bed545040251f1b82b3cc8 100644 (file)
@@ -32,7 +32,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: inquire_sec_context_by_oid.c,v 1.12 2006/11/13 18:02:27 lha Exp $");
+RCSID("$Id: inquire_sec_context_by_oid.c 19031 2006-11-13 18:02:57Z lha $");
 
 static int
 oid_prefix_equal(gss_OID oid_enc, gss_OID prefix_enc, unsigned *suffix)
 
 static int
 oid_prefix_equal(gss_OID oid_enc, gss_OID prefix_enc, unsigned *suffix)
diff --git a/source4/heimdal/lib/gssapi/krb5/prf.c b/source4/heimdal/lib/gssapi/krb5/prf.c
new file mode 100644 (file)
index 0000000..3eb90d2
--- /dev/null
@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2007 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "krb5/gsskrb5_locl.h"
+
+RCSID("$Id: prf.c 20679 2007-05-14 03:12:05Z lha $");
+
+OM_uint32
+_gsskrb5_pseudo_random(OM_uint32 *minor_status,
+                      gss_ctx_id_t context_handle,
+                      int prf_key,
+                      const gss_buffer_t prf_in,
+                      ssize_t desired_output_len,
+                      gss_buffer_t prf_out)
+{
+    gsskrb5_ctx ctx = (gsskrb5_ctx)context_handle;
+    krb5_context context;
+    krb5_error_code ret;
+    krb5_crypto crypto;
+    krb5_data input, output;
+    uint32_t num;
+    unsigned char *p;
+    krb5_keyblock *key = NULL;
+
+    if (ctx == NULL) {
+       *minor_status = 0;
+       return GSS_S_NO_CONTEXT;
+    }
+
+    if (desired_output_len <= 0) {
+       *minor_status = 0;
+       return GSS_S_FAILURE;
+    }
+
+    GSSAPI_KRB5_INIT (&context);
+
+    switch(prf_key) {
+    case GSS_C_PRF_KEY_FULL:
+       _gsskrb5i_get_acceptor_subkey(ctx, context, &key);
+    case GSS_C_PRF_KEY_PARTIAL:
+       _gsskrb5i_get_initiator_subkey(ctx, context, &key);
+       break;
+    default:
+       _gsskrb5_set_status("unknown kerberos prf_key");
+       *minor_status = 0;
+       return GSS_S_FAILURE;
+    }
+
+    if (key == NULL) {
+       _gsskrb5_set_status("no prf_key found");
+       *minor_status = 0;
+       return GSS_S_FAILURE;
+    }
+
+    ret = krb5_crypto_init(context, key, 0, &crypto);
+    krb5_free_keyblock (context, key);
+    if (ret) {
+       *minor_status = ret;
+       return GSS_S_FAILURE;
+    }
+
+    prf_out->value = malloc(desired_output_len);
+    if (prf_out->value == NULL) {
+       _gsskrb5_set_status("Out of memory");
+       *minor_status = GSS_KRB5_S_KG_INPUT_TOO_LONG;
+       krb5_crypto_destroy(context, crypto);
+       return GSS_S_FAILURE;
+    }
+    prf_out->length = desired_output_len;
+
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+
+    input.length = prf_in->length + 4;
+    input.data = malloc(prf_in->length + 4);
+    if (input.data == NULL) {
+       OM_uint32 junk;
+       _gsskrb5_set_status("Out of memory");
+       *minor_status = GSS_KRB5_S_KG_INPUT_TOO_LONG;
+       gss_release_buffer(&junk, prf_out);
+       krb5_crypto_destroy(context, crypto);
+       HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+       return GSS_S_FAILURE;
+    }
+    memcpy(((unsigned char *)input.data) + 4, prf_in->value, prf_in->length);
+
+    num = 0;
+    p = prf_out->value;
+    while(desired_output_len > 0) {
+       _gsskrb5_encode_om_uint32(num, input.data);
+       ret = krb5_crypto_prf(context, crypto, &input, &output);
+       if (ret) {
+           OM_uint32 junk;
+           *minor_status = ret;
+           free(input.data);
+           gss_release_buffer(&junk, prf_out);
+           krb5_crypto_destroy(context, crypto);
+           HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+           return GSS_S_FAILURE;
+       }
+       memcpy(p, output.data, min(desired_output_len, output.length));
+       p += output.length;
+       desired_output_len -= output.length;
+       krb5_data_free(&output);
+       num++;
+    }
+
+    krb5_crypto_destroy(context, crypto);
+
+    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+
+    return GSS_S_COMPLETE;
+}
index 411d689635e3cb6b96b70283230c492e511ff7b7..15638f57fcc5644982e42d39eb14b5a6b741d245 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: process_context_token.c,v 1.5 2006/11/13 18:02:30 lha Exp $");
+RCSID("$Id: process_context_token.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_process_context_token (
        OM_uint32          *minor_status,
 
 OM_uint32 _gsskrb5_process_context_token (
        OM_uint32          *minor_status,
index b62ad0211783c42896510481e8ad7acd7c0bd528..5dff62631ab4f86be0171336fdbac85ece521896 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: release_buffer.c,v 1.7 2006/10/07 22:15:22 lha Exp $");
+RCSID("$Id: release_buffer.c 18334 2006-10-07 22:16:04Z lha $");
 
 OM_uint32 _gsskrb5_release_buffer
            (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_release_buffer
            (OM_uint32 * minor_status,
index f6d98b29c6d4f6801bad781bcbe449b191f92829..ab5695b097b1bf9fa06fe51f1aceb694fdec1d8d 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: release_cred.c,v 1.14 2006/11/13 18:02:34 lha Exp $");
+RCSID("$Id: release_cred.c 20753 2007-05-31 22:50:06Z lha $");
 
 OM_uint32 _gsskrb5_release_cred
            (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_release_cred
            (OM_uint32 * minor_status,
@@ -42,6 +42,7 @@ OM_uint32 _gsskrb5_release_cred
 {
     krb5_context context;
     gsskrb5_cred cred;
 {
     krb5_context context;
     gsskrb5_cred cred;
+    OM_uint32 junk;
 
     *minor_status = 0;
 
 
     *minor_status = 0;
 
@@ -67,7 +68,9 @@ OM_uint32 _gsskrb5_release_cred
        else 
            krb5_cc_close(context, cred->ccache);
     }
        else 
            krb5_cc_close(context, cred->ccache);
     }
-    _gsskrb5_release_oid_set(NULL, &cred->mechanisms);
+    gss_release_oid_set(&junk, &cred->mechanisms);
+    if (cred->enctypes)
+       free(cred->enctypes);
     HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
     HEIMDAL_MUTEX_destroy(&cred->cred_id_mutex);
     memset(cred, 0, sizeof(*cred));
     HEIMDAL_MUTEX_unlock(&cred->cred_id_mutex);
     HEIMDAL_MUTEX_destroy(&cred->cred_id_mutex);
     memset(cred, 0, sizeof(*cred));
index cc9c0934f75e1370c578d7cea2c2fef3dd205560..a01a9a2a62b3fbed5bc6d721e98f82e2dd5ed055 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: release_name.c,v 1.11 2006/11/13 18:02:37 lha Exp $");
+RCSID("$Id: release_name.c 19031 2006-11-13 18:02:57Z lha $");
 
 OM_uint32 _gsskrb5_release_name
            (OM_uint32 * minor_status,
 
 OM_uint32 _gsskrb5_release_name
            (OM_uint32 * minor_status,
diff --git a/source4/heimdal/lib/gssapi/krb5/release_oid_set.c b/source4/heimdal/lib/gssapi/krb5/release_oid_set.c
deleted file mode 100644 (file)
index a9f79a3..0000000
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright (c) 1997 - 2000, 2003 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden). 
- * All rights reserved. 
- *
- * Redistribution and use in source and binary forms, with or without 
- * modification, are permitted provided that the following conditions 
- * are met: 
- *
- * 1. Redistributions of source code must retain the above copyright 
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright 
- *    notice, this list of conditions and the following disclaimer in the 
- *    documentation and/or other materials provided with the distribution. 
- *
- * 3. Neither the name of the Institute nor the names of its contributors 
- *    may be used to endorse or promote products derived from this software 
- *    without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
- * SUCH DAMAGE. 
- */
-
-#include "krb5/gsskrb5_locl.h"
-
-RCSID("$Id: release_oid_set.c,v 1.7 2006/10/07 22:15:30 lha Exp $");
-
-OM_uint32 _gsskrb5_release_oid_set
-           (OM_uint32 * minor_status,
-            gss_OID_set * set
-           )
-{
-  if (minor_status)
-      *minor_status = 0;
-  free ((*set)->elements);
-  free (*set);
-  *set = GSS_C_NO_OID_SET;
-  return GSS_S_COMPLETE;
-}
index 3014edd04dee3b60be17656705c377619d25940f..677a3c8d0778ea538028d70c50518f77912072fe 100755 (executable)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: sequence.c,v 1.8 2006/10/07 22:15:32 lha Exp $");
+RCSID("$Id: sequence.c 18334 2006-10-07 22:16:04Z lha $");
 
 #define DEFAULT_JITTER_WINDOW 20
 
 
 #define DEFAULT_JITTER_WINDOW 20
 
index 849760ee4a6e5d3d158c4109736cf28be3404b91..d0ca1c4d95ddf779ebc3969a2c02a0669c2d24c0 100644 (file)
@@ -32,7 +32,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: set_cred_option.c,v 1.5 2006/11/13 18:02:39 lha Exp $");
+RCSID("$Id: set_cred_option.c 20325 2007-04-12 16:49:17Z lha $");
 
 static gss_OID_desc gss_krb5_import_cred_x_oid_desc =
 {9, (void *)"\x2b\x06\x01\x04\x01\xa9\x4a\x13\x04"}; /* XXX */
 
 static gss_OID_desc gss_krb5_import_cred_x_oid_desc =
 {9, (void *)"\x2b\x06\x01\x04\x01\xa9\x4a\x13\x04"}; /* XXX */
@@ -130,6 +130,78 @@ out:
 }
 
 
 }
 
 
+static OM_uint32
+allowed_enctypes(OM_uint32 *minor_status,
+                krb5_context context,
+                gss_cred_id_t *cred_handle,
+                const gss_buffer_t value)
+{
+    OM_uint32 major_stat;
+    krb5_error_code ret;
+    size_t len, i;
+    krb5_enctype *enctypes = NULL;
+    krb5_storage *sp = NULL;
+    gsskrb5_cred cred;
+
+    if (cred_handle == NULL || *cred_handle == GSS_C_NO_CREDENTIAL) {
+       *minor_status = 0;
+       return GSS_S_FAILURE;
+    }
+
+    cred = (gsskrb5_cred)*cred_handle;
+
+    if ((value->length % 4) != 0) {
+       *minor_status = 0;
+       major_stat = GSS_S_FAILURE;
+       goto out;
+    }
+
+    len = value->length / 4;
+    enctypes = malloc((len + 1) * 4);
+    if (enctypes == NULL) {
+       *minor_status = ENOMEM;
+       major_stat = GSS_S_FAILURE;
+       goto out;
+    }
+
+    sp = krb5_storage_from_mem(value->value, value->length);
+    if (sp == NULL) {
+       *minor_status = ENOMEM;
+       major_stat = GSS_S_FAILURE;
+       goto out;
+    }
+
+    for (i = 0; i < len; i++) {
+       uint32_t e;
+
+       ret = krb5_ret_uint32(sp, &e);
+       if (ret) {
+           *minor_status = ret;
+           major_stat =  GSS_S_FAILURE;
+           goto out;
+       }
+       enctypes[i] = e;
+    }
+    enctypes[i] = 0;
+
+    if (cred->enctypes)
+       free(cred->enctypes);
+    cred->enctypes = enctypes;
+
+    krb5_storage_free(sp);
+
+    return GSS_S_COMPLETE;
+
+out:
+    if (sp)
+       krb5_storage_free(sp);
+    if (enctypes)
+       free(enctypes);
+
+    return major_stat;
+}
+
+
 OM_uint32
 _gsskrb5_set_cred_option
            (OM_uint32 *minor_status,
 OM_uint32
 _gsskrb5_set_cred_option
            (OM_uint32 *minor_status,
@@ -146,9 +218,11 @@ _gsskrb5_set_cred_option
        return GSS_S_FAILURE;
     }
 
        return GSS_S_FAILURE;
     }
 
-    if (gss_oid_equal(desired_object, GSS_KRB5_IMPORT_CRED_X)) {
+    if (gss_oid_equal(desired_object, GSS_KRB5_IMPORT_CRED_X))
        return import_cred(minor_status, context, cred_handle, value);
        return import_cred(minor_status, context, cred_handle, value);
-    }
+
+    if (gss_oid_equal(desired_object, GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X))
+       return allowed_enctypes(minor_status, context, cred_handle, value);
 
     *minor_status = EINVAL;
     return GSS_S_FAILURE;
 
     *minor_status = EINVAL;
     return GSS_S_FAILURE;
index 4a5f60ce94221c0ef58a95c3f4aa0b3462a99925..50441a11ad3cb88c5c4eecfc29c859c7639404c6 100644 (file)
@@ -36,7 +36,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: set_sec_context_option.c,v 1.10 2006/12/14 11:02:16 lha Exp $");
+RCSID("$Id: set_sec_context_option.c 20384 2007-04-18 08:51:06Z lha $");
 
 static OM_uint32
 get_bool(OM_uint32 *minor_status,
 
 static OM_uint32
 get_bool(OM_uint32 *minor_status,
@@ -51,6 +51,25 @@ get_bool(OM_uint32 *minor_status,
     return GSS_S_COMPLETE;
 }
 
     return GSS_S_COMPLETE;
 }
 
+static OM_uint32
+get_string(OM_uint32 *minor_status,
+          const gss_buffer_t value,
+          char **str)
+{
+    if (value == NULL || value->length == 0) {
+       *str = NULL;
+    } else {
+       *str = malloc(value->length + 1);
+       if (*str == NULL) {
+           *minor_status = 0;
+           return GSS_S_UNAVAILABLE;
+       }
+       memcpy(*str, value->value, value->length);
+       (*str)[value->length] = '\0';
+    }
+    return GSS_S_COMPLETE;
+}
+
 OM_uint32
 _gsskrb5_set_sec_context_option
            (OM_uint32 *minor_status,
 OM_uint32
 _gsskrb5_set_sec_context_option
            (OM_uint32 *minor_status,
@@ -103,17 +122,9 @@ _gsskrb5_set_sec_context_option
     } else if (gss_oid_equal(desired_object, GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X)) {
        char *str;
 
     } else if (gss_oid_equal(desired_object, GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X)) {
        char *str;
 
-       if (value == NULL || value->length == 0) {
-           str = NULL;
-       } else {
-           str = malloc(value->length + 1);
-           if (str) {
-               *minor_status = 0;
-               return GSS_S_UNAVAILABLE;
-           }
-           memcpy(str, value->value, value->length);
-           str[value->length] = '\0';
-       }
+       maj_stat = get_string(minor_status, value, &str);
+       if (maj_stat != GSS_S_COMPLETE)
+           return maj_stat;
 
        _gsskrb5_register_acceptor_identity(str);
        free(str);
 
        _gsskrb5_register_acceptor_identity(str);
        free(str);
@@ -124,17 +135,13 @@ _gsskrb5_set_sec_context_option
     } else if (gss_oid_equal(desired_object, GSS_KRB5_SET_DEFAULT_REALM_X)) {
        char *str;
 
     } else if (gss_oid_equal(desired_object, GSS_KRB5_SET_DEFAULT_REALM_X)) {
        char *str;
 
-       if (value == NULL || value->length == 0) {
-           *minor_status = 0;
-           return GSS_S_CALL_INACCESSIBLE_READ;
-       }
-       str = malloc(value->length + 1);
+       maj_stat = get_string(minor_status, value, &str);
+       if (maj_stat != GSS_S_COMPLETE)
+           return maj_stat;
        if (str == NULL) {
            *minor_status = 0;
        if (str == NULL) {
            *minor_status = 0;
-           return GSS_S_UNAVAILABLE;
+           return GSS_S_CALL_INACCESSIBLE_READ;
        }
        }
-       memcpy(str, value->value, value->length);
-       str[value->length] = '\0';
 
        krb5_set_default_realm(context, str);
        free(str);
 
        krb5_set_default_realm(context, str);
        free(str);
@@ -161,8 +168,24 @@ _gsskrb5_set_sec_context_option
 
        *minor_status = 0;
        return GSS_S_COMPLETE;
 
        *minor_status = 0;
        return GSS_S_COMPLETE;
-    }
+    } else if (gss_oid_equal(desired_object, GSS_KRB5_CCACHE_NAME_X)) {
+       char *str;
+
+       maj_stat = get_string(minor_status, value, &str);
+       if (maj_stat != GSS_S_COMPLETE)
+           return maj_stat;
+       if (str == NULL) {
+           *minor_status = 0;
+           return GSS_S_CALL_INACCESSIBLE_READ;
+       }
 
 
+       *minor_status = krb5_cc_set_default_name(context, str);
+       free(str);
+       if (*minor_status)
+           return GSS_S_FAILURE;
+
+       return GSS_S_COMPLETE;
+    }
 
     *minor_status = EINVAL;
     return GSS_S_FAILURE;
 
     *minor_status = EINVAL;
     return GSS_S_FAILURE;
index 3dd7618561578951e5964549b915f085de485217..d0a33d86fbfcbde2b15b7f068b31286138f8fb74 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: unwrap.c,v 1.39 2006/11/13 18:02:51 lha Exp $");
+RCSID("$Id: unwrap.c 19031 2006-11-13 18:02:57Z lha $");
 
 static OM_uint32
 unwrap_des
 
 static OM_uint32
 unwrap_des
index 29b3a7f4bb37aaf5e2f2a5073e91104b6e6c5c68..52381afcc28ae9fc11645ca1119df452c0667432 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: verify_mic.c,v 1.37 2006/11/13 18:02:54 lha Exp $");
+RCSID("$Id: verify_mic.c 19031 2006-11-13 18:02:57Z lha $");
 
 static OM_uint32
 verify_mic_des
 
 static OM_uint32
 verify_mic_des
index 79cfb48ed2a8f71ab3295150662c0784adab9a5c..d41379870ae90976023c661c0a317ba91a4de65f 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5/gsskrb5_locl.h"
 
 
 #include "krb5/gsskrb5_locl.h"
 
-RCSID("$Id: wrap.c,v 1.39 2006/11/14 09:49:56 lha Exp $");
+RCSID("$Id: wrap.c 19035 2006-11-14 09:49:56Z lha $");
 
 /*
  * Return initiator subkey, or if that doesn't exists, the subkey.
 
 /*
  * Return initiator subkey, or if that doesn't exists, the subkey.
diff --git a/source4/heimdal/lib/gssapi/mech/context.c b/source4/heimdal/lib/gssapi/mech/context.c
new file mode 100644 (file)
index 0000000..1691fd9
--- /dev/null
@@ -0,0 +1,141 @@
+#include "mech/mech_locl.h"
+#include "heim_threads.h"
+
+RCSID("$Id: context.c 19924 2007-01-16 10:17:01Z lha $");
+
+struct mg_thread_ctx {
+    gss_OID mech;
+    OM_uint32 maj_stat;
+    OM_uint32 min_stat;
+    gss_buffer_desc maj_error;
+    gss_buffer_desc min_error;
+};
+
+static HEIMDAL_MUTEX context_mutex = HEIMDAL_MUTEX_INITIALIZER;
+static int created_key;
+static HEIMDAL_thread_key context_key;
+
+
+static void
+destroy_context(void *ptr)
+{
+    struct mg_thread_ctx *mg = ptr;
+    OM_uint32 junk;
+
+    if (mg == NULL)
+       return;
+
+    gss_release_buffer(&junk, &mg->maj_error);
+    gss_release_buffer(&junk, &mg->min_error);
+    free(mg);
+}
+
+
+static struct mg_thread_ctx *
+_gss_mechglue_thread(void)
+{
+    struct mg_thread_ctx *ctx;
+    int ret = 0;
+
+    HEIMDAL_MUTEX_lock(&context_mutex);
+
+    if (!created_key) {
+       HEIMDAL_key_create(&context_key, destroy_context, ret);
+       if (ret) {
+           HEIMDAL_MUTEX_unlock(&context_mutex);
+           return NULL;
+       }
+       created_key = 1;
+    }
+    HEIMDAL_MUTEX_unlock(&context_mutex);
+
+    ctx = HEIMDAL_getspecific(context_key);
+    if (ctx == NULL) {
+
+       ctx = calloc(1, sizeof(*ctx));
+       if (ctx == NULL)
+           return NULL;
+       HEIMDAL_setspecific(context_key, ctx, ret);
+       if (ret) {
+           free(ctx);
+           return NULL;
+       }
+    }
+    return ctx;
+}
+
+OM_uint32
+_gss_mg_get_error(const gss_OID mech, OM_uint32 type,
+                 OM_uint32 value, gss_buffer_t string)
+{
+    struct mg_thread_ctx *mg;
+
+    mg = _gss_mechglue_thread();
+    if (mg == NULL)
+       return GSS_S_BAD_STATUS;
+
+    if (mech != NULL && gss_oid_equal(mg->mech, mech) == 0)
+       return GSS_S_BAD_STATUS;
+
+    switch (type) {
+    case GSS_C_GSS_CODE: {
+       if (value != mg->maj_stat)
+           break;
+       string->value = malloc(mg->maj_error.length);
+       string->length = mg->maj_error.length;
+       memcpy(string->value, mg->maj_error.value, mg->maj_error.length);
+       return GSS_S_COMPLETE;
+    }
+    case GSS_C_MECH_CODE: {
+       if (value != mg->min_stat)
+           break;
+       string->value = malloc(mg->min_error.length);
+       string->length = mg->min_error.length;
+       memcpy(string->value, mg->min_error.value, mg->min_error.length);
+       return GSS_S_COMPLETE;
+    }
+    }
+    string->value = NULL;
+    string->length = 0;
+    return GSS_S_BAD_STATUS;
+}
+
+void
+_gss_mg_error(gssapi_mech_interface m, OM_uint32 maj, OM_uint32 min)
+{
+    OM_uint32 major_status, minor_status;
+    OM_uint32 message_content;
+    struct mg_thread_ctx *mg;
+
+    mg = _gss_mechglue_thread();
+    if (mg == NULL)
+       return;
+
+    gss_release_buffer(&minor_status, &mg->maj_error);
+    gss_release_buffer(&minor_status, &mg->min_error);
+
+    mg->mech = &m->gm_mech_oid;
+    mg->maj_stat = maj;
+    mg->min_stat = min;
+
+    major_status = m->gm_display_status(&minor_status,
+                                       maj, 
+                                       GSS_C_GSS_CODE,
+                                       &m->gm_mech_oid,
+                                       &message_content,
+                                       &mg->maj_error);
+    if (GSS_ERROR(major_status)) {
+       mg->maj_error.value = NULL;
+       mg->maj_error.length = 0;
+    }
+    major_status = m->gm_display_status(&minor_status,
+                                       min, 
+                                       GSS_C_MECH_CODE,
+                                       &m->gm_mech_oid,
+                                       &message_content,
+                                       &mg->min_error);
+    if (GSS_ERROR(major_status)) {
+       mg->min_error.value = NULL;
+       mg->min_error.length = 0;
+    }
+}
index 7a215dd7d8f94938220fe2a39961625748d37811..24e529864d6116a55d2e222893b3b0c8480aad96 100644 (file)
@@ -24,7 +24,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/context.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/context.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
- *     $Id: context.h,v 1.2 2006/06/28 09:00:25 lha Exp $
+ *     $Id: context.h 19925 2007-01-16 10:19:27Z lha $
  */
 
 #include <gssapi_mech.h>
  */
 
 #include <gssapi_mech.h>
@@ -33,3 +33,9 @@ struct _gss_context {
        gssapi_mech_interface   gc_mech;
        gss_ctx_id_t            gc_ctx;
 };
        gssapi_mech_interface   gc_mech;
        gss_ctx_id_t            gc_ctx;
 };
+
+void
+_gss_mg_error(gssapi_mech_interface, OM_uint32, OM_uint32);
+
+OM_uint32
+_gss_mg_get_error(const gss_OID, OM_uint32, OM_uint32, gss_buffer_t);
index df89e797279b6f1db015c5aa27ebe7ed0f502514..7f77b8a68e2efe9a77e71bef1ffd660c9aeb9e64 100644 (file)
@@ -24,7 +24,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/cred.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/cred.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
- *     $Id: cred.h,v 1.3 2006/10/05 18:26:54 lha Exp $
+ *     $Id: cred.h 20626 2007-05-08 13:56:49Z lha $
  */
 
 struct _gss_mechanism_cred {
  */
 
 struct _gss_mechanism_cred {
@@ -36,7 +36,6 @@ struct _gss_mechanism_cred {
 SLIST_HEAD(_gss_mechanism_cred_list, _gss_mechanism_cred);
 
 struct _gss_cred {
 SLIST_HEAD(_gss_mechanism_cred_list, _gss_mechanism_cred);
 
 struct _gss_cred {
-       gss_cred_usage_t gc_usage;
        struct _gss_mechanism_cred_list gc_mc;
 };
 
        struct _gss_mechanism_cred_list gc_mc;
 };
 
index 7df8a3483eabbfa57ee8f19490c27ae538558808..8c5f4d0b08e107599c769a1936bff0dfa949a2da 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_accept_sec_context.c,v 1.9 2006/12/15 20:12:20 lha Exp $");
+RCSID("$Id: gss_accept_sec_context.c 20626 2007-05-08 13:56:49Z lha $");
 
 static OM_uint32
 parse_header(const gss_buffer_t input_token, gss_OID mech_oid)
 
 static OM_uint32
 parse_header(const gss_buffer_t input_token, gss_OID mech_oid)
@@ -127,10 +127,10 @@ choose_mech(const gss_buffer_t input, gss_OID mech_oid)
                return GSS_S_COMPLETE;
        } else if (input->length == 0) {
                /* 
                return GSS_S_COMPLETE;
        } else if (input->length == 0) {
                /* 
-                * There is the a wiered mode of SPNEGO (in CIFS and
+                * There is the a wierd mode of SPNEGO (in CIFS and
                 * SASL GSS-SPENGO where the first token is zero
                 * length and the acceptor returns a mech_list, lets
                 * SASL GSS-SPENGO where the first token is zero
                 * length and the acceptor returns a mech_list, lets
-                * home that is what is happening now.
+                * hope that is what is happening now.
                 */
                *mech_oid = spnego_mechanism;
                return GSS_S_COMPLETE;
                 */
                *mech_oid = spnego_mechanism;
                return GSS_S_COMPLETE;
@@ -161,13 +161,18 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
        int allocated_ctx;
 
        *minor_status = 0;
        int allocated_ctx;
 
        *minor_status = 0;
-       if (src_name) *src_name = 0;
-       if (mech_type) *mech_type = 0;
-       if (ret_flags) *ret_flags = 0;
-       if (time_rec) *time_rec = 0;
-       if (delegated_cred_handle) *delegated_cred_handle = 0;
-       output_token->length = 0;
-       output_token->value = 0;
+       if (src_name)
+           *src_name = GSS_C_NO_NAME;
+       if (mech_type)
+           *mech_type = GSS_C_NO_OID;
+       if (ret_flags)
+           *ret_flags = 0;
+       if (time_rec)
+           *time_rec = 0;
+       if (delegated_cred_handle)
+           *delegated_cred_handle = GSS_C_NO_CREDENTIAL;
+       _mg_buffer_zero(output_token);
+
 
        /*
         * If this is the first call (*context_handle is NULL), we must
 
        /*
         * If this is the first call (*context_handle is NULL), we must
@@ -227,7 +232,10 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
            &delegated_mc);
        if (major_status != GSS_S_COMPLETE &&
            major_status != GSS_S_CONTINUE_NEEDED)
            &delegated_mc);
        if (major_status != GSS_S_COMPLETE &&
            major_status != GSS_S_CONTINUE_NEEDED)
+       {
+               _gss_mg_error(m, major_status, *minor_status);
                return (major_status);
                return (major_status);
+       }
 
        if (!src_name) {
                m->gm_release_name(minor_status, &src_mn);
 
        if (!src_name) {
                m->gm_release_name(minor_status, &src_mn);
@@ -264,8 +272,6 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
                                *minor_status = ENOMEM;
                                return (GSS_S_FAILURE);
                        }
                                *minor_status = ENOMEM;
                                return (GSS_S_FAILURE);
                        }
-                       m->gm_inquire_cred(minor_status, delegated_mc,
-                           0, 0, &dcred->gc_usage, 0);
                        dmc->gmc_mech = m;
                        dmc->gmc_mech_oid = &m->gm_mech_oid;
                        dmc->gmc_cred = delegated_mc;
                        dmc->gmc_mech = m;
                        dmc->gmc_mech_oid = &m->gm_mech_oid;
                        dmc->gmc_cred = delegated_mc;
index 0b3554c0fa3d00929eadc27b3ae44d2bac72659c..d6e448a223a8833b1ca1f6eb138773a34569f3d7 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_acquire_cred.c,v 1.4 2006/10/25 00:44:55 lha Exp $");
+RCSID("$Id: gss_acquire_cred.c 20626 2007-05-08 13:56:49Z lha $");
 
 OM_uint32
 gss_acquire_cred(OM_uint32 *minor_status,
 
 OM_uint32
 gss_acquire_cred(OM_uint32 *minor_status,
@@ -49,6 +49,14 @@ gss_acquire_cred(OM_uint32 *minor_status,
        OM_uint32 min_time, cred_time;
        int i;
 
        OM_uint32 min_time, cred_time;
        int i;
 
+       *minor_status = 0;
+       if (actual_mechs)
+           *output_cred_handle = GSS_C_NO_CREDENTIAL;
+       if (actual_mechs)
+           *actual_mechs = GSS_C_NO_OID_SET;
+       if (time_rec)
+           *time_rec = 0;
+
        _gss_load_mech();
 
        /*
        _gss_load_mech();
 
        /*
@@ -64,7 +72,6 @@ gss_acquire_cred(OM_uint32 *minor_status,
                                break;
                }
                if (i == mechs->count) {
                                break;
                }
                if (i == mechs->count) {
-                       *output_cred_handle = 0;
                        *minor_status = 0;
                        return (GSS_S_BAD_MECH);
                }
                        *minor_status = 0;
                        return (GSS_S_BAD_MECH);
                }
@@ -84,7 +91,6 @@ gss_acquire_cred(OM_uint32 *minor_status,
                *minor_status = ENOMEM;
                return (GSS_S_FAILURE);
        }
                *minor_status = ENOMEM;
                return (GSS_S_FAILURE);
        }
-       cred->gc_usage = cred_usage;
        SLIST_INIT(&cred->gc_mc);
 
        if (mechs == GSS_C_NO_OID_SET)
        SLIST_INIT(&cred->gc_mc);
 
        if (mechs == GSS_C_NO_OID_SET)
@@ -109,7 +115,6 @@ gss_acquire_cred(OM_uint32 *minor_status,
                if (!mc) {
                        continue;
                }
                if (!mc) {
                        continue;
                }
-               SLIST_INIT(&cred->gc_mc);
                mc->gmc_mech = m;
                mc->gmc_mech_oid = &m->gm_mech_oid;
 
                mc->gmc_mech = m;
                mc->gmc_mech_oid = &m->gm_mech_oid;
 
@@ -151,7 +156,6 @@ gss_acquire_cred(OM_uint32 *minor_status,
                free(cred);
                if (actual_mechs)
                        gss_release_oid_set(minor_status, actual_mechs);
                free(cred);
                if (actual_mechs)
                        gss_release_oid_set(minor_status, actual_mechs);
-               *output_cred_handle = 0;
                *minor_status = 0;
                return (GSS_S_NO_CRED);
        }
                *minor_status = 0;
                return (GSS_S_NO_CRED);
        }
index beffd54e29e1d92e30b9dd67700a48cbafc315be..4947c5c30edcdf3ac691fd7c3a7f1bb7d9d9cd92 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_add_cred.c,v 1.3 2006/06/29 08:23:53 lha Exp $");
+RCSID("$Id: gss_add_cred.c 20626 2007-05-08 13:56:49Z lha $");
 
 static struct _gss_mechanism_cred *
 _gss_copy_cred(struct _gss_mechanism_cred *mc)
 
 static struct _gss_mechanism_cred *
 _gss_copy_cred(struct _gss_mechanism_cred *mc)
@@ -43,8 +43,10 @@ _gss_copy_cred(struct _gss_mechanism_cred *mc)
        major_status = m->gm_inquire_cred_by_mech(&minor_status,
            mc->gmc_cred, mc->gmc_mech_oid,
            &name, &initiator_lifetime, &acceptor_lifetime, &cred_usage);
        major_status = m->gm_inquire_cred_by_mech(&minor_status,
            mc->gmc_cred, mc->gmc_mech_oid,
            &name, &initiator_lifetime, &acceptor_lifetime, &cred_usage);
-       if (major_status)
+       if (major_status) {
+               _gss_mg_error(m, major_status, minor_status);
                return (0);
                return (0);
+       }
 
        major_status = m->gm_add_cred(&minor_status,
            GSS_C_NO_CREDENTIAL, name, mc->gmc_mech_oid,
 
        major_status = m->gm_add_cred(&minor_status,
            GSS_C_NO_CREDENTIAL, name, mc->gmc_mech_oid,
@@ -52,8 +54,10 @@ _gss_copy_cred(struct _gss_mechanism_cred *mc)
            &cred, 0, 0, 0);
        m->gm_release_name(&minor_status, &name);
 
            &cred, 0, 0, 0);
        m->gm_release_name(&minor_status, &name);
 
-       if (major_status)
+       if (major_status) {
+               _gss_mg_error(m, major_status, minor_status);
                return (0);
                return (0);
+       }
 
        new_mc = malloc(sizeof(struct _gss_mechanism_cred));
        if (!new_mc) {
 
        new_mc = malloc(sizeof(struct _gss_mechanism_cred));
        if (!new_mc) {
@@ -89,15 +93,20 @@ gss_add_cred(OM_uint32 *minor_status,
        struct _gss_mechanism_name *mn;
        OM_uint32 junk;
 
        struct _gss_mechanism_name *mn;
        OM_uint32 junk;
 
-       *output_cred_handle = 0;
        *minor_status = 0;
        *minor_status = 0;
+       *output_cred_handle = GSS_C_NO_CREDENTIAL;
+       if (initiator_time_rec)
+           *initiator_time_rec = 0;
+       if (acceptor_time_rec)
+           *acceptor_time_rec = 0;
+       if (actual_mechs)
+           *actual_mechs = GSS_C_NO_OID_SET;
 
        new_cred = malloc(sizeof(struct _gss_cred));
        if (!new_cred) {
                *minor_status = ENOMEM;
                return (GSS_S_FAILURE);
        }
 
        new_cred = malloc(sizeof(struct _gss_cred));
        if (!new_cred) {
                *minor_status = ENOMEM;
                return (GSS_S_FAILURE);
        }
-       new_cred->gc_usage = cred_usage;
        SLIST_INIT(&new_cred->gc_mc);
 
        /*
        SLIST_INIT(&new_cred->gc_mc);
 
        /*
@@ -162,6 +171,7 @@ gss_add_cred(OM_uint32 *minor_status,
            acceptor_time_rec);
 
        if (major_status) {
            acceptor_time_rec);
 
        if (major_status) {
+               _gss_mg_error(m, major_status, *minor_status);
                release_cred = (gss_cred_id_t)new_cred;
                gss_release_cred(&junk, &release_cred);
                free(mc);
                release_cred = (gss_cred_id_t)new_cred;
                gss_release_cred(&junk, &release_cred);
                free(mc);
index 5806cec0095aac297011ac081a85a23ffd9df6c2..87d1ab3725e48e46f3c96f8c7987250a13bff081 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_add_oid_set_member.c,v 1.3 2006/10/22 09:36:13 lha Exp $");
+RCSID("$Id: gss_add_oid_set_member.c 18817 2006-10-22 09:36:13Z lha $");
 
 OM_uint32
 gss_add_oid_set_member (OM_uint32 * minor_status,
 
 OM_uint32
 gss_add_oid_set_member (OM_uint32 * minor_status,
index 9e9bd5e790b71a3fdc126cedc0e4c9939d63aa9b..56e003937972f700cf487bcfccd850bd2284f1e5 100644 (file)
@@ -31,7 +31,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_buffer_set.c,v 1.2 2006/10/24 21:53:02 lha Exp $");
+RCSID("$Id: gss_buffer_set.c 18885 2006-10-24 21:53:02Z lha $");
 
 OM_uint32 
 gss_create_empty_buffer_set
 
 OM_uint32 
 gss_create_empty_buffer_set
index 38a464be4683a17cd30de110a0a100c40356fdee..1437a9bc7b50b6fe7e53e74c8d9a93f5381079ea 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_canonicalize_name.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_canonicalize_name.c 19928 2007-01-16 10:37:54Z lha $");
 
 OM_uint32
 gss_canonicalize_name(OM_uint32 *minor_status,
 
 OM_uint32
 gss_canonicalize_name(OM_uint32 *minor_status,
@@ -52,8 +52,10 @@ gss_canonicalize_name(OM_uint32 *minor_status,
        m = mn->gmn_mech;
        major_status = m->gm_canonicalize_name(minor_status,
            mn->gmn_name, mech_type, &new_canonical_name);
        m = mn->gmn_mech;
        major_status = m->gm_canonicalize_name(minor_status,
            mn->gmn_name, mech_type, &new_canonical_name);
-       if (major_status)
+       if (major_status) {
+               _gss_mg_error(m, major_status, *minor_status);
                return (major_status);
                return (major_status);
+       }
 
        /*
         * Now we make a new name and mark it as an MN.
 
        /*
         * Now we make a new name and mark it as an MN.
index 1068bfabf6e840cf51d2167c3e0f68b13cfd362f..147ad60c94ef0a5cfe8372342eb642defb29487c 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_compare_name.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_compare_name.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_compare_name(OM_uint32 *minor_status,
 
 OM_uint32
 gss_compare_name(OM_uint32 *minor_status,
index 4b17381776b1eb7f932c6daec6b1dccfd50419b2..47999f35cfa556a848cdc2449913f8c03cd4fa65 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_context_time.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_context_time.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_context_time(OM_uint32 *minor_status,
 
 OM_uint32
 gss_context_time(OM_uint32 *minor_status,
index 7298ec9e83a9d5662b11748a83c6b77d1a70db3f..841271b1fd98552fcfb37b13b2a08723e9e3ce4a 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_create_empty_oid_set.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_create_empty_oid_set.c 19951 2007-01-17 10:14:58Z lha $");
 
 OM_uint32
 gss_create_empty_oid_set(OM_uint32 *minor_status,
 
 OM_uint32
 gss_create_empty_oid_set(OM_uint32 *minor_status,
@@ -36,7 +36,7 @@ gss_create_empty_oid_set(OM_uint32 *minor_status,
        gss_OID_set set;
 
        *minor_status = 0;
        gss_OID_set set;
 
        *minor_status = 0;
-       *oid_set = 0;
+       *oid_set = GSS_C_NO_OID_SET;
 
        set = malloc(sizeof(gss_OID_set_desc));
        if (!set) {
 
        set = malloc(sizeof(gss_OID_set_desc));
        if (!set) {
index 8ebb8481882e55979ae0d72eddacc67bbf8b63bc..e8b86e4d228fc8b660f866033b349abc19a4964f 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_decapsulate_token.c,v 1.2 2006/10/14 10:04:45 lha Exp $");
+RCSID("$Id: gss_decapsulate_token.c 19951 2007-01-17 10:14:58Z lha $");
 
 OM_uint32
 gss_decapsulate_token(gss_buffer_t input_token,
 
 OM_uint32
 gss_decapsulate_token(gss_buffer_t input_token,
@@ -45,8 +45,7 @@ gss_decapsulate_token(gss_buffer_t input_token,
     int ret;
     size_t size;
 
     int ret;
     size_t size;
 
-    output_token->length = 0;
-    output_token->value = NULL;
+    _mg_buffer_zero(output_token);
 
     ret = der_get_oid (oid->elements, oid->length, &o, &size);
     if (ret)
 
     ret = der_get_oid (oid->elements, oid->length, &o, &size);
     if (ret)
index 06ef8e6d09ba751d520f578a9e5670e115f12a70..8c4099473915808351bff7fa4112ea5e41f25204 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_delete_sec_context.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_delete_sec_context.c 19951 2007-01-17 10:14:58Z lha $");
 
 OM_uint32
 gss_delete_sec_context(OM_uint32 *minor_status,
 
 OM_uint32
 gss_delete_sec_context(OM_uint32 *minor_status,
@@ -37,6 +37,9 @@ gss_delete_sec_context(OM_uint32 *minor_status,
        OM_uint32 major_status;
        struct _gss_context *ctx = (struct _gss_context *) *context_handle;
 
        OM_uint32 major_status;
        struct _gss_context *ctx = (struct _gss_context *) *context_handle;
 
+       if (output_token)
+           _mg_buffer_zero(output_token);
+
        *minor_status = 0;
        if (ctx) {
                /*
        *minor_status = 0;
        if (ctx) {
                /*
@@ -46,12 +49,9 @@ gss_delete_sec_context(OM_uint32 *minor_status,
                if (ctx->gc_ctx) {
                        major_status = ctx->gc_mech->gm_delete_sec_context(
                                minor_status, &ctx->gc_ctx, output_token);
                if (ctx->gc_ctx) {
                        major_status = ctx->gc_mech->gm_delete_sec_context(
                                minor_status, &ctx->gc_ctx, output_token);
-               } else if (output_token != GSS_C_NO_BUFFER) {
-                       output_token->length = 0;
-                       output_token->value = 0;
                }
                free(ctx);
                }
                free(ctx);
-               *context_handle = 0;
+               *context_handle = GSS_C_NO_CONTEXT;
        }
 
        return (GSS_S_COMPLETE);
        }
 
        return (GSS_S_COMPLETE);
index 79f62a7a4f7063fea56edf2ff3eeed58b46bdb48..e57e5dd795da242be68cad9993af23bec2d7f1d3 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_display_name.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_display_name.c 19952 2007-01-17 10:16:15Z lha $");
 
 OM_uint32
 gss_display_name(OM_uint32 *minor_status,
 
 OM_uint32
 gss_display_name(OM_uint32 *minor_status,
@@ -39,6 +39,10 @@ gss_display_name(OM_uint32 *minor_status,
        struct _gss_name *name = (struct _gss_name *) input_name;
        struct _gss_mechanism_name *mn;
 
        struct _gss_name *name = (struct _gss_name *) input_name;
        struct _gss_mechanism_name *mn;
 
+       _mg_buffer_zero(output_name_buffer);
+       if (output_name_type)
+           *output_name_type = GSS_C_NO_OID;
+
        /*
         * If we know it, copy the buffer used to import the name in
         * the first place. Otherwise, ask all the MNs in turn if
        /*
         * If we know it, copy the buffer used to import the name in
         * the first place. Otherwise, ask all the MNs in turn if
index 7871f5338b4d8dfa538d8100e4c16b60b2bfc132..c316c26fd764d80cb67569d19b501d5f6d00c3a8 100644 (file)
@@ -59,7 +59,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_display_status.c,v 1.4 2006/07/19 11:02:33 lha Exp $");
+RCSID("$Id: gss_display_status.c 20084 2007-01-31 12:12:08Z lha $");
 
 static const char *
 calling_error(OM_uint32 v)
 
 static const char *
 calling_error(OM_uint32 v)
@@ -148,6 +148,18 @@ gss_display_status(OM_uint32 *minor_status,
 {
        OM_uint32 major_status;
 
 {
        OM_uint32 major_status;
 
+       _mg_buffer_zero(status_string);
+       *message_content = 0;
+
+       major_status = _gss_mg_get_error(mech_type, status_type,
+                                        status_value, status_string);
+       if (major_status == GSS_S_COMPLETE) {
+
+           *message_content = 0;
+           *minor_status = 0;
+           return GSS_S_COMPLETE;
+       }
+
        *minor_status = 0;
        switch (status_type) {
        case GSS_C_GSS_CODE: {
        *minor_status = 0;
        switch (status_type) {
        case GSS_C_GSS_CODE: {
@@ -161,24 +173,40 @@ gss_display_status(OM_uint32 *minor_status,
                        calling_error(GSS_CALLING_ERROR(status_value)),
                        routine_error(GSS_ROUTINE_ERROR(status_value)));
 
                        calling_error(GSS_CALLING_ERROR(status_value)),
                        routine_error(GSS_ROUTINE_ERROR(status_value)));
 
+               if (buf == NULL)
+                   break;
+
                status_string->length = strlen(buf);
                status_string->value  = buf;
 
                return GSS_S_COMPLETE;
        }
        case GSS_C_MECH_CODE: {
                status_string->length = strlen(buf);
                status_string->value  = buf;
 
                return GSS_S_COMPLETE;
        }
        case GSS_C_MECH_CODE: {
-              gssapi_mech_interface m;
-              m = __gss_get_mechanism(mech_type);
-              if (m) {
-                       major_status = m->gm_display_status(minor_status,
-                           status_value, status_type, mech_type,
-                           message_content, status_string);
-                       if (major_status == GSS_S_COMPLETE)
-                               return (GSS_S_COMPLETE);
+               OM_uint32 maj_junk, min_junk;
+               gss_buffer_desc oid;
+               char *buf;
+
+               maj_junk = gss_oid_to_str(&min_junk, mech_type, &oid);
+               if (maj_junk != GSS_S_COMPLETE) {
+                   oid.value = rk_UNCONST("unknown");
+                   oid.length = 7;
                }
                }
+
+               asprintf (&buf, "unknown mech-code %lu for mech %.*s",
+                         (unsigned long)status_value,
+                         (int)oid.length, (char *)oid.value);
+               if (maj_junk == GSS_S_COMPLETE)
+                   gss_release_buffer(&min_junk, &oid);
+
+               if (buf == NULL)
+                   break;
+
+               status_string->length = strlen(buf);
+               status_string->value  = buf;
+
+               return GSS_S_COMPLETE;
        }
        }
        }
        }
-       status_string->value = NULL;
-       status_string->length = 0;
+       _mg_buffer_zero(status_string);
        return (GSS_S_BAD_STATUS);
 }
        return (GSS_S_BAD_STATUS);
 }
index 5ef828f472a141144bd40ebd5266a3134ef3ff22..3aab0b9bbcd234ddb661b60d8d4693b0c664c6f2 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_duplicate_name.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_duplicate_name.c 19953 2007-01-17 11:16:35Z lha $");
 
 OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
     const gss_name_t src_name,
 
 OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
     const gss_name_t src_name,
@@ -39,6 +39,7 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
        struct _gss_mechanism_name *mn;
 
        *minor_status = 0;
        struct _gss_mechanism_name *mn;
 
        *minor_status = 0;
+       *dest_name = GSS_C_NO_NAME;
 
        /*
         * If this name has a value (i.e. it didn't come from
 
        /*
         * If this name has a value (i.e. it didn't come from
index bfb0e753157b674a702af33f294c7caeff11b590..d111a0ed6189ec8cb463be2e3d4d86c52a9e09f0 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_duplicate_oid.c,v 1.1 2006/06/28 09:07:07 lha Exp $");
+RCSID("$Id: gss_duplicate_oid.c 19954 2007-01-17 11:50:23Z lha $");
 
 OM_uint32 gss_duplicate_oid (
         OM_uint32 *minor_status,
 
 OM_uint32 gss_duplicate_oid (
         OM_uint32 *minor_status,
@@ -56,6 +56,7 @@ OM_uint32 gss_duplicate_oid (
     (*dest_oid)->elements = malloc(src_oid->length);
     if ((*dest_oid)->elements == NULL) {
        free(*dest_oid);
     (*dest_oid)->elements = malloc(src_oid->length);
     if ((*dest_oid)->elements == NULL) {
        free(*dest_oid);
+       *dest_oid = GSS_C_NO_OID;
        *minor_status = ENOMEM;
        return GSS_S_FAILURE;
     }
        *minor_status = ENOMEM;
        return GSS_S_FAILURE;
     }
index d1285815ee0f9a2524191d426d95149910aedfd1..476d4513756cbb2ab4a459d3d26df0ac352ff6fd 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_encapsulate_token.c,v 1.2 2006/10/14 10:05:12 lha Exp $");
+RCSID("$Id: gss_encapsulate_token.c 19954 2007-01-17 11:50:23Z lha $");
 
 OM_uint32
 gss_encapsulate_token(gss_buffer_t input_token,
 
 OM_uint32
 gss_encapsulate_token(gss_buffer_t input_token,
@@ -45,8 +45,7 @@ gss_encapsulate_token(gss_buffer_t input_token,
 
     ret = der_get_oid (oid->elements, oid->length, &ct.thisMech, &size);
     if (ret) {
 
     ret = der_get_oid (oid->elements, oid->length, &ct.thisMech, &size);
     if (ret) {
-       output_token->value = NULL;
-       output_token->length = 0;
+       _mg_buffer_zero(output_token);
        return GSS_S_FAILURE;
     }
 
        return GSS_S_FAILURE;
     }
 
@@ -58,8 +57,7 @@ gss_encapsulate_token(gss_buffer_t input_token,
                       &ct, &size, ret);
     der_free_oid(&ct.thisMech);
     if (ret) {
                       &ct, &size, ret);
     der_free_oid(&ct.thisMech);
     if (ret) {
-       output_token->length = 0;
-       output_token->value = NULL;
+       _mg_buffer_zero(output_token);
        return GSS_S_FAILURE;
     }  
     if (output_token->length != size)
        return GSS_S_FAILURE;
     }  
     if (output_token->length != size)
index bc1c39c8ee85adc49a67805d13e7de8427f9e9ad..11c9dd2db5fad7f69e8d3de08b1d671d90b833ef 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_export_name.c,v 1.3 2006/07/05 22:41:57 lha Exp $");
+RCSID("$Id: gss_export_name.c 19954 2007-01-17 11:50:23Z lha $");
 
 OM_uint32
 gss_export_name(OM_uint32 *minor_status,
 
 OM_uint32
 gss_export_name(OM_uint32 *minor_status,
@@ -37,8 +37,7 @@ gss_export_name(OM_uint32 *minor_status,
        struct _gss_name *name = (struct _gss_name *) input_name;
        struct _gss_mechanism_name *mn;
 
        struct _gss_name *name = (struct _gss_name *) input_name;
        struct _gss_mechanism_name *mn;
 
-       exported_name->value = NULL;
-       exported_name->length = 0;
+       _mg_buffer_zero(exported_name);
 
        /*
         * If this name already has any attached MNs, export the first
 
        /*
         * If this name already has any attached MNs, export the first
index 1acc72b33d371f3302908231cf772d638931321e..cf13bc0cd3275516efc6528479fdf7b34fd9ba30 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_export_sec_context.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_export_sec_context.c 19954 2007-01-17 11:50:23Z lha $");
 
 OM_uint32
 gss_export_sec_context(OM_uint32 *minor_status,
 
 OM_uint32
 gss_export_sec_context(OM_uint32 *minor_status,
@@ -39,6 +39,8 @@ gss_export_sec_context(OM_uint32 *minor_status,
        gssapi_mech_interface m = ctx->gc_mech;
        gss_buffer_desc buf;
 
        gssapi_mech_interface m = ctx->gc_mech;
        gss_buffer_desc buf;
 
+       _mg_buffer_zero(interprocess_token);
+
        major_status = m->gm_export_sec_context(minor_status,
            &ctx->gc_ctx, &buf);
        
        major_status = m->gm_export_sec_context(minor_status,
            &ctx->gc_ctx, &buf);
        
@@ -58,6 +60,7 @@ gss_export_sec_context(OM_uint32 *minor_status,
                         * GSS_C_NO_CONTEXT, which we did above.
                         * Return GSS_S_FAILURE.
                         */
                         * GSS_C_NO_CONTEXT, which we did above.
                         * Return GSS_S_FAILURE.
                         */
+                       _mg_buffer_zero(interprocess_token);
                        *minor_status = ENOMEM;
                        return (GSS_S_FAILURE);
                }
                        *minor_status = ENOMEM;
                        return (GSS_S_FAILURE);
                }
@@ -67,6 +70,8 @@ gss_export_sec_context(OM_uint32 *minor_status,
                memcpy(p + 2, m->gm_mech_oid.elements, m->gm_mech_oid.length);
                memcpy(p + 2 + m->gm_mech_oid.length, buf.value, buf.length);
                gss_release_buffer(minor_status, &buf);
                memcpy(p + 2, m->gm_mech_oid.elements, m->gm_mech_oid.length);
                memcpy(p + 2 + m->gm_mech_oid.length, buf.value, buf.length);
                gss_release_buffer(minor_status, &buf);
+       } else {
+               _gss_mg_error(m, major_status, *minor_status);
        }
 
        return (major_status);
        }
 
        return (major_status);
index e9a8f294a4ce4cfaf1b354a5ed2da59a4236d94f..496dd2065c5a3ac4ee443840b194641c3320fb4b 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_get_mic.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_get_mic.c 19954 2007-01-17 11:50:23Z lha $");
 
 OM_uint32
 gss_get_mic(OM_uint32 *minor_status,
 
 OM_uint32
 gss_get_mic(OM_uint32 *minor_status,
@@ -39,6 +39,12 @@ gss_get_mic(OM_uint32 *minor_status,
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
 
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
 
+       _mg_buffer_zero(message_token);
+       if (ctx == NULL) {
+           *minor_status = 0;
+           return GSS_S_NO_CONTEXT;
+       }
+
        return (m->gm_get_mic(minor_status, ctx->gc_ctx, qop_req,
                    message_buffer, message_token));
 }
        return (m->gm_get_mic(minor_status, ctx->gc_ctx, qop_req,
                    message_buffer, message_token));
 }
index 9684301ba48375face7cac98d194c3afdbe6a005..6f55a1d61cf24e6253ca54bdc046480f9a94c35b 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_import_name.c,v 1.3 2006/06/29 21:23:13 lha Exp $");
+RCSID("$Id: gss_import_name.c 19954 2007-01-17 11:50:23Z lha $");
 
 static OM_uint32
 _gss_import_export_name(OM_uint32 *minor_status,
 
 static OM_uint32
 _gss_import_export_name(OM_uint32 *minor_status,
@@ -119,6 +119,10 @@ _gss_import_export_name(OM_uint32 *minor_status,
         */
        major_status = m->gm_import_name(minor_status,
            input_name_buffer, GSS_C_NT_EXPORT_NAME, &new_canonical_name);
         */
        major_status = m->gm_import_name(minor_status,
            input_name_buffer, GSS_C_NT_EXPORT_NAME, &new_canonical_name);
+       if (major_status != GSS_S_COMPLETE) {
+               _gss_mg_error(m, major_status, *minor_status);
+               return major_status;
+       }
 
        /*
         * Now we make a new name and mark it as an MN.
 
        /*
         * Now we make a new name and mark it as an MN.
@@ -145,9 +149,10 @@ gss_import_name(OM_uint32 *minor_status,
        OM_uint32               major_status;
        struct _gss_name        *name;
 
        OM_uint32               major_status;
        struct _gss_name        *name;
 
+       *output_name = GSS_C_NO_NAME;
+
        if (input_name_buffer->length == 0) {
                *minor_status = 0;
        if (input_name_buffer->length == 0) {
                *minor_status = 0;
-               *output_name = 0;
                return (GSS_S_BAD_NAME);
        }
 
                return (GSS_S_BAD_NAME);
        }
 
@@ -180,7 +185,6 @@ gss_import_name(OM_uint32 *minor_status,
            && !gss_oid_equal(name_type, GSS_C_NT_ANONYMOUS)
            && !gss_oid_equal(name_type, GSS_KRB5_NT_PRINCIPAL_NAME)) {
                *minor_status = 0;
            && !gss_oid_equal(name_type, GSS_C_NT_ANONYMOUS)
            && !gss_oid_equal(name_type, GSS_KRB5_NT_PRINCIPAL_NAME)) {
                *minor_status = 0;
-               *output_name = 0;
                return (GSS_S_BAD_NAMETYPE);
        }
 
                return (GSS_S_BAD_NAMETYPE);
        }
 
index 5466f97cf4a6028013de923a97d12be59eb2b068..44ca1b2677bad5964e7102ccb20de57ba2d17081 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_import_sec_context.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_import_sec_context.c 19956 2007-01-17 12:04:16Z lha $");
 
 OM_uint32
 gss_import_sec_context(OM_uint32 *minor_status,
 
 OM_uint32
 gss_import_sec_context(OM_uint32 *minor_status,
@@ -43,7 +43,7 @@ gss_import_sec_context(OM_uint32 *minor_status,
        size_t len;
 
        *minor_status = 0;
        size_t len;
 
        *minor_status = 0;
-       *context_handle = 0;
+       *context_handle = GSS_C_NO_CONTEXT;
 
        /*
         * We added an oid to the front of the token in
 
        /*
         * We added an oid to the front of the token in
@@ -73,6 +73,7 @@ gss_import_sec_context(OM_uint32 *minor_status,
        major_status = m->gm_import_sec_context(minor_status,
            &buf, &ctx->gc_ctx);
        if (major_status != GSS_S_COMPLETE) {
        major_status = m->gm_import_sec_context(minor_status,
            &buf, &ctx->gc_ctx);
        if (major_status != GSS_S_COMPLETE) {
+               _gss_mg_error(m, major_status, *minor_status);
                free(ctx);
        } else {
                *context_handle = (gss_ctx_id_t) ctx;
                free(ctx);
        } else {
                *context_handle = (gss_ctx_id_t) ctx;
index 0da6c48834c0152c123abfb1c3a879c4da4c1f3f..00c6ed28ee6c1269afc5da3f57b1a418009b5626 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_indicate_mechs.c,v 1.3 2006/07/05 22:36:49 lha Exp $");
+RCSID("$Id: gss_indicate_mechs.c 17803 2006-07-05 22:36:49Z lha $");
 
 OM_uint32
 gss_indicate_mechs(OM_uint32 *minor_status,
 
 OM_uint32
 gss_indicate_mechs(OM_uint32 *minor_status,
index 0d50bbd92bfa612755ca056b964febf08effe4aa..c1c058d146cdc5a25ecc99f222f3face9a30e95f 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_init_sec_context.c,v 1.4 2006/11/14 12:33:11 lha Exp $");
+RCSID("$Id: gss_init_sec_context.c 19957 2007-01-17 13:48:11Z lha $");
 
 static gss_cred_id_t
 _gss_mech_cred_find(gss_cred_id_t cred_handle, gss_OID mech_type)
 
 static gss_cred_id_t
 _gss_mech_cred_find(gss_cred_id_t cred_handle, gss_OID mech_type)
@@ -71,6 +71,14 @@ gss_init_sec_context(OM_uint32 * minor_status,
 
        *minor_status = 0;
 
 
        *minor_status = 0;
 
+       _mg_buffer_zero(output_token);
+       if (actual_mech_type)
+           *actual_mech_type = GSS_C_NO_OID;
+       if (ret_flags)
+           *ret_flags = 0;
+       if (time_rec)
+           *time_rec = 0;
+
        /*
         * If we haven't allocated a context yet, do so now and lookup
         * the mechanism switch table. If we have one already, make
        /*
         * If we haven't allocated a context yet, do so now and lookup
         * the mechanism switch table. If we have one already, make
@@ -131,6 +139,8 @@ gss_init_sec_context(OM_uint32 * minor_status,
            && major_status != GSS_S_CONTINUE_NEEDED) {
                if (allocated_ctx)
                        free(ctx);
            && major_status != GSS_S_CONTINUE_NEEDED) {
                if (allocated_ctx)
                        free(ctx);
+               _mg_buffer_zero(output_token);
+               _gss_mg_error(m, major_status, *minor_status);
        } else {
                *context_handle = (gss_ctx_id_t) ctx;
        }
        } else {
                *context_handle = (gss_ctx_id_t) ctx;
        }
index 88bbb3941f2b075f8d148bed7f6472fe8469f391..5cce30c6bd86a28226f93fc8a95207dd437f238b 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_context.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_inquire_context.c 19958 2007-01-17 13:56:18Z lha $");
 
 OM_uint32
 gss_inquire_context(OM_uint32 *minor_status,
 
 OM_uint32
 gss_inquire_context(OM_uint32 *minor_status,
@@ -46,27 +46,42 @@ gss_inquire_context(OM_uint32 *minor_status,
        struct _gss_name *name;
        gss_name_t src_mn, targ_mn;
 
        struct _gss_name *name;
        gss_name_t src_mn, targ_mn;
 
+       if (locally_initiated)
+           *locally_initiated = 0;
+       if (open)
+           *open = 0;
+       if (lifetime_rec)
+           *lifetime_rec = 0;
+
+       if (src_name)
+           *src_name = GSS_C_NO_NAME;
+       if (targ_name)
+           *targ_name = GSS_C_NO_NAME;
+       if (mech_type)
+           *mech_type = GSS_C_NO_OID;
+       src_mn = targ_mn = GSS_C_NO_NAME;
+
        major_status = m->gm_inquire_context(minor_status,
            ctx->gc_ctx,
        major_status = m->gm_inquire_context(minor_status,
            ctx->gc_ctx,
-           src_name ? &src_mn : 0,
-           targ_name ? &targ_mn : 0,
+           src_name ? &src_mn : NULL,
+           targ_name ? &targ_mn : NULL,
            lifetime_rec,
            mech_type,
            ctx_flags,
            locally_initiated,
            open);
 
            lifetime_rec,
            mech_type,
            ctx_flags,
            locally_initiated,
            open);
 
-       if (src_name) *src_name = 0;
-       if (targ_name) *targ_name = 0;
-
        if (major_status != GSS_S_COMPLETE) {
        if (major_status != GSS_S_COMPLETE) {
+               _gss_mg_error(m, major_status, *minor_status);
                return (major_status);
        }
 
        if (src_name) {
                name = _gss_make_name(m, src_mn);
                if (!name) {
                return (major_status);
        }
 
        if (src_name) {
                name = _gss_make_name(m, src_mn);
                if (!name) {
-                       minor_status = 0;
+                       *mech_type = GSS_C_NO_OID;
+                       m->gm_release_name(minor_status, &src_mn);
+                       *minor_status = 0;
                        return (GSS_S_FAILURE);
                }
                *src_name = (gss_name_t) name;
                        return (GSS_S_FAILURE);
                }
                *src_name = (gss_name_t) name;
@@ -75,7 +90,10 @@ gss_inquire_context(OM_uint32 *minor_status,
        if (targ_name) {
                name = _gss_make_name(m, targ_mn);
                if (!name) {
        if (targ_name) {
                name = _gss_make_name(m, targ_mn);
                if (!name) {
-                       minor_status = 0;
+                       *mech_type = GSS_C_NO_OID;
+                       gss_release_name(minor_status, src_name);
+                       m->gm_release_name(minor_status, &targ_mn);
+                       *minor_status = 0;
                        return (GSS_S_FAILURE);
                }
                *targ_name = (gss_name_t) name;
                        return (GSS_S_FAILURE);
                }
                *targ_name = (gss_name_t) name;
index 223140205d3d91c11a256ff3a7931e6020d225a2..97c3628225b3ff7de3b5620f019db58757b9ab00 100644 (file)
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_cred.c,v 1.5 2006/07/20 02:03:18 lha Exp $");
+RCSID("$Id: gss_inquire_cred.c 20626 2007-05-08 13:56:49Z lha $");
+
+#define AUSAGE 1
+#define IUSAGE 2
+
+static void
+updateusage(gss_cred_usage_t usage, int *usagemask)
+{
+    if (usage == GSS_C_BOTH)
+       *usagemask |= AUSAGE | IUSAGE;
+    else if (usage == GSS_C_ACCEPT)
+       *usagemask |= AUSAGE;
+    else if (usage == GSS_C_INITIATE)
+       *usagemask |= IUSAGE;
+}
 
 OM_uint32
 gss_inquire_cred(OM_uint32 *minor_status,
 
 OM_uint32
 gss_inquire_cred(OM_uint32 *minor_status,
@@ -44,27 +58,30 @@ gss_inquire_cred(OM_uint32 *minor_status,
        struct _gss_mechanism_name *mn;
        OM_uint32 min_lifetime;
        int found = 0;
        struct _gss_mechanism_name *mn;
        OM_uint32 min_lifetime;
        int found = 0;
+       int usagemask = 0;
+       gss_cred_usage_t usage;
 
        _gss_load_mech();
 
        *minor_status = 0;
        if (name_ret)
 
        _gss_load_mech();
 
        *minor_status = 0;
        if (name_ret)
-               *name_ret = 0;
+               *name_ret = GSS_C_NO_NAME;
        if (lifetime)
                *lifetime = 0;
        if (cred_usage)
                *cred_usage = 0;
        if (lifetime)
                *lifetime = 0;
        if (cred_usage)
                *cred_usage = 0;
+       if (mechanisms)
+               *mechanisms = GSS_C_NO_OID_SET;
 
        if (name_ret) {
 
        if (name_ret) {
-               name = malloc(sizeof(struct _gss_name));
-               if (!name) {
+               name = calloc(1, sizeof(*name));
+               if (name == NULL) {
                        *minor_status = ENOMEM;
                        return (GSS_S_FAILURE);
                }
                        *minor_status = ENOMEM;
                        return (GSS_S_FAILURE);
                }
-               memset(name, 0, sizeof(struct _gss_name));
                SLIST_INIT(&name->gn_mn);
        } else {
                SLIST_INIT(&name->gn_mn);
        } else {
-               name = 0;
+               name = NULL;
        }
 
        if (mechanisms) {
        }
 
        if (mechanisms) {
@@ -85,10 +102,11 @@ gss_inquire_cred(OM_uint32 *minor_status,
                        OM_uint32 mc_lifetime;
 
                        major_status = mc->gmc_mech->gm_inquire_cred(minor_status,
                        OM_uint32 mc_lifetime;
 
                        major_status = mc->gmc_mech->gm_inquire_cred(minor_status,
-                           mc->gmc_cred, &mc_name, &mc_lifetime, NULL, NULL);
+                           mc->gmc_cred, &mc_name, &mc_lifetime, &usage, NULL);
                        if (major_status)
                                continue;
 
                        if (major_status)
                                continue;
 
+                       updateusage(usage, &usagemask);
                        if (name) {
                                mn = malloc(sizeof(struct _gss_mechanism_name));
                                if (!mn) {
                        if (name) {
                                mn = malloc(sizeof(struct _gss_mechanism_name));
                                if (!mn) {
@@ -120,10 +138,11 @@ gss_inquire_cred(OM_uint32 *minor_status,
 
                        major_status = m->gm_mech.gm_inquire_cred(minor_status,
                            GSS_C_NO_CREDENTIAL, &mc_name, &mc_lifetime,
 
                        major_status = m->gm_mech.gm_inquire_cred(minor_status,
                            GSS_C_NO_CREDENTIAL, &mc_name, &mc_lifetime,
-                           cred_usage, NULL);
+                           &usage, NULL);
                        if (major_status)
                                continue;
 
                        if (major_status)
                                continue;
 
+                       updateusage(usage, &usagemask);
                        if (name && mc_name) {
                                mn = malloc(
                                        sizeof(struct _gss_mechanism_name));
                        if (name && mc_name) {
                                mn = malloc(
                                        sizeof(struct _gss_mechanism_name));
@@ -152,6 +171,9 @@ gss_inquire_cred(OM_uint32 *minor_status,
        }
 
        if (found == 0) {
        }
 
        if (found == 0) {
+               gss_name_t n = (gss_name_t)name;
+               if (n)
+                       gss_release_name(minor_status, &n);
                gss_release_oid_set(minor_status, mechanisms);
                *minor_status = 0;
                return (GSS_S_NO_CRED);
                gss_release_oid_set(minor_status, mechanisms);
                *minor_status = 0;
                return (GSS_S_NO_CRED);
@@ -162,7 +184,13 @@ gss_inquire_cred(OM_uint32 *minor_status,
                *name_ret = (gss_name_t) name;
        if (lifetime)
                *lifetime = min_lifetime;
                *name_ret = (gss_name_t) name;
        if (lifetime)
                *lifetime = min_lifetime;
-       if (cred && cred_usage)
-               *cred_usage = cred->gc_usage;
+       if (cred_usage) {
+               if ((usagemask & (AUSAGE|IUSAGE)) == (AUSAGE|IUSAGE))
+                       *cred_usage = GSS_C_BOTH;
+               else if (usagemask & IUSAGE)
+                       *cred_usage = GSS_C_INITIATE;
+               else if (usagemask & AUSAGE)
+                       *cred_usage = GSS_C_ACCEPT;
+       }
        return (GSS_S_COMPLETE);
 }
        return (GSS_S_COMPLETE);
 }
index 771a6956a58864a244c067939fefa81f14b726d5..a4ace9e9e93e3d200e87e0bb5eaf8e38960451ee 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_cred_by_mech.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_inquire_cred_by_mech.c 19960 2007-01-17 15:09:24Z lha $");
 
 OM_uint32
 gss_inquire_cred_by_mech(OM_uint32 *minor_status,
 
 OM_uint32
 gss_inquire_cred_by_mech(OM_uint32 *minor_status,
@@ -46,6 +46,14 @@ gss_inquire_cred_by_mech(OM_uint32 *minor_status,
        struct _gss_name *name;
 
        *minor_status = 0;
        struct _gss_name *name;
 
        *minor_status = 0;
+       if (cred_name)
+           *cred_name = GSS_C_NO_NAME;
+       if (initiator_lifetime)
+           *initiator_lifetime = 0;
+       if (acceptor_lifetime)
+           *acceptor_lifetime = 0;
+       if (cred_usage)
+           *cred_usage = 0;
 
        m = __gss_get_mechanism(mech_type);
        if (!m)
 
        m = __gss_get_mechanism(mech_type);
        if (!m)
@@ -65,8 +73,10 @@ gss_inquire_cred_by_mech(OM_uint32 *minor_status,
 
        major_status = m->gm_inquire_cred_by_mech(minor_status, mc, mech_type,
            &mn, initiator_lifetime, acceptor_lifetime, cred_usage);
 
        major_status = m->gm_inquire_cred_by_mech(minor_status, mc, mech_type,
            &mn, initiator_lifetime, acceptor_lifetime, cred_usage);
-       if (major_status != GSS_S_COMPLETE)
+       if (major_status != GSS_S_COMPLETE) {
+               _gss_mg_error(m, major_status, *minor_status);
                return (major_status);
                return (major_status);
+       }
 
        name = _gss_make_name(m, mn);
        if (!name) {
 
        name = _gss_make_name(m, mn);
        if (!name) {
index 3cfe89af21a94e2374c792c060450f380179b833..7b53a2ff4a822f8c6545b2274dd64ec01faa7b19 100644 (file)
@@ -31,7 +31,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_cred_by_oid.c,v 1.2 2006/06/28 16:20:41 lha Exp $");
+RCSID("$Id: gss_inquire_cred_by_oid.c 19960 2007-01-17 15:09:24Z lha $");
 
 OM_uint32
 gss_inquire_cred_by_oid (OM_uint32 *minor_status,
 
 OM_uint32
 gss_inquire_cred_by_oid (OM_uint32 *minor_status,
@@ -46,6 +46,7 @@ gss_inquire_cred_by_oid (OM_uint32 *minor_status,
        gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 
        *minor_status = 0;
        gss_buffer_set_t set = GSS_C_NO_BUFFER_SET;
 
        *minor_status = 0;
+       *data_set = GSS_C_NO_BUFFER_SET;
 
        if (cred == NULL)
                return GSS_S_NO_CRED;
 
        if (cred == NULL)
                return GSS_S_NO_CRED;
@@ -55,8 +56,11 @@ gss_inquire_cred_by_oid (OM_uint32 *minor_status,
                int i;
 
                m = mc->gmc_mech;
                int i;
 
                m = mc->gmc_mech;
-               if (m == NULL)
+               if (m == NULL) {
+                       gss_release_buffer_set(minor_status, &set);
+                       *minor_status = 0;
                        return GSS_S_BAD_MECH;
                        return GSS_S_BAD_MECH;
+               }
 
                if (m->gm_inquire_cred_by_oid == NULL)
                        continue;
 
                if (m->gm_inquire_cred_by_oid == NULL)
                        continue;
@@ -77,6 +81,7 @@ gss_inquire_cred_by_oid (OM_uint32 *minor_status,
        if (set == GSS_C_NO_BUFFER_SET)
                status = GSS_S_FAILURE;
        *data_set = set;
        if (set == GSS_C_NO_BUFFER_SET)
                status = GSS_S_FAILURE;
        *data_set = set;
+       *minor_status = 0;
        return status;
 }
 
        return status;
 }
 
index 7052bf8b72c383801c14a31578a01f522bbea85e..5330a747a6b27de5f9bc37e0cf5702ba4ca25b0c 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_mechs_for_name.c,v 1.3 2006/07/20 02:04:00 lha Exp $");
+RCSID("$Id: gss_inquire_mechs_for_name.c 17844 2006-07-20 02:04:00Z lha $");
 
 OM_uint32
 gss_inquire_mechs_for_name(OM_uint32 *minor_status,
 
 OM_uint32
 gss_inquire_mechs_for_name(OM_uint32 *minor_status,
index 2293163b03d0d0916e09cff4888d82306f39fe6a..65b52cbbc301c4ed80a86ee4570ff38b68a75173 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_names_for_mech.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_inquire_names_for_mech.c 19960 2007-01-17 15:09:24Z lha $");
 
 OM_uint32
 gss_inquire_names_for_mech(OM_uint32 *minor_status,
 
 OM_uint32
 gss_inquire_names_for_mech(OM_uint32 *minor_status,
@@ -38,6 +38,7 @@ gss_inquire_names_for_mech(OM_uint32 *minor_status,
        gssapi_mech_interface m = __gss_get_mechanism(mechanism);
 
        *minor_status = 0;
        gssapi_mech_interface m = __gss_get_mechanism(mechanism);
 
        *minor_status = 0;
+       *name_types = GSS_C_NO_OID_SET;
        if (!m)
                return (GSS_S_BAD_MECH);
 
        if (!m)
                return (GSS_S_BAD_MECH);
 
@@ -56,15 +57,15 @@ gss_inquire_names_for_mech(OM_uint32 *minor_status,
                major_status = gss_add_oid_set_member(minor_status,
                    GSS_C_NT_HOSTBASED_SERVICE, name_types);
                if (major_status) {
                major_status = gss_add_oid_set_member(minor_status,
                    GSS_C_NT_HOSTBASED_SERVICE, name_types);
                if (major_status) {
-                       OM_uint32 ms;
-                       gss_release_oid_set(&ms, name_types);
+                       OM_uint32 junk;
+                       gss_release_oid_set(&junk, name_types);
                        return (major_status);
                }
                major_status = gss_add_oid_set_member(minor_status,
                    GSS_C_NT_USER_NAME, name_types);
                if (major_status) {
                        return (major_status);
                }
                major_status = gss_add_oid_set_member(minor_status,
                    GSS_C_NT_USER_NAME, name_types);
                if (major_status) {
-                       OM_uint32 ms;
-                       gss_release_oid_set(&ms, name_types);
+                       OM_uint32 junk;
+                       gss_release_oid_set(&junk, name_types);
                        return (major_status);
                }
        }
                        return (major_status);
                }
        }
index 7f5632ac556978b46de49bf659b4142f1eb5c9d6..fd8219ce0280048910fce53e069506707495fbd3 100644 (file)
@@ -31,7 +31,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_inquire_sec_context_by_oid.c,v 1.1 2006/06/28 09:07:08 lha Exp $");
+RCSID("$Id: gss_inquire_sec_context_by_oid.c 19961 2007-01-17 15:57:51Z lha $");
 
 OM_uint32
 gss_inquire_sec_context_by_oid (OM_uint32 *minor_status,
 
 OM_uint32
 gss_inquire_sec_context_by_oid (OM_uint32 *minor_status,
@@ -44,7 +44,7 @@ gss_inquire_sec_context_by_oid (OM_uint32 *minor_status,
        gssapi_mech_interface   m;
 
        *minor_status = 0;
        gssapi_mech_interface   m;
 
        *minor_status = 0;
-
+       *data_set = GSS_C_NO_BUFFER_SET;
        if (ctx == NULL)
                return GSS_S_NO_CONTEXT;
 
        if (ctx == NULL)
                return GSS_S_NO_CONTEXT;
 
@@ -58,10 +58,12 @@ gss_inquire_sec_context_by_oid (OM_uint32 *minor_status,
        if (m == NULL)
                return GSS_S_BAD_MECH;
 
        if (m == NULL)
                return GSS_S_BAD_MECH;
 
-       if (m->gm_inquire_sec_context_by_oid != NULL)
+       if (m->gm_inquire_sec_context_by_oid != NULL) {
                major_status = m->gm_inquire_sec_context_by_oid(minor_status,
                    ctx->gc_ctx, desired_object, data_set);
                major_status = m->gm_inquire_sec_context_by_oid(minor_status,
                    ctx->gc_ctx, desired_object, data_set);
-       else
+               if (major_status != GSS_S_COMPLETE)
+                       _gss_mg_error(m, major_status, *minor_status);
+       } else
                major_status = GSS_S_BAD_MECH;
 
        return major_status;
                major_status = GSS_S_BAD_MECH;
 
        return major_status;
index 76a2c2b637b91ba222304b4c043f1b515118277c..2500928baf31935da3da57fb5dc94302d2e1aac2 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_krb5.c,v 1.21 2006/11/10 00:57:27 lha Exp $");
+RCSID("$Id: gss_krb5.c 20383 2007-04-18 08:49:53Z lha $");
 
 #include <krb5.h>
 #include <roken.h>
 
 #include <krb5.h>
 #include <roken.h>
@@ -164,7 +164,12 @@ gss_krb5_import_cred(OM_uint32 *minor_status,
        goto out;
     }
 
        goto out;
     }
 
-    krb5_storage_to_data(sp, &data);
+    ret = krb5_storage_to_data(sp, &data);
+    if (ret) {
+       *minor_status = ret;
+       major_status = GSS_S_FAILURE;
+       goto out;
+    }
 
     buffer.value = data.data;
     buffer.length = data.length;
 
     buffer.value = data.data;
     buffer.length = data.length;
@@ -421,37 +426,49 @@ gss_krb5_free_lucid_sec_context(OM_uint32 *minor_status, void *c)
  */
 
 OM_uint32
  */
 
 OM_uint32
-gss_krb5_set_allowable_enctypes(OM_uint32 *min_status, 
+gss_krb5_set_allowable_enctypes(OM_uint32 *minor_status, 
                                gss_cred_id_t cred,
                                OM_uint32 num_enctypes,
                                int32_t *enctypes)
 {
                                gss_cred_id_t cred,
                                OM_uint32 num_enctypes,
                                int32_t *enctypes)
 {
+    krb5_error_code ret;
     OM_uint32 maj_status;
     gss_buffer_desc buffer;
     krb5_storage *sp;
     krb5_data data;
     OM_uint32 maj_status;
     gss_buffer_desc buffer;
     krb5_storage *sp;
     krb5_data data;
+    int i;
 
     sp = krb5_storage_emem();
     if (sp == NULL) {
 
     sp = krb5_storage_emem();
     if (sp == NULL) {
-       *min_status = ENOMEM;
+       *minor_status = ENOMEM;
        maj_status = GSS_S_FAILURE;
        goto out;
     }
 
        maj_status = GSS_S_FAILURE;
        goto out;
     }
 
-    while(*enctypes) {
-       krb5_store_int32(sp, *enctypes);
-       enctypes++;
+    for (i = 0; i < num_enctypes; i++) {
+       ret = krb5_store_int32(sp, enctypes[i]);
+       if (ret) {
+           *minor_status = ret;
+           maj_status = GSS_S_FAILURE;
+           goto out;
+       }
     }
 
     }
 
-    krb5_storage_to_data(sp, &data);
+    ret = krb5_storage_to_data(sp, &data);
+    if (ret) {
+       *minor_status = ret;
+       maj_status = GSS_S_FAILURE;
+       goto out;
+    }
 
     buffer.value = data.data;
     buffer.length = data.length;
 
 
     buffer.value = data.data;
     buffer.length = data.length;
 
-    maj_status = gss_set_cred_option(min_status,
+    maj_status = gss_set_cred_option(minor_status,
                                     &cred,
                                     GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X,
                                     &buffer);
                                     &cred,
                                     GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X,
                                     &buffer);
+    krb5_data_free(&data);
 out:
     if (sp)
        krb5_storage_free(sp);
 out:
     if (sp)
        krb5_storage_free(sp);
@@ -489,6 +506,38 @@ gsskrb5_set_send_to_kdc(struct gsskrb5_send_to_kdc *c)
     return (GSS_S_COMPLETE);
 }
 
     return (GSS_S_COMPLETE);
 }
 
+/*
+ *
+ */
+
+OM_uint32
+gss_krb5_ccache_name(OM_uint32 *minor_status, 
+                    const char *name,
+                    const char **out_name)
+{
+    struct _gss_mech_switch *m;
+    gss_buffer_desc buffer;
+    OM_uint32 junk;
+
+    _gss_load_mech();
+
+    if (out_name)
+       *out_name = NULL;
+
+    buffer.value = rk_UNCONST(name);
+    buffer.length = strlen(name);
+
+    SLIST_FOREACH(m, &_gss_mechs, gm_link) {
+       if (m->gm_mech.gm_set_sec_context_option == NULL)
+           continue;
+       m->gm_mech.gm_set_sec_context_option(&junk, NULL,
+           GSS_KRB5_CCACHE_NAME_X, &buffer);
+    }
+
+    return (GSS_S_COMPLETE);
+}
+
+
 /*
  *
  */
 /*
  *
  */
index b8fdefdca13fdb0ec3f1566c1ae9ca35698d1170..604027490ef0b91396af19c46034eeb18cc01a86 100644 (file)
@@ -28,7 +28,7 @@
 
 #include "mech_locl.h"
 #include <heim_threads.h>
 
 #include "mech_locl.h"
 #include <heim_threads.h>
-RCSID("$Id: gss_mech_switch.c,v 1.8 2006/12/15 20:05:43 lha Exp $");
+RCSID("$Id: gss_mech_switch.c 20625 2007-05-08 13:55:03Z lha $");
 
 #ifndef _PATH_GSS_MECH
 #define _PATH_GSS_MECH "/etc/gss/mech"
 
 #ifndef _PATH_GSS_MECH
 #define _PATH_GSS_MECH "/etc/gss/mech"
@@ -50,6 +50,9 @@ _gss_string_to_oid(const char* s, gss_OID oid)
        const char              *p, *q;
        char                    *res;
 
        const char              *p, *q;
        char                    *res;
 
+       oid->length = 0;
+       oid->elements = NULL;
+
        /*
         * First figure out how many numbers in the oid, then
         * calculate the compiled oid size.
        /*
         * First figure out how many numbers in the oid, then
         * calculate the compiled oid size.
@@ -169,8 +172,10 @@ add_builtin(gssapi_mech_interface mech)
 {
     struct _gss_mech_switch *m;
     OM_uint32 minor_status;
 {
     struct _gss_mech_switch *m;
     OM_uint32 minor_status;
-    if (!mech) 
-        return 0;
+
+    /* not registering any mech is ok */
+    if (mech == NULL)
+       return 0;
 
     m = malloc(sizeof(*m));
     if (m == NULL)
 
     m = malloc(sizeof(*m));
     if (m == NULL)
@@ -299,6 +304,7 @@ _gss_load_mech(void)
                OPTSYM(inquire_sec_context_by_oid);
                OPTSYM(set_sec_context_option);
                OPTSYM(set_cred_option);
                OPTSYM(inquire_sec_context_by_oid);
                OPTSYM(set_sec_context_option);
                OPTSYM(set_cred_option);
+               OPTSYM(pseudo_random);
 
                SLIST_INSERT_HEAD(&_gss_mechs, m, gm_link);
                continue;
 
                SLIST_INSERT_HEAD(&_gss_mechs, m, gm_link);
                continue;
index 833c582006f22778fe1ac7a6d21d86f3cf22deb7..3ab609c19292d5b812c0b7a41b11b1f58133cf68 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_names.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_names.c 19928 2007-01-16 10:37:54Z lha $");
 
 struct _gss_mechanism_name *
 _gss_find_mn(struct _gss_name *name, gss_OID mech)
 
 struct _gss_mechanism_name *
 _gss_find_mn(struct _gss_name *name, gss_OID mech)
@@ -62,7 +62,8 @@ _gss_find_mn(struct _gss_name *name, gss_OID mech)
                    (name->gn_type.elements
                        ? &name->gn_type : GSS_C_NO_OID),
                    &mn->gmn_name);
                    (name->gn_type.elements
                        ? &name->gn_type : GSS_C_NO_OID),
                    &mn->gmn_name);
-               if (major_status) {
+               if (major_status != GSS_S_COMPLETE) {
+                       _gss_mg_error(m, major_status, minor_status);
                        free(mn);
                        return (0);
                }
                        free(mn);
                        return (0);
                }
index 1a8b811f375e3df945fcdfee8d7341bdc8f62c00..8c75410cc124b012506bc7f9a38b970b62ce8555 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_oid_equal.c,v 1.1 2006/06/28 09:07:08 lha Exp $");
+RCSID("$Id: gss_oid_equal.c 17702 2006-06-28 09:07:08Z lha $");
 
 int
 gss_oid_equal(const gss_OID a, const gss_OID b)
 
 int
 gss_oid_equal(const gss_OID a, const gss_OID b)
similarity index 72%
rename from source4/heimdal/lib/gssapi/krb5/test_oid_set_member.c
rename to source4/heimdal/lib/gssapi/mech/gss_oid_to_str.c
index 5a0ac4418f71e5c5bd74b32095ac31d580291b61..3195370b77721a66af114de68835901a54be4c9a 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-#include "krb5/gsskrb5_locl.h"
+#include "mech_locl.h"
+RCSID("$Id: gss_oid_to_str.c 19963 2007-01-17 16:01:22Z lha $");
 
 
-RCSID("$Id: test_oid_set_member.c,v 1.7 2006/10/07 22:15:50 lha Exp $");
-
-OM_uint32 _gsskrb5_test_oid_set_member
-           (OM_uint32 * minor_status,
-            const gss_OID member,
-            const gss_OID_set set,
-            int * present
-           )
+OM_uint32
+gss_oid_to_str(OM_uint32 *minor_status, gss_OID oid, gss_buffer_t oid_str)
 {
 {
-    size_t i;
+    int ret;
+    size_t size;
+    heim_oid o;
+    char *p;
+
+    _mg_buffer_zero(oid_str);
+
+    ret = der_get_oid (oid->elements, oid->length, &o, &size);
+    if (ret) {
+       *minor_status = ret;
+       return GSS_S_FAILURE;
+    }
+
+    ret = der_print_heim_oid(&o, ' ', &p);
+    der_free_oid(&o);
+    if (ret) {
+       *minor_status = ret;
+       return GSS_S_FAILURE;
+    }
+    
+    oid_str->value = p;
+    oid_str->length = strlen(p);
 
     *minor_status = 0;
 
     *minor_status = 0;
-    *present = 0;
-    for (i = 0; i < set->count; ++i)
-       if (gss_oid_equal(member, &set->elements[i]) != 0) {
-           *present = 1;
-           break;
-       }
     return GSS_S_COMPLETE;
 }
     return GSS_S_COMPLETE;
 }
index 1e6f39979fdb6ab41a1debbc325c4b4c2a9ef842..dff6b04f14e1941b6e62afbd66e2ba8019ddc063 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_process_context_token.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_process_context_token.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_process_context_token(OM_uint32 *minor_status,
 
 OM_uint32
 gss_process_context_token(OM_uint32 *minor_status,
index 66705bb40e0451c438db1222e11bcb5a3fbee071..fc55cae0309ebb28462febe4e4aba7461727d1c8 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_release_buffer.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_release_buffer.c 19962 2007-01-17 15:59:04Z lha $");
 
 OM_uint32
 gss_release_buffer(OM_uint32 *minor_status,
 
 OM_uint32
 gss_release_buffer(OM_uint32 *minor_status,
@@ -37,8 +37,7 @@ gss_release_buffer(OM_uint32 *minor_status,
        *minor_status = 0;
        if (buffer->value)
                free(buffer->value);
        *minor_status = 0;
        if (buffer->value)
                free(buffer->value);
-       buffer->length = 0;
-       buffer->value = 0;
+       _mg_buffer_zero(buffer);
 
        return (GSS_S_COMPLETE);
 }
 
        return (GSS_S_COMPLETE);
 }
index 760621c861036d2758ce47f3720e1c671c379f0c..b26dbd78651ef9285386462bf36714909eb25d35 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_release_cred.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_release_cred.c 19963 2007-01-17 16:01:22Z lha $");
 
 OM_uint32
 gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
 
 OM_uint32
 gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
@@ -47,6 +47,6 @@ gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
        free(cred);
 
        *minor_status = 0;
        free(cred);
 
        *minor_status = 0;
-       *cred_handle = 0;
+       *cred_handle = GSS_C_NO_CREDENTIAL;
        return (GSS_S_COMPLETE);
 }
        return (GSS_S_COMPLETE);
 }
index 1286cd3b79af443c098bf780cc09352cc4bc9d06..313eab8245c1174c38d44ea24ea74dbbeb91ba7b 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_release_name.c,v 1.3 2006/10/22 07:59:06 lha Exp $");
+RCSID("$Id: gss_release_name.c 18812 2006-10-22 07:59:06Z lha $");
 
 OM_uint32
 gss_release_name(OM_uint32 *minor_status,
 
 OM_uint32
 gss_release_name(OM_uint32 *minor_status,
index fc84fabd293ba76b4dbb391d210fe72ee6f833d7..7754787fa8dabf30977c4f8f930ecf311cf10940 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "mech_locl.h"
 
 
 #include "mech_locl.h"
 
-RCSID("$Id: gss_release_oid.c,v 1.1 2006/06/30 09:34:54 lha Exp $");
+RCSID("$Id: gss_release_oid.c 17747 2006-06-30 09:34:54Z lha $");
 
 OM_uint32
 gss_release_oid(OM_uint32 *minor_status, gss_OID *oid)
 
 OM_uint32
 gss_release_oid(OM_uint32 *minor_status, gss_OID *oid)
index 101657e4fbb74992d70bf52ee7a82b95504d023f..4372e622948b2bf0efd28acb599138360cecd102 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_release_oid_set.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_release_oid_set.c 19963 2007-01-17 16:01:22Z lha $");
 
 OM_uint32
 gss_release_oid_set(OM_uint32 *minor_status,
 
 OM_uint32
 gss_release_oid_set(OM_uint32 *minor_status,
@@ -39,7 +39,7 @@ gss_release_oid_set(OM_uint32 *minor_status,
                if ((*set)->elements)
                        free((*set)->elements);
                free(*set);
                if ((*set)->elements)
                        free((*set)->elements);
                free(*set);
-               *set = 0;
+               *set = GSS_C_NO_OID_SET;
        }
        return (GSS_S_COMPLETE);
 }
        }
        return (GSS_S_COMPLETE);
 }
index 2f66f90d4f78adab72d0a8a59a17dacc564b57c7..71c5e70dc751c931443ec6821e31ec580104d071 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_seal.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_seal.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_seal(OM_uint32 *minor_status,
 
 OM_uint32
 gss_seal(OM_uint32 *minor_status,
index f813d72ac8bc9ac0efbf11d836e5fb19a2a9ac5c..78c8cc79c105500ab1bc413517144a42639b45ff 100644 (file)
@@ -31,7 +31,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_set_cred_option.c,v 1.8 2006/11/13 08:59:43 lha Exp $");
+RCSID("$Id: gss_set_cred_option.c 20626 2007-05-08 13:56:49Z lha $");
 
 OM_uint32
 gss_set_cred_option (OM_uint32 *minor_status,
 
 OM_uint32
 gss_set_cred_option (OM_uint32 *minor_status,
@@ -55,7 +55,6 @@ gss_set_cred_option (OM_uint32 *minor_status,
                if (cred == NULL)
                    return GSS_S_FAILURE;
 
                if (cred == NULL)
                    return GSS_S_FAILURE;
 
-               cred->gc_usage = GSS_C_BOTH; /* XXX */
                SLIST_INIT(&cred->gc_mc);
 
                SLIST_FOREACH(m, &_gss_mechs, gm_link) {
                SLIST_INIT(&cred->gc_mc);
 
                SLIST_FOREACH(m, &_gss_mechs, gm_link) {
@@ -104,6 +103,9 @@ gss_set_cred_option (OM_uint32 *minor_status,
                            &mc->gmc_cred, object, value);
                        if (major_status == GSS_S_COMPLETE)
                                one_ok = 1;
                            &mc->gmc_cred, object, value);
                        if (major_status == GSS_S_COMPLETE)
                                one_ok = 1;
+                       else
+                               _gss_mg_error(m, major_status, *minor_status);
+
                }
        }
        if (one_ok) {
                }
        }
        if (one_ok) {
index aa562a23b61d08d2f9b3dbb5faf9f9788adbd2fd..d312251f53305909fde80a1897b60f9ec523ea25 100644 (file)
@@ -31,7 +31,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_set_sec_context_option.c,v 1.2 2006/06/28 14:39:00 lha Exp $");
+RCSID("$Id: gss_set_sec_context_option.c 19928 2007-01-16 10:37:54Z lha $");
 
 OM_uint32
 gss_set_sec_context_option (OM_uint32 *minor_status,
 
 OM_uint32
 gss_set_sec_context_option (OM_uint32 *minor_status,
@@ -58,10 +58,12 @@ gss_set_sec_context_option (OM_uint32 *minor_status,
        if (m == NULL)
                return GSS_S_BAD_MECH;
 
        if (m == NULL)
                return GSS_S_BAD_MECH;
 
-       if (m->gm_set_sec_context_option != NULL)
+       if (m->gm_set_sec_context_option != NULL) {
                major_status = m->gm_set_sec_context_option(minor_status,
                    &ctx->gc_ctx, object, value);
                major_status = m->gm_set_sec_context_option(minor_status,
                    &ctx->gc_ctx, object, value);
-       else
+               if (major_status != GSS_S_COMPLETE)
+                       _gss_mg_error(m, major_status, *minor_status);
+       } else
                major_status = GSS_S_BAD_MECH;
 
        return major_status;
                major_status = GSS_S_BAD_MECH;
 
        return major_status;
index 8c854e5e4345705f8cc68b2ea3cf6cee53396372..5268197c6165b5df0a5ad555f7232e00879d0bf6 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_sign.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_sign.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_sign(OM_uint32 *minor_status,
 
 OM_uint32
 gss_sign(OM_uint32 *minor_status,
index a71a8b7c922fb4cee2260882f03536d004725371..fc3c5ddeeff1cc8e68207b7c8467dc72cddf98bf 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_test_oid_set_member.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_test_oid_set_member.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_test_oid_set_member(OM_uint32 *minor_status,
 
 OM_uint32
 gss_test_oid_set_member(OM_uint32 *minor_status,
index 128dc7883c2d1e34e9b6b62caca101e8381bbb3d..205cc6e326c8c290584103a1a8553d56e990ef78 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_unseal.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_unseal.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_unseal(OM_uint32 *minor_status,
 
 OM_uint32
 gss_unseal(OM_uint32 *minor_status,
index 1c9484b18dc5b0f9537814e30eb32089f0c293ad..69c125356beaeb7afa14b351e5235ebb173001b8 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_unwrap.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_unwrap.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_unwrap(OM_uint32 *minor_status,
 
 OM_uint32
 gss_unwrap(OM_uint32 *minor_status,
index d674fb163b273d86c805ce54fe1e31995d80f43d..22217a9d62b770419aa77d6c20c25d63693b271c 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_utils.c,v 1.3 2006/12/18 13:01:25 lha Exp $");
+RCSID("$Id: gss_utils.c 19965 2007-01-17 16:23:47Z lha $");
 
 OM_uint32
 _gss_copy_oid(OM_uint32 *minor_status,
 
 OM_uint32
 _gss_copy_oid(OM_uint32 *minor_status,
@@ -38,6 +38,7 @@ _gss_copy_oid(OM_uint32 *minor_status,
        *minor_status = 0;
        to_oid->elements = malloc(len);
        if (!to_oid->elements) {
        *minor_status = 0;
        to_oid->elements = malloc(len);
        if (!to_oid->elements) {
+               to_oid->length = 0;
                *minor_status = ENOMEM;
                return GSS_S_FAILURE;
        }
                *minor_status = ENOMEM;
                return GSS_S_FAILURE;
        }
@@ -68,6 +69,7 @@ _gss_copy_buffer(OM_uint32 *minor_status,
        to_buf->value = malloc(len);
        if (!to_buf->value) {
                *minor_status = ENOMEM;
        to_buf->value = malloc(len);
        if (!to_buf->value) {
                *minor_status = ENOMEM;
+               to_buf->length = 0;
                return GSS_S_FAILURE;
        }
        to_buf->length = len;
                return GSS_S_FAILURE;
        }
        to_buf->length = len;
index a99d17e2d71e22b6a9e9523a892b8b7bb1601924..f11cac7d2e3423974091290d510aa53d5c675b27 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_verify.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_verify.c 17700 2006-06-28 09:00:26Z lha $");
 
 OM_uint32
 gss_verify(OM_uint32 *minor_status,
 
 OM_uint32
 gss_verify(OM_uint32 *minor_status,
index b51ed7a8c498a0af2b8230186ddb27f0e84efeb3..118f50735ff9c371e418e85fc650204f3a39d4be 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_verify_mic.c,v 1.2 2006/06/28 09:00:25 lha Exp $");
+RCSID("$Id: gss_verify_mic.c 19965 2007-01-17 16:23:47Z lha $");
 
 OM_uint32
 gss_verify_mic(OM_uint32 *minor_status,
 
 OM_uint32
 gss_verify_mic(OM_uint32 *minor_status,
@@ -39,6 +39,13 @@ gss_verify_mic(OM_uint32 *minor_status,
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
 
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
 
+       if (qop_state)
+           *qop_state = 0;
+       if (ctx == NULL) {
+           *minor_status = 0;
+           return GSS_S_NO_CONTEXT;
+       }
+
        return (m->gm_verify_mic(minor_status, ctx->gc_ctx,
                    message_buffer, token_buffer, qop_state));
 }
        return (m->gm_verify_mic(minor_status, ctx->gc_ctx,
                    message_buffer, token_buffer, qop_state));
 }
index a97ec1308f07e57a33306a3ae78f8018090b3168..0eb9dfbc6db689b0ac3e14fc52cc0658d932655b 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_wrap.c,v 1.2 2006/06/28 09:00:26 lha Exp $");
+RCSID("$Id: gss_wrap.c 19965 2007-01-17 16:23:47Z lha $");
 
 OM_uint32
 gss_wrap(OM_uint32 *minor_status,
 
 OM_uint32
 gss_wrap(OM_uint32 *minor_status,
@@ -41,6 +41,14 @@ gss_wrap(OM_uint32 *minor_status,
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
 
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
 
+       if (conf_state)
+           *conf_state = 0;
+       _mg_buffer_zero(output_message_buffer);
+       if (ctx == NULL) {
+           *minor_status = 0;
+           return GSS_S_NO_CONTEXT;
+       }
+
        return (m->gm_wrap(minor_status, ctx->gc_ctx,
                    conf_req_flag, qop_req, input_message_buffer,
                    conf_state, output_message_buffer));
        return (m->gm_wrap(minor_status, ctx->gc_ctx,
                    conf_req_flag, qop_req, input_message_buffer,
                    conf_state, output_message_buffer));
index 27493aa90d52474393eb8df8ae5acc32f0e59fd6..35b3ad723d7df53a35148bd2868beb5c1eefcdeb 100644 (file)
@@ -27,7 +27,7 @@
  */
 
 #include "mech_locl.h"
  */
 
 #include "mech_locl.h"
-RCSID("$Id: gss_wrap_size_limit.c,v 1.2 2006/06/28 09:00:26 lha Exp $");
+RCSID("$Id: gss_wrap_size_limit.c 19965 2007-01-17 16:23:47Z lha $");
 
 OM_uint32
 gss_wrap_size_limit(OM_uint32 *minor_status,
 
 OM_uint32
 gss_wrap_size_limit(OM_uint32 *minor_status,
@@ -39,6 +39,12 @@ gss_wrap_size_limit(OM_uint32 *minor_status,
 {
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
 {
        struct _gss_context *ctx = (struct _gss_context *) context_handle;
        gssapi_mech_interface m = ctx->gc_mech;
+       
+       *max_input_size = 0;
+       if (ctx == NULL) {
+           *minor_status = 0;
+           return GSS_S_NO_CONTEXT;
+       }
 
        return (m->gm_wrap_size_limit(minor_status, ctx->gc_ctx,
                    conf_req_flag, qop_req, req_output_size, max_input_size));
 
        return (m->gm_wrap_size_limit(minor_status, ctx->gc_ctx,
                    conf_req_flag, qop_req, req_output_size, max_input_size));
index 544618b7d4d8b7475698f1e26f5a176b00e7723e..44b30bfa7ebd1a7efc776bdb529f61e7f2b21287 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: gssapi.asn1,v 1.3 2006/10/18 21:08:19 lha Exp $
+-- $Id: gssapi.asn1 18565 2006-10-18 21:08:19Z lha $
 
 GSS-API DEFINITIONS ::= BEGIN
 
 
 GSS-API DEFINITIONS ::= BEGIN
 
index f5db15c5fa1ed150b194442c192714ff11ae5e48..4399fa78a681e75dbad8ee5bb105c5ed0608f23e 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: mech_locl.h,v 1.4 2006/10/07 18:25:27 lha Exp $ */
+/* $Id: mech_locl.h 19948 2007-01-17 10:03:07Z lha $ */
 
 #include <config.h>
 
 
 #include <config.h>
 
@@ -61,3 +61,6 @@
 #include "mech_switch.h"
 #include "name.h"
 #include "utils.h"
 #include "mech_switch.h"
 #include "name.h"
 #include "utils.h"
+
+#define _mg_buffer_zero(buffer) \
+       do { (buffer)->value = NULL; (buffer)->length = 0; } while(0)
index 0984d36ef3990c594872707cf2fcdfdeee5b1ba6..14e6d7978c058e9882001178e7e3bb12b9f76661 100644 (file)
@@ -24,7 +24,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/mech_switch.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/mech_switch.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
- *     $Id: mech_switch.h,v 1.3 2006/10/05 18:31:53 lha Exp $
+ *     $Id: mech_switch.h 18246 2006-10-05 18:36:07Z lha $
  */
 
 #include <gssapi_mech.h>
  */
 
 #include <gssapi_mech.h>
index 3e7443ba207f71630572778d1a4d2e83d75ede7f..2252150a06f6a6ced8de6a633506b3936e6ec815 100644 (file)
@@ -24,7 +24,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/name.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/name.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
- *     $Id: name.h,v 1.4 2006/10/05 18:36:07 lha Exp $
+ *     $Id: name.h 18246 2006-10-05 18:36:07Z lha $
  */
 
 struct _gss_mechanism_name {
  */
 
 struct _gss_mechanism_name {
index 42e92c3f42bc57f5ba6a56797de0d70034de2120..908203557ee3d319b1d461e1bf998364f536da71 100644 (file)
@@ -24,7 +24,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/utils.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/lib/libgssapi/utils.h,v 1.1 2005/12/29 14:40:20 dfr Exp $
- *     $Id: utils.h,v 1.4 2006/12/18 13:01:40 lha Exp $
+ *     $Id: utils.h 19398 2006-12-18 13:01:40Z lha $
  */
 
 OM_uint32 _gss_free_oid(OM_uint32 *, gss_OID);
  */
 
 OM_uint32 _gss_free_oid(OM_uint32 *, gss_OID);
index 2c86b3f794ed19e392900c1ab09bae56e25b1b06..106897b9b09832b3a1b29e3b59e5f711b92feeb0 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c,v 1.16 2006/12/19 12:10:35 lha Exp $");
+RCSID("$Id: accept_sec_context.c 20929 2007-06-05 21:19:22Z lha $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -92,7 +92,7 @@ send_supported_mechs (OM_uint32 *minor_status,
                      gss_buffer_t output_token)
 {
     NegotiationTokenWin nt;
                      gss_buffer_t output_token)
 {
     NegotiationTokenWin nt;
-    char hostname[MAXHOSTNAMELEN], *p;
+    char hostname[MAXHOSTNAMELEN + 1], *p;
     gss_buffer_desc name_buf;
     gss_OID name_type;
     gss_name_t target_princ;
     gss_buffer_desc name_buf;
     gss_OID name_type;
     gss_name_t target_princ;
@@ -117,11 +117,12 @@ send_supported_mechs (OM_uint32 *minor_status,
     }
 
     memset(&target_princ, 0, sizeof(target_princ));
     }
 
     memset(&target_princ, 0, sizeof(target_princ));
-    if (gethostname(hostname, sizeof(hostname) - 1) != 0) {
+    if (gethostname(hostname, sizeof(hostname) - 2) != 0) {
        *minor_status = errno;
        free_NegotiationTokenWin(&nt);
        return GSS_S_FAILURE;
     }
        *minor_status = errno;
        free_NegotiationTokenWin(&nt);
        return GSS_S_FAILURE;
     }
+    hostname[sizeof(hostname) - 1] = '\0';
 
     /* Send the constructed SAM name for this host */
     for (p = hostname; *p != '\0' && *p != '.'; p++) {
 
     /* Send the constructed SAM name for this host */
     for (p = hostname; *p != '\0' && *p != '.'; p++) {
@@ -662,6 +663,11 @@ acceptor_start
                                     &ctx->mech_time_rec,
                                     &mech_delegated_cred);
        if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
                                     &ctx->mech_time_rec,
                                     &mech_delegated_cred);
        if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
+           ctx->preferred_mech_type = preferred_mech_type;
+           ctx->negotiated_mech_type = preferred_mech_type;
+           if (ret == GSS_S_COMPLETE)
+               ctx->open = 1;
+
            if (delegated_cred_handle)
                ret = _gss_spnego_alloc_cred(minor_status,
                                             mech_delegated_cred,
            if (delegated_cred_handle)
                ret = _gss_spnego_alloc_cred(minor_status,
                                             mech_delegated_cred,
@@ -669,11 +675,6 @@ acceptor_start
            else
                gss_release_cred(&ret2, &mech_delegated_cred);
 
            else
                gss_release_cred(&ret2, &mech_delegated_cred);
 
-           ctx->preferred_mech_type = preferred_mech_type;
-           ctx->negotiated_mech_type = preferred_mech_type;
-           if (ret == GSS_S_COMPLETE)
-               ctx->open = 1;
-
            ret = acceptor_complete(minor_status,
                                    ctx,
                                    &get_mic,
            ret = acceptor_complete(minor_status,
                                    ctx,
                                    &get_mic,
index 786eac13400aa208534ab2bc71bcaad45a1b6fcd..bc7da9410e6a71317e7f65d3a8300353c2005afd 100644 (file)
@@ -32,7 +32,7 @@
 
 #include "spnego/spnego_locl.h"
 
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: compat.c,v 1.9 2006/12/18 17:52:26 lha Exp $");
+RCSID("$Id: compat.c 19415 2006-12-18 17:52:26Z lha $");
 
 /*
  * Apparently Microsoft got the OID wrong, and used
 
 /*
  * Apparently Microsoft got the OID wrong, and used
index 57bc45a49276c7e6efef472392adaa0d6c2fa0c7..3535c7bb3596cb782b0fe745eb5fd1ad8478d529 100644 (file)
@@ -32,7 +32,7 @@
 
 #include "spnego/spnego_locl.h"
 
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: context_stubs.c,v 1.9 2006/12/18 12:59:44 lha Exp $");
+RCSID("$Id: context_stubs.c 21035 2007-06-09 15:32:47Z lha $");
 
 static OM_uint32
 spnego_supported_mechs(OM_uint32 *minor_status, gss_OID_set *mechs)
 
 static OM_uint32
 spnego_supported_mechs(OM_uint32 *minor_status, gss_OID_set *mechs)
@@ -310,7 +310,7 @@ OM_uint32 _gss_spnego_display_name
 
     *minor_status = 0;
 
 
     *minor_status = 0;
 
-    if (name->mech == GSS_C_NO_NAME)
+    if (name == NULL || name->mech == GSS_C_NO_NAME)
        return GSS_S_FAILURE;
 
     return gss_display_name(minor_status, name->mech,
        return GSS_S_FAILURE;
 
     return gss_display_name(minor_status, name->mech,
index 8f8edab15eb5335f28a8eaf91fe34e9a70d6df57..2362e99019633ed88cddc1c608ad1907a09ec59c 100644 (file)
@@ -32,7 +32,7 @@
 
 #include "spnego/spnego_locl.h"
 
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: cred_stubs.c,v 1.5 2006/10/07 22:27:04 lha Exp $");
+RCSID("$Id: cred_stubs.c 20619 2007-05-08 13:43:45Z lha $");
 
 OM_uint32
 _gss_spnego_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
 
 OM_uint32
 _gss_spnego_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
@@ -97,6 +97,8 @@ OM_uint32 _gss_spnego_acquire_cred
  OM_uint32 * time_rec
     )
 {
  OM_uint32 * time_rec
     )
 {
+    const spnego_name dname = (const spnego_name)desired_name;
+    gss_name_t name = GSS_C_NO_NAME;
     OM_uint32 ret, tmp;
     gss_OID_set_desc actual_desired_mechs;
     gss_OID_set mechs;
     OM_uint32 ret, tmp;
     gss_OID_set_desc actual_desired_mechs;
     gss_OID_set mechs;
@@ -106,9 +108,18 @@ OM_uint32 _gss_spnego_acquire_cred
 
     *output_cred_handle = GSS_C_NO_CREDENTIAL;
 
 
     *output_cred_handle = GSS_C_NO_CREDENTIAL;
 
+    if (dname) {
+       ret = gss_import_name(minor_status, &dname->value, &dname->type, &name);
+       if (ret) {
+           return ret;
+       }
+    }
+    
     ret = gss_indicate_mechs(minor_status, &mechs);
     ret = gss_indicate_mechs(minor_status, &mechs);
-    if (ret != GSS_S_COMPLETE)
+    if (ret != GSS_S_COMPLETE) {
+       gss_release_name(minor_status, &name);
        return ret;
        return ret;
+    }
 
     /* Remove ourselves from this list */
     actual_desired_mechs.count = mechs->count;
 
     /* Remove ourselves from this list */
     actual_desired_mechs.count = mechs->count;
@@ -135,7 +146,7 @@ OM_uint32 _gss_spnego_acquire_cred
        goto out;
 
     cred = (gssspnego_cred)cred_handle;
        goto out;
 
     cred = (gssspnego_cred)cred_handle;
-    ret = gss_acquire_cred(minor_status, desired_name,
+    ret = gss_acquire_cred(minor_status, name,
                           time_req, &actual_desired_mechs,
                           cred_usage,
                           &cred->negotiated_cred_id,
                           time_req, &actual_desired_mechs,
                           cred_usage,
                           &cred->negotiated_cred_id,
@@ -146,6 +157,7 @@ OM_uint32 _gss_spnego_acquire_cred
     *output_cred_handle = cred_handle;
 
 out:
     *output_cred_handle = cred_handle;
 
 out:
+    gss_release_name(minor_status, &name);
     gss_release_oid_set(&tmp, &mechs);
     if (actual_desired_mechs.elements != NULL) {
        free(actual_desired_mechs.elements);
     gss_release_oid_set(&tmp, &mechs);
     if (actual_desired_mechs.elements != NULL) {
        free(actual_desired_mechs.elements);
@@ -167,6 +179,7 @@ OM_uint32 _gss_spnego_inquire_cred
            )
 {
     gssspnego_cred cred;
            )
 {
     gssspnego_cred cred;
+    spnego_name sname = NULL;
     OM_uint32 ret;
 
     if (cred_handle == GSS_C_NO_CREDENTIAL) {
     OM_uint32 ret;
 
     if (cred_handle == GSS_C_NO_CREDENTIAL) {
@@ -174,14 +187,29 @@ OM_uint32 _gss_spnego_inquire_cred
        return GSS_S_NO_CRED;
     }
 
        return GSS_S_NO_CRED;
     }
 
+    if (name) {
+       sname = calloc(1, sizeof(*sname));
+       if (sname == NULL) {
+           *minor_status = ENOMEM;
+           return GSS_S_FAILURE;
+       }
+    }
+
     cred = (gssspnego_cred)cred_handle;
 
     ret = gss_inquire_cred(minor_status,
                           cred->negotiated_cred_id,
     cred = (gssspnego_cred)cred_handle;
 
     ret = gss_inquire_cred(minor_status,
                           cred->negotiated_cred_id,
-                          name,
+                          sname ? &sname->mech : NULL,
                           lifetime,
                           cred_usage,
                           mechanisms);
                           lifetime,
                           cred_usage,
                           mechanisms);
+    if (ret) {
+       if (sname)
+           free(sname);
+       return ret;
+    }
+    if (name)
+       *name = (gss_name_t)sname;
 
     return ret;
 }
 
     return ret;
 }
@@ -246,6 +274,7 @@ OM_uint32 _gss_spnego_inquire_cred_by_mech (
            )
 {
     gssspnego_cred cred;
            )
 {
     gssspnego_cred cred;
+    spnego_name sname = NULL;
     OM_uint32 ret;
 
     if (cred_handle == GSS_C_NO_CREDENTIAL) {
     OM_uint32 ret;
 
     if (cred_handle == GSS_C_NO_CREDENTIAL) {
@@ -253,17 +282,33 @@ OM_uint32 _gss_spnego_inquire_cred_by_mech (
        return GSS_S_NO_CRED;
     }
 
        return GSS_S_NO_CRED;
     }
 
+    if (name) {
+       sname = calloc(1, sizeof(*sname));
+       if (sname == NULL) {
+           *minor_status = ENOMEM;
+           return GSS_S_FAILURE;
+       }
+    }
+
     cred = (gssspnego_cred)cred_handle;
 
     ret = gss_inquire_cred_by_mech(minor_status,
                                   cred->negotiated_cred_id,
                                   mech_type,
     cred = (gssspnego_cred)cred_handle;
 
     ret = gss_inquire_cred_by_mech(minor_status,
                                   cred->negotiated_cred_id,
                                   mech_type,
-                                  name,
+                                  sname ? &sname->mech : NULL,
                                   initiator_lifetime,
                                   acceptor_lifetime,
                                   cred_usage);
 
                                   initiator_lifetime,
                                   acceptor_lifetime,
                                   cred_usage);
 
-    return ret;
+    if (ret) {
+       if (sname)
+           free(sname);
+       return ret;
+    }
+    if (name)
+       *name = (gss_name_t)sname;
+
+    return GSS_S_COMPLETE;
 }
 
 OM_uint32 _gss_spnego_inquire_cred_by_oid
 }
 
 OM_uint32 _gss_spnego_inquire_cred_by_oid
index b7e02a55e144c2cd15a9441c5457ff8b3e0cddca..fbc231f3aebbdb53d73ff8d31a8e55e105f10daf 100644 (file)
@@ -33,7 +33,7 @@
 #include "spnego/spnego_locl.h"
 #include <gssapi_mech.h>
 
 #include "spnego/spnego_locl.h"
 #include <gssapi_mech.h>
 
-RCSID("$Id: external.c,v 1.7 2006/10/07 22:27:06 lha Exp $");
+RCSID("$Id: external.c 18336 2006-10-07 22:27:13Z lha $");
 
 /*
  * RFC2478, SPNEGO:
 
 /*
  * RFC2478, SPNEGO:
index a221281a70797d4698951243369d1956c00613b1..7c74981e664e880a9bd6ee45da07d2d947df6978 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: init_sec_context.c,v 1.11 2006/12/18 15:42:03 lha Exp $");
+RCSID("$Id: init_sec_context.c 19411 2006-12-18 15:42:03Z lha $");
 
 /*
  * Is target_name an sane target for `mech´.
 
 /*
  * Is target_name an sane target for `mech´.
index 76fafa356c33d2be5ff00ddc0ada19e4de50fd66..aed67dc4ae74ffccfece148eefdd41d739efe399 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: spnego.asn1,v 1.3 2006/12/18 18:28:49 lha Exp $
+-- $Id: spnego.asn1 19420 2006-12-18 18:28:49Z lha $
 
 SPNEGO DEFINITIONS ::=
 BEGIN
 
 SPNEGO DEFINITIONS ::=
 BEGIN
index 45dff04313baefba9afa58f163f618fc896c4049..44b24688e18ff639119fba1c259b3ebb3dbe9bb5 100644 (file)
@@ -30,7 +30,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: spnego_locl.h,v 1.15 2006/12/18 15:42:03 lha Exp $ */
+/* $Id: spnego_locl.h 19411 2006-12-18 15:42:03Z lha $ */
 
 #ifndef SPNEGO_LOCL_H
 #define SPNEGO_LOCL_H
 
 #ifndef SPNEGO_LOCL_H
 #define SPNEGO_LOCL_H
similarity index 98%
rename from source4/heimdal/lib/des/aes.c
rename to source4/heimdal/lib/hcrypto/aes.c
index 5e0069de9da34d435c84910359d403bd18b8eb11..a36459a457078aa0561438122fe73d56d6a6e6b7 100755 (executable)
@@ -34,7 +34,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: aes.c,v 1.5 2005/06/18 22:46:35 lha Exp $");
+RCSID("$Id: aes.c 15495 2005-06-18 22:47:33Z lha $");
 #endif
 
 #ifdef KRB5
 #endif
 
 #ifdef KRB5
similarity index 97%
rename from source4/heimdal/lib/des/aes.h
rename to source4/heimdal/lib/hcrypto/aes.h
index 3ea1c141be9872a0d62d843ee5421a51a437d812..e91d8e73e16711c1d298d7ce101e4fdad448f72b 100755 (executable)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: aes.h,v 1.6 2006/05/05 11:06:35 lha Exp $ */
+/* $Id: aes.h 17450 2006-05-05 11:11:43Z lha $ */
 
 #ifndef HEIM_AES_H
 #define HEIM_AES_H 1
 
 #ifndef HEIM_AES_H
 #define HEIM_AES_H 1
similarity index 99%
rename from source4/heimdal/lib/des/bn.c
rename to source4/heimdal/lib/hcrypto/bn.c
index c4230b6abcdf6f1419c5dad028a3398547bfcb41..698da2fe0b1d89b0923ed7a1593ddaa26b05082b 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: bn.c,v 1.9 2006/10/14 09:21:09 lha Exp $");
+RCSID("$Id: bn.c 18449 2006-10-14 09:21:09Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
similarity index 98%
rename from source4/heimdal/lib/des/bn.h
rename to source4/heimdal/lib/hcrypto/bn.h
index b0c90d36fc1f63f44d0ceadcb722dd300a60a913..82c9991c2cb96298545e3ac51d212101d474a7a4 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /*
  */
 
 /*
- * $Id: bn.h,v 1.3 2006/01/13 08:27:50 lha Exp $
+ * $Id: bn.h 16536 2006-01-13 08:27:50Z lha $
  */
 
 #ifndef _HEIM_BN_H
  */
 
 #ifndef _HEIM_BN_H
similarity index 99%
rename from source4/heimdal/lib/des/des.c
rename to source4/heimdal/lib/hcrypto/des.c
index 5b1f5c29f4f5e4fb409a6c00aaf40dd0ec2fd270..a4444a8a7c544e19adeb370c9b723a87efa65731 100644 (file)
@@ -45,7 +45,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: des.c,v 1.18 2006/04/24 14:26:19 lha Exp $");
+RCSID("$Id: des.c 17211 2006-04-24 14:26:19Z lha $");
 #endif
 
 #include <stdio.h>
 #endif
 
 #include <stdio.h>
similarity index 98%
rename from source4/heimdal/lib/des/des.h
rename to source4/heimdal/lib/hcrypto/des.h
index 890fab462ddad02aea15a53a6ea11af1323f3244..ac8deb8ab8449538cb65cab67d10e56b6c98647f 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: des.h,v 1.25 2006/01/08 21:47:28 lha Exp $ */
+/* $Id: des.h 16480 2006-01-08 21:47:29Z lha $ */
 
 #ifndef _DESperate_H
 #define _DESperate_H 1
 
 #ifndef _DESperate_H
 #define _DESperate_H 1
similarity index 98%
rename from source4/heimdal/lib/des/dh-imath.c
rename to source4/heimdal/lib/hcrypto/dh-imath.c
index ebf02c72beb594b8a8a84798f7210a0e48b87b8f..17592bbdf69d4474087c19c90b7be093d240c3aa 100644 (file)
@@ -43,7 +43,7 @@
 
 #include "imath/imath.h"
 
 
 #include "imath/imath.h"
 
-RCSID("$Id: dh-imath.c,v 1.6 2006/10/20 06:56:57 lha Exp $");
+RCSID("$Id: dh-imath.c 18645 2006-10-20 06:56:57Z lha $");
 
 static void
 BN2mpz(mpz_t *s, const BIGNUM *bn)
 
 static void
 BN2mpz(mpz_t *s, const BIGNUM *bn)
similarity index 98%
rename from source4/heimdal/lib/des/dh.c
rename to source4/heimdal/lib/hcrypto/dh.c
index 66d611f6d48b34a73c007ec1ce24d2900baf99a9..b558eb901cce84b9d0eabf1eddfe6e42f91cf772 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: dh.c,v 1.10 2006/10/19 17:31:51 lha Exp $");
+RCSID("$Id: dh.c 18618 2006-10-19 17:31:51Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
similarity index 98%
rename from source4/heimdal/lib/des/dh.h
rename to source4/heimdal/lib/hcrypto/dh.h
index 105d298bc3da766bf401b335ef0f351c2e10be89..e34390dc99c5c69c1a5c596cc1af6558fe3f34ff 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /*
  */
 
 /*
- * $Id: dh.h,v 1.6 2006/05/06 13:11:15 lha Exp $
+ * $Id: dh.h 17483 2006-05-06 13:11:15Z lha $
  */
 
 #ifndef _HEIM_DH_H
  */
 
 #ifndef _HEIM_DH_H
similarity index 98%
rename from source4/heimdal/lib/des/dsa.c
rename to source4/heimdal/lib/hcrypto/dsa.c
index 411597b1c66e8bd663fbccba013a4ba6d050cc9e..0dc59dac614fb6c71c6e486e2932b979018596b7 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: dsa.c,v 1.2 2006/05/07 11:31:58 lha Exp $");
+RCSID("$Id: dsa.c 17496 2006-05-07 11:31:58Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
similarity index 98%
rename from source4/heimdal/lib/des/dsa.h
rename to source4/heimdal/lib/hcrypto/dsa.h
index 18859effc846df8819af8c2d8c585486fdd846d5..0544b80118413e60ff779d78ce2120a504b4c4e2 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /*
  */
 
 /*
- * $Id: dsa.h,v 1.2 2006/01/13 15:26:52 lha Exp $
+ * $Id: dsa.h 16564 2006-01-13 15:26:52Z lha $
  */
 
 #ifndef _HEIM_DSA_H
  */
 
 #ifndef _HEIM_DSA_H
similarity index 93%
rename from source4/heimdal/lib/des/engine.c
rename to source4/heimdal/lib/hcrypto/engine.c
index b72339c362bf7e661699a3b02b48d163bcd2f979..1a754909c5b74db65d175d7aaca51f0acdee0c1e 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: engine.c,v 1.11 2006/10/19 14:23:00 lha Exp $");
+RCSID("$Id: engine.c 20828 2007-06-03 05:10:20Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -322,24 +322,4 @@ ENGINE_by_id(const char *id)
 void
 ENGINE_add_conf_module(void)
 {
 void
 ENGINE_add_conf_module(void)
 {
-    ENGINE *engine;
-
-    /*
-     * XXX Parse configuration file instead
-     */
-
-    engine = ENGINE_by_dso("/usr/heimdal/lib/hc-modules/hc-gmp.so", NULL);
-    if (engine == NULL)
-       return;
-    {
-       const RSA_METHOD *method = ENGINE_get_RSA(engine);
-       if (method)
-           RSA_set_default_method(method);
-    }
-    {
-       const DH_METHOD *method = ENGINE_get_DH(engine);
-       if (method)
-           DH_set_default_method(method);
-    }
-
 }
 }
similarity index 98%
rename from source4/heimdal/lib/des/engine.h
rename to source4/heimdal/lib/hcrypto/engine.h
index 65588f7d78f68cb9f5635c6785534e896b47162b..547a2d1324a4161ac4644037b0f7a2ac422c1c94 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /*
  */
 
 /*
- * $Id: engine.h,v 1.6 2006/05/06 12:34:36 lha Exp $
+ * $Id: engine.h 17475 2006-05-06 12:34:36Z lha $
  */
 
 #ifndef _HEIM_ENGINE_H
  */
 
 #ifndef _HEIM_ENGINE_H
similarity index 99%
rename from source4/heimdal/lib/des/evp.h
rename to source4/heimdal/lib/hcrypto/evp.h
index 2fdf8d076543e0b1d06de9cb55c4d12b288b07e2..a3fbc4c9cad0635f394b9649c15ed9d4d7bc41a2 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: evp.h,v 1.11 2006/10/07 17:21:24 lha Exp $ */
+/* $Id: evp.h 18312 2006-10-07 17:21:48Z lha $ */
 
 #ifndef HEIM_EVP_H
 #define HEIM_EVP_H 1
 
 #ifndef HEIM_EVP_H
 #define HEIM_EVP_H 1
similarity index 97%
rename from source4/heimdal/lib/des/hash.h
rename to source4/heimdal/lib/hcrypto/hash.h
index b6da9bd8e0fae019aceb7bf5bc76e3f0ba35f06a..d19f0c0ae1de35c03ac10b8c07b3372da508129a 100644 (file)
@@ -30,7 +30,7 @@
  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
 
  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
 
-/* $Id: hash.h,v 1.4 2006/05/05 11:06:49 lha Exp $ */
+/* $Id: hash.h 17450 2006-05-05 11:11:43Z lha $ */
 
 /* stuff in common between md4, md5, and sha1 */
 
 
 /* stuff in common between md4, md5, and sha1 */
 
similarity index 98%
rename from source4/heimdal/lib/des/hmac.h
rename to source4/heimdal/lib/hcrypto/hmac.h
index a72ab574e7de0eac830234bd761b1139a4e61083..5bdae0a369460d9ca38f02d8e247a8e3a411b302 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: hmac.h,v 1.3 2006/01/13 15:26:52 lha Exp $ */
+/* $Id: hmac.h 16564 2006-01-13 15:26:52Z lha $ */
 
 #ifndef HEIM_HMAC_H
 #define HEIM_HMAC_H 1
 
 #ifndef HEIM_HMAC_H
 #define HEIM_HMAC_H 1
similarity index 96%
rename from source4/heimdal/lib/des/imath/imath.c
rename to source4/heimdal/lib/hcrypto/imath/imath.c
index 0a124fa13fcd62f2cdb3561e901e59766e4d366b..376425788b0efe50a62248ec31e2922a535e4b8c 100755 (executable)
@@ -2,9 +2,9 @@
   Name:     imath.c
   Purpose:  Arbitrary precision integer arithmetic routines.
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
   Name:     imath.c
   Purpose:  Arbitrary precision integer arithmetic routines.
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
-  Info:     $Id: imath.c,v 1.6 2007/01/08 10:17:31 lha Exp $
+  Info:     $Id: imath.c 20854 2007-06-03 18:04:10Z lha $
 
 
-  Copyright (C) 2002 Michael J. Fromberger, All Rights Reserved.
+  Copyright (C) 2002-2007 Michael J. Fromberger, All Rights Reserved.
 
   Permission is hereby granted, free of charge, to any person
   obtaining a copy of this software and associated documentation files
 
   Permission is hereby granted, free of charge, to any person
   obtaining a copy of this software and associated documentation files
 #endif
 
 #include <stdlib.h>
 #endif
 
 #include <stdlib.h>
-#include <stdio.h>
 #include <string.h>
 #include <ctype.h>
 
 #include <assert.h>
 
 #include <string.h>
 #include <ctype.h>
 
 #include <assert.h>
 
+#if DEBUG
+#define static
+#endif
+
 /* {{{ Constants */
 
 const mp_result MP_OK     = 0;  /* no error, all is well  */
 /* {{{ Constants */
 
 const mp_result MP_OK     = 0;  /* no error, all is well  */
@@ -183,15 +186,13 @@ static const mp_size multiply_threshold = MP_MULT_THRESH;
 /* Allocate a buffer of (at least) num digits, or return
    NULL if that couldn't be done.  */
 static mp_digit *s_alloc(mp_size num);
 /* Allocate a buffer of (at least) num digits, or return
    NULL if that couldn't be done.  */
 static mp_digit *s_alloc(mp_size num);
-#if TRACEABLE_FREE
+
+/* Release a buffer of digits allocated by s_alloc(). */
 static void s_free(void *ptr);
 static void s_free(void *ptr);
-#else
-#define s_free(P) free(P)
-#endif
 
 /* Insure that z has at least min digits allocated, resizing if
    necessary.  Returns true if successful, false if out of memory. */
 
 /* Insure that z has at least min digits allocated, resizing if
    necessary.  Returns true if successful, false if out of memory. */
-int       s_pad(mp_int z, mp_size min);
+static int  s_pad(mp_int z, mp_size min);
 
 /* Normalize by removing leading zeroes (except when z = 0) */
 #if TRACEABLE_CLAMP
 
 /* Normalize by removing leading zeroes (except when z = 0) */
 #if TRACEABLE_CLAMP
@@ -284,7 +285,7 @@ static mp_result s_brmu(mp_int z, mp_int m);
 static int       s_reduce(mp_int x, mp_int m, mp_int mu, mp_int q1, mp_int q2);
 
 /* Modular exponentiation, using Barrett reduction */
 static int       s_reduce(mp_int x, mp_int m, mp_int mu, mp_int q1, mp_int q2);
 
 /* Modular exponentiation, using Barrett reduction */
-mp_result s_embar(mp_int a, mp_int b, mp_int m, mp_int mu, mp_int c);
+static mp_result s_embar(mp_int a, mp_int b, mp_int m, mp_int mu, mp_int c);
 
 /* Unsigned magnitude division.  Assumes |a| > |b|.  Allocates
    temporaries; overwrites a with quotient, b with remainder. */
 
 /* Unsigned magnitude division.  Assumes |a| > |b|.  Allocates
    temporaries; overwrites a with quotient, b with remainder. */
@@ -457,7 +458,7 @@ void      mp_int_free(mp_int z)
   NRCHECK(z != NULL);
 
   mp_int_clear(z);
   NRCHECK(z != NULL);
 
   mp_int_clear(z);
-  free(z);
+  free(z); /* note: NOT s_free() */
 }
 
 /* }}} */
 }
 
 /* }}} */
@@ -724,10 +725,11 @@ mp_result mp_int_mul(mp_int a, mp_int b, mp_int c)
   /* Output is positive if inputs have same sign, otherwise negative */
   osign = (MP_SIGN(a) == MP_SIGN(b)) ? MP_ZPOS : MP_NEG;
 
   /* Output is positive if inputs have same sign, otherwise negative */
   osign = (MP_SIGN(a) == MP_SIGN(b)) ? MP_ZPOS : MP_NEG;
 
-  /* If the output is not equal to any of the inputs, we'll write the
-     results there directly; otherwise, allocate a temporary space. */
+  /* If the output is not identical to any of the inputs, we'll write
+     the results directly; otherwise, allocate a temporary space. */
   ua = MP_USED(a); ub = MP_USED(b);
   ua = MP_USED(a); ub = MP_USED(b);
-  osize = ua + ub;
+  osize = MAX(ua, ub);
+  osize = 4 * ((osize + 1) / 2);
 
   if(c == a || c == b) {
     p = ROUND_PREC(osize);
 
   if(c == a || c == b) {
     p = ROUND_PREC(osize);
@@ -808,7 +810,7 @@ mp_result mp_int_sqr(mp_int a, mp_int c)
   CHECK(a != NULL && c != NULL);
 
   /* Get a temporary buffer big enough to hold the result */
   CHECK(a != NULL && c != NULL);
 
   /* Get a temporary buffer big enough to hold the result */
-  osize = (mp_size) 2 * MP_USED(a);
+  osize = (mp_size) 4 * ((MP_USED(a) + 1) / 2);
   if(a == c) {
     p = ROUND_PREC(osize);
     p = MAX(p, default_precision);
   if(a == c) {
     p = ROUND_PREC(osize);
     p = MAX(p, default_precision);
@@ -977,7 +979,6 @@ mp_result mp_int_mod(mp_int a, mp_int m, mp_int c)
 
 /* }}} */
 
 
 /* }}} */
 
-
 /* {{{ mp_int_div_value(a, value, q, r) */
 
 mp_result mp_int_div_value(mp_int a, int value, mp_int q, int *r)
 /* {{{ mp_int_div_value(a, value, q, r) */
 
 mp_result mp_int_div_value(mp_int a, int value, mp_int q, int *r)
@@ -2018,20 +2019,38 @@ static mp_digit *s_alloc(mp_size num)
   mp_digit *out = malloc(num * sizeof(mp_digit));
 
   assert(out != NULL); /* for debugging */
   mp_digit *out = malloc(num * sizeof(mp_digit));
 
   assert(out != NULL); /* for debugging */
+#if DEBUG > 1
+  {
+    mp_digit v = (mp_digit) 0xdeadbeef;
+    int      ix;
+
+    for(ix = 0; ix < num; ++ix)
+      out[ix] = v;
+  }
+#endif
 
   return out;
 }
 
 /* }}} */
 
 
   return out;
 }
 
 /* }}} */
 
-/* {{{ s_realloc(old, num) */
+/* {{{ s_realloc(old, osize, nsize) */
 
 
-static mp_digit *s_realloc(mp_digit *old, mp_size num)
+static mp_digit *s_realloc(mp_digit *old, mp_size osize, mp_size nsize)
 {
 {
-  mp_digit *new = realloc(old, num * sizeof(mp_digit));
+#if DEBUG > 1
+  mp_digit *new = s_alloc(nsize);
+  int       ix;
 
 
-  assert(new != NULL); /* for debugging */
+  for(ix = 0; ix < nsize; ++ix)
+    new[ix] = (mp_digit) 0xdeadbeef;
+
+  memcpy(new, old, osize * sizeof(mp_digit));
+#else
+  mp_digit *new = realloc(old, nsize * sizeof(mp_digit));
 
 
+  assert(new != NULL); /* for debugging */
+#endif
   return new;
 }
 
   return new;
 }
 
@@ -2039,18 +2058,16 @@ static mp_digit *s_realloc(mp_digit *old, mp_size num)
 
 /* {{{ s_free(ptr) */
 
 
 /* {{{ s_free(ptr) */
 
-#if TRACEABLE_FREE
 static void s_free(void *ptr)
 {
   free(ptr);
 }
 static void s_free(void *ptr)
 {
   free(ptr);
 }
-#endif
 
 /* }}} */
 
 /* {{{ s_pad(z, min) */
 
 
 /* }}} */
 
 /* {{{ s_pad(z, min) */
 
-int      s_pad(mp_int z, mp_size min)
+static int      s_pad(mp_int z, mp_size min)
 {
   if(MP_ALLOC(z) < min) {
     mp_size nsize = ROUND_PREC(min);
 {
   if(MP_ALLOC(z) < min) {
     mp_size nsize = ROUND_PREC(min);
@@ -2062,7 +2079,7 @@ int      s_pad(mp_int z, mp_size min)
 
       COPY(MP_DIGITS(z), tmp, MP_USED(z));
     }
 
       COPY(MP_DIGITS(z), tmp, MP_USED(z));
     }
-    else if((tmp = s_realloc(MP_DIGITS(z), nsize)) == NULL)
+    else if((tmp = s_realloc(MP_DIGITS(z), MP_ALLOC(z), nsize)) == NULL)
       return 0;
     
     MP_DIGITS(z) = tmp;
       return 0;
     
     MP_DIGITS(z) = tmp;
@@ -2292,26 +2309,26 @@ static int       s_kmul(mp_digit *da, mp_digit *db, mp_digit *dc,
        product; twice the space is plenty.
      */
     if((t1 = s_alloc(4 * buf_size)) == NULL) return 0;
        product; twice the space is plenty.
      */
     if((t1 = s_alloc(4 * buf_size)) == NULL) return 0;
-    t2 = t1 + buf_size; 
+    t2 = t1 + buf_size;
     t3 = t2 + buf_size;
     ZERO(t1, 4 * buf_size);
 
     /* t1 and t2 are initially used as temporaries to compute the inner product
        (a1 + a0)(b1 + b0) = a1b1 + a1b0 + a0b1 + a0b0
      */
     t3 = t2 + buf_size;
     ZERO(t1, 4 * buf_size);
 
     /* t1 and t2 are initially used as temporaries to compute the inner product
        (a1 + a0)(b1 + b0) = a1b1 + a1b0 + a0b1 + a0b0
      */
-    carry = s_uadd(da, a_top, t1, bot_size, at_size); /* t1 = a1 + a0 */
+    carry = s_uadd(da, a_top, t1, bot_size, at_size);      /* t1 = a1 + a0 */
     t1[bot_size] = carry;
 
     t1[bot_size] = carry;
 
-    carry = s_uadd(db, b_top, t2, bot_size, bt_size); /* t2 = b1 + b0 */
+    carry = s_uadd(db, b_top, t2, bot_size, bt_size);      /* t2 = b1 + b0 */
     t2[bot_size] = carry;
 
     t2[bot_size] = carry;
 
-    (void) s_kmul(t1, t2, t3, bot_size + 1, bot_size + 1);   /* t3 = t1 * t2 */
+    (void) s_kmul(t1, t2, t3, bot_size + 1, bot_size + 1); /* t3 = t1 * t2 */
 
     /* Now we'll get t1 = a0b0 and t2 = a1b1, and subtract them out so that
        we're left with only the pieces we want:  t3 = a1b0 + a0b1
      */
 
     /* Now we'll get t1 = a0b0 and t2 = a1b1, and subtract them out so that
        we're left with only the pieces we want:  t3 = a1b0 + a0b1
      */
-    ZERO(t1, bot_size + 1);
-    ZERO(t2, bot_size + 1);
+    ZERO(t1, buf_size);
+    ZERO(t2, buf_size);
     (void) s_kmul(da, db, t1, bot_size, bot_size);     /* t1 = a0 * b0 */
     (void) s_kmul(a_top, b_top, t2, at_size, bt_size); /* t2 = a1 * b1 */
 
     (void) s_kmul(da, db, t1, bot_size, bot_size);     /* t1 = a0 * b0 */
     (void) s_kmul(a_top, b_top, t2, at_size, bt_size); /* t2 = a1 * b1 */
 
@@ -2321,11 +2338,13 @@ static int       s_kmul(mp_digit *da, mp_digit *db, mp_digit *dc,
 
     /* Assemble the output value */
     COPY(t1, dc, buf_size);
 
     /* Assemble the output value */
     COPY(t1, dc, buf_size);
-    (void) s_uadd(t3, dc + bot_size, dc + bot_size,
-                 buf_size + 1, buf_size + 1); 
+    carry = s_uadd(t3, dc + bot_size, dc + bot_size,
+                  buf_size + 1, buf_size); 
+    assert(carry == 0);
     
     
-    (void) s_uadd(t2, dc + 2*bot_size, dc + 2*bot_size,
-                 buf_size, buf_size); 
+    carry = s_uadd(t2, dc + 2*bot_size, dc + 2*bot_size,
+                  buf_size, buf_size); 
+    assert(carry == 0);
     
     s_free(t1); /* note t2 and t3 are just internal pointers to t1 */
   } 
     
     s_free(t1); /* note t2 and t3 are just internal pointers to t1 */
   } 
@@ -2374,7 +2393,7 @@ static int       s_ksqr(mp_digit *da, mp_digit *dc, mp_size size_a)
   if(multiply_threshold && size_a > multiply_threshold) {
     mp_size    bot_size = (size_a + 1) / 2;
     mp_digit  *a_top = da + bot_size;
   if(multiply_threshold && size_a > multiply_threshold) {
     mp_size    bot_size = (size_a + 1) / 2;
     mp_digit  *a_top = da + bot_size;
-    mp_digit  *t1, *t2, *t3;
+    mp_digit  *t1, *t2, *t3, carry;
     mp_size    at_size = size_a - bot_size;
     mp_size    buf_size = 2 * bot_size;
 
     mp_size    at_size = size_a - bot_size;
     mp_size    buf_size = 2 * bot_size;
 
@@ -2404,13 +2423,15 @@ static int       s_ksqr(mp_digit *da, mp_digit *dc, mp_size size_a)
 
     /* Assemble the output value */
     COPY(t1, dc, 2 * bot_size);
 
     /* Assemble the output value */
     COPY(t1, dc, 2 * bot_size);
-    (void) s_uadd(t3, dc + bot_size, dc + bot_size,
-                 buf_size + 1, buf_size + 1);
-    
-    (void) s_uadd(t2, dc + 2*bot_size, dc + 2*bot_size,
-                 buf_size, buf_size);
+    carry = s_uadd(t3, dc + bot_size, dc + bot_size,
+                  buf_size + 1, buf_size);
+    assert(carry == 0);
+
+    carry = s_uadd(t2, dc + 2*bot_size, dc + 2*bot_size,
+                  buf_size, buf_size);
+    assert(carry == 0);
 
 
-    free(t1); /* note that t2 and t2 are internal pointers only */
+    s_free(t1); /* note that t2 and t2 are internal pointers only */
 
   } 
   else {
 
   } 
   else {
@@ -2707,7 +2728,9 @@ static int      s_qmul(mp_int z, mp_size p2)
 
 /* {{{ s_qsub(z, p2) */
 
 
 /* {{{ s_qsub(z, p2) */
 
-/* Subtract |z| from 2^p2, assuming 2^p2 > |z|, and set z to be positive */
+/* Compute z = 2^p2 - |z|; requires that 2^p2 >= |z|
+   The sign of the result is always zero/positive.
+ */
 static int       s_qsub(mp_int z, mp_size p2)
 {
   mp_digit hi = (1 << (p2 % MP_DIGIT_BIT)), *zp;
 static int       s_qsub(mp_int z, mp_size p2)
 {
   mp_digit hi = (1 << (p2 % MP_DIGIT_BIT)), *zp;
@@ -2885,10 +2908,11 @@ static int       s_reduce(mp_int x, mp_int m, mp_int mu, mp_int q1, mp_int q2)
 
   /* If x > m, we need to back it off until it is in range.
      This will be required at most twice.  */
 
   /* If x > m, we need to back it off until it is in range.
      This will be required at most twice.  */
-  if(mp_int_compare(x, m) >= 0)
-    (void) mp_int_sub(x, m, x);
-  if(mp_int_compare(x, m) >= 0)
+  if(mp_int_compare(x, m) >= 0) {
     (void) mp_int_sub(x, m, x);
     (void) mp_int_sub(x, m, x);
+    if(mp_int_compare(x, m) >= 0)
+      (void) mp_int_sub(x, m, x);
+  }
 
   /* At this point, x has been properly reduced. */
   return 1;
 
   /* At this point, x has been properly reduced. */
   return 1;
@@ -2900,7 +2924,7 @@ static int       s_reduce(mp_int x, mp_int m, mp_int mu, mp_int q1, mp_int q2)
 
 /* Perform modular exponentiation using Barrett's method, where mu is
    the reduction constant for m.  Assumes a < m, b > 0. */
 
 /* Perform modular exponentiation using Barrett's method, where mu is
    the reduction constant for m.  Assumes a < m, b > 0. */
-mp_result s_embar(mp_int a, mp_int b, mp_int m, mp_int mu, mp_int c)
+static mp_result s_embar(mp_int a, mp_int b, mp_int m, mp_int mu, mp_int c)
 {
   mp_digit  *db, *dbt, umu, d;
   mpz_t     temp[3]; 
 {
   mp_digit  *db, *dbt, umu, d;
   mpz_t     temp[3]; 
@@ -2909,8 +2933,10 @@ mp_result s_embar(mp_int a, mp_int b, mp_int m, mp_int mu, mp_int c)
 
   umu = MP_USED(mu); db = MP_DIGITS(b); dbt = db + MP_USED(b) - 1;
 
 
   umu = MP_USED(mu); db = MP_DIGITS(b); dbt = db + MP_USED(b) - 1;
 
-  while(last < 3) 
+  while(last < 3) {
     SETUP(mp_int_init_size(TEMP(last), 4 * umu), last);
     SETUP(mp_int_init_size(TEMP(last), 4 * umu), last);
+    ZERO(MP_DIGITS(TEMP(last - 1)), MP_ALLOC(TEMP(last - 1)));
+  }
 
   (void) mp_int_set_value(c, 1);
 
 
   (void) mp_int_set_value(c, 1);
 
@@ -3006,22 +3032,13 @@ static mp_result s_udiv(mp_int a, mp_int b)
 
   /* Solve for quotient digits, store in q.digits in reverse order */
   while(r.digits >= da) {
 
   /* Solve for quotient digits, store in q.digits in reverse order */
   while(r.digits >= da) {
-    if (qpos > q.alloc) {
-      char buf[1024];
-      printf("qpos = %d q.alloc = %d da = %d ua = %d\n",
-            (int)qpos, (int)q.alloc, (int)da, (int)ua);
-      mp_int_to_string(a, 10, buf, sizeof(buf));
-      printf("a = %s\n", buf);
-      mp_int_to_string(b, 10, buf, sizeof(buf));
-      printf("b = %s\n", buf);
-      assert(qpos <= q.alloc);
-    }  
+    assert(qpos <= q.alloc);
 
     if(s_ucmp(b, &r) > 0) {
       r.digits -= 1;
       r.used += 1;
       
 
     if(s_ucmp(b, &r) > 0) {
       r.digits -= 1;
       r.used += 1;
       
-      if(++skip > 1)
+      if(++skip > 1 && qpos > 0) 
        q.digits[qpos++] = 0;
       
       CLAMP(&r);
        q.digits[qpos++] = 0;
       
       CLAMP(&r);
@@ -3030,15 +3047,19 @@ static mp_result s_udiv(mp_int a, mp_int b)
       mp_word  pfx = r.digits[r.used - 1];
       mp_word  qdigit;
       
       mp_word  pfx = r.digits[r.used - 1];
       mp_word  qdigit;
       
-      if(r.used > 1 && (pfx < btop || r.digits[r.used - 2] == 0)) {
+      if(r.used > 1 && pfx <= btop) {
        pfx <<= MP_DIGIT_BIT / 2;
        pfx <<= MP_DIGIT_BIT / 2;
        pfx |= r.digits[r.used - 2];
       }
 
       qdigit = pfx / btop;
        pfx <<= MP_DIGIT_BIT / 2;
        pfx <<= MP_DIGIT_BIT / 2;
        pfx |= r.digits[r.used - 2];
       }
 
       qdigit = pfx / btop;
-      if(qdigit > MP_DIGIT_MAX) 
-       qdigit = 1;
+      if(qdigit > MP_DIGIT_MAX) {
+       if(qdigit & MP_DIGIT_MAX)
+         qdigit = MP_DIGIT_MAX;
+       else
+         qdigit = 1;
+      }
       
       s_dbmul(MP_DIGITS(b), (mp_digit) qdigit, t.digits, ub);
       t.used = ub + 1; CLAMP(&t);
       
       s_dbmul(MP_DIGITS(b), (mp_digit) qdigit, t.digits, ub);
       t.used = ub + 1; CLAMP(&t);
@@ -3055,7 +3076,7 @@ static mp_result s_udiv(mp_int a, mp_int b)
       skip = 0;
     }
   }
       skip = 0;
     }
   }
-  
+
   /* Put quotient digits in the correct order, and discard extra zeroes */
   q.used = qpos;
   REV(mp_digit, q.digits, qpos);
   /* Put quotient digits in the correct order, and discard extra zeroes */
   q.used = qpos;
   REV(mp_digit, q.digits, qpos);
similarity index 98%
rename from source4/heimdal/lib/des/imath/imath.h
rename to source4/heimdal/lib/hcrypto/imath/imath.h
index 93cc35654d45bdddfa22eb31829fab3c521131e0..f13c09d1a2ef18177581813a00786c2a5dc6ca83 100755 (executable)
@@ -2,9 +2,9 @@
   Name:     imath.h
   Purpose:  Arbitrary precision integer arithmetic routines.
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
   Name:     imath.h
   Purpose:  Arbitrary precision integer arithmetic routines.
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
-  Info:     $Id: imath.h,v 1.3 2006/10/21 16:32:15 lha Exp $
+  Info:     $Id: imath.h 20764 2007-06-01 03:55:14Z lha $
 
 
-  Copyright (C) 2002 Michael J. Fromberger, All Rights Reserved.
+  Copyright (C) 2002-2007 Michael J. Fromberger, All Rights Reserved.
 
   Permission is hereby granted, free of charge, to any person
   obtaining a copy of this software and associated documentation files
 
   Permission is hereby granted, free of charge, to any person
   obtaining a copy of this software and associated documentation files
@@ -94,7 +94,7 @@ extern const mp_result MP_BADARG;
    standard multiplication algorithm; otherwise, a recursive algorithm
    is used.  Choose a value to suit your platform.  
  */
    standard multiplication algorithm; otherwise, a recursive algorithm
    is used.  Choose a value to suit your platform.  
  */
-#define MP_MULT_THRESH  32
+#define MP_MULT_THRESH  22
 
 #define MP_DEFAULT_PREC 8   /* default memory allocation, in digits */
 
 
 #define MP_DEFAULT_PREC 8   /* default memory allocation, in digits */
 
similarity index 99%
rename from source4/heimdal/lib/des/imath/iprime.c
rename to source4/heimdal/lib/hcrypto/imath/iprime.c
index 582ade0f54283daa50f1746874dc90e436e86930..6313bab1b7110efc320d5a8f443c325908220c2c 100755 (executable)
@@ -2,7 +2,7 @@
   Name:     iprime.c
   Purpose:  Pseudoprimality testing routines
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
   Name:     iprime.c
   Purpose:  Pseudoprimality testing routines
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
-  Info:     $Id: iprime.c,v 1.5 2007/01/05 21:01:48 lha Exp $
+  Info:     $Id: iprime.c 19737 2007-01-05 21:01:48Z lha $
 
   Copyright (C) 2002 Michael J. Fromberger, All Rights Reserved.
 
 
   Copyright (C) 2002 Michael J. Fromberger, All Rights Reserved.
 
similarity index 96%
rename from source4/heimdal/lib/des/imath/iprime.h
rename to source4/heimdal/lib/hcrypto/imath/iprime.h
index cd54a7312787aab55eeb37f2b7c171cb136f7565..c935cdc11108f960423cc8275ef8d5274b251ddd 100755 (executable)
@@ -2,7 +2,7 @@
   Name:     iprime.h
   Purpose:  Pseudoprimality testing routines
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
   Name:     iprime.h
   Purpose:  Pseudoprimality testing routines
   Author:   M. J. Fromberger <http://www.dartmouth.edu/~sting/>
-  Info:     $Id: iprime.h,v 1.3 2006/10/21 16:32:30 lha Exp $
+  Info:     $Id: iprime.h 18759 2006-10-21 16:32:36Z lha $
 
   Copyright (C) 2002 Michael J. Fromberger, All Rights Reserved.
 
 
   Copyright (C) 2002 Michael J. Fromberger, All Rights Reserved.
 
similarity index 98%
rename from source4/heimdal/lib/des/md2.c
rename to source4/heimdal/lib/hcrypto/md2.c
index 91d7afd125b424028bc0d68aaa4299ec7331537a..84b66c225f97d56fa0a8b63ded16c742535e4a8f 100644 (file)
@@ -34,7 +34,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: md2.c,v 1.1 2006/01/08 21:47:28 lha Exp $");
+RCSID("$Id: md2.c 16480 2006-01-08 21:47:29Z lha $");
 #endif
 
 #include "hash.h"
 #endif
 
 #include "hash.h"
similarity index 97%
rename from source4/heimdal/lib/des/md2.h
rename to source4/heimdal/lib/hcrypto/md2.h
index f305d943aa33f0aa6f75e12703a4a6692bf32ee6..cf3960b93503819c85e6a054d3b6fbc319c67568 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: md2.h,v 1.1 2006/01/08 21:47:28 lha Exp $ */
+/* $Id: md2.h 16480 2006-01-08 21:47:29Z lha $ */
 
 #ifndef HEIM_MD2_H
 #define HEIM_MD2_H 1
 
 #ifndef HEIM_MD2_H
 #define HEIM_MD2_H 1
similarity index 99%
rename from source4/heimdal/lib/des/md4.c
rename to source4/heimdal/lib/hcrypto/md4.c
index ded4fe12e8fab42703d2436c48f1b926f5c24e88..95ab340b48fdc7d0e46b47ddc0f271feafa9a00a 100644 (file)
@@ -34,7 +34,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: md4.c,v 1.18 2006/05/05 10:22:04 lha Exp $");
+RCSID("$Id: md4.c 17445 2006-05-05 10:37:46Z lha $");
 #endif
 
 #include "hash.h"
 #endif
 
 #include "hash.h"
similarity index 97%
rename from source4/heimdal/lib/des/md4.h
rename to source4/heimdal/lib/hcrypto/md4.h
index f8c011b9b79b4799b9ee4b4e04d22d9da0f3a3d7..8725209d02dc540821f893d870672498cb09b27a 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: md4.h,v 1.11 2006/05/05 11:07:01 lha Exp $ */
+/* $Id: md4.h 17450 2006-05-05 11:11:43Z lha $ */
 
 #ifndef HEIM_MD4_H
 #define HEIM_MD4_H 1
 
 #ifndef HEIM_MD4_H
 #define HEIM_MD4_H 1
similarity index 99%
rename from source4/heimdal/lib/des/md5.c
rename to source4/heimdal/lib/hcrypto/md5.c
index e23d6c8fd7108f1191887353698cd0db33c73e51..b145fd2ac775b9c11be3d1aafa0def00e7723d1c 100644 (file)
@@ -34,7 +34,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: md5.c,v 1.18 2006/05/05 10:22:35 lha Exp $");
+RCSID("$Id: md5.c 17445 2006-05-05 10:37:46Z lha $");
 #endif
 
 #include "hash.h"
 #endif
 
 #include "hash.h"
similarity index 97%
rename from source4/heimdal/lib/des/md5.h
rename to source4/heimdal/lib/hcrypto/md5.h
index 54c34fe572d8f738583a22d90de6092fb0a836c9..de6bd3a0a692b741e8a8b7dc9f16f0bd920807f4 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: md5.h,v 1.11 2006/05/05 11:07:11 lha Exp $ */
+/* $Id: md5.h 17450 2006-05-05 11:11:43Z lha $ */
 
 #ifndef HEIM_MD5_H
 #define HEIM_MD5_H 1
 
 #ifndef HEIM_MD5_H
 #define HEIM_MD5_H 1
similarity index 93%
rename from source4/heimdal/lib/des/pkcs12.c
rename to source4/heimdal/lib/hcrypto/pkcs12.c
index cc9228575452ce35d7e45dd10c72f1078132c9ff..dcfbdfad424c49c5d16b4ed333f649e900382ea9 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: pkcs12.c,v 1.1 2006/01/13 08:26:49 lha Exp $");
+RCSID("$Id: pkcs12.c 20661 2007-05-10 21:57:58Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -77,7 +77,12 @@ PKCS12_key_gen(const void *key, size_t keylen,
            I[i] = ((unsigned char*)salt)[i % saltlen];
        size_I += vlen;
     }
            I[i] = ((unsigned char*)salt)[i % saltlen];
        size_I += vlen;
     }
-    if (key && keylen > 0) {
+    /* 
+     * There is a diffrence between the no password string and the
+     * empty string, in the empty string the UTF16 NUL terminator is
+     * included into the string.
+     */
+    if (key && keylen >= 0) {
        for (i = 0; i < vlen / 2; i++) {
            I[(i * 2) + size_I] = 0;
            I[(i * 2) + size_I + 1] = ((unsigned char*)key)[i % (keylen + 1)];
        for (i = 0; i < vlen / 2; i++) {
            I[(i * 2) + size_I] = 0;
            I[(i * 2) + size_I + 1] = ((unsigned char*)key)[i % (keylen + 1)];
similarity index 97%
rename from source4/heimdal/lib/des/pkcs12.h
rename to source4/heimdal/lib/hcrypto/pkcs12.h
index b55f1fced582209d5397a2f2a942f65f75bfdc77..eb28b0546795b9126a8503d4b63f6b22a20d04c0 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /*
  */
 
 /*
- * $Id: pkcs12.h,v 1.2 2006/01/13 15:26:52 lha Exp $
+ * $Id: pkcs12.h 16564 2006-01-13 15:26:52Z lha $
  */
 
 #ifndef _HEIM_PKCS12_H
  */
 
 #ifndef _HEIM_PKCS12_H
similarity index 98%
rename from source4/heimdal/lib/des/pkcs5.c
rename to source4/heimdal/lib/hcrypto/pkcs5.c
index 9ed494ef6fc42cd69d50dcf58e5074cdfe908020..85b8713cba190fafad33d9b7bf55cf7d5b802bfd 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: pkcs5.c,v 1.3 2006/05/05 10:23:11 lha Exp $");
+RCSID("$Id: pkcs5.c 17445 2006-05-05 10:37:46Z lha $");
 
 #ifdef KRB5
 #include <krb5-types.h>
 
 #ifdef KRB5
 #include <krb5-types.h>
diff --git a/source4/heimdal/lib/hcrypto/rand-egd.c b/source4/heimdal/lib/hcrypto/rand-egd.c
new file mode 100644 (file)
index 0000000..d1b024b
--- /dev/null
@@ -0,0 +1,262 @@
+/*
+ * Copyright (c) 2007 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+RCSID("$Id: rand-egd.c 20093 2007-01-31 12:44:28Z lha $");
+
+#include <sys/types.h>
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+#include <assert.h>
+
+#include <rand.h>
+#include <randi.h>
+
+#include <roken.h>
+
+static const char *egd_path = "/var/run/egd-pool";
+
+#define MAX_EGD_DATA 255
+
+static int
+connect_egd(const char *path)
+{
+    struct sockaddr_un addr;
+    int fd;
+    
+    memset(&addr, 0, sizeof(addr));
+
+    if (strlen(path) > sizeof(addr.sun_path))
+       return -1;
+
+    addr.sun_family = AF_UNIX;
+    strlcpy(addr.sun_path, path, sizeof(addr.sun_path));
+
+    fd = socket(AF_UNIX, SOCK_STREAM, 0);
+    if (fd < 0)
+       return -1;
+
+    if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) != 0) {
+       close(fd);
+       return -1;
+    }
+
+    return fd;
+}
+
+static int
+get_entropy(int fd, void *data, size_t len)
+{
+    unsigned char msg[2];
+
+    assert(len <= MAX_EGD_DATA);
+
+    msg[0] = 0x02; /* read blocking data */
+    msg[1] = len; /* wanted length */
+
+    if (net_write(fd, msg, sizeof(msg)) != sizeof(msg))
+       return 0;
+
+    if (net_read(fd, data, len) != len)
+       return 0;
+
+    return 1;
+}
+
+static int
+put_entropy(int fd, const void *data, size_t len)
+{
+    unsigned char msg[4];
+
+    assert (len <= MAX_EGD_DATA);
+
+    msg[0] = 0x03; /* write data */
+    msg[1] = 0; /* dummy */
+    msg[2] = 0; /* entropy */
+    msg[3] = len; /* length */
+
+    if (net_write(fd, msg, sizeof(msg)) != sizeof(msg))
+       return 0;
+    if (net_write(fd, data, len) != len)
+       return 0;
+
+    return 1;
+}
+
+/*
+ *
+ */
+
+static void
+egd_seed(const void *indata, int size)
+{
+    size_t len;
+    int fd, ret = 1;
+
+    fd = connect_egd(egd_path);
+    if (fd < 0)
+       return;
+
+    while(size) {
+       len = size;
+       if (len > MAX_EGD_DATA)
+           len = MAX_EGD_DATA;
+       ret = put_entropy(fd, indata, len);
+       if (ret != 1)
+           break;
+       indata = ((unsigned char *)indata) + len;
+       size -= len;
+    }     
+    close(fd);
+}
+
+static int 
+get_bytes(const char *path, unsigned char *outdata, int size)
+{
+    size_t len;
+    int fd, ret = 1;
+
+    if (path == NULL)
+       path = egd_path;
+
+    fd = connect_egd(path);
+    if (fd < 0)
+       return 0;
+
+    while(size) {
+       len = size;
+       if (len > MAX_EGD_DATA)
+           len = MAX_EGD_DATA;
+       ret = get_entropy(fd, outdata, len);
+       if (ret != 1)
+           break;
+       outdata += len;
+       size -= len;
+    }     
+    close(fd);
+
+    return ret;
+}
+
+static int 
+egd_bytes(unsigned char *outdata, int size)
+{
+    return get_bytes(NULL, outdata, size);
+}
+
+static void
+egd_cleanup(void)
+{
+}
+
+static void
+egd_add(const void *indata, int size, double entropi)
+{
+    egd_seed(indata, size);
+}
+
+static int
+egd_pseudorand(unsigned char *outdata, int size)
+{
+    return get_bytes(NULL, outdata, size);
+}
+
+static int
+egd_status(void)
+{
+    int fd;
+    fd = connect_egd(egd_path);
+    if (fd < 0)
+       return 0;
+    close(fd);
+    return 1;
+}
+
+const RAND_METHOD hc_rand_egd_method = {
+    egd_seed,
+    egd_bytes,
+    egd_cleanup,
+    egd_add,
+    egd_pseudorand,
+    egd_status
+};
+
+const RAND_METHOD *
+RAND_egd_method(void)
+{
+    return &hc_rand_egd_method;
+}
+
+
+int
+RAND_egd(const char *filename)
+{
+    return RAND_egd_bytes(filename, 128);
+}
+
+int
+RAND_egd_bytes(const char *filename, int size)
+{
+    void *data;
+    int ret;
+
+    if (size <= 0)
+       return 0;
+
+    data = malloc(size);
+    if (data == NULL)
+       return 0;
+
+    ret = get_bytes(filename, data, size);
+    if (ret != 1) {
+       free(data);
+       return ret;
+    }
+
+    RAND_seed(data, size);
+
+    memset(data, 0, sizeof(data));
+    free(data);
+
+    return 1;
+}
diff --git a/source4/heimdal/lib/hcrypto/rand-fortuna.c b/source4/heimdal/lib/hcrypto/rand-fortuna.c
new file mode 100644 (file)
index 0000000..6cc4267
--- /dev/null
@@ -0,0 +1,563 @@
+/*
+ * fortuna.c
+ *             Fortuna-like PRNG.
+ *
+ * Copyright (c) 2005 Marko Kreen
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.     IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $PostgreSQL: pgsql/contrib/pgcrypto/fortuna.c,v 1.8 2006/10/04 00:29:46 momjian Exp $
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+RCSID("$Id: rand-fortuna.c 20029 2007-01-21 09:55:42Z lha $");
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <rand.h>
+
+#include <roken.h>
+
+#include "randi.h"
+#include "aes.h"
+#include "sha.h"
+
+/*
+ * Why Fortuna-like: There does not seem to be any definitive reference
+ * on Fortuna in the net.  Instead this implementation is based on
+ * following references:
+ *
+ * http://en.wikipedia.org/wiki/Fortuna_(PRNG)
+ *      - Wikipedia article
+ * http://jlcooke.ca/random/
+ *      - Jean-Luc Cooke Fortuna-based /dev/random driver for Linux.
+ */
+
+/*
+ * There is some confusion about whether and how to carry forward
+ * the state of the pools.     Seems like original Fortuna does not
+ * do it, resetting hash after each request.  I guess expecting
+ * feeding to happen more often that requesting.   This is absolutely
+ * unsuitable for pgcrypto, as nothing asynchronous happens here.
+ *
+ * J.L. Cooke fixed this by feeding previous hash to new re-initialized
+ * hash context.
+ *
+ * Fortuna predecessor Yarrow requires ability to query intermediate
+ * 'final result' from hash, without affecting it.
+ *
+ * This implementation uses the Yarrow method - asking intermediate
+ * results, but continuing with old state.
+ */
+
+
+/*
+ * Algorithm parameters
+ */
+
+#define NUM_POOLS              32
+
+/* in microseconds */
+#define RESEED_INTERVAL 100000 /* 0.1 sec */
+
+/* for one big request, reseed after this many bytes */
+#define RESEED_BYTES   (1024*1024)
+
+/*
+ * Skip reseed if pool 0 has less than this many
+ * bytes added since last reseed.
+ */
+#define POOL0_FILL             (256/8)
+
+/*
+ * Algorithm constants
+ */
+
+/* Both cipher key size and hash result size */
+#define BLOCK                  32
+
+/* cipher block size */
+#define CIPH_BLOCK             16
+
+/* for internal wrappers */
+#define MD_CTX                 SHA256_CTX
+#define CIPH_CTX               AES_KEY
+
+struct fortuna_state
+{
+    unsigned char      counter[CIPH_BLOCK];
+    unsigned char      result[CIPH_BLOCK];
+    unsigned char      key[BLOCK];
+    MD_CTX             pool[NUM_POOLS];
+    CIPH_CTX           ciph;
+    unsigned           reseed_count;
+    struct timeval     last_reseed_time;
+    unsigned           pool0_bytes;
+    unsigned           rnd_pos;
+    int                        tricks_done;
+};
+typedef struct fortuna_state FState;
+
+
+/*
+ * Use our own wrappers here.
+ * - Need to get intermediate result from digest, without affecting it.
+ * - Need re-set key on a cipher context.
+ * - Algorithms are guaranteed to exist.
+ * - No memory allocations.
+ */
+
+static void
+ciph_init(CIPH_CTX * ctx, const unsigned char *key, int klen)
+{
+    AES_set_encrypt_key(key, klen * 8, ctx);
+}
+
+static void
+ciph_encrypt(CIPH_CTX * ctx, const unsigned char *in, unsigned char *out)
+{
+    AES_encrypt(in, out, ctx);
+}
+
+static void
+md_init(MD_CTX * ctx)
+{
+    SHA256_Init(ctx);
+}
+
+static void
+md_update(MD_CTX * ctx, const unsigned char *data, int len)
+{
+    SHA256_Update(ctx, data, len);
+}
+
+static void
+md_result(MD_CTX * ctx, unsigned char *dst)
+{
+    SHA256_CTX tmp;
+
+    memcpy(&tmp, ctx, sizeof(*ctx));
+    SHA256_Final(dst, &tmp);
+    memset(&tmp, 0, sizeof(tmp));
+}
+
+/*
+ * initialize state
+ */
+static void
+init_state(FState * st)
+{
+    int                        i;
+
+    memset(st, 0, sizeof(*st));
+    for (i = 0; i < NUM_POOLS; i++)
+       md_init(&st->pool[i]);
+}
+
+/*
+ * Endianess does not matter.
+ * It just needs to change without repeating.
+ */
+static void
+inc_counter(FState * st)
+{
+    uint32_t   *val = (uint32_t *) st->counter;
+
+    if (++val[0])
+       return;
+    if (++val[1])
+       return;
+    if (++val[2])
+       return;
+    ++val[3];
+}
+
+/*
+ * This is called 'cipher in counter mode'.
+ */
+static void
+encrypt_counter(FState * st, unsigned char *dst)
+{
+    ciph_encrypt(&st->ciph, st->counter, dst);
+    inc_counter(st);
+}
+
+
+/*
+ * The time between reseed must be at least RESEED_INTERVAL
+ * microseconds.
+ */
+static int
+enough_time_passed(FState * st)
+{
+    int                        ok;
+    struct timeval tv;
+    struct timeval *last = &st->last_reseed_time;
+
+    gettimeofday(&tv, NULL);
+
+    /* check how much time has passed */
+    ok = 0;
+    if (tv.tv_sec > last->tv_sec + 1)
+       ok = 1;
+    else if (tv.tv_sec == last->tv_sec + 1)
+    {
+       if (1000000 + tv.tv_usec - last->tv_usec >= RESEED_INTERVAL)
+           ok = 1;
+    }
+    else if (tv.tv_usec - last->tv_usec >= RESEED_INTERVAL)
+       ok = 1;
+
+    /* reseed will happen, update last_reseed_time */
+    if (ok)
+       memcpy(last, &tv, sizeof(tv));
+
+    memset(&tv, 0, sizeof(tv));
+
+    return ok;
+}
+
+/*
+ * generate new key from all the pools
+ */
+static void
+reseed(FState * st)
+{
+    unsigned   k;
+    unsigned   n;
+    MD_CTX             key_md;
+    unsigned char      buf[BLOCK];
+
+    /* set pool as empty */
+    st->pool0_bytes = 0;
+
+    /*
+     * Both #0 and #1 reseed would use only pool 0. Just skip #0 then.
+     */
+    n = ++st->reseed_count;
+
+    /*
+     * The goal: use k-th pool only 1/(2^k) of the time.
+     */
+    md_init(&key_md);
+    for (k = 0; k < NUM_POOLS; k++)
+    {
+       md_result(&st->pool[k], buf);
+       md_update(&key_md, buf, BLOCK);
+
+       if (n & 1 || !n)
+           break;
+       n >>= 1;
+    }
+
+    /* add old key into mix too */
+    md_update(&key_md, st->key, BLOCK);
+
+    /* now we have new key */
+    md_result(&key_md, st->key);
+
+    /* use new key */
+    ciph_init(&st->ciph, st->key, BLOCK);
+
+    memset(&key_md, 0, sizeof(key_md));
+    memset(buf, 0, BLOCK);
+}
+
+/*
+ * Pick a random pool. This uses key bytes as random source.
+ */
+static unsigned
+get_rand_pool(FState * st)
+{
+    unsigned   rnd;
+
+    /*
+     * This slightly prefers lower pools - thats OK.
+     */
+    rnd = st->key[st->rnd_pos] % NUM_POOLS;
+
+    st->rnd_pos++;
+    if (st->rnd_pos >= BLOCK)
+       st->rnd_pos = 0;
+
+    return rnd;
+}
+
+/*
+ * update pools
+ */
+static void
+add_entropy(FState * st, const unsigned char *data, unsigned len)
+{
+    unsigned           pos;
+    unsigned char      hash[BLOCK];
+    MD_CTX             md;
+
+    /* hash given data */
+    md_init(&md);
+    md_update(&md, data, len);
+    md_result(&md, hash);
+
+    /*
+     * Make sure the pool 0 is initialized, then update randomly.
+     */
+    if (st->reseed_count == 0)
+       pos = 0;
+    else
+       pos = get_rand_pool(st);
+    md_update(&st->pool[pos], hash, BLOCK);
+
+    if (pos == 0)
+       st->pool0_bytes += len;
+
+    memset(hash, 0, BLOCK);
+    memset(&md, 0, sizeof(md));
+}
+
+/*
+ * Just take 2 next blocks as new key
+ */
+static void
+rekey(FState * st)
+{
+    encrypt_counter(st, st->key);
+    encrypt_counter(st, st->key + CIPH_BLOCK);
+    ciph_init(&st->ciph, st->key, BLOCK);
+}
+
+/*
+ * Hide public constants. (counter, pools > 0)
+ *
+ * This can also be viewed as spreading the startup
+ * entropy over all of the components.
+ */
+static void
+startup_tricks(FState * st)
+{
+    int                        i;
+    unsigned char      buf[BLOCK];
+
+    /* Use next block as counter. */
+    encrypt_counter(st, st->counter);
+
+    /* Now shuffle pools, excluding #0 */
+    for (i = 1; i < NUM_POOLS; i++)
+    {
+       encrypt_counter(st, buf);
+       encrypt_counter(st, buf + CIPH_BLOCK);
+       md_update(&st->pool[i], buf, BLOCK);
+    }
+    memset(buf, 0, BLOCK);
+
+    /* Hide the key. */
+    rekey(st);
+
+    /* This can be done only once. */
+    st->tricks_done = 1;
+}
+
+static void
+extract_data(FState * st, unsigned count, unsigned char *dst)
+{
+    unsigned   n;
+    unsigned   block_nr = 0;
+
+    /* Should we reseed? */
+    if (st->pool0_bytes >= POOL0_FILL || st->reseed_count == 0)
+       if (enough_time_passed(st))
+           reseed(st);
+
+    /* Do some randomization on first call */
+    if (!st->tricks_done)
+       startup_tricks(st);
+
+    while (count > 0)
+    {
+       /* produce bytes */
+       encrypt_counter(st, st->result);
+
+       /* copy result */
+       if (count > CIPH_BLOCK)
+           n = CIPH_BLOCK;
+       else
+           n = count;
+       memcpy(dst, st->result, n);
+       dst += n;
+       count -= n;
+
+       /* must not give out too many bytes with one key */
+       block_nr++;
+       if (block_nr > (RESEED_BYTES / CIPH_BLOCK))
+       {
+           rekey(st);
+           block_nr = 0;
+       }
+    }
+    /* Set new key for next request. */
+    rekey(st);
+}
+
+/*
+ * public interface
+ */
+
+static FState  main_state;
+static int     init_done;
+static int     have_entropy;
+
+/*
+ * Try our best to do an inital seed
+ */
+#define INIT_BYTES     128
+
+static int
+fortuna_reseed(void)
+{
+    int entropy_p = 0;
+
+    if (!init_done)
+       abort();
+
+    {
+       unsigned char buf[INIT_BYTES];
+       if ((*hc_rand_unix_method.bytes)(buf, sizeof(buf)) == 1) {
+           add_entropy(&main_state, buf, sizeof(buf));
+           entropy_p = 1;
+           memset(buf, 0, sizeof(buf));
+       }
+    }
+#ifdef HAVE_ARC4RANDOM
+    {
+       uint32_t buf[INIT_BYTES / sizeof(uint32_t)];
+       int i;
+
+       for (i = 0; i < sizeof(buf)/sizeof(buf[0]); i++)
+           buf[i] = arc4random();
+       add_entropy(&main_state, (void *)buf, sizeof(buf));
+       entropy_p = 1;
+    }
+#endif
+    /* 
+     * Only to get egd entropy if /dev/random or arc4rand failed since
+     * it can be horribly slow to generate new bits.
+     */
+    if (!entropy_p) {
+       unsigned char buf[INIT_BYTES];
+       if ((*hc_rand_egd_method.bytes)(buf, sizeof(buf)) == 1) {
+           add_entropy(&main_state, buf, sizeof(buf));
+           entropy_p = 1;
+           memset(buf, 0, sizeof(buf));
+       }
+    }
+    {
+       pid_t pid = getpid();
+       add_entropy(&main_state, (void *)&pid, sizeof(pid));
+    }
+    {
+       struct timeval tv;
+       gettimeofday(&tv, NULL);
+       add_entropy(&main_state, (void *)&tv, sizeof(tv));
+    }
+    {
+       uid_t u = getuid();
+       add_entropy(&main_state, (void *)&u, sizeof(u));
+    }
+    return entropy_p;
+}
+
+static int
+fortuna_init(void)
+{
+    if (!init_done)
+    {
+       init_state(&main_state);
+       init_done = 1;
+    }
+    if (!have_entropy)
+       have_entropy = fortuna_reseed();
+    return (init_done && have_entropy);
+}
+
+
+
+static void
+fortuna_seed(const void *indata, int size)
+{
+    fortuna_init();
+    add_entropy(&main_state, indata, size);
+    if (size >= INIT_BYTES)
+       have_entropy = 1;
+}
+
+static int 
+fortuna_bytes(unsigned char *outdata, int size)
+{
+    if (!fortuna_init())
+       return 0;
+    extract_data(&main_state, size, outdata);
+    return 1;
+}
+
+static void
+fortuna_cleanup(void)
+{
+    init_done = 0;
+    have_entropy = 0;
+    memset(&main_state, 0, sizeof(main_state));
+}
+
+static void
+fortuna_add(const void *indata, int size, double entropi)
+{
+    fortuna_seed(indata, size);
+}
+
+static int
+fortuna_pseudorand(unsigned char *outdata, int size)
+{
+    return fortuna_bytes(outdata, size);
+}
+
+static int
+fortuna_status(void)
+{
+    return fortuna_init() ? 1 : 0;
+}
+
+const RAND_METHOD hc_rand_fortuna_method = {
+    fortuna_seed,
+    fortuna_bytes,
+    fortuna_cleanup,
+    fortuna_add,
+    fortuna_pseudorand,
+    fortuna_status
+};
+
+const RAND_METHOD *
+RAND_fortuna_method(void)
+{
+    return &hc_rand_fortuna_method;
+}
similarity index 95%
rename from source4/heimdal/lib/des/rand-unix.c
rename to source4/heimdal/lib/hcrypto/rand-unix.c
index a51c6c0c0dd9279fca49bfd200b0d9b825f23c00..354492fb3db5d431ab82e6e1bbcfa0d9393180ee 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: rand-unix.c,v 1.2 2006/10/21 21:09:14 lha Exp $");
+RCSID("$Id: rand-unix.c 20028 2007-01-21 09:54:56Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -43,6 +43,8 @@ RCSID("$Id: rand-unix.c,v 1.2 2006/10/21 21:09:14 lha Exp $");
 
 #include <roken.h>
 
 
 #include <roken.h>
 
+#include "randi.h"
+
 /*
  * Unix /dev/random
  */
 /*
  * Unix /dev/random
  */
@@ -151,3 +153,9 @@ const RAND_METHOD hc_rand_unix_method = {
     unix_pseudorand,
     unix_status
 };
     unix_pseudorand,
     unix_status
 };
+
+const RAND_METHOD *
+RAND_unix_method(void)
+{
+    return &hc_rand_unix_method;
+}
similarity index 58%
rename from source4/heimdal/lib/des/rand.c
rename to source4/heimdal/lib/hcrypto/rand.c
index 6eb959b7240bde64cd9575e1c1f90385d9636ae0..29f2d46dba930371a80243b44f66513a96c49cd2 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: rand.c,v 1.7 2006/10/16 10:23:01 lha Exp $");
+RCSID("$Id: rand.c 20126 2007-02-01 22:08:41Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <rand.h>
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <rand.h>
+#include <randi.h>
 
 #include <roken.h>
 
 
 #include <roken.h>
 
-extern RAND_METHOD hc_rand_unix_method;
-static const RAND_METHOD *selected_meth = &hc_rand_unix_method;
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+
+
+const static RAND_METHOD *selected_meth = NULL;
+
+static void
+init_method(void)
+{
+    if (selected_meth != NULL)
+       return;
+
+    if ((*hc_rand_unix_method.status)() == 1)
+       selected_meth = &hc_rand_unix_method;
+    else
+       selected_meth = &hc_rand_fortuna_method;
+}
 
 void
 RAND_seed(const void *indata, size_t size)
 {
 
 void
 RAND_seed(const void *indata, size_t size)
 {
+    init_method();
     (*selected_meth->seed)(indata, size);
 }
 
 int
 RAND_bytes(void *outdata, size_t size)
 {
     (*selected_meth->seed)(indata, size);
 }
 
 int
 RAND_bytes(void *outdata, size_t size)
 {
+    init_method();
     return (*selected_meth->bytes)(outdata, size);
 }
 
 void
 RAND_cleanup(void)
 {
     return (*selected_meth->bytes)(outdata, size);
 }
 
 void
 RAND_cleanup(void)
 {
+    init_method();
     (*selected_meth->cleanup)();
 }
 
 void
 RAND_add(const void *indata, size_t size, double entropi)
 {
     (*selected_meth->cleanup)();
 }
 
 void
 RAND_add(const void *indata, size_t size, double entropi)
 {
+    init_method();
     (*selected_meth->add)(indata, size, entropi);
 }
 
 int
 RAND_pseudo_bytes(void *outdata, size_t size)
 {
     (*selected_meth->add)(indata, size, entropi);
 }
 
 int
 RAND_pseudo_bytes(void *outdata, size_t size)
 {
+    init_method();
     return (*selected_meth->pseudorand)(outdata, size);
 }
 
 int
 RAND_status(void)
 {
     return (*selected_meth->pseudorand)(outdata, size);
 }
 
 int
 RAND_status(void)
 {
+    init_method();
     return (*selected_meth->status)();
 }
 
     return (*selected_meth->status)();
 }
 
@@ -101,20 +124,92 @@ RAND_set_rand_engine(ENGINE *engine)
     return 1;
 }
 
     return 1;
 }
 
+#define RAND_FILE_SIZE 1024
+
 int
 RAND_load_file(const char *filename, size_t size)
 {
 int
 RAND_load_file(const char *filename, size_t size)
 {
-    return 1;
+    unsigned char buf[128];
+    size_t len;
+    ssize_t slen;
+    int fd;
+
+    fd = open(filename, O_RDONLY | O_BINARY, 0600);
+    if (fd < 0)
+       return 0;
+
+    len = 0;
+    while(len < size) {
+       slen = read(fd, buf, sizeof(buf));
+       if (slen <= 0)
+           break;
+       RAND_seed(buf, slen);
+       len += slen;
+    }
+    close(fd);
+
+    return len ? 1 : 0;
 }
 
 int
 RAND_write_file(const char *filename)
 {
 }
 
 int
 RAND_write_file(const char *filename)
 {
-    return 1;
+    unsigned char buf[128];
+    size_t len;
+    int res = 0, fd;
+
+    fd = open(filename, O_WRONLY | O_CREAT | O_BINARY, 0600);
+    if (fd < 0)
+       return 0;
+
+    len = 0;
+    while(len < RAND_FILE_SIZE) {
+       res = RAND_bytes(buf, sizeof(buf));
+       if (res != 1)
+           break;
+       if (write(fd, buf, sizeof(buf)) != sizeof(buf)) {
+           res = 0;
+           break;
+       }
+       len += sizeof(buf);
+    }
+
+    close(fd);
+
+    return res;
 }
 
 }
 
-int
-RAND_egd(const char *filename)
+const char *
+RAND_file_name(char *filename, size_t size)
 {
 {
-    return 1;
+    const char *e = NULL;
+    int pathp = 0, ret;
+
+    if (!issuid()) {
+       e = getenv("RANDFILE");
+       if (e == NULL) {
+           e = getenv("HOME");
+           if (e)
+               pathp = 1;
+       }
+    }
+    if (e == NULL) {
+       struct passwd *pw = getpwuid(getuid()); 
+       if (pw) {
+           e = pw->pw_dir;
+           pathp = 1;
+       }
+    }
+    if (e == NULL)
+       return NULL;
+
+    if (pathp)
+       ret = snprintf(filename, size, "%s/.rnd", e);
+    else
+       ret = snprintf(filename, size, "%s", e);
+
+    if (ret <= 0 || ret >= size)
+       return NULL;
+
+    return filename;
 }
 }
similarity index 86%
rename from source4/heimdal/lib/des/rand.h
rename to source4/heimdal/lib/hcrypto/rand.h
index a57da5392874e77630f3ee13318acc7b539e327a..c8ba2d9a7b813788088be3067af709c3df985fd6 100644 (file)
@@ -33,7 +33,7 @@
  */
 
 /*
  */
 
 /*
- * $Id: rand.h,v 1.4 2006/04/17 13:23:04 lha Exp $
+ * $Id: rand.h 20063 2007-01-30 18:30:36Z lha $
  */
 
 #ifndef _HEIM_RAND_H
  */
 
 #ifndef _HEIM_RAND_H
@@ -53,10 +53,15 @@ typedef struct RAND_METHOD RAND_METHOD;
 #define RAND_set_rand_method hc_RAND_set_rand_method
 #define RAND_get_rand_method hc_RAND_get_rand_method
 #define RAND_set_rand_engine hc_RAND_set_rand_engine
 #define RAND_set_rand_method hc_RAND_set_rand_method
 #define RAND_get_rand_method hc_RAND_get_rand_method
 #define RAND_set_rand_engine hc_RAND_set_rand_engine
+#define RAND_file_name hc_RAND_file_name
 #define RAND_load_file hc_RAND_load_file
 #define RAND_write_file hc_RAND_write_file
 #define RAND_status hc_RAND_status
 #define RAND_egd hc_RAND_egd
 #define RAND_load_file hc_RAND_load_file
 #define RAND_write_file hc_RAND_write_file
 #define RAND_status hc_RAND_status
 #define RAND_egd hc_RAND_egd
+#define RAND_egd_bytes hc_RAND_egd_bytes
+#define RAND_fortuna_method hc_RAND_fortuna_method
+#define RAND_egd_method hc_RAND_egd_method
+#define RAND_unix_method hc_RAND_unix_method
 
 /*
  *
 
 /*
  *
@@ -87,10 +92,17 @@ const RAND_METHOD *
        RAND_get_rand_method(void);
 int    RAND_set_rand_engine(ENGINE *);
 
        RAND_get_rand_method(void);
 int    RAND_set_rand_engine(ENGINE *);
 
+const char *
+       RAND_file_name(char *, size_t);
 int    RAND_load_file(const char *, size_t);
 int    RAND_write_file(const char *);
 int    RAND_status(void);
 int    RAND_egd(const char *);
 int    RAND_load_file(const char *, size_t);
 int    RAND_write_file(const char *);
 int    RAND_status(void);
 int    RAND_egd(const char *);
+int    RAND_egd_bytes(const char *, int);
 
 
 
 
+const RAND_METHOD *    RAND_fortuna_method(void);
+const RAND_METHOD *    RAND_unix_method(void);
+const RAND_METHOD *    RAND_egd_method(void);
+
 #endif /* _HEIM_RAND_H */
 #endif /* _HEIM_RAND_H */
similarity index 83%
rename from source4/heimdal/lib/gssapi/gssapi.h
rename to source4/heimdal/lib/hcrypto/randi.h
index 340b35377d6c4de5ea694917fb0f0eac04bfabc3..b9b9b5309c0042a5f7a7d2c49c67916fffe51d72 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: gssapi.h,v 1.50 2006/10/07 20:57:15 lha Exp $ */
+/*
+ * $Id: randi.h 20027 2007-01-21 09:54:00Z lha $
+ */
 
 
-#ifndef GSSAPI_H_
-#define GSSAPI_H_
+#ifndef _HEIM_RANDI_H
+#define _HEIM_RANDI_H 1
 
 
-#include <gssapi/gssapi.h>
+extern const RAND_METHOD hc_rand_fortuna_method;
+extern const RAND_METHOD hc_rand_unix_method;
+extern const RAND_METHOD hc_rand_egd_method;
 
 
-#endif
+#endif /* _HEIM_RANDI_H */
similarity index 99%
rename from source4/heimdal/lib/des/rc2.c
rename to source4/heimdal/lib/hcrypto/rc2.c
index ed43c7060591051112186c8d48a0cc6621e37243..63992be9a90d6466e2be5b49f5a8a78cb44100b4 100755 (executable)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: rc2.c,v 1.7 2006/04/09 17:03:21 lha Exp $");
+RCSID("$Id: rc2.c 17022 2006-04-09 17:03:21Z lha $");
 #endif
 
 #include "rc2.h"
 #endif
 
 #include "rc2.h"
similarity index 97%
rename from source4/heimdal/lib/des/rc2.h
rename to source4/heimdal/lib/hcrypto/rc2.h
index b2cd50b88026af9a76da7f1133b9cf9532b2b01b..5a2dd2d70533c3aa8d34339a415f27bff038691d 100755 (executable)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: rc2.h,v 1.2 2006/01/08 21:47:29 lha Exp $ */
+/* $Id: rc2.h 16480 2006-01-08 21:47:29Z lha $ */
 
 /* symbol renaming */
 #define RC2_set_key hc_RC2_set_key 
 
 /* symbol renaming */
 #define RC2_set_key hc_RC2_set_key 
similarity index 97%
rename from source4/heimdal/lib/des/rc4.c
rename to source4/heimdal/lib/hcrypto/rc4.c
index 17d4b021fff813322d088630a1e4e46ee4f32444..edaf37ddc420365b22e80eb9fd8df2194acfa760 100755 (executable)
@@ -36,7 +36,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: rc4.c,v 1.1 2004/03/25 16:40:59 lha Exp $");
+RCSID("$Id: rc4.c 13640 2004-03-25 16:40:59Z lha $");
 #endif
 
 #include <rc4.h>
 #endif
 
 #include <rc4.h>
similarity index 97%
rename from source4/heimdal/lib/des/rc4.h
rename to source4/heimdal/lib/hcrypto/rc4.h
index 3c359dc72aaa7de1413b2c42a498cdb40dd022ae..1ab25f59e66b5650cbbd66e9a18a07635c34b014 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: rc4.h,v 1.4 2006/01/08 21:47:29 lha Exp $ */
+/* $Id: rc4.h 16480 2006-01-08 21:47:29Z lha $ */
 
 /* symbol renaming */
 #define RC4_set_key hc_RC4_set_key
 
 /* symbol renaming */
 #define RC4_set_key hc_RC4_set_key
similarity index 99%
rename from source4/heimdal/lib/des/rijndael-alg-fst.c
rename to source4/heimdal/lib/hcrypto/rijndael-alg-fst.c
index d6e4f45c187c6c20825b44d94bd25483e094bbdd..c6330d27e457488fcf516906ed3cae6373850d18 100755 (executable)
@@ -31,7 +31,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: rijndael-alg-fst.c,v 1.3 2006/05/05 10:23:41 lha Exp $");
+RCSID("$Id: rijndael-alg-fst.c 17445 2006-05-05 10:37:46Z lha $");
 #endif
 
 #ifdef KRB5
 #endif
 
 #ifdef KRB5
similarity index 99%
rename from source4/heimdal/lib/des/rnd_keys.c
rename to source4/heimdal/lib/hcrypto/rnd_keys.c
index e58faefcb09db7d1a41cf442b06871bae7a83129..a035b890b887385249e7e88bcf80f294146678a4 100644 (file)
@@ -34,7 +34,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: rnd_keys.c,v 1.71 2006/05/05 10:24:31 lha Exp $");
+RCSID("$Id: rnd_keys.c 17445 2006-05-05 10:37:46Z lha $");
 #endif
 
 #ifdef KRB5
 #endif
 
 #ifdef KRB5
similarity index 99%
rename from source4/heimdal/lib/des/rsa-imath.c
rename to source4/heimdal/lib/hcrypto/rsa-imath.c
index 298affadfe60d62d1cfafc37113e61f42b715f6d..e05ead1e666ae8463ce3362a214dab903b47d1e1 100644 (file)
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: rsa-imath.c,v 1.23 2007/01/06 13:45:25 lha Exp $");
+RCSID("$Id: rsa-imath.c 19750 2007-01-06 13:45:25Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
similarity index 97%
rename from source4/heimdal/lib/des/rsa.c
rename to source4/heimdal/lib/hcrypto/rsa.c
index 241afb2e463cd0441dda05a7b6a5eae92b2a994d..a7b4371e4d491b457b000c1b595d66a0cbf80766 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -35,7 +35,7 @@
 #include <config.h>
 #endif
 
 #include <config.h>
 #endif
 
-RCSID("$Id: rsa.c,v 1.19 2007/01/09 10:04:20 lha Exp $");
+RCSID("$Id: rsa.c 20466 2007-04-20 08:29:05Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -110,6 +110,7 @@ RSA_free(RSA *rsa)
     free_if(rsa->q);
     free_if(rsa->dmp1);
     free_if(rsa->dmq1);
     free_if(rsa->q);
     free_if(rsa->dmp1);
     free_if(rsa->dmq1);
+    free_if(rsa->iqmp);
 #undef free_if
 
     memset(rsa, 0, sizeof(*rsa));
 #undef free_if
 
     memset(rsa, 0, sizeof(*rsa));
@@ -234,7 +235,7 @@ RSA_verify(int type, const unsigned char *from, unsigned int flen,
 
 /*
  * A NULL RSA_METHOD that returns failure for all operations. This is
 
 /*
  * A NULL RSA_METHOD that returns failure for all operations. This is
- * used as the default RSA method is we don't have any native
+ * used as the default RSA method if we don't have any native
  * support.
  */
 
  * support.
  */
 
similarity index 99%
rename from source4/heimdal/lib/des/rsa.h
rename to source4/heimdal/lib/hcrypto/rsa.h
index 0aceb9f9dad0322ee63c99864296abb036f33994..575774dbde8d8ec5b7e8dab50c0eeda1d273b8b8 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 /*
  */
 
 /*
- * $Id: rsa.h,v 1.9 2007/01/05 20:26:23 lha Exp $
+ * $Id: rsa.h 19734 2007-01-05 20:26:23Z lha $
  */
 
 #ifndef _HEIM_RSA_H
  */
 
 #ifndef _HEIM_RSA_H
similarity index 99%
rename from source4/heimdal/lib/des/sha.c
rename to source4/heimdal/lib/hcrypto/sha.c
index fae0fe01cbaf77e9b5eae8bbcddf0640d23157e7..a264f53f33f13eae20af01ef11cffa540b680bb5 100644 (file)
@@ -34,7 +34,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: sha.c,v 1.19 2006/05/05 10:25:00 lha Exp $");
+RCSID("$Id: sha.c 17445 2006-05-05 10:37:46Z lha $");
 #endif
 
 #include "hash.h"
 #endif
 
 #include "hash.h"
similarity index 97%
rename from source4/heimdal/lib/des/sha.h
rename to source4/heimdal/lib/hcrypto/sha.h
index 977b9f7bb2bef97d0ca9eed5468b17cdc17c44ac..70fc20e222afc6e421d39d1d7cb888a9942ecb37 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: sha.h,v 1.11 2006/05/05 11:06:21 lha Exp $ */
+/* $Id: sha.h 17450 2006-05-05 11:11:43Z lha $ */
 
 #ifndef HEIM_SHA_H
 #define HEIM_SHA_H 1
 
 #ifndef HEIM_SHA_H
 #define HEIM_SHA_H 1
similarity index 99%
rename from source4/heimdal/lib/des/sha256.c
rename to source4/heimdal/lib/hcrypto/sha256.c
index 58fb92815a29c03e59d43f578aa73db25b451697..b95442eff62aaa63bef0015ad31f0e360b211209 100644 (file)
@@ -34,7 +34,7 @@
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 
-RCSID("$Id: sha256.c,v 1.2 2006/05/05 10:25:37 lha Exp $");
+RCSID("$Id: sha256.c 17445 2006-05-05 10:37:46Z lha $");
 #endif
 
 #include "hash.h"
 #endif
 
 #include "hash.h"
similarity index 98%
rename from source4/heimdal/lib/des/ui.c
rename to source4/heimdal/lib/hcrypto/ui.c
index 25b0ad293cc3a574bb1fea6d1f7dfed6de41bab4..3e651998b535659fda01038cf53905729215e78c 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: ui.c,v 1.6 2006/09/22 15:45:57 lha Exp $");
+RCSID("$Id: ui.c 18158 2006-09-22 15:45:57Z lha $");
 #endif
 
 #include <stdio.h>
 #endif
 
 #include <stdio.h>
similarity index 97%
rename from source4/heimdal/lib/des/ui.h
rename to source4/heimdal/lib/hcrypto/ui.h
index d6e68e12cca6a08d3286331e00559d0a719ac88e..53926cc1f7a1ba3aa75b83bfce85d11d0e0b046d 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: ui.h,v 1.1 2006/01/08 21:47:29 lha Exp $ */
+/* $Id: ui.h 16480 2006-01-08 21:47:29Z lha $ */
 
 #ifndef _HEIM_UI_H
 #define _HEIM_UI_H 1
 
 #ifndef _HEIM_UI_H
 #define _HEIM_UI_H 1
index 0bbf6f22107472bd80292fba2b5d346decbf283e..870f0431cf3a8d379177d72df039c6d465f98b92 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "hdb_locl.h"
 
 
 #include "hdb_locl.h"
 
-RCSID("$Id: db.c,v 1.36 2006/09/12 18:12:37 lha Exp $");
+RCSID("$Id: db.c 20215 2007-02-09 21:59:53Z lha $");
 
 #if HAVE_DB1
 
 
 #if HAVE_DB1
 
@@ -67,8 +67,11 @@ DB_lock(krb5_context context, HDB *db, int operation)
 {
     DB *d = (DB*)db->hdb_db;
     int fd = (*d->fd)(d);
 {
     DB *d = (DB*)db->hdb_db;
     int fd = (*d->fd)(d);
-    if(fd < 0)
+    if(fd < 0) {
+       krb5_set_error_string(context,
+                             "Can't lock database: %s", db->hdb_name);
        return HDB_ERR_CANT_LOCK_DB;
        return HDB_ERR_CANT_LOCK_DB;
+    }
     return hdb_lock(fd, operation);
 }
 
     return hdb_lock(fd, operation);
 }
 
@@ -77,8 +80,11 @@ DB_unlock(krb5_context context, HDB *db)
 {
     DB *d = (DB*)db->hdb_db;
     int fd = (*d->fd)(d);
 {
     DB *d = (DB*)db->hdb_db;
     int fd = (*d->fd)(d);
-    if(fd < 0)
+    if(fd < 0) {
+       krb5_set_error_string(context, 
+                             "Can't unlock database: %s", db->hdb_name);
        return HDB_ERR_CANT_LOCK_DB;
        return HDB_ERR_CANT_LOCK_DB;
+    }
     return hdb_unlock(fd);
 }
 
     return hdb_unlock(fd);
 }
 
@@ -93,14 +99,22 @@ DB_seq(krb5_context context, HDB *db,
     int code;
 
     code = db->hdb_lock(context, db, HDB_RLOCK);
     int code;
 
     code = db->hdb_lock(context, db, HDB_RLOCK);
-    if(code == -1)
+    if(code == -1) {
+       krb5_set_error_string(context, "Database %s in use", db->hdb_name);
        return HDB_ERR_DB_INUSE;
        return HDB_ERR_DB_INUSE;
+    }
     code = (*d->seq)(d, &key, &value, flag);
     db->hdb_unlock(context, db); /* XXX check value */
     code = (*d->seq)(d, &key, &value, flag);
     db->hdb_unlock(context, db); /* XXX check value */
-    if(code == -1)
-       return errno;
-    if(code == 1)
+    if(code == -1) {
+       code = errno;
+       krb5_set_error_string(context, "Database %s seq error: %s", 
+                             db->hdb_name, strerror(code));
+       return code;
+    }
+    if(code == 1) {
+       krb5_clear_error_string(context);
        return HDB_ERR_NOENTRY;
        return HDB_ERR_NOENTRY;
+    }
 
     key_data.data = key.data;
     key_data.length = key.size;
 
     key_data.data = key.data;
     key_data.length = key.size;
@@ -174,10 +188,16 @@ DB__get(krb5_context context, HDB *db, krb5_data key, krb5_data *reply)
        return code;
     code = (*d->get)(d, &k, &v, 0);
     db->hdb_unlock(context, db);
        return code;
     code = (*d->get)(d, &k, &v, 0);
     db->hdb_unlock(context, db);
-    if(code < 0)
-       return errno;
-    if(code == 1)
+    if(code < 0) {
+       code = errno;
+       krb5_set_error_string(context, "Database %s get error: %s", 
+                             db->hdb_name, strerror(code));
+       return code;
+    }
+    if(code == 1) {
+       krb5_clear_error_string(context);
        return HDB_ERR_NOENTRY;
        return HDB_ERR_NOENTRY;
+    }
     
     krb5_data_copy(reply, v.data, v.size);
     return 0;
     
     krb5_data_copy(reply, v.data, v.size);
     return 0;
@@ -200,10 +220,16 @@ DB__put(krb5_context context, HDB *db, int replace,
        return code;
     code = (*d->put)(d, &k, &v, replace ? 0 : R_NOOVERWRITE);
     db->hdb_unlock(context, db);
        return code;
     code = (*d->put)(d, &k, &v, replace ? 0 : R_NOOVERWRITE);
     db->hdb_unlock(context, db);
-    if(code < 0)
-       return errno;
-    if(code == 1)
+    if(code < 0) {
+       code = errno;
+       krb5_set_error_string(context, "Database %s put error: %s", 
+                             db->hdb_name, strerror(code));
+       return code;
+    }
+    if(code == 1) {
+       krb5_clear_error_string(context);
        return HDB_ERR_EXISTS;
        return HDB_ERR_EXISTS;
+    }
     return 0;
 }
 
     return 0;
 }
 
@@ -220,8 +246,12 @@ DB__del(krb5_context context, HDB *db, krb5_data key)
        return code;
     code = (*d->del)(d, &k, 0);
     db->hdb_unlock(context, db);
        return code;
     code = (*d->del)(d, &k, 0);
     db->hdb_unlock(context, db);
-    if(code == 1)
-       return HDB_ERR_NOENTRY;
+    if(code == 1) {
+       code = errno;
+       krb5_set_error_string(context, "Database %s put error: %s", 
+                             db->hdb_name, strerror(code));
+       return code;
+    }
     if(code < 0)
        return errno;
     return 0;
     if(code < 0)
        return errno;
     return 0;
index 141c63a8ac15003474d3111b90cf9375f621f48b..aac0ff5367078a70aa7c97593e045c64480ea441 100644 (file)
@@ -34,7 +34,7 @@
 #include "hdb_locl.h"
 #include <der.h>
 
 #include "hdb_locl.h"
 #include <der.h>
 
-RCSID("$Id: ext.c,v 1.6 2006/10/14 10:13:03 lha Exp $");
+RCSID("$Id: ext.c 20236 2007-02-16 23:52:29Z lha $");
 
 krb5_error_code
 hdb_entry_check_mandatory(krb5_context context, const hdb_entry *ent)
 
 krb5_error_code
 hdb_entry_check_mandatory(krb5_context context, const hdb_entry *ent)
@@ -394,3 +394,17 @@ hdb_entry_get_ConstrainedDelegACL(const hdb_entry *entry,
 
     return 0;
 }
 
     return 0;
 }
+
+krb5_error_code
+hdb_entry_get_aliases(const hdb_entry *entry, const HDB_Ext_Aliases **a)
+{
+    const HDB_extension *ext;
+
+    ext = hdb_find_extension(entry, choice_HDB_extension_data_aliases);
+    if (ext)
+       *a = &ext->data.u.aliases;
+    else
+       *a = NULL;
+
+    return 0;
+}
index de0545a037f93e16617e8b714c96ae4f795057c7..6d679fd48f71c7132dfa960b6b97e72f269d83b8 100644 (file)
@@ -42,6 +42,41 @@ hdb_db_create (
        HDB **/*db*/,
        const char */*filename*/);
 
        HDB **/*db*/,
        const char */*filename*/);
 
+const char *
+hdb_dbinfo_get_acl_file (
+       krb5_context /*context*/,
+       struct hdb_dbinfo */*dbp*/);
+
+const krb5_config_binding *
+hdb_dbinfo_get_binding (
+       krb5_context /*context*/,
+       struct hdb_dbinfo */*dbp*/);
+
+const char *
+hdb_dbinfo_get_dbname (
+       krb5_context /*context*/,
+       struct hdb_dbinfo */*dbp*/);
+
+const char *
+hdb_dbinfo_get_label (
+       krb5_context /*context*/,
+       struct hdb_dbinfo */*dbp*/);
+
+const char *
+hdb_dbinfo_get_mkey_file (
+       krb5_context /*context*/,
+       struct hdb_dbinfo */*dbp*/);
+
+struct hdb_dbinfo *
+hdb_dbinfo_get_next (
+       struct hdb_dbinfo */*dbp*/,
+       struct hdb_dbinfo */*dbprevp*/);
+
+const char *
+hdb_dbinfo_get_realm (
+       krb5_context /*context*/,
+       struct hdb_dbinfo */*dbp*/);
+
 krb5_error_code
 hdb_enctype2key (
        krb5_context /*context*/,
 krb5_error_code
 hdb_enctype2key (
        krb5_context /*context*/,
@@ -58,7 +93,13 @@ hdb_entry2string (
 int
 hdb_entry2value (
        krb5_context /*context*/,
 int
 hdb_entry2value (
        krb5_context /*context*/,
-       hdb_entry */*ent*/,
+       const hdb_entry */*ent*/,
+       krb5_data */*value*/);
+
+int
+hdb_entry_alias2value (
+       krb5_context /*context*/,
+       const hdb_entry_alias */*alias*/,
        krb5_data */*value*/);
 
 krb5_error_code
        krb5_data */*value*/);
 
 krb5_error_code
@@ -76,6 +117,11 @@ hdb_entry_get_ConstrainedDelegACL (
        const hdb_entry */*entry*/,
        const HDB_Ext_Constrained_delegation_acl **/*a*/);
 
        const hdb_entry */*entry*/,
        const HDB_Ext_Constrained_delegation_acl **/*a*/);
 
+krb5_error_code
+hdb_entry_get_aliases (
+       const hdb_entry */*entry*/,
+       const HDB_Ext_Aliases **/*a*/);
+
 int
 hdb_entry_get_password (
        krb5_context /*context*/,
 int
 hdb_entry_get_password (
        krb5_context /*context*/,
@@ -124,6 +170,11 @@ hdb_foreach (
        hdb_foreach_func_t /*func*/,
        void */*data*/);
 
        hdb_foreach_func_t /*func*/,
        void */*data*/);
 
+void
+hdb_free_dbinfo (
+       krb5_context /*context*/,
+       struct hdb_dbinfo **/*dbp*/);
+
 void
 hdb_free_entry (
        krb5_context /*context*/,
 void
 hdb_free_entry (
        krb5_context /*context*/,
@@ -159,6 +210,11 @@ hdb_generate_key_set_password (
        Key **/*keys*/,
        size_t */*num_keys*/);
 
        Key **/*keys*/,
        size_t */*num_keys*/);
 
+int
+hdb_get_dbinfo (
+       krb5_context /*context*/,
+       struct hdb_dbinfo **/*dbp*/);
+
 krb5_error_code
 hdb_init_db (
        krb5_context /*context*/,
 krb5_error_code
 hdb_init_db (
        krb5_context /*context*/,
@@ -314,6 +370,12 @@ hdb_value2entry (
        krb5_data */*value*/,
        hdb_entry */*ent*/);
 
        krb5_data */*value*/,
        hdb_entry */*ent*/);
 
+int
+hdb_value2entry_alias (
+       krb5_context /*context*/,
+       krb5_data */*value*/,
+       hdb_entry_alias */*ent*/);
+
 krb5_error_code
 hdb_write_master_key (
        krb5_context /*context*/,
 krb5_error_code
 hdb_write_master_key (
        krb5_context /*context*/,
index c8c276ff6e54aae9b5ca97f09ae1e9f038b3d57c..acd8f61d7e8f578b6bd56b02ab07ce5295856d03 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: hdb.asn1,v 1.17 2006/08/24 10:45:19 lha Exp $
+-- $Id: hdb.asn1 20236 2007-02-16 23:52:29Z lha $
 HDB DEFINITIONS ::=
 BEGIN
 
 HDB DEFINITIONS ::=
 BEGIN
 
@@ -120,4 +120,8 @@ hdb_entry ::= SEQUENCE {
         extensions[13]  HDB-extensions OPTIONAL
 }
 
         extensions[13]  HDB-extensions OPTIONAL
 }
 
+hdb_entry_alias ::= [APPLICATION 0] SEQUENCE {
+       principal[0]    Principal  OPTIONAL
+}
+
 END
 END
index cd4f24a7321d0b86a54737efeb716cecaf058c97..f0731ed98eb8f8d2d01a7503d722f495d1b22aae 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "hdb_locl.h"
 
 
 #include "hdb_locl.h"
 
-RCSID("$Id: hdb.c,v 1.64 2006/11/28 14:24:27 lha Exp $");
+RCSID("$Id: hdb.c 20214 2007-02-09 21:51:10Z lha $");
 
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
 
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
@@ -56,7 +56,7 @@ static struct hdb_method methods[] = {
     {"ldapi:", hdb_ldapi_create},
 #endif
 #ifdef _SAMBA_BUILD_
     {"ldapi:", hdb_ldapi_create},
 #endif
 #ifdef _SAMBA_BUILD_
-    {"ldb:",   hdb_ldb_create},
+    {"ldb:",   hdb_ldb_create},
 #endif
 #ifdef HAVE_LDB /* Used for integrated samba build */
     {"ldb:",   hdb_ldb_create},
 #endif
 #ifdef HAVE_LDB /* Used for integrated samba build */
     {"ldb:",   hdb_ldb_create},
@@ -81,11 +81,15 @@ hdb_next_enctype2key(krb5_context context,
     
     for (k = *key ? (*key) + 1 : e->keys.val;
         k < e->keys.val + e->keys.len; 
     
     for (k = *key ? (*key) + 1 : e->keys.val;
         k < e->keys.val + e->keys.len; 
-        k++)
+        k++) 
+    {
        if(k->key.keytype == enctype){
            *key = k;
            return 0;
        }
        if(k->key.keytype == enctype){
            *key = k;
            return 0;
        }
+    }
+    krb5_set_error_string(context, "No next enctype %d for hdb-entry", 
+                         (int)enctype);
     return KRB5_PROG_ETYPE_NOSUPP; /* XXX */
 }
 
     return KRB5_PROG_ETYPE_NOSUPP; /* XXX */
 }
 
@@ -164,6 +168,8 @@ hdb_foreach(krb5_context context,
     krb5_error_code ret;
     hdb_entry_ex entry;
     ret = db->hdb_firstkey(context, db, flags, &entry);
     krb5_error_code ret;
     hdb_entry_ex entry;
     ret = db->hdb_firstkey(context, db, flags, &entry);
+    if (ret == 0)
+       krb5_clear_error_string(context);
     while(ret == 0){
        ret = (*func)(context, db, &entry, data);
        hdb_free_entry(context, &entry);
     while(ret == 0){
        ret = (*func)(context, db, &entry, data);
        hdb_free_entry(context, &entry);
@@ -228,8 +234,11 @@ hdb_init_db(krb5_context context, HDB *db)
     version.length = strlen(version.data) + 1; /* zero terminated */
     ret = (*db->hdb__put)(context, db, 0, tag, version);
     ret2 = db->hdb_unlock(context, db);
     version.length = strlen(version.data) + 1; /* zero terminated */
     ret = (*db->hdb__put)(context, db, 0, tag, version);
     ret2 = db->hdb_unlock(context, db);
-    if (ret)
+    if (ret) {
+       if (ret2)
+           krb5_clear_error_string(context);
        return ret;
        return ret;
+    }
     return ret2;
 }
 
     return ret2;
 }
 
index dcfceb58f07ccd73c07490137d1c41317a07ede3..830589388f8a984da3405f899537cc3a8f37bebd 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: hdb.h,v 1.38 2006/04/28 07:37:11 lha Exp $ */
+/* $Id: hdb.h 20535 2007-04-23 07:49:16Z lha $ */
 
 #ifndef __HDB_H__
 #define __HDB_H__
 
 #ifndef __HDB_H__
 #define __HDB_H__
@@ -41,6 +41,8 @@
 #include <heim_asn1.h>
 #include <hdb_asn1.h>
 
 #include <heim_asn1.h>
 #include <hdb_asn1.h>
 
+struct hdb_dbinfo;
+
 enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
 
 /* flags for various functions */
 enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
 
 /* flags for various functions */
@@ -50,6 +52,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
 #define HDB_F_GET_SERVER       8       /* fetch server */
 #define HDB_F_GET_KRBTGT       16      /* fetch krbtgt */
 #define HDB_F_GET_ANY          28      /* fetch any of client,server,krbtgt */
 #define HDB_F_GET_SERVER       8       /* fetch server */
 #define HDB_F_GET_KRBTGT       16      /* fetch krbtgt */
 #define HDB_F_GET_ANY          28      /* fetch any of client,server,krbtgt */
+#define HDB_F_CANON            32      /* want canonicalition */
 
 /* key usage for master key */
 #define HDB_KU_MKEY    0x484442
 
 /* key usage for master key */
 #define HDB_KU_MKEY    0x484442
@@ -69,7 +72,7 @@ typedef struct HDB{
     char *hdb_name;
     int hdb_master_key_set;
     hdb_master_key hdb_master_key;
     char *hdb_name;
     int hdb_master_key_set;
     hdb_master_key hdb_master_key;
-    void *hdb_openp;
+    int hdb_openp;
 
     krb5_error_code (*hdb_open)(krb5_context,
                                struct HDB*,
 
     krb5_error_code (*hdb_open)(krb5_context,
                                struct HDB*,
index f2636b2fea74178df46644ad665e14d3b0c32ba3..5c5b80bb366097941e9d0b6f3f764ae5d9ace7e9 100644 (file)
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: hdb_err.et,v 1.6 2005/08/11 13:17:22 lha Exp $"
+id "$Id: hdb_err.et 15878 2005-08-11 13:17:22Z lha $"
 
 error_table hdb
 
 
 error_table hdb
 
index 0bf4e8191c57219eccc9c721a3b0b40e01486200..ad16075b247fe91b4af367d04060e0e20e008911 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: hdb_locl.h,v 1.19 2003/09/10 21:54:58 lha Exp $ */
+/* $Id: hdb_locl.h 12820 2003-09-10 21:54:58Z lha $ */
 
 #ifndef __HDB_LOCL_H__
 #define __HDB_LOCL_H__
 
 #ifndef __HDB_LOCL_H__
 #define __HDB_LOCL_H__
index 8d4810f5c917c96ed93153d3ae5df1db7b32bbb0..9b870501201dccd40de18d11c8d13d5172ca9e99 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "hdb_locl.h"
 
 
 #include "hdb_locl.h"
 
-RCSID("$Id: keys.c,v 1.6 2006/10/22 09:40:12 lha Exp $");
+RCSID("$Id: keys.c 18819 2006-10-22 09:40:12Z lha $");
 
 /*
  * free all the memory used by (len, keys)
 
 /*
  * free all the memory used by (len, keys)
index 7ae3ec31503dfcdf3ceb711bf301368248b1ae5b..5c867daf20915d473d17732cfe6978264ae473e2 100644 (file)
@@ -35,7 +35,7 @@
 
 /* keytab backend for HDB databases */
 
 
 /* keytab backend for HDB databases */
 
-RCSID("$Id: keytab.c,v 1.16 2006/10/09 12:36:40 lha Exp $");
+RCSID("$Id: keytab.c 18380 2006-10-09 12:36:40Z lha $");
 
 struct hdb_data {
     char *dbname;
 
 struct hdb_data {
     char *dbname;
index 40569b29ad9add72925c1ce185fb58b813f75527..02d87b6cf3efbd00560b1bc266e3cf2733504c1a 100644 (file)
@@ -36,7 +36,7 @@
 #define O_BINARY 0
 #endif
 
 #define O_BINARY 0
 #endif
 
-RCSID("$Id: mkey.c,v 1.22 2006/05/05 10:27:59 lha Exp $");
+RCSID("$Id: mkey.c 17445 2006-05-05 10:37:46Z lha $");
 
 struct hdb_master_key_data {
     krb5_keytab_entry keytab;
 
 struct hdb_master_key_data {
     krb5_keytab_entry keytab;
index 6c72ea78c570200844e809bf7bd4336ea8c4e01d..6575b8a4171c75ee2ba06d005f06ae6e35119491 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "hdb_locl.h"
 
 
 #include "hdb_locl.h"
 
-RCSID("$Id: ndbm.c,v 1.38 2005/12/13 11:54:10 lha Exp $");
+RCSID("$Id: ndbm.c 16395 2005-12-13 11:54:10Z lha $");
 
 #if HAVE_NDBM
 
 
 #if HAVE_NDBM
 
index 1a5b4947be0a755c9fec7f35ff6d9a0297f52ccd..0e48269aa47fd6180c31ffe5fa199c777f6575ed 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "hx_locl.h"
 #include <pkinit_asn1.h>
 
 #include "hx_locl.h"
 #include <pkinit_asn1.h>
-RCSID("$Id: ca.c,v 1.12 2007/01/05 18:40:46 lha Exp $");
+RCSID("$Id: ca.c 20904 2007-06-05 01:58:45Z lha $");
 
 struct hx509_ca_tbs {
     hx509_name subject;
 
 struct hx509_ca_tbs {
     hx509_name subject;
@@ -47,10 +47,12 @@ struct hx509_ca_tbs {
        unsigned int ca:1;
        unsigned int key:1;
        unsigned int serial:1;
        unsigned int ca:1;
        unsigned int key:1;
        unsigned int serial:1;
+       unsigned int domaincontroller:1;
     } flags;
     time_t notBefore;
     time_t notAfter;
     int pathLenConstraint; /* both for CA and Proxy */
     } flags;
     time_t notBefore;
     time_t notAfter;
     int pathLenConstraint; /* both for CA and Proxy */
+    CRLDistributionPoints crldp;
 };
 
 int
 };
 
 int
@@ -66,6 +68,8 @@ hx509_ca_tbs_init(hx509_context context, hx509_ca_tbs *tbs)
     (*tbs)->eku.len = 0;
     (*tbs)->eku.val = NULL;
     (*tbs)->pathLenConstraint = 0;
     (*tbs)->eku.len = 0;
     (*tbs)->eku.val = NULL;
     (*tbs)->pathLenConstraint = 0;
+    (*tbs)->crldp.len = 0;
+    (*tbs)->crldp.val = NULL;
 
     return 0;
 }
 
     return 0;
 }
@@ -80,6 +84,7 @@ hx509_ca_tbs_free(hx509_ca_tbs *tbs)
     free_GeneralNames(&(*tbs)->san);
     free_ExtKeyUsage(&(*tbs)->eku);
     der_free_heim_integer(&(*tbs)->serial);
     free_GeneralNames(&(*tbs)->san);
     free_ExtKeyUsage(&(*tbs)->eku);
     der_free_heim_integer(&(*tbs)->serial);
+    free_CRLDistributionPoints(&(*tbs)->crldp);
 
     hx509_name_free(&(*tbs)->subject);
 
 
     hx509_name_free(&(*tbs)->subject);
 
@@ -114,6 +119,89 @@ hx509_ca_tbs_set_notAfter_lifetime(hx509_context context,
     return hx509_ca_tbs_set_notAfter(context, tbs, time(NULL) + delta);
 }
 
     return hx509_ca_tbs_set_notAfter(context, tbs, time(NULL) + delta);
 }
 
+static const struct units templatebits[] = {
+    { "ExtendedKeyUsage", HX509_CA_TEMPLATE_EKU },
+    { "KeyUsage", HX509_CA_TEMPLATE_KU },
+    { "SPKI", HX509_CA_TEMPLATE_SPKI },
+    { "notAfter", HX509_CA_TEMPLATE_NOTAFTER },
+    { "notBefore", HX509_CA_TEMPLATE_NOTBEFORE },
+    { "serial", HX509_CA_TEMPLATE_SERIAL },
+    { "subject", HX509_CA_TEMPLATE_SUBJECT },
+    { NULL, 0 }
+};
+
+const struct units *
+hx509_ca_tbs_template_units(void)
+{
+    return templatebits;
+}
+
+int
+hx509_ca_tbs_set_template(hx509_context context,
+                         hx509_ca_tbs tbs,
+                         int flags,
+                         hx509_cert cert)
+{
+    int ret;
+
+    if (flags & HX509_CA_TEMPLATE_SUBJECT) {
+       if (tbs->subject)
+           hx509_name_free(&tbs->subject);
+       ret = hx509_cert_get_subject(cert, &tbs->subject);
+       if (ret) {
+           hx509_set_error_string(context, 0, ret, 
+                                  "Failed to get subject from template");
+           return ret;
+       }
+    }
+    if (flags & HX509_CA_TEMPLATE_SERIAL) {
+       der_free_heim_integer(&tbs->serial);
+       ret = hx509_cert_get_serialnumber(cert, &tbs->serial);
+       tbs->flags.serial = !ret;
+       if (ret) {
+           hx509_set_error_string(context, 0, ret, 
+                                  "Failed to copy serial number");
+           return ret;
+       }
+    }
+    if (flags & HX509_CA_TEMPLATE_NOTBEFORE)
+       tbs->notBefore = hx509_cert_get_notBefore(cert);
+    if (flags & HX509_CA_TEMPLATE_NOTAFTER)
+       tbs->notAfter = hx509_cert_get_notAfter(cert);
+    if (flags & HX509_CA_TEMPLATE_SPKI) {
+       free_SubjectPublicKeyInfo(&tbs->spki);
+       ret = hx509_cert_get_SPKI(cert, &tbs->spki);
+       tbs->flags.key = !ret;
+       if (ret) {
+           hx509_set_error_string(context, 0, ret, "Failed to copy SPKI");
+           return ret;
+       }
+    }
+    if (flags & HX509_CA_TEMPLATE_KU) {
+       KeyUsage ku;
+       ret = _hx509_cert_get_keyusage(context, cert, &ku);
+       if (ret)
+           return ret;
+       tbs->key_usage = KeyUsage2int(ku);
+    }
+    if (flags & HX509_CA_TEMPLATE_EKU) {
+       ExtKeyUsage eku;
+       int i;
+       ret = _hx509_cert_get_eku(context, cert, &eku);
+       if (ret)
+           return ret;
+       for (i = 0; i < eku.len; i++) {
+           ret = hx509_ca_tbs_add_eku(context, tbs, &eku.val[i]);
+           if (ret) {
+               free_ExtKeyUsage(&eku);
+               return ret;
+           }
+       }
+       free_ExtKeyUsage(&eku);
+    }
+    return 0;
+}
+
 int
 hx509_ca_tbs_set_ca(hx509_context context,
                    hx509_ca_tbs tbs,
 int
 hx509_ca_tbs_set_ca(hx509_context context,
                    hx509_ca_tbs tbs,
@@ -135,6 +223,14 @@ hx509_ca_tbs_set_proxy(hx509_context context,
 }
 
 
 }
 
 
+int
+hx509_ca_tbs_set_domaincontroller(hx509_context context,
+                                 hx509_ca_tbs tbs)
+{
+    tbs->flags.domaincontroller = 1;
+    return 0;
+}
+
 int
 hx509_ca_tbs_set_spki(hx509_context context,
                      hx509_ca_tbs tbs,
 int
 hx509_ca_tbs_set_spki(hx509_context context,
                      hx509_ca_tbs tbs,
@@ -160,24 +256,122 @@ hx509_ca_tbs_set_serialnumber(hx509_context context,
 }
 
 int
 }
 
 int
-hx509_ca_tbs_add_eku(hx509_context contex,
+hx509_ca_tbs_add_eku(hx509_context context,
                     hx509_ca_tbs tbs,
                     const heim_oid *oid)
 {
     void *ptr;
     int ret;
                     hx509_ca_tbs tbs,
                     const heim_oid *oid)
 {
     void *ptr;
     int ret;
+    unsigned i;
+
+    /* search for duplicates */
+    for (i = 0; i < tbs->eku.len; i++) {
+       if (der_heim_oid_cmp(oid, &tbs->eku.val[i]) == 0)
+           return 0;
+    }
 
     ptr = realloc(tbs->eku.val, sizeof(tbs->eku.val[0]) * (tbs->eku.len + 1));
 
     ptr = realloc(tbs->eku.val, sizeof(tbs->eku.val[0]) * (tbs->eku.len + 1));
-    if (ptr == NULL)
+    if (ptr == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
        return ENOMEM;
        return ENOMEM;
+    }
     tbs->eku.val = ptr;
     ret = der_copy_oid(oid, &tbs->eku.val[tbs->eku.len]);
     tbs->eku.val = ptr;
     ret = der_copy_oid(oid, &tbs->eku.val[tbs->eku.len]);
-    if (ret)
+    if (ret) {
+       hx509_set_error_string(context, 0, ret, "out of memory");
        return ret;
        return ret;
+    }
     tbs->eku.len += 1;
     return 0;
 }
 
     tbs->eku.len += 1;
     return 0;
 }
 
+int
+hx509_ca_tbs_add_crl_dp_uri(hx509_context context,
+                           hx509_ca_tbs tbs,
+                           const char *uri,
+                           hx509_name issuername)
+{
+    DistributionPoint dp;
+    int ret;
+
+    memset(&dp, 0, sizeof(dp));
+    
+    dp.distributionPoint = ecalloc(1, sizeof(*dp.distributionPoint));
+
+    {
+       DistributionPointName name;
+       GeneralName gn;
+       size_t size;
+
+       name.element = choice_DistributionPointName_fullName;
+       name.u.fullName.len = 1;
+       name.u.fullName.val = &gn;
+
+       gn.element = choice_GeneralName_uniformResourceIdentifier;
+       gn.u.uniformResourceIdentifier = rk_UNCONST(uri);
+
+       ASN1_MALLOC_ENCODE(DistributionPointName, 
+                          dp.distributionPoint->data, 
+                          dp.distributionPoint->length,
+                          &name, &size, ret);
+       if (ret) {
+           hx509_set_error_string(context, 0, ret,
+                                  "Failed to encoded DistributionPointName");
+           goto out;
+       }
+       if (dp.distributionPoint->length != size)
+           _hx509_abort("internal ASN.1 encoder error");
+    }
+
+    if (issuername) {
+#if 1
+       hx509_set_error_string(context, 0, EINVAL,
+                              "CRLDistributionPoints.name.issuername not yet supported");
+       return EINVAL;
+#else 
+       GeneralNames *crlissuer;
+       GeneralName gn;
+       Name n;
+
+       crlissuer = calloc(1, sizeof(*crlissuer));
+       if (crlissuer == NULL) {
+           return ENOMEM;
+       }
+       memset(&gn, 0, sizeof(gn));
+
+       gn.element = choice_GeneralName_directoryName;
+       ret = hx509_name_to_Name(issuername, &n);
+       if (ret) {
+           hx509_set_error_string(context, 0, ret, "out of memory");
+           goto out;
+       }
+
+       gn.u.directoryName.element = n.element;
+       gn.u.directoryName.u.rdnSequence = n.u.rdnSequence;
+
+       ret = add_GeneralNames(&crlissuer, &gn);
+       free_Name(&n);
+       if (ret) {
+           hx509_set_error_string(context, 0, ret, "out of memory");
+           goto out;
+       }
+
+       dp.cRLIssuer = &crlissuer;
+#endif
+    }
+
+    ret = add_CRLDistributionPoints(&tbs->crldp, &dp);
+    if (ret) {
+       hx509_set_error_string(context, 0, ret, "out of memory");
+       goto out;
+    }
+
+out:
+    free_DistributionPoint(&dp);
+
+    return ret;
+}
+
 int
 hx509_ca_tbs_add_san_otherName(hx509_context context,
                               hx509_ca_tbs tbs,
 int
 hx509_ca_tbs_add_san_otherName(hx509_context context,
                               hx509_ca_tbs tbs,
@@ -282,6 +476,58 @@ out:
     return ret;
 }
     
     return ret;
 }
     
+/*
+ *
+ */
+
+static int
+add_utf8_san(hx509_context context,
+            hx509_ca_tbs tbs,
+            const heim_oid *oid,
+            const char *string)
+{
+    const PKIXXmppAddr ustring = (const PKIXXmppAddr)string;
+    heim_octet_string os;
+    size_t size;
+    int ret;
+
+    os.length = 0;
+    os.data = NULL;
+
+    ASN1_MALLOC_ENCODE(PKIXXmppAddr, os.data, os.length, &ustring, &size, ret);
+    if (ret) {
+       hx509_set_error_string(context, 0, ret, "Out of memory");
+       goto out;
+    }
+    if (size != os.length)
+       _hx509_abort("internal ASN.1 encoder error");
+    
+    ret = hx509_ca_tbs_add_san_otherName(context,
+                                        tbs,
+                                        oid,
+                                        &os);
+    free(os.data);
+out:
+    return ret;
+}
+
+int
+hx509_ca_tbs_add_san_ms_upn(hx509_context context,
+                           hx509_ca_tbs tbs,
+                           const char *principal)
+{
+    return add_utf8_san(context, tbs, oid_id_pkinit_ms_san(), principal);
+}
+
+int
+hx509_ca_tbs_add_san_jid(hx509_context context,
+                        hx509_ca_tbs tbs,
+                        const char *jid)
+{
+    return add_utf8_san(context, tbs, oid_id_pkix_on_xmppAddr(), jid);
+}
+
+
 int
 hx509_ca_tbs_add_san_hostname(hx509_context context,
                              hx509_ca_tbs tbs,
 int
 hx509_ca_tbs_add_san_hostname(hx509_context context,
                              hx509_ca_tbs tbs,
@@ -321,6 +567,14 @@ hx509_ca_tbs_set_subject(hx509_context context,
     return hx509_name_copy(context, subject, &tbs->subject);
 }
 
     return hx509_name_copy(context, subject, &tbs->subject);
 }
 
+int
+hx509_ca_tbs_subject_expand(hx509_context context,
+                           hx509_ca_tbs tbs,
+                           hx509_env env)
+{
+    return hx509_name_expand(context, tbs->subject, env);
+}
+
 static int
 add_extension(hx509_context context,
              TBSCertificate *tbsc,
 static int
 add_extension(hx509_context context,
              TBSCertificate *tbsc,
@@ -410,7 +664,7 @@ ca_sign(hx509_context context,
     time_t notAfter;
     unsigned key_usage;
 
     time_t notAfter;
     unsigned key_usage;
 
-    sigalg = hx509_signature_rsa_with_sha1();
+    sigalg = _hx509_crypto_default_sig_alg;
 
     memset(&c, 0, sizeof(c));
 
 
     memset(&c, 0, sizeof(c));
 
@@ -439,6 +693,7 @@ ca_sign(hx509_context context,
        KeyUsage ku;
        memset(&ku, 0, sizeof(ku));
        ku.keyCertSign = 1;
        KeyUsage ku;
        memset(&ku, 0, sizeof(ku));
        ku.keyCertSign = 1;
+       ku.cRLSign = 1;
        key_usage |= KeyUsage2int(ku);
     }
 
        key_usage |= KeyUsage2int(ku);
     }
 
@@ -453,16 +708,25 @@ ca_sign(hx509_context context,
        hx509_set_error_string(context, 0, ret, "No public key set");
        return ret;
     }
        hx509_set_error_string(context, 0, ret, "No public key set");
        return ret;
     }
-    if (tbs->subject == NULL && !tbs->flags.proxy) {
-       ret = EINVAL;
-       hx509_set_error_string(context, 0, ret, "No subject name set");
-       return ret;
+    /*
+     * Don't put restrictions on proxy certificate's subject name, it
+     * will be generated below.
+     */
+    if (!tbs->flags.proxy) {
+       if (tbs->subject == NULL) {
+           hx509_set_error_string(context, 0, EINVAL, "No subject name set");
+           return EINVAL;
+       }
+       if (hx509_name_is_null_p(tbs->subject) && tbs->san.len == 0) {
+           hx509_set_error_string(context, 0, EINVAL, 
+                                  "NULL subject and no SubjectAltNames");
+           return EINVAL;
+       }
     }
     if (tbs->flags.ca && tbs->flags.proxy) {
     }
     if (tbs->flags.ca && tbs->flags.proxy) {
-       ret = EINVAL;
-       hx509_set_error_string(context, 0, ret, "Can't be proxy and CA "
+       hx509_set_error_string(context, 0, EINVAL, "Can't be proxy and CA "
                               "at the same time");
                               "at the same time");
-       return ret;
+       return EINVAL;
     }
     if (tbs->flags.proxy) {
        if (tbs->san.len > 0) {
     }
     if (tbs->flags.proxy) {
        if (tbs->san.len > 0) {
@@ -549,6 +813,22 @@ ca_sign(hx509_context context,
        goto out;
     }
     
        goto out;
     }
     
+    /* Add the text BMP string Domaincontroller to the cert */
+    if (tbs->flags.domaincontroller) {
+       data.data = rk_UNCONST("\x1e\x20\x00\x44\x00\x6f\x00\x6d"
+                              "\x00\x61\x00\x69\x00\x6e\x00\x43"
+                              "\x00\x6f\x00\x6e\x00\x74\x00\x72"
+                              "\x00\x6f\x00\x6c\x00\x6c\x00\x65"
+                              "\x00\x72");
+       data.length = 34;
+
+       ret = add_extension(context, tbsc, 0,
+                           oid_id_ms_cert_enroll_domaincontroller(),
+                           &data);
+       if (ret)
+           goto out;
+    }
+
     /* add KeyUsage */
     {
        KeyUsage ku;
     /* add KeyUsage */
     {
        KeyUsage ku;
@@ -561,7 +841,7 @@ ca_sign(hx509_context context,
        }
        if (size != data.length)
            _hx509_abort("internal ASN.1 encoder error");
        }
        if (size != data.length)
            _hx509_abort("internal ASN.1 encoder error");
-       ret = add_extension(context, tbsc, 1, 
+       ret = add_extension(context, tbsc, 1,
                            oid_id_x509_ce_keyUsage(), &data);
        free(data.data);
        if (ret)
                            oid_id_x509_ce_keyUsage(), &data);
        free(data.data);
        if (ret)
@@ -678,7 +958,8 @@ ca_sign(hx509_context context,
        }
        if (size != data.length)
            _hx509_abort("internal ASN.1 encoder error");
        }
        if (size != data.length)
            _hx509_abort("internal ASN.1 encoder error");
-       ret = add_extension(context, tbsc, 0,
+       /* Critical if this is a CA */
+       ret = add_extension(context, tbsc, tbs->flags.ca,
                            oid_id_x509_ce_basicConstraints(),
                            &data);
        free(data.data);
                            oid_id_x509_ce_basicConstraints(),
                            &data);
        free(data.data);
@@ -728,6 +1009,23 @@ ca_sign(hx509_context context,
            goto out;
     }
 
            goto out;
     }
 
+    if (tbs->crldp.len) {
+
+       ASN1_MALLOC_ENCODE(CRLDistributionPoints, data.data, data.length,
+                          &tbs->crldp, &size, ret);
+       if (ret) {
+           hx509_set_error_string(context, 0, ret, "Out of memory");
+           goto out;
+       }
+       if (size != data.length)
+           _hx509_abort("internal ASN.1 encoder error");
+       ret = add_extension(context, tbsc, FALSE,
+                           oid_id_x509_ce_cRLDistributionPoints(),
+                           &data);
+       free(data.data);
+       if (ret)
+           goto out;
+    }
 
     ASN1_MALLOC_ENCODE(TBSCertificate, data.data, data.length,tbsc, &size, ret);
     if (ret) {
 
     ASN1_MALLOC_ENCODE(TBSCertificate, data.data, data.length,tbsc, &size, ret);
     if (ret) {
@@ -772,11 +1070,13 @@ get_AuthorityKeyIdentifier(hx509_context context,
     if (ret == 0) {
        ai->keyIdentifier = calloc(1, sizeof(*ai->keyIdentifier));
        if (ai->keyIdentifier == NULL) {
     if (ret == 0) {
        ai->keyIdentifier = calloc(1, sizeof(*ai->keyIdentifier));
        if (ai->keyIdentifier == NULL) {
+           free_SubjectKeyIdentifier(&si);
            ret = ENOMEM;
            hx509_set_error_string(context, 0, ret, "Out of memory");
            goto out;
        }
        ret = der_copy_octet_string(&si, ai->keyIdentifier);
            ret = ENOMEM;
            hx509_set_error_string(context, 0, ret, "Out of memory");
            goto out;
        }
        ret = der_copy_octet_string(&si, ai->keyIdentifier);
+       free_SubjectKeyIdentifier(&si);
        if (ret) {
            hx509_set_error_string(context, 0, ret, "Out of memory");
            goto out;
        if (ret) {
            hx509_set_error_string(context, 0, ret, "Out of memory");
            goto out;
@@ -818,6 +1118,7 @@ get_AuthorityKeyIdentifier(hx509_context context,
            goto out;
        }
 
            goto out;
        }
 
+       memset(&gn, 0, sizeof(gn));
        gn.element = choice_GeneralName_directoryName;
        gn.u.directoryName.element = 
            choice_GeneralName_directoryName_rdnSequence;
        gn.element = choice_GeneralName_directoryName;
        gn.u.directoryName.element = 
            choice_GeneralName_directoryName_rdnSequence;
index f84c61a798234676e7d8160b34a4a7abb3c9b257..27b17a02049147e51674e5de6cc5477e607aeae7 100644 (file)
@@ -32,8 +32,9 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: cert.c,v 1.82 2007/01/09 10:52:03 lha Exp $");
+RCSID("$Id: cert.c 20915 2007-06-05 03:58:56Z lha $");
 #include "crypto-headers.h"
 #include "crypto-headers.h"
+#include <rtbl.h>
 
 struct hx509_verify_ctx_data {
     hx509_certs trust_anchors;
 
 struct hx509_verify_ctx_data {
     hx509_certs trust_anchors;
@@ -102,11 +103,13 @@ hx509_context_init(hx509_context *context)
     if (*context == NULL)
        return ENOMEM;
 
     if (*context == NULL)
        return ENOMEM;
 
+    _hx509_ks_null_register(*context);
     _hx509_ks_mem_register(*context);
     _hx509_ks_file_register(*context);
     _hx509_ks_pkcs12_register(*context);
     _hx509_ks_pkcs11_register(*context);
     _hx509_ks_dir_register(*context);
     _hx509_ks_mem_register(*context);
     _hx509_ks_file_register(*context);
     _hx509_ks_pkcs12_register(*context);
     _hx509_ks_pkcs11_register(*context);
     _hx509_ks_dir_register(*context);
+    _hx509_ks_keychain_register(*context);
 
     ENGINE_add_conf_module();
     OpenSSL_add_all_algorithms();
 
     ENGINE_add_conf_module();
     OpenSSL_add_all_algorithms();
@@ -116,6 +119,11 @@ hx509_context_init(hx509_context *context)
     initialize_hx_error_table_r(&(*context)->et_list);
     initialize_asn1_error_table_r(&(*context)->et_list);
 
     initialize_hx_error_table_r(&(*context)->et_list);
     initialize_asn1_error_table_r(&(*context)->et_list);
 
+#ifdef HX509_DEFAULT_ANCHORS
+    (void)hx509_certs_init(*context, HX509_DEFAULT_ANCHORS, 0,
+                          NULL, &(*context)->default_trust_anchors);
+#endif
+
     return 0;
 }
 
     return 0;
 }
 
@@ -138,6 +146,9 @@ hx509_context_free(hx509_context *context)
     }
     (*context)->ks_num_ops = 0;
     free_error_table ((*context)->et_list);
     }
     (*context)->ks_num_ops = 0;
     free_error_table ((*context)->et_list);
+    if ((*context)->querystat)
+       free((*context)->querystat);
+    memset(*context, 0, sizeof(**context));
     free(*context);
     *context = NULL;
 }
     free(*context);
     *context = NULL;
 }
@@ -836,7 +847,7 @@ find_parent(hx509_context context,
        
        hx509_set_error_string(context, 0, HX509_ISSUER_NOT_FOUND,
                               "Failed to find issuer for "
        
        hx509_set_error_string(context, 0, HX509_ISSUER_NOT_FOUND,
                               "Failed to find issuer for "
-                              "certificate with subject: %s", str);
+                              "certificate with subject: '%s'", str);
        free(str);
     }
     return HX509_ISSUER_NOT_FOUND;
        free(str);
     }
     return HX509_ISSUER_NOT_FOUND;
@@ -847,7 +858,9 @@ find_parent(hx509_context context,
  */
 
 static int
  */
 
 static int
-is_proxy_cert(hx509_context context, const Certificate *cert, ProxyCertInfo *rinfo)
+is_proxy_cert(hx509_context context, 
+             const Certificate *cert, 
+             ProxyCertInfo *rinfo)
 {
     ProxyCertInfo info;
     const Extension *e;
 {
     ProxyCertInfo info;
     const Extension *e;
@@ -876,7 +889,9 @@ is_proxy_cert(hx509_context context, const Certificate *cert, ProxyCertInfo *rin
        hx509_clear_error_string(context);
        return HX509_EXTRA_DATA_AFTER_STRUCTURE; 
     }
        hx509_clear_error_string(context);
        return HX509_EXTRA_DATA_AFTER_STRUCTURE; 
     }
-    if (rinfo)
+    if (rinfo == NULL)
+       free_ProxyCertInfo(&info);
+    else
        *rinfo = info;
 
     return 0;
        *rinfo = info;
 
     return 0;
@@ -969,8 +984,10 @@ _hx509_calculate_path(hx509_context context,
        current = parent;
 
        if (path->len > max_depth) {
        current = parent;
 
        if (path->len > max_depth) {
+           hx509_cert_free(current);
            hx509_set_error_string(context, 0, HX509_PATH_TOO_LONG,
            hx509_set_error_string(context, 0, HX509_PATH_TOO_LONG,
-                                  "Path too long while bulding certificate chain");
+                                  "Path too long while bulding "
+                                  "certificate chain");
            return HX509_PATH_TOO_LONG;
        }
     }
            return HX509_PATH_TOO_LONG;
        }
     }
@@ -1065,6 +1082,25 @@ hx509_cert_get_serialnumber(hx509_cert p, heim_integer *i)
     return der_copy_heim_integer(&p->data->tbsCertificate.serialNumber, i);
 }
 
     return der_copy_heim_integer(&p->data->tbsCertificate.serialNumber, i);
 }
 
+time_t
+hx509_cert_get_notBefore(hx509_cert p)
+{
+    return _hx509_Time2time_t(&p->data->tbsCertificate.validity.notBefore);
+}
+
+time_t
+hx509_cert_get_notAfter(hx509_cert p)
+{
+    return _hx509_Time2time_t(&p->data->tbsCertificate.validity.notAfter);
+}
+
+int
+hx509_cert_get_SPKI(hx509_cert p, SubjectPublicKeyInfo *spki)
+{
+    return copy_SubjectPublicKeyInfo(&p->data->tbsCertificate.subjectPublicKeyInfo,
+                                    spki);
+}
+
 hx509_private_key
 _hx509_cert_private_key(hx509_cert p)
 {
 hx509_private_key
 _hx509_cert_private_key(hx509_cert p)
 {
@@ -1349,7 +1385,7 @@ match_tree(const GeneralSubtrees *t, const Certificate *c, int *match)
        {
            GeneralName certname;
            
        {
            GeneralName certname;
            
-           
+           memset(&certname, 0, sizeof(certname));
            certname.element = choice_GeneralName_directoryName;
            certname.u.directoryName.element = 
                c->tbsCertificate.subject.element;
            certname.element = choice_GeneralName_directoryName;
            certname.u.directoryName.element = 
                c->tbsCertificate.subject.element;
@@ -1435,6 +1471,7 @@ hx509_verify_path(hx509_context context,
     int ret, i, proxy_cert_depth;
     enum certtype type;
     Name proxy_issuer;
     int ret, i, proxy_cert_depth;
     enum certtype type;
     Name proxy_issuer;
+    hx509_certs anchors = NULL;
 
     memset(&proxy_issuer, 0, sizeof(proxy_issuer));
 
 
     memset(&proxy_issuer, 0, sizeof(proxy_issuer));
 
@@ -1448,12 +1485,25 @@ hx509_verify_path(hx509_context context,
     if ((ctx->flags & HX509_VERIFY_CTX_F_TIME_SET) == 0)
        ctx->time_now = time(NULL);
 
     if ((ctx->flags & HX509_VERIFY_CTX_F_TIME_SET) == 0)
        ctx->time_now = time(NULL);
 
+    /*
+     *
+     */
+    ret = hx509_certs_init(context, "MEMORY:trust-anchors", 0, NULL, &anchors);
+    if (ret)
+       goto out;
+    ret = hx509_certs_merge(context, anchors, ctx->trust_anchors);
+    if (ret)
+       goto out;
+    ret = hx509_certs_merge(context, anchors, context->default_trust_anchors);
+    if (ret)
+       goto out;
+
     /*
      * Calculate the path from the certificate user presented to the
      * to an anchor.
      */
     ret = _hx509_calculate_path(context, 0, ctx->time_now,
     /*
      * Calculate the path from the certificate user presented to the
      * to an anchor.
      */
     ret = _hx509_calculate_path(context, 0, ctx->time_now,
-                               ctx->trust_anchors, ctx->max_depth,
+                               anchors, ctx->max_depth,
                                cert, pool, &path);
     if (ret)
        goto out;
                                cert, pool, &path);
     if (ret)
        goto out;
@@ -1775,6 +1825,7 @@ hx509_verify_path(hx509_context context,
     }
 
 out:
     }
 
 out:
+    hx509_certs_free(&anchors);
     free_Name(&proxy_issuer);
     free_name_constraints(&nc);
     _hx509_path_free(&path);
     free_Name(&proxy_issuer);
     free_name_constraints(&nc);
     _hx509_path_free(&path);
@@ -2030,6 +2081,8 @@ _hx509_query_match_cert(hx509_context context, const hx509_query *q, hx509_cert
 {
     Certificate *c = _hx509_get_cert(cert);
 
 {
     Certificate *c = _hx509_get_cert(cert);
 
+    _hx509_query_statistic(context, 1, q);
+
     if ((q->match & HX509_QUERY_FIND_ISSUER_CERT) &&
        _hx509_cert_is_parent_cmp(q->subject, c, 0) != 0)
        return 0;
     if ((q->match & HX509_QUERY_FIND_ISSUER_CERT) &&
        _hx509_cert_is_parent_cmp(q->subject, c, 0) != 0)
        return 0;
@@ -2154,6 +2207,139 @@ _hx509_query_match_cert(hx509_context context, const hx509_query *q, hx509_cert
     return 1;
 }
 
     return 1;
 }
 
+void
+hx509_query_statistic_file(hx509_context context, const char *fn)
+{
+    if (context->querystat)
+       free(context->querystat);
+    context->querystat = strdup(fn);
+}
+
+void
+_hx509_query_statistic(hx509_context context, int type, const hx509_query *q)
+{
+    FILE *f;
+    if (context->querystat == NULL)
+       return;
+    f = fopen(context->querystat, "a");
+    if (f == NULL)
+       return;
+    fprintf(f, "%d %d\n", type, q->match);
+    fclose(f);
+}
+
+static const char *statname[] = {
+    "find issuer cert",
+    "match serialnumber",
+    "match issuer name",
+    "match subject name",
+    "match subject key id",
+    "match issuer id",
+    "private key",
+    "ku encipherment",
+    "ku digitalsignature",
+    "ku keycertsign",
+    "ku crlsign",
+    "ku nonrepudiation",
+    "ku keyagreement",
+    "ku dataencipherment",
+    "anchor",
+    "match certificate",
+    "match local key id",
+    "no match path",
+    "match friendly name",
+    "match function",
+    "match key hash sha1",
+    "match time"
+};
+
+struct stat_el {
+    unsigned long stats;
+    unsigned int index;
+};
+
+
+static int
+stat_sort(const void *a, const void *b)
+{
+    const struct stat_el *ae = a;
+    const struct stat_el *be = b;
+    return be->stats - ae->stats;
+}
+
+void
+hx509_query_unparse_stats(hx509_context context, int printtype, FILE *out)
+{
+    rtbl_t t;
+    FILE *f;
+    int type, mask, i, num;
+    unsigned long multiqueries = 0, totalqueries = 0;
+    struct stat_el stats[32];
+
+    if (context->querystat == NULL)
+       return;
+    f = fopen(context->querystat, "r");
+    if (f == NULL) {
+       fprintf(out, "No statistic file %s: %s.\n", 
+               context->querystat, strerror(errno));
+       return;
+    }
+    
+    for (i = 0; i < sizeof(stats)/sizeof(stats[0]); i++) {
+       stats[i].index = i;
+       stats[i].stats = 0;
+    }
+
+    while (fscanf(f, "%d %d\n", &type, &mask) == 2) {
+       if (type != printtype)
+           continue;
+       num = i = 0;
+       while (mask && i < sizeof(stats)/sizeof(stats[0])) {
+           if (mask & 1) {
+               stats[i].stats++;
+               num++;
+           }
+           mask = mask >>1 ;
+           i++;
+       }
+       if (num > 1)
+           multiqueries++;
+       totalqueries++;
+    }
+    fclose(f);
+
+    qsort(stats, sizeof(stats)/sizeof(stats[0]), sizeof(stats[0]), stat_sort);
+
+    t = rtbl_create();
+    if (t == NULL)
+       errx(1, "out of memory");
+
+    rtbl_set_separator (t, "  ");
+    
+    rtbl_add_column_by_id (t, 0, "Name", 0);
+    rtbl_add_column_by_id (t, 1, "Counter", 0);
+
+
+    for (i = 0; i < sizeof(stats)/sizeof(stats[0]); i++) {
+       char str[10];
+
+       if (stats[i].index < sizeof(statname)/sizeof(statname[0])) 
+           rtbl_add_column_entry_by_id (t, 0, statname[stats[i].index]);
+       else {
+           snprintf(str, sizeof(str), "%d", stats[i].index);
+           rtbl_add_column_entry_by_id (t, 0, str);
+       }
+       snprintf(str, sizeof(str), "%lu", stats[i].stats);
+       rtbl_add_column_entry_by_id (t, 1, str);
+    }
+
+    rtbl_format(t, out);
+    rtbl_destroy(t);
+
+    fprintf(out, "\nQueries: multi %lu total %lu\n", 
+           multiqueries, totalqueries);
+}
+
 int
 hx509_cert_check_eku(hx509_context context, hx509_cert cert,
                     const heim_oid *eku, int allow_any_eku)
 int
 hx509_cert_check_eku(hx509_context context, hx509_cert cert,
                     const heim_oid *eku, int allow_any_eku)
@@ -2212,3 +2398,39 @@ _hx509_cert_get_keyusage(hx509_context context,
        return ret;
     return 0;
 }
        return ret;
     return 0;
 }
+
+int
+_hx509_cert_get_eku(hx509_context context,
+                   hx509_cert cert,
+                   ExtKeyUsage *e)
+{
+    int ret;
+
+    memset(e, 0, sizeof(*e));
+
+    ret = find_extension_eku(_hx509_get_cert(cert), e);
+    if (ret && ret != HX509_EXTENSION_NOT_FOUND) {
+       hx509_clear_error_string(context);
+       return ret;
+    }
+    return 0;
+}
+
+int
+hx509_cert_binary(hx509_context context, hx509_cert c, heim_octet_string *os)
+{
+    size_t size;
+    int ret;
+
+    os->data = NULL;
+    os->length = 0;
+
+    ASN1_MALLOC_ENCODE(Certificate, os->data, os->length, 
+                      _hx509_get_cert(c), &size, ret);
+    if (ret)
+       return ret;
+    if (os->length != size)
+       _hx509_abort("internal ASN.1 encoder error");
+
+    return ret;
+}
index 4ed70b8f84b20b6f3a54430319d3dfb765624349..29ca80e1941cf2859b81106d7d6cb095a4ad900c 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2003 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  *
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: cms.c,v 1.48 2007/01/08 18:45:03 lha Exp $");
+RCSID("$Id: cms.c 20937 2007-06-06 20:50:55Z lha $");
 
 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X)))
 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0)
 
 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X)))
 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0)
@@ -302,6 +302,11 @@ hx509_cms_unenvelope(hx509_context context,
            goto out;
        }
        enccontent = encryptedContent;
            goto out;
        }
        enccontent = encryptedContent;
+    } else if (encryptedContent != NULL) {
+       ret = HX509_CMS_NO_DATA_AVAILABLE;
+       hx509_set_error_string(context, 0, ret,
+                              "Both internal and external encrypted data");
+       goto out;
     }
 
     cert = NULL;
     }
 
     cert = NULL;
@@ -423,6 +428,7 @@ out:
 
 int
 hx509_cms_envelope_1(hx509_context context,
 
 int
 hx509_cms_envelope_1(hx509_context context,
+                    int flags,
                     hx509_cert cert,
                     const void *data,
                     size_t length,
                     hx509_cert cert,
                     const void *data,
                     size_t length,
@@ -621,6 +627,7 @@ hx509_cms_verify_signed(hx509_context context,
                        hx509_verify_ctx ctx,
                        const void *data,
                        size_t length,
                        hx509_verify_ctx ctx,
                        const void *data,
                        size_t length,
+                       const heim_octet_string *signedContent,
                        hx509_certs store,
                        heim_oid *contentType,
                        heim_octet_string *content,
                        hx509_certs store,
                        heim_oid *contentType,
                        heim_octet_string *content,
@@ -648,12 +655,20 @@ hx509_cms_verify_signed(hx509_context context,
        goto out;
     }
 
        goto out;
     }
 
-    if (sd.encapContentInfo.eContent == NULL) {
+    if (sd.encapContentInfo.eContent == NULL && signedContent == NULL) {
        ret = HX509_CMS_NO_DATA_AVAILABLE;
        hx509_set_error_string(context, 0, ret,
                               "No content data in SignedData");
        goto out;
     }
        ret = HX509_CMS_NO_DATA_AVAILABLE;
        hx509_set_error_string(context, 0, ret,
                               "No content data in SignedData");
        goto out;
     }
+    if (sd.encapContentInfo.eContent && signedContent) {
+       ret = HX509_CMS_NO_DATA_AVAILABLE;
+       hx509_set_error_string(context, 0, ret,
+                              "Both external and internal SignedData");
+       goto out;
+    }
+    if (sd.encapContentInfo.eContent)
+       signedContent = sd.encapContentInfo.eContent;
 
     ret = hx509_certs_init(context, "MEMORY:cms-cert-buffer",
                           0, NULL, &certs);
 
     ret = hx509_certs_init(context, "MEMORY:cms-cert-buffer",
                           0, NULL, &certs);
@@ -739,7 +754,7 @@ hx509_cms_verify_signed(hx509_context context,
            ret = _hx509_verify_signature(context,
                                          NULL,
                                          &signer_info->digestAlgorithm,
            ret = _hx509_verify_signature(context,
                                          NULL,
                                          &signer_info->digestAlgorithm,
-                                         sd.encapContentInfo.eContent,
+                                         signedContent,
                                          &os);
            der_free_octet_string(&os);
            if (ret) {
                                          &os);
            der_free_octet_string(&os);
            if (ret) {
@@ -801,7 +816,7 @@ hx509_cms_verify_signed(hx509_context context,
                _hx509_abort("internal ASN.1 encoder error");
 
        } else {
                _hx509_abort("internal ASN.1 encoder error");
 
        } else {
-           signed_data = sd.encapContentInfo.eContent;
+           signed_data = rk_UNCONST(signedContent);
            match_oid = oid_id_pkcs7_data();
        }
 
            match_oid = oid_id_pkcs7_data();
        }
 
@@ -824,7 +839,7 @@ hx509_cms_verify_signed(hx509_context context,
                                       "Failed to verify sigature in "
                                       "CMS SignedData");
        }
                                       "Failed to verify sigature in "
                                       "CMS SignedData");
        }
-       if (signed_data != sd.encapContentInfo.eContent) {
+       if (signed_data != signedContent) {
            der_free_octet_string(signed_data);
            free(signed_data);
        }
            der_free_octet_string(signed_data);
            free(signed_data);
        }
@@ -861,14 +876,14 @@ hx509_cms_verify_signed(hx509_context context,
        goto out;
     }
 
        goto out;
     }
 
-    content->data = malloc(sd.encapContentInfo.eContent->length);
+    content->data = malloc(signedContent->length);
     if (content->data == NULL) {
        hx509_clear_error_string(context);
        ret = ENOMEM;
        goto out;
     }
     if (content->data == NULL) {
        hx509_clear_error_string(context);
        ret = ENOMEM;
        goto out;
     }
-    content->length = sd.encapContentInfo.eContent->length;
-    memcpy(content->data,sd.encapContentInfo.eContent->data,content->length);
+    content->length = signedContent->length;
+    memcpy(content->data, signedContent->data, content->length);
 
 out:
     free_SignedData(&sd);
 
 out:
     free_SignedData(&sd);
@@ -884,38 +899,6 @@ out:
     return ret;
 }
 
     return ret;
 }
 
-int
-_hx509_set_digest_alg(DigestAlgorithmIdentifier *id,
-                     const heim_oid *oid,
-                     void *param, size_t length)
-{
-    int ret;
-    if (param) {
-       id->parameters = malloc(sizeof(*id->parameters));
-       if (id->parameters == NULL)
-           return ENOMEM;
-       id->parameters->data = malloc(length);
-       if (id->parameters->data == NULL) {
-           free(id->parameters);
-           id->parameters = NULL;
-           return ENOMEM;
-       }
-       memcpy(id->parameters->data, param, length);
-       id->parameters->length = length;
-    } else
-       id->parameters = NULL;
-    ret = der_copy_oid(oid, &id->algorithm);
-    if (ret) {
-       if (id->parameters) {
-           free(id->parameters->data);
-           free(id->parameters);
-           id->parameters = NULL;
-       }
-       return ret;
-    }
-    return 0;
-}
-
 static int
 add_one_attribute(Attribute **attr,
                  unsigned int *len,
 static int
 add_one_attribute(Attribute **attr,
                  unsigned int *len,
@@ -950,6 +933,7 @@ add_one_attribute(Attribute **attr,
        
 int
 hx509_cms_create_signed_1(hx509_context context,
        
 int
 hx509_cms_create_signed_1(hx509_context context,
+                         int flags,
                          const heim_oid *eContentType,
                          const void *data, size_t length,
                          const AlgorithmIdentifier *digest_alg,
                          const heim_oid *eContentType,
                          const void *data, size_t length,
                          const AlgorithmIdentifier *digest_alg,
@@ -962,7 +946,7 @@ hx509_cms_create_signed_1(hx509_context context,
     AlgorithmIdentifier digest;
     hx509_name name;
     SignerInfo *signer_info;
     AlgorithmIdentifier digest;
     hx509_name name;
     SignerInfo *signer_info;
-    heim_octet_string buf;
+    heim_octet_string buf, content, sigdata = { 0, NULL };
     SignedData sd;
     int ret;
     size_t size;
     SignedData sd;
     int ret;
     size_t size;
@@ -973,6 +957,9 @@ hx509_cms_create_signed_1(hx509_context context,
     memset(&path, 0, sizeof(path));
     memset(&digest, 0, sizeof(digest));
 
     memset(&path, 0, sizeof(path));
     memset(&digest, 0, sizeof(digest));
 
+    content.data = rk_UNCONST(data);
+    content.length = length;
+
     if (_hx509_cert_private_key(cert) == NULL) {
        hx509_set_error_string(context, 0, HX509_PRIVATE_KEY_MISSING,
                               "Private key missing for signing");
     if (_hx509_cert_private_key(cert) == NULL) {
        hx509_set_error_string(context, 0, HX509_PRIVATE_KEY_MISSING,
                               "Private key missing for signing");
@@ -992,22 +979,29 @@ hx509_cms_create_signed_1(hx509_context context,
 
     sd.version = CMSVersion_v3;
 
 
     sd.version = CMSVersion_v3;
 
+    if (eContentType == NULL)
+       eContentType = oid_id_pkcs7_data();
+
     der_copy_oid(eContentType, &sd.encapContentInfo.eContentType);
     der_copy_oid(eContentType, &sd.encapContentInfo.eContentType);
-    ALLOC(sd.encapContentInfo.eContent, 1);
-    if (sd.encapContentInfo.eContent == NULL) {
-       hx509_clear_error_string(context);
-       ret = ENOMEM;
-       goto out;
-    }
 
 
-    sd.encapContentInfo.eContent->data = malloc(length);
-    if (sd.encapContentInfo.eContent->data == NULL) {
-       hx509_clear_error_string(context);
-       ret = ENOMEM;
-       goto out;
+    /* */
+    if ((flags & HX509_CMS_SIGATURE_DETACHED) == 0) {
+       ALLOC(sd.encapContentInfo.eContent, 1);
+       if (sd.encapContentInfo.eContent == NULL) {
+           hx509_clear_error_string(context);
+           ret = ENOMEM;
+           goto out;
+       }
+       
+       sd.encapContentInfo.eContent->data = malloc(length);
+       if (sd.encapContentInfo.eContent->data == NULL) {
+           hx509_clear_error_string(context);
+           ret = ENOMEM;
+           goto out;
+       }
+       memcpy(sd.encapContentInfo.eContent->data, data, length);
+       sd.encapContentInfo.eContent->length = length;
     }
     }
-    memcpy(sd.encapContentInfo.eContent->data, data, length);
-    sd.encapContentInfo.eContent->length = length;
 
     ALLOC_SEQ(&sd.signerInfos, 1);
     if (sd.signerInfos.val == NULL) {
 
     ALLOC_SEQ(&sd.signerInfos, 1);
     if (sd.signerInfos.val == NULL) {
@@ -1029,39 +1023,43 @@ hx509_cms_create_signed_1(hx509_context context,
     signer_info->signedAttrs = NULL;
     signer_info->unsignedAttrs = NULL;
 
     signer_info->signedAttrs = NULL;
     signer_info->unsignedAttrs = NULL;
 
-    ALLOC(signer_info->signedAttrs, 1);
-    if (signer_info->signedAttrs == NULL) {
-       ret = ENOMEM;
+
+    ret = copy_AlgorithmIdentifier(&digest, &signer_info->digestAlgorithm);
+    if (ret) {
+       hx509_clear_error_string(context);
        goto out;
     }
 
        goto out;
     }
 
-    {
-       heim_octet_string data;
+    /*
+     * If its not pkcs7-data send signedAttributes
+     */
 
 
-       ret = copy_AlgorithmIdentifier(&digest, &signer_info->digestAlgorithm);
-       if (ret) {
-           hx509_clear_error_string(context);
+    if (der_heim_oid_cmp(eContentType, oid_id_pkcs7_data()) != 0) {
+       CMSAttributes sa;       
+       heim_octet_string sig;
+
+       ALLOC(signer_info->signedAttrs, 1);
+       if (signer_info->signedAttrs == NULL) {
+           ret = ENOMEM;
            goto out;
        }
 
        ret = _hx509_create_signature(context,
                                      NULL,
                                      &digest,
            goto out;
        }
 
        ret = _hx509_create_signature(context,
                                      NULL,
                                      &digest,
-                                     sd.encapContentInfo.eContent,
+                                     &content,
                                      NULL,
                                      NULL,
-                                     &data);
-       if (ret) {
-           hx509_clear_error_string(context);
+                                     &sig);
+       if (ret)
            goto out;
            goto out;
-       }
 
        ASN1_MALLOC_ENCODE(MessageDigest,
                           buf.data,
                           buf.length,
 
        ASN1_MALLOC_ENCODE(MessageDigest,
                           buf.data,
                           buf.length,
-                          &data,
+                          &sig,
                           &size,
                           ret);
                           &size,
                           ret);
-       der_free_octet_string(&data);
+       der_free_octet_string(&sig);
        if (ret) {
            hx509_clear_error_string(context);
            goto out;
        if (ret) {
            hx509_clear_error_string(context);
            goto out;
@@ -1078,9 +1076,6 @@ hx509_cms_create_signed_1(hx509_context context,
            goto out;
        }
 
            goto out;
        }
 
-    }
-
-    if (der_heim_oid_cmp(eContentType, oid_id_pkcs7_data()) != 0) {
 
        ASN1_MALLOC_ENCODE(ContentType,
                           buf.data,
 
        ASN1_MALLOC_ENCODE(ContentType,
                           buf.data,
@@ -1101,19 +1096,13 @@ hx509_cms_create_signed_1(hx509_context context,
            hx509_clear_error_string(context);
            goto out;
        }
            hx509_clear_error_string(context);
            goto out;
        }
-    }
-
 
 
-    {
-       CMSAttributes sa;
-       heim_octet_string os;
-       
        sa.val = signer_info->signedAttrs->val;
        sa.len = signer_info->signedAttrs->len;
        
        ASN1_MALLOC_ENCODE(CMSAttributes,
        sa.val = signer_info->signedAttrs->val;
        sa.len = signer_info->signedAttrs->len;
        
        ASN1_MALLOC_ENCODE(CMSAttributes,
-                          os.data,
-                          os.length,
+                          sigdata.data,
+                          sigdata.length,
                           &sa,
                           &size,
                           ret);
                           &sa,
                           &size,
                           ret);
@@ -1121,21 +1110,32 @@ hx509_cms_create_signed_1(hx509_context context,
            hx509_clear_error_string(context);
            goto out;
        }
            hx509_clear_error_string(context);
            goto out;
        }
-       if (size != os.length)
+       if (size != sigdata.length)
            _hx509_abort("internal ASN.1 encoder error");
            _hx509_abort("internal ASN.1 encoder error");
-                       
+    } else {
+       sigdata.data = content.data;
+       sigdata.length = content.length;
+    }
+
+
+    {
+       AlgorithmIdentifier sigalg;
+
+       ret = hx509_crypto_select(context, HX509_SELECT_PUBLIC_SIG,
+                                 _hx509_cert_private_key(cert), peer,
+                                 &sigalg);
+       if (ret)
+           goto out;
+
        ret = _hx509_create_signature(context,
                                      _hx509_cert_private_key(cert),
        ret = _hx509_create_signature(context,
                                      _hx509_cert_private_key(cert),
-                                     hx509_signature_rsa_with_sha1(),
-                                     &os,
+                                     &sigalg,
+                                     &sigdata,
                                      &signer_info->signatureAlgorithm,
                                      &signer_info->signature);
                                      &signer_info->signatureAlgorithm,
                                      &signer_info->signature);
-                               
-       der_free_octet_string(&os);
-       if (ret) {
-           hx509_clear_error_string(context);
+       free_AlgorithmIdentifier(&sigalg);
+       if (ret)
            goto out;
            goto out;
-       }
     }
 
     ALLOC_SEQ(&sd.digestAlgorithms, 1);
     }
 
     ALLOC_SEQ(&sd.digestAlgorithms, 1);
@@ -1184,17 +1184,12 @@ hx509_cms_create_signed_1(hx509_context context,
        }
 
        for (i = 0; i < path.len; i++) {
        }
 
        for (i = 0; i < path.len; i++) {
-           ASN1_MALLOC_ENCODE(Certificate,
-                              sd.certificates->val[i].data,
-                              sd.certificates->val[i].length,
-                              _hx509_get_cert(path.val[i]),
-                              &size, ret);
+           ret = hx509_cert_binary(context, path.val[i],
+                                   &sd.certificates->val[i]);
            if (ret) {
                hx509_clear_error_string(context);
                goto out;
            }
            if (ret) {
                hx509_clear_error_string(context);
                goto out;
            }
-           if (sd.certificates->val[i].length != size)
-               _hx509_abort("internal ASN.1 encoder error");
        }
     }
 
        }
     }
 
@@ -1209,6 +1204,8 @@ hx509_cms_create_signed_1(hx509_context context,
        _hx509_abort("internal ASN.1 encoder error");
 
 out:
        _hx509_abort("internal ASN.1 encoder error");
 
 out:
+    if (sigdata.data != content.data)
+       der_free_octet_string(&sigdata);
     free_AlgorithmIdentifier(&digest);
     _hx509_path_free(&path);
     free_SignedData(&sd);
     free_AlgorithmIdentifier(&digest);
     _hx509_path_free(&path);
     free_SignedData(&sd);
index ec172f46f4449282e3ae91a0df7ee5cb38a47897..8b6ffcb9456798d9aff186f241e1d9987f36927b 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: collector.c,v 1.16 2007/01/09 10:52:04 lha Exp $");
+RCSID("$Id: collector.c 20778 2007-06-01 22:04:13Z lha $");
 
 struct private_key {
     AlgorithmIdentifier alg;
 
 struct private_key {
     AlgorithmIdentifier alg;
@@ -51,22 +51,26 @@ struct hx509_collector {
 };
 
 
 };
 
 
-struct hx509_collector *
-_hx509_collector_alloc(hx509_context context, hx509_lock lock)
+int
+_hx509_collector_alloc(hx509_context context, hx509_lock lock, struct hx509_collector **collector)
 {
     struct hx509_collector *c;
     int ret;
 
 {
     struct hx509_collector *c;
     int ret;
 
+    *collector = NULL;
+
     c = calloc(1, sizeof(*c));
     c = calloc(1, sizeof(*c));
-    if (c == NULL)
-       return NULL;
+    if (c == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
     c->lock = lock;
 
     ret = hx509_certs_init(context, "MEMORY:collector-unenvelop-cert",
                           0,NULL, &c->unenvelop_certs);
     if (ret) {
        free(c);
     c->lock = lock;
 
     ret = hx509_certs_init(context, "MEMORY:collector-unenvelop-cert",
                           0,NULL, &c->unenvelop_certs);
     if (ret) {
        free(c);
-       return NULL;
+       return ret;
     }
     c->val.data = NULL;
     c->val.len = 0;
     }
     c->val.data = NULL;
     c->val.len = 0;
@@ -75,10 +79,11 @@ _hx509_collector_alloc(hx509_context context, hx509_lock lock)
     if (ret) {
        hx509_certs_free(&c->unenvelop_certs);
        free(c);
     if (ret) {
        hx509_certs_free(&c->unenvelop_certs);
        free(c);
-       return NULL;
+       return ret;
     }
 
     }
 
-    return c;
+    *collector = c;
+    return 0;
 }
 
 hx509_lock
 }
 
 hx509_lock
index 4f02b268724e85a152de0e4b6b1d17cf795f4d80..97ade264ae2c7b4907f101c21befd03952dbc3ea 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: crmf.asn1,v 1.1 2006/04/18 13:05:21 lha Exp $
+-- $Id: crmf.asn1 17102 2006-04-18 13:05:21Z lha $
 PKCS10 DEFINITIONS ::=
 
 BEGIN
 PKCS10 DEFINITIONS ::=
 
 BEGIN
index dac0a8160b820afa78bca6c1ce59ea94da0c094c..96d9693cc25f58081afd9f52561ed729f2be6694 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: crypto.c,v 1.63 2007/01/09 10:52:05 lha Exp $");
+RCSID("$Id: crypto.c 20939 2007-06-06 20:53:02Z lha $");
 
 struct hx509_crypto;
 
 
 struct hx509_crypto;
 
@@ -42,6 +42,11 @@ enum crypto_op_type {
     COT_SIGN
 };
 
     COT_SIGN
 };
 
+struct hx509_generate_private_context {
+    const heim_oid *key_oid;
+    int isCA;
+    unsigned long num_bits;
+};
 
 struct hx509_private_key_ops {
     const char *pemtype;
 
 struct hx509_private_key_ops {
     const char *pemtype;
@@ -56,8 +61,9 @@ struct hx509_private_key_ops {
                  const void *data,
                  size_t len,
                  hx509_private_key private_key);
                  const void *data,
                  size_t len,
                  hx509_private_key private_key);
-    int (*generate_private_key)(hx509_context context,
-                               hx509_private_key private_key);
+    int (*generate_private_key)(hx509_context,
+                               struct hx509_generate_private_context *,
+                               hx509_private_key);
     int (*handle_alg)(const hx509_private_key,
                      const AlgorithmIdentifier *,
                      enum crypto_op_type);
     int (*handle_alg)(const hx509_private_key,
                      const AlgorithmIdentifier *,
                      enum crypto_op_type);
@@ -96,7 +102,7 @@ struct hx509_private_key {
  */
 
 struct signature_alg {
  */
 
 struct signature_alg {
-    char *name;
+    const char *name;
     const heim_oid *(*sig_oid)(void);
     const AlgorithmIdentifier *(*sig_alg)(void);
     const heim_oid *(*key_oid)(void);
     const heim_oid *(*sig_oid)(void);
     const AlgorithmIdentifier *(*sig_alg)(void);
     const heim_oid *(*key_oid)(void);
@@ -107,8 +113,7 @@ struct signature_alg {
 
 #define SIG_DIGEST     0x100
 #define SIG_PUBLIC_SIG 0x200
 
 #define SIG_DIGEST     0x100
 #define SIG_PUBLIC_SIG 0x200
-#define SIG_PUBLIC_ENC 0x400
-#define SIG_SECRET     0x800
+#define SIG_SECRET     0x400
 
     int (*verify_signature)(hx509_context context,
                            const struct signature_alg *,
 
     int (*verify_signature)(hx509_context context,
                            const struct signature_alg *,
@@ -123,9 +128,6 @@ struct signature_alg {
                            const heim_octet_string *,
                            AlgorithmIdentifier *,
                            heim_octet_string *);
                            const heim_octet_string *,
                            AlgorithmIdentifier *,
                            heim_octet_string *);
-    int (*private_key2SPKI)(hx509_context,
-                           hx509_private_key,
-                           SubjectPublicKeyInfo *);
 };
 
 /*
 };
 
 /*
@@ -142,6 +144,46 @@ heim_int2BN(const heim_integer *i)
     return bn;
 }
 
     return bn;
 }
 
+/*
+ *
+ */
+
+static int
+set_digest_alg(DigestAlgorithmIdentifier *id,
+              const heim_oid *oid,
+              const void *param, size_t length)
+{
+    int ret;
+    if (param) {
+       id->parameters = malloc(sizeof(*id->parameters));
+       if (id->parameters == NULL)
+           return ENOMEM;
+       id->parameters->data = malloc(length);
+       if (id->parameters->data == NULL) {
+           free(id->parameters);
+           id->parameters = NULL;
+           return ENOMEM;
+       }
+       memcpy(id->parameters->data, param, length);
+       id->parameters->length = length;
+    } else
+       id->parameters = NULL;
+    ret = der_copy_oid(oid, &id->algorithm);
+    if (ret) {
+       if (id->parameters) {
+           free(id->parameters->data);
+           free(id->parameters);
+           id->parameters = NULL;
+       }
+       return ret;
+    }
+    return 0;
+}
+
+/*
+ *
+ */
+
 static int
 rsa_verify_signature(hx509_context context,
                     const struct signature_alg *sig_alg,
 static int
 rsa_verify_signature(hx509_context context,
                     const struct signature_alg *sig_alg,
@@ -280,12 +322,13 @@ rsa_create_signature(hx509_context context,
        digest_alg = hx509_signature_md5();
     } else if (der_heim_oid_cmp(sig_oid, oid_id_dsa_with_sha1()) == 0) {
        digest_alg = hx509_signature_sha1();
        digest_alg = hx509_signature_md5();
     } else if (der_heim_oid_cmp(sig_oid, oid_id_dsa_with_sha1()) == 0) {
        digest_alg = hx509_signature_sha1();
+    } else if (der_heim_oid_cmp(sig_oid, oid_id_pkcs1_rsaEncryption()) == 0) {
+       digest_alg = hx509_signature_sha1();
     } else
        return HX509_ALG_NOT_SUPP;
 
     if (signatureAlgorithm) {
     } else
        return HX509_ALG_NOT_SUPP;
 
     if (signatureAlgorithm) {
-       ret = _hx509_set_digest_alg(signatureAlgorithm,
-                                   sig_oid, "\x05\x00", 2);
+       ret = set_digest_alg(signatureAlgorithm, sig_oid, "\x05\x00", 2);
        if (ret) {
            hx509_clear_error_string(context);
            return ret;
        if (ret) {
            hx509_clear_error_string(context);
            return ret;
@@ -380,9 +423,8 @@ rsa_private_key2SPKI(hx509_context context,
     }
     spki->subjectPublicKey.length = len * 8;
 
     }
     spki->subjectPublicKey.length = len * 8;
 
-    ret = _hx509_set_digest_alg(&spki->algorithm,
-                               oid_id_pkcs1_rsaEncryption(), 
-                               "\x05\x00", 2);
+    ret = set_digest_alg(&spki->algorithm,oid_id_pkcs1_rsaEncryption(), 
+                        "\x05\x00", 2);
     if (ret) {
        hx509_set_error_string(context, 0, ret, "malloc - out of memory");
        free(spki->subjectPublicKey.data);
     if (ret) {
        hx509_set_error_string(context, 0, ret, "malloc - out of memory");
        free(spki->subjectPublicKey.data);
@@ -400,17 +442,13 @@ rsa_private_key2SPKI(hx509_context context,
 }
 
 static int
 }
 
 static int
-cb_func(int a, int b, BN_GENCB *c)
+rsa_generate_private_key(hx509_context context, 
+                        struct hx509_generate_private_context *ctx,
+                        hx509_private_key private_key)
 {
 {
-    return 1;
-}
-
-static int
-rsa_generate_private_key(hx509_context context, hx509_private_key private_key)
-{
-    BN_GENCB cb;
     BIGNUM *e;
     int ret;
     BIGNUM *e;
     int ret;
+    unsigned long bits;
 
     static const int default_rsa_e = 65537;
     static const int default_rsa_bits = 1024;
 
     static const int default_rsa_e = 65537;
     static const int default_rsa_bits = 1024;
@@ -425,9 +463,14 @@ rsa_generate_private_key(hx509_context context, hx509_private_key private_key)
     e = BN_new();
     BN_set_word(e, default_rsa_e);
 
     e = BN_new();
     BN_set_word(e, default_rsa_e);
 
-    BN_GENCB_set(&cb, cb_func, NULL);
-    ret = RSA_generate_key_ex(private_key->private_key.rsa, 
-                             default_rsa_bits, e, &cb);
+    bits = default_rsa_bits;
+
+    if (ctx->num_bits)
+       bits = ctx->num_bits;
+    else if (ctx->isCA)
+       bits *= 2;
+
+    ret = RSA_generate_key_ex(private_key->private_key.rsa, bits, e, NULL);
     BN_free(e);
     if (ret != 1) {
        hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
     BN_free(e);
     if (ret != 1) {
        hx509_set_error_string(context, 0, HX509_PARSING_KEY_FAILED,
@@ -642,8 +685,8 @@ sha256_create_signature(hx509_context context,
 
     if (signatureAlgorithm) {
        int ret;
 
     if (signatureAlgorithm) {
        int ret;
-       ret = _hx509_set_digest_alg(signatureAlgorithm,
-                                   (*sig_alg->sig_oid)(), "\x05\x00", 2);
+       ret = set_digest_alg(signatureAlgorithm, (*sig_alg->sig_oid)(),
+                            "\x05\x00", 2);
        if (ret)
            return ret;
     }
        if (ret)
            return ret;
     }
@@ -708,8 +751,8 @@ sha1_create_signature(hx509_context context,
 
     if (signatureAlgorithm) {
        int ret;
 
     if (signatureAlgorithm) {
        int ret;
-       ret = _hx509_set_digest_alg(signatureAlgorithm,
-                                   (*sig_alg->sig_oid)(), "\x05\x00", 2);
+       ret = set_digest_alg(signatureAlgorithm, (*sig_alg->sig_oid)(), 
+                            "\x05\x00", 2);
        if (ret)
            return ret;
     }
        if (ret)
            return ret;
     }
@@ -789,7 +832,7 @@ md2_verify_signature(hx509_context context,
     return 0;
 }
 
     return 0;
 }
 
-static struct signature_alg pkcs1_rsa_sha1_alg = {
+static const struct signature_alg pkcs1_rsa_sha1_alg = {
     "rsa",
     oid_id_pkcs1_rsaEncryption,
     hx509_signature_rsa_with_sha1,
     "rsa",
     oid_id_pkcs1_rsaEncryption,
     hx509_signature_rsa_with_sha1,
@@ -797,11 +840,10 @@ static struct signature_alg pkcs1_rsa_sha1_alg = {
     NULL,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
     NULL,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
-    rsa_create_signature,
-    rsa_private_key2SPKI
+    rsa_create_signature
 };
 
 };
 
-static struct signature_alg rsa_with_sha256_alg = {
+static const struct signature_alg rsa_with_sha256_alg = {
     "rsa-with-sha256",
     oid_id_pkcs1_sha256WithRSAEncryption,
     hx509_signature_rsa_with_sha256,
     "rsa-with-sha256",
     oid_id_pkcs1_sha256WithRSAEncryption,
     hx509_signature_rsa_with_sha256,
@@ -809,11 +851,10 @@ static struct signature_alg rsa_with_sha256_alg = {
     oid_id_sha256,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
     oid_id_sha256,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
-    rsa_create_signature,
-    rsa_private_key2SPKI
+    rsa_create_signature
 };
 
 };
 
-static struct signature_alg rsa_with_sha1_alg = {
+static const struct signature_alg rsa_with_sha1_alg = {
     "rsa-with-sha1",
     oid_id_pkcs1_sha1WithRSAEncryption,
     hx509_signature_rsa_with_sha1,
     "rsa-with-sha1",
     oid_id_pkcs1_sha1WithRSAEncryption,
     hx509_signature_rsa_with_sha1,
@@ -821,11 +862,10 @@ static struct signature_alg rsa_with_sha1_alg = {
     oid_id_secsig_sha_1,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
     oid_id_secsig_sha_1,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
-    rsa_create_signature,
-    rsa_private_key2SPKI
+    rsa_create_signature
 };
 
 };
 
-static struct signature_alg rsa_with_md5_alg = {
+static const struct signature_alg rsa_with_md5_alg = {
     "rsa-with-md5",
     oid_id_pkcs1_md5WithRSAEncryption,
     hx509_signature_rsa_with_md5,
     "rsa-with-md5",
     oid_id_pkcs1_md5WithRSAEncryption,
     hx509_signature_rsa_with_md5,
@@ -833,11 +873,10 @@ static struct signature_alg rsa_with_md5_alg = {
     oid_id_rsa_digest_md5,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
     oid_id_rsa_digest_md5,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
-    rsa_create_signature,
-    rsa_private_key2SPKI
+    rsa_create_signature
 };
 
 };
 
-static struct signature_alg rsa_with_md2_alg = {
+static const struct signature_alg rsa_with_md2_alg = {
     "rsa-with-md2",
     oid_id_pkcs1_md2WithRSAEncryption,
     hx509_signature_rsa_with_md2,
     "rsa-with-md2",
     oid_id_pkcs1_md2WithRSAEncryption,
     hx509_signature_rsa_with_md2,
@@ -845,11 +884,10 @@ static struct signature_alg rsa_with_md2_alg = {
     oid_id_rsa_digest_md2,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
     oid_id_rsa_digest_md2,
     PROVIDE_CONF|REQUIRE_SIGNER|SIG_PUBLIC_SIG,
     rsa_verify_signature,
-    rsa_create_signature,
-    rsa_private_key2SPKI
+    rsa_create_signature
 };
 
 };
 
-static struct signature_alg dsa_sha1_alg = {
+static const struct signature_alg dsa_sha1_alg = {
     "dsa-with-sha1",
     oid_id_dsa_with_sha1,
     NULL,
     "dsa-with-sha1",
     oid_id_dsa_with_sha1,
     NULL,
@@ -860,7 +898,7 @@ static struct signature_alg dsa_sha1_alg = {
     /* create_signature */ NULL,
 };
 
     /* create_signature */ NULL,
 };
 
-static struct signature_alg sha256_alg = {
+static const struct signature_alg sha256_alg = {
     "sha-256",
     oid_id_sha256,
     hx509_signature_sha256,
     "sha-256",
     oid_id_sha256,
     hx509_signature_sha256,
@@ -871,7 +909,7 @@ static struct signature_alg sha256_alg = {
     sha256_create_signature
 };
 
     sha256_create_signature
 };
 
-static struct signature_alg sha1_alg = {
+static const struct signature_alg sha1_alg = {
     "sha1",
     oid_id_secsig_sha_1,
     hx509_signature_sha1,
     "sha1",
     oid_id_secsig_sha_1,
     hx509_signature_sha1,
@@ -882,7 +920,7 @@ static struct signature_alg sha1_alg = {
     sha1_create_signature
 };
 
     sha1_create_signature
 };
 
-static struct signature_alg md5_alg = {
+static const struct signature_alg md5_alg = {
     "rsa-md5",
     oid_id_rsa_digest_md5,
     hx509_signature_md5,
     "rsa-md5",
     oid_id_rsa_digest_md5,
     hx509_signature_md5,
@@ -892,7 +930,7 @@ static struct signature_alg md5_alg = {
     md5_verify_signature
 };
 
     md5_verify_signature
 };
 
-static struct signature_alg md2_alg = {
+static const struct signature_alg md2_alg = {
     "rsa-md2",
     oid_id_rsa_digest_md2,
     hx509_signature_md2,
     "rsa-md2",
     oid_id_rsa_digest_md2,
     hx509_signature_md2,
@@ -907,12 +945,13 @@ static struct signature_alg md2_alg = {
  * compatible" type (type is RSA, DSA, none, etc)
  */
 
  * compatible" type (type is RSA, DSA, none, etc)
  */
 
-static struct signature_alg *sig_algs[] = {
+static const struct signature_alg *sig_algs[] = {
     &rsa_with_sha256_alg,
     &rsa_with_sha1_alg,
     &pkcs1_rsa_sha1_alg,
     &rsa_with_md5_alg,
     &rsa_with_md2_alg,
     &rsa_with_sha256_alg,
     &rsa_with_sha1_alg,
     &pkcs1_rsa_sha1_alg,
     &rsa_with_md5_alg,
     &rsa_with_md2_alg,
+    &pkcs1_rsa_sha1_alg,
     &dsa_sha1_alg,
     &sha256_alg,
     &sha1_alg,
     &dsa_sha1_alg,
     &sha256_alg,
     &sha1_alg,
@@ -1234,9 +1273,57 @@ _hx509_private_key2SPKI(hx509_context context,
     return (*ops->get_spki)(context, private_key, spki);
 }
 
     return (*ops->get_spki)(context, private_key, spki);
 }
 
+int
+_hx509_generate_private_key_init(hx509_context context,
+                                const heim_oid *oid,
+                                struct hx509_generate_private_context **ctx)
+{
+    *ctx = NULL;
+
+    if (der_heim_oid_cmp(oid, oid_id_pkcs1_rsaEncryption()) != 0) {
+       hx509_set_error_string(context, 0, EINVAL, 
+                              "private key not an RSA key");
+       return EINVAL;
+    }
+
+    *ctx = calloc(1, sizeof(**ctx));
+    if (*ctx == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+    (*ctx)->key_oid = oid;
+
+    return 0;
+}
+
+int
+_hx509_generate_private_key_is_ca(hx509_context context,
+                                 struct hx509_generate_private_context *ctx)
+{
+    ctx->isCA = 1;
+    return 0;
+}
+
+int
+_hx509_generate_private_key_bits(hx509_context context,
+                                struct hx509_generate_private_context *ctx,
+                                unsigned long bits)
+{
+    ctx->num_bits = bits;
+    return 0;
+}
+
+
+void
+_hx509_generate_private_key_free(struct hx509_generate_private_context **ctx)
+{
+    free(*ctx);
+    *ctx = NULL;
+}
+
 int
 _hx509_generate_private_key(hx509_context context,
 int
 _hx509_generate_private_key(hx509_context context,
-                           const heim_oid *key_oid,
+                           struct hx509_generate_private_context *ctx,
                            hx509_private_key *private_key)
 {
     struct hx509_private_key_ops *ops;
                            hx509_private_key *private_key)
 {
     struct hx509_private_key_ops *ops;
@@ -1244,7 +1331,7 @@ _hx509_generate_private_key(hx509_context context,
 
     *private_key = NULL;
 
 
     *private_key = NULL;
 
-    ops = find_private_alg(key_oid);
+    ops = find_private_alg(ctx->key_oid);
     if (ops == NULL) {
        hx509_clear_error_string(context);
        return HX509_SIG_ALG_NO_SUPPORTED;
     if (ops == NULL) {
        hx509_clear_error_string(context);
        return HX509_SIG_ALG_NO_SUPPORTED;
@@ -1256,7 +1343,7 @@ _hx509_generate_private_key(hx509_context context,
        return ret;
     }
 
        return ret;
     }
 
-    ret = (*ops->generate_private_key)(context, *private_key);
+    ret = (*ops->generate_private_key)(context, ctx, *private_key);
     if (ret)
        _hx509_private_key_free(private_key);
 
     if (ret)
        _hx509_private_key_free(private_key);
 
@@ -1268,21 +1355,21 @@ _hx509_generate_private_key(hx509_context context,
  *
  */
 
  *
  */
 
-static const heim_octet_string null_entry_oid = { 2, "\x05\x00" };
+static const heim_octet_string null_entry_oid = { 2, rk_UNCONST("\x05\x00") };
 
 
-static const unsigned sha512_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 3 };
+static const unsigned sha512_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2, 3 };
 const AlgorithmIdentifier _hx509_signature_sha512_data = { 
 const AlgorithmIdentifier _hx509_signature_sha512_data = { 
-    { 8, rk_UNCONST(sha512_oid_tree) }, rk_UNCONST(&null_entry_oid)
+    { 9, rk_UNCONST(sha512_oid_tree) }, rk_UNCONST(&null_entry_oid)
 };
 
 };
 
-static const unsigned sha384_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2 };
+static const unsigned sha384_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2, 2 };
 const AlgorithmIdentifier _hx509_signature_sha384_data = { 
 const AlgorithmIdentifier _hx509_signature_sha384_data = { 
-    { 8, rk_UNCONST(sha384_oid_tree) }, rk_UNCONST(&null_entry_oid)
+    { 9, rk_UNCONST(sha384_oid_tree) }, rk_UNCONST(&null_entry_oid)
 };
 
 static const unsigned sha256_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2, 1 };
 const AlgorithmIdentifier _hx509_signature_sha256_data = { 
 };
 
 static const unsigned sha256_oid_tree[] = { 2, 16, 840, 1, 101, 3, 4, 2, 1 };
 const AlgorithmIdentifier _hx509_signature_sha256_data = { 
-    { 8, rk_UNCONST(sha256_oid_tree) }, rk_UNCONST(&null_entry_oid)
+    { 9, rk_UNCONST(sha256_oid_tree) }, rk_UNCONST(&null_entry_oid)
 };
 
 static const unsigned sha1_oid_tree[] = { 1, 3, 14, 3, 2, 26 };
 };
 
 static const unsigned sha1_oid_tree[] = { 1, 3, 14, 3, 2, 26 };
@@ -1335,6 +1422,20 @@ const AlgorithmIdentifier _hx509_signature_rsa_data = {
     { 7, rk_UNCONST(rsa_oid) }, NULL
 };
 
     { 7, rk_UNCONST(rsa_oid) }, NULL
 };
 
+static const unsigned des_rsdi_ede3_cbc_oid[] ={ 1, 2, 840, 113549, 3, 7 };
+const AlgorithmIdentifier _hx509_des_rsdi_ede3_cbc_oid = {
+    { 6, rk_UNCONST(des_rsdi_ede3_cbc_oid) }, NULL
+};
+
+static const unsigned aes128_cbc_oid[] ={ 2, 16, 840, 1, 101, 3, 4, 1, 2 };
+const AlgorithmIdentifier _hx509_crypto_aes128_cbc_data = {
+    { 9, rk_UNCONST(aes128_cbc_oid) }, NULL
+};
+
+static const unsigned aes256_cbc_oid[] ={ 2, 16, 840, 1, 101, 3, 4, 1, 42 };
+const AlgorithmIdentifier _hx509_crypto_aes256_cbc_data = {
+    { 9, rk_UNCONST(aes256_cbc_oid) }, NULL
+};
 
 const AlgorithmIdentifier *
 hx509_signature_sha512(void)
 
 const AlgorithmIdentifier *
 hx509_signature_sha512(void)
@@ -1388,6 +1489,33 @@ const AlgorithmIdentifier *
 hx509_signature_rsa(void)
 { return &_hx509_signature_rsa_data; }
 
 hx509_signature_rsa(void)
 { return &_hx509_signature_rsa_data; }
 
+const AlgorithmIdentifier *
+hx509_crypto_des_rsdi_ede3_cbc(void)
+{ return &_hx509_des_rsdi_ede3_cbc_oid; }
+
+const AlgorithmIdentifier *
+hx509_crypto_aes128_cbc(void)
+{ return &_hx509_crypto_aes128_cbc_data; }
+
+const AlgorithmIdentifier *
+hx509_crypto_aes256_cbc(void)
+{ return &_hx509_crypto_aes256_cbc_data; }
+
+/*
+ *
+ */
+
+const AlgorithmIdentifier * _hx509_crypto_default_sig_alg = 
+    &_hx509_signature_rsa_with_sha1_data;
+const AlgorithmIdentifier * _hx509_crypto_default_digest_alg = 
+    &_hx509_signature_sha1_data;
+const AlgorithmIdentifier * _hx509_crypto_default_secret_alg = 
+    &_hx509_crypto_aes128_cbc_data;
+
+/*
+ *
+ */
+
 int
 _hx509_private_key_init(hx509_private_key *key,
                        hx509_private_key_ops *ops,
 int
 _hx509_private_key_init(hx509_private_key *key,
                        hx509_private_key_ops *ops,
@@ -1487,6 +1615,7 @@ _hx509_private_key_export(hx509_context context,
 struct hx509cipher {
     const char *name;
     const heim_oid *(*oid_func)(void);
 struct hx509cipher {
     const char *name;
     const heim_oid *(*oid_func)(void);
+    const AlgorithmIdentifier *(*ai_func)(void);
     const EVP_CIPHER *(*evp_func)(void);
     int (*get_params)(hx509_context, const hx509_crypto,
                      const heim_octet_string *, heim_octet_string *);
     const EVP_CIPHER *(*evp_func)(void);
     int (*get_params)(hx509_context, const hx509_crypto,
                      const heim_octet_string *, heim_octet_string *);
@@ -1654,6 +1783,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "rc2-cbc",
        oid_id_pkcs3_rc2_cbc,
     {
        "rc2-cbc",
        oid_id_pkcs3_rc2_cbc,
+       NULL,
        EVP_rc2_cbc,
        CMSRC2CBCParam_get,
        CMSRC2CBCParam_set
        EVP_rc2_cbc,
        CMSRC2CBCParam_get,
        CMSRC2CBCParam_set
@@ -1661,6 +1791,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "rc2-cbc",
        oid_id_rsadsi_rc2_cbc,
     {
        "rc2-cbc",
        oid_id_rsadsi_rc2_cbc,
+       NULL,
        EVP_rc2_cbc,
        CMSRC2CBCParam_get,
        CMSRC2CBCParam_set
        EVP_rc2_cbc,
        CMSRC2CBCParam_get,
        CMSRC2CBCParam_set
@@ -1668,6 +1799,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "rc2-40-cbc",
        oid_private_rc2_40,
     {
        "rc2-40-cbc",
        oid_private_rc2_40,
+       NULL,
        EVP_rc2_40_cbc,
        CMSRC2CBCParam_get,
        CMSRC2CBCParam_set
        EVP_rc2_40_cbc,
        CMSRC2CBCParam_get,
        CMSRC2CBCParam_set
@@ -1675,6 +1807,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "des-ede3-cbc",
        oid_id_pkcs3_des_ede3_cbc,
     {
        "des-ede3-cbc",
        oid_id_pkcs3_des_ede3_cbc,
+       NULL,
        EVP_des_ede3_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
        EVP_des_ede3_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
@@ -1682,6 +1815,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "des-ede3-cbc",
        oid_id_rsadsi_des_ede3_cbc,
     {
        "des-ede3-cbc",
        oid_id_rsadsi_des_ede3_cbc,
+       hx509_crypto_des_rsdi_ede3_cbc,
        EVP_des_ede3_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
        EVP_des_ede3_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
@@ -1689,6 +1823,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "aes-128-cbc",
        oid_id_aes_128_cbc,
     {
        "aes-128-cbc",
        oid_id_aes_128_cbc,
+       hx509_crypto_aes128_cbc,
        EVP_aes_128_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
        EVP_aes_128_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
@@ -1696,6 +1831,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "aes-192-cbc",
        oid_id_aes_192_cbc,
     {
        "aes-192-cbc",
        oid_id_aes_192_cbc,
+       NULL,
        EVP_aes_192_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
        EVP_aes_192_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
@@ -1703,6 +1839,7 @@ static const struct hx509cipher ciphers[] = {
     {
        "aes-256-cbc",
        oid_id_aes_256_cbc,
     {
        "aes-256-cbc",
        oid_id_aes_256_cbc,
+       hx509_crypto_aes256_cbc,
        EVP_aes_256_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
        EVP_aes_256_cbc,
        CMSCBCParam_get,
        CMSCBCParam_set
@@ -2060,11 +2197,13 @@ PBE_string2key(hx509_context context,
               const EVP_MD *md)
 {
     PKCS12_PBEParams p12params;
               const EVP_MD *md)
 {
     PKCS12_PBEParams p12params;
-    int passwordlen = strlen(password);
+    int passwordlen;
     hx509_crypto c;
     int iter, saltlen, ret;
     unsigned char *salt;
 
     hx509_crypto c;
     int iter, saltlen, ret;
     unsigned char *salt;
 
+    passwordlen = password ? strlen(password) : 0;
+
     if (parameters == NULL)
        return HX509_ALG_NOT_SUPP;
 
     if (parameters == NULL)
        return HX509_ALG_NOT_SUPP;
 
@@ -2081,10 +2220,6 @@ PBE_string2key(hx509_context context,
     salt = p12params.salt.data;
     saltlen = p12params.salt.length;
 
     salt = p12params.salt.data;
     saltlen = p12params.salt.length;
 
-    /* XXX It needs to be here, but why ?  */
-    if (passwordlen == 0)
-       password = NULL;
-
     if (!PKCS12_key_gen (password, passwordlen, salt, saltlen, 
                         PKCS12_KEY_ID, iter, key->length, key->data, md)) {
        ret = HX509_CRYPTO_INTERNAL_ERROR;
     if (!PKCS12_key_gen (password, passwordlen, salt, saltlen, 
                         PKCS12_KEY_ID, iter, key->length, key->data, md)) {
        ret = HX509_CRYPTO_INTERNAL_ERROR;
@@ -2205,8 +2340,10 @@ _hx509_pbe_decrypt(hx509_context context,
 
        if (i < pw->len)
            password = pw->val[i];
 
        if (i < pw->len)
            password = pw->val[i];
-       else
+       else if (i < pw->len + 1)
            password = "";
            password = "";
+       else
+           password = NULL;
 
        ret = (*s2k)(context, password, ai->parameters, &crypto, 
                     &key, &iv, enc_oid, md);
 
        ret = (*s2k)(context, password, ai->parameters, &crypto, 
                     &key, &iv, enc_oid, md);
@@ -2314,7 +2451,6 @@ hx509_crypto_select(const hx509_context context,
                    hx509_peer_info peer,
                    AlgorithmIdentifier *selected)
 {
                    hx509_peer_info peer,
                    AlgorithmIdentifier *selected)
 {
-    const heim_oid *keytype = NULL;
     const AlgorithmIdentifier *def;
     size_t i, j;
     int ret, bits;
     const AlgorithmIdentifier *def;
     size_t i, j;
     int ret, bits;
@@ -2323,20 +2459,25 @@ hx509_crypto_select(const hx509_context context,
 
     if (type == HX509_SELECT_DIGEST) {
        bits = SIG_DIGEST;
 
     if (type == HX509_SELECT_DIGEST) {
        bits = SIG_DIGEST;
-       def = hx509_signature_sha1();
+       def = _hx509_crypto_default_digest_alg;
     } else if (type == HX509_SELECT_PUBLIC_SIG) {
        bits = SIG_PUBLIC_SIG;
        /* XXX depend on `source´ and `peer´ */
     } else if (type == HX509_SELECT_PUBLIC_SIG) {
        bits = SIG_PUBLIC_SIG;
        /* XXX depend on `source´ and `peer´ */
-       def = hx509_signature_rsa_with_sha1();
+       def = _hx509_crypto_default_sig_alg;
+    } else if (type == HX509_SELECT_SECRET_ENC) {
+       bits = SIG_SECRET;
+       def = _hx509_crypto_default_secret_alg;
     } else {
        hx509_set_error_string(context, 0, EINVAL, 
                               "Unknown type %d of selection", type);
        return EINVAL;
     }
 
     } else {
        hx509_set_error_string(context, 0, EINVAL, 
                               "Unknown type %d of selection", type);
        return EINVAL;
     }
 
-    keytype = find_keytype(source);
-
     if (peer) {
     if (peer) {
+       const heim_oid *keytype = NULL;
+
+       keytype = find_keytype(source);
+
        for (i = 0; i < peer->len; i++) {
            for (j = 0; sig_algs[j]; j++) {
                if ((sig_algs[j]->flags & bits) != bits)
        for (i = 0; i < peer->len; i++) {
            for (j = 0; sig_algs[j]; j++) {
                if ((sig_algs[j]->flags & bits) != bits)
@@ -2354,6 +2495,19 @@ hx509_crypto_select(const hx509_context context,
                    hx509_clear_error_string(context);
                return ret;
            }
                    hx509_clear_error_string(context);
                return ret;
            }
+           if (bits & SIG_SECRET) {
+               const struct hx509cipher *cipher;
+
+               cipher = find_cipher_by_oid(&peer->val[i].algorithm);
+               if (cipher == NULL)
+                   continue;
+               if (cipher->ai_func == NULL)
+                   continue;
+               ret = copy_AlgorithmIdentifier(cipher->ai_func(), selected);
+               if (ret)
+                   hx509_clear_error_string(context);
+               return ret;
+           }
        }
     }
 
        }
     }
 
@@ -2379,7 +2533,7 @@ hx509_crypto_available(hx509_context context,
     *val = NULL;
 
     if (type == HX509_SELECT_ALL) {
     *val = NULL;
 
     if (type == HX509_SELECT_ALL) {
-       bits = SIG_DIGEST | SIG_PUBLIC_SIG;
+       bits = SIG_DIGEST | SIG_PUBLIC_SIG | SIG_SECRET;
     } else if (type == HX509_SELECT_DIGEST) {
        bits = SIG_DIGEST;
     } else if (type == HX509_SELECT_PUBLIC_SIG) {
     } else if (type == HX509_SELECT_DIGEST) {
        bits = SIG_DIGEST;
     } else if (type == HX509_SELECT_PUBLIC_SIG) {
@@ -2415,6 +2569,26 @@ hx509_crypto_available(hx509_context context,
        len++;
     }
 
        len++;
     }
 
+    /* Add AES */
+    if (bits & SIG_SECRET) {
+
+       for (i = 0; i < sizeof(ciphers)/sizeof(ciphers[0]); i++) {
+       
+           if (ciphers[i].ai_func == NULL)
+               continue;
+
+           ptr = realloc(*val, sizeof(**val) * (len + 1));
+           if (ptr == NULL)
+               goto out;
+           *val = ptr;
+           
+           ret = copy_AlgorithmIdentifier((ciphers[i].ai_func)(), &(*val)[len]);
+           if (ret)
+               goto out;
+           len++;
+       }
+    }
+
     *plen = len;
     return 0;
 
     *plen = len;
     return 0;
 
diff --git a/source4/heimdal/lib/hx509/env.c b/source4/heimdal/lib/hx509/env.c
new file mode 100644 (file)
index 0000000..4cb2f9f
--- /dev/null
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2007 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "hx_locl.h"
+RCSID("$Id: env.c 19878 2007-01-13 00:58:39Z lha $");
+
+struct hx509_env {
+    struct {
+       char *key;
+       char *value;
+    } *val;
+    size_t len;
+};
+
+int
+hx509_env_init(hx509_context context, hx509_env *env)
+{
+    *env = calloc(1, sizeof(**env));
+    if (*env == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+    return 0;
+}
+
+int
+hx509_env_add(hx509_context context, hx509_env env, 
+             const char *key, const char *value)
+{
+    void *ptr;
+
+    ptr = realloc(env->val, sizeof(env->val[0]) * (env->len + 1));
+    if (ptr == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+    env->val = ptr;
+    env->val[env->len].key = strdup(key);
+    if (env->val[env->len].key == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+    env->val[env->len].value = strdup(value);
+    if (env->val[env->len].value == NULL) {
+       free(env->val[env->len].key);
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+    env->len++;
+    return 0;
+}
+
+const char *
+hx509_env_lfind(hx509_context context, hx509_env env,
+               const char *key, size_t len)
+{
+    size_t i;
+
+    for (i = 0; i < env->len; i++) {
+       char *s = env->val[i].key;
+       if (strncmp(key, s, len) == 0 && s[len] == '\0')
+           return env->val[i].value;
+    }
+    return NULL;
+}
+
+
+void
+hx509_env_free(hx509_env *env)
+{
+    size_t i;
+
+    for (i = 0; i < (*env)->len; i++) {
+       free((*env)->val[i].key);
+       free((*env)->val[i].value);
+    }
+    free((*env)->val);
+    free(*env);
+    *env = NULL;
+}
+
index 770b71981a4ce2487fbec3bcf9259c8e0cc9dbf9..9f3a01487323dea974c486b24a02ceacbabf694e 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: error.c,v 1.4 2006/11/16 15:08:09 lha Exp $");
+RCSID("$Id: error.c 20912 2007-06-05 03:53:52Z lha $");
 
 struct hx509_error_data {
     hx509_error next;
 
 struct hx509_error_data {
     hx509_error next;
@@ -87,7 +87,8 @@ hx509_set_error_stringv(hx509_context context, int flags, int code,
 }
 
 void
 }
 
 void
-hx509_set_error_string(hx509_context context, int flags, int code, const char *fmt, ...)
+hx509_set_error_string(hx509_context context, int flags, int code,
+                      const char *fmt, ...)
 {
     va_list ap;
 
 {
     va_list ap;
 
@@ -100,9 +101,9 @@ char *
 hx509_get_error_string(hx509_context context, int error_code)
 {
     struct rk_strpool *p = NULL;
 hx509_get_error_string(hx509_context context, int error_code)
 {
     struct rk_strpool *p = NULL;
-    hx509_error msg;
+    hx509_error msg = context->error;
 
 
-    if (context->error == NULL) {
+    if (msg == NULL || msg->code != error_code) {
        const char *cstr;
        char *str;
 
        const char *cstr;
        char *str;
 
@@ -125,10 +126,12 @@ hx509_get_error_string(hx509_context context, int error_code)
 }
 
 void
 }
 
 void
-hx509_err(hx509_context context, int exit_code, int error_code, char *fmt, ...)
+hx509_err(hx509_context context, int exit_code, 
+         int error_code, const char *fmt, ...)
 {
     va_list ap;
 {
     va_list ap;
-    char *msg, *str;
+    const char *msg;
+    char *str;
 
     va_start(ap, fmt);
     vasprintf(&str, fmt, ap);
 
     va_start(ap, fmt);
     vasprintf(&str, fmt, ap);
index 39497fc3a9a702cc84813997eef8f2e1c1dde71a..1152af2423c473d1b8f6ba783c016feda9527963 100644 (file)
 #include "hx_locl.h"
 RCSID("$ID$");
 
 #include "hx_locl.h"
 RCSID("$ID$");
 
+int
+_hx509_map_file_os(const char *fn, heim_octet_string *os, struct stat *rsb)
+{
+    size_t length;
+    void *data;
+    int ret;
+
+    ret = _hx509_map_file(fn, &data, &length, rsb);
+
+    os->data = data;
+    os->length = length;
+
+    return ret;
+}
+
+void
+_hx509_unmap_file_os(heim_octet_string *os)
+{
+    _hx509_unmap_file(os->data, os->length);
+}
+
 int
 _hx509_map_file(const char *fn, void **data, size_t *length, struct stat *rsb)
 {
 int
 _hx509_map_file(const char *fn, void **data, size_t *length, struct stat *rsb)
 {
index 2db3f4f9327130cf5e98ea8ca2e5e53e5787c3b2..2763df957f6f065ee7d0432803bd873651c2aa29 100644 (file)
@@ -38,6 +38,12 @@ _hx509_cert_assign_key (
        hx509_cert /*cert*/,
        hx509_private_key /*private_key*/);
 
        hx509_cert /*cert*/,
        hx509_private_key /*private_key*/);
 
+int
+_hx509_cert_get_eku (
+       hx509_context /*context*/,
+       hx509_cert /*cert*/,
+       ExtKeyUsage */*e*/);
+
 int
 _hx509_cert_get_keyusage (
        hx509_context /*context*/,
 int
 _hx509_cert_get_keyusage (
        hx509_context /*context*/,
@@ -105,10 +111,11 @@ _hx509_check_key_usage (
        unsigned /*flags*/,
        int /*req_present*/);
 
        unsigned /*flags*/,
        int /*req_present*/);
 
-struct hx509_collector *
+int
 _hx509_collector_alloc (
        hx509_context /*context*/,
 _hx509_collector_alloc (
        hx509_context /*context*/,
-       hx509_lock /*lock*/);
+       hx509_lock /*lock*/,
+       struct hx509_collector **/*collector*/);
 
 int
 _hx509_collector_certs_add (
 
 int
 _hx509_collector_certs_add (
@@ -169,9 +176,29 @@ _hx509_find_extension_subject_key_id (
 int
 _hx509_generate_private_key (
        hx509_context /*context*/,
 int
 _hx509_generate_private_key (
        hx509_context /*context*/,
-       const heim_oid */*key_oid*/,
+       struct hx509_generate_private_context */*ctx*/,
        hx509_private_key */*private_key*/);
 
        hx509_private_key */*private_key*/);
 
+int
+_hx509_generate_private_key_bits (
+       hx509_context /*context*/,
+       struct hx509_generate_private_context */*ctx*/,
+       unsigned long /*bits*/);
+
+void
+_hx509_generate_private_key_free (struct hx509_generate_private_context **/*ctx*/);
+
+int
+_hx509_generate_private_key_init (
+       hx509_context /*context*/,
+       const heim_oid */*oid*/,
+       struct hx509_generate_private_context **/*ctx*/);
+
+int
+_hx509_generate_private_key_is_ca (
+       hx509_context /*context*/,
+       struct hx509_generate_private_context */*ctx*/);
+
 Certificate *
 _hx509_get_cert (hx509_cert /*cert*/);
 
 Certificate *
 _hx509_get_cert (hx509_cert /*cert*/);
 
@@ -181,9 +208,15 @@ _hx509_ks_dir_register (hx509_context /*context*/);
 void
 _hx509_ks_file_register (hx509_context /*context*/);
 
 void
 _hx509_ks_file_register (hx509_context /*context*/);
 
+void
+_hx509_ks_keychain_register (hx509_context /*context*/);
+
 void
 _hx509_ks_mem_register (hx509_context /*context*/);
 
 void
 _hx509_ks_mem_register (hx509_context /*context*/);
 
+void
+_hx509_ks_null_register (hx509_context /*context*/);
+
 void
 _hx509_ks_pkcs11_register (hx509_context /*context*/);
 
 void
 _hx509_ks_pkcs11_register (hx509_context /*context*/);
 
@@ -214,6 +247,12 @@ _hx509_map_file (
        size_t */*length*/,
        struct stat */*rsb*/);
 
        size_t */*length*/,
        struct stat */*rsb*/);
 
+int
+_hx509_map_file_os (
+       const char */*fn*/,
+       heim_octet_string */*os*/,
+       struct stat */*rsb*/);
+
 int
 _hx509_match_keys (
        hx509_cert /*c*/,
 int
 _hx509_match_keys (
        hx509_cert /*c*/,
@@ -269,9 +308,9 @@ _hx509_pbe_decrypt (
 
 void
 _hx509_pi_printf (
 
 void
 _hx509_pi_printf (
-       int (*/*func*/)(void *, char *),
+       int (*/*func*/)(void *, const char *),
        void */*ctx*/,
        void */*ctx*/,
-       char */*fmt*/,
+       const char */*fmt*/,
        ...);
 
 int
        ...);
 
 int
@@ -340,6 +379,12 @@ _hx509_query_match_cert (
        const hx509_query */*q*/,
        hx509_cert /*cert*/);
 
        const hx509_query */*q*/,
        hx509_cert /*cert*/);
 
+void
+_hx509_query_statistic (
+       hx509_context /*context*/,
+       int /*type*/,
+       const hx509_query */*q*/);
+
 int
 _hx509_request_add_dns_name (
        hx509_context /*context*/,
 int
 _hx509_request_add_dns_name (
        hx509_context /*context*/,
@@ -392,18 +437,14 @@ _hx509_set_cert_attribute (
        const heim_oid */*oid*/,
        const heim_octet_string */*attr*/);
 
        const heim_oid */*oid*/,
        const heim_octet_string */*attr*/);
 
-int
-_hx509_set_digest_alg (
-       DigestAlgorithmIdentifier */*id*/,
-       const heim_oid */*oid*/,
-       void */*param*/,
-       size_t /*length*/);
-
 void
 _hx509_unmap_file (
        void */*data*/,
        size_t /*len*/);
 
 void
 _hx509_unmap_file (
        void */*data*/,
        size_t /*len*/);
 
+void
+_hx509_unmap_file_os (heim_octet_string */*os*/);
+
 int
 _hx509_unparse_Name (
        const Name */*aname*/,
 int
 _hx509_unparse_Name (
        const Name */*aname*/,
index 4fcab70ff89da4af52d803acc6e9c67cc4ddea30..ab312cdbdfdca701c671eddee18035066535f260 100644 (file)
@@ -8,6 +8,14 @@
 extern "C" {
 #endif
 
 extern "C" {
 #endif
 
+#ifndef HX509_LIB_FUNCTION
+#if defined(_WIN32)
+#define HX509_LIB_FUNCTION _stdcall
+#else
+#define HX509_LIB_FUNCTION
+#endif
+#endif
+
 void
 hx509_bitstring_print (
        const heim_bit_string */*b*/,
 void
 hx509_bitstring_print (
        const heim_bit_string */*b*/,
@@ -28,9 +36,16 @@ hx509_ca_sign_self (
        hx509_private_key /*signer*/,
        hx509_cert */*certificate*/);
 
        hx509_private_key /*signer*/,
        hx509_cert */*certificate*/);
 
+int
+hx509_ca_tbs_add_crl_dp_uri (
+       hx509_context /*context*/,
+       hx509_ca_tbs /*tbs*/,
+       const char */*uri*/,
+       hx509_name /*issuername*/);
+
 int
 hx509_ca_tbs_add_eku (
 int
 hx509_ca_tbs_add_eku (
-       hx509_context /*contex*/,
+       hx509_context /*context*/,
        hx509_ca_tbs /*tbs*/,
        const heim_oid */*oid*/);
 
        hx509_ca_tbs /*tbs*/,
        const heim_oid */*oid*/);
 
@@ -40,6 +55,18 @@ hx509_ca_tbs_add_san_hostname (
        hx509_ca_tbs /*tbs*/,
        const char */*dnsname*/);
 
        hx509_ca_tbs /*tbs*/,
        const char */*dnsname*/);
 
+int
+hx509_ca_tbs_add_san_jid (
+       hx509_context /*context*/,
+       hx509_ca_tbs /*tbs*/,
+       const char */*jid*/);
+
+int
+hx509_ca_tbs_add_san_ms_upn (
+       hx509_context /*context*/,
+       hx509_ca_tbs /*tbs*/,
+       const char */*principal*/);
+
 int
 hx509_ca_tbs_add_san_otherName (
        hx509_context /*context*/,
 int
 hx509_ca_tbs_add_san_otherName (
        hx509_context /*context*/,
@@ -73,6 +100,11 @@ hx509_ca_tbs_set_ca (
        hx509_ca_tbs /*tbs*/,
        int /*pathLenConstraint*/);
 
        hx509_ca_tbs /*tbs*/,
        int /*pathLenConstraint*/);
 
+int
+hx509_ca_tbs_set_domaincontroller (
+       hx509_context /*context*/,
+       hx509_ca_tbs /*tbs*/);
+
 int
 hx509_ca_tbs_set_notAfter (
        hx509_context /*context*/,
 int
 hx509_ca_tbs_set_notAfter (
        hx509_context /*context*/,
@@ -115,6 +147,28 @@ hx509_ca_tbs_set_subject (
        hx509_ca_tbs /*tbs*/,
        hx509_name /*subject*/);
 
        hx509_ca_tbs /*tbs*/,
        hx509_name /*subject*/);
 
+int
+hx509_ca_tbs_set_template (
+       hx509_context /*context*/,
+       hx509_ca_tbs /*tbs*/,
+       int /*flags*/,
+       hx509_cert /*cert*/);
+
+int
+hx509_ca_tbs_subject_expand (
+       hx509_context /*context*/,
+       hx509_ca_tbs /*tbs*/,
+       hx509_env /*env*/);
+
+const struct units *
+hx509_ca_tbs_template_units (void);
+
+int
+hx509_cert_binary (
+       hx509_context /*context*/,
+       hx509_cert /*c*/,
+       heim_octet_string */*os*/);
+
 int
 hx509_cert_check_eku (
        hx509_context /*context*/,
 int
 hx509_cert_check_eku (
        hx509_context /*context*/,
@@ -136,6 +190,11 @@ hx509_cert_find_subjectAltName_otherName (
 void
 hx509_cert_free (hx509_cert /*cert*/);
 
 void
 hx509_cert_free (hx509_cert /*cert*/);
 
+int
+hx509_cert_get_SPKI (
+       hx509_cert /*p*/,
+       SubjectPublicKeyInfo */*spki*/);
+
 hx509_cert_attribute
 hx509_cert_get_attribute (
        hx509_cert /*cert*/,
 hx509_cert_attribute
 hx509_cert_get_attribute (
        hx509_cert /*cert*/,
@@ -155,6 +214,12 @@ hx509_cert_get_issuer (
        hx509_cert /*p*/,
        hx509_name */*name*/);
 
        hx509_cert /*p*/,
        hx509_name */*name*/);
 
+time_t
+hx509_cert_get_notAfter (hx509_cert /*p*/);
+
+time_t
+hx509_cert_get_notBefore (hx509_cert /*p*/);
+
 int
 hx509_cert_get_serialnumber (
        hx509_cert /*p*/,
 int
 hx509_cert_get_serialnumber (
        hx509_cert /*p*/,
@@ -218,7 +283,7 @@ int
 hx509_certs_info (
        hx509_context /*context*/,
        hx509_certs /*certs*/,
 hx509_certs_info (
        hx509_context /*context*/,
        hx509_certs /*certs*/,
-       int (*/*func*/)(void *, char *),
+       int (*/*func*/)(void *, const char *),
        void */*ctx*/);
 
 int
        void */*ctx*/);
 
 int
@@ -274,6 +339,7 @@ hx509_clear_error_string (hx509_context /*context*/);
 int
 hx509_cms_create_signed_1 (
        hx509_context /*context*/,
 int
 hx509_cms_create_signed_1 (
        hx509_context /*context*/,
+       int /*flags*/,
        const heim_oid */*eContentType*/,
        const void */*data*/,
        size_t /*length*/,
        const heim_oid */*eContentType*/,
        const void */*data*/,
        size_t /*length*/,
@@ -296,6 +362,7 @@ hx509_cms_decrypt_encrypted (
 int
 hx509_cms_envelope_1 (
        hx509_context /*context*/,
 int
 hx509_cms_envelope_1 (
        hx509_context /*context*/,
+       int /*flags*/,
        hx509_cert /*cert*/,
        const void */*data*/,
        size_t /*length*/,
        hx509_cert /*cert*/,
        const void */*data*/,
        size_t /*length*/,
@@ -327,6 +394,7 @@ hx509_cms_verify_signed (
        hx509_verify_ctx /*ctx*/,
        const void */*data*/,
        size_t /*length*/,
        hx509_verify_ctx /*ctx*/,
        const void */*data*/,
        size_t /*length*/,
+       const heim_octet_string */*signedContent*/,
        hx509_certs /*store*/,
        heim_oid */*contentType*/,
        heim_octet_string */*content*/,
        hx509_certs /*store*/,
        heim_oid */*contentType*/,
        heim_octet_string */*content*/,
@@ -349,6 +417,41 @@ hx509_context_set_missing_revoke (
        hx509_context /*context*/,
        int /*flag*/);
 
        hx509_context /*context*/,
        int /*flag*/);
 
+int
+hx509_crl_add_revoked_certs (
+       hx509_context /*context*/,
+       hx509_crl /*crl*/,
+       hx509_certs /*certs*/);
+
+int
+hx509_crl_alloc (
+       hx509_context /*context*/,
+       hx509_crl */*crl*/);
+
+void
+hx509_crl_free (
+       hx509_context /*context*/,
+       hx509_crl */*crl*/);
+
+int
+hx509_crl_lifetime (
+       hx509_context /*context*/,
+       hx509_crl /*crl*/,
+       int /*delta*/);
+
+int
+hx509_crl_sign (
+       hx509_context /*context*/,
+       hx509_cert /*signer*/,
+       hx509_crl /*crl*/,
+       heim_octet_string */*os*/);
+
+const AlgorithmIdentifier *
+hx509_crypto_aes128_cbc (void);
+
+const AlgorithmIdentifier *
+hx509_crypto_aes256_cbc (void);
+
 int
 hx509_crypto_available (
        hx509_context /*context*/,
 int
 hx509_crypto_available (
        hx509_context /*context*/,
@@ -365,6 +468,9 @@ hx509_crypto_decrypt (
        heim_octet_string */*ivec*/,
        heim_octet_string */*clear*/);
 
        heim_octet_string */*ivec*/,
        heim_octet_string */*clear*/);
 
+const AlgorithmIdentifier *
+hx509_crypto_des_rsdi_ede3_cbc (void);
+
 void
 hx509_crypto_destroy (hx509_crypto /*crypto*/);
 
 void
 hx509_crypto_destroy (hx509_crypto /*crypto*/);
 
@@ -432,17 +538,44 @@ hx509_crypto_set_random_key (
        hx509_crypto /*crypto*/,
        heim_octet_string */*key*/);
 
        hx509_crypto /*crypto*/,
        heim_octet_string */*key*/);
 
+int
+hx509_env_add (
+       hx509_context /*context*/,
+       hx509_env /*env*/,
+       const char */*key*/,
+       const char */*value*/);
+
+void
+hx509_env_free (hx509_env */*env*/);
+
+int
+hx509_env_init (
+       hx509_context /*context*/,
+       hx509_env */*env*/);
+
+const char *
+hx509_env_lfind (
+       hx509_context /*context*/,
+       hx509_env /*env*/,
+       const char */*key*/,
+       size_t /*len*/);
+
 void
 hx509_err (
        hx509_context /*context*/,
        int /*exit_code*/,
        int /*error_code*/,
 void
 hx509_err (
        hx509_context /*context*/,
        int /*exit_code*/,
        int /*error_code*/,
-       char */*fmt*/,
+       const char */*fmt*/,
        ...);
 
 void
 hx509_free_octet_string_list (hx509_octet_string_list */*list*/);
 
        ...);
 
 void
 hx509_free_octet_string_list (hx509_octet_string_list */*list*/);
 
+int
+hx509_general_name_unparse (
+       GeneralName */*name*/,
+       char **/*str*/);
+
 char *
 hx509_get_error_string (
        hx509_context /*context*/,
 char *
 hx509_get_error_string (
        hx509_context /*context*/,
@@ -506,18 +639,34 @@ hx509_lock_set_prompter (
        hx509_prompter_fct /*prompt*/,
        void */*data*/);
 
        hx509_prompter_fct /*prompt*/,
        void */*data*/);
 
+int
+hx509_name_cmp (
+       hx509_name /*n1*/,
+       hx509_name /*n2*/);
+
 int
 hx509_name_copy (
        hx509_context /*context*/,
        const hx509_name /*from*/,
        hx509_name */*to*/);
 
 int
 hx509_name_copy (
        hx509_context /*context*/,
        const hx509_name /*from*/,
        hx509_name */*to*/);
 
+int
+hx509_name_expand (
+       hx509_context /*context*/,
+       hx509_name /*name*/,
+       hx509_env /*env*/);
+
 void
 hx509_name_free (hx509_name */*name*/);
 
 int
 hx509_name_is_null_p (const hx509_name /*name*/);
 
 void
 hx509_name_free (hx509_name */*name*/);
 
 int
 hx509_name_is_null_p (const hx509_name /*name*/);
 
+int
+hx509_name_normalize (
+       hx509_context /*context*/,
+       hx509_name /*name*/);
+
 int
 hx509_name_to_Name (
        const hx509_name /*from*/,
 int
 hx509_name_to_Name (
        const hx509_name /*from*/,
@@ -576,7 +725,7 @@ hx509_peer_info_alloc (
        hx509_context /*context*/,
        hx509_peer_info */*peer*/);
 
        hx509_context /*context*/,
        hx509_peer_info */*peer*/);
 
-int
+void
 hx509_peer_info_free (hx509_peer_info /*peer*/);
 
 int
 hx509_peer_info_free (hx509_peer_info /*peer*/);
 
 int
@@ -639,6 +788,17 @@ hx509_query_match_option (
        hx509_query */*q*/,
        hx509_query_option /*option*/);
 
        hx509_query */*q*/,
        hx509_query_option /*option*/);
 
+void
+hx509_query_statistic_file (
+       hx509_context /*context*/,
+       const char */*fn*/);
+
+void
+hx509_query_unparse_stats (
+       hx509_context /*context*/,
+       int /*printtype*/,
+       FILE */*out*/);
+
 int
 hx509_revoke_add_crl (
        hx509_context /*context*/,
 int
 hx509_revoke_add_crl (
        hx509_context /*context*/,
index 70f29ea92d1c831bf46b2a11155420949b5c52d3..664c12e045a1124c0f592fa053ef568398e5f96c 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: hx509.h,v 1.16 2007/01/09 10:52:05 lha Exp $ */
+/* $Id: hx509.h 20798 2007-06-02 03:28:55Z lha $ */
 
 typedef struct hx509_cert_attribute_data *hx509_cert_attribute;
 typedef struct hx509_cert_data *hx509_cert;
 
 typedef struct hx509_cert_attribute_data *hx509_cert_attribute;
 typedef struct hx509_cert_data *hx509_cert;
@@ -50,6 +50,8 @@ typedef struct hx509_request_data *hx509_request;
 typedef struct hx509_error_data *hx509_error;
 typedef struct hx509_peer_info *hx509_peer_info;
 typedef struct hx509_ca_tbs *hx509_ca_tbs;
 typedef struct hx509_error_data *hx509_error;
 typedef struct hx509_peer_info *hx509_peer_info;
 typedef struct hx509_ca_tbs *hx509_ca_tbs;
+typedef struct hx509_env *hx509_env;
+typedef struct hx509_crl *hx509_crl;
 
 typedef void (*hx509_vprint_func)(void *, const char *, va_list);
 
 
 typedef void (*hx509_vprint_func)(void *, const char *, va_list);
 
@@ -107,5 +109,18 @@ typedef enum {
 #define HX509_SELECT_DIGEST 1
 #define HX509_SELECT_PUBLIC_SIG 2
 #define HX509_SELECT_PUBLIC_ENC 3
 #define HX509_SELECT_DIGEST 1
 #define HX509_SELECT_PUBLIC_SIG 2
 #define HX509_SELECT_PUBLIC_ENC 3
+#define HX509_SELECT_SECRET_ENC 4
+
+/* flags to hx509_ca_tbs_set_template */
+#define HX509_CA_TEMPLATE_SUBJECT 1
+#define HX509_CA_TEMPLATE_SERIAL 2
+#define HX509_CA_TEMPLATE_NOTBEFORE 4
+#define HX509_CA_TEMPLATE_NOTAFTER 8
+#define HX509_CA_TEMPLATE_SPKI 16
+#define HX509_CA_TEMPLATE_KU 32
+#define HX509_CA_TEMPLATE_EKU 64
+
+/* flags hx509_cms_create_signed* */
+#define HX509_CMS_SIGATURE_DETACHED 1
 
 #include <hx509-protos.h>
 
 #include <hx509-protos.h>
index 54ec177e473da2fbc50c333a9480e43c26cd57a7..90f3b3d907db44264ecbae5b396197ed7264bea2 100644 (file)
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: hx509_err.et,v 1.19 2006/12/30 23:05:39 lha Exp $"
+id "$Id: hx509_err.et 20807 2007-06-03 03:11:20Z lha $"
 
 error_table hx
 prefix HX509
 
 error_table hx
 prefix HX509
@@ -76,7 +76,8 @@ error_code CRL_CERT_REVOKED, "Certificate is included in CRL"
 error_code REVOKE_STATUS_MISSING, "No revoke status found for certificates"
 error_code CRL_UNKNOWN_EXTENSION, "Unknown extension"
 error_code REVOKE_WRONG_DATA, "Got wrong CRL/OCSP data from server"
 error_code REVOKE_STATUS_MISSING, "No revoke status found for certificates"
 error_code CRL_UNKNOWN_EXTENSION, "Unknown extension"
 error_code REVOKE_WRONG_DATA, "Got wrong CRL/OCSP data from server"
-error_code REVOKE_NOT_SAME_PARENT, "Doesn't have same parent as other certificaes"
+error_code REVOKE_NOT_SAME_PARENT, "Doesn't have same parent as other certificates"
+error_code CERT_NOT_IN_OCSP, "Certificates not in OCSP reply"
 
 # misc error
 index 108
 
 # misc error
 index 108
index 78d158f8b19c1c6d0236244ceb79328ea3131623..bfbee0943ebc7dc052261bbc1f3529a7092edfb4 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: hx_locl.h,v 1.30 2007/01/09 10:52:06 lha Exp $ */
+/* $Id: hx_locl.h 20930 2007-06-06 00:23:42Z lha $ */
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
@@ -71,6 +71,7 @@
 
 struct hx509_keyset_ops;
 struct hx509_collector;
 
 struct hx509_keyset_ops;
 struct hx509_collector;
+struct hx509_generate_private_context;
 typedef struct hx509_path hx509_path;
 
 #include <hx509.h>
 typedef struct hx509_path hx509_path;
 
 #include <hx509.h>
@@ -144,7 +145,7 @@ struct hx509_query_data {
 };
 
 struct hx509_keyset_ops {
 };
 
 struct hx509_keyset_ops {
-    char *name;
+    const char *name;
     int flags;
     int (*init)(hx509_context, hx509_certs, void **, 
                int, const char *, hx509_lock);
     int flags;
     int (*init)(hx509_context, hx509_certs, void **, 
                int, const char *, hx509_lock);
@@ -157,7 +158,7 @@ struct hx509_keyset_ops {
     int (*iter)(hx509_context, hx509_certs, void *, void *, hx509_cert *);
     int (*iter_end)(hx509_context, hx509_certs, void *, void *);
     int (*printinfo)(hx509_context, hx509_certs, 
     int (*iter)(hx509_context, hx509_certs, void *, void *, hx509_cert *);
     int (*iter_end)(hx509_context, hx509_certs, void *, void *);
     int (*printinfo)(hx509_context, hx509_certs, 
-                    void *, int (*)(void *, char *), void *);
+                    void *, int (*)(void *, const char *), void *);
     int (*getkeys)(hx509_context, hx509_certs, void *, hx509_private_key **);
     int (*addkey)(hx509_context, hx509_certs, void *, hx509_private_key);
 };
     int (*getkeys)(hx509_context, hx509_certs, void *, hx509_private_key **);
     int (*addkey)(hx509_context, hx509_certs, void *, hx509_private_key);
 };
@@ -178,7 +179,21 @@ struct hx509_context_data {
 #define HX509_DEFAULT_OCSP_TIME_DIFF   (5*60)
     hx509_error error;
     struct et_list *et_list;
 #define HX509_DEFAULT_OCSP_TIME_DIFF   (5*60)
     hx509_error error;
     struct et_list *et_list;
+    char *querystat;
+    hx509_certs default_trust_anchors;
 };
 
 /* _hx509_calculate_path flag field */
 #define HX509_CALCULATE_PATH_NO_ANCHOR 1
 };
 
 /* _hx509_calculate_path flag field */
 #define HX509_CALCULATE_PATH_NO_ANCHOR 1
+
+extern const AlgorithmIdentifier * _hx509_crypto_default_sig_alg;
+extern const AlgorithmIdentifier * _hx509_crypto_default_digest_alg;
+extern const AlgorithmIdentifier * _hx509_crypto_default_secret_alg;
+
+/*
+ * Configurable options
+ */
+
+#if 0 /* fdef __APPLE__*/
+#define HX509_DEFAULT_ANCHORS "KEYCHAIN:system"
+#endif
index c3d5ee210c25290108b0c27156317bad4ad1d519..475835b9b09a5820acec85240532b5f7c70e6fa8 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: keyset.c,v 1.18 2007/01/09 10:52:07 lha Exp $");
+RCSID("$Id: keyset.c 20911 2007-06-05 03:41:17Z lha $");
 
 struct hx509_certs_data {
     struct hx509_keyset_ops *ops;
 
 struct hx509_certs_data {
     struct hx509_keyset_ops *ops;
@@ -276,6 +276,8 @@ hx509_certs_find(hx509_context context,
 
     *r = NULL;
 
 
     *r = NULL;
 
+    _hx509_query_statistic(context, 0, q);
+
     if (certs->ops->query)
        return (*certs->ops->query)(context, certs, certs->ops_data, q, r);
 
     if (certs->ops->query)
        return (*certs->ops->query)(context, certs, certs->ops_data, q, r);
 
@@ -317,6 +319,8 @@ certs_merge_func(hx509_context context, void *ctx, hx509_cert c)
 int
 hx509_certs_merge(hx509_context context, hx509_certs to, hx509_certs from)
 {
 int
 hx509_certs_merge(hx509_context context, hx509_certs to, hx509_certs from)
 {
+    if (from == NULL)
+       return 0;
     return hx509_certs_iter(context, from, certs_merge_func, to);
 }
 
     return hx509_certs_iter(context, from, certs_merge_func, to);
 }
 
@@ -358,7 +362,7 @@ hx509_get_one_cert(hx509_context context, hx509_certs certs, hx509_cert *c)
 }
 
 static int
 }
 
 static int
-certs_info_stdio(void *ctx, char *str)
+certs_info_stdio(void *ctx, const char *str)
 {
     FILE *f = ctx;
     fprintf(f, "%s\n", str);
 {
     FILE *f = ctx;
     fprintf(f, "%s\n", str);
@@ -368,7 +372,7 @@ certs_info_stdio(void *ctx, char *str)
 int
 hx509_certs_info(hx509_context context, 
                 hx509_certs certs,
 int
 hx509_certs_info(hx509_context context, 
                 hx509_certs certs,
-                int (*func)(void *, char *),
+                int (*func)(void *, const char *),
                 void *ctx)
 {
     if (func == NULL) {
                 void *ctx)
 {
     if (func == NULL) {
@@ -385,8 +389,8 @@ hx509_certs_info(hx509_context context,
 }
 
 void
 }
 
 void
-_hx509_pi_printf(int (*func)(void *, char *), void *ctx,
-                char *fmt, ...)
+_hx509_pi_printf(int (*func)(void *, const char *), void *ctx,
+                const char *fmt, ...)
 {
     va_list ap;
     char *str;
 {
     va_list ap;
     char *str;
index 01dcf5795b42ee227c3fa827633a403e3add72f1..a0bc875e5b8c356539b8640974cad62395671801 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_dir.c,v 1.7 2007/01/09 10:52:08 lha Exp $");
+RCSID("$Id: ks_dir.c 19778 2007-01-09 10:52:13Z lha $");
 #include <dirent.h>
 
 /*
 #include <dirent.h>
 
 /*
index db0f475129dcf83c28e1ec3b4e2126d48b8fc9d0..f9a35808805ab1d3f4ed9a652fe4fb47ca6f2cc3 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_file.c,v 1.31 2007/01/09 10:52:08 lha Exp $");
+RCSID("$Id: ks_file.c 20776 2007-06-01 22:02:01Z lha $");
 
 struct ks_file {
     hx509_certs certs;
 
 struct ks_file {
     hx509_certs certs;
@@ -542,12 +542,9 @@ file_init(hx509_context context,
        return 0;
     }
 
        return 0;
     }
 
-    c = _hx509_collector_alloc(context, lock);
-    if (c == NULL) {
-       ret = ENOMEM;
-       hx509_set_error_string(context, 0, ret, "out of memory");
+    ret = _hx509_collector_alloc(context, lock, &c);
+    if (ret)
        goto out;
        goto out;
-    }
 
     for (p = f->fn; p != NULL; p = pnext) {
        int found_data;
 
     for (p = f->fn; p != NULL; p = pnext) {
        int found_data;
@@ -678,16 +675,12 @@ static int
 store_func(hx509_context context, void *ctx, hx509_cert c)
 {
     FILE *f = (FILE *)ctx;
 store_func(hx509_context context, void *ctx, hx509_cert c)
 {
     FILE *f = (FILE *)ctx;
-    size_t size;
     heim_octet_string data;
     int ret;
 
     heim_octet_string data;
     int ret;
 
-    ASN1_MALLOC_ENCODE(Certificate, data.data, data.length, 
-                      _hx509_get_cert(c), &size, ret);
+    ret = hx509_cert_binary(context, c, &data);
     if (ret)
        return ret;
     if (ret)
        return ret;
-    if (data.length != size)
-       _hx509_abort("internal ASN.1 encoder error");
     
     dump_pem_file(context, "CERTIFICATE", f, data.data, data.length);
     free(data.data);
     
     dump_pem_file(context, "CERTIFICATE", f, data.data, data.length);
     free(data.data);
diff --git a/source4/heimdal/lib/hx509/ks_keychain.c b/source4/heimdal/lib/hx509/ks_keychain.c
new file mode 100644 (file)
index 0000000..2f0f72c
--- /dev/null
@@ -0,0 +1,487 @@
+/*
+ * Copyright (c) 2007 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "hx_locl.h"
+RCSID("$Id: ks_keychain.c 20945 2007-06-06 22:17:17Z lha $");
+
+#ifdef HAVE_FRAMEWORK_SECURITY
+
+#include <Security/Security.h>
+
+/* Missing function decls */
+OSStatus SecKeyGetCSPHandle(SecKeyRef, CSSM_CSP_HANDLE *);
+OSStatus SecKeyGetCredentials(SecKeyRef, CSSM_ACL_AUTHORIZATION_TAG,
+                             int, const CSSM_ACCESS_CREDENTIALS **);
+#define kSecCredentialTypeDefault 0
+
+
+static int
+getAttribute(SecKeychainItemRef itemRef, SecItemAttr item,
+            SecKeychainAttributeList **attrs)
+{           
+    SecKeychainAttributeInfo attrInfo;
+    uint32 attrFormat = 0;
+    OSStatus ret;
+
+    *attrs = NULL;
+
+    attrInfo.count = 1;
+    attrInfo.tag = &item;
+    attrInfo.format = &attrFormat;
+  
+    ret = SecKeychainItemCopyAttributesAndData(itemRef, &attrInfo, NULL,
+                                              attrs, NULL, NULL);
+    if (ret)
+       return EINVAL;
+    return 0;
+}
+
+
+/*
+ *
+ */
+
+struct kc_rsa {
+    SecKeychainItemRef item;
+    size_t keysize;
+};
+
+
+static int
+kc_rsa_public_encrypt(int flen,
+                     const unsigned char *from,
+                     unsigned char *to,
+                     RSA *rsa,
+                     int padding)
+{
+    return -1;
+}
+
+static int
+kc_rsa_public_decrypt(int flen,
+                     const unsigned char *from,
+                     unsigned char *to,
+                     RSA *rsa,
+                     int padding)
+{
+    return -1;
+}
+
+
+static int
+kc_rsa_private_encrypt(int flen, 
+                      const unsigned char *from,
+                      unsigned char *to,
+                      RSA *rsa,
+                      int padding)
+{
+    struct kc_rsa *kc = RSA_get_app_data(rsa);
+
+    CSSM_RETURN cret;
+    OSStatus ret;
+    const CSSM_ACCESS_CREDENTIALS *creds;
+    SecKeyRef privKeyRef = (SecKeyRef)kc->item;
+    CSSM_CSP_HANDLE cspHandle;
+    const CSSM_KEY *cssmKey;
+    CSSM_CC_HANDLE sigHandle = 0;
+    CSSM_DATA sig, in;
+    int fret = 0;
+
+
+    cret = SecKeyGetCSSMKey(privKeyRef, &cssmKey);
+    if(cret) abort();
+
+    cret = SecKeyGetCSPHandle(privKeyRef, &cspHandle);
+    if(cret) abort();
+
+    ret = SecKeyGetCredentials(privKeyRef, CSSM_ACL_AUTHORIZATION_SIGN,
+                              kSecCredentialTypeDefault, &creds);
+    if(ret) abort();
+
+    ret = CSSM_CSP_CreateSignatureContext(cspHandle, CSSM_ALGID_RSA,
+                                         creds, cssmKey, &sigHandle);
+    if(ret) abort();
+
+    in.Data = (uint8 *)from;
+    in.Length = flen;
+       
+    sig.Data = (uint8 *)to;
+    sig.Length = kc->keysize;
+       
+    cret = CSSM_SignData(sigHandle, &in, 1, CSSM_ALGID_NONE, &sig);
+    if(cret) {
+       /* cssmErrorString(cret); */
+       fret = -1;
+    } else
+       fret = sig.Length;
+
+    if(sigHandle)
+       CSSM_DeleteContext(sigHandle);
+
+    return fret;
+}
+
+static int
+kc_rsa_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
+                      RSA * rsa, int padding)
+{
+    return -1;
+}
+
+static int 
+kc_rsa_init(RSA *rsa)
+{
+    return 1;
+}
+
+static int
+kc_rsa_finish(RSA *rsa)
+{
+    struct kc_rsa *kc_rsa = RSA_get_app_data(rsa);
+    CFRelease(kc_rsa->item);
+    memset(kc_rsa, 0, sizeof(*kc_rsa));
+    free(kc_rsa);
+    return 1;
+}
+
+static const RSA_METHOD kc_rsa_pkcs1_method = {
+    "hx509 Keychain PKCS#1 RSA",
+    kc_rsa_public_encrypt,
+    kc_rsa_public_decrypt,
+    kc_rsa_private_encrypt,
+    kc_rsa_private_decrypt,
+    NULL,
+    NULL,
+    kc_rsa_init,
+    kc_rsa_finish,
+    0,
+    NULL,
+    NULL,
+    NULL
+};
+
+static int
+set_private_key(hx509_context context,
+               SecKeychainItemRef itemRef,
+               hx509_cert cert)
+{
+    struct kc_rsa *kc;
+    hx509_private_key key;
+    RSA *rsa;
+    int ret;
+
+    ret = _hx509_private_key_init(&key, NULL, NULL);
+    if (ret)
+       return ret;
+
+    kc = calloc(1, sizeof(*kc));
+    if (kc == NULL)
+       _hx509_abort("out of memory");
+
+    kc->item = itemRef;
+
+    rsa = RSA_new();
+    if (rsa == NULL)
+       _hx509_abort("out of memory");
+
+    /* Argh, fake modulus since OpenSSL API is on crack */
+    {
+       SecKeychainAttributeList *attrs = NULL;
+       uint32_t size;
+       void *data;
+
+       rsa->n = BN_new();
+       if (rsa->n == NULL) abort();
+
+       ret = getAttribute(itemRef, kSecKeyKeySizeInBits, &attrs);
+       if (ret) abort();
+
+       size = *(uint32_t *)attrs->attr[0].data;
+       SecKeychainItemFreeAttributesAndData(attrs, NULL);
+
+       kc->keysize = (size + 7) / 8;
+
+       data = malloc(kc->keysize);
+       memset(data, 0xe0, kc->keysize);
+       BN_bin2bn(data, kc->keysize, rsa->n);
+       free(data);
+    }
+    rsa->e = NULL;
+
+    RSA_set_method(rsa, &kc_rsa_pkcs1_method);
+    ret = RSA_set_app_data(rsa, kc);
+    if (ret != 1)
+       _hx509_abort("RSA_set_app_data");
+
+    _hx509_private_key_assign_rsa(key, rsa);
+    _hx509_cert_assign_key(cert, key);
+
+    return 0;
+}
+
+/*
+ *
+ */
+
+struct ks_keychain {
+    SecKeychainRef keychain;
+};
+
+static int
+keychain_init(hx509_context context,
+             hx509_certs certs, void **data, int flags,
+             const char *residue, hx509_lock lock)
+{
+    struct ks_keychain *ctx;
+    OSStatus ret;
+
+    ctx = calloc(1, sizeof(*ctx));
+    if (ctx == NULL) {
+       hx509_clear_error_string(context);
+       return ENOMEM;
+    }
+
+    if (residue) {
+       if (strcasecmp(residue, "system") == 0)
+           residue = "/System/Library/Keychains/X509Anchors";
+
+       ret = SecKeychainOpen(residue, &ctx->keychain);
+       if (ret != noErr) {
+           hx509_set_error_string(context, 0, ENOENT, 
+                                  "Failed to open %s", residue);
+           return ENOENT;
+       }
+    }
+
+    *data = ctx;
+    return 0;
+}
+
+/*
+ *
+ */
+
+static int
+keychain_free(hx509_certs certs, void *data)
+{
+    struct ks_keychain *ctx = data;
+    if (ctx->keychain)
+       CFRelease(ctx->keychain);
+    memset(ctx, 0, sizeof(*ctx));
+    free(ctx);
+    return 0;
+}
+
+/*
+ *
+ */
+
+struct iter {
+    SecKeychainSearchRef searchRef;
+};
+
+static int 
+keychain_iter_start(hx509_context context,
+                   hx509_certs certs, void *data, void **cursor)
+{
+    struct ks_keychain *ctx = data;
+    struct iter *iter;
+    OSStatus ret;
+
+    iter = calloc(1, sizeof(*iter));
+    if (iter == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+
+    ret = SecKeychainSearchCreateFromAttributes(ctx->keychain,
+                                               kSecCertificateItemClass,
+                                               NULL,
+                                               &iter->searchRef);
+    if (ret) {
+       free(iter);
+       hx509_set_error_string(context, 0, ret, 
+                              "Failed to start search for attributes");
+       return ENOMEM;
+    }
+
+    *cursor = iter;
+    return 0;
+}
+
+/*
+ *
+ */
+
+static int
+keychain_iter(hx509_context context,
+             hx509_certs certs, void *data, void *cursor, hx509_cert *cert)
+{
+    SecKeychainAttributeList *attrs = NULL;
+    SecKeychainAttributeInfo attrInfo;
+    uint32 attrFormat = 0;
+    SecKeychainItemRef itemRef;
+    SecItemAttr item;
+    struct iter *iter = cursor;
+    Certificate t;
+    OSStatus ret;
+    UInt32 len;
+    void *ptr = NULL;
+    size_t size;
+
+    *cert = NULL;
+
+    ret = SecKeychainSearchCopyNext(iter->searchRef, &itemRef);
+    if (ret == errSecItemNotFound)
+       return 0;
+    else if (ret != 0)
+       return EINVAL;
+       
+    /*
+     * Pick out certificate and matching "keyid"
+     */
+
+    item = kSecPublicKeyHashItemAttr;
+
+    attrInfo.count = 1;
+    attrInfo.tag = &item;
+    attrInfo.format = &attrFormat;
+  
+    ret = SecKeychainItemCopyAttributesAndData(itemRef, &attrInfo, NULL,
+                                              &attrs, &len, &ptr);
+    if (ret)
+       return EINVAL;
+    
+    ret = decode_Certificate(ptr, len, &t, &size);
+    CFRelease(itemRef);
+    if (ret) {
+       hx509_set_error_string(context, 0, ret, "Failed to parse certificate");
+       goto out;
+    }
+
+    ret = hx509_cert_init(context, &t, cert);
+    free_Certificate(&t);
+    if (ret)
+       goto out;
+
+    /* 
+     * Find related private key if there is one by looking at
+     * kSecPublicKeyHashItemAttr == kSecKeyLabel
+     */
+    {
+       SecKeychainSearchRef search;
+       SecKeychainAttribute attrKeyid;
+       SecKeychainAttributeList attrList;
+
+       attrKeyid.tag = kSecKeyLabel;
+       attrKeyid.length = attrs->attr[0].length;
+       attrKeyid.data = attrs->attr[0].data;
+       
+       attrList.count = 1;
+       attrList.attr = &attrKeyid;
+
+       ret = SecKeychainSearchCreateFromAttributes(NULL,
+                                                   CSSM_DL_DB_RECORD_PRIVATE_KEY,
+                                                   &attrList,
+                                                   &search);
+       if (ret) {
+           ret = 0;
+           goto out;
+       }
+
+       ret = SecKeychainSearchCopyNext(search, &itemRef);
+       CFRelease(search);
+       if (ret == errSecItemNotFound) {
+           ret = 0;
+           goto out;
+       } else if (ret) {
+           ret = EINVAL;
+           goto out;
+       }
+       set_private_key(context, itemRef, *cert);
+    }
+
+out:
+    SecKeychainItemFreeAttributesAndData(attrs, ptr);
+
+    return ret;
+}
+
+/*
+ *
+ */
+
+static int
+keychain_iter_end(hx509_context context,
+                 hx509_certs certs,
+                 void *data,
+                 void *cursor)
+{
+    struct iter *iter = cursor;
+
+    CFRelease(iter->searchRef);
+    memset(iter, 0, sizeof(*iter));
+    free(iter);
+    return 0;
+}
+
+/*
+ *
+ */
+
+struct hx509_keyset_ops keyset_keychain = {
+    "KEYCHAIN",
+    0,
+    keychain_init,
+    NULL,
+    keychain_free,
+    NULL,
+    NULL,
+    keychain_iter_start,
+    keychain_iter,
+    keychain_iter_end
+};
+
+#endif /* HAVE_FRAMEWORK_SECURITY */
+
+/*
+ *
+ */
+
+void
+_hx509_ks_keychain_register(hx509_context context)
+{
+#ifdef HAVE_FRAMEWORK_SECURITY
+    _hx509_ks_register(context, &keyset_keychain);
+#endif
+}
index dd7b7166bc8a6e846e2a5716136b704fee6da384..efa19eb19c54f10327c4ac34e534b975150166a4 100644 (file)
@@ -80,6 +80,7 @@ mem_free(hx509_certs certs, void *data)
     free(mem->certs.val);
     for (i = 0; mem->keys && mem->keys[i]; i++)
        _hx509_private_key_free(&mem->keys[i]);
     free(mem->certs.val);
     for (i = 0; mem->keys && mem->keys[i]; i++)
        _hx509_private_key_free(&mem->keys[i]);
+    free(mem->keys);
     free(mem->name);
     free(mem);
 
     free(mem->name);
     free(mem);
 
@@ -162,7 +163,7 @@ mem_getkeys(hx509_context context,
 
     for (i = 0; mem->keys && mem->keys[i]; i++)
        ;
 
     for (i = 0; mem->keys && mem->keys[i]; i++)
        ;
-    *keys = calloc(i, sizeof(**keys));
+    *keys = calloc(i + 1, sizeof(**keys));
     for (i = 0; mem->keys && mem->keys[i]; i++) {
        (*keys)[i] = _hx509_private_key_ref(mem->keys[i]);
        if ((*keys)[i] == NULL) {
     for (i = 0; mem->keys && mem->keys[i]; i++) {
        (*keys)[i] = _hx509_private_key_ref(mem->keys[i]);
        if ((*keys)[i] == NULL) {
index 1e6c2ea3fb94851dc949b5711841453bf6e75bb9..3be259fc6052fd64491f97d7b8515b933a376b10 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_null.c,v 1.5 2007/01/09 10:52:10 lha Exp $");
+RCSID("$Id: ks_null.c 20901 2007-06-04 23:14:08Z lha $");
 
 
 static int
 
 
 static int
@@ -90,3 +90,9 @@ struct hx509_keyset_ops keyset_null = {
     null_iter,
     null_iter_end
 };
     null_iter,
     null_iter_end
 };
+
+void
+_hx509_ks_null_register(hx509_context context)
+{
+    _hx509_ks_register(context, &keyset_null);
+}
index b103264b7a7a5df7547631ae23ef1a882de2b792..90c716213fd450b747e3ab1f9f5cced3973d2098 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_p11.c,v 1.45 2007/01/09 19:43:35 lha Exp $");
+RCSID("$Id: ks_p11.c 20920 2007-06-05 05:47:06Z lha $");
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
 #endif
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
 #endif
@@ -214,7 +214,7 @@ p11_rsa_finish(RSA *rsa)
     return 1;
 }
 
     return 1;
 }
 
-static const RSA_METHOD rsa_pkcs1_method = {
+static const RSA_METHOD p11_rsa_pkcs1_method = {
     "hx509 PKCS11 PKCS#1 RSA",
     p11_rsa_public_encrypt,
     p11_rsa_public_decrypt,
     "hx509 PKCS11 PKCS#1 RSA",
     p11_rsa_public_encrypt,
     p11_rsa_public_decrypt,
@@ -644,7 +644,7 @@ collect_private_key(hx509_context context,
     if (p->refcount == 0)
        _hx509_abort("pkcs11 refcount to high");
 
     if (p->refcount == 0)
        _hx509_abort("pkcs11 refcount to high");
 
-    RSA_set_method(rsa, &rsa_pkcs1_method);
+    RSA_set_method(rsa, &p11_rsa_pkcs1_method);
     ret = RSA_set_app_data(rsa, p11rsa);
     if (ret != 1)
        _hx509_abort("RSA_set_app_data");
     ret = RSA_set_app_data(rsa, p11rsa);
     if (ret != 1)
        _hx509_abort("RSA_set_app_data");
@@ -766,11 +766,9 @@ p11_list_keys(hx509_context context,
     if (lock == NULL)
        lock = _hx509_empty_lock;
 
     if (lock == NULL)
        lock = _hx509_empty_lock;
 
-    collector = _hx509_collector_alloc(context, lock);
-    if (collector == NULL) {
-       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
-       return ENOMEM;
-    }
+    ret = _hx509_collector_alloc(context, lock, &collector);
+    if (ret)
+       return ret;
 
     key_class = CKO_PRIVATE_KEY;
     ret = iterate_entries(context, p, slot, session,
 
     key_class = CKO_PRIVATE_KEY;
     ret = iterate_entries(context, p, slot, session,
@@ -1113,7 +1111,7 @@ static int
 p11_printinfo(hx509_context context, 
              hx509_certs certs, 
              void *data,
 p11_printinfo(hx509_context context, 
              hx509_certs certs, 
              void *data,
-             int (*func)(void *, char *),
+             int (*func)(void *, const char *),
              void *ctx)
 {
     struct p11_module *p = data;
              void *ctx)
 {
     struct p11_module *p = data;
@@ -1140,6 +1138,17 @@ p11_printinfo(hx509_context context,
                MECHNAME(CKM_RSA_X_509, "rsa-x-509");
                MECHNAME(CKM_MD5_RSA_PKCS, "md5-rsa-pkcs");
                MECHNAME(CKM_SHA1_RSA_PKCS, "sha1-rsa-pkcs");
                MECHNAME(CKM_RSA_X_509, "rsa-x-509");
                MECHNAME(CKM_MD5_RSA_PKCS, "md5-rsa-pkcs");
                MECHNAME(CKM_SHA1_RSA_PKCS, "sha1-rsa-pkcs");
+               MECHNAME(CKM_RIPEMD160_RSA_PKCS, "ripemd160-rsa-pkcs");
+               MECHNAME(CKM_RSA_PKCS_OAEP, "rsa-pkcs-oaep");
+               MECHNAME(CKM_SHA_1, "sha1");
+               MECHNAME(CKM_MD5, "md5");
+               MECHNAME(CKM_MD2, "md2");
+               MECHNAME(CKM_RIPEMD160, "ripemd-160");
+               MECHNAME(CKM_DES_ECB, "des-ecb");
+               MECHNAME(CKM_DES_CBC, "des-cbc");
+               MECHNAME(CKM_AES_ECB, "aes-ecb");
+               MECHNAME(CKM_AES_CBC, "aes-cbc");
+               MECHNAME(CKM_DH_PKCS_PARAMETER_GEN, "dh-pkcs-parameter-gen");
            default:
                snprintf(unknownname, sizeof(unknownname),
                         "unknown-mech-%lu", 
            default:
                snprintf(unknownname, sizeof(unknownname),
                         "unknown-mech-%lu", 
index 69dba802e5dba957a204bb0e6c9b2beadbaf90e3..5fddbd07def011589a31bc7124c22e6b64657108 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: ks_p12.c,v 1.18 2007/01/09 10:52:11 lha Exp $");
+RCSID("$Id: ks_p12.c 20909 2007-06-05 03:09:13Z lha $");
 
 struct ks_pkcs12 {
     hx509_certs certs;
 
 struct ks_pkcs12 {
     hx509_certs certs;
@@ -341,39 +341,45 @@ p12_init(hx509_context context,
     if (lock == NULL)
        lock = _hx509_empty_lock;
 
     if (lock == NULL)
        lock = _hx509_empty_lock;
 
-    c = _hx509_collector_alloc(context, lock);
-    if (c == NULL)
-       return ENOMEM;
+    ret = _hx509_collector_alloc(context, lock, &c);
+    if (ret)
+       return ret;
 
     p12 = calloc(1, sizeof(*p12));
     if (p12 == NULL) {
        ret = ENOMEM;
 
     p12 = calloc(1, sizeof(*p12));
     if (p12 == NULL) {
        ret = ENOMEM;
+       hx509_set_error_string(context, 0, ret, "out of memory");
        goto out;
     }
 
     p12->fn = strdup(residue);
     if (p12->fn == NULL) {
        ret = ENOMEM;
        goto out;
     }
 
     p12->fn = strdup(residue);
     if (p12->fn == NULL) {
        ret = ENOMEM;
+       hx509_set_error_string(context, 0, ret, "out of memory");
        goto out;
     }
 
     if (flags & HX509_CERTS_CREATE) {
        goto out;
     }
 
     if (flags & HX509_CERTS_CREATE) {
-       ret = hx509_certs_init(context, "MEMORY:ks-file-create", 
+       ret = hx509_certs_init(context, "MEMORY:ks-file-create",
                               0, lock, &p12->certs);
                               0, lock, &p12->certs);
-       if (ret)
-           goto out;
-       *data = p12;
-       return 0;
+       if (ret == 0)
+           *data = p12;
+       goto out;
     }
 
     ret = _hx509_map_file(residue, &buf, &len, NULL);
     }
 
     ret = _hx509_map_file(residue, &buf, &len, NULL);
-    if (ret)
+    if (ret) {
+       hx509_clear_error_string(context);
        goto out;
        goto out;
+    }
 
     ret = decode_PKCS12_PFX(buf, len, &pfx, NULL);
     _hx509_unmap_file(buf, len);
 
     ret = decode_PKCS12_PFX(buf, len, &pfx, NULL);
     _hx509_unmap_file(buf, len);
-    if (ret)
+    if (ret) {
+       hx509_set_error_string(context, 0, ret,
+                              "Failed to decode the PFX in %s", residue);
        goto out;
        goto out;
+    }
 
     if (der_heim_oid_cmp(&pfx.authSafe.contentType, oid_id_pkcs7_data()) != 0) {
        free_PKCS12_PFX(&pfx);
 
     if (der_heim_oid_cmp(&pfx.authSafe.contentType, oid_id_pkcs7_data()) != 0) {
        free_PKCS12_PFX(&pfx);
@@ -452,15 +458,20 @@ addBag(hx509_context context,
 
     ptr = realloc(as->val, sizeof(as->val[0]) * (as->len + 1));
     if (ptr == NULL) {
 
     ptr = realloc(as->val, sizeof(as->val[0]) * (as->len + 1));
     if (ptr == NULL) {
-       hx509_set_error_string(context, 0, ENOMEM, "malloc out of memory");
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
        return ENOMEM;
     }
     as->val = ptr;
 
     ret = der_copy_oid(oid, &as->val[as->len].contentType);
        return ENOMEM;
     }
     as->val = ptr;
 
     ret = der_copy_oid(oid, &as->val[as->len].contentType);
+    if (ret) {
+       hx509_set_error_string(context, 0, ret, "out of memory");
+       return ret;
+    }
     
     as->val[as->len].content = calloc(1, sizeof(*as->val[0].content));
     if (as->val[as->len].content == NULL) {
     
     as->val[as->len].content = calloc(1, sizeof(*as->val[0].content));
     if (as->val[as->len].content == NULL) {
+       der_free_oid(&as->val[as->len].contentType);
        hx509_set_error_string(context, 0, ENOMEM, "malloc out of memory");
        return ENOMEM;
     }
        hx509_set_error_string(context, 0, ENOMEM, "malloc out of memory");
        return ENOMEM;
     }
@@ -488,11 +499,11 @@ store_func(hx509_context context, void *ctx, hx509_cert c)
     os.data = NULL;
     os.length = 0;
 
     os.data = NULL;
     os.length = 0;
 
-    ASN1_MALLOC_ENCODE(Certificate, os.data, os.length, 
-                      _hx509_get_cert(c), &size, ret);
+    ret = hx509_cert_binary(context, c, &os);
     if (ret)
     if (ret)
-       goto out;
-    ASN1_MALLOC_ENCODE(PKCS12_OctetString, 
+       return ret;
+
+    ASN1_MALLOC_ENCODE(PKCS12_OctetString,
                       cb.certValue.data,cb.certValue.length,
                       &os, &size, ret);
     free(os.data);
                       cb.certValue.data,cb.certValue.length,
                       &os, &size, ret);
     free(os.data);
@@ -505,7 +516,7 @@ store_func(hx509_context context, void *ctx, hx509_cert c)
     }
     ASN1_MALLOC_ENCODE(PKCS12_CertBag, os.data, os.length,
                       &cb, &size, ret);
     }
     ASN1_MALLOC_ENCODE(PKCS12_CertBag, os.data, os.length,
                       &cb, &size, ret);
-    free(cb.certValue.data);
+    free_PKCS12_CertBag(&cb);
     if (ret)
        goto out;
 
     if (ret)
        goto out;
 
index 95fc0aa26da85c7a07e5f98fff4ed53d6dcaee7a..de326f2e2de65f2e12e723129d069c31ba44d0a0 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: lock.c,v 1.13 2006/10/14 09:41:05 lha Exp $");
+RCSID("$Id: lock.c 18452 2006-10-14 09:41:05Z lha $");
 
 struct hx509_lock_data {
     struct _hx509_password password;
 
 struct hx509_lock_data {
     struct _hx509_password password;
index 92e9e6f974f75690950e097391f7f30956bbc9d1..5198633b1e52b37b120e3c7330c61d007ebb9861 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: name.c,v 1.33 2006/12/30 23:04:11 lha Exp $");
+RCSID("$Id: name.c 20891 2007-06-04 22:51:41Z lha $");
 
 /* 
  * name parsing from rfc2253
 
 /* 
  * name parsing from rfc2253
@@ -41,7 +41,7 @@ RCSID("$Id: name.c,v 1.33 2006/12/30 23:04:11 lha Exp $");
  */
 
 static const struct {
  */
 
 static const struct {
-    char *n;
+    const char *n;
     const heim_oid *(*o)(void);
 } no[] = {
     { "C", oid_id_at_countryName },
     const heim_oid *(*o)(void);
 } no[] = {
     { "C", oid_id_at_countryName },
@@ -51,6 +51,7 @@ static const struct {
     { "O", oid_id_at_organizationName },
     { "OU", oid_id_at_organizationalUnitName },
     { "S", oid_id_at_stateOrProvinceName },
     { "O", oid_id_at_organizationName },
     { "OU", oid_id_at_organizationalUnitName },
     { "S", oid_id_at_stateOrProvinceName },
+    { "STREET", oid_id_at_streetAddress },
     { "UID", oid_id_Userid },
     { "emailAddress", oid_id_pkcs9_emailAddress },
     { "serialNumber", oid_id_at_serialNumber }
     { "UID", oid_id_Userid },
     { "emailAddress", oid_id_pkcs9_emailAddress },
     { "serialNumber", oid_id_at_serialNumber }
@@ -81,25 +82,27 @@ quote_string(const char *f, size_t len, size_t *rlen)
            to[j++] = from[i];
        } else {
            int l = snprintf(&to[j], tolen - j - 1,
            to[j++] = from[i];
        } else {
            int l = snprintf(&to[j], tolen - j - 1,
-                            "#%02x", (unsigned int)from[i]);
+                            "#%02x", (unsigned char)from[i]);
            j += l;
        }
     }
     to[j] = '\0';
            j += l;
        }
     }
     to[j] = '\0';
+    assert(j < tolen);
     *rlen = j;
     return to;
 }
 
 
 static int
     *rlen = j;
     return to;
 }
 
 
 static int
-append_string(char **str, size_t *total_len, char *ss, size_t len, int quote)
+append_string(char **str, size_t *total_len, const char *ss, 
+             size_t len, int quote)
 {
     char *s, *qs;
 
     if (quote)
        qs = quote_string(ss, len, &len);
     else
 {
     char *s, *qs;
 
     if (quote)
        qs = quote_string(ss, len, &len);
     else
-       qs = ss;
+       qs = rk_UNCONST(ss);
 
     s = realloc(*str, len + *total_len + 1);
     if (s == NULL)
 
     s = realloc(*str, len + *total_len + 1);
     if (s == NULL)
@@ -181,10 +184,10 @@ _hx509_Name_to_string(const Name *n, char **str)
                ss = ds->u.ia5String;
                break;
            case choice_DirectoryString_printableString:
                ss = ds->u.ia5String;
                break;
            case choice_DirectoryString_printableString:
-               ss = ds->u.ia5String;
+               ss = ds->u.printableString;
                break;
            case choice_DirectoryString_utf8String:
                break;
            case choice_DirectoryString_utf8String:
-               ss = ds->u.ia5String;
+               ss = ds->u.utf8String;
                break;
            case choice_DirectoryString_bmpString: {
                uint16_t *bmp = ds->u.bmpString.data;
                break;
            case choice_DirectoryString_bmpString: {
                uint16_t *bmp = ds->u.bmpString.data;
@@ -200,11 +203,25 @@ _hx509_Name_to_string(const Name *n, char **str)
                break;
            }
            case choice_DirectoryString_teletexString:
                break;
            }
            case choice_DirectoryString_teletexString:
-               ss = "teletex-string"; /* XXX */
+               ss = malloc(ds->u.teletexString.length + 1);
+               if (ss == NULL)
+                   _hx509_abort("allocation failure"); /* XXX */
+               memcpy(ss, ds->u.teletexString.data, ds->u.teletexString.length);
+               ss[ds->u.teletexString.length] = '\0';
                break;
                break;
-           case choice_DirectoryString_universalString:
-               ss = "universalString"; /* XXX */
+           case choice_DirectoryString_universalString: {
+               uint32_t *uni = ds->u.universalString.data;
+               size_t unilen = ds->u.universalString.length;
+               size_t k;
+
+               ss = malloc(unilen + 1);
+               if (ss == NULL)
+                   _hx509_abort("allocation failure"); /* XXX */
+               for (k = 0; k < unilen; k++)
+                   ss[k] = uni[k] & 0xff; /* XXX */
+               ss[k] = '\0';
                break;
                break;
+           }
            default:
                _hx509_abort("unknown directory type: %d", ds->element);
                exit(1);
            default:
                _hx509_abort("unknown directory type: %d", ds->element);
                exit(1);
@@ -214,8 +231,12 @@ _hx509_Name_to_string(const Name *n, char **str)
            append_string(str, &total_len, "=", 1, 0);
            len = strlen(ss);
            append_string(str, &total_len, ss, len, 1);
            append_string(str, &total_len, "=", 1, 0);
            len = strlen(ss);
            append_string(str, &total_len, ss, len, 1);
-           if (ds->element == choice_DirectoryString_bmpString)
+           if (ds->element == choice_DirectoryString_universalString ||
+               ds->element == choice_DirectoryString_bmpString ||
+               ds->element == choice_DirectoryString_teletexString)
+           {
                free(ss);
                free(ss);
+           }
            if (j + 1 < n->u.rdnSequence.val[i].len)
                append_string(str, &total_len, "+", 1, 0);
        }
            if (j + 1 < n->u.rdnSequence.val[i].len)
                append_string(str, &total_len, "+", 1, 0);
        }
@@ -298,6 +319,13 @@ _hx509_name_cmp(const Name *n1, const Name *n2)
     return 0;
 }
 
     return 0;
 }
 
+int
+hx509_name_cmp(hx509_name n1, hx509_name n2)
+{
+    return _hx509_name_cmp(&n1->der_name, &n2->der_name);
+}
+
+
 int
 _hx509_name_from_Name(const Name *n, hx509_name *name)
 {
 int
 _hx509_name_from_Name(const Name *n, hx509_name *name)
 {
@@ -487,6 +515,106 @@ hx509_name_to_Name(const hx509_name from, Name *to)
     return copy_Name(&from->der_name, to);
 }
 
     return copy_Name(&from->der_name, to);
 }
 
+int
+hx509_name_normalize(hx509_context context, hx509_name name)
+{
+    return 0;
+}
+
+int
+hx509_name_expand(hx509_context context,
+                 hx509_name name,
+                 hx509_env env)
+{
+    Name *n = &name->der_name;
+    int i, j;
+
+    if (env == NULL)
+       return 0;
+
+    if (n->element != choice_Name_rdnSequence) {
+       hx509_set_error_string(context, 0, EINVAL, "RDN not of supported type");
+       return EINVAL;
+    }
+
+    for (i = 0 ; i < n->u.rdnSequence.len; i++) {
+       for (j = 0; j < n->u.rdnSequence.val[i].len; j++) {
+           /*
+             THIS SHOULD REALLY BE:
+             COMP = n->u.rdnSequence.val[i].val[j];
+             normalize COMP to utf8
+             check if there are variables
+               expand variables
+               convert back to orignal format, store in COMP
+             free normalized utf8 string
+           */
+           DirectoryString *ds = &n->u.rdnSequence.val[i].val[j].value;
+           char *p, *p2;
+           struct rk_strpool *strpool = NULL;
+
+           if (ds->element != choice_DirectoryString_utf8String) {
+               hx509_set_error_string(context, 0, EINVAL, "unsupported type");
+               return EINVAL;
+           }
+           p = strstr(ds->u.utf8String, "${");
+           if (p) {
+               strpool = rk_strpoolprintf(strpool, "%.*s", 
+                                          (int)(p - ds->u.utf8String), 
+                                          ds->u.utf8String);
+               if (strpool == NULL) {
+                   hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+                   return ENOMEM;
+               }
+           }
+           while (p != NULL) {
+               /* expand variables */
+               const char *value;
+               p2 = strchr(p, '}');
+               if (p2 == NULL) {
+                   hx509_set_error_string(context, 0, EINVAL, "missing }");
+                   rk_strpoolfree(strpool);
+                   return EINVAL;
+               }
+               p += 2;
+               value = hx509_env_lfind(context, env, p, p2 - p);
+               if (value == NULL) {
+                   hx509_set_error_string(context, 0, EINVAL, 
+                                          "variable %.*s missing",
+                                          (int)(p2 - p), p);
+                   rk_strpoolfree(strpool);
+                   return EINVAL;
+               }
+               strpool = rk_strpoolprintf(strpool, "%s", value);
+               if (strpool == NULL) {
+                   hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+                   return ENOMEM;
+               }
+               p2++;
+
+               p = strstr(p2, "${");
+               if (p)
+                   strpool = rk_strpoolprintf(strpool, "%.*s", 
+                                              (int)(p - p2), p2);
+               else
+                   strpool = rk_strpoolprintf(strpool, "%s", p2);
+               if (strpool == NULL) {
+                   hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+                   return ENOMEM;
+               }
+           }
+           if (strpool) {
+               free(ds->u.utf8String);
+               ds->u.utf8String = rk_strpoolcollect(strpool);
+               if (ds->u.utf8String == NULL) {
+                   hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+                   return ENOMEM;
+               }
+           }
+       }
+    }
+    return 0;
+}
+
 
 void
 hx509_name_free(hx509_name *name)
 
 void
 hx509_name_free(hx509_name *name)
@@ -548,3 +676,91 @@ hx509_name_is_null_p(const hx509_name name)
 {
     return name->der_name.u.rdnSequence.len == 0;
 }
 {
     return name->der_name.u.rdnSequence.len == 0;
 }
+
+int
+hx509_general_name_unparse(GeneralName *name, char **str)
+{
+    struct rk_strpool *strpool = NULL;
+
+    *str = NULL;
+
+    switch (name->element) {
+    case choice_GeneralName_otherName: {
+       char *str;
+       hx509_oid_sprint(&name->u.otherName.type_id, &str);
+       if (str == NULL)
+           return ENOMEM;
+       strpool = rk_strpoolprintf(strpool, "otherName: %s", str);
+       free(str);
+       break;
+    }
+    case choice_GeneralName_rfc822Name:
+       strpool = rk_strpoolprintf(strpool, "rfc822Name: %s\n",
+                                  name->u.rfc822Name);
+       break;
+    case choice_GeneralName_dNSName:
+       strpool = rk_strpoolprintf(strpool, "dNSName: %s\n",
+                                  name->u.dNSName);
+       break;
+    case choice_GeneralName_directoryName: {
+       Name dir;
+       char *s;
+       int ret;
+       memset(&dir, 0, sizeof(dir));
+       dir.element = name->u.directoryName.element;
+       dir.u.rdnSequence = name->u.directoryName.u.rdnSequence;
+       ret = _hx509_unparse_Name(&dir, &s);
+       if (ret)
+           return ret;
+       strpool = rk_strpoolprintf(strpool, "directoryName: %s", s);
+       free(s);
+       break;
+    }
+    case choice_GeneralName_uniformResourceIdentifier:
+       strpool = rk_strpoolprintf(strpool, "URI: %s", 
+                                  name->u.uniformResourceIdentifier);
+       break;
+    case choice_GeneralName_iPAddress: {
+       unsigned char *a = name->u.iPAddress.data;
+
+       strpool = rk_strpoolprintf(strpool, "IPAddress: ");
+       if (strpool == NULL)
+           break;
+       if (name->u.iPAddress.length == 4)
+           strpool = rk_strpoolprintf(strpool, "%d.%d.%d.%d", 
+                                      a[0], a[1], a[2], a[3]);
+       else if (name->u.iPAddress.length == 16)
+           strpool = rk_strpoolprintf(strpool, 
+                                      "%02X:%02X:%02X:%02X:"
+                                      "%02X:%02X:%02X:%02X:"
+                                      "%02X:%02X:%02X:%02X:"
+                                      "%02X:%02X:%02X:%02X", 
+                                      a[0], a[1], a[2], a[3],
+                                      a[4], a[5], a[6], a[7],
+                                      a[8], a[9], a[10], a[11],
+                                      a[12], a[13], a[14], a[15]);
+       else
+           strpool = rk_strpoolprintf(strpool, 
+                                      "unknown IP address of length %lu",
+                                      (unsigned long)name->u.iPAddress.length);
+       break;
+    }
+    case choice_GeneralName_registeredID: {
+       char *str;
+       hx509_oid_sprint(&name->u.registeredID, &str);
+       if (str == NULL)
+           return ENOMEM;
+       strpool = rk_strpoolprintf(strpool, "registeredID: %s", str);
+       free(str);
+       break;
+    }
+    default:
+       return EINVAL;
+    }
+    if (strpool == NULL)
+       return ENOMEM;
+
+    *str = rk_strpoolcollect(strpool);
+
+    return 0;
+}
index 62a2750b96e170b57632b256f0d2523bc4c4a10d..d8ecd66ccf70244b7de597d99b3f04be2aa90d15 100644 (file)
@@ -1,5 +1,5 @@
 -- From rfc2560
 -- From rfc2560
--- $Id: ocsp.asn1,v 1.4 2006/12/30 12:38:44 lha Exp $
+-- $Id: ocsp.asn1 19576 2006-12-30 12:40:43Z lha $
 OCSP DEFINITIONS EXPLICIT TAGS::=
 
 BEGIN
 OCSP DEFINITIONS EXPLICIT TAGS::=
 
 BEGIN
index f82f2877f6c6a71f26ab6a360ee97fd83f108bb9..eccedf10433831650c1019f43bed92809324d9c5 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: peer.c,v 1.1 2006/11/26 15:49:01 lha Exp $");
+RCSID("$Id: peer.c 20938 2007-06-06 20:51:34Z lha $");
 
 int
 hx509_peer_info_alloc(hx509_context context, hx509_peer_info *peer)
 
 int
 hx509_peer_info_alloc(hx509_context context, hx509_peer_info *peer)
@@ -59,14 +59,16 @@ free_cms_alg(hx509_peer_info peer)
     }
 }
 
     }
 }
 
-int
+void
 hx509_peer_info_free(hx509_peer_info peer)
 {
 hx509_peer_info_free(hx509_peer_info peer)
 {
+    if (peer == NULL)
+       return;
     if (peer->cert)
        hx509_cert_free(peer->cert);
     free_cms_alg(peer);
     memset(peer, 0, sizeof(*peer));
     if (peer->cert)
        hx509_cert_free(peer->cert);
     free_cms_alg(peer);
     memset(peer, 0, sizeof(*peer));
-    return 0;
+    free(peer);
 }
 
 int
 }
 
 int
index c33fd36cb2c9852eb7f05f6497def5dac2ce025c..518fe3bfa36a3edb045b243af1f70a8be0efe19c 100644 (file)
@@ -1,4 +1,4 @@
--- $Id: pkcs10.asn1,v 1.1 2006/04/01 09:46:57 lha Exp $
+-- $Id: pkcs10.asn1 16918 2006-04-01 09:46:57Z lha $
 PKCS10 DEFINITIONS ::=
 
 BEGIN
 PKCS10 DEFINITIONS ::=
 
 BEGIN
index 802ac12b4e7eca39875d5d9f8b5aab572ec6c856..dc9d4cfa58c5794dfb2b6b559f1f7fdf337dae36 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: print.c,v 1.15 2006/12/07 20:37:57 lha Exp $");
+RCSID("$Id: print.c 20908 2007-06-05 02:59:33Z lha $");
 
 
 struct hx509_validate_ctx_data {
 
 
 struct hx509_validate_ctx_data {
@@ -41,6 +41,18 @@ struct hx509_validate_ctx_data {
     void *ctx;
 };
 
     void *ctx;
 };
 
+struct cert_status {
+    unsigned int selfsigned:1;
+    unsigned int isca:1;
+    unsigned int isproxy:1;
+    unsigned int haveSAN:1;
+    unsigned int haveIAN:1;
+    unsigned int haveSKI:1;
+    unsigned int haveAKI:1;
+    unsigned int haveCRLDP:1;
+};
+
+
 /*
  *
  */
 /*
  *
  */
@@ -155,10 +167,16 @@ validate_print(hx509_validate_ctx ctx, int flags, const char *fmt, ...)
     va_end(va);
 }
 
     va_end(va);
 }
 
+/* 
+ * Dont Care, SHOULD critical, SHOULD NOT critical, MUST critical,
+ * MUST NOT critical
+ */
 enum critical_flag { D_C = 0, S_C, S_N_C, M_C, M_N_C };
 
 static int
 enum critical_flag { D_C = 0, S_C, S_N_C, M_C, M_N_C };
 
 static int
-check_Null(hx509_validate_ctx ctx, enum critical_flag cf, const Extension *e)
+check_Null(hx509_validate_ctx ctx,
+          struct cert_status *status,
+          enum critical_flag cf, const Extension *e)
 {
     switch(cf) {
     case D_C:
 {
     switch(cf) {
     case D_C:
@@ -191,13 +209,96 @@ check_Null(hx509_validate_ctx ctx, enum critical_flag cf, const Extension *e)
 
 static int
 check_subjectKeyIdentifier(hx509_validate_ctx ctx, 
 
 static int
 check_subjectKeyIdentifier(hx509_validate_ctx ctx, 
+                          struct cert_status *status,
                           enum critical_flag cf,
                           const Extension *e)
 {
                           enum critical_flag cf,
                           const Extension *e)
 {
-    check_Null(ctx, cf, e);
+    SubjectKeyIdentifier si;
+    size_t size;
+    int ret;
+
+    status->haveSKI = 1;
+    check_Null(ctx, status, cf, e);
+
+    ret = decode_SubjectKeyIdentifier(e->extnValue.data, 
+                                     e->extnValue.length,
+                                     &si, &size);
+    if (ret) {
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding SubjectKeyIdentifier failed: %d", ret);
+       return 1;
+    }
+    if (size != e->extnValue.length) {
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding SKI ahve extra bits on the end");
+       return 1;
+    }
+    if (si.length == 0)
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "SKI is too short (0 bytes)");
+    if (si.length > 20)
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "SKI is too long");
+
+    {
+       char *id;
+       hex_encode(si.data, si.length, &id);
+       if (id) {
+           validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
+                          "\tsubject key id: %s\n", id);
+           free(id);
+       }
+    }
+
+    free_SubjectKeyIdentifier(&si);
+
+    return 0;
+}
+
+static int
+check_authorityKeyIdentifier(hx509_validate_ctx ctx, 
+                            struct cert_status *status,
+                            enum critical_flag cf,
+                            const Extension *e)
+{
+    AuthorityKeyIdentifier ai;
+    size_t size;
+    int ret;
+
+    status->haveAKI = 1;
+    check_Null(ctx, status, cf, e);
+
+    status->haveSKI = 1;
+    check_Null(ctx, status, cf, e);
+
+    ret = decode_AuthorityKeyIdentifier(e->extnValue.data, 
+                                       e->extnValue.length,
+                                       &ai, &size);
+    if (ret) {
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding AuthorityKeyIdentifier failed: %d", ret);
+       return 1;
+    }
+    if (size != e->extnValue.length) {
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding SKI ahve extra bits on the end");
+       return 1;
+    }
+
+    if (ai.keyIdentifier) {
+       char *id;
+       hex_encode(ai.keyIdentifier->data, ai.keyIdentifier->length, &id);
+       if (id) {
+           validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
+                          "\tauthority key id: %s\n", id);
+           free(id);
+       }
+    }
+
     return 0;
 }
 
     return 0;
 }
 
+
 static int
 check_pkinit_san(hx509_validate_ctx ctx, heim_any *a)
 {
 static int
 check_pkinit_san(hx509_validate_ctx ctx, heim_any *a)
 {
@@ -206,15 +307,16 @@ check_pkinit_san(hx509_validate_ctx ctx, heim_any *a)
     size_t size;
     int ret;
 
     size_t size;
     int ret;
 
-    ret = decode_KRB5PrincipalName(a->data, a->length,
-                                  &kn, &size);
+    ret = decode_KRB5PrincipalName(a->data, a->length, &kn, &size);
     if (ret) {
     if (ret) {
-       printf("Decoding kerberos name in SAN failed: %d", ret);
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding kerberos name in SAN failed: %d", ret);
        return 1;
     }
 
     if (size != a->length) {
        return 1;
     }
 
     if (size != a->length) {
-       printf("Decoding kerberos name have extra bits on the end");
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding kerberos name have extra bits on the end");
        return 1;
     }
 
        return 1;
     }
 
@@ -233,22 +335,117 @@ check_pkinit_san(hx509_validate_ctx ctx, heim_any *a)
 }
 
 static int
 }
 
 static int
-check_dnssrv_san(hx509_validate_ctx ctx, heim_any *a)
+check_utf8_string_san(hx509_validate_ctx ctx, heim_any *a)
 {
 {
+    PKIXXmppAddr jid;
+    size_t size;
+    int ret;
+
+    ret = decode_PKIXXmppAddr(a->data, a->length, &jid, &size);
+    if (ret) {
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding JID in SAN failed: %d", ret);
+       return 1;
+    }
+
+    validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "%s", jid);
+    free_PKIXXmppAddr(&jid);
+
     return 0;
 }
 
     return 0;
 }
 
+static int
+check_altnull(hx509_validate_ctx ctx, heim_any *a)
+{
+    return 0;
+}
+
+static int
+check_CRLDistributionPoints(hx509_validate_ctx ctx, 
+                          struct cert_status *status,
+                          enum critical_flag cf,
+                          const Extension *e)
+{
+    CRLDistributionPoints dp;
+    size_t size;
+    int ret, i;
+
+    check_Null(ctx, status, cf, e);
+
+    ret = decode_CRLDistributionPoints(e->extnValue.data, 
+                                      e->extnValue.length,
+                                      &dp, &size);
+    if (ret) {
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Decoding CRL Distribution Points failed: %d\n", ret);
+       return 1;
+    }
+
+    validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "CRL Distribution Points:\n");
+    for (i = 0 ; i < dp.len; i++) {
+       if (dp.val[i].distributionPoint) {
+           DistributionPointName dpname;
+           heim_any *data = dp.val[i].distributionPoint;
+           int j;
+           
+           ret = decode_DistributionPointName(data->data, data->length,
+                                              &dpname, NULL);
+           if (ret) {
+               validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                              "Failed to parse CRL Distribution Point Name: %d\n", ret);
+               continue;
+           }
+
+           switch (dpname.element) {
+           case choice_DistributionPointName_fullName:
+               validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "Fullname:\n");
+               
+               for (j = 0 ; j < dpname.u.fullName.len; j++) {
+                   char *s;
+                   GeneralName *name = &dpname.u.fullName.val[j];
+
+                   ret = hx509_general_name_unparse(name, &s);
+                   if (ret == 0 && s != NULL) {
+                       validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "   %s\n", s);
+                       free(s);
+                   }
+               }
+               break;
+           case choice_DistributionPointName_nameRelativeToCRLIssuer:
+               validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
+                              "Unknown nameRelativeToCRLIssuer");
+               break;
+           default:
+               validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                              "Unknown DistributionPointName");
+               break;
+           }
+           free_DistributionPointName(&dpname);
+       }
+    }
+    free_CRLDistributionPoints(&dp);
+
+    status->haveCRLDP = 1;
+
+    return 0;
+}
+
+
 struct {
     const char *name;
     const heim_oid *(*oid)(void);
     int (*func)(hx509_validate_ctx, heim_any *);
 } check_altname[] = {
     { "pk-init", oid_id_pkinit_san, check_pkinit_san },
 struct {
     const char *name;
     const heim_oid *(*oid)(void);
     int (*func)(hx509_validate_ctx, heim_any *);
 } check_altname[] = {
     { "pk-init", oid_id_pkinit_san, check_pkinit_san },
-    { "dns-srv", oid_id_pkix_on_dnsSRV, check_dnssrv_san }
+    { "jabber", oid_id_pkix_on_xmppAddr, check_utf8_string_san },
+    { "dns-srv", oid_id_pkix_on_dnsSRV, check_altnull },
+    { "card-id", oid_id_uspkicommon_card_id, check_altnull },
+    { "Microsoft NT-PRINCIPAL-NAME", oid_id_pkinit_ms_san, check_utf8_string_san }
 };
 
 static int
 check_altName(hx509_validate_ctx ctx,
 };
 
 static int
 check_altName(hx509_validate_ctx ctx,
+             struct cert_status *status,
              const char *name,
              enum critical_flag cf,
              const Extension *e)
              const char *name,
              enum critical_flag cf,
              const Extension *e)
@@ -257,20 +454,24 @@ check_altName(hx509_validate_ctx ctx,
     size_t size;
     int ret, i;
 
     size_t size;
     int ret, i;
 
-    check_Null(ctx, cf, e);
+    check_Null(ctx, status, cf, e);
 
     if (e->extnValue.length == 0) {
 
     if (e->extnValue.length == 0) {
-       printf("%sAltName empty, not allowed", name);
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "%sAltName empty, not allowed", name);
        return 1;
     }
     ret = decode_GeneralNames(e->extnValue.data, e->extnValue.length,
                              &gn, &size);
     if (ret) {
        return 1;
     }
     ret = decode_GeneralNames(e->extnValue.data, e->extnValue.length,
                              &gn, &size);
     if (ret) {
-       printf("\tret = %d while decoding %s GeneralNames\n", ret, name);
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "\tret = %d while decoding %s GeneralNames\n", 
+                      ret, name);
        return 1;
     }
     if (gn.len == 0) {
        return 1;
     }
     if (gn.len == 0) {
-       printf("%sAltName generalName empty, not allowed", name);
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "%sAltName generalName empty, not allowed\n", name);
        return 1;
     }
 
        return 1;
     }
 
@@ -278,7 +479,9 @@ check_altName(hx509_validate_ctx ctx,
        switch (gn.val[i].element) {
        case choice_GeneralName_otherName: {
            unsigned j;
        switch (gn.val[i].element) {
        case choice_GeneralName_otherName: {
            unsigned j;
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "%sAltName otherName ", name);
+
+           validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
+                          "%sAltName otherName ", name);
 
            for (j = 0; j < sizeof(check_altname)/sizeof(check_altname[0]); j++) {
                if (der_heim_oid_cmp((*check_altname[j].oid)(), 
 
            for (j = 0; j < sizeof(check_altname)/sizeof(check_altname[0]); j++) {
                if (der_heim_oid_cmp((*check_altname[j].oid)(), 
@@ -298,41 +501,18 @@ check_altName(hx509_validate_ctx ctx,
            validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "\n");
            break;
        }
            validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "\n");
            break;
        }
-       case choice_GeneralName_rfc822Name:
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "rfc822Name: %s\n",
-                          gn.val[i].u.rfc822Name);
-           break;
-       case choice_GeneralName_dNSName:
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "dNSName: %s\n",
-                          gn.val[i].u.dNSName);
-           break;
-       case choice_GeneralName_directoryName: {
-           Name dir;
+       default: {
            char *s;
            char *s;
-           dir.element = gn.val[i].u.directoryName.element;
-           dir.u.rdnSequence = gn.val[i].u.directoryName.u.rdnSequence;
-           ret = _hx509_unparse_Name(&dir, &s);
+           ret = hx509_general_name_unparse(&gn.val[i], &s);
            if (ret) {
            if (ret) {
-               printf("unable to parse %sAltName directoryName\n", name);
+               validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                              "ret = %d unparsing GeneralName\n", ret);
                return 1;
            }
                return 1;
            }
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "directoryName: %s\n", s);
+           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "%s\n", s);
            free(s);
            break;
        }
            free(s);
            break;
        }
-       case choice_GeneralName_uniformResourceIdentifier:
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "uri: %s\n",
-                          gn.val[i].u.uniformResourceIdentifier);
-           break;
-       case choice_GeneralName_iPAddress:
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "ip address\n");
-           break;
-       case choice_GeneralName_registeredID:
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "registered id: ");
-               hx509_oid_print(&gn.val[i].u.registeredID,
-                               validate_vprint, ctx);
-           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "\n");
-           break;
        }
     }
 
        }
     }
 
@@ -343,23 +523,28 @@ check_altName(hx509_validate_ctx ctx,
 
 static int
 check_subjectAltName(hx509_validate_ctx ctx,
 
 static int
 check_subjectAltName(hx509_validate_ctx ctx,
+                    struct cert_status *status,
                     enum critical_flag cf,
                     const Extension *e)
 {
                     enum critical_flag cf,
                     const Extension *e)
 {
-    return check_altName(ctx, "subject", cf, e);
+    status->haveSAN = 1;
+    return check_altName(ctx, status, "subject", cf, e);
 }
 
 static int
 check_issuerAltName(hx509_validate_ctx ctx,
 }
 
 static int
 check_issuerAltName(hx509_validate_ctx ctx,
+                   struct cert_status *status,
                     enum critical_flag cf,
                     const Extension *e)
 {
                     enum critical_flag cf,
                     const Extension *e)
 {
-    return check_altName(ctx, "issuer", cf, e);
+    status->haveIAN = 1;
+    return check_altName(ctx, status, "issuer", cf, e);
 }
 
 
 static int
 check_basicConstraints(hx509_validate_ctx ctx, 
 }
 
 
 static int
 check_basicConstraints(hx509_validate_ctx ctx, 
+                      struct cert_status *status,
                       enum critical_flag cf, 
                       const Extension *e)
 {
                       enum critical_flag cf, 
                       const Extension *e)
 {
@@ -367,7 +552,7 @@ check_basicConstraints(hx509_validate_ctx ctx,
     size_t size;
     int ret;
 
     size_t size;
     int ret;
 
-    check_Null(ctx, cf, e);
+    check_Null(ctx, status, cf, e);
     
     ret = decode_BasicConstraints(e->extnValue.data, e->extnValue.length,
                                  &b, &size);
     
     ret = decode_BasicConstraints(e->extnValue.data, e->extnValue.length,
                                  &b, &size);
@@ -384,6 +569,30 @@ check_basicConstraints(hx509_validate_ctx ctx,
        validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                       "\tpathLenConstraint: %d\n", *b.pathLenConstraint);
 
        validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                       "\tpathLenConstraint: %d\n", *b.pathLenConstraint);
 
+    if (b.cA) {
+       if (*b.cA) {
+           if (!e->critical)
+               validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                              "Is a CA and not BasicConstraints CRITICAL\n");
+           status->isca = 1;
+       }
+       else
+           validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                          "cA is FALSE, not allowed to be\n");
+    }
+    free_BasicConstraints(&b);
+
+    return 0;
+}
+
+static int
+check_proxyCertInfo(hx509_validate_ctx ctx, 
+                   struct cert_status *status,
+                   enum critical_flag cf, 
+                   const Extension *e)
+{
+    status->isproxy = 1;
+
     return 0;
 }
 
     return 0;
 }
 
@@ -391,6 +600,7 @@ struct {
     const char *name;
     const heim_oid *(*oid)(void);
     int (*func)(hx509_validate_ctx ctx, 
     const char *name;
     const heim_oid *(*oid)(void);
     int (*func)(hx509_validate_ctx ctx, 
+               struct cert_status *status,
                enum critical_flag cf, 
                const Extension *);
     enum critical_flag cf;
                enum critical_flag cf, 
                const Extension *);
     enum critical_flag cf;
@@ -401,7 +611,7 @@ struct {
     { ext(keyUsage, Null), S_C },
     { ext(subjectAltName, subjectAltName), M_N_C },
     { ext(issuerAltName, issuerAltName), S_N_C },
     { ext(keyUsage, Null), S_C },
     { ext(subjectAltName, subjectAltName), M_N_C },
     { ext(issuerAltName, issuerAltName), S_N_C },
-    { ext(basicConstraints, basicConstraints), M_C },
+    { ext(basicConstraints, basicConstraints), D_C },
     { ext(cRLNumber, Null), M_N_C },
     { ext(cRLReason, Null), M_N_C },
     { ext(holdInstructionCode, Null), M_N_C },
     { ext(cRLNumber, Null), M_N_C },
     { ext(cRLReason, Null), M_N_C },
     { ext(holdInstructionCode, Null), M_N_C },
@@ -410,14 +620,20 @@ struct {
     { ext(issuingDistributionPoint, Null), M_C },
     { ext(certificateIssuer, Null), M_C },
     { ext(nameConstraints, Null), M_C },
     { ext(issuingDistributionPoint, Null), M_C },
     { ext(certificateIssuer, Null), M_C },
     { ext(nameConstraints, Null), M_C },
-    { ext(cRLDistributionPoints, Null), S_N_C },
+    { ext(cRLDistributionPoints, CRLDistributionPoints), S_N_C },
     { ext(certificatePolicies, Null) },
     { ext(policyMappings, Null), M_N_C },
     { ext(certificatePolicies, Null) },
     { ext(policyMappings, Null), M_N_C },
-    { ext(authorityKeyIdentifier, Null), M_N_C },
+    { ext(authorityKeyIdentifier, authorityKeyIdentifier), M_N_C },
     { ext(policyConstraints, Null), D_C },
     { ext(extKeyUsage, Null), D_C },
     { ext(freshestCRL, Null), M_N_C },
     { ext(inhibitAnyPolicy, Null), M_C },
     { ext(policyConstraints, Null), D_C },
     { ext(extKeyUsage, Null), D_C },
     { ext(freshestCRL, Null), M_N_C },
     { ext(inhibitAnyPolicy, Null), M_C },
+    { "proxyCertInfo", oid_id_pe_proxyCertInfo, 
+      check_proxyCertInfo, M_C },
+    { "US Fed PKI - PIV Interim", oid_id_uspkicommon_piv_interim, 
+      check_Null, D_C },
+    { "Netscape cert comment", oid_id_netscape_cert_comment, 
+      check_Null, D_C },
     { NULL }
 };
 
     { NULL }
 };
 
@@ -459,31 +675,45 @@ hx509_validate_cert(hx509_context context,
 {
     Certificate *c = _hx509_get_cert(cert);
     TBSCertificate *t = &c->tbsCertificate;
 {
     Certificate *c = _hx509_get_cert(cert);
     TBSCertificate *t = &c->tbsCertificate;
-    hx509_name name;
+    hx509_name issuer, subject;
     char *str;
     char *str;
+    struct cert_status status;
+    int ret;
+
+    memset(&status, 0, sizeof(status));
 
     if (_hx509_cert_get_version(c) != 3)
        validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                       "Not version 3 certificate\n");
     
 
     if (_hx509_cert_get_version(c) != 3)
        validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                       "Not version 3 certificate\n");
     
-    if (t->version && *t->version < 2 && t->extensions)
+    if ((t->version == NULL || *t->version < 2) && t->extensions)
        validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
                       "Not version 3 certificate with extensions\n");
        
        validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
                       "Not version 3 certificate with extensions\n");
        
-    _hx509_name_from_Name(&t->subject, &name);
-    hx509_name_to_string(name, &str);
-    hx509_name_free(&name);
+    if (_hx509_cert_get_version(c) >= 3 && t->extensions == NULL)
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE,
+                      "Version 3 certificate without extensions\n");
+
+    ret = hx509_cert_get_subject(cert, &subject);
+    if (ret) abort();
+    hx509_name_to_string(subject, &str);
     validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                   "subject name: %s\n", str);
     free(str);
 
     validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                   "subject name: %s\n", str);
     free(str);
 
-    _hx509_name_from_Name(&t->issuer, &name);
-    hx509_name_to_string(name, &str);
-    hx509_name_free(&name);
+    ret = hx509_cert_get_issuer(cert, &issuer);
+    if (ret) abort();
+    hx509_name_to_string(issuer, &str);
     validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                   "issuer name: %s\n", str);
     free(str);
 
     validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                   "issuer name: %s\n", str);
     free(str);
 
+    if (hx509_name_cmp(subject, issuer) == 0) {
+       status.selfsigned = 1;
+       validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
+                      "\tis a self-signed certificate\n");
+    }
+
     validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                   "Validity:\n");
 
     validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
                   "Validity:\n");
 
@@ -528,11 +758,68 @@ hx509_validate_cert(hx509_context context,
                           "checking extention: %s\n",
                           check_extension[j].name);
            (*check_extension[j].func)(ctx,
                           "checking extention: %s\n",
                           check_extension[j].name);
            (*check_extension[j].func)(ctx,
+                                      &status,
                                       check_extension[j].cf,
                                       &t->extensions->val[i]);
        }
     } else
        validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "no extentions\n");
        
                                       check_extension[j].cf,
                                       &t->extensions->val[i]);
        }
     } else
        validate_print(ctx, HX509_VALIDATE_F_VERBOSE, "no extentions\n");
        
+    if (status.isca) {
+       if (!status.haveSKI)
+           validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                          "CA certificate have no SubjectKeyIdentifier\n");
+
+    } else {
+       if (!status.haveAKI)
+           validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                          "Is not CA and doesn't have "
+                          "AuthorityKeyIdentifier\n");
+    }
+           
+
+    if (!status.haveSKI)
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                      "Doesn't have SubjectKeyIdentifier\n");
+
+    if (status.isproxy && status.isca)
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                      "Proxy and CA at the same time!\n");
+
+    if (status.isproxy) {
+       if (status.haveSAN)
+           validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                          "Proxy and have SAN\n");
+       if (status.haveIAN)
+           validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                          "Proxy and have IAN\n");
+    }
+
+    if (hx509_name_is_null_p(subject) && !status.haveSAN)
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                      "NULL subject DN and doesn't have a SAN\n");
+
+    if (!status.selfsigned && !status.haveCRLDP)
+       validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                      "Not a CA nor PROXY and doesn't have"
+                      "CRL Dist Point\n");
+
+    if (status.selfsigned) {
+       ret = _hx509_verify_signature_bitstring(context,
+                                               c,
+                                               &c->signatureAlgorithm,
+                                               &c->tbsCertificate._save,
+                                               &c->signatureValue);
+       if (ret == 0)
+           validate_print(ctx, HX509_VALIDATE_F_VERBOSE, 
+                          "Self-signed certificate was self-signed\n");
+       else
+           validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+                          "Self-signed certificate NOT really self-signed!\n");
+    }
+
+    hx509_name_free(&subject);
+    hx509_name_free(&issuer);
+
     return 0;
 }
     return 0;
 }
index ca7baa514b61f729dba982a8351c4bb24877ee81..34e3a4ea27c22ff6a85b0ad4fcf520877a1e58b5 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "hx_locl.h"
 #include <pkcs10_asn1.h>
 
 #include "hx_locl.h"
 #include <pkcs10_asn1.h>
-RCSID("$Id: req.c,v 1.7 2007/01/04 20:20:11 lha Exp $");
+RCSID("$Id: req.c 20934 2007-06-06 15:30:02Z lha $");
 
 struct hx509_request_data {
     hx509_name name;
 
 struct hx509_request_data {
     hx509_name name;
@@ -191,7 +191,7 @@ _hx509_request_to_pkcs10(hx509_context context,
 
     ret = _hx509_create_signature(context,
                                  signer,
 
     ret = _hx509_create_signature(context,
                                  signer,
-                                 hx509_signature_rsa_with_sha1(),
+                                 _hx509_crypto_default_sig_alg,
                                  &data,
                                  &r.signatureAlgorithm,
                                  &os);
                                  &data,
                                  &r.signatureAlgorithm,
                                  &os);
index 8067b29c1092f472391f576047a91d24083d4f5b..0d477945c88d1e6641fd4ca506013790dc0d151b 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: revoke.c,v 1.32 2006/12/30 17:09:06 lha Exp $");
+RCSID("$Id: revoke.c 20871 2007-06-03 21:22:51Z lha $");
 
 struct revoke_crl {
     char *path;
 
 struct revoke_crl {
     char *path;
@@ -281,8 +281,11 @@ load_ocsp(hx509_context context, struct revoke_ocsp *ocsp)
 
     ret = parse_ocsp_basic(data, length, &basic);
     _hx509_unmap_file(data, length);
 
     ret = parse_ocsp_basic(data, length, &basic);
     _hx509_unmap_file(data, length);
-    if (ret)
+    if (ret) {
+       hx509_set_error_string(context, 0, ret,
+                              "Failed to parse OCSP response");
        return ret;
        return ret;
+    }
 
     if (basic.certs) {
        int i;
 
     if (basic.certs) {
        int i;
@@ -442,7 +445,8 @@ verify_crl(hx509_context context,
                                            &crl->tbsCertList._save,
                                            &crl->signatureValue);
     if (ret) {
                                            &crl->tbsCertList._save,
                                            &crl->signatureValue);
     if (ret) {
-       hx509_set_error_string(context, HX509_ERROR_APPEND, ret, "CRL signature invalid");
+       hx509_set_error_string(context, HX509_ERROR_APPEND, ret,
+                              "CRL signature invalid");
        goto out;
     }
 
        goto out;
     }
 
@@ -800,7 +804,7 @@ hx509_ocsp_request(hx509_context context,
     memset(&req, 0, sizeof(req));
 
     if (digest == NULL)
     memset(&req, 0, sizeof(req));
 
     if (digest == NULL)
-       digest = hx509_signature_sha1();
+       digest = _hx509_crypto_default_digest_alg;
 
     ctx.req = &req.tbsRequest;
     ctx.certs = pool;
 
     ctx.req = &req.tbsRequest;
     ctx.certs = pool;
@@ -922,7 +926,7 @@ hx509_revoke_ocsp_print(hx509_context context, const char *path, FILE *out)
     fprintf(out, "replies: %d\n", ocsp.ocsp.tbsResponseData.responses.len);
 
     for (i = 0; i < ocsp.ocsp.tbsResponseData.responses.len; i++) {
     fprintf(out, "replies: %d\n", ocsp.ocsp.tbsResponseData.responses.len);
 
     for (i = 0; i < ocsp.ocsp.tbsResponseData.responses.len; i++) {
-       char *status;
+       const char *status;
        switch (ocsp.ocsp.tbsResponseData.responses.val[i].certStatus.element) {
        case choice_OCSPCertStatus_good:
            status = "good";
        switch (ocsp.ocsp.tbsResponseData.responses.val[i].certStatus.element) {
        case choice_OCSPCertStatus_good:
            status = "good";
@@ -955,6 +959,12 @@ hx509_revoke_ocsp_print(hx509_context context, const char *path, FILE *out)
     return ret;
 }
 
     return ret;
 }
 
+/*
+ * Verify that the `cert' is part of the OCSP reply and its not
+ * expired. Doesn't verify signature the OCSP reply or its done by a
+ * authorized sender, that is assumed to be already done.
+ */
+
 int
 hx509_ocsp_verify(hx509_context context,
                  time_t now,
 int
 hx509_ocsp_verify(hx509_context context,
                  time_t now,
@@ -967,12 +977,17 @@ hx509_ocsp_verify(hx509_context context,
     OCSPBasicOCSPResponse basic;
     int ret, i;
 
     OCSPBasicOCSPResponse basic;
     int ret, i;
 
+    if (now == 0)
+       now = time(NULL);
+
     *expiration = 0;
 
     ret = parse_ocsp_basic(data, length, &basic);
     *expiration = 0;
 
     ret = parse_ocsp_basic(data, length, &basic);
-    if (ret)
+    if (ret) {
+       hx509_set_error_string(context, 0, ret,
+                              "Failed to parse OCSP response");
        return ret;
        return ret;
-
+    }
 
     for (i = 0; i < basic.tbsResponseData.responses.len; i++) {
 
 
     for (i = 0; i < basic.tbsResponseData.responses.len; i++) {
 
@@ -1003,18 +1018,244 @@ hx509_ocsp_verify(hx509_context context,
            now + context->ocsp_time_diff)
            continue;
 
            now + context->ocsp_time_diff)
            continue;
 
-       /* don't allow the next updte to be in the past */
+       /* don't allow the next update to be in the past */
        if (basic.tbsResponseData.responses.val[i].nextUpdate) {
            if (*basic.tbsResponseData.responses.val[i].nextUpdate < now)
                continue;
        if (basic.tbsResponseData.responses.val[i].nextUpdate) {
            if (*basic.tbsResponseData.responses.val[i].nextUpdate < now)
                continue;
+           *expiration = *basic.tbsResponseData.responses.val[i].nextUpdate;
        } else
        } else
-           continue;
-
-       *expiration = *basic.tbsResponseData.responses.val[i].nextUpdate;
+           *expiration = now;
 
 
+       free_OCSPBasicOCSPResponse(&basic);
        return 0;
     }
        return 0;
     }
+
     free_OCSPBasicOCSPResponse(&basic);
 
     free_OCSPBasicOCSPResponse(&basic);
 
+    {
+       hx509_name name;
+       char *subject;
+       
+       ret = hx509_cert_get_subject(cert, &name);
+       if (ret) {
+           hx509_clear_error_string(context);
+           goto out;
+       }
+       ret = hx509_name_to_string(name, &subject);
+       hx509_name_free(&name);
+       if (ret) {
+           hx509_clear_error_string(context);
+           goto out;
+       }
+       hx509_set_error_string(context, 0, HX509_CERT_NOT_IN_OCSP,
+                              "Certificate %s not in OCSP response "
+                              "or not good",
+                              subject);
+       free(subject);
+    }
+out:
+    return HX509_CERT_NOT_IN_OCSP;
+}
+
+struct hx509_crl {
+    hx509_certs revoked;
+    time_t expire;
+};
+
+int
+hx509_crl_alloc(hx509_context context, hx509_crl *crl)
+{
+    int ret;
+
+    *crl = calloc(1, sizeof(**crl));
+    if (*crl == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+
+    ret = hx509_certs_init(context, "MEMORY:crl", 0, NULL, &(*crl)->revoked);
+    if (ret) {
+       free(*crl);
+       *crl = NULL;
+    }
+    (*crl)->expire = 0;
+    return ret;
+}
+
+int
+hx509_crl_add_revoked_certs(hx509_context context,
+                           hx509_crl crl, 
+                           hx509_certs certs)
+{
+    return hx509_certs_merge(context, crl->revoked, certs);
+}
+
+int
+hx509_crl_lifetime(hx509_context context, hx509_crl crl, int delta)
+{
+    crl->expire = time(NULL) + delta;
+    return 0;
+}
+
+
+void
+hx509_crl_free(hx509_context context, hx509_crl *crl)
+{
+    if (*crl == NULL)
+       return;
+    hx509_certs_free(&(*crl)->revoked);
+    memset(*crl, 0, sizeof(**crl));
+    free(*crl);
+    *crl = NULL;
+}
+
+static int
+add_revoked(hx509_context context, void *ctx, hx509_cert cert)
+{
+    TBSCRLCertList *c = ctx;
+    unsigned int num;
+    void *ptr;
+    int ret;
+
+    num = c->revokedCertificates->len;
+    ptr = realloc(c->revokedCertificates->val,
+                 (num + 1) * sizeof(c->revokedCertificates->val[0]));
+    if (ptr == NULL) {
+       hx509_clear_error_string(context);
+       return ENOMEM;
+    }
+    c->revokedCertificates->val = ptr;
+
+    ret = hx509_cert_get_serialnumber(cert, 
+                                     &c->revokedCertificates->val[num].userCertificate);
+    if (ret) {
+       hx509_clear_error_string(context);
+       return ret;
+    }
+    c->revokedCertificates->val[num].revocationDate.element = 
+       choice_Time_generalTime;
+    c->revokedCertificates->val[num].revocationDate.u.generalTime =
+       time(NULL) - 3600 * 24;
+    c->revokedCertificates->val[num].crlEntryExtensions = NULL;
+
+    c->revokedCertificates->len++;
+
+    return 0;
+}    
+
+
+int
+hx509_crl_sign(hx509_context context,
+              hx509_cert signer,
+              hx509_crl crl,
+              heim_octet_string *os)
+{
+    const AlgorithmIdentifier *sigalg = _hx509_crypto_default_sig_alg;
+    CRLCertificateList c;
+    size_t size;
+    int ret;
+    hx509_private_key signerkey;
+
+    memset(&c, 0, sizeof(c));
+
+    signerkey = _hx509_cert_private_key(signer);
+    if (signerkey == NULL) {
+       ret = HX509_PRIVATE_KEY_MISSING;
+       hx509_set_error_string(context, 0, ret,
+                              "Private key missing for CRL signing");
+       return ret;
+    }
+
+    c.tbsCertList.version = malloc(sizeof(*c.tbsCertList.version));
+    if (c.tbsCertList.version == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       return ENOMEM;
+    }
+
+    *c.tbsCertList.version = 1;
+
+    ret = copy_AlgorithmIdentifier(sigalg, &c.tbsCertList.signature);
+    if (ret) {
+       hx509_clear_error_string(context);
+       goto out;
+    }
+
+    ret = copy_Name(&_hx509_get_cert(signer)->tbsCertificate.issuer,
+                   &c.tbsCertList.issuer);
+    if (ret) {
+       hx509_clear_error_string(context);
+       goto out;
+    }
+
+    c.tbsCertList.thisUpdate.element = choice_Time_generalTime;
+    c.tbsCertList.thisUpdate.u.generalTime = time(NULL) - 24 * 3600;
+
+    c.tbsCertList.nextUpdate = malloc(sizeof(*c.tbsCertList.nextUpdate));
+    if (c.tbsCertList.nextUpdate == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       ret = ENOMEM;
+       goto out;
+    }
+
+    {
+       time_t next = crl->expire;
+       if (next == 0)
+           next = time(NULL) + 24 * 3600 * 365;
+
+       c.tbsCertList.nextUpdate->element = choice_Time_generalTime;
+       c.tbsCertList.nextUpdate->u.generalTime = next;
+    }
+
+    c.tbsCertList.revokedCertificates = 
+       calloc(1, sizeof(*c.tbsCertList.revokedCertificates));
+    if (c.tbsCertList.revokedCertificates == NULL) {
+       hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+       ret = ENOMEM;
+       goto out;
+    }
+    c.tbsCertList.crlExtensions = NULL;
+
+    ret = hx509_certs_iter(context, crl->revoked, add_revoked, &c.tbsCertList);
+    if (ret)
+       goto out;
+
+    /* if not revoked certs, remove OPTIONAL entry */
+    if (c.tbsCertList.revokedCertificates->len == 0) {
+       free(c.tbsCertList.revokedCertificates);
+       c.tbsCertList.revokedCertificates = NULL;
+    }
+
+    ASN1_MALLOC_ENCODE(TBSCRLCertList, os->data, os->length,
+                      &c.tbsCertList, &size, ret);
+    if (ret) {
+       hx509_set_error_string(context, 0, ret, "failed to encode tbsCRL");
+       goto out;
+    }
+    if (size != os->length)
+       _hx509_abort("internal ASN.1 encoder error");
+
+
+    ret = _hx509_create_signature_bitstring(context,
+                                           signerkey,
+                                           sigalg,
+                                           os,
+                                           &c.signatureAlgorithm,
+                                           &c.signatureValue);
+    free(os->data);
+
+    ASN1_MALLOC_ENCODE(CRLCertificateList, os->data, os->length,
+                      &c, &size, ret);
+    free_CRLCertificateList(&c);
+    if (ret) {
+       hx509_set_error_string(context, 0, ret, "failed to encode CRL");
+       goto out;
+    }
+    if (size != os->length)
+       _hx509_abort("internal ASN.1 encoder error");
+
     return 0;
     return 0;
+
+out:
+    free_CRLCertificateList(&c);
+    return ret;
 }
 }
index 9017e54ab1f67cbcb1a138e126017c7ab2b69c67..2c6dd516cb8001c49307bb411d92b6211c3ad40e 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -32,7 +32,7 @@
  */
 
 #include "hx_locl.h"
  */
 
 #include "hx_locl.h"
-RCSID("$Id: test_name.c,v 1.6 2006/12/30 23:04:54 lha Exp $");
+RCSID("$Id: test_name.c 19882 2007-01-13 01:02:57Z lha $");
 
 static int
 test_name(hx509_context context, const char *name)
 
 static int
 test_name(hx509_context context, const char *name)
@@ -69,6 +69,39 @@ test_name_fail(hx509_context context, const char *name)
     return 1;
 }
 
     return 1;
 }
 
+static int
+test_expand(hx509_context context, const char *name, const char *expected)
+{
+    hx509_env env;
+    hx509_name n;
+    char *s;
+    int ret;
+
+    hx509_env_init(context, &env);
+    hx509_env_add(context, env, "uid", "lha");
+
+    ret = hx509_parse_name(context, name, &n);
+    if (ret)
+       return 1;
+
+    ret = hx509_name_expand(context, n, env);
+    hx509_env_free(&env);
+    if (ret)
+       return 1;
+
+    ret = hx509_name_to_string(n, &s);
+    hx509_name_free(&n);
+    if (ret)
+       return 1;
+    
+    ret = strcmp(s, expected) != 0;
+    free(s);
+    if (ret)
+       return 1;
+
+    return 0;
+}
+
 int
 main(int argc, char **argv)
 {
 int
 main(int argc, char **argv)
 {
@@ -86,6 +119,13 @@ main(int argc, char **argv)
     ret += test_name_fail(context, "CN=foo,=foo");
     ret += test_name_fail(context, "CN=foo,really-unknown-type=foo");
 
     ret += test_name_fail(context, "CN=foo,=foo");
     ret += test_name_fail(context, "CN=foo,really-unknown-type=foo");
 
+    ret += test_expand(context, "UID=${uid},C=SE", "UID=lha,C=SE");
+    ret += test_expand(context, "UID=foo${uid},C=SE", "UID=foolha,C=SE");
+    ret += test_expand(context, "UID=${uid}bar,C=SE", "UID=lhabar,C=SE");
+    ret += test_expand(context, "UID=f${uid}b,C=SE", "UID=flhab,C=SE");
+    ret += test_expand(context, "UID=${uid}${uid},C=SE", "UID=lhalha,C=SE");
+    ret += test_expand(context, "UID=${uid}{uid},C=SE", "UID=lha{uid},C=SE");
+
     hx509_context_free(&context);
 
     return ret;
     hx509_context_free(&context);
 
     return ret;
index d20c24699be5489d371f0f30f6c8e72fd74ddc5d..999ce7f120408094beff45d5367f763ee8f0d244 100644 (file)
@@ -37,7 +37,7 @@
 #include <dlfcn.h>
 #endif
 
 #include <dlfcn.h>
 #endif
 
-RCSID("$Id: acache.c,v 1.17 2007/01/08 15:31:01 lha Exp $");
+RCSID("$Id: acache.c 19764 2007-01-08 15:31:01Z lha $");
 
 /* XXX should we fetch these for each open ? */
 static HEIMDAL_MUTEX acc_mutex = HEIMDAL_MUTEX_INITIALIZER;
 
 /* XXX should we fetch these for each open ? */
 static HEIMDAL_MUTEX acc_mutex = HEIMDAL_MUTEX_INITIALIZER;
index 3b9773bebb16ae47dc3e209b59e7cc22b448cc48..a6005c685903718938abb0b8021eefad3953e2ea 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: add_et_list.c,v 1.3 2004/04/13 14:33:45 lha Exp $");
+RCSID("$Id: add_et_list.c 13713 2004-04-13 14:33:45Z lha $");
 
 /*
  * Add a specified list of error messages to the et list in context.
 
 /*
  * Add a specified list of error messages to the et list in context.
index f68be423b068c087e95ab035a5af07834b064f41..8c3184305817f208ac8893376ff141c7e7c8578a 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: addr_families.c,v 1.53 2006/10/22 06:54:00 lha Exp $");
+RCSID("$Id: addr_families.c 18805 2006-10-22 06:54:00Z lha $");
 
 struct addr_operations {
     int af;
 
 struct addr_operations {
     int af;
index 03fa933b6fc8e3fa12b78d04932e330e41ce37e7..b0bb171f4a14816908e091ac6d3bde9ea8b6f473 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: appdefault.c,v 1.10 2005/01/05 05:40:59 lukeh Exp $");
+RCSID("$Id: appdefault.c 14465 2005-01-05 05:40:59Z lukeh $");
 
 void KRB5_LIB_FUNCTION
 krb5_appdefault_boolean(krb5_context context, const char *appname, 
 
 void KRB5_LIB_FUNCTION
 krb5_appdefault_boolean(krb5_context context, const char *appname, 
index b07e0585504f9c52f5f576dcfbd02db2db677914..6b7d40d4537fbc148edca3333cdbc464879994c7 100644 (file)
@@ -37,7 +37,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: asn1_glue.c,v 1.10 2006/10/06 17:02:48 lha Exp $");
+RCSID("$Id: asn1_glue.c 18269 2006-10-06 17:02:48Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 _krb5_principal2principalname (PrincipalName *p,
 
 krb5_error_code KRB5_LIB_FUNCTION
 _krb5_principal2principalname (PrincipalName *p,
@@ -47,23 +47,14 @@ _krb5_principal2principalname (PrincipalName *p,
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
-_krb5_principalname2krb5_principal (krb5_context context, 
+_krb5_principalname2krb5_principal (krb5_context context,
                                    krb5_principal *principal,
                                    const PrincipalName from,
                                    const Realm realm)
 {
                                    krb5_principal *principal,
                                    const PrincipalName from,
                                    const Realm realm)
 {
-    if (from.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
-           if (from.name_string.len != 1) {
-                   return KRB5_PARSE_MALFORMED;
-           }
-           return krb5_parse_name(context, 
-                                  from.name_string.val[0],
-                                  principal);
-    } else {
-           krb5_principal p = malloc(sizeof(*p));
-           copy_PrincipalName(&from, &p->name);
-           p->realm = strdup(realm);
-           *principal = p;
-    }
+    krb5_principal p = malloc(sizeof(*p));
+    copy_PrincipalName(&from, &p->name);
+    p->realm = strdup(realm);
+    *principal = p;
     return 0;
 }
     return 0;
 }
index b8ce65d9a5efe36ae373adb0aa6dfc78bbe88070..5e08f15ad46102957b810ae7cc363f636f90f256 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: auth_context.c,v 1.62 2005/01/05 02:34:08 lukeh Exp $");
+RCSID("$Id: auth_context.c 14452 2005-01-05 02:34:08Z lukeh $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_auth_con_init(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_auth_con_init(krb5_context context,
index e11744cc3aa7687ed901909341e7c913c7fbe5a5..b1968fe817b78db20063a50649ce5b8101cf7354 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: build_ap_req.c,v 1.20 2004/05/25 21:18:17 lha Exp $");
+RCSID("$Id: build_ap_req.c 13863 2004-05-25 21:46:46Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_build_ap_req (krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_build_ap_req (krb5_context context,
index 9eff09bb0a5d3c0106298de3b71548b52b19ac89..f8739c044d161f5a69a2e5676e50f2f5584861f7 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: build_auth.c,v 1.43 2006/04/10 08:53:21 lha Exp $");
+RCSID("$Id: build_auth.c 17033 2006-04-10 08:53:21Z lha $");
 
 static krb5_error_code
 make_etypelist(krb5_context context,
 
 static krb5_error_code
 make_etypelist(krb5_context context,
index a96870a7de9201805eb5b8c03b480eafcd6add33..5be3935f2bbe812df53c726917779db3e5e337ef 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: cache.c,v 1.82 2006/09/12 17:35:33 lha Exp $");
+RCSID("$Id: cache.c 20503 2007-04-21 22:03:56Z lha $");
 
 /*
  * Add a new ccache type with operations `ops', overwriting any
 
 /*
  * Add a new ccache type with operations `ops', overwriting any
@@ -473,7 +473,8 @@ krb5_cc_store_cred(krb5_context context,
 
 /*
  * Retrieve the credential identified by `mcreds' (and `whichfields')
 
 /*
  * Retrieve the credential identified by `mcreds' (and `whichfields')
- * from `id' in `creds'.
+ * from `id' in `creds'. 'creds' must be free by the caller using
+ * krb5_free_cred_contents.
  * Return 0 or an error code.
  */
 
  * Return 0 or an error code.
  */
 
index ba584a04a44d6e64017475f5914675ce13ba7a09..3ceb6df89cabb60b825003ad04e563178274738f 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: changepw.c,v 1.56 2006/05/05 09:26:47 lha Exp $");
+RCSID("$Id: changepw.c 17442 2006-05-05 09:31:15Z lha $");
 
 static void
 str2data (krb5_data *d,
 
 static void
 str2data (krb5_data *d,
index 080e8a6511bc6d7cc8ffdb0595da328554b52d3d..0d36b4b4426856f287d221d939ce880333938550 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: codec.c,v 1.9 2004/05/25 21:19:37 lha Exp $");
+RCSID("$Id: codec.c 13863 2004-05-25 21:46:46Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_decode_EncTicketPart (krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_decode_EncTicketPart (krb5_context context,
index bbd9cf4c781550f5aa3e07954c3a75e6213c2841..ac5eba39dcff4e4bcf29fae134c68269ca574618 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: config_file.c,v 1.55 2006/12/04 23:35:54 lha Exp $");
+RCSID("$Id: config_file.c 19213 2006-12-04 23:36:36Z lha $");
 
 #ifndef HAVE_NETINFO
 
 
 #ifndef HAVE_NETINFO
 
index 6e72509ab6a30dc7b319f6a6be5c1dbc439845a5..1e01e7c5ffbce954e1e16e702003ebae2c59c416 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: config_file_netinfo.c,v 1.4 2004/05/25 21:20:18 lha Exp $");
+RCSID("$Id: config_file_netinfo.c 13863 2004-05-25 21:46:46Z lha $");
 
 /*
  * Netinfo implementation from Luke Howard <lukeh@xedoc.com.au>
 
 /*
  * Netinfo implementation from Luke Howard <lukeh@xedoc.com.au>
index 89ebc34a1a8f2a5ff489ddcc4222f712e765081a..5188a1d3a86479663256c95dc9e79a669295a583 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: constants.c,v 1.8 2004/09/23 07:57:37 joda Exp $");
+RCSID("$Id: constants.c 14253 2004-09-23 07:57:37Z joda $");
 
 const char *krb5_config_file = 
 #ifdef __APPLE__
 
 const char *krb5_config_file = 
 #ifdef __APPLE__
index d0317da37554433e23786be05a1619eeb9f00856..b54e293a602a765005d95003ee6e25be45e9acc4 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include <com_err.h>
 
 #include "krb5_locl.h"
 #include <com_err.h>
 
-RCSID("$Id: context.c,v 1.112 2006/11/24 14:24:33 lha Exp $");
+RCSID("$Id: context.c 19107 2006-11-24 14:24:33Z lha $");
 
 #define INIT_FIELD(C, T, E, D, F)                                      \
     (C)->E = krb5_config_get_ ## T ## _default ((C), NULL, (D),        \
 
 #define INIT_FIELD(C, T, E, D, F)                                      \
     (C)->E = krb5_config_get_ ## T ## _default ((C), NULL, (D),        \
index bff56a260248fa00f933617b10ce57f0c6fbcb25..1d1b4d70706a01a39df07fd6500fabdaeedf87f7 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: convert_creds.c,v 1.32 2005/04/23 19:40:57 lha Exp $");
+RCSID("$Id: convert_creds.c 14897 2005-04-23 19:40:57Z lha $");
 
 #include "krb5-v4compat.h"
 
 
 #include "krb5-v4compat.h"
 
index eb77fba024e22391db60fd24af8a72c5a71a3d27..4e668c2a14f128307fc8605527c804b4368420dd 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: copy_host_realm.c,v 1.5 2004/05/25 21:21:17 lha Exp $");
+RCSID("$Id: copy_host_realm.c 13863 2004-05-25 21:46:46Z lha $");
 
 /*
  * Copy the list of realms from `from' to `to'.
 
 /*
  * Copy the list of realms from `from' to `to'.
index 4cfed751545ae7f12f0c067b2e6b504c4e6de8af..072c29d68974735a2399cbb09730e4cfa14dfea4 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: crc.c,v 1.10 2006/05/05 09:27:09 lha Exp $");
+RCSID("$Id: crc.c 17442 2006-05-05 09:31:15Z lha $");
 
 static u_long table[256];
 
 
 static u_long table[256];
 
index 2afd0725f1dfda4f66c8d04a2921702b1adb2362..d4d83162f1e471073a2ce7a1be8e28cc4c80bc39 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: creds.c,v 1.20 2005/05/18 04:21:04 lha Exp $");
+RCSID("$Id: creds.c 15167 2005-05-18 04:21:57Z lha $");
 
 /* keep this for compatibility with older code */
 krb5_error_code KRB5_LIB_FUNCTION
 
 /* keep this for compatibility with older code */
 krb5_error_code KRB5_LIB_FUNCTION
index 6d4a81baa8c4332e56afdd6239d7dee6d8e4f2a7..93f3e44ba1c34050d57bc3141b5ac79986114cd3 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: crypto.c,v 1.146 2006/11/17 21:58:47 lha Exp $");
+RCSID("$Id: crypto.c 20981 2007-06-07 20:05:50Z lha $");
 
 #undef CRYPTO_DEBUG
 #ifdef CRYPTO_DEBUG
 
 #undef CRYPTO_DEBUG
 #ifdef CRYPTO_DEBUG
@@ -57,8 +57,6 @@ struct krb5_crypto_data {
     struct key_usage *key_usage;
 };
 
     struct key_usage *key_usage;
 };
 
-#define kcrypto_oid_enc(n) { sizeof(n)/sizeof(n[0]), n }
-
 #define CRYPTO_ETYPE(C) ((C)->et->type)
 
 /* bits for `flags' below */
 #define CRYPTO_ETYPE(C) ((C)->et->type)
 
 /* bits for `flags' below */
@@ -82,7 +80,6 @@ struct key_type {
     const char *name;
     size_t bits;
     size_t size;
     const char *name;
     size_t bits;
     size_t size;
-    size_t minsize;
     size_t schedule_size;
 #if 0
     krb5_enctype best_etype;
     size_t schedule_size;
 #if 0
     krb5_enctype best_etype;
@@ -128,6 +125,9 @@ struct encryption_type {
                               krb5_boolean encryptp,
                               int usage,
                               void *ivec);
                               krb5_boolean encryptp,
                               int usage,
                               void *ivec);
+    size_t prf_length;
+    krb5_error_code (*prf)(krb5_context,
+                          krb5_crypto, const krb5_data *, krb5_data *);
 };
 
 #define ENCRYPTION_USAGE(U) (((U) << 8) | 0xAA)
 };
 
 #define ENCRYPTION_USAGE(U) (((U) << 8) | 0xAA)
@@ -724,7 +724,6 @@ static struct key_type keytype_null = {
     0,
     0,
     0,
     0,
     0,
     0,
-    0,
     NULL,
     NULL,
     NULL
     NULL,
     NULL,
     NULL
@@ -735,7 +734,6 @@ static struct key_type keytype_des = {
     "des",
     56,
     sizeof(DES_cblock),
     "des",
     56,
     sizeof(DES_cblock),
-    sizeof(DES_cblock),
     sizeof(DES_key_schedule),
     krb5_DES_random_key,
     krb5_DES_schedule,
     sizeof(DES_key_schedule),
     krb5_DES_random_key,
     krb5_DES_schedule,
@@ -748,7 +746,6 @@ static struct key_type keytype_des3 = {
     "des3",
     168,
     3 * sizeof(DES_cblock), 
     "des3",
     168,
     3 * sizeof(DES_cblock), 
-    3 * sizeof(DES_cblock), 
     3 * sizeof(DES_key_schedule), 
     DES3_random_key,
     DES3_schedule,
     3 * sizeof(DES_key_schedule), 
     DES3_random_key,
     DES3_schedule,
@@ -761,7 +758,6 @@ static struct key_type keytype_des3_derived = {
     "des3",
     168,
     3 * sizeof(DES_cblock),
     "des3",
     168,
     3 * sizeof(DES_cblock),
-    3 * sizeof(DES_cblock),
     3 * sizeof(DES_key_schedule), 
     DES3_random_key,
     DES3_schedule,
     3 * sizeof(DES_key_schedule), 
     DES3_random_key,
     DES3_schedule,
@@ -774,7 +770,6 @@ static struct key_type keytype_aes128 = {
     "aes-128",
     128,
     16,
     "aes-128",
     128,
     16,
-    16,
     sizeof(struct krb5_aes_schedule),
     NULL,
     AES_schedule,
     sizeof(struct krb5_aes_schedule),
     NULL,
     AES_schedule,
@@ -786,7 +781,6 @@ static struct key_type keytype_aes256 = {
     "aes-256",
     256,
     32,
     "aes-256",
     256,
     32,
-    32,
     sizeof(struct krb5_aes_schedule),
     NULL,
     AES_schedule,
     sizeof(struct krb5_aes_schedule),
     NULL,
     AES_schedule,
@@ -798,7 +792,6 @@ static struct key_type keytype_arcfour = {
     "arcfour",
     128,
     16,
     "arcfour",
     128,
     16,
-    16,
     sizeof(RC4_KEY),
     NULL,
     ARCFOUR_schedule,
     sizeof(RC4_KEY),
     NULL,
     ARCFOUR_schedule,
@@ -2450,6 +2443,58 @@ ARCFOUR_encrypt(krb5_context context,
 }
 
 
 }
 
 
+/*
+ *
+ */
+
+static krb5_error_code
+AES_PRF(krb5_context context,
+       krb5_crypto crypto,
+       const krb5_data *in,
+       krb5_data *out)
+{
+    struct checksum_type *ct = crypto->et->checksum;
+    krb5_error_code ret;
+    Checksum result;
+    krb5_keyblock *derived;
+
+    result.cksumtype = ct->type;
+    ret = krb5_data_alloc(&result.checksum, ct->checksumsize);
+    if (ret) {
+       krb5_set_error_string(context, "out memory");
+       return ret;
+    }
+
+    (*ct->checksum)(context, NULL, in->data, in->length, 0, &result);
+
+    if (result.checksum.length < crypto->et->blocksize)
+       krb5_abortx(context, "internal prf error");
+
+    derived = NULL;
+    ret = krb5_derive_key(context, crypto->key.key, 
+                         crypto->et->type, "prf", 3, &derived);
+    if (ret)
+       krb5_abortx(context, "krb5_derive_key");
+
+    ret = krb5_data_alloc(out, crypto->et->blocksize);
+    if (ret)
+       krb5_abortx(context, "malloc failed");
+    
+    { 
+       AES_KEY key;
+
+       AES_set_encrypt_key(derived->keyvalue.data, 
+                           crypto->et->keytype->bits, &key);
+       AES_encrypt(result.checksum.data, out->data, &key);
+       memset(&key, 0, sizeof(key));
+    }
+
+    krb5_data_free(&result.checksum);
+    krb5_free_keyblock(context, derived);
+
+    return ret;
+}
+
 /*
  * these should currently be in reverse preference order.
  * (only relevant for !F_PSEUDO) */
 /*
  * these should currently be in reverse preference order.
  * (only relevant for !F_PSEUDO) */
@@ -2466,6 +2511,8 @@ static struct encryption_type enctype_null = {
     NULL,
     F_DISABLED,
     NULL_encrypt,
     NULL,
     F_DISABLED,
     NULL_encrypt,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des_cbc_crc = {
     ETYPE_DES_CBC_CRC,
 };
 static struct encryption_type enctype_des_cbc_crc = {
     ETYPE_DES_CBC_CRC,
@@ -2479,6 +2526,8 @@ static struct encryption_type enctype_des_cbc_crc = {
     NULL,
     0,
     DES_CBC_encrypt_key_ivec,
     NULL,
     0,
     DES_CBC_encrypt_key_ivec,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des_cbc_md4 = {
     ETYPE_DES_CBC_MD4,
 };
 static struct encryption_type enctype_des_cbc_md4 = {
     ETYPE_DES_CBC_MD4,
@@ -2492,6 +2541,8 @@ static struct encryption_type enctype_des_cbc_md4 = {
     &checksum_rsa_md4_des,
     0,
     DES_CBC_encrypt_null_ivec,
     &checksum_rsa_md4_des,
     0,
     DES_CBC_encrypt_null_ivec,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des_cbc_md5 = {
     ETYPE_DES_CBC_MD5,
 };
 static struct encryption_type enctype_des_cbc_md5 = {
     ETYPE_DES_CBC_MD5,
@@ -2505,6 +2556,8 @@ static struct encryption_type enctype_des_cbc_md5 = {
     &checksum_rsa_md5_des,
     0,
     DES_CBC_encrypt_null_ivec,
     &checksum_rsa_md5_des,
     0,
     DES_CBC_encrypt_null_ivec,
+    0,
+    NULL
 };
 static struct encryption_type enctype_arcfour_hmac_md5 = {
     ETYPE_ARCFOUR_HMAC_MD5,
 };
 static struct encryption_type enctype_arcfour_hmac_md5 = {
     ETYPE_ARCFOUR_HMAC_MD5,
@@ -2517,7 +2570,9 @@ static struct encryption_type enctype_arcfour_hmac_md5 = {
     &checksum_hmac_md5,
     NULL,
     F_SPECIAL,
     &checksum_hmac_md5,
     NULL,
     F_SPECIAL,
-    ARCFOUR_encrypt
+    ARCFOUR_encrypt,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des3_cbc_md5 = { 
     ETYPE_DES3_CBC_MD5,
 };
 static struct encryption_type enctype_des3_cbc_md5 = { 
     ETYPE_DES3_CBC_MD5,
@@ -2531,6 +2586,8 @@ static struct encryption_type enctype_des3_cbc_md5 = {
     &checksum_rsa_md5_des3,
     0,
     DES3_CBC_encrypt,
     &checksum_rsa_md5_des3,
     0,
     DES3_CBC_encrypt,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des3_cbc_sha1 = {
     ETYPE_DES3_CBC_SHA1,
 };
 static struct encryption_type enctype_des3_cbc_sha1 = {
     ETYPE_DES3_CBC_SHA1,
@@ -2544,6 +2601,8 @@ static struct encryption_type enctype_des3_cbc_sha1 = {
     &checksum_hmac_sha1_des3,
     F_DERIVED,
     DES3_CBC_encrypt,
     &checksum_hmac_sha1_des3,
     F_DERIVED,
     DES3_CBC_encrypt,
+    0,
+    NULL
 };
 static struct encryption_type enctype_old_des3_cbc_sha1 = {
     ETYPE_OLD_DES3_CBC_SHA1,
 };
 static struct encryption_type enctype_old_des3_cbc_sha1 = {
     ETYPE_OLD_DES3_CBC_SHA1,
@@ -2557,6 +2616,8 @@ static struct encryption_type enctype_old_des3_cbc_sha1 = {
     &checksum_hmac_sha1_des3,
     0,
     DES3_CBC_encrypt,
     &checksum_hmac_sha1_des3,
     0,
     DES3_CBC_encrypt,
+    0,
+    NULL
 };
 static struct encryption_type enctype_aes128_cts_hmac_sha1 = {
     ETYPE_AES128_CTS_HMAC_SHA1_96,
 };
 static struct encryption_type enctype_aes128_cts_hmac_sha1 = {
     ETYPE_AES128_CTS_HMAC_SHA1_96,
@@ -2570,6 +2631,8 @@ static struct encryption_type enctype_aes128_cts_hmac_sha1 = {
     &checksum_hmac_sha1_aes128,
     F_DERIVED,
     AES_CTS_encrypt,
     &checksum_hmac_sha1_aes128,
     F_DERIVED,
     AES_CTS_encrypt,
+    16,
+    AES_PRF
 };
 static struct encryption_type enctype_aes256_cts_hmac_sha1 = {
     ETYPE_AES256_CTS_HMAC_SHA1_96,
 };
 static struct encryption_type enctype_aes256_cts_hmac_sha1 = {
     ETYPE_AES256_CTS_HMAC_SHA1_96,
@@ -2583,6 +2646,8 @@ static struct encryption_type enctype_aes256_cts_hmac_sha1 = {
     &checksum_hmac_sha1_aes256,
     F_DERIVED,
     AES_CTS_encrypt,
     &checksum_hmac_sha1_aes256,
     F_DERIVED,
     AES_CTS_encrypt,
+    16,
+    AES_PRF
 };
 static struct encryption_type enctype_des_cbc_none = {
     ETYPE_DES_CBC_NONE,
 };
 static struct encryption_type enctype_des_cbc_none = {
     ETYPE_DES_CBC_NONE,
@@ -2596,6 +2661,8 @@ static struct encryption_type enctype_des_cbc_none = {
     NULL,
     F_PSEUDO,
     DES_CBC_encrypt_null_ivec,
     NULL,
     F_PSEUDO,
     DES_CBC_encrypt_null_ivec,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des_cfb64_none = {
     ETYPE_DES_CFB64_NONE,
 };
 static struct encryption_type enctype_des_cfb64_none = {
     ETYPE_DES_CFB64_NONE,
@@ -2609,6 +2676,8 @@ static struct encryption_type enctype_des_cfb64_none = {
     NULL,
     F_PSEUDO,
     DES_CFB64_encrypt_null_ivec,
     NULL,
     F_PSEUDO,
     DES_CFB64_encrypt_null_ivec,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des_pcbc_none = {
     ETYPE_DES_PCBC_NONE,
 };
 static struct encryption_type enctype_des_pcbc_none = {
     ETYPE_DES_PCBC_NONE,
@@ -2622,6 +2691,8 @@ static struct encryption_type enctype_des_pcbc_none = {
     NULL,
     F_PSEUDO,
     DES_PCBC_encrypt_key_ivec,
     NULL,
     F_PSEUDO,
     DES_PCBC_encrypt_key_ivec,
+    0,
+    NULL
 };
 static struct encryption_type enctype_des3_cbc_none = {
     ETYPE_DES3_CBC_NONE,
 };
 static struct encryption_type enctype_des3_cbc_none = {
     ETYPE_DES3_CBC_NONE,
@@ -2635,6 +2706,8 @@ static struct encryption_type enctype_des3_cbc_none = {
     NULL,
     F_PSEUDO,
     DES3_CBC_encrypt,
     NULL,
     F_PSEUDO,
     DES3_CBC_encrypt,
+    0,
+    NULL
 };
 
 static struct encryption_type *etypes[] = {
 };
 
 static struct encryption_type *etypes[] = {
@@ -3090,8 +3163,8 @@ decrypt_internal_derived(krb5_context context,
     
     checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
     if (len < checksum_sz) {
     
     checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
     if (len < checksum_sz) {
-       krb5_clear_error_string (context);
-       return EINVAL;          /* XXX - better error code? */
+       krb5_set_error_string(context, "Encrypted data shorter then checksum");
+       return KRB5_BAD_MSIZE;
     }
 
     if (((len - checksum_sz) % et->padsize) != 0) {
     }
 
     if (((len - checksum_sz) % et->padsize) != 0) {
@@ -3357,11 +3430,8 @@ krb5_decrypt_EncryptedData(krb5_context context,
  *                                                          *
  ************************************************************/
 
  *                                                          *
  ************************************************************/
 
-#ifdef HAVE_OPENSSL
-#include <openssl/rand.h>
+#define ENTROPY_NEEDED 128
 
 
-/* From openssl/crypto/rand/rand_lcl.h */
-#define ENTROPY_NEEDED 20
 static int
 seed_something(void)
 {
 static int
 seed_something(void)
 {
@@ -3417,7 +3487,8 @@ krb5_generate_random_block(void *buf, size_t len)
     HEIMDAL_MUTEX_lock(&crypto_mutex);
     if (!rng_initialized) {
        if (seed_something())
     HEIMDAL_MUTEX_lock(&crypto_mutex);
     if (!rng_initialized) {
        if (seed_something())
-           krb5_abortx(NULL, "Fatal: could not seed the random number generator");
+           krb5_abortx(NULL, "Fatal: could not seed the "
+                       "random number generator");
        
        rng_initialized = 1;
     }
        
        rng_initialized = 1;
     }
@@ -3426,38 +3497,6 @@ krb5_generate_random_block(void *buf, size_t len)
        krb5_abortx(NULL, "Failed to generate random block");
 }
 
        krb5_abortx(NULL, "Failed to generate random block");
 }
 
-#else
-
-void KRB5_LIB_FUNCTION
-krb5_generate_random_block(void *buf, size_t len)
-{
-    DES_cblock key, out;
-    static DES_cblock counter;
-    static DES_key_schedule schedule;
-    int i;
-    static int initialized = 0;
-
-    HEIMDAL_MUTEX_lock(&crypto_mutex);
-    if(!initialized) {
-       DES_new_random_key(&key);
-       DES_set_key(&key, &schedule);
-       memset(&key, 0, sizeof(key));
-       DES_new_random_key(&counter);
-       initialized = 1;
-    }
-    HEIMDAL_MUTEX_unlock(&crypto_mutex);
-    while(len > 0) {
-       DES_ecb_encrypt(&counter, &out, &schedule, DES_ENCRYPT);
-       for(i = 7; i >=0; i--)
-           if(counter[i]++)
-               break;
-       memcpy(buf, out, min(len, sizeof(out)));
-       len -= min(len, sizeof(out));
-       buf = (char*)buf + sizeof(out);
-    }
-}
-#endif
-
 static void
 DES3_postproc(krb5_context context,
              unsigned char *k, size_t len, struct key_data *key)
 static void
 DES3_postproc(krb5_context context,
              unsigned char *k, size_t len, struct key_data *key)
@@ -3645,7 +3684,7 @@ krb5_crypto_init(krb5_context context,
                               etype);
        return KRB5_PROG_ETYPE_NOSUPP;
     }
                               etype);
        return KRB5_PROG_ETYPE_NOSUPP;
     }
-    if((*crypto)->et->keytype->minsize > key->keyvalue.length) {
+    if((*crypto)->et->keytype->size != key->keyvalue.length) {
        free(*crypto);
        *crypto = NULL;
        krb5_set_error_string (context, "encryption key has bad length");
        free(*crypto);
        *crypto = NULL;
        krb5_set_error_string (context, "encryption key has bad length");
@@ -3844,6 +3883,50 @@ krb5_get_wrapped_length (krb5_context context,
        return wrapped_length (context, crypto, data_len);
 }
 
        return wrapped_length (context, crypto, data_len);
 }
 
+/*
+ * Return the size of an encrypted packet of length `data_len'
+ */
+
+static size_t
+crypto_overhead (krb5_context context,
+                krb5_crypto  crypto)
+{
+    struct encryption_type *et = crypto->et;
+    size_t res;
+
+    res = CHECKSUMSIZE(et->checksum);
+    res += et->confoundersize;
+    if (et->padsize > 1)
+       res += et->padsize;
+    return res;
+}
+
+static size_t
+crypto_overhead_dervied (krb5_context context,
+                        krb5_crypto  crypto)
+{
+    struct encryption_type *et = crypto->et;
+    size_t res;
+
+    if (et->keyed_checksum)
+       res = CHECKSUMSIZE(et->keyed_checksum);
+    else
+       res = CHECKSUMSIZE(et->checksum);
+    res += et->confoundersize;
+    if (et->padsize > 1)
+       res += et->padsize;
+    return res;
+}
+
+size_t
+krb5_crypto_overhead (krb5_context context, krb5_crypto crypto)
+{
+    if (derived_crypto (context, crypto))
+       return crypto_overhead_dervied (context, crypto);
+    else
+       return crypto_overhead (context, crypto);
+}
+
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_random_to_key(krb5_context context,
                   krb5_enctype type,
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_random_to_key(krb5_context context,
                   krb5_enctype type,
@@ -3934,6 +4017,44 @@ _krb5_pk_octetstring2key(krb5_context context,
     return ret;
 }
 
     return ret;
 }
 
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_crypto_prf_length(krb5_context context,
+                      krb5_enctype type,
+                      size_t *length)
+{
+    struct encryption_type *et = _find_enctype(type);
+
+    if(et == NULL || et->prf_length == 0) {
+       krb5_set_error_string(context, "encryption type %d not supported",
+                             type);
+       return KRB5_PROG_ETYPE_NOSUPP;
+    }
+
+    *length = et->prf_length;
+    return 0;
+}
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_crypto_prf(krb5_context context,
+               const krb5_crypto crypto,
+               const krb5_data *input, 
+               krb5_data *output)
+{
+    struct encryption_type *et = crypto->et;
+
+    krb5_data_zero(output);
+
+    if(et->prf == NULL) {
+       krb5_set_error_string(context, "kerberos prf for %s not supported",
+                             et->name);
+       return KRB5_PROG_ETYPE_NOSUPP;
+    }
+
+    return (*et->prf)(context, crypto, input, output);
+}
+       
+
+
 
 #ifdef CRYPTO_DEBUG
 
 
 #ifdef CRYPTO_DEBUG
 
index f0c6d00abe30c8a6c39592847c1438da88cbd88a..2ece85bdb322fc20874dd1f2b651315c504b32d6 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: data.c,v 1.21 2006/10/14 09:45:41 lha Exp $");
+RCSID("$Id: data.c 20039 2007-01-23 20:34:01Z lha $");
 
 void KRB5_LIB_FUNCTION
 krb5_data_zero(krb5_data *p)
 
 void KRB5_LIB_FUNCTION
 krb5_data_zero(krb5_data *p)
@@ -118,3 +118,11 @@ krb5_copy_data(krb5_context context,
     }
     return ret;
 }
     }
     return ret;
 }
+
+int KRB5_LIB_FUNCTION
+krb5_data_cmp(const krb5_data *data1, const krb5_data *data2)
+{
+    if (data1->length != data2->length)
+       return data1->length - data2->length;
+    return memcmp(data1->data, data2->data, data1->length);
+}
index f0d1f51033adb753b365bdd1c82c743690eeb516..c6b5cfb18bb768607bbe1ff3f4675ae8412e3a3b 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: eai_to_heim_errno.c,v 1.5 2004/05/25 21:23:35 lha Exp $");
+RCSID("$Id: eai_to_heim_errno.c 13863 2004-05-25 21:46:46Z lha $");
 
 /*
  * convert the getaddrinfo error code in `eai_errno' into a
 
 /*
  * convert the getaddrinfo error code in `eai_errno' into a
index b672fe74f99f5d0d43ac04717e77392076e932dd..1ba64944872cac2bf3cd61e691b4a48f61405cca 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: error_string.c,v 1.7 2006/02/16 07:49:23 lha Exp $");
+RCSID("$Id: error_string.c 16746 2006-02-16 07:49:23Z lha $");
 
 #undef __attribute__
 #define __attribute__(X)
 
 #undef __attribute__
 #define __attribute__(X)
index 46e784f561da03c6d40cdb03a72ba90e11404d68..b2b410269ede5f94aedbba80c34be7b81222b2d3 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: expand_hostname.c,v 1.14 2006/11/04 03:34:57 lha Exp $");
+RCSID("$Id: expand_hostname.c 18906 2006-11-04 03:34:57Z lha $");
 
 static krb5_error_code
 copy_hostname(krb5_context context,
 
 static krb5_error_code
 copy_hostname(krb5_context context,
index 7441509e388c31965c921d6dedec1fe07c12dc80..864efa8d7d1bc803af9862b00738af8a1d82eece 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: fcache.c,v 1.54 2006/12/15 21:35:52 lha Exp $");
+RCSID("$Id: fcache.c 19379 2006-12-15 21:35:52Z lha $");
 
 typedef struct krb5_fcache{
     char *filename;
 
 typedef struct krb5_fcache{
     char *filename;
index 84aa6f8c2cc8cfb5a53dc5034c838f3930278377..1b0bd05412f2a497301be4a42eb8b34e47d56e5a 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: free.c,v 1.8 2005/05/18 10:06:16 lha Exp $");
+RCSID("$Id: free.c 15175 2005-05-18 10:06:16Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_free_kdc_rep(krb5_context context, krb5_kdc_rep *rep)
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_free_kdc_rep(krb5_context context, krb5_kdc_rep *rep)
index 27afcdbb23c421020f0e21331b18e0843dad16a9..6b13ce7d0e048b2be4918d4a67ff294a0f3ba6b7 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: free_host_realm.c,v 1.5 2004/05/25 21:25:02 lha Exp $");
+RCSID("$Id: free_host_realm.c 13863 2004-05-25 21:46:46Z lha $");
 
 /*
  * Free all memory allocated by `realmlist'
 
 /*
  * Free all memory allocated by `realmlist'
index 7f79e29858cc98c50132d8c6b68a22afc6be9c78..8a04f048c8c8777c1422a11d65641a5ac5e92ea2 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: generate_seq_number.c,v 1.10 2006/05/05 09:28:06 lha Exp $");
+RCSID("$Id: generate_seq_number.c 17442 2006-05-05 09:31:15Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_generate_seq_number(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_generate_seq_number(krb5_context context,
index df4828d09745fd2618514dc4a23cd2c803b41bb5..fb99cbbf3f7448e10cbf4e878405c12cff79fcb3 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: generate_subkey.c,v 1.11 2005/01/05 02:39:21 lukeh Exp $");
+RCSID("$Id: generate_subkey.c 14455 2005-01-05 02:39:21Z lukeh $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_generate_subkey(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_generate_subkey(krb5_context context,
index 663b5e7f1b92f5282d9cb0b07328ab8ef0461653..761224b82c84b5ea67970e661d3b1c3b40467e4f 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: get_cred.c,v 1.113 2006/11/21 05:14:01 lha Exp $");
+RCSID("$Id: get_cred.c 21004 2007-06-08 01:53:10Z lha $");
 
 /*
  * Take the `body' and encode it into `padata' using the credentials
 
 /*
  * Take the `body' and encode it into `padata' using the credentials
@@ -542,8 +542,8 @@ again:
                                   KRB5_KU_TGS_REP_ENC_PART_SESSION,
                                   &krbtgt->addresses,
                                   nonce,
                                   KRB5_KU_TGS_REP_ENC_PART_SESSION,
                                   &krbtgt->addresses,
                                   nonce,
-                                  TRUE,
-                                  TRUE /* flags.b.request_anonymous */,
+                                  EXTRACT_TICKET_ALLOW_CNAME_MISMATCH|
+                                  EXTRACT_TICKET_ALLOW_SERVER_MISMATCH,
                                   decrypt_tkt_with_subkey,
                                   subkey);
        krb5_free_kdc_rep(context, &rep);
                                   decrypt_tkt_with_subkey,
                                   subkey);
        krb5_free_kdc_rep(context, &rep);
@@ -659,6 +659,20 @@ krb5_get_kdc_cred(krb5_context context,
     return ret;
 }
 
     return ret;
 }
 
+static void
+not_found(krb5_context context, krb5_const_principal p)
+{
+    krb5_error_code ret;
+    char *str;
+
+    ret = krb5_unparse_name(context, p, &str);
+    if(ret) {
+       krb5_clear_error_string(context);
+       return;
+    }
+    krb5_set_error_string(context, "Matching credential (%s) not found", str);
+    free(str);
+}
 
 static krb5_error_code
 find_cred(krb5_context context,
 
 static krb5_error_code
 find_cred(krb5_context context,
@@ -684,17 +698,7 @@ find_cred(krb5_context context,
        }
        tgts++;
     }
        }
        tgts++;
     }
-    {
-       char *str;
-       ret = krb5_unparse_name(context, server, &str);
-       if(ret == 0) {
-           krb5_set_error_string(context, "Matching credential "
-                                 "(%s) not found", str);
-           free(str);
-       } else {
-           krb5_clear_error_string(context);
-       }
-    }
+    not_found(context, server);
     return KRB5_CC_NOTFOUND;
 }
 
     return KRB5_CC_NOTFOUND;
 }
 
@@ -818,7 +822,7 @@ get_cred_from_kdc_flags(krb5_context context,
        }
     }
     if(krb5_realm_compare(context, in_creds->client, in_creds->server)) {
        }
     }
     if(krb5_realm_compare(context, in_creds->client, in_creds->server)) {
-       krb5_clear_error_string (context);
+       not_found(context, in_creds->server);
        return KRB5_CC_NOTFOUND;
     }
     /* XXX this can loop forever */
        return KRB5_CC_NOTFOUND;
     }
     /* XXX this can loop forever */
@@ -972,7 +976,7 @@ krb5_get_credentials_with_flags(krb5_context context,
     }
     free(res_creds);
     if(options & KRB5_GC_CACHED) {
     }
     free(res_creds);
     if(options & KRB5_GC_CACHED) {
-        krb5_clear_error_string (context);        
+       not_found(context, in_creds->server);
         return KRB5_CC_NOTFOUND;
     }
     if(options & KRB5_GC_USER_USER)
         return KRB5_CC_NOTFOUND;
     }
     if(options & KRB5_GC_USER_USER)
@@ -1175,7 +1179,7 @@ krb5_get_creds(krb5_context context,
     }
     free(res_creds);
     if(options & KRB5_GC_CACHED) {
     }
     free(res_creds);
     if(options & KRB5_GC_CACHED) {
-        krb5_clear_error_string (context);        
+       not_found(context, in_creds.server);
        krb5_free_principal(context, in_creds.client);
         return KRB5_CC_NOTFOUND;
     }
        krb5_free_principal(context, in_creds.client);
         return KRB5_CC_NOTFOUND;
     }
index 03e8f0a82388858292d7ca8c25c126c51e457991..83fb2b0fa984fd63c5622158d98af0ad942f9c8a 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: get_default_principal.c,v 1.10 2005/04/20 20:53:29 lha Exp $");
+RCSID("$Id: get_default_principal.c 14870 2005-04-20 20:53:29Z lha $");
 
 /*
  * Try to find out what's a reasonable default principal.
 
 /*
  * Try to find out what's a reasonable default principal.
index bb72daf3735ab3832c92b4b635d0d30e57f7dd68..09c8577b260184b12b579e0a734855d0ab008682 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: get_default_realm.c,v 1.13 2004/05/25 21:27:17 lha Exp $");
+RCSID("$Id: get_default_realm.c 13863 2004-05-25 21:46:46Z lha $");
 
 /*
  * Return a NULL-terminated list of default realms in `realms'.
 
 /*
  * Return a NULL-terminated list of default realms in `realms'.
index 6eebf1fa8028411bf31e70ff3345137431579b0f..1bb98737d1a8a454f02e9850a307dec66d59d8be 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: get_for_creds.c,v 1.49 2006/04/10 09:28:15 lha Exp $");
+RCSID("$Id: get_for_creds.c 17036 2006-04-10 09:28:15Z lha $");
 
 static krb5_error_code
 add_addrs(krb5_context context,
 
 static krb5_error_code
 add_addrs(krb5_context context,
index ffc646d98bbadadcd9a67b25439037990851e50a..d709e4b38d17aef14915761a1f5523c13add2313 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include <resolve.h>
 
 #include "krb5_locl.h"
 #include <resolve.h>
 
-RCSID("$Id: get_host_realm.c,v 1.37 2006/10/17 19:28:36 lha Exp $");
+RCSID("$Id: get_host_realm.c 18541 2006-10-17 19:28:36Z lha $");
 
 /* To automagically find the correct realm of a host (without
  * [domain_realm] in krb5.conf) add a text record for your domain with
 
 /* To automagically find the correct realm of a host (without
  * [domain_realm] in krb5.conf) add a text record for your domain with
index e140011413a054afde775a7cd976fa4741c5a383..ec106bb7eccfc58a9ccd8dfd2883338e6ec36853 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: get_in_tkt.c,v 1.119 2006/10/06 17:05:08 lha Exp $");
+RCSID("$Id: get_in_tkt.c 20226 2007-02-16 03:31:50Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_init_etype (krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_init_etype (krb5_context context,
@@ -125,13 +125,12 @@ _krb5_extract_ticket(krb5_context context,
                     krb5_key_usage key_usage,
                     krb5_addresses *addrs,
                     unsigned nonce,
                     krb5_key_usage key_usage,
                     krb5_addresses *addrs,
                     unsigned nonce,
-                    krb5_boolean allow_server_mismatch,
-                    krb5_boolean ignore_cname,
+                    unsigned flags,
                     krb5_decrypt_proc decrypt_proc,
                     krb5_const_pointer decryptarg)
 {
     krb5_error_code ret;
                     krb5_decrypt_proc decrypt_proc,
                     krb5_const_pointer decryptarg)
 {
     krb5_error_code ret;
-    krb5_principal tmp_principal, srv_principal = NULL;
+    krb5_principal tmp_principal;
     int tmp;
     size_t len;
     time_t tmp_time;
     int tmp;
     size_t len;
     time_t tmp_time;
@@ -143,8 +142,8 @@ _krb5_extract_ticket(krb5_context context,
  * as realm against windows KDC's, they always return the full realm
  * based on the DNS Name.
  */
  * as realm against windows KDC's, they always return the full realm
  * based on the DNS Name.
  */
-allow_server_mismatch = 1;
-ignore_cname = 1;
+flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
+flags |=EXTRACT_TICKET_ALLOW_CNAME_MISMATCH ;
 
     ret = _krb5_principalname2krb5_principal (context,
                                              &tmp_principal,
 
     ret = _krb5_principalname2krb5_principal (context,
                                              &tmp_principal,
@@ -155,7 +154,7 @@ ignore_cname = 1;
 
     /* compare client */
 
 
     /* compare client */
 
-    if (!ignore_cname) {
+    if((flags & EXTRACT_TICKET_ALLOW_CNAME_MISMATCH) == 0){
        tmp = krb5_principal_compare (context, tmp_principal, creds->client);
        if (!tmp) {
            krb5_free_principal (context, tmp_principal);
        tmp = krb5_principal_compare (context, tmp_principal, creds->client);
        if (!tmp) {
            krb5_free_principal (context, tmp_principal);
@@ -177,60 +176,49 @@ ignore_cname = 1;
        krb5_abortx(context, "internal error in ASN.1 encoder");
     creds->second_ticket.length = 0;
     creds->second_ticket.data   = NULL;
        krb5_abortx(context, "internal error in ASN.1 encoder");
     creds->second_ticket.length = 0;
     creds->second_ticket.data   = NULL;
-    
-    /* decrypt */
-
-    if (decrypt_proc == NULL)
-       decrypt_proc = decrypt_tkt;
-    
-    ret = (*decrypt_proc)(context, key, key_usage, decryptarg, rep);
-    if (ret)
-       goto out;
-
-#if 0
-    /* XXX should this decode be here, or in the decrypt_proc? */
-    ret = krb5_decode_keyblock(context, &rep->enc_part.key, 1);
-    if(ret)
-       goto out;
-#endif
 
     /* compare server */
 
     ret = _krb5_principalname2krb5_principal (context,
 
     /* compare server */
 
     ret = _krb5_principalname2krb5_principal (context,
-                                             &srv_principal,
+                                             &tmp_principal,
                                              rep->kdc_rep.ticket.sname,
                                              rep->kdc_rep.ticket.realm);
     if (ret)
        goto out;
                                              rep->kdc_rep.ticket.sname,
                                              rep->kdc_rep.ticket.realm);
     if (ret)
        goto out;
+    if(flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH){
+       krb5_free_principal(context, creds->server);
+       creds->server = tmp_principal;
+       tmp_principal = NULL;
+    } else {
+       tmp = krb5_principal_compare (context, tmp_principal,
+                                     creds->server);
+       krb5_free_principal (context, tmp_principal);
+       if (!tmp) {
+           ret = KRB5KRB_AP_ERR_MODIFIED;
+           krb5_clear_error_string (context);
+           goto out;
+       }
+    }
+    
+    /* decrypt */
 
 
-    ret = _krb5_principalname2krb5_principal (context,
-                                             &tmp_principal,
-                                             rep->enc_part.sname,
-                                             rep->enc_part.srealm);
+    if (decrypt_proc == NULL)
+       decrypt_proc = decrypt_tkt;
+    
+    ret = (*decrypt_proc)(context, key, key_usage, decryptarg, rep);
     if (ret)
        goto out;
 
     if (ret)
        goto out;
 
-    /* 
-     * see if the service principal matches in the ticket
-     * and in the enc_part
-     */
-    tmp = krb5_principal_compare (context, tmp_principal, srv_principal);
-    krb5_free_principal (context, tmp_principal);
-    if (!tmp) {
-       ret = KRB5KRB_AP_ERR_MODIFIED;
-       krb5_clear_error_string (context);
-       goto out;
-    }
+    /* verify names */
+    if(flags & EXTRACT_TICKET_MATCH_REALM){
+       const char *srealm = krb5_principal_get_realm(context, creds->server);
+       const char *crealm = krb5_principal_get_realm(context, creds->client);
 
 
-    if(allow_server_mismatch){
-       krb5_free_principal(context, creds->server);
-       creds->server = srv_principal;
-       srv_principal = NULL;
-    }else{
-       tmp = krb5_principal_compare (context, srv_principal, creds->server);
-       if (!tmp) {
+       if (strcmp(rep->enc_part.srealm, srealm) != 0 ||
+           strcmp(rep->enc_part.srealm, crealm) != 0)
+       {
            ret = KRB5KRB_AP_ERR_MODIFIED;
            ret = KRB5KRB_AP_ERR_MODIFIED;
-           krb5_clear_error_string (context);
+           krb5_clear_error_string(context);
            goto out;
        }
     }
            goto out;
        }
     }
@@ -329,8 +317,6 @@ ignore_cname = 1;
 out:
     memset (rep->enc_part.key.keyvalue.data, 0,
            rep->enc_part.key.keyvalue.length);
 out:
     memset (rep->enc_part.key.keyvalue.data, 0,
            rep->enc_part.key.keyvalue.length);
-    if (srv_principal)
-        krb5_free_principal (context, srv_principal);
     return ret;
 }
 
     return ret;
 }
 
@@ -792,18 +778,23 @@ krb5_get_in_cred(krb5_context context,
     if (ret)
        goto out;
        
     if (ret)
        goto out;
        
-    ret = _krb5_extract_ticket(context, 
-                              &rep, 
-                              creds, 
-                              key, 
-                              keyseed, 
-                              KRB5_KU_AS_REP_ENC_PART,
-                              NULL, 
-                              nonce, 
-                              FALSE, 
-                              opts.request_anonymous,
-                              decrypt_proc, 
-                              decryptarg);
+    {
+       unsigned flags = 0;
+       if (opts.request_anonymous)
+           flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
+
+       ret = _krb5_extract_ticket(context, 
+                                  &rep, 
+                                  creds, 
+                                  key, 
+                                  keyseed, 
+                                  KRB5_KU_AS_REP_ENC_PART,
+                                  NULL, 
+                                  nonce, 
+                                  flags,
+                                  decrypt_proc, 
+                                  decryptarg);
+    }
     memset (key->keyvalue.data, 0, key->keyvalue.length);
     krb5_free_keyblock_contents (context, key);
     free (key);
     memset (key->keyvalue.data, 0, key->keyvalue.length);
     krb5_free_keyblock_contents (context, key);
     free (key);
index 69da6c5ea769409fc487b5d0d749b2167abdfdea..52f95c4bc45e4bd17bc57c620c409917fa2e4523 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: get_in_tkt_with_keytab.c,v 1.9 2005/06/17 04:56:44 lha Exp $");
+RCSID("$Id: get_in_tkt_with_keytab.c 15477 2005-06-17 04:56:44Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_keytab_key_proc (krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_keytab_key_proc (krb5_context context,
index ba76466e065928f9f91b901b586acd90d5622d5c..85587ea766200a2dd99ad676b00d541552137a17 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: get_port.c,v 1.9 2004/05/25 21:29:59 lha Exp $");
+RCSID("$Id: get_port.c 13863 2004-05-25 21:46:46Z lha $");
 
 int KRB5_LIB_FUNCTION
 krb5_getportbyname (krb5_context context,
 
 int KRB5_LIB_FUNCTION
 krb5_getportbyname (krb5_context context,
index 3c4f06edb1efdfe80817008c6f9b628c76d86488..1b8ab49bc11e1ea0902404544302ddbbb2800060 100644 (file)
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: heim_err.et,v 1.13 2004/02/13 16:23:40 lha Exp $"
+id "$Id: heim_err.et 13352 2004-02-13 16:23:40Z lha $"
 
 error_table heim
 
 
 error_table heim
 
index 3ebe66beee16b2abf1442bca3c2f6097aaec1b55..3c27d13d81b9027490047fdbf58ebb88b0f2b554 100755 (executable)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: heim_threads.h,v 1.11 2004/12/18 16:03:38 lha Exp $ */
+/* $Id: heim_threads.h 14409 2004-12-18 16:03:38Z lha $ */
 
 /*
  * Provide wrapper macros for thread synchronization primitives so we
 
 /*
  * Provide wrapper macros for thread synchronization primitives so we
index a331524a7edee8b281280d5c57aff15aeb10eb49..5bdf23d97f03e37cf95e0b103648ecc0ecd9051e 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: init_creds.c,v 1.30 2006/11/23 16:27:36 lha Exp $");
+RCSID("$Id: init_creds.c 20541 2007-04-23 12:19:14Z lha $");
 
 void KRB5_LIB_FUNCTION
 krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt)
 
 void KRB5_LIB_FUNCTION
 krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt)
@@ -386,7 +386,7 @@ krb5_get_init_creds_opt_get_error(krb5_context context,
        return ENOMEM;
     }
 
        return ENOMEM;
     }
 
-    ret = copy_KRB_ERROR(*error, opt->opt_private->error);
+    ret = copy_KRB_ERROR(opt->opt_private->error, *error);
     if (ret)
        krb5_clear_error_string(context);
 
     if (ret)
        krb5_clear_error_string(context);
 
@@ -408,3 +408,36 @@ krb5_get_init_creds_opt_set_addressless(krb5_context context,
        opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_FALSE;
     return 0;
 }
        opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_FALSE;
     return 0;
 }
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_get_init_creds_opt_set_canonicalize(krb5_context context,
+                                        krb5_get_init_creds_opt *opt,
+                                        krb5_boolean req)
+{
+    krb5_error_code ret;
+    ret = require_ext_opt(context, opt, "init_creds_opt_set_canonicalize");
+    if (ret)
+       return ret;
+    if (req)
+       opt->opt_private->flags |= KRB5_INIT_CREDS_CANONICALIZE;
+    else
+       opt->opt_private->flags &= ~KRB5_INIT_CREDS_CANONICALIZE;
+    return 0;
+}
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_get_init_creds_opt_set_win2k(krb5_context context,
+                                 krb5_get_init_creds_opt *opt,
+                                 krb5_boolean req)
+{
+    krb5_error_code ret;
+    ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
+    if (ret)
+       return ret;
+    if (req)
+       opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_CANON_CHECK;
+    else
+       opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_CANON_CHECK;
+    return 0;
+}
+
index f6f6eac7d5b739fae4edea7837c4c8100c4b1d2e..a58435a9eaf7ff0db00e965e64704aad26d26b77 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: init_creds_pw.c,v 1.105 2007/01/09 10:44:59 lha Exp $");
+RCSID("$Id: init_creds_pw.c 20262 2007-02-18 00:33:01Z lha $");
 
 typedef struct krb5_get_init_creds_ctx {
     KDCOptions flags;
 
 typedef struct krb5_get_init_creds_ctx {
     KDCOptions flags;
@@ -55,6 +55,7 @@ typedef struct krb5_get_init_creds_ctx {
     krb5_get_init_creds_tristate req_pac;
 
     krb5_pk_init_ctx pk_init_ctx;
     krb5_get_init_creds_tristate req_pac;
 
     krb5_pk_init_ctx pk_init_ctx;
+    int ic_flags;
 } krb5_get_init_creds_ctx;
 
 static krb5_error_code
 } krb5_get_init_creds_ctx;
 
 static krb5_error_code
@@ -285,12 +286,16 @@ get_init_creds_common(krb5_context context,
        ctx->key_proc = options->opt_private->key_proc;
        ctx->req_pac = options->opt_private->req_pac;
        ctx->pk_init_ctx = options->opt_private->pk_init_ctx;
        ctx->key_proc = options->opt_private->key_proc;
        ctx->req_pac = options->opt_private->req_pac;
        ctx->pk_init_ctx = options->opt_private->pk_init_ctx;
+       ctx->ic_flags = options->opt_private->flags;
     } else
        ctx->req_pac = KRB5_INIT_CREDS_TRISTATE_UNSET;
 
     if (ctx->key_proc == NULL)
        ctx->key_proc = default_s2k_func;
 
     } else
        ctx->req_pac = KRB5_INIT_CREDS_TRISTATE_UNSET;
 
     if (ctx->key_proc == NULL)
        ctx->key_proc = default_s2k_func;
 
+    if (ctx->ic_flags & KRB5_INIT_CREDS_CANONICALIZE)
+       ctx->flags.canonicalize = 1;
+
     ctx->pre_auth_types = NULL;
     ctx->addrs = NULL;
     ctx->etypes = NULL;
     ctx->pre_auth_types = NULL;
     ctx->addrs = NULL;
     ctx->etypes = NULL;
@@ -834,6 +839,8 @@ static PA_DATA *
 find_pa_data(const METHOD_DATA *md, int type)
 {
     int i;
 find_pa_data(const METHOD_DATA *md, int type)
 {
     int i;
+    if (md == NULL)
+       return NULL;
     for (i = 0; i < md->len; i++)
        if (md->val[i].padata_type == type)
            return &md->val[i];
     for (i = 0; i < md->len; i++)
        if (md->val[i].padata_type == type)
            return &md->val[i];
@@ -1347,6 +1354,15 @@ init_cred_loop(krb5_context context,
 
     {
        krb5_keyblock *key = NULL;
 
     {
        krb5_keyblock *key = NULL;
+       unsigned flags = 0;
+
+       if (ctx->flags.request_anonymous)
+           flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
+       if (ctx->flags.canonicalize) {
+           flags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
+           flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
+           flags |= EXTRACT_TICKET_MATCH_REALM;
+       }
 
        ret = process_pa_data_to_key(context, ctx, creds, 
                                     &ctx->as_req, &rep, hi, &key);
 
        ret = process_pa_data_to_key(context, ctx, creds, 
                                     &ctx->as_req, &rep, hi, &key);
@@ -1361,12 +1377,65 @@ init_cred_loop(krb5_context context,
                                   KRB5_KU_AS_REP_ENC_PART,
                                   NULL,
                                   ctx->nonce,
                                   KRB5_KU_AS_REP_ENC_PART,
                                   NULL,
                                   ctx->nonce,
-                                  FALSE,
-                                  ctx->flags.request_anonymous,
+                                  flags,
                                   NULL,
                                   NULL);
        krb5_free_keyblock(context, key);
     }
                                   NULL,
                                   NULL);
        krb5_free_keyblock(context, key);
     }
+    /*
+     * Verify referral data
+     */
+    if ((ctx->ic_flags & KRB5_INIT_CREDS_CANONICALIZE) &&
+       (ctx->ic_flags & KRB5_INIT_CREDS_NO_C_CANON_CHECK) == 0)
+    {
+       PA_ClientCanonicalized canon;
+       krb5_crypto crypto;
+       krb5_data data;
+       PA_DATA *pa;
+       size_t len;
+
+       pa = find_pa_data(rep.kdc_rep.padata, KRB5_PADATA_CLIENT_CANONICALIZED);
+       if (pa == NULL) {
+           ret = EINVAL;
+           krb5_set_error_string(context, "Client canonicalizion not signed");
+           goto out;
+       }
+       
+       ret = decode_PA_ClientCanonicalized(pa->padata_value.data, 
+                                           pa->padata_value.length,
+                                           &canon, &len);
+       if (ret) {
+           krb5_set_error_string(context, "Failed to decode "
+                                 "PA_ClientCanonicalized");
+           goto out;
+       }
+
+       ASN1_MALLOC_ENCODE(PA_ClientCanonicalizedNames, data.data, data.length,
+                          &canon.names, &len, ret);
+       if (ret) 
+           goto out;
+       if (data.length != len)
+           krb5_abortx(context, "internal asn.1 error");
+
+       ret = krb5_crypto_init(context, &creds->session, 0, &crypto);
+       if (ret) {
+           free(data.data);
+           free_PA_ClientCanonicalized(&canon);
+           goto out;
+       }
+
+       ret = krb5_verify_checksum(context, crypto, KRB5_KU_CANONICALIZED_NAMES,
+                                  data.data, data.length,
+                                  &canon.canon_checksum);
+       krb5_crypto_destroy(context, crypto);
+       free(data.data);
+       free_PA_ClientCanonicalized(&canon);
+       if (ret) {
+           krb5_set_error_string(context, "Failed to verify "
+                                 "client canonicalized data");
+           goto out;
+       }
+    }
 out:
     krb5_data_free(&ctx->req_buffer);
     free_METHOD_DATA(&md);
 out:
     krb5_data_free(&ctx->req_buffer);
     free_METHOD_DATA(&md);
index 2dc60f46ae2bfe9441ccb3c2b9e40e18b90ea0ab..0ca25f74d474bdfca89c204d545e5592af4cb314 100644 (file)
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: k524_err.et,v 1.1 2001/06/20 02:44:11 joda Exp $"
+id "$Id: k524_err.et 10141 2001-06-20 02:45:58Z joda $"
 
 error_table k524
 
 
 error_table k524
 
index 8f2d9f7f86ebb5666c92c33a90abc58ae78691ee..c945a9ce135260ed1732099b0039b5cc3b2bb83c 100644 (file)
@@ -43,7 +43,7 @@
 
 #include "kcm.h"
 
 
 #include "kcm.h"
 
-RCSID("$Id: kcm.c,v 1.9 2006/05/05 09:28:48 lha Exp $");
+RCSID("$Id: kcm.c 17442 2006-05-05 09:31:15Z lha $");
 
 typedef struct krb5_kcmcache {
     char *name;
 
 typedef struct krb5_kcmcache {
     char *name;
index 314d97978bf7858c6999d12774b8169132ccc859..ff4f972e57d79cd0c60a79a3353a678792503498 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keyblock.c,v 1.17 2005/05/18 04:21:31 lha Exp $");
+RCSID("$Id: keyblock.c 15167 2005-05-18 04:21:57Z lha $");
 
 void KRB5_LIB_FUNCTION
 krb5_keyblock_zero(krb5_keyblock *keyblock)
 
 void KRB5_LIB_FUNCTION
 krb5_keyblock_zero(krb5_keyblock *keyblock)
index 43fc21c1d1ba7572b615c48de100e7f5afc4b68e..f6c7858c12ec1e77ee66dc3fbc4c987d902728fc 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab.c,v 1.63 2005/11/25 21:46:40 lha Exp $");
+RCSID("$Id: keytab.c 20211 2007-02-09 07:11:03Z lha $");
 
 /*
  * Register a new keytab in `ops'
 
 /*
  * Register a new keytab in `ops'
@@ -364,11 +364,11 @@ krb5_kt_get_entry(krb5_context context,
     if (entry->vno) {
        return 0;
     } else {
     if (entry->vno) {
        return 0;
     } else {
-       char princ[256], kt_name[256], kvno_str[25];
+       char princ[256], kvno_str[25], *kt_name;
        char *enctype_str = NULL;
 
        krb5_unparse_name_fixed (context, principal, princ, sizeof(princ));
        char *enctype_str = NULL;
 
        krb5_unparse_name_fixed (context, principal, princ, sizeof(princ));
-       krb5_kt_get_name (context, id, kt_name, sizeof(kt_name));
+       krb5_kt_get_full_name (context, id, &kt_name);
        krb5_enctype_to_string(context, enctype, &enctype_str);
 
        if (kvno)
        krb5_enctype_to_string(context, enctype, &enctype_str);
 
        if (kvno)
@@ -377,11 +377,12 @@ krb5_kt_get_entry(krb5_context context,
            kvno_str[0] = '\0';
 
        krb5_set_error_string (context,
            kvno_str[0] = '\0';
 
        krb5_set_error_string (context,
-                              "failed to find %s%s in keytab %s (%s)",
+                              "Failed to find %s%s in keytab %s (%s)",
                               princ,
                               kvno_str,
                               princ,
                               kvno_str,
-                              kt_name,
+                              kt_name ? kt_name : "unknown keytab",
                               enctype_str ? enctype_str : "unknown enctype");
                               enctype_str ? enctype_str : "unknown enctype");
+       free(kt_name);
        free(enctype_str);
        return KRB5_KT_NOTFOUND;
     }
        free(enctype_str);
        return KRB5_KT_NOTFOUND;
     }
index d5130aaad880f7d35bec1fd8df47c3a4d8f08335..54272d48453fd4da9c9f261fc7e1c52dcebc5fa9 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_any.c,v 1.8 2006/04/10 09:20:13 lha Exp $");
+RCSID("$Id: keytab_any.c 17035 2006-04-10 09:20:13Z lha $");
 
 struct any_data {
     krb5_keytab kt;
 
 struct any_data {
     krb5_keytab kt;
index 1b063873395d8dc89e0758aa9b3a086d5b71d239..4ada3a463ea8ef071b6435f79f96c365bfce4a69 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_file.c,v 1.23 2006/05/05 12:36:57 lha Exp $");
+RCSID("$Id: keytab_file.c 17457 2006-05-05 12:36:57Z lha $");
 
 #define KRB5_KT_VNO_1 1
 #define KRB5_KT_VNO_2 2
 
 #define KRB5_KT_VNO_1 1
 #define KRB5_KT_VNO_2 2
index d7f8a720e14d442207d4c61dac246b83383d4b55..77455ba5f7c260a5bccfbf3a9cdf7b3377b6a5d4 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2002, 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_keyfile.c,v 1.19 2006/04/24 15:06:57 lha Exp $");
+RCSID("$Id: keytab_keyfile.c 20695 2007-05-30 14:09:09Z lha $");
 
 /* afs keyfile operations --------------------------------------- */
 
 
 /* afs keyfile operations --------------------------------------- */
 
@@ -350,7 +350,7 @@ akf_add_entry(krb5_context context,
        for (i = 0; i < len; i++) {
            ret = krb5_ret_int32(sp, &kvno);
            if (ret) {
        for (i = 0; i < len; i++) {
            ret = krb5_ret_int32(sp, &kvno);
            if (ret) {
-               krb5_set_error_string (context, "Failed got get kvno ");
+               krb5_set_error_string (context, "Failed to get kvno ");
                goto out;
            }
            if(krb5_storage_seek(sp, 8, SEEK_CUR) < 0) {
                goto out;
            }
            if(krb5_storage_seek(sp, 8, SEEK_CUR) < 0) {
index 19e7f106bfca7104c1d398565ea28592a93db311..907836c144f768c07bac2cf2f01117472b7336e3 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_krb4.c,v 1.15 2006/04/10 17:10:53 lha Exp $");
+RCSID("$Id: keytab_krb4.c 17046 2006-04-10 17:10:53Z lha $");
 
 struct krb4_kt_data {
     char *filename;
 
 struct krb4_kt_data {
     char *filename;
index fa54ff43ceabde1e678e09012bb63d262f974c2a..0ad8720c3fb8ccfb4583a0a299b174df9253998d 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_memory.c,v 1.8 2005/12/05 18:39:46 lha Exp $");
+RCSID("$Id: keytab_memory.c 16352 2005-12-05 18:39:46Z lha $");
 
 /* memory operations -------------------------------------------- */
 
 
 /* memory operations -------------------------------------------- */
 
index c3e573275393dee21538211c7b4eb494c132345f..be718f67143391f7b0e40a53fa7aac5678566395 100644 (file)
@@ -4,14 +4,6 @@
 
 #include <stdarg.h>
 
 
 #include <stdarg.h>
 
-#ifndef KRB5_LIB_FUNCTION
-#if defined(_WIN32)
-#define KRB5_LIB_FUNCTION _stdcall
-#else
-#define KRB5_LIB_FUNCTION
-#endif
-#endif
-
 void KRB5_LIB_FUNCTION
 _krb5_aes_cts_encrypt (
        const unsigned char */*in*/,
 void KRB5_LIB_FUNCTION
 _krb5_aes_cts_encrypt (
        const unsigned char */*in*/,
@@ -68,8 +60,7 @@ _krb5_extract_ticket (
        krb5_key_usage /*key_usage*/,
        krb5_addresses */*addrs*/,
        unsigned /*nonce*/,
        krb5_key_usage /*key_usage*/,
        krb5_addresses */*addrs*/,
        unsigned /*nonce*/,
-       krb5_boolean /*allow_server_mismatch*/,
-       krb5_boolean /*ignore_cname*/,
+       unsigned /*flags*/,
        krb5_decrypt_proc /*decrypt_proc*/,
        krb5_const_pointer /*decryptarg*/);
 
        krb5_decrypt_proc /*decrypt_proc*/,
        krb5_const_pointer /*decryptarg*/);
 
index 9dfe487b0af955528e9fa48b1e3eb2ef513de08b..e852bffeb1af40a06db60369473f395a1d15fa80 100644 (file)
@@ -520,6 +520,19 @@ krb5_c_make_random_key (
        krb5_enctype /*enctype*/,
        krb5_keyblock */*random_key*/);
 
        krb5_enctype /*enctype*/,
        krb5_keyblock */*random_key*/);
 
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_c_prf (
+       krb5_context /*context*/,
+       const krb5_keyblock */*key*/,
+       const krb5_data */*input*/,
+       krb5_data */*output*/);
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_c_prf_length (
+       krb5_context /*context*/,
+       krb5_enctype /*type*/,
+       size_t */*length*/);
+
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_c_set_checksum (
        krb5_context /*context*/,
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_c_set_checksum (
        krb5_context /*context*/,
@@ -1103,11 +1116,34 @@ krb5_crypto_init (
        krb5_enctype /*etype*/,
        krb5_crypto */*crypto*/);
 
        krb5_enctype /*etype*/,
        krb5_crypto */*crypto*/);
 
+size_t
+krb5_crypto_overhead (
+       krb5_context /*context*/,
+       krb5_crypto /*crypto*/);
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_crypto_prf (
+       krb5_context /*context*/,
+       const krb5_crypto /*crypto*/,
+       const krb5_data */*input*/,
+       krb5_data */*output*/);
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_crypto_prf_length (
+       krb5_context /*context*/,
+       krb5_enctype /*type*/,
+       size_t */*length*/);
+
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_data_alloc (
        krb5_data */*p*/,
        int /*len*/);
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_data_alloc (
        krb5_data */*p*/,
        int /*len*/);
 
+int KRB5_LIB_FUNCTION
+krb5_data_cmp (
+       const krb5_data */*data1*/,
+       const krb5_data */*data2*/);
+
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_data_copy (
        krb5_data */*p*/,
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_data_copy (
        krb5_data */*p*/,
@@ -1247,12 +1283,6 @@ krb5_digest_alloc (
 void
 krb5_digest_free (krb5_digest /*digest*/);
 
 void
 krb5_digest_free (krb5_digest /*digest*/);
 
-krb5_error_code
-krb5_digest_get_a1_hash (
-       krb5_context /*context*/,
-       krb5_digest /*digest*/,
-       krb5_data */*data*/);
-
 krb5_error_code
 krb5_digest_get_client_binding (
        krb5_context /*context*/,
 krb5_error_code
 krb5_digest_get_client_binding (
        krb5_context /*context*/,
@@ -1270,11 +1300,6 @@ krb5_digest_get_opaque (
        krb5_context /*context*/,
        krb5_digest /*digest*/);
 
        krb5_context /*context*/,
        krb5_digest /*digest*/);
 
-const char *
-krb5_digest_get_responseData (
-       krb5_context /*context*/,
-       krb5_digest /*digest*/);
-
 const char *
 krb5_digest_get_rsp (
        krb5_context /*context*/,
 const char *
 krb5_digest_get_rsp (
        krb5_context /*context*/,
@@ -1285,6 +1310,12 @@ krb5_digest_get_server_nonce (
        krb5_context /*context*/,
        krb5_digest /*digest*/);
 
        krb5_context /*context*/,
        krb5_digest /*digest*/);
 
+krb5_error_code
+krb5_digest_get_session_key (
+       krb5_context /*context*/,
+       krb5_digest /*digest*/,
+       krb5_data */*data*/);
+
 krb5_error_code
 krb5_digest_get_tickets (
        krb5_context /*context*/,
 krb5_error_code
 krb5_digest_get_tickets (
        krb5_context /*context*/,
@@ -1298,6 +1329,11 @@ krb5_digest_init_request (
        krb5_realm /*realm*/,
        krb5_ccache /*ccache*/);
 
        krb5_realm /*realm*/,
        krb5_ccache /*ccache*/);
 
+krb5_boolean
+krb5_digest_rep_get_status (
+       krb5_context /*context*/,
+       krb5_digest /*digest*/);
+
 krb5_error_code
 krb5_digest_request (
        krb5_context /*context*/,
 krb5_error_code
 krb5_digest_request (
        krb5_context /*context*/,
@@ -1371,6 +1407,12 @@ krb5_digest_set_realm (
        krb5_digest /*digest*/,
        const char */*realm*/);
 
        krb5_digest /*digest*/,
        const char */*realm*/);
 
+int
+krb5_digest_set_responseData (
+       krb5_context /*context*/,
+       krb5_digest /*digest*/,
+       const char */*response*/);
+
 krb5_error_code
 krb5_digest_set_server_cb (
        krb5_context /*context*/,
 krb5_error_code
 krb5_digest_set_server_cb (
        krb5_context /*context*/,
@@ -2057,6 +2099,12 @@ krb5_get_init_creds_opt_set_anonymous (
        krb5_get_init_creds_opt */*opt*/,
        int /*anonymous*/);
 
        krb5_get_init_creds_opt */*opt*/,
        int /*anonymous*/);
 
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_get_init_creds_opt_set_canonicalize (
+       krb5_context /*context*/,
+       krb5_get_init_creds_opt */*opt*/,
+       krb5_boolean /*req*/);
+
 void KRB5_LIB_FUNCTION
 krb5_get_init_creds_opt_set_default_flags (
        krb5_context /*context*/,
 void KRB5_LIB_FUNCTION
 krb5_get_init_creds_opt_set_default_flags (
        krb5_context /*context*/,
@@ -2128,6 +2176,12 @@ krb5_get_init_creds_opt_set_tkt_life (
        krb5_get_init_creds_opt */*opt*/,
        krb5_deltat /*tkt_life*/);
 
        krb5_get_init_creds_opt */*opt*/,
        krb5_deltat /*tkt_life*/);
 
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_get_init_creds_opt_set_win2k (
+       krb5_context /*context*/,
+       krb5_get_init_creds_opt */*opt*/,
+       krb5_boolean /*req*/);
+
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_get_init_creds_password (
        krb5_context /*context*/,
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_get_init_creds_password (
        krb5_context /*context*/,
index 3e14c5a38fcc89ce01067313be9776fe9033fdc5..2ea534cfe3a512f82fe3a48841f4fa81480add6e 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb5-v4compat.h,v 1.7 2006/05/05 09:29:07 lha Exp $ */
+/* $Id: krb5-v4compat.h 17442 2006-05-05 09:31:15Z lha $ */
 
 #ifndef __KRB5_V4COMPAT_H__
 #define __KRB5_V4COMPAT_H__
 
 #ifndef __KRB5_V4COMPAT_H__
 #define __KRB5_V4COMPAT_H__
index 55a83fb53359c9b2645009bba7302a204848d45b..eefda81ca903dcc87506daf27c2de61248c33b40 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb5.h,v 1.259 2007/01/03 18:51:52 lha Exp $ */
+/* $Id: krb5.h 20245 2007-02-17 00:09:57Z lha $ */
 
 #ifndef __KRB5_H__
 #define __KRB5_H__
 
 #ifndef __KRB5_H__
 #define __KRB5_H__
@@ -222,8 +222,10 @@ typedef enum krb5_key_usage {
     /* Encryption key usage used in the digest encryption field */
     KRB5_KU_DIGEST_OPAQUE = -19,
     /* Checksum key usage used in the digest opaque field */
     /* Encryption key usage used in the digest encryption field */
     KRB5_KU_DIGEST_OPAQUE = -19,
     /* Checksum key usage used in the digest opaque field */
-    KRB5_KU_KRB5SIGNEDPATH = -21
+    KRB5_KU_KRB5SIGNEDPATH = -21,
     /* Checksum key usage on KRB5SignedPath */
     /* Checksum key usage on KRB5SignedPath */
+    KRB5_KU_CANONICALIZED_NAMES = -23
+    /* Checksum key usage on PA-CANONICALIZED */
 } krb5_key_usage;
 
 typedef krb5_key_usage krb5_keyusage;
 } krb5_key_usage;
 
 typedef krb5_key_usage krb5_keyusage;
@@ -744,7 +746,8 @@ typedef krb5_error_code (*krb5_send_to_kdc_func)(krb5_context,
 /* flags for krb5_parse_name_flags */
 enum {
     KRB5_PRINCIPAL_PARSE_NO_REALM = 1,
 /* flags for krb5_parse_name_flags */
 enum {
     KRB5_PRINCIPAL_PARSE_NO_REALM = 1,
-    KRB5_PRINCIPAL_PARSE_MUST_REALM = 2
+    KRB5_PRINCIPAL_PARSE_MUST_REALM = 2,
+    KRB5_PRINCIPAL_PARSE_ENTERPRISE = 4
 };
 
 /* flags for krb5_unparse_name_flags */
 };
 
 /* flags for krb5_unparse_name_flags */
index d59b589304eafa899e0b88c5c94a7802abd05f4c..b53d77ef18854fd696879b16558dd5c0742bb199 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb5_ccapi.h,v 1.3 2006/05/05 09:29:59 lha Exp $ */
+/* $Id: krb5_ccapi.h 17442 2006-05-05 09:31:15Z lha $ */
 
 #ifndef KRB5_CCAPI_H
 #define KRB5_CCAPI_H 1
 
 #ifndef KRB5_CCAPI_H
 #define KRB5_CCAPI_H 1
index e7bada1808623f7e160d8f74d5662f48831ecccb..785c258ee0c2a4dbe165a8bc813afa1434031519 100644 (file)
@@ -3,7 +3,7 @@
 #
 # This might look like a com_err file, but is not
 #
 #
 # This might look like a com_err file, but is not
 #
-id "$Id: krb5_err.et,v 1.14 2006/02/13 11:28:22 lha Exp $"
+id "$Id: krb5_err.et 20760 2007-06-01 03:24:49Z lha $"
 
 error_table krb5
 
 
 error_table krb5
 
@@ -76,6 +76,10 @@ error_code KDC_NOT_TRUSTED,  "KDC not trusted"
 error_code INVALID_SIG,                "Invalid signature"
 error_code DH_KEY_PARAMETERS_NOT_ACCEPTED, "DH parameters not accepted"
 
 error_code INVALID_SIG,                "Invalid signature"
 error_code DH_KEY_PARAMETERS_NOT_ACCEPTED, "DH parameters not accepted"
 
+index 68
+prefix KRB5_KDC_ERR
+error_code WRONG_REALM,                "Wrong realm"
+
 index 69
 prefix KRB5_AP_ERR
 error_code USER_TO_USER_REQUIRED, "User to user required"
 index 69
 prefix KRB5_AP_ERR
 error_code USER_TO_USER_REQUIRED, "User to user required"
@@ -86,7 +90,8 @@ error_code CANT_VERIFY_CERTIFICATE, "Cannot verify certificate"
 error_code INVALID_CERTIFICATE, "Certificate invalid"
 error_code REVOKED_CERTIFICATE, "Certificate revoked"
 error_code REVOCATION_STATUS_UNKNOWN, "Revocation status unknown"
 error_code INVALID_CERTIFICATE, "Certificate invalid"
 error_code REVOKED_CERTIFICATE, "Certificate revoked"
 error_code REVOCATION_STATUS_UNKNOWN, "Revocation status unknown"
-error_code CLIENT_NAME_MISMATCH, "Revocation status unknown"
+error_code REVOCATION_STATUS_UNAVAILABLE, "Revocation status unavaible"
+error_code CLIENT_NAME_MISMATCH, "Client name mismatch in certificate"
 error_code INCONSISTENT_KEY_PURPOSE, "Inconsistent key purpose"
 error_code DIGEST_IN_CERT_NOT_ACCEPTED, "Digest in certificate not accepted"
 error_code PA_CHECKSUM_MUST_BE_INCLUDED, "paChecksum must be included"
 error_code INCONSISTENT_KEY_PURPOSE, "Inconsistent key purpose"
 error_code DIGEST_IN_CERT_NOT_ACCEPTED, "Digest in certificate not accepted"
 error_code PA_CHECKSUM_MUST_BE_INCLUDED, "paChecksum must be included"
@@ -103,7 +108,7 @@ error_code PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED, "Public key encryption not suppo
 
 index 128
 prefix
 
 index 128
 prefix
-error_code KRB5_ERR_RCSID,     "$Id: krb5_err.et,v 1.14 2006/02/13 11:28:22 lha Exp $"
+error_code KRB5_ERR_RCSID,     "$Id: krb5_err.et 20760 2007-06-01 03:24:49Z lha $"
 
 error_code KRB5_LIBOS_BADLOCKFLAG,     "Invalid flag for file lock mode"
 error_code KRB5_LIBOS_CANTREADPWD,     "Cannot read password"
 
 error_code KRB5_LIBOS_BADLOCKFLAG,     "Invalid flag for file lock mode"
 error_code KRB5_LIBOS_CANTREADPWD,     "Cannot read password"
index 35d046c8d9dbf257b49e99fea0f8f2e8c4726996..87169fc43078db6899828a0ddadda3cf3ec4aa37 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb5_locl.h,v 1.97 2006/12/15 16:46:51 lha Exp $ */
+/* $Id: krb5_locl.h 20261 2007-02-18 00:32:22Z lha $ */
 
 #ifndef __KRB5_LOCL_H__
 #define __KRB5_LOCL_H__
 
 #ifndef __KRB5_LOCL_H__
 #define __KRB5_LOCL_H__
@@ -196,9 +196,11 @@ struct _krb5_get_init_creds_opt_private {
     krb5_get_init_creds_tristate req_pac;
     /* PKINIT */
     krb5_pk_init_ctx pk_init_ctx;
     krb5_get_init_creds_tristate req_pac;
     /* PKINIT */
     krb5_pk_init_ctx pk_init_ctx;
-    int canonicalize;
     KRB_ERROR *error;
     krb5_get_init_creds_tristate addressless;
     KRB_ERROR *error;
     krb5_get_init_creds_tristate addressless;
+    int flags;
+#define KRB5_INIT_CREDS_CANONICALIZE           1
+#define KRB5_INIT_CREDS_NO_C_CANON_CHECK       2
 };
 
 typedef struct krb5_context_data {
 };
 
 typedef struct krb5_context_data {
@@ -244,6 +246,10 @@ typedef struct krb5_context_data {
 #define KRB5_DEFAULT_CCNAME_FILE "FILE:/tmp/krb5cc_%{uid}"
 #define KRB5_DEFAULT_CCNAME_API "API:"
 
 #define KRB5_DEFAULT_CCNAME_FILE "FILE:/tmp/krb5cc_%{uid}"
 #define KRB5_DEFAULT_CCNAME_API "API:"
 
+#define EXTRACT_TICKET_ALLOW_CNAME_MISMATCH            1
+#define EXTRACT_TICKET_ALLOW_SERVER_MISMATCH           2
+#define EXTRACT_TICKET_MATCH_REALM                     4
+
 /*
  * Configurable options
  */
 /*
  * Configurable options
  */
index 3e281e5c639ecda0760a873524b5145f30359b25..51bf934bfd159bfbbd4b097c239c6219152d7e5c 100644 (file)
@@ -35,7 +35,7 @@
 #include <resolve.h>
 #include "locate_plugin.h"
 
 #include <resolve.h>
 #include "locate_plugin.h"
 
-RCSID("$Id: krbhst.c,v 1.61 2006/11/30 17:23:08 lha Exp $");
+RCSID("$Id: krbhst.c 19198 2006-11-30 17:23:08Z lha $");
 
 static int
 string_to_proto(const char *string)
 
 static int
 string_to_proto(const char *string)
index ec06d362cf49021e19863fab19380d8335af7a73..251712c8940db4c86e2b74913e014542f22f6e1e 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: locate_plugin.h,v 1.1 2006/11/12 19:00:03 lha Exp $ */
+/* $Id: locate_plugin.h 18998 2006-11-12 19:00:03Z lha $ */
 
 #ifndef HEIMDAL_KRB5_LOCATE_PLUGIN_H
 #define HEIMDAL_KRB5_LOCATE_PLUGIN_H 1
 
 #ifndef HEIMDAL_KRB5_LOCATE_PLUGIN_H
 #define HEIMDAL_KRB5_LOCATE_PLUGIN_H 1
index 9523ca848c44de97123fff24b24a7c365f88aed5..c04f50fd9aa87776c507a40a7e25affe3e010a00 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: log.c,v 1.40 2006/11/21 08:08:46 lha Exp $");
+RCSID("$Id: log.c 19088 2006-11-21 08:08:46Z lha $");
 
 struct facility {
     int min;
 
 struct facility {
     int min;
index 9588d936d53ee8cfb5633d3b64ed268e2067fe55..ff9261a7db75dbbe62f2b5bc7e28aa20d280e9d5 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: mcache.c,v 1.20 2005/09/30 11:16:04 lha Exp $");
+RCSID("$Id: mcache.c 19834 2007-01-11 09:26:21Z lha $");
 
 typedef struct krb5_mcache {
     char *name;
 
 typedef struct krb5_mcache {
     char *name;
@@ -54,8 +54,6 @@ static struct krb5_mcache *mcc_head;
 
 #define MISDEAD(X)     ((X)->dead)
 
 
 #define MISDEAD(X)     ((X)->dead)
 
-#define MCC_CURSOR(C) ((struct link*)(C))
-
 static const char*
 mcc_get_name(krb5_context context,
             krb5_ccache id)
 static const char*
 mcc_get_name(krb5_context context,
             krb5_ccache id)
index f04f8d99967c6e33f29ffbc0ef52cedb29b2e92d..0d410b57d218bfea469215a9c3d5c70cae87f2de 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: misc.c,v 1.6 2006/06/06 14:57:47 lha Exp $");
+RCSID("$Id: misc.c 17616 2006-06-06 14:57:47Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 _krb5_s4u2self_to_checksumdata(krb5_context context, 
 
 krb5_error_code KRB5_LIB_FUNCTION
 _krb5_s4u2self_to_checksumdata(krb5_context context, 
index c4d3ff53905a8c0d983cff76914dd4aecf5dcd21..7440d5476279f8ebe08ef16f69547475c846e48d 100755 (executable)
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: mit_glue.c,v 1.12 2006/11/17 22:17:46 lha Exp $");
+RCSID("$Id: mit_glue.c 20042 2007-01-23 20:37:43Z lha $");
 
 /*
  * Glue for MIT API
 
 /*
  * Glue for MIT API
@@ -340,3 +340,30 @@ krb5_c_keylengths(krb5_context context,
     *ilen = (*ilen + 7) / 8;
     return krb5_enctype_keysize(context, enctype, keylen);
 }
     *ilen = (*ilen + 7) / 8;
     return krb5_enctype_keysize(context, enctype, keylen);
 }
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_c_prf_length(krb5_context context,
+                 krb5_enctype type,
+                 size_t *length)
+{
+    return krb5_crypto_prf_length(context, type, length);
+}
+
+krb5_error_code KRB5_LIB_FUNCTION
+krb5_c_prf(krb5_context context,
+          const krb5_keyblock *key,
+          const krb5_data *input, 
+          krb5_data *output)
+{
+    krb5_crypto crypto;
+    krb5_error_code ret;
+
+    ret = krb5_crypto_init(context, key, 0, &crypto);
+    if (ret)
+       return ret;
+
+    ret = krb5_crypto_prf(context, crypto, input, output);
+    krb5_crypto_destroy(context, crypto);
+
+    return ret;
+}
index 7a8b1ba06b9542eaf7273de317ef71a8af105c3c..704664993435cada9dbe62a9b0f94f3e1e9d165a 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: mk_error.c,v 1.22 2005/06/16 21:16:40 lha Exp $");
+RCSID("$Id: mk_error.c 15457 2005-06-16 21:16:40Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_mk_error(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_mk_error(krb5_context context,
index b5a1aadfea23c695d2e385114a1fdc6c1794bb39..87e429af8cba50c4e4c206f0945afb4cf15e07b8 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_priv.c,v 1.35 2006/02/01 12:39:26 lha Exp $");
+RCSID("$Id: mk_priv.c 16680 2006-02-01 12:39:26Z lha $");
 
       
 krb5_error_code KRB5_LIB_FUNCTION
 
       
 krb5_error_code KRB5_LIB_FUNCTION
index 90823f947849701bd2be04162dfcc4d37387f8c0..570a83720132dbe576c2cfd79e9a2f438a47cacd 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_rep.c,v 1.26 2004/05/25 21:33:51 lha Exp $");
+RCSID("$Id: mk_rep.c 13863 2004-05-25 21:46:46Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_mk_rep(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_mk_rep(krb5_context context,
index adc077e13fa071ffd0fbd1b1b2835b40e4401865..5f64f01e9560714aab4c361285d12f26fe449c87 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_req.c,v 1.26 2004/05/25 21:34:11 lha Exp $");
+RCSID("$Id: mk_req.c 13863 2004-05-25 21:46:46Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_mk_req_exact(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_mk_req_exact(krb5_context context,
index 8646c4ebea6437394e32fd0002c3e22c9f4b8c6d..b6d55c8815acf4442626ea5954a331da696a498b 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_req_ext.c,v 1.33 2006/12/27 12:07:22 lha Exp $");
+RCSID("$Id: mk_req_ext.c 19511 2006-12-27 12:07:22Z lha $");
 
 krb5_error_code
 _krb5_mk_req_internal(krb5_context context,
 
 krb5_error_code
 _krb5_mk_req_internal(krb5_context context,
index 691e95eb86e26442dbfd997f7ca3864933427bef..1474a76b7752e3a3c3f774bb2d4a4763f9d1f6e6 100644 (file)
@@ -32,7 +32,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: n-fold.c,v 1.7 2004/05/25 21:35:31 lha Exp $");
+RCSID("$Id: n-fold.c 13863 2004-05-25 21:46:46Z lha $");
 
 static void
 rr13(unsigned char *buf, size_t len)
 
 static void
 rr13(unsigned char *buf, size_t len)
index 283759c98b0755364b16cd77e2768ac7cdd9baa1..55d4f5ff5646165fed066b50c4e8ae980f523740 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: pac.c,v 1.13 2007/01/09 11:22:56 lha Exp $");
+RCSID("$Id: pac.c 20845 2007-06-03 14:31:16Z lha $");
 
 struct PAC_INFO_BUFFER {
     uint32_t type;
 
 struct PAC_INFO_BUFFER {
     uint32_t type;
@@ -56,14 +56,15 @@ struct krb5_pac {
     struct PAC_INFO_BUFFER *logon_name;
 };
 
     struct PAC_INFO_BUFFER *logon_name;
 };
 
-#define PAC_ALIGNMENT          8
+#define PAC_ALIGNMENT                  8
 
 
-#define PACTYPE_SIZE           8
-#define PAC_INFO_BUFFER_SIZE   16
+#define PACTYPE_SIZE                   8
+#define PAC_INFO_BUFFER_SIZE           16
 
 
-#define PAC_SERVER_CHECKSUM    6
-#define PAC_PRIVSVR_CHECKSUM   7
-#define PAC_LOGON_NAME         10
+#define PAC_SERVER_CHECKSUM            6
+#define PAC_PRIVSVR_CHECKSUM           7
+#define PAC_LOGON_NAME                 10
+#define PAC_CONSTRAINED_DELEGATION     11
 
 #define CHECK(r,f,l)                                           \
        do {                                                    \
 
 #define CHECK(r,f,l)                                           \
        do {                                                    \
@@ -252,12 +253,10 @@ krb5_pac_add_buffer(krb5_context context, struct krb5_pac *p,
 {
     krb5_error_code ret;
     void *ptr;
 {
     krb5_error_code ret;
     void *ptr;
-    size_t len, offset, header_end;
+    size_t len, offset, header_end, old_end;
     uint32_t i;
 
     uint32_t i;
 
-    len = p->pac->numbuffers + 1;
-    if (len < p->pac->numbuffers)
-       return EINVAL;
+    len = p->pac->numbuffers;
 
     ptr = realloc(p->pac,
                  sizeof(*p->pac) + (sizeof(p->pac->buffers[0]) * len));
 
     ptr = realloc(p->pac,
                  sizeof(*p->pac) + (sizeof(p->pac->buffers[0]) * len));
@@ -272,11 +271,12 @@ krb5_pac_add_buffer(krb5_context context, struct krb5_pac *p,
 
     offset = p->data.length + PAC_INFO_BUFFER_SIZE;
 
 
     offset = p->data.length + PAC_INFO_BUFFER_SIZE;
 
-    p->pac->buffers[len - 1].type = type;
-    p->pac->buffers[len - 1].buffersize = data->length;
-    p->pac->buffers[len - 1].offset_lo = offset;
-    p->pac->buffers[len - 1].offset_hi = 0;
+    p->pac->buffers[len].type = type;
+    p->pac->buffers[len].buffersize = data->length;
+    p->pac->buffers[len].offset_lo = offset;
+    p->pac->buffers[len].offset_hi = 0;
 
 
+    old_end = p->data.length;
     len = p->data.length + data->length + PAC_INFO_BUFFER_SIZE;
     if (len < p->data.length) {
        krb5_set_error_string(context, "integer overrun");
     len = p->data.length + data->length + PAC_INFO_BUFFER_SIZE;
     if (len < p->data.length) {
        krb5_set_error_string(context, "integer overrun");
@@ -292,14 +292,17 @@ krb5_pac_add_buffer(krb5_context context, struct krb5_pac *p,
        return ret;
     }
 
        return ret;
     }
 
-    /* make place for PAC INFO BUFFER header */
+    /* 
+     * make place for new PAC INFO BUFFER header
+     */
     header_end = PACTYPE_SIZE + (PAC_INFO_BUFFER_SIZE * p->pac->numbuffers);
     header_end = PACTYPE_SIZE + (PAC_INFO_BUFFER_SIZE * p->pac->numbuffers);
-    memmove((unsigned char *)p->data.data + header_end,
-           (unsigned char *)p->data.data + header_end + PAC_INFO_BUFFER_SIZE,
-           PAC_INFO_BUFFER_SIZE);
+    memmove((unsigned char *)p->data.data + header_end + PAC_INFO_BUFFER_SIZE,
+           (unsigned char *)p->data.data + header_end ,
+           old_end - header_end);
+    memset((unsigned char *)p->data.data + header_end, 0, PAC_INFO_BUFFER_SIZE);
 
     /*
 
     /*
-     *
+     * copy in new data part
      */
 
     memcpy((unsigned char *)p->data.data + offset,
      */
 
     memcpy((unsigned char *)p->data.data + offset,
@@ -444,12 +447,15 @@ verify_checksum(krb5_context context,
 
     ret = krb5_verify_checksum(context, crypto, KRB5_KU_OTHER_CKSUM,
                               ptr, len, &cksum);
 
     ret = krb5_verify_checksum(context, crypto, KRB5_KU_OTHER_CKSUM,
                               ptr, len, &cksum);
+    free(cksum.checksum.data);
     krb5_crypto_destroy(context, crypto);
     krb5_storage_free(sp);
 
     return ret;
 
 out:
     krb5_crypto_destroy(context, crypto);
     krb5_storage_free(sp);
 
     return ret;
 
 out:
+    if (cksum.checksum.data)
+       free(cksum.checksum.data);
     if (sp)
        krb5_storage_free(sp);
     if (crypto)
     if (sp)
        krb5_storage_free(sp);
     if (crypto)
@@ -890,7 +896,6 @@ _krb5_pac_sign(krb5_context context,
        goto out;
 
     /* Set lengths for checksum */
        goto out;
 
     /* Set lengths for checksum */
-
     ret = pac_checksum(context, server_key, &server_cksumtype, &server_size);
     if (ret)
        goto out;
     ret = pac_checksum(context, server_key, &server_cksumtype, &server_size);
     if (ret)
        goto out;
index d5c3f422a796111a2e481384f54a17f7afcd69fc..b2b70f52e786b1781962b4430166927f34aa247e 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: padata.c,v 1.5 2005/06/17 04:28:35 lha Exp $");
+RCSID("$Id: padata.c 15469 2005-06-17 04:28:35Z lha $");
 
 PA_DATA *
 krb5_find_padata(PA_DATA *val, unsigned len, int type, int *idx)
 
 PA_DATA *
 krb5_find_padata(PA_DATA *val, unsigned len, int type, int *idx)
index 4f8ed8fe0757120c61aadcfd71f7635befb7c397..dd828420847681a84f7ac11399082987422c386d 100755 (executable)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: pkinit.c,v 1.120 2006/12/08 02:48:09 lha Exp $");
+RCSID("$Id: pkinit.c 21004 2007-06-08 01:53:10Z lha $");
 
 struct krb5_dh_moduli {
     char *name;
 
 struct krb5_dh_moduli {
     char *name;
@@ -83,10 +83,11 @@ struct krb5_pk_init_ctx_data {
     struct krb5_dh_moduli **m;
     hx509_peer_info peer;
     int type;
     struct krb5_dh_moduli **m;
     hx509_peer_info peer;
     int type;
-    int require_binding;
-    int require_eku;
-    int require_krbtgt_otherName;
-    int require_hostname_match;
+    unsigned int require_binding:1;
+    unsigned int require_eku:1;
+    unsigned int require_krbtgt_otherName:1;
+    unsigned int require_hostname_match:1;
+    unsigned int trustedCertifiers:1;
 };
 
 static void
 };
 
 static void
@@ -170,6 +171,7 @@ _krb5_pk_create_sign(krb5_context context,
     }
 
     ret = hx509_cms_create_signed_1(id->hx509ctx,
     }
 
     ret = hx509_cms_create_signed_1(id->hx509ctx,
+                                   0,
                                    eContentType,
                                    eContent->data,
                                    eContent->length,
                                    eContentType,
                                    eContent->data,
                                    eContent->length,
@@ -438,7 +440,6 @@ build_auth_pack(krb5_context context,
            return ret;
     }
 
            return ret;
     }
 
-
     return ret;
 }
 
     return ret;
 }
 
@@ -587,18 +588,21 @@ pk_mk_padata(krb5_context context,
        memset(&req, 0, sizeof(req));
        req.signedAuthPack = buf;       
 
        memset(&req, 0, sizeof(req));
        req.signedAuthPack = buf;       
 
-       req.trustedCertifiers = calloc(1, sizeof(*req.trustedCertifiers));
-       if (req.trustedCertifiers == NULL) {
-           krb5_set_error_string(context, "malloc: out of memory");
-           free_PA_PK_AS_REQ(&req);
-           goto out;
-       }
-       ret = build_edi(context, ctx->id->hx509ctx, 
-                       ctx->id->anchors, req.trustedCertifiers);
-       if (ret) {
-           krb5_set_error_string(context, "pk-init: failed to build trustedCertifiers");
-           free_PA_PK_AS_REQ(&req);
-           goto out;
+       if (ctx->trustedCertifiers) {
+
+           req.trustedCertifiers = calloc(1, sizeof(*req.trustedCertifiers));
+           if (req.trustedCertifiers == NULL) {
+               krb5_set_error_string(context, "malloc: out of memory");
+               free_PA_PK_AS_REQ(&req);
+               goto out;
+           }
+           ret = build_edi(context, ctx->id->hx509ctx, 
+                           ctx->id->anchors, req.trustedCertifiers);
+           if (ret) {
+               krb5_set_error_string(context, "pk-init: failed to build trustedCertifiers");
+               free_PA_PK_AS_REQ(&req);
+               goto out;
+           }
        }
        req.kdcPkId = NULL;
 
        }
        req.kdcPkId = NULL;
 
@@ -684,6 +688,14 @@ _krb5_pk_mk_padata(krb5_context context,
                                     "pkinit_require_hostname_match",
                                     NULL);
 
                                     "pkinit_require_hostname_match",
                                     NULL);
 
+    ctx->trustedCertifiers = 
+       krb5_config_get_bool_default(context, NULL,
+                                    TRUE,
+                                    "realms",
+                                    req_body->realm,
+                                    "pkinit_trustedCertifiers",
+                                    NULL);
+
     return pk_mk_padata(context, ctx, req_body, nonce, md);
 }
 
     return pk_mk_padata(context, ctx, req_body, nonce, md);
 }
 
@@ -705,6 +717,7 @@ _krb5_pk_verify_sign(krb5_context context,
                                  id->verify_ctx,
                                  data,
                                  length,
                                  id->verify_ctx,
                                  data,
                                  length,
+                                 NULL,
                                  id->certpool,
                                  contentType,
                                  content,
                                  id->certpool,
                                  contentType,
                                  content,
@@ -1120,8 +1133,11 @@ pk_rd_pa_reply_dh(krb5_context context,
                              &kdc_dh_info,
                              &size);
 
                              &kdc_dh_info,
                              &size);
 
-    if (ret)
+    if (ret) {
+       krb5_set_error_string(context, "pkinit - "
+                             "failed to decode KDC DH Key Info");
        goto out;
        goto out;
+    }
 
     if (kdc_dh_info.nonce != nonce) {
        krb5_set_error_string(context, "PKINIT: DH nonce is wrong");
 
     if (kdc_dh_info.nonce != nonce) {
        krb5_set_error_string(context, "PKINIT: DH nonce is wrong");
@@ -1226,6 +1242,7 @@ pk_rd_pa_reply_dh(krb5_context context,
        _krb5_pk_cert_free(host);
     if (content.data)
        krb5_data_free(&content);
        _krb5_pk_cert_free(host);
     if (content.data)
        krb5_data_free(&content);
+    der_free_oid(&contentType);
     free_KDCDHKeyInfo(&kdc_dh_info);
 
     return ret;
     free_KDCDHKeyInfo(&kdc_dh_info);
 
     return ret;
@@ -1262,8 +1279,10 @@ _krb5_pk_rd_pa_reply(krb5_context context,
                                  pa->padata_value.length,
                                  &rep,
                                  &size);
                                  pa->padata_value.length,
                                  &rep,
                                  &size);
-       if (ret)
+       if (ret) {
+           krb5_set_error_string(context, "Failed to decode pkinit AS rep");
            return ret;
            return ret;
+       }
 
        switch (rep.element) {
        case choice_PA_PK_AS_REP_dhInfo:
 
        switch (rep.element) {
        case choice_PA_PK_AS_REP_dhInfo:
@@ -1861,6 +1880,7 @@ _krb5_get_init_creds_opt_free_pkinit(krb5_get_init_creds_opt *opt)
        free(ctx->id);
        ctx->id = NULL;
     }
        free(ctx->id);
        ctx->id = NULL;
     }
+    free(opt->opt_private->pk_init_ctx);
     opt->opt_private->pk_init_ctx = NULL;
 #endif
 }
     opt->opt_private->pk_init_ctx = NULL;
 #endif
 }
index ce7171dbf0abf3d18c2a83be874a608bf4be3f88..f19464bf3c8609452fa1ffc24b13a2d0e3a99298 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: plugin.c,v 1.4 2007/01/09 17:46:01 lha Exp $");
+RCSID("$Id: plugin.c 19789 2007-01-09 17:46:01Z lha $");
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
 #endif
 #ifdef HAVE_DLFCN_H
 #include <dlfcn.h>
 #endif
index 57fcf63dcfa716e6decb49f50241355cd0c61424..ef3f5412db008ecd81d5e12c70c73f0c4e70770d 100644 (file)
@@ -41,7 +41,7 @@
 #include <fnmatch.h>
 #include "resolve.h"
 
 #include <fnmatch.h>
 #include "resolve.h"
 
-RCSID("$Id: principal.c,v 1.100 2006/12/17 22:53:39 lha Exp $");
+RCSID("$Id: principal.c 20223 2007-02-15 04:17:04Z lha $");
 
 #define princ_num_comp(P) ((P)->name.name_string.len)
 #define princ_type(P) ((P)->name.name_type)
 
 #define princ_num_comp(P) ((P)->name.name_string.len)
 #define princ_type(P) ((P)->name.name_type)
@@ -110,6 +110,8 @@ krb5_parse_name_flags(krb5_context context,
     int n;
     char c;
     int got_realm = 0;
     int n;
     char c;
     int got_realm = 0;
+    int first_at = 1;
+    int enterprise = (flags & KRB5_PRINCIPAL_PARSE_ENTERPRISE);
   
     *principal = NULL;
 
   
     *principal = NULL;
 
@@ -122,18 +124,24 @@ krb5_parse_name_flags(krb5_context context,
     }
 #undef RFLAGS
 
     }
 #undef RFLAGS
 
-    /* count number of component */
+    /* count number of component,
+     * enterprise names only have one component
+     */
     ncomp = 1;
     ncomp = 1;
-    for(p = name; *p; p++){
-       if(*p=='\\'){
-           if(!p[1]) {
-               krb5_set_error_string (context,
-                                      "trailing \\ in principal name");
-               return KRB5_PARSE_MALFORMED;
-           }
-           p++;
-       } else if(*p == '/')
-           ncomp++;
+    if (!enterprise) {
+       for(p = name; *p; p++){
+           if(*p=='\\'){
+               if(!p[1]) {
+                   krb5_set_error_string (context,
+                                          "trailing \\ in principal name");
+                   return KRB5_PARSE_MALFORMED;
+               }
+               p++;
+           } else if(*p == '/')
+               ncomp++;
+           else if(*p == '@')
+               break;
+       }
     }
     comp = calloc(ncomp, sizeof(*comp));
     if (comp == NULL) {
     }
     comp = calloc(ncomp, sizeof(*comp));
     if (comp == NULL) {
@@ -166,7 +174,10 @@ krb5_parse_name_flags(krb5_context context,
                ret = KRB5_PARSE_MALFORMED;
                goto exit;
            }
                ret = KRB5_PARSE_MALFORMED;
                goto exit;
            }
-       }else if(c == '/' || c == '@'){
+       }else if(enterprise && first_at) {
+           if (c == '@')
+               first_at = 0;
+       }else if((c == '/' && !enterprise) || c == '@'){
            if(got_realm){
                krb5_set_error_string (context,
                                       "part after realm in principal name");
            if(got_realm){
                krb5_set_error_string (context,
                                       "part after realm in principal name");
@@ -241,7 +252,10 @@ krb5_parse_name_flags(krb5_context context,
        ret = ENOMEM;
        goto exit;
     }
        ret = ENOMEM;
        goto exit;
     }
-    (*principal)->name.name_type = KRB5_NT_PRINCIPAL;
+    if (enterprise)
+       (*principal)->name.name_type = KRB5_NT_ENTERPRISE_PRINCIPAL;
+    else
+       (*principal)->name.name_type = KRB5_NT_PRINCIPAL;
     (*principal)->name.name_string.val = comp;
     princ_num_comp(*principal) = n;
     (*principal)->realm = realm;
     (*principal)->name.name_string.val = comp;
     princ_num_comp(*principal) = n;
     (*principal)->realm = realm;
index 3ea512c9a7e2d7e841e4dcd1c5199811a972dfa7..e0f407fb247e13c24d823e80640989c6bb9bd06d 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: prompter_posix.c,v 1.10 2004/05/25 21:38:14 lha Exp $");
+RCSID("$Id: prompter_posix.c 13863 2004-05-25 21:46:46Z lha $");
 
 int KRB5_LIB_FUNCTION
 krb5_prompter_posix (krb5_context context,
 
 int KRB5_LIB_FUNCTION
 krb5_prompter_posix (krb5_context context,
index 46a36c9aac7d189534746b936c7d8a25c2ff6289..c3f732201f3d9b271d5b3d0c3e2719dde3705666 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_cred.c,v 1.29 2006/10/06 17:04:47 lha Exp $");
+RCSID("$Id: rd_cred.c 20304 2007-04-11 11:15:05Z lha $");
 
 static krb5_error_code
 compare_addrs(krb5_context context,
 
 static krb5_error_code
 compare_addrs(krb5_context context,
@@ -79,8 +79,10 @@ krb5_rd_cred(krb5_context context,
 
     ret = decode_KRB_CRED(in_data->data, in_data->length, 
                          &cred, &len);
 
     ret = decode_KRB_CRED(in_data->data, in_data->length, 
                          &cred, &len);
-    if(ret)
+    if(ret) {
+       krb5_clear_error_string(context);
        return ret;
        return ret;
+    }
 
     if (cred.pvno != 5) {
        ret = KRB5KRB_AP_ERR_BADVERSION;
 
     if (cred.pvno != 5) {
        ret = KRB5KRB_AP_ERR_BADVERSION;
@@ -151,6 +153,8 @@ krb5_rd_cred(krb5_context context,
                                      enc_krb_cred_part_data.length,
                                      &enc_krb_cred_part,
                                      &len);
                                      enc_krb_cred_part_data.length,
                                      &enc_krb_cred_part,
                                      &len);
+    if (enc_krb_cred_part_data.data != cred.enc_part.cipher.data)
+       krb5_data_free(&enc_krb_cred_part_data);
     if (ret)
        goto out;
 
     if (ret)
        goto out;
 
index 93e70c48bd80a6ba51abfb1875ad1b19e4f11dd6..89615ee8ac71b7e08fdcf6dba351a87d0761a143 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: rd_error.c,v 1.8 2005/05/18 04:21:57 lha Exp $");
+RCSID("$Id: rd_error.c 20304 2007-04-11 11:15:05Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_rd_error(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_rd_error(krb5_context context,
@@ -45,8 +45,10 @@ krb5_rd_error(krb5_context context,
     krb5_error_code ret;
 
     ret = decode_KRB_ERROR(msg->data, msg->length, result, &len);
     krb5_error_code ret;
 
     ret = decode_KRB_ERROR(msg->data, msg->length, result, &len);
-    if(ret)
+    if(ret) {
+       krb5_clear_error_string(context);
        return ret;
        return ret;
+    }
     result->error_code += KRB5KDC_ERR_NONE;
     return 0;
 }
     result->error_code += KRB5KDC_ERR_NONE;
     return 0;
 }
index c52ac175fdb8e7e0d2a11329dfd9617ee1f3656b..d3920dd941739cb9fe5cdc86bd074d4d50737426 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_priv.c,v 1.33 2006/04/12 16:18:10 lha Exp $");
+RCSID("$Id: rd_priv.c 17056 2006-04-12 16:18:10Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_rd_priv(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_rd_priv(krb5_context context,
index 6b7f27c3cffa2c8e81335fa4e3138b1423e13be4..8c9b7bb441d7be3f2937211570f9c5b1d536991c 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_rep.c,v 1.26 2006/08/21 09:19:22 lha Exp $");
+RCSID("$Id: rd_rep.c 17890 2006-08-21 09:19:22Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_rd_rep(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_rd_rep(krb5_context context,
index b7dea2a3279102b4cbf1bacf10dd1d8791ef21da..001b47f094dfa715f08088fd8f4f27ede13755c4 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1997 - 2001, 2003 - 2005 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_req.c,v 1.70 2007/01/04 11:27:20 lha Exp $");
+RCSID("$Id: rd_req.c 21004 2007-06-08 01:53:10Z lha $");
 
 static krb5_error_code
 decrypt_tkt_enc_part (krb5_context context,
 
 static krb5_error_code
 decrypt_tkt_enc_part (krb5_context context,
@@ -208,6 +208,8 @@ find_etypelist(krb5_context context,
                           adIfRelevant.val[0].ad_data.length,
                           etypes,
                           NULL);
                           adIfRelevant.val[0].ad_data.length,
                           etypes,
                           NULL);
+    if (ret)
+       krb5_clear_error_string(context);
 
     free_AD_IF_RELEVANT(&adIfRelevant);
 
 
     free_AD_IF_RELEVANT(&adIfRelevant);
 
index b89f150159a08ad27f5ad0797c9c3e715093b204..12894d96a95ead3cc20a14a584ff49d135c159a5 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include <vis.h>
 
 #include "krb5_locl.h"
 #include <vis.h>
 
-RCSID("$Id: replay.c,v 1.12 2006/04/10 17:13:49 lha Exp $");
+RCSID("$Id: replay.c 17047 2006-04-10 17:13:49Z lha $");
 
 struct krb5_rcache_data {
     char *name;
 
 struct krb5_rcache_data {
     char *name;
index 11c07c9e8f0ab4c84d60bfa31b4f6deef220c893..6c70244327667e47c9f4e92609fced41b0d3ced5 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: send_to_kdc.c,v 1.60 2006/10/20 18:42:01 lha Exp $");
+RCSID("$Id: send_to_kdc.c 19973 2007-01-17 17:19:52Z lha $");
 
 struct send_to_kdc {
     krb5_send_to_kdc_func func;
 
 struct send_to_kdc {
     krb5_send_to_kdc_func func;
@@ -331,6 +331,8 @@ krb5_sendto (krb5_context context,
      int fd;
      int i;
 
      int fd;
      int i;
 
+     krb5_data_zero(receive);
+
      for (i = 0; i < context->max_retries; ++i) {
         krb5_krbhst_info *hi;
 
      for (i = 0; i < context->max_retries; ++i) {
         krb5_krbhst_info *hi;
 
index 965883309c023df36a2152296e55efd944290db1..98040bc2e9d6c73065be182258d33dfb26697e37 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: set_default_realm.c,v 1.14 2004/05/25 21:42:26 lha Exp $");
+RCSID("$Id: set_default_realm.c 13863 2004-05-25 21:46:46Z lha $");
 
 /*
  * Convert the simple string `s' into a NULL-terminated and freshly allocated 
 
 /*
  * Convert the simple string `s' into a NULL-terminated and freshly allocated 
index 5422c540b93a75c761938c4500c61016fc5be681..4abcf44a43ac36b7c96272aa1eab8f0d926f78c9 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include "store-int.h"
 
 #include "krb5_locl.h"
 #include "store-int.h"
 
-RCSID("$Id: store.c,v 1.60 2006/12/17 22:49:37 lha Exp $");
+RCSID("$Id: store.c 20529 2007-04-22 14:28:19Z lha $");
 
 #define BYTEORDER_IS(SP, V) (((SP)->flags & KRB5_STORAGE_BYTEORDER_MASK) == (V))
 #define BYTEORDER_IS_LE(SP) BYTEORDER_IS((SP), KRB5_STORAGE_BYTEORDER_LE)
 
 #define BYTEORDER_IS(SP, V) (((SP)->flags & KRB5_STORAGE_BYTEORDER_MASK) == (V))
 #define BYTEORDER_IS_LE(SP) BYTEORDER_IS((SP), KRB5_STORAGE_BYTEORDER_LE)
@@ -891,7 +891,7 @@ krb5_store_creds_tag(krb5_storage *sp, krb5_creds *creds)
        header |= SC_CLIENT_PRINCIPAL;
     if (creds->server)
        header |= SC_SERVER_PRINCIPAL;
        header |= SC_CLIENT_PRINCIPAL;
     if (creds->server)
        header |= SC_SERVER_PRINCIPAL;
-    if (creds->session.keyvalue.data)
+    if (creds->session.keytype != ETYPE_NULL)
        header |= SC_SESSION_KEY;
     if (creds->ticket.data)
        header |= SC_TICKET;
        header |= SC_SESSION_KEY;
     if (creds->ticket.data)
        header |= SC_TICKET;
@@ -916,7 +916,7 @@ krb5_store_creds_tag(krb5_storage *sp, krb5_creds *creds)
            return ret;
     }
 
            return ret;
     }
 
-    if (creds->session.keyvalue.data) {
+    if (creds->session.keytype != ETYPE_NULL) {
        ret = krb5_store_keyblock(sp, creds->session);
        if(ret)
            return ret;
        ret = krb5_store_keyblock(sp, creds->session);
        if(ret)
            return ret;
index b9f93728dec78177e6d049edeecf07c1ccf5f2e6..07acdd1a00b7f9fe9eff1d534e05c7e059d0cca5 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include "store-int.h"
 
 #include "krb5_locl.h"
 #include "store-int.h"
 
-RCSID("$Id: store_emem.c,v 1.14 2004/05/25 21:43:29 lha Exp $");
+RCSID("$Id: store_emem.c 13863 2004-05-25 21:46:46Z lha $");
 
 typedef struct emem_storage{
     unsigned char *base;
 
 typedef struct emem_storage{
     unsigned char *base;
index 835d3478e22289ab756a859750bdcc74f379139c..15f86fcac30bf281d8a3c08f01112c37d9e90d94 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include "store-int.h"
 
 #include "krb5_locl.h"
 #include "store-int.h"
 
-RCSID("$Id: store_fd.c,v 1.13 2006/06/30 21:23:19 lha Exp $");
+RCSID("$Id: store_fd.c 17779 2006-06-30 21:23:19Z lha $");
 
 typedef struct fd_storage {
     int fd;
 
 typedef struct fd_storage {
     int fd;
index d2b6d182522aba5208ba2c5685b9e4c470eed2fb..e6e62b5a62e42111310efb53cd2ddfc04e958019 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include "store-int.h"
 
 #include "krb5_locl.h"
 #include "store-int.h"
 
-RCSID("$Id: store_mem.c,v 1.13 2006/11/07 23:02:53 lha Exp $");
+RCSID("$Id: store_mem.c 20307 2007-04-11 11:16:28Z lha $");
 
 typedef struct mem_storage{
     unsigned char *base;
 
 typedef struct mem_storage{
     unsigned char *base;
@@ -121,7 +121,7 @@ krb5_storage_from_mem(void *buf, size_t len)
 krb5_storage * KRB5_LIB_FUNCTION
 krb5_storage_from_data(krb5_data *data)
 {
 krb5_storage * KRB5_LIB_FUNCTION
 krb5_storage_from_data(krb5_data *data)
 {
-       return krb5_storage_from_mem(data->data, data->length);
+    return krb5_storage_from_mem(data->data, data->length);
 }
 
 krb5_storage * KRB5_LIB_FUNCTION
 }
 
 krb5_storage * KRB5_LIB_FUNCTION
index 81372c158e2d4cbb072f4c3d768fdab1531c40ba..7eb4d32fad57fd75d8403acfdb0f1506de272a25 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: ticket.c,v 1.18 2006/12/28 20:49:18 lha Exp $");
+RCSID("$Id: ticket.c 19544 2006-12-28 20:49:18Z lha $");
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_free_ticket(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_free_ticket(krb5_context context,
index 4a120ab7716792806d4b14cc0f09a95f477aa532..4cd992d48f27386f05772b1f280cacd43dc84054 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: time.c,v 1.13 2004/10/13 17:57:11 lha Exp $");
+RCSID("$Id: time.c 14308 2004-10-13 17:57:11Z lha $");
 
 /*
  * Set the absolute time that the caller knows the kdc has so the
 
 /*
  * Set the absolute time that the caller knows the kdc has so the
index 7f18b30c883a91d0647033993a85aa425493b903..7f5498f5921c62ee0abade98b1b0100311c58126 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: transited.c,v 1.18 2006/04/10 10:26:35 lha Exp $");
+RCSID("$Id: transited.c 17043 2006-04-10 10:26:35Z lha $");
 
 /* this is an attempt at one of the most horrible `compression'
    schemes that has ever been invented; it's so amazingly brain-dead
 
 /* this is an attempt at one of the most horrible `compression'
    schemes that has ever been invented; it's so amazingly brain-dead
index b1e12674dc821ceb48b21eb65fca3941859274e0..d42fbec3a50fe751a3f8d0ddb6a4698717f1592f 100644 (file)
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: v4_glue.c,v 1.5 2006/05/05 09:31:00 lha Exp $");
+RCSID("$Id: v4_glue.c 17442 2006-05-05 09:31:15Z lha $");
 
 #include "krb5-v4compat.h"
 
 
 #include "krb5-v4compat.h"
 
index 5f0fd6680bf5ef8c733f12dc201ff496073ce099..f7ccff5bc882e7d43236a4094d9a8dc00363d1b5 100644 (file)
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
 
 #include "krb5_locl.h"
 
-RCSID("$Id: version.c,v 1.3 1999/12/02 17:05:13 joda Exp $");
+RCSID("$Id: version.c 7464 1999-12-02 17:05:13Z joda $");
 
 /* this is just to get a version stamp in the library file */
 
 
 /* this is just to get a version stamp in the library file */
 
index 42528653011b5815d3ca08ef55486340343f5445..85f143b8b4b6ee5fc29cd1052b09aa36917f57a0 100644 (file)
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include <err.h>
 
 #include "krb5_locl.h"
 #include <err.h>
 
-RCSID("$Id: warn.c,v 1.16 2006/11/21 08:06:40 lha Exp $");
+RCSID("$Id: warn.c 19086 2006-11-21 08:06:40Z lha $");
 
 static krb5_error_code _warnerr(krb5_context context, int do_errtext, 
         krb5_error_code code, int level, const char *fmt, va_list ap)
 
 static krb5_error_code _warnerr(krb5_context context, int do_errtext, 
         krb5_error_code code, int level, const char *fmt, va_list ap)
index e9e0837003169488e451ddb8bd3d7f8125554146..2df32dfa50d9ea2dcee4c5420a71588410333c0a 100644 (file)
@@ -83,7 +83,7 @@ void
 heim_ntlm_free_type1 (struct ntlm_type1 */*data*/);
 
 void
 heim_ntlm_free_type1 (struct ntlm_type1 */*data*/);
 
 void
-heim_ntlm_free_type2 (struct ntlm_type2 */*type2*/);
+heim_ntlm_free_type2 (struct ntlm_type2 */*data*/);
 
 void
 heim_ntlm_free_type3 (struct ntlm_type3 */*data*/);
 
 void
 heim_ntlm_free_type3 (struct ntlm_type3 */*data*/);
index 1e38b2e400a35240a5642cc4aad922c83456790b..1c1afe1eb1fd0f59aa55550f7a13e58b000dde66 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: heimntlm.h,v 1.4 2006/12/20 07:28:37 lha Exp $ */
+/* $Id: heimntlm.h 19469 2006-12-20 07:28:37Z lha $ */
 
 #ifndef HEIM_NTLM_H
 #define HEIM_NTLM_H
 
 #ifndef HEIM_NTLM_H
 #define HEIM_NTLM_H
index 430e80505efc24d4987d08ccd575af48351153ce..af950cc3b5205fe4ce6b161065fbabac937642e0 100644 (file)
@@ -33,7 +33,7 @@
 
 #include <config.h>
 
 
 #include <config.h>
 
-RCSID("$Id: ntlm.c,v 1.8 2006/12/26 00:25:17 lha Exp $");
+RCSID("$Id: ntlm.c 20816 2007-06-03 04:36:31Z lha $");
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -308,8 +308,10 @@ heim_ntlm_decode_targetinfo(struct ntlm_buf *data, int ucs2,
 void
 heim_ntlm_free_type1(struct ntlm_type1 *data)
 {
 void
 heim_ntlm_free_type1(struct ntlm_type1 *data)
 {
-    free(data->domain);
-    free(data->hostname);
+    if (data->domain)
+       free(data->domain);
+    if (data->hostname)
+       free(data->hostname);
     memset(data, 0, sizeof(*data));
 }
 
     memset(data, 0, sizeof(*data));
 }
 
@@ -432,9 +434,12 @@ out:
  */
 
 void
  */
 
 void
-heim_ntlm_free_type2(struct ntlm_type2 *type2)
+heim_ntlm_free_type2(struct ntlm_type2 *data)
 {
 {
-    memset(type2, 0, sizeof(*type2));
+    if (data->targetname)
+       free(data->targetname);
+    _ntlm_free_buf(&data->targetinfo);
+    memset(data, 0, sizeof(*data));
 }
 
 int
 }
 
 int
@@ -558,10 +563,18 @@ out:
 void
 heim_ntlm_free_type3(struct ntlm_type3 *data)
 {
 void
 heim_ntlm_free_type3(struct ntlm_type3 *data)
 {
+    _ntlm_free_buf(&data->lm);
+    _ntlm_free_buf(&data->ntlm);
+    if (data->targetname)
+       free(data->targetname);
+    if (data->username)
+       free(data->username);
+    if (data->ws)
+       free(data->ws);
+    _ntlm_free_buf(&data->sessionkey);
     memset(data, 0, sizeof(*data));
 }
 
     memset(data, 0, sizeof(*data));
 }
 
-
 /*
  *
  */
 /*
  *
  */
index 0d9d6119db07ba80a8da7053c7e25663cc33c411..daf7fc567161b131dfe4326c0ef34c8364a75eeb 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: base64.c,v 1.7 2005/06/23 10:47:57 lha Exp $");
+RCSID("$Id: base64.c 15506 2005-06-23 10:47:57Z lha $");
 #endif
 #include <stdlib.h>
 #include <string.h>
 #endif
 #include <stdlib.h>
 #include <string.h>
index 95992f9c2127b87ac6c69b8b6558c828470827e3..09aadffe7c4180273a27aa17cd3636ad8f6ba022 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: base64.h,v 1.4 2005/06/30 07:13:33 lha Exp $ */
+/* $Id: base64.h 15535 2005-06-30 07:13:33Z lha $ */
 
 #ifndef _BASE64_H_
 #define _BASE64_H_
 
 #ifndef _BASE64_H_
 #define _BASE64_H_
index dd7ea832af6b72885397c188b573da09ea952209..1e7a7abc114893aec0ab351f5ac7b57e63166ef4 100644 (file)
@@ -36,7 +36,7 @@
 #endif
 #include <roken.h>
 
 #endif
 #include <roken.h>
 
-RCSID("$Id: bswap.c,v 1.4 2005/04/12 11:28:35 lha Exp $");
+RCSID("$Id: bswap.c 14773 2005-04-12 11:29:18Z lha $");
 
 #ifndef HAVE_BSWAP32
 
 
 #ifndef HAVE_BSWAP32
 
index 6b02f1ebca683471b16237bde980528e319eed10..697566561c470e6a4b483943f329f24651a88765 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: closefrom.c,v 1.2 2005/04/13 08:01:38 lha Exp $");
+RCSID("$Id: closefrom.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #ifdef HAVE_SYS_TYPES_H
 #endif
 
 #ifdef HAVE_SYS_TYPES_H
index 7d458dc1b98a794f257b10ef593b8f2d912839b2..73e20ed039493f900e8b4e5bd73d1a156d335f08 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: copyhostent.c,v 1.3 2005/04/12 11:28:36 lha Exp $");
+RCSID("$Id: copyhostent.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 402b4b1cb997dd40983a1ceb63c63ad73642fc56..c445bfa361b260cd01bf5f8a27aaee6ab198e82f 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: dumpdata.c,v 1.1 2005/09/22 23:51:35 lha Exp $");
+RCSID("$Id: dumpdata.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <unistd.h>
 #endif
 
 #include <unistd.h>
index ad22a4557efca102877c5a27e2bd4ef49ea0c1aa..c9e6b9c6af629c536d74c98ec0bfd8ab13fda27f 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: ecalloc.c,v 1.2 2005/04/12 11:28:36 lha Exp $");
+RCSID("$Id: ecalloc.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdlib.h>
 #endif
 
 #include <stdlib.h>
index 91af6b51843a97850bbeafe6ef8a53b786b8a9b1..0807da6105ded0c733430f4c5578d3525334aaa0 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: emalloc.c,v 1.6 2005/04/12 11:28:37 lha Exp $");
+RCSID("$Id: emalloc.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdlib.h>
 #endif
 
 #include <stdlib.h>
index 497b1e7ec2ffef830222d5ab6fae169d742c68cd..cbcfb1b4697b59acfe36fea8d8d3326ee3569196 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: erealloc.c,v 1.6 2005/04/12 11:28:37 lha Exp $");
+RCSID("$Id: erealloc.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdlib.h>
 #endif
 
 #include <stdlib.h>
index 1a20cdd4100cb211b2b9de8b72e92d427c571a79..a53c1f7b9d2daeb4f94889639b79a03eaac50bed 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: estrdup.c,v 1.4 2005/04/12 11:28:39 lha Exp $");
+RCSID("$Id: estrdup.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdlib.h>
 #endif
 
 #include <stdlib.h>
index cd2898036bf094be7e15874afcc79be85d116a8c..71b5abb38fde0239324e3f653ff05438b9f73217 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: freeaddrinfo.c,v 1.5 2005/04/12 11:28:41 lha Exp $");
+RCSID("$Id: freeaddrinfo.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 1ebb01361c0bf5d886196a8b8b8d634b14f1e9f5..e773f07a2255b677445feae193e02398d8787ca6 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: freehostent.c,v 1.3 2005/04/12 11:28:41 lha Exp $");
+RCSID("$Id: freehostent.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 102aa75ea138832d07dc0858960391c112e8917c..1e563ae2887046b1a5320e58780238e81218ed9d 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: gai_strerror.c,v 1.7 2005/08/05 09:31:35 lha Exp $");
+RCSID("$Id: gai_strerror.c 15837 2005-08-05 09:31:35Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 6743e15af9a62474ac574f3b1226e802f403ff01..fd4e81fd7415241a17b9882f87d2fe0ebeba1740 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: get_window_size.c,v 1.10 2005/04/12 11:28:42 lha Exp $");
+RCSID("$Id: get_window_size.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdlib.h>
 #endif
 
 #include <stdlib.h>
index 86af8b72cc845ea7bcff499cd490e6b4f09c1808..2c232e3a594ee9ad7aebd84bd2e9adc601240c2b 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: getaddrinfo.c,v 1.14 2005/06/16 17:49:29 lha Exp $");
+RCSID("$Id: getaddrinfo.c 15417 2005-06-16 17:49:29Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index e4e0556adf19ffb062e660949305bf81688068e9..840febbf2118207c34e073e4dc98e5cd0c3eeb03 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: getarg.c,v 1.48 2005/04/12 11:28:43 lha Exp $");
+RCSID("$Id: getarg.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdio.h>
 #endif
 
 #include <stdio.h>
index bffa04486f77bddafeaff92ff31c6e862cbdd87f..62d1b6687c365653febcec5bf7419fda4638e403 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: getarg.h,v 1.14 2005/04/13 05:52:27 lha Exp $ */
+/* $Id: getarg.h 14776 2005-04-13 05:52:27Z lha $ */
 
 #ifndef __GETARG_H__
 #define __GETARG_H__
 
 #ifndef __GETARG_H__
 #define __GETARG_H__
index 3f447d6d0643caf6bc553202c723f0c334b86587..7e370d5f587b56372165e299df80dc3699593d0a 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: getipnodebyaddr.c,v 1.3 2005/04/12 11:28:47 lha Exp $");
+RCSID("$Id: getipnodebyaddr.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index b928efcc539f4b8f76339b006149512ae110d610..04f12509abf274f42c6297984a49e5f477d2d908 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: getipnodebyname.c,v 1.4 2005/04/12 11:28:47 lha Exp $");
+RCSID("$Id: getipnodebyname.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 2cf81897f8bef8679ce303d308d361a3f37e1298..04c5e1cdc94e19213bb55fcea2c52ca219271fb5 100644 (file)
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: getnameinfo.c,v 1.6 2005/06/16 16:53:09 lha Exp $");
+RCSID("$Id: getnameinfo.c 15412 2005-06-16 16:53:09Z lha $");
 #endif
 
 #endif
 
-#include "roken.h"
+#include <roken.h>
 
 static int
 doit (int af,
 
 static int
 doit (int af,
index 7eabe40093b44cf20363b7eb4debdc0f795fe793..19f161831c873d888019b53f19c9983ade3d89ba 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: getprogname.c,v 1.3 2005/04/12 11:28:48 lha Exp $");
+RCSID("$Id: getprogname.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index c2d4452c3280e1fc993daf8b819c12e8d6780e95..11dcb08ac2431a89a1ae332a4d288791be7bba66 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: h_errno.c,v 1.1 2001/08/08 03:47:23 assar Exp $");
+RCSID("$Id: h_errno.c 10442 2001-08-08 03:47:23Z assar $");
 #endif
 
 #ifndef HAVE_H_ERRNO
 #endif
 
 #ifndef HAVE_H_ERRNO
index e41b508fcb3f7d561bd94ba74b8ce898f1271b0e..994d89484e298bd0814de573e0c4562a4e90e3d4 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: hex.c,v 1.8 2006/01/09 17:09:29 lha Exp $");
+RCSID("$Id: hex.c 16504 2006-01-09 17:09:29Z lha $");
 #endif
 #include <roken.h>
 #include <ctype.h>
 #endif
 #include <roken.h>
 #include <ctype.h>
index cd47b21f9f683bb7d84e1dcbe49c608130e20cf1..4c4b8508ed4dc030f6c0007533d86afbe20390c4 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: hex.h,v 1.3 2005/04/12 11:28:50 lha Exp $ */
+/* $Id: hex.h 14773 2005-04-12 11:29:18Z lha $ */
 
 #ifndef _rk_HEX_H_
 #define _rk_HEX_H_ 1
 
 #ifndef _rk_HEX_H_
 #define _rk_HEX_H_ 1
index 1762b112262b78264744f040044e3af5e2e5738a..4e583a1d20c40122ff90e57ccecc29301040e3ef 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: hostent_find_fqdn.c,v 1.3 2005/04/12 11:28:51 lha Exp $");
+RCSID("$Id: hostent_find_fqdn.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 0483a05256b563be98f79a9c262a53aa79147870..176aed1f2b64a04c6230c23188a1e9d1ed1a92b9 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: inet_aton.c,v 1.14 2005/04/12 11:28:52 lha Exp $");
+RCSID("$Id: inet_aton.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 35e96eb49b4ace26166b2cb915225fe4bb4e057d..430c0044c3af0a6a397e9d7f42cc4fe8333e7090 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: inet_ntop.c,v 1.6 2005/04/12 11:28:52 lha Exp $");
+RCSID("$Id: inet_ntop.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 21606accb1438f09c630ef55e72599bfdcf06dba..e0e5ca74b238680838c22d6825c0f1da96287c21 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: inet_pton.c,v 1.4 2005/04/12 11:28:52 lha Exp $");
+RCSID("$Id: inet_pton.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index e6b524816488459cbcf89ce51cc0b831a29cd58f..ea09d3a9ad43e65efb7a9111a1394f5c953bd16e 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: issuid.c,v 1.6 2005/05/13 07:42:03 lha Exp $");
+RCSID("$Id: issuid.c 15131 2005-05-13 07:42:03Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index f8d4dd1424f36f9160a893762e7ddbcd092fa985..ef01f018d80db8bed575df8f832a669447ef2153 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: net_read.c,v 1.4 2005/04/12 11:28:57 lha Exp $");
+RCSID("$Id: net_read.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <sys/types.h>
 #endif
 
 #include <sys/types.h>
index 83d14f4af94bcda0713d3a10f21885817fc724ce..e379caa750a9af7df5942d08f9a308401b6de3cc 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: net_write.c,v 1.5 2005/04/12 11:28:58 lha Exp $");
+RCSID("$Id: net_write.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <sys/types.h>
 #endif
 
 #include <sys/types.h>
index 1537d16c33fa8a7fa920a4b3767f058adf56af5a..1998f70736ada96b1e4300e6e29df6cc5abf47ff 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: parse_bytes.h,v 1.4 2005/04/13 13:19:07 lha Exp $ */
+/* $Id: parse_bytes.h 14787 2005-04-13 13:19:07Z lha $ */
 
 #ifndef __PARSE_BYTES_H__
 #define __PARSE_BYTES_H__
 
 #ifndef __PARSE_BYTES_H__
 #define __PARSE_BYTES_H__
index 551bee313fdef85df1fb67c5dabdbacdde299203..1c39bde4e8a0196d708db391ff0edf58184db8ec 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: parse_time.c,v 1.7 2005/04/12 11:28:58 lha Exp $");
+RCSID("$Id: parse_time.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <parse_units.h>
 #endif
 
 #include <parse_units.h>
index 5c9de87675c67e12064670e1370b0f6fd59b026a..4dc2da08bcb28e0b20d8c16871f371c34066a089 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: parse_time.h,v 1.5 2005/04/12 11:28:59 lha Exp $ */
+/* $Id: parse_time.h 14773 2005-04-12 11:29:18Z lha $ */
 
 #ifndef __PARSE_TIME_H__
 #define __PARSE_TIME_H__
 
 #ifndef __PARSE_TIME_H__
 #define __PARSE_TIME_H__
index 5b01937aeed25ecd4c0d0673f4131b575e6a394e..8cc6850c1f25a442f35976e84df272480bc844e5 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: parse_units.c,v 1.18 2005/04/12 11:28:59 lha Exp $");
+RCSID("$Id: parse_units.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdio.h>
 #endif
 
 #include <stdio.h>
index 9d019266acd8d660af53fd7a3a6f3f3a96980210..a42154d4869f60f186ab40a021e4669c392c0572 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
  * SUCH DAMAGE. 
  */
 
-/* $Id: parse_units.h,v 1.9 2005/04/12 11:28:59 lha Exp $ */
+/* $Id: parse_units.h 14773 2005-04-12 11:29:18Z lha $ */
 
 #ifndef __PARSE_UNITS_H__
 #define __PARSE_UNITS_H__
 
 #ifndef __PARSE_UNITS_H__
 #define __PARSE_UNITS_H__
index 9b54fc50f02d34970fcb6a092b5e84dc73ae6114..a8778fda57d23e018f9ffe2402969d6e1f20cbfa 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 1995 - 2004 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -45,7 +45,7 @@
 
 #include <assert.h>
 
 
 #include <assert.h>
 
-RCSID("$Id: resolve.c,v 1.55 2006/04/14 13:56:00 lha Exp $");
+RCSID("$Id: resolve.c 19869 2007-01-12 16:03:14Z lha $");
 
 #ifdef _AIX /* AIX have broken res_nsearch() in 5.1 (5.0 also ?) */
 #undef HAVE_RES_NSEARCH
 
 #ifdef _AIX /* AIX have broken res_nsearch() in 5.1 (5.0 also ?) */
 #undef HAVE_RES_NSEARCH
@@ -492,6 +492,14 @@ parse_reply(const unsigned char *data, size_t len)
     return r;
 }
 
     return r;
 }
 
+#ifdef HAVE_RES_NSEARCH
+#ifdef HAVE_RES_NDESTROY
+#define rk_res_free(x) res_ndestroy(x)
+#else
+#define rk_res_free(x) res_nclose(x)
+#endif
+#endif
+
 static struct dns_reply *
 dns_lookup_int(const char *domain, int rr_class, int rr_type)
 {
 static struct dns_reply *
 dns_lookup_int(const char *domain, int rr_class, int rr_type)
 {
@@ -530,7 +538,7 @@ dns_lookup_int(const char *domain, int rr_class, int rr_type)
        reply = malloc(size);
        if (reply == NULL) {
 #ifdef HAVE_RES_NSEARCH
        reply = malloc(size);
        if (reply == NULL) {
 #ifdef HAVE_RES_NSEARCH
-           res_nclose(&state);
+           rk_res_free(&state);
 #endif
            return NULL;
        }
 #endif
            return NULL;
        }
@@ -548,18 +556,14 @@ dns_lookup_int(const char *domain, int rr_class, int rr_type)
        }
        if (len < 0) {
 #ifdef HAVE_RES_NSEARCH
        }
        if (len < 0) {
 #ifdef HAVE_RES_NSEARCH
-#ifdef HAVE_RES_NDESTROY
-           res_ndestroy(&state);
-#else
-           res_nclose(&state);
-#endif
+           rk_res_free(&state);
 #endif
            free(reply);
            return NULL;
        }
     } while (size < len && len < rk_DNS_MAX_PACKET_SIZE);
 #ifdef HAVE_RES_NSEARCH
 #endif
            free(reply);
            return NULL;
        }
     } while (size < len && len < rk_DNS_MAX_PACKET_SIZE);
 #ifdef HAVE_RES_NSEARCH
-    res_nclose(&state);
+    rk_res_free(&state);
 #endif
 
     len = min(len, size);
 #endif
 
     len = min(len, size);
index 2106c11ebd3c1dd43af620f4fb0185c1ff74f904..fe83115b1ec217a6e61a8b3b3575768b6ec2a590 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: resolve.h,v 1.24 2005/04/12 11:29:02 lha Exp $ */
+/* $Id: resolve.h 14773 2005-04-12 11:29:18Z lha $ */
 
 #ifndef __RESOLVE_H__
 #define __RESOLVE_H__
 
 #ifndef __RESOLVE_H__
 #define __RESOLVE_H__
index 8368530ff7a1fab41dff4969b6b6ee90870109e5..b835e880a2498fb1339c5a8a881e284f78ec4f10 100644 (file)
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
  * SUCH DAMAGE.
  */
 
-/* $Id: roken-common.h,v 1.64 2005/09/28 03:05:58 lha Exp $ */
+/* $Id: roken-common.h 20867 2007-06-03 21:00:45Z lha $ */
 
 #ifndef __ROKEN_COMMON_H__
 #define __ROKEN_COMMON_H__
 
 #ifndef __ROKEN_COMMON_H__
 #define __ROKEN_COMMON_H__
@@ -375,6 +375,9 @@ pid_file_delete (char **);
 int ROKEN_LIB_FUNCTION
 read_environment(const char *file, char ***env);
 
 int ROKEN_LIB_FUNCTION
 read_environment(const char *file, char ***env);
 
+void ROKEN_LIB_FUNCTION
+free_environment(char **);
+
 void ROKEN_LIB_FUNCTION
 warnerr(int doerrno, const char *fmt, va_list ap)
     __attribute__ ((format (printf, 2, 0)));
 void ROKEN_LIB_FUNCTION
 warnerr(int doerrno, const char *fmt, va_list ap)
     __attribute__ ((format (printf, 2, 0)));
index 8f200dfe102d2fab0c1f387f3481751695feccfc..08eed5f8ed3cb884e942119497f92431d5dd357a 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: roken_gethostby.c,v 1.8 2006/04/02 00:09:28 lha Exp $");
+RCSID("$Id: roken_gethostby.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
diff --git a/source4/heimdal/lib/roken/rtbl.c b/source4/heimdal/lib/roken/rtbl.c
new file mode 100644 (file)
index 0000000..50ab509
--- /dev/null
@@ -0,0 +1,489 @@
+/*
+ * Copyright (c) 2000, 2002, 2004 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+RCSID ("$Id: rtbl.c 17758 2006-06-30 13:41:40Z lha $");
+#endif
+#include <roken.h>
+#include "rtbl.h"
+
+struct column_entry {
+    char *data;
+};
+
+struct column_data {
+    char *header;
+    char *prefix;
+    int width;
+    unsigned flags;
+    size_t num_rows;
+    struct column_entry *rows;
+    unsigned int column_id;
+    char *suffix;
+};
+
+struct rtbl_data {
+    char *column_prefix;
+    size_t num_columns;
+    struct column_data **columns;
+    unsigned int flags;
+    char *column_separator;
+};
+
+rtbl_t ROKEN_LIB_FUNCTION
+rtbl_create (void)
+{
+    return calloc (1, sizeof (struct rtbl_data));
+}
+
+void ROKEN_LIB_FUNCTION
+rtbl_set_flags (rtbl_t table, unsigned int flags)
+{
+    table->flags = flags;
+}
+
+unsigned int ROKEN_LIB_FUNCTION
+rtbl_get_flags (rtbl_t table)
+{
+    return table->flags;
+}
+
+static struct column_data *
+rtbl_get_column_by_id (rtbl_t table, unsigned int id)
+{
+    int i;
+    for(i = 0; i < table->num_columns; i++)
+       if(table->columns[i]->column_id == id)
+           return table->columns[i];
+    return NULL;
+}
+
+static struct column_data *
+rtbl_get_column (rtbl_t table, const char *column)
+{
+    int i;
+    for(i = 0; i < table->num_columns; i++)
+       if(strcmp(table->columns[i]->header, column) == 0)
+           return table->columns[i];
+    return NULL;
+}
+
+void ROKEN_LIB_FUNCTION
+rtbl_destroy (rtbl_t table)
+{
+    int i, j;
+
+    for (i = 0; i < table->num_columns; i++) {
+       struct column_data *c = table->columns[i];
+
+       for (j = 0; j < c->num_rows; j++)
+           free (c->rows[j].data);
+       free (c->rows);
+       free (c->header);
+       free (c->prefix);
+       free (c->suffix);
+       free (c);
+    }
+    free (table->column_prefix);
+    free (table->column_separator);
+    free (table->columns);
+    free (table);
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_by_id (rtbl_t table, unsigned int id, 
+                      const char *header, unsigned int flags)
+{
+    struct column_data *col, **tmp;
+
+    tmp = realloc (table->columns, (table->num_columns + 1) * sizeof (*tmp));
+    if (tmp == NULL)
+       return ENOMEM;
+    table->columns = tmp;
+    col = malloc (sizeof (*col));
+    if (col == NULL)
+       return ENOMEM;
+    col->header = strdup (header);
+    if (col->header == NULL) {
+       free (col);
+       return ENOMEM;
+    }
+    col->prefix = NULL;
+    col->width = 0;
+    col->flags = flags;
+    col->num_rows = 0;
+    col->rows = NULL;
+    col->column_id = id;
+    col->suffix = NULL;
+    table->columns[table->num_columns++] = col;
+    return 0;
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column (rtbl_t table, const char *header, unsigned int flags)
+{
+    return rtbl_add_column_by_id(table, 0, header, flags);
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_new_row(rtbl_t table)
+{
+    size_t max_rows = 0;
+    size_t c;
+    for (c = 0; c < table->num_columns; c++)
+       if(table->columns[c]->num_rows > max_rows)
+           max_rows = table->columns[c]->num_rows;
+    for (c = 0; c < table->num_columns; c++) {
+       struct column_entry *tmp;
+
+       if(table->columns[c]->num_rows == max_rows)
+           continue;
+       tmp = realloc(table->columns[c]->rows, 
+                     max_rows * sizeof(table->columns[c]->rows));
+       if(tmp == NULL)
+           return ENOMEM;
+       table->columns[c]->rows = tmp;
+       while(table->columns[c]->num_rows < max_rows) {
+           if((tmp[table->columns[c]->num_rows++].data = strdup("")) == NULL)
+               return ENOMEM;
+       }
+    }
+    return 0;
+}
+
+static void
+column_compute_width (rtbl_t table, struct column_data *column)
+{
+    int i;
+
+    if(table->flags & RTBL_HEADER_STYLE_NONE)
+       column->width = 0;
+    else
+       column->width = strlen (column->header);
+    for (i = 0; i < column->num_rows; i++)
+       column->width = max (column->width, strlen (column->rows[i].data));
+}
+
+/* DEPRECATED */
+int ROKEN_LIB_FUNCTION
+rtbl_set_prefix (rtbl_t table, const char *prefix)
+{
+    if (table->column_prefix)
+       free (table->column_prefix);
+    table->column_prefix = strdup (prefix);
+    if (table->column_prefix == NULL)
+       return ENOMEM;
+    return 0;
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_set_separator (rtbl_t table, const char *separator)
+{
+    if (table->column_separator)
+       free (table->column_separator);
+    table->column_separator = strdup (separator);
+    if (table->column_separator == NULL)
+       return ENOMEM;
+    return 0;
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_set_column_prefix (rtbl_t table, const char *column,
+                       const char *prefix)
+{
+    struct column_data *c = rtbl_get_column (table, column);
+
+    if (c == NULL)
+       return -1;
+    if (c->prefix)
+       free (c->prefix);
+    c->prefix = strdup (prefix);
+    if (c->prefix == NULL)
+       return ENOMEM;
+    return 0;
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_set_column_affix_by_id(rtbl_t table, unsigned int id,
+                           const char *prefix, const char *suffix)
+{
+    struct column_data *c = rtbl_get_column_by_id (table, id);
+
+    if (c == NULL)
+       return -1;
+    if (c->prefix)
+       free (c->prefix);
+    if(prefix == NULL)
+       c->prefix = NULL;
+    else {
+       c->prefix = strdup (prefix);
+       if (c->prefix == NULL)
+           return ENOMEM;
+    }
+
+    if (c->suffix)
+       free (c->suffix);
+    if(suffix == NULL)
+       c->suffix = NULL;
+    else {
+       c->suffix = strdup (suffix);
+       if (c->suffix == NULL)
+           return ENOMEM;
+    }
+    return 0;
+}
+
+
+static const char *
+get_column_prefix (rtbl_t table, struct column_data *c)
+{
+    if (c == NULL)
+       return "";
+    if (c->prefix)
+       return c->prefix;
+    if (table->column_prefix)
+       return table->column_prefix;
+    return "";
+}
+
+static const char *
+get_column_suffix (rtbl_t table, struct column_data *c)
+{
+    if (c && c->suffix)
+       return c->suffix;
+    return "";
+}
+
+static int
+add_column_entry (struct column_data *c, const char *data)
+{
+    struct column_entry row, *tmp;
+
+    row.data = strdup (data);
+    if (row.data == NULL)
+       return ENOMEM;
+    tmp = realloc (c->rows, (c->num_rows + 1) * sizeof (*tmp));
+    if (tmp == NULL) {
+       free (row.data);
+       return ENOMEM;
+    }
+    c->rows = tmp;
+    c->rows[c->num_rows++] = row;
+    return 0;
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entry_by_id (rtbl_t table, unsigned int id, const char *data)
+{
+    struct column_data *c = rtbl_get_column_by_id (table, id);
+
+    if (c == NULL)
+       return -1;
+
+    return add_column_entry(c, data);
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entryv_by_id (rtbl_t table, unsigned int id,
+                             const char *fmt, ...)
+{
+    va_list ap;
+    char *str;
+    int ret;
+
+    va_start(ap, fmt);
+    ret = vasprintf(&str, fmt, ap);
+    va_end(ap);
+    if (ret == -1)
+       return -1;
+    ret = rtbl_add_column_entry_by_id(table, id, str);
+    free(str);
+    return ret;
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entry (rtbl_t table, const char *column, const char *data)
+{
+    struct column_data *c = rtbl_get_column (table, column);
+
+    if (c == NULL)
+       return -1;
+
+    return add_column_entry(c, data);
+}
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entryv (rtbl_t table, const char *column, const char *fmt, ...)
+{
+    va_list ap;
+    char *str;
+    int ret;
+
+    va_start(ap, fmt);
+    ret = vasprintf(&str, fmt, ap);
+    va_end(ap);
+    if (ret == -1)
+       return -1;
+    ret = rtbl_add_column_entry(table, column, str);
+    free(str);
+    return ret;
+}
+
+
+int ROKEN_LIB_FUNCTION
+rtbl_format (rtbl_t table, FILE * f)
+{
+    int i, j;
+
+    for (i = 0; i < table->num_columns; i++)
+       column_compute_width (table, table->columns[i]);
+    if((table->flags & RTBL_HEADER_STYLE_NONE) == 0) {
+       for (i = 0; i < table->num_columns; i++) {
+           struct column_data *c = table->columns[i];
+
+           if(table->column_separator != NULL && i > 0)
+               fprintf (f, "%s", table->column_separator);
+           fprintf (f, "%s", get_column_prefix (table, c));
+           if(i == table->num_columns - 1 && c->suffix == NULL)
+               /* last column, so no need to pad with spaces */
+               fprintf (f, "%-*s", 0, c->header);
+           else
+               fprintf (f, "%-*s", (int)c->width, c->header);
+           fprintf (f, "%s", get_column_suffix (table, c));
+       }
+       fprintf (f, "\n");
+    }
+
+    for (j = 0;; j++) {
+       int flag = 0;
+
+       /* are there any more rows left? */
+       for (i = 0; flag == 0 && i < table->num_columns; ++i) {
+           struct column_data *c = table->columns[i];
+
+           if (c->num_rows > j) {
+               ++flag;
+               break;
+           }
+       }
+       if (flag == 0)
+           break;
+
+       for (i = 0; i < table->num_columns; i++) {
+           int w;
+           struct column_data *c = table->columns[i];
+
+           if(table->column_separator != NULL && i > 0)
+               fprintf (f, "%s", table->column_separator);
+
+           w = c->width;
+
+           if ((c->flags & RTBL_ALIGN_RIGHT) == 0) {
+               if(i == table->num_columns - 1 && c->suffix == NULL)
+                   /* last column, so no need to pad with spaces */
+                   w = 0;
+               else
+                   w = -w;
+           }
+           fprintf (f, "%s", get_column_prefix (table, c));
+           if (c->num_rows <= j)
+               fprintf (f, "%*s", w, "");
+           else
+               fprintf (f, "%*s", w, c->rows[j].data);
+           fprintf (f, "%s", get_column_suffix (table, c));
+       }
+       fprintf (f, "\n");
+    }
+    return 0;
+}
+
+#ifdef TEST
+int
+main (int argc, char **argv)
+{
+    rtbl_t table;
+
+    table = rtbl_create ();
+    rtbl_add_column_by_id (table, 0, "Issued", 0);
+    rtbl_add_column_by_id (table, 1, "Expires", 0);
+    rtbl_add_column_by_id (table, 2, "Foo", RTBL_ALIGN_RIGHT);
+    rtbl_add_column_by_id (table, 3, "Principal", 0);
+
+    rtbl_add_column_entry_by_id (table, 0, "Jul  7 21:19:29");
+    rtbl_add_column_entry_by_id (table, 1, "Jul  8 07:19:29");
+    rtbl_add_column_entry_by_id (table, 2, "73");
+    rtbl_add_column_entry_by_id (table, 2, "0");
+    rtbl_add_column_entry_by_id (table, 2, "-2000");
+    rtbl_add_column_entry_by_id (table, 3, "krbtgt/NADA.KTH.SE@NADA.KTH.SE");
+
+    rtbl_add_column_entry_by_id (table, 0, "Jul  7 21:19:29");
+    rtbl_add_column_entry_by_id (table, 1, "Jul  8 07:19:29");
+    rtbl_add_column_entry_by_id (table, 3, "afs/pdc.kth.se@NADA.KTH.SE");
+
+    rtbl_add_column_entry_by_id (table, 0, "Jul  7 21:19:29");
+    rtbl_add_column_entry_by_id (table, 1, "Jul  8 07:19:29");
+    rtbl_add_column_entry_by_id (table, 3, "afs@NADA.KTH.SE");
+
+    rtbl_set_separator (table, "  ");
+
+    rtbl_format (table, stdout);
+
+    rtbl_destroy (table);
+
+    printf("\n");
+
+    table = rtbl_create ();
+    rtbl_add_column_by_id (table, 0, "Column A", 0);
+    rtbl_set_column_affix_by_id (table, 0, "<", ">");
+    rtbl_add_column_by_id (table, 1, "Column B", 0);
+    rtbl_set_column_affix_by_id (table, 1, "[", "]");
+    rtbl_add_column_by_id (table, 2, "Column C", 0);
+    rtbl_set_column_affix_by_id (table, 2, "(", ")");
+
+    rtbl_add_column_entry_by_id (table, 0, "1");
+    rtbl_new_row(table);
+    rtbl_add_column_entry_by_id (table, 1, "2");
+    rtbl_new_row(table);
+    rtbl_add_column_entry_by_id (table, 2, "3");
+    rtbl_new_row(table);
+
+    rtbl_set_separator (table, "  ");
+    rtbl_format (table, stdout);
+
+    rtbl_destroy (table);
+
+    return 0;
+}
+
+#endif
diff --git a/source4/heimdal/lib/roken/rtbl.h b/source4/heimdal/lib/roken/rtbl.h
new file mode 100644 (file)
index 0000000..9b168c7
--- /dev/null
@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) 2000,2004 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/* $Id: rtbl.h 17760 2006-06-30 13:42:39Z lha $ */
+
+#ifndef __rtbl_h__
+#define __rtbl_h__
+
+#ifndef ROKEN_LIB_FUNCTION
+#ifdef _WIN32
+#define ROKEN_LIB_FUNCTION _stdcall
+#else
+#define ROKEN_LIB_FUNCTION
+#endif
+#endif
+
+#if !defined(__GNUC__) && !defined(__attribute__)
+#define __attribute__(x)
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct rtbl_data;
+typedef struct rtbl_data *rtbl_t;
+
+#define RTBL_ALIGN_LEFT                0
+#define RTBL_ALIGN_RIGHT       1
+
+/* flags */
+#define RTBL_HEADER_STYLE_NONE 1
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column (rtbl_t, const char*, unsigned int);
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_by_id (rtbl_t, unsigned int, const char*, unsigned int);
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entryv_by_id (rtbl_t table, unsigned int id,
+                             const char *fmt, ...)
+       __attribute__ ((format (printf, 3, 0)));
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entry (rtbl_t, const char*, const char*);
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entryv (rtbl_t, const char*, const char*, ...)
+       __attribute__ ((format (printf, 3, 0)));
+
+int ROKEN_LIB_FUNCTION
+rtbl_add_column_entry_by_id (rtbl_t, unsigned int, const char*);
+
+rtbl_t ROKEN_LIB_FUNCTION
+rtbl_create (void);
+
+void ROKEN_LIB_FUNCTION
+rtbl_destroy (rtbl_t);
+
+int ROKEN_LIB_FUNCTION
+rtbl_format (rtbl_t, FILE*);
+
+unsigned int ROKEN_LIB_FUNCTION
+rtbl_get_flags (rtbl_t);
+
+int ROKEN_LIB_FUNCTION
+rtbl_new_row (rtbl_t);
+
+int ROKEN_LIB_FUNCTION
+rtbl_set_column_affix_by_id (rtbl_t, unsigned int, const char*, const char*);
+
+int ROKEN_LIB_FUNCTION
+rtbl_set_column_prefix (rtbl_t, const char*, const char*);
+
+void ROKEN_LIB_FUNCTION
+rtbl_set_flags (rtbl_t, unsigned int);
+
+int ROKEN_LIB_FUNCTION
+rtbl_set_prefix (rtbl_t, const char*);
+
+int ROKEN_LIB_FUNCTION
+rtbl_set_separator (rtbl_t, const char*);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __rtbl_h__ */
index c13e8d4ee1ba4ad2c2018379e168c2c9838351bc..3213c1c7a5ad6d21da58654c40211f2ca3e521ba 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: setprogname.c,v 1.4 2005/08/23 10:19:20 lha Exp $");
+RCSID("$Id: setprogname.c 15955 2005-08-23 10:19:20Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index 7076847fb3577fc8e7d3488a0cfcd2927cbcae3d..d5ea6fb86a587f86d2799db7d00cd5b5f26a9717 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: signal.c,v 1.13 2005/04/12 11:29:05 lha Exp $");
+RCSID("$Id: signal.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <signal.h>
 #endif
 
 #include <signal.h>
index 048f2846ddf3ec69a91c058cbd1d72f1fd8a501a..c4359f421ee373adee62238a569dd01489793ae8 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: simple_exec.c,v 1.14 2005/04/13 11:39:00 lha Exp $");
+RCSID("$Id: simple_exec.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdarg.h>
 #endif
 
 #include <stdarg.h>
index 5f77aacf43be27a978d4d64ca3b8fb2e694f529b..91316dfbd892dd86ffad2bdbf37e5e9af8dcdc77 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: socket.c,v 1.11 2005/09/01 18:48:17 lha Exp $");
+RCSID("$Id: socket.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <roken.h>
 #endif
 
 #include <roken.h>
index d6f30773481fe35f7151e4d1ce3973e0009f46ba..c431e18f3d38e1e8365758a673e4946424f4f37d 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: strcollect.c,v 1.2 2005/04/12 11:29:07 lha Exp $");
+RCSID("$Id: strcollect.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdarg.h>
 #endif
 
 #include <stdarg.h>
index c0ef46dc35b372b46ed2a3eab158bdacd2e85eba..356c8d2e9abc3b412810a7701a90628152ee8517 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: strlwr.c,v 1.6 2005/04/12 11:29:09 lha Exp $");
+RCSID("$Id: strlwr.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 #include <string.h>
 #include <ctype.h>
 #endif
 #include <string.h>
 #include <ctype.h>
index cf9997af9d53802cef8a86758ae200069ac2b06b..d47580ff8da42d0f385b8ce87c66058e7bd44852 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: strpool.c,v 1.2 2005/08/25 14:59:06 lha Exp $");
+RCSID("$Id: strpool.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 
 #include <stdarg.h>
 #endif
 
 #include <stdarg.h>
index f08c33b7a5e0577f54fe7cc2f29d5e6911141a4f..b1ad87de27e33222545dcfa620216ab25fa9c673 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: strsep.c,v 1.4 2005/04/12 11:29:10 lha Exp $");
+RCSID("$Id: strsep.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <string.h>
 #endif
 
 #include <string.h>
index 34759fe15c98c1d6fe2c4d5aa5db509543fa46fb..aeade2957f0eaa5267a6010944787b6b642abc5f 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: strsep_copy.c,v 1.5 2005/04/12 11:29:11 lha Exp $");
+RCSID("$Id: strsep_copy.c 14773 2005-04-12 11:29:18Z lha $");
 #endif
 
 #include <string.h>
 #endif
 
 #include <string.h>
index 4763a1a111cf043377fb4df853f73f9e4015b797..fadfacbb371f32d67ffc4be6ec65ea675a4aca58 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: strupr.c,v 1.6 2005/04/12 11:29:11 lha Exp $");
+RCSID("$Id: strupr.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 #include <string.h>
 #include <ctype.h>
 #endif
 #include <string.h>
 #include <ctype.h>
index 3e54f6d58a6ebe7f00c985429e9ab9bed1ccb441..5dedb793cc5b1a1b8fb2b8351ed073f9032ee086 100644 (file)
@@ -65,7 +65,7 @@
 #if 1
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #if 1
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: vis.c,v 1.13 2006/12/15 11:49:22 lha Exp $");
+RCSID("$Id: vis.c 21005 2007-06-08 01:54:35Z lha $");
 #endif
 #include <roken.h>
 #ifndef _DIAGASSERT
 #endif
 #include <roken.h>
 #ifndef _DIAGASSERT
index 5f5a2c4a4a4f0efd28ef0b87b0c395d002c4de9c..4337d591c42efc1f288e5c39eab51473b7235ac4 100644 (file)
@@ -33,7 +33,7 @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
-RCSID("$Id: print_version.c,v 1.10 2006/12/29 16:00:16 lha Exp $");
+RCSID("$Id: print_version.c 19566 2006-12-29 16:00:16Z lha $");
 #endif
 #include "roken.h"
 
 #endif
 #include "roken.h"
 
index fe9791c0d7ef0ff49fa0135d85b1386f66e303ee..06d2b7ae3c57a224bf287bcbc53d4e50d81af076 100755 (executable)
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 # Generate make dependency rules for asn1 files
 # Jelmer Vernooij <jelmer@samba.org> 2005
 #!/usr/bin/perl
 # Generate make dependency rules for asn1 files
 # Jelmer Vernooij <jelmer@samba.org> 2005
+# Andrew Bartlett <abartlet@samba.org> 2006
 # Stefan Metzmacher <metze@samba.org> 2007
 # GPL
 
 # Stefan Metzmacher <metze@samba.org> 2007
 # GPL
 
index 93152fc8687ea59c24f7fc68037503341bfe28bb..5ab270cf184c5957e807280cf7037f2724838149 100644 (file)
@@ -18,7 +18,7 @@ OBJ_FILES = \
        ../heimdal/kdc/kx509.o \
        ../heimdal/lib/asn1/asn1_KRB5SignedPath.o
 PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5 HEIMDAL_HDB HEIMDAL_HEIM_ASN1 HEIMDAL_DIGEST_ASN1 HEIMDAL_KX509_ASN1
        ../heimdal/kdc/kx509.o \
        ../heimdal/lib/asn1/asn1_KRB5SignedPath.o
 PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5 HEIMDAL_HDB HEIMDAL_HEIM_ASN1 HEIMDAL_DIGEST_ASN1 HEIMDAL_KX509_ASN1
-PUBLIC_DEPENDENCIES = HEIMDAL_NTLM HEIMDAL_DES
+PUBLIC_DEPENDENCIES = HEIMDAL_NTLM HEIMDAL_HCRYPTO
 # End SUBSYSTEM HEIMDAL_KDC
 #######################
 
 # End SUBSYSTEM HEIMDAL_KDC
 #######################
 
@@ -26,7 +26,7 @@ PUBLIC_DEPENDENCIES = HEIMDAL_NTLM HEIMDAL_DES
 CFLAGS = -Iheimdal_build -Iheimdal/lib/ntlm
 OBJ_FILES = \
        ../heimdal/lib/ntlm/ntlm.o
 CFLAGS = -Iheimdal_build -Iheimdal/lib/ntlm
 OBJ_FILES = \
        ../heimdal/lib/ntlm/ntlm.o
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_DES HEIMDAL_KRB5
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_KRB5
 
 [SUBSYSTEM::HEIMDAL_HDB_KEYS]
 CFLAGS = -Iheimdal_build -Iheimdal/lib/hdb
 
 [SUBSYSTEM::HEIMDAL_HDB_KEYS]
 CFLAGS = -Iheimdal_build -Iheimdal/lib/hdb
@@ -34,7 +34,7 @@ OBJ_FILES = \
        ../heimdal/lib/hdb/keys.o \
        ../heimdal/lib/hdb/asn1_Key.o \
        ../heimdal/lib/hdb/asn1_Salt.o
        ../heimdal/lib/hdb/keys.o \
        ../heimdal/lib/hdb/asn1_Key.o \
        ../heimdal/lib/hdb/asn1_Salt.o
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_DES HEIMDAL_KRB5
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_KRB5
 
 #######################
 # Start SUBSYSTEM HEIMDAL_HDB
 
 #######################
 # Start SUBSYSTEM HEIMDAL_HDB
@@ -48,7 +48,7 @@ OBJ_FILES = \
        ../heimdal/lib/hdb/mkey.o \
        ../heimdal/lib/hdb/ndbm.o \
        ../heimdal/lib/hdb/hdb_err.o
        ../heimdal/lib/hdb/mkey.o \
        ../heimdal/lib/hdb/ndbm.o \
        ../heimdal/lib/hdb/hdb_err.o
-PRIVATE_DEPENDENCIES = HDB_LDB HEIMDAL_KRB5 HEIMDAL_HDB_KEYS HEIMDAL_ROKEN HEIMDAL_DES HEIMDAL_COM_ERR HEIMDAL_HDB_ASN1
+PRIVATE_DEPENDENCIES = HDB_LDB HEIMDAL_KRB5 HEIMDAL_HDB_KEYS HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_COM_ERR HEIMDAL_HDB_ASN1
 # End SUBSYSTEM HEIMDAL_HDB
 #######################
 
 # End SUBSYSTEM HEIMDAL_HDB
 #######################
 
@@ -57,6 +57,7 @@ PRIVATE_DEPENDENCIES = HDB_LDB HEIMDAL_KRB5 HEIMDAL_HDB_KEYS HEIMDAL_ROKEN HEIMD
 [SUBSYSTEM::HEIMDAL_GSSAPI]
 CFLAGS = -Iheimdal_build -Iheimdal/lib/gssapi -Iheimdal/lib/gssapi/gssapi -Iheimdal/lib/gssapi/spnego -Iheimdal/lib/gssapi/krb5 -Iheimdal/lib/gssapi/mech
 OBJ_FILES = \
 [SUBSYSTEM::HEIMDAL_GSSAPI]
 CFLAGS = -Iheimdal_build -Iheimdal/lib/gssapi -Iheimdal/lib/gssapi/gssapi -Iheimdal/lib/gssapi/spnego -Iheimdal/lib/gssapi/krb5 -Iheimdal/lib/gssapi/mech
 OBJ_FILES = \
+       ../heimdal/lib/gssapi/mech/context.o \
        ../heimdal/lib/gssapi/mech/gss_krb5.o \
        ../heimdal/lib/gssapi/mech/gss_mech_switch.o \
        ../heimdal/lib/gssapi/mech/gss_process_context_token.o \
        ../heimdal/lib/gssapi/mech/gss_krb5.o \
        ../heimdal/lib/gssapi/mech/gss_mech_switch.o \
        ../heimdal/lib/gssapi/mech/gss_process_context_token.o \
@@ -96,6 +97,7 @@ OBJ_FILES = \
        ../heimdal/lib/gssapi/mech/gss_utils.o \
        ../heimdal/lib/gssapi/mech/gss_init_sec_context.o \
        ../heimdal/lib/gssapi/mech/gss_oid_equal.o \
        ../heimdal/lib/gssapi/mech/gss_utils.o \
        ../heimdal/lib/gssapi/mech/gss_init_sec_context.o \
        ../heimdal/lib/gssapi/mech/gss_oid_equal.o \
+       ../heimdal/lib/gssapi/mech/gss_oid_to_str.o \
        ../heimdal/lib/gssapi/mech/gss_context_time.o \
        ../heimdal/lib/gssapi/mech/gss_encapsulate_token.o \
        ../heimdal/lib/gssapi/mech/gss_get_mic.o \
        ../heimdal/lib/gssapi/mech/gss_context_time.o \
        ../heimdal/lib/gssapi/mech/gss_encapsulate_token.o \
        ../heimdal/lib/gssapi/mech/gss_get_mic.o \
@@ -143,9 +145,6 @@ OBJ_FILES = \
        ../heimdal/lib/gssapi/krb5/wrap.o \
        ../heimdal/lib/gssapi/krb5/release_name.o \
        ../heimdal/lib/gssapi/krb5/cfx.o \
        ../heimdal/lib/gssapi/krb5/wrap.o \
        ../heimdal/lib/gssapi/krb5/release_name.o \
        ../heimdal/lib/gssapi/krb5/cfx.o \
-       ../heimdal/lib/gssapi/krb5/add_oid_set_member.o \
-       ../heimdal/lib/gssapi/krb5/release_oid_set.o \
-       ../heimdal/lib/gssapi/krb5/create_emtpy_oid_set.o \
        ../heimdal/lib/gssapi/krb5/8003.o \
        ../heimdal/lib/gssapi/krb5/arcfour.o \
        ../heimdal/lib/gssapi/krb5/encapsulate.o \
        ../heimdal/lib/gssapi/krb5/8003.o \
        ../heimdal/lib/gssapi/krb5/arcfour.o \
        ../heimdal/lib/gssapi/krb5/encapsulate.o \
@@ -153,7 +152,6 @@ OBJ_FILES = \
        ../heimdal/lib/gssapi/krb5/sequence.o \
        ../heimdal/lib/gssapi/krb5/display_status.o \
        ../heimdal/lib/gssapi/krb5/release_buffer.o \
        ../heimdal/lib/gssapi/krb5/sequence.o \
        ../heimdal/lib/gssapi/krb5/display_status.o \
        ../heimdal/lib/gssapi/krb5/release_buffer.o \
-       ../heimdal/lib/gssapi/krb5/test_oid_set_member.o \
        ../heimdal/lib/gssapi/krb5/external.o \
        ../heimdal/lib/gssapi/krb5/compat.o \
        ../heimdal/lib/gssapi/krb5/acquire_cred.o \
        ../heimdal/lib/gssapi/krb5/external.o \
        ../heimdal/lib/gssapi/krb5/compat.o \
        ../heimdal/lib/gssapi/krb5/acquire_cred.o \
@@ -163,8 +161,9 @@ OBJ_FILES = \
        ../heimdal/lib/gssapi/krb5/verify_mic.o \
        ../heimdal/lib/gssapi/krb5/accept_sec_context.o \
        ../heimdal/lib/gssapi/krb5/set_sec_context_option.o \
        ../heimdal/lib/gssapi/krb5/verify_mic.o \
        ../heimdal/lib/gssapi/krb5/accept_sec_context.o \
        ../heimdal/lib/gssapi/krb5/set_sec_context_option.o \
-       ../heimdal/lib/gssapi/krb5/process_context_token.o
-PRIVATE_DEPENDENCIES = HEIMDAL_DES HEIMDAL_HEIM_ASN1 HEIMDAL_SPNEGO_ASN1
+       ../heimdal/lib/gssapi/krb5/process_context_token.o \
+       ../heimdal/lib/gssapi/krb5/prf.o
+PRIVATE_DEPENDENCIES = HEIMDAL_HCRYPTO HEIMDAL_HEIM_ASN1 HEIMDAL_SPNEGO_ASN1
 PUBLIC_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5
 # End SUBSYSTEM HEIMDAL_GSSAPI
 #######################
 PUBLIC_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5
 # End SUBSYSTEM HEIMDAL_GSSAPI
 #######################
@@ -174,7 +173,7 @@ PUBLIC_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5
 [SUBSYSTEM::HEIMDAL_KRB5]
 CFLAGS = -Iheimdal_build -Iheimdal/lib/krb5 
 PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_PKINIT_ASN1
 [SUBSYSTEM::HEIMDAL_KRB5]
 CFLAGS = -Iheimdal_build -Iheimdal/lib/krb5 
 PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_PKINIT_ASN1
-PUBLIC_DEPENDENCIES = HEIMDAL_KRB5_ASN1 HEIMDAL_GLUE HEIMDAL_HX509 HEIMDAL_DES
+PUBLIC_DEPENDENCIES = HEIMDAL_KRB5_ASN1 HEIMDAL_GLUE HEIMDAL_HX509 HEIMDAL_HCRYPTO
 OBJ_FILES = \
        ../heimdal/lib/krb5/acache.o \
        ../heimdal/lib/krb5/add_et_list.o \
 OBJ_FILES = \
        ../heimdal/lib/krb5/acache.o \
        ../heimdal/lib/krb5/add_et_list.o \
@@ -286,46 +285,48 @@ PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_COM_ERR
 #######################
 
 #######################
 #######################
 
 #######################
-# Start SUBSYSTEM HEIMDAL_DES_IMATH
-[SUBSYSTEM::HEIMDAL_DES_IMATH]
-CFLAGS = -Iheimdal_build -Iheimdal/lib/des/imath 
+# Start SUBSYSTEM HEIMDAL_HCRYPTO_IMATH
+[SUBSYSTEM::HEIMDAL_HCRYPTO_IMATH]
+CFLAGS = -Iheimdal_build -Iheimdal/lib/hcrypto/imath 
 PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN 
 OBJ_FILES = \
 PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN 
 OBJ_FILES = \
-       ../heimdal/lib/des/imath/imath.o \
-       ../heimdal/lib/des/imath/iprime.o
-# End SUBSYSTEM HEIMDAL_DES_IMATH
+       ../heimdal/lib/hcrypto/imath/imath.o \
+       ../heimdal/lib/hcrypto/imath/iprime.o
+# End SUBSYSTEM HEIMDAL_HCRYPTO_IMATH
 #######################
 
 #######################
 
-[SUBSYSTEM::HEIMDAL_DES]
-CFLAGS = -Iheimdal_build -Iheimdal/lib/des 
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HEIM_ASN1 HEIMDAL_DES_IMATH HEIMDAL_RFC2459_ASN1
+[SUBSYSTEM::HEIMDAL_HCRYPTO]
+CFLAGS = -Iheimdal_build -Iheimdal/lib/hcrypto
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HEIM_ASN1 HEIMDAL_HCRYPTO_IMATH HEIMDAL_RFC2459_ASN1
 OBJ_FILES = \
 OBJ_FILES = \
-       ../heimdal/lib/des/aes.o \
-       ../heimdal/lib/des/bn.o \
-       ../heimdal/lib/des/dh.o \
-       ../heimdal/lib/des/dh-imath.o \
-       ../heimdal/lib/des/des.o \
-       ../heimdal/lib/des/dsa.o \
-       ../heimdal/lib/des/engine.o \
-       ../heimdal/lib/des/md2.o \
-       ../heimdal/lib/des/md4.o \
-       ../heimdal/lib/des/md5.o \
-       ../heimdal/lib/des/rsa.o \
-       ../heimdal/lib/des/rsa-imath.o \
-       ../heimdal/lib/des/rc2.o \
-       ../heimdal/lib/des/rc4.o \
-       ../heimdal/lib/des/rijndael-alg-fst.o \
-       ../heimdal/lib/des/rnd_keys.o \
-       ../heimdal/lib/des/sha.o \
-       ../heimdal/lib/des/sha256.o \
-       ../heimdal/lib/des/ui.o \
-       ../heimdal/lib/des/evp.o \
-       ../heimdal/lib/des/pkcs5.o \
-       ../heimdal/lib/des/pkcs12.o \
-       ../heimdal/lib/des/rand.o \
-       ../heimdal/lib/des/rand-unix.o \
-       ../heimdal/lib/des/hmac.o
-# End SUBSYSTEM HEIMDAL_DES
+       ../heimdal/lib/hcrypto/aes.o \
+       ../heimdal/lib/hcrypto/bn.o \
+       ../heimdal/lib/hcrypto/dh.o \
+       ../heimdal/lib/hcrypto/dh-imath.o \
+       ../heimdal/lib/hcrypto/des.o \
+       ../heimdal/lib/hcrypto/dsa.o \
+       ../heimdal/lib/hcrypto/engine.o \
+       ../heimdal/lib/hcrypto/md2.o \
+       ../heimdal/lib/hcrypto/md4.o \
+       ../heimdal/lib/hcrypto/md5.o \
+       ../heimdal/lib/hcrypto/rsa.o \
+       ../heimdal/lib/hcrypto/rsa-imath.o \
+       ../heimdal/lib/hcrypto/rc2.o \
+       ../heimdal/lib/hcrypto/rc4.o \
+       ../heimdal/lib/hcrypto/rijndael-alg-fst.o \
+       ../heimdal/lib/hcrypto/rnd_keys.o \
+       ../heimdal/lib/hcrypto/sha.o \
+       ../heimdal/lib/hcrypto/sha256.o \
+       ../heimdal/lib/hcrypto/ui.o \
+       ../heimdal/lib/hcrypto/evp.o \
+       ../heimdal/lib/hcrypto/pkcs5.o \
+       ../heimdal/lib/hcrypto/pkcs12.o \
+       ../heimdal/lib/hcrypto/rand.o \
+       ../heimdal/lib/hcrypto/rand-egd.o \
+       ../heimdal/lib/hcrypto/rand-unix.o \
+       ../heimdal/lib/hcrypto/rand-fortuna.o \
+       ../heimdal/lib/hcrypto/hmac.o
+# End SUBSYSTEM HEIMDAL_HCRYPTO
 #######################
 
 #######################
 #######################
 
 #######################
@@ -334,10 +335,11 @@ OBJ_FILES = \
 CFLAGS = -Iheimdal_build -Iheimdal/lib/hx509 
 PRIVATE_DEPENDENCIES = \
        HEIMDAL_ROKEN HEIMDAL_COM_ERR \
 CFLAGS = -Iheimdal_build -Iheimdal/lib/hx509 
 PRIVATE_DEPENDENCIES = \
        HEIMDAL_ROKEN HEIMDAL_COM_ERR \
-       HEIMDAL_HEIM_ASN1 HEIMDAL_DES \
+       HEIMDAL_HEIM_ASN1 HEIMDAL_HCRYPTO \
        HEIMDAL_CMS_ASN1 HEIMDAL_RFC2459_ASN1 \
        HEIMDAL_OCSP_ASN1 HEIMDAL_PKCS8_ASN1 \
        HEIMDAL_CMS_ASN1 HEIMDAL_RFC2459_ASN1 \
        HEIMDAL_OCSP_ASN1 HEIMDAL_PKCS8_ASN1 \
-       HEIMDAL_PKCS9_ASN1 HEIMDAL_PKCS12_ASN1
+       HEIMDAL_PKCS9_ASN1 HEIMDAL_PKCS12_ASN1 \
+       HEIMDAL_PKINIT_ASN1
 OBJ_FILES = \
        ../heimdal/lib/hx509/ca.o \
        ../heimdal/lib/hx509/cert.o \
 OBJ_FILES = \
        ../heimdal/lib/hx509/ca.o \
        ../heimdal/lib/hx509/cert.o \
@@ -345,10 +347,12 @@ OBJ_FILES = \
        ../heimdal/lib/hx509/collector.o \
        ../heimdal/lib/hx509/crypto.o \
        ../heimdal/lib/hx509/error.o \
        ../heimdal/lib/hx509/collector.o \
        ../heimdal/lib/hx509/crypto.o \
        ../heimdal/lib/hx509/error.o \
+       ../heimdal/lib/hx509/env.o \
        ../heimdal/lib/hx509/file.o \
        ../heimdal/lib/hx509/keyset.o \
        ../heimdal/lib/hx509/ks_dir.o \
        ../heimdal/lib/hx509/ks_file.o \
        ../heimdal/lib/hx509/file.o \
        ../heimdal/lib/hx509/keyset.o \
        ../heimdal/lib/hx509/ks_dir.o \
        ../heimdal/lib/hx509/ks_file.o \
+       ../heimdal/lib/hx509/ks_keychain.o \
        ../heimdal/lib/hx509/ks_mem.o \
        ../heimdal/lib/hx509/ks_null.o \
        ../heimdal/lib/hx509/ks_p11.o \
        ../heimdal/lib/hx509/ks_mem.o \
        ../heimdal/lib/hx509/ks_null.o \
        ../heimdal/lib/hx509/ks_p11.o \
@@ -421,6 +425,7 @@ OBJ_FILES = \
        ../heimdal/lib/roken/bswap.o \
        ../heimdal/lib/roken/dumpdata.o \
        ../heimdal/lib/roken/emalloc.o \
        ../heimdal/lib/roken/bswap.o \
        ../heimdal/lib/roken/dumpdata.o \
        ../heimdal/lib/roken/emalloc.o \
+       ../heimdal/lib/roken/ecalloc.o \
        ../heimdal/lib/roken/get_window_size.o \
        ../heimdal/lib/roken/h_errno.o \
        ../heimdal/lib/roken/issuid.o \
        ../heimdal/lib/roken/get_window_size.o \
        ../heimdal/lib/roken/h_errno.o \
        ../heimdal/lib/roken/issuid.o \
@@ -443,6 +448,7 @@ OBJ_FILES = \
        ../heimdal/lib/roken/simple_exec.o \
        ../heimdal/lib/roken/simple_exec.o \
        ../heimdal/lib/roken/strcollect.o \
        ../heimdal/lib/roken/simple_exec.o \
        ../heimdal/lib/roken/simple_exec.o \
        ../heimdal/lib/roken/strcollect.o \
+       ../heimdal/lib/roken/rtbl.o \
        replace.o
 PUBLIC_DEPENDENCIES = \
                        HEIMDAL_ROKEN_ADDRINFO \
        replace.o
 PUBLIC_DEPENDENCIES = \
                        HEIMDAL_ROKEN_ADDRINFO \
@@ -550,12 +556,12 @@ PRIVATE_DEPENDENCIES = HEIMDAL_COM_ERR_COMPILE_LEX HEIMDAL_ROKEN_GETPROGNAME_H E
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/hdb/hdb.asn1 hdb_asn1 heimdal/lib/hdb |
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/gssapi/spnego/spnego.asn1 spnego_asn1 heimdal/lib/gssapi --sequence=MechTypeList |
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/gssapi/mech/gssapi.asn1 gssapi_asn1 heimdal/lib/gssapi|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/hdb/hdb.asn1 hdb_asn1 heimdal/lib/hdb |
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/gssapi/spnego/spnego.asn1 spnego_asn1 heimdal/lib/gssapi --sequence=MechTypeList |
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/gssapi/mech/gssapi.asn1 gssapi_asn1 heimdal/lib/gssapi|
-include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/k5.asn1 krb5_asn1 heimdal/lib/asn1 --encode-rfc1510-bit-string --sequence=KRB5SignedPathPrincipals --sequence=AuthorizationData|
+include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/k5.asn1 krb5_asn1 heimdal/lib/asn1 --encode-rfc1510-bit-string --sequence=KRB5SignedPathPrincipals --sequence=AuthorizationData --sequence=METHOD-DATA|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/digest.asn1 digest_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkcs8.asn1 pkcs8_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkcs9.asn1 pkcs9_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkcs12.asn1 pkcs12_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/digest.asn1 digest_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkcs8.asn1 pkcs8_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkcs9.asn1 pkcs9_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkcs12.asn1 pkcs12_asn1 heimdal/lib/asn1|
-include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/rfc2459.asn1 rfc2459_asn1 heimdal/lib/asn1 --preserve-binary=TBSCertificate --preserve-binary=TBSCRLCertList --preserve-binary=Name --sequence=GeneralNames --sequence=Extensions|
+include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/rfc2459.asn1 rfc2459_asn1 heimdal/lib/asn1 --preserve-binary=TBSCertificate --preserve-binary=TBSCRLCertList --preserve-binary=Name --sequence=GeneralNames --sequence=Extensions --sequence=CRLDistributionPoints|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkinit.asn1 pkinit_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/CMS.asn1 cms_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/hx509/ocsp.asn1 ocsp_asn1 heimdal/lib/hx509 --preserve-binary=OCSPTBSRequest --preserve-binary=OCSPResponseData|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/pkinit.asn1 pkinit_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/CMS.asn1 cms_asn1 heimdal/lib/asn1|
 include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/hx509/ocsp.asn1 ocsp_asn1 heimdal/lib/hx509 --preserve-binary=OCSPTBSRequest --preserve-binary=OCSPResponseData|
@@ -569,14 +575,14 @@ include perl_path_wrapper.sh et_deps.pl heimdal/lib/krb5/krb5_err.et heimdal/lib
 include perl_path_wrapper.sh et_deps.pl heimdal/lib/gssapi/krb5/gkrb5_err.et heimdal/lib/gssapi|
 include perl_path_wrapper.sh et_deps.pl heimdal/lib/hx509/hx509_err.et heimdal/lib/hx509|
 
 include perl_path_wrapper.sh et_deps.pl heimdal/lib/gssapi/krb5/gkrb5_err.et heimdal/lib/gssapi|
 include perl_path_wrapper.sh et_deps.pl heimdal/lib/hx509/hx509_err.et heimdal/lib/hx509|
 
-include perl_path_wrapper.sh hcrypto-deps.pl heimdal/lib/des/*.h|
+include perl_path_wrapper.sh hcrypto-deps.pl heimdal/lib/hcrypto/*.h|
 
 
-heimdal/lib/des/hcrypto: 
-       @rm -f $@; ln -s ./../des $@
+heimdal/lib/hcrypto/hcrypto:
+       @rm -f $@; ln -s ./../hcrypto $@
 
 clean::        
        @-rm -f bin/compile_et bin/asn1_compile
 
 clean::        
        @-rm -f bin/compile_et bin/asn1_compile
-       @-rm -f heimdal/lib/krb5/des/hcrypto
+       @-rm -f heimdal/lib/krb5/hcrypto/hcrypto
 
 #######################
 # Start SUBSYSTEM HEIMDAL
 
 #######################
 # Start SUBSYSTEM HEIMDAL
@@ -606,7 +612,7 @@ OBJ_FILES = ../heimdal/kuser/kinit.o \
        ../heimdal/lib/vers/print_version.o \
        ../heimdal/lib/roken/setprogname.o \
        ../heimdal/lib/roken/getarg.o 
        ../heimdal/lib/vers/print_version.o \
        ../heimdal/lib/roken/setprogname.o \
        ../heimdal/lib/roken/getarg.o 
-PRIVATE_DEPENDENCIES = HEIMDAL_KRB5
+PRIVATE_DEPENDENCIES = HEIMDAL_KRB5 HEIMDAL_NTLM
 # End BINARY compile_et
 #######################
 
 # End BINARY compile_et
 #######################
 
index 61dd832b6ac9c251263ca31c93ad402bc7e9db51..0a2bba12a148508e19d3ec138dad930c8b6835ab 100755 (executable)
@@ -3,7 +3,7 @@ use strict;
 
 foreach (@ARGV) {
        my $old = $_;
 
 foreach (@ARGV) {
        my $old = $_;
-       my $new = $old; $new =~ s/des/des\/hcrypto/g;
+       my $new = $old; $new =~ s/hcrypto/hcrypto\/hcrypto/g;
        my $dir = $old; 
        my $dir = $old; 
-       print "$new: heimdal/lib/des/hcrypto\n";
+       print "$new: heimdal/lib/hcrypto/hcrypto\n";
 }
 }
index 0cb05dee348412fdf3cafb3ddf84eaace1923f46..5f777a667c4164b80bc015e1be76577133dbe88f 100644 (file)
@@ -323,6 +323,8 @@ static BOOL kdc_process(struct kdc_server *kdc,
        krb5_data k5_reply;
        krb5_data_zero(&k5_reply);
 
        krb5_data k5_reply;
        krb5_data_zero(&k5_reply);
 
+       krb5_kdc_update_time(NULL);
+
        DEBUG(10,("Received KDC packet of length %lu from %s:%d\n", 
                  (long)input->length - 4, peer_addr->addr, peer_addr->port));
 
        DEBUG(10,("Received KDC packet of length %lu from %s:%d\n", 
                  (long)input->length - 4, peer_addr->addr, peer_addr->port));
 
@@ -592,25 +594,15 @@ static void kdc_task_init(struct task_server *task)
 
        krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
 
 
        krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
 
-       /* Registar WinDC hooks */
-       ret = _krb5_plugin_register(kdc->smb_krb5_context->krb5_context, 
-                                   PLUGIN_TYPE_DATA, "windc",
-                                   &windc_plugin_table);
+       ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context, 
+                                 &kdc->config);
        if(ret) {
        if(ret) {
-               task_server_terminate(task, "kdc: failed to register hdb keytab");
-               return;
-       }
-
-       /* Setup the KDC configuration */
-       kdc->config = talloc(kdc, krb5_kdc_configuration);
-       if (!kdc->config) {
-               task_server_terminate(task, "kdc: out of memory");
+               task_server_terminate(task, "kdc: failed to get KDC configuration");
                return;
        }
                return;
        }
-       krb5_kdc_default_config(kdc->config);
 
        kdc->config->logf = kdc->smb_krb5_context->logf;
 
        kdc->config->logf = kdc->smb_krb5_context->logf;
-       kdc->config->db = talloc(kdc->config, struct HDB *);
+       kdc->config->db = talloc(kdc, struct HDB *);
        if (!kdc->config->db) {
                task_server_terminate(task, "kdc: out of memory");
                return;
        if (!kdc->config->db) {
                task_server_terminate(task, "kdc: out of memory");
                return;
@@ -630,7 +622,16 @@ static void kdc_task_init(struct task_server *task)
                return;
        }
 
                return;
        }
 
-       krb5_kdc_configure(kdc->smb_krb5_context->krb5_context, kdc->config);
+       /* Registar WinDC hooks */
+       ret = _krb5_plugin_register(kdc->smb_krb5_context->krb5_context, 
+                                   PLUGIN_TYPE_DATA, "windc",
+                                   &windc_plugin_table);
+       if(ret) {
+               task_server_terminate(task, "kdc: failed to register hdb keytab");
+               return;
+       }
+
+       krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
 
        kdc_mem_ctx = kdc->smb_krb5_context;
 
 
        kdc_mem_ctx = kdc->smb_krb5_context;
 
index f84a27b05b1aa81e4079934b9640464fedca54b4..c62a959b327f1452fecd1fa5e0992559c6656a24 100644 (file)
@@ -38,7 +38,7 @@ heimdal_basics: \
        heimdal/lib/krb5/krb5_err.h \
        heimdal/lib/gssapi/gkrb5_err.h \
        heimdal/lib/hx509/hx509_err.h \
        heimdal/lib/krb5/krb5_err.h \
        heimdal/lib/gssapi/gkrb5_err.h \
        heimdal/lib/hx509/hx509_err.h \
-       heimdal/lib/des/hcrypto
+       heimdal/lib/hcrypto/hcrypto
 
 proto: basics
 basics: include/includes.h \
 
 proto: basics
 basics: include/includes.h \