Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (7865b978f85dc5cf0cfd8b2bed758d4699938602)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Ladislav Hagara <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (7865b978f85dc5cf0cfd8b2bed758d4699938602)
  • Date: Mon, 23 Apr 2007 18:08:22 -0500

GIT changes to master grimoire by Ladislav Hagara <ladislav.hagara AT unob.cz>:

crypto/krb5/2007-001-patch.txt | 74 --
crypto/krb5/2007-002-patch.txt | 1273
-----------------------------------------
crypto/krb5/2007-003-patch.txt | 24
crypto/krb5/BUILD | 5
crypto/krb5/DETAILS | 4
crypto/krb5/HISTORY | 4
6 files changed, 6 insertions(+), 1378 deletions(-)

New commits:
commit 7865b978f85dc5cf0cfd8b2bed758d4699938602
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Ladislav Hagara <ladislav.hagara AT unob.cz>

krb5 1.6.1

diff --git a/crypto/krb5/2007-001-patch.txt b/crypto/krb5/2007-001-patch.txt
deleted file mode 100644
index 741ed35..0000000
--- a/crypto/krb5/2007-001-patch.txt
+++ /dev/null
@@ -1,74 +0,0 @@
-*** src/appl/telnet/telnetd/state.c (revision 19480)
---- src/appl/telnet/telnetd/state.c (local)
-***************
-*** 1665,1671 ****
- strcmp(varp, "RESOLV_HOST_CONF") && /* linux */
- strcmp(varp, "NLSPATH") && /* locale stuff */
- strncmp(varp, "LC_", strlen("LC_")) && /* locale stuff */
-! strcmp(varp, "IFS")) {
- return 1;
- } else {
- syslog(LOG_INFO, "Rejected the attempt to modify the
environment variable \"%s\"", varp);
---- 1665,1672 ----
- strcmp(varp, "RESOLV_HOST_CONF") && /* linux */
- strcmp(varp, "NLSPATH") && /* locale stuff */
- strncmp(varp, "LC_", strlen("LC_")) && /* locale stuff */
-! strcmp(varp, "IFS") &&
-! !strchr(varp, '-')) {
- return 1;
- } else {
- syslog(LOG_INFO, "Rejected the attempt to modify the
environment variable \"%s\"", varp);
-*** src/appl/telnet/telnetd/sys_term.c (revision 19480)
---- src/appl/telnet/telnetd/sys_term.c (local)
-***************
-*** 1287,1292 ****
---- 1287,1302 ----
- #endif
- #if defined (AUTHENTICATION)
- if (auth_level >= 0 && autologin == AUTH_VALID) {
-+ if (name[0] == '-') {
-+ /* Authenticated and authorized to log in to an
-+ account starting with '-'? Even if that
-+ unlikely case comes to pass, the current login
-+ program will not parse the resulting command
-+ line properly. */
-+ syslog(LOG_ERR, "user name cannot start with '-'");
-+ fatal(net, "user name cannot start with '-'");
-+ exit(1);
-+ }
- # if !defined(NO_LOGIN_F)
- #if defined(LOGIN_CAP_F)
- argv = addarg(argv, "-F");
-***************
-*** 1377,1387 ****
- } else
- #endif
- if (getenv("USER")) {
-! argv = addarg(argv, getenv("USER"));
- #if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
- {
- register char **cpp;
- for (cpp = environ; *cpp; cpp++)
- argv = addarg(argv, *cpp);
- }
- #endif
---- 1387,1405 ----
- } else
- #endif
- if (getenv("USER")) {
-! char *user = getenv("USER");
-! if (user[0] == '-') {
-! /* "telnet -l-x ..." */
-! syslog(LOG_ERR, "user name cannot start with '-'");
-! fatal(net, "user name cannot start with '-'");
-! exit(1);
-! }
-! argv = addarg(argv, user);
- #if defined(LOGIN_ARGS) && defined(NO_LOGIN_P)
- {
- register char **cpp;
- for (cpp = environ; *cpp; cpp++)
-+ if ((*cpp)[0] != '-')
- argv = addarg(argv, *cpp);
- }
- #endif
diff --git a/crypto/krb5/2007-002-patch.txt b/crypto/krb5/2007-002-patch.txt
deleted file mode 100644
index 69f7d19..0000000
--- a/crypto/krb5/2007-002-patch.txt
+++ /dev/null
@@ -1,1273 +0,0 @@
-*** src/kadmin/server/kadm_rpc_svc.c (revision 19480)
---- src/kadmin/server/kadm_rpc_svc.c (local)
-***************
-*** 250,255 ****
---- 250,257 ----
- krb5_data *c1, *c2, *realm;
- gss_buffer_desc gss_str;
- kadm5_server_handle_t handle;
-+ size_t slen;
-+ char *sdots;
-
- success = 0;
- handle = (kadm5_server_handle_t)global_server_handle;
-***************
-*** 274,279 ****
---- 276,283 ----
- if (ret == 0)
- goto fail_name;
-
-+ slen = gss_str.length;
-+ trunc_name(&slen, &sdots);
- /*
- * Since we accept with GSS_C_NO_NAME, the client can authenticate
- * against the entire kdb. Therefore, ensure that the service
-***************
-*** 296,303 ****
-
- fail_princ:
- if (!success) {
-! krb5_klog_syslog(LOG_ERR, "bad service principal %.*s",
-! gss_str.length, gss_str.value);
- }
- gss_release_buffer(&min_stat, &gss_str);
- krb5_free_principal(kctx, princ);
---- 300,307 ----
-
- fail_princ:
- if (!success) {
-! krb5_klog_syslog(LOG_ERR, "bad service principal %.*s%s",
-! slen, gss_str.value, sdots);
- }
- gss_release_buffer(&min_stat, &gss_str);
- krb5_free_principal(kctx, princ);
-*** src/kadmin/server/misc.c (revision 19480)
---- src/kadmin/server/misc.c (local)
-***************
-*** 171,173 ****
---- 171,182 ----
-
- return kadm5_free_principal_ent(handle->lhandle, &princ);
- }
-+
-+ #define MAXPRINCLEN 125
-+
-+ void
-+ trunc_name(size_t *len, char **dots)
-+ {
-+ *dots = *len > MAXPRINCLEN ? "..." : "";
-+ *len = *len > MAXPRINCLEN ? MAXPRINCLEN : *len;
-+ }
-*** src/kadmin/server/misc.h (revision 19480)
---- src/kadmin/server/misc.h (local)
-***************
-*** 45,47 ****
---- 45,49 ----
- #ifdef SVC_GETARGS
- void kadm_1(struct svc_req *, SVCXPRT *);
- #endif
-+
-+ void trunc_name(size_t *len, char **dots);
-*** src/kadmin/server/ovsec_kadmd.c (revision 19480)
---- src/kadmin/server/ovsec_kadmd.c (local)
-***************
-*** 992,997 ****
---- 992,999 ----
- rpcproc_t proc;
- int i;
- const char *procname;
-+ size_t clen, slen;
-+ char *cdots, *sdots;
-
- client.length = 0;
- client.value = NULL;
-***************
-*** 1000,1009 ****
-
- (void) gss_display_name(&minor, client_name, &client, &gss_type);
- (void) gss_display_name(&minor, server_name, &server, &gss_type);
-! if (client.value == NULL)
- client.value = "(null)";
-! if (server.value == NULL)
- server.value = "(null)";
- a = inet_ntoa(rqst->rq_xprt->xp_raddr.sin_addr);
-
- proc = msg->rm_call.cb_proc;
---- 1002,1021 ----
-
- (void) gss_display_name(&minor, client_name, &client, &gss_type);
- (void) gss_display_name(&minor, server_name, &server, &gss_type);
-! if (client.value == NULL) {
- client.value = "(null)";
-! clen = sizeof("(null)") -1;
-! } else {
-! clen = client.length;
-! }
-! trunc_name(&clen, &cdots);
-! if (server.value == NULL) {
- server.value = "(null)";
-+ slen = sizeof("(null)") - 1;
-+ } else {
-+ slen = server.length;
-+ }
-+ trunc_name(&slen, &sdots);
- a = inet_ntoa(rqst->rq_xprt->xp_raddr.sin_addr);
-
- proc = msg->rm_call.cb_proc;
-***************
-*** 1016,1029 ****
- }
- if (procname != NULL)
- krb5_klog_syslog(LOG_NOTICE, "WARNING! Forged/garbled request: %s, "
-! "claimed client = %s, server = %s, addr = %s",
-! procname, client.value,
-! server.value, a);
- else
- krb5_klog_syslog(LOG_NOTICE, "WARNING! Forged/garbled request: %d, "
-! "claimed client = %s, server = %s, addr = %s",
-! proc, client.value,
-! server.value, a);
-
- (void) gss_release_buffer(&minor, &client);
- (void) gss_release_buffer(&minor, &server);
---- 1028,1041 ----
- }
- if (procname != NULL)
- krb5_klog_syslog(LOG_NOTICE, "WARNING! Forged/garbled request: %s, "
-! "claimed client = %.*s%s, server = %.*s%s, addr =
%s",
-! procname, clen, client.value, cdots,
-! slen, server.value, sdots, a);
- else
- krb5_klog_syslog(LOG_NOTICE, "WARNING! Forged/garbled request: %d, "
-! "claimed client = %.*s%s, server = %.*s%s, addr =
%s",
-! proc, clen, client.value, cdots,
-! slen, server.value, sdots, a);
-
- (void) gss_release_buffer(&minor, &client);
- (void) gss_release_buffer(&minor, &server);
-*** src/kadmin/server/schpw.c (revision 19480)
---- src/kadmin/server/schpw.c (local)
-***************
-*** 40,45 ****
---- 40,47 ----
- int numresult;
- char strresult[1024];
- char *clientstr;
-+ size_t clen;
-+ char *cdots;
-
- ret = 0;
- rep->length = 0;
-***************
-*** 258,266 ****
- free(ptr);
- clear.length = 0;
-
-! krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %s: %s",
- inet_ntoa(((struct sockaddr_in
*)&remote_addr)->sin_addr),
-! clientstr, ret ? krb5_get_error_message (context, ret) :
"success");
- krb5_free_unparsed_name(context, clientstr);
-
- if (ret) {
---- 260,271 ----
- free(ptr);
- clear.length = 0;
-
-! clen = strlen(clientstr);
-! trunc_name(&clen, &cdots);
-! krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %.*s%s: %s",
- inet_ntoa(((struct sockaddr_in
*)&remote_addr)->sin_addr),
-! clen, clientstr, cdots,
-! ret ? krb5_get_error_message (context, ret) : "success");
- krb5_free_unparsed_name(context, clientstr);
-
- if (ret) {
-*** src/kadmin/server/server_stubs.c (revision 19480)
---- src/kadmin/server/server_stubs.c (local)
-***************
-*** 14,19 ****
---- 14,20 ----
- #include <arpa/inet.h> /* inet_ntoa */
- #include <adm_proto.h> /* krb5_klog_syslog */
- #include "misc.h"
-+ #include <string.h>
-
- #define LOG_UNAUTH "Unauthorized request: %s, %s, client=%s, service=%s,
addr=%s"
- #define LOG_DONE "Request: %s, %s, %s, client=%s, service=%s,
addr=%s"
-***************
-*** 237,242 ****
---- 238,298 ----
- return 0;
- }
-
-+ static int
-+ log_unauth(
-+ char *op,
-+ char *target,
-+ gss_buffer_t client,
-+ gss_buffer_t server,
-+ struct svc_req *rqstp)
-+ {
-+ size_t tlen, clen, slen;
-+ char *tdots, *cdots, *sdots;
-+
-+ tlen = strlen(target);
-+ trunc_name(&tlen, &tdots);
-+ clen = client->length;
-+ trunc_name(&clen, &cdots);
-+ slen = server->length;
-+ trunc_name(&slen, &sdots);
-+
-+ return krb5_klog_syslog(LOG_NOTICE,
-+ "Unauthorized request: %s, %.*s%s, "
-+ "client=%.*s%s, service=%.*s%s, addr=%s",
-+ op, tlen, target, tdots,
-+ clen, client->value, cdots,
-+ slen, server->value, sdots,
-+ inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-+ }
-+
-+ static int
-+ log_done(
-+ char *op,
-+ char *target,
-+ char *errmsg,
-+ gss_buffer_t client,
-+ gss_buffer_t server,
-+ struct svc_req *rqstp)
-+ {
-+ size_t tlen, clen, slen;
-+ char *tdots, *cdots, *sdots;
-+
-+ tlen = strlen(target);
-+ trunc_name(&tlen, &tdots);
-+ clen = client->length;
-+ trunc_name(&clen, &cdots);
-+ slen = server->length;
-+ trunc_name(&slen, &sdots);
-+
-+ return krb5_klog_syslog(LOG_NOTICE,
-+ "Request: %s, %.*s%s, %s, "
-+ "client=%.*s%s, service=%.*s%s, addr=%s",
-+ op, tlen, target, tdots, errmsg,
-+ clen, client->value, cdots,
-+ slen, server->value, sdots,
-+ inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-+ }
-+
- generic_ret *
- create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
- {
-***************
-*** 275,283 ****
- || kadm5int_acl_impose_restrictions(handle->context,
- &arg->rec, &arg->mask, rp)) {
- ret.code = KADM5_AUTH_ADD;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- ret.code = kadm5_create_principal((void *)handle,
- &arg->rec, arg->mask,
---- 331,338 ----
- || kadm5int_acl_impose_restrictions(handle->context,
- &arg->rec, &arg->mask, rp)) {
- ret.code = KADM5_AUTH_ADD;
-! log_unauth("kadm5_create_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- ret.code = kadm5_create_principal((void *)handle,
- &arg->rec, arg->mask,
-***************
-*** 287,296 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
---- 342,349 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_create_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
-***************
-*** 341,349 ****
- || kadm5int_acl_impose_restrictions(handle->context,
- &arg->rec, &arg->mask, rp)) {
- ret.code = KADM5_AUTH_ADD;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- ret.code = kadm5_create_principal_3((void *)handle,
- &arg->rec, arg->mask,
---- 394,401 ----
- || kadm5int_acl_impose_restrictions(handle->context,
- &arg->rec, &arg->mask, rp)) {
- ret.code = KADM5_AUTH_ADD;
-! log_unauth("kadm5_create_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- ret.code = kadm5_create_principal_3((void *)handle,
- &arg->rec, arg->mask,
-***************
-*** 355,364 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
---- 407,414 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_create_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
-***************
-*** 406,414 ****
- || !kadm5int_acl_check(handle->context, rqst2name(rqstp), ACL_DELETE,
- arg->princ, NULL)) {
- ret.code = KADM5_AUTH_DELETE;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- ret.code = kadm5_delete_principal((void *)handle, arg->princ);
- if( ret.code == 0 )
---- 456,463 ----
- || !kadm5int_acl_check(handle->context, rqst2name(rqstp), ACL_DELETE,
- arg->princ, NULL)) {
- ret.code = KADM5_AUTH_DELETE;
-! log_unauth("kadm5_delete_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- ret.code = kadm5_delete_principal((void *)handle, arg->princ);
- if( ret.code == 0 )
-***************
-*** 416,425 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
---- 465,472 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_delete_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
-***************
-*** 469,477 ****
- || kadm5int_acl_impose_restrictions(handle->context,
- &arg->rec, &arg->mask, rp)) {
- ret.code = KADM5_AUTH_MODIFY;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- ret.code = kadm5_modify_principal((void *)handle, &arg->rec,
- arg->mask);
---- 516,523 ----
- || kadm5int_acl_impose_restrictions(handle->context,
- &arg->rec, &arg->mask, rp)) {
- ret.code = KADM5_AUTH_MODIFY;
-! log_unauth("kadm5_modify_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- ret.code = kadm5_modify_principal((void *)handle, &arg->rec,
- arg->mask);
-***************
-*** 480,489 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
---- 526,533 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_modify_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
-
- /* no need to check for NULL. Even if it is NULL, atleast error_code
will be returned */
- }
-***************
-*** 546,554 ****
- } else
- ret.code = KADM5_AUTH_INSUFFICIENT;
- if (ret.code != KADM5_OK) {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_rename_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- ret.code = kadm5_rename_principal((void *)handle, arg->src,
- arg->dest);
---- 590,597 ----
- } else
- ret.code = KADM5_AUTH_INSUFFICIENT;
- if (ret.code != KADM5_OK) {
-! log_unauth("kadm5_rename_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- ret.code = kadm5_rename_principal((void *)handle, arg->src,
- arg->dest);
-***************
-*** 557,566 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_rename_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- free(prime_arg1);
---- 600,607 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_rename_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- free(prime_arg1);
-***************
-*** 614,622 ****
- arg->princ,
- NULL))) {
- ret.code = KADM5_AUTH_GET;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- if (handle->api_version == KADM5_API_VERSION_1) {
- ret.code = kadm5_get_principal_v1((void *)handle,
---- 655,662 ----
- arg->princ,
- NULL))) {
- ret.code = KADM5_AUTH_GET;
-! log_unauth(funcname, prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- if (handle->api_version == KADM5_API_VERSION_1) {
- ret.code = kadm5_get_principal_v1((void *)handle,
-***************
-*** 636,646 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-! prime_arg,
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
- }
- free_server_handle(handle);
---- 676,683 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done(funcname, prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
-
- }
- free_server_handle(handle);
-***************
-*** 688,696 ****
- NULL,
- NULL)) {
- ret.code = KADM5_AUTH_LIST;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_principals",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- ret.code = kadm5_get_principals((void *)handle,
- arg->exp, &ret.princs,
---- 725,732 ----
- NULL,
- NULL)) {
- ret.code = KADM5_AUTH_LIST;
-! log_unauth("kadm5_get_principals", prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- ret.code = kadm5_get_principals((void *)handle,
- arg->exp, &ret.princs,
-***************
-*** 700,710 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_principals",
-! prime_arg,
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
- }
- free_server_handle(handle);
---- 736,743 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_get_principals", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
-
- }
- free_server_handle(handle);
-***************
-*** 755,763 ****
- ret.code = kadm5_chpass_principal((void *)handle, arg->princ,
- arg->pass);
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
---- 788,795 ----
- ret.code = kadm5_chpass_principal((void *)handle, arg->princ,
- arg->pass);
- } else {
-! log_unauth("kadm5_chpass_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
-***************
-*** 767,776 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
-
- free_server_handle(handle);
---- 799,806 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_chpass_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
-
- free_server_handle(handle);
-***************
-*** 828,836 ****
- arg->ks_tuple,
- arg->pass);
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
---- 858,865 ----
- arg->ks_tuple,
- arg->pass);
- } else {
-! log_unauth("kadm5_chpass_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
-***************
-*** 840,849 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
-
- free_server_handle(handle);
---- 869,876 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_chpass_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
-
- free_server_handle(handle);
-***************
-*** 892,900 ****
- ret.code = kadm5_setv4key_principal((void *)handle, arg->princ,
- arg->keyblock);
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setv4key_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_SETKEY;
- }
-
---- 919,926 ----
- ret.code = kadm5_setv4key_principal((void *)handle, arg->princ,
- arg->keyblock);
- } else {
-! log_unauth("kadm5_setv4key_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_SETKEY;
- }
-
-***************
-*** 904,913 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setv4key_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
-
- free_server_handle(handle);
---- 930,937 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_setv4key_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
-
- free_server_handle(handle);
-***************
-*** 956,964 ****
- ret.code = kadm5_setkey_principal((void *)handle, arg->princ,
- arg->keyblocks, arg->n_keys);
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_SETKEY;
- }
-
---- 980,987 ----
- ret.code = kadm5_setkey_principal((void *)handle, arg->princ,
- arg->keyblocks, arg->n_keys);
- } else {
-! log_unauth("kadm5_setkey_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_SETKEY;
- }
-
-***************
-*** 968,977 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
-
- free_server_handle(handle);
---- 991,998 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_setkey_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
-
- free_server_handle(handle);
-***************
-*** 1023,1031 ****
- arg->ks_tuple,
- arg->keyblocks, arg->n_keys);
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_SETKEY;
- }
-
---- 1044,1051 ----
- arg->ks_tuple,
- arg->keyblocks, arg->n_keys);
- } else {
-! log_unauth("kadm5_setkey_principal", prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_SETKEY;
- }
-
-***************
-*** 1035,1044 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal",
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
-
- free_server_handle(handle);
---- 1055,1062 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_setkey_principal", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
-
- free_server_handle(handle);
-***************
-*** 1097,1105 ****
- ret.code = kadm5_randkey_principal((void *)handle, arg->princ,
- &k, &nkeys);
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
---- 1115,1122 ----
- ret.code = kadm5_randkey_principal((void *)handle, arg->princ,
- &k, &nkeys);
- } else {
-! log_unauth(funcname, prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
-***************
-*** 1119,1128 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- free(prime_arg);
---- 1136,1143 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done(funcname, prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- free(prime_arg);
-***************
-*** 1185,1193 ****
- arg->ks_tuple,
- &k, &nkeys);
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
---- 1200,1207 ----
- arg->ks_tuple,
- &k, &nkeys);
- } else {
-! log_unauth(funcname, prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_CHANGEPW;
- }
-
-***************
-*** 1207,1216 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-! prime_arg, errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- free(prime_arg);
---- 1221,1228 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done(funcname, prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- free(prime_arg);
-***************
-*** 1253,1262 ****
- rqst2name(rqstp),
- ACL_ADD, NULL, NULL)) {
- ret.code = KADM5_AUTH_ADD;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_policy",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-!
- } else {
- ret.code = kadm5_create_policy((void *)handle, &arg->rec,
- arg->mask);
---- 1265,1273 ----
- rqst2name(rqstp),
- ACL_ADD, NULL, NULL)) {
- ret.code = KADM5_AUTH_ADD;
-! log_unauth("kadm5_create_policy", prime_arg,
-! &client_name, &service_name, rqstp);
-!
- } else {
- ret.code = kadm5_create_policy((void *)handle, &arg->rec,
- arg->mask);
-***************
-*** 1265,1275 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_policy",
-! ((prime_arg == NULL) ? "(null)" : prime_arg),
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
---- 1276,1284 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_create_policy",
-! ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
-***************
-*** 1310,1318 ****
- if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context,
- rqst2name(rqstp),
- ACL_DELETE, NULL, NULL)) {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_policy",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_DELETE;
- } else {
- ret.code = kadm5_delete_policy((void *)handle, arg->name);
---- 1319,1326 ----
- if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context,
- rqst2name(rqstp),
- ACL_DELETE, NULL, NULL)) {
-! log_unauth("kadm5_delete_policy", prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_DELETE;
- } else {
- ret.code = kadm5_delete_policy((void *)handle, arg->name);
-***************
-*** 1321,1331 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_policy",
-! ((prime_arg == NULL) ? "(null)" : prime_arg),
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
---- 1329,1337 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_delete_policy",
-! ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
-***************
-*** 1366,1374 ****
- if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context,
- rqst2name(rqstp),
- ACL_MODIFY, NULL, NULL)) {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_policy",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- ret.code = KADM5_AUTH_MODIFY;
- } else {
- ret.code = kadm5_modify_policy((void *)handle, &arg->rec,
---- 1372,1379 ----
- if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context,
- rqst2name(rqstp),
- ACL_MODIFY, NULL, NULL)) {
-! log_unauth("kadm5_modify_policy", prime_arg,
-! &client_name, &service_name, rqstp);
- ret.code = KADM5_AUTH_MODIFY;
- } else {
- ret.code = kadm5_modify_policy((void *)handle, &arg->rec,
-***************
-*** 1378,1388 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_policy",
-! ((prime_arg == NULL) ? "(null)" : prime_arg),
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
---- 1383,1391 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_modify_policy",
-! ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
-***************
-*** 1464,1478 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-! ((prime_arg == NULL) ? "(null)" : prime_arg),
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
---- 1467,1478 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done(funcname,
-! ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
-! &client_name, &service_name, rqstp);
- } else {
-! log_unauth(funcname, prime_arg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
-***************
-*** 1517,1525 ****
- rqst2name(rqstp),
- ACL_LIST, NULL, NULL)) {
- ret.code = KADM5_AUTH_LIST;
-! krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_policies",
-! prime_arg, client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- } else {
- ret.code = kadm5_get_policies((void *)handle,
- arg->exp, &ret.pols,
---- 1517,1524 ----
- rqst2name(rqstp),
- ACL_LIST, NULL, NULL)) {
- ret.code = KADM5_AUTH_LIST;
-! log_unauth("kadm5_get_policies", prime_arg,
-! &client_name, &service_name, rqstp);
- } else {
- ret.code = kadm5_get_policies((void *)handle,
- arg->exp, &ret.pols,
-***************
-*** 1529,1539 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_policies",
-! prime_arg,
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
---- 1528,1535 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_get_policies", prime_arg, errmsg,
-! &client_name, &service_name, rqstp);
- }
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
-***************
-*** 1573,1583 ****
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_privs",
-! client_name.value,
-! errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
-
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
---- 1569,1576 ----
- else
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-
-! log_done("kadm5_get_privs", client_name.value, errmsg,
-! &client_name, &service_name, rqstp);
-
- free_server_handle(handle);
- gss_release_buffer(&minor_stat, &client_name);
-***************
-*** 1594,1599 ****
---- 1587,1594 ----
- kadm5_server_handle_t handle;
- OM_uint32 minor_stat;
- char *errmsg = 0;
-+ size_t clen, slen;
-+ char *cdots, *sdots;
-
- xdr_free(xdr_generic_ret, &ret);
-
-***************
-*** 1612,1625 ****
-
- if (ret.code != 0)
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-! krb5_klog_syslog(LOG_NOTICE, LOG_DONE ", flavor=%d",
-! (ret.api_version == KADM5_API_VERSION_1 ?
-! "kadm5_init (V1)" : "kadm5_init"),
-! client_name.value,
-! (ret.code == 0) ? "success" : errmsg,
-! client_name.value, service_name.value,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr),
-! rqstp->rq_cred.oa_flavor);
- gss_release_buffer(&minor_stat, &client_name);
- gss_release_buffer(&minor_stat, &service_name);
-
---- 1607,1628 ----
-
- if (ret.code != 0)
- errmsg = krb5_get_error_message(handle ? handle->context : NULL,
ret.code);
-! else
-! errmsg = "success";
-!
-! clen = client_name.length;
-! trunc_name(&clen, &cdots);
-! slen = service_name.length;
-! trunc_name(&slen, &sdots);
-! krb5_klog_syslog(LOG_NOTICE, "Request: %s, %.*s%s, %s, "
-! "client=%.*s%s, service=%.*s%s, addr=%s, flavor=%d",
-! (ret.api_version == KADM5_API_VERSION_1 ?
-! "kadm5_init (V1)" : "kadm5_init"),
-! clen, client_name.value, cdots, errmsg,
-! clen, client_name.value, cdots,
-! slen, service_name.value, sdots,
-! inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr),
-! rqstp->rq_cred.oa_flavor);
- gss_release_buffer(&minor_stat, &client_name);
- gss_release_buffer(&minor_stat, &service_name);
-
-*** src/kdc/do_tgs_req.c (revision 19480)
---- src/kdc/do_tgs_req.c (local)
-***************
-*** 491,518 ****
- newtransited = 1;
- }
- if (!isflagset (request->kdc_options,
KDC_OPT_DISABLE_TRANSITED_CHECK)) {
- errcode = krb5_check_transited_list (kdc_context,
-
&enc_tkt_reply.transited.tr_contents,
- krb5_princ_realm (kdc_context,
header_ticket->enc_part2->client),
- krb5_princ_realm (kdc_context,
request->server));
- if (errcode == 0) {
- setflag (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED);
- } else if (errcode == KRB5KRB_AP_ERR_ILL_CR_TKT)
- krb5_klog_syslog (LOG_INFO,
-! "bad realm transit path from '%s' to '%s' via
'%.*s'",
- cname ? cname : "<unknown client>",
- sname ? sname : "<unknown server>",
-! enc_tkt_reply.transited.tr_contents.length,
-! enc_tkt_reply.transited.tr_contents.data);
- else {
- const char *emsg = krb5_get_error_message(kdc_context, errcode);
- krb5_klog_syslog (LOG_ERR,
-! "unexpected error checking transit from '%s' to
'%s' via '%.*s': %s",
- cname ? cname : "<unknown client>",
- sname ? sname : "<unknown server>",
-! enc_tkt_reply.transited.tr_contents.length,
- enc_tkt_reply.transited.tr_contents.data,
-! emsg);
- krb5_free_error_message(kdc_context, emsg);
- }
- } else
---- 491,528 ----
- newtransited = 1;
- }
- if (!isflagset (request->kdc_options,
KDC_OPT_DISABLE_TRANSITED_CHECK)) {
-+ unsigned int tlen;
-+ char *tdots;
-+
- errcode = krb5_check_transited_list (kdc_context,
-
&enc_tkt_reply.transited.tr_contents,
- krb5_princ_realm (kdc_context,
header_ticket->enc_part2->client),
- krb5_princ_realm (kdc_context,
request->server));
-+ tlen = enc_tkt_reply.transited.tr_contents.length;
-+ tdots = tlen > 125 ? "..." : "";
-+ tlen = tlen > 125 ? 125 : tlen;
-+
- if (errcode == 0) {
- setflag (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED);
- } else if (errcode == KRB5KRB_AP_ERR_ILL_CR_TKT)
- krb5_klog_syslog (LOG_INFO,
-! "bad realm transit path from '%s' to '%s' "
-! "via '%.*s%s'",
- cname ? cname : "<unknown client>",
- sname ? sname : "<unknown server>",
-! tlen,
-! enc_tkt_reply.transited.tr_contents.data,
-! tdots);
- else {
- const char *emsg = krb5_get_error_message(kdc_context, errcode);
- krb5_klog_syslog (LOG_ERR,
-! "unexpected error checking transit from "
-! "'%s' to '%s' via '%.*s%s': %s",
- cname ? cname : "<unknown client>",
- sname ? sname : "<unknown server>",
-! tlen,
- enc_tkt_reply.transited.tr_contents.data,
-! tdots, emsg);
- krb5_free_error_message(kdc_context, emsg);
- }
- } else
-***************
-*** 542,547 ****
---- 552,560 ----
- if (!krb5_principal_compare(kdc_context, request->server, client2)) {
- if ((errcode = krb5_unparse_name(kdc_context, client2, &tmp)))
- tmp = 0;
-+ if (tmp != NULL)
-+ limit_string(tmp);
-+
- krb5_klog_syslog(LOG_INFO,
- "TGS_REQ %s: 2ND_TKT_MISMATCH: "
- "authtime %d, %s for %s, 2nd tkt client %s",
-***************
-*** 816,821 ****
---- 829,835 ----
- krb5_klog_syslog(LOG_INFO,
- "TGS_REQ: issuing alternate <un-unparseable> TGT");
- } else {
-+ limit_string(sname);
- krb5_klog_syslog(LOG_INFO,
- "TGS_REQ: issuing TGT %s", sname);
- free(sname);
-*** src/kdc/kdc_util.c (revision 19480)
---- src/kdc/kdc_util.c (local)
-***************
-*** 404,409 ****
---- 404,410 ----
-
- krb5_db_free_principal(kdc_context, &server, nprincs);
- if (!krb5_unparse_name(kdc_context, ticket->server, &sname)) {
-+ limit_string(sname);
- krb5_klog_syslog(LOG_ERR,"TGS_REQ: UNKNOWN SERVER: server='%s'",
- sname);
- free(sname);
-*** src/lib/kadm5/logger.c (revision 19480)
---- src/lib/kadm5/logger.c (local)
-***************
-*** 45,51 ****
- #include <varargs.h>
- #endif /* HAVE_STDARG_H */
-
-! #define KRB5_KLOG_MAX_ERRMSG_SIZE 1024
- #ifndef MAXHOSTNAMELEN
- #define MAXHOSTNAMELEN 256
- #endif /* MAXHOSTNAMELEN */
---- 45,51 ----
- #include <varargs.h>
- #endif /* HAVE_STDARG_H */
-
-! #define KRB5_KLOG_MAX_ERRMSG_SIZE 2048
- #ifndef MAXHOSTNAMELEN
- #define MAXHOSTNAMELEN 256
- #endif /* MAXHOSTNAMELEN */
-***************
-*** 261,267 ****
- #endif /* HAVE_SYSLOG */
-
- /* Now format the actual message */
-! #if HAVE_VSPRINTF
- vsprintf(cp, actual_format, ap);
- #else /* HAVE_VSPRINTF */
- sprintf(cp, actual_format, ((int *) ap)[0], ((int *) ap)[1],
---- 261,269 ----
- #endif /* HAVE_SYSLOG */
-
- /* Now format the actual message */
-! #if HAVE_VSNPRINTF
-! vsnprintf(cp, sizeof(outbuf) - (cp - outbuf), actual_format, ap);
-! #elif HAVE_VSPRINTF
- vsprintf(cp, actual_format, ap);
- #else /* HAVE_VSPRINTF */
- sprintf(cp, actual_format, ((int *) ap)[0], ((int *) ap)[1],
-***************
-*** 850,856 ****
- syslogp = &outbuf[strlen(outbuf)];
-
- /* Now format the actual message */
-! #ifdef HAVE_VSPRINTF
- vsprintf(syslogp, format, arglist);
- #else /* HAVE_VSPRINTF */
- sprintf(syslogp, format, ((int *) arglist)[0], ((int *) arglist)[1],
---- 852,860 ----
- syslogp = &outbuf[strlen(outbuf)];
-
- /* Now format the actual message */
-! #ifdef HAVE_VSNPRINTF
-! vsnprintf(syslogp, sizeof(outbuf) - (syslogp - outbuf), format,
arglist);
-! #elif HAVE_VSPRINTF
- vsprintf(syslogp, format, arglist);
- #else /* HAVE_VSPRINTF */
- sprintf(syslogp, format, ((int *) arglist)[0], ((int *) arglist)[1],
diff --git a/crypto/krb5/2007-003-patch.txt b/crypto/krb5/2007-003-patch.txt
deleted file mode 100644
index cefd724..0000000
--- a/crypto/krb5/2007-003-patch.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-*** src/lib/gssapi/krb5/k5unseal.c (revision 19510)
---- src/lib/gssapi/krb5/k5unseal.c (revision 19511)
-***************
-*** 457,464 ****
-
- if ((ctx->initiate && direction != 0xff) ||
- (!ctx->initiate && direction != 0)) {
-! if (toktype == KG_TOK_SEAL_MSG)
- xfree(token.value);
- *minor_status = G_BAD_DIRECTION;
- return(GSS_S_BAD_SIG);
- }
---- 457,467 ----
-
- if ((ctx->initiate && direction != 0xff) ||
- (!ctx->initiate && direction != 0)) {
-! if (toktype == KG_TOK_SEAL_MSG) {
- xfree(token.value);
-+ message_buffer->value = NULL;
-+ message_buffer->length = 0;
-+ }
- *minor_status = G_BAD_DIRECTION;
- return(GSS_S_BAD_SIG);
- }
diff --git a/crypto/krb5/BUILD b/crypto/krb5/BUILD
index 3a94233..14d1206 100755
--- a/crypto/krb5/BUILD
+++ b/crypto/krb5/BUILD
@@ -6,11 +6,6 @@ fi

cd $SPELL-$VERSION/src &&

-# Kerberos Security Advisories
-patch -p1 < $SCRIPT_DIRECTORY/2007-001-patch.txt &&
-patch -p1 < $SCRIPT_DIRECTORY/2007-002-patch.txt &&
-patch -p1 < $SCRIPT_DIRECTORY/2007-003-patch.txt &&
-
./configure --enable-dns-for-kdc \
--enable-dns-for-realm \
--infodir=/usr/share/info \
diff --git a/crypto/krb5/DETAILS b/crypto/krb5/DETAILS
index fe1e94b..5ebfceb 100755
--- a/crypto/krb5/DETAILS
+++ b/crypto/krb5/DETAILS
@@ -1,10 +1,10 @@
SPELL=krb5
- VERSION=1.6
+ VERSION=1.6.1
SOURCE=$SPELL-$VERSION-signed.tar
SOURCE_RAW=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE_URL[0]=http://web.mit.edu/kerberos/www/dist/krb5/1.6/$SOURCE
-
SOURCE_HASH=sha512:207ff8683cd9dee4f676b0a18cd3a4828f0af4f9947bac82f0ebca242c15a93d161619cb8a4cb13e13c1da5d2e50ccec2821d52481f160b7b5ddc6dd224ac1c8
+
SOURCE_HASH=sha512:6f6193eab28a9df487e912ebaa0a43453a01a66cf4c3cae4a2743ee27d89c6aad8add42735bc81123b10518c5723c0bc403ea35498a1371e2a6d680108855992
WEB_SITE=http://web.mit.edu/kerberos/www/
ENTERED=20020215

LICENSE[0]=http://web.mit.edu/kerberos/www/krb5-1.6/krb5-1.6/doc/krb5-install.html#Copyright
diff --git a/crypto/krb5/HISTORY b/crypto/krb5/HISTORY
index 74aac0f..6c95444 100644
--- a/crypto/krb5/HISTORY
+++ b/crypto/krb5/HISTORY
@@ -1,3 +1,7 @@
+2007-04-24 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 1.6.1
+ * BUILD, 2007-00[123]-patch.txt: removed patches
+
2007-04-04 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: SECURITY_PATCH=3
* BUILD, 2007-00[123]-patch.txt: added security patches



  • [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (7865b978f85dc5cf0cfd8b2bed758d4699938602), Ladislav Hagara, 04/23/2007

Archive powered by MHonArc 2.6.24.

Top of Page