diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2005-12-15 20:38:24 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 13:47:26 -0500 |
| commit | fbf106f6701c580f5839da575996de34fc953e1f (patch) | |
| tree | 3691623409aab4ff0ede4b50cc4fcbfa255814f3 | |
| parent | d8966dcd7e88df9817c81434056628c0beff21e3 (diff) | |
| download | samba-fbf106f6701c580f5839da575996de34fc953e1f.tar.gz samba-fbf106f6701c580f5839da575996de34fc953e1f.tar.bz2 samba-fbf106f6701c580f5839da575996de34fc953e1f.zip | |
r12269: Update to current lorikeet-heimdal. This changed the way the hdb
interface worked, so hdb-ldb.c and the glue have been updated.
Andrew Bartlett
(This used to be commit 8fd5224c6b5c17c3a2c04c7366b7e367012db77e)
32 files changed, 949 insertions, 742 deletions
diff --git a/source4/heimdal/kdc/524.c b/source4/heimdal/kdc/524.c index 497539b2e0..1642975616 100644 --- a/source4/heimdal/kdc/524.c +++ b/source4/heimdal/kdc/524.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kdc_locl.h" -RCSID("$Id: 524.c,v 1.34 2005/06/30 01:47:35 lha Exp $"); +RCSID("$Id: 524.c,v 1.35 2005/12/13 19:42:37 lha Exp $"); #include <krb5-v4compat.h> @@ -47,7 +47,7 @@ fetch_server (krb5_context context, krb5_kdc_configuration *config, const Ticket *t, char **spn, - hdb_entry **server, + hdb_entry_ex **server, const char *from) { krb5_error_code ret; @@ -221,7 +221,7 @@ static krb5_error_code encode_524_response(krb5_context context, krb5_kdc_configuration *config, const char *spn, const EncTicketPart et, - const Ticket *t, hdb_entry *server, + const Ticket *t, hdb_entry_ex *server, EncryptedData *ticket, int *kvno) { krb5_error_code ret; @@ -274,7 +274,7 @@ encode_524_response(krb5_context context, "Failed to encrypt v4 ticket (%s)", spn); return ret; } - *kvno = server->kvno; + *kvno = server->entry.kvno; } return 0; @@ -293,7 +293,7 @@ _kdc_do_524(krb5_context context, { krb5_error_code ret = 0; krb5_crypto crypto; - hdb_entry *server = NULL; + hdb_entry_ex *server = NULL; Key *skey; krb5_data et_data; EncTicketPart et; @@ -316,7 +316,7 @@ _kdc_do_524(krb5_context context, goto out; } - ret = hdb_enctype2key(context, server, t->enc_part.etype, &skey); + ret = hdb_enctype2key(context, &server->entry, t->enc_part.etype, &skey); if(ret){ kdc_log(context, config, 0, "No suitable key found for server (%s) from %s", spn, from); diff --git a/source4/heimdal/kdc/kaserver.c b/source4/heimdal/kdc/kaserver.c index 4a9bd87cb6..069af21660 100644 --- a/source4/heimdal/kdc/kaserver.c +++ b/source4/heimdal/kdc/kaserver.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kdc_locl.h" -RCSID("$Id: kaserver.c,v 1.30 2005/06/30 01:49:39 lha Exp $"); +RCSID("$Id: kaserver.c,v 1.31 2005/12/13 19:44:27 lha Exp $"); #include <krb5-v4compat.h> #include <rx.h> @@ -404,8 +404,8 @@ do_authenticate (krb5_context context, time_t end_time; krb5_data request; int32_t max_seq_len; - hdb_entry *client_entry = NULL; - hdb_entry *server_entry = NULL; + hdb_entry_ex *client_entry = NULL; + hdb_entry_ex *server_entry = NULL; Key *ckey = NULL; Key *skey = NULL; krb5_storage *reply_sp; @@ -453,8 +453,8 @@ do_authenticate (krb5_context context, } ret = _kdc_check_flags (context, config, - client_entry, client_name, - server_entry, server_name, + &client_entry->entry, client_name, + &server_entry->entry, server_name, TRUE); if (ret) { make_error_reply (hdr, KAPWEXPIRED, reply); @@ -516,17 +516,17 @@ do_authenticate (krb5_context context, time skew between client and server. Let's make sure it is postive */ if(max_life < 1) max_life = 1; - if (client_entry->max_life) - max_life = min(max_life, *client_entry->max_life); - if (server_entry->max_life) - max_life = min(max_life, *server_entry->max_life); + if (client_entry->entry.max_life) + max_life = min(max_life, *client_entry->entry.max_life); + if (server_entry->entry.max_life) + max_life = min(max_life, *server_entry->entry.max_life); life = krb_time_to_life(kdc_time, kdc_time + max_life); create_reply_ticket (context, hdr, skey, name, instance, config->v4_realm, - addr, life, server_entry->kvno, + addr, life, server_entry->entry.kvno, max_seq_len, "krbtgt", config->v4_realm, chal + 1, "tgsT", @@ -618,9 +618,9 @@ do_getticket (krb5_context context, char *instance = NULL; krb5_data times; int32_t max_seq_len; - hdb_entry *server_entry = NULL; - hdb_entry *client_entry = NULL; - hdb_entry *krbtgt_entry = NULL; + hdb_entry_ex *server_entry = NULL; + hdb_entry_ex *client_entry = NULL; + hdb_entry_ex *krbtgt_entry = NULL; Key *kkey = NULL; Key *skey = NULL; DES_cblock key; @@ -752,8 +752,8 @@ do_getticket (krb5_context context, } ret = _kdc_check_flags (context, config, - client_entry, client_name, - server_entry, server_name, + &client_entry->entry, client_name, + &server_entry->entry, server_name, FALSE); if (ret) { make_error_reply (hdr, KAPWEXPIRED, reply); @@ -789,21 +789,21 @@ do_getticket (krb5_context context, time skew between client and server. Let's make sure it is postive */ if(max_life < 1) max_life = 1; - if (krbtgt_entry->max_life) - max_life = min(max_life, *krbtgt_entry->max_life); - if (server_entry->max_life) - max_life = min(max_life, *server_entry->max_life); + if (krbtgt_entry->entry.max_life) + max_life = min(max_life, *krbtgt_entry->entry.max_life); + if (server_entry->entry.max_life) + max_life = min(max_life, *server_entry->entry.max_life); /* if this is a cross realm request, the client_entry will likely be NULL */ - if (client_entry && client_entry->max_life) - max_life = min(max_life, *client_entry->max_life); + if (client_entry && client_entry->entry.max_life) + max_life = min(max_life, *client_entry->entry.max_life); life = _krb5_krb_time_to_life(kdc_time, kdc_time + max_life); create_reply_ticket (context, hdr, skey, ad.pname, ad.pinst, ad.prealm, - addr, life, server_entry->kvno, + addr, life, server_entry->entry.kvno, max_seq_len, name, instance, 0, "gtkt", diff --git a/source4/heimdal/kdc/kdc-private.h b/source4/heimdal/kdc/kdc-private.h new file mode 100644 index 0000000000..cfb76fd7b0 --- /dev/null +++ b/source4/heimdal/kdc/kdc-private.h @@ -0,0 +1,151 @@ +/* This is a generated file */ +#ifndef __kdc_private_h__ +#define __kdc_private_h__ + +#include <stdarg.h> + +krb5_error_code +_kdc_as_rep ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + KDC_REQ */*req*/, + const krb5_data */*req_buffer*/, + krb5_data */*reply*/, + const char */*from*/, + struct sockaddr */*from_addr*/); + +krb5_error_code +_kdc_check_flags ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + hdb_entry */*client*/, + const char */*client_name*/, + hdb_entry */*server*/, + const char */*server_name*/, + krb5_boolean /*is_as_req*/); + +krb5_error_code +_kdc_db_fetch ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + krb5_principal /*principal*/, + enum hdb_ent_type, + hdb_entry_ex **/*h*/); + +krb5_error_code +_kdc_db_fetch4 ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + const char */*name*/, + const char */*instance*/, + const char */*realm*/, + enum hdb_ent_type /*ent_type*/, + hdb_entry_ex **/*ent*/); + +krb5_error_code +_kdc_do_524 ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + const Ticket */*t*/, + krb5_data */*reply*/, + const char */*from*/, + struct sockaddr */*addr*/); + +krb5_error_code +_kdc_do_kaserver ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + unsigned char */*buf*/, + size_t /*len*/, + krb5_data */*reply*/, + const char */*from*/, + struct sockaddr_in */*addr*/); + +krb5_error_code +_kdc_do_version4 ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + unsigned char */*buf*/, + size_t /*len*/, + krb5_data */*reply*/, + const char */*from*/, + struct sockaddr_in */*addr*/); + +krb5_error_code +_kdc_encode_v4_ticket ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + void */*buf*/, + size_t /*len*/, + const EncTicketPart */*et*/, + const PrincipalName */*service*/, + size_t */*size*/); + +void +_kdc_free_ent ( + krb5_context /*context*/, + hdb_entry_ex */*ent*/); + +krb5_error_code +_kdc_get_des_key ( + krb5_context /*context*/, + hdb_entry_ex */*principal*/, + krb5_boolean /*is_server*/, + krb5_boolean /*prefer_afs_key*/, + Key **/*ret_key*/); + +int +_kdc_maybe_version4 ( + unsigned char */*buf*/, + int /*len*/); + +krb5_error_code +_kdc_pk_check_client ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + krb5_principal /*client_princ*/, + const hdb_entry */*client*/, + pk_client_params */*client_params*/, + char **/*subject_name*/); + +void +_kdc_pk_free_client_param ( + krb5_context /*context*/, + pk_client_params */*client_params*/); + +krb5_error_code +_kdc_pk_initialize ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + const char */*user_id*/, + const char */*x509_anchors*/); + +krb5_error_code +_kdc_pk_mk_pa_reply ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + pk_client_params */*client_params*/, + const hdb_entry */*client*/, + const KDC_REQ */*req*/, + const krb5_data */*req_buffer*/, + krb5_keyblock **/*reply_key*/, + METHOD_DATA */*md*/); + +krb5_error_code +_kdc_pk_rd_padata ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + KDC_REQ */*req*/, + PA_DATA */*pa*/, + pk_client_params **/*ret_params*/); + +krb5_error_code +_kdc_tgs_rep ( + krb5_context /*context*/, + krb5_kdc_configuration */*config*/, + KDC_REQ */*req*/, + krb5_data */*data*/, + const char */*from*/, + struct sockaddr */*from_addr*/); + +#endif /* __kdc_private_h__ */ diff --git a/source4/heimdal/kdc/kdc_locl.h b/source4/heimdal/kdc/kdc_locl.h index 8658d33b68..58cf1f4173 100644 --- a/source4/heimdal/kdc/kdc_locl.h +++ b/source4/heimdal/kdc/kdc_locl.h @@ -32,7 +32,7 @@ */ /* - * $Id: kdc_locl.h,v 1.73 2005/08/15 11:07:25 lha Exp $ + * $Id: kdc_locl.h,v 1.74 2005/12/12 12:23:33 lha Exp $ */ #ifndef __KDC_LOCL_H__ @@ -41,6 +41,9 @@ #include "headers.h" #include "kdc.h" +typedef struct pk_client_params pk_client_params; +#include <kdc-private.h> + extern sig_atomic_t exit_flag; extern size_t max_request; extern const char *port_str; @@ -68,20 +71,13 @@ krb5_kdc_configuration * configure(krb5_context context, int argc, char **argv); krb5_error_code -_kdc_db_fetch(krb5_context, krb5_kdc_configuration *, - krb5_principal, enum hdb_ent_type, hdb_entry **); - -krb5_error_code -_kdc_db_fetch_ex(krb5_context context, - krb5_kdc_configuration *config, - krb5_principal principal, enum hdb_ent_type ent_type, - hdb_entry_ex **h); - -void -_kdc_free_ent(krb5_context context, hdb_entry *); +_kdc_db_fetch(krb5_context context, + krb5_kdc_configuration *config, + krb5_principal principal, enum hdb_ent_type ent_type, + hdb_entry_ex **h); void -_kdc_free_ent_ex(krb5_context context, hdb_entry_ex *ent); +_kdc_free_ent(krb5_context context, hdb_entry_ex *ent); void loop(krb5_context context, krb5_kdc_configuration *config); @@ -99,7 +95,7 @@ _kdc_check_flags(krb5_context context, krb5_boolean is_as_req); krb5_error_code -_kdc_get_des_key(krb5_context context, hdb_entry*, +_kdc_get_des_key(krb5_context context, hdb_entry_ex*, krb5_boolean, krb5_boolean, Key**); krb5_error_code @@ -145,7 +141,7 @@ void _kdc_pk_free_client_param(krb5_context, pk_client_params *); krb5_error_code _kdc_db_fetch4 (krb5_context context, krb5_kdc_configuration *config, - const char*, const char*, const char*, enum hdb_ent_type, hdb_entry**); + const char*, const char*, const char*, enum hdb_ent_type, hdb_entry_ex**); krb5_error_code _kdc_do_version4 (krb5_context context, diff --git a/source4/heimdal/kdc/kerberos4.c b/source4/heimdal/kdc/kerberos4.c index a81fbb7b59..72ea41d9e6 100644 --- a/source4/heimdal/kdc/kerberos4.c +++ b/source4/heimdal/kdc/kerberos4.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -35,7 +35,7 @@ #include <krb5-v4compat.h> -RCSID("$Id: kerberos4.c,v 1.54 2005/06/30 01:51:43 lha Exp $"); +RCSID("$Id: kerberos4.c,v 1.56 2005/12/13 19:44:01 lha Exp $"); #ifndef swap32 static u_int32_t @@ -70,7 +70,7 @@ valid_princ(krb5_context context, krb5_kdc_configuration *config = funcctx; krb5_error_code ret; char *s; - hdb_entry *ent; + hdb_entry_ex *ent; ret = krb5_unparse_name(context, princ, &s); if (ret) @@ -93,7 +93,7 @@ _kdc_db_fetch4(krb5_context context, krb5_kdc_configuration *config, const char *name, const char *instance, const char *realm, enum hdb_ent_type ent_type, - hdb_entry **ent) + hdb_entry_ex **ent) { krb5_principal p; krb5_error_code ret; @@ -126,7 +126,7 @@ _kdc_do_version4(krb5_context context, { krb5_storage *sp; krb5_error_code ret; - hdb_entry *client = NULL, *server = NULL; + hdb_entry_ex *client = NULL, *server = NULL; Key *ckey, *skey; int8_t pvno; int8_t msg_type; @@ -201,8 +201,8 @@ _kdc_do_version4(krb5_context context, } ret = _kdc_check_flags (context, config, - client, client_name, - server, server_name, + &client->entry, client_name, + &server->entry, server_name, TRUE); if (ret) { /* good error code? */ @@ -217,8 +217,8 @@ _kdc_do_version4(krb5_context context, */ if (config->require_preauth - || client->flags.require_preauth - || server->flags.require_preauth) { + || client->entry.flags.require_preauth + || server->entry.flags.require_preauth) { kdc_log(context, config, 0, "Pre-authentication required for v4-request: " "%s for %s", @@ -240,7 +240,7 @@ _kdc_do_version4(krb5_context context, /* this is not necessary with the new code in libkrb */ /* find a properly salted key */ while(ckey->salt == NULL || ckey->salt->salt.length != 0) - ret = hdb_next_keytype2key(context, client, KEYTYPE_DES, &ckey); + ret = hdb_next_keytype2key(context, &client->entry, KEYTYPE_DES, &ckey); if(ret){ kdc_log(context, config, 0, "No version-4 salted key in database -- %s.%s@%s", name, inst, realm); @@ -260,10 +260,10 @@ _kdc_do_version4(krb5_context context, } max_life = _krb5_krb_life_to_time(0, life); - if(client->max_life) - max_life = min(max_life, *client->max_life); - if(server->max_life) - max_life = min(max_life, *server->max_life); + if(client->entry.max_life) + max_life = min(max_life, *client->entry.max_life); + if(server->entry.max_life) + max_life = min(max_life, *server->entry.max_life); life = krb_time_to_life(kdc_time, kdc_time + max_life); @@ -302,7 +302,7 @@ _kdc_do_version4(krb5_context context, sinst, config->v4_realm, life, - server->kvno % 255, + server->entry.kvno % 255, &ticket, kdc_time, &ckey->key, @@ -321,8 +321,8 @@ _kdc_do_version4(krb5_context context, realm, req_time, 0, - client->pw_end ? *client->pw_end : 0, - client->kvno % 256, + client->entry.pw_end ? *client->entry.pw_end : 0, + client->entry.kvno % 256, &cipher, reply); krb5_data_free(&cipher); @@ -339,7 +339,7 @@ _kdc_do_version4(krb5_context context, int32_t address; size_t pos; krb5_principal tgt_princ = NULL; - hdb_entry *tgt = NULL; + hdb_entry_ex *tgt = NULL; Key *tkey; time_t max_end, actual_end, issue_time; @@ -373,10 +373,10 @@ _kdc_do_version4(krb5_context context, goto out2; } - if(tgt->kvno % 256 != kvno){ + if(tgt->entry.kvno % 256 != kvno){ kdc_log(context, config, 0, "tgs-req (krb4) with old kvno %d (current %d) for " - "krbtgt.%s@%s", kvno, tgt->kvno % 256, + "krbtgt.%s@%s", kvno, tgt->entry.kvno % 256, realm, config->v4_realm); make_err_reply(context, reply, KDC_AUTH_EXP, "old krbtgt kvno used"); @@ -489,8 +489,8 @@ _kdc_do_version4(krb5_context context, } ret = _kdc_check_flags (context, config, - client, client_name, - server, server_name, + &client->entry, client_name, + &server->entry, server_name, FALSE); if (ret) { /* good error code? */ @@ -511,10 +511,10 @@ _kdc_do_version4(krb5_context context, max_end = _krb5_krb_life_to_time(ad.time_sec, ad.life); max_end = min(max_end, _krb5_krb_life_to_time(kdc_time, life)); - if(server->max_life) - max_end = min(max_end, kdc_time + *server->max_life); - if(client && client->max_life) - max_end = min(max_end, kdc_time + *client->max_life); + if(server->entry.max_life) + max_end = min(max_end, kdc_time + *server->entry.max_life); + if(client && client->entry.max_life) + max_end = min(max_end, kdc_time + *client->entry.max_life); life = min(life, krb_time_to_life(kdc_time, max_end)); issue_time = kdc_time; @@ -571,7 +571,7 @@ _kdc_do_version4(krb5_context context, sinst, config->v4_realm, life, - server->kvno % 255, + server->entry.kvno % 255, &ticket, issue_time, &ad.session, @@ -721,7 +721,7 @@ _kdc_encode_v4_ticket(krb5_context context, krb5_error_code _kdc_get_des_key(krb5_context context, - hdb_entry *principal, krb5_boolean is_server, + hdb_entry_ex *principal, krb5_boolean is_server, krb5_boolean prefer_afs_key, Key **ret_key) { Key *v5_key = NULL, *v4_key = NULL, *afs_key = NULL, *server_key = NULL; @@ -736,7 +736,7 @@ _kdc_get_des_key(krb5_context context, afs_key == NULL || server_key == NULL); ++i) { Key *key = NULL; - while(hdb_next_enctype2key(context, principal, etypes[i], &key) == 0) { + while(hdb_next_enctype2key(context, &principal->entry, etypes[i], &key) == 0) { if(key->salt == NULL) { if(v5_key == NULL) v5_key = key; diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c index 6f6203a92c..a0136ba425 100644 --- a/source4/heimdal/kdc/kerberos5.c +++ b/source4/heimdal/kdc/kerberos5.c @@ -33,7 +33,7 @@ #include "kdc_locl.h" -RCSID("$Id: kerberos5.c,v 1.198 2005/11/28 20:33:57 lha Exp $"); +RCSID("$Id: kerberos5.c,v 1.201 2005/12/14 12:17:58 lha Exp $"); #define MAX_TIME ((time_t)((1U << 31) - 1)) @@ -88,7 +88,7 @@ find_padata(KDC_REQ *req, int *start, int type) */ static krb5_error_code -find_etype(krb5_context context, hdb_entry *princ, +find_etype(krb5_context context, const hdb_entry_ex *princ, krb5_enctype *etypes, unsigned len, Key **ret_key, krb5_enctype *ret_etype) { @@ -101,7 +101,7 @@ find_etype(krb5_context context, hdb_entry *princ, if (krb5_enctype_valid(context, etypes[i]) != 0) continue; - while (hdb_next_enctype2key(context, princ, etypes[i], &key) == 0) { + while (hdb_next_enctype2key(context, &princ->entry, etypes[i], &key) == 0) { if (key->key.keyvalue.length == 0) { ret = KRB5KDC_ERR_NULL_KEY; continue; @@ -119,8 +119,8 @@ find_etype(krb5_context context, hdb_entry *princ, static krb5_error_code find_keys(krb5_context context, krb5_kdc_configuration *config, - hdb_entry *client, - hdb_entry *server, + const hdb_entry_ex *client, + const hdb_entry_ex *server, Key **ckey, krb5_enctype *cetype, Key **skey, @@ -136,7 +136,7 @@ find_keys(krb5_context context, /* find client key */ ret = find_etype(context, client, etypes, num_etypes, ckey, cetype); if (ret) { - if (krb5_unparse_name(context, client->principal, &name) != 0) + if (krb5_unparse_name(context, client->entry.principal, &name) != 0) name = unparse_name; kdc_log(context, config, 0, "Client (%s) has no support for etypes", name); @@ -150,7 +150,7 @@ find_keys(krb5_context context, /* find server key */ ret = find_etype(context, server, etypes, num_etypes, skey, setype); if (ret) { - if (krb5_unparse_name(context, server->principal, &name) != 0) + if (krb5_unparse_name(context, server->entry.principal, &name) != 0) name = unparse_name; kdc_log(context, config, 0, "Server (%s) has no support for etypes", name); @@ -805,7 +805,7 @@ _kdc_as_rep(krb5_context context, AS_REP rep; KDCOptions f = b->kdc_options; hdb_entry_ex *client = NULL; - hdb_entry *server = NULL; + hdb_entry_ex *server = NULL; krb5_enctype cetype, setype; EncTicketPart et; EncKDCRepPart ek; @@ -851,7 +851,7 @@ _kdc_as_rep(krb5_context context, kdc_log(context, config, 0, "AS-REQ %s from %s for %s", client_name, from, server_name); - ret = _kdc_db_fetch_ex(context, config, client_princ, HDB_ENT_TYPE_CLIENT, &client); + ret = _kdc_db_fetch(context, config, client_princ, HDB_ENT_TYPE_CLIENT, &client); if(ret){ kdc_log(context, config, 0, "UNKNOWN -- %s: %s", client_name, krb5_get_err_text(context, ret)); @@ -869,7 +869,7 @@ _kdc_as_rep(krb5_context context, ret = _kdc_check_flags(context, config, &client->entry, client_name, - server, server_name, + &server->entry, server_name, TRUE); if(ret) goto out; @@ -920,7 +920,7 @@ _kdc_as_rep(krb5_context context, ret = _kdc_pk_check_client(context, config, client_princ, - &client->entry, + client, pkp, &client_cert); if (ret) { @@ -969,7 +969,8 @@ _kdc_as_rep(krb5_context context, goto out; } - ret = hdb_enctype2key(context, &client->entry, enc_data.etype, &pa_key); + ret = hdb_enctype2key(context, &client->entry, + enc_data.etype, &pa_key); if(ret){ char *estr; e_text = "No key matches pa-data"; @@ -1076,7 +1077,7 @@ _kdc_as_rep(krb5_context context, } }else if (config->require_preauth || client->entry.flags.require_preauth - || server->flags.require_preauth) { + || server->entry.flags.require_preauth) { METHOD_DATA method_data; PA_DATA *pa; unsigned char *buf; @@ -1110,11 +1111,12 @@ _kdc_as_rep(krb5_context context, */ /* XXX check ret */ if (only_older_enctype_p(req)) - ret = get_pa_etype_info(context, config, &method_data, &client->entry, + ret = get_pa_etype_info(context, config, + &method_data, &client->entry, b->etype.val, b->etype.len); /* XXX check ret */ - ret = get_pa_etype_info2(context, config, &method_data, &client->entry, - b->etype.val, b->etype.len); + ret = get_pa_etype_info2(context, config, &method_data, + &client->entry, b->etype.val, b->etype.len); ASN1_MALLOC_ENCODE(METHOD_DATA, buf, len, &method_data, &len, ret); @@ -1141,7 +1143,7 @@ _kdc_as_rep(krb5_context context, } ret = find_keys(context, config, - &client->entry, server, &ckey, &cetype, &skey, &setype, + client, server, &ckey, &cetype, &skey, &setype, b->etype.val, b->etype.len); if(ret) { kdc_log(context, config, 0, "Server/client has no support for etypes"); @@ -1213,12 +1215,12 @@ _kdc_as_rep(krb5_context context, _krb5_principal2principalname(&rep.cname, client->entry.principal); rep.ticket.tkt_vno = 5; - copy_Realm(&server->principal->realm, &rep.ticket.realm); + copy_Realm(&server->entry.principal->realm, &rep.ticket.realm); _krb5_principal2principalname(&rep.ticket.sname, - server->principal); + server->entry.principal); et.flags.initial = 1; - if(client->entry.flags.forwardable && server->flags.forwardable) + if(client->entry.flags.forwardable && server->entry.flags.forwardable) et.flags.forwardable = f.forwardable; else if (f.forwardable) { ret = KRB5KDC_ERR_POLICY; @@ -1226,7 +1228,7 @@ _kdc_as_rep(krb5_context context, "Ticket may not be forwardable -- %s", client_name); goto out; } - if(client->entry.flags.proxiable && server->flags.proxiable) + if(client->entry.flags.proxiable && server->entry.flags.proxiable) et.flags.proxiable = f.proxiable; else if (f.proxiable) { ret = KRB5KDC_ERR_POLICY; @@ -1234,7 +1236,7 @@ _kdc_as_rep(krb5_context context, "Ticket may not be proxiable -- %s", client_name); goto out; } - if(client->entry.flags.postdate && server->flags.postdate) + if(client->entry.flags.postdate && server->entry.flags.postdate) et.flags.may_postdate = f.allow_postdate; else if (f.allow_postdate){ ret = KRB5KDC_ERR_POLICY; @@ -1274,8 +1276,8 @@ _kdc_as_rep(krb5_context context, if(client->entry.max_life) t = start + min(t - start, *client->entry.max_life); - if(server->max_life) - t = start + min(t - start, *server->max_life); + if(server->entry.max_life) + t = start + min(t - start, *server->entry.max_life); #if 0 t = min(t, start + realm->max_life); #endif @@ -1295,8 +1297,8 @@ _kdc_as_rep(krb5_context context, t = MAX_TIME; if(client->entry.max_renew) t = start + min(t - start, *client->entry.max_renew); - if(server->max_renew) - t = start + min(t - start, *server->max_renew); + if(server->entry.max_renew) + t = start + min(t - start, *server->entry.max_renew); #if 0 t = min(t, start + realm->max_renew); #endif @@ -1352,7 +1354,8 @@ _kdc_as_rep(krb5_context context, ALLOC(ek.key_expiration); if (client->entry.valid_end) { if (client->entry.pw_end) - *ek.key_expiration = min(*client->entry.valid_end, *client->entry.pw_end); + *ek.key_expiration = min(*client->entry.valid_end, + *client->entry.pw_end); else *ek.key_expiration = *client->entry.valid_end; } else @@ -1415,7 +1418,7 @@ _kdc_as_rep(krb5_context context, et.endtime, et.renew_till); ret = encode_reply(context, config, - &rep, &et, &ek, setype, server->kvno, &skey->key, + &rep, &et, &ek, setype, server->entry.kvno, &skey->key, client->entry.kvno, reply_key, &e_text, reply); free_EncTicketPart(&et); free_EncKDCRepPart(&ek); @@ -1445,7 +1448,7 @@ _kdc_as_rep(krb5_context context, krb5_free_principal(context, server_princ); free(server_name); if(client) - _kdc_free_ent_ex(context, client); + _kdc_free_ent(context, client); if(server) _kdc_free_ent(context, server); return ret; @@ -1697,9 +1700,9 @@ tgs_make_reply(krb5_context context, AuthorizationData *auth_data, krb5_ticket *tgs_ticket, hdb_entry_ex *server, - hdb_entry *client, + hdb_entry_ex *client, krb5_principal client_principal, - hdb_entry *krbtgt, + hdb_entry_ex *krbtgt, EncryptionKey *tgtkey, krb5_enctype cetype, const char **e_text, @@ -1717,21 +1720,18 @@ tgs_make_reply(krb5_context context, if(adtkt) { int i; - krb5_keytype kt; ekey = &adtkt->key; - for(i = 0; i < b->etype.len; i++){ - ret = krb5_enctype_to_keytype(context, b->etype.val[i], &kt); - if(ret) - continue; - if(adtkt->key.keytype == kt) + for(i = 0; i < b->etype.len; i++) + if (b->etype.val[i] == adtkt->key.keytype) break; - } - if(i == b->etype.len) + if(i == b->etype.len) { + krb5_clear_error_string(context); return KRB5KDC_ERR_ETYPE_NOSUPP; + } etype = b->etype.val[i]; }else{ ret = find_keys(context, config, - NULL, &server->entry, NULL, NULL, &skey, &etype, + NULL, server, NULL, NULL, &skey, &etype, b->etype.val, b->etype.len); if(ret) { kdc_log(context, config, 0, "Server has no support for etypes"); @@ -1786,7 +1786,7 @@ tgs_make_reply(krb5_context context, &tgt->transited, &et, *krb5_princ_realm(context, client_principal), *krb5_princ_realm(context, server->entry.principal), - *krb5_princ_realm(context, krbtgt->principal)); + *krb5_princ_realm(context, krbtgt->entry.principal)); if(ret) goto out; @@ -1807,8 +1807,8 @@ tgs_make_reply(krb5_context context, { time_t life; life = et.endtime - *et.starttime; - if(client && client->max_life) - life = min(life, *client->max_life); + if(client && client->entry.max_life) + life = min(life, *client->entry.max_life); if(server->entry.max_life) life = min(life, *server->entry.max_life); et.endtime = *et.starttime + life; @@ -1822,8 +1822,8 @@ tgs_make_reply(krb5_context context, if(et.renew_till){ time_t renew; renew = *et.renew_till - et.authtime; - if(client && client->max_renew) - renew = min(renew, *client->max_renew); + if(client && client->entry.max_renew) + renew = min(renew, *client->entry.max_renew); if(server->entry.max_renew) renew = min(renew, *server->entry.max_renew); *et.renew_till = et.authtime + renew; @@ -1902,8 +1902,8 @@ tgs_make_reply(krb5_context context, etype list, even if we don't want a session key with DES3? */ ret = encode_reply(context, config, - &rep, &et, &ek, etype, adtkt ? 0 : server->entry.kvno, ekey, - 0, &tgt->key, e_text, reply); + &rep, &et, &ek, etype, adtkt ? 0 : server->entry.kvno, + ekey, 0, &tgt->key, e_text, reply); out: free_TGS_REP(&rep); free_TransitedEncoding(&et.transited); @@ -2053,7 +2053,7 @@ tgs_rep2(krb5_context context, const char *e_text = NULL; krb5_crypto crypto; - hdb_entry *krbtgt = NULL; + hdb_entry_ex *krbtgt = NULL; EncTicketPart *tgt; Key *tkey; krb5_enctype cetype; @@ -2101,7 +2101,7 @@ tgs_rep2(krb5_context context, } if(ap_req.ticket.enc_part.kvno && - *ap_req.ticket.enc_part.kvno != krbtgt->kvno){ + *ap_req.ticket.enc_part.kvno != krbtgt->entry.kvno){ char *p; ret = krb5_unparse_name (context, princ, &p); @@ -2111,7 +2111,7 @@ tgs_rep2(krb5_context context, kdc_log(context, config, 0, "Ticket kvno = %d, DB kvno = %d (%s)", *ap_req.ticket.enc_part.kvno, - krbtgt->kvno, + krbtgt->entry.kvno, p); if (ret == 0) free (p); @@ -2119,13 +2119,16 @@ tgs_rep2(krb5_context context, goto out2; } - ret = hdb_enctype2key(context, krbtgt, ap_req.ticket.enc_part.etype, &tkey); + ret = hdb_enctype2key(context, &krbtgt->entry, + ap_req.ticket.enc_part.etype, &tkey); if(ret){ - char *str; + char *str, *p; krb5_enctype_to_string(context, ap_req.ticket.enc_part.etype, &str); + krb5_unparse_name(context, princ, &p); kdc_log(context, config, 0, - "No server key found for %s", str); + "No server key with enctype %s found for %s", str, p); free(str); + free(p); ret = KRB5KRB_AP_ERR_BADKEYVER; goto out2; } @@ -2252,8 +2255,7 @@ tgs_rep2(krb5_context context, PrincipalName *s; Realm r; char *spn = NULL, *cpn = NULL; - hdb_entry_ex *server = NULL; - hdb_entry *client = NULL; + hdb_entry_ex *server = NULL, *client = NULL; int nloop = 0; EncTicketPart adtkt; char opt_str[128]; @@ -2262,7 +2264,7 @@ tgs_rep2(krb5_context context, r = b->realm; if(b->kdc_options.enc_tkt_in_skey){ Ticket *t; - hdb_entry *uu; + hdb_entry_ex *uu; krb5_principal p; Key *uukey; @@ -2288,13 +2290,15 @@ tgs_rep2(krb5_context context, ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; goto out; } - ret = hdb_enctype2key(context, uu, t->enc_part.etype, &uukey); + ret = hdb_enctype2key(context, &uu->entry, + t->enc_part.etype, &uukey); if(ret){ + _kdc_free_ent(context, uu); ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */ goto out; } ret = krb5_decrypt_ticket(context, t, &uukey->key, &adtkt, 0); - + _kdc_free_ent(context, uu); if(ret) goto out; s = &adtkt.cname; @@ -2320,7 +2324,7 @@ tgs_rep2(krb5_context context, kdc_log(context, config, 0, "TGS-REQ %s from %s for %s", cpn, from, spn); server_lookup: - ret = _kdc_db_fetch_ex(context, config, sp, HDB_ENT_TYPE_SERVER, &server); + ret = _kdc_db_fetch(context, config, sp, HDB_ENT_TYPE_SERVER, &server); if(ret){ const char *new_rlm; @@ -2386,9 +2390,9 @@ tgs_rep2(krb5_context context, #endif if(strcmp(krb5_principal_get_realm(context, sp), - krb5_principal_get_comp_string(context, krbtgt->principal, 1)) != 0) { + krb5_principal_get_comp_string(context, krbtgt->entry.principal, 1)) != 0) { char *tpn; - ret = krb5_unparse_name(context, krbtgt->principal, &tpn); + ret = krb5_unparse_name(context, krbtgt->entry.principal, &tpn); kdc_log(context, config, 0, "Request with wrong krbtgt: %s", (ret == 0) ? tpn : "<unknown>"); @@ -2400,7 +2404,7 @@ tgs_rep2(krb5_context context, } ret = _kdc_check_flags(context, config, - client, cpn, + &client->entry, cpn, &server->entry, spn, FALSE); if(ret) @@ -2408,7 +2412,7 @@ tgs_rep2(krb5_context context, if((b->kdc_options.validate || b->kdc_options.renew) && !krb5_principal_compare(context, - krbtgt->principal, + krbtgt->entry.principal, server->entry.principal)){ kdc_log(context, config, 0, "Inconsistent request."); ret = KRB5KDC_ERR_SERVER_NOMATCH; @@ -2422,7 +2426,8 @@ tgs_rep2(krb5_context context, goto out; } - ret = tgs_make_reply(context, config, + ret = tgs_make_reply(context, + config, b, tgt, b->kdc_options.enc_tkt_in_skey ? &adtkt : NULL, @@ -2442,7 +2447,7 @@ tgs_rep2(krb5_context context, free(cpn); if(server) - _kdc_free_ent_ex(context, server); + _kdc_free_ent(context, server); if(client) _kdc_free_ent(context, client); } diff --git a/source4/heimdal/kdc/misc.c b/source4/heimdal/kdc/misc.c index b14bb50ea5..3027d32cfc 100644 --- a/source4/heimdal/kdc/misc.c +++ b/source4/heimdal/kdc/misc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kdc_locl.h" -RCSID("$Id: misc.c,v 1.25 2005/06/30 01:53:48 lha Exp $"); +RCSID("$Id: misc.c,v 1.26 2005/12/12 12:37:31 lha Exp $"); struct timeval _kdc_now; @@ -41,16 +41,15 @@ krb5_error_code _kdc_db_fetch(krb5_context context, krb5_kdc_configuration *config, krb5_principal principal, enum hdb_ent_type ent_type, - hdb_entry **h) + hdb_entry_ex **h) { - hdb_entry *ent; + hdb_entry_ex *ent; krb5_error_code ret = HDB_ERR_NOENTRY; int i; ent = malloc (sizeof (*ent)); if (ent == NULL) return ENOMEM; - ent->principal = principal; for(i = 0; i < config->num_db; i++) { ret = config->db[i]->hdb_open(context, config->db[i], O_RDONLY, 0); @@ -76,65 +75,9 @@ _kdc_db_fetch(krb5_context context, } void -_kdc_free_ent(krb5_context context, hdb_entry *ent) +_kdc_free_ent(krb5_context context, hdb_entry_ex *ent) { hdb_free_entry (context, ent); free (ent); } -krb5_error_code -_kdc_db_fetch_ex(krb5_context context, - krb5_kdc_configuration *config, - krb5_principal principal, enum hdb_ent_type ent_type, - hdb_entry_ex **h) -{ - hdb_entry_ex *ent; - krb5_error_code ret = HDB_ERR_NOENTRY; - int i; - - ent = malloc (sizeof (*ent)); - if (ent == NULL) - return ENOMEM; - memset(ent, '\0', sizeof(*ent)); - - ent->entry.principal = principal; - - for(i = 0; i < config->num_db; i++) { - ret = config->db[i]->hdb_open(context, config->db[i], O_RDONLY, 0); - if (ret) { - kdc_log(context, config, 0, "Failed to open database: %s", - krb5_get_err_text(context, ret)); - continue; - } - if (config->db[i]->hdb_fetch_ex) { - ret = config->db[i]->hdb_fetch_ex(context, - config->db[i], - HDB_F_DECRYPT, - principal, - ent_type, - ent); - } else { - ret = config->db[i]->hdb_fetch(context, - config->db[i], - HDB_F_DECRYPT, - principal, - ent_type, - &ent->entry); - } - config->db[i]->hdb_close(context, config->db[i]); - if(ret == 0) { - *h = ent; - return 0; - } - } - free(ent); - return ret; -} - -void -_kdc_free_ent_ex(krb5_context context, hdb_entry_ex *ent) -{ - hdb_free_entry_ex (context, ent); - free (ent); -} - diff --git a/source4/heimdal/lib/asn1/gen.c b/source4/heimdal/lib/asn1/gen.c index aee1ee5b3f..921d2ebba6 100644 --- a/source4/heimdal/lib/asn1/gen.c +++ b/source4/heimdal/lib/asn1/gen.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$Id: gen.c,v 1.63 2005/08/23 10:49:16 lha Exp $"); +RCSID("$Id: gen.c,v 1.64 2005/12/06 19:59:13 lha Exp $"); FILE *headerfile, *codefile, *logfile; @@ -567,6 +567,7 @@ define_type (int level, const char *name, Type *t, int typedefp, int preservep) i.type = TInteger; i.range = ⦥ i.members = NULL; + i.constraint = NULL; space(level); if(ASN1_TAILQ_EMPTY(t->members)) @@ -640,6 +641,7 @@ define_type (int level, const char *name, Type *t, int typedefp, int preservep) i.type = TInteger; i.range = ⦥ i.members = NULL; + i.constraint = NULL; space(level); fprintf (headerfile, "struct %s {\n", typedefp ? name : ""); diff --git a/source4/heimdal/lib/asn1/parse.c b/source4/heimdal/lib/asn1/parse.c index 858a669da1..0bf3cdafdb 100644 --- a/source4/heimdal/lib/asn1/parse.c +++ b/source4/heimdal/lib/asn1/parse.c @@ -247,9 +247,10 @@ #include "gen_locl.h" #include "der.h" -RCSID("$Id: parse.y,v 1.25 2005/08/23 10:52:31 lha Exp $"); +RCSID("$Id: parse.y,v 1.27 2005/12/14 09:44:36 lha Exp $"); static Type *new_type (Typetype t); +static struct constraint_spec *new_constraint_spec(enum ctype); static Type *new_tag(int tagclass, int tagvalue, int tagenv, Type *oldtype); void yyerror (const char *); static struct objid *new_objid(const char *label, int value); @@ -277,7 +278,7 @@ struct string_list { #endif #if ! defined (YYSTYPE) && ! defined (YYSTYPE_IS_DECLARED) -#line 64 "parse.y" +#line 65 "parse.y" typedef union YYSTYPE { int constant; struct value *value; @@ -290,9 +291,10 @@ typedef union YYSTYPE { struct string_list *sl; struct tagtype tag; struct memhead *members; + struct constraint_spec *constraint_spec; } YYSTYPE; /* Line 190 of yacc.c. */ -#line 296 "parse.c" +#line 298 "parse.c" # define yystype YYSTYPE /* obsolescent; will be withdrawn */ # define YYSTYPE_IS_DECLARED 1 # define YYSTYPE_IS_TRIVIAL 1 @@ -304,7 +306,7 @@ typedef union YYSTYPE { /* Line 213 of yacc.c. */ -#line 308 "parse.c" +#line 310 "parse.c" #if ! defined (yyoverflow) || YYERROR_VERBOSE @@ -406,16 +408,16 @@ union yyalloc /* YYFINAL -- State number of the termination state. */ #define YYFINAL 4 /* YYLAST -- Last index in YYTABLE. */ -#define YYLAST 152 +#define YYLAST 168 /* YYNTOKENS -- Number of terminals. */ #define YYNTOKENS 98 /* YYNNTS -- Number of nonterminals. */ -#define YYNNTS 61 +#define YYNNTS 67 /* YYNRULES -- Number of rules. */ -#define YYNRULES 120 +#define YYNRULES 130 /* YYNRULES -- Number of states. */ -#define YYNSTATES 181 +#define YYNSTATES 201 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */ #define YYUNDEFTOK 2 @@ -473,15 +475,16 @@ static const unsigned short int yyprhs[] = 29, 30, 34, 35, 37, 38, 40, 43, 48, 50, 53, 55, 57, 61, 63, 67, 69, 71, 73, 75, 77, 79, 81, 83, 85, 87, 89, 91, 93, 95, - 97, 99, 101, 107, 109, 112, 117, 119, 123, 127, - 132, 137, 139, 142, 148, 151, 154, 156, 161, 165, - 169, 174, 178, 182, 187, 189, 191, 193, 195, 197, - 201, 206, 207, 209, 211, 213, 214, 216, 218, 223, - 225, 227, 229, 231, 233, 235, 237, 239, 243, 247, - 250, 252, 255, 259, 261, 265, 270, 272, 273, 277, - 278, 281, 286, 288, 290, 292, 294, 296, 298, 300, - 302, 304, 306, 308, 310, 312, 314, 316, 318, 320, - 322 + 97, 99, 101, 103, 109, 111, 114, 119, 121, 125, + 129, 134, 139, 141, 144, 150, 153, 156, 158, 163, + 167, 171, 176, 180, 184, 189, 191, 193, 195, 197, + 199, 202, 206, 208, 210, 212, 215, 219, 225, 230, + 234, 239, 240, 242, 244, 246, 247, 249, 251, 256, + 258, 260, 262, 264, 266, 268, 270, 272, 276, 280, + 283, 285, 288, 292, 294, 298, 303, 305, 306, 310, + 311, 314, 319, 321, 323, 325, 327, 329, 331, 333, + 335, 337, 339, 341, 343, 345, 347, 349, 351, 353, + 355 }; /* YYRHS -- A `-1'-separated list of the rules' RHS. */ @@ -491,53 +494,57 @@ static const short int yyrhs[] = 24, -1, 27, 70, -1, 38, 70, -1, 7, 70, -1, -1, 29, 39, -1, -1, 103, 107, -1, -1, 40, 104, 90, -1, -1, 105, -1, -1, 106, -1, - 105, 106, -1, 109, 32, 86, 144, -1, 108, -1, - 108, 107, -1, 110, -1, 136, -1, 86, 91, 109, + 105, 106, -1, 109, 32, 86, 150, -1, 108, -1, + 108, 107, -1, 110, -1, 142, -1, 86, 91, 109, -1, 86, -1, 86, 84, 111, -1, 112, -1, 129, - -1, 120, -1, 113, -1, 137, -1, 128, -1, 118, - -1, 115, -1, 123, -1, 121, -1, 122, -1, 124, - -1, 125, -1, 126, -1, 127, -1, 132, -1, 11, - -1, 92, 148, 83, 148, 93, -1, 43, -1, 43, - 114, -1, 43, 94, 116, 95, -1, 117, -1, 116, - 91, 117, -1, 116, 91, 85, -1, 86, 92, 156, - 93, -1, 25, 94, 119, 95, -1, 116, -1, 9, - 67, -1, 9, 67, 94, 142, 95, -1, 51, 37, - -1, 52, 67, -1, 49, -1, 64, 94, 139, 95, - -1, 64, 94, 95, -1, 64, 53, 111, -1, 65, - 94, 139, 95, -1, 65, 94, 95, -1, 65, 53, - 111, -1, 14, 94, 139, 95, -1, 130, -1, 131, - -1, 86, -1, 34, -1, 77, -1, 133, 135, 111, - -1, 96, 134, 89, 97, -1, -1, 76, -1, 6, - -1, 60, -1, -1, 27, -1, 38, -1, 86, 111, - 84, 148, -1, 138, -1, 33, -1, 78, -1, 61, - -1, 36, -1, 10, -1, 79, -1, 141, -1, 139, - 91, 141, -1, 139, 91, 85, -1, 86, 111, -1, - 140, -1, 140, 54, -1, 140, 20, 148, -1, 143, - -1, 142, 91, 143, -1, 86, 92, 89, 93, -1, - 145, -1, -1, 94, 146, 95, -1, -1, 147, 146, - -1, 86, 92, 89, 93, -1, 86, -1, 89, -1, - 149, -1, 150, -1, 154, -1, 153, -1, 155, -1, - 158, -1, 157, -1, 151, -1, 152, -1, 86, -1, - 88, -1, 71, -1, 31, -1, 156, -1, 89, -1, - 49, -1, 145, -1 + -1, 132, -1, 120, -1, 113, -1, 143, -1, 128, + -1, 118, -1, 115, -1, 123, -1, 121, -1, 122, + -1, 124, -1, 125, -1, 126, -1, 127, -1, 138, + -1, 11, -1, 92, 154, 83, 154, 93, -1, 43, + -1, 43, 114, -1, 43, 94, 116, 95, -1, 117, + -1, 116, 91, 117, -1, 116, 91, 85, -1, 86, + 92, 162, 93, -1, 25, 94, 119, 95, -1, 116, + -1, 9, 67, -1, 9, 67, 94, 148, 95, -1, + 51, 37, -1, 52, 67, -1, 49, -1, 64, 94, + 145, 95, -1, 64, 94, 95, -1, 64, 53, 111, + -1, 65, 94, 145, 95, -1, 65, 94, 95, -1, + 65, 53, 111, -1, 14, 94, 145, 95, -1, 130, + -1, 131, -1, 86, -1, 34, -1, 77, -1, 111, + 133, -1, 92, 134, 93, -1, 135, -1, 136, -1, + 137, -1, 19, 111, -1, 23, 12, 154, -1, 19, + 111, 23, 12, 154, -1, 18, 12, 94, 95, -1, + 139, 141, 111, -1, 96, 140, 89, 97, -1, -1, + 76, -1, 6, -1, 60, -1, -1, 27, -1, 38, + -1, 86, 111, 84, 154, -1, 144, -1, 33, -1, + 78, -1, 61, -1, 36, -1, 10, -1, 79, -1, + 147, -1, 145, 91, 147, -1, 145, 91, 85, -1, + 86, 111, -1, 146, -1, 146, 54, -1, 146, 20, + 154, -1, 149, -1, 148, 91, 149, -1, 86, 92, + 89, 93, -1, 151, -1, -1, 94, 152, 95, -1, + -1, 153, 152, -1, 86, 92, 89, 93, -1, 86, + -1, 89, -1, 155, -1, 156, -1, 160, -1, 159, + -1, 161, -1, 164, -1, 163, -1, 157, -1, 158, + -1, 86, -1, 88, -1, 71, -1, 31, -1, 162, + -1, 89, -1, 49, -1, 151, -1 }; /* YYRLINE[YYN] -- source line where rule number YYN was defined. */ static const unsigned short int yyrline[] = { - 0, 222, 222, 229, 230, 232, 234, 237, 239, 242, - 243, 246, 247, 250, 251, 254, 255, 258, 269, 270, - 273, 274, 277, 283, 291, 301, 302, 305, 306, 307, - 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, - 318, 321, 328, 338, 343, 350, 358, 364, 369, 373, - 386, 394, 397, 404, 412, 418, 425, 432, 438, 446, - 454, 460, 468, 476, 483, 484, 487, 498, 503, 510, - 523, 532, 535, 539, 543, 550, 553, 557, 564, 575, - 578, 583, 588, 593, 598, 603, 611, 617, 622, 633, - 644, 650, 656, 664, 670, 677, 690, 691, 694, 701, - 704, 715, 719, 730, 736, 737, 740, 741, 742, 743, - 744, 747, 750, 753, 764, 772, 778, 786, 794, 797, - 802 + 0, 231, 231, 238, 239, 241, 243, 246, 248, 251, + 252, 255, 256, 259, 260, 263, 264, 267, 278, 279, + 282, 283, 286, 292, 300, 310, 311, 312, 315, 316, + 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, + 327, 328, 331, 338, 348, 353, 360, 368, 374, 379, + 383, 396, 404, 407, 414, 422, 428, 435, 442, 448, + 456, 464, 470, 478, 486, 493, 494, 497, 508, 513, + 520, 536, 541, 543, 544, 547, 553, 561, 571, 577, + 590, 599, 602, 606, 610, 617, 620, 624, 631, 642, + 645, 650, 655, 660, 665, 670, 678, 684, 689, 700, + 711, 717, 723, 731, 737, 744, 757, 758, 761, 768, + 771, 782, 786, 797, 803, 804, 807, 808, 809, 810, + 811, 814, 817, 820, 831, 839, 845, 853, 861, 864, + 869 }; #endif @@ -575,7 +582,9 @@ static const char *const yytname[] = "Enumerations", "BitStringType", "ObjectIdentifierType", "OctetStringType", "NullType", "SequenceType", "SequenceOfType", "SetType", "SetOfType", "ChoiceType", "ReferencedType", "DefinedType", - "UsefulType", "TaggedType", "Tag", "Class", "tagenv", "ValueAssignment", + "UsefulType", "ConstrainedType", "Constraint", "ConstraintSpec", + "GeneralConstraint", "ContentsConstraint", "UserDefinedConstraint", + "TaggedType", "Tag", "Class", "tagenv", "ValueAssignment", "CharacterStringType", "RestrictedCharactedStringType", "ComponentTypeList", "NamedType", "ComponentType", "NamedBitList", "NamedBit", "objid_opt", "objid", "objid_list", "objid_element", "Value", @@ -608,17 +617,18 @@ static const unsigned char yyr1[] = { 0, 98, 99, 100, 100, 100, 100, 101, 101, 102, 102, 103, 103, 104, 104, 105, 105, 106, 107, 107, - 108, 108, 109, 109, 110, 111, 111, 112, 112, 112, + 108, 108, 109, 109, 110, 111, 111, 111, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, - 112, 113, 114, 115, 115, 115, 116, 116, 116, 117, - 118, 119, 120, 120, 121, 122, 123, 124, 124, 125, - 126, 126, 127, 128, 129, 129, 130, 131, 131, 132, - 133, 134, 134, 134, 134, 135, 135, 135, 136, 137, - 138, 138, 138, 138, 138, 138, 139, 139, 139, 140, - 141, 141, 141, 142, 142, 143, 144, 144, 145, 146, - 146, 147, 147, 147, 148, 148, 149, 149, 149, 149, - 149, 150, 151, 152, 153, 154, 154, 155, 156, 157, - 158 + 112, 112, 113, 114, 115, 115, 115, 116, 116, 116, + 117, 118, 119, 120, 120, 121, 122, 123, 124, 124, + 125, 126, 126, 127, 128, 129, 129, 130, 131, 131, + 132, 133, 134, 135, 135, 136, 136, 136, 137, 138, + 139, 140, 140, 140, 140, 141, 141, 141, 142, 143, + 144, 144, 144, 144, 144, 144, 145, 145, 145, 146, + 147, 147, 147, 148, 148, 149, 150, 150, 151, 152, + 152, 153, 153, 153, 154, 154, 155, 155, 155, 155, + 155, 156, 157, 158, 159, 160, 160, 161, 162, 163, + 164 }; /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */ @@ -628,9 +638,10 @@ static const unsigned char yyr2[] = 0, 3, 0, 1, 0, 1, 2, 4, 1, 2, 1, 1, 3, 1, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, - 1, 1, 5, 1, 2, 4, 1, 3, 3, 4, - 4, 1, 2, 5, 2, 2, 1, 4, 3, 3, - 4, 3, 3, 4, 1, 1, 1, 1, 1, 3, + 1, 1, 1, 5, 1, 2, 4, 1, 3, 3, + 4, 4, 1, 2, 5, 2, 2, 1, 4, 3, + 3, 4, 3, 3, 4, 1, 1, 1, 1, 1, + 2, 3, 1, 1, 1, 2, 3, 5, 4, 3, 4, 0, 1, 1, 1, 0, 1, 1, 4, 1, 1, 1, 1, 1, 1, 1, 1, 3, 3, 2, 1, 2, 3, 1, 3, 4, 1, 0, 3, 0, @@ -647,72 +658,76 @@ static const unsigned char yydefact[] = 0, 0, 0, 6, 1, 0, 0, 0, 8, 5, 3, 4, 0, 0, 7, 0, 10, 14, 0, 0, 23, 0, 13, 15, 0, 2, 0, 9, 18, 20, - 21, 0, 11, 16, 0, 0, 84, 41, 0, 0, - 80, 67, 83, 43, 56, 0, 0, 82, 0, 0, - 68, 81, 85, 0, 66, 71, 0, 25, 28, 32, - 31, 27, 34, 35, 33, 36, 37, 38, 39, 30, - 26, 64, 65, 40, 75, 29, 79, 19, 22, 97, - 52, 0, 0, 0, 0, 44, 54, 55, 0, 0, - 0, 0, 24, 73, 74, 72, 0, 0, 76, 77, - 0, 99, 17, 96, 0, 0, 0, 90, 86, 0, - 51, 46, 0, 116, 119, 115, 113, 114, 118, 120, - 0, 104, 105, 111, 112, 107, 106, 108, 117, 110, - 109, 0, 59, 58, 0, 62, 61, 0, 0, 78, - 69, 102, 103, 0, 99, 0, 0, 93, 89, 0, - 63, 0, 91, 0, 0, 50, 0, 45, 57, 60, - 70, 0, 98, 100, 0, 0, 53, 88, 87, 92, - 0, 48, 47, 0, 0, 0, 94, 49, 42, 101, - 95 + 21, 0, 11, 16, 0, 0, 94, 42, 0, 0, + 90, 68, 93, 44, 57, 0, 0, 92, 0, 0, + 69, 91, 95, 0, 67, 81, 0, 25, 29, 33, + 32, 28, 35, 36, 34, 37, 38, 39, 40, 31, + 26, 65, 66, 27, 41, 85, 30, 89, 19, 22, + 107, 53, 0, 0, 0, 0, 45, 55, 56, 0, + 0, 0, 0, 24, 83, 84, 82, 0, 0, 0, + 70, 86, 87, 0, 109, 17, 106, 0, 0, 0, + 100, 96, 0, 52, 47, 0, 126, 129, 125, 123, + 124, 128, 130, 0, 114, 115, 121, 122, 117, 116, + 118, 127, 120, 119, 0, 60, 59, 0, 63, 62, + 0, 0, 88, 0, 0, 0, 0, 72, 73, 74, + 79, 112, 113, 0, 109, 0, 0, 103, 99, 0, + 64, 0, 101, 0, 0, 51, 0, 46, 58, 61, + 80, 0, 75, 0, 71, 0, 108, 110, 0, 0, + 54, 98, 97, 102, 0, 49, 48, 0, 0, 0, + 76, 0, 0, 104, 50, 43, 78, 0, 111, 105, + 77 }; /* YYDEFGOTO[NTERM-NUM]. */ static const short int yydefgoto[] = { -1, 2, 8, 13, 18, 19, 21, 22, 23, 27, - 28, 24, 29, 56, 57, 58, 85, 59, 110, 111, - 60, 112, 61, 62, 63, 64, 65, 66, 67, 68, - 69, 70, 71, 72, 73, 74, 96, 100, 30, 75, - 76, 106, 107, 108, 146, 147, 102, 119, 143, 144, - 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, - 130 + 28, 24, 29, 56, 57, 58, 86, 59, 113, 114, + 60, 115, 61, 62, 63, 64, 65, 66, 67, 68, + 69, 70, 71, 72, 73, 100, 146, 147, 148, 149, + 74, 75, 97, 103, 30, 76, 77, 109, 110, 111, + 156, 157, 105, 122, 153, 154, 123, 124, 125, 126, + 127, 128, 129, 130, 131, 132, 133 }; /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing STATE-NUM. */ -#define YYPACT_NINF -94 -static const yysigned_char yypact[] = +#define YYPACT_NINF -99 +static const short int yypact[] = { - -49, 5, 60, 3, -94, -6, 1, 10, 43, -94, - -94, -94, 42, -2, -94, 76, -33, 0, 64, 4, - 7, 9, 0, -94, 61, -94, -9, -94, 4, -94, - -94, 0, -94, -94, 14, 28, -94, -94, 12, 13, - -94, -94, -94, -56, -94, 66, 41, -94, -50, -47, - -94, -94, -94, 40, -94, 2, 25, -94, -94, -94, - -94, -94, -94, -94, -94, -94, -94, -94, -94, -94, - -94, -94, -94, -94, -18, -94, -94, -94, -94, 16, - 17, 26, 27, 8, 27, -94, -94, -94, 40, -73, - 40, -72, -94, -94, -94, -94, 34, 8, -94, -94, - 40, -41, -94, -94, 29, 40, -80, -8, -94, 22, - 30, -94, 21, -94, -94, -94, -94, -94, -94, -94, - 44, -94, -94, -94, -94, -94, -94, -94, -94, -94, - -94, -74, -94, -94, -63, -94, -94, -62, 31, -94, - -94, 33, -94, 35, -41, 37, -60, -94, -94, -67, - -94, 8, -94, 45, -19, -94, 8, -94, -94, -94, - -94, 46, -94, -94, 49, 29, -94, -94, -94, -94, - 38, -94, -94, 47, 48, 50, -94, -94, -94, -94, - -94 + -46, 20, 13, 21, -99, 11, 23, 25, 54, -99, + -99, -99, 58, 6, -99, 90, -34, 15, 80, 19, + 16, 18, 15, -99, 74, -99, -7, -99, 19, -99, + -99, 15, -99, -99, 24, 42, -99, -99, 17, 26, + -99, -99, -99, -73, -99, 76, 50, -99, -45, -44, + -99, -99, -99, 51, -99, 4, -67, -99, -99, -99, + -99, -99, -99, -99, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -99, -16, -99, -99, -99, -99, + 27, 28, 33, 37, 47, 37, -99, -99, -99, 51, + -72, 51, -71, 22, -99, -99, -99, 35, 47, 12, + -99, -99, -99, 51, 2, -99, -99, 39, 51, -75, + -8, -99, 34, 36, -99, 43, -99, -99, -99, -99, + -99, -99, -99, 48, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -57, 22, -99, -48, 22, -99, + -22, 45, -99, 120, 51, 122, 46, -99, -99, -99, + 22, 52, -99, 53, 2, 57, -9, -99, 22, -53, + -99, 47, -99, 56, -19, -99, 47, -99, -99, -99, + -99, 49, -18, 47, -99, 61, -99, -99, 62, 39, + -99, -99, -99, -99, 59, -99, -99, 60, 63, 128, + -99, 64, 66, -99, -99, -99, -99, 47, -99, -99, + -99 }; /* YYPGOTO[NTERM-NUM]. */ static const yysigned_char yypgoto[] = { - -94, -94, -94, -94, -94, -94, -94, -94, 102, 105, - -94, 108, -94, 32, -94, -94, -94, -94, 58, -10, - -94, -94, -94, -94, -94, -94, -94, -94, -94, -94, - -94, -94, -94, -94, -94, -94, -94, -94, -94, -94, - -94, -30, -94, -4, -94, -17, -94, 67, 6, -94, - -93, -94, -94, -94, -94, -94, -94, -94, -1, -94, - -94 + -99, -99, -99, -99, -99, -99, -99, -99, 124, 126, + -99, 125, -99, -52, -99, -99, -99, -99, 70, -4, + -99, -99, -99, -99, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -99, -99, -99, -99, -99, -99, + -99, -99, -99, -99, -99, -99, -99, -37, -99, 3, + -99, -15, -99, 81, 9, -99, -98, -99, -99, -99, + -99, -99, -99, -99, 5, -99, -99 }; /* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If @@ -722,42 +737,44 @@ static const yysigned_char yypgoto[] = #define YYTABLE_NINF -13 static const short int yytable[] = { - 35, 36, 37, 88, 139, 38, 90, 17, 93, 98, - 5, 149, 151, 105, 105, 150, 39, 154, 167, 105, - 99, 157, 133, 136, 40, 41, 3, 42, 149, 149, - 6, 165, 158, 159, 43, 166, 83, 1, 84, 113, - 44, 7, 45, 46, 89, 141, 152, 91, 142, 35, - 36, 37, 47, -12, 38, 48, 49, 114, 169, 134, - 4, 137, 94, 173, 9, 39, 171, 109, 50, 51, - 52, 10, 12, 40, 41, 53, 42, 54, 95, 115, - 11, 14, 15, 43, 16, 92, 20, 55, 25, 44, - 26, 45, 46, 34, 116, 80, 117, 118, 31, 32, - 79, 47, 101, 86, 48, 49, 81, 82, 87, 97, - 101, 104, 105, 109, 153, 145, 155, 50, 51, 52, - 132, 154, 135, 138, 33, 161, 54, 156, 160, 164, - 162, 177, 140, 77, 118, 174, 55, 148, 175, 78, - 178, 179, 131, 180, 172, 168, 103, 0, 176, 0, - 163, 0, 170 + 142, 93, 35, 36, 37, 189, 17, 38, 89, 91, + 94, 101, 161, 4, 108, 108, 159, 98, 39, 84, + 160, 85, 102, 136, 139, 99, 40, 41, 5, 42, + 143, 144, 181, 108, 164, 145, 43, 135, 167, 138, + 1, 3, 44, 159, 45, 46, 162, 168, 6, 90, + 92, 150, -12, 137, 47, 140, 158, 48, 49, 7, + 35, 36, 37, 183, 95, 38, 185, 112, 187, 159, + 50, 51, 52, 169, 99, 190, 39, 53, 116, 54, + 96, 9, 179, 12, 40, 41, 180, 42, 151, 55, + 15, 152, 172, 10, 43, 11, 117, 14, 16, 200, + 44, 20, 45, 46, 25, 26, 34, 31, 32, 81, + 80, 82, 47, 87, 99, 48, 49, 88, 118, 108, + 83, 104, 107, 112, 141, 155, 163, 164, 50, 51, + 52, 166, 171, 119, 173, 120, 121, 54, 165, 174, + 197, 104, 170, 188, 175, 121, 33, 55, 176, 178, + 191, 192, 194, 195, 78, 134, 79, 198, 196, 199, + 186, 106, 182, 177, 193, 0, 0, 0, 184 }; static const short int yycheck[] = { - 9, 10, 11, 53, 97, 14, 53, 40, 6, 27, - 7, 91, 20, 86, 86, 95, 25, 91, 85, 86, - 38, 95, 95, 95, 33, 34, 21, 36, 91, 91, - 27, 91, 95, 95, 43, 95, 92, 86, 94, 31, - 49, 38, 51, 52, 94, 86, 54, 94, 89, 9, - 10, 11, 61, 86, 14, 64, 65, 49, 151, 89, - 0, 91, 60, 156, 70, 25, 85, 86, 77, 78, - 79, 70, 29, 33, 34, 84, 36, 86, 76, 71, - 70, 39, 84, 43, 8, 53, 86, 96, 24, 49, - 86, 51, 52, 32, 86, 67, 88, 89, 91, 90, - 86, 61, 94, 37, 64, 65, 94, 94, 67, 84, - 94, 94, 86, 86, 92, 86, 95, 77, 78, 79, - 88, 91, 90, 89, 22, 92, 86, 83, 97, 92, - 95, 93, 100, 28, 89, 89, 96, 105, 89, 31, - 93, 93, 84, 93, 154, 149, 79, -1, 165, -1, - 144, -1, 153 + 98, 53, 9, 10, 11, 23, 40, 14, 53, 53, + 6, 27, 20, 0, 86, 86, 91, 84, 25, 92, + 95, 94, 38, 95, 95, 92, 33, 34, 7, 36, + 18, 19, 85, 86, 91, 23, 43, 89, 95, 91, + 86, 21, 49, 91, 51, 52, 54, 95, 27, 94, + 94, 103, 86, 90, 61, 92, 108, 64, 65, 38, + 9, 10, 11, 161, 60, 14, 85, 86, 166, 91, + 77, 78, 79, 95, 92, 173, 25, 84, 31, 86, + 76, 70, 91, 29, 33, 34, 95, 36, 86, 96, + 84, 89, 144, 70, 43, 70, 49, 39, 8, 197, + 49, 86, 51, 52, 24, 86, 32, 91, 90, 67, + 86, 94, 61, 37, 92, 64, 65, 67, 71, 86, + 94, 94, 94, 86, 89, 86, 92, 91, 77, 78, + 79, 83, 12, 86, 12, 88, 89, 86, 95, 93, + 12, 94, 97, 94, 92, 89, 22, 96, 95, 92, + 89, 89, 93, 93, 28, 85, 31, 93, 95, 93, + 164, 80, 159, 154, 179, -1, -1, -1, 163 }; /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing @@ -767,22 +784,24 @@ static const unsigned char yystos[] = 0, 86, 99, 21, 0, 7, 27, 38, 100, 70, 70, 70, 29, 101, 39, 84, 8, 40, 102, 103, 86, 104, 105, 106, 109, 24, 86, 107, 108, 110, - 136, 91, 90, 106, 32, 9, 10, 11, 14, 25, + 142, 91, 90, 106, 32, 9, 10, 11, 14, 25, 33, 34, 36, 43, 49, 51, 52, 61, 64, 65, 77, 78, 79, 84, 86, 96, 111, 112, 113, 115, 118, 120, 121, 122, 123, 124, 125, 126, 127, 128, - 129, 130, 131, 132, 133, 137, 138, 107, 109, 86, - 67, 94, 94, 92, 94, 114, 37, 67, 53, 94, - 53, 94, 111, 6, 60, 76, 134, 84, 27, 38, - 135, 94, 144, 145, 94, 86, 139, 140, 141, 86, - 116, 117, 119, 31, 49, 71, 86, 88, 89, 145, - 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, - 158, 116, 111, 95, 139, 111, 95, 139, 89, 148, - 111, 86, 89, 146, 147, 86, 142, 143, 111, 91, + 129, 130, 131, 132, 138, 139, 143, 144, 107, 109, + 86, 67, 94, 94, 92, 94, 114, 37, 67, 53, + 94, 53, 94, 111, 6, 60, 76, 140, 84, 92, + 133, 27, 38, 141, 94, 150, 151, 94, 86, 145, + 146, 147, 86, 116, 117, 119, 31, 49, 71, 86, + 88, 89, 151, 154, 155, 156, 157, 158, 159, 160, + 161, 162, 163, 164, 116, 111, 95, 145, 111, 95, + 145, 89, 154, 18, 19, 23, 134, 135, 136, 137, + 111, 86, 89, 152, 153, 86, 148, 149, 111, 91, 95, 20, 54, 92, 91, 95, 83, 95, 95, 95, - 97, 92, 95, 146, 92, 91, 95, 85, 141, 148, - 156, 85, 117, 148, 89, 89, 143, 93, 93, 93, - 93 + 97, 12, 111, 12, 93, 92, 95, 152, 92, 91, + 95, 85, 147, 154, 162, 85, 117, 154, 94, 23, + 154, 89, 89, 149, 93, 93, 95, 12, 93, 93, + 154 }; #if ! defined (YYSIZE_T) && defined (__SIZE_TYPE__) @@ -1423,29 +1442,29 @@ yyreduce: switch (yyn) { case 2: -#line 224 "parse.y" +#line 233 "parse.y" { checkundefined(); } break; case 4: -#line 231 "parse.y" +#line 240 "parse.y" { error_message("implicit tagging is not supported"); } break; case 5: -#line 233 "parse.y" +#line 242 "parse.y" { error_message("automatic tagging is not supported"); } break; case 7: -#line 238 "parse.y" +#line 247 "parse.y" { error_message("no extensibility options supported"); } break; case 17: -#line 259 "parse.y" +#line 268 "parse.y" { struct string_list *sl; for(sl = (yyvsp[-3].sl); sl != NULL; sl = sl->next) { @@ -1457,7 +1476,7 @@ yyreduce: break; case 22: -#line 278 "parse.y" +#line 287 "parse.y" { (yyval.sl) = emalloc(sizeof(*(yyval.sl))); (yyval.sl)->string = (yyvsp[-2].name); @@ -1466,7 +1485,7 @@ yyreduce: break; case 23: -#line 284 "parse.y" +#line 293 "parse.y" { (yyval.sl) = emalloc(sizeof(*(yyval.sl))); (yyval.sl)->string = (yyvsp[0].name); @@ -1475,7 +1494,7 @@ yyreduce: break; case 24: -#line 292 "parse.y" +#line 301 "parse.y" { Symbol *s = addsym ((yyvsp[-2].name)); s->stype = Stype; @@ -1485,16 +1504,16 @@ yyreduce: } break; - case 41: -#line 322 "parse.y" + case 42: +#line 332 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_Boolean, TE_EXPLICIT, new_type(TBoolean)); } break; - case 42: -#line 329 "parse.y" + case 43: +#line 339 "parse.y" { if((yyvsp[-3].value)->type != integervalue || (yyvsp[-1].value)->type != integervalue) @@ -1504,16 +1523,16 @@ yyreduce: } break; - case 43: -#line 339 "parse.y" + case 44: +#line 349 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_Integer, TE_EXPLICIT, new_type(TInteger)); } break; - case 44: -#line 344 "parse.y" + case 45: +#line 354 "parse.y" { (yyval.type) = new_type(TInteger); (yyval.type)->range = emalloc(sizeof(*(yyval.type)->range)); @@ -1522,8 +1541,8 @@ yyreduce: } break; - case 45: -#line 351 "parse.y" + case 46: +#line 361 "parse.y" { (yyval.type) = new_type(TInteger); (yyval.type)->members = (yyvsp[-1].members); @@ -1531,8 +1550,8 @@ yyreduce: } break; - case 46: -#line 359 "parse.y" + case 47: +#line 369 "parse.y" { (yyval.members) = emalloc(sizeof(*(yyval.members))); ASN1_TAILQ_INIT((yyval.members)); @@ -1540,21 +1559,21 @@ yyreduce: } break; - case 47: -#line 365 "parse.y" + case 48: +#line 375 "parse.y" { ASN1_TAILQ_INSERT_TAIL((yyvsp[-2].members), (yyvsp[0].member), members); (yyval.members) = (yyvsp[-2].members); } break; - case 48: -#line 370 "parse.y" + case 49: +#line 380 "parse.y" { (yyval.members) = (yyvsp[-2].members); } break; - case 49: -#line 374 "parse.y" + case 50: +#line 384 "parse.y" { (yyval.member) = emalloc(sizeof(*(yyval.member))); (yyval.member)->name = (yyvsp[-3].name); @@ -1567,8 +1586,8 @@ yyreduce: } break; - case 50: -#line 387 "parse.y" + case 51: +#line 397 "parse.y" { (yyval.type) = new_type(TInteger); (yyval.type)->members = (yyvsp[-1].members); @@ -1576,8 +1595,8 @@ yyreduce: } break; - case 52: -#line 398 "parse.y" + case 53: +#line 408 "parse.y" { (yyval.type) = new_type(TBitString); (yyval.type)->members = emalloc(sizeof(*(yyval.type)->members)); @@ -1586,8 +1605,8 @@ yyreduce: } break; - case 53: -#line 405 "parse.y" + case 54: +#line 415 "parse.y" { (yyval.type) = new_type(TBitString); (yyval.type)->members = (yyvsp[-1].members); @@ -1595,32 +1614,32 @@ yyreduce: } break; - case 54: -#line 413 "parse.y" + case 55: +#line 423 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_OID, TE_EXPLICIT, new_type(TOID)); } break; - case 55: -#line 419 "parse.y" + case 56: +#line 429 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_OctetString, TE_EXPLICIT, new_type(TOctetString)); } break; - case 56: -#line 426 "parse.y" + case 57: +#line 436 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_Null, TE_EXPLICIT, new_type(TNull)); } break; - case 57: -#line 433 "parse.y" + case 58: +#line 443 "parse.y" { (yyval.type) = new_type(TSequence); (yyval.type)->members = (yyvsp[-1].members); @@ -1628,8 +1647,8 @@ yyreduce: } break; - case 58: -#line 439 "parse.y" + case 59: +#line 449 "parse.y" { (yyval.type) = new_type(TSequence); (yyval.type)->members = NULL; @@ -1637,8 +1656,8 @@ yyreduce: } break; - case 59: -#line 447 "parse.y" + case 60: +#line 457 "parse.y" { (yyval.type) = new_type(TSequenceOf); (yyval.type)->subtype = (yyvsp[0].type); @@ -1646,8 +1665,8 @@ yyreduce: } break; - case 60: -#line 455 "parse.y" + case 61: +#line 465 "parse.y" { (yyval.type) = new_type(TSet); (yyval.type)->members = (yyvsp[-1].members); @@ -1655,8 +1674,8 @@ yyreduce: } break; - case 61: -#line 461 "parse.y" + case 62: +#line 471 "parse.y" { (yyval.type) = new_type(TSet); (yyval.type)->members = NULL; @@ -1664,8 +1683,8 @@ yyreduce: } break; - case 62: -#line 469 "parse.y" + case 63: +#line 479 "parse.y" { (yyval.type) = new_type(TSetOf); (yyval.type)->subtype = (yyvsp[0].type); @@ -1673,16 +1692,16 @@ yyreduce: } break; - case 63: -#line 477 "parse.y" + case 64: +#line 487 "parse.y" { (yyval.type) = new_type(TChoice); (yyval.type)->members = (yyvsp[-1].members); } break; - case 66: -#line 488 "parse.y" + case 67: +#line 498 "parse.y" { Symbol *s = addsym((yyvsp[0].name)); (yyval.type) = new_type(TType); @@ -1693,24 +1712,85 @@ yyreduce: } break; - case 67: -#line 499 "parse.y" + case 68: +#line 509 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralizedTime, TE_EXPLICIT, new_type(TGeneralizedTime)); } break; - case 68: -#line 504 "parse.y" + case 69: +#line 514 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTCTime, TE_EXPLICIT, new_type(TUTCTime)); } break; - case 69: -#line 511 "parse.y" + case 70: +#line 521 "parse.y" + { + /* if (Constraint.type == contentConstrant) { + assert(Constraint.u.constraint.type == octetstring|bitstring-w/o-NamedBitList); // remember to check type reference too + if (Constraint.u.constraint.type) { + assert((Constraint.u.constraint.type.length % 8) == 0); + } + } + if (Constraint.u.constraint.encoding) { + type == der-oid|ber-oid + } + */ + } + break; + + case 71: +#line 537 "parse.y" + { + (yyval.constraint_spec) = (yyvsp[-1].constraint_spec); + } + break; + + case 75: +#line 548 "parse.y" + { + (yyval.constraint_spec) = new_constraint_spec(CT_CONTENTS); + (yyval.constraint_spec)->u.content.type = (yyvsp[0].type); + (yyval.constraint_spec)->u.content.encoding = NULL; + } + break; + + case 76: +#line 554 "parse.y" + { + if ((yyvsp[0].value)->type != objectidentifiervalue) + error_message("Non-OID used in ENCODED BY constraint"); + (yyval.constraint_spec) = new_constraint_spec(CT_CONTENTS); + (yyval.constraint_spec)->u.content.type = NULL; + (yyval.constraint_spec)->u.content.encoding = (yyvsp[0].value); + } + break; + + case 77: +#line 562 "parse.y" + { + if ((yyvsp[0].value)->type != objectidentifiervalue) + error_message("Non-OID used in ENCODED BY constraint"); + (yyval.constraint_spec) = new_constraint_spec(CT_CONTENTS); + (yyval.constraint_spec)->u.content.type = (yyvsp[-3].type); + (yyval.constraint_spec)->u.content.encoding = (yyvsp[0].value); + } + break; + + case 78: +#line 572 "parse.y" + { + (yyval.constraint_spec) = new_constraint_spec(CT_USER); + } + break; + + case 79: +#line 578 "parse.y" { (yyval.type) = new_type(TTag); (yyval.type)->tag = (yyvsp[-2].tag); @@ -1723,8 +1803,8 @@ yyreduce: } break; - case 70: -#line 524 "parse.y" + case 80: +#line 591 "parse.y" { (yyval.tag).tagclass = (yyvsp[-2].constant); (yyval.tag).tagvalue = (yyvsp[-1].constant); @@ -1732,57 +1812,57 @@ yyreduce: } break; - case 71: -#line 532 "parse.y" + case 81: +#line 599 "parse.y" { (yyval.constant) = ASN1_C_CONTEXT; } break; - case 72: -#line 536 "parse.y" + case 82: +#line 603 "parse.y" { (yyval.constant) = ASN1_C_UNIV; } break; - case 73: -#line 540 "parse.y" + case 83: +#line 607 "parse.y" { (yyval.constant) = ASN1_C_APPL; } break; - case 74: -#line 544 "parse.y" + case 84: +#line 611 "parse.y" { (yyval.constant) = ASN1_C_PRIVATE; } break; - case 75: -#line 550 "parse.y" + case 85: +#line 617 "parse.y" { (yyval.constant) = TE_EXPLICIT; } break; - case 76: -#line 554 "parse.y" + case 86: +#line 621 "parse.y" { (yyval.constant) = TE_EXPLICIT; } break; - case 77: -#line 558 "parse.y" + case 87: +#line 625 "parse.y" { (yyval.constant) = TE_IMPLICIT; } break; - case 78: -#line 565 "parse.y" + case 88: +#line 632 "parse.y" { Symbol *s; s = addsym ((yyvsp[-3].name)); @@ -1793,56 +1873,56 @@ yyreduce: } break; - case 80: -#line 579 "parse.y" + case 90: +#line 646 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralString, TE_EXPLICIT, new_type(TGeneralString)); } break; - case 81: -#line 584 "parse.y" + case 91: +#line 651 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTF8String, TE_EXPLICIT, new_type(TUTF8String)); } break; - case 82: -#line 589 "parse.y" + case 92: +#line 656 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_PrintableString, TE_EXPLICIT, new_type(TPrintableString)); } break; - case 83: -#line 594 "parse.y" + case 93: +#line 661 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_IA5String, TE_EXPLICIT, new_type(TIA5String)); } break; - case 84: -#line 599 "parse.y" + case 94: +#line 666 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_BMPString, TE_EXPLICIT, new_type(TBMPString)); } break; - case 85: -#line 604 "parse.y" + case 95: +#line 671 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_UniversalString, TE_EXPLICIT, new_type(TUniversalString)); } break; - case 86: -#line 612 "parse.y" + case 96: +#line 679 "parse.y" { (yyval.members) = emalloc(sizeof(*(yyval.members))); ASN1_TAILQ_INIT((yyval.members)); @@ -1850,16 +1930,16 @@ yyreduce: } break; - case 87: -#line 618 "parse.y" + case 97: +#line 685 "parse.y" { ASN1_TAILQ_INSERT_TAIL((yyvsp[-2].members), (yyvsp[0].member), members); (yyval.members) = (yyvsp[-2].members); } break; - case 88: -#line 623 "parse.y" + case 98: +#line 690 "parse.y" { struct member *m = ecalloc(1, sizeof(*m)); m->name = estrdup("..."); @@ -1870,8 +1950,8 @@ yyreduce: } break; - case 89: -#line 634 "parse.y" + case 99: +#line 701 "parse.y" { (yyval.member) = emalloc(sizeof(*(yyval.member))); (yyval.member)->name = (yyvsp[-1].name); @@ -1882,8 +1962,8 @@ yyreduce: } break; - case 90: -#line 645 "parse.y" + case 100: +#line 712 "parse.y" { (yyval.member) = (yyvsp[0].member); (yyval.member)->optional = 0; @@ -1891,8 +1971,8 @@ yyreduce: } break; - case 91: -#line 651 "parse.y" + case 101: +#line 718 "parse.y" { (yyval.member) = (yyvsp[-1].member); (yyval.member)->optional = 1; @@ -1900,8 +1980,8 @@ yyreduce: } break; - case 92: -#line 657 "parse.y" + case 102: +#line 724 "parse.y" { (yyval.member) = (yyvsp[-2].member); (yyval.member)->optional = 0; @@ -1909,8 +1989,8 @@ yyreduce: } break; - case 93: -#line 665 "parse.y" + case 103: +#line 732 "parse.y" { (yyval.members) = emalloc(sizeof(*(yyval.members))); ASN1_TAILQ_INIT((yyval.members)); @@ -1918,16 +1998,16 @@ yyreduce: } break; - case 94: -#line 671 "parse.y" + case 104: +#line 738 "parse.y" { ASN1_TAILQ_INSERT_TAIL((yyvsp[-2].members), (yyvsp[0].member), members); (yyval.members) = (yyvsp[-2].members); } break; - case 95: -#line 678 "parse.y" + case 105: +#line 745 "parse.y" { (yyval.member) = emalloc(sizeof(*(yyval.member))); (yyval.member)->name = (yyvsp[-3].name); @@ -1940,27 +2020,27 @@ yyreduce: } break; - case 97: -#line 691 "parse.y" + case 107: +#line 758 "parse.y" { (yyval.objid) = NULL; } break; - case 98: -#line 695 "parse.y" + case 108: +#line 762 "parse.y" { (yyval.objid) = (yyvsp[-1].objid); } break; - case 99: -#line 701 "parse.y" + case 109: +#line 768 "parse.y" { (yyval.objid) = NULL; } break; - case 100: -#line 705 "parse.y" + case 110: +#line 772 "parse.y" { if ((yyvsp[0].objid)) { (yyval.objid) = (yyvsp[0].objid); @@ -1971,15 +2051,15 @@ yyreduce: } break; - case 101: -#line 716 "parse.y" + case 111: +#line 783 "parse.y" { (yyval.objid) = new_objid((yyvsp[-3].name), (yyvsp[-1].constant)); } break; - case 102: -#line 720 "parse.y" + case 112: +#line 787 "parse.y" { Symbol *s = addsym((yyvsp[0].name)); if(s->stype != SValue || @@ -1992,15 +2072,15 @@ yyreduce: } break; - case 103: -#line 731 "parse.y" + case 113: +#line 798 "parse.y" { (yyval.objid) = new_objid(NULL, (yyvsp[0].constant)); } break; - case 113: -#line 754 "parse.y" + case 123: +#line 821 "parse.y" { Symbol *s = addsym((yyvsp[0].name)); if(s->stype != SValue) @@ -2011,8 +2091,8 @@ yyreduce: } break; - case 114: -#line 765 "parse.y" + case 124: +#line 832 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = stringvalue; @@ -2020,8 +2100,8 @@ yyreduce: } break; - case 115: -#line 773 "parse.y" + case 125: +#line 840 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = booleanvalue; @@ -2029,8 +2109,8 @@ yyreduce: } break; - case 116: -#line 779 "parse.y" + case 126: +#line 846 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = booleanvalue; @@ -2038,8 +2118,8 @@ yyreduce: } break; - case 117: -#line 787 "parse.y" + case 127: +#line 854 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = integervalue; @@ -2047,14 +2127,14 @@ yyreduce: } break; - case 119: -#line 798 "parse.y" + case 129: +#line 865 "parse.y" { } break; - case 120: -#line 803 "parse.y" + case 130: +#line 870 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = objectidentifiervalue; @@ -2066,7 +2146,7 @@ yyreduce: } /* Line 1037 of yacc.c. */ -#line 2070 "parse.c" +#line 2150 "parse.c" yyvsp -= yylen; yyssp -= yylen; @@ -2294,7 +2374,7 @@ yyreturn: } -#line 810 "parse.y" +#line 877 "parse.y" void @@ -2349,6 +2429,14 @@ new_type (Typetype tt) return t; } +static struct constraint_spec * +new_constraint_spec(enum ctype ct) +{ + struct constraint_spec *c = ecalloc(1, sizeof(*c)); + c->ctype = ct; + return c; +} + static void fix_labels2(Type *t, const char *prefix); static void fix_labels1(struct memhead *members, const char *prefix) { diff --git a/source4/heimdal/lib/asn1/parse.h b/source4/heimdal/lib/asn1/parse.h index 76ff8755c9..5cc1342618 100644 --- a/source4/heimdal/lib/asn1/parse.h +++ b/source4/heimdal/lib/asn1/parse.h @@ -210,7 +210,7 @@ #if ! defined (YYSTYPE) && ! defined (YYSTYPE_IS_DECLARED) -#line 64 "parse.y" +#line 65 "parse.y" typedef union YYSTYPE { int constant; struct value *value; @@ -223,9 +223,10 @@ typedef union YYSTYPE { struct string_list *sl; struct tagtype tag; struct memhead *members; + struct constraint_spec *constraint_spec; } YYSTYPE; /* Line 1318 of yacc.c. */ -#line 229 "parse.h" +#line 230 "parse.h" # define yystype YYSTYPE /* obsolescent; will be withdrawn */ # define YYSTYPE_IS_DECLARED 1 # define YYSTYPE_IS_TRIVIAL 1 diff --git a/source4/heimdal/lib/asn1/symbol.h b/source4/heimdal/lib/asn1/symbol.h index 83df57b77f..93a6e019bd 100644 --- a/source4/heimdal/lib/asn1/symbol.h +++ b/source4/heimdal/lib/asn1/symbol.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $Id: symbol.h,v 1.12 2005/07/12 06:27:40 lha Exp $ */ +/* $Id: symbol.h,v 1.13 2005/12/06 19:59:52 lha Exp $ */ #ifndef _SYMBOL_H #define _SYMBOL_H @@ -111,6 +111,10 @@ struct range { int max; }; +enum ctype { CT_CONTENTS, CT_USER } ; + +struct constraint_spec; + struct type { Typetype type; struct memhead *members; @@ -118,10 +122,21 @@ struct type { struct type *subtype; struct tagtype tag; struct range *range; + struct constraint_spec *constraint; }; typedef struct type Type; +struct constraint_spec { + enum ctype ctype; + union { + struct { + Type *type; + struct value *encoding; + } content; + } u; +}; + struct objid { const char *label; int value; diff --git a/source4/heimdal/lib/gssapi/context_time.c b/source4/heimdal/lib/gssapi/context_time.c index e13480c85e..ee1dc6fe93 100644 --- a/source4/heimdal/lib/gssapi/context_time.c +++ b/source4/heimdal/lib/gssapi/context_time.c @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$Id: context_time.c,v 1.10 2003/06/03 15:08:00 lha Exp $"); +RCSID("$Id: context_time.c,v 1.11 2005/12/05 09:19:52 lha Exp $"); OM_uint32 gssapi_lifetime_left(OM_uint32 *minor_status, @@ -43,6 +43,11 @@ gssapi_lifetime_left(OM_uint32 *minor_status, krb5_timestamp timeret; krb5_error_code kret; + if (lifetime == 0) { + *lifetime_rec = GSS_C_INDEFINITE; + return GSS_S_COMPLETE; + } + kret = krb5_timeofday(gssapi_krb5_context, &timeret); if (kret) { *minor_status = kret; diff --git a/source4/heimdal/lib/gssapi/gssapi.h b/source4/heimdal/lib/gssapi/gssapi.h index 20700dc826..b93ad4e481 100644 --- a/source4/heimdal/lib/gssapi/gssapi.h +++ b/source4/heimdal/lib/gssapi/gssapi.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $Id: gssapi.h,v 1.38 2005/10/26 11:22:13 lha Exp $ */ +/* $Id: gssapi.h,v 1.39 2005/12/05 11:52:45 lha Exp $ */ #ifndef GSSAPI_H_ #define GSSAPI_H_ diff --git a/source4/heimdal/lib/hdb/db.c b/source4/heimdal/lib/hdb/db.c index 4cc0218a5c..4b4e6e673d 100644 --- a/source4/heimdal/lib/hdb/db.c +++ b/source4/heimdal/lib/hdb/db.c @@ -33,7 +33,7 @@ #include "hdb_locl.h" -RCSID("$Id: db.c,v 1.33 2005/11/28 23:30:51 lha Exp $"); +RCSID("$Id: db.c,v 1.35 2005/12/13 11:52:55 lha Exp $"); #if HAVE_DB1 @@ -85,7 +85,7 @@ DB_unlock(krb5_context context, HDB *db) static krb5_error_code DB_seq(krb5_context context, HDB *db, - unsigned flags, hdb_entry *entry, int flag) + unsigned flags, hdb_entry_ex *entry, int flag) { DB *d = (DB*)db->hdb_db; DBT key, value; @@ -106,21 +106,22 @@ DB_seq(krb5_context context, HDB *db, key_data.length = key.size; data.data = value.data; data.length = value.size; - if (hdb_value2entry(context, &data, entry)) + memset(entry, 0, sizeof(*entry)); + if (hdb_value2entry(context, &data, &entry->entry)) return DB_seq(context, db, flags, entry, R_NEXT); if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) { - code = hdb_unseal_keys (context, db, entry); + code = hdb_unseal_keys (context, db, &entry->entry); if (code) hdb_free_entry (context, entry); } - if (code == 0 && entry->principal == NULL) { - entry->principal = malloc(sizeof(*entry->principal)); - if (entry->principal == NULL) { + if (code == 0 && entry->entry.principal == NULL) { + entry->entry.principal = malloc(sizeof(*entry->entry.principal)); + if (entry->entry.principal == NULL) { krb5_set_error_string(context, "malloc: out of memory"); code = ENOMEM; hdb_free_entry (context, entry); } else { - hdb_key2principal(context, &key_data, entry->principal); + hdb_key2principal(context, &key_data, entry->entry.principal); } } return code; @@ -128,14 +129,14 @@ DB_seq(krb5_context context, HDB *db, static krb5_error_code -DB_firstkey(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) +DB_firstkey(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry) { return DB_seq(context, db, flags, entry, R_FIRST); } static krb5_error_code -DB_nextkey(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) +DB_nextkey(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry) { return DB_seq(context, db, flags, entry, R_NEXT); } diff --git a/source4/heimdal/lib/hdb/hdb-private.h b/source4/heimdal/lib/hdb/hdb-private.h index 7baa944053..e602f01373 100644 --- a/source4/heimdal/lib/hdb/hdb-private.h +++ b/source4/heimdal/lib/hdb/hdb-private.h @@ -11,7 +11,7 @@ _hdb_fetch ( unsigned /*flags*/, krb5_const_principal /*principal*/, enum hdb_ent_type /*ent_type*/, - hdb_entry */*entry*/); + hdb_entry_ex */*entry*/); hdb_master_key _hdb_find_master_key ( @@ -43,13 +43,13 @@ krb5_error_code _hdb_remove ( krb5_context /*context*/, HDB */*db*/, - hdb_entry */*entry*/); + hdb_entry_ex */*entry*/); krb5_error_code _hdb_store ( krb5_context /*context*/, HDB */*db*/, unsigned /*flags*/, - hdb_entry */*entry*/); + hdb_entry_ex */*entry*/); #endif /* __hdb_private_h__ */ diff --git a/source4/heimdal/lib/hdb/hdb-protos.h b/source4/heimdal/lib/hdb/hdb-protos.h index 4b5b4d3ede..c221175e41 100644 --- a/source4/heimdal/lib/hdb/hdb-protos.h +++ b/source4/heimdal/lib/hdb/hdb-protos.h @@ -428,11 +428,6 @@ hdb_foreach ( void hdb_free_entry ( krb5_context /*context*/, - hdb_entry */*ent*/); - -void -hdb_free_entry_ex ( - krb5_context /*context*/, hdb_entry_ex */*ent*/); void @@ -477,12 +472,25 @@ hdb_key2principal ( krb5_principal /*p*/); krb5_error_code +hdb_ldap_common ( + krb5_context /*context*/, + HDB ** /*db*/, + const char */*search_base*/, + const char */*url*/); + +krb5_error_code hdb_ldap_create ( krb5_context /*context*/, HDB ** /*db*/, const char */*arg*/); krb5_error_code +hdb_ldapi_create ( + krb5_context /*context*/, + HDB ** /*db*/, + const char */*arg*/); + +krb5_error_code hdb_list_builtin ( krb5_context /*context*/, char **/*list*/); @@ -515,7 +523,7 @@ krb5_error_code hdb_print_entry ( krb5_context /*context*/, HDB */*db*/, - hdb_entry */*entry*/, + hdb_entry_ex */*entry*/, void */*data*/); krb5_error_code @@ -614,9 +622,6 @@ hdb_write_master_key ( hdb_master_key /*mkey*/); void -initialize_hdb_error_table (void); - -void initialize_hdb_error_table_r (struct et_list **/*list*/); HDBFlags diff --git a/source4/heimdal/lib/hdb/hdb.c b/source4/heimdal/lib/hdb/hdb.c index df342ffadf..5631d05332 100644 --- a/source4/heimdal/lib/hdb/hdb.c +++ b/source4/heimdal/lib/hdb/hdb.c @@ -33,7 +33,7 @@ #include "hdb_locl.h" -RCSID("$Id: hdb.c,v 1.59 2005/11/30 12:22:09 lha Exp $"); +RCSID("$Id: hdb.c,v 1.60 2005/12/12 12:35:36 lha Exp $"); #ifdef HAVE_DLFCN_H #include <dlfcn.h> @@ -133,25 +133,18 @@ hdb_unlock(int fd) } void -hdb_free_entry(krb5_context context, hdb_entry *ent) +hdb_free_entry(krb5_context context, hdb_entry_ex *ent) { int i; - for(i = 0; i < ent->keys.len; ++i) { - Key *k = &ent->keys.val[i]; + if (ent->free_entry) + (*ent->free_entry)(context, ent); - memset (k->key.keyvalue.data, 0, k->key.keyvalue.length); - } - free_hdb_entry(ent); -} + for(i = 0; i < ent->entry.keys.len; ++i) { + Key *k = &ent->entry.keys.val[i]; -void -hdb_free_entry_ex(krb5_context context, hdb_entry_ex *ent) -{ - if (ent->free_private) { - ent->free_private(context, ent); + memset (k->key.keyvalue.data, 0, k->key.keyvalue.length); } - free_hdb_entry(&ent->entry); } @@ -163,7 +156,7 @@ hdb_foreach(krb5_context context, void *data) { krb5_error_code ret; - hdb_entry entry; + hdb_entry_ex entry; ret = db->hdb_firstkey(context, db, flags, &entry); while(ret == 0){ ret = (*func)(context, db, &entry, data); diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h index 45ea5a9f30..463cbf71f2 100644 --- a/source4/heimdal/lib/hdb/hdb.h +++ b/source4/heimdal/lib/hdb/hdb.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $Id: hdb.h,v 1.35 2005/08/11 13:16:44 lha Exp $ */ +/* $Id: hdb.h,v 1.36 2005/12/12 12:35:36 lha Exp $ */ #ifndef __HDB_H__ #define __HDB_H__ @@ -55,27 +55,30 @@ enum hdb_ent_type{ HDB_ENT_TYPE_CLIENT, HDB_ENT_TYPE_SERVER, HDB_ENT_TYPE_ANY }; typedef struct hdb_master_key_data *hdb_master_key; typedef struct hdb_entry_ex { - struct hdb_entry entry; - void *private; - - krb5_error_code (*free_private)(krb5_context, struct hdb_entry_ex *); - krb5_error_code (*check_client_access)(krb5_context, struct hdb_entry_ex *, HostAddresses *); - krb5_error_code (*authz_data_as_req)(krb5_context, struct hdb_entry_ex *, - METHOD_DATA* pa_data_seq, - time_t authtime, - EncryptionKey *tgtkey, - EncryptionKey *sessionkey, - AuthorizationData **out); - krb5_error_code (*authz_data_tgs_req)(krb5_context, struct hdb_entry_ex *, - krb5_principal client, - AuthorizationData *in, - time_t authtime, - EncryptionKey *tgtkey, - EncryptionKey *servicekey, - EncryptionKey *sessionkey, - AuthorizationData **out); + void *ctx; + hdb_entry entry; + void (*free_entry)(krb5_context, struct hdb_entry_ex *); + krb5_error_code (*check_client_access)(krb5_context, struct hdb_entry_ex *, + HostAddresses *); + krb5_error_code (*authz_data_as_req)(krb5_context, + struct hdb_entry_ex *, + METHOD_DATA* pa_data_seq, + time_t authtime, + EncryptionKey *tgtkey, + EncryptionKey *sessionkey, + AuthorizationData **out); + krb5_error_code (*authz_data_tgs_req)(krb5_context, + struct hdb_entry_ex *, + krb5_principal client, + AuthorizationData *in, + time_t authtime, + EncryptionKey *tgtkey, + EncryptionKey *servicekey, + EncryptionKey *sessionkey, + AuthorizationData **out); } hdb_entry_ex; + typedef struct HDB{ void *hdb_db; void *hdb_dbc; @@ -86,16 +89,17 @@ typedef struct HDB{ krb5_error_code (*hdb_open)(krb5_context, struct HDB*, int, mode_t); krb5_error_code (*hdb_close)(krb5_context, struct HDB*); - krb5_error_code (*hdb_fetch)(krb5_context,struct HDB*,unsigned hdb_flags, krb5_const_principal principal, - enum hdb_ent_type ent_type, hdb_entry*); - krb5_error_code (*hdb_fetch_ex)(krb5_context,struct HDB*,unsigned hdb_flags, krb5_const_principal principal, + void (*hdb_free)(krb5_context,struct HDB*,hdb_entry_ex*); + krb5_error_code (*hdb_fetch)(krb5_context,struct HDB*,unsigned hdb_flags, + krb5_const_principal principal, enum hdb_ent_type ent_type, hdb_entry_ex*); - krb5_error_code (*hdb_store)(krb5_context,struct HDB*,unsigned,hdb_entry*); - krb5_error_code (*hdb_remove)(krb5_context, struct HDB*, hdb_entry*); - krb5_error_code (*hdb_firstkey)(krb5_context, struct HDB*, - unsigned, hdb_entry*); - krb5_error_code (*hdb_nextkey)(krb5_context, struct HDB*, - unsigned, hdb_entry*); + krb5_error_code (*hdb_store)(krb5_context,struct HDB*, + unsigned,hdb_entry_ex*); + krb5_error_code (*hdb_remove)(krb5_context, struct HDB*, hdb_entry_ex*); + krb5_error_code (*hdb_firstkey)(krb5_context, struct HDB*, + unsigned, hdb_entry_ex*); + krb5_error_code (*hdb_nextkey)(krb5_context, struct HDB*, + unsigned, hdb_entry_ex*); krb5_error_code (*hdb_lock)(krb5_context, struct HDB*, int operation); krb5_error_code (*hdb_unlock)(krb5_context, struct HDB*); krb5_error_code (*hdb_rename)(krb5_context, struct HDB*, const char*); @@ -119,7 +123,7 @@ struct hdb_so_method { #define HDB_DB_FORMAT_ENTRY "hdb/db-format" typedef krb5_error_code (*hdb_foreach_func_t)(krb5_context, HDB*, - hdb_entry*, void*); + hdb_entry_ex*, void*); extern krb5_kt_ops hdb_kt_ops; #include <hdb-protos.h> diff --git a/source4/heimdal/lib/hdb/ndbm.c b/source4/heimdal/lib/hdb/ndbm.c index 793d03829d..f4c2497abc 100644 --- a/source4/heimdal/lib/hdb/ndbm.c +++ b/source4/heimdal/lib/hdb/ndbm.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "hdb_locl.h" -RCSID("$Id: ndbm.c,v 1.36 2005/11/28 23:31:36 lha Exp $"); +RCSID("$Id: ndbm.c,v 1.38 2005/12/13 11:54:10 lha Exp $"); #if HAVE_NDBM @@ -77,7 +77,7 @@ NDBM_unlock(krb5_context context, HDB *db) static krb5_error_code NDBM_seq(krb5_context context, HDB *db, - unsigned flags, hdb_entry *entry, int first) + unsigned flags, hdb_entry_ex *entry, int first) { struct ndbm_db *d = (struct ndbm_db *)db->hdb_db; @@ -99,21 +99,22 @@ NDBM_seq(krb5_context context, HDB *db, db->hdb_unlock(context, db); data.data = value.dptr; data.length = value.dsize; - if(hdb_value2entry(context, &data, entry)) + memset(entry, 0, sizeof(*entry)); + if(hdb_value2entry(context, &data, &entry->entry)) return NDBM_seq(context, db, flags, entry, 0); if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) { - ret = hdb_unseal_keys (context, db, entry); + ret = hdb_unseal_keys (context, db, &entry->entry); if (ret) hdb_free_entry (context, entry); } - if (entry->principal == NULL) { - entry->principal = malloc (sizeof(*entry->principal)); - if (entry->principal == NULL) { + if (ret == 0 && entry->entry.principal == NULL) { + entry->entry.principal = malloc (sizeof(*entry->entry.principal)); + if (entry->entry.principal == NULL) { ret = ENOMEM; hdb_free_entry (context, entry); krb5_set_error_string(context, "malloc: out of memory"); } else { - hdb_key2principal (context, &key_data, entry->principal); + hdb_key2principal (context, &key_data, entry->entry.principal); } } return ret; @@ -121,14 +122,14 @@ NDBM_seq(krb5_context context, HDB *db, static krb5_error_code -NDBM_firstkey(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) +NDBM_firstkey(krb5_context context, HDB *db,unsigned flags,hdb_entry_ex *entry) { return NDBM_seq(context, db, flags, entry, 1); } static krb5_error_code -NDBM_nextkey(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) +NDBM_nextkey(krb5_context context, HDB *db, unsigned flags,hdb_entry_ex *entry) { return NDBM_seq(context, db, flags, entry, 0); } @@ -339,8 +340,6 @@ hdb_ndbm_create(krb5_context context, HDB **db, return ENOMEM; } - memset(*db, '\0', sizeof(**db)); - (*db)->hdb_db = NULL; (*db)->hdb_name = strdup(filename); if ((*db)->hdb_name == NULL) { diff --git a/source4/heimdal/lib/krb5/cache.c b/source4/heimdal/lib/krb5/cache.c index 0c821cb11d..efb2ad1374 100644 --- a/source4/heimdal/lib/krb5/cache.c +++ b/source4/heimdal/lib/krb5/cache.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$Id: cache.c,v 1.76 2005/11/29 09:10:47 lha Exp $"); +RCSID("$Id: cache.c,v 1.77 2005/12/13 15:42:36 lha Exp $"); /* * Add a new ccache type with operations `ops', overwriting any @@ -358,14 +358,12 @@ krb5_cc_set_default_name(krb5_context context, const char *name) if (e == NULL) { e = krb5_config_get_string(context, NULL, "libdefaults", "default_cc_name", NULL); - if (e) { - ret = _krb5_expand_default_cc_name(context, e, &p); - if (ret) - return ret; - } + if (e == NULL) + e = KRB5_DEFAULT_CCNAME; + ret = _krb5_expand_default_cc_name(context, e, &p); + if (ret) + return ret; } - if (e == NULL) - asprintf(&p,"FILE:/tmp/krb5cc_%u", (unsigned)getuid()); } else p = strdup(name); diff --git a/source4/heimdal/lib/krb5/changepw.c b/source4/heimdal/lib/krb5/changepw.c index c3cd6d4db9..7907e1ad9c 100644 --- a/source4/heimdal/lib/krb5/changepw.c +++ b/source4/heimdal/lib/krb5/changepw.c @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$Id: changepw.c,v 1.54 2005/09/08 11:38:01 lha Exp $"); +RCSID("$Id: changepw.c,v 1.55 2005/12/12 12:48:57 lha Exp $"); static void str2data (krb5_data *d, @@ -522,7 +522,12 @@ change_password_loop (krb5_context context, int sock; int i; int done = 0; - krb5_realm realm = creds->client->realm; + krb5_realm realm; + + if (targprinc) + realm = targprinc->realm; + else + realm = creds->client->realm; ret = krb5_auth_con_init (context, &auth_context); if (ret) @@ -712,7 +717,7 @@ krb5_set_password(krb5_context context, for (i = 0; procs[i].name != NULL; i++) { *result_code = 0; - ret = change_password_loop(context, creds, targprinc, newpw, + ret = change_password_loop(context, creds, principal, newpw, result_code, result_code_string, result_string, &procs[i]); diff --git a/source4/heimdal/lib/krb5/crypto.c b/source4/heimdal/lib/krb5/crypto.c index 2e23306c96..de40b059b8 100644 --- a/source4/heimdal/lib/krb5/crypto.c +++ b/source4/heimdal/lib/krb5/crypto.c @@ -32,7 +32,7 @@ */ #include "krb5_locl.h" -RCSID("$Id: crypto.c,v 1.129 2005/09/19 22:13:54 lha Exp $"); +RCSID("$Id: crypto.c,v 1.130 2005/12/02 14:47:44 lha Exp $"); #undef CRYPTO_DEBUG #ifdef CRYPTO_DEBUG @@ -3942,6 +3942,8 @@ krb5_derive_key(krb5_context context, struct encryption_type *et; struct key_data d; + *derived_key = NULL; + et = _find_enctype (etype); if (et == NULL) { krb5_set_error_string(context, "encryption type %d not supported", @@ -3949,16 +3951,15 @@ krb5_derive_key(krb5_context context, return KRB5_PROG_ETYPE_NOSUPP; } - ret = krb5_copy_keyblock(context, key, derived_key); + ret = krb5_copy_keyblock(context, key, &d.key); if (ret) return ret; - d.key = *derived_key; d.schedule = NULL; ret = derive_key(context, et, &d, constant, constant_len); - if (ret) - return ret; - ret = krb5_copy_keyblock(context, d.key, derived_key); + if (ret == 0) + ret = krb5_copy_keyblock(context, d.key, derived_key); + free_key_data(context, &d); return ret; } diff --git a/source4/heimdal/lib/krb5/keytab_memory.c b/source4/heimdal/lib/krb5/keytab_memory.c index 1039847de9..fa54ff43ce 100644 --- a/source4/heimdal/lib/krb5/keytab_memory.c +++ b/source4/heimdal/lib/krb5/keytab_memory.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$Id: keytab_memory.c,v 1.7 2005/12/01 12:40:22 lha Exp $"); +RCSID("$Id: keytab_memory.c,v 1.8 2005/12/05 18:39:46 lha Exp $"); /* memory operations -------------------------------------------- */ @@ -214,15 +214,9 @@ mkt_remove_entry(krb5_context context, krb5_clear_error_string (context); return KRB5_KT_NOTFOUND; } - if (d->num_entries == 0) { - free(d->entries); - d->entries = NULL; - } else { - e = realloc(d->entries, d->num_entries * sizeof(*d->entries)); - if(e != NULL) - d->entries = e; - } - + e = realloc(d->entries, d->num_entries * sizeof(*d->entries)); + if(e != NULL || d->num_entries == 0) + d->entries = e; return 0; } diff --git a/source4/heimdal/lib/krb5/krb5-protos.h b/source4/heimdal/lib/krb5/krb5-protos.h index 301b8853e4..c08d8058a4 100644 --- a/source4/heimdal/lib/krb5/krb5-protos.h +++ b/source4/heimdal/lib/krb5/krb5-protos.h @@ -21,21 +21,12 @@ extern "C" { #endif void -initialize_heim_error_table (void); - -void initialize_heim_error_table_r (struct et_list **/*list*/); void -initialize_k524_error_table (void); - -void initialize_k524_error_table_r (struct et_list **/*list*/); void -initialize_krb5_error_table (void); - -void initialize_krb5_error_table_r (struct et_list **/*list*/); krb5_error_code KRB5_LIB_FUNCTION diff --git a/source4/heimdal/lib/krb5/krb5_locl.h b/source4/heimdal/lib/krb5/krb5_locl.h index 4a02677239..60d72c8f80 100644 --- a/source4/heimdal/lib/krb5/krb5_locl.h +++ b/source4/heimdal/lib/krb5/krb5_locl.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $Id: krb5_locl.h,v 1.83 2005/10/07 12:08:02 lha Exp $ */ +/* $Id: krb5_locl.h,v 1.84 2005/12/13 15:40:50 lha Exp $ */ #ifndef __KRB5_LOCL_H__ #define __KRB5_LOCL_H__ @@ -170,6 +170,14 @@ struct _krb5_krb_auth_data; #define KRB5_BUFSIZ 1024 +#ifndef KRB5_DEFAULT_CCNAME +#ifdef __APPLE__ +#define KRB5_DEFAULT_CCNAME "API:" +#else +#define KRB5_DEFAULT_CCNAME "FILE:/tmp/krb5cc_%{uid}" +#endif +#endif + typedef enum { KRB5_PA_PAC_DONT_CARE = 0, KRB5_PA_PAC_REQ_TRUE, diff --git a/source4/heimdal/lib/krb5/principal.c b/source4/heimdal/lib/krb5/principal.c index ae5c8c1de8..6cc49945cc 100644 --- a/source4/heimdal/lib/krb5/principal.c +++ b/source4/heimdal/lib/krb5/principal.c @@ -41,7 +41,7 @@ #include <fnmatch.h> #include "resolve.h" -RCSID("$Id: principal.c,v 1.91 2005/08/23 08:34:40 lha Exp $"); +RCSID("$Id: principal.c,v 1.92 2005/12/11 17:48:13 lha Exp $"); #define princ_num_comp(P) ((P)->name.name_string.len) #define princ_type(P) ((P)->name.name_type) diff --git a/source4/heimdal/lib/krb5/set_default_realm.c b/source4/heimdal/lib/krb5/set_default_realm.c index 965883309c..fd57b6fe67 100644 --- a/source4/heimdal/lib/krb5/set_default_realm.c +++ b/source4/heimdal/lib/krb5/set_default_realm.c @@ -77,8 +77,19 @@ krb5_set_default_realm(krb5_context context, "libdefaults", "default_realm", NULL); - if (realms == NULL) - ret = krb5_get_host_realm(context, NULL, &realms); + if (realms == NULL) { + char hostname[MAXHOSTNAMELEN]; + if (gethostname (hostname, sizeof(hostname))) { + return errno; + } + + if (strchr(hostname, '.') == NULL) { + /* There is no way we can get this mapping, as we can't do DNS */ + return KRB5_CONFIG_NODEFREALM; + } + ret = krb5_get_host_realm(context, hostname, + &realms); + } } else { ret = string_to_list (context, realm, &realms); } diff --git a/source4/heimdal_build/config.h b/source4/heimdal_build/config.h index 660739c73f..d2a72cacfb 100644 --- a/source4/heimdal_build/config.h +++ b/source4/heimdal_build/config.h @@ -62,6 +62,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } #ifndef HAVE_STRNDUP #define HAVE_STRNDUP #endif +#ifndef HAVE_SOCKLEN_T +#define HAVE_SOCKLEN_T +#endif #ifndef HAVE_SSIZE_T #define HAVE_SSIZE_T diff --git a/source4/heimdal_build/config.m4 b/source4/heimdal_build/config.m4 index fb4f27387f..92e38e42c2 100644 --- a/source4/heimdal_build/config.m4 +++ b/source4/heimdal_build/config.m4 @@ -139,6 +139,7 @@ AC_HAVE_TYPE([struct sockaddr], [#include <sys/socket.h>]) AC_HAVE_TYPE([struct sockaddr_storage], [#include <sys/socket.h>]) AC_HAVE_TYPE([struct addrinfo], [#include <netdb.h>]) AC_HAVE_TYPE([struct ifaddrs], [#include <ifaddrs.h>]) +AC_HAVE_TYPE([socklen_t],[#include <sys/socket.h>]) AC_DEFUN([AC_KRB_STRUCT_WINSIZE], [ diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c index 9b1d673764..3862ec7f99 100644 --- a/source4/kdc/hdb-ldb.c +++ b/source4/kdc/hdb-ldb.c @@ -198,10 +198,17 @@ static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum h return flags; } -static krb5_error_code hdb_ldb_free_private(krb5_context context, hdb_entry_ex *entry_ex) +static int hdb_ldb_destrutor(void *ptr) { - talloc_free(entry_ex->private); - return 0; + struct hdb_ldb_private *private = ptr; + hdb_entry_ex *entry_ex = private->entry_ex; + free_hdb_entry(&entry_ex->entry); + return 0; +} + +static void hdb_ldb_free_entry(krb5_context context, hdb_entry_ex *entry_ex) +{ + talloc_free(entry_ex->ctx); } /* @@ -223,10 +230,9 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, struct ldb_dn *domain_dn = samdb_result_dn(mem_ctx, realm_ref_msg, "nCName", ldb_dn_new(mem_ctx)); struct hdb_ldb_private *private; - hdb_entry *ent = &entry_ex->entry; NTTIME acct_expiry; - memset(ent, 0, sizeof(*ent)); + memset(entry_ex, 0, sizeof(*entry_ex)); krb5_warnx(context, "LDB_message2entry:\n"); @@ -236,9 +242,22 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, goto out; } + private = talloc(mem_ctx, struct hdb_ldb_private); + if (!private) { + ret = ENOMEM; + goto out; + } + + private->entry_ex = entry_ex; + + talloc_set_destructor(private, hdb_ldb_destrutor); + + entry_ex->ctx = private; + entry_ex->free_entry = hdb_ldb_free_entry; + userAccountControl = ldb_msg_find_uint(msg, "userAccountControl", 0); - ent->principal = malloc(sizeof(*(ent->principal))); + entry_ex->entry.principal = malloc(sizeof(*(entry_ex->entry.principal))); if (ent_type == HDB_LDB_ENT_TYPE_ANY && principal == NULL) { const char *samAccountName = ldb_msg_find_string(msg, "samAccountName", NULL); if (!samAccountName) { @@ -247,10 +266,10 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, goto out; } samAccountName = ldb_msg_find_string(msg, "samAccountName", NULL); - krb5_make_principal(context, &ent->principal, realm, samAccountName, NULL); + krb5_make_principal(context, &entry_ex->entry.principal, realm, samAccountName, NULL); } else { char *strdup_realm; - ret = copy_Principal(principal, ent->principal); + ret = copy_Principal(principal, entry_ex->entry.principal); if (ret) { krb5_clear_error_string(context); goto out; @@ -263,7 +282,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, * we determine from our records */ /* don't leak */ - free(*krb5_princ_realm(context, ent->principal)); + free(*krb5_princ_realm(context, entry_ex->entry.principal)); /* this has to be with malloc() */ strdup_realm = strdup(realm); @@ -272,56 +291,56 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, krb5_clear_error_string(context); goto out; } - krb5_princ_set_realm(context, ent->principal, &strdup_realm); + krb5_princ_set_realm(context, entry_ex->entry.principal, &strdup_realm); } - ent->kvno = ldb_msg_find_int(msg, "msDS-KeyVersionNumber", 0); + entry_ex->entry.kvno = ldb_msg_find_int(msg, "msDS-KeyVersionNumber", 0); - ent->flags = uf2HDBFlags(context, userAccountControl, ent_type); + entry_ex->entry.flags = uf2HDBFlags(context, userAccountControl, ent_type); if (ent_type == HDB_LDB_ENT_TYPE_KRBTGT) { - ent->flags.invalid = 0; - ent->flags.server = 1; - ent->flags.forwardable = 1; - ent->flags.ok_as_delegate = 1; + entry_ex->entry.flags.invalid = 0; + entry_ex->entry.flags.server = 1; + entry_ex->entry.flags.forwardable = 1; + entry_ex->entry.flags.ok_as_delegate = 1; } if (lp_parm_bool(-1, "kdc", "require spn for service", True)) { if (!ldb_msg_find_string(msg, "servicePrincipalName", NULL)) { - ent->flags.server = 0; + entry_ex->entry.flags.server = 0; } } /* use 'whenCreated' */ - ent->created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0); + entry_ex->entry.created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0); /* use '???' */ - ent->created_by.principal = NULL; + entry_ex->entry.created_by.principal = NULL; - ent->modified_by = (Event *) malloc(sizeof(Event)); - if (ent->modified_by == NULL) { + entry_ex->entry.modified_by = (Event *) malloc(sizeof(Event)); + if (entry_ex->entry.modified_by == NULL) { krb5_set_error_string(context, "malloc: out of memory"); ret = ENOMEM; goto out; } /* use 'whenChanged' */ - ent->modified_by->time = ldb_msg_find_krb5time_ldap_time(msg, "whenChanged", 0); + entry_ex->entry.modified_by->time = ldb_msg_find_krb5time_ldap_time(msg, "whenChanged", 0); /* use '???' */ - ent->modified_by->principal = NULL; + entry_ex->entry.modified_by->principal = NULL; - ent->valid_start = NULL; + entry_ex->entry.valid_start = NULL; acct_expiry = samdb_result_nttime(msg, "accountExpires", (NTTIME)-1); if ((acct_expiry == (NTTIME)-1) || (acct_expiry == 0x7FFFFFFFFFFFFFFFULL)) { - ent->valid_end = NULL; + entry_ex->entry.valid_end = NULL; } else { - ent->valid_end = malloc(sizeof(*ent->valid_end)); - if (ent->valid_end == NULL) { + entry_ex->entry.valid_end = malloc(sizeof(*entry_ex->entry.valid_end)); + if (entry_ex->entry.valid_end == NULL) { ret = ENOMEM; goto out; } - *ent->valid_end = nt_time_to_unix(acct_expiry); + *entry_ex->entry.valid_end = nt_time_to_unix(acct_expiry); } if ((ent_type != HDB_LDB_ENT_TYPE_KRBTGT) && (!(userAccountControl & UF_DONT_EXPIRE_PASSWD))) { @@ -330,24 +349,24 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, domain_dn, msg, "pwdLastSet"); if (must_change_time != 0) { - ent->pw_end = malloc(sizeof(*ent->pw_end)); - if (ent->pw_end == NULL) { + entry_ex->entry.pw_end = malloc(sizeof(*entry_ex->entry.pw_end)); + if (entry_ex->entry.pw_end == NULL) { ret = ENOMEM; goto out; } - *ent->pw_end = nt_time_to_unix(must_change_time); + *entry_ex->entry.pw_end = nt_time_to_unix(must_change_time); } else { - ent->pw_end = NULL; + entry_ex->entry.pw_end = NULL; } } else { - ent->pw_end = NULL; + entry_ex->entry.pw_end = NULL; } - ent->max_life = NULL; + entry_ex->entry.max_life = NULL; - ent->max_renew = NULL; + entry_ex->entry.max_renew = NULL; - ent->generation = NULL; + entry_ex->entry.generation = NULL; /* create the keys and enctypes */ unicodePwd = ldb_msg_find_string(msg, "unicodePwd", NULL); @@ -399,21 +418,21 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, } if (ret == 0) { - size_t num_keys = ent->keys.len; + size_t num_keys = entry_ex->entry.keys.len; /* * create keys from unicodePwd */ ret = hdb_generate_key_set_password(context, salt_principal, unicodePwd, - &ent->keys.val, &num_keys); - ent->keys.len = num_keys; + &entry_ex->entry.keys.val, &num_keys); + entry_ex->entry.keys.len = num_keys; krb5_free_principal(context, salt_principal); } if (ret != 0) { krb5_warnx(context, "could not generate keys from unicodePwd\n"); - ent->keys.val = NULL; - ent->keys.len = 0; + entry_ex->entry.keys.val = NULL; + entry_ex->entry.keys.len = 0; goto out; } } else { @@ -423,11 +442,11 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, val = ldb_msg_find_ldb_val(msg, "ntPwdHash"); if (!val) { krb5_warnx(context, "neither type of key available for this account\n"); - ent->keys.val = NULL; - ent->keys.len = 0; + entry_ex->entry.keys.val = NULL; + entry_ex->entry.keys.len = 0; } else if (val->length < 16) { - ent->keys.val = NULL; - ent->keys.len = 0; + entry_ex->entry.keys.val = NULL; + entry_ex->entry.keys.len = 0; krb5_warnx(context, "ntPwdHash has invalid length: %d\n", (int)val->length); } else { @@ -440,53 +459,45 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, memcpy(keyvalue.data, val->data, 16); - ent->keys.val = malloc(sizeof(ent->keys.val[0])); - if (ent->keys.val == NULL) { + entry_ex->entry.keys.val = malloc(sizeof(entry_ex->entry.keys.val[0])); + if (entry_ex->entry.keys.val == NULL) { krb5_data_free(&keyvalue); krb5_clear_error_string(context); ret = ENOMEM; goto out; } - memset(&ent->keys.val[0], 0, sizeof(Key)); - ent->keys.val[0].key.keytype = ETYPE_ARCFOUR_HMAC_MD5; - ent->keys.val[0].key.keyvalue = keyvalue; + memset(&entry_ex->entry.keys.val[0], 0, sizeof(Key)); + entry_ex->entry.keys.val[0].key.keytype = ETYPE_ARCFOUR_HMAC_MD5; + entry_ex->entry.keys.val[0].key.keyvalue = keyvalue; - ent->keys.len = 1; + entry_ex->entry.keys.len = 1; } } - ent->etypes = malloc(sizeof(*(ent->etypes))); - if (ent->etypes == NULL) { + entry_ex->entry.etypes = malloc(sizeof(*(entry_ex->entry.etypes))); + if (entry_ex->entry.etypes == NULL) { krb5_clear_error_string(context); ret = ENOMEM; goto out; } - ent->etypes->len = ent->keys.len; - ent->etypes->val = calloc(ent->etypes->len, sizeof(int)); - if (ent->etypes->val == NULL) { + entry_ex->entry.etypes->len = entry_ex->entry.keys.len; + entry_ex->entry.etypes->val = calloc(entry_ex->entry.etypes->len, sizeof(int)); + if (entry_ex->entry.etypes->val == NULL) { krb5_clear_error_string(context); ret = ENOMEM; goto out; } - for (i=0; i < ent->etypes->len; i++) { - ent->etypes->val[i] = ent->keys.val[i].key.keytype; + for (i=0; i < entry_ex->entry.etypes->len; i++) { + entry_ex->entry.etypes->val[i] = entry_ex->entry.keys.val[i].key.keytype; } - private = talloc(db, struct hdb_ldb_private); - if (!private) { - ret = ENOMEM; - goto out; - } - private->msg = talloc_steal(private, msg); private->realm_ref_msg = talloc_steal(private, realm_ref_msg); private->samdb = (struct ldb_context *)db->hdb_db; - entry_ex->private = private; - entry_ex->free_private = hdb_ldb_free_private; entry_ex->check_client_access = hdb_ldb_check_client_access; entry_ex->authz_data_tgs_req = hdb_ldb_authz_data_tgs_req; entry_ex->authz_data_as_req = hdb_ldb_authz_data_as_req; @@ -494,7 +505,9 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, out: if (ret != 0) { /* This doesn't free ent itself, that is for the eventual caller to do */ - hdb_free_entry(context, &entry_ex->entry); + hdb_free_entry(context, entry_ex); + } else { + talloc_steal(db, entry_ex->ctx); } return ret; @@ -669,10 +682,10 @@ static krb5_error_code LDB_rename(krb5_context context, HDB *db, const char *new return HDB_ERR_DB_INUSE; } -static krb5_error_code LDB_fetch_ex(krb5_context context, HDB *db, unsigned flags, - krb5_const_principal principal, - enum hdb_ent_type ent_type, - hdb_entry_ex *entry_ex) +static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, + krb5_const_principal principal, + enum hdb_ent_type ent_type, + hdb_entry_ex *entry_ex) { struct ldb_message **msg = NULL; struct ldb_message **realm_ref_msg = NULL; @@ -860,32 +873,12 @@ static krb5_error_code LDB_fetch_ex(krb5_context context, HDB *db, unsigned flag return ret; } -static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, - krb5_const_principal principal, - enum hdb_ent_type ent_type, - hdb_entry *entry) -{ - struct hdb_entry_ex entry_ex; - krb5_error_code ret; - - memset(&entry_ex, '\0', sizeof(entry_ex)); - ret = LDB_fetch_ex(context, db, flags, principal, ent_type, &entry_ex); - - if (ret == 0) { - if (entry_ex.free_private) { - entry_ex.free_private(context, &entry_ex); - } - *entry = entry_ex.entry; - } - return ret; -} - -static krb5_error_code LDB_store(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) +static krb5_error_code LDB_store(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry) { return HDB_ERR_DB_INUSE; } -static krb5_error_code LDB_remove(krb5_context context, HDB *db, hdb_entry *entry) +static krb5_error_code LDB_remove(krb5_context context, HDB *db, hdb_entry_ex *entry) { return HDB_ERR_DB_INUSE; } @@ -898,7 +891,7 @@ struct hdb_ldb_seq { struct ldb_message **realm_ref_msgs; }; -static krb5_error_code LDB_seq(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) +static krb5_error_code LDB_seq(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry) { krb5_error_code ret; struct hdb_ldb_seq *priv = (struct hdb_ldb_seq *)db->hdb_openp; @@ -921,13 +914,7 @@ static krb5_error_code LDB_seq(krb5_context context, HDB *db, unsigned flags, hd ret = LDB_message2entry(context, db, mem_ctx, NULL, HDB_LDB_ENT_TYPE_ANY, priv->msgs[priv->index++], - priv->realm_ref_msgs[0], &entry_ex); - if (ret == 0) { - if (entry_ex.free_private) { - entry_ex.free_private(context, &entry_ex); - } - *entry = entry_ex.entry; - } + priv->realm_ref_msgs[0], entry); } else { ret = HDB_ERR_NOENTRY; } @@ -943,7 +930,7 @@ static krb5_error_code LDB_seq(krb5_context context, HDB *db, unsigned flags, hd } static krb5_error_code LDB_firstkey(krb5_context context, HDB *db, unsigned flags, - hdb_entry *entry) + hdb_entry_ex *entry) { struct ldb_context *ldb_ctx = (struct ldb_context *)db->hdb_db; struct hdb_ldb_seq *priv = (struct hdb_ldb_seq *)db->hdb_openp; @@ -1028,7 +1015,7 @@ static krb5_error_code LDB_firstkey(krb5_context context, HDB *db, unsigned flag } static krb5_error_code LDB_nextkey(krb5_context context, HDB *db, unsigned flags, - hdb_entry *entry) + hdb_entry_ex *entry) { return LDB_seq(context, db, flags, entry); } @@ -1083,7 +1070,6 @@ NTSTATUS hdb_ldb_create(TALLOC_CTX *mem_ctx, (*db)->hdb_open = LDB_open; (*db)->hdb_close = LDB_close; (*db)->hdb_fetch = LDB_fetch; - (*db)->hdb_fetch_ex = LDB_fetch_ex; (*db)->hdb_store = LDB_store; (*db)->hdb_remove = LDB_remove; (*db)->hdb_firstkey = LDB_firstkey; diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c index 79e7b3c5a7..a3dec8c46d 100644 --- a/source4/kdc/pac-glue.c +++ b/source4/kdc/pac-glue.c @@ -157,7 +157,7 @@ krb5_error_code hdb_ldb_authz_data_as_req(krb5_context context, struct hdb_entry krb5_boolean pac_wanted = TRUE; unsigned int userAccountControl; struct PA_PAC_REQUEST pac_request; - struct hdb_ldb_private *private = talloc_get_type(entry_ex->private, struct hdb_ldb_private); + struct hdb_ldb_private *private = talloc_get_type(entry_ex->ctx, struct hdb_ldb_private); /* The user account may be set not to want the PAC */ userAccountControl = ldb_msg_find_uint(private->msg, "userAccountControl", 0); @@ -218,7 +218,7 @@ krb5_error_code hdb_ldb_authz_data_tgs_req(krb5_context context, struct hdb_entr unsigned int userAccountControl; - struct hdb_ldb_private *private = talloc_get_type(entry_ex->private, struct hdb_ldb_private); + struct hdb_ldb_private *private = talloc_get_type(entry_ex->ctx, struct hdb_ldb_private); krb5_data k5pac_in, k5pac_out; DATA_BLOB pac_in, pac_out; @@ -321,8 +321,8 @@ krb5_error_code hdb_ldb_check_client_access(krb5_context context, hdb_entry_ex * { krb5_error_code ret; NTSTATUS nt_status; - TALLOC_CTX *tmp_ctx = talloc_new(entry_ex->private); - struct hdb_ldb_private *private = talloc_get_type(entry_ex->private, struct hdb_ldb_private); + TALLOC_CTX *tmp_ctx = talloc_new(entry_ex->ctx); + struct hdb_ldb_private *private = talloc_get_type(entry_ex->ctx, struct hdb_ldb_private); char *name, *workstation = NULL; int i; diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h index 953ddae815..e5b1960209 100644 --- a/source4/kdc/pac-glue.h +++ b/source4/kdc/pac-glue.h @@ -25,6 +25,7 @@ struct ldb_context *samdb; struct ldb_message *msg; struct ldb_message *realm_ref_msg; + hdb_entry_ex *entry_ex; }; krb5_error_code hdb_ldb_authz_data_as_req(krb5_context context, struct hdb_entry_ex *entry_ex, |