diff options
58 files changed, 1145 insertions, 786 deletions
diff --git a/source4/heimdal/kdc/default_config.c b/source4/heimdal/kdc/default_config.c index e06366f214..5f336e3275 100644 --- a/source4/heimdal/kdc/default_config.c +++ b/source4/heimdal/kdc/default_config.c @@ -36,7 +36,7 @@ #include <getarg.h> #include <parse_bytes.h> -RCSID("$Id: default_config.c 21296 2007-06-25 14:49:11Z lha $"); +RCSID("$Id: default_config.c 21405 2007-07-04 10:35:45Z lha $"); krb5_error_code krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config) diff --git a/source4/heimdal/kdc/digest.c b/source4/heimdal/kdc/digest.c index 801449fe5e..358ca5ad56 100644 --- a/source4/heimdal/kdc/digest.c +++ b/source4/heimdal/kdc/digest.c @@ -34,7 +34,7 @@ #include "kdc_locl.h" #include <hex.h> -RCSID("$Id: digest.c 21241 2007-06-20 11:30:19Z lha $"); +RCSID("$Id: digest.c 21606 2007-07-17 07:03:25Z lha $"); #define MS_CHAP_V2 0x20 #define CHAP_MD5 0x10 @@ -975,7 +975,7 @@ _kdc_do_digest(krb5_context context, } kdc_log(context, config, 0, "Digest %s request successful %s", - ireq.u.digestRequest.type, from); + ireq.u.digestRequest.type, ireq.u.digestRequest.username); break; } @@ -1227,7 +1227,7 @@ _kdc_do_digest(krb5_context context, version = 1; if (flags & NTLM_NEG_NTLM2_SESSION) { - char sessionhash[MD5_DIGEST_LENGTH]; + unsigned char sessionhash[MD5_DIGEST_LENGTH]; MD5_CTX md5ctx; if ((config->digests_allowed & NTLM_V1_SESSION) == 0) { @@ -1331,10 +1331,24 @@ _kdc_do_digest(krb5_context context, version, ireq.u.ntlmRequest.username); break; } - default: + default: { + char *s; + krb5_set_error_string(context, "unknown operation to digest"); + ret = EINVAL; + failed: + + s = krb5_get_error_message(context, ret); + if (s == NULL) { + krb5_clear_error_string(context); + goto out; + } + + kdc_log(context, config, 0, "Digest failed with: %s", s); + r.element = choice_DigestRepInner_error; - r.u.error.reason = strdup("unknown/failed operation"); + r.u.error.reason = strdup("unknown error"); + krb5_free_error_string(context, s); if (r.u.error.reason == NULL) { krb5_set_error_string(context, "out of memory"); ret = ENOMEM; @@ -1343,6 +1357,7 @@ _kdc_do_digest(krb5_context context, r.u.error.code = EINVAL; break; } + } ASN1_MALLOC_ENCODE(DigestRepInner, buf.data, buf.length, &r, &size, ret); if (ret) { diff --git a/source4/heimdal/kdc/kaserver.c b/source4/heimdal/kdc/kaserver.c index deb32e1019..15624e8e76 100644 --- a/source4/heimdal/kdc/kaserver.c +++ b/source4/heimdal/kdc/kaserver.c @@ -33,7 +33,7 @@ #include "kdc_locl.h" -RCSID("$Id: kaserver.c 17904 2006-08-23 11:45:16Z lha $"); +RCSID("$Id: kaserver.c 21661 2007-07-22 01:57:17Z lha $"); #include <krb5-v4compat.h> #include <rx.h> @@ -191,19 +191,28 @@ init_reply_header (struct rx_header *hdr, reply_hdr->serviceid = hdr->serviceid; } +/* + * Create an error `reply´ using for the packet `hdr' with the error + * `error´ code. + */ static void make_error_reply (struct rx_header *hdr, - uint32_t ret, + uint32_t error, krb5_data *reply) { - krb5_storage *sp; struct rx_header reply_hdr; + krb5_error_code ret; + krb5_storage *sp; init_reply_header (hdr, &reply_hdr, HT_ABORT, HF_LAST); sp = krb5_storage_emem(); + if (sp == NULL) + return; ret = encode_rx_header (&reply_hdr, sp); - krb5_store_int32(sp, ret); + if (ret) + return; + krb5_store_int32(sp, error); krb5_storage_to_data (sp, reply); krb5_storage_free (sp); } diff --git a/source4/heimdal/kdc/kerberos4.c b/source4/heimdal/kdc/kerberos4.c index 3c76bb99b2..cbba64945b 100644 --- a/source4/heimdal/kdc/kerberos4.c +++ b/source4/heimdal/kdc/kerberos4.c @@ -35,7 +35,7 @@ #include <krb5-v4compat.h> -RCSID("$Id: kerberos4.c 18349 2006-10-08 13:43:52Z lha $"); +RCSID("$Id: kerberos4.c 21577 2007-07-16 08:14:06Z lha $"); #ifndef swap32 static uint32_t @@ -151,7 +151,8 @@ _kdc_do_version4(krb5_context context, if(!config->enable_v4) { kdc_log(context, config, 0, "Rejected version 4 request from %s", from); - make_err_reply(context, reply, KDC_GEN_ERR, "function not enabled"); + make_err_reply(context, reply, KRB4ET_KDC_GEN_ERR, + "Function not enabled"); return 0; } @@ -160,7 +161,7 @@ _kdc_do_version4(krb5_context context, if(pvno != 4){ kdc_log(context, config, 0, "Protocol version mismatch (krb4) (%d)", pvno); - make_err_reply(context, reply, KDC_PKT_VER, "protocol mismatch"); + make_err_reply(context, reply, KRB4ET_KDC_PKT_VER, "protocol mismatch"); goto out; } RCHECK(krb5_ret_int8(sp, &msg_type), out); @@ -196,7 +197,7 @@ _kdc_do_version4(krb5_context context, if(ret) { kdc_log(context, config, 0, "Client not found in database: %s: %s", client_name, krb5_get_err_text(context, ret)); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, "principal unknown"); goto out1; } @@ -205,7 +206,7 @@ _kdc_do_version4(krb5_context context, if(ret){ kdc_log(context, config, 0, "Server not found in database: %s: %s", server_name, krb5_get_err_text(context, ret)); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, "principal unknown"); goto out1; } @@ -216,7 +217,7 @@ _kdc_do_version4(krb5_context context, TRUE); if (ret) { /* good error code? */ - make_err_reply(context, reply, KERB_ERR_NAME_EXP, + make_err_reply(context, reply, KRB4ET_KDC_NAME_EXP, "operation not allowed"); goto out1; } @@ -227,7 +228,7 @@ _kdc_do_version4(krb5_context context, kdc_log(context, config, 0, "Per principal Kerberos 4 flag not turned on for %s", client_name); - make_err_reply(context, reply, KERB_ERR_NULL_KEY, + make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, "allow kerberos4 flag required"); goto out1; } @@ -244,7 +245,7 @@ _kdc_do_version4(krb5_context context, "Pre-authentication required for v4-request: " "%s for %s", client_name, server_name); - make_err_reply(context, reply, KERB_ERR_NULL_KEY, + make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, "preauth required"); goto out1; } @@ -252,7 +253,7 @@ _kdc_do_version4(krb5_context context, ret = _kdc_get_des_key(context, client, FALSE, FALSE, &ckey); if(ret){ kdc_log(context, config, 0, "no suitable DES key for client"); - make_err_reply(context, reply, KDC_NULL_KEY, + make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, "no suitable DES key for client"); goto out1; } @@ -265,7 +266,7 @@ _kdc_do_version4(krb5_context context, if(ret){ kdc_log(context, config, 0, "No version-4 salted key in database -- %s.%s@%s", name, inst, realm); - make_err_reply(context, reply, KDC_NULL_KEY, + make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, "No version-4 salted key in database"); goto out1; } @@ -274,8 +275,7 @@ _kdc_do_version4(krb5_context context, ret = _kdc_get_des_key(context, server, TRUE, FALSE, &skey); if(ret){ kdc_log(context, config, 0, "no suitable DES key for server"); - /* XXX */ - make_err_reply(context, reply, KDC_NULL_KEY, + make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, "no suitable DES key for server"); goto out1; } @@ -400,7 +400,7 @@ _kdc_do_version4(krb5_context context, "tgs-req (krb4) with old kvno %d (current %d) for " "krbtgt.%s@%s", kvno, tgt->entry.kvno % 256, realm, config->v4_realm); - make_err_reply(context, reply, KDC_AUTH_EXP, + make_err_reply(context, reply, KRB4ET_KDC_AUTH_EXP, "old krbtgt kvno used"); goto out2; } @@ -409,8 +409,7 @@ _kdc_do_version4(krb5_context context, if(ret){ kdc_log(context, config, 0, "no suitable DES key for krbtgt (krb4)"); - /* XXX */ - make_err_reply(context, reply, KDC_NULL_KEY, + make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, "no suitable DES key for krbtgt"); goto out2; } @@ -456,7 +455,7 @@ _kdc_do_version4(krb5_context context, if(strcmp(ad.prealm, realm)){ kdc_log(context, config, 0, "Can't hop realms (krb4) %s -> %s", realm, ad.prealm); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, "Can't hop realms"); goto out2; } @@ -465,7 +464,7 @@ _kdc_do_version4(krb5_context context, kdc_log(context, config, 0, "krb4 Cross-realm %s -> %s disabled", realm, config->v4_realm); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, "Can't hop realms"); goto out2; } @@ -473,7 +472,7 @@ _kdc_do_version4(krb5_context context, if(strcmp(sname, "changepw") == 0){ kdc_log(context, config, 0, "Bad request for changepw ticket (krb4)"); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, "Can't authorize password change based on TGT"); goto out2; } @@ -485,7 +484,7 @@ _kdc_do_version4(krb5_context context, s = kdc_log_msg(context, config, 0, "Client not found in database: (krb4) %s: %s", client_name, krb5_get_err_text(context, ret)); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, s); + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, s); free(s); goto out2; } @@ -494,7 +493,7 @@ _kdc_do_version4(krb5_context context, s = kdc_log_msg(context, config, 0, "Local client not found in database: (krb4) " "%s", client_name); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, s); + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, s); free(s); goto out2; } @@ -506,7 +505,7 @@ _kdc_do_version4(krb5_context context, s = kdc_log_msg(context, config, 0, "Server not found in database (krb4): %s: %s", server_name, krb5_get_err_text(context, ret)); - make_err_reply(context, reply, KERB_ERR_PRINCIPAL_UNKNOWN, s); + make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, s); free(s); goto out2; } @@ -516,8 +515,7 @@ _kdc_do_version4(krb5_context context, server, server_name, FALSE); if (ret) { - /* good error code? */ - make_err_reply(context, reply, KERB_ERR_NAME_EXP, + make_err_reply(context, reply, KRB4ET_KDC_NAME_EXP, "operation not allowed"); goto out2; } @@ -526,8 +524,7 @@ _kdc_do_version4(krb5_context context, if(ret){ kdc_log(context, config, 0, "no suitable DES key for server (krb4)"); - /* XXX */ - make_err_reply(context, reply, KDC_NULL_KEY, + make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, "no suitable DES key for server"); goto out2; } @@ -787,7 +784,7 @@ _kdc_get_des_key(krb5_context context, else if(is_server && server_key) *ret_key = server_key; else - return KERB_ERR_NULL_KEY; + return KRB4ET_KDC_NULL_KEY; } else { if(v4_key) *ret_key = v4_key; @@ -798,11 +795,11 @@ _kdc_get_des_key(krb5_context context, else if(is_server && server_key) *ret_key = server_key; else - return KERB_ERR_NULL_KEY; + return KRB4ET_KDC_NULL_KEY; } if((*ret_key)->key.keyvalue.length == 0) - return KERB_ERR_NULL_KEY; + return KRB4ET_KDC_NULL_KEY; return 0; } diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c index e34938447a..40a9c9c972 100644 --- a/source4/heimdal/kdc/kerberos5.c +++ b/source4/heimdal/kdc/kerberos5.c @@ -33,7 +33,7 @@ #include "kdc_locl.h" -RCSID("$Id: kerberos5.c 21040 2007-06-10 06:20:59Z lha $"); +RCSID("$Id: kerberos5.c 21529 2007-07-13 12:37:14Z lha $"); #define MAX_TIME ((time_t)((1U << 31) - 1)) @@ -85,6 +85,22 @@ _kdc_find_padata(const KDC_REQ *req, int *start, int type) } /* + * Detect if `key' is the using the the precomputed `default_salt'. + */ + +static krb5_boolean +is_default_salt_p(const krb5_salt *default_salt, const Key *key) +{ + if (key->salt == NULL) + return TRUE; + if (default_salt->salttype != key->salt->type) + return FALSE; + if (krb5_data_cmp(&default_salt->saltvalue, &key->salt->salt)) + return FALSE; + return TRUE; +} + +/* * return the first appropriate key of `princ' in `ret_key'. Look for * all the etypes in (`etypes', `len'), stopping as soon as we find * one, but preferring one that has default salt @@ -97,6 +113,9 @@ _kdc_find_etype(krb5_context context, const hdb_entry_ex *princ, { int i; krb5_error_code ret = KRB5KDC_ERR_ETYPE_NOSUPP; + krb5_salt def_salt; + + krb5_get_pw_salt (context, princ->entry.principal, &def_salt); for(i = 0; ret != 0 && i < len ; i++) { Key *key = NULL; @@ -112,10 +131,13 @@ _kdc_find_etype(krb5_context context, const hdb_entry_ex *princ, *ret_key = key; *ret_etype = etypes[i]; ret = 0; - if (key->salt == NULL) + if (is_default_salt_p(&def_salt, key)) { + krb5_free_salt (context, def_salt); return ret; + } } } + krb5_free_salt (context, def_salt); return ret; } @@ -325,6 +347,43 @@ _kdc_encode_reply(krb5_context context, return 0; } +/* + * Return 1 if the client have only older enctypes, this is for + * determining if the server should send ETYPE_INFO2 or not. + */ + +static int +older_enctype(krb5_enctype enctype) +{ + switch (enctype) { + case ETYPE_DES_CBC_CRC: + case ETYPE_DES_CBC_MD4: + case ETYPE_DES_CBC_MD5: + case ETYPE_DES3_CBC_SHA1: + case ETYPE_ARCFOUR_HMAC_MD5: + case ETYPE_ARCFOUR_HMAC_MD5_56: + return 1; + default: + return 0; + } +} + +static int +only_older_enctype_p(const KDC_REQ *req) +{ + int i; + + for(i = 0; i < req->req_body.etype.len; i++) { + if (!older_enctype(req->req_body.etype.val[i])) + return 0; + } + return 1; +} + +/* + * + */ + static krb5_error_code make_etype_info_entry(krb5_context context, ETYPE_INFO_ENTRY *ent, Key *key) { @@ -395,14 +454,18 @@ get_pa_etype_info(krb5_context context, return ENOMEM; memset(pa.val, 0, pa.len * sizeof(*pa.val)); - for(j = 0; j < etypes_len; j++) { - for (i = 0; i < n; i++) - if (pa.val[i].etype == etypes[j]) + for(i = 0; i < client->keys.len; i++) { + for (j = 0; j < n; j++) + if (pa.val[j].etype == client->keys.val[i].key.keytype) goto skip1; - for(i = 0; i < client->keys.len; i++) { + for(j = 0; j < etypes_len; j++) { if(client->keys.val[i].key.keytype == etypes[j]) { if (krb5_enctype_valid(context, etypes[j]) != 0) continue; + if (!older_enctype(etypes[j])) + continue; + if (n >= pa.len) + krb5_abortx(context, "internal error: n >= p.len"); if((ret = make_etype_info_entry(context, &pa.val[n++], &client->keys.val[i])) != 0) { @@ -420,6 +483,10 @@ get_pa_etype_info(krb5_context context, } if (krb5_enctype_valid(context, client->keys.val[i].key.keytype) != 0) continue; + if (!older_enctype(etypes[j])) + continue; + if (n >= pa.len) + krb5_abortx(context, "internal error: n >= p.len"); if((ret = make_etype_info_entry(context, &pa.val[n++], &client->keys.val[i])) != 0) { @@ -429,16 +496,8 @@ get_pa_etype_info(krb5_context context, skip2:; } - if(n != pa.len) { - char *name; - ret = krb5_unparse_name(context, client->principal, &name); - if (ret) - name = rk_UNCONST("<unparse_name failed>"); - kdc_log(context, config, 0, - "internal error in get_pa_etype_info(%s): %d != %d", - name, n, pa.len); - if (ret == 0) - free(name); + if(n < pa.len) { + /* stripped out newer enctypes */ pa.len = n; } @@ -528,33 +587,9 @@ make_etype_info2_entry(ETYPE_INFO2_ENTRY *ent, Key *key) } /* - * Return 1 if the client have only older enctypes, this is for - * determining if the server should send ETYPE_INFO2 or not. - */ - -static int -only_older_enctype_p(const KDC_REQ *req) -{ - int i; - - for(i = 0; i < req->req_body.etype.len; i++) { - switch (req->req_body.etype.val[i]) { - case ETYPE_DES_CBC_CRC: - case ETYPE_DES_CBC_MD4: - case ETYPE_DES_CBC_MD5: - case ETYPE_DES3_CBC_SHA1: - case ETYPE_ARCFOUR_HMAC_MD5: - case ETYPE_ARCFOUR_HMAC_MD5_56: - break; - default: - return 0; - } - } - return 1; -} - -/* - * + * Return an ETYPE-INFO2. Enctypes are storted the same way as in the + * database (client supported enctypes first, then the unsupported + * enctypes). */ static krb5_error_code @@ -578,11 +613,11 @@ get_pa_etype_info2(krb5_context context, return ENOMEM; memset(pa.val, 0, pa.len * sizeof(*pa.val)); - for(j = 0; j < etypes_len; j++) { - for (i = 0; i < n; i++) - if (pa.val[i].etype == etypes[j]) + for(i = 0; i < client->keys.len; i++) { + for (j = 0; j < n; j++) + if (pa.val[j].etype == client->keys.val[i].key.keytype) goto skip1; - for(i = 0; i < client->keys.len; i++) { + for(j = 0; j < etypes_len; j++) { if(client->keys.val[i].key.keytype == etypes[j]) { if (krb5_enctype_valid(context, etypes[j]) != 0) continue; @@ -595,6 +630,7 @@ get_pa_etype_info2(krb5_context context, } skip1:; } + /* send enctypes that the cliene doesn't know about too */ for(i = 0; i < client->keys.len; i++) { for(j = 0; j < etypes_len; j++) { if(client->keys.val[i].key.keytype == etypes[j]) @@ -959,7 +995,9 @@ _kdc_as_rep(krb5_context context, if (b->cname->name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) { if (b->cname->name_string.len != 1) { kdc_log(context, config, 0, - "AS-REQ malformed canon request from %s", from); + "AS-REQ malformed canon request from %s, " + "enterprise name with %d name components", + from, b->cname->name_string.len); ret = KRB5_PARSE_MALFORMED; goto out; } @@ -1395,6 +1433,12 @@ _kdc_as_rep(krb5_context context, copy_Realm(&server->entry.principal->realm, &rep.ticket.realm); _krb5_principal2principalname(&rep.ticket.sname, server->entry.principal); + /* java 1.6 expects the name to be the same type, lets allow that + * uncomplicated name-types. */ +#define CNT(sp,t) (((sp)->sname->name_type) == KRB5_NT_##t) + if (CNT(b, UNKNOWN) || CNT(b, PRINCIPAL) || CNT(b, SRV_INST) || CNT(b, SRV_HST) || CNT(b, SRV_XHST)) + rep.ticket.sname.name_type = b->sname->name_type; +#undef CNT et.flags.initial = 1; if(client->entry.flags.forwardable && server->entry.flags.forwardable) diff --git a/source4/heimdal/kdc/kx509.c b/source4/heimdal/kdc/kx509.c index 8414ecb4b2..b1b861efef 100644 --- a/source4/heimdal/kdc/kx509.c +++ b/source4/heimdal/kdc/kx509.c @@ -36,7 +36,7 @@ #include <rfc2459_asn1.h> #include <hx509.h> -RCSID("$Id: kx509.c 19992 2007-01-20 09:06:18Z lha $"); +RCSID("$Id: kx509.c 21607 2007-07-17 07:04:52Z lha $"); /* * @@ -56,7 +56,7 @@ _kdc_try_kx509_request(void *ptr, size_t len, Kx509Request *req, size_t *size) * */ -static const char version_2_0[4] = {0 , 0, 2, 0}; +static const unsigned char version_2_0[4] = {0 , 0, 2, 0}; static krb5_error_code verify_req_hash(krb5_context context, @@ -122,7 +122,7 @@ calculate_reply_hash(krb5_context context, if (rep->certificate) HMAC_Update(&ctx, rep->certificate->data, rep->certificate->length); if (rep->e_text) - HMAC_Update(&ctx, *rep->e_text, strlen(*rep->e_text)); + HMAC_Update(&ctx, (unsigned char *)*rep->e_text, strlen(*rep->e_text)); HMAC_Final(&ctx, rep->hash->data, 0); HMAC_CTX_cleanup(&ctx); diff --git a/source4/heimdal/kuser/kinit.c b/source4/heimdal/kuser/kinit.c index 29a9bdd5c7..23fa7a5baf 100644 --- a/source4/heimdal/kuser/kinit.c +++ b/source4/heimdal/kuser/kinit.c @@ -32,18 +32,10 @@ */ #include "kuser_locl.h" -RCSID("$Id: kinit.c 20517 2007-04-22 10:42:26Z lha $"); +RCSID("$Id: kinit.c 21483 2007-07-10 16:40:46Z lha $"); #include "krb5-v4compat.h" -struct krb5_pk_identity; -struct krb5_pk_cert; -struct ContentInfo; -struct _krb5_krb_auth_data; -struct krb5_dh_moduli; -struct krb5_plugin; -enum plugin_type; -#include "krb5-private.h" #include "heimntlm.h" int forwardable_flag = -1; diff --git a/source4/heimdal/lib/asn1/asn1_err.et b/source4/heimdal/lib/asn1/asn1_err.et index 67af1a44fc..c624e218e7 100644 --- a/source4/heimdal/lib/asn1/asn1_err.et +++ b/source4/heimdal/lib/asn1/asn1_err.et @@ -3,7 +3,7 @@ # # This might look like a com_err file, but is not # -id "$Id: asn1_err.et 20010 2007-01-20 21:52:27Z lha $" +id "$Id: asn1_err.et 21394 2007-07-02 10:14:43Z lha $" error_table asn1 prefix ASN1 @@ -19,4 +19,7 @@ error_code BAD_FORMAT, "ASN.1 badly-formatted encoding" error_code PARSE_ERROR, "ASN.1 parse error" error_code EXTRA_DATA, "ASN.1 extra data past end of end structure" error_code BAD_CHARACTER, "ASN.1 invalid character in string" +error_code MIN_CONSTRAINT, "ASN.1 too few elements" +error_code MAX_CONSTRAINT, "ASN.1 too many elements" +error_code EXACT_CONSTRAINT, "ASN.1 wrong number of elements" end diff --git a/source4/heimdal/lib/asn1/der_get.c b/source4/heimdal/lib/asn1/der_get.c index 3022435b33..f232ce9a29 100644 --- a/source4/heimdal/lib/asn1/der_get.c +++ b/source4/heimdal/lib/asn1/der_get.c @@ -33,7 +33,7 @@ #include "der_locl.h" -RCSID("$Id: der_get.c 20570 2007-04-27 14:06:27Z lha $"); +RCSID("$Id: der_get.c 21369 2007-06-27 10:14:39Z lha $"); #include <version.h> @@ -336,32 +336,25 @@ generalizedtime2time (const char *s, time_t *t) *t = _der_timegm (&tm); return 0; } -#undef timegm static int der_get_time (const unsigned char *p, size_t len, time_t *data, size_t *size) { - heim_octet_string k; char *times; - size_t ret = 0; - size_t l; int e; - e = der_get_octet_string (p, len, &k, &l); - if (e) return e; - p += l; - len -= l; - ret += l; - times = realloc(k.data, k.length + 1); - if (times == NULL){ - free(k.data); + if (len > len + 1 || len == 0) + return ASN1_BAD_LENGTH; + + times = malloc(len + 1); + if (times == NULL) return ENOMEM; - } - times[k.length] = 0; + memcpy(times, p, len); + times[len] = '\0'; e = generalizedtime2time(times, data); free (times); - if(size) *size = ret; + if(size) *size = len; return e; } diff --git a/source4/heimdal/lib/asn1/gen.c b/source4/heimdal/lib/asn1/gen.c index cc1a3056de..26890212ae 100644 --- a/source4/heimdal/lib/asn1/gen.c +++ b/source4/heimdal/lib/asn1/gen.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$Id: gen.c 20670 2007-05-11 00:39:41Z lha $"); +RCSID("$Id: gen.c 21364 2007-06-27 08:51:06Z lha $"); FILE *headerfile, *codefile, *logfile; @@ -253,6 +253,7 @@ generate_header_of_codefile(const char *name) "#include <time.h>\n" "#include <string.h>\n" "#include <errno.h>\n" + "#include <limits.h>\n" "#include <krb5-types.h>\n", orig_filename); diff --git a/source4/heimdal/lib/asn1/gen_decode.c b/source4/heimdal/lib/asn1/gen_decode.c index 7ebef6cdce..face9ba47a 100644 --- a/source4/heimdal/lib/asn1/gen_decode.c +++ b/source4/heimdal/lib/asn1/gen_decode.c @@ -34,7 +34,7 @@ #include "gen_locl.h" #include "lex.h" -RCSID("$Id: gen_decode.c 19572 2006-12-29 17:30:32Z lha $"); +RCSID("$Id: gen_decode.c 21503 2007-07-12 11:57:19Z lha $"); static void decode_primitive (const char *typename, const char *name, const char *forwstr) @@ -202,6 +202,32 @@ find_tag (const Type *t, } } +static void +range_check(const char *name, + const char *length, + const char *forwstr, + struct range *r) +{ + if (r->min == r->max + 2 || r->min < r->max) + fprintf (codefile, + "if ((%s)->%s > %d) {\n" + "e = ASN1_MAX_CONSTRAINT; %s;\n" + "}\n", + name, length, r->max, forwstr); + if (r->min - 1 == r->max || r->min < r->max) + fprintf (codefile, + "if ((%s)->%s < %d) {\n" + "e = ASN1_MIN_CONSTRAINT; %s;\n" + "}\n", + name, length, r->min, forwstr); + if (r->max == r->min) + fprintf (codefile, + "if ((%s)->%s != %d) {\n" + "e = ASN1_EXACT_CONSTRAINT; %s;\n" + "}\n", + name, length, r->min, forwstr); +} + static int decode_type (const char *name, const Type *t, int optional, const char *forwstr, const char *tmpstr) @@ -236,12 +262,14 @@ decode_type (const char *name, const Type *t, int optional, } case TInteger: if(t->members) { - char *s; - asprintf(&s, "(int*)%s", name); - if (s == NULL) - errx (1, "out of memory"); - decode_primitive ("integer", s, forwstr); - free(s); + fprintf(codefile, + "{\n" + "int enumint;\n"); + decode_primitive ("integer", "&enumint", forwstr); + fprintf(codefile, + "*%s = enumint;\n" + "}\n", + name); } else if (t->range == NULL) { decode_primitive ("heim_integer", name, forwstr); } else if (t->range->min == INT_MIN && t->range->max == INT_MAX) { @@ -262,6 +290,8 @@ decode_type (const char *name, const Type *t, int optional, break; case TOctetString: decode_primitive ("octet_string", name, forwstr); + if (t->range) + range_check(name, "length", forwstr, t->range); break; case TBitString: { Member *m; @@ -394,19 +424,31 @@ decode_type (const char *name, const Type *t, int optional, "{\n" "size_t %s_origlen = len;\n" "size_t %s_oldret = ret;\n" + "size_t %s_olen = 0;\n" "void *%s_tmp;\n" "ret = 0;\n" "(%s)->len = 0;\n" - "(%s)->val = NULL;\n" + "(%s)->val = NULL;\n", + tmpstr, + tmpstr, + tmpstr, + tmpstr, + name, + name); + + fprintf (codefile, "while(ret < %s_origlen) {\n" - "%s_tmp = realloc((%s)->val, " - " sizeof(*((%s)->val)) * ((%s)->len + 1));\n" - "if (%s_tmp == NULL) { %s; }\n" + "size_t %s_nlen = %s_olen + sizeof(*((%s)->val));\n" + "if (%s_olen > %s_nlen) { e = ASN1_OVERFLOW; %s; }\n" + "%s_olen = %s_nlen;\n" + "%s_tmp = realloc((%s)->val, %s_olen);\n" + "if (%s_tmp == NULL) { e = ENOMEM; %s; }\n" "(%s)->val = %s_tmp;\n", - tmpstr, tmpstr, tmpstr, - name, name, + tmpstr, + tmpstr, tmpstr, name, + tmpstr, tmpstr, forwstr, tmpstr, tmpstr, - name, name, name, + tmpstr, name, tmpstr, tmpstr, forwstr, name, tmpstr); @@ -425,6 +467,8 @@ decode_type (const char *name, const Type *t, int optional, "}\n", name, tmpstr, tmpstr); + if (t->range) + range_check(name, "len", forwstr, t->range); free (n); free (sname); break; diff --git a/source4/heimdal/lib/asn1/gen_encode.c b/source4/heimdal/lib/asn1/gen_encode.c index b5337b1c43..9544514212 100644 --- a/source4/heimdal/lib/asn1/gen_encode.c +++ b/source4/heimdal/lib/asn1/gen_encode.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$Id: gen_encode.c 19572 2006-12-29 17:30:32Z lha $"); +RCSID("$Id: gen_encode.c 21503 2007-07-12 11:57:19Z lha $"); static void encode_primitive (const char *typename, const char *name) @@ -121,12 +121,12 @@ encode_type (const char *name, const Type *t, const char *tmpstr) break; case TInteger: if(t->members) { - char *s; - asprintf(&s, "(const int*)%s", name); - if(s == NULL) - errx(1, "out of memory"); - encode_primitive ("integer", s); - free(s); + fprintf(codefile, + "{\n" + "int enumint = (int)*%s;\n", + name); + encode_primitive ("integer", "&enumint"); + fprintf(codefile, "}\n;"); } else if (t->range == NULL) { encode_primitive ("heim_integer", name); } else if (t->range->min == INT_MIN && t->range->max == INT_MAX) { @@ -293,6 +293,11 @@ encode_type (const char *name, const Type *t, const char *tmpstr) "int eret;\n"); fprintf(codefile, + "if ((%s)->len > UINT_MAX/sizeof(val[0]))\n" + "return ERANGE;\n", + name); + + fprintf(codefile, "val = malloc(sizeof(val[0]) * (%s)->len);\n" "if (val == NULL && (%s)->len != 0) return ENOMEM;\n", name, name); diff --git a/source4/heimdal/lib/asn1/gen_length.c b/source4/heimdal/lib/asn1/gen_length.c index a1f7cc6644..4cb5d45089 100644 --- a/source4/heimdal/lib/asn1/gen_length.c +++ b/source4/heimdal/lib/asn1/gen_length.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$Id: gen_length.c 19539 2006-12-28 17:15:05Z lha $"); +RCSID("$Id: gen_length.c 21503 2007-07-12 11:57:19Z lha $"); static void length_primitive (const char *typename, @@ -72,12 +72,11 @@ length_type (const char *name, const Type *t, break; case TInteger: if(t->members) { - char *s; - asprintf(&s, "(const int*)%s", name); - if(s == NULL) - errx (1, "out of memory"); - length_primitive ("integer", s, variable); - free(s); + fprintf(codefile, + "{\n" + "int enumint = *%s;\n", name); + length_primitive ("integer", "&enumint", variable); + fprintf(codefile, "}\n"); } else if (t->range == NULL) { length_primitive ("heim_integer", name, variable); } else if (t->range->min == INT_MIN && t->range->max == INT_MAX) { diff --git a/source4/heimdal/lib/asn1/k5.asn1 b/source4/heimdal/lib/asn1/k5.asn1 index 14e9793fdc..e3fe2b11e9 100644 --- a/source4/heimdal/lib/asn1/k5.asn1 +++ b/source4/heimdal/lib/asn1/k5.asn1 @@ -1,4 +1,4 @@ --- $Id: k5.asn1 21092 2007-06-15 19:47:46Z lha $ +-- $Id: k5.asn1 21400 2007-07-02 19:57:31Z lha $ KERBEROS5 DEFINITIONS ::= BEGIN @@ -332,7 +332,7 @@ ETYPE-INFO2-ENTRY ::= SEQUENCE { s2kparams[2] OCTET STRING OPTIONAL } -ETYPE-INFO2 ::= SEQUENCE OF ETYPE-INFO2-ENTRY +ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO2-ENTRY METHOD-DATA ::= SEQUENCE OF PA-DATA @@ -341,7 +341,7 @@ TypedData ::= SEQUENCE { data-value[1] OCTET STRING OPTIONAL } -TYPED-DATA ::= SEQUENCE OF TypedData +TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF TypedData KDC-REQ-BODY ::= SEQUENCE { kdc-options[0] KDCOptions, diff --git a/source4/heimdal/lib/asn1/lex.c b/source4/heimdal/lib/asn1/lex.c index fe488eb904..d628e4696f 100644 --- a/source4/heimdal/lib/asn1/lex.c +++ b/source4/heimdal/lib/asn1/lex.c @@ -1,6 +1,5 @@ -#include "config.h" -#line 3 "lex.yy.c" +#line 3 "lex.c" #define YY_INT_ALIGNED short int @@ -343,6 +342,9 @@ FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0; typedef int yy_state_type; extern int yylineno; + +int yylineno = 1; + extern char *yytext; #define yytext_ptr yytext @@ -824,7 +826,7 @@ char *yytext; * SUCH DAMAGE. */ -/* $Id: lex.l,v 1.31 2006/10/21 11:57:22 lha Exp $ */ +/* $Id: lex.l 18738 2006-10-21 11:57:22Z lha $ */ #ifdef HAVE_CONFIG_H #include <config.h> @@ -849,7 +851,7 @@ static unsigned lineno = 1; static void unterminated(const char *, unsigned); /* This is for broken old lexes (solaris 10 and hpux) */ -#line 852 "lex.yy.c" +#line 855 "lex.c" #define INITIAL 0 @@ -1004,7 +1006,7 @@ YY_DECL #line 68 "lex.l" -#line 1007 "lex.yy.c" +#line 1010 "lex.c" if ( !(yy_init) ) { @@ -1673,7 +1675,7 @@ YY_RULE_SETUP #line 274 "lex.l" ECHO; YY_BREAK -#line 1676 "lex.yy.c" +#line 1679 "lex.c" case YY_STATE_EOF(INITIAL): yyterminate(); @@ -2483,6 +2485,15 @@ static void yy_fatal_error (yyconst char* msg ) /* Accessor methods (get/set functions) to struct members. */ +/** Get the current line number. + * + */ +int yyget_lineno (void) +{ + + return yylineno; +} + /** Get the input stream. * */ @@ -2516,6 +2527,16 @@ char *yyget_text (void) return yytext; } +/** Set the current line number. + * @param line_number + * + */ +void yyset_lineno (int line_number ) +{ + + yylineno = line_number; +} + /** Set the input stream. This does not discard the current * input buffer. * @param in_str A readable stream. diff --git a/source4/heimdal/lib/asn1/parse.c b/source4/heimdal/lib/asn1/parse.c index d9cd23b662..6a3e524e93 100644 --- a/source4/heimdal/lib/asn1/parse.c +++ b/source4/heimdal/lib/asn1/parse.c @@ -16,7 +16,9 @@ GNU General Public License for more details. You should have received a copy of the GNU General Public License - along with this program; if not, see <http://www.gnu.org/licenses/>. */ + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, + Boston, MA 02110-1301, USA. */ /* As a special exception, you may create a larger work that contains part or all of the Bison parser skeleton and distribute that work @@ -259,7 +261,7 @@ #include "gen_locl.h" #include "der.h" -RCSID("$Id: parse.y 19539 2006-12-28 17:15:05Z lha $"); +RCSID("$Id: parse.y 21597 2007-07-16 18:48:58Z lha $"); static Type *new_type (Typetype t); static struct constraint_spec *new_constraint_spec(enum ctype); @@ -300,7 +302,7 @@ typedef union YYSTYPE { int constant; struct value *value; - struct range range; + struct range *range; char *name; Type *type; Member *member; @@ -538,18 +540,18 @@ union yyalloc #endif /* YYFINAL -- State number of the termination state. */ -#define YYFINAL 4 +#define YYFINAL 6 /* YYLAST -- Last index in YYTABLE. */ -#define YYLAST 169 +#define YYLAST 195 /* YYNTOKENS -- Number of terminals. */ #define YYNTOKENS 98 /* YYNNTS -- Number of nonterminals. */ -#define YYNNTS 67 +#define YYNNTS 68 /* YYNRULES -- Number of rules. */ -#define YYNRULES 131 +#define YYNRULES 136 /* YYNRULES -- Number of states. */ -#define YYNSTATES 202 +#define YYNSTATES 214 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */ #define YYUNDEFTOK 2 @@ -603,80 +605,83 @@ static const yytype_uint8 yytranslate[] = YYRHS. */ static const yytype_uint16 yyprhs[] = { - 0, 0, 3, 12, 15, 18, 21, 22, 25, 26, - 29, 30, 34, 35, 37, 38, 40, 43, 48, 50, - 53, 55, 57, 61, 63, 67, 69, 71, 73, 75, - 77, 79, 81, 83, 85, 87, 89, 91, 93, 95, - 97, 99, 101, 103, 109, 111, 114, 119, 121, 125, - 129, 134, 139, 141, 144, 150, 153, 156, 158, 163, - 167, 171, 176, 180, 184, 189, 191, 193, 195, 197, - 199, 202, 206, 208, 210, 212, 215, 219, 225, 230, - 234, 239, 240, 242, 244, 246, 247, 249, 251, 256, - 258, 260, 262, 264, 266, 268, 270, 272, 274, 278, - 282, 285, 287, 290, 294, 296, 300, 305, 307, 308, - 312, 313, 316, 321, 323, 325, 327, 329, 331, 333, - 335, 337, 339, 341, 343, 345, 347, 349, 351, 353, - 355, 357 + 0, 0, 3, 13, 16, 19, 22, 23, 26, 27, + 30, 31, 35, 36, 38, 39, 41, 44, 49, 51, + 54, 56, 58, 62, 64, 68, 70, 72, 74, 76, + 78, 80, 82, 84, 86, 88, 90, 92, 94, 96, + 98, 100, 102, 104, 110, 116, 122, 126, 128, 131, + 136, 138, 142, 146, 151, 156, 158, 161, 167, 170, + 174, 176, 177, 180, 185, 189, 194, 199, 203, 207, + 212, 214, 216, 218, 220, 222, 225, 229, 231, 233, + 235, 238, 242, 248, 253, 257, 262, 263, 265, 267, + 269, 270, 272, 274, 279, 281, 283, 285, 287, 289, + 291, 293, 295, 297, 301, 305, 308, 310, 313, 317, + 319, 323, 328, 330, 331, 335, 336, 339, 344, 346, + 348, 350, 352, 354, 356, 358, 360, 362, 364, 366, + 368, 370, 372, 374, 376, 378, 380 }; /* YYRHS -- A `-1'-separated list of the rules' RHS. */ static const yytype_int16 yyrhs[] = { - 99, 0, -1, 86, 21, 100, 101, 84, 8, 102, - 24, -1, 27, 70, -1, 38, 70, -1, 7, 70, - -1, -1, 29, 39, -1, -1, 103, 107, -1, -1, - 40, 104, 90, -1, -1, 105, -1, -1, 106, -1, - 105, 106, -1, 109, 32, 86, 150, -1, 108, -1, - 108, 107, -1, 110, -1, 142, -1, 86, 91, 109, - -1, 86, -1, 86, 84, 111, -1, 112, -1, 129, - -1, 132, -1, 120, -1, 113, -1, 143, -1, 128, - -1, 118, -1, 115, -1, 123, -1, 121, -1, 122, - -1, 124, -1, 125, -1, 126, -1, 127, -1, 138, - -1, 11, -1, 92, 154, 83, 154, 93, -1, 43, - -1, 43, 114, -1, 43, 94, 116, 95, -1, 117, - -1, 116, 91, 117, -1, 116, 91, 85, -1, 86, - 92, 162, 93, -1, 25, 94, 119, 95, -1, 116, - -1, 9, 67, -1, 9, 67, 94, 148, 95, -1, - 51, 37, -1, 52, 67, -1, 49, -1, 64, 94, - 145, 95, -1, 64, 94, 95, -1, 64, 53, 111, - -1, 65, 94, 145, 95, -1, 65, 94, 95, -1, - 65, 53, 111, -1, 14, 94, 145, 95, -1, 130, - -1, 131, -1, 86, -1, 34, -1, 77, -1, 111, - 133, -1, 92, 134, 93, -1, 135, -1, 136, -1, - 137, -1, 19, 111, -1, 23, 12, 154, -1, 19, - 111, 23, 12, 154, -1, 18, 12, 94, 95, -1, - 139, 141, 111, -1, 96, 140, 89, 97, -1, -1, - 76, -1, 6, -1, 60, -1, -1, 27, -1, 38, - -1, 86, 111, 84, 154, -1, 144, -1, 33, -1, - 78, -1, 61, -1, 81, -1, 36, -1, 10, -1, - 79, -1, 147, -1, 145, 91, 147, -1, 145, 91, - 85, -1, 86, 111, -1, 146, -1, 146, 54, -1, - 146, 20, 154, -1, 149, -1, 148, 91, 149, -1, - 86, 92, 89, 93, -1, 151, -1, -1, 94, 152, - 95, -1, -1, 153, 152, -1, 86, 92, 89, 93, - -1, 86, -1, 89, -1, 155, -1, 156, -1, 160, - -1, 159, -1, 161, -1, 164, -1, 163, -1, 157, - -1, 158, -1, 86, -1, 88, -1, 71, -1, 31, - -1, 162, -1, 89, -1, 49, -1, 151, -1 + 99, 0, -1, 86, 151, 21, 100, 101, 84, 8, + 102, 24, -1, 27, 70, -1, 38, 70, -1, 7, + 70, -1, -1, 29, 39, -1, -1, 103, 107, -1, + -1, 40, 104, 90, -1, -1, 105, -1, -1, 106, + -1, 105, 106, -1, 109, 32, 86, 151, -1, 108, + -1, 108, 107, -1, 110, -1, 143, -1, 86, 91, + 109, -1, 86, -1, 86, 84, 111, -1, 112, -1, + 130, -1, 133, -1, 120, -1, 113, -1, 144, -1, + 129, -1, 118, -1, 115, -1, 123, -1, 121, -1, + 122, -1, 125, -1, 126, -1, 127, -1, 128, -1, + 139, -1, 11, -1, 92, 155, 83, 155, 93, -1, + 92, 155, 83, 46, 93, -1, 92, 47, 83, 155, + 93, -1, 92, 155, 93, -1, 43, -1, 43, 114, + -1, 43, 94, 116, 95, -1, 117, -1, 116, 91, + 117, -1, 116, 91, 85, -1, 86, 92, 163, 93, + -1, 25, 94, 119, 95, -1, 116, -1, 9, 67, + -1, 9, 67, 94, 149, 95, -1, 51, 37, -1, + 52, 67, 124, -1, 49, -1, -1, 66, 114, -1, + 64, 94, 146, 95, -1, 64, 94, 95, -1, 64, + 124, 53, 111, -1, 65, 94, 146, 95, -1, 65, + 94, 95, -1, 65, 53, 111, -1, 14, 94, 146, + 95, -1, 131, -1, 132, -1, 86, -1, 34, -1, + 77, -1, 111, 134, -1, 92, 135, 93, -1, 136, + -1, 137, -1, 138, -1, 19, 111, -1, 23, 12, + 155, -1, 19, 111, 23, 12, 155, -1, 18, 12, + 94, 95, -1, 140, 142, 111, -1, 96, 141, 89, + 97, -1, -1, 76, -1, 6, -1, 60, -1, -1, + 27, -1, 38, -1, 86, 111, 84, 155, -1, 145, + -1, 33, -1, 78, -1, 61, -1, 81, -1, 36, + -1, 10, -1, 79, -1, 148, -1, 146, 91, 148, + -1, 146, 91, 85, -1, 86, 111, -1, 147, -1, + 147, 54, -1, 147, 20, 155, -1, 150, -1, 149, + 91, 150, -1, 86, 92, 89, 93, -1, 152, -1, + -1, 94, 153, 95, -1, -1, 154, 153, -1, 86, + 92, 89, 93, -1, 86, -1, 89, -1, 156, -1, + 157, -1, 161, -1, 160, -1, 162, -1, 165, -1, + 164, -1, 158, -1, 159, -1, 86, -1, 88, -1, + 71, -1, 31, -1, 163, -1, 89, -1, 49, -1, + 152, -1 }; /* YYRLINE[YYN] -- source line where rule number YYN was defined. */ static const yytype_uint16 yyrline[] = { - 0, 231, 231, 238, 239, 241, 243, 246, 248, 251, - 252, 255, 256, 259, 260, 263, 264, 267, 278, 279, - 282, 283, 286, 292, 300, 310, 311, 312, 315, 316, - 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, - 327, 328, 331, 338, 348, 353, 360, 368, 374, 379, - 383, 396, 404, 407, 414, 422, 428, 435, 442, 448, - 456, 464, 470, 478, 486, 493, 494, 497, 508, 513, - 520, 536, 542, 545, 546, 549, 555, 563, 573, 579, - 592, 601, 604, 608, 612, 619, 622, 626, 633, 644, - 647, 652, 657, 662, 667, 672, 677, 685, 691, 696, - 707, 718, 724, 730, 738, 744, 751, 764, 765, 768, - 775, 778, 789, 793, 804, 810, 811, 814, 815, 816, - 817, 818, 821, 824, 827, 838, 846, 852, 860, 868, - 871, 876 + 0, 233, 233, 240, 241, 243, 245, 248, 250, 253, + 254, 257, 258, 261, 262, 265, 266, 269, 280, 281, + 284, 285, 288, 294, 302, 312, 313, 314, 317, 318, + 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, + 329, 330, 333, 340, 350, 358, 366, 377, 382, 388, + 396, 402, 407, 411, 424, 432, 435, 442, 450, 456, + 465, 473, 474, 479, 485, 493, 502, 508, 516, 524, + 531, 532, 535, 546, 551, 558, 574, 580, 583, 584, + 587, 593, 601, 611, 617, 630, 639, 642, 646, 650, + 657, 660, 664, 671, 682, 685, 690, 695, 700, 705, + 710, 715, 723, 729, 734, 745, 756, 762, 768, 776, + 782, 789, 802, 803, 806, 813, 816, 827, 831, 842, + 848, 849, 852, 853, 854, 855, 856, 859, 862, 865, + 876, 884, 890, 898, 906, 909, 914 }; #endif @@ -712,7 +717,7 @@ static const char *const yytname[] = "TypeAssignment", "Type", "BuiltinType", "BooleanType", "range", "IntegerType", "NamedNumberList", "NamedNumber", "EnumeratedType", "Enumerations", "BitStringType", "ObjectIdentifierType", - "OctetStringType", "NullType", "SequenceType", "SequenceOfType", + "OctetStringType", "NullType", "size", "SequenceType", "SequenceOfType", "SetType", "SetOfType", "ChoiceType", "ReferencedType", "DefinedType", "UsefulType", "ConstrainedType", "Constraint", "ConstraintSpec", "GeneralConstraint", "ContentsConstraint", "UserDefinedConstraint", @@ -751,35 +756,35 @@ static const yytype_uint8 yyr1[] = 102, 103, 103, 104, 104, 105, 105, 106, 107, 107, 108, 108, 109, 109, 110, 111, 111, 111, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, - 112, 112, 113, 114, 115, 115, 115, 116, 116, 116, - 117, 118, 119, 120, 120, 121, 122, 123, 124, 124, - 125, 126, 126, 127, 128, 129, 129, 130, 131, 131, - 132, 133, 134, 135, 135, 136, 136, 136, 137, 138, - 139, 140, 140, 140, 140, 141, 141, 141, 142, 143, - 144, 144, 144, 144, 144, 144, 144, 145, 145, 145, - 146, 147, 147, 147, 148, 148, 149, 150, 150, 151, - 152, 152, 153, 153, 153, 154, 154, 155, 155, 155, - 155, 155, 156, 157, 158, 159, 160, 160, 161, 162, - 163, 164 + 112, 112, 113, 114, 114, 114, 114, 115, 115, 115, + 116, 116, 116, 117, 118, 119, 120, 120, 121, 122, + 123, 124, 124, 125, 125, 126, 127, 127, 128, 129, + 130, 130, 131, 132, 132, 133, 134, 135, 136, 136, + 137, 137, 137, 138, 139, 140, 141, 141, 141, 141, + 142, 142, 142, 143, 144, 145, 145, 145, 145, 145, + 145, 145, 146, 146, 146, 147, 148, 148, 148, 149, + 149, 150, 151, 151, 152, 153, 153, 154, 154, 154, + 155, 155, 156, 156, 156, 156, 156, 157, 158, 159, + 160, 161, 161, 162, 163, 164, 165 }; /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */ static const yytype_uint8 yyr2[] = { - 0, 2, 8, 2, 2, 2, 0, 2, 0, 2, + 0, 2, 9, 2, 2, 2, 0, 2, 0, 2, 0, 3, 0, 1, 0, 1, 2, 4, 1, 2, 1, 1, 3, 1, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, - 1, 1, 1, 5, 1, 2, 4, 1, 3, 3, - 4, 4, 1, 2, 5, 2, 2, 1, 4, 3, - 3, 4, 3, 3, 4, 1, 1, 1, 1, 1, - 2, 3, 1, 1, 1, 2, 3, 5, 4, 3, - 4, 0, 1, 1, 1, 0, 1, 1, 4, 1, - 1, 1, 1, 1, 1, 1, 1, 1, 3, 3, - 2, 1, 2, 3, 1, 3, 4, 1, 0, 3, - 0, 2, 4, 1, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 5, 5, 5, 3, 1, 2, 4, + 1, 3, 3, 4, 4, 1, 2, 5, 2, 3, + 1, 0, 2, 4, 3, 4, 4, 3, 3, 4, + 1, 1, 1, 1, 1, 2, 3, 1, 1, 1, + 2, 3, 5, 4, 3, 4, 0, 1, 1, 1, + 0, 1, 1, 4, 1, 1, 1, 1, 1, 1, + 1, 1, 1, 3, 3, 2, 1, 2, 3, 1, + 3, 4, 1, 0, 3, 0, 2, 4, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, - 1, 1 + 1, 1, 1, 1, 1, 1, 1 }; /* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state @@ -787,79 +792,81 @@ static const yytype_uint8 yyr2[] = means the default is an error. */ static const yytype_uint8 yydefact[] = { - 0, 0, 0, 6, 1, 0, 0, 0, 8, 5, - 3, 4, 0, 0, 7, 0, 10, 14, 0, 0, - 23, 0, 13, 15, 0, 2, 0, 9, 18, 20, - 21, 0, 11, 16, 0, 0, 95, 42, 0, 0, - 90, 68, 94, 44, 57, 0, 0, 92, 0, 0, - 69, 91, 96, 93, 0, 67, 81, 0, 25, 29, - 33, 32, 28, 35, 36, 34, 37, 38, 39, 40, - 31, 26, 65, 66, 27, 41, 85, 30, 89, 19, - 22, 108, 53, 0, 0, 0, 0, 45, 55, 56, - 0, 0, 0, 0, 24, 83, 84, 82, 0, 0, - 0, 70, 86, 87, 0, 110, 17, 107, 0, 0, - 0, 101, 97, 0, 52, 47, 0, 127, 130, 126, - 124, 125, 129, 131, 0, 115, 116, 122, 123, 118, - 117, 119, 128, 121, 120, 0, 60, 59, 0, 63, - 62, 0, 0, 88, 0, 0, 0, 0, 72, 73, - 74, 79, 113, 114, 0, 110, 0, 0, 104, 100, - 0, 64, 0, 102, 0, 0, 51, 0, 46, 58, - 61, 80, 0, 75, 0, 71, 0, 109, 111, 0, - 0, 54, 99, 98, 103, 0, 49, 48, 0, 0, - 0, 76, 0, 0, 105, 50, 43, 78, 0, 112, - 106, 77 + 0, 113, 0, 115, 0, 112, 1, 118, 119, 0, + 115, 6, 0, 114, 116, 0, 0, 0, 8, 0, + 5, 3, 4, 0, 0, 117, 7, 0, 10, 14, + 0, 0, 23, 0, 13, 15, 0, 2, 0, 9, + 18, 20, 21, 0, 11, 16, 0, 0, 100, 42, + 0, 0, 95, 73, 99, 47, 60, 0, 0, 97, + 61, 0, 74, 96, 101, 98, 0, 72, 86, 0, + 25, 29, 33, 32, 28, 35, 36, 34, 37, 38, + 39, 40, 31, 26, 70, 71, 27, 41, 90, 30, + 94, 19, 22, 113, 56, 0, 0, 0, 0, 48, + 58, 61, 0, 0, 0, 0, 0, 24, 88, 89, + 87, 0, 0, 0, 75, 91, 92, 0, 17, 0, + 0, 0, 106, 102, 0, 55, 50, 0, 132, 0, + 135, 131, 129, 130, 134, 136, 0, 120, 121, 127, + 128, 123, 122, 124, 133, 126, 125, 0, 59, 62, + 64, 0, 0, 68, 67, 0, 0, 93, 0, 0, + 0, 0, 77, 78, 79, 84, 0, 0, 109, 105, + 0, 69, 0, 107, 0, 0, 54, 0, 0, 46, + 49, 63, 65, 66, 85, 0, 80, 0, 76, 0, + 0, 57, 104, 103, 108, 0, 52, 51, 0, 0, + 0, 0, 0, 81, 0, 110, 53, 45, 44, 43, + 83, 0, 111, 82 }; /* YYDEFGOTO[NTERM-NUM]. */ static const yytype_int16 yydefgoto[] = { - -1, 2, 8, 13, 18, 19, 21, 22, 23, 27, - 28, 24, 29, 57, 58, 59, 87, 60, 114, 115, - 61, 116, 62, 63, 64, 65, 66, 67, 68, 69, - 70, 71, 72, 73, 74, 101, 147, 148, 149, 150, - 75, 76, 98, 104, 30, 77, 78, 110, 111, 112, - 157, 158, 106, 123, 154, 155, 124, 125, 126, 127, - 128, 129, 130, 131, 132, 133, 134 + -1, 2, 18, 24, 30, 31, 33, 34, 35, 39, + 40, 36, 41, 69, 70, 71, 99, 72, 125, 126, + 73, 127, 74, 75, 76, 77, 104, 78, 79, 80, + 81, 82, 83, 84, 85, 86, 114, 161, 162, 163, + 164, 87, 88, 111, 117, 42, 89, 90, 121, 122, + 123, 167, 168, 4, 135, 9, 10, 136, 137, 138, + 139, 140, 141, 142, 143, 144, 145, 146 }; /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing STATE-NUM. */ -#define YYPACT_NINF -100 +#define YYPACT_NINF -113 static const yytype_int16 yypact[] = { - -65, 19, 33, 5, -100, -29, -17, 11, 53, -100, - -100, -100, 47, 13, -100, 90, -34, 18, 81, 20, - 16, 21, 18, -100, 76, -100, -7, -100, 20, -100, - -100, 18, -100, -100, 23, 43, -100, -100, 24, 25, - -100, -100, -100, -4, -100, 77, 46, -100, -48, -45, - -100, -100, -100, -100, 51, -100, 4, -64, -100, -100, - -100, -100, -100, -100, -100, -100, -100, -100, -100, -100, - -100, -100, -100, -100, -100, -100, -16, -100, -100, -100, - -100, 26, 27, 31, 36, 52, 36, -100, -100, -100, - 51, -71, 51, -70, 32, -100, -100, -100, 37, 52, - 12, -100, -100, -100, 51, -39, -100, -100, 39, 51, - -78, -6, -100, 35, 40, -100, 38, -100, -100, -100, - -100, -100, -100, -100, 56, -100, -100, -100, -100, -100, - -100, -100, -100, -100, -100, -72, 32, -100, -57, 32, - -100, -36, 45, -100, 122, 51, 123, 50, -100, -100, - -100, 32, 44, -100, 49, -39, 57, -22, -100, 32, - -19, -100, 52, -100, 59, 10, -100, 52, -100, -100, - -100, -100, 58, -14, 52, -100, 61, -100, -100, 62, - 39, -100, -100, -100, -100, 60, -100, -100, 63, 64, - 133, -100, 65, 67, -100, -100, -100, -100, 52, -100, - -100, -100 + -74, -67, 38, -69, 23, -113, -113, -44, -113, -41, + -69, 4, -26, -113, -113, -3, 1, 10, 52, -10, + -113, -113, -113, 45, 13, -113, -113, 77, -35, 15, + 64, 19, 17, 20, 15, -113, 85, -113, 25, -113, + 19, -113, -113, 15, -113, -113, 27, 47, -113, -113, + 26, 29, -113, -113, -113, -30, -113, 89, 61, -113, + -57, -47, -113, -113, -113, -113, 82, -113, -4, -68, + -113, -113, -113, -113, -113, -113, -113, -113, -113, -113, + -113, -113, -113, -113, -113, -113, -113, -113, -17, -113, + -113, -113, -113, -67, 35, 33, 46, 51, 46, -113, + -113, 69, 44, -73, 88, 82, -72, 56, -113, -113, + -113, 49, 93, 7, -113, -113, -113, 82, -113, 58, + 82, -76, -13, -113, 57, 59, -113, 60, -113, 68, + -113, -113, -113, -113, -113, -113, -75, -113, -113, -113, + -113, -113, -113, -113, -113, -113, -113, -63, -113, -113, + -113, -62, 82, 56, -113, -46, 65, -113, 141, 82, + 142, 63, -113, -113, -113, 56, 66, -38, -113, 56, + -16, -113, 93, -113, 76, -7, -113, 93, 81, -113, + -113, -113, 56, -113, -113, 72, -19, 93, -113, 83, + 58, -113, -113, -113, -113, 78, -113, -113, 80, 84, + 87, 62, 162, -113, 90, -113, -113, -113, -113, -113, + -113, 93, -113, -113 }; /* YYPGOTO[NTERM-NUM]. */ static const yytype_int16 yypgoto[] = { - -100, -100, -100, -100, -100, -100, -100, -100, 132, 127, - -100, 126, -100, -53, -100, -100, -100, -100, 75, -3, - -100, -100, -100, -100, -100, -100, -100, -100, -100, -100, - -100, -100, -100, -100, -100, -100, -100, -100, -100, -100, - -100, -100, -100, -100, -100, -100, -100, 0, -100, 3, - -100, -15, -100, 83, 14, -100, -99, -100, -100, -100, - -100, -100, -100, -100, 2, -100, -100 + -113, -113, -113, -113, -113, -113, -113, -113, 150, 136, + -113, 143, -113, -65, -113, -113, 86, -113, 91, 16, + -113, -113, -113, -113, -113, -113, 92, -113, -113, -113, + -113, -113, -113, -113, -113, -113, -113, -113, -113, -113, + -113, -113, -113, -113, -113, -113, -113, -113, -60, -113, + 22, -113, -5, 97, 2, 184, -113, -112, -113, -113, + -113, -113, -113, -113, -113, 21, -113, -113 }; /* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If @@ -869,71 +876,78 @@ static const yytype_int16 yypgoto[] = #define YYTABLE_NINF -13 static const yytype_int16 yytable[] = { - 143, 94, 35, 36, 37, 90, 17, 38, 92, 190, - 95, 102, 5, 160, 162, 109, 109, 161, 39, 165, - 99, 1, 103, 168, 137, 140, 40, 41, 100, 42, - 144, 145, 6, 4, 160, 146, 43, 136, 169, 139, - 3, 9, 44, 7, 45, 46, 91, 152, 163, 93, - 153, 151, -12, 10, 47, 160, 159, 48, 49, 170, - 35, 36, 37, 184, 96, 38, 182, 109, 188, 180, - 50, 51, 52, 181, 53, 191, 39, 54, 100, 55, - 97, 11, 12, 117, 40, 41, 14, 42, 85, 56, - 86, 138, 173, 141, 43, 186, 113, 15, 16, 201, - 44, 118, 45, 46, 20, 25, 26, 31, 34, 81, - 82, 32, 47, 89, 88, 48, 49, 109, 83, 84, - 105, 108, 113, 119, 100, 156, 142, 164, 50, 51, - 52, 165, 53, 166, 172, 174, 176, 55, 120, 167, - 121, 122, 171, 175, 177, 198, 105, 56, 122, 179, - 192, 193, 189, 195, 33, 79, 196, 80, 199, 197, - 200, 135, 187, 183, 107, 194, 185, 0, 0, 178 + 157, 107, 108, 5, 202, 29, 105, 172, 178, 102, + 115, 15, 1, 120, 120, 170, 112, 7, 179, 171, + 8, 116, 150, 154, 113, 158, 159, 3, 175, 170, + 160, 16, 180, 181, 47, 48, 49, 103, 6, 50, + 153, 173, 17, 151, 11, 170, 155, 106, 12, 183, + 51, -12, 165, 190, 13, 169, 109, 191, 52, 53, + 194, 54, 97, 19, 98, 198, 200, 20, 55, 192, + 120, 21, 110, 113, 56, 203, 57, 58, 196, 124, + 22, 23, 128, 25, 26, 28, 59, 182, 37, 60, + 61, 47, 48, 49, 186, 5, 50, 27, 129, 213, + 130, 32, 62, 63, 64, 38, 65, 51, 43, 66, + 44, 67, 128, 93, 94, 52, 53, 46, 54, 120, + 95, 68, 131, 96, 128, 55, 100, 199, 101, 119, + 130, 56, 124, 57, 58, 102, 97, 132, 156, 133, + 134, 152, 130, 59, 166, 3, 60, 61, 113, 174, + 175, 177, 131, 185, 187, 176, 188, 210, 189, 62, + 63, 64, 184, 65, 131, 134, 201, 132, 67, 133, + 134, 206, 204, 207, 211, 3, 91, 208, 68, 132, + 209, 133, 134, 212, 45, 205, 92, 3, 149, 147, + 118, 197, 193, 148, 14, 195 }; -static const yytype_int16 yycheck[] = +static const yytype_uint8 yycheck[] = { - 99, 54, 9, 10, 11, 53, 40, 14, 53, 23, - 6, 27, 7, 91, 20, 86, 86, 95, 25, 91, - 84, 86, 38, 95, 95, 95, 33, 34, 92, 36, - 18, 19, 27, 0, 91, 23, 43, 90, 95, 92, - 21, 70, 49, 38, 51, 52, 94, 86, 54, 94, - 89, 104, 86, 70, 61, 91, 109, 64, 65, 95, - 9, 10, 11, 162, 60, 14, 85, 86, 167, 91, - 77, 78, 79, 95, 81, 174, 25, 84, 92, 86, - 76, 70, 29, 31, 33, 34, 39, 36, 92, 96, - 94, 91, 145, 93, 43, 85, 86, 84, 8, 198, - 49, 49, 51, 52, 86, 24, 86, 91, 32, 86, - 67, 90, 61, 67, 37, 64, 65, 86, 94, 94, - 94, 94, 86, 71, 92, 86, 89, 92, 77, 78, - 79, 91, 81, 95, 12, 12, 92, 86, 86, 83, - 88, 89, 97, 93, 95, 12, 94, 96, 89, 92, - 89, 89, 94, 93, 22, 28, 93, 31, 93, 95, - 93, 86, 165, 160, 81, 180, 164, -1, -1, 155 + 112, 66, 6, 1, 23, 40, 53, 20, 83, 66, + 27, 7, 86, 86, 86, 91, 84, 86, 93, 95, + 89, 38, 95, 95, 92, 18, 19, 94, 91, 91, + 23, 27, 95, 95, 9, 10, 11, 94, 0, 14, + 105, 54, 38, 103, 21, 91, 106, 94, 92, 95, + 25, 86, 117, 91, 95, 120, 60, 95, 33, 34, + 172, 36, 92, 89, 94, 177, 178, 70, 43, 85, + 86, 70, 76, 92, 49, 187, 51, 52, 85, 86, + 70, 29, 31, 93, 39, 8, 61, 152, 24, 64, + 65, 9, 10, 11, 159, 93, 14, 84, 47, 211, + 49, 86, 77, 78, 79, 86, 81, 25, 91, 84, + 90, 86, 31, 86, 67, 33, 34, 32, 36, 86, + 94, 96, 71, 94, 31, 43, 37, 46, 67, 94, + 49, 49, 86, 51, 52, 66, 92, 86, 89, 88, + 89, 53, 49, 61, 86, 94, 64, 65, 92, 92, + 91, 83, 71, 12, 12, 95, 93, 95, 92, 77, + 78, 79, 97, 81, 71, 89, 94, 86, 86, 88, + 89, 93, 89, 93, 12, 94, 40, 93, 96, 86, + 93, 88, 89, 93, 34, 190, 43, 94, 102, 98, + 93, 175, 170, 101, 10, 174 }; /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing symbol of state STATE-NUM. */ static const yytype_uint8 yystos[] = { - 0, 86, 99, 21, 0, 7, 27, 38, 100, 70, - 70, 70, 29, 101, 39, 84, 8, 40, 102, 103, - 86, 104, 105, 106, 109, 24, 86, 107, 108, 110, - 142, 91, 90, 106, 32, 9, 10, 11, 14, 25, - 33, 34, 36, 43, 49, 51, 52, 61, 64, 65, - 77, 78, 79, 81, 84, 86, 96, 111, 112, 113, - 115, 118, 120, 121, 122, 123, 124, 125, 126, 127, - 128, 129, 130, 131, 132, 138, 139, 143, 144, 107, - 109, 86, 67, 94, 94, 92, 94, 114, 37, 67, - 53, 94, 53, 94, 111, 6, 60, 76, 140, 84, - 92, 133, 27, 38, 141, 94, 150, 151, 94, 86, - 145, 146, 147, 86, 116, 117, 119, 31, 49, 71, - 86, 88, 89, 151, 154, 155, 156, 157, 158, 159, - 160, 161, 162, 163, 164, 116, 111, 95, 145, 111, - 95, 145, 89, 154, 18, 19, 23, 134, 135, 136, - 137, 111, 86, 89, 152, 153, 86, 148, 149, 111, - 91, 95, 20, 54, 92, 91, 95, 83, 95, 95, - 95, 97, 12, 111, 12, 93, 92, 95, 152, 92, - 91, 95, 85, 147, 154, 162, 85, 117, 154, 94, - 23, 154, 89, 89, 149, 93, 93, 95, 12, 93, - 93, 154 + 0, 86, 99, 94, 151, 152, 0, 86, 89, 153, + 154, 21, 92, 95, 153, 7, 27, 38, 100, 89, + 70, 70, 70, 29, 101, 93, 39, 84, 8, 40, + 102, 103, 86, 104, 105, 106, 109, 24, 86, 107, + 108, 110, 143, 91, 90, 106, 32, 9, 10, 11, + 14, 25, 33, 34, 36, 43, 49, 51, 52, 61, + 64, 65, 77, 78, 79, 81, 84, 86, 96, 111, + 112, 113, 115, 118, 120, 121, 122, 123, 125, 126, + 127, 128, 129, 130, 131, 132, 133, 139, 140, 144, + 145, 107, 109, 86, 67, 94, 94, 92, 94, 114, + 37, 67, 66, 94, 124, 53, 94, 111, 6, 60, + 76, 141, 84, 92, 134, 27, 38, 142, 151, 94, + 86, 146, 147, 148, 86, 116, 117, 119, 31, 47, + 49, 71, 86, 88, 89, 152, 155, 156, 157, 158, + 159, 160, 161, 162, 163, 164, 165, 116, 124, 114, + 95, 146, 53, 111, 95, 146, 89, 155, 18, 19, + 23, 135, 136, 137, 138, 111, 86, 149, 150, 111, + 91, 95, 20, 54, 92, 91, 95, 83, 83, 93, + 95, 95, 111, 95, 97, 12, 111, 12, 93, 92, + 91, 95, 85, 148, 155, 163, 85, 117, 155, 46, + 155, 94, 23, 155, 89, 150, 93, 93, 93, 93, + 95, 12, 93, 155 }; #define yyerrok (yyerrstatus = 0) @@ -1748,29 +1762,29 @@ yyreduce: switch (yyn) { case 2: -#line 233 "parse.y" +#line 235 "parse.y" { checkundefined(); } break; case 4: -#line 240 "parse.y" +#line 242 "parse.y" { error_message("implicit tagging is not supported"); } break; case 5: -#line 242 "parse.y" +#line 244 "parse.y" { error_message("automatic tagging is not supported"); } break; case 7: -#line 247 "parse.y" +#line 249 "parse.y" { error_message("no extensibility options supported"); } break; case 17: -#line 268 "parse.y" +#line 270 "parse.y" { struct string_list *sl; for(sl = (yyvsp[(1) - (4)].sl); sl != NULL; sl = sl->next) { @@ -1782,7 +1796,7 @@ yyreduce: break; case 22: -#line 287 "parse.y" +#line 289 "parse.y" { (yyval.sl) = emalloc(sizeof(*(yyval.sl))); (yyval.sl)->string = (yyvsp[(1) - (3)].name); @@ -1791,7 +1805,7 @@ yyreduce: break; case 23: -#line 293 "parse.y" +#line 295 "parse.y" { (yyval.sl) = emalloc(sizeof(*(yyval.sl))); (yyval.sl)->string = (yyvsp[(1) - (1)].name); @@ -1800,7 +1814,7 @@ yyreduce: break; case 24: -#line 301 "parse.y" +#line 303 "parse.y" { Symbol *s = addsym ((yyvsp[(1) - (3)].name)); s->stype = Stype; @@ -1811,7 +1825,7 @@ yyreduce: break; case 42: -#line 332 "parse.y" +#line 334 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_Boolean, TE_EXPLICIT, new_type(TBoolean)); @@ -1819,36 +1833,70 @@ yyreduce: break; case 43: -#line 339 "parse.y" +#line 341 "parse.y" { - if((yyvsp[(2) - (5)].value)->type != integervalue || - (yyvsp[(4) - (5)].value)->type != integervalue) - error_message("Non-integer value used in range"); - (yyval.range).min = (yyvsp[(2) - (5)].value)->u.integervalue; - (yyval.range).max = (yyvsp[(4) - (5)].value)->u.integervalue; + if((yyvsp[(2) - (5)].value)->type != integervalue) + error_message("Non-integer used in first part of range"); + if((yyvsp[(2) - (5)].value)->type != integervalue) + error_message("Non-integer in second part of range"); + (yyval.range) = ecalloc(1, sizeof(*(yyval.range))); + (yyval.range)->min = (yyvsp[(2) - (5)].value)->u.integervalue; + (yyval.range)->max = (yyvsp[(4) - (5)].value)->u.integervalue; } break; case 44: -#line 349 "parse.y" +#line 351 "parse.y" + { + if((yyvsp[(2) - (5)].value)->type != integervalue) + error_message("Non-integer in first part of range"); + (yyval.range) = ecalloc(1, sizeof(*(yyval.range))); + (yyval.range)->min = (yyvsp[(2) - (5)].value)->u.integervalue; + (yyval.range)->max = (yyvsp[(2) - (5)].value)->u.integervalue - 1; + } + break; + + case 45: +#line 359 "parse.y" + { + if((yyvsp[(4) - (5)].value)->type != integervalue) + error_message("Non-integer in second part of range"); + (yyval.range) = ecalloc(1, sizeof(*(yyval.range))); + (yyval.range)->min = (yyvsp[(4) - (5)].value)->u.integervalue + 2; + (yyval.range)->max = (yyvsp[(4) - (5)].value)->u.integervalue; + } + break; + + case 46: +#line 367 "parse.y" + { + if((yyvsp[(2) - (3)].value)->type != integervalue) + error_message("Non-integer used in limit"); + (yyval.range) = ecalloc(1, sizeof(*(yyval.range))); + (yyval.range)->min = (yyvsp[(2) - (3)].value)->u.integervalue; + (yyval.range)->max = (yyvsp[(2) - (3)].value)->u.integervalue; + } + break; + + case 47: +#line 378 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_Integer, TE_EXPLICIT, new_type(TInteger)); } break; - case 45: -#line 354 "parse.y" + case 48: +#line 383 "parse.y" { (yyval.type) = new_type(TInteger); - (yyval.type)->range = emalloc(sizeof(*(yyval.type)->range)); - *((yyval.type)->range) = (yyvsp[(2) - (2)].range); + (yyval.type)->range = (yyvsp[(2) - (2)].range); (yyval.type) = new_tag(ASN1_C_UNIV, UT_Integer, TE_EXPLICIT, (yyval.type)); } break; - case 46: -#line 361 "parse.y" + case 49: +#line 389 "parse.y" { (yyval.type) = new_type(TInteger); (yyval.type)->members = (yyvsp[(3) - (4)].members); @@ -1856,8 +1904,8 @@ yyreduce: } break; - case 47: -#line 369 "parse.y" + case 50: +#line 397 "parse.y" { (yyval.members) = emalloc(sizeof(*(yyval.members))); ASN1_TAILQ_INIT((yyval.members)); @@ -1865,21 +1913,21 @@ yyreduce: } break; - case 48: -#line 375 "parse.y" + case 51: +#line 403 "parse.y" { ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members); (yyval.members) = (yyvsp[(1) - (3)].members); } break; - case 49: -#line 380 "parse.y" + case 52: +#line 408 "parse.y" { (yyval.members) = (yyvsp[(1) - (3)].members); } break; - case 50: -#line 384 "parse.y" + case 53: +#line 412 "parse.y" { (yyval.member) = emalloc(sizeof(*(yyval.member))); (yyval.member)->name = (yyvsp[(1) - (4)].name); @@ -1892,8 +1940,8 @@ yyreduce: } break; - case 51: -#line 397 "parse.y" + case 54: +#line 425 "parse.y" { (yyval.type) = new_type(TInteger); (yyval.type)->members = (yyvsp[(3) - (4)].members); @@ -1901,8 +1949,8 @@ yyreduce: } break; - case 53: -#line 408 "parse.y" + case 56: +#line 436 "parse.y" { (yyval.type) = new_type(TBitString); (yyval.type)->members = emalloc(sizeof(*(yyval.type)->members)); @@ -1911,8 +1959,8 @@ yyreduce: } break; - case 54: -#line 415 "parse.y" + case 57: +#line 443 "parse.y" { (yyval.type) = new_type(TBitString); (yyval.type)->members = (yyvsp[(4) - (5)].members); @@ -1920,32 +1968,44 @@ yyreduce: } break; - case 55: -#line 423 "parse.y" + case 58: +#line 451 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_OID, TE_EXPLICIT, new_type(TOID)); } break; - case 56: -#line 429 "parse.y" + case 59: +#line 457 "parse.y" { - (yyval.type) = new_tag(ASN1_C_UNIV, UT_OctetString, - TE_EXPLICIT, new_type(TOctetString)); + Type *t = new_type(TOctetString); + t->range = (yyvsp[(3) - (3)].range); + (yyval.type) = new_tag(ASN1_C_UNIV, UT_OctetString, + TE_EXPLICIT, t); } break; - case 57: -#line 436 "parse.y" + case 60: +#line 466 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_Null, TE_EXPLICIT, new_type(TNull)); } break; - case 58: -#line 443 "parse.y" + case 61: +#line 473 "parse.y" + { (yyval.range) = NULL; } + break; + + case 62: +#line 475 "parse.y" + { (yyval.range) = (yyvsp[(2) - (2)].range); } + break; + + case 63: +#line 480 "parse.y" { (yyval.type) = new_type(TSequence); (yyval.type)->members = (yyvsp[(3) - (4)].members); @@ -1953,8 +2013,8 @@ yyreduce: } break; - case 59: -#line 449 "parse.y" + case 64: +#line 486 "parse.y" { (yyval.type) = new_type(TSequence); (yyval.type)->members = NULL; @@ -1962,17 +2022,18 @@ yyreduce: } break; - case 60: -#line 457 "parse.y" + case 65: +#line 494 "parse.y" { (yyval.type) = new_type(TSequenceOf); - (yyval.type)->subtype = (yyvsp[(3) - (3)].type); + (yyval.type)->range = (yyvsp[(2) - (4)].range); + (yyval.type)->subtype = (yyvsp[(4) - (4)].type); (yyval.type) = new_tag(ASN1_C_UNIV, UT_Sequence, TE_EXPLICIT, (yyval.type)); } break; - case 61: -#line 465 "parse.y" + case 66: +#line 503 "parse.y" { (yyval.type) = new_type(TSet); (yyval.type)->members = (yyvsp[(3) - (4)].members); @@ -1980,8 +2041,8 @@ yyreduce: } break; - case 62: -#line 471 "parse.y" + case 67: +#line 509 "parse.y" { (yyval.type) = new_type(TSet); (yyval.type)->members = NULL; @@ -1989,8 +2050,8 @@ yyreduce: } break; - case 63: -#line 479 "parse.y" + case 68: +#line 517 "parse.y" { (yyval.type) = new_type(TSetOf); (yyval.type)->subtype = (yyvsp[(3) - (3)].type); @@ -1998,16 +2059,16 @@ yyreduce: } break; - case 64: -#line 487 "parse.y" + case 69: +#line 525 "parse.y" { (yyval.type) = new_type(TChoice); (yyval.type)->members = (yyvsp[(3) - (4)].members); } break; - case 67: -#line 498 "parse.y" + case 72: +#line 536 "parse.y" { Symbol *s = addsym((yyvsp[(1) - (1)].name)); (yyval.type) = new_type(TType); @@ -2018,24 +2079,24 @@ yyreduce: } break; - case 68: -#line 509 "parse.y" + case 73: +#line 547 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralizedTime, TE_EXPLICIT, new_type(TGeneralizedTime)); } break; - case 69: -#line 514 "parse.y" + case 74: +#line 552 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTCTime, TE_EXPLICIT, new_type(TUTCTime)); } break; - case 70: -#line 521 "parse.y" + case 75: +#line 559 "parse.y" { /* if (Constraint.type == contentConstrant) { assert(Constraint.u.constraint.type == octetstring|bitstring-w/o-NamedBitList); // remember to check type reference too @@ -2050,15 +2111,15 @@ yyreduce: } break; - case 71: -#line 537 "parse.y" + case 76: +#line 575 "parse.y" { (yyval.constraint_spec) = (yyvsp[(2) - (3)].constraint_spec); } break; - case 75: -#line 550 "parse.y" + case 80: +#line 588 "parse.y" { (yyval.constraint_spec) = new_constraint_spec(CT_CONTENTS); (yyval.constraint_spec)->u.content.type = (yyvsp[(2) - (2)].type); @@ -2066,8 +2127,8 @@ yyreduce: } break; - case 76: -#line 556 "parse.y" + case 81: +#line 594 "parse.y" { if ((yyvsp[(3) - (3)].value)->type != objectidentifiervalue) error_message("Non-OID used in ENCODED BY constraint"); @@ -2077,8 +2138,8 @@ yyreduce: } break; - case 77: -#line 564 "parse.y" + case 82: +#line 602 "parse.y" { if ((yyvsp[(5) - (5)].value)->type != objectidentifiervalue) error_message("Non-OID used in ENCODED BY constraint"); @@ -2088,15 +2149,15 @@ yyreduce: } break; - case 78: -#line 574 "parse.y" + case 83: +#line 612 "parse.y" { (yyval.constraint_spec) = new_constraint_spec(CT_USER); } break; - case 79: -#line 580 "parse.y" + case 84: +#line 618 "parse.y" { (yyval.type) = new_type(TTag); (yyval.type)->tag = (yyvsp[(1) - (3)].tag); @@ -2109,8 +2170,8 @@ yyreduce: } break; - case 80: -#line 593 "parse.y" + case 85: +#line 631 "parse.y" { (yyval.tag).tagclass = (yyvsp[(2) - (4)].constant); (yyval.tag).tagvalue = (yyvsp[(3) - (4)].constant); @@ -2118,57 +2179,57 @@ yyreduce: } break; - case 81: -#line 601 "parse.y" + case 86: +#line 639 "parse.y" { (yyval.constant) = ASN1_C_CONTEXT; } break; - case 82: -#line 605 "parse.y" + case 87: +#line 643 "parse.y" { (yyval.constant) = ASN1_C_UNIV; } break; - case 83: -#line 609 "parse.y" + case 88: +#line 647 "parse.y" { (yyval.constant) = ASN1_C_APPL; } break; - case 84: -#line 613 "parse.y" + case 89: +#line 651 "parse.y" { (yyval.constant) = ASN1_C_PRIVATE; } break; - case 85: -#line 619 "parse.y" + case 90: +#line 657 "parse.y" { (yyval.constant) = TE_EXPLICIT; } break; - case 86: -#line 623 "parse.y" + case 91: +#line 661 "parse.y" { (yyval.constant) = TE_EXPLICIT; } break; - case 87: -#line 627 "parse.y" + case 92: +#line 665 "parse.y" { (yyval.constant) = TE_IMPLICIT; } break; - case 88: -#line 634 "parse.y" + case 93: +#line 672 "parse.y" { Symbol *s; s = addsym ((yyvsp[(1) - (4)].name)); @@ -2179,64 +2240,64 @@ yyreduce: } break; - case 90: -#line 648 "parse.y" + case 95: +#line 686 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_GeneralString, TE_EXPLICIT, new_type(TGeneralString)); } break; - case 91: -#line 653 "parse.y" + case 96: +#line 691 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_UTF8String, TE_EXPLICIT, new_type(TUTF8String)); } break; - case 92: -#line 658 "parse.y" + case 97: +#line 696 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_PrintableString, TE_EXPLICIT, new_type(TPrintableString)); } break; - case 93: -#line 663 "parse.y" + case 98: +#line 701 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_VisibleString, TE_EXPLICIT, new_type(TVisibleString)); } break; - case 94: -#line 668 "parse.y" + case 99: +#line 706 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_IA5String, TE_EXPLICIT, new_type(TIA5String)); } break; - case 95: -#line 673 "parse.y" + case 100: +#line 711 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_BMPString, TE_EXPLICIT, new_type(TBMPString)); } break; - case 96: -#line 678 "parse.y" + case 101: +#line 716 "parse.y" { (yyval.type) = new_tag(ASN1_C_UNIV, UT_UniversalString, TE_EXPLICIT, new_type(TUniversalString)); } break; - case 97: -#line 686 "parse.y" + case 102: +#line 724 "parse.y" { (yyval.members) = emalloc(sizeof(*(yyval.members))); ASN1_TAILQ_INIT((yyval.members)); @@ -2244,16 +2305,16 @@ yyreduce: } break; - case 98: -#line 692 "parse.y" + case 103: +#line 730 "parse.y" { ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members); (yyval.members) = (yyvsp[(1) - (3)].members); } break; - case 99: -#line 697 "parse.y" + case 104: +#line 735 "parse.y" { struct member *m = ecalloc(1, sizeof(*m)); m->name = estrdup("..."); @@ -2264,8 +2325,8 @@ yyreduce: } break; - case 100: -#line 708 "parse.y" + case 105: +#line 746 "parse.y" { (yyval.member) = emalloc(sizeof(*(yyval.member))); (yyval.member)->name = (yyvsp[(1) - (2)].name); @@ -2276,8 +2337,8 @@ yyreduce: } break; - case 101: -#line 719 "parse.y" + case 106: +#line 757 "parse.y" { (yyval.member) = (yyvsp[(1) - (1)].member); (yyval.member)->optional = 0; @@ -2285,8 +2346,8 @@ yyreduce: } break; - case 102: -#line 725 "parse.y" + case 107: +#line 763 "parse.y" { (yyval.member) = (yyvsp[(1) - (2)].member); (yyval.member)->optional = 1; @@ -2294,8 +2355,8 @@ yyreduce: } break; - case 103: -#line 731 "parse.y" + case 108: +#line 769 "parse.y" { (yyval.member) = (yyvsp[(1) - (3)].member); (yyval.member)->optional = 0; @@ -2303,8 +2364,8 @@ yyreduce: } break; - case 104: -#line 739 "parse.y" + case 109: +#line 777 "parse.y" { (yyval.members) = emalloc(sizeof(*(yyval.members))); ASN1_TAILQ_INIT((yyval.members)); @@ -2312,16 +2373,16 @@ yyreduce: } break; - case 105: -#line 745 "parse.y" + case 110: +#line 783 "parse.y" { ASN1_TAILQ_INSERT_TAIL((yyvsp[(1) - (3)].members), (yyvsp[(3) - (3)].member), members); (yyval.members) = (yyvsp[(1) - (3)].members); } break; - case 106: -#line 752 "parse.y" + case 111: +#line 790 "parse.y" { (yyval.member) = emalloc(sizeof(*(yyval.member))); (yyval.member)->name = (yyvsp[(1) - (4)].name); @@ -2334,27 +2395,27 @@ yyreduce: } break; - case 108: -#line 765 "parse.y" + case 113: +#line 803 "parse.y" { (yyval.objid) = NULL; } break; - case 109: -#line 769 "parse.y" + case 114: +#line 807 "parse.y" { (yyval.objid) = (yyvsp[(2) - (3)].objid); } break; - case 110: -#line 775 "parse.y" + case 115: +#line 813 "parse.y" { (yyval.objid) = NULL; } break; - case 111: -#line 779 "parse.y" + case 116: +#line 817 "parse.y" { if ((yyvsp[(2) - (2)].objid)) { (yyval.objid) = (yyvsp[(2) - (2)].objid); @@ -2365,15 +2426,15 @@ yyreduce: } break; - case 112: -#line 790 "parse.y" + case 117: +#line 828 "parse.y" { (yyval.objid) = new_objid((yyvsp[(1) - (4)].name), (yyvsp[(3) - (4)].constant)); } break; - case 113: -#line 794 "parse.y" + case 118: +#line 832 "parse.y" { Symbol *s = addsym((yyvsp[(1) - (1)].name)); if(s->stype != SValue || @@ -2386,15 +2447,15 @@ yyreduce: } break; - case 114: -#line 805 "parse.y" + case 119: +#line 843 "parse.y" { (yyval.objid) = new_objid(NULL, (yyvsp[(1) - (1)].constant)); } break; - case 124: -#line 828 "parse.y" + case 129: +#line 866 "parse.y" { Symbol *s = addsym((yyvsp[(1) - (1)].name)); if(s->stype != SValue) @@ -2405,8 +2466,8 @@ yyreduce: } break; - case 125: -#line 839 "parse.y" + case 130: +#line 877 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = stringvalue; @@ -2414,8 +2475,8 @@ yyreduce: } break; - case 126: -#line 847 "parse.y" + case 131: +#line 885 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = booleanvalue; @@ -2423,8 +2484,8 @@ yyreduce: } break; - case 127: -#line 853 "parse.y" + case 132: +#line 891 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = booleanvalue; @@ -2432,8 +2493,8 @@ yyreduce: } break; - case 128: -#line 861 "parse.y" + case 133: +#line 899 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = integervalue; @@ -2441,14 +2502,14 @@ yyreduce: } break; - case 130: -#line 872 "parse.y" + case 135: +#line 910 "parse.y" { } break; - case 131: -#line 877 "parse.y" + case 136: +#line 915 "parse.y" { (yyval.value) = emalloc(sizeof(*(yyval.value))); (yyval.value)->type = objectidentifiervalue; @@ -2458,7 +2519,7 @@ yyreduce: /* Line 1267 of yacc.c. */ -#line 2464 "parse.c" +#line 2523 "parse.c" default: break; } YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc); @@ -2672,7 +2733,7 @@ yyreturn: } -#line 884 "parse.y" +#line 922 "parse.y" void diff --git a/source4/heimdal/lib/asn1/parse.h b/source4/heimdal/lib/asn1/parse.h index a0c26d50f1..5e73094f9e 100644 --- a/source4/heimdal/lib/asn1/parse.h +++ b/source4/heimdal/lib/asn1/parse.h @@ -16,7 +16,9 @@ GNU General Public License for more details. You should have received a copy of the GNU General Public License - along with this program; if not, see <http://www.gnu.org/licenses/>. */ + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, + Boston, MA 02110-1301, USA. */ /* As a special exception, you may create a larger work that contains part or all of the Bison parser skeleton and distribute that work @@ -224,7 +226,7 @@ typedef union YYSTYPE { int constant; struct value *value; - struct range range; + struct range *range; char *name; Type *type; Member *member; diff --git a/source4/heimdal/lib/asn1/rfc2459.asn1 b/source4/heimdal/lib/asn1/rfc2459.asn1 index 71f197eba7..0ec3b695eb 100644 --- a/source4/heimdal/lib/asn1/rfc2459.asn1 +++ b/source4/heimdal/lib/asn1/rfc2459.asn1 @@ -169,7 +169,7 @@ Extension ::= SEQUENCE { extnValue OCTET STRING } -Extensions ::= SEQUENCE OF Extension -- SIZE (1..MAX) +Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension TBSCertificate ::= SEQUENCE { version [0] Version OPTIONAL, -- EXPLICIT nnn DEFAULT 1, @@ -232,7 +232,7 @@ GeneralName ::= CHOICE { registeredID [8] IMPLICIT OBJECT IDENTIFIER } -GeneralNames ::= SEQUENCE -- SIZE (1..MAX) -- OF GeneralName +GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName id-x509-ce-keyUsage OBJECT IDENTIFIER ::= { id-x509-ce 15 } @@ -320,7 +320,7 @@ DistributionPointReasonFlags ::= BIT STRING { } DistributionPointName ::= CHOICE { - fullName [0] IMPLICIT -- GeneralNames -- SEQUENCE -- SIZE (1..MAX) -- OF GeneralName, + fullName [0] IMPLICIT -- GeneralNames -- SEQUENCE SIZE (1..MAX) OF GeneralName, nameRelativeToCRLIssuer [1] RelativeDistinguishedName } @@ -330,7 +330,7 @@ DistributionPoint ::= SEQUENCE { cRLIssuer [2] IMPLICIT heim_any -- GeneralNames -- OPTIONAL } -CRLDistributionPoints ::= SEQUENCE -- SIZE (1..MAX) -- OF DistributionPoint +CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint -- rfc3279 @@ -449,11 +449,20 @@ id-pkix-kp-emailProtection OBJECT IDENTIFIER ::= { id-pkix-kp 4 } id-pkix-kp-timeStamping OBJECT IDENTIFIER ::= { id-pkix-kp 8 } id-pkix-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-pkix-kp 9 } --- RFC 3820 Proxy Certificate Profile - id-pkix-pe OBJECT IDENTIFIER ::= { id-pkix 1 } -id-pe-proxyCertInfo OBJECT IDENTIFIER ::= { id-pkix-pe 14 } +id-pkix-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pkix-pe 1 } + +AccessDescription ::= SEQUENCE { + accessMethod OBJECT IDENTIFIER, + accessLocation GeneralName +} + +AuthorityInfoAccessSyntax ::= SEQUENCE SIZE (1..MAX) OF AccessDescription + +-- RFC 3820 Proxy Certificate Profile + +id-pkix-pe-proxyCertInfo OBJECT IDENTIFIER ::= { id-pkix-pe 14 } id-pkix-ppl OBJECT IDENTIFIER ::= { id-pkix 21 } diff --git a/source4/heimdal/lib/asn1/test.asn1 b/source4/heimdal/lib/asn1/test.asn1 index 98b507a4da..b2f58a20c2 100644 --- a/source4/heimdal/lib/asn1/test.asn1 +++ b/source4/heimdal/lib/asn1/test.asn1 @@ -1,4 +1,4 @@ --- $Id: test.asn1 18013 2006-09-05 14:00:44Z lha $ -- +-- $Id: test.asn1 21455 2007-07-10 12:51:19Z lha $ -- TEST DEFINITIONS ::= @@ -85,4 +85,11 @@ TESTUSERCONSTRAINED ::= OCTET STRING (CONSTRAINED BY { -- meh -- }) TESTSeqOf ::= SEQUENCE OF TESTInteger +TESTSeqSizeOf1 ::= SEQUENCE SIZE (2) OF TESTInteger +TESTSeqSizeOf2 ::= SEQUENCE SIZE (1..2) OF TESTInteger +TESTSeqSizeOf3 ::= SEQUENCE SIZE (1..MAX) OF TESTInteger +TESTSeqSizeOf4 ::= SEQUENCE SIZE (MIN..2) OF TESTInteger + +TESTOSSize1 ::= OCTET STRING SIZE (1..2) + END diff --git a/source4/heimdal/lib/asn1/timegm.c b/source4/heimdal/lib/asn1/timegm.c index a6776458cf..33b9684a5d 100644 --- a/source4/heimdal/lib/asn1/timegm.c +++ b/source4/heimdal/lib/asn1/timegm.c @@ -33,7 +33,7 @@ #include "der_locl.h" -RCSID("$Id: timegm.c 18607 2006-10-19 16:19:32Z lha $"); +RCSID("$Id: timegm.c 21366 2007-06-27 10:06:22Z lha $"); static int is_leap(unsigned y) @@ -43,8 +43,8 @@ is_leap(unsigned y) } /* - * This is a simplifed version of _der_timegm that doesn't accept out - * of bound values that timegm(3) normally accepts but those are not + * This is a simplifed version of timegm(3) that doesn't accept out of + * bound values that timegm(3) normally accepts but those are not * valid in asn1 encodings. */ diff --git a/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c b/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c index d6e448a223..cb1b62308c 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c +++ b/source4/heimdal/lib/gssapi/mech/gss_acquire_cred.c @@ -27,7 +27,7 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_acquire_cred.c 20626 2007-05-08 13:56:49Z lha $"); +RCSID("$Id: gss_acquire_cred.c 21478 2007-07-10 16:32:01Z lha $"); OM_uint32 gss_acquire_cred(OM_uint32 *minor_status, @@ -50,7 +50,7 @@ gss_acquire_cred(OM_uint32 *minor_status, int i; *minor_status = 0; - if (actual_mechs) + if (output_cred_handle) *output_cred_handle = GSS_C_NO_CREDENTIAL; if (actual_mechs) *actual_mechs = GSS_C_NO_OID_SET; @@ -106,8 +106,9 @@ gss_acquire_cred(OM_uint32 *minor_status, continue; if (desired_name != GSS_C_NO_NAME) { - mn = _gss_find_mn(name, &mechs->elements[i]); - if (!mn) + major_status = _gss_find_mn(minor_status, name, + &mechs->elements[i], &mn); + if (major_status != GSS_S_COMPLETE) continue; } diff --git a/source4/heimdal/lib/gssapi/mech/gss_add_cred.c b/source4/heimdal/lib/gssapi/mech/gss_add_cred.c index 4947c5c30e..09b592b5da 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_add_cred.c +++ b/source4/heimdal/lib/gssapi/mech/gss_add_cred.c @@ -27,7 +27,7 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_add_cred.c 20626 2007-05-08 13:56:49Z lha $"); +RCSID("$Id: gss_add_cred.c 21474 2007-07-10 16:30:23Z lha $"); static struct _gss_mechanism_cred * _gss_copy_cred(struct _gss_mechanism_cred *mc) @@ -136,11 +136,13 @@ gss_add_cred(OM_uint32 *minor_status, * Figure out a suitable mn, if any. */ if (desired_name) { - mn = _gss_find_mn((struct _gss_name *) desired_name, - desired_mech); - if (!mn) { + major_status = _gss_find_mn(minor_status, + (struct _gss_name *) desired_name, + desired_mech, + &mn); + if (major_status != GSS_S_COMPLETE) { free(new_cred); - return (GSS_S_BAD_NAME); + return major_status; } } else { mn = 0; diff --git a/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c b/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c index 1437a9bc7b..c950c03166 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c +++ b/source4/heimdal/lib/gssapi/mech/gss_canonicalize_name.c @@ -27,7 +27,7 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_canonicalize_name.c 19928 2007-01-16 10:37:54Z lha $"); +RCSID("$Id: gss_canonicalize_name.c 21476 2007-07-10 16:31:27Z lha $"); OM_uint32 gss_canonicalize_name(OM_uint32 *minor_status, @@ -44,10 +44,9 @@ gss_canonicalize_name(OM_uint32 *minor_status, *minor_status = 0; *output_name = 0; - mn = _gss_find_mn(name, mech_type); - if (!mn) { - return (GSS_S_BAD_MECH); - } + major_status = _gss_find_mn(minor_status, name, mech_type, &mn); + if (major_status) + return major_status; m = mn->gmn_mech; major_status = m->gm_canonicalize_name(minor_status, diff --git a/source4/heimdal/lib/gssapi/mech/gss_compare_name.c b/source4/heimdal/lib/gssapi/mech/gss_compare_name.c index 147ad60c94..617ff13d98 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_compare_name.c +++ b/source4/heimdal/lib/gssapi/mech/gss_compare_name.c @@ -27,7 +27,7 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_compare_name.c 17700 2006-06-28 09:00:26Z lha $"); +RCSID("$Id: gss_compare_name.c 21475 2007-07-10 16:31:03Z lha $"); OM_uint32 gss_compare_name(OM_uint32 *minor_status, @@ -57,8 +57,11 @@ gss_compare_name(OM_uint32 *minor_status, struct _gss_mechanism_name *mn2; SLIST_FOREACH(mn1, &name1->gn_mn, gmn_link) { - mn2 = _gss_find_mn(name2, mn1->gmn_mech_oid); - if (mn2) { + OM_uint32 major_status; + + major_status = _gss_find_mn(minor_status, name2, + mn1->gmn_mech_oid, &mn2); + if (major_status == GSS_S_COMPLETE) { return (mn1->gmn_mech->gm_compare_name( minor_status, mn1->gmn_name, diff --git a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c index 4ff81fdf2d..f38c840b31 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c +++ b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c @@ -27,7 +27,7 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_duplicate_name.c 21219 2007-06-20 08:27:11Z lha $"); +RCSID("$Id: gss_duplicate_name.c 21480 2007-07-10 16:32:32Z lha $"); OM_uint32 gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t src_name, @@ -54,7 +54,9 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status, new_name = (struct _gss_name *) *dest_name; SLIST_FOREACH(mn, &name->gn_mn, gmn_link) { - _gss_find_mn(new_name, mn->gmn_mech_oid); + struct _gss_mechanism_name *mn2; + _gss_find_mn(minor_status, new_name, + mn->gmn_mech_oid, &mn2); } } else { new_name = malloc(sizeof(struct _gss_name)); diff --git a/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c b/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c index c1c058d146..b9a1680dcb 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c +++ b/source4/heimdal/lib/gssapi/mech/gss_init_sec_context.c @@ -27,7 +27,7 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_init_sec_context.c 19957 2007-01-17 13:48:11Z lha $"); +RCSID("$Id: gss_init_sec_context.c 21479 2007-07-10 16:32:19Z lha $"); static gss_cred_id_t _gss_mech_cred_find(gss_cred_id_t cred_handle, gss_OID mech_type) @@ -109,11 +109,11 @@ gss_init_sec_context(OM_uint32 * minor_status, /* * Find the MN for this mechanism. */ - mn = _gss_find_mn(name, mech_type); - if (mn == NULL) { + major_status = _gss_find_mn(minor_status, name, mech_type, &mn); + if (major_status != GSS_S_COMPLETE) { if (allocated_ctx) free(ctx); - return GSS_S_BAD_NAME; + return major_status; } /* diff --git a/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c b/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c index 604027490e..f1a18afb13 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c +++ b/source4/heimdal/lib/gssapi/mech/gss_mech_switch.c @@ -28,7 +28,7 @@ #include "mech_locl.h" #include <heim_threads.h> -RCSID("$Id: gss_mech_switch.c 20625 2007-05-08 13:55:03Z lha $"); +RCSID("$Id: gss_mech_switch.c 21700 2007-07-26 19:08:34Z lha $"); #ifndef _PATH_GSS_MECH #define _PATH_GSS_MECH "/etc/gss/mech" @@ -223,9 +223,9 @@ _gss_load_mech(void) add_builtin(__gss_spnego_initialize()); add_builtin(__gss_ntlm_initialize()); +#ifdef HAVE_DLOPEN fp = fopen(_PATH_GSS_MECH, "r"); if (!fp) { -/* perror(_PATH_GSS_MECH); */ HEIMDAL_MUTEX_unlock(&_gss_mech_mutex); return; } @@ -316,6 +316,7 @@ _gss_load_mech(void) continue; } fclose(fp); +#endif HEIMDAL_MUTEX_unlock(&_gss_mech_mutex); } diff --git a/source4/heimdal/lib/gssapi/mech/gss_names.c b/source4/heimdal/lib/gssapi/mech/gss_names.c index 3ab609c192..f78672d837 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_names.c +++ b/source4/heimdal/lib/gssapi/mech/gss_names.c @@ -27,15 +27,18 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_names.c 19928 2007-01-16 10:37:54Z lha $"); +RCSID("$Id: gss_names.c 21473 2007-07-10 16:29:53Z lha $"); -struct _gss_mechanism_name * -_gss_find_mn(struct _gss_name *name, gss_OID mech) +OM_uint32 +_gss_find_mn(OM_uint32 *minor_status, struct _gss_name *name, gss_OID mech, + struct _gss_mechanism_name **output_mn) { - OM_uint32 major_status, minor_status; + OM_uint32 major_status; gssapi_mech_interface m; struct _gss_mechanism_name *mn; + *output_mn = NULL; + SLIST_FOREACH(mn, &name->gn_mn, gmn_link) { if (gss_oid_equal(mech, mn->gmn_mech_oid)) break; @@ -47,34 +50,36 @@ _gss_find_mn(struct _gss_name *name, gss_OID mech) * MN but it is from a different mech), give up now. */ if (!name->gn_value.value) - return (0); + return GSS_S_BAD_NAME; m = __gss_get_mechanism(mech); if (!m) - return (0); + return (GSS_S_BAD_MECH); mn = malloc(sizeof(struct _gss_mechanism_name)); if (!mn) - return (0); + return GSS_S_FAILURE; - major_status = m->gm_import_name(&minor_status, + major_status = m->gm_import_name(minor_status, &name->gn_value, (name->gn_type.elements ? &name->gn_type : GSS_C_NO_OID), &mn->gmn_name); if (major_status != GSS_S_COMPLETE) { - _gss_mg_error(m, major_status, minor_status); + _gss_mg_error(m, major_status, *minor_status); free(mn); - return (0); + return major_status; } mn->gmn_mech = m; mn->gmn_mech_oid = &m->gm_mech_oid; SLIST_INSERT_HEAD(&name->gn_mn, mn, gmn_link); } - return (mn); + *output_mn = mn; + return 0; } + /* * Make a name from an MN. */ diff --git a/source4/heimdal/lib/gssapi/mech/gss_oid_to_str.c b/source4/heimdal/lib/gssapi/mech/gss_oid_to_str.c index 3195370b77..e2cecaf6b4 100644 --- a/source4/heimdal/lib/gssapi/mech/gss_oid_to_str.c +++ b/source4/heimdal/lib/gssapi/mech/gss_oid_to_str.c @@ -32,7 +32,7 @@ */ #include "mech_locl.h" -RCSID("$Id: gss_oid_to_str.c 19963 2007-01-17 16:01:22Z lha $"); +RCSID("$Id: gss_oid_to_str.c 21409 2007-07-04 14:19:11Z lha $"); OM_uint32 gss_oid_to_str(OM_uint32 *minor_status, gss_OID oid, gss_buffer_t oid_str) @@ -44,6 +44,9 @@ gss_oid_to_str(OM_uint32 *minor_status, gss_OID oid, gss_buffer_t oid_str) _mg_buffer_zero(oid_str); + if (oid == GSS_C_NULL_OID) + return GSS_S_FAILURE; + ret = der_get_oid (oid->elements, oid->length, &o, &size); if (ret) { *minor_status = ret; diff --git a/source4/heimdal/lib/gssapi/mech/name.h b/source4/heimdal/lib/gssapi/mech/name.h index 2252150a06..7c9ba33d85 100644 --- a/source4/heimdal/lib/gssapi/mech/name.h +++ b/source4/heimdal/lib/gssapi/mech/name.h @@ -24,7 +24,7 @@ * SUCH DAMAGE. * * $FreeBSD: src/lib/libgssapi/name.h,v 1.1 2005/12/29 14:40:20 dfr Exp $ - * $Id: name.h 18246 2006-10-05 18:36:07Z lha $ + * $Id: name.h 21477 2007-07-10 16:31:44Z lha $ */ struct _gss_mechanism_name { @@ -41,7 +41,8 @@ struct _gss_name { struct _gss_mechanism_name_list gn_mn; /* list of MNs */ }; -struct _gss_mechanism_name * - _gss_find_mn(struct _gss_name *name, gss_OID mech); +OM_uint32 + _gss_find_mn(OM_uint32 *, struct _gss_name *, gss_OID, + struct _gss_mechanism_name **); struct _gss_name * _gss_make_name(gssapi_mech_interface m, gss_name_t new_mn); diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c index d20c913bf0..1afe26f1e3 100644 --- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c +++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c @@ -33,7 +33,7 @@ #include "spnego/spnego_locl.h" -RCSID("$Id: accept_sec_context.c 21243 2007-06-20 15:16:22Z lha $"); +RCSID("$Id: accept_sec_context.c 21461 2007-07-10 14:01:13Z lha $"); static OM_uint32 send_reject (OM_uint32 *minor_status, @@ -555,23 +555,16 @@ acceptor_start int get_mic = 0; int first_ok = 0; - if (src_name) - *src_name = GSS_C_NO_NAME; - mech_output_token.value = NULL; mech_output_token.length = 0; mech_buf.value = NULL; - if (*context_handle == GSS_C_NO_CONTEXT) { - ret = _gss_spnego_alloc_sec_context(minor_status, - context_handle); - if (ret != GSS_S_COMPLETE) - return ret; - - if (input_token_buffer->length == 0) { - return send_supported_mechs (minor_status, output_token); - } - } + if (input_token_buffer->length == 0) + return send_supported_mechs (minor_status, output_token); + + ret = _gss_spnego_alloc_sec_context(minor_status, context_handle); + if (ret != GSS_S_COMPLETE) + return ret; ctx = (gssspnego_ctx)*context_handle; diff --git a/source4/heimdal/lib/gssapi/spnego/spnego.asn1 b/source4/heimdal/lib/gssapi/spnego/spnego.asn1 index aed67dc4ae..058f10ba3a 100644 --- a/source4/heimdal/lib/gssapi/spnego/spnego.asn1 +++ b/source4/heimdal/lib/gssapi/spnego/spnego.asn1 @@ -1,4 +1,4 @@ --- $Id: spnego.asn1 19420 2006-12-18 18:28:49Z lha $ +-- $Id: spnego.asn1 21403 2007-07-04 08:13:12Z lha $ SPNEGO DEFINITIONS ::= BEGIN @@ -8,34 +8,34 @@ MechType::= OBJECT IDENTIFIER MechTypeList ::= SEQUENCE OF MechType ContextFlags ::= BIT STRING { - delegFlag (0), - mutualFlag (1), - replayFlag (2), - sequenceFlag (3), - anonFlag (4), - confFlag (5), - integFlag (6) + delegFlag (0), + mutualFlag (1), + replayFlag (2), + sequenceFlag (3), + anonFlag (4), + confFlag (5), + integFlag (6) } NegHints ::= SEQUENCE { - hintName [0] GeneralString OPTIONAL, - hintAddress [1] OCTET STRING OPTIONAL + hintName [0] GeneralString OPTIONAL, + hintAddress [1] OCTET STRING OPTIONAL } NegTokenInitWin ::= SEQUENCE { - mechTypes [0] MechTypeList, - reqFlags [1] ContextFlags OPTIONAL, - mechToken [2] OCTET STRING OPTIONAL, - negHints [3] NegHints OPTIONAL - } + mechTypes [0] MechTypeList, + reqFlags [1] ContextFlags OPTIONAL, + mechToken [2] OCTET STRING OPTIONAL, + negHints [3] NegHints OPTIONAL +} NegTokenInit ::= SEQUENCE { - mechTypes [0] MechTypeList, - reqFlags [1] ContextFlags OPTIONAL, - mechToken [2] OCTET STRING OPTIONAL, - mechListMIC [3] OCTET STRING OPTIONAL - } - + mechTypes [0] MechTypeList, + reqFlags [1] ContextFlags OPTIONAL, + mechToken [2] OCTET STRING OPTIONAL, + mechListMIC [3] OCTET STRING OPTIONAL, + ... +} -- NB: negResult is not OPTIONAL in the new SPNEGO spec but -- Windows clients do not always send it @@ -47,7 +47,8 @@ NegTokenResp ::= SEQUENCE { request-mic (3) } OPTIONAL, supportedMech [1] MechType OPTIONAL, responseToken [2] OCTET STRING OPTIONAL, - mechListMIC [3] OCTET STRING OPTIONAL + mechListMIC [3] OCTET STRING OPTIONAL, + ... } NegotiationToken ::= CHOICE { diff --git a/source4/heimdal/lib/hcrypto/hmac.c b/source4/heimdal/lib/hcrypto/hmac.c index 848b987a90..b8156e38d4 100644 --- a/source4/heimdal/lib/hcrypto/hmac.c +++ b/source4/heimdal/lib/hcrypto/hmac.c @@ -52,8 +52,10 @@ HMAC_Init_ex(HMAC_CTX *ctx, if (ctx->md != md) { ctx->md = md; - if (ctx->buf) + if (ctx->buf) { + memset(ctx->buf, 0, ctx->key_length); free (ctx->buf); + } ctx->key_length = EVP_MD_size(ctx->md); ctx->buf = malloc(ctx->key_length); } @@ -67,10 +69,14 @@ HMAC_Init_ex(HMAC_CTX *ctx, keylen = EVP_MD_size(ctx->md); } - if (ctx->opad) + if (ctx->opad) { + memset(ctx->opad, 0, ctx->key_length); free(ctx->opad); - if (ctx->ipad) + } + if (ctx->ipad) { + memset(ctx->ipad, 0, ctx->key_length); free(ctx->ipad); + } ctx->opad = malloc(EVP_MD_block_size(ctx->md)); ctx->ipad = malloc(EVP_MD_block_size(ctx->md)); diff --git a/source4/heimdal/lib/hx509/ca.c b/source4/heimdal/lib/hx509/ca.c index 0e48269aa4..bf8fe1be1a 100644 --- a/source4/heimdal/lib/hx509/ca.c +++ b/source4/heimdal/lib/hx509/ca.c @@ -33,7 +33,7 @@ #include "hx_locl.h" #include <pkinit_asn1.h> -RCSID("$Id: ca.c 20904 2007-06-05 01:58:45Z lha $"); +RCSID("$Id: ca.c 21379 2007-06-28 07:38:17Z lha $"); struct hx509_ca_tbs { hx509_name subject; @@ -1002,7 +1002,7 @@ ca_sign(hx509_context context, if (size != data.length) _hx509_abort("internal ASN.1 encoder error"); ret = add_extension(context, tbsc, 0, - oid_id_pe_proxyCertInfo(), + oid_id_pkix_pe_proxyCertInfo(), &data); free(data.data); if (ret) diff --git a/source4/heimdal/lib/hx509/cert.c b/source4/heimdal/lib/hx509/cert.c index caf163f8e4..b7f19d152a 100644 --- a/source4/heimdal/lib/hx509/cert.c +++ b/source4/heimdal/lib/hx509/cert.c @@ -32,7 +32,7 @@ */ #include "hx_locl.h" -RCSID("$Id: cert.c 21294 2007-06-25 14:37:15Z lha $"); +RCSID("$Id: cert.c 21380 2007-06-28 07:38:38Z lha $"); #include "crypto-headers.h" #include <rtbl.h> @@ -898,7 +898,7 @@ is_proxy_cert(hx509_context context, if (rinfo) memset(rinfo, 0, sizeof(*rinfo)); - e = find_extension(cert, oid_id_pe_proxyCertInfo(), &i); + e = find_extension(cert, oid_id_pkix_pe_proxyCertInfo(), &i); if (e == NULL) { hx509_clear_error_string(context); return HX509_EXTENSION_NOT_FOUND; diff --git a/source4/heimdal/lib/hx509/hx509-private.h b/source4/heimdal/lib/hx509/hx509-private.h index 451c3c89f2..acbc3218c6 100644 --- a/source4/heimdal/lib/hx509/hx509-private.h +++ b/source4/heimdal/lib/hx509/hx509-private.h @@ -314,14 +314,6 @@ _hx509_pbe_decrypt ( const heim_octet_string */*econtent*/, heim_octet_string */*content*/); -int -_hx509_pbe_encrypt ( - hx509_context /*context*/, - hx509_lock /*lock*/, - const AlgorithmIdentifier */*ai*/, - const heim_octet_string */*content*/, - heim_octet_string */*econtent*/); - void _hx509_pi_printf ( int (*/*func*/)(void *, const char *), @@ -423,35 +415,11 @@ void _hx509_request_free (hx509_request */*req*/); int -_hx509_request_get_SubjectPublicKeyInfo ( - hx509_context /*context*/, - hx509_request /*req*/, - SubjectPublicKeyInfo */*key*/); - -int -_hx509_request_get_name ( - hx509_context /*context*/, - hx509_request /*req*/, - hx509_name */*name*/); - -int _hx509_request_init ( hx509_context /*context*/, hx509_request */*req*/); int -_hx509_request_parse ( - hx509_context /*context*/, - const char */*path*/, - hx509_request */*req*/); - -int -_hx509_request_print ( - hx509_context /*context*/, - hx509_request /*req*/, - FILE */*f*/); - -int _hx509_request_set_SubjectPublicKeyInfo ( hx509_context /*context*/, hx509_request /*req*/, diff --git a/source4/heimdal/lib/hx509/ks_p11.c b/source4/heimdal/lib/hx509/ks_p11.c index b899005b33..e3066bbcfa 100644 --- a/source4/heimdal/lib/hx509/ks_p11.c +++ b/source4/heimdal/lib/hx509/ks_p11.c @@ -32,7 +32,7 @@ */ #include "hx_locl.h" -RCSID("$Id: ks_p11.c 21085 2007-06-13 06:39:53Z lha $"); +RCSID("$Id: ks_p11.c 21387 2007-06-28 08:53:45Z lha $"); #ifdef HAVE_DLFCN_H #include <dlfcn.h> #endif @@ -1129,8 +1129,17 @@ p11_printinfo(hx509_context context, MECHNAME(CKM_RSA_X_509, "rsa-x-509"); MECHNAME(CKM_MD5_RSA_PKCS, "md5-rsa-pkcs"); MECHNAME(CKM_SHA1_RSA_PKCS, "sha1-rsa-pkcs"); + MECHNAME(CKM_SHA256_RSA_PKCS, "sha256-rsa-pkcs"); + MECHNAME(CKM_SHA384_RSA_PKCS, "sha384-rsa-pkcs"); + MECHNAME(CKM_SHA512_RSA_PKCS, "sha512-rsa-pkcs"); MECHNAME(CKM_RIPEMD160_RSA_PKCS, "ripemd160-rsa-pkcs"); MECHNAME(CKM_RSA_PKCS_OAEP, "rsa-pkcs-oaep"); + MECHNAME(CKM_SHA512_HMAC, "sha512-hmac"); + MECHNAME(CKM_SHA512, "sha512"); + MECHNAME(CKM_SHA384_HMAC, "sha384-hmac"); + MECHNAME(CKM_SHA384, "sha384"); + MECHNAME(CKM_SHA256_HMAC, "sha256-hmac"); + MECHNAME(CKM_SHA256, "sha256"); MECHNAME(CKM_SHA_1, "sha1"); MECHNAME(CKM_MD5, "md5"); MECHNAME(CKM_MD2, "md2"); diff --git a/source4/heimdal/lib/hx509/peer.c b/source4/heimdal/lib/hx509/peer.c index eccedf1043..e90f8f34b0 100644 --- a/source4/heimdal/lib/hx509/peer.c +++ b/source4/heimdal/lib/hx509/peer.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2006 Kungliga Tekniska Högskolan + * Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,7 +32,7 @@ */ #include "hx_locl.h" -RCSID("$Id: peer.c 20938 2007-06-06 20:51:34Z lha $"); +RCSID("$Id: peer.c 21481 2007-07-10 16:33:23Z lha $"); int hx509_peer_info_alloc(hx509_context context, hx509_peer_info *peer) @@ -143,7 +143,7 @@ hx509_peer_info_parse(hx509_peer_info peer, int hx509_peer_info_unparse(hx509_peer_info peer, - heim_octet_string *data) + heim_octet_string *data) { return 0; } diff --git a/source4/heimdal/lib/hx509/print.c b/source4/heimdal/lib/hx509/print.c index dc9d4cfa58..e6f71ea2ce 100644 --- a/source4/heimdal/lib/hx509/print.c +++ b/source4/heimdal/lib/hx509/print.c @@ -32,7 +32,7 @@ */ #include "hx_locl.h" -RCSID("$Id: print.c 20908 2007-06-05 02:59:33Z lha $"); +RCSID("$Id: print.c 21381 2007-06-28 08:29:22Z lha $"); struct hx509_validate_ctx_data { @@ -591,11 +591,50 @@ check_proxyCertInfo(hx509_validate_ctx ctx, enum critical_flag cf, const Extension *e) { + check_Null(ctx, status, cf, e); status->isproxy = 1; + return 0; +} + +static int +check_authorityInfoAccess(hx509_validate_ctx ctx, + struct cert_status *status, + enum critical_flag cf, + const Extension *e) +{ + AuthorityInfoAccessSyntax aia; + size_t size; + int ret, i; + + check_Null(ctx, status, cf, e); + + ret = decode_AuthorityInfoAccessSyntax(e->extnValue.data, + e->extnValue.length, + &aia, &size); + if (ret) { + printf("\tret = %d while decoding AuthorityInfoAccessSyntax\n", ret); + return 0; + } + + for (i = 0; i < aia.len; i++) { + char *str; + validate_print(ctx, HX509_VALIDATE_F_VERBOSE, + "\ttype: "); + hx509_oid_print(&aia.val[i].accessMethod, validate_vprint, ctx); + hx509_general_name_unparse(&aia.val[i].accessLocation, &str); + validate_print(ctx, HX509_VALIDATE_F_VERBOSE, + "\n\tdirname: %s\n", str); + free(str); + } + free_AuthorityInfoAccessSyntax(&aia); return 0; } +/* + * + */ + struct { const char *name; const heim_oid *(*oid)(void); @@ -628,8 +667,11 @@ struct { { ext(extKeyUsage, Null), D_C }, { ext(freshestCRL, Null), M_N_C }, { ext(inhibitAnyPolicy, Null), M_C }, - { "proxyCertInfo", oid_id_pe_proxyCertInfo, - check_proxyCertInfo, M_C }, +#undef ext +#define ext(name, checkname) #name, &oid_id_pkix_pe_##name, check_##checkname + { ext(proxyCertInfo, proxyCertInfo), M_C }, + { ext(authorityInfoAccess, authorityInfoAccess), M_C }, +#undef ext { "US Fed PKI - PIV Interim", oid_id_uspkicommon_piv_interim, check_Null, D_C }, { "Netscape cert comment", oid_id_netscape_cert_comment, diff --git a/source4/heimdal/lib/krb5/cache.c b/source4/heimdal/lib/krb5/cache.c index 5be3935f2b..59aae40d28 100644 --- a/source4/heimdal/lib/krb5/cache.c +++ b/source4/heimdal/lib/krb5/cache.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$Id: cache.c 20503 2007-04-21 22:03:56Z lha $"); +RCSID("$Id: cache.c 21498 2007-07-11 09:41:43Z lha $"); /* * Add a new ccache type with operations `ops', overwriting any @@ -339,6 +339,35 @@ _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res) } /* + * Return non-zero if envirnoment that will determine default krb5cc + * name has changed. + */ + +static int +environment_changed(krb5_context context) +{ + const char *e; + + if(issuid()) + return 0; + + e = getenv("KRB5CCNAME"); + if (e == NULL) { + if (context->default_cc_name_env) { + free(context->default_cc_name_env); + context->default_cc_name_env = NULL; + return 1; + } + } else { + if (context->default_cc_name_env == NULL) + return 1; + if (strcmp(e, context->default_cc_name_env) != 0) + return 1; + } + return 0; +} + +/* * Set the default cc name for `context' to `name'. */ @@ -353,8 +382,12 @@ krb5_cc_set_default_name(krb5_context context, const char *name) if(!issuid()) { e = getenv("KRB5CCNAME"); - if (e) + if (e) { p = strdup(e); + if (context->default_cc_name_env) + free(context->default_cc_name_env); + context->default_cc_name_env = strdup(e); + } } if (e == NULL) { e = krb5_config_get_string(context, NULL, "libdefaults", @@ -389,7 +422,7 @@ krb5_cc_set_default_name(krb5_context context, const char *name) const char* KRB5_LIB_FUNCTION krb5_cc_default_name(krb5_context context) { - if (context->default_cc_name == NULL) + if (context->default_cc_name == NULL || environment_changed(context)) krb5_cc_set_default_name(context, NULL); return context->default_cc_name; diff --git a/source4/heimdal/lib/krb5/changepw.c b/source4/heimdal/lib/krb5/changepw.c index 3ceb6df89c..703cf43eb6 100644 --- a/source4/heimdal/lib/krb5/changepw.c +++ b/source4/heimdal/lib/krb5/changepw.c @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$Id: changepw.c 17442 2006-05-05 09:31:15Z lha $"); +RCSID("$Id: changepw.c 21505 2007-07-12 12:28:38Z lha $"); static void str2data (krb5_data *d, @@ -46,10 +46,12 @@ str2data (krb5_data *d, ...) { va_list args; + char *str; va_start(args, fmt); - d->length = vasprintf ((char **)&d->data, fmt, args); + d->length = vasprintf (&str, fmt, args); va_end(args); + d->data = str; } /* diff --git a/source4/heimdal/lib/krb5/get_cred.c b/source4/heimdal/lib/krb5/get_cred.c index 8a0af23e40..7c3f128ae5 100644 --- a/source4/heimdal/lib/krb5/get_cred.c +++ b/source4/heimdal/lib/krb5/get_cred.c @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$Id: get_cred.c 21327 2007-06-26 10:54:15Z lha $"); +RCSID("$Id: get_cred.c 21669 2007-07-22 11:29:13Z lha $"); /* * Take the `body' and encode it into `padata' using the credentials @@ -1224,9 +1224,10 @@ krb5_get_renewed_creds(krb5_context context, { krb5_error_code ret; krb5_kdc_flags flags; - krb5_creds in, *template; + krb5_creds in, *template, *out = NULL; memset(&in, 0, sizeof(in)); + memset(creds, 0, sizeof(*creds)); ret = krb5_copy_principal(context, client, &in.client); if (ret) @@ -1263,9 +1264,14 @@ krb5_get_renewed_creds(krb5_context context, krb5_free_creds (context, template); } - ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &creds); + ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out); krb5_free_principal(context, in.client); krb5_free_principal(context, in.server); + if (ret) + return ret; + + ret = krb5_copy_creds_contents(context, out, creds); + krb5_free_creds(context, out); return ret; } diff --git a/source4/heimdal/lib/krb5/init_creds.c b/source4/heimdal/lib/krb5/init_creds.c index 5bdf23d97f..bd250cef2b 100644 --- a/source4/heimdal/lib/krb5/init_creds.c +++ b/source4/heimdal/lib/krb5/init_creds.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$Id: init_creds.c 20541 2007-04-23 12:19:14Z lha $"); +RCSID("$Id: init_creds.c 21712 2007-07-27 14:23:41Z lha $"); void KRB5_LIB_FUNCTION krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt) @@ -225,9 +225,8 @@ krb5_get_init_creds_opt_set_default_flags(krb5_context context, krb5_get_init_creds_opt_set_renew_life(opt, t); krb5_appdefault_boolean(context, appname, realm, "no-addresses", - FALSE, &b); - if (b) - krb5_get_init_creds_opt_set_addressless (context, opt, TRUE); + KRB5_ADDRESSLESS_DEFAULT, &b); + krb5_get_init_creds_opt_set_addressless (context, opt, b); #if 0 krb5_appdefault_boolean(context, appname, realm, "anonymous", FALSE, &b); diff --git a/source4/heimdal/lib/krb5/init_creds_pw.c b/source4/heimdal/lib/krb5/init_creds_pw.c index 1676da3bd6..0043b5ef3c 100644 --- a/source4/heimdal/lib/krb5/init_creds_pw.c +++ b/source4/heimdal/lib/krb5/init_creds_pw.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$Id: init_creds_pw.c 21061 2007-06-12 17:56:30Z lha $"); +RCSID("$Id: init_creds_pw.c 21428 2007-07-10 12:31:58Z lha $"); typedef struct krb5_get_init_creds_ctx { KDCOptions flags; diff --git a/source4/heimdal/lib/krb5/krb5-private.h b/source4/heimdal/lib/krb5/krb5-private.h index a551c42ecd..9a84dde61a 100644 --- a/source4/heimdal/lib/krb5/krb5-private.h +++ b/source4/heimdal/lib/krb5/krb5-private.h @@ -383,7 +383,7 @@ _krb5_pk_verify_sign ( krb5_error_code _krb5_plugin_find ( krb5_context /*context*/, - enum plugin_type /*type*/, + enum krb5_plugin_type /*type*/, const char */*name*/, struct krb5_plugin **/*list*/); @@ -399,7 +399,7 @@ _krb5_plugin_get_symbol (struct krb5_plugin */*p*/); krb5_error_code _krb5_plugin_register ( krb5_context /*context*/, - enum plugin_type /*type*/, + enum krb5_plugin_type /*type*/, const char */*name*/, void */*symbol*/); diff --git a/source4/heimdal/lib/krb5/krb5-protos.h b/source4/heimdal/lib/krb5/krb5-protos.h index 058496434e..740b394be8 100644 --- a/source4/heimdal/lib/krb5/krb5-protos.h +++ b/source4/heimdal/lib/krb5/krb5-protos.h @@ -2244,14 +2244,6 @@ krb5_get_pw_salt ( krb5_salt */*salt*/); krb5_error_code KRB5_LIB_FUNCTION -krb5_get_renewed_creds ( - krb5_context /*context*/, - krb5_creds */*creds*/, - krb5_const_principal /*client*/, - krb5_ccache /*ccache*/, - const char */*in_tkt_service*/); - -krb5_error_code KRB5_LIB_FUNCTION krb5_get_server_rcache ( krb5_context /*context*/, const krb5_data */*piece*/, diff --git a/source4/heimdal/lib/krb5/krb5-v4compat.h b/source4/heimdal/lib/krb5/krb5-v4compat.h index 2ea534cfe3..dfd7e94460 100644 --- a/source4/heimdal/lib/krb5/krb5-v4compat.h +++ b/source4/heimdal/lib/krb5/krb5-v4compat.h @@ -31,11 +31,13 @@ * SUCH DAMAGE. */ -/* $Id: krb5-v4compat.h 17442 2006-05-05 09:31:15Z lha $ */ +/* $Id: krb5-v4compat.h 21575 2007-07-16 07:44:54Z lha $ */ #ifndef __KRB5_V4COMPAT_H__ #define __KRB5_V4COMPAT_H__ +#include "krb_err.h" + /* * This file must only be included with v4 compat glue stuff in * heimdal sources. @@ -57,56 +59,10 @@ #define AUTH_MSG_KDC_RENEW (10<<1) #define AUTH_MSG_DIE (63<<1) -/* values for kerb error codes */ - -#define KERB_ERR_OK 0 -#define KERB_ERR_NAME_EXP 1 -#define KERB_ERR_SERVICE_EXP 2 -#define KERB_ERR_AUTH_EXP 3 -#define KERB_ERR_PKT_VER 4 -#define KERB_ERR_NAME_MAST_KEY_VER 5 -#define KERB_ERR_SERV_MAST_KEY_VER 6 -#define KERB_ERR_BYTE_ORDER 7 -#define KERB_ERR_PRINCIPAL_UNKNOWN 8 -#define KERB_ERR_PRINCIPAL_NOT_UNIQUE 9 -#define KERB_ERR_NULL_KEY 10 -#define KERB_ERR_TIMEOUT 11 - - -/* Error codes returned from the KDC */ -#define KDC_OK 0 /* Request OK */ -#define KDC_NAME_EXP 1 /* Principal expired */ -#define KDC_SERVICE_EXP 2 /* Service expired */ -#define KDC_AUTH_EXP 3 /* Auth expired */ -#define KDC_PKT_VER 4 /* Protocol version unknown */ -#define KDC_P_MKEY_VER 5 /* Wrong master key version */ -#define KDC_S_MKEY_VER 6 /* Wrong master key version */ -#define KDC_BYTE_ORDER 7 /* Byte order unknown */ -#define KDC_PR_UNKNOWN 8 /* Principal unknown */ -#define KDC_PR_N_UNIQUE 9 /* Principal not unique */ -#define KDC_NULL_KEY 10 /* Principal has null key */ -#define KDC_GEN_ERR 20 /* Generic error from KDC */ - /* General definitions */ #define KSUCCESS 0 #define KFAILURE 255 -/* Values returned by rd_ap_req */ -#define RD_AP_OK 0 /* Request authentic */ -#define RD_AP_UNDEC 31 /* Can't decode authenticator */ -#define RD_AP_EXP 32 /* Ticket expired */ -#define RD_AP_NYV 33 /* Ticket not yet valid */ -#define RD_AP_REPEAT 34 /* Repeated request */ -#define RD_AP_NOT_US 35 /* The ticket isn't for us */ -#define RD_AP_INCON 36 /* Request is inconsistent */ -#define RD_AP_TIME 37 /* delta_t too big */ -#define RD_AP_BADD 38 /* Incorrect net address */ -#define RD_AP_VERSION 39 /* protocol version mismatch */ -#define RD_AP_MSG_TYPE 40 /* invalid msg type */ -#define RD_AP_MODIFIED 41 /* message stream modified */ -#define RD_AP_ORDER 42 /* message out of order */ -#define RD_AP_UNAUTHOR 43 /* unauthorized request */ - /* */ #define MAX_KTXT_LEN 1250 diff --git a/source4/heimdal/lib/krb5/krb5.h b/source4/heimdal/lib/krb5/krb5.h index 345fe70764..4f9a63bf05 100644 --- a/source4/heimdal/lib/krb5/krb5.h +++ b/source4/heimdal/lib/krb5/krb5.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $Id: krb5.h 21252 2007-06-21 04:18:28Z lha $ */ +/* $Id: krb5.h 21551 2007-07-15 09:03:39Z lha $ */ #ifndef __KRB5_H__ #define __KRB5_H__ @@ -436,11 +436,6 @@ typedef struct krb5_config_binding krb5_config_binding; typedef krb5_config_binding krb5_config_section; -enum { - KRB5_PKINIT_WIN2K = 1, /* wire compatible with Windows 2k */ - KRB5_PKINIT_PACKET_CABLE = 2 /* use packet cable standard */ -}; - typedef struct krb5_ticket { EncTicketPart ticket; krb5_principal client; @@ -766,6 +761,12 @@ typedef struct krb5_sendto_ctx *krb5_sendto_ctx; typedef krb5_error_code (*krb5_sendto_ctx_func)(krb5_context, krb5_sendto_ctx, void *, const krb5_data *, int *); +struct krb5_plugin; +enum krb5_plugin_type { + PLUGIN_TYPE_DATA = 1, + PLUGIN_TYPE_FUNC +}; + struct credentials; /* this is to keep the compiler happy */ struct getargs; struct sockaddr; diff --git a/source4/heimdal/lib/krb5/krb5_locl.h b/source4/heimdal/lib/krb5/krb5_locl.h index 87169fc430..b41e6e1182 100644 --- a/source4/heimdal/lib/krb5/krb5_locl.h +++ b/source4/heimdal/lib/krb5/krb5_locl.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $Id: krb5_locl.h 20261 2007-02-18 00:32:22Z lha $ */ +/* $Id: krb5_locl.h 21552 2007-07-15 09:04:00Z lha $ */ #ifndef __KRB5_LOCL_H__ #define __KRB5_LOCL_H__ @@ -148,12 +148,6 @@ struct krb5_dh_moduli; /* v4 glue */ struct _krb5_krb_auth_data; -struct krb5_plugin; -enum plugin_type { - PLUGIN_TYPE_DATA = 1, - PLUGIN_TYPE_FUNC -}; - #include <der.h> #include <krb5.h> @@ -236,7 +230,7 @@ typedef struct krb5_context_data { char error_buf[256]; krb5_addresses *ignore_addresses; char *default_cc_name; - int pkinit_flags; + char *default_cc_name_env; void *mutex; /* protects error_string/error_buf */ int large_msg_size; int dns_canonicalize_hostname; diff --git a/source4/heimdal/lib/krb5/krb_err.et b/source4/heimdal/lib/krb5/krb_err.et new file mode 100644 index 0000000000..f7dbb6ce7a --- /dev/null +++ b/source4/heimdal/lib/krb5/krb_err.et @@ -0,0 +1,63 @@ +# +# Error messages for the krb4 library +# +# This might look like a com_err file, but is not +# +id "$Id: krb_err.et,v 1.7 1998/03/29 14:19:52 bg Exp $" + +error_table krb + +prefix KRB4ET +ec KSUCCESS, "Kerberos 4 successful" +ec KDC_NAME_EXP, "Kerberos 4 principal expired" +ec KDC_SERVICE_EXP, "Kerberos 4 service expired" +ec KDC_AUTH_EXP, "Kerberos 4 auth expired" +ec KDC_PKT_VER, "Incorrect Kerberos 4 master key version" +ec KDC_P_MKEY_VER, "Incorrect Kerberos 4 master key version" +ec KDC_S_MKEY_VER, "Incorrect Kerberos 4 master key version" +ec KDC_BYTE_ORDER, "Kerberos 4 byte order unknown" +ec KDC_PR_UNKNOWN, "Kerberos 4 principal unknown" +ec KDC_PR_N_UNIQUE, "Kerberos 4 principal not unique" +ec KDC_NULL_KEY, "Kerberos 4 principal has null key" +index 20 +ec KDC_GEN_ERR, "Generic error from KDC (Kerberos 4)" +ec GC_TKFIL, "Can't read Kerberos 4 ticket file" +ec GC_NOTKT, "Can't find Kerberos 4 ticket or TGT" +index 26 +ec MK_AP_TGTEXP, "Kerberos 4 TGT Expired" +index 31 +ec RD_AP_UNDEC, "Kerberos 4: Can't decode authenticator" +ec RD_AP_EXP, "Kerberos 4 ticket expired" +ec RD_AP_NYV, "Kerberos 4 ticket not yet valid" +ec RD_AP_REPEAT, "Kerberos 4: Repeated request" +ec RD_AP_NOT_US, "The Kerberos 4 ticket isn't for us" +ec RD_AP_INCON, "Kerberos 4 request inconsistent" +ec RD_AP_TIME, "Kerberos 4: delta_t too big" +ec RD_AP_BADD, "Kerberos 4: incorrect net address" +ec RD_AP_VERSION, "Kerberos protocol not version 4" +ec RD_AP_MSG_TYPE, "Kerberos 4: invalid msg type" +ec RD_AP_MODIFIED, "Kerberos 4: message stream modified" +ec RD_AP_ORDER, "Kerberos 4: message out of order" +ec RD_AP_UNAUTHOR, "Kerberos 4: unauthorized request" +index 51 +ec GT_PW_NULL, "Kerberos 4: current PW is null" +ec GT_PW_BADPW, "Kerberos 4: Incorrect current password" +ec GT_PW_PROT, "Kerberos 4 protocol error" +ec GT_PW_KDCERR, "Error returned by KDC (Kerberos 4)" +ec GT_PW_NULLTKT, "Null Kerberos 4 ticket returned by KDC" +ec SKDC_RETRY, "Kerberos 4: Retry count exceeded" +ec SKDC_CANT, "Kerberos 4: Can't send request" +index 61 +ec INTK_W_NOTALL, "Kerberos 4: not all tickets returned" +ec INTK_BADPW, "Kerberos 4: incorrect password" +ec INTK_PROT, "Kerberos 4: Protocol Error" +index 70 +ec INTK_ERR, "Other error in Kerberos 4" +ec AD_NOTGT, "Don't have Kerberos 4 ticket-granting ticket" +index 76 +ec NO_TKT_FIL, "No Kerberos 4 ticket file found" +ec TKT_FIL_ACC, "Couldn't access Kerberos 4 ticket file" +ec TKT_FIL_LCK, "Couldn't lock Kerberos 4 ticket file" +ec TKT_FIL_FMT, "Bad Kerberos 4 ticket file format" +ec TKT_FIL_INI, "Kerberos 4: tf_init not called first" +ec KNAME_FMT, "Bad Kerberos 4 name format" diff --git a/source4/heimdal/lib/krb5/krbhst.c b/source4/heimdal/lib/krb5/krbhst.c index 69b52dd808..094fd4f9c6 100644 --- a/source4/heimdal/lib/krb5/krbhst.c +++ b/source4/heimdal/lib/krb5/krbhst.c @@ -35,7 +35,7 @@ #include <resolve.h> #include "locate_plugin.h" -RCSID("$Id: krbhst.c 21131 2007-06-18 20:48:09Z lha $"); +RCSID("$Id: krbhst.c 21457 2007-07-10 12:53:25Z lha $"); static int string_to_proto(const char *string) @@ -919,8 +919,10 @@ gethostlist(krb5_context context, const char *realm, while(krb5_krbhst_next(context, handle, &hostinfo) == 0) nhost++; - if(nhost == 0) + if(nhost == 0) { + krb5_set_error_string(context, "No KDC found for realm %s", realm); return KRB5_KDC_UNREACH; + } *hostlist = calloc(nhost + 1, sizeof(**hostlist)); if(*hostlist == NULL) { krb5_krbhst_free(context, handle); diff --git a/source4/heimdal/lib/krb5/pkinit.c b/source4/heimdal/lib/krb5/pkinit.c index 105cab554d..c8587770f4 100755 --- a/source4/heimdal/lib/krb5/pkinit.c +++ b/source4/heimdal/lib/krb5/pkinit.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$Id: pkinit.c 21321 2007-06-26 05:21:56Z lha $"); +RCSID("$Id: pkinit.c 21684 2007-07-23 23:09:10Z lha $"); struct krb5_dh_moduli { char *name; @@ -645,8 +645,6 @@ _krb5_pk_mk_padata(krb5_context context, req_body->realm, "pkinit_win2k", NULL); - if (context->pkinit_flags & KRB5_PKINIT_WIN2K) - win2k_compat = 1; if (win2k_compat) { ctx->require_binding = @@ -1721,7 +1719,7 @@ _krb5_free_moduli(struct krb5_dh_moduli **moduli) free(moduli); } -static const char *default_moduli = +static const char *default_moduli_RFC2412_MODP_group2 = /* name */ "RFC2412-MODP-group2 " /* bits */ @@ -1743,6 +1741,37 @@ static const char *default_moduli = "F71C35FD" "AD44CFD2" "D74F9208" "BE258FF3" "24943328" "F67329C0" "FFFFFFFF" "FFFFFFFF"; +static const char *default_moduli_rfc3526_MODP_group14 = + /* name */ + "rfc3526-MODP-group14 " + /* bits */ + "1760 " + /* p */ + "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1" + "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD" + "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245" + "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED" + "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D" + "C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F" + "83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D" + "670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B" + "E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9" + "DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510" + "15728E5A" "8AACAA68" "FFFFFFFF" "FFFFFFFF " + /* g */ + "02 " + /* q */ + "7FFFFFFF" "FFFFFFFF" "E487ED51" "10B4611A" "62633145" "C06E0E68" + "94812704" "4533E63A" "0105DF53" "1D89CD91" "28A5043C" "C71A026E" + "F7CA8CD9" "E69D218D" "98158536" "F92F8A1B" "A7F09AB6" "B6A8E122" + "F242DABB" "312F3F63" "7A262174" "D31BF6B5" "85FFAE5B" "7A035BF6" + "F71C35FD" "AD44CFD2" "D74F9208" "BE258FF3" "24943328" "F6722D9E" + "E1003E5C" "50B1DF82" "CC6D241B" "0E2AE9CD" "348B1FD4" "7E9267AF" + "C1B2AE91" "EE51D6CB" "0E3179AB" "1042A95D" "CF6A9483" "B84B4B36" + "B3861AA7" "255E4C02" "78BA3604" "650C10BE" "19482F23" "171B671D" + "F1CF3B96" "0C074301" "CD93C1D1" "7603D147" "DAE2AEF8" "37A62964" + "EF15E5FB" "4AAC0B8C" "1CCAA4BE" "754AB572" "8AE9130C" "4C7D0288" + "0AB9472D" "45565534" "7FFFFFFF" "FFFFFFFF"; krb5_error_code _krb5_parse_moduli(krb5_context context, const char *file, @@ -1757,19 +1786,28 @@ _krb5_parse_moduli(krb5_context context, const char *file, *moduli = NULL; - m = calloc(1, sizeof(m[0]) * 2); + m = calloc(1, sizeof(m[0]) * 3); if (m == NULL) { krb5_set_error_string(context, "malloc: out of memory"); return ENOMEM; } - strlcpy(buf, default_moduli, sizeof(buf)); + strlcpy(buf, default_moduli_rfc3526_MODP_group14, sizeof(buf)); ret = _krb5_parse_moduli_line(context, "builtin", 1, buf, &m[0]); if (ret) { _krb5_free_moduli(m); return ret; } - n = 1; + n++; + + strlcpy(buf, default_moduli_RFC2412_MODP_group2, sizeof(buf)); + ret = _krb5_parse_moduli_line(context, "builtin", 1, buf, &m[1]); + if (ret) { + _krb5_free_moduli(m); + return ret; + } + n++; + if (file == NULL) file = MODULI_FILE; diff --git a/source4/heimdal/lib/krb5/plugin.c b/source4/heimdal/lib/krb5/plugin.c index 68317a12c0..43fa3f5b45 100644 --- a/source4/heimdal/lib/krb5/plugin.c +++ b/source4/heimdal/lib/krb5/plugin.c @@ -32,7 +32,7 @@ */ #include "krb5_locl.h" -RCSID("$Id: plugin.c 21134 2007-06-18 21:02:23Z lha $"); +RCSID("$Id: plugin.c 21702 2007-07-26 19:13:53Z lha $"); #ifdef HAVE_DLFCN_H #include <dlfcn.h> #endif @@ -45,7 +45,7 @@ struct krb5_plugin { }; struct plugin { - enum plugin_type type; + enum krb5_plugin_type type; void *name; void *symbol; struct plugin *next; @@ -76,9 +76,11 @@ _krb5_plugin_get_next(struct krb5_plugin *p) * */ +#ifdef HAVE_DLOPEN + static krb5_error_code loadlib(krb5_context context, - enum plugin_type type, + enum krb5_plugin_type type, const char *name, const char *lib, struct krb5_plugin **e) @@ -113,10 +115,11 @@ loadlib(krb5_context context, return 0; } +#endif /* HAVE_DLOPEN */ krb5_error_code _krb5_plugin_register(krb5_context context, - enum plugin_type type, + enum krb5_plugin_type type, const char *name, void *symbol) { @@ -146,7 +149,7 @@ _krb5_plugin_register(krb5_context context, krb5_error_code _krb5_plugin_find(krb5_context context, - enum plugin_type type, + enum krb5_plugin_type type, const char *name, struct krb5_plugin **list) { @@ -181,6 +184,8 @@ _krb5_plugin_find(krb5_context context, } HEIMDAL_MUTEX_unlock(&plugin_mutex); +#ifdef HAVE_DLOPEN + dirs = krb5_config_get_strings(context, NULL, "libdefaults", "plugin_dir", NULL); if (dirs == NULL) { @@ -213,6 +218,7 @@ _krb5_plugin_find(krb5_context context, } if (dirs != sysdirs) krb5_config_free_strings(dirs); +#endif /* HAVE_DLOPEN */ if (*list == NULL) { krb5_set_error_string(context, "Did not find a plugin for %s", name); diff --git a/source4/heimdal/lib/krb5/rd_priv.c b/source4/heimdal/lib/krb5/rd_priv.c index d3920dd941..47b5df85b2 100644 --- a/source4/heimdal/lib/krb5/rd_priv.c +++ b/source4/heimdal/lib/krb5/rd_priv.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$Id: rd_priv.c 17056 2006-04-12 16:18:10Z lha $"); +RCSID("$Id: rd_priv.c 21770 2007-08-01 04:04:33Z lha $"); krb5_error_code KRB5_LIB_FUNCTION krb5_rd_priv(krb5_context context, @@ -55,13 +55,17 @@ krb5_rd_priv(krb5_context context, if ((auth_context->flags & (KRB5_AUTH_CONTEXT_RET_TIME | KRB5_AUTH_CONTEXT_RET_SEQUENCE)) && - outdata == NULL) + outdata == NULL) { + krb5_clear_error_string (context); return KRB5_RC_REQUIRED; /* XXX better error, MIT returns this */ + } memset(&priv, 0, sizeof(priv)); ret = decode_KRB_PRIV (inbuf->data, inbuf->length, &priv, &len); - if (ret) + if (ret) { + krb5_clear_error_string (context); goto failure; + } if (priv.pvno != 5) { krb5_clear_error_string (context); ret = KRB5KRB_AP_ERR_BADVERSION; @@ -94,8 +98,10 @@ krb5_rd_priv(krb5_context context, ret = decode_EncKrbPrivPart (plain.data, plain.length, &part, &len); krb5_data_free (&plain); - if (ret) + if (ret) { + krb5_clear_error_string (context); goto failure; + } /* check sender address */ diff --git a/source4/heimdal/lib/krb5/v4_glue.c b/source4/heimdal/lib/krb5/v4_glue.c index d42fbec3a5..3f99df6391 100644 --- a/source4/heimdal/lib/krb5/v4_glue.c +++ b/source4/heimdal/lib/krb5/v4_glue.c @@ -32,7 +32,7 @@ */ #include "krb5_locl.h" -RCSID("$Id: v4_glue.c 17442 2006-05-05 09:31:15Z lha $"); +RCSID("$Id: v4_glue.c 21572 2007-07-16 05:13:08Z lha $"); #include "krb5-v4compat.h" @@ -351,12 +351,12 @@ storage_to_etext(krb5_context context, size = krb5_storage_seek(sp, 0, SEEK_END); if (size < 0) - return EINVAL; + return KRB4ET_RD_AP_UNDEC; size = 8 - (size & 7); ret = krb5_storage_write(sp, eightzeros, size); if (ret != size) - return EINVAL; + return KRB4ET_RD_AP_UNDEC; ret = krb5_storage_to_data(sp, &data); if (ret) @@ -435,7 +435,7 @@ _krb5_krb_create_ticket(krb5_context context, session->keyvalue.data, session->keyvalue.length); if (ret != session->keyvalue.length) { - ret = EINVAL; + ret = KRB4ET_INTK_PROT; goto error; } @@ -487,7 +487,7 @@ _krb5_krb_create_ciph(krb5_context context, session->keyvalue.data, session->keyvalue.length); if (ret != session->keyvalue.length) { - ret = EINVAL; + ret = KRB4ET_INTK_PROT; goto error; } @@ -497,7 +497,7 @@ _krb5_krb_create_ciph(krb5_context context, RCHECK(ret, krb5_store_int8(sp, ticket->length), error); ret = krb5_storage_write(sp, ticket->data, ticket->length); if (ret != ticket->length) { - ret = EINVAL; + ret = KRB4ET_INTK_PROT; goto error; } RCHECK(ret, krb5_store_int32(sp, kdc_time), error); @@ -550,7 +550,7 @@ _krb5_krb_create_auth_reply(krb5_context context, RCHECK(ret, krb5_store_int16(sp, cipher->length), error); ret = krb5_storage_write(sp, cipher->data, cipher->length); if (ret != cipher->length) { - ret = EINVAL; + ret = KRB4ET_INTK_PROT; goto error; } @@ -599,6 +599,9 @@ _krb5_krb_cr_err_reply(krb5_context context, RCHECK(ret, krb5_store_int8(sp, AUTH_MSG_ERR_REPLY), error); RCHECK(ret, put_nir(sp, name, inst, realm), error); RCHECK(ret, krb5_store_int32(sp, time_ws), error); + /* If its a Kerberos 4 error-code, remove the et BASE */ + if (e >= ERROR_TABLE_BASE_krb && e <= ERROR_TABLE_BASE_krb + 255) + e -= ERROR_TABLE_BASE_krb; RCHECK(ret, krb5_store_int32(sp, e), error); RCHECK(ret, krb5_store_stringz(sp, e_string), error); @@ -623,7 +626,7 @@ get_v4_stringz(krb5_storage *sp, char **str, size_t max_len) if (strlen(*str) > max_len) { free(*str); *str = NULL; - return EINVAL; + return KRB4ET_INTK_PROT; } return 0; } @@ -662,7 +665,7 @@ _krb5_krb_decomp_ticket(krb5_context context, return ENOMEM; } - krb5_storage_set_eof_code(sp, EINVAL); /* XXX */ + krb5_storage_set_eof_code(sp, KRB4ET_INTK_PROT); RCHECK(ret, krb5_ret_int8(sp, &ad->k_flags), error); RCHECK(ret, get_v4_stringz(sp, &ad->pname, ANAME_SZ), error); @@ -672,7 +675,7 @@ _krb5_krb_decomp_ticket(krb5_context context, size = krb5_storage_read(sp, des_key, sizeof(des_key)); if (size != sizeof(des_key)) { - ret = EINVAL; /* XXX */ + ret = KRB4ET_INTK_PROT; goto error; } @@ -770,26 +773,32 @@ _krb5_krb_rd_req(krb5_context context, return ENOMEM; } - krb5_storage_set_eof_code(sp, EINVAL); /* XXX */ + krb5_storage_set_eof_code(sp, KRB4ET_INTK_PROT); ret = krb5_ret_int8(sp, &pvno); - if (ret) + if (ret) { + krb5_set_error_string(context, "Failed reading v4 pvno"); goto error; + } if (pvno != KRB_PROT_VERSION) { - ret = EINVAL; /* XXX */ + ret = KRB4ET_RD_AP_VERSION; + krb5_set_error_string(context, "Failed v4 pvno not 4"); goto error; } ret = krb5_ret_int8(sp, &type); - if (ret) + if (ret) { + krb5_set_error_string(context, "Failed readin v4 type"); goto error; + } little_endian = type & 1; type &= ~1; if(type != AUTH_MSG_APPL_REQUEST && type != AUTH_MSG_APPL_REQUEST_MUTUAL) { - ret = EINVAL; /* RD_AP_MSG_TYPE */ + ret = KRB4ET_RD_AP_MSG_TYPE; + krb5_set_error_string(context, "Not a valid v4 request type"); goto error; } @@ -801,7 +810,8 @@ _krb5_krb_rd_req(krb5_context context, size = krb5_storage_read(sp, ticket.data, ticket.length); if (size != ticket.length) { - ret = EINVAL; + ret = KRB4ET_INTK_PROT; + krb5_set_error_string(context, "Failed reading v4 ticket"); goto error; } @@ -815,7 +825,8 @@ _krb5_krb_rd_req(krb5_context context, size = krb5_storage_read(sp, eaut.data, eaut.length); if (size != eaut.length) { - ret = EINVAL; + ret = KRB4ET_INTK_PROT; + krb5_set_error_string(context, "Failed reading v4 authenticator"); goto error; } @@ -828,8 +839,8 @@ _krb5_krb_rd_req(krb5_context context, sp = krb5_storage_from_data(&aut); if (sp == NULL) { - krb5_set_error_string(context, "alloc: out of memory"); ret = ENOMEM; + krb5_set_error_string(context, "alloc: out of memory"); goto error; } @@ -849,19 +860,22 @@ _krb5_krb_rd_req(krb5_context context, if (strcmp(ad->pname, r_name) != 0 || strcmp(ad->pinst, r_instance) != 0 || strcmp(ad->prealm, r_realm) != 0) { - ret = EINVAL; /* RD_AP_INCON */ + krb5_set_error_string(context, "v4 principal mismatch"); + ret = KRB4ET_RD_AP_INCON; goto error; } - if (from_addr && from_addr != ad->address) { - ret = EINVAL; /* RD_AP_BADD */ + if (from_addr && ad->address && from_addr != ad->address) { + krb5_set_error_string(context, "v4 bad address in ticket"); + ret = KRB4ET_RD_AP_BADD; goto error; } gettimeofday(&tv, NULL); delta_t = abs((int)(tv.tv_sec - r_time_sec)); if (delta_t > CLOCK_SKEW) { - ret = EINVAL; /* RD_AP_TIME */ + ret = KRB4ET_RD_AP_TIME; + krb5_set_error_string(context, "v4 clock skew"); goto error; } @@ -870,12 +884,14 @@ _krb5_krb_rd_req(krb5_context context, tkt_age = tv.tv_sec - ad->time_sec; if ((tkt_age < 0) && (-tkt_age > CLOCK_SKEW)) { - ret = EINVAL; /* RD_AP_NYV */ + ret = KRB4ET_RD_AP_NYV; + krb5_set_error_string(context, "v4 clock skew for expiration"); goto error; } if (tv.tv_sec > _krb5_krb_life_to_time(ad->time_sec, ad->life)) { - ret = EINVAL; /* RD_AP_EXP */ + ret = KRB4ET_RD_AP_EXP; + krb5_set_error_string(context, "v4 ticket expired"); goto error; } diff --git a/source4/heimdal/lib/ntlm/ntlm.c b/source4/heimdal/lib/ntlm/ntlm.c index 1961c7fa22..671bf329e8 100644 --- a/source4/heimdal/lib/ntlm/ntlm.c +++ b/source4/heimdal/lib/ntlm/ntlm.c @@ -33,7 +33,7 @@ #include <config.h> -RCSID("$Id: ntlm.c 21317 2007-06-25 19:22:02Z lha $"); +RCSID("$Id: ntlm.c 21604 2007-07-17 06:48:55Z lha $"); #include <stdio.h> #include <stdlib.h> @@ -1105,7 +1105,7 @@ heim_ntlm_verify_ntlm2(const void *key, size_t len, HMAC_CTX_init(&c); HMAC_Init_ex(&c, ntlmv2, 16, EVP_md5(), NULL); HMAC_Update(&c, serverchallange, 8); - HMAC_Update(&c, ((char *)answer->data) + 16, answer->length - 16); + HMAC_Update(&c, ((unsigned char *)answer->data) + 16, answer->length - 16); HMAC_Final(&c, serveranswer, &hmaclen); HMAC_CTX_cleanup(&c); diff --git a/source4/heimdal_build/config.mk b/source4/heimdal_build/config.mk index 73187c31dc..940d9cdb9c 100644 --- a/source4/heimdal_build/config.mk +++ b/source4/heimdal_build/config.mk @@ -259,7 +259,8 @@ OBJ_FILES = \ ../heimdal/lib/krb5/warn.o \ ../heimdal/lib/krb5/krb5_err.o \ ../heimdal/lib/krb5/heim_err.o \ - ../heimdal/lib/krb5/k524_err.o + ../heimdal/lib/krb5/k524_err.o \ + ../heimdal/lib/krb5/krb_err.o # End SUBSYSTEM HEIMDAL_KRB5 ####################### @@ -568,10 +569,15 @@ include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/CMS.asn1 cms_asn1 hei include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/hx509/ocsp.asn1 ocsp_asn1 heimdal/lib/hx509 --preserve-binary=OCSPTBSRequest --preserve-binary=OCSPResponseData| include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/asn1/kx509.asn1 kx509_asn1 heimdal/lib/asn1| include perl_path_wrapper.sh asn1_deps.pl heimdal/lib/hx509/pkcs10.asn1 pkcs10_asn1 heimdal/lib/hx509 --preserve-binary=CertificationRequestInfo| + +# +# Ensure to update ../static_deps.mk when you add a new entry here! +# include perl_path_wrapper.sh et_deps.pl heimdal/lib/asn1/asn1_err.et heimdal/lib/asn1| include perl_path_wrapper.sh et_deps.pl heimdal/lib/hdb/hdb_err.et heimdal/lib/hdb| include perl_path_wrapper.sh et_deps.pl heimdal/lib/krb5/heim_err.et heimdal/lib/krb5| include perl_path_wrapper.sh et_deps.pl heimdal/lib/krb5/k524_err.et heimdal/lib/krb5| +include perl_path_wrapper.sh et_deps.pl heimdal/lib/krb5/krb_err.et heimdal/lib/krb5| include perl_path_wrapper.sh et_deps.pl heimdal/lib/krb5/krb5_err.et heimdal/lib/krb5| include perl_path_wrapper.sh et_deps.pl heimdal/lib/gssapi/krb5/gkrb5_err.et heimdal/lib/gssapi| include perl_path_wrapper.sh et_deps.pl heimdal/lib/hx509/hx509_err.et heimdal/lib/hx509| diff --git a/source4/static_deps.mk b/source4/static_deps.mk index 34bb1263c1..1c9173b32c 100644 --- a/source4/static_deps.mk +++ b/source4/static_deps.mk @@ -35,6 +35,7 @@ heimdal_basics: \ heimdal/lib/hdb/hdb_err.h \ heimdal/lib/krb5/heim_err.h \ heimdal/lib/krb5/k524_err.h \ + heimdal/lib/krb5/krb_err.h \ heimdal/lib/krb5/krb5_err.h \ heimdal/lib/gssapi/gkrb5_err.h \ heimdal/lib/hx509/hx509_err.h |