| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
| |
It's sort of nice to be able to build with debugging.
|
| |
|
|
|
|
|
|
|
| |
This adds support to the server for a new client control message,
CLIENT_FLUSHSUBS, which flushes all subscriptions and pending retransmits
for clients belonging to a given principal. The target principal must be
the same as the sender, unless the sender is on the opstaff ACL.
This is the server side of #103
|
| |
|
|
|
|
|
|
| |
Client acks don't actually include authenticators or checksums, but do
claim to be authed if the original notice was. So, don't bother ever
checking authentication on client acks.
This fixes #93
|
| |
|
|
|
|
|
|
|
|
| |
When processing a request to retrieve subscriptions, we actually do need
to send a SERVACK in response to the incoming notice before sending the
subscription list (directly) to the client that requested it. The line
that did this was inadvertently removed when the OLD_COMPAT support was
removed in commit 9b709859db5310444052d13ed8ebccec6ead1669.
This fixes #91
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Eliminate compiler warnings due to various issues (listed below). This
allows Zephyr to build cleanly under GCC versions ranging from 4.1.0 to
4.7.2 with all of the options shown below:
-g -O2 -Wall -Werror
-Wno-deprecated-declarations
-Wmissing-declarations
-Wpointer-arith
-Wstrict-prototypes
-Wshadow
-Wextra
-Wno-missing-field-initializers
-Wno-unused-parameter
and, on recent versions, -Wunreachable-code
Test builds were done
- On Ubuntu 12.10 (Quantal Quetzal) using both MIT Kerberos 1.10.1 and
Heimdal 1.6, without krb4 and both with and without C-Ares and Hesiod
- On Fedora 14 using Heimdal 0.6, without C-Ares or Hesiod and both
with and without krb4 (KTH Kerberos 1.3rc2)
- On Fedora Core 3, Fedora Core 5, Fedora 7, and Fedora 10, using
Heimdal 0.6 and without C-Ares, Hesiod, or krb4
It also allows clean builds on Solaris 10 under the Sun Studio 12 (9/07)
C compiler with the following options:
-g -fd -v -errfmt -errhdr=%user -errtags=yes -errwarn=%all
-erroff=E_OLD_STYLE_FUNC_DECL,E_ENUM_TYPE_MISMATCH_ARG,E_ARG_INCOMPATIBLE_WITH_ARG
... and under Solaris 9 with the Sun Forte 7 (3/02) C compiler with the above
options and -erroff=E_FUNC_HAS_NO_RETURN_STMT. Solaris builds were done
with Heimdal 0.6 and without C-Ares, Hesiod, or krb4.
The following types of issues are addressed in this change:
- Parameters and local variables with the same names as library functions
- Parameters and local variables with the same names as globals
- Declarations for exported global variables missing from headers
- Prototypes for exported functions missing from headers
- Missing 'static' on functions that shouldn't be exported
- Old-style function declarations
- Duplicate declarations
- Type mismatches
- Unused variables and functions
- Uninitialized variables
- Forward references to enums
- Necessary header files not included
- Violations of the aliasing rules, where GCC was able to detect them
- Missing braces on if blocks that might be empty
- Attempts to do pointer arithmetic on pointers of type void *, which
is not permitted in standard C.
- An attempt to pass a function pointer via a void * parameter, which is
not permitted in standard C. Instead, we now pass a pointer to a
structure, which then contains the required function pointer.
- Unnecessary inclusion of <krb5_err.h>, which is already included by
<krb5.h> when the former exists, and might not be protected against
double inclusion, depending on which com_err was used.
- Missing include of <com_err.h>, which was masked by the fact that it is
included by headers generated by e2fsprogs compile_et
- Use of com_err() with a non-constant value in place of the format string,
which in every case was a fixed-size buffer in which a message was built
using sprintf(!). Both the calls to sprintf and the fixed-size buffers
have been removed, in favor of just letting com_err() do the formatting.
- Various cases where X library functions expecting a parameter of type
wchar_t * were instead passed a parameter of type XChar2b *. The two
types look similar, but are not the same and are _not_ interchangeable.
- An overly-simplistic configure test which failed to detect existence of
<term.h> on Solaris, due to not including <curses.h>.
- Using the wrong type for the flags output of krb5_auth_con_getflags()
when building against Heimdal. A configure test is added to detect
the correct type.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This allows ACLs to grant access based on the IP address of a client
instead of its principal name. This is done using ACL entries with the
syntax "@a.b.c.d". Currently, only IPv4 addresses are supported. A single
entry may match all hosts on a particular subnet by using CIDR notation,
written as @a.b.c.d/nn. If no length is given, 32 is assumed.
Host and principal entries can be freely mixed within the same ACL; the ACL
matches if any entry matches the client. Note that this means that ACLs can
now match unauthenticated clients (however, this does not lift the general
constraint that only authenticated clients can subscribe at all).
Additionally, support for negative ACL entries is added. These entries are
indicated by a leading '!', which may be applied to both principal and host
entries. Negative entries are applied in the style of AFS ACLs; that is,
a matching negative entry overrides any positive entry and thus guarantees
that matching clients will be denied access.
(edited slightly for style by kcr@1TS.ORG)
|
| |
|
|
| |
To my knowledge, this hasn't been enabled by anyone in ages
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
(Thanks to nelhage@mit.edu for noticing the formatting problem)
|
| | |
|
| |
|
|
|
|
|
| |
deprecated sender_addr macro.)
Actually remove the code from realm.c:real_dispatch because nothing was using
the result.
Ran nuke-trailing-whitespace on all the files I touched, as usual.
|
| |
|
|
| |
(also fiddle around with what krb4 checksums are available in krb5-only land)
|
| | |
|
| |
|
|
| |
figure out where it is
|
| |
|
|
|
|
|
| |
Really, it almost terrifies me that servers have probably been sending
shutdown messages to stack-garbage address families for the past two
decades
|
| |
|
|
|
|
| |
Also, the C preprocessor has seen enough abuse; it is the future, so we can
abuse inline functions instead.
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
fencepost error.
|
| |
|
|
|
| |
also check the size of what we're sprintfing into
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
getsid problem
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
all operations yet.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Better interrealm support:
- Don't do unneeded check on ack authenticity.
- Avoid allowing a remote realm to forge a local user sending to an
acl'ed class.
- Fix calling conventions.
- Refragment packets if we grew them and now need to.
- Avoiding failing to ack if packet grew.
- Tell other realms we're shutting down.
- Avoid nacking bogus packets from broken servers.
* Avoid buffer overrun (in #if 0'd code)
* memset 0 cleanliness.
|
| |
|
|
|
| |
checksums on messages. With this change, you can't fiddle with subs if
you don't have a valid checksum.
|
| | |
|
| |
|
|
|
|
| |
would be to save nacked->client in a variable). Do make sure to
remove nacked from the list before calling client_deregister(),
though.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
and rename client_which_client() to client_find() and make the second
argument a port instead of a notice.
|
| | |
|
| | |
|
| |
|
|
| |
detailed change information.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
Jeffrey Hutzelman
Karl Ramm
Karl Ramm
Greg Hudson
Garry Zacheiss
Richard Basch