ticket: 6936
target_version: 1.10
tags: pullup

Do mech fallback for first SPNEGO context token

When producing the first SPNEGO security context token, if the first
mechanism's init_sec_context fails, fall back to a later mechanism.

This fixes a regression in 1.10 for SPNEGO initiators using non-krb5
credentials.  The identity selection work causes errors to be deferred
from krb5's acquire_cred in some cases, which means SPNEGO doesn't see
an error until it tries the krb5 init_sec_context.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25591 dc483132-0cff-0310-8789-dd5450dbe970
ticket: 7054

Avoid using itertools.permutations in k5test

k5test is only supposed to require Python 2.4, but cross_realms uses
itertools.permutations which is new in 2.6.  Use a list display
instead.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25592 dc483132-0cff-0310-8789-dd5450dbe970
Fix make depend in unbuilt build tree

Add dependency rules so that "make depend" succeeds from a fresh build
tree.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25593 dc483132-0cff-0310-8789-dd5450dbe970
Correct typos and formating.



git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25594 dc483132-0cff-0310-8789-dd5450dbe970
Table of Contents.hhc -> Table_of_Contents.hhc

Avoid using spaces in filenames as it makes searching the source
tree less convenient on Unix.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25598 dc483132-0cff-0310-8789-dd5450dbe970
Remove MITKC logo from the tree.


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25599 dc483132-0cff-0310-8789-dd5450dbe970
Stop using krb5_octet_data

For consistency with the rest of the code base, make PKINIT use
krb5_data as a pointer/length container.  Leave krb5_octet_data and
krb5_free_octet_data behind for API compatibility.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25600 dc483132-0cff-0310-8789-dd5450dbe970
Stop using krb5_typed_data structure type

Use the krb5_pa_data structure type when encoding or decoding
TYPED-DATA.  Leave the krb5_typed_data structure definition in krb5.h
with a comment saying not to use it.  Remove krb5_free_typed_data
(which was never declared in krb5.h).  Remove some vestigial accessor
stuff related to PKINIT encoding and decoding TYPED-DATA, which was
unneeded since r25483.  Bump the accessor structure version to 19
accordingly.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25601 dc483132-0cff-0310-8789-dd5450dbe970
Updated env variable sections, formating and  other corrections


git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25602 dc483132-0cff-0310-8789-dd5450dbe970
ticket: 6936

Fix an unlikely memory leak in r25591

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25604 dc483132-0cff-0310-8789-dd5450dbe970
ticket: 7057

Fix implicit declaration in ksu for some builds

ksu's setenv implementation needs to include <string.h> for memcpy.
Patch from basch@alum.mit.edu.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25605 dc483132-0cff-0310-8789-dd5450dbe970
Remove unused functions (older API residue) krb5_realm_iterator* and krb5_free_realm_string



git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25606 dc483132-0cff-0310-8789-dd5450dbe970
Fix asn1_encode_subject_pk_info without params

r20923 inadvertently broke asn1_encode_subject_pk_info in the case
where algorithm.parameters.length == 0.  Fortunately this case never
happens, but fix it anyway.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25607 dc483132-0cff-0310-8789-dd5450dbe970
Simplify and reformat ASN.1 test code

Use abort-on-error memory allocation to reduce failure handling.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25608 dc483132-0cff-0310-8789-dd5450dbe970
Add test cases for PKINIT ASN.1 encoders

Do not add decode tests, because those would trip some bugs in the
decoders, and we can't safely fix some of those bugs without interop
testing.  Encode tests are sufficient to detect when we
unintentionally change the output of the encoders.

Fix trval2() not to use the context shortcut on primitive context
tags.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25609 dc483132-0cff-0310-8789-dd5450dbe970
Add missing test cases for ASN.1 types

Add test cases for ASN.1 types which didn't previously have them.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25610 dc483132-0cff-0310-8789-dd5450dbe970
Make ASN.1 struct atype_info more extensible

Instead of including all of the possible type fields in struct
atype_info, use a pointer to a type-specific structure.  This might
save a little space, but more importantly, if we get to the point of
exposing this stuff across plugin APIs, it allows ASN.1 type
information to be extensible via defining new atype_type values.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25611 dc483132-0cff-0310-8789-dd5450dbe970
Use content-only ASN.1 primitives

As part of implicit tag support, rework ASN.1 encoding primitives so
that they encode only content, not tags.  Combine primitives which
become identical with this change.  The new atype_primitive type
invokes a primitive encoder and adds a tag.  atype_fn_len is split
into atype_string and atype_opaque, both of which are hardcoded to
use asn1_encode_bytestring.

For the encoders still using macros, create asn1_addprimitive,
asn1_addinteger, and asn1_addstring macros which call the primitive
encoder function and add a tag.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25612 dc483132-0cff-0310-8789-dd5450dbe970
Support ASN.1 encoding without the outer tag

In order to support implicit tagging, make it possible to ASN.1-encode
a value without its outer tag, instead remembering the construction
bit of the omitted tag.

A cleaner design would be to have separate functions for encoding a
value's contents and its tag.  However, we can't do that for atype_fn
or atype_opaque, and the possible indirections between types and
fields mean we want to stay at the "encode everything" level for as
long as possible to allow implicit tagging of the largest possible
subset of types.  If we can get rid of atype_fn, we may be able to
switch to the cleaner design with some adjustments to atype_opaque.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25613 dc483132-0cff-0310-8789-dd5450dbe970
Support implicit context tags in ASN.1 fields

Add a field_info bit (the 32nd bit of the bitfields) indicating whether
the context tag is implicit, and support it in encode_a_field.  Adjust
all field-generating macros and invocations to include the new bit
(always 0 for the moment).

For atype_tagged_thing, narrow the construction field to six bits and
add an implicit bit.  We could remove the construction field if it
weren't for DEFOCTETWRAPPEDTYPE abusing atype_tagged_thing a little
bit, since (normal) explicit tags are always constructed and implicit
tag construction is computed from the base type.

Given how rarely implicit tagging is used, it might be nice to have
separate _IMPLICIT macros rather than an extra argument to every
field.  But we already have separate _OPT macros for optional fields
and FIELDOF_STRING vs. FIELDOF_STRINGL, so we start to get a
combinatoric explosion in the number of macros.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25614 dc483132-0cff-0310-8789-dd5450dbe970