heimdal/kdc/krb5tgs.c

104 			krb5_kdc_configuration *config,
188 		     krb5_kdc_configuration *config,
245 	    kdc_log(context, config, 5,
280 	  krb5_kdc_configuration *config,
375 		krb5_kdc_configuration *config,
382 	    kdc_log(context, config, 0,
387 	    kdc_log(context, config, 0,
394 	kdc_log(context, config, 0,
401 	    kdc_log(context, config, 0,
409 	    kdc_log(context, config, 0,
421 	    kdc_log(context, config, 0,
429 	    kdc_log(context, config, 0,
441 	    kdc_log(context, config, 0,
449 	    kdc_log(context, config, 0,
458 	kdc_log(context, config, 0, "Ticket cannot be postdated");
464 	    kdc_log(context, config, 0,
476 	    kdc_log(context, config, 0,
492     if(f.request_anonymous && !config->allow_anonymous){
493 	kdc_log(context, config, 0,
507 			     krb5_kdc_configuration *config,
525 	kdc_log(context, config, 0,
553     kdc_log(context, config, 0,
567 	       krb5_kdc_configuration *config,
594 	      krb5_kdc_configuration *config,
599 	kdc_log(context, config, 0, "Ticket expired (%s)", pstr);
603 	kdc_log(context, config, 0, "Ticket not valid (%s)", pstr);
615 		       krb5_kdc_configuration *config,
638 	kdc_log(context, config, 0,
642 	kdc_log(context, config, 0,
679 	    kdc_log(context, config, 0,
694 	    kdc_log(context, config, 0,
725 	       krb5_kdc_configuration *config,
768     ret = check_tgs_flags(context, config, b, tgt, &et);
781     (config->trpolicy == TRPOLICY_ALWAYS_CHECK)
783     (config->trpolicy == TRPOLICY_ALLOW_PER_PRINCIPAL)
785     (config->trpolicy == TRPOLICY_ALWAYS_HONOUR_REQUEST)
791     ret = fix_transited_encoding(context, config,
940     _kdc_log_timestamp(context, config, "TGS-REQ", et.authtime, et.starttime,
949 					  config,
990     ret = _kdc_encode_reply(context, config,
1017 			krb5_kdc_configuration *config,
1032 	kdc_log(context, config, 0, "No authenticator in request");
1046 	kdc_log(context, config, 0, "Bad checksum type in authenticator: %d",
1056 	kdc_log(context, config, 0, "Failed to encode KDC-REQ-BODY: %s", msg);
1062 	kdc_log(context, config, 0, "Internal error in ASN.1 encoder");
1071 	kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1085 	kdc_log(context, config, 0,
1113 need_referral(krb5_context context, krb5_kdc_configuration *config,
1129     kdc_log(context, config, 0, "Searching referral for %s", name);
1136 		  krb5_kdc_configuration *config,
1172 	kdc_log(context, config, 0, "Failed to decode AP-REQ: %s", msg);
1179 	kdc_log(context, config, 0, "PA-DATA is not a ticket-granting ticket");
1189     ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT, ap_req.ticket.enc_part.kvno, NULL, krbtgt);
1197 	kdc_log(context, config, 5, "Ticket-granting ticket account %s does not have secrets at this KDC, need to proxy", p);
1209 	kdc_log(context, config, 0,
1226 	kdc_log(context, config, 0,
1246  	kdc_log(context, config, 0,
1274 	kdc_log(context, config, 0, "Failed to verify AP-REQ: %s", msg);
1287 		kdc_log(context, config, 0, "malloc failed");
1294 		kdc_log(context, config, 0, "malloc failed");
1302     ret = tgs_check_authenticator(context, config,
1316 	kdc_log(context, config, 0, "Failed to get remote subkey: %s", msg);
1328 	    kdc_log(context, config, 0, "Failed to get session key: %s", msg);
1335 	kdc_log(context, config, 0,
1350 	    kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1362 	    kdc_log(context, config, 0,
1378 	    kdc_log(context, config, 0, "Failed to decode authorization data");
1394 		      krb5_kdc_configuration *config,
1470 		krb5_kdc_configuration *config,
1535 	    kdc_log(context, config, 0,
1541 	    kdc_log(context, config, 0,
1547 	ret = _kdc_db_fetch(context, config, p,
1568 	ret = verify_flags(context, config, &adtkt, spn);
1588 	kdc_log(context, config, 0,
1592 	kdc_log(context, config, 0,
1600     ret = _kdc_db_fetch(context, config, sp, HDB_F_GET_SERVER | flags,
1604 	kdc_log(context, config, 5, "target %s does not have secrets at this KDC, need to proxy", sp);
1615 		    kdc_log(context, config, 5, "krbtgt for realm %s "
1632 	} else if(need_referral(context, config, &b->kdc_options, sp, &realms)) {
1634 		kdc_log(context, config, 5,
1656 	kdc_log(context, config, 0,
1690 		kdc_log(context, config, 0,
1703 				  config->tgt_use_strongest_session_key :
1704 				  config->svc_use_strongest_session_key, FALSE,
1708 		kdc_log(context, config, 0,
1735 	kdc_log(context, config, 0,
1752 	kdc_log(context, config, 0,
1757     ret = _kdc_db_fetch(context, config, krbtgt_principal, HDB_F_GET_KRBTGT, NULL, NULL, &krbtgt_out);
1764 	kdc_log(context, config, 0,
1784 	kdc_log(context, config, 0,
1795 	kdc_log(context, config, 0,
1800     ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT | flags,
1820 	    kdc_log(context, config, 1, "Client no longer in database: %s",
1826 	kdc_log(context, config, 1, "Client not found in database: %s", msg);
1830     ret = check_PAC(context, config, cp, NULL,
1837 	kdc_log(context, config, 0,
1846 			       config,
1854 	kdc_log(context, config, 0,
1884 		kdc_log(context, config, 0, "Failed to decode PA-S4U2Self");
1897 		kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1913 		kdc_log(context, config, 0,
1935 		ret = _kdc_db_fetch(context, config, tp, HDB_F_GET_CLIENT | flags,
1949 		    kdc_log(context, config, 1,
1957 		    kdc_log(context, config, 0, "PAC generation failed for -- %s",
1968 			kdc_log(context, config, 0, "PAC signing failed for -- %s",
1979 	    ret = check_s4u2self(context, config, clientdb, client, sp);
1981 		kdc_log(context, config, 0, "S4U2Self: %s is not allowed "
1999 	    kdc_log(context, config, 0, "s4u2self %s impersonating %s to "
2023 	    kdc_log(context, config, 0,
2040 	    kdc_log(context, config, 0,
2070 	    kdc_log(context, config, 0,
2078 	ret = check_constrained_delegation(context, config, clientdb,
2081 	    kdc_log(context, config, 0,
2087 	ret = verify_flags(context, config, &adtkt, tpn);
2100 	ret = check_PAC(context, config, tp, dp,
2107 	    kdc_log(context, config, 0,
2119 				   config,
2127 	    kdc_log(context, config, 0,
2138 	    kdc_log(context, config, 0,
2146 	kdc_log(context, config, 0, "constrained delegation for %s "
2154     ret = kdc_check_flags(context, config,
2165 	kdc_log(context, config, 0, "Inconsistent request.");
2171     if(!_kdc_check_addresses(context, config, tgt->caddr, from_addr)) {
2173 	kdc_log(context, config, 0, "Request from wrong address");
2185 	kdc_log(context, config, 0,
2192 	ret = build_server_referral(context, config, crypto, ref_realm,
2196 	    kdc_log(context, config, 0,
2205 	    kdc_log(context, config, 0,
2216 			 config,
2281 	     krb5_kdc_configuration *config,
2305 	kdc_log(context, config, 0,
2315 	kdc_log(context, config, 0,
2319     ret = tgs_parse_request(context, config,
2335 	kdc_log(context, config, 0,
2341 			  config,
2355 	kdc_log(context, config, 0,
2361     if (datagram_reply && data->length > config->max_datagram_reply_length) {