source: heimdal/trunk/ChangeLog.2004@ 4

Last change on this file since 4 was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 44.1 KB
Line 
12004-12-30 Love Hörnquist Å
2strand <lha@it.su.se>
3
4 * lib/krb5/Makefile.am (CHECK_SYMBOLS): add heim_ and pkcs7_ for
5 now (used in pkinit)
6
72004-12-29 Love Hörnquist Å
8strand <lha@it.su.se>
9
10 * lib/hdb/Makefile.am: add CHECK_SYMBOLS
11
12 * lib/hdb/keys.c: make all_etypes static
13
14 * lib/krb5/Makefile.am: add CHECK_SYMBOLS, approve of: -com_err
15 -version krb5_ _krb5_ __heimdal krb524_ krb4_fkt_ops
16
17 * kdc/kerberos5.c: use private version of principalname
18
19 * kdc/kerberos4.c: use private version of principalname
20
21 * kdc/hpropd.c: use private version of principalname
22
23 * kdc/524.c: use private version of principalname
24
25 * lib/krb5/rd_req.c: use private version of principalname
26
27 * lib/krb5/rd_cred.c: use private version of principalname
28
29 * lib/krb5/init_creds_pw.c: use private version of principalname
30
31 * lib/krb5/get_in_tkt.c: use private version of principalname
32
33 * lib/krb5/asn1_glue.c: make principalname functions private
34
35 * lib/krb5/krb5.h: add key usage for server referrals
36
372004-12-29 Love Hörnquist Å
38strand <lha@it.su.se>
39
40 * lib/krb5/principal.c: make default_v4_name_convert static
41
42 * lib/krb5/crypto.c: make lots of crypto related variables static
43
44 * lib/krb5/acache.c: make default_acc_name static
45
462004-12-28 Love Hörnquist Å
47strand <lha@it.su.se>
48
49 * doc/setup.texi: add some text about samba, use example.com
50
51 * lib/hdb/hdb-ldap.c: Add account expiration for samba from James
52 F. Hranicky <jfh@cise.ufl.edu>.
53 Add LDAP_addmod_integer and use it.
54
552004-12-27 Love Hörnquist Å
56strand <lha@it.su.se>
57
58 * doc/{Makefile.am,setup.texi,win2k.texi}: spelling and text
59 fixes, from Dave Love
60
612004-12-18 Love Hörnquist Å
62strand <lha@it.su.se>
63
64 * lib/krb5/heim_threads.h: NetBSD 2.99.11 (any maybe 2.1) just
65 needs pthread.h, threadlib is dead
66
672004-12-17 Love Hörnquist Å
68strand <lha@it.su.se>
69
70 * kdc/config.c (configure): check for deprecated
71 enforce-transited-policy is set and fail if it is
72
73 * lib/asn1/asn1_print.c: don't print garabage for octet strings
74
752004-12-13 Love Hörnquist Å
76strand <lha@it.su.se>
77
78 * kdc/main.c (main): catch sigpipe, we don't bother select()ing
79 for errors
80
81 * kdc/connect.c (handle_http_tcp): handle error from write(2)
82
83 * doc/setup.texi: clarify credentials refreshing stuff
84
85 * doc/setup.texi: add new node: Providing Kerberos credentials to
86 servers and programs
87
88 * doc/whatis.texi: fix spurious cross-reference makeinfo warning
89
90 * lib/hdb/hdb-ldap.c (pos): uppercase in character
91
922004-12-12 Love Hörnquist Å
93strand <lha@it.su.se>
94
95 * lib/hdb/hdb-ldap.c (LDAP__bytes2hex,LDAP__hex2bytes): encode
96 nibbels in the other order
97
98 * lib/hdb/hdb-ldap.c: s/objectclass/objectClass/ check if
99 attribute exists before we try to delete it LDAP__bytes2hex
100 encodes in strange byte order, is this really right ?
101
1022004-12-11 Love Hörnquist Å
103strand <lha@it.su.se>
104
105 * lib/hdb/hdb-ldap.c (LDAP_firstkey): When iterating over all
106 entries, search for samba accounts too, From: "James F. Hranicky"
107 <jfh@cise.ufl.edu>
108
109 * lib/hdb/hdb-ldap.c (krb5kdcentry_attrs): ask for attribute uid
110 too
111
112 * lib/hdb/hdb-ldap.c (LDAP_message2entry): if the entry is missing
113 both krb5PrincipalName and uid, it must be broken, ignore it and
114 return it doesn't exists.
115
1162004-12-10 Love Hörnquist Å
117strand <lha@it.su.se>
118
119 * kdc/hpropd.8: spelling, from OpenBSD
120
121 * kdc/kdc.8: use keeps for options, From OpenBSD k
122
1232004-12-09 Love Hörnquist Å
124strand <lha@it.su.se>
125
126 * doc/setup.texi: document --random-key and the need to do backup
127 of the master key
128
129 * kdc/kstash.8: add --random-key
130
131 * kdc/kstash.c: add --random-key
132
1332004-12-08 Love Hörnquist Å
134strand <lha@it.su.se>
135
136 * lib/krb5/verify_krb5_conf.8: spelling, from openbsd
137
138 * lib/krb5/krb5_init_context.3: spelling, from openbsd
139
140 * lib/krb5/krb5.conf.5: spelling, from openbsd
141
142 * kuser/kdestroy.1: use keeps around options, spelling, from
143 openbsd
144
145 * kpasswd/kpasswdd.8: use ., use keeps around options, from OpenBSD
146
147 * kdc/hpropd.8: use keeps around options, from OpenBSD
148
149 * kdc/hprop.8: use keeps around options, from OpenBSD
150
1512004-11-30 Love Hörnquist Å
152strand <lha@it.su.se>
153
154 * lib/krb5/context.c (krb5_free_context): clear error string
155 before destroying mutex
156 (krb5_init_context): don't call krb5_free_context before there is a
157 mutex initialized
158
1592004-11-18 Love Hörnquist Å
160strand <lha@it.su.se>
161
162 * kuser/kinit.c (get_new_tickets): only complain about ticket
163 renewable lifetime when the user asked for a specific renewable
164 lifetime
165
1662004-11-15 Love Hörnquist Å
167strand <lha@it.su.se>
168
169 * kdc/kerberos5.c (find_keys): log what principal is missing
170 enctypes
171
1722004-11-13 Love Hörnquist Å
173strand <lha@it.su.se>
174
175 * lib/krb5/get_in_tkt.c (krb5_get_in_cred): clear pointer after
176 freeing data
177
178 * lib/krb5/init_creds_pw.c (change_password): handle old_options
179 being NULL From Guenther Deschner on samba-technical.
180
1812004-11-12 Love Hörnquist Å
182strand <lha@it.su.se>
183
184 * lib/krb5/krb5_get_init_creds.3: add more text describing the
185 krb5_get_init_creds functions
186
1872004-11-11 Love Hörnquist Å
188strand <lha@it.su.se>
189
190 * lib/krb5/init_creds_pw.c: make krb5_get_init_creds_keytab work
191 again
192
1932004-11-10 Love Hörnquist Å
194strand <lha@it.su.se>
195
196 * lib/hdb/hdb.asn1: use constrained integers
197
1982004-11-09 Love Hörnquist Å
199strand <lha@it.su.se>
200
201 * lib/krb5/krb5_get_init_creds.3: add description for opt_init,
202 opt_alloc, opt_free
203
204 * lib/krb5/pkinit.c: unexport krb5_get_init_creds_opt_free_pkinit
205
206 * lib/krb5/init_creds.c: unexport
207 krb5_get_init_creds_opt_free_pkinit
208
209 * lib/krb5/init_creds_pw.c: fold init_init_creds_ctx into
210 get_init_creds_common
211
212 * lib/krb5/init_creds.c (_krb5_get_init_creds_opt_copy): if the in
213 options NULL, just make a clean copy
214
2152004-11-01 Love Hörnquist Å
216strand <lha@it.su.se>
217
218 * lib/krb5/sendauth.c (krb5_rd_rep): free ap_rep message earlier
219 so we don't leak it on error
220
2212004-10-31 Love Hörnquist Å
222strand <lha@it.su.se>
223
224 * lib/krb5/krb5.conf.5: unbreak 2b entry
225
226 * lib/krb5/acache.c (make_cred_from_ccred): the address isn't a
227 sockaddr but rather a kerberos address, deal with that. Based on
228 bug report from Jakob Schlyter <jakob@rfc.se>.
229
2302004-10-30 Love Hörnquist Å
231strand <lha@it.su.se>
232
233 * kdc/connect.c: Make sure argument passed to ctype isn't signed
234 char
235
2362004-10-14 Love Hörnquist Å
237strand <lha@it.su.se>
238
239 * lib/krb5/pkinit.c: match new error names
240
241 * lib/krb5/krb5_err.et: make error messages sane again
242
2432004-10-13 Love Hörnquist Å
244strand <lha@it.su.se>
245
246 * lib/krb5/keytab.c: use KRB5_KT_BADNAME
247
248 * lib/krb5/krb5_err.et: sync with mit krb5_err.et (require major
249 version bump) add KRB5_DELTAT_BADFORMAT
250
251 * lib/krb5/krb5.conf.5: time defaults to "s"
252
253 * lib/krb5/time.c (krb5_string_to_deltat): default to "s" again,
254 MIT's behavior was actually that it failed to parse the number
255 (and thus used the default). Even better, ticket_lifetime (that
256 was a consumer supposed a of the interface) was documented but
257 never implemented, when it was implemented, people configuraiton
258 files started to fail. Also, use KRB5_DELTAT_BADFORMAT as a
259 failure code.
260
261 * lib/asn1/k5.asn1: sync enctypes with pkinit branch
262
263 * lib/asn1/parse.y (readd) support negative numbers
264
265 * lib/asn1/lex.l: support hex numbers
266
2672004-10-12 Love Hörnquist Å
268strand <lha@it.su.se>
269
270 * kdc/pkinit.c: use ETYPE_DES3_CBC_NONE_CMS
271
272 * lib/krb5/crypto.c: add enctype_des3_cbc_none_cms add cms padding
273 for rc2 don't to padding for blocksize 1
274
275 * lib/hdb/{keys.c,Makefile.am},lib/kadm5/{keys,set_keys}.c:
276 Move keyset parsing and password based keyset generation into hdb.
277 Requested by Andrew Bartlett <abartlet@samba.org> for hdb-ldb
278 backend.
279
2802004-10-07 Love Hörnquist Å
281strand <lha@it.su.se>
282
283 * kuser/kinit.c: adapt to new signature of
284 krb5_get_init_creds_opt_set_pkinit
285
286 * lib/krb5/pkinit.c: free openssl engine deal with
287 RecipientIdentifier -> CMSIdentifier and heim_any -> name change
288 improve error messages
289
290 * kdc/pkinit.c: free openssl engine deal with RecipientIdentifier
291 -> CMSIdentifier and heim_any -> name change
292
2932004-10-04 Johan Danielsson <joda@pdc.kth.se>
294
295 * kuser/klist.c: use rtbl_set_separator
296
2972004-10-03 Love Hörnquist Å
298strand <lha@it.su.se>
299
300 * lib/krb5/pkinit.c: filter out dup openssl engine keys, parse
301 user options first
302
303 * lib/krb5/pkinit.c: stop using AlgorithmIdentifierNonOpt, add
304 openssl engine support for private key
305
306 * lib/krb5/crypto.c: support padding as its done in CMS
307
308 * kdc/pkinit.c: improve error logging
309
310 * kdc/pkinit.c: stop using AlgorithmIdentifierNonOpt
311
3122004-09-30 Love Hörnquist Å
313strand <lha@it.su.se>
314
315 * lib/krb5/krb5.conf.5: assume minutes for time
316
317 * lib/krb5/config_file.c (krb5_config_vget_time_default): use
318 krb5_string_to_deltat
319
320 * lib/krb5/appdefault.c (krb5_appdefault_time): use
321 krb5_string_to_deltat
322
323 * lib/krb5/time.c (krb5_string_to_deltat): set default unit to
324 minute for compatibility with MIT Kerberos.
325
326
3272004-09-28 Love Hörnquist Å
328strand <lha@it.su.se>
329
330 * lib/krb5/get_cred.c (get_cred_kdc_usage): retry using "large
331 message safe" transport if we get back
332 KRB5KRB_ERR_RESPONSE_TOO_BIG error. Idea from Guenther Deschner
333 <gd@sernet.de>
334
3352004-09-23 Johan Danielsson <joda@pdc.kth.se>
336
337 * admin/list.c: use rtbl
338
339 * admin/ktutil-commands.in: slc source file
340
341 * lib/krb5/constants.c: check
342 /Library/Preferences/edu.mit.Kerberos on OSX
343
3442004-09-21 Johan Danielsson <joda@pdc.kth.se>
345
346 * lib/krb5/time.c (krb5_format_time): check return value from
347 localtime and strftime
348
3492004-09-14 Johan Danielsson <joda@pdc.kth.se>
350
351 * kuser/kinit.c: make sure we don't always get renewable creds
352
3532004-09-11 Love Hörnquist Å
354strand <lha@it.su.se>
355
356 * lib/krb5/acache.c: use krb5_ccapi.h
357
358 * lib/krb5/krb5_ccapi.h: break out krb5 api definitions to
359 separate (not installed) file
360
361 * lib/krb5/Makefile.am: add AM_CPPFLAGS to libkrb5_la_CPPFLAGS
362 since AM_CPPFLAGS overridden by target specific _CPPFLAGS
363
3642004-09-08 Love Hörnquist Å
365strand <lha@it.su.se>
366
367 * lib/krb5/pkinit.c: make variable shorter, make error messages
368 from pkinit, make freeing easier
369
3702004-09-06 Love Hörnquist Å
371strand <lha@it.su.se>
372
373 * lib/krb5/Makefile.am: link libkrb5 with LIB_dlopen
374
375 * lib/krb5/crypto.c (seed_something): avoid poking at memory that
376 is uninitialized, make valgrind unhappy. Pointd out by
377 abartlet@samba.org. While where, plug the fd leak.
378
3792004-09-05 Love Hörnquist Å
380strand <lha@it.su.se>
381
382 * lib/asn1/der_get.c (decode_*): name all tag-length variables the
383 same
384 (decode_enumerated): check that the tag-length is not longer the length
385
386 * lib/asn1/der_get.c (decode_boolean): fail if length of tag is
387 larger then len
388
3892004-08-31 Love Hörnquist Å
390strand <lha@it.su.se>
391
392 * lib/krb5/init_creds_pw.c (krb5_get_init_creds): kdc_reply can be
393 set in case of failure too, free unconditionally on exit to avoid
394 memory leak
395
3962004-08-23 Love Hörnquist Å
397strand <lha@it.su.se>
398
399 * lib/krb5/get_cred.c (set_auth_data): set pointer to NULL after
400 free
401
4022004-08-20 Love Hörnquist Å
403strand <lha@it.su.se>
404
405 * lib/krb5/context.c (krb5_get_err_text): if neither of com_right
406 nor strerror finds the error-code, return Unknown error.
407
4082004-08-19 Johan Danielsson <joda@pdc.kth.se>
409
410 * lib/krb5/krb5_kuserok.3: update to reality
411
412 * lib/krb5/kuserok.c: if a .k5login file exist, don't give
413 implicit rights to anyone; also check owner/mode of .k5login
414
4152004-08-15 Love Hörnquist Å
416strand <lha@it.su.se>
417
418 * lib/krb5/Makefile.am: man_MANS = krb5_getportbyname.3
419
420 * lib/krb5/krb5_getportbyname.3: manpage for krb5_getportbyname
421
422 * lib/krb5/krb5.3: add krb5_getportbyname
423
424 * lib/krb5/krb5.3: krb5_free_salt and krb5_enctype_valid
425
426 * lib/krb5/krb5_encrypt.3: document krb5_enctype_valid
427
4282004-08-13 Love Hörnquist Å
429strand <lha@it.su.se>
430
431 * kdc/kerberos5.c (get_pa_etype_info{,2}): check for dup enctypes
432 from the client and filter them out.
433
434 * lib/krb5/krb5_string_to_key.3: document krb5_free_salt
435
4362004-08-12 Love Hörnquist Å
437strand <lha@it.su.se>
438
439 * lib/krb5/krb5_ticket.3: data needs to be freed when using
440 krb5_ticket_get_authorization_data_type
441
4422004-08-11 Love Hörnquist Å
443strand <lha@it.su.se>
444
445 * lib/krb5/test_cc.c: test variables in default_cc_name
446
447 * lib/krb5/krb5.conf.5: explain support for varibles in
448 [libdefaults]default_cc_name
449
450 * lib/krb5/cache.c: drop ${time}, its not very useful
451
452 * lib/krb5/cache.c: Add _krb5_expand_default_cc_name that expand
453 variables in the default cc name. Supported variables now are:
454 ${time},${uid} and ${null}
455
456 * lib/krb5/krb5.conf.5: document default_cc_name
457
458 * lib/krb5/cache.c (krb5_cc_set_default_name):
459 s/libdefault/libdefaults/
460
4612004-08-06 Love Hörnquist Å
462strand <lha@it.su.se>
463
464 * lib/krb5/acache.c: replace magic 3 with ccapi_version_3
465
466 * lib/krb5/Makefile.am: libkrb5_la_SOURCES += acache.c
467
468 * lib/krb5/krb5.h: add krb5_acc_ops
469
470 * lib/krb5/acache.c: CCAPI v3 implementation, the read only
471 support was from Magnus Ahltorp and then extended by me to support
472 all other operations. Tested with MIT kerberos cc cache
473 implementation on MacOS 10.3.3
474
475 * lib/krb5/cache.c (krb5_cc_set_default_name): allow setting the
476 default cc name, this is not very useful for general purpose glue
477 since its not possible to glue in user information (like uid), but
478 for CCAPI it works just fine
479
4802004-08-05 Love Hörnquist Å
481strand <lha@it.su.se>
482
483 * kuser/kgetcred.1: document --cache/-c
484
485 * kuser/kgetcred.c: allow to specify what credential cache to use
486
4872004-08-03 Love Hörnquist Å
488strand <lha@it.su.se>
489
490 * lib/krb5/Makefile.am: add krb5_eai_to_heim_errno.3
491
492 * lib/krb5/krb5_eai_to_heim_errno.3: document
493 krb5_eai_to_heim_errno, krb5_h_errno_to_heim_errno
494
495 * lib/krb5/krb5.3: add krb5_eai_to_heim_errno,
496 krb5_h_errno_to_heim_errno
497
4982004-07-26 Love Hörnquist Å
499strand <lha@it.su.se>
500
501 * lib/krb5/krb5_expand_hostname.3: krb5_expand_hostname_realms
502 result should be free with krb5_free_host_realm drop
503 krb5_get_host_realm text
504
505 * lib/krb5/krb5_set_default_realm.3: krb5_get_host_realm result
506 should be free with krb5_free_host_realm
507
508 * lib/krb5/krb5_get_in_cred.3: document krb5_free_kdc_rep
509
510 * lib/krb5/krb5_get_init_creds.3: remove dup krb5_get_init_creds
511
512 * lib/krb5/krb5_auth_context.3: sort, add krb5_free_authenticator
513
514 * lib/krb5/Makefile.am: man_MANS += krb5_rd_error
515
516 * lib/krb5/krb5_rd_error.3: krb5_rd_error and friends
517
518 * lib/krb5/krb5_warn.3: clarify on what string
519 krb5_free_error_string should operate on
520
521 * lib/krb5/krb5_get_credentials.3: add krb5_get_kdc_cred
522
523 * lib/krb5/Makefile.am: krb5_get_credentials,
524 krb5_get_forwarded_creds and friends
525
526 * lib/krb5/krb5_get_forwarded_creds.3: krb5_get_forwarded_creds
527 and friends
528
529 * lib/krb5/krb5_get_credentials.3: krb5_get_credentials and
530 friends
531
5322004-07-23 Love Hörnquist Å
533strand <lha@it.su.se>
534
535 * kuser/klist.c (print_cred_verbose): keytypes are no longer, use
536 enctype
537
5382004-07-22 Love Hörnquist Å
539strand <lha@it.su.se>
540
541 * lib/hdb/hdb-ldap.c (LDAP_entry2mods): allow for pre-c99
542 compilers, From metze at samba.org
543
5442004-07-20 Love Hörnquist Å
545strand <lha@it.su.se>
546
547 * lib/krb5/test_cc.c: more cc tests
548
549 * lib/krb5/krb5_check_transited.3: document krb5_check_transited
550
5512004-07-19 Love Hörnquist Å
552strand <lha@it.su.se>
553
554 * kdc/pkinit.c (pk_principal_from_X509): reverse test, makes
555 principal in cert work From: Mayur Patel <patelm4@rpi.edu>
556
5572004-07-18 Love Hörnquist Å
558strand <lha@it.su.se>
559
560 * lib/krb5/Makefile.am: add krb5_verify_init_creds.3
561
562 * lib/krb5/krb5_verify_init_creds.3: add krb5_verify_init_creds
563
5642004-07-15 Love Hörnquist Å
565strand <lha@it.su.se>
566
567 * lib/krb5/krb5_set_password.3: spelling from wiz@netbsd.org
568 description for krb5_passwd_result_to_string
569
5702004-07-14 Love Hörnquist Å
571strand <lha@it.su.se>
572
573 * lib/krb5/krb5_set_password.3: Remove superfluous comma; grammar
574 fixes; split sentence in two for better understanding. From
575 wiz@NetBSD.org. Describe krb5_set_password_using_ccache while here.
576
577 * lib/krb5/krb5_set_password.3: nroff and spelling, from Jonathan
578 Stone <jonathan@dsg.stanford.edu>
579
580 * lib/krb5/changepw.c (process_reply): cast ssize_t to long and
581 print that From NetBSD via Havard Eidnes.
582
5832004-07-09 Love Hörnquist Å
584strand <lha@it.su.se>
585
586 * configure.in: fix helpstring for hdb-openldap-module
587
588 * lib/krb5/test_cc.c: don't use krb5_err on error code 0
589
5902004-07-08 Love Hörnquist Å
591strand <lha@it.su.se>
592
593 * lib/hdb/hdb-ldap.c (LDAP_seq): try handling errors better
594
5952004-07-02 Love Hörnquist Å
596strand <lha@it.su.se>
597
598 * lib/krb5/get_in_tkt.c (set_ptypes): make ptypes const
599
6002004-07-01 Love Hörnquist Å
601strand <lha@it.su.se>
602
603 * lib/hdb/hdb-ldap.c (LDAP__connect): call ldap_initialize with
604 right argument
605
6062004-06-27 Johan Danielsson <joda@pdc.kth.se>
607
608 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): if the
609 krbtgt is without addresses, default to not sending our own
610 addrport
611
612 * lib/asn1/lex.l: add support for /* */ and partial line --
613 comments
614
615 * kuser/Makefile.am: don't install copy_cred_cache manpage
616
6172004-06-24 Johan Danielsson <joda@pdc.kth.se>
618
619 * lib/krb5/init_creds.c (_krb5_get_init_creds_opt_copy): if
620 copying a static opt, make sure to allocate the "private" field
621
6222004-06-24 Love <lha@stacken.kth.se>
623
624 * kdc/config.c: add enable_pkinit_princ_in_cert
625
626 * kdc/kdc_locl.h: enable_pkinit_princ_in_cert
627
628 * kdc/pkinit.c: Check certificate for Kerberos Principal in
629 OtherName of subjectAltName Based on patch from Mayur Patel
630 <patelm4@rpi.edu>
631
6322004-06-21 Love Hörnquist Å
633strand <lha@it.su.se>
634
635 * lib/krb5/get_cred.c (init_tgs_req): if subkey not avaible, use
636 session key for authorization-data
637
6382004-06-15 Love Hörnquist Å
639strand <lha@it.su.se>
640
641 * kdc/connect.c (handle_tcp): note who is what that closed the
642 connection on us
643
6442004-06-09 Love Hörnquist Å
645strand <lha@it.su.se>
646
647 * admin/get.c (kt_get): catch errors from krb5_parse_name
648
6492004-06-05 Love Hörnquist Å
650strand <lha@it.su.se>
651
652 * lib/hdb/hdb-ldap.c: if its the entry just contains the
653 structural object (no samba nor heimdal object), add an aux
654 heimdal object on to it.
655
6562004-06-02 Love Hörnquist Å
657strand <lha@it.su.se>
658
659 * kpasswd/kpasswd.c: use krb5_set_password_using_ccache
660
661 * lib/krb5/krb5_set_password.3: add krb5_set_password_using_ccache
662
663 * lib/krb5/changepw.c: implement krb5_set_password_using_ccache
664
665 * lib/hdb/hdb-ldap.c: Allow the objectClass to be
666 "sambaSamAccount" or structural_object when searching for uid
667 entries.
668
669 * lib/krb5/krb5.conf.5: document [kdc]hdb-ldap-create-base
670
671 * lib/hdb/hdb-ldap.c: add creation base that defaults to the
672 search base
673
674 * lib/hdb/hdb-ldap.c: indent like the rest of the code
675
6762004-06-01 Love Hörnquist Å
677strand <lha@it.su.se>
678
679 * lib/hdb/hdb-ldap.c: check return values from ldap operations and
680 close it we get back LDAP_SERVER_DOWN. stupid ldap client lib, you
681 should retry by yourself.
682
683 * lib/hdb/hdb-ldap.c: require search base to be configured, create
684 local context structure
685
6862004-05-31 Love Hörnquist Å
687strand <lha@it.su.se>
688
689 * doc/setup.texi: more ldap text, partly from Tarjei Huse
690 <tarjei@nu.no>
691
6922004-05-28 Love Hörnquist Å
693strand <lha@it.su.se>
694
695 * lib/hdb/hdb-ldap.c: clean, indent
696
697 * lib/hdb/hdb-ldap.c (LDAP_entry2mods): make sure
698 krb5KeyVersionNumber is added on new entires
699
7002004-05-27 Love Hörnquist Å
701strand <lha@it.su.se>
702
703 * doc/setup.texi: minor fixes, partly from Tarjei Huse
704 <tarjei@nu.no>
705
706 * lib/krb5/krb5.conf.5: some text about dbname and realm
707
708 * lib/krb5/krb5.conf.5: default value for
709 hdb-ldap-structural-object is account
710
7112004-05-26 Love Hörnquist Å
712strand <lha@it.su.se>
713
714 * tools/Makefile.am: use ! instead of , as sed delimiter
715
7162004-05-25 Love Hörnquist Å
717strand <lha@it.su.se>
718
719 * lib/krb5/*.c: add KRB5_LIB_FUNCTION to all exported functions
720
7212004-05-23 Love Hörnquist Å
722strand <lha@it.su.se>
723
724 * lib/hdb/hdb-ldap.c: make samba_forwardable a krb5_boolean
725
726 * lib/hdb/hdb-ldap.c: make samba forwarding a runtime configure
727 option
728
729 * lib/hdb/hdb-ldap.c (LDAP_message2entry): fix [] test From:
730 Andrew Bartlett <abartlet@samba.org>
731
732 * lib/hdb/hdb-ldap.c (LDAP_message2entry): remove bogus length
733 check From: Andrew Bartlett <abartlet@samba.org>
734
735 * lib/hdb/hdb-ldap.c (LDAP_message2entry): in the sambaNTPassword
736 case, make sure ent->etypes are allocated, From: Andrew Bartlett
737 <abartlet@samba.org>
738
7392004-05-14 Love Hörnquist Å
740strand <lha@it.su.se>
741
742 * kuser/kinit.c: move "setpag if (argc < 1)" to common path
743
7442004-05-12 Love Hörnquist Å
745strand <lha@it.su.se>
746
747 * lib/krb5/verify_krb5_conf.c: pacify pre c99 compilers
748
749 * fix-export: use right argument for -E
750
7512004-05-06 Johan Danielsson <joda@pdc.kth.se>
752
753 * kuser/kinit.c: print some diagnostics if the exec fails
754
7552004-04-29 Love Hörnquist Å
756strand <lha@it.su.se>
757
758 * lib/krb5/pkinit.c (pk_rd_pa_reply_dh): use krb5_random_to_key
759 From: Luke Howard <lukeh@padl.com>
760
761 * lib/krb5/rd_req.c (krb5_verify_ap_req2): clear the whole ticket,
762 not just a pointer size of it From: Luke Howard <lukeh@padl.com>
763
7642004-04-28 Love Hörnquist Å
765strand <lha@it.su.se>
766
767 * fix-export: add -E flag where needed to make-proto
768
7692004-04-26 Love Hörnquist Å
770strand <lha@it.su.se>
771
772 * lib/krb5/crypto.c: add set_param for RC2
773
774 * lib/krb5/pkinit.c: use krb5_oid_to_enctype and remove all oids
775 that are no longer needed
776
777 * kdc/pkinit.c: use krb5_enctype_to_oid
778
779 * lib/krb5/crypto.c (krb5_oid_to_enctype): make sure oid exists
780 before we compare with it
781
782 * lib/krb5/crypto.c (krb5_crypto_get_params): check ivec length
783 before returning it add aes-oids
784
785 * lib/krb5/crypto.c: add krb5_enctype_to_oid and
786 krb5_oid_to_enctype
787
788 * kdc/pkinit.c: use krb5_crypto_set_params
789
790 * lib/krb5/crypto.c: add krb5_crypto_set_params, add aes-NNN-cbc-none
791
792 * lib/krb5/krb5.h: add KEYTYPE_AES192
793
794 * lib/krb5/pkinit.c: use krb5_crypto_get_params to implement
795 kcrypto RC2 support
796
797 * lib/asn1/k5.asn1: add CMS symmetrical parameters here, enctype
798 rc2-cbc XXX RC2CBCParameter is wrong because the compiler is
799 broken
800
801 * lib/krb5/krb5.h: add KEYTYPE_RC2
802
803 * lib/krb5/crypto.c: add partial CMS parameter handling, this is
804 needed for RC2
805
806 * lib/asn1/der_cmp.c: add heim_oid_cmp and heim_octet_string_cmp
807
808 * lib/asn1/Makefile.am (libasn1_la_SOURCES) += der_cmp.c
809
810 * lib/asn1/der.h: add heim_oid_cmp and heim_octet_string_cmp
811
812 * lib/asn1/k5.asn1: add ETYPE_AESNNN_CBC_NONE
813
814 * lib/asn1/k5.asn1: add CMS symmetrical parameters here, enctype
815 rc2-cbc, XXX RC2CBCParameter is wrong because the compiler is broken
816
8172004-04-26 Johan Danielsson <joda@pdc.kth.se>
818
819 * lib/krb5/config_file.c: allow parsing directly from strings with
820 krb5_config_parse_string_multi
821
822 * lib/krb5/verify_krb5_conf.c: try to resolve hostnames
823
8242004-04-25 Johan Danielsson <joda@pdc.kth.se>
825
826 * lib/krb5/store_fd.c (krb5_storage_from_fd): dup the file
827 descriptor so we don't have to keep track of it in two places
828
829 * kuser/copy_cred_cache.c: krb5_cc_copy_cache_match now lives in
830 libkrb5
831
832 * lib/krb5/krb5_{,compare_}creds.3: move krb5_compare_creds to its
833 own manpage
834
835 * replace krb5_free_creds_contents by krb5_free_cred_contents
836
837 * lib/krb5/cache.c: add krb5_cc_next_cred_match() and
838 krb5_cc_copy_cred_match()
839
840 * lib/krb5/creds.c (krb5_compare_creds): add more matching options
841
842 * lib/krb5/krb5.h: add more creds match flags
843
844 * kuser/copy_cred_cache: add --valid-for option
845
846 * lib/krb5/store.c (krb5_store_creds): set is_skey flag if length
847 of second ticket is > 0
848
8492004-04-25 Love Hörnquist Å
850strand <lha@it.su.se>
851
852 * lib/krb5/pkinit.c: use the right oid for pkauthdata
853
854 * lib/krb5/pkinit.c: always send both win2k compat version and the
855 ietf draft one, this is possible since microsoft use
856 wrong/diffrent PA number. Make the configuration flag boolean
857 configuring if NOT to send the win2k compat glue.
858
859 * lib/krb5/krb5_encrypt.3: document krb5_{de,en}crypt_ivec
860
861 * kuser/copy_cred_cache.1: pacify mdoclint
862
863 * kdc/pkinit.c: use IV for envelopeddata encryption, patch
864 originally from Luke Howard <lukeh@padl.com>, tweeked by me.
865
866 * lib/krb5/krb5_storage.3: document
867 KRB5_STORAGE_CREDS_FLAGS_WRONG_BITORDER
868
869 * lib/krb5/krb5_data.3: document that krb5_data_free cleans the
870 structure too
871
872 * lib/krb5/pkinit.c: use IV for envelopeddata encryption, patch
873 originally from Luke Howard <lukeh@padl.com>, tweeked by me.
874
8752004-04-24 Johan Danielsson <joda@pdc.kth.se>
876
877 * kuser/copy_cred_cache.{c,1}: add cred cache copy tool
878
879 * configure.in: use rk_SYS_LARGEFILE
880
881 * lib/krb5/{krb5.h,store.c,fcache.c}: Fix the cache flags bitorder
882 issue with a storage flag instead of a separate function.
883
8842004-04-24 Love Hörnquist Å
885strand <lha@it.su.se>
886
887 * lib/krb5/pkinit.c: move out the oid check from get_reply_key
888
889 * lib/krb5/pkinit.c: uniquify error messages
890
891 * lib/krb5/init_creds_pw.c: make the pkinit nonce same os the
892 plain nonce for now
893
894 * lib/krb5/pkinit.c: more w2k compat from Luke Howard
895 <lukeh@padl.com> add RC2 support, clean up error messages
896
897 * lib/krb5/pkinit.c: remove more dependency on
898 krb5_config->pkinit_flags
899
900 * lib/krb5/pkinit.c (_krb5_pk_convert_rep): convert microsoft
901 style answer to IETF, From Luke Howard <lukeh@padl.com>
902 (_krb5_pk_create_sign): ms handles NULL in param, so always send it
903 (_krb5_pk_mk_padata): look for [realms]REALM = { win2k_pkinit = bool }
904
905 * lib/krb5/pkinit.c (_krb5_pk_create_sign): always set the
906 digestAlgorithm to sha1 (both for SignerInfo and SignedData, add
907 new function _set_digest_alg to set it
908
9092004-04-23 Love Hörnquist Å
910strand <lha@it.su.se>
911
912 * include/make_crypto.c: include rc2.h, and when I'm here, make
913 aes mandatory
914
915 * lib/krb5/krb5.h: add ENCTYPE_ARCFOUR_HMAC as compat glue for MIT
916 kerberos
917
918 * lib/krb5/crypto.c (krb5_crypto_init): clear return pointer on
919 failure
920
921 * lib/krb5/crypto.c (DES3_random_to_key): make it produce the
922 right result
923 (DES3_postproc): use DES3_random_to_key
924 (krb5_random_to_key): check the required number of bits (not the size
925 of the key)
926
927 * lib/krb5/aes-test.c: test random to key function
928
929 * lib/krb5/string-to-key-test.c: comment out the "@"/"" test for
930 now
931
9322004-04-22 Love Hörnquist Å
933strand <lha@it.su.se>
934
935 * lib/krb5/krb5_string_to_key.3: document that
936 krb5_string_to_key_derived is broken for non 3des enctypes and
937 thus deprecated
938
939 * kdc/pkinit.c (generate_dh_keyblock): use the new function
940 krb5_random_to_key
941
942 * lib/krb5/crypto.c: add des and DES3 random_to_key hooks, they
943 need special processing
944
945 * lib/krb5/crypto.c (krb5_random_to_key): new function
946
947 * lib/krb5/krb5_keyblock.3: document krb5_random_to_key
948
9492004-04-21 Love Hörnquist Å
950strand <lha@it.su.se>
951
952 * kdc/pkinit.c: use the first proposed enable enctype
953
954 * lib/krb5/context.c (krb5_set_default_in_tkt_etypes): use the
955 return from krb5_enctype_valid
956
957 * kdc/pkinit.c: at least try to handle diffrent enveloped enctypes
958
9592004-04-21 Love Hörnquist Å
960strand <lha@it.su.se>
961
962 * lib/asn1/der_get.c: 1.28.2.16: (der_get_oid): handle all oid
963 components being smaller then 127 and allocate one extra element
964 since first byte is split to to elements.
965
9662004-04-20 Love Hörnquist Å
967strand <lha@it.su.se>
968
969 * lib/asn1/k5.asn1: ETYPE_DIGEST_MD5_NONE, ETYPE_CRAM_MD5_NONE:
970 private use, lukeh@padl.com
971
9722004-04-19 Love Hörnquist Å
973strand <lha@it.su.se>
974
975 * lib/krb5/pkinit.c (build_auth_pack): use heim_integer to encode
976 DH public key
977
9782004-04-18 Love Hörnquist Å
979strand <lha@it.su.se>
980
981 * lib/krb5/krb5_init_context.3: add krb5_context to so its added
982 as manpage-link too
983
9842004-04-17 Love Hörnquist Å
985strand <lha@it.su.se>
986
987 * lib/krb5/fcache.c (fcc_remove_cred): simplistic implementation,
988 XXX add locking
989
990 * kuser/kdestroy.c: add --credential argument that just remove one
991 credential entry out of the cache specified
992
993 * kdc/pkinit.c: replace the krb5.conf configuration option that
994 describes the mapping between principals and subject names with a
995 file, default /var/heimdal/pki-mapping. XXX this should be pushed
996 into HDB. XXX should add issuer too
997
998 * kdc/config.c: merge certificate/private_key to a user_id
999
10002004-04-16 Love Hörnquist Å
1001strand <lha@it.su.se>
1002
1003 * kdc/kdc_locl.h: update prototype for pk_initialize
1004
1005 * kuser/kinit.c: merge certificate/private_key to a user_id
1006
1007 * kdc/pkinit.c: adapt to heim_integer changes
1008
1009 * lib/krb5/pkinit.c: merge certificate/private_key to a user_id
1010
1011 * kdc/pkinit.c: adapt to heim_integer changes,
1012 merge certificate/private_key to a user_id
1013
10142004-04-15 Love Hörnquist Å
1015strand <lha@it.su.se>
1016
1017 * lib/krb5/pkinit.c: use KRB5_PADATA_PK_AS_REQ_WIN free X509_STORE
1018
10192004-04-13 Love Hörnquist Å
1020strand <lha@it.su.se>
1021
1022 * lib/krb5/Makefile.am: define BUILD_KRB5_LIB when building
1023 libkrb5.la, add KRB5_LIB_FUNCTION proto
1024
1025 * lib/krb5/add_et_list.c: add KRB5_LIB_FUNCTION
1026
1027 * configure.in: export KRB5_LIB_FUNCTION when building with
1028 BUILD_KRB5_LIB
1029
1030 * lib/krb5/ticket.c (krb5_ticket_get_authorization_data_type): add
1031 error strings
1032
1033 * lib/krb5/prompter_posix.c (krb5_prompter_posix): if some thing
1034 is printed on stderr, fflush it
1035
1036 * lib/krb5/krb5_keyblock.3: free functions also zeros out the key
1037
1038 * lib/krb5/krb5_get_init_creds.3: some text about
1039 krb5_prompter_posix
1040
1041 * lib/krb5/krb5.conf.5: document hdb-ldap-structural-object
1042
1043 * lib/krb5/cache.c: add krb5_cc_get_prefix_ops
1044
1045 * lib/krb5/krb5_ccache.3: add krb5_cc_get_prefix_ops
1046
10472004-04-05 Love Hörnquist Å
1048strand <lha@it.su.se>
1049
1050 * appl/test/http_client.c: support GSS_C_DELEG_FLAG and
1051 GSS_C_MUTUAL_FLAG
1052
1053 * appl/test/http_client.c: verbose logging
1054
10552004-04-02 Love Hörnquist Å
1056strand <lha@it.su.se>
1057
1058 * kdc/connect.c: case size_t to unsigned long for LP64 platforms
1059
10602004-04-01 Love Hörnquist Å
1061strand <lha@it.su.se>
1062
1063 * lib/hdb/hdb-ldap.c (hdb_ldap_create): allow configuration of
1064 default structural object
1065
1066 * tools/Makefile.am: handle sed expression breaking
1067
10682004-03-31 Love Hörnquist Å
1069strand <lha@it.su.se>
1070
1071 * lib/krb5/krbhst.c: also lookup _kpasswd._tcp SRV-rr
1072
1073 * lib/krb5/changepw.c: add tcp support to the set protocol, should
1074 be cleaned up to enable sharing code with krb5_sendto
1075
1076 * kpasswd/kpasswd.c (change_password): remove extra free
1077
1078 * lib/krb5/krb5_acl_match_file.3: try to pacify mdoc macros on
1079 osf/1
1080
10812004-03-30 Love Hörnquist Å
1082strand <lha@it.su.se>
1083
1084 * lib/krb5/init_creds_pw.c (pa_data_add_pac_request): don't
1085 increase md->len, krb5_padata_add already does that
1086
1087 * lib/krb5/init_creds.c: its PAC not PAQ
1088
1089 * kuser/kinit.c: its PAC not PAQ
1090
1091 * kdc/kerberos4.c: stop the client from renewing tickets into the
1092 future From: Jeffrey Hutzelman <jhutz@cmu.edu>
1093
10942004-03-29 Love Hörnquist Å
1095strand <lha@it.su.se>
1096
1097 * configure.in: try to handle sys/strtty.h needing sys/stream.h
1098
10992004-03-23 Love Hörnquist Å
1100strand <lha@it.su.se>
1101
1102 * lib/krb5/send_to_kdc.c: remove function krb5_sendto_kdc2, its no
1103 longer used
1104
1105 * kdc/kerberos5.c: s/krb5_get_host_realm_int/_&/
1106
1107 * lib/krb5/get_host_realm.c: unexport krb5_get_host_realm_int to
1108 external users by prefixing it with _
1109
1110 * lib/krb5/get_cred.c: s/krb5_mk_req_internal/_&/
1111
1112 * lib/krb5/mk_req_ext.c: unexport krb5_mk_req_internal to external
1113 users by prefixing it with _
1114
11152004-03-22 Love Hörnquist Å
1116strand <lha@it.su.se>
1117
1118 * lib/krb5/pkinit.c: add missing }
1119
11202004-03-21 Love Hörnquist Å
1121strand <lha@it.su.se>
1122
1123 * kdc/pkinit.c: adapt to change of signature of
1124 _krb5_pk_load_openssl_id
1125
1126 * lib/krb5/pkinit.c: (krb5_get_init_creds_opt_set_pkinit): add
1127 prompter argument and use it
1128
1129 * kuser/kinit.c: adapt to signature change of
1130 krb5_get_init_creds_opt_set_pkinit
1131
1132 * lib/krb5/krb5.3: add more stuff, 105 functions to go
1133
1134 * lib/krb5/krb5_rcache.3: add krb5_get_server_rcache
1135
1136 * lib/krb5/krb5_rcache.3: framework for replay cache manpage
1137
1138 * lib/krb5/krb5_string_to_key.3: document string to key functions
1139
1140 * lib/krb5/Makefile.am: man_MANS += krb5_expand_hostname.3
1141 krb5_find_padata.3 krb5_generate_random_block.3
1142
1143 * lib/krb5/krb5_encrypt.3: document krb5_get_wrapped_length
1144
1145 * lib/krb5/krb5.3: add some more, 137 to go
1146
1147 * lib/krb5/krb5_principal.3: document krb5_get_default_principal
1148
1149 * lib/krb5/krb5_keyblock.3: document krb5_generate_subkey
1150
1151 * lib/krb5/krb5_generate_random_block.3: document
1152 krb5_generate_random_block
1153
1154 * lib/krb5/krb5_find_padata.3: document padata functions
1155
1156 * lib/krb5/krb5.3: add some more, 142 to go
1157
1158 * lib/krb5/krb5_creds.3: drop .Pp before .Sh
1159
1160 * lib/krb5/krb5_set_default_realm.3: document krb5_copy_host_realm
1161
1162 * lib/krb5/krb5_expand_hostname.3: document krb5_expand_hostname
1163 and krb5_expand_hostname_realms
1164
1165 * lib/krb5/krb5.3: add more functions, 147 to go
1166
1167 * lib/krb5/krb5_creds.3: document krb5_creds
1168
1169 * lib/krb5/krb5_get_init_creds.3: add more functions, some more
1170 text
1171
1172 * lib/krb5/krb5_ticket.3: document
1173 krb5_ticket_get_authorization_data_type
1174
11752004-03-20 Love Hörnquist Å
1176strand <lha@it.su.se>
1177
1178 * lib/krb5/aes-test.c: remove #if 0'ed code
1179
1180 * lib/krb5/krb5.3: add keyblock functions, 177 functions to go
1181
1182 * lib/krb5/krb5_verify_user.3: add krb5_verify_opt_set_ccache
1183
1184 * lib/krb5/krb5_encrypt.3: document krb5_decrypt_ticket
1185
1186 * lib/krb5/krb5_config.3: document krb5_config_free_strings and
1187 krb5_config_file_free
1188
1189 * lib/krb5/krb5_create_checksum.3: add krb5_hmac
1190
1191 * lib/krb5/krb5.3: add keyblock functions, 190 functions to go
1192
1193 * lib/krb5/krb5_keyblock.3: update .Dd
1194
1195 * lib/krb5/krb5_keyblock.3: document krb5_copy_keyblock and
1196 krb5_generate_random_keyblock
1197
1198 * lib/krb5/krb5_init_context.3: add krb5_init_ets
1199
1200 * lib/krb5/krb5_config.3: add more krb5_config_ functions and
1201 prototypes
1202
1203 * lib/krb5/krb5_init_context.3: document context modifcation
1204 functions: address list, config file, use admin kdc, fcc version
1205
1206 * lib/krb5/krb5_storage.3: document krb5_storage and related
1207 functions
1208
1209 * lib/krb5/Makefile.am: add acl and krb524_convert_creds_kdc
1210 manpages and test_acl test program
1211
1212 * lib/krb5/krb5.3: add error string functions and sort
1213
1214 * lib/krb5/krb5_warn.3: document krb5_abort and error string
1215 functions
1216
1217 * lib/krb5/krb5.3: add missing functions, only 285 left to
1218 document
1219
1220 * lib/krb5/krb5_crypto_init.3: remove various enctype related
1221 function
1222
1223 * lib/krb5/krb5_encrypt.3: add various enctype related function
1224 here
1225
1226 * lib/krb5/krb5_create_checksum.3: add krb5_cksumtype_valid
1227 krb5_cksumtype_valid
1228
1229 * lib/krb5/crypto.c: real return values for
1230 krb5_{enctype,cksumtype}_valid
1231
1232 * lib/krb5/krb5_create_checksum.3: add some functions and
1233 descriptions
1234
1235 * lib/krb5/krb5_c_make_checksum.3: move out non krb5_c functions
1236
1237 * lib/krb5/krb5_auth_context.3: document
1238 krb5_auth_con_generatelocalsubkey
1239
1240 * lib/krb5/krb5_krbhst_init.3: document krb5_krbhst_init_flags
1241
1242 * lib/krb5/krb5_keytab.3: document krb5_kt_default_modify_name
1243
1244 * lib/krb5/krb5_init_context.3: document krb5_add_et_list
1245
1246 * lib/krb5/krb524_convert_creds_kdc.3: document
1247 krb524_convert_creds_kdc, krb524_convert_creds_kdc_ccache
1248
1249 * lib/krb5/krb5_acl_match_file.3: document krb5_acl_match_*
1250
1251 * lib/krb5/test_acl.c: test for generic acl code
1252
1253 * lib/krb5/acl.c: plug memory leak on file matching,
1254 make it not fall over when no non matching acl,
1255 make fnmatch matching useful by switching arguments
1256
12572004-03-19 Love Hörnquist Å
1258strand <lha@it.su.se>
1259
1260 * kdc/config.c: add --builtin-hdb command
1261
1262 * lib/hdb/hdb.c (hdb_list_builtin): return a list of builtin
1263 backends
1264
1265 * doc/setup.texi: include Luke Howard of PADL.COM ldap hdb
1266 documentation
1267
1268 * doc/win2k.texi: fix bugs in examples, add more restrictions, use
1269 example.com as an example. From: Pavel Ferdan
1270 <xferdan@informatics.muni.cz>
1271
12722004-03-18 Johan Danielsson <joda@pdc.kth.se>
1273
1274 * lib/krb5/krb5.conf.5: add a bunch of Li and document [kadmin]
1275 password_lifetime; from Henry B. Hotz
1276
12772004-03-14 Love Hörnquist Å
1278strand <lha@it.su.se>
1279
1280 * lib/krb5/mk_rep.c (krb5_mk_rep): if KRB5_AUTH_CONTEXT_USE_SUBKEY
1281 is set send subkey
1282 (generate if needed)
1283
1284 * lib/krb5/krb5.h: add KRB5_AUTH_CONTEXT_USE_SUBKEY
1285
12862004-03-14 Love Hörnquist Å
1287strand <lha@it.su.se>
1288
1289 * lib/hdb/hdb-ldap.c: clean up error handling, plug memory leaks,
1290 and free memory in error path, assume realloc(NULL, ...) works,
1291 factor out common code, indent
1292
12932004-03-12 Love Hörnquist Å
1294strand <lha@it.su.se>
1295
1296 * lib/krb5/verify_krb5_conf.c: understand [password_quality]
1297 spelling
1298
1299 * kuser/kgetcred.1: document --canonicalize
1300
1301 * kuser/kgetcred.c: add --canonicalize
1302
13032004-03-10 Love Hörnquist Å
1304strand <lha@it.su.se>
1305
1306 * lib/krb5/fcache.c (fcc_store_cred): NULL terminate
1307 krb5_config_get_bool_default' arglist
1308
13092004-03-09 Love Hörnquist Å
1310strand <lha@it.su.se>
1311
1312 * kdc/kerberos5.c: add missing req argument to pk_mk_pa_reply
1313
1314 * kdc/pkinit.c (pk_mk_pa_reply): add hdb_entry
1315
1316 * kdc/pkinit.c: pass client hdb_entry to pk_check_client
1317
1318 * kdc/kdc_locl.h: pass client hdb_entry to pk_check_client
1319
1320 * kuser/kinit.c: rename ca_dir to pkinit/x509_anchors since its
1321 more like that language in RFC3280
1322
1323 * lib/krb5/pkinit.c: rename ca_dir to pkinit/x509_anchors since
1324 its more like that language in RFC3280
1325
1326 * lib/krb5/krb5.conf.5: document
1327 [libdefaults]fcc-mit-ticketflags=boolean
1328
1329 * lib/krb5/fcache.c (fcc_store_cred): use
1330 [libdefaults]fcc-mit-ticketflags=boolean to decide what format to
1331 write the fcc in. Default to mit version (aka heimdal 0.7)
1332
1333 * lib/krb5/store.c: add _krb5_store_creds_heimdal_0_7 and
1334 _krb5_store_creds_heimdal_pre_0_7 that store the creds in just
1335 that format make krb5_store_creds default to mit format
1336
1337 * lib/krb5/store.c (krb5_ret_creds): Runtime detect the what is
1338 the higher bits of the bitfield
1339
13402004-03-08 Love Hörnquist Å
1341strand <lha@it.su.se>
1342
1343 * lib/krb5/store.c (krb5_store_creds): add disabled code that
1344 store the ticket flags in reverse order
1345 (bitswap32): new function
1346
1347 * lib/krb5/store.c (krb5_ret_creds): if the higher ticket flags
1348 are set, its a mit cache, reverse the bits, bug pointed out by
1349 Sergio Gelato <Sergio.Gelato@astro.su.se>
1350
13512004-03-07 Love Hörnquist Å
1352strand <lha@it.su.se>
1353
1354 * lib/hdb/hdb-ldap.c: use macro for HDB * -> LDAP *
1355
1356 * kuser/kinit.c: when running kinit with a subprocess, fetch new
1357 tickets after half the tickets lifetime
1358
1359 * lib/hdb/hdb.c: spelling
1360
1361 * lib/hdb/hdb-ldap.c: Intergrate Heimdal's hdb-ldap and the Samba
1362 password database. From: Andrew Bartlett <abartlet@samba.org>
1363
1364 * kdc/config.c: add --disable-DES
1365
1366 * kdc/kdc.8: document --detach and --disable-DES
1367
1368 * kdc/kerberos5.c: check if enctype is disabled before using it
1369
1370 * lib/krb5/crypto.c: add support for disabling checksum/encryption
1371 types
1372
1373 * tools/kdc-log-analyze.pl: add more cases
1374
1375 * kdc/connect.c: on strange tcp error; log local port number and
1376 socket type
1377
1378 * lib/asn1/der.h: fix prototype of encode_utf8string
1379
1380 * lib/asn1/gen.c: catch CHOICE and generate dummy placeholder
1381
1382 * lib/asn1/lex.l: added dummy parsing of CHOICE
1383
1384 * lib/asn1/parse.y: added dummy parsing of CHOICE
1385
1386 * lib/asn1/k5.asn1: drop SMTP_NAME
1387
13882004-03-06 Love Hörnquist Å
1389strand <lha@it.su.se>
1390
1391 * lib/hdb/Makefile.am: support building ldap backend as module
1392 sort asn1 hdb files
1393
1394 * lib/hdb/hdb.c: when building ldap as a shared module, don't
1395 include it in the list
1396
1397 * configure.in: add --enable-hdb-openldap-module
1398
1399 * lib/hdb/hdb-ldap.c: make ldap possible to build as a shared
1400 module
1401
1402 * lib/hdb/mkey.c: add hdb_{,un}seal_key{,_mkey} from Andrew
1403 Bartlett <abartlet@samba.org>
1404
1405 * lib/krb5/crypto.c (decrypt_internal_special): do not not modify
1406 the original data test case from Ronnie Sahlberg
1407 <ronnie_sahlberg@ozemail.com.au>
1408
14092004-03-03 Love Hörnquist Å
1410strand <lha@it.su.se>
1411
1412 * lib/krb5/test_cc.c: more cc tests, mostly related to mcc
1413 behavior
1414
1415 * lib/krb5/mcache.c (mcc_get_principal): also check for
1416 primary_principal == NULL now that that isn't used as dead flag
1417
1418 * lib/krb5/mcache.c: don't overload the primary_principal == NULL
1419 as dead since that doesn't always work. Based on patch from
1420 Jeffrey Hutzelman <jhutz@cmu.edu>, tweeked by me
1421
14222004-02-22 Love Hörnquist Å
1423strand <lha@it.su.se>
1424
1425 * kdc/pkinit.c: adapt to rename of oid_cmp to heim_oid_cmp
1426
1427 * lib/krb5/pkinit.c: adapt to rename of oid_cmp to heim_oid_cmp
1428
1429 * lib/hdb/db3.c: fix all db >= 4.1 cases
1430
1431 * doc/setup.texi: add text about hostname to realm mapping using
1432 DNS
1433
14342004-02-20 Love Hörnquist Å
1435strand <lha@it.su.se>
1436
1437 * kdc/pkinit.c: update error codes
1438
1439 * lib/krb5/krb5_err.et: prefix pkinit error codes with KRB5_
1440
1441 * lib/krb5/pkinit.c: update error codes
1442
14432004-02-19 Love Hörnquist Å
1444strand <lha@it.su.se>
1445
1446 * lib/krb5/pkinit.c: indent, use krb5_abortx() instead of abort()
1447
1448 * lib/krb5/init_creds_pw.c (process_pa_data_to_key): spelling
1449
1450 * lib/krb5/store.c: handle memory allocate errors
1451
1452 * lib/krb5/fcache.c (_krb5_xlock): handle that everything was ok,
1453 and don't put an error in the error strings then
1454
14552004-02-13 Love Hörnquist Å
1456strand <lha@it.su.se>
1457
1458 * kdc/pkinit.c: s/heim_big_integer/heim_integer/
1459
1460 * lib/krb5/pkinit.c: s/heim_big_integer/heim_integer/
1461
1462 * kdc/pkinit.c: adapt to asn1 bignum code, use HEIM_PKINIT errors
1463
1464 * lib/krb5/pkinit.c: adapt to asn1 bignum code, use HEIM_PKINIT
1465 errors
1466
1467 * lib/krb5/heim_err.et: add HEIM_PKINIT specific errors
1468
14692004-02-12 Love Hörnquist Å
1470strand <lha@it.su.se>
1471
1472 * configure.in: rename AC_WFLAGS to rk_WFLAGS
1473
1474 * acinclude.m4: use m4_define, over-quote string
1475
14762004-02-11 Love Hörnquist Å
1477strand <lha@it.su.se>
1478
1479 * lib/krb5/init_creds_pw.c (change_password): handle that
1480 printf("%.*s", 0, (void*)NULL); doesn't work on solaris
1481
14822004-02-10 Love Hörnquist Å
1483strand <lha@it.su.se>
1484
1485 * kpasswd/kpasswd.c (change_password): handle that printf("%.*s",
1486 0, (void*)NULL); doesn't work on solaris
1487
1488 * lib/krb5/krb5.conf.5: don't use path's in first .Nm, it confuses
1489 some locate.updatedb, use FILES section to describe where the file
1490 is instead.
1491
14922004-02-07 Love Hörnquist Å
1493strand <lha@it.su.se>
1494
1495 * lib/asn1/check-der.c: test for "der_length.c: Fix len_unsigned
1496 for certain negative integers, it got the length wrong" , from
1497 Panasas, Inc.
1498
1499 * lib/asn1/der_length.c: Fix len_unsigned for certain negative
1500 integers, it got the length wrong, fix from Panasas, Inc.
1501
1502 rename len_int and len_unsigned to _heim_\&
1503
1504 * lib/asn1/der_locl.h: add _heim_len_unsigned, _heim_len_int
1505
15062004-02-06 Dave Love <d.love@dl.ac.uk>
1507
1508 * configure.in: Check for sys/socket.h, net/if.h. Modify term.h,
1509 security/pam_appl.h tests.
1510
15112004-02-03 Love Hörnquist Å
1512strand <lha@it.su.se>
1513
1514 * lib/asn1/check-gen.c: test for: (length_type): TSequenceOf: add
1515 up the size of all the elements, don't use just the size of the
1516 last element.
1517
1518 * lib/krb5/aes-test.c: add "next iv" test for aes128, check
1519 decryption case too
1520
1521 * lib/krb5/crypto.c (_krb5_aes_cts_encrypt): out iv is the iv of
1522 the next to last block, fix decryption case too
1523
1524 * lib/krb5/aes-test.c: add "next iv" test for aes128
1525
1526 * lib/krb5/crypto.c (_krb5_aes_cts_encrypt): out iv is the iv of
1527 the next to last block
1528
1529 * lib/krb5/mk_rep.c (krb5_mk_rep): abort on internal asn1 encode
1530 error
1531
1532 * lib/krb5/mk_rep.c (krb5_mk_rep): abort on internal asn1 encode
1533 error
1534
1535 * lib/krb5/get_in_tkt.c (krb5_get_in_cred): abort on internal asn1
1536 encode error
1537
1538 * lib/krb5/mk_priv.c (krb5_mk_priv): abort on internal asn1 encode
1539 error
1540
1541 * lib/krb5/get_cred.c (make_pa_tgs_req): abort on internal asn1
1542 encode error
1543
1544 * lib/krb5/build_auth.c (krb5_build_authenticator): abort on
1545 internal asn1 encode error
1546
1547 * lib/krb5/build_ap_req.c (krb5_build_ap_req): abort on internal
1548 asn1 encode error
1549
15502004-01-30 Love Hörnquist Å
1551strand <lha@it.su.se>
1552
1553 * doc/setup.texi: some text about order of [capaths] realms
1554
15552004-01-25 Love Hörnquist Å
1556strand <lha@it.su.se>
1557
1558 * lib/krb5/context.c: register WRFILE ops
1559
1560 * lib/krb5/keytab_file.c: add krb5_wrfkt_ops/WRFILE (same as FILE)
1561
1562 * lib/krb5/krb5.h: add krb5_wrfkt_ops
1563
1564 * kpasswd/kpasswdd.c (change): use the right password when
1565 changing the password
1566
15672004-01-21 Love Hörnquist Å
1568strand <lha@it.su.se>
1569
1570 * lib/krb5/fcache.c (_krb5_xlock): catch EINVAL and assume that it
1571 means that the filesystem doesn't support locking
1572
1573 * lib/krb5/keytab.c: remove #if 0 out file locking code
1574
15752004-01-19 Love Hörnquist Å
1576strand <lha@it.su.se>
1577
1578 * lib/asn1/gen_length.c (length_type): TSequenceOf: add up the
1579 size of all the elements, don't use just the size of the last
1580 element.
1581
15822004-01-13 Love Hörnquist Å
1583strand <lha@it.su.se>
1584
1585 * kuser/kinit.c (renew_validate): if renewable_flag and not time
1586 specifed, use "1 month"
1587
15882004-01-08 Love Hörnquist Å
1589strand <lha@it.su.se>
1590
1591 * lib/krb5/krb5_keyblock.3: add prototypes, describe
1592 krb5_keyblock_zero
1593
15942004-01-05 Love Hörnquist Å
1595strand <lha@it.su.se>
1596
1597 * lib/krb5/get_for_creds.c (add_addrs): don't add same address
1598 multiple times
1599
1600 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): try to
1601 handle errors better for previous commit
1602
1603 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): If tickets
1604 are address-less, forward address-less tickets.
1605
1606 * lib/krb5/get_cred.c: rename get_krbtgt to _krb5_get_krbtgt and
1607 export it
1608
Note: See TracBrowser for help on using the repository browser.