source: heimdal/trunk/ChangeLog.2005@ 3

Last change on this file since 3 was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 60.3 KB
Line 
12005-12-15 Love Hörnquist Å
2strand <lha@it.su.se>
3
4 * kdc/kerberos5.c (tgs_make_reply): less const on hdb_entry_ex to
5 make samba happy
6
7 * fix-export: Build kdc-private.h.
8
92005-12-14 Love Hörnquist Å
10strand <lha@it.su.se>
11
12 * kdc/kerberos5.c (tgs_rep2): also print the principal for which
13 the enctype was missing
14
152005-12-13 Love Hörnquist Å
16strand <lha@it.su.se>
17
18 * kdc/kaserver.c: Finish up transition from hdb_entry to
19 hdb_entry_ex.
20
21 * kdc/kerberos4.c: Finish up transition from hdb_entry to
22 hdb_entry_ex.
23
24 * kdc/524.c: Finish up transition from hdb_entry to hdb_entry_ex.
25
26 * kdc/kerberos5.c: Finish up transition from hdb_entry with
27 hdb_entry_ex.
28
29 * lib/krb5/cache.c (krb5_cc_set_default_name): use
30 KRB5_DEFAULT_CCNAME.
31
32 * lib/krb5/krb5_locl.h: Add KRB5_DEFAULT_CCNAME, pointer to
33 default credential cache.
34
35 * lib/hdb/ndbm.c: memset hdb_entry_ex before use
36
37 * lib/hdb/db3.c: memset hdb_entry_ex before use
38
39 * lib/hdb/db.c: memset hdb_entry_ex before use
40
412005-12-12 Love Hörnquist Å
42strand <lha@it.su.se>
43
44 * lib/krb5/krb5.3: Add some more entrypoints.
45
46 * lib/krb5/changepw.c: If there is a target principal, use the
47 realm of the realm to change the password with,
48
49 * kuser/kinit.c: Default to use DH when fetching keys.
50
51 * lib/hdb, kdc, kadmin/load.c: Wrap hdb_entry with hdb_entry_ex, patch
52 originally from Andrew Bartlet
53
54 * lib/hdb/hdb-ldap.c: Wrap hdb_entry with hdb_entry_ex, add url
55 support, add ldapi support.
56
57 * kdc/kerberos5.c (tgs_make_reply): there are no such things a
58 keytypes any more, just use enctypes.
59
60 * kdc/kdc_locl.h: Remove private prototypes and instead include
61 <kdc-private.h>.
62
63 * kdc/Makefile.am: Build kdc-private.h and depend on it.
64
65 * kdc/config.c (configure): wrap line
66
67 * doc/kerberos4.texi: KDC 4 support is always compiled in.
68
69 * TODO: Remove some stuff that have been done.
70
71 * Makefile.am: Split long line
72
73 * doc/apps.texi: Spelling, From MÃ¥ns Nilsson.
74
75 * doc/install.texi: spelling, From MÃ¥ns Nilsson
76
772005-12-11 Love Hörnquist Å
78strand <lha@it.su.se>
79
80 * lib/krb5/krb5_principal.3: Constify principal argument to on
81 krb5_principal_get_ functions.
82
83 * lib/krb5/principal.c: Constify principal argument to on
84 krb5_principal_get_ functions.
85
862005-12-08 Love Hörnquist Å
87strand <lha@it.su.se>
88
89 * lib/hdb: drop convert_db, 0.0 to 0.1 transition was a long long
90 time ago
91
922005-12-05 Love Hörnquist Å
93strand <lha@it.su.se>
94
95 * lib/krb5/test_keytab.c: more tests, From Andrew Bartlet
96
97 * lib/krb5/keytab_memory.c (mkt_remove_entry): realloc can return
98 NULL on success in the case 0 entries are allocated, From Andrew
99 Bartlet
100
1012005-12-02 Love Hörnquist Å
102strand <lha@it.su.se>
103
104 * lib/krb5/acl.c (acl_parse_format): tmp needs to be freed too on
105 failure to parse format specifier.
106
107 * lib/krb5/store-test.c: Free more of the allocated memory.
108
109 * lib/krb5/crypto.c (krb5_derive_key): Free more of the allocated
110 memory, this function is only used by the test program.
111
112 * lib/krb5/parse-name-test.c: Free more of the allocated memory.
113
114 * lib/krb5/derived-key-test.c: Free more of the allocated memory.
115
1162005-12-01 Love Hörnquist Å
117strand <lha@it.su.se>
118
119 * doc/setup.texi: spelling, From MÃ¥ns Nilsson
120
121 * lib/krb5/krb5_keytab.3: Memory keytab are now named and
122 refcounted.
123
124 * lib/krb5/test_keytab.c: Test that memory keytab are refcounted.
125
126 * lib/krb5/keytab_memory.c: Index by name and start reference
127 counting on entries.
128
1292005-11-30 Love Hörnquist Å
130strand <lha@it.su.se>
131
132 * lib/krb5/krb5.h (krb5_address_type): add
133 KRB5_ADDRESS_NETBIOS (20)
134
135 * lib/hdb/hdb.c (find_method): accept relative paths as old db
136 format too.
137
138 * lib/krb5/aes-test.c: Remove usage of krb5_enctype_to_keytype.
139
1402005-11-29 Dave Love <fx@gnu.org>
141
142 * kcm/connect.c (kcm_loop): Use HAVE_DOOR_CREATE, not HAVE_DOORS.
143
1442005-11-29 Love Hörnquist Å
145strand <lha@it.su.se>
146
147 * lib/krb5/verify_krb5_conf.c (libdefaults_entries): add
148 default_cc_name
149
150 * lib/hdb/hdb.c: Only match db databases on filename starting with
151 '/'.
152
153 * lib/krb5/rd_req.c (krb5_verify_ap_re2): check timestamp in
154 authenticator
155
156 * lib/krb5/rd_req.c (check_transited): explain the TR-type 0
157 better and why it matters.
158
159 * lib/krb5/test_cc.c: test krb5_cc_get_prefix_ops
160
161 * lib/krb5/cache.c (krb5_cc_get_prefix_ops): change the behavior
162 to return NULL when its not found, and fcc when the name starts
163 with a '/'. Almost matches behavior in other parts of the code,
164 but can't really do that since the name passed in to this function
165 may only contain the prefix itself without the colon.
166
167 * lib/krb5/cache.c (krb5_cc_get_prefix_ops): if there are not
168 colon (:) in the name, its a file credential cache
169
170 * lib/hdb/db3.c (hdb_db_create): use calloc to callocate memory
171
172 * lib/hdb/ndbm.c (hdb_ndbm_create): use calloc to allocate memory
173
174 * lib/hdb/db.c (hdb_db_create): use calloc to allocate memory
175
1762005-11-28 Love Hörnquist Å
177strand <lha@it.su.se>
178
179 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): use session
180 key for delegated credentials
181
182 * kdc/kerberos5.c (_kdc_as_rep): add comment when we send
183 ETYPE-INFO and ETYPE-INFO2, from Andrew Bartlett
184
1852005-11-25 Love Hörnquist Å
186strand <lha@it.su.se>
187
188 * lib/krb5/keytab.c (krb5_kt_get_full_name): new function
189
1902005-11-24 Love Hörnquist Å
191strand <lha@it.su.se>
192
193 * lib/krb5/test_crypto.c: Split encryption and s2k iterations to
194 diffrent counters, 38seconds of aes256 s2k is way too long.
195
196 * lib/krb5/test_crypto.c: Add timing code for s2k function.
197
1982005-11-07 Love Hörnquist Å
199strand <lha@it.su.se>
200
201 * kdc/kerberos5.c: Print the time the principal expired, based on
202 patch from Andrew Bartlett.
203
2042005-11-01 Love Hörnquist Å
205strand <lha@it.su.se>
206
207 * lib/krb5/cache.c (krb5_cc_get_full_name): Add
208
2092005-11-01 Love Hörnquist Å
210strand <lha@it.su.se>
211
212 * configure.in: Spelling, From Michael Banck <mbanck@debian.org>
213
2142005-10-30 Love Hörnquist Å
215strand <lha@it.su.se>
216
217 * kcm/headers.h: Maybe include <sys/param.h>.
218
2192005-10-27 Love Hörnquist Å
220strand <lha@it.su.se>
221
222 * lib/krb5/ticket.c (krb5_ticket_get_authorization_data_type):
223 understand KRB5_AUTHDATA_IF_RELEVANT and KRB5_AUTHDATA_AND_OR (but
224 have KRB5_AUTHDATA_KDC_ISSUED commented out for now)
225
2262005-10-26 Love Hörnquist Å
227strand <lha@it.su.se>
228
229 * kuser/klist.c: In the list caches view, rename the Status field
230 to Expires.
231
232 * lib/krb5/krb5_encrypt.3: Fix mdoc for
233 krb5_encrypt_EncryptedData, Johnny Lam <jlam@pkgsrc.org>
234
2352005-10-25 Love Hörnquist Å
236strand <lha@it.su.se>
237
238 * appl/test/gssapi_client.c: Check return value from asprintf
239 instead of string != NULL since it undefined behavior on
240 Linux. From Björn Sandell
241
2422005-10-21 Love Hörnquist Å
243strand <lha@it.su.se>
244
245 * lib/krb5/pkinit.c (_krb5_dh_group_ok): if not enough bits are
246 generated from the DH groups, fail.
247
248 * kdc/pkinit.c (get_dh_param): Pass down config so this function
249 can check pkinit_dh_min_bits
250
251 * kdc/config.c: Fill in pkinit_dh_min_bits from configuration
252 file.
253
254 * kdc/kdc.h: Add pkinit_dh_min_bits to krb5_kdc_configuration.
255
2562005-10-20 Love Hörnquist Å
257strand <lha@it.su.se>
258
259 * lib/krb5/pkinit.c: Add option to require binding between reply
260 and response for the win2k version of the protocol.
261
2622005-10-19 Love Hörnquist Å
263strand <lha@it.su.se>
264
265 * doc/programming.texi: Text about Kerberos errors.
266
267 * lib/krb5/pkinit.c: Try both ReplyKey and ReplyKey-Win2k for the
268 Windows case to support the updated -09 protocol (using
269 asChecksum). Tell KDC we support this by sending
270 KRB5-PADATA-PK-AS-09-BINDING in the pa-data.
271
272 * lib/krb5/test_cc.c: Test copy FILE -> FILE, and MEMORY -> MEMORY
273 too.
274
275 * lib/krb5/test_cc.c: Test krb5_cc_copy_cache and
276 krb5_cc_cache_match.
277
278 * lib/krb5/cache.c (krb5_cc_cache_match): add function that
279 iterates over all credential caches for a user and returns a
280 match.
281
282 * lib/krb5/krb5_ccache.3: Add krb5_cc_start_seq_get and an
283 example.
284
2852005-10-18 Love Hörnquist Å
286strand <lha@it.su.se>
287
288 * doc/programming.texi: Try to explain krb5_ccache, krb5_principal
289 and errors.
290
2912005-10-13 Love Hörnquist Å
292strand <lha@it.su.se>
293
294 * lib/krb5/krb5_get_credentials.3: Add example how to use
295 krb5_get_credentials.
296
2972005-10-12 Love Hörnquist Å
298strand <lha@it.su.se>
299
300 * lib/krb5/init_creds.c: Rename private to opt_private.
301
302 * lib/krb5/init_creds_pw.c: Rename private to opt_private.
303
304 * lib/krb5/pkinit.c: rename element private to opt_private to make
305 c++ picky compilers less upset.
306
307 * lib/krb5/krb5.h (krb5_get_init_creds_opt): rename element
308 private to opt_private to make c++ picky compilers less upset.
309
3102005-10-08 Love Hörnquist Å
311strand <lha@it.su.se>
312
313 * lib/krb5/krbhst.c (_krb5_krbhost_info_move): new function
314 (_krb5_free_krbhst_info): expose to internal use
315
316 * lib/krb5/init_creds_pw.c: Prepare to pass down a
317 krb5_krbhst_info into the pre-auth mechs
318
319 * lib/krb5/pkinit.c: Inline short functions, share more code,
320 rename COMPAT_27 to COMPAT_IETF, pass down a krb5_krbhst_info for
321 verification of KDC info, and general cleaning up.
322
3232005-10-07 Love Hörnquist Å
324strand <lha@it.su.se>
325
326 * lib/krb5/Makefile.am: Install krb5.moduli in sysconfdir.
327
328 * lib/krb5/krb5_locl.h: rename moduli file to SYSCONFDIR
329 "/krb5.moduli"
330
331 * lib/krb5/krb5_locl.h: Add forward declaration for
332 krb5_dh_moduli. Add define for MODULI_FILE.
333
334 * kdc/pkinit.c: Removing PK-INIT-19 support.
335
336 * lib/krb5/pkinit.c: Removing PK-INIT-19 support.
337
338 * lib/krb5/pkinit.c (_krb5_dh_group_ok): return DH group name on
339 success.
340 (krb5_get_init_creds_opt_set_pkinit): use moduli file if it exists
341
342 * kdc/pkinit.c: Save DH group name and print it on success.
343
344 * lib/krb5/pkinit.c (_krb5_dh_group_ok): if q is zero, ignore it.
345
346 * kdc/pkinit.c: Check dh group parameters from client.
347
348 * lib/krb5/krb5_err.et: Match error code with pk-init-27.
349
350 * lib/krb5/pkinit.c: Update error codes. Add name to group. Change
351 return value of _krb5_dh_group_ok.
352
353 * lib/krb5/pkinit.c: Add support for reading a moduli-file for DH
354 parameters.
355
3562005-10-06 Love Hörnquist Å
357strand <lha@it.su.se>
358
359 * kuser/klist.1: Document --list-caches
360
361 * kuser/klist.c: Change short flag of --list-caches to -l (-v is
362 already used).
363
3642005-10-03 Love Hörnquist Å
365strand <lha@it.su.se>
366
367 * lib/krb5/kerberos.8: RFC 1510 was obsoleted by 4120.
368
369 * lib/krb5/acache.c (init_ccapi): return kerberos errors, callers
370 expect it
371 (acc_get_cache_first): don't leak memory or abort on malloc
372 failure
373
3742005-10-02 Love Hörnquist Å
375strand <lha@it.su.se>
376
377 * lib/krb5/kerberos.8: Update text about Kerberos RFC's.
378
3792005-10-01 Love Hörnquist Å
380strand <lha@it.su.se>
381
382 * kuser/klist.c: Add option --list-caches that lists the avaible
383 caches and their status.
384
385 $ klist --list-caches
386 Principal Cache name Status
387 lha@E.KTH.SE 2 Valid
388 lha@SU.SE 1 Expired
389 lha/root@SU.SE 0 Expired
390 lha@N.L.NXS.SE Initial default ccache Expired
391
3922005-09-30 Love Hörnquist Å
393strand <lha@it.su.se>
394
395 * lib/krb5/keytab_keyfile.c: Use all DES keys, not just
396 des-cbc-md5, verify that they all are the same.
397
398 * lib/krb5/mcache.c Implement the cache iteration functions.
399
400 * lib/krb5/acache.c: Implement the cache iteration functions.
401
402 * lib/krb5/test_cc.c: Test the new cache iteration functions.
403
404 * lib/krb5/cache.c: Add cache iteration funcations. Add internal
405 allocation function for the memory of a krb5_ccache, and use it.
406
407 * lib/krb5/krb5.h (krb5_cc_ops): add cache iteration functions
408
4092005-09-25 Love Hörnquist Å
410strand <lha@it.su.se>
411
412 * lib/krb5/krb5_mk_req.3: Remove leftovers, remove extra space.
413
414 * kdc/kerberos5.c: More verbose PK-INIT logging.
415
416 * kdc/pkinit.c: The public DH key is encoded as an INTEGER in
417 subjectPublicKey. Don't verify OID's for now.
418
419 * lib/krb5/pkinit.c: Support cached DH variable (still need to
420 store it though), don't check the oid of the DH signedData for
421 now.
422
4232005-09-22 Love Hörnquist Å
424strand <lha@it.su.se>
425
426 * lib/krb5/rd_cred.c (krb5_rd_cred): try both the session key and
427 the sender subkey. Both RFC1510 and RFC4120 say that you have to
428 use the session key, Heimdal uses subkey.
429
4302005-09-21 Love Hörnquist Å
431strand <lha@it.su.se>
432
433 * lib/krb5/pkinit.c: Don't check oid's too closely, they change in
434 Windows Vista.
435
4362005-09-20 Love Hörnquist Å
437strand <lha@it.su.se>
438
439 * lib/krb5/pkinit.c: Disable sending -19, fix parsing -27 of the
440 protocol.
441
442 * kdc/pkinit.c: Support PK-INIT-27 DH (and remove -19)
443
444 * lib/krb5/pkinit.c (pk_verify_chain_standard): set cert to NULL
445 to make sure its not freed.
446
4472005-09-19 Love Hörnquist Å
448strand <lha@it.su.se>
449
450 * lib/krb5/crypto.c (krb5_DES_string_to_key): If the opaque length
451 it set to 1, and content is 0x01, use the afs3 string-to-key.
452
453 * kdc/kerberos5.c (make_etype_info2_entry): When its a afs3-salted
454 key, use send the opaque, length 1 (with content set to 0x01) in
455 ETYPE-INFO2-ENTRY.
456
457 * lib/krb5/kcm.c: Remove signedness warnings.
458
4592005-09-15 Love Hörnquist Å
460strand <lha@it.su.se>
461
462 * configure.in: Use libtool's default values for building
463 shared/static libaries, ie remove AC_ENABLE_SHARED(no), solves
464 building problems users have on Mac OS X.
465
4662005-09-08 Love Hörnquist Å
467strand <lha@it.su.se>
468
469 * lib/krb5/changepw.c: Constify password.
470
4712005-09-05 Love Hörnquist Å
472strand <lha@it.su.se>
473
474 * lib/krb5/krb5_mk_req.3: Document krb5_rd_req.
475
476 * lib/krb5/Makefile.am: MAN_mans+= krb5_mk_req.3
477
478 * lib/krb5/krb5_mk_req.3: Document krb5_mk_req, krb5_mk_req_exact,
479 krb5_mk_req_extended, krb5_rd_req, krb5_rd_req_with_keyblock,
480 krb5_mk_rep, krb5_mk_rep_exact, krb5_mk_rep_extended, krb5_rd_rep,
481 krb5_build_ap_req, krb5_verify_ap_req.
482
4832005-09-01 Love Hörnquist Å
484strand <lha@it.su.se>
485
486 * kdc/kerberos5.c (make_etype_info_entry): Dont send salttype at
487 all, use KRB5-PADATA-AFS3-SALT
488
4892005-08-31 Love Hörnquist Å
490strand <lha@it.su.se>
491
492 * kdc/kerberos5.c (log_timestamp): endtime, not endtype
493
4942005-08-30 Love Hörnquist Å
495strand <lha@it.su.se>
496
497 * configure.in: Check for <sys/ucred.h>.
498
499 * kcm/connect.c (update_client_creds): in case there is no
500 UCRED_VERSION, skip LOCAL_PEERCRED
501
502 * kcm/headers.h: include <sys/ucred.h>
503
5042005-08-27 Love Hörnquist Å
505strand <lha@it.su.se>
506
507 * lib/krb5/rd_req.c (check_transited): Allow empty content of type
508 0 because that is was Microsoft generates in their TGT.
509
510 * kdc/kerberos5.c (fix_transited_encoding): Allow empty content of
511 type 0 because that is was Microsoft enerates in their TGT.
512
5132005-08-26 Love Hörnquist Å
514strand <lha@it.su.se>
515
516 * doc/intro.texi: RFC 4120 replaces RFC 1510
517
5182005-08-25 Love Hörnquist Å
519strand <lha@it.su.se>
520
521 * configure.in: Add --disable-afs-support.
522
5232005-08-23 Love Hörnquist Å
524strand <lha@it.su.se>
525
526 * lib/krb5/Makefile.am: Add test_hostname to check_PROGRAMS but
527 not TESTS, I have no same dns to use.
528
529 * lib/krb5/test_hostname.c: Testprogram for krb5_expand_hostname()
530 and krb5_expand_hostname_realms().
531
532 * configure.in: Build KCM if we have doors or unix sockets.
533
534 * lib/krb5/principal.c (krb5_425_conv_principal_ex2): Remove
535 shadowing variable.
536
537 * lib/krb5/get_host_realm.c (dns_find_realm): Fix const warnings,
538 plug memory leak. From: Stefan Metzmacher <metze@samba.org>
539
540 * lib/krb5/krb5_config.3: Document what happens with NULL to
541 krb5_config_free_strings
542 (nothing). Mdoc nit.
543
5442005-08-22 Love Hörnquist Å
545strand <lha@it.su.se>
546
547 * kuser/klist.c (check_for_tgt): Re-order code so it only free the
548 credential if one was returned.
549
550 * lib/krb5/test_crypto_wrapping.c: Fix printing of size_t.
551
5522005-08-19 Love Hörnquist Å
553strand <lha@it.su.se>
554
555 * lib/hdb/dbinfo.c: provide interface to find databases
556
557 * lib/hdb/mkey.c: hdb_seal_key_mkey): dont double encrypt keys
558
5592005-08-15 Love Hörnquist Å
560strand <lha@it.su.se>
561
562 * kdc/kdc_locl.h: Update prototype for _kdc_pk_mk_pa_reply.
563
5642005-08-13 Love Hörnquist Å
565strand <lha@it.su.se>
566
567 * lib/krb5/init_creds_pw.c: Save the request buffer so that
568 pre-auth mechanism that needs it can verify the reply.
569
5702005-08-12 Love Hörnquist Å
571strand <lha@it.su.se>
572
573 * lib/krb5/test_mem.c: Rename logf to avoid shadowing.
574
575 * lib/krb5/krb5_keytab.3: Fix the version number for
576 fcc-mit-ticketflags.
577
578 * lib/krb5/fcache.c: Revert previous, I was confused.
579
580 * lib/krb5/krb5_keytab.3: Document fcc-mit-ticketflags in
581 COMPATIBILITY section.
582
583 * lib/krb5/fcache.c (fcc_store_cred): default to MIT style ticket
584 flags.
585
586 * kdc/pkinit.c (pk_mk_pa_reply_enckey): add missing break;
587
588 * lib/krb5/krb5_create_checksum.3: Update prototype for
589 krb5_create_checksum.
590
591 * kdc/pkinit.c: Make compile.
592
593 * lib/krb5/pkinit.c: Implement verification of asChecksum, now
594 client side code is using -27 of the pk-init draft.
595
596 * kdc/kdc_locl.h: update prototype for _kdc_as_rep
597
598 * kdc/pkinit.c: Fill in asChecksum, we now implements -27 in the KDC.
599
600 * kdc/process.c: Pass down the request buffer to _kdc_as_rep().
601
602 * kdc/kerberos5.c (_kdc_as_rep): Pass down the request buffer to
603 _kdc_pk_mk_pa_reply.
604
6052005-08-11 Love Hörnquist Å
606strand <lha@it.su.se>
607
608 * lib/hdb/ext.c: HDB extensions access glue.
609
610 * kcm/acquire.c: Use krb5_set_password instead of
611 krb5_change_password.
612
613 * configure.in: Add tests/Makefile and tests/db/Makefile.
614
615 * NEWS: New ASN.1 compiler
616
617 * lib/hdb/Makefile.am: Build extensions.
618
619 * lib/hdb/print.c: Print extensions.
620
621 * lib/hdb/hdb_err.et: Add error "Entry contains unknown mandatory
622 extension".
623
624 * lib/hdb/hdb.h: Update interface version (and indent).
625
626 * lib/hdb/hdb.asn1: Add support for HDB-extension.
627
6282005-08-10 Love Hörnquist Å
629strand <lha@it.su.se>
630
631 * lib/krb5/test_pkinit_dh2key.c: add tests vectors from
632 "Liqiang(Larry) Zhu" <lzhu@windows.microsoft.com>
633
634 * lib/hdb/mkey.c: Expose the crypto operations on the master key.
635
636 * lib/krb5/test_pkinit_dh2key.c: even more bits, not done yet
637
6382005-08-09 Love Hörnquist Å
639strand <lha@it.su.se>
640
641 * kdc/kerberos5.c (_kdc_as_rep): preserve the error code in the
642 ENC-TS case. From: Andrew Bartlett <abartlet@samba.org>
643
644 * kdc/kerberos5.c (tgs_rep2): only needs to log "Failed to verify
645 authenticator" once, its already done by
646 tgs_check_authenticator().
647
648 * kdc/kerberos5.c: Indent strings.
649
650 * kdc/kerberos5.c (log_timestamp): avoid shadow warnings From:
651 Andrew Bartlett <abartlet@samba.org>
652
653 * lib/krb5/verify_user.c: Add krb5_verify_opt_alloc and
654 krb5_verify_opt_free.
655
656 * lib/krb5/krb5_verify_user.3: Document krb5_verify_opt_alloc and
657 krb5_verify_opt_free.
658
659 * lib/hdb/db3.c (DB_open): catch errors from the d->open calls
660 instead of letting them slip though to d->cursor. Bug repport from
661 Andrew Bartlett <abartlet@samba.org>
662
6632005-07-29 Love Hörnquist Å
664strand <lha@it.su.se>
665
666 * kdc/Makefile.am (kdc_LDADD): add LDADD
667
6682005-07-28 Love Hörnquist Å
669strand <lha@it.su.se>
670
671 * kdc/kerberos5.c (_kdc_as_rep): log what enctypes was using in
672 ENC-TS preauth, both for failure and success.
673
674 * kdc/hprop.c: Use the _krb5_krb_life_to_time function from
675 libkrb5 instead of including our own here too.
676
677 * kdc/kerberos5.c: indent printf strings
678
679 * lib/hdb/mkey.c (hdb_unseal_key_mkey): try to unseal key with
680 keyusage 0 in case the key was encrypted with MIT Kerberos (old
681 patch from Johan)
682
6832005-07-26 Love Hörnquist Å
684strand <lha@it.su.se>
685
686 * kdc/pkinit.c: update to pkinit-27
687
6882005-07-23 Love Hörnquist Å
689strand <lha@it.su.se>
690
691 * lib/krb5/pkinit.c: Adapt to IMPLICIT changes in CMS module.
692
6932005-07-20 Love Hörnquist Å
694strand <lha@it.su.se>
695
696 * lib/krb5/test_pkinit_dh2key.c: framework for testing
697 _krb5_pk_octetstring2key
698
699 * kpasswd/kpasswdd.c (doit): krb5_addr2sockaddr takes a
700 krb5_socklen_t
701
702 * kdc/connect.c (de_http): sscanf takes a char *, not unsigned
703 ditto, cast approriately
704
705 * lib/krb5/crypto.c (_krb5_pk_octetstring2key): make sha1 output
706 unsigned char to match openssl
707
7082005-07-14 Love Hörnquist Å
709strand <lha@it.su.se>
710
711 * lib/hdb/common.c: Check encoder lengths from ASN1_MALLOC_ENCODE.
712
7132005-07-13 Love Hörnquist Å
714strand <lha@it.su.se>
715
716 * lib/krb5/rd_cred.c (krb5_rd_cred): don't leak memory
717
718 * lib/krb5/get_cred.c (krb5_get_credentials_with_flags): only call
719 krb5_cc_retrieve_cred once, and plug memory leak.
720
7212005-07-13 Love Hörnquist Å
722strand <lha@it.su.se>
723
724 * lib/hdb/Makefile.am: the new asn.1 compiler includes the modules
725 name in the depend file
726
727 * lib/krb5/keytab_file.c (fkt_start_seq_get_int): check return
728 value from krb5_storage_from_fd
729
730 * lib/krb5/pkinit.c (pk_rd_pa_reply_dh): client do not contribute
731 to the DH when the server doesn't support the cached DH request.
732
733 * lib/krb5/crypto.c (_krb5_pk_octetstring2key): fix arguments
734
7352005-07-12 Love Hörnquist Å
736strand <lha@it.su.se>
737
738 * lib/krb5/pkinit.c: clean up pk-init DH support, not finished
739 yet; improve error reporting
740
741 * lib/krb5/crypto.c (_krb5_pk_octetstring2key): string2key
742 function used in pk-init-25
743
744 * configure.in: Use a configure switch to turn on PK-INIT, not by
745 detecting existence of the new ASN.1 library.
746
747 * lib/asn1: Much improved ASN.1 compiler from joda-choice-branch.
748
749 Highlighs for the compiler is support for CHOICE and in general better
750 support for tags. This compiler support most of what is needed for
751 PK-INIT, LDAP, X.509, PKCS-12 and many other protocols.
752
7532005-07-10 Love Hörnquist Å
754strand <lha@it.su.se>
755
756 * lib/asn1: make scope variables unique to avoid shadow warnings
757
7582005-07-09 Love Hörnquist Å
759strand <lha@it.su.se>
760
761 * lib/krb5/krb5.h: comment out paramenter name in typedef
762 functions to avoid shadow warnings
763
764 * lib/krb5/crypto.c: make input data to krb5_encrypt{,_ivec} const
765
766 * kuser/klist.c: If there are no addresses, print addressless
767 instead of nothing.
768
769 * lib/krb5/Makefile.am (TESTS): add test_crypto_wrapping
770
771 * lib/krb5/crypto.c (wrapped_length): the underived encrypted
772 types checksum are all unkeyed (matches the code in
773 encrypt_internal() and encrypt_internal_special())
774
775 * lib/krb5/test_crypto_wrapping.c: ETYPE_ARCFOUR_HMAC_MD5_56 isn't
776 not supported
777
778 * lib/krb5/test_crypto_wrapping.c: test encryption wrapping
779
780 * lib/krb5/test_crypto.c (time_encryption): free cleartext buffer
781
7822005-07-08 Love Hörnquist Å
783strand <lha@it.su.se>
784
785 * configure.in: run AM_INIT_AUTOMAKE before AM_PROG_CC_C_O
786 otherwise am_aux_dir will be expanded using ac_aux_dir before the
787 later is set.
788
789 * configure.in: check for strings.h explicitly instead of
790 depending on AC_HEADER_STDC to check it for us
791
7922005-07-07 Assar Westerlund <assar@kth.se>
793
794 * configure.in: add AM_PROG_CC_C_O for automake 1.9
795
7962005-07-06 Love Hörnquist Å
797strand <lha@it.su.se>
798
799 * lib/krb5/keytab.c (krb5_kt_get_entry): clear error string when
800 returning a new error
801
802 * lib/krb5/keytab.c: krb5_kt_close frees all resources, even on
803 error.
804
805 * lib/krb5/verify_init.c (krb5_verify_init_creds): `entry' unused,
806 remove From: "Henry B. Hotz" <hotz@jpl.nasa.gov>
807
8082005-07-05 Love Hörnquist Å
809strand <lha@it.su.se>
810
811 * doc/win2k.texi: arcfour-hmac-md5 support for windows cross was
812 added in w2k3-sp1 From David Love
813
814 * doc/setup.texi: document kadmin command password-quality instead
815 of the not installed test_pw_quality
816
817 * lib/krb5/krb5_get_init_creds.3: Spelling, from David Love
818
819 * fix-export: build kdc-protos.h
820
8212005-07-01 Love Hörnquist Å
822strand <lha@it.su.se>
823
824 * kdc: prefix pkinit symbols with _kdc
825
826 * kuser/kinit.c: avoid shadowing variables
827
828 * kuser: s/optind/optidx/
829
830 * kdc: adapt pkinit code to libkdc split
831
8322005-06-30 Love Hörnquist Å
833strand <lha@it.su.se>
834
835 * tools/Makefile.am: add depency on LIB_dlopen and LIB_door_create
836
837 * tools/krb5-config.in: add depency on LIB_dlopen and LIB_door_create
838
839 * kdc/kdc_locl.h: indent, remove dup prototypes
840
841 * kdc/libkdc: don't pollute namespace, generate public headerfile
842
843 * lib/krb5/principal.c: add krb5_425_conv_principal_ext2 that work
844 just like krb5_425_conv_principal_ext but takes a context variable
845 for the verification function
846
847 * kdc/Makefile.am: there is no export script, not pretend there is
848
849 * kdc: Merge in the libkdc/kdc configuration split from Andrew
850 Bartlet <abartlet@samba.org>
851
852 * lib/krb5/crypto.c: optionally compile in support for afs string2key
853
854 * configure.in: add --disable-afs-string-to-key to allow removal
855 of support for afs string2key (and dependency on crypt)
856
8572005-06-29 Love Hörnquist Å
858strand <lha@it.su.se>
859
860 * kdc/kerberos5.c: Add logging of all timestamps in AS-REQ and
861 TGS-REQ, for auditing
862
863 * kdc/kerberos5.c (as_req): print the supported encryption types
864 so its possible to know what clients to update.
865 (find_rpath): return const char * and update callers.
866
8672005-06-28 Luke Howard <lukeh@padl.com>
868
869 * kcm/connect.c: fix arguments to kcm_log() when reporting
870 sendmsg() error
871
872 * kcm/connect.c: don't send socket address in msghdr, it
873 returns an already connected error on Linux
874
8752005-06-24 Love Hörnquist Å
876strand <lha@it.su.se>
877
878 * kdc/524.c: Always include <krb5-v4compat.h>.
879
8802005-06-23 Love Hörnquist Å
881strand <lha@it.su.se>
882
883 * doc/intro.texi: no more libdes, gssapi lib is complete
884
885 * lib/krb5/krb5.conf.5: Documentation for password quality
886 control. From: "James F. Hranicky" <jfh@cise.ufl.edu>
887
888 * lib/krb5/verify_krb5_conf.c (password_quality_entries): add
889 min_length and min_classes
890
891 * kdc/kaserver.c: log the kaserver requests, avoid shadowing
892 variables
893
894 * lib/hdb/db3.c (DB_open): in case of error, close database
895
896 * lib/hdb/ndbm.c (NDBM_open): in case of error, close database
897
898 * lib/hdb/db.c (DB_open): in case of error, close database
899
9002005-06-20 Love Hörnquist Å
901strand <lha@it.su.se>
902
903 * kcm/kcm.8: fix example
904
9052005-06-17 Love Hörnquist Å
906strand <lha@it.su.se>
907
908 * lib/krb5/rd_rep.c: indent
909
910 * lib/krb5/rd_rep.c (krb5_rd_rep): check if
911 KRB5_AUTH_CONTEXT_DO_TIME set and use that as a que that timestamp
912 should be checked, DCE-STYLE gssapi needs to be able to tweek this
913
914 * kdc/string2key.c: rename optind to optidx
915
916 * lib/hdb/convert_db.c: rename optind to optidx
917
918 * lib/hdb/keytab.c: const poison, add a unconst where needed
919
920 * lib/krb5/crypto.c (krb5_string_to_key): unconst password
921
922 * lib/asn1/k5.asn1: rename pvno to krb5-pvno
923
924 * lib/krb5/get_in_tkt_with_keytab.c (krb5_keytab_key_proc):
925 unconst argument
926
927 * lib/krb5/verify_krb5_conf.c: rename optind to optidx
928
929 * lib/krb5/transited.c: rename the temporary string variable to
930 `str'
931
932 * lib/krb5/test_crypto.c: rename optind to optidx
933
934 * lib/krb5/test_alname.c: rename optind to optidx
935
936 * lib/krb5/store.c: unconst argument to krb5_store (XXX this
937 should be fixed, krb5_store doesn't need to modify its argument)
938
939 * lib/krb5/send_to_kdc.c (krb5_sendto): remove shadowing
940 unnessecery variable ret
941
942 * lib/krb5/rd_cred.c (krb5_rd_cred): remove shadowing unnessecery
943 variable len
944
945 * lib/krb5/prog_setup.c: rename optind to optidx
946
947 * lib/krb5/padata.c: rename variable index to idx
948
949 * lib/krb5/log.c: rename variable time to timestr to avoid
950 shadowing
951
952 * lib/krb5/krbhst.c (krb5_krbhst_init_flags): rename variable to
953 avoid shadowing
954
955 * lib/krb5/krbhst-test.c: rename optind to optidx
956
957 * lib/krb5/kcm.c: unconst argumen to connect, unconst argument to
958 krb5_store (XXX this should be fixed, krb5_store doesn't need to
959 modify its argument)
960
961 * lib/krb5/init_creds_pw.c (default_s2k_func): unconst password
962
963 * lib/krb5/crypto.c: rename `encrypt' to avoid shadow warning
964
9652005-06-16 Love Hörnquist Å
966strand <lha@it.su.se>
967
968 * lib/krb5/principal.c: rename index to idx
969
970 * lib/krb5/mk_error.c: use rk_UNCONST
971
972 * lib/krb5/fcache.c: rename to avoid shadowing
973
974 * lib/krb5/config_file.c: rename to avoid shadowing
975
976 * lib/krb5/cache.c (_krb5_expand_default_cc_name): just copy the
977 string instead of losing const
978
979 * lib/krb5/addr_families.c: use rk_UNCONST to silence const
980 warning
981
982 * lib/krb5/addr_families.c: rename sin to sin4
983
984 * lib/asn1/asn1_print.c: rename optind to optidx, remove shadowed
985 variables
986
987 * lib/asn1/main.c: rename optind to optidx
988
989 * lib/asn1/gen_copy.c: rename to avoid shadowing
990
991 * lib/asn1/gen_locl.h: rename function filename to get_filename
992
993 * lib/asn1/lex.l: use get_filename
994
995 * lib/asn1/gen.c: rename function filename to get_filename
996
997 * lib/krb5/acache.c: use HAVE_DLOPEN around cc_handle
998
999 * configure.in: add headers and prototypes to logwtmp, logout and
1000 openpty checks
1001
1002 * configure.in: include headerfiles and set prototype for tgetent
1003
1004 * kdc/kerberos5.c (make_etype_info2_entry): NUL terminate the
1005 string
1006
1007 * kdc/kerberos5.c: replace strndup with inline copy, free data on
1008 failure
1009
1010 * lib/krb5/cache.c (_krb5_expand_default_cc_name): replace strndup
1011 with inline copy
1012
1013 * lib/krb5/log.c: rename close and log to avoid shadow warnings
1014
1015 * lib/krb5/get_in_tkt.c: rename index to i to avoid shadowing
1016
1017 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): rename two
1018 of the local `realm' to srealm to avoid shadowing
1019
1020 * kdc/kerberos5.c (tgs_rep2): rename one of the tkey to uukey to
1021 avoid shadow warning
1022
1023 * kdc/kerberos5.c (tgs_rep2): rename loop to nloop to avoid shadow
1024 warning
1025
10262005-06-15 Love Hörnquist Å
1027strand <lha@it.su.se>
1028
1029 * Release 0.7, see branch
1030
10312005-06-14 Love Hörnquist Å
1032strand <lha@it.su.se>
1033
1034 * lib/krb5/Makefile.am: TESTS += test_mem libkrb5_la_SOURCES +=
1035 kcm.h
1036
1037 * kuser/kinit.c (main): catch KRB5_CONFIG_BADFORMAT from
1038 krb5_init_context
1039
1040 * kdc/main.c (main): catch KRB5_CONFIG_BADFORMAT from
1041 krb5_init_context
1042
1043 * lib/krb5/verify_krb5_conf.c (main): catch KRB5_CONFIG_BADFORMAT
1044 from krb5_init_context From: Mathias Feiler
1045 <feiler@uni-hohenheim.de>
1046
1047 * lib/krb5/verify_krb5_conf.c: Add more missig entires, from
1048 Mathias Feiler <feiler@uni-hohenheim.de>
1049
10502005-06-11 Love Hörnquist Å
1051strand <lha@it.su.se>
1052
1053 * kdc/pkinit.c (pk_principal_from_X509): remember to free
1054 KRB5PrincipalName
1055
1056 * lib/krb5/log.c (krb5_closelog): free all content in
1057 krb5_log_facility
1058
10592005-06-08 Love Hörnquist Å
1060strand <lha@it.su.se>
1061
1062 * kdc/524.c: init kvno to please gcc
1063
1064 * kdc/kaserver.c (do_authenticate): check return value from
1065 unparse_auth_args
1066
10672005-06-07 Dave Love <fx@gnu.org>
1068
1069 * doc/setup.texi: Spelling.
1070
1071 * doc/programming.texi: Spelling.
1072
10732005-06-02 Dave Love <fx@gnu.org>
1074
1075 * kcm/connect.c (kcm_door_server): Make static.
1076
1077 * kcm/kcm_locl.h (disallow_getting_krbtgt): Declare.
1078
10792005-06-02 Love Hörnquist Å
1080strand <lha@it.su.se>
1081
1082 * kdc/mit_dump.c (mit_prop_dump): cast argument to
1083 krb5_parse_principal to avoid warning
1084
1085 * kdc/mit_dump.c: rename KRB5_TL_MOD_PRINC to
1086 mit_KRB5_TL_MOD_PRINC to hint its a constant originating from mit
1087 codebase
1088
10892005-06-01 Love Hörnquist Å
1090strand <lha@it.su.se>
1091
1092 * lib/krb5/store.c: If we are allocating 0 entires, avoid failing
1093 if ALLOC returns NULL
1094
1095 * lib/krb5/verify_krb5_conf.c: Check for [kdc]v4-realm
1096
1097 * lib/krb5/cache.c: When returning a new error code, set error
1098 string.
1099
11002005-05-31 Love Hörnquist Å
1101strand <lha@it.su.se>
1102
1103 * lib/krb5/keytab_file.c: Adapt to changed signature of
1104 _krb5_xunlock, clear more error string where needed.
1105
1106 * lib/krb5/fcache.c (_krb5_xunlock): catch the error and turn it
1107 into something sensable
1108
11092005-05-30 Love Hörnquist Å
1110strand <lha@it.su.se>
1111
1112 * kdc/kerberos5.c (tgs_make_reply): copy ok-as-delegate flag from
1113 server entry to encrypted ticket flags
1114
11152005-05-30 Johan Danielsson <joda@pdc.kth.se>
1116
1117 * kdc/connect.c: rename sendlength to prependlength (which
1118 hopefully better represents its purpose), and change type to
1119 krb5_boolean
1120
1121 * kdc/connect.c: log signal causing exit
1122
1123 * kdc/main.c (sigterm): set exit_flag to signal causing exit;
1124 (main): trap SIGXCPU
1125
11262005-05-30 Love Hörnquist Å
1127strand <lha@it.su.se>
1128
1129 * kcm/kcm.8: document --disallow-getting-krbtgt and --door-path
1130
1131 * kcm/protocol.c (kcm_op_retrieve): check server for krbtgt, not
1132 client
1133
1134 * kcm/main.c: ignore SIGPIPE
1135
1136 * kcm/protocol.c: Add option to disallow getting krbtgt out from
1137 from KCM. KCM will do the fetching part itself.
1138
1139 * kcm/config.c: Add option to disallow getting krbtgt out from
1140 from KCM. KCM will do the fetching part itself.
1141
11422005-05-30 Luke Howard <lukeh@padl.com>
1143
1144 * kcm/events.c: if credentials have expired when attempting
1145 to renew, attempt to reacquire them using initial creds
1146
11472005-05-29 Love Hörnquist Å
1148strand <lha@it.su.se>
1149
1150 * lib/krb5/krb5_principal.3: Spelling, from Björn Sandell
1151
1152 * doc/setup.texi: spelling, from Björn Sandell
1153
1154 * lib/krb5/name-45-test.c: XXX don't run the test unless the
1155 machine is in kth.se or su.se because it depends on local resolver
1156 configuration.
1157
1158 * lib/hdb/hdb.c: provde RTLD_NOW and RTLD_GLOBAL if they don't
1159 exists
1160
1161 * kcm/connect.c: fix doors support, fix signedness warnings
1162
1163 * kcm/config.c: add --door-path=
1164
1165 * configure.in: comment what the "detect doors on solaris"
1166 fragment tries to do
1167
1168 * kcm/acquire.c (generate_random_pw): fix signed-ness warnings
1169
1170 * kcm/connect.c (update_client_creds): fix compile error in the
1171 getpeerucred case
1172
1173 * lib/krb5/test_cc.c: change format for expantion variables in
1174 default_cc_name to %{variable} to not confuse them with shell
1175 ditto
1176
1177 * kcm/headers.h: Maybe include <door.h>.
1178
1179 * kcm/kcm_locl.h: add extern door_path;
1180
1181 * configure.in: detect doors using door_create
1182
1183 * kcm/Makefile.am: add dependcy on kcm_protos.h add lib depency on
1184 LIB_door_create
1185
1186 * lib/krb5/kcm.h: add _PATH_KCM_DOOR, default path to kcm door
1187
1188 * lib/krb5/kcm.c: use [libdefaults]kcm_door to find the door to
1189 kcm
1190
1191 * lib/krb5/Makefile.am: libkrb5_la_LIBADD += LIB_door_create
1192
1193 * lib/krb5/krb5_locl.h: Maybe include <sys/mman.h>, maybe include
1194 <door.h>.
1195
1196 * lib/krb5/kcm.c (kcm_send_request): add support for doing a door
1197 call to kcm
1198
1199 * lib/asn1: prefix Der_class with ASN1_C_ to avoid problems with
1200 system headerfiles that pollute the name space
1201
1202 * kcm/kcm.8: change format for expantion variables in
1203 default_cc_name to %{variable} to not confuse them with shell
1204 ditto
1205
1206 * lib/krb5/krb5.conf.5: change format for expantion variables in
1207 default_cc_name to %{variable} to not confuse them with shell
1208 ditto
1209
1210 * lib/krb5/cache.c (_krb5_expand_default_cc_name): change format
1211 for expantion variables to %{variable} to not confuse them with
1212 shell ditto
1213
1214 * kcm/connect.c: add LOCAL_PEERCRED and experimental doors support
1215
12162005-05-27 Love Hörnquist Å
1217strand <lha@it.su.se>
1218
1219 * appl/kf/kfd.c: case uid_t to unsigned long in printf format
1220
12212005-05-25 Love Hörnquist Å
1222strand <lha@it.su.se>
1223
1224 * lib/krb5/krb5_auth_context.3: remove trailing space
1225
12262005-05-24 Love Hörnquist Å
1227strand <lha@it.su.se>
1228
1229 * kcm/connect.c (do_request): use sendmsg to send the reply
1230
1231 * fix-export: add make_proto for kcm/kcm_protos.h
1232
1233 * kcm/kcm_locl.h: remove prototypes and add <kcm_protos.h>
1234
1235 * kcm/Makefile.am (kcm_SOURCES): add headerfiles
1236 (kcm_protos.h): generate prototypes
1237
1238 * kcm/protocol.c: fix error in last commit, use right function
1239
1240 * kcm/headers.h: include <ucred.h> if we have getpeerucred
1241
1242 * configure.in: check for functions getpeerucred and getpeereid
1243
1244 * kcm/connect.c (update_client_creds): add support for
1245 getpeerucred and getpeereid
1246
1247 * lib/krb5/kcm.c (kcm_alloc): allow kcm socket to be configured by
1248 [libdefaults]kcm_socket=/path
1249
12502005-05-24 David Love <fx@gnu.org>
1251
1252 * kcm/kcm.8: KRB5CCNAME needs an literal uid, not ${uid}, spelling
1253
12542005-05-23 Love Hörnquist Å
1255strand <lha@it.su.se>
1256
1257 * kcm/protocol.c: Merge the description and function jumptables
1258 into one structure. Use the length of the array when checking if
1259 opcode is value, not a constant.
1260
1261 * kcm/kcm_locl.h: struct kcm_op: jumptable structure
1262
1263 * kcm/main.c: move declaration of detach_from_console away from
1264 here to kcm_locl.h, Don't test HAVE_DAEMON since roken supplies it.
1265
1266 * kcm/kcm_locl.h: move declaration of detach_from_console here
1267
1268 * kdc/config.c: Don't test HAVE_DAEMON since roken supplies it.
1269
12702005-05-23 Dave Love <fx@gnu.org>
1271
1272 * kcm/config.c: Don't test HAVE_DAEMON since roken supplies it.
1273
1274 * kdc/main.c: Don't test HAVE_DAEMON since roken supplies it.
1275
12762005-05-23 Love Hörnquist Å
1277strand <lha@it.su.se>
1278
1279 * lib/krb5/krb5_keytab.3: document WRFILE and JAVA14
1280
12812005-05-20 Love Hörnquist Å
1282strand <lha@it.su.se>
1283
1284 * lib/krb5/krbhst.c (srv_get_hosts): if srv_get_hosts failes,
1285 return and ignore the error
1286
1287 * lib/krb5/krbhst.c (srv_find_realm): make sure `res' and `count'
1288 have good values
1289
1290 * lib/krb5/test_keytab.c: tests all keytab format
1291
12922005-05-19 Love Hörnquist Å
1293strand <lha@it.su.se>
1294
1295 * lib/krb5/pkinit.c (_krb5_pk_rd_pa_reply): non non asn1 decoding
1296 errors, fail. Make sure we free memory on error.
1297 (pk_verify_chain_standard): make sure we provide good errors.
1298
1299 * lib/krb5/verify_krb5_conf.c: add missing options, prompted by
1300 James F. Hranicky mail to heimdal-discuss
1301
1302 * lib/krb5/verify_krb5_conf.c: add pkinit and password quailty
1303 check options
1304
1305 * lib/krb5/pkinit.c (pk_verify_chain_standard): store better error
1306 message in the context for certificate errors.
1307
1308 * lib/krb5/keytab.c (krb5_kt_free_entry): zero out content of all
1309 krb5_free_x_content like functions to make sure data doesnt get
1310 reused, idea from Wynn Wilkes <wwilkes@vintela.com>
1311
1312 * configure.in: depend on automake 1.8, we don't test anything
1313 older
1314
1315 * lib/krb5/init_creds_pw.c (process_pa_data_to_md): add comment
1316 that the caller always free out_md; remove comment about memory,
1317 it doesn't happen.
1318 (init_cred_loop): free ctx->as_req.padata when its reset (From Wynn
1319 Wilkes <wwilkes@vintela.com>), move a comment close the the code
1320
1321 * lib/krb5/keytab_krb4.c (fkt_remove_entry): need to call
1322 krb5_kt_free_entry after each krb5_kt_next_entry.
1323
1324 * lib/krb5/keytab_file.c (fkt_remove_entry): need to call
1325 krb5_kt_free_entry after each fkt_next_entry_int. From: Wynn
1326 Wilkes <wwilkes@vintela.com>
1327
13282005-05-18 Love Hörnquist Å
1329strand <lha@it.su.se>
1330
1331 * lib/krb5/Makefile.am: TESTS += test_keytab
1332
1333 * lib/krb5/keytab_krb4.c (krb4_kt_remove_entry): plug memory leaks,
1334 avoid crashing on empty keytab
1335
1336 * lib/krb5/krb5_keytab.3: document behavior of
1337 krb5_kt_remove_entry
1338
1339 * lib/krb5/keytab_memory.c (mkt_remove_entry): check if there
1340 isn't any entries in the keytab before removing any since that
1341 leads to bad pointer arithmetic and crashing. From: Wynn Wilkes
1342 <wwilkes@vintela.com>. Make the function return KRB5_KT_NOTFOUND
1343 if the entry wasn't in the keytab (just like the filebased
1344 keytab).
1345
1346 * lib/krb5/test_keytab.c: test memory corruption in MEMORY keytab
1347
1348 * lib/krb5{addr_families,context,creds,free,keyblock,
1349 mit_glue,rd_error}.c:zero out content of all krb5_free_x_content
1350 like functions to make sure data doesnt get reused, idea from
1351 Wynn Wilkes <wwilkes@vintela.com>
1352
1353 * lib/krb5/krb5_get_credentials.3: document KRB5_GC_EXPIRED_OK
1354
1355 * lib/krb5/krb5.3: add krb5_cc_new_unique
1356
13572005-05-17 Love Hörnquist Å
1358strand <lha@it.su.se>
1359
1360 * lib/krb5/fcache.c (fcc_get_first): check return value from
1361 malloc, memset the structure, make sure cursor doesn't point to
1362 freed memory on failure. From: Wynn Wilkes <wwilkes@vintela.com>
1363
1364 * lib/krb5/krb5_auth_context.3: document
1365 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED
1366
1367 * lib/krb5/get_cred.c: Remove expired credentials, based on
1368 patches and comments from Anders Magnusson <ragge@ltu.se> and Wynn
1369 Wilkes <wwilkes@vintela.com>
1370
1371 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): honor
1372 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED and create unencrypted
1373 (ENCTYPE_NULL) credentials. for use with old mit server and java based
1374 ones as they can't handle encrypted KRB-CRED. Note that the option
1375 needs to turned on because if the consumer sends the KRB-CRED in
1376 clear bad things will happen.
1377
1378 * lib/krb5/context.c (krb5_init_context): register krb5_javakt_ops
1379
1380 * lib/krb5/krb5.h: KRB5_GC_EXPIRED_OK: expired credentials is ok
1381 to return from krb5_get_credentials.
1382 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED: make forward credentials
1383 be unencrypted, for compatibility with mit kerberos and java
1384 kerberos. krb5_javakt_ops: export
1385
13862005-05-16 Love Hörnquist Å
1387strand <lha@it.su.se>
1388
1389 * lib/krb5/keytab_file.c: Add new keytab file format JAVA14 that
1390 doesn't the use extended kvnos, as hinted, this is needed for
1391 Java's Kerberos implementation.
1392
13932005-05-10 Love Hörnquist Å
1394strand <lha@it.su.se>
1395
1396 * lib/krb5/pkinit.c: handle pkinit-9, pkinit-19, and pkinit-25
1397 enckey, still no DH
1398
1399 * kdc/pkinit.c: handle pkinit-9, pkinit-19, and pkinit-25 enckey,
1400 still no DH
1401
1402 * kdc/kerberos5.c (as_rep): search for pkinit-9, pkinit-19, and
1403 pkinit-25 pa-data, return empty pkinit pa-data in the
1404 PREAUTH_REQUIRED krb-error
1405
1406 * doc/ack.texi: add pkinit people
1407
1408 * lib/krb5/krb5_storage.3: document krb5_storage_is_flags
1409
1410 * lib/krb5/{krb5_compare_creds.3,krb5_get_init_creds.3,
1411 krb5_krbhst_init.3,krb5_storage.3}:
1412 make more pretty, from Björn Sandell
1413
14142005-05-09 Dave Love <fx@gnu.org>
1415
1416 * doc/setup.texi: Fix and clarify password quality check examples.
1417
14182005-05-09 Love Hörnquist Å
1419strand <lha@it.su.se>
1420
1421 * lib/krb5/kuserok.c (krb5_kuserok): use POSIX_GETPWNAM_R instead
1422 of HAVE_GETPWNAM_R From: Dave Love <d.love@dl.ac.uk>
1423
14242005-05-07 Love Hörnquist Å
1425strand <lha@it.su.se>
1426
1427 * lib/krb5/addr_families.c (krb5_print_address): catch when the
1428 unknown adress don't fit. From Björn Sandell <biorn@dce.chalmers.se>
1429
14302005-05-05 Dave Love <d.love@dl.ac.uk>
1431
1432 * configure.in: fix type right test, include <termios.h> for
1433 sys/strtty.h, not sys/ptyvar.h
1434
14352005-05-05 Love Hörnquist Å
1436strand <lha@it.su.se>
1437
1438 * lib/krb5/krb5.conf.5: spelling
1439
14402005-05-04 Love Hörnquist Å
1441strand <lha@it.su.se>
1442
1443 * lib/krb5/krb5.conf.5: expand on what "trailing component" means
1444
14452005-05-04 Johan Danielsson <joda@pdc.kth.se>
1446
1447 * lib/krb5/rd_cred.c: put address comparison in separate function
1448
1449 * lib/krb5/krb5_kuserok.3: check the user's ~/.k5login.d directory
1450 for access files, all of which is handled like the regular
1451 ~/.k5login
1452
1453 * lib/krb5/kuserok.c: check the user's ~/.k5login.d directory for
1454 access files, all of which is handled like the regular ~/.k5login
1455
14562005-05-03 Love Hörnquist Å
1457strand <lha@it.su.se>
1458
1459 * doc/ack.texi: Clearify what version of libdes we are using and
1460 who's code in it we are using.
1461
1462 * kcm/kcm.8: more text about usage
1463
1464 * kcm/Makefile.am: man_MANS += kcm.8
1465
1466 * kcm/kcm.8: initial manpage
1467
1468 * configure.in: if we have a $srcdir/lib/asn1/pkcs12.asn1, define
1469 PKINIT
1470
14712005-05-02 Dave Love <fx@gnu.org>
1472
1473 * configure.in: sys/tty.h (for sys/ptyvar.h) might need termios.h.
1474
14752005-05-02 Love Hörnquist Å
1476strand <lha@it.su.se>
1477
1478 * tools/krb5-config.in: add com_err to required libs
1479
1480 * lib/krb5/pkinit.c (krb5_ui_method_read_string): use the fill in
1481 length
1482
1483 * lib/krb5/init_creds_pw.c: Now that we fixed the signed-ness of
1484 nonce for windows, remove the code that removed the signed
1485 bit. Instead add comment that they still need to be the same
1486 (Kerberos protocol nonce and pk-init nonce) for Windows.
1487
14882005-05-02 David Love <fx@gnu.org>
1489
1490 * lib/krb5/crypto.c: Don't declare des_salt &c as static with
1491 incomplete type (invalid in c89, at least).
1492
14932005-05-02 Love Hörnquist Å
1494strand <lha@it.su.se>
1495
1496 * lib/krb5/krb5_locl.h: include <crypt.h>
1497
14982005-05-02 David Love <fx@gnu.org>
1499
1500 * kcm/connect.c (init_socket): rename variable sun to un to avoid
1501 namespace collision.
1502 (handle_stream): Cast arg of krb5_warnx.
1503
15042005-04-30 Love Hörnquist Å
1505strand <lha@it.su.se>
1506
1507 * lib/krb5/init_creds_pw.c: if we are using PKINIT, strip of the
1508 highest bit to make windows PK-INIT happy. Also make the nonces
1509 the same, again for windows, they are using pk-init-9.
1510
1511 XXX check if it isn't the that nonce is an unsigned variable so
1512 its just a asn1 mismatch.
1513
1514 * kdc/pkinit.c: pass a NULL prompter data to _krb5_pk_load_openssl_id
1515
1516 * kuser/kinit.c: krb5_get_init_creds_opt_set_pkinit
1517
1518 * lib/krb5/pkinit.c: Pass prompter data to the prompter function,
1519 implement a UI prompter function wrapping the kerberos prompter
1520 function so that the the OpenSSL ENGINE can ask for a password
1521 when loading the private key. From: Douglas E. Engert
1522
1523 * lib/krb5: add <err.h> in test programs
1524
1525 * configure.in: sys/ptyvar.h might need <sys/tty.h>
1526
1527 * lib/krb5/Makefile.am: use LIB_com_err for libkrb5.la
1528
15292005-04-29 Love Hörnquist Å
1530strand <lha@it.su.se>
1531
1532 * lib/asn1/Makefile.am: use $(LIB_com_err)
1533
15342005-04-28 Love Hörnquist Å
1535strand <lha@it.su.se>
1536
1537 * lib/krb5/context.c (krb5_set_config_files): ignore permission
1538 denied on configuration files, user might not be allowed to read
1539 /var/heimdal/kdc.conf
1540
15412005-04-26 Dave Love <fx@gnu.org>
1542
1543 * lib/krb5/krb5_locl.h: define _POSIX_PTHREAD_SEMANTICS so we get
1544 posix getpwnam_r
1545
15462005-04-25 Love Hörnquist Å
1547strand <lha@it.su.se>
1548
1549 * lib/asn1/gen_glue.c: switch the units variable to a
1550 function. gcc-4.1 needs the size of the structure if its defined
1551 as extern struct units foo_units[] an we don't want to include
1552 <parse_units.h> in the generate headerfile
1553
15542005-04-25 Love Hörnquist Å
1555strand <lha@it.su.se>
1556
1557 * lib/hdb/hdb.schema: add EQUALITY rule for krb5ValidStart,
1558 krb5ValidEnd, krb5PasswordEnd From Howard Chu
1559
15602005-04-24 Love Hörnquist Å
1561strand <lha@it.su.se>
1562
1563 * doc/whatis.texi: comment out docbook stuff for now
1564
1565 * kuser/klist.c: use strlcpy
1566
1567 * doc/ack.texi: we no longer use eay libdes, make acknowledgment
1568 still be there, but claim that we no longer use it. Mark editline
1569 to be a modified version as required by the license.
1570
1571 * lib/krb5/pkinit.c: use the unexported oid_to_enctype function
1572
1573 * lib/krb5/crypto.c: unexport the oid_to_enctype function, not for
1574 external consumers
1575
1576 * kdc/Makefile.am: always add kaserver
1577
1578 * lib/krb5/krb5_ccache.3: document krb5_cc_new_unique
1579
1580 * lib/krb5/cache.c (krb5_cc_new_unique): new function to create a
1581 new credential cache
1582
1583 * kdc/headers.h: don't include kerberos 4 headers here
1584
1585 * kdc/hpropd.c: include kerberos 4 headers here
1586
1587 * kdc/connect.c: add kaserver support independ of having krb4
1588 support
1589
1590 * kdc/config.c: add kaserver support unconditionally, make kdc
1591 only fail to start when there are no v4 realm configured and
1592 krb4/kaserver is turned on
1593
1594 * kdc/kaserver.c: Use the new Kerberos 4 functions in libkrb5 and
1595 so kaserver support is always compiled in (still default disabled)
1596
1597 * lib/krb5/v4_glue.c: simplify error handling
1598
1599 * doc/whatis.texi: add docbook version macro of @sub
1600
1601 * doc/heimdal.texi: change the wrapping around the Top node to
1602 ifnottex, make html generation work
1603
1604 * lib/krb5/krb5_krbhst_init.3: spelling, from Björn Sandell
1605 <biorn@dce.chalmers.se>
1606
1607 * lib/krb5/krb5_get_krbhst.3: spelling, from Björn Sandell
1608 <biorn@dce.chalmers.se>
1609
1610 * lib/krb5/krb5_data.3: spelling, from Björn Sandell
1611 <biorn@dce.chalmers.se>
1612
1613 * lib/krb5/krb5_aname_to_localname.3: spelling, from Björn Sandell
1614 <biorn@dce.chalmers.se>
1615
1616 * lib/krb5/krb5_address.3: spelling, from Björn Sandell
1617 <biorn@dce.chalmers.se>
1618
16192005-04-23 Love Hörnquist Å
1620strand <lha@it.su.se>
1621
1622 * kdc/config.c: Use the new Kerberos 4 functions in libkrb5 and so
1623 kerberos 4 is always compiled in (still default disabled)
1624
1625 * kdc/kerberos4.c: Use the new Kerberos 4 functions in libkrb5 and
1626 so kerberos 4 is always compiled in (still default disabled)
1627
1628 * lib/krb5/krb5_locl.h: forward declaration of _krb5_krb_auth_data
1629
1630 * lib/krb5/convert_creds.c: Move the kerberos v4 replacement
1631 functions to v4_glue.c
1632
1633 * lib/krb5/v4_glue.c: Implement enough of kerberos 4 protocol to
1634 be a KDC, move the v4 bits over here
1635
1636 * lib/krb5/krb5-v4compat.h: add more v4 defines
1637
16382005-04-22 Love Hörnquist Å
1639strand <lha@it.su.se>
1640
1641 * kpasswd/kpasswdd.c: Support multi-realms databases, requires
1642 that all the realms are configured on the KDC in krb5.conf with
1643 [libdefaults]default_realm stanzas.
1644
16452005-04-21 Love Hörnquist Å
1646strand <lha@it.su.se>
1647
1648 * kdc/kerberos5.c: spell succeeded correctly, From Sean Chittenden
1649
1650 * lib/krb5/addr_families.c: catch two more snprintf problems
1651
16522005-04-20 Love Hörnquist Å
1653strand <lha@it.su.se>
1654
1655 * lib/hdb/Makefile.am: this lib include com_err, add -com_err to
1656 CHECK_SYMBOLS
1657
1658 * appl/test/http_client.c: cast ssize_t to unsigned long, fix
1659 printf format
1660
16612005-04-19 Love Hörnquist Å
1662strand <lha@it.su.se>
1663
1664 * lib/krb5/kuserok.c: use asprintf to avoid truncating pathnames
1665
1666 * lib/krb5/get_host_realm.c: check return value of snprintf
1667
1668 * lib/krb5/test_addr.c: check address truncation
1669
1670 * lib/krb5/addr_families.c: check return values from snprintf and
1671 clean up semantics of ret_len
1672
1673 * lib/krb5/krb5_address.3: clarify what ret_len is in
1674 krb5_print_address
1675
1676 * lib/krb5/test_kuserok.c: add --version and --help
1677
1678 * lib/krb5/kuserok.c: use getpwnamn_r if it exists
1679
1680 * lib/krb5/Makefile.am: noinst_PROGRAMS += test_kuserok
1681
1682 * lib/krb5/test_kuserok.c: test program for krb5_kuserok
1683
16842005-04-18 Love Hörnquist Å
1685strand <lha@it.su.se>
1686
1687 * lib/krb5/acache.c (acc_resolve): if open_default_ccache failed
1688 with ccErrCCacheNotFound try again with create_default_ccache,
1689 this fixes the problem where the security server apperenly haven't
1690 started yet on Mac OS X
1691
1692 * lib/krb5/get_default_principal.c
1693 (_krb5_get_default_principal_local): add, for use of functions
1694 that in ccache layer to avoid recursive calls.
1695
1696 * lib/hdb/hdb-ldap.c: drop <ctype.h>, no longer use any of the is*
1697 macros in this file
1698
1699 * include/make_crypto.c: cast to unsigned char to make sure its
1700 not negative when passing it to is* functions
1701
17022005-04-15 Love Hörnquist Å
1703strand <lha@it.su.se>
1704
1705 * doc/programming.texi: remove manpage macro, add some more
1706 references to manpages
1707
1708 * doc/heimdal.texi: define manpage macro
1709
1710 * doc/setup.texi: document new password policy code
1711
1712 * kpasswd/kpasswdd.c: add verifier libraries with
1713 kadm5_add_passwd_quality_verifier
1714
1715 * lib/krb5/krb5_keyblock.3: document krb5_keyblock_init
1716
17172005-04-14 Love Hörnquist Å
1718strand <lha@it.su.se>
1719
1720 * kdc/kaserver.c: AUTHENTICATE and AUTHENTICATE_V2 is almost the
1721 same, and clients
1722 (klog) can deal with that the kaserver returns the same thing for
1723 both
1724
1725 * lib/krb5/keyblock.c: Add krb5_keyblock_init to allocate an fill
1726 in a keyblock from key data.
1727
17282005-04-12 Love Hörnquist Å
1729strand <lha@it.su.se>
1730
1731 * configure.in: rk_WIN32_EXPORT for roken
1732
17332005-04-10 Love Hörnquist Å
1734strand <lha@it.su.se>
1735
1736 * appl/test/gssapi_server.c: print out client principla of
1737 delegated credential
1738
17392005-04-07 Love Hörnquist Å
1740strand <lha@it.su.se>
1741
1742 * lib/krb5/init_creds_pw.c (process_pa_data_to_key): also check
1743 for KRB5_PADATA_PK_AS_REP_19, From: Douglas Engert
1744
17452005-04-07 Love Hörnquist Å
1746strand <lha@it.su.se>
1747
1748 * .cvsignore: ignore more generate files
1749
17502005-04-04 Love Hörnquist Å
1751strand <lha@it.su.se>
1752
1753 * lib/asn1/check-der.c: use size_t, print size_t by casting to
1754 unsigned long
1755
1756 * lib/krb5/test_crypto.c: print size_t by casting to unsigned long
1757
1758 * lib/krb5/acache.c: Argument to create_new_ccache is a principal,
1759 not a credential cache name. Clean up lossage related to this
1760 problem.
1761
1762 * lib/hdb/Makefile.am: CHECK_SYMBOLS += HDBFlags2int
1763
1764 * lib/krb5/addr_families.c
1765 (krb5_address_prefixlen_boundary,krb5_free_address):
1766 use find_atype when we are dealing with a kerberos address type
1767
1768 * lib/krb5/aes-test.c: size_t vs int + fix printf
1769
1770 * lib/krb5/pkinit.c: Since the decode can't make out the diffrence
1771 between PA-PK-AS-REP-19 and PA-PK-AS-REQ-Win2k, try harder to
1772 verify both cases
1773
17742005-04-03 Love Hörnquist Å
1775strand <lha@it.su.se>
1776
1777 * appl/test/uu_client.c: print size_t by casting to unsigned long
1778
17792005-04-01 Johan Danielsson <joda@pdc.kth.se>
1780
1781 * kdc/kerberos4.c (do_version4): check client and server max_life
1782
1783 * kdc/kaserver.c (do_getticket): check client max_life
1784
17852005-03-31 Love <lha@kth.se>
1786
1787 * lib/krb5/verify_krb5_conf.c: const poison
1788
1789 * lib/krb5/test_alname.c: const poison
1790
1791 * lib/asn1/main.c: const poison
1792
1793 * lib/krb5/test_addr.c: test parse IPv6 RANGE addresses
1794
1795 * lib/krb5/addr_families.c: implement mask boundary for IPv6
1796
1797 * lib/asn1/gen.c: avoid const string warnings steming from
1798 writeable-string
1799
18002005-03-28 Love Hörnquist Å
1801strand <lha@it.su.se>
1802
1803 * lib/krb5/Makefile.am: TESTS += test_addr
1804
1805 * lib/krb5/test_addr.c: simple test for addresses
1806
1807 * lib/krb5/addr_families.c: make RANGE parse prefixlen style
1808 addresses too, fix printing of RANGE addresses, add
1809 krb5_address_prefixlen_boundary
1810
1811 * lib/krb5/krb5_keytab.3: stop memory leak in example, expand on
1812 wildcards
1813
18142005-03-26 Love Hörnquist Å
1815strand <lha@it.su.se>
1816
1817 * lib/krb5/krb5_principal.3: spelling, from Tomas Olsson
1818
1819 * lib/krb5/krb5_warn.3: spelling, from Tomas Olsson
1820
18212005-03-19 Love Hörnquist Å
1822strand <lha@it.su.se>
1823
1824 * lib/krb5/acache.c: add mutex for global variables, clean up
1825 returned error codes, implement storing addresses into the ccapi
1826
1827 * appl/test/gssapi_server.c: free memory, make error strings match
1828
1829 * appl/test/gssapi_server.c: use print_gss_name, print server name
1830 too
1831
1832 * appl/test/gss_common.h (print_gss_name): common code for
1833 printing gss name
1834
1835 * appl/test/gss_common.c (print_gss_name): common code for
1836 printing gss name
1837
1838 * appl/test/http_client.c: Make constent with rest of the gssapi
1839 test programs
1840
18412005-03-17 Love Hörnquist Å
1842strand <lha@it.su.se>
1843
1844 * lib/hdb/keys.c: AES is enabled by default, remove ifdefs
1845
1846 * lib/krb5/crypto.c: AES is enabled by default, remove ifdefs
1847
1848 * lib/krb5/aes-test.c: use hex encoder from roken AES is enabled
1849 by default, remove ifdefs
1850
1851 * kdc/kerberos5.c: AES is enabled by default, remove ifdefs
1852
18532005-03-16 Love Hörnquist Å
1854strand <lha@it.su.se>
1855
1856 * doc/setup.texi: Add some text about modifying the database
1857
18582005-03-15 Love Hörnquist Å
1859strand <lha@it.su.se>
1860
1861 * kuser/kinit.c: widen lifetime/renewal warning text field, also
1862 make use of unparse_time_approx, no need to be specific to the
1863 second when ticket needs to be renewed or their lifetime.
1864
1865 * doc/heimdal.texi: copyright maintenance, drop eay, use updated
1866 UCB license
1867
1868 * lib/krb5/crypto.c: more static and unsigned issues
1869
1870 * lib/krb5/crypto.c: fix signedness issues, prompted by report of
1871 Magnus Ahltorp
1872
18732005-03-13 Love Hörnquist Å
1874strand <lha@it.su.se>
1875
1876 * lib/krb5/krb5_keytab.3: more text about how to free returned
1877 resources
1878
18792005-03-10 Love Hörnquist Å
1880strand <lha@it.su.se>
1881
1882 * lib/krb5/pkinit.c: handle the -25 generation path
1883
1884 * lib/krb5/pkinit.c: use KRB5_PADATA_PK_AS_REQ_19
1885
1886 * lib/krb5/pkinit.c: fold in pk-init-25 asn1 changes
1887
18882005-03-09 Love Hörnquist Å
1889strand <lha@it.su.se>
1890
1891 * kdc/pkinit.c: use generated oid's
1892
1893 * lib/krb5/pkinit.c: use generated oid's
1894
18952005-03-08 Love Hörnquist Å
1896strand <lha@it.su.se>
1897
1898 * kdc/pkinit.c: update to the asn1 structures used in -25's
1899
1900 * lib/krb5/pkinit.c: update to the asn1 structures used in -25's
1901
19022005-03-04 Love Hörnquist Å
1903strand <lha@it.su.se>
1904
1905 * lib/hdb/hdb-ldap.c: use the newly written hex function from
1906 roken and remove the old implementation
1907
19082005-03-01 Love Hörnquist Å
1909strand <lha@it.su.se>
1910
1911 * appl/test/http_client.c: allow specifing port to connect to
1912
19132005-02-24 Love Hörnquist Å
1914strand <lha@it.su.se>
1915
1916 * lib/krb5/Makefile.am: bump version to 21:0:4
1917
1918 * lib/hdb/Makefile.am: bump version to 8:0:1
1919
1920 * lib/asn1/Makefile.am: bump version to 7:0:1
1921
19222005-02-23 Love Hörnquist Å
1923strand <lha@it.su.se>
1924
1925 * lib/krb5/crypto.c (DES_string_to_key_int): must check for weak
1926 keys after doing the DES_cbc_cksum
1927
19282005-02-19 Luke Howard <lukeh@padl.com>
1929
1930 * lib/krb5/krbhst.c: set KD_CONFIG after calling
1931 config_get_hosts() in kpasswd_get_next()
1932 From: Wynn Wilkes <wynnw@vintela.com>
1933
19342005-02-15 Love Hörnquist Å
1935strand <lha@it.su.se>
1936
1937 * lib/hdb/db3.c (DB_open): correct the check for O_RDONLY
1938 From: Chaskiel M Grundman <cg2v@andrew.cmu.edu>
1939
19402005-02-09 Love Hörnquist Å
1941strand <lha@it.su.se>
1942
1943 * lib/krb5/crypto.c (krb5_random_to_key): cast size_t to int to
1944 make %d work
1945
19462005-02-08 Love Hörnquist Å
1947strand <lha@it.su.se>
1948
1949 * lib/krb5/keytab.c (krb5_kt_get_entry): tell what enctype the
1950 caller requested to provide the user with a glue what the caller
1951 was asking for.
1952
19532005-02-05 Luke Howard <lukeh@padl.com>
1954
1955 * lib/krb5/kcm.c: add _krb5_kcm_is_running, _krb5_kcm_noop
1956
1957 * kcm/acquire.c: don't leak salt if keyproc called multiple
1958 times
1959
1960 * kcm/config.c: allow KCM system ccache to be configured from
1961 krb5.conf, in the system_ccache stanza of [kcm]
1962
19632005-02-03 Love Hörnquist Å
1964strand <lha@it.su.se>
1965
1966 * kcm/protocol.c: use -1 as the invalid pid number
1967
1968 * kcm/connect.c: support SCM_CREDS (for NetBSD)
1969
1970 * kcm/Makefile.am: LDADD += LIB_pidfile
1971
1972 * kcm/connect.c: make it possible to build on systems without
1973 SO_PEERCRED (still doesn't work)
1974
1975 * kcm/config.c: cast argument to isdigit to unsigned char
1976
1977 * lib/krb5/krb5.conf.5: document large_msg_size
1978
1979 * lib/krb5/context.c (init_context_from_config_file): init
1980 large_msg_size to 6000
1981
1982 * lib/krb5/krb5.h (krb5_context_data): add large_msg_size,
1983 threshold where we start to use transport protocols without tiny
1984 max data transport sizes.
1985
1986 * lib/krb5/kcm.h: drop prototypes, they all live in krb5-private.h
1987 by now
1988
19892005-02-02 Luke Howard <lukeh@padl.com>
1990
1991 * configure.in: generate kcm/Makefile
1992
1993 * Makefile.am: recurse into kcm/ if KCM defined
1994
1995 * kcm: add KCM daemon
1996
19972005-02-02 Love Hörnquist Å
1998strand <lha@it.su.se>
1999
2000 * lib/krb5/send_to_kdc.c (send_and_recv_udp): make private again
2001
2002 * lib/krb5/kcm.c: use AF_UNIX like the rest of the codebase, add
2003 some more error strings
2004
20052005-02-02 Luke Howard <lukeh@padl.com>
2006
2007 * configure.in: add --enable-kcm option for Kerberos
2008 Credentials Manager (KCM)
2009
2010 * lib/krb5/Makefile.am: add kcm.c
2011
2012 * lib/krb5/cache.c: use cc_retrieve_cred if present rather
2013 than enumerating ccache
2014
2015 * lib/krb5/context.c: register KCM cc_ops
2016
2017 * lib/krb5/get_cred.c: pass all options to cc_retrieve_cred
2018
2019 * lib/krb5/init_creds_pw.c: add krb5_get_init_creds_keyblock
2020
2021 * lib/krb5/kcm.[ch]: add initial implementation of KCM
2022 client library
2023
2024 * lib/krb5/krb5.h: fix cc_retrieve prototype, add KCM cc_ops
2025
2026 * lib/krb5/send_to_kdc.c: add _krb5_send_and_recv_tcp
2027
2028 * lib/krb5/store.c: add krb5_store_creds_tag, krb5_ret_creds_tag
2029
20302005-01-24 Luke Howard <lukeh@padl.com>
2031
2032 * lib/krb5/init_creds_pw.c: allow NULL in_options to be passed
2033 krb5_get_init_creds_password()
2034
2035 * kdc/kerberos5.c: don't crash when logging no server etype
2036 support if client == NULL
2037
20382005-01-17 Love Hörnquist Å
2039strand <lha@it.su.se>
2040
2041 * kdc/kstash.c: s/random_key/random_key_flag/, From Dave Love
2042 <d.love@dl.ac.uk>
2043
20442005-01-12 Love Hörnquist Å
2045strand <lha@it.su.se>
2046
2047 * doc/apps.texi: Texinfo fixes. Text about irix 6.5 using
2048 PAM. From: Dave Love <d.love@dl.ac.uk>
2049
20502005-01-08 Love Hörnquist Å
2051strand <lha@it.su.se>
2052
2053 * lib/krb5/verify_krb5_conf.c: cast argument to isdigit to
2054 unsigned char
2055
2056 * lib/krb5/keytab_keyfile.c: cast argument to toupper to unsigned
2057 char
2058
2059 * lib/asn1/hash.c (hashcaseadd): cast argument to toupper to
2060 unsigned char
2061
2062 * appl/kf/kfd.c (kfd_match_version): cast argument to islower to
2063 unsigned char
2064
2065 * lib/krb5/krb5.3: drop krb5_{checksum,enctype}_is_disabled
2066
2067 * lib/krb5/krb5_encrypt.3: drop krb5_enctype_is_disabled, more
2068 text about krb5_enctype_valid
2069
2070 * lib/krb5/krb5_create_checksum.3: drop
2071 krb5_checksum_is_disabled
2072
2073 * lib/krb5/crypto.c: drop krb5_{checksum,enctype}_isdisabled
2074
2075 * lib/krb5/context.c: krb5_enctype_is_disabled is the same thing
2076 as krb5_enctype_valid, so use the later since its older and the
2077 api doesn't really need another entry point
2078
2079 * lib/krb5/rd_req.c: krb5_enctype_is_disabled is the same thing as
2080 krb5_enctype_valid, so use the later since its older and the api
2081 doesn't really need another entry point
2082
2083 * kdc/kerberos5.c: krb5_enctype_is_disabled is the same thing as
2084 krb5_enctype_valid, so use the later since its older and the api
2085 doesn't really need another entry point
2086
20872005-01-05 Love Hörnquist Å
2088strand <lha@it.su.se>
2089
2090 * kpasswd/kpasswdd.8: document --addresses, controls what
2091 addresses kpasswd should listen too
2092
2093 * kpasswd/kpasswdd.c: add --addresses, controls what addresses
2094 kpasswd should listen too
2095
2096 * lib/krb5/addr_families.c (krb5_parse_address): filter out dup
2097 addresses from getaddrinfo
2098
2099 * kpasswd/kpasswd.1: document -c
2100
2101 * kpasswd/kpasswd.c: allow specifying a credential cache to use
2102 for the admin principal
2103
2104 * include/bits.c: constify to avoid warning with -Wwrite-string
2105
2106 * NEWS: add 0.6.2 and 0.6.3 items
2107
2108 * lib/krb5/krb5_keyblock.3: document krb5_generate_subkey_extended
2109
2110 * lib/krb5/krb5_is_thread_safe.3: document function
2111
2112 * lib/krb5/Makefile.am (man_MANS) += krb5_is_thread_safe.3
2113
2114 * lib/krb5/context.c (krb5_is_thread_safe): return TRUE is the
2115 library was compiled with multithreading support. If not,
2116 application must global lock the library, it it uses threads that
2117 call kerberos functions at the same time.
2118
21192005-01-05 Luke Howard <lukeh@padl.com>
2120
2121 * lib/krb5/auth_context.c: use krb5_generate_subkey_extended()
2122
2123 * lib/krb5/appdefault.c: remove redundant KRB5_LIB_FUNCTION
2124
2125 * lib/krb5/build_auth.c: support for enctype negotiation
2126 (client sends EtypeList in Authenticator authz data)
2127
2128 * lib/krb5/context.c: mutex should be destroyed last in
2129 krb5_free_context()
2130
2131 * lib/krb5/generate_subkey.c: add krb5_generate_subkey_extended(),
2132 set *subkey to NULL if key geneartion fails
2133
2134 * lib/krb5/krb5.h: add KRB5_KU_PA_SERVER_REFERRAL_DATA
2135
2136 * lib/krb5/mk_req_ext.c: support ETYPE_ARCFOUR_HMAC_MD5_56
2137
2138 * lib/krb5/rd_req.c: support for enctype negotiation
2139 (client sends EtypeList in Authenticator authz data)
2140
21412005-01-04 Luke Howard <lukeh@padl.com>
2142
2143 * lib/asn1/k5.asn1: add authorization data types for enctype
2144 negotiation implementation
2145
21462005-01-04 Love Hörnquist Å
2147strand <lha@it.su.se>
2148
2149 * lib/krb5/changepw.c (change_password_loop): on failing to find a
2150 kdc, set result_code to KRB5_KPASSWD_HARDERROR
2151
21522005-01-01 Love Hörnquist Å
2153strand <lha@it.su.se>
2154
2155 * doc/heimdal.texi: Happy New Year
2156
Note: See TracBrowser for help on using the repository browser.