source: heimdal/trunk/ChangeLog.2006@ 4

Last change on this file since 4 was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 60.0 KB
Line 
12006-12-28 Love Hörnquist Å
2strand <lha@it.su.se>
3
4 * kdc/process.c: Handle kx509 requests.
5
6 * kdc/connect.c: Listen to 9878 if kca is turned on.
7
8 * kdc/headers.h: Include <kx509_asn1.h>.
9
10 * kdc/config.c: code to parse [kdc]enable-kx509
11
12 * kdc/kdc.h: add enable_kx509
13
14 * kdc/Makefile.am: add kx509.c
15
16 * kdc/kx509.c: Kx509server (external certificate genration).
17
18 * lib/krb5/ticket.c: add krb5_ticket_get_endtime
19
20 * lib/krb5/krb5_ticket.3: Document krb5_ticket_get_endtime
21
22 * kdc/digest.c: Remove <digest_asn.h>, its already included in
23 headers.h
24
25 * kdc/digest.c: Return session key for the NTLMv2 case too
26
27 * lib/krb5/digest.c (krb5_ntlm_rep_get_sessionkey): return value
28 is krb5_error_code
29
302006-12-27 Love Hörnquist Å
31strand <lha@it.su.se>
32
33 * lib/krb5/mk_req_ext.c (_krb5_mk_req_internal): use md5 for
34 des-cbc-md4 and des-cbc-md5. This is for (older) windows that
35 will be unhappy anything else. From Inna Bort-Shatsky
36
372006-12-26 Love Hörnquist Å
38strand <lha@it.su.se>
39
40 * kdc/digest.c: Prefix internal symbol with _kdc_.
41
42 * kdc/kdc.h: add digests_allowed
43
44 * kdc/digest.c: return NTLM2 targetinfo structure.
45
46 * lib/krb5/digest.c: Add krb5_ntlm_init_get_targetinfo.
47
48 * kdc/config.c: Parse digest acl's
49
50 * kdc/kdc_locl.h: forward decl;
51
52 * kdc/digest.c: Add digest acl's
53
542006-12-22 Love Hörnquist Å
55strand <lha@it.su.se>
56
57 * fix-export: build ntlm-private.h
58
592006-12-20 Love Hörnquist Å
60strand <lha@it.su.se>
61
62 * include/make_crypto.c: Include <.../hmac.h>.
63
64 * kdc/digest.c: reorder to show slot here ntlmv2 code will be
65 placed.
66
67 * kdc/digest.c: Announce that we support key exchange and add bits
68 to detect when it wasn't used.
69
70 * kdc/digest.c: Add support for generating NTLM2 session security
71 answer.
72
732006-12-19 Love Hörnquist Å
74strand <lha@it.su.se>
75
76 * lib/krb5/digest.c: Add sessionkey accessor functions.
77
782006-12-18 Love Hörnquist Å
79strand <lha@it.su.se>
80
81 * kdc/digest.c: Unwrap the NTLM session key and return it to the
82 server.
83
842006-12-17 Love Hörnquist Å
85strand <lha@it.su.se>
86
87 * lib/krb5/store.c (krb5_ret_principal): Fix a bug in the malloc
88 failure part, noticed by Arnaud Lacombe in NetBSD coverity scan.
89
902006-12-15 Love Hörnquist Å
91strand <lha@it.su.se>
92
93 * lib/krb5/fcache.c (fcc_get_cache_next): avoid const warning.
94
95 * kdc/digest.c: Support NTLM verification, note that the KDC does
96 no NTLM packet parsing, its all done by the client side, the KDC
97 just calculate and verify the digest and return the result to the
98 service.
99
100 * kuser/kdigest.c: add ntlm-server-init
101
102 * kuser/Makefile.am: kdigest depends on libheimntlm.la
103
104 * kdc/headers.h: Include <heimntlm.h>.
105
106 * kdc/Makefile.am: libkdc needs libheimntlm.la
107
108 * autogen.sh: just run autoreconf -i -f
109
110 * lib/Makefile.am: hook in ntlm
111
112 * configure.in (AC_CONFIG_FILES): add lib/ntlm/Makefile
113
114 * lib/krb5/digest.c: API to authenticate ntlm requests.
115
116 * lib/krb5/fcache.c: Support "iteration" of file credential caches
117 by giving the user back the default file credential cache and only
118 that.
119
120 * lib/krb5/krb5_locl.h: Expand the default root for some of the cc
121 type names.
122
1232006-12-14 Love Hörnquist Å
124strand <lha@it.su.se>
125
126 * lib/krb5/init_creds_pw.c (free_paid): free the krb5_data
127 structure too. Bug report from Stefan Metzmacher.
128
1292006-12-12 Love Hörnquist Å
130strand <lha@it.su.se>
131
132 * kuser/kinit.c: Read the appdefault configration before we try to
133 use the flags. Bug reported by Ingemar Nilsson.
134
135 * kuser/kdigest.c: prefix digest commands with digest_
136
137 * kuser/kdigest-commands.in: prefix digest commands with digest-
138
1392006-12-10 Love Hörnquist Å
140strand <lha@it.su.se>
141
142 * kdc/hprop.c: Return error codes on failure, improve error
143 reporting.
144
1452006-12-08 Love Hörnquist Å
146strand <lha@it.su.se>
147
148 * lib/krb5/pkinit.c: sprinkle more _krb5_pk_copy_error
149
150 * lib/krb5/pkinit.c: Copy more hx509 error strings to krb5 error
151 strings
152
1532006-12-07 Love Hörnquist Å
154strand <lha@it.su.se>
155
156 * include/Makefile.am: CLEANFILES += vis.h
157
1582006-12-06 Love Hörnquist Å
159strand <lha@it.su.se>
160
161 * kdc/kerberos5.c (_kdc_as_rep): add AD-INITAL-VERIFIED-CAS to the
162 encrypted ticket
163
164 * kdc/pkinit.c (_kdc_add_inital_verified_cas): new function, adds
165 an empty (for now) AD_INITIAL_VERIFIED_CAS to tell the clients
166 that we vouches for the CA.
167
168 * kdc/kerberos5.c (_kdc_tkt_add_if_relevant_ad): new function.
169
170 * lib/Makefile.am: Make the directories test automake conditional
171 so automake can include directories in make dist step.
172
173 * kdc/pkinit.c (_kdc_pk_rd_padata): leak less memory for
174 ExternalPrincipalIdentifiers
175
176 * kdc/pkinit.c: Parse and use PA-PK-AS-REQ.trustedCertifiers
177
178 * kdc/pkinit.c: Add comment that the anchors in the signed data
179 really should be the trust anchors of the client.
180
181 * kuser/generate-requests.c: Use strcspn to remove \n from
182 string returned by fgets. From Björn Sandell
183
184 * kpasswd/kpasswd-generator.c: Use strcspn to remove \n from
185 string returned by fgets. From Björn Sandell
186
1872006-12-05 Love Hörnquist Å
188strand <lha@it.su.se>
189
190 * lib/hdb/hdb-ldap.c: Clear errno before calling the strtol
191 functions. From Paul Stoeber to OpenBSD by Ray Lai and Björn
192 Sandell.
193
194 * lib/krb5/config_file.c: Use strcspn to remove \n from fgets
195 result. Prompted by change by Ray Lai of OpenBSD via Björn
196 Sandell.
197
198 * kdc/string2key.c: Use strcspn to remove \n from fgets
199 result. Prompted by change by Ray Lai of OpenBSD via Björn
200 Sandell.
201
2022006-11-30 Love Hörnquist Å
203strand <lha@it.su.se>
204
205 * lib/krb5/krbhst.c (plugin_get_hosts): be more paranoid and pass
206 in a NULLed plugin list
207
2082006-11-29 Love Hörnquist Å
209strand <lha@it.su.se>
210
211 * lib/krb5/verify_krb5_conf.c: add more pkinit options.
212
213 * lib/krb5/pkinit.c: Store what PK-INIT type we used to know reply
214 to expect, this avoids overwriting the real PK-INIT error from
215 just a failed requeat with a Windows PK-INIT error (that always
216 failes).
217
218 * kdc/Makefile.am: Add LIB_pkinit to pacify AIX
219
220 * lib/hdb/Makefile.am: Add LIB_com_err to pacify AIX
221
2222006-11-28 Love Hörnquist Å
223strand <lha@it.su.se>
224
225 * lib/hdb/hdb-ldap.c: Make build again from the hdb_entry
226 wrapping. Patch from Andreas Hasenack.
227
228 * kdc/pkinit.c: Need better code in the DH parameter rejection
229 case, add comment to that effect.
230
2312006-11-27 Love Hörnquist Å
232strand <lha@it.su.se>
233
234 * kdc/krb5tgs.c: Reply KRB5KRB_ERR_RESPONSE_TOO_BIG for too large
235 packets when using datagram based transports.
236
237 * kdc/process.c: Pass down datagram_reply to _kdc_tgs_rep.
238
239 * lib/krb5/pkinit.c (build_auth_pack): set supportedCMSTypes.
240
2412006-11-26 Love Hörnquist Å
242strand <lha@it.su.se>
243
244 * lib/krb5/pkinit.c: Pass down hx509_peer_info.
245
246 * kdc/pkinit.c (_kdc_pk_rd_padata): Pick up supportedCMSTypes and
247 pass in into hx509_cms_create_signed_1 via hx509_peer_info blob.
248
249 * kdc/pkinit.c (_kdc_pk_rd_padata): Pick up supportedCMSTypes and
250 pass in into hx509_cms_create_signed_1 via hx509_peer_info blob.
251
2522006-11-24 Love Hörnquist Å
253strand <lha@it.su.se>
254
255 * lib/krb5/send_to_kdc.c: Set the large_msg_size to 1400, lets not
256 fragment packets and avoid stupid linklayers that doesn't allow
257 fragmented packets (unix dgram sockets on Mac OS X)
258
2592006-11-23 Love Hörnquist Å
260strand <lha@it.su.se>
261
262 * lib/krb5/pkinit.c (_krb5_pk_create_sign): stuff down the users
263 certs in the pool to make sure a path is returned, without this
264 proxy certificates wont work.
265
2662006-11-21 Love Hörnquist Å
267strand <lha@it.su.se>
268
269 * kdc/config.c: Make all pkinit options prefixed with pkinit_
270
271 * lib/krb5/log.c (krb5_get_warn_dest): return warn_dest from
272 krb5_context
273
274 * lib/krb5/krb5_warn.3: document krb5_[gs]et_warn_dest
275
276 * lib/krb5/krb5.h: Drop KRB5_KU_TGS_IMPERSONATE.
277
278 * kdc/krb5tgs.c: Use KRB5_KU_OTHER_CKSUM for the impersonate
279 checksum.
280
281 * lib/krb5/get_cred.c: Use KRB5_KU_OTHER_CKSUM for the impersonate
282 checksum.
283
2842006-11-20 Love Hörnquist Å
285strand <lha@it.su.se>
286
287 * lib/krb5/verify_user.c: Make krb5_get_init_creds_opt_free take a
288 context argument.
289
290 * lib/krb5/krb5_get_init_creds.3: Make
291 krb5_get_init_creds_opt_free take a context argument.
292
293 * lib/krb5/init_creds_pw.c: Make krb5_get_init_creds_opt_free take
294 a context argument.
295
296 * kuser/kinit.c: Make krb5_get_init_creds_opt_free take a context
297 argument.
298
299 * kpasswd/kpasswd.c: Make krb5_get_init_creds_opt_free take a
300 context argument.
301
302 * kpasswd/kpasswd-generator.c: Make krb5_get_init_creds_opt_free
303 take a context argument.
304
305 * kdc/hprop.c: Make krb5_get_init_creds_opt_free take a context
306 argument.
307
308 * lib/krb5/init_creds.c: Make krb5_get_init_creds_opt_free take a
309 context argument.
310
311 * appl/gssmask/gssmask.c: Make krb5_get_init_creds_opt_free take a
312 context argument.
313
3142006-11-19 Love Hörnquist Å
315strand <lha@it.su.se>
316
317 * doc/setup.texi: fix pkinit option (s/-/_/)
318
319 * kdc/config.c: revert the enable-pkinit change, and make it
320 consistant with all other other enable- options
321
3222006-11-17 Love Hörnquist Å
323strand <lha@it.su.se>
324
325 * doc/setup.texi: Make all pkinit options prefixed with pkinit_
326
327 * kdc/config.c: Make all pkinit options prefixed with pkinit_
328
329 * kdc/pkinit.c: Make app pkinit options prefixed with pkinit_
330
331 * lib/krb5/pkinit.c: Make app pkinit options prefixed with pkinit_
332
333 * lib/krb5/mit_glue.c (krb5_c_keylengths): make compile again.
334
335 * lib/krb5/mit_glue.c (krb5_c_keylengths): rename.
336
337 * lib/krb5/mit_glue.c (krb5_c_keylength): mit changed the api,
338 deal.
339
3402006-11-13 Love Hörnquist Å
341strand <lha@it.su.se>
342
343 * lib/krb5/pac.c (fill_zeros): stop using MIN.
344
345 * kuser/kinit.c: Forward decl
346
347 * lib/krb5/test_plugin.c: Use NOTHERE.H5L.SE.
348
349 * lib/krb5/krbhst.c: Fill in hints for picky getaddrinfo()s.
350
351 * lib/krb5/test_plugin.c: Set sin_len if it exists.
352
353 * lib/krb5/krbhst.c: Use plugin for the other realm locate types
354 too.
355
3562006-11-12 Love Hörnquist Å
357strand <lha@it.su.se>
358
359 * lib/krb5/krb5_locl.h: Add plugin api
360
361 * lib/krb5/Makefile.am: Add plugin api.
362
363 * lib/krb5/krbhst.c: Use the resolve plugin interface.
364
365 * lib/krb5/locate_plugin.h: Add plugin interface for resolving
366 that is API compatible with MITs version.
367
368 * lib/krb5/plugin.c: Add first version of the plugin interface.
369
370 * lib/krb5/test_pac.c: Test signing.
371
372 * lib/krb5/pac.c: Add code to sign PACs, only arcfour for now.
373
374 * lib/krb5/krb5.h: Add struct krb5_pac.
375
3762006-11-09 Love Hörnquist Å
377strand <lha@it.su.se>
378
379 * lib/krb5/test_pac.c: PAC testing.
380
381 * lib/krb5/pac.c: Sprinkle error strings.
382
383 * lib/krb5/pac.c: Verify LOGON_NAME.
384
385 * kdc/pkinit.c (_kdc_pk_check_client): drop client_princ as an
386 argument
387
388 * kdc/kerberos5.c (_kdc_as_rep): drop client_princ from
389 _kdc_pk_check_client since its not valid in canonicalize case
390
391 * lib/krb5/krb5_c_make_checksum.3: Document krb5_c_keylength.
392
393 * lib/krb5/mit_glue.c: Add krb5_c_keylength.
394
3952006-11-08 Love Hörnquist Å
396strand <lha@it.su.se>
397
398 * lib/krb5/pac.c: Almost enough code to do PAC parsing and
399 verification, missing in the unix2NTTIME and ucs2 corner. The
400 later will be adressed by finally adding libwind.
401
402 * lib/krb5/krb5_init_context.3: document krb5_[gs]et_max_time_skew
403
404 * kdc/hpropd.c: Remove support dumping to a kerberos 4 database.
405
4062006-11-07 Love Hörnquist Å
407strand <lha@it.su.se>
408
409 * lib/krb5/context.c: rename krb5_[gs]et_time_wrap to
410 krb5_[gs]et_max_time_skew
411
412 * kdc/pkinit.c: Catch error string from hx509_cms_verify_signed.
413 Check for id-pKKdcEkuOID and warn if its not there.
414
415 * lib/krb5/rd_req.c: Add more krb5_rd_req_out_get functions.
416
4172006-11-06 Love Hörnquist Å
418strand <lha@it.su.se>
419
420 * lib/krb5/krb5.h: krb5_rd_req{,_in,_out}_ctx.
421
422 * lib/krb5/rd_req.c (krb5_rd_req_ctx): Add context all singing-all
423 dancing version of the krb5_rd_req and implement krb5_rd_req and
424 krb5_rd_req_with_keyblock using it.
425
4262006-11-04 Love Hörnquist Å
427strand <lha@it.su.se>
428
429 * kdc/kerberos5.c (_kdc_as_rep): More verbose time skew logging.
430
4312006-11-03 Love Hörnquist Å
432strand <lha@it.su.se>
433
434 * lib/krb5/expand_hostname.c: Rename various routines and
435 constants from canonize to canonicalize. From Andrew Bartlett
436
437 * lib/krb5/context.c: Add krb5_[gs]et_time_wrap
438
439 * lib/krb5/krb5_locl.h: Rename various routines and constants from
440 canonize to canonicalize. From Andrew Bartlett
441
442 * appl/gssmask/common.c (add_list): fix alloc statement.
443 From Alex Deiter
444
4452006-10-25 Love Hörnquist Å
446strand <lha@it.su.se>
447
448 * include/Makefile.am: Move version.h and version.h.in to
449 DISTCLEANFILES.
450
4512006-10-24 Love Hörnquist Å
452strand <lha@it.su.se>
453
454 * appl/gssmask/gssmask.c: Only log when there are resources left.
455
456 * appl/gssmask/gssmask.c: make compile
457
458 * appl/gssmask/gssmask.c (AcquireCreds): free
459 krb5_get_init_creds_opt
460
4612006-10-23 Love Hörnquist Å
462strand <lha@it.su.se>
463
464 * configure.in: heimdal 0.8-RC1
465
4662006-10-22 Love Hörnquist Å
467strand <lha@it.su.se>
468
469 * lib/krb5/digest.c: Try to not leak memory.
470
471 * kdc/digest.c: Try to not leak memory.
472
473 * Makefile.am: remove valgrind target, it doesn't belong here.
474
475 * kuser/kinit.c: Try to not leak memory.
476
477 * kuser/kgetcred.c: Try to not leak memory.
478
479 * kdc/krb5tgs.c (check_KRB5SignedPath): free KRB5SignedPath on
480 successful completion too, not just the error cases.
481
482 * fix-export: Make make fix-export less verbose.
483
484 * kuser/kgetcred.c: Try to not leak memory.
485
486 * lib/hdb/keys.c (hdb_generate_key_set): free list of enctype when
487 done.
488
489 * lib/krb5/crypto.c: Allocate the memory we later use.
490
491 * lib/krb5/test_princ.c: Try to not leak memory.
492
493 * lib/krb5/test_crypto_wrapping.c: Try to not leak memory.
494
495 * lib/krb5/test_cc.c: Try to not leak memory.
496
497 * lib/krb5/addr_families.c (arange_free): Try to not leak memory.
498
499 * lib/krb5/crypto.c (AES_string_to_key): Try to not leak memory.
500
5012006-10-21 Love Hörnquist Å
502strand <lha@it.su.se>
503
504 * tools/heimdal-build.sh: Add --test-environment
505
506 * tools/heimdal-build.sh: Add --ccache-dir
507
508 * lib/hdb/Makefile.am: remove dependency on et files covert_db
509 that now is removed
510
5112006-10-20 Love Hörnquist Å
512strand <lha@it.su.se>
513
514 * include/Makefile.am: add gssapi to subdirs
515
516 * lib/hdb/hdb-ldap.c: Make compile.
517
518 * configure.in: add include/gssapi/Makefile.
519
520 * include/Makefile.am: clean more files
521
522 * include/make_crypto.c: Avoid creating a file called --version.
523
524 * include/bits.c: Avoid creating a file called --version.
525
526 * appl/test/Makefile.am: add nt_gss_common.h
527
528 * doc/Makefile.am: Disable TEXI2DVI for now.
529
530 * tools/Makefile.am: more files
531
532 * lib/krb5/context.c (krb5_free_context): free send_to_kdc context
533
534 * doc/heimdal.texi: Put Heimdal in the dircategory Security.
535
536 * lib/krb5/send_to_kdc.c: Add sent_to_kdc hook, from Andrew
537 Bartlet.
538
539 * lib/krb5/krb5_locl.h: Add send_to_kdc hook.
540
541 * lib/krb5/krb5.h: Add krb5_send_to_kdc_func prototype.
542
543 * kcm/Makefile.am: more files
544
545 * kdc/Makefile.am: more files
546
547 * lib/hdb/Makefile.am: more files
548
549 * lib/krb5/Makefile.am: add more files
550
5512006-10-19 Love Hörnquist Å
552strand <lha@it.su.se>
553
554 * tools/Makefile.am: Add heimdal-build.sh to EXTRA_DIST.
555
556 * configure.in: Don't check for timegm, libroken provides it for
557 us.
558
559 * lib/krb5/acache.c: Does function typecasts instead of void *
560 type-casts.
561
562 * lib/krb5/krb5.h: Remove bonus , that Love sneeked in.
563
564 * configure.in: make --disable-pk-init help text also negative
565
5662006-10-18 Love Hörnquist Å
567strand <lha@it.su.se>
568
569 * kuser/kgetcred.c: Avoid memory leak.
570
571 * tools/heimdal-build.sh: Add more verbose logging, add version of
572 script and heimdal to the mail.
573
574 * lib/hdb/db3.c: Wrap function call pointer calls in (*func) to
575 avoid macros rewriting open and close.
576
577 * lib/krb5/Makefile.am: Add test_princ.
578
579 * lib/krb5/principal.c: More error strings, handle realm-less
580 printing.
581
582 * lib/krb5/test_princ.c: Test principal parsing and unparsing.
583
5842006-10-17 Love Hörnquist Å
585strand <lha@it.su.se>
586
587 * lib/krb5/get_host_realm.c (krb5_get_host_realm): make sure we
588 don't recurse
589
590 * lib/krb5/get_host_realm.c (krb5_get_host_realm): no components
591 -> no dns. no mapping, try local realm and hope KDC knows better.
592
593 * lib/krb5/krb5.h: Add flags for krb5_unparse_name_flags
594
595 * lib/krb5/krb5_principal.3: Document
596 krb5_unparse_name{_fixed,}_flags.
597
598 * lib/krb5/principal.c: Add krb5_unparse_name_flags and
599 krb5_unparse_name_fixed_flags.
600
601 * lib/krb5/krb5_principal.3: Document krb5_parse_name_flags.
602
603 * lib/krb5/principal.c: Add krb5_parse_name_flags.
604
605 * lib/krb5/principal.c: Add krb5_parse_name_flags.
606
607 * lib/krb5/krb5.h: Add krb5_parse_name_flags flags.
608
609 * lib/krb5/krb5_locl.h: Hide krb5_context_data from public
610 exposure.
611
612 * lib/krb5/krb5.h: Hide krb5_context_data from public exposure.
613
614 * kuser/klist.c: Use krb5_get_kdc_sec_offset.
615
616 * lib/krb5/context.c: Document krb5_get_kdc_sec_offset()
617
618 * lib/krb5/krb5_init_context.3: Add krb5_get_kdc_sec_offset()
619
620 * lib/krb5/krb5_init_context.3: Add krb5_set_dns_canonize_hostname
621 and krb5_get_dns_canonize_hostname
622
623 * lib/krb5/verify_krb5_conf.c:
624 add [libdefaults]dns_canonize_hostname
625
626 * lib/krb5/expand_hostname.c: use dns_canonize_hostname to
627 determin if we should talk to dns to find the canonical name of
628 the host.
629
630 * lib/krb5/krb5.h (krb5_context): add dns_canonize_hostname.
631
632 * tools/heimdal-build.sh: Set status.
633
634 * appl/gssmask/gssmask.c: handle more bits
635
636 * kdc/kerberos5.c: Prefix asn1 primitives with der_.
637
6382006-10-16 Love Hörnquist Å
639strand <lha@it.su.se>
640
641 * fix-export: Build lib/asn1/der-protos.h.
642
6432006-10-14 Love Hörnquist Å
644strand <lha@it.su.se>
645
646 * appl/gssmask/Makefile.am: Add explit depenency on libroken.
647
648 * kdc/krb5tgs.c: Prefix der primitives with der_.
649
650 * kdc/pkinit.c: Prefix der primitives with der_.
651
652 * lib/hdb/ext.c: Prefix der primitives with der_.
653
654 * lib/hdb/ext.c: Prefix der primitives with der_.
655
656 * lib/krb5/crypto.c: Remove workaround from when there wasn't
657 always aes.
658
659 * lib/krb5/ticket.c: Prefix der primitives with der_.
660
661 * lib/krb5/digest.c: Prefix der primitives with der_.
662
663 * lib/krb5/crypto.c: Prefix der primitives with der_.
664
665 * lib/krb5/data.c: Prefix der primitives with der_.
666
6672006-10-12 Love Hörnquist Å
668strand <lha@it.su.se>
669
670 * kdc/pkinit.c (pk_mk_pa_reply_enckey): add missing break. From
671 Olga Kornievskaia.
672
673 * kdc/kdc.8: document max-kdc-datagram-reply-length
674
675 * include/bits.c: Include Xint64 types.
676
6772006-10-10 Love Hörnquist Å
678strand <lha@it.su.se>
679
680 * tools/heimdal-build.sh: Add socketwrapper and cputime limit.
681
682 * kdc/connect.c (loop): Log that the kdc have started.
683
6842006-10-09 Love Hörnquist Å
685strand <lha@it.su.se>
686
687 * kdc/connect.c (do_request): tell krb5_kdc_process_request if its
688 a datagram reply or not
689
690 * kdc/kerberos5.c: Reply KRB5KRB_ERR_RESPONSE_TOO_BIG error if its
691 a datagram reply and the datagram reply length limit is reached.
692
693 * kdc/process.c: Rename krb5_kdc_process_generic_request to
694 krb5_kdc_process_request Add datagram_reply argument.
695
696 * kdc/config.c: check for [kdc]max-kdc-datagram-reply-length
697
698 * kdc/kdc.h (krb5_kdc_config): Add max_datagram_reply_length.
699
700 * lib/hdb/keytab.c: Change || to |, From metze.
701
702 * lib/hdb/keytab.c: Add back :file to sample format.
703
704 * lib/hdb/keytab.c: Add more HDB_F flags to hdb_fetch. Pointed out
705 by Andrew Bartlet.
706
707 * kdc/krb5tgs.c (tgs_parse_request): set cusec, not csec from
708 auth->cusec.
709
7102006-10-08 Love Hörnquist Å
711strand <lha@it.su.se>
712
713 * fix-export: dist_-ify libkadm5clnt_la_SOURCES too
714
715 * doc/heimdal.texi: Update (c) years.
716
717 * appl/gssmask/protocol.h: Clarify protocol.
718
719 * kdc/hpropd.c: Adapt to signature change of
720 _krb5_principalname2krb5_principal.
721
722 * kdc/kerberos4.c: Adapt to signature change of
723 _krb5_principalname2krb5_principal.
724
725 * kdc/connect.c (handle_vanilla_tcp): shorten length when we
726 shorten the buffer, this matter im the PK-INIT encKey case where a
727 checksum is done over the whole packet. Reported by Olga
728 Kornievskaia
729
7302006-10-07 Love Hörnquist Å
731strand <lha@it.su.se>
732
733 * include/Makefile.am: crypto-headers.h is a nodist header
734
735 * lib/krb5/aes-test.c: Make argument to PKCS5_PBKDF2_HMAC_SHA1
736 unsigned char to make OpenSSL happy.
737
738 * appl/kf/Makefile.am: Add man_MANS to EXTRA_DIST
739
740 * kuser/Makefile.am: split build files into dist_ and noinst_
741 SOURCES
742
743 * lib/hdb/Makefile.am: split build files into dist_ and noinst_
744 SOURCES
745
746 * lib/krb5/Makefile.am: split build files into dist_ and noinst_
747 SOURCES
748
749 * kdc/kerberos5.c: Adapt to signature change of
750 _krb5_principalname2krb5_principal.
751
7522006-10-06 Love Hörnquist Å
753strand <lha@it.su.se>
754
755 * lib/krb5/krbhst.c (common_init): don't try DNS when there is
756 realm w/o a dot.
757
758 * kdc/524.c: Adapt to signature change of
759 _krb5_principalname2krb5_principal.
760
761 * kdc/krb5tgs.c: Adapt to signature change of
762 _krb5_principalname2krb5_principal.
763
764 * lib/krb5/get_in_tkt.c: Adapt to signature change of
765 _krb5_principalname2krb5_principal.
766
767 * lib/krb5/rd_cred.c: Adapt to signature change of
768 _krb5_principalname2krb5_principal.
769
770 * lib/krb5/rd_req.c: Adapt to signature change of
771 _krb5_principalname2krb5_principal.
772
773 * lib/krb5/asn1_glue.c (_krb5_principalname2krb5_principal): add
774 krb5_context to signature.
775
776 * kdc/524.c (_krb5_principalname2krb5_principal): adapt to
777 signature change
778
779 * lib/hdb/keytab.c (hdb_get_entry): close and destroy the database
780 later, the hdb_entry_ex might still contain links to the database
781 that it expects to use.
782
783 * kdc/digest.c: Make digest argument o MD5_final unsigned char to
784 help OpenSSL.
785
786 * kuser/kdigest.c: Make digest argument o MD5_final unsigned char
787 to help OpenSSL.
788
789 * appl/gssmask/common.h: Maybe include <sys/wait.h>.
790
7912006-10-05 Love Hörnquist Å
792strand <lha@it.su.se>
793
794 * appl/gssmask/common.h: disable ENABLE_PTHREAD_SUPPORT and
795 explain why
796
797 * tools/heimdal-build.sh: Another mail header.
798
799 * tools/heimdal-build.sh: small fixes
800
801 * fix-export: More liberal parsing of AC_INIT
802
803 * tools/heimdal-build.sh: first cut
804
8052006-10-04 Love Hörnquist Å
806strand <lha@it.su.se>
807
808 * configure.in: Call AB_INIT.
809
810 * kuser/kinit.c: Add flag --pk-use-enckey.
811
812 * kdc/pkinit.c: Sign the request in the encKey case. Bug reported
813 by Olga Kornievskaia of Umich.
814
815 * lib/krb5/Makefile.am: man_MANS += krb5_digest.3
816
817 * lib/krb5/krb5_digest.3: Add all protos
818
8192006-10-03 Love Hörnquist Å
820strand <lha@it.su.se>
821
822 * lib/krb5/krb5_digest.3: Basic krb5_digest manpage.
823
8242006-10-02 Love Hörnquist Å
825strand <lha@it.su.se>
826
827 * fix-export: build gssapi mech private files
828
829 * lib/krb5/init_creds_pw.c: minimize layering and remove
830 krb5_kdc_flags
831
832 * lib/krb5/get_in_tkt.c: Always use the kdc_flags in the right bit
833 order.
834
835 * lib/krb5/init_creds_pw.c: Always use the kdc_flags in the right
836 bit order.
837
838 * kuser/kdigest.c: Don't require --kerberos-realm.
839
840 * lib/krb5/digest.c (digest_request): if NULL is passed in as
841 realm, use default realm.
842
843 * fix-export: build gssapi mech private files
844
8452006-09-26 Love Hörnquist Å
846strand <lha@it.su.se>
847
848 * appl/gssmask/gssmaestro.c: Handle FIRST_CALL in the context
849 building, better error handling.
850
851 * appl/gssmask/gssmaestro.c: switch from wrap/unwrap to
852 encrypt/decrypt
853
854 * appl/gssmask/gssmask.c: Don't announce spn if there is none.
855
856 * appl/gssmask/gssmaestro.c: Check that the pre-wrapped data is
857 the same as afterward.
858
8592006-09-25 Love Hörnquist Å
860strand <lha@it.su.se>
861
862 * appl/gssmask/gssmaestro.c: Remove stray GSS_C_DCE_STYLE.
863
864 * appl/gssmask/gssmaestro.c: Add logsocket support.
865
8662006-09-22 Love Hörnquist Å
867strand <lha@it.su.se>
868
869 * appl/gssmask/gssmaestro.c (build_context): print the step the
870 context exchange.
871
8722006-09-21 Love Hörnquist Å
873strand <lha@it.su.se>
874
875 * appl/gssmask/gssmaestro.c: Add GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG
876 to all context flags
877
878 * appl/gssmask/gssmaestro.c: Add wrap and mic tests for all
879 elements
880
881 * appl/gssmask/gssmask.c: Add mic tests
882
883 * appl/gssmask/gssmaestro.c: dont exit early then when context
884 is half built.
885
886 * lib/krb5/rd_req.c: disable ETypeList parsing usage for now, cfx
887 seems broken and its not good to upgrade to a broken enctype.
888
8892006-09-20 Love Hörnquist Å
890strand <lha@it.su.se>
891
892 * appl/gssmask/gssmask.c: Add wrap/unwrap ops
893
894 * appl/gssmask/protocol.h: Add eGetVersionAndCapabilities flags
895
896 * appl/gssmask/common.c: Add permutate_all (and support
897 functions).
898
899 * appl/gssmask/common.h: Add permutate_all
900
901 * appl/gssmask/gssmask.c: use new flags, return moniker
902
903 * appl/gssmask/gssmaestro.c: test self context building and all
904 permutation of clients
905
9062006-09-19 Love Hörnquist Å
907strand <lha@it.su.se>
908
909 * appl/gssmask/gssmask.c: add --logfile option, use htons() on
910 port number
911
912 * appl/gssmask/gssmaestro.c: Log port in connection message.
913
914 * configure.in: Make pk-init turned on by default.
915
9162006-09-18 Love Hörnquist Å
917strand <lha@it.su.se>
918
919 * fix-export: Build lib/hx509/{hx509-protos.h,hx509-private.h}.
920
921 * kuser/Makefile.am: Add tool for printing tickets.
922
923 * kuser/kimpersonate.1: Add tool for printing tickets.
924
925 * kuser/kimpersonate.c: Add tool for printing tickets.
926
927 * kdc/krb5tgs.c: Check the adtkt in the constrained delegation
928 case too.
929
9302006-09-16 Love Hörnquist Å
931strand <lha@it.su.se>
932
933 * kdc/main.c (sigterm): don't _exit, let loop() catch the signal
934 instead.
935
936 * lib/krb5/krb5_timeofday.3: Fixes from Björn Sandell.
937
938 * lib/krb5/krb5_get_init_creds.3: Fixes from Björn Sandell.
939
9402006-09-15 Love Hörnquist Å
941strand <lha@it.su.se>
942
943 * tools/krb5-config.in: Add "kafs" option.
944
9452006-09-12 Love Hörnquist Å
946strand <lha@it.su.se>
947
948 * lib/hdb/db.c: By using full function calling conversion (*func)
949 we avoid problem when close(fd) is overridden using a macro.
950
951 * lib/krb5/cache.c: By using full function calling
952 conversion (*func) we avoid problem when close(fd) is overridden
953 using a macro.
954
9552006-09-11 Love Hörnquist Å
956strand <lha@it.su.se>
957
958 * kdc/kerberos5.c: Signing outgoing tickets.
959
960 * kdc/krb5tgs.c: Add signing and checking of tickets to s4u2self
961 works securely.
962
963 * lib/krb5/pkinit.c: Adapt to new signature of
964 hx509_cms_unenvelope.
965
9662006-09-09 Love Hörnquist Å
967strand <lha@it.su.se>
968
969 * lib/krb5/pkinit.c (pk_verify_host): set errorstrings in a
970 sensable way
971
9722006-09-08 Love Hörnquist Å
973strand <lha@it.su.se>
974
975 * lib/krb5/krb5_init_context.3: Prevent a font generation warning,
976 from Jason McIntyre.
977
9782006-09-06 Love Hörnquist Å
979strand <lha@it.su.se>
980
981 * lib/krb5/context.c (krb5_init_ets): Add the hx errortable
982
983 * lib/krb5/krb5_locl.h: Include hx509_err.h.
984
985 * lib/krb5/pkinit.c (_krb5_pk_verify_sign): catch the error string
986 from the hx509 lib
987
9882006-09-04 Love Hörnquist Å
989strand <lha@it.su.se>
990
991 * lib/krb5/init_creds.c (krb5_get_init_creds_opt_set_default_flags):
992 fix argument to krb5_get_init_creds_opt_set_addressless.
993
994 * lib/krb5/init_creds_pw.c (init_cred_loop): try to catch the
995 error when we actually have an error to catch.
996
997 * lib/krb5/init_creds_pw.c: Remove debug printfs.
998
999 * kuser/kinit.c: Remove debug printf
1000
1001 * lib/krb5/krb5_get_init_creds.3: Document
1002 krb5_get_init_creds_opt_set_addressless.
1003
1004 * kuser/kinit.c: Use new function
1005 krb5_get_init_creds_opt_set_addressless.
1006
1007 * lib/krb5/krb5_locl.h: use new addressless, convert pa-pac option
1008 to use the same tri-state option as the new addressless option.
1009
1010 * lib/krb5/init_creds_pw.c: use new addressless, convert pa-pac
1011 option to use the same tri-state option as the new addressless
1012 option.
1013
1014 * lib/krb5/init_creds.c (krb5_get_init_creds_opt_set_addressless):
1015 used to control the address-lessness of the initial tickets
1016 instead of passing in the empty set of address into
1017 krb5_get_init_creds_opt_set_addresses.
1018
10192006-09-01 Love Hörnquist Å
1020strand <lha@it.su.se>
1021
1022 * kuser/kinit.c (renew_validate): inherit the proxiable and
1023 forwardable from the orignal ticket, pointed out by Bernard
1024 Antoine of CERN.
1025
1026 * doc/setup.texi: More text about the acl_file entry and
1027 hdb-ldap-structural-object. From RÃŒdiger Ranft.
1028
1029 * lib/krb5/krbhst.c (fallback_get_hosts): limit the fallback
1030 lookups to 5. Patch from Wesley Craig, umich.edu
1031
1032 * configure.in: Add special tests for <sys/ucred.h>, include test
1033 for sys/param.h and sys/types.h
1034
1035 * appl/test/tcp_server.c (proto): use keytab for krb5_recvauth
1036 Patch from Ingemar Nilsson <init@pdc.kth.se>
1037
10382006-08-28 Love Hörnquist Å
1039strand <lha@it.su.se>
1040
1041 * kuser/kdigest.c (help): use sl_slc_help().
1042
1043 * kdc/digest.c: Catch more error, add SASL DIGEST MD5.
1044
1045 * lib/krb5/digest.c: Catch more error.
1046
10472006-08-25 Love Hörnquist Å
1048strand <lha@it.su.se>
1049
1050 * doc/setup.texi: language.
1051
1052 * doc/heimdal.texi: Add last updated text.
1053
1054 * doc/heimdal.css: make box around heimdal title
1055
1056 * doc/heimdal.css: Inital Heimdal css for the info manual
1057
1058 * lib/krb5/digest.c: In the case where we get a DigestError back,
1059 save the error string and code.
1060
10612006-08-24 Love Hörnquist Å
1062strand <lha@it.su.se>
1063
1064 * kdc/kerberos5.c: Remove _kdc_find_etype(), its no longer used.
1065
1066 * kdc/digest.c: Remove local error label and have just one exit
1067 label, set error strings properly.
1068
1069 * kdc/digest.c: Simply the disabled-service case. Check the
1070 allow-digest flag in the HDB entry for the client.
1071
1072 * kdc/process.c (krb5_kdc_process_generic_request): check if we
1073 got a digest request and process it.
1074
1075 * kdc/main.c: Register hdb keytab operations.
1076
1077 * kdc/kdc.8: document [kdc]enable-digest=boolean
1078
1079 * kdc/Makefile.am: add digest to libkdc
1080
1081 * kdc/digest.c: Make a return a goto to avoid freeing un-inited
1082 memory in cleanup code.
1083
1084 * kdc/default_config.c (krb5_kdc_default_config): default to all
1085 bits set to zero.
1086
1087 * kdc/kdc.h (krb5_kdc_configuration): Add enable_digest
1088
1089 * kdc/headers.h: Include <digest_asn1.h>.
1090
1091 * lib/krb5/context.c (krb5_kerberos_enctypes): new function,
1092 returns the list of Kerberos encryption types sorted in order of
1093 most preferred to least preferred encryption type.
1094
1095 * kdc/misc.c (_kdc_get_preferred_key): new function, Use the order
1096 list of preferred encryption types and sort the available keys and
1097 return the most preferred key.
1098
1099 * kdc/krb5tgs.c: Adapt to the new sigature of _kdc_find_keys().
1100
1101 * kdc/kerberos5.c: Handle session key etype separately from the
1102 tgt etype, now the krbtgt can be a aes-only key without the need
1103 to support not-as-good etypes for the krbtgt.
1104
11052006-08-23 Love Hörnquist Å
1106strand <lha@it.su.se>
1107
1108 * kdc/misc.c: Change _kdc_db_fetch() to return the database
1109 pointer to if needed by the consumer.
1110
1111 * kdc/krb5tgs.c: Change _kdc_db_fetch() to return the database
1112 pointer to if needed by the consumer.
1113
1114 * kdc/kerberos5.c: Change _kdc_db_fetch() to return the database
1115 pointer to if needed by the consumer.
1116
1117 * kdc/kerberos4.c: Change _kdc_db_fetch() to return the database
1118 pointer to if needed by the consumer.
1119
1120 * kdc/kaserver.c: Change _kdc_db_fetch() to return the database
1121 pointer to if needed by the consumer.
1122
1123 * kdc/524.c: Change _kdc_db_fetch() to return the database pointer
1124 to if needed by the consumer.
1125
1126 * kuser/kdigest-commands.in: Add --kerberos-realm, add client
1127 request command.
1128
1129 * lib/krb5/Makefile.am: digest.c
1130
1131 * lib/krb5/krb5.h: Add digest glue.
1132
1133 * lib/krb5/digest.c (krb5_digest_set_authentication_user): use
1134 krb5_principal
1135
1136 * lib/krb5/digest.c: Add digest support to the client side.
1137
11382006-08-21 Love Hörnquist Å
1139strand <lha@it.kth.se>
1140
1141 * lib/krb5/rd_rep.c (krb5_rd_rep): free krb5_ap_rep_enc_part on
1142 error and set return pointer to NULL
1143 (krb5_free_ap_rep_enc_part): permit freeing of NULL
1144
11452006-08-18 Love Hörnquist Å
1146strand <lha@it.kth.se>
1147
1148 * kdc/{Makefile.am,kdigest.c,kdigest-commands.in}:
1149 Frontend for remote digest service in KDC
1150
1151 * lib/krb5/krb5_storage.3: Document krb5_{ret,store}_stringnl
1152 functions.
1153
1154 * lib/krb5/store.c: Add krb5_{ret,store}_stringnl functions,
1155 stores/retrieves a \n terminated string.
1156
1157 * lib/krb5/krb5_locl.h: Default to address-less tickets.
1158
1159 * lib/krb5/init_creds.c (krb5_get_init_creds_opt_get_error): clear
1160 error string on error.
1161
11622006-07-20 Love Hörnquist Å
1163strand <lha@it.su.se>
1164
1165 * lib/krb5/crypto.c: remove aes-192 (CMS)
1166
1167 * lib/krb5/crypto.c: Remove more CMS bits.
1168
1169 * lib/krb5/crypto.c: Remove CMS symmetric encryption support.
1170
11712006-07-13 Love Hörnquist Å
1172strand <lha@it.su.se>
1173
1174 * kdc/pkinit.c (_kdc_pk_check_client): make it not crash when
1175 there are no acl
1176
1177 * kdc/pkinit.c (_kdc_pk_check_client): use the acl in the kerberos
1178 database
1179
1180 * lib/hdb/hdb.asn1: Rename HDB-Ext-PKINIT-certificate to
1181 HDB-Ext-PKINIT-hash. Add trust anchor to HDB-Ext-PKINIT-acl.
1182
1183 * lib/hdb/Makefile.am: rename asn1_HDB_Ext_PKINIT_certificate to
1184 asn1_HDB_Ext_PKINIT_hash
1185
1186 * lib/hdb/ext.c: Add hdb_entry_get_pkinit_hash().
1187
11882006-07-10 Love Hörnquist Å
1189strand <lha@it.su.se>
1190
1191 * kuser/kinit.c: If --password-file gets STDIN, read the password
1192 from the standard input.
1193
1194 * kuser/kinit.1: Document --password-file=STDIN.
1195
1196 * lib/krb5/krb5_string_to_key.3: Remove duplicate to.
1197
11982006-07-06 Love Hörnquist Å
1199strand <lha@it.su.se>
1200
1201 * kdc/krb5tgs.c: (tgs_build_reply): when checking for removed
1202 principals, check the second component of the krbtgt, otherwise
1203 cross realm wont work. Prompted by report from Mattias Amnefelt.
1204
12052006-07-05 Love Hörnquist Å
1206strand <lha@it.su.se>
1207
1208 * kdc/connect.c (handle_vanilla_tcp): use unsigned integer for for
1209 length
1210 (handle_tcp): if the high bit it set in the unknown case, send
1211 back a KRB_ERR_FIELD_TOOLONG
1212
12132006-07-03 Love Hörnquist Å
1214strand <lha@it.su.se>
1215
1216 * appl/gssmask/gssmaestro.c: Add get_version_capa, cache
1217 target_name.
1218
1219 * appl/gssmask/gssmask.c: use utname() to find the local hostname
1220 and version of operatingsystem
1221
1222 * appl/gssmask/common.h: include <sys/utsname.h>
1223
1224 * appl/gssmask/gssmask.c: break out creation of a client and make
1225 handleServer pthread_create compatible
1226
1227 * appl/gssmask/gssmaestro.c: break out out the build context
1228 function
1229
12302006-07-01 Love Hörnquist Å
1231strand <lha@it.su.se>
1232
1233 * appl/gssmask/gssmaestro.c: externalize slave handling, add
1234 GetTargetName glue
1235
1236 * appl/gssmask/gssmaestro.c: externalize principal/password handling
1237
1238 * lib/krb5/principal.c (krb5_parse_name): set *principal to NULL
1239 the first thing we do, so that on failure its set to a known value
1240
1241 * appl/gssmask/gssmask.c: AcquireCreds: set principal to NULL to
1242 avoid memory corruption GetTargetName: always send a string, even
1243 though we don't have a targetname
1244
1245 * appl/gssmask: break out common function; add gssmaestro (that
1246 only tests one context for now)
1247
12482006-06-30 Love Hörnquist Å
1249strand <lha@it.su.se>
1250
1251 * lib/krb5/store_fd.c (krb5_storage_from_fd): don't leak fd on
1252 malloc failure
1253
1254 * appl/gssmask/gssmask.c: split out fetching of credentials for
1255 easier reuse for pk-init testing
1256
1257 * appl/gssmask: maggot replacement, handles context testing
1258
1259 * lib/krb5/cache.c (krb5_cc_new_unique): use KRB5_DEFAULT_CCNAME
1260 as the default prefix
1261
12622006-06-28 Love Hörnquist Å
1263strand <lha@it.su.se>
1264
1265 * doc/heimdal.texi: Add Doug Rabson's license
1266
12672006-06-22 Love Hörnquist Å
1268strand <lha@it.su.se>
1269
1270 * lib/krb5/init_creds.c: Add storing and getting KRB-ERROR in the
1271 krb5_get_init_creds_opt structure.
1272
1273 * lib/krb5/init_creds_pw.c: Save KRB-ERROR on error.
1274
1275 * lib/krb5/krb5_locl.h (_krb5_get_init_creds_opt_private): add
1276 KRB-ERROR
1277
12782006-06-21 Love Hörnquist Å
1279strand <lha@it.su.se>
1280
1281 * doc/setup.texi: section about verify_krb5_conf and kadmin check
1282
12832006-06-15 Love Hörnquist Å
1284strand <lha@it.su.se>
1285
1286 * lib/krb5/init_creds_pw.c (get_init_creds_common): drop cred
1287 argument, its unused
1288
1289 * lib/krb5/Makefile.am: install krb5_get_creds.3
1290
1291 * lib/krb5/krb5_get_creds.3: new file
1292
12932006-06-14 Love Hörnquist Å
1294strand <lha@it.su.se>
1295
1296 * lib/hdb/hdb-ldap.c: don't use the sambaNTPassword if there is
1297 ARCFOUR key already. Idea from Andreas Hasenack. While here, set
1298 pw change time using sambaPwdLastSet
1299
1300 * kdc/kerberos4.c: Use enable_v4_per_principal and check the new
1301 hdb flag.
1302
1303 * kdc/kdc.h: Add enable_v4_per_principal
1304
13052006-06-12 Love Hörnquist Å
1306strand <lha@it.su.se>
1307
1308 * kdc/kerberos5.c (_kdc_as_rep): if kdc_time +
1309 config->kdc_warn_pwexpire is past pw_end, add expiration
1310 message. From Bernard Antoine.
1311
1312 * kdc/default_config.c (krb5_kdc_default_config): set
1313 kdc_warn_pwexpire to 0
1314
1315 * kdc/kerberos5.c: indent.
1316
13172006-06-07 Love Hörnquist Å
1318strand <lha@it.su.se>
1319
1320 * kdc/kerberos5.c: constify
1321
13222006-06-06 Love Hörnquist Å
1323strand <lha@it.su.se>
1324
1325 * lib/krb5/get_cred.c: Allow setting additional tickets in the
1326 tgs-req
1327
1328 * kuser/kgetcred.c: add --delegation-credential-cache
1329
1330 * kdc/krb5tgs.c (tgs_build_reply): add constrained delegation.
1331
1332 * kdc/krb5tgs.c: Add impersonation.
1333
1334 * kuser/kgetcred.c: use new krb5_get_creds interface, add
1335 impersonation.
1336
1337 * lib/krb5/get_cred.c (krb5_get_creds): add
1338 KRB5_GC_NO_TRANSIT_CHECK
1339
1340 * lib/krb5/misc.c: Add impersonate support functions.
1341
1342 * lib/krb5/get_cred.c: Add impersonate and new krb5_get_creds interface.
1343
1344 * lib/hdb/hdb.asn1 (HDBFlags): add trusted-for-delegation
1345
1346 * lib/krb5/krb5.h: Add krb5_get_creds_opt_data and some more
1347 KRB5_GC flags.
1348
13492006-06-01 Love Hörnquist Å
1350strand <lha@it.su.se>
1351
1352 * lib/hdb/ext.c (hdb_entry_get_ConstrainedDelegACL): new function.
1353
1354 * lib/krb5/pkinit.c: Avoid more shadowing.
1355
1356 * kdc/connect.c (do_request): clean reply with krb5_data_zero
1357
1358 * kdc/krb5tgs.c: Split up the reverse cross krbtgt check and local
1359 clien must exists test.
1360
1361 * kdc/krb5tgs.c: Plug old memory leaks, unify all goto's.
1362
1363 * kdc/krb5tgs.c: Split tgs_rep2 into tgs_parse_request and
1364 tgs_build_reply.
1365
1366 * kdc/kerberos5.c: split out krb5 tgs req to make it easier to
1367 reorganize the code.
1368
13692006-05-29 Love Hörnquist Å
1370strand <lha@it.su.se>
1371
1372 * lib/krb5/krb5_get_init_creds.3: spelling Björn Sandell
1373
1374 * lib/krb5/krb5_get_in_cred.3: spelling Björn Sandell
1375
13762006-05-13 Love Hörnquist Å
1377strand <lha@it.su.se>
1378
1379 * kpasswd/kpasswdd.c (change): select the realm based on the
1380 target principal From Gabor Gombas
1381
1382 * lib/krb5/krb5_get_init_creds.3: Add KRB5_PROMPT_TYPE_INFO
1383
1384 * lib/krb5/krb5.h: Add KRB5_PROMPT_TYPE_INFO
1385
13862006-05-12 Love Hörnquist Å
1387strand <lha@it.su.se>
1388
1389 * lib/krb5/pkinit.c: Hidden field of hx509 prompter is removed.
1390 Fix a warning.
1391
1392 * doc/setup.texi: Point to more examples, hint that you have to
1393 use openssl 0.9.8a or later.
1394
1395 * doc/setup.texi: DIR now handles both PEM and DER.
1396
1397 * kuser/kinit.c: Pass down prompter and password to
1398 krb5_get_init_creds_opt_set_pkinit.
1399
1400 * lib/krb5/pkinit.c (_krb5_pk_load_id): only use password if its
1401 longer then 0
1402
1403 * doc/ack.texi: Add Jason McIntyre.
1404
1405 * lib/krb5/krb5_acl_match_file.3: Various tweaks, from Jason
1406 McIntyre.
1407
14082006-05-11 Love Hörnquist Å
1409strand <lha@it.su.se>
1410
1411 * kuser/kinit.c: Move parsing of the PK-INIT configuration file to
1412 the library so application doesn't need to deal with it.
1413
1414 * lib/krb5/pkinit.c (krb5_get_init_creds_opt_set_pkinit): move
1415 parsing of the configuration file to the library so application
1416 doesn't need to deal with it.
1417
1418 * lib/krb5/pkinit.c (_krb5_pk_load_id): pass the hx509_lock to
1419 when trying to read the user certificate.
1420
1421 * lib/krb5/pkinit.c (hx_pass_prompter): return 0 on success and 1
1422 on failure. Pointed out by Douglas E. Engert.
1423
14242006-05-08 Love Hörnquist Å
1425strand <lha@it.su.se>
1426
1427 * lib/krb5/crypto.c: Catches both keyed checkout w/o crypto
1428 context cases and doesn't reset the string, and corrects the
1429 grammar.
1430
1431 * lib/krb5/crypto.c: Drop aes-cbc, rc2 and CMS padding support,
1432 its all containted in libhcrypto and libhx509 now.
1433
14342006-05-07 Love Hörnquist Å
1435strand <lha@it.su.se>
1436
1437 * lib/krb5/pkinit.c (_krb5_pk_verify_sign): Use
1438 hx509_get_one_cert.
1439
1440 * lib/krb5/crypto.c (create_checksum): provide a error message
1441 that a key checksum needs a key. From Andew Bartlett.
1442
14432006-05-06 Love Hörnquist Å
1444strand <lha@it.su.se>
1445
1446 * lib/krb5/pkinit.c: Now that hcrypto supports DH, remove check
1447 for hx509 null DH.
1448
1449 * kdc/pkinit.c: Don't call DH_check_pubkey, it doesn't exists in
1450 older OpenSSL.
1451
1452 * doc/heimdal.texi: Add blob about imath.
1453
1454 * doc/ack.texi: Add blob about imath.
1455
1456 * include/make_crypto.c: Move up evp.h to please OpenSSL, from
1457 Douglas E. Engert.
1458
1459 * kcm/acl.c: Multicache kcm interation isn't done yet, let wait
1460 with this enum.
1461
14622006-05-05 Love Hörnquist Å
1463strand <lha@it.su.se>
1464
1465 * lib/krb5/krb5_set_default_realm.3: Spelling/mdoc from Björn
1466 Sandell
1467
1468 * lib/krb5/krb5_rcache.3: Spelling/mdoc from Björn Sandell
1469
1470 * lib/krb5/krb5_keytab.3: Spelling/mdoc from Björn Sandell
1471
1472 * lib/krb5/krb5_get_in_cred.3: Spelling/mdoc from Björn Sandell
1473
1474 * lib/krb5/krb5_expand_hostname.3: Spelling/mdoc from Björn
1475 Sandell
1476
1477 * lib/krb5/krb5_c_make_checksum.3: Spelling/mdoc from Björn
1478 Sandell
1479
1480 * lib/krb5/keytab_file.c (fkt_next_entry_int): read the 32 bit
1481 kvno if the reset of the data is longer then 4 bytes in hope to be
1482 forward compatible. Pointed out by Michael B Allen.
1483
1484 * doc/programming.texi: Add fileformats.
1485
1486 * appl/test: Rename u_intXX_t to uintXX_t
1487
1488 * kuser: Rename u_intXX_t to uintXX_t
1489
1490 * kdc: Rename u_intXX_t to uintXX_t
1491
1492 * lib/hdb: Rename u_intXX_t to uintXX_t
1493
1494 * lib/45]: Rename u_intXX_t to uintXX_t
1495
1496 * lib/krb5: Rename u_intXX_t to uintXX_t
1497
1498 * lib/krb5/Makefile.am: Add test_store to TESTS
1499
1500 * lib/krb5/pkinit.c: Catch using hx509 null DH and print a more
1501 useful error message.
1502
1503 * lib/krb5/store.c: Rewrite the krb5_ret_u as proposed by Johan.
1504
15052006-05-04 Love Hörnquist Å
1506strand <lha@it.su.se>
1507
1508 * kdc/kerberos4.c: Use the new unsigned integer storage types.
1509
1510 * kdc/kaserver.c: Use the new unsigned integer storage
1511 types. Sprinkle some error handling.
1512
1513 * lib/krb5/krb5_storage.3: Document ret and store function for the
1514 unsigned fixed size integer types.
1515
1516 * lib/krb5/v4_glue.c: Use the new unsigned integer storage
1517 types. Fail that the address doesn't match, not the reverse.
1518
1519 * lib/krb5/store.c: Add ret and store function for the unsigned
1520 fixed size integer types.
1521
1522 * lib/krb5/test_store.c: Test the integer storage types.
1523
15242006-05-03 Love Hörnquist Å
1525strand <lha@it.su.se>
1526
1527 * lib/krb5/store.c (krb5_store_principal): make it take a
1528 krb5_const_principal, indent
1529
1530 * lib/krb5/krb5_storage.3: krb5_store_principal takes a
1531 krb5_const_principal
1532
1533 * lib/krb5/pkinit.c: Deal with that hx509_prompt.reply is no
1534 longer a pointer.
1535
1536 * kdc/kdc.h (krb5_kdc_configuration): add pkinit_kdc_ocsp_file
1537
1538 * kdc/config.c: read [kdc]pki-kdc-ocsp
1539
15402006-05-02 Love Hörnquist Å
1541strand <lha@it.su.se>
1542
1543 * kdc/pkinit.c (_kdc_pk_mk_pa_reply): send back ocsp response if
1544 it seems to be valid, simplfy the pkinit-windows DH case (it
1545 doesn't exists).
1546
15472006-05-01 Love Hörnquist Å
1548strand <lha@it.su.se>
1549
1550 * lib/krb5/krb5_warn.3: Spelling/mdoc changes, from Björn Sandell.
1551
1552 * lib/krb5/krb5_verify_user.3: Spelling/mdoc changes, from Björn
1553 Sandell.
1554
1555 * lib/krb5/krb5_verify_init_creds.3: Spelling/mdoc changes, from
1556 Björn Sandell.
1557
1558 * lib/krb5/krb5_timeofday.3: Spelling/mdoc changes, from Björn
1559 Sandell.
1560
1561 * lib/krb5/krb5_ticket.3: Spelling/mdoc changes, from Björn
1562 Sandell.
1563
1564 * lib/krb5/krb5_rd_safe.3: Spelling/mdoc changes, from Björn
1565 Sandell.
1566
1567 * lib/krb5/krb5_rcache.3: Spelling/mdoc changes, from Björn
1568 Sandell.
1569
1570 * lib/krb5/krb5_principal.3: Spelling/mdoc changes, from Björn
1571 Sandell.
1572
1573 * lib/krb5/krb5_parse_name.3: Spelling/mdoc changes, from Björn
1574 Sandell.
1575
1576 * lib/krb5/krb5_mk_safe.3: Spelling/mdoc changes, from Björn
1577 Sandell.
1578
1579 * lib/krb5/krb5_keyblock.3: Spelling/mdoc changes, from Björn
1580 Sandell.
1581
1582 * lib/krb5/krb5_is_thread_safe.3: Spelling/mdoc changes, from
1583 Björn Sandell.
1584
1585 * lib/krb5/krb5_generate_random_block.3: Spelling/mdoc changes,
1586 from Björn Sandell.
1587
1588 * lib/krb5/krb5_generate_random_block.3: Spelling/mdoc changes,
1589 from Björn Sandell.
1590
1591 * lib/krb5/krb5_expand_hostname.3: Spelling/mdoc changes, from
1592 Björn Sandell.
1593
1594 * lib/krb5/krb5_check_transited.3: Spelling/mdoc changes, from
1595 Björn Sandell.
1596
1597 * lib/krb5/krb5_c_make_checksum.3: Spelling/mdoc changes, from
1598 Björn Sandell.
1599
1600 * lib/krb5/krb5_address.3: Spelling/mdoc changes, from
1601 Björn Sandell.
1602
1603 * lib/krb5/krb5_acl_match_file.3: Spelling/mdoc changes, from
1604 Björn Sandell.
1605
1606 * lib/krb5/krb5.3: Spelling, from Björn Sandell.
1607
1608 * doc/ack.texi: add Björn
1609
16102006-04-30 Love Hörnquist Å
1611strand <lha@it.su.se>
1612
1613 * lib/krb5/pkinit.c (cert2epi): don't include subject if its null
1614
16152006-04-29 Love Hörnquist Å
1616strand <lha@it.su.se>
1617
1618 * lib/krb5/pkinit.c: Send over what trust anchors the client have
1619 configured.
1620
1621 * lib/krb5/pkinit.c (pk_verify_host): set better error string,
1622 only check kdc name/address when we got a hostname/address passed
1623 in the the function.
1624
1625 * kdc/pkinit.c (_kdc_pk_check_client): reorganize and make log
1626 when a SAN matches.
1627
16282006-04-28 Love Hörnquist Å
1629strand <lha@it.su.se>
1630
1631 * doc/setup.texi: More options and some text about windows
1632 clients, certificate and KDCs.
1633
1634 * doc/setup.texi: notice about pki-mappings file space sensitive
1635
1636 * doc/setup.texi: Example pki-mapping file.
1637
1638 * lib/krb5/pkinit.c (pk_verify_host): verify hostname/address
1639
1640 * lib/hdb/hdb.h: Bump hdb interface version to 4.
1641
16422006-04-27 Love Hörnquist Å
1643strand <lha@it.su.se>
1644
1645 * kuser/kdestroy.1: Document --credential=principal.
1646
1647 * kdc/kerberos5.c (tgs_rep2): check that the client exists in the
1648 kerberos database if its local request.
1649
1650 * kdc/{misc.c,524.c,kaserver.c,kerberos5.c}: pass down HDB_F_GET_
1651 flags as appropriate
1652
1653 * kdc/kerberos4.c (_kdc_db_fetch4): pass down flags though
1654 krb5_425_conv_principal_ext2
1655
1656 * kdc/misc.c (_kdc_db_fetch): Break out the that we request from
1657 principal from the entry and pass it in as a seprate argument.
1658
1659 * lib/hdb/keytab.c (hdb_get_entry): Break out the that we request
1660 from principal from the entry and pass it in as a seprate
1661 argument.
1662
1663 * lib/hdb/common.c: Break out the that we request from principal
1664 from the entry and pass it in as a seprate argument.
1665
1666 * lib/hdb/hdb.h: Break out the that we request from principal from
1667 the entry and pass it in as a seprate argument. Add more flags to
1668 ->hdb_get(). Re-indent.
1669
16702006-04-26 Love Hörnquist Å
1671strand <lha@it.su.se>
1672
1673 * doc/setup.texi: document pki-allow-proxy-certificate
1674
1675 * kdc/pkinit.c: Add option [kdc]pki-allow-proxy-certificate=bool
1676 to allow using proxy certificate.
1677
1678 * lib/krb5/pkinit.c (_krb5_pk_allow_proxy_certificates): expose
1679 hx509_verify_set_proxy_certificate
1680
1681 * kdc/pkinit.c (_kdc_pk_check_client): Use
1682 hx509_cert_get_base_subject to get subject name of the
1683 certificate, needed for proxy certificates.
1684
1685 * kdc/kerberos5.c: Now that find_keys speaks for it self, remove
1686 extra logging.
1687
1688 * kdc/kerberos5.c (find_keys): add client_name and server_name
1689 argument and use them, and adapt callers.
1690
16912006-04-25 Love Hörnquist Å
1692strand <lha@it.su.se>
1693
1694 * kuser/kinit.1: document option password-file
1695
1696 * kuser/kinit.c: Add option password-file, read password from the
1697 first line of a file.
1698
1699 * configure.in: make tests/kdc/Makefile
1700
1701 * kdc/kerberos5.c: Catch the case where the client sends no
1702 encryption types or no pa-types.
1703
1704 * lib/hdb/ext.c (hdb_replace_extension): set error message on
1705 failure, not success.
1706
1707 * lib/hdb/keys.c (parse_key_set): handle error case better
1708 (hdb_generate_key_set): return better error
1709
17102006-04-24 Love Hörnquist Å
1711strand <lha@it.su.se>
1712
1713 * lib/hdb/hdb.c (hdb_create): print out what we don't support
1714
1715 * lib/krb5/principal.c: Remove a double free introduced in 1.93
1716
1717 * lib/krb5/log.c (log_file): reset pointer to freed memory
1718
1719 * lib/krb5/keytab_keyfile.c (get_cell_and_realm): reset d->cell to
1720 make sure its not refereced
1721
1722 * tools/krb5-config.in: libhcrypto might depend on libasn1, switch
1723 order
1724
1725 * lib/krb5/recvauth.c: indent
1726
1727 * doc/heimdal.texi: Add Setting up PK-INIT to Detailed Node
1728 Listing.
1729
1730 * lib/krb5/pkinit.c: Pass down realm to pk_verify_host so the
1731 function can verify the certificate is from the right realm.
1732
1733 * lib/krb5/init_creds_pw.c: Pass down realm to
1734 _krb5_pk_rd_pa_reply
1735
17362006-04-23 Love Hörnquist Å
1737strand <lha@it.su.se>
1738
1739 * lib/krb5/pkinit.c (pk_verify_host): Add begining of finding
1740 subjectAltName_otherName pk-init-san and verifing it.
1741
1742 * lib/krb5/sendauth.c: reindent
1743
1744 * doc/Makefile.am: use --no-split to make one large file, mostly
1745 for html
1746
1747 * doc/setup.texi: "document" pkinit_require_eku and
1748 pkinit_require_krbtgt_otherName
1749
1750 * lib/krb5/pkinit.c: Add pkinit_require_eku and
1751 pkinit_require_krbtgt_otherName
1752
1753 * doc/setup.texi: Add text about pk-init
1754
1755 * tools/kdc-log-analyze.pl: count v5 cross realms too
1756
17572006-04-22 Love Hörnquist Å
1758strand <lha@it.su.se>
1759
1760 * kdc/pkinit.c: Adapt to change in hx509_cms_create_signed_1.
1761
1762 * lib/krb5/pkinit.c: Adapt to change in hx509_cms_create_signed_1.
1763
17642006-04-20 Love Hörnquist Å
1765strand <lha@it.su.se>
1766
1767 * kdc/pkinit.c (_kdc_pk_rd_padata): use
1768 hx509_cms_unwrap_ContentInfo.
1769
1770 * kdc/config.c: unbreak
1771
1772 * lib/krb5/pkinit.c: Handle diffrences between libhcrypto and
1773 libcrypto.
1774
1775 * kdc/config.c: Rename pki-chain to pki-pool to match rest of
1776 code.
1777
17782006-04-12 Love Hörnquist Å
1779strand <lha@it.su.se>
1780
1781 * lib/krb5/rd_priv.c: Fix argument to krb5_data_zero.
1782
1783 * kdc/config.c: Added certificate revoke information from
1784 configuration file.
1785
1786 * kdc/pkinit.c: Added certificate revoke information.
1787
1788 * kuser/kinit.c: Added certificate revoke information from
1789 configuration file.
1790
1791 * lib/krb5/pkinit.c (_krb5_pk_load_id): Added certificate revoke
1792 information, ie CRL's
1793
17942006-04-10 Love Hörnquist Å
1795strand <lha@it.su.se>
1796
1797 * lib/krb5/replay.c (krb5_rc_resolve_full): make compile again.
1798
1799 * lib/krb5/keytab_krb4.c (krb4_kt_start_seq_get_int): make compile
1800 again.
1801
1802 * lib/krb5/transited.c (make_path): make sure we return allocated
1803 memory Coverity, NetBSD CID#1892
1804
1805 * lib/krb5/transited.c (make_path): make sure we return allocated
1806 memory Coverity, NetBSD CID#1892
1807
1808 * lib/krb5/rd_req.c (krb5_verify_authenticator_checksum): on
1809 protocol failure, avoid leaking memory Coverity, NetBSD CID#1900
1810
1811 * lib/krb5/principal.c (krb5_parse_name): remember to free realm
1812 in case of error Coverity, NetBSD CID#1883
1813
1814 * lib/krb5/principal.c (krb5_425_conv_principal_ext2): remove
1815 memory leak in case of weird formated dns replys.
1816 Coverity, NetBSD CID#1885
1817
1818 * lib/krb5/replay.c (krb5_rc_resolve_full): don't return pointer
1819 to a allocated krb5_rcache in case of error.
1820
1821 * lib/krb5/log.c (krb5_addlog_dest): free fn in case of error
1822 Coverity, NetBSD CID#1882
1823
1824 * lib/krb5/keytab_krb4.c: Fix deref before NULL check, fix error
1825 handling. Coverity, NetBSD CID#2369
1826
1827 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds):
1828 in_creds->client should always be set, assume so.
1829
1830 * lib/krb5/keytab_any.c (any_next_entry): restructure to make it
1831 easier to read Fixes Coverity, NetBSD CID#625
1832
1833 * lib/krb5/crypto.c (krb5_string_to_key_derived): deref after NULL
1834 check. Coverity NetBSD CID#2367
1835
1836 * lib/krb5/build_auth.c (krb5_build_authenticator): use
1837 calloc. removed check that was never really used. Coverity NetBSD
1838 CID#2370
1839
18402006-04-09 Love Hörnquist Å
1841strand <lha@it.su.se>
1842
1843 * lib/krb5/rd_req.c (krb5_verify_ap_req2): make sure `ticketÂŽ
1844 points to NULL in case of error, add error handling, use calloc.
1845
1846 * kpasswd/kpasswdd.c (doit): when done, close all fd in the
1847 sockets array and free it. Coverity NetBSD CID#1916
1848
18492006-04-08 Love Hörnquist Å
1850strand <lha@it.su.se>
1851
1852 * lib/krb5/store.c (krb5_ret_principal): fix memory leak Coverity,
1853 NetBSD CID#1695
1854
1855 * kdc/524.c (_kdc_do_524): Handle memory allocation failure
1856 Coverity, NetBSD CID#2752
1857
18582006-04-07 Love Hörnquist Å
1859strand <lha@it.su.se>
1860
1861 * lib/krb5/keytab_file.c (krb5_kt_ret_principal): plug a memory
1862 leak Coverity NetBSD CID#1890
1863
1864 * kdc/hprop.c (main): make sure type doesn't need to be set
1865
1866 * kdc/mit_dump.c (mit_prop_dump): close fd when done processing
1867 Coverity NetBSD CID#1955
1868
1869 * kdc/string2key.c (tokey): catch warnings, free memory after use.
1870 Based on Coverity NetBSD CID#1894
1871
1872 * kdc/hprop.c (main): remove dead code. Coverity NetBSD CID#633
1873
18742006-04-04 Love Hörnquist Å
1875strand <lha@it.su.se>
1876
1877 * kpasswd/kpasswd-generator.c (read_words): catch empty file case,
1878 will cause PBE (division by zero) later. From Tobias Stoeckmann.
1879
18802006-04-02 Love Hörnquist Å
1881strand <lha@it.su.se>
1882
1883 * lib/hdb/keytab.c: Remove a delta from last revision that should
1884 have gone in later.
1885
1886 * lib/krb5/krbhst.c: fix spelling
1887
1888 * lib/krb5/send_to_kdc.c (send_and_recv_http): don't expose freed
1889 pointer, found by IBM checker.
1890
1891 * lib/krb5/rd_cred.c (krb5_rd_cred): don't expose freed pointer,
1892 found by IBM checker.
1893
1894 * lib/krb5/addr_families.c (krb5_make_addrport): clear return
1895 value on error, found by IBM checker.
1896
1897 * kdc/kerberos5.c (check_addresses): treat netbios as no addresses
1898
1899 * kdc/{kerberos4,kaserver}.c: _kdc_check_flags takes hdb_entry_ex
1900
1901 * kdc/kerberos5.c (_kdc_check_flags): make it take hdb_entry_ex to
1902 avoid ?:'s at callers
1903
1904 * lib/krb5/v4_glue.c: Avoid using free memory, found by IBM
1905 checker.
1906
1907 * lib/krb5/transited.c (expand_realm): avoid passing NULL to
1908 strlen, found by IBM checker.
1909
1910 * lib/krb5/rd_cred.c (krb5_rd_cred): avoid a memory leak on malloc
1911 failure, found by IBM checker.
1912
1913 * lib/krb5/krbhst.c (_krb5_krbhost_info_move): replace a strcpy
1914 with a memcpy
1915
1916 * lib/krb5/keytab_keyfile.c (get_cell_and_realm): plug a memory
1917 leak, found by IBM checker.
1918
1919 * lib/krb5/keytab_file.c (fkt_next_entry_int): remove a
1920 dereferencing NULL pointer, found by IBM checker.
1921
1922 * lib/krb5/init_creds_pw.c (init_creds_init_as_req): in AS-REQ the
1923 cname must always be given, don't avoid that fact and remove a
1924 cname == NULL case. Plugs a memory leak found by IBM checker.
1925
1926 * lib/krb5/init_creds_pw.c (default_s2k_func): avoid exposing
1927 free-ed memory on error. Found by IBM checker.
1928
1929 * lib/krb5/init_creds.c (_krb5_get_init_creds_opt_copy): use
1930 calloc to avoid uninitialized memory problem.
1931
1932 * lib/krb5/data.c (krb5_copy_data): avoid exposing free-ed memory
1933 on error. Found by IBM checker.
1934
1935 * lib/krb5/fcache.c (fcc_gen_new): fix a use after free, found by
1936 IBM checker.
1937
1938 * lib/krb5/config_file.c (krb5_config_vget_strings): IBM checker
1939 thought it found a memory leak, it didn't, but there was another
1940 error in the code, lets fix that instead.
1941
1942 * lib/krb5/cache.c (_krb5_expand_default_cc_name): plug memory
1943 leak. Found by IBM checker.
1944
1945 * lib/krb5/cache.c (_krb5_expand_default_cc_name): avoid return
1946 pointer to freed memory in the error case. Found by IBM checker.
1947
1948 * lib/hdb/keytab.c (hdb_resolve): off by one, found by IBM
1949 checker.
1950
1951 * lib/hdb/keys.c (hdb_generate_key_set): set ret_key_set before
1952 going into the error clause and freeing key_set. Found by IBM
1953 checker. Make sure ret == 0 after of parse error, we catch the
1954 "no entries parsed" case later.
1955
1956 * lib/krb5/log.c (krb5_addlog_dest): make string length match
1957 strings in strcasecmp. Found by IBM checker.
1958
19592006-03-30 Love Hörnquist Å
1960strand <lha@it.su.se>
1961
1962 * lib/hdb/hdb-ldap.c (LDAP_message2entry): in declaration set
1963 variable_name as "hdb_entry_ex"
1964 (hdb_ldap_common): change "arg" in condition (if) to "search_base"
1965 (hdb_ldapi_create): change "serach_base" to "search_base" From
1966 Alex V. Labuta.
1967
1968 * lib/krb5/pkinit.c (krb5_get_init_creds_opt_set_pkinit); fix
1969 prototype
1970
1971 * kuser/kinit.c: Add pool of certificates to help certificate path
1972 building for clients sending incomplete path in the signedData.
1973
19742006-03-28 Love Hörnquist Å
1975strand <lha@it.su.se>
1976
1977 * kdc/pkinit.c: Add pool of certificates to help certificate path
1978 building for clients sending incomplete path in the signedData.
1979
1980 * lib/krb5/pkinit.c: Add pool of certificates to help certificate
1981 path building for clients sending incomplete path in the
1982 signedData.
1983
19842006-03-27 Love Hörnquist Å
1985strand <lha@it.su.se>
1986
1987 * kdc/config.c: Allow passing in related certificates used to
1988 build the chain.
1989
1990 * kdc/pkinit.c: Allow passing in related certificates used to
1991 build the chain.
1992
1993 * kdc/kerberos5.c (log_patype): Add case for
1994 KRB5_PADATA_PA_PK_OCSP_RESPONSE.
1995
1996 * tools/Makefile.am: Spelling
1997
1998 * tools/krb5-config.in: Add hx509 when using PK-INIT.
1999
2000 * tools/Makefile.am: Add hx509 when using PK-INIT.
2001
20022006-03-26 Love Hörnquist Å
2003strand <lha@it.su.se>
2004
2005 * lib/krb5/acache.c: Use ticket flags definition, might fix Mac OS
2006 X Kerberos.app problems.
2007
2008 * lib/krb5/krb5_ccapi.h: Add ticket flags definitions
2009
2010 * lib/krb5/pkinit.c: Use less openssl, spell chelling.
2011
2012 * kdc/pkinit.c (pk_mk_pa_reply_dh): encode the DH public key with
2013 asn1 wrapping
2014
2015 * configure.in (AC_CONFIG_FILES): add lib/hx509/Makefile
2016
2017 * lib/Makefile.am: Add hx509.
2018
2019 * lib/krb5/Makefile.am: Add libhx509.la when PKINIT is used.
2020
2021 * configure.in: define automake PKINIT variable
2022
2023 * kdc/pkinit.c: Switch to hx509.
2024
2025 * lib/krb5/pkinit.c: Switch to hx509.
2026
20272006-03-24 Love Hörnquist Å
2028strand <lha@it.su.se>
2029
2030 * kdc/kerberos5.c (log_patypes): log the patypes requested by the
2031 client
2032
20332006-03-23 Love Hörnquist Å
2034strand <lha@it.su.se>
2035
2036 * lib/krb5/pkinit.c (_krb5_pk_rd_pa_reply): pass down the
2037 req_buffer in the w2k case too. From Douglas E. Engert.
2038
20392006-03-19 Love Hörnquist Å
2040strand <lha@it.su.se>
2041
2042 * lib/krb5/mk_req_ext.c (_krb5_mk_req_internal): on failure, goto
2043 error handling. Fixes Coverity NetBSD CID 2591 by catching a
2044 failing krb5_copy_keyblock()
2045
20462006-03-17 Love Hörnquist Å
2047strand <lha@it.su.se>
2048
2049 * lib/krb5/addr_families.c (krb5_free_addresses): reset val,len in
2050 address when free-ing. Fixes Coverity NetBSD bug #2605
2051 (krb5_parse_address): reset val,len before possibly return errors
2052 Fixes Coverity NetBSD bug #2605
2053
20542006-03-07 Love Hörnquist Å
2055strand <lha@it.su.se>
2056
2057 * lib/krb5/send_to_kdc.c (recv_loop): it should never happen, but
2058 make sure nbytes > 0
2059
2060 * lib/krb5/get_for_creds.c (add_addrs): handle the case where
2061 addr->len == 0 and n == 0, then realloc might return NULL.
2062
2063 * lib/krb5/crypto.c (decrypt_*): handle the case where the
2064 plaintext is 0 bytes long, realloc might then return NULL.
2065
20662006-02-28 Love Hörnquist Å
2067strand <lha@it.su.se>
2068
2069 * lib/krb5/krb5_string_to_key.3: Drop krb5_string_to_key_derived.
2070
2071 * lib/krb5/krb5.3: Remove krb5_string_to_key_derived.
2072
2073 * lib/krb5/crypto.c (AES_string_to_key): drop _krb5_PKCS5_PBKDF2
2074 and use PKCS5_PBKDF2_HMAC_SHA1 instead.
2075
2076 * lib/krb5/aes-test.c: reformat, avoid free-ing un-init'd memory
2077
2078 * lib/krb5/aes-test.c: Only use PKCS5_PBKDF2_HMAC_SHA1.
2079
20802006-02-27 Johan Danielsson <joda@pdc.kth.se>
2081
2082 * doc/setup.texi: remove cartouches - we don't use them anywhere
2083 else, they should be around the example, not inside it, and
2084 probably shouldn't be used in html at all
2085
20862006-02-18 Love Hörnquist Å
2087strand <lha@it.su.se>
2088
2089 * lib/krb5/krb5_warn.3: Document that applications want to use
2090 krb5_get_error_message, add example.
2091
20922006-02-16 Love Hörnquist Å
2093strand <lha@it.su.se>
2094
2095 * lib/krb5/crypto.c (krb5_generate_random_block): check return
2096 value from RAND_bytes
2097
2098 * lib/krb5/error_string.c: Change indentation, update (c)
2099
21002006-02-14 Love Hörnquist Å
2101strand <lha@it.su.se>
2102
2103 * lib/krb5/pkinit.c: Make struct krb5_dh_moduli available when
2104 compiling w/o pkinit.
2105
21062006-02-13 Love Hörnquist Å
2107strand <lha@it.su.se>
2108
2109 * lib/krb5/pkinit.c: update to new paChecksum definition, update
2110 the dhgroup handling
2111
2112 * kdc/pkinit.c: update to new paChecksum definition, use
2113 hdb_entry_ex
2114
21152006-02-09 Love Hörnquist Å
2116strand <lha@it.su.se>
2117
2118 * lib/krb5/krb5_locl.h: Move Configurable options to last in the
2119 file.
2120
2121 * lib/krb5/krb5_locl.h: Wrap KRB5_ADDRESSLESS_DEFAULT with #ifndef
2122
21232006-02-03 Love Hörnquist Å
2124strand <lha@it.su.se>
2125
2126 * kpasswd/kpasswdd.c: Send back a better error-message to the
2127 client in case the password change was rejected.
2128
2129 * lib/krb5/krb5_warn.3: Document krb5_get_error_message.
2130
2131 * lib/krb5/error_string.c (krb5_get_error_message): new function,
2132 and combination of krb5_get_error_string and krb5_get_err_text
2133
2134 * lib/krb5/krb5.3: sort, and krb5_get_error_message
2135
2136 * lib/hdb/hdb-ldap.c: Log the filter string to the error message
2137 when doing searches.
2138
2139 * lib/krb5/init_creds.c (krb5_get_init_creds_opt_set_default_flags):
2140 Use KRB5_ADDRESSLESS_DEFAULT when
2141 checking [appdefault]no-addresses.
2142
2143 * lib/krb5/get_cred.c (get_cred_from_kdc_flags): Use
2144 KRB5_ADDRESSLESS_DEFAULT when checking
2145 [appdefault]no-addresses.
2146
2147 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds):
2148 Use [appdefault]no-addresses before checking if the krbtgt is
2149 address-less, use KRB5_ADDRESSLESS_DEFAULT.
2150
2151 * lib/krb5/krb5_locl.h: Introduce KRB5_ADDRESSLESS_DEFAULT that
2152 controlls all address-less behavior. Defaults to false.
2153
21542006-02-01 Love Hörnquist Å
2155strand <lha@it.su.se>
2156
2157 * lib/krb5/n-fold-test.c: main is not a KRB5_LIB_FUNCTION
2158
2159 * lib/krb5/mk_priv.c (krb5_mk_priv): abort if ASN1_MALLOC_ENCODE
2160 failes to produce the matching lenghts.
2161
21622006-01-27 Love Hörnquist Å
2163strand <lha@it.su.se>
2164
2165 * kcm/protocol.c (kcm_op_retrieve): remove unused variable
2166
21672006-01-15 Love Hörnquist Å
2168strand <lha@it.su.se>
2169
2170 * tools/krb5-config.in: Move depenency on @LIB_dbopen@ to
2171 kadm-server, kerberos library doesn't depend on db-library.
2172
21732006-01-13 Love Hörnquist Å
2174strand <lha@it.su.se>
2175
2176 * include/Makefile.am: Don't clean crypto headers, they now live
2177 in hcrypto/. Add hcrypto to SUBDIRS.
2178
2179 * include/hcrypto/Makefile.am: clean installed headers
2180
2181 * include/make_crypto.c: include crypto headers from hcrypto/
2182
2183 * include/make_crypto.c: Include more crypto headerfiles. Remove
2184 support for old hash names.
2185
21862006-01-02 Love Hörnquist Å
2187strand <lha@it.su.se>
2188
2189 * kdc/misc.c (_kdc_db_fetch): use calloc to allocate the entry,
2190 from Andrew Bartlet.
2191
2192 * Happy New Year.
Note: See TracBrowser for help on using the repository browser.