source: heimdal/trunk/lib/gssapi/ChangeLog@ 6

Last change on this file since 6 was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 88.4 KB
Line 
12008-08-14 Love Hornquist Astrand <lha@10a140laptop.local>
2
3 * krb5/accept_sec_context.c: If there is a initiator subkey, copy
4 that to acceptor subkey to match windows behavior. From Metze.
5
62008-08-02 Love Hörnquist Å
7strand <lha@h5l.org>
8
9 * ntlm/init_sec_context.c: Catch error
10
11 * krb5/inquire_sec_context_by_oid.c: Catch store failure.
12
13 * mech/gss_canonicalize_name.c: Not init m, return never
14 used (overwritten later).
15
162008-07-25 Love Hörnquist Å
17strand <lha@kth.se>
18
19 * ntlm/init_sec_context.c: Use krb5_cc_get_config.
20
212008-07-25 Love Hörnquist Å
22strand <lha@kth.se>
23
24 * krb5/init_sec_context.c: Match the orignal patch I got from
25 metze, seems that DCE-STYLE is even more weirer then what I though
26 when I merged the patch.
27
282008-06-02 Love Hörnquist Å
29strand <lha@kth.se>
30
31 * krb5/init_sec_context.c: Don't add asn1 wrapping to token when
32 using DCE_STYLE. Patch from Stefan Metzmacher.
33
342008-05-27 Love Hörnquist Å
35strand <lha@kth.se>
36
37 * ntlm/init_sec_context.c: use krb5_get_error_message
38
392008-05-05 Love Hörnquist Å
40strand <lha@kth.se>
41
42 * spnego/spnego_locl.h: Add back "mech/utils.h", its needed for
43 oid/buffer functions.
44
452008-05-02 Love Hörnquist Å
46strand <lha@it.su.se>
47
48 * spnego: Changes from doug barton to make spnego indepedant of
49 the heimdal version of the plugin system.
50
512008-04-27 Love Hörnquist Å
52strand <lha@it.su.se>
53
54 * krb5: use DES_set_key_unchecked()
55
562008-04-17 Love Hörnquist Å
57strand <lha@it.su.se>
58
59 * add __declspec() for windows.
60
612008-04-15 Love Hörnquist Å
62strand <lha@it.su.se>
63
64 * krb5/import_sec_context.c: Use tmp to read ac->flags value to
65 avoid warning.
66
672008-04-07 Love Hörnquist Å
68strand <lha@it.su.se>
69
70 * mech/gss_mech_switch.c: Use unsigned where appropriate.
71
722008-03-14 Love Hörnquist Å
73strand <lha@it.su.se>
74
75 * test_context.c: Add test for gsskrb5_register_acceptor_identity.
76
772008-03-09 Love Hörnquist Å
78strand <lha@it.su.se>
79
80 * krb5/init_sec_context.c (init_auth): use right variable to
81 detect if we want to free or not.
82
832008-02-26 Love Hörnquist Å
84strand <lha@it.su.se>
85
86 * Makefile.am: add missing \
87
88 * Makefile.am: reshuffle depenencies
89
90 * Add flag to krb5 to not add GSS-API INT|CONF to the negotiation
91
922008-02-21 Love Hörnquist Å
93strand <lha@it.su.se>
94
95 * make the SPNEGO mech store the error itself instead, works for
96 everything except other stackable mechs
97
982008-02-18 Love Hörnquist Å
99strand <lha@it.su.se>
100
101 * spnego/init_sec_context.c (spnego_reply): if the reply token was
102 of length 0, make it the same as no token. Pointed out by Zeqing
103 Xia.
104
105 * krb5/acquire_cred.c (acquire_initiator_cred): handle the
106 credential cache better, use destroy/close when appriate and for
107 all cases. Thanks to Michael Allen for point out the memory-leak
108 that I also fixed.
109
1102008-02-03 Love Hörnquist Å
111strand <lha@it.su.se>
112
113 * spnego/accept_sec_context.c: Make error reporting somewhat more
114 correct for SPNEGO.
115
1162008-01-27 Love Hörnquist Å
117strand <lha@it.su.se>
118
119 * test_common.c: Improve the error message.
120
1212008-01-24 Love Hörnquist Å
122strand <lha@it.su.se>
123
124 * ntlm/accept_sec_context.c: Avoid free-ing type1 message before
125 its allocated.
126
1272008-01-13 Love Hörnquist Å
128strand <lha@it.su.se>
129
130 * test_ntlm.c: Test source name (and make the acceptor in ntlm gss
131 mech useful).
132
1332007-12-30 Love Hörnquist Å
134strand <lha@it.su.se>
135
136 * ntlm/init_sec_context.c: Don't confuse target name and source
137 name, make regressiont tests pass again.
138
1392007-12-29 Love Hörnquist Å
140strand <lha@it.su.se>
141
142 * ntlm: clean up name handling
143
1442007-12-04 Love Hörnquist Å
145strand <lha@it.su.se>
146
147 * ntlm/init_sec_context.c: Use credential if it was passed in.
148
149 * ntlm/acquire_cred.c: Check if there is initial creds with
150 _gss_ntlm_get_user_cred().
151
152 * ntlm/init_sec_context.c: Add _gss_ntlm_get_user_info() that
153 return the user info so it can be used by external modules.
154
155 * ntlm/inquire_cred.c: use the right error code.
156
157 * ntlm/inquire_cred.c: Return GSS_C_NO_CREDENTIAL if there is no
158 credential, ntlm have (not yet) a default credential.
159
160 * mech/gss_release_oid_set.c: Avoid trying to deref NULL, from
161 Phil Fisher.
162
1632007-12-03 Love Hörnquist Å
164strand <lha@it.su.se>
165
166 * test_acquire_cred.c: Always try to fetch cred (even with
167 GSS_C_NO_NAME).
168
1692007-08-09 Love Hörnquist Å
170strand <lha@it.su.se>
171
172 * mech/gss_krb5.c: Readd gss_krb5_get_tkt_flags.
173
1742007-08-08 Love Hörnquist Å
175strand <lha@it.su.se>
176
177 * spnego/compat.c (_gss_spnego_internal_delete_sec_context):
178 release ctx->target_name too From Rafal Malinowski.
179
1802007-07-26 Love Hörnquist Å
181strand <lha@it.su.se>
182
183 * mech/gss_mech_switch.c: Don't try to do dlopen if system doesn't
184 have dlopen. From Rune of Chalmers.
185
1862007-07-10 Love Hörnquist Å
187strand <lha@it.su.se>
188
189 * mech/gss_duplicate_name.c: New signature of _gss_find_mn.
190
191 * mech/gss_init_sec_context.c: New signature of _gss_find_mn.
192
193 * mech/gss_acquire_cred.c: New signature of _gss_find_mn.
194
195 * mech/name.h: New signature of _gss_find_mn.
196
197 * mech/gss_canonicalize_name.c: New signature of _gss_find_mn.
198
199 * mech/gss_compare_name.c: New signature of _gss_find_mn.
200
201 * mech/gss_add_cred.c: New signature of _gss_find_mn.
202
203 * mech/gss_names.c (_gss_find_mn): Return an error code for
204 caller.
205
206 * spnego/accept_sec_context.c: remove checks that are done by the
207 previous function.
208
209 * Makefile.am: New library version.
210
2112007-07-04 Love Hörnquist Å
212strand <lha@it.su.se>
213
214 * mech/gss_oid_to_str.c: Refuse to print GSS_C_NULL_OID, from
215 Rafal Malinowski.
216
217 * spnego/spnego.asn1: Indent and make NegTokenInit and
218 NegTokenResp extendable.
219
2202007-06-21 Love Hörnquist Å
221strand <lha@it.su.se>
222
223 * ntlm/inquire_cred.c: Implement _gss_ntlm_inquire_cred.
224
225 * mech/gss_display_status.c: Provide message for GSS_S_COMPLETE.
226
227 * mech/context.c: If the canned string is "", its no use to the
228 user, make it fall back to the default error string.
229
2302007-06-20 Love Hörnquist Å
231strand <lha@it.su.se>
232
233 * mech/gss_display_name.c (gss_display_name): no name ->
234 fail. From Rafal Malinswski.
235
236 * spnego/accept_sec_context.c: Wrap name in a spnego_name instead
237 of just a copy of the underlaying object. From Rafal Malinswski.
238
239 * spnego/accept_sec_context.c: Handle underlaying mech not
240 returning mn.
241
242 * mech/gss_accept_sec_context.c: Handle underlaying mech not
243 returning mn.
244
245 * spnego/accept_sec_context.c: Make sure src_name is always set to
246 GSS_C_NO_NAME when returning.
247
248 * krb5/acquire_cred.c (acquire_acceptor_cred): don't claim
249 everything is well on failure. From Phil Fisher.
250
251 * mech/gss_duplicate_name.c: catch error (and ignore it)
252
253 * ntlm/init_sec_context.c: Use heim_ntlm_calculate_ntlm2_sess.
254
255 * mech/gss_accept_sec_context.c: Only wrap the delegated cred if
256 we got a delegated mech cred. From Rafal Malinowski.
257
258 * spnego/accept_sec_context.c: Only wrap the delegated cred if we
259 are going to return it to the consumer. From Rafal Malinowski.
260
261 * spnego/accept_sec_context.c: Fixed memory leak pointed out by
262 Rafal Malinowski, also while here moved to use NegotiationToken
263 for decoding.
264
2652007-06-18 Love Hörnquist Å
266strand <lha@it.su.se>
267
268 * krb5/prf.c (_gsskrb5_pseudo_random): add missing break.
269
270 * krb5/release_name.c: Set *minor_status unconditionallty, its
271 done later anyway.
272
273 * spnego/accept_sec_context.c: Init get_mic to 0.
274
275 * mech/gss_set_cred_option.c: Free memory in failure case, found
276 by beam.
277
278 * mech/gss_inquire_context.c: Handle mech_type being NULL.
279
280 * mech/gss_inquire_cred_by_mech.c: Handle cred_name being NULL.
281
282 * mech/gss_krb5.c: Free memory in error case, found by beam.
283
2842007-06-12 Love Hörnquist Å
285strand <lha@it.su.se>
286
287 * ntlm/inquire_context.c: Use ctx->gssflags for flags.
288
289 * krb5/display_name.c: Use KRB5_PRINCIPAL_UNPARSE_DISPLAY, this is
290 not ment for machine consumption.
291
2922007-06-09 Love Hörnquist Å
293strand <lha@it.su.se>
294
295 * ntlm/digest.c (kdc_alloc): free memory on failure, pointed out
296 by Rafal Malinowski.
297
298 * ntlm/digest.c (kdc_destroy): free context when done, pointed out
299 by Rafal Malinowski.
300
301 * spnego/context_stubs.c (_gss_spnego_display_name): if input_name
302 is null, fail. From Rafal Malinowski.
303
3042007-06-04 Love Hörnquist Å
305strand <lha@it.su.se>
306
307 * ntlm/digest.c: Free memory when done.
308
3092007-06-02 Love Hörnquist Å
310strand <lha@it.su.se>
311
312 * test_ntlm.c: Test both with and without keyex.
313
314 * ntlm/digest.c: If we didn't set session key, don't expect one
315 back.
316
317 * test_ntlm.c: Set keyex flag and calculate session key.
318
3192007-05-31 Love Hörnquist Å
320strand <lha@it.su.se>
321
322 * spnego/accept_sec_context.c: Use the return value before is
323 overwritten by later calls. From Rafal Malinowski
324
325 * krb5/release_cred.c: Give an minor_status argument to
326 gss_release_oid_set. From Rafal Malinowski
327
3282007-05-30 Love Hörnquist Å
329strand <lha@it.su.se>
330
331 * ntlm/accept_sec_context.c: Catch errors and return the up the
332 stack.
333
334 * test_kcred.c: more testing of lifetimes
335
3362007-05-17 Love Hörnquist Å
337strand <lha@it.su.se>
338
339 * Makefile.am: Drop the gss oid_set function for the krb5 mech,
340 use the mech glue versions instead. Pointed out by Rafal
341 Malinowski.
342
343 * krb5: Use gss oid_set functions from mechglue
344
3452007-05-14 Love Hörnquist Å
346strand <lha@it.su.se>
347
348 * ntlm/accept_sec_context.c: Set session key only if we are
349 returned a session key. Found by David Love.
350
3512007-05-13 Love Hörnquist Å
352strand <lha@it.su.se>
353
354 * krb5/prf.c: switched MIN to min to make compile on solaris,
355 pointed out by David Love.
356
3572007-05-09 Love Hörnquist Å
358strand <lha@it.su.se>
359
360 * krb5/inquire_cred_by_mech.c: Fill in all of the variables if
361 they are passed in. Pointed out by Phil Fisher.
362
3632007-05-08 Love Hörnquist Å
364strand <lha@it.su.se>
365
366 * krb5/inquire_cred.c: Fix copy and paste error, bug spotted by
367 from Phil Fisher.
368
369 * mech: dont keep track of gc_usage, just figure it out at
370 gss_inquire_cred() time
371
372 * mech/gss_mech_switch.c (add_builtin): ok for
373 __gss_mech_initialize() to return NULL
374
375 * test_kcred.c: more correct tests
376
377 * spnego/cred_stubs.c (gss_inquire_cred*): wrap the name with a
378 spnego_name.
379
380 * ntlm/inquire_cred.c: make ntlm gss_inquire_cred fail for now,
381 need to find default cred and friends.
382
383 * krb5/inquire_cred_by_mech.c: reimplement
384
3852007-05-07 Love Hörnquist Å
386strand <lha@it.su.se>
387
388 * ntlm/acquire_cred.c: drop unused variable.
389
390 * ntlm/acquire_cred.c: Reimplement.
391
392 * Makefile.am: add ntlm/digest.c
393
394 * ntlm: split out backend ntlm server processing
395
3962007-04-24 Love Hörnquist Å
397strand <lha@it.su.se>
398
399 * ntlm/delete_sec_context.c (_gss_ntlm_delete_sec_context): free
400 credcache when done
401
4022007-04-22 Love Hörnquist Å
403strand <lha@it.su.se>
404
405 * ntlm/init_sec_context.c: ntlm-key credential entry is prefix with @
406
407 * ntlm/init_sec_context.c (get_user_ccache): pick up the ntlm
408 creds from the krb5 credential cache.
409
4102007-04-21 Love Hörnquist Å
411strand <lha@it.su.se>
412
413 * ntlm/delete_sec_context.c: free the key stored in the context
414
415 * ntlm/ntlm.h: switch password for a key
416
417 * test_oid.c: Switch oid to one that is exported.
418
4192007-04-20 Love Hörnquist Å
420strand <lha@it.su.se>
421
422 * ntlm/init_sec_context.c: move where hash is calculated to make
423 it easier to add ccache support.
424
425 * Makefile.am: Add version-script.map to EXTRA_DIST.
426
4272007-04-19 Love Hörnquist Å
428strand <lha@it.su.se>
429
430 * Makefile.am: Unconfuse newer versions of automake that doesn't
431 know the diffrence between depenences and setting variables. foo:
432 vs foo=.
433
434 * test_ntlm.c: delete sec context when done.
435
436 * version-script.map: export more symbols.
437
438 * Makefile.am: add version script if ld supports it
439
440 * version-script.map: add version script if ld supports it
441
4422007-04-18 Love Hörnquist Å
443strand <lha@it.su.se>
444
445 * Makefile.am: test_acquire_cred need test_common.[ch]
446
447 * test_acquire_cred.c: add more test options.
448
449 * krb5/external.c: add GSS_KRB5_CCACHE_NAME_X
450
451 * gssapi/gssapi_krb5.h: add GSS_KRB5_CCACHE_NAME_X
452
453 * krb5/set_sec_context_option.c: refactor code, implement
454 GSS_KRB5_CCACHE_NAME_X
455
456 * mech/gss_krb5.c: reimplement gss_krb5_ccache_name
457
4582007-04-17 Love Hörnquist Å
459strand <lha@it.su.se>
460
461 * spnego/cred_stubs.c: Need to import spnego name before we can
462 use it as a gss_name_t.
463
464 * test_acquire_cred.c: use this test as part of the regression
465 suite.
466
467 * mech/gss_acquire_cred.c (gss_acquire_cred): dont init
468 cred->gc_mc every time in the loop.
469
4702007-04-15 Love Hörnquist Å
471strand <lha@it.su.se>
472
473 * Makefile.am: add test_common.h
474
4752007-02-16 Love Hörnquist Å
476strand <lha@it.su.se>
477
478 * gss_acquire_cred.3: Add link for
479 gsskrb5_register_acceptor_identity.
480
4812007-02-08 Love Hörnquist Å
482strand <lha@it.su.se>
483
484 * krb5/copy_ccache.c: Try to leak less memory in the failure case.
485
4862007-01-31 Love Hörnquist Å
487strand <lha@it.su.se>
488
489 * mech/gss_display_status.c: Use right printf formater.
490
491 * test_*.[ch]: split out the error printing function and try to
492 return better errors
493
4942007-01-30 Love Hörnquist Å
495strand <lha@it.su.se>
496
497 * krb5/init_sec_context.c: revert 1.75: (init_auth): only turn on
498 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
499
500 This is because Kerberos always support INT|CONF, matches behavior
501 with MS and MIT. The creates problems for the GSS-SPNEGO mech.
502
5032007-01-24 Love Hörnquist Å
504strand <lha@it.su.se>
505
506 * krb5/prf.c: constrain desired_output_len
507
508 * krb5/external.c (krb5_mech): add _gsskrb5_pseudo_random
509
510 * mech/gss_pseudo_random.c: Catch error from underlaying mech on
511 failure.
512
513 * Makefile.am: Add krb5/prf.c
514
515 * krb5/prf.c: gss_pseudo_random for krb5
516
517 * test_context.c: Checks for gss_pseudo_random.
518
519 * krb5/gkrb5_err.et: add KG_INPUT_TOO_LONG
520
521 * Makefile.am: Add mech/gss_pseudo_random.c
522
523 * gssapi/gssapi.h: try to load pseudo_random
524
525 * mech/gss_mech_switch.c: try to load pseudo_random
526
527 * mech/gss_pseudo_random.c: Add gss_pseudo_random.
528
529 * gssapi_mech.h: Add hook for gm_pseudo_random.
530
5312007-01-17 Love Hörnquist Å
532strand <lha@it.su.se>
533
534 * test_context.c: Don't assume bufer from gss_display_status is
535 ok.
536
537 * mech/gss_wrap_size_limit.c: Reset out variables.
538
539 * mech/gss_wrap.c: Reset out variables.
540
541 * mech/gss_verify_mic.c: Reset out variables.
542
543 * mech/gss_utils.c: Reset out variables.
544
545 * mech/gss_release_oid_set.c: Reset out variables.
546
547 * mech/gss_release_cred.c: Reset out variables.
548
549 * mech/gss_release_buffer.c: Reset variables.
550
551 * mech/gss_oid_to_str.c: Reset out variables.
552
553 * mech/gss_inquire_sec_context_by_oid.c: Fix reset out variables.
554
555 * mech/gss_mech_switch.c: Reset out variables.
556
557 * mech/gss_inquire_sec_context_by_oid.c: Reset out variables.
558
559 * mech/gss_inquire_names_for_mech.c: Reset out variables.
560
561 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
562
563 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
564
565 * mech/gss_inquire_cred_by_mech.c: Reset out variables.
566
567 * mech/gss_inquire_cred.c: Reset out variables, fix memory leak.
568
569 * mech/gss_inquire_context.c: Reset out variables.
570
571 * mech/gss_init_sec_context.c: Zero out outbuffer on failure.
572
573 * mech/gss_import_name.c: Reset out variables.
574
575 * mech/gss_import_name.c: Reset out variables.
576
577 * mech/gss_get_mic.c: Reset out variables.
578
579 * mech/gss_export_name.c: Reset out variables.
580
581 * mech/gss_encapsulate_token.c: Reset out variables.
582
583 * mech/gss_duplicate_oid.c: Reset out variables.
584
585 * mech/gss_duplicate_oid.c: Reset out variables.
586
587 * mech/gss_duplicate_name.c: Reset out variables.
588
589 * mech/gss_display_status.c: Reset out variables.
590
591 * mech/gss_display_name.c: Reset out variables.
592
593 * mech/gss_delete_sec_context.c: Reset out variables using propper
594 macros.
595
596 * mech/gss_decapsulate_token.c: Reset out variables using propper
597 macros.
598
599 * mech/gss_add_cred.c: Reset out variables.
600
601 * mech/gss_acquire_cred.c: Reset out variables.
602
603 * mech/gss_accept_sec_context.c: Reset out variables using propper
604 macros.
605
606 * mech/gss_init_sec_context.c: Reset out variables.
607
608 * mech/mech_locl.h (_mg_buffer_zero): new macro that zaps a
609 gss_buffer_t
610
6112007-01-16 Love Hörnquist Å
612strand <lha@it.su.se>
613
614 * mech: sprinkel _gss_mg_error
615
616 * mech/gss_display_status.c (gss_display_status): use
617 _gss_mg_get_error to fetch the error from underlaying mech, if it
618 failes, let do the regular dance for GSS-CODE version and a
619 generic print-the-error code for MECH-CODE.
620
621 * mech/gss_oid_to_str.c: Don't include the NUL in the length of
622 the string.
623
624 * mech/context.h: Protoypes for _gss_mg_.
625
626 * mech/context.c: Glue to catch the error from the lower gss-api
627 layer and save that for later so gss_display_status() can show the
628 error.
629
630 * gss.c: Detect NTLM.
631
6322007-01-11 Love Hörnquist Å
633strand <lha@it.su.se>
634
635 * mech/gss_accept_sec_context.c: spelling
636
6372007-01-04 Love Hörnquist Å
638strand <lha@it.su.se>
639
640 * Makefile.am: Include build (private) prototypes header files.
641
642 * Makefile.am (ntlmsrc): add ntlm/ntlm-private.h
643
6442006-12-28 Love Hörnquist Å
645strand <lha@it.su.se>
646
647 * ntlm/accept_sec_context.c: Pass signseal argument to
648 _gss_ntlm_set_key.
649
650 * ntlm/init_sec_context.c: Pass signseal argument to
651 _gss_ntlm_set_key.
652
653 * ntlm/crypto.c (_gss_ntlm_set_key): add signseal argument
654
655 * test_ntlm.c: add ntlmv2 test
656
657 * ntlm/ntlm.h: break out struct ntlmv2_key;
658
659 * ntlm/crypto.c (_gss_ntlm_set_key): set ntlm v2 keys.
660
661 * ntlm/accept_sec_context.c: Set dummy ntlmv2 keys and Check TI.
662
663 * ntlm/ntlm.h: NTLMv2 keys.
664
665 * ntlm/crypto.c: NTLMv2 sign and verify.
666
6672006-12-20 Love Hörnquist Å
668strand <lha@it.su.se>
669
670 * ntlm/accept_sec_context.c: Don't send targetinfo now.
671
672 * ntlm/init_sec_context.c: Build ntlmv2 answer buffer.
673
674 * ntlm/init_sec_context.c: Leak less memory.
675
676 * ntlm/init_sec_context.c: Announce that we support key exchange.
677
678 * ntlm/init_sec_context.c: Add NTLM_NEG_NTLM2_SESSION, NTLMv2
679 session security (disable because missing sign and seal).
680
6812006-12-19 Love Hörnquist Å
682strand <lha@it.su.se>
683
684 * ntlm/accept_sec_context.c: split RC4 send and recv keystreams
685
686 * ntlm/init_sec_context.c: split RC4 send and recv keystreams
687
688 * ntlm/ntlm.h: split RC4 send and recv keystreams
689
690 * ntlm/crypto.c: Implement SEAL.
691
692 * ntlm/crypto.c: move gss_wrap/gss_unwrap here
693
694 * test_context.c: request INT and CONF from the gss layer, test
695 get and verify MIC.
696
697 * ntlm/ntlm.h: add crypto bits.
698
699 * ntlm/accept_sec_context.c: Save session master key.
700
701 * Makefile.am: Move get and verify mic to the same file (crypto.c)
702 since they share code.
703
704 * ntlm/crypto.c: Move get and verify mic to the same file since
705 they share code, implement NTLM v1 and dummy signatures.
706
707 * ntlm/init_sec_context.c: pass on GSS_C_CONF_FLAG and
708 GSS_C_INTEG_FLAG, save the session master key
709
710 * spnego/accept_sec_context.c: try using gss_accept_sec_context()
711 on the opportunistic token instead of guessing the acceptor name
712 and do gss_acquire_cred, this make SPNEGO work like before.
713
7142006-12-18 Love Hörnquist Å
715strand <lha@it.su.se>
716
717 * ntlm/init_sec_context.c: Calculate the NTLM version 1 "master"
718 key.
719
720 * spnego/accept_sec_context.c: Resurect negHints for the acceptor
721 sends first packet.
722
723 * Makefile.am: Add "windows" versions of the NegTokenInitWin and
724 friends.
725
726 * test_context.c: add --wrapunwrap flag
727
728 * spnego/compat.c: move _gss_spnego_indicate_mechtypelist() to
729 compat.c, use the sequence types of MechTypeList, make
730 add_mech_type() static.
731
732 * spnego/accept_sec_context.c: move
733 _gss_spnego_indicate_mechtypelist() to compat.c
734
735 * Makefile.am: Generate sequence code for MechTypeList
736
737 * spnego: check that the generated acceptor mechlist is acceptable too
738
739 * spnego/init_sec_context.c: Abstract out the initiator filter
740 function, it will be needed for the acceptor too.
741
742 * spnego/accept_sec_context.c: Abstract out the initiator filter
743 function, it will be needed for the acceptor too. Remove negHints.
744
745 * test_context.c: allow asserting return mech
746
747 * ntlm/accept_sec_context.c: add _gss_ntlm_allocate_ctx
748
749 * ntlm/acquire_cred.c: Check that the KDC seem to there and
750 answering us, we can't do better then that wen checking if we will
751 accept the credential.
752
753 * ntlm/get_mic.c: return GSS_S_UNAVAILABLE
754
755 * mech/utils.h: add _gss_free_oid, reverse of _gss_copy_oid
756
757 * mech/gss_utils.c: add _gss_free_oid, reverse of _gss_copy_oid
758
759 * spnego/spnego.asn1: Its very sad, but NegHints its are not part
760 of the NegTokenInit, this makes SPNEGO acceptor life a lot harder.
761
762 * spnego: try harder to handle names better. handle missing
763 acceptor and initator creds better (ie dont propose/accept mech
764 that there are no credentials for) split NegTokenInit and
765 NegTokenResp in acceptor
766
7672006-12-16 Love Hörnquist Å
768strand <lha@it.su.se>
769
770 * ntlm/import_name.c: Allocate the buffer from the right length.
771
7722006-12-15 Love Hörnquist Å
773strand <lha@it.su.se>
774
775 * ntlm/init_sec_context.c (init_sec_context): Tell the other side
776 what domain we think we are talking to.
777
778 * ntlm/delete_sec_context.c: free username and password
779
780 * ntlm/release_name.c (_gss_ntlm_release_name): free name.
781
782 * ntlm/import_name.c (_gss_ntlm_import_name): add support for
783 GSS_C_NT_HOSTBASED_SERVICE names
784
785 * ntlm/ntlm.h: Add ntlm_name.
786
787 * test_context.c: allow testing of ntlm.
788
789 * gssapi_mech.h: add __gss_ntlm_initialize
790
791 * ntlm/accept_sec_context.c (handle_type3): verify that the kdc
792 approved of the ntlm exchange too
793
794 * mech/gss_mech_switch.c: Add the builtin ntlm mech
795
796 * test_ntlm.c: NTLM test app.
797
798 * mech/gss_accept_sec_context.c: Add detection of NTLMSSP.
799
800 * gssapi/gssapi.h: add ntlm mech oid
801
802 * ntlm/external.c: Switch OID to the ms ntlmssp oid
803
804 * Makefile.am: Add ntlm gss-api module.
805
806 * ntlm/accept_sec_context.c: Catch more error errors.
807
808 * ntlm/accept_sec_context.c: Check after a credential to use.
809
8102006-12-14 Love Hörnquist Å
811strand <lha@it.su.se>
812
813 * krb5/set_sec_context_option.c (GSS_KRB5_SET_DEFAULT_REALM_X):
814 don't fail on success. Bug report from Stefan Metzmacher.
815
8162006-12-13 Love Hörnquist Å
817strand <lha@it.su.se>
818
819 * krb5/init_sec_context.c (init_auth): only turn on
820 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
821 From Stefan Metzmacher.
822
8232006-12-11 Love Hörnquist Å
824strand <lha@it.su.se>
825
826 * Makefile.am (libgssapi_la_OBJECTS): depends on gssapi_asn1.h
827 spnego_asn1.h.
828
8292006-11-20 Love Hörnquist Å
830strand <lha@it.su.se>
831
832 * krb5/acquire_cred.c: Make krb5_get_init_creds_opt_free take a
833 context argument.
834
8352006-11-16 Love Hörnquist Å
836strand <lha@it.su.se>
837
838 * test_context.c: Test that token keys are the same, return
839 actual_mech.
840
8412006-11-15 Love Hörnquist Å
842strand <lha@it.su.se>
843
844 * spnego/spnego_locl.h: Make bitfields unsigned, add maybe_open.
845
846 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
847 encode CHOICE structure now that we can handle it.
848
849 * spnego/init_sec_context.c: Use ASN.1 encoder functions to encode
850 CHOICE structure now that we can handle it.
851
852 * spnego/accept_sec_context.c (_gss_spnego_accept_sec_context):
853 send back ad accept_completed when the security context is ->open,
854 w/o this the client doesn't know that the server have completed
855 the transaction.
856
857 * test_context.c: Add delegate flag and check that the delegated
858 cred works.
859
860 * spnego/init_sec_context.c: Keep track of the opportunistic token
861 in the inital message, it might be a complete gss-api context, in
862 that case we'll get back accept_completed without any token. With
863 this change, krb5 w/o mutual authentication works.
864
865 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
866 encode CHOICE structure now that we can handle it.
867
868 * spnego/accept_sec_context.c: Filter out SPNEGO from the out
869 supported mechs list and make sure we don't select that for the
870 preferred mechamism.
871
8722006-11-14 Love Hörnquist Å
873strand <lha@it.su.se>
874
875 * mech/gss_init_sec_context.c (_gss_mech_cred_find): break out the
876 cred finding to its own function
877
878 * krb5/wrap.c: Better error strings, from Andrew Bartlet.
879
8802006-11-13 Love Hörnquist Å
881strand <lha@it.su.se>
882
883 * test_context.c: Create our own krb5_context.
884
885 * krb5: Switch from using a specific error message context in the
886 TLS to have a whole krb5_context in TLS. This have some
887 interestion side-effekts for the configruration setting options
888 since they operate on per-thread basis now.
889
890 * mech/gss_set_cred_option.c: When calling ->gm_set_cred_option
891 and checking for success, use GSS_S_COMPLETE. From Andrew Bartlet.
892
8932006-11-12 Love Hörnquist Å
894strand <lha@it.su.se>
895
896 * Makefile.am: Help solaris make even more.
897
898 * Makefile.am: Help solaris make.
899
9002006-11-09 Love Hörnquist Å
901strand <lha@it.su.se>
902
903 * Makefile.am: remove include $(srcdir)/Makefile-digest.am for now
904
905 * mech/gss_accept_sec_context.c: Try better guessing what is mech
906 we are going to select by looking harder at the input_token, idea
907 from Luke Howard's mechglue branch.
908
909 * Makefile.am: libgssapi_la_OBJECTS: add depency on gkrb5_err.h
910
911 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X
912
913 * mech/gss_krb5.c: implement gss_krb5_set_allowable_enctypes
914
915 * gssapi/gssapi.h: GSS_KRB5_S_
916
917 * krb5/gsskrb5_locl.h: Include <gkrb5_err.h>.
918
919 * gssapi/gssapi_krb5.h: Add gss_krb5_set_allowable_enctypes.
920
921 * Makefile.am: Build and install gkrb5_err.h
922
923 * krb5/gkrb5_err.et: Move the GSS_KRB5_S error here.
924
9252006-11-08 Love Hörnquist Å
926strand <lha@it.su.se>
927
928 * mech/gss_krb5.c: Add gsskrb5_set_default_realm.
929
930 * krb5/set_sec_context_option.c: Support
931 GSS_KRB5_SET_DEFAULT_REALM_X.
932
933 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DEFAULT_REALM_X
934
935 * krb5/external.c: add GSS_KRB5_SET_DEFAULT_REALM_X
936
9372006-11-07 Love Hörnquist Å
938strand <lha@it.su.se>
939
940 * test_context.c: rename krb5_[gs]et_time_wrap to
941 krb5_[gs]et_max_time_skew
942
943 * krb5/copy_ccache.c: _gsskrb5_extract_authz_data_from_sec_context
944 no longer used, bye bye
945
946 * mech/gss_krb5.c: No depenency of the krb5 gssapi mech.
947
948 * mech/gss_krb5.c (gsskrb5_extract_authtime_from_sec_context): use
949 _gsskrb5_decode_om_uint32. From Andrew Bartlet.
950
951 * mech/gss_krb5.c: Add dummy gss_krb5_set_allowable_enctypes for
952 now.
953
954 * spnego/spnego_locl.h: Include <roken.h> for compatiblity.
955
956 * krb5/arcfour.c: Use IS_DCE_STYLE flag. There is no padding in
957 DCE-STYLE, don't try to use to. From Andrew Bartlett.
958
959 * test_context.c: test wrap/unwrap, add flag for dce-style and
960 mutual auth, also support multi-roundtrip sessions
961
962 * krb5/gsskrb5_locl.h: Add IS_DCE_STYLE macro.
963
964 * krb5/accept_sec_context.c (gsskrb5_acceptor_start): use
965 krb5_rd_req_ctx
966
967 * mech/gss_krb5.c (gsskrb5_get_subkey): return the per message
968 token subkey
969
970 * krb5/inquire_sec_context_by_oid.c: check if there is any key at
971 all
972
9732006-11-06 Love Hörnquist Å
974strand <lha@it.su.se>
975
976 * krb5/inquire_sec_context_by_oid.c: Set more error strings, use
977 right enum for acceptor subkey. From Andrew Bartlett.
978
9792006-11-04 Love Hörnquist Å
980strand <lha@it.su.se>
981
982 * test_context.c: Test gsskrb5_extract_service_keyblock, needed in
983 PAC valication. From Andrew Bartlett
984
985 * mech/gss_krb5.c: Add gsskrb5_extract_authz_data_from_sec_context
986 and keyblock extraction functions.
987
988 * gssapi/gssapi_krb5.h: Add extraction of keyblock function, from
989 Andrew Bartlett.
990
991 * krb5/external.c: Add GSS_KRB5_GET_SERVICE_KEYBLOCK_X
992
9932006-11-03 Love Hörnquist Å
994strand <lha@it.su.se>
995
996 * test_context.c: Rename various routines and constants from
997 canonize to canonicalize. From Andrew Bartlett
998
999 * mech/gss_krb5.c: Rename various routines and constants from
1000 canonize to canonicalize. From Andrew Bartlett
1001
1002 * krb5/set_sec_context_option.c: Rename various routines and
1003 constants from canonize to canonicalize. From Andrew Bartlett
1004
1005 * krb5/external.c: Rename various routines and constants from
1006 canonize to canonicalize. From Andrew Bartlett
1007
1008 * gssapi/gssapi_krb5.h: Rename various routines and constants from
1009 canonize to canonicalize. From Andrew Bartlett
1010
10112006-10-25 Love Hörnquist Å
1012strand <lha@it.su.se>
1013
1014 * krb5/accept_sec_context.c (gsskrb5_accept_delegated_token): need
1015 to free ccache
1016
10172006-10-24 Love Hörnquist Å
1018strand <lha@it.su.se>
1019
1020 * test_context.c (loop): free target_name
1021
1022 * mech/gss_accept_sec_context.c: SLIST_INIT the ->gc_mc'
1023
1024 * mech/gss_acquire_cred.c : SLIST_INIT the ->gc_mc'
1025
1026 * krb5/init_sec_context.c: Avoid leaking memory.
1027
1028 * mech/gss_buffer_set.c (gss_release_buffer_set): don't leak the
1029 ->elements memory.
1030
1031 * test_context.c: make compile
1032
1033 * krb5/cfx.c (_gssapi_verify_mic_cfx): always free crypto context.
1034
1035 * krb5/set_cred_option.c (import_cred): free sp
1036
10372006-10-22 Love Hörnquist Å
1038strand <lha@it.su.se>
1039
1040 * mech/gss_add_oid_set_member.c: Use old implementation of
1041 gss_add_oid_set_member, it leaks less memory.
1042
1043 * krb5/test_cfx.c: free krb5_crypto.
1044
1045 * krb5/test_cfx.c: free krb5_context
1046
1047 * mech/gss_release_name.c (gss_release_name): free input_name
1048 it-self.
1049
10502006-10-21 Love Hörnquist Å
1051strand <lha@it.su.se>
1052
1053 * test_context.c: Call setprogname.
1054
1055 * mech/gss_krb5.c: Add gsskrb5_extract_authtime_from_sec_context.
1056
1057 * gssapi/gssapi_krb5.h: add
1058 gsskrb5_extract_authtime_from_sec_context
1059
10602006-10-20 Love Hörnquist Å
1061strand <lha@it.su.se>
1062
1063 * krb5/inquire_sec_context_by_oid.c: Add get_authtime.
1064
1065 * krb5/external.c: add GSS_KRB5_GET_AUTHTIME_X
1066
1067 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_AUTHTIME_X
1068
1069 * krb5/set_sec_context_option.c: Implement GSS_KRB5_SEND_TO_KDC_X.
1070
1071 * mech/gss_krb5.c: Add gsskrb5_set_send_to_kdc
1072
1073 * gssapi/gssapi_krb5.h: Add GSS_KRB5_SEND_TO_KDC_X and
1074 gsskrb5_set_send_to_kdc
1075
1076 * krb5/external.c: add GSS_KRB5_SEND_TO_KDC_X
1077
1078 * Makefile.am: more files
1079
10802006-10-19 Love Hörnquist Å
1081strand <lha@it.su.se>
1082
1083 * Makefile.am: remove spnego/gssapi_spnego.h, its now in gssapi/
1084
1085 * test_context.c: Allow specifing mech.
1086
1087 * krb5/external.c: add GSS_SASL_DIGEST_MD5_MECHANISM (for now)
1088
1089 * gssapi/gssapi.h: Rename GSS_DIGEST_MECHANISM to
1090 GSS_SASL_DIGEST_MD5_MECHANISM
1091
10922006-10-18 Love Hörnquist Å
1093strand <lha@it.su.se>
1094
1095 * mech/gssapi.asn1: Make it into a heim_any_set, its doesn't
1096 except a tag.
1097
1098 * mech/gssapi.asn1: GSSAPIContextToken is IMPLICIT SEQUENCE
1099
1100 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X
1101
1102 * krb5/external.c: Add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X.
1103
1104 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_INITIATOR_SUBKEY_X and
1105 GSS_KRB5_GET_SUBKEY_X
1106
1107 * krb5/external.c: add GSS_KRB5_GET_INITIATOR_SUBKEY_X,
1108 GSS_KRB5_GET_SUBKEY_X
1109
11102006-10-17 Love Hörnquist Å
1111strand <lha@it.su.se>
1112
1113 * test_context.c: Support switching on name type oid's
1114
1115 * test_context.c: add test for dns canon flag
1116
1117 * mech/gss_krb5.c: Add gsskrb5_set_dns_canonlize.
1118
1119 * gssapi/gssapi_krb5.h: remove gss_krb5_compat_des3_mic
1120
1121 * gssapi/gssapi_krb5.h: Add gsskrb5_set_dns_canonlize.
1122
1123 * krb5/set_sec_context_option.c: implement
1124 GSS_KRB5_SET_DNS_CANONIZE_X
1125
1126 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DNS_CANONIZE_X
1127
1128 * krb5/external.c: add GSS_KRB5_SET_DNS_CANONIZE_X
1129
1130 * mech/gss_krb5.c: add bits to make lucid context work
1131
11322006-10-14 Love Hörnquist Å
1133strand <lha@it.su.se>
1134
1135 * mech/gss_oid_to_str.c: Prefix der primitives with der_.
1136
1137 * krb5/inquire_sec_context_by_oid.c: Prefix der primitives with
1138 der_.
1139
1140 * krb5/encapsulate.c: Prefix der primitives with der_.
1141
1142 * mech/gss_oid_to_str.c: New der_print_heim_oid signature.
1143
11442006-10-12 Love Hörnquist Å
1145strand <lha@it.su.se>
1146
1147 * Makefile.am: add test_context
1148
1149 * krb5/inquire_sec_context_by_oid.c: Make it work.
1150
1151 * test_oid.c: Test lucid oid.
1152
1153 * gssapi/gssapi.h: Add OM_uint64_t.
1154
1155 * krb5/inquire_sec_context_by_oid.c: Add lucid interface.
1156
1157 * krb5/external.c: Add lucid interface, renumber oids to my
1158 delegated space.
1159
1160 * mech/gss_krb5.c: Add lucid interface.
1161
1162 * gssapi/gssapi_krb5.h: Add lucid interface.
1163
1164 * spnego/spnego_locl.h: Maybe include <netdb.h>.
1165
11662006-10-09 Love Hörnquist Å
1167strand <lha@it.su.se>
1168
1169 * mech/gss_mech_switch.c: define RTLD_LOCAL to 0 if not defined.
1170
11712006-10-08 Love Hörnquist Å
1172strand <lha@it.su.se>
1173
1174 * Makefile.am: install gssapi_krb5.H and gssapi_spnego.h
1175
1176 * gssapi/gssapi_krb5.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1177
1178 * gssapi/gssapi.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1179
1180 * Makefile.am: Drop some -I no longer needed.
1181
1182 * gssapi/gssapi_spnego.h: Move gssapi_spengo.h over here.
1183
1184 * krb5: reference all include files using 'krb5/'
1185
11862006-10-07 Love Hörnquist Å
1187strand <lha@it.su.se>
1188
1189 * gssapi.h: Add file inclusion protection.
1190
1191 * gssapi/gssapi.h: Correct header file inclusion protection.
1192
1193 * gssapi/gssapi.h: Move the gssapi.h from lib/gssapi/ to
1194 lib/gssapi/gssapi/ to please automake.
1195
1196 * spnego/spnego_locl.h: Maybe include <sys/types.h>.
1197
1198 * mech/mech_locl.h: Include <roken.h>.
1199
1200 * Makefile.am: split build files into dist_ and noinst_ SOURCES
1201
12022006-10-06 Love Hörnquist Å
1203strand <lha@it.su.se>
1204
1205 * gss.c: #if 0 out unused code.
1206
1207 * mech/gss_mech_switch.c: Cast argument to ctype(3) functions
1208 to (unsigned char).
1209
12102006-10-05 Love Hörnquist Å
1211strand <lha@it.su.se>
1212
1213 * mech/name.h: remove <sys/queue.h>
1214
1215 * mech/mech_switch.h: remove <sys/queue.h>
1216
1217 * mech/cred.h: remove <sys/queue.h>
1218
12192006-10-02 Love Hörnquist Å
1220strand <lha@it.su.se>
1221
1222 * krb5/arcfour.c: Thinker more with header lengths.
1223
1224 * krb5/arcfour.c: Improve the calcucation of header
1225 lengths. DCE-STYLE data is also padded so remove if (1 || ...)
1226 code.
1227
1228 * krb5/wrap.c (_gsskrb5_wrap_size_limit): use
1229 _gssapi_wrap_size_arcfour for arcfour
1230
1231 * krb5/arcfour.c: Move _gssapi_wrap_size_arcfour here.
1232
1233 * Makefile.am: Split all mech to diffrent mechsrc variables.
1234
1235 * spnego/context_stubs.c: Make internal function static (and
1236 rename).
1237
12382006-10-01 Love Hörnquist Å
1239strand <lha@it.su.se>
1240
1241 * krb5/inquire_cred.c: Fix "if (x) lock(y)" bug. From Harald
1242 Barth.
1243
1244 * spnego/spnego_locl.h: Include <sys/param.h> for MAXHOSTNAMELEN.
1245
12462006-09-25 Love Hörnquist Å
1247strand <lha@it.su.se>
1248
1249 * krb5/arcfour.c: Add wrap support, interrop with itself but not
1250 w2k3s-sp1
1251
1252 * krb5/gsskrb5_locl.h: move the arcfour specific stuff to the
1253 arcfour header.
1254
1255 * krb5/arcfour.c: Support DCE-style unwrap, tested with
1256 w2k3server-sp1.
1257
1258 * mech/gss_accept_sec_context.c (gss_accept_sec_context): if the
1259 token doesn't start with [APPLICATION 0] SEQUENCE, lets assume its
1260 a DCE-style kerberos 5 connection. XXX this needs to be made
1261 better in cause we get another GSS-API protocol violating
1262 protocol. It should be possible to detach the Kerberos DCE-style
1263 since it starts with a AP-REQ PDU, but that have to wait for now.
1264
12652006-09-22 Love Hörnquist Å
1266strand <lha@it.su.se>
1267
1268 * gssapi.h: Add GSS_C flags from
1269 draft-brezak-win2k-krb-rc4-hmac-04.txt.
1270
1271 * krb5/delete_sec_context.c: Free service_keyblock and fwd_data,
1272 indent.
1273
1274 * krb5/accept_sec_context.c: Merge of the acceptor part from the
1275 samba patch by Stefan Metzmacher and Andrew Bartlet.
1276
1277 * krb5/init_sec_context.c: Add GSS_C_DCE_STYLE.
1278
1279 * krb5/{init_sec_context.c,gsskrb5_locl.h}: merge most of the
1280 initiator part from the samba patch by Stefan Metzmacher and
1281 Andrew Bartlet (still missing DCE/RPC support)
1282
12832006-08-28 Love Hörnquist Å
1284strand <lha@it.su.se>
1285
1286 * gss.c (help): use sl_slc_help().
1287
12882006-07-22 Love Hörnquist Å
1289strand <lha@it.su.se>
1290
1291 * gss-commands.in: rename command to supported-mechanisms
1292
1293 * Makefile.am: Make gss objects depend on the slc built
1294 gss-commands.h
1295
12962006-07-20 Love Hörnquist Å
1297strand <lha@it.su.se>
1298
1299 * gss-commands.in: add slc commands for gss
1300
1301 * krb5/gsskrb5_locl.h: Remove dup prototype of _gsskrb5_init()
1302
1303 * Makefile.am: Add test_cfx
1304
1305 * krb5/external.c: add GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1306
1307 * krb5/set_sec_context_option.c: catch
1308 GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1309
1310 * krb5/accept_sec_context.c: reimplement
1311 gsskrb5_register_acceptor_identity
1312
1313 * mech/gss_krb5.c: implement gsskrb5_register_acceptor_identity
1314
1315 * mech/gss_inquire_mechs_for_name.c: call _gss_load_mech
1316
1317 * mech/gss_inquire_cred.c (gss_inquire_cred): call _gss_load_mech
1318
1319 * mech/gss_mech_switch.c: Make _gss_load_mech() atomic and run
1320 only once, this have the side effect that _gss_mechs and
1321 _gss_mech_oids is only initialized once, so if just the users of
1322 these two global variables calls _gss_load_mech() first, it will
1323 act as a barrier and make sure the variables are never changed and
1324 we don't need to lock them.
1325
1326 * mech/utils.h: no need to mark functions extern.
1327
1328 * mech/name.h: no need to mark _gss_find_mn extern.
1329
13302006-07-19 Love Hörnquist Å
1331strand <lha@it.su.se>
1332
1333 * krb5/cfx.c: Redo the wrap length calculations.
1334
1335 * krb5/test_cfx.c: test max_wrap_size in cfx.c
1336
1337 * mech/gss_display_status.c: Handle more error codes.
1338
13392006-07-07 Love Hörnquist Å
1340strand <lha@it.su.se>
1341
1342 * mech/mech_locl.h: Include <krb5-types.h> and "mechqueue.h"
1343
1344 * mech/mechqueue.h: Add SLIST macros.
1345
1346 * krb5/inquire_context.c: Don't free return values on success.
1347
1348 * krb5/inquire_cred.c (_gsskrb5_inquire_cred): When cred provided
1349 is the default cred, acquire the acceptor cred and initator cred
1350 in two diffrent steps and then query them for the information,
1351 this way, the code wont fail if there are no keytab, but there is
1352 a credential cache.
1353
1354 * mech/gss_inquire_cred.c: move the check if we found any cred
1355 where it matter for both cases
1356 (default cred and provided cred)
1357
1358 * mech/gss_init_sec_context.c: If the desired mechanism can't
1359 convert the name to a MN, fail with GSS_S_BAD_NAME rather then a
1360 NULL de-reference.
1361
13622006-07-06 Love Hörnquist Å
1363strand <lha@it.su.se>
1364
1365 * spnego/external.c: readd gss_spnego_inquire_names_for_mech
1366
1367 * spnego/spnego_locl.h: reimplement
1368 gss_spnego_inquire_names_for_mech add support function
1369 _gss_spnego_supported_mechs
1370
1371 * spnego/context_stubs.h: reimplement
1372 gss_spnego_inquire_names_for_mech add support function
1373 _gss_spnego_supported_mechs
1374
1375 * spnego/context_stubs.c: drop gss_spnego_indicate_mechs
1376
1377 * mech/gss_indicate_mechs.c: if the underlaying mech doesn't
1378 support gss_indicate_mechs, use the oid in the mechswitch
1379 structure
1380
1381 * spnego/external.c: let the mech glue layer implement
1382 gss_indicate_mechs
1383
1384 * spnego/cred_stubs.c (gss_spnego_acquire_cred): don't care about
1385 desired_mechs, get our own list with indicate_mechs and remove
1386 ourself.
1387
13882006-07-05 Love Hörnquist Å
1389strand <lha@it.su.se>
1390
1391 * spnego/external.c: remove gss_spnego_inquire_names_for_mech, let
1392 the mechglue layer implement it
1393
1394 * spnego/context_stubs.c: remove gss_spnego_inquire_names_for_mech, let
1395 the mechglue layer implement it
1396
1397 * spnego/spnego_locl.c: remove gss_spnego_inquire_names_for_mech, let
1398 the mechglue layer implement it
1399
14002006-07-01 Love Hörnquist Å
1401strand <lha@it.su.se>
1402
1403 * mech/gss_set_cred_option.c: fix argument to gss_release_cred
1404
14052006-06-30 Love Hörnquist Å
1406strand <lha@it.su.se>
1407
1408 * krb5/init_sec_context.c: Make work on compilers that are
1409 somewhat more picky then gcc4 (like gcc2.95)
1410
1411 * krb5/init_sec_context.c (do_delegation): use KDCOptions2int to
1412 convert fwd_flags to an integer, since otherwise int2KDCOptions in
1413 krb5_get_forwarded_creds wont do the right thing.
1414
1415 * mech/gss_set_cred_option.c (gss_set_cred_option): free memory on
1416 failure
1417
1418 * krb5/set_sec_context_option.c (_gsskrb5_set_sec_context_option):
1419 init global kerberos context
1420
1421 * krb5/set_cred_option.c (_gsskrb5_set_cred_option): init global
1422 kerberos context
1423
1424 * mech/gss_accept_sec_context.c: Insert the delegated sub cred on
1425 the delegated cred handle, not cred handle
1426
1427 * mech/gss_accept_sec_context.c (gss_accept_sec_context): handle
1428 the case where ret_flags == NULL
1429
1430 * mech/gss_mech_switch.c (add_builtin): set
1431 _gss_mech_switch->gm_mech_oid
1432
1433 * mech/gss_set_cred_option.c (gss_set_cred_option): laod mechs
1434
1435 * test_cred.c (gss_print_errors): don't try to print error when
1436 gss_display_status failed
1437
1438 * Makefile.am: Add mech/gss_release_oid.c
1439
1440 * mech/gss_release_oid.c: Add gss_release_oid, reverse of
1441 gss_duplicate_oid
1442
1443 * spnego/compat.c: preferred_mech_type was allocated with
1444 gss_duplicate_oid in one place and assigned static varianbles a
1445 the second place. change that static assignement to
1446 gss_duplicate_oid and bring back gss_release_oid.
1447
1448 * spnego/compat.c (_gss_spnego_delete_sec_context): don't release
1449 preferred_mech_type and negotiated_mech_type, they where never
1450 allocated from the begining.
1451
14522006-06-29 Love Hörnquist Å
1453strand <lha@it.su.se>
1454
1455 * mech/gss_import_name.c (gss_import_name): avoid
1456 type-punned/strict aliasing rules
1457
1458 * mech/gss_add_cred.c: avoid type-punned/strict aliasing rules
1459
1460 * gssapi.h: Make gss_name_t an opaque type.
1461
1462 * krb5: make gss_name_t an opaque type
1463
1464 * krb5/set_cred_option.c: Add
1465
1466 * mech/gss_set_cred_option.c (gss_set_cred_option): support the
1467 case where *cred_handle == NULL
1468
1469 * mech/gss_krb5.c (gss_krb5_import_cred): make sure cred is
1470 GSS_C_NO_CREDENTIAL on failure.
1471
1472 * mech/gss_acquire_cred.c (gss_acquire_cred): if desired_mechs is
1473 NO_OID_SET, there is a need to load the mechs, so always do that.
1474
14752006-06-28 Love Hörnquist Å
1476strand <lha@it.su.se>
1477
1478 * krb5/inquire_cred_by_oid.c: Reimplement GSS_KRB5_COPY_CCACHE_X
1479 to instead pass a fullname to the credential, then resolve and
1480 copy out the content, and then close the cred.
1481
1482 * mech/gss_krb5.c: Reimplement GSS_KRB5_COPY_CCACHE_X to instead
1483 pass a fullname to the credential, then resolve and copy out the
1484 content, and then close the cred.
1485
1486 * krb5/inquire_cred_by_oid.c: make "work", GSS_KRB5_COPY_CCACHE_X
1487 interface needs to be re-done, currently its utterly broken.
1488
1489 * mech/gss_set_cred_option.c: Make work.
1490
1491 * krb5/external.c: Add _gsskrb5_set_{sec_context,cred}_option
1492
1493 * mech/gss_krb5.c (gss_krb5_import_cred): implement
1494
1495 * Makefile.am: Add gss_set_{sec_context,cred}_option and sort
1496
1497 * mech/gss_set_{sec_context,cred}_option.c: add
1498
1499 * gssapi.h: Add GSS_KRB5_IMPORT_CRED_X
1500
1501 * test_*.c: make compile again
1502
1503 * Makefile.am: Add lib dependencies and test programs
1504
1505 * spnego: remove dependency on libkrb5
1506
1507 * mech: Bug fixes, cleanup, compiler warnings, restructure code.
1508
1509 * spnego: Rename gss_context_id_t and gss_cred_id_t to local names
1510
1511 * krb5: repro copy the krb5 files here
1512
1513 * mech: import Doug Rabson mechglue from freebsd
1514
1515 * spnego: Import Luke Howard's SPNEGO from the mechglue branch
1516
15172006-06-22 Love Hörnquist Å
1518strand <lha@it.su.se>
1519
1520 * gssapi.h: Add oid_to_str.
1521
1522 * Makefile.am: add oid_to_str and test_oid
1523
1524 * oid_to_str.c: Add gss_oid_to_str
1525
1526 * test_oid.c: Add test for gss_oid_to_str()
1527
15282006-05-13 Love Hörnquist Å
1529strand <lha@it.su.se>
1530
1531 * verify_mic.c: Less pointer signedness warnings.
1532
1533 * unwrap.c: Less pointer signedness warnings.
1534
1535 * arcfour.c: Less pointer signedness warnings.
1536
1537 * gssapi_locl.h: Use const void * to instead of unsigned char * to
1538 avoid pointer signedness warnings.
1539
1540 * encapsulate.c: Use const void * to instead of unsigned char * to
1541 avoid pointer signedness warnings.
1542
1543 * decapsulate.c: Use const void * to instead of unsigned char * to
1544 avoid pointer signedness warnings.
1545
1546 * decapsulate.c: Less pointer signedness warnings.
1547
1548 * cfx.c: Less pointer signedness warnings.
1549
1550 * init_sec_context.c: Less pointer signedness warnings (partly by
1551 using the new asn.1 CHOICE decoder)
1552
1553 * import_sec_context.c: Less pointer signedness warnings.
1554
15552006-05-09 Love Hörnquist Å
1556strand <lha@it.su.se>
1557
1558 * accept_sec_context.c (gsskrb5_is_cfx): always set is_cfx. From
1559 Andrew Abartlet.
1560
15612006-05-08 Love Hörnquist Å
1562strand <lha@it.su.se>
1563
1564 * get_mic.c (mic_des3): make sure message_buffer doesn't point to
1565 free()ed memory on failure. Pointed out by IBM checker.
1566
15672006-05-05 Love Hörnquist Å
1568strand <lha@it.su.se>
1569
1570 * Rename u_intXX_t to uintXX_t
1571
15722006-05-04 Love Hörnquist Å
1573strand <lha@it.su.se>
1574
1575 * cfx.c: Less pointer signedness warnings.
1576
1577 * arcfour.c: Avoid pointer signedness warnings.
1578
1579 * gssapi_locl.h (gssapi_decode_*): make data argument const void *
1580
1581 * 8003.c (gssapi_decode_*): make data argument const void *
1582
15832006-04-12 Love Hörnquist Å
1584strand <lha@it.su.se>
1585
1586 * export_sec_context.c: Export sequence order element. From Wynn
1587 Wilkes <wynn.wilkes@quest.com>.
1588
1589 * import_sec_context.c: Import sequence order element. From Wynn
1590 Wilkes <wynn.wilkes@quest.com>.
1591
1592 * sequence.c (_gssapi_msg_order_import,_gssapi_msg_order_export):
1593 New functions, used by {import,export}_sec_context. From Wynn
1594 Wilkes <wynn.wilkes@quest.com>.
1595
1596 * test_sequence.c: Add test for import/export sequence.
1597
15982006-04-09 Love Hörnquist Å
1599strand <lha@it.su.se>
1600
1601 * add_cred.c: Check that cred != GSS_C_NO_CREDENTIAL, this is a
1602 standard conformance failure, but much better then a crash.
1603
16042006-04-02 Love Hörnquist Å
1605strand <lha@it.su.se>
1606
1607 * get_mic.c (get_mic*)_: make sure message_token is cleaned on
1608 error, found by IBM checker.
1609
1610 * wrap.c (wrap*): Reset output_buffer on error, found by IBM
1611 checker.
1612
16132006-02-15 Love Hörnquist Å
1614strand <lha@it.su.se>
1615
1616 * import_name.c: Accept both GSS_C_NT_HOSTBASED_SERVICE and
1617 GSS_C_NT_HOSTBASED_SERVICE_X as nametype for hostbased names.
1618
16192006-01-16 Love Hörnquist Å
1620strand <lha@it.su.se>
1621
1622 * delete_sec_context.c (gss_delete_sec_context): if the context
1623 handle is GSS_C_NO_CONTEXT, don't fall over.
1624
16252005-12-12 Love Hörnquist Å
1626strand <lha@it.su.se>
1627
1628 * gss_acquire_cred.3: Replace gss_krb5_import_ccache with
1629 gss_krb5_import_cred and add more references
1630
16312005-12-05 Love Hörnquist Å
1632strand <lha@it.su.se>
1633
1634 * gssapi.h: Change gss_krb5_import_ccache to gss_krb5_import_cred,
1635 it can handle keytabs too.
1636
1637 * add_cred.c (gss_add_cred): avoid deadlock
1638
1639 * context_time.c (gssapi_lifetime_left): define the 0 lifetime as
1640 GSS_C_INDEFINITE.
1641
16422005-12-01 Love Hörnquist Å
1643strand <lha@it.su.se>
1644
1645 * acquire_cred.c (acquire_acceptor_cred): only check if principal
1646 exists if we got called with principal as an argument.
1647
1648 * acquire_cred.c (acquire_acceptor_cred): check that the acceptor
1649 exists in the keytab before returning ok.
1650
16512005-11-29 Love Hörnquist Å
1652strand <lha@it.su.se>
1653
1654 * copy_ccache.c (gss_krb5_import_cred): fix buglet, from Andrew
1655 Bartlett.
1656
16572005-11-25 Love Hörnquist Å
1658strand <lha@it.su.se>
1659
1660 * test_kcred.c: Rename gss_krb5_import_ccache to
1661 gss_krb5_import_cred.
1662
1663 * copy_ccache.c: Rename gss_krb5_import_ccache to
1664 gss_krb5_import_cred and let it grow code to handle keytabs too.
1665
16662005-11-02 Love Hörnquist Å
1667strand <lha@it.su.se>
1668
1669 * init_sec_context.c: Change sematics of ok-as-delegate to match
1670 windows if
1671 [gssapi]realm/ok-as-delegate=true is set, otherwise keep old
1672 sematics.
1673
1674 * release_cred.c (gss_release_cred): use
1675 GSS_CF_DESTROY_CRED_ON_RELEASE to decide if the cache should be
1676 krb5_cc_destroy-ed
1677
1678 * acquire_cred.c (acquire_initiator_cred):
1679 GSS_CF_DESTROY_CRED_ON_RELEASE on created credentials.
1680
1681 * accept_sec_context.c (gsskrb5_accept_delegated_token): rewrite
1682 to use gss_krb5_import_ccache
1683
16842005-11-01 Love Hörnquist Å
1685strand <lha@it.su.se>
1686
1687 * arcfour.c: Remove signedness warnings.
1688
16892005-10-31 Love Hörnquist Å
1690strand <lha@it.su.se>
1691
1692 * gss_acquire_cred.3: Document that gss_krb5_import_ccache is copy
1693 by reference.
1694
1695 * copy_ccache.c (gss_krb5_import_ccache): Instead of making a copy
1696 of the ccache, make a reference by getting the name and resolving
1697 the name. This way the cache is shared, this flipp side is of
1698 course that if someone calls krb5_cc_destroy the cache is lost for
1699 everyone.
1700
1701 * test_kcred.c: Remove memory leaks.
1702
17032005-10-26 Love Hörnquist Å
1704strand <lha@it.su.se>
1705
1706 * Makefile.am: build test_kcred
1707
1708 * gss_acquire_cred.3: Document gss_krb5_import_ccache
1709
1710 * gssapi.3: Sort and add gss_krb5_import_ccache.
1711
1712 * acquire_cred.c (_gssapi_krb5_ccache_lifetime): break out code
1713 used to extract lifetime from a credential cache
1714
1715 * gssapi_locl.h: Add _gssapi_krb5_ccache_lifetime, used to extract
1716 lifetime from a credential cache.
1717
1718 * gssapi.h: add gss_krb5_import_ccache, reverse of
1719 gss_krb5_copy_ccache
1720
1721 * copy_ccache.c: add gss_krb5_import_ccache, reverse of
1722 gss_krb5_copy_ccache
1723
1724 * test_kcred.c: test gss_krb5_import_ccache
1725
17262005-10-21 Love Hörnquist Å
1727strand <lha@it.su.se>
1728
1729 * acquire_cred.c (acquire_initiator_cred): use krb5_cc_cache_match
1730 to find a matching creditial cache, if that failes, fallback to
1731 the default cache.
1732
17332005-10-12 Love Hörnquist Å
1734strand <lha@it.su.se>
1735
1736 * gssapi_locl.h: Add gssapi_krb5_set_status and
1737 gssapi_krb5_clear_status
1738
1739 * init_sec_context.c (spnego_reply): Don't pass back raw Kerberos
1740 errors, use GSS-API errors instead. From Michael B Allen.
1741
1742 * display_status.c: Add gssapi_krb5_clear_status,
1743 gssapi_krb5_set_status for handling error messages.
1744
17452005-08-23 Love Hörnquist Å
1746strand <lha@it.su.se>
1747
1748 * external.c: Use rk_UNCONST to avoid const warning.
1749
1750 * display_status.c: Constify strings to avoid warnings.
1751
17522005-08-11 Love Hörnquist Å
1753strand <lha@it.su.se>
1754
1755 * init_sec_context.c: avoid warnings, update (c)
1756
17572005-07-13 Love Hörnquist Å
1758strand <lha@it.su.se>
1759
1760 * init_sec_context.c (spnego_initial): use NegotiationToken
1761 encoder now that we have one with the new asn1. compiler.
1762
1763 * Makefile.am: the new asn.1 compiler includes the modules name in
1764 the depend file
1765
17662005-06-16 Love Hörnquist Å
1767strand <lha@it.su.se>
1768
1769 * decapsulate.c: use rk_UNCONST
1770
1771 * ccache_name.c: rename to avoid shadowing
1772
1773 * gssapi_locl.h: give kret in GSSAPI_KRB5_INIT a more unique name
1774
1775 * process_context_token.c: use rk_UNCONST to unconstify
1776
1777 * test_cred.c: rename optind to optidx
1778
17792005-05-30 Love Hörnquist Å
1780strand <lha@it.su.se>
1781
1782 * init_sec_context.c (init_auth): honor ok-as-delegate if local
1783 configuration approves
1784
1785 * gssapi_locl.h: prototype for _gss_check_compat
1786
1787 * compat.c: export check_compat as _gss_check_compat
1788
17892005-05-29 Love Hörnquist Å
1790strand <lha@it.su.se>
1791
1792 * init_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1793 problems with system headerfiles that pollute the name space.
1794
1795 * accept_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1796 problems with system headerfiles that pollute the name space.
1797
17982005-05-17 Love Hörnquist Å
1799strand <lha@it.su.se>
1800
1801 * init_sec_context.c (init_auth): set
1802 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED (for java compatibility),
1803 also while here, use krb5_auth_con_addflags
1804
18052005-05-06 Love Hörnquist Å
1806strand <lha@it.su.se>
1807
1808 * arcfour.c (_gssapi_wrap_arcfour): fix calculating the encap
1809 length. From: Tom Maher <tmaher@eecs.berkeley.edu>
1810
18112005-05-02 Dave Love <fx@gnu.org>
1812
1813 * test_cred.c (main): Call setprogname.
1814
18152005-04-27 Love Hörnquist Å
1816strand <lha@it.su.se>
1817
1818 * prefix all sequence symbols with _, they are not part of the
1819 GSS-API api. By comment from Wynn Wilkes <wynnw@vintela.com>
1820
18212005-04-10 Love Hörnquist Å
1822strand <lha@it.su.se>
1823
1824 * accept_sec_context.c: break out the processing of the delegated
1825 credential to a separate function to make error handling easier,
1826 move the credential handling to after other setup is done
1827
1828 * test_sequence.c: make less verbose in case of success
1829
1830 * Makefile.am: add test_sequence to TESTS
1831
18322005-04-01 Love Hörnquist Å
1833strand <lha@it.su.se>
1834
1835 * 8003.c (gssapi_krb5_verify_8003_checksum): check that cksum
1836 isn't NULL From: Nicolas Pouvesle <npouvesle@tenablesecurity.com>
1837
18382005-03-21 Love Hörnquist Å
1839strand <lha@it.su.se>
1840
1841 * Makefile.am: use $(LIB_roken)
1842
18432005-03-16 Love Hörnquist Å
1844strand <lha@it.su.se>
1845
1846 * display_status.c (gssapi_krb5_set_error_string): pass in the
1847 krb5_context to krb5_free_error_string
1848
18492005-03-15 Love Hörnquist Å
1850strand <lha@it.su.se>
1851
1852 * display_status.c (gssapi_krb5_set_error_string): don't misuse
1853 the krb5_get_error_string api
1854
18552005-03-01 Love Hörnquist Å
1856strand <lha@it.su.se>
1857
1858 * compat.c (_gss_DES3_get_mic_compat): don't unlock mutex
1859 here. Bug reported by Stefan Metzmacher <metze@samba.org>
1860
18612005-02-21 Luke Howard <lukeh@padl.com>
1862
1863 * init_sec_context.c: don't call krb5_get_credentials() with
1864 KRB5_TC_MATCH_KEYTYPE, it can lead to the credentials cache
1865 growing indefinitely as no key is found with KEYTYPE_NULL
1866
1867 * compat.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG, it is
1868 no longer used (however the mechListMIC behaviour is broken,
1869 rfc2478bis support requires the code in the mechglue branch)
1870
1871 * init_sec_context.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1872
1873 * gssapi.h: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1874
18752005-01-05 Luke Howard <lukeh@padl.com>
1876
1877 * 8003.c: use symbolic name for checksum type
1878
1879 * accept_sec_context.c: allow client to indicate
1880 that subkey should be used
1881
1882 * acquire_cred.c: plug leak
1883
1884 * get_mic.c: use gss_krb5_get_subkey() instead
1885 of gss_krb5_get_{local,remote}key(), support
1886 KEYTYPE_ARCFOUR_56
1887
1888 * gssapi_local.c: use gss_krb5_get_subkey(),
1889 support KEYTYPE_ARCFOUR_56
1890
1891 * import_sec_context.c: plug leak
1892
1893 * unwrap.c: use gss_krb5_get_subkey(),
1894 support KEYTYPE_ARCFOUR_56
1895
1896 * verify_mic.c: use gss_krb5_get_subkey(),
1897 support KEYTYPE_ARCFOUR_56
1898
1899 * wrap.c: use gss_krb5_get_subkey(),
1900 support KEYTYPE_ARCFOUR_56
1901
19022004-11-30 Love Hörnquist Å
1903strand <lha@it.su.se>
1904
1905 * inquire_cred.c: Reverse order of HEIMDAL_MUTEX_unlock and
1906 gss_release_cred to avoid deadlock, from Luke Howard
1907 <lukeh@padl.com>.
1908
19092004-09-06 Love Hörnquist Å
1910strand <lha@it.su.se>
1911
1912 * gss_acquire_cred.3: gss_krb5_extract_authz_data_from_sec_context
1913 was renamed to gsskrb5_extract_authz_data_from_sec_context
1914
19152004-08-07 Love Hörnquist Å
1916strand <lha@it.su.se>
1917
1918 * unwrap.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1919
1920 * arcfour.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1921
19222004-05-06 Love Hörnquist Å
1923strand <lha@it.su.se>
1924
1925 * gssapi.3: spelling from Josef El-Rayes <josef@FreeBSD.org> while
1926 here, write some text about the SPNEGO situation
1927
19282004-04-08 Love Hörnquist Å
1929strand <lha@it.su.se>
1930
1931 * cfx.c: s/CTXAcceptorSubkey/CFXAcceptorSubkey/
1932
19332004-04-07 Love Hörnquist Å
1934strand <lha@it.su.se>
1935
1936 * gssapi.h: add GSS_C_EXPECTING_MECH_LIST_MIC_FLAG From: Luke
1937 Howard <lukeh@padl.com>
1938
1939 * init_sec_context.c (spnego_reply): use
1940 _gss_spnego_require_mechlist_mic to figure out if we need to check
1941 MechListMIC; From: Luke Howard <lukeh@padl.com>
1942
1943 * accept_sec_context.c (send_accept): use
1944 _gss_spnego_require_mechlist_mic to figure out if we need to send
1945 MechListMIC; From: Luke Howard <lukeh@padl.com>
1946
1947 * gssapi_locl.h: add _gss_spnego_require_mechlist_mic
1948 From: Luke Howard <lukeh@padl.com>
1949
1950 * compat.c: add _gss_spnego_require_mechlist_mic for compatibility
1951 with MS SPNEGO, From: Luke Howard <lukeh@padl.com>
1952
19532004-04-05 Love Hörnquist Å
1954strand <lha@it.su.se>
1955
1956 * accept_sec_context.c (gsskrb5_is_cfx): krb5_keyblock->keytype is
1957 an enctype, not keytype
1958
1959 * accept_sec_context.c: use ASN1_MALLOC_ENCODE
1960
1961 * init_sec_context.c: avoid the malloc loop and just allocate the
1962 propper amount of data
1963
1964 * init_sec_context.c (spnego_initial): handle mech_token better
1965
19662004-03-19 Love Hörnquist Å
1967strand <lha@it.su.se>
1968
1969 * gssapi.h: add gss_krb5_get_tkt_flags
1970
1971 * Makefile.am: add ticket_flags.c
1972
1973 * ticket_flags.c: Get ticket-flags from acceptor ticket From: Luke
1974 Howard <lukeh@PADL.COM>
1975
1976 * gss_acquire_cred.3: document gss_krb5_get_tkt_flags
1977
19782004-03-14 Love Hörnquist Å
1979strand <lha@it.su.se>
1980
1981 * acquire_cred.c (gss_acquire_cred): check usage before even
1982 bothering to process it, add both keytab and initial tgt if
1983 requested
1984
1985 * wrap.c: support cfx, try to handle acceptor asserted subkey
1986
1987 * unwrap.c: support cfx, try to handle acceptor asserted subkey
1988
1989 * verify_mic.c: support cfx
1990
1991 * get_mic.c: support cfx
1992
1993 * test_sequence.c: handle changed signature of
1994 gssapi_msg_order_create
1995
1996 * import_sec_context.c: handle acceptor asserted subkey
1997
1998 * init_sec_context.c: handle acceptor asserted subkey
1999
2000 * accept_sec_context.c: handle acceptor asserted subkey
2001
2002 * sequence.c: add dummy use_64 argument to gssapi_msg_order_create
2003
2004 * gssapi_locl.h: add partial support for CFX
2005
2006 * Makefile.am (noinst_PROGRAMS) += test_cred
2007
2008 * test_cred.c: gssapi credential testing
2009
2010 * test_acquire_cred.c: fix comment
2011
20122004-03-07 Love Hörnquist Å
2013strand <lha@it.su.se>
2014
2015 * arcfour.h: drop structures for message formats, no longer used
2016
2017 * arcfour.c: comment describing message formats
2018
2019 * accept_sec_context.c (spnego_accept_sec_context): make sure the
2020 length of the choice element doesn't overrun us
2021
2022 * init_sec_context.c (spnego_reply): make sure the length of the
2023 choice element doesn't overrun us
2024
2025 * spnego.asn1: move NegotiationToken to avoid warning
2026
2027 * spnego.asn1: uncomment NegotiationToken
2028
2029 * Makefile.am: spnego_files += asn1_NegotiationToken.x
2030
20312004-01-25 Love Hörnquist Å
2032strand <lha@it.su.se>
2033
2034 * gssapi.h: add gss_krb5_ccache_name
2035
2036 * Makefile.am (libgssapi_la_SOURCES): += ccache_name.c
2037
2038 * ccache_name.c (gss_krb5_ccache_name): help function enable to
2039 set krb5 name, using out_name argument makes function no longer
2040 thread-safe
2041
2042 * gssapi.3: add missing gss_krb5_ references
2043
2044 * gss_acquire_cred.3: document gss_krb5_ccache_name
2045
20462003-12-12 Love Hörnquist Å
2047strand <lha@it.su.se>
2048
2049 * cfx.c: make rrc a modulus operation if its longer then the
2050 length of the message, noticed by Sam Hartman
2051
20522003-12-07 Love Hörnquist Å
2053strand <lha@it.su.se>
2054
2055 * accept_sec_context.c: use krb5_auth_con_addflags
2056
20572003-12-05 Love Hörnquist Å
2058strand <lha@it.su.se>
2059
2060 * cfx.c: Wrap token id was in wrong order, found by Sam Hartman
2061
20622003-12-04 Love Hörnquist Å
2063strand <lha@it.su.se>
2064
2065 * cfx.c: add AcceptorSubkey (but no code understand it yet) ignore
2066 unknown token flags
2067
20682003-11-22 Love Hörnquist Å
2069strand <lha@it.su.se>
2070
2071 * accept_sec_context.c: Don't require timestamp to be set on
2072 delegated token, its already protected by the outer token (and
2073 windows doesn't alway send it) Pointed out by Zi-Bin Yang
2074 <zbyang@decru.com> on heimdal-discuss
2075
20762003-11-14 Love Hörnquist Å
2077strand <lha@it.su.se>
2078
2079 * cfx.c: fix {} error, pointed out by Liqiang Zhu
2080
20812003-11-10 Love Hörnquist Å
2082strand <lha@it.su.se>
2083
2084 * cfx.c: Sequence number should be stored in bigendian order From:
2085 Luke Howard <lukeh@padl.com>
2086
20872003-11-09 Love Hörnquist Å
2088strand <lha@it.su.se>
2089
2090 * delete_sec_context.c (gss_delete_sec_context): don't free
2091 ticket, krb5_free_ticket does that now
2092
20932003-11-06 Love Hörnquist Å
2094strand <lha@it.su.se>
2095
2096 * cfx.c: checksum the header last in MIC token, update to -03
2097 From: Luke Howard <lukeh@padl.com>
2098
20992003-10-07 Love Hörnquist Å
2100strand <lha@it.su.se>
2101
2102 * add_cred.c: If its a MEMORY cc, make a copy. We need to do this
2103 since now gss_release_cred will destroy the cred. This should be
2104 really be solved a better way.
2105
2106 * acquire_cred.c (gss_release_cred): if its a mcc, destroy it
2107 rather the just release it Found by: "Zi-Bin Yang"
2108 <zbyang@decru.com>
2109
2110 * acquire_cred.c (acquire_initiator_cred): use kret instead of ret
2111 where appropriate
2112
21132003-09-30 Love Hörnquist Å
2114strand <lha@it.su.se>
2115
2116 * gss_acquire_cred.3: spelling
2117 From: jmc <jmc@prioris.mini.pw.edu.pl>
2118
21192003-09-23 Love Hörnquist Å
2120strand <lha@it.su.se>
2121
2122 * cfx.c: - EC and RRC are big-endian, not little-endian - The
2123 default is now to rotate regardless of GSS_C_DCE_STYLE. There are
2124 no longer any references to GSS_C_DCE_STYLE. - rrc_rotate()
2125 avoids allocating memory on the heap if rrc <= 256
2126 From: Luke Howard <lukeh@padl.com>
2127
21282003-09-22 Love Hörnquist Å
2129strand <lha@it.su.se>
2130
2131 * cfx.[ch]: rrc_rotate() was untested and broken, fix it.
2132 Set and verify wrap Token->Filler.
2133 Correct token ID for wrap tokens,
2134 were accidentally swapped with delete tokens.
2135 From: Luke Howard <lukeh@PADL.COM>
2136
21372003-09-21 Love Hörnquist Å
2138strand <lha@it.su.se>
2139
2140 * cfx.[ch]: no ASN.1-ish header on per-message tokens
2141 From: Luke Howard <lukeh@PADL.COM>
2142
21432003-09-19 Love Hörnquist Å
2144strand <lha@it.su.se>
2145
2146 * arcfour.h: remove depenency on gss_arcfour_mic_token and
2147 gss_arcfour_warp_token
2148
2149 * arcfour.c: remove depenency on gss_arcfour_mic_token and
2150 gss_arcfour_warp_token
2151
21522003-09-18 Love Hörnquist Å
2153strand <lha@it.su.se>
2154
2155 * 8003.c: remove #if 0'ed code
2156
21572003-09-17 Love Hörnquist Å
2158strand <lha@it.su.se>
2159
2160 * accept_sec_context.c (gsskrb5_accept_sec_context): set sequence
2161 number when not requesting mutual auth From: Luke Howard
2162 <lukeh@PADL.COM>
2163
2164 * init_sec_context.c (init_auth): set sequence number when not
2165 requesting mutual auth From: Luke Howard <lukeh@PADL.COM>
2166
21672003-09-16 Love Hörnquist Å
2168strand <lha@it.su.se>
2169
2170 * arcfour.c (*): set minor_status
2171 (gss_wrap): set conf_state to conf_req_flags on success
2172 From: Luke Howard <lukeh@PADL.COM>
2173
2174 * wrap.c (gss_wrap_size_limit): use existing function From: Luke
2175 Howard <lukeh@PADL.COM>
2176
21772003-09-12 Love Hörnquist Å
2178strand <lha@it.su.se>
2179
2180 * indicate_mechs.c (gss_indicate_mechs): in case of error, free
2181 mech_set
2182
2183 * indicate_mechs.c (gss_indicate_mechs): add SPNEGO
2184
21852003-09-10 Love Hörnquist Å
2186strand <lha@it.su.se>
2187
2188 * init_sec_context.c (spnego_initial): catch errors and return
2189 them
2190
2191 * init_sec_context.c (spnego_initial): add #if 0 out version of
2192 the CHOICE branch encoding, also where here, free no longer used
2193 memory
2194
21952003-09-09 Love Hörnquist Å
2196strand <lha@it.su.se>
2197
2198 * gss_acquire_cred.3: support GSS_SPNEGO_MECHANISM
2199
2200 * accept_sec_context.c: SPNEGO doesn't include gss wrapping on
2201 SubsequentContextToken like the Kerberos 5 mech does.
2202
2203 * init_sec_context.c (spnego_reply): SPNEGO doesn't include gss
2204 wrapping on SubsequentContextToken like the Kerberos 5 mech
2205 does. Lets check for it anyway.
2206
2207 * accept_sec_context.c: Add support for SPNEGO on the initator
2208 side. Implementation initially from Assar Westerlund, passes
2209 though quite a lot of hands before I commited it.
2210
2211 * init_sec_context.c: Add support for SPNEGO on the initator side.
2212 Tested with ldap server on a Windows 2000 DC. Implementation
2213 initially from Assar Westerlund, passes though quite a lot of
2214 hands before I commited it.
2215
2216 * gssapi.h: export GSS_SPNEGO_MECHANISM
2217
2218 * gssapi_locl.h: include spnego_as.h add prototype for
2219 gssapi_krb5_get_mech
2220
2221 * decapsulate.c (gssapi_krb5_get_mech): make non static
2222
2223 * Makefile.am: build SPNEGO file
2224
22252003-09-08 Love Hörnquist Å
2226strand <lha@it.su.se>
2227
2228 * external.c: SPENGO and IAKERB oids
2229
2230 * spnego.asn1: SPENGO ASN1
2231
22322003-09-05 Love Hörnquist Å
2233strand <lha@it.su.se>
2234
2235 * cfx.c: RRC also need to be zero before wraping them
2236 From: Luke Howard <lukeh@PADL.COM>
2237
22382003-09-04 Love Hörnquist Å
2239strand <lha@it.su.se>
2240
2241 * encapsulate.c (gssapi_krb5_encap_length): don't return void
2242
22432003-09-03 Love Hörnquist Å
2244strand <lha@it.su.se>
2245
2246 * verify_mic.c: switch from the des_ to the DES_ api
2247
2248 * get_mic.c: switch from the des_ to the DES_ api
2249
2250 * unwrap.c: switch from the des_ to the DES_ api
2251
2252 * wrap.c: switch from the des_ to the DES_ api
2253
2254 * cfx.c: EC is not included in the checksum since the length might
2255 change depending on the data. From: Luke Howard <lukeh@PADL.COM>
2256
2257 * acquire_cred.c: use
2258 krb5_get_init_creds_opt_alloc/krb5_get_init_creds_opt_free
2259
22602003-09-01 Love Hörnquist Å
2261strand <lha@it.su.se>
2262
2263 * copy_ccache.c: rename
2264 gss_krb5_extract_authz_data_from_sec_context to
2265 gsskrb5_extract_authz_data_from_sec_context
2266
2267 * gssapi.h: rename gss_krb5_extract_authz_data_from_sec_context to
2268 gsskrb5_extract_authz_data_from_sec_context
2269
22702003-08-31 Love Hörnquist Å
2271strand <lha@it.su.se>
2272
2273 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2274 check that we have a ticket before we start to use it
2275
2276 * gss_acquire_cred.3: document
2277 gss_krb5_extract_authz_data_from_sec_context
2278
2279 * gssapi.h (gss_krb5_extract_authz_data_from_sec_context):
2280 return the kerberos authorizationdata, from idea of Luke Howard
2281
2282 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2283 return the kerberos authorizationdata, from idea of Luke Howard
2284
2285 * verify_mic.c (gss_verify_mic_internal): switch type and key
2286 argument
2287
22882003-08-30 Love Hörnquist Å
2289strand <lha@it.su.se>
2290
2291 * cfx.[ch]: draft-ietf-krb-wg-gssapi-cfx-01.txt implemetation
2292 From: Luke Howard <lukeh@PADL.COM>
2293
22942003-08-28 Love Hörnquist Å
2295strand <lha@it.su.se>
2296
2297 * arcfour.c (arcfour_mic_cksum): use free_Checksum to free the
2298 checksum
2299
2300 * arcfour.h: swap two last arguments to verify_mic for consistency
2301 with des3
2302
2303 * wrap.c,unwrap.c,get_mic.c,verify_mic.c,cfx.c,cfx.h:
2304 prefix cfx symbols with _gssapi_
2305
2306 * arcfour.c: release the right buffer
2307
2308 * arcfour.c: rename token structure in consistency with rest of
2309 GSS-API From: Luke Howard <lukeh@PADL.COM>
2310
2311 * unwrap.c (unwrap_des3): use _gssapi_verify_pad
2312 (unwrap_des): use _gssapi_verify_pad
2313
2314 * arcfour.c (_gssapi_wrap_arcfour): set the correct padding
2315 (_gssapi_unwrap_arcfour): verify and strip padding
2316
2317 * gssapi_locl.h: added _gssapi_verify_pad
2318
2319 * decapsulate.c (_gssapi_verify_pad): verify padding of a gss
2320 wrapped message and return its length
2321
2322 * arcfour.c: support KEYTYPE_ARCFOUR_56 keys, from Luke Howard
2323 <lukeh@PADL.COM>
2324
2325 * arcfour.c: use right seal alg, inherit keytype from parent key
2326
2327 * arcfour.c: include the confounder in the checksum use the right
2328 key usage number for warped/unwraped tokens
2329
2330 * gssapi.h: add gss_krb5_nt_general_name as an mit compat glue
2331 (same as GSS_KRB5_NT_PRINCIPAL_NAME)
2332
2333 * unwrap.c: hook in arcfour unwrap
2334
2335 * wrap.c: hook in arcfour wrap
2336
2337 * verify_mic.c: hook in arcfour verify_mic
2338
2339 * get_mic.c: hook in arcfour get_mic
2340
2341 * arcfour.c: implement wrap/unwarp
2342
2343 * gssapi_locl.h: add gssapi_{en,de}code_be_om_uint32
2344
2345 * 8003.c: add gssapi_{en,de}code_be_om_uint32
2346
23472003-08-27 Love Hörnquist Å
2348strand <lha@it.su.se>
2349
2350 * arcfour.c (_gssapi_verify_mic_arcfour): Do the checksum on right
2351 area. Swap filler check, it was reversed.
2352
2353 * Makefile.am (libgssapi_la_SOURCES): += arcfour.c
2354
2355 * gssapi_locl.h: include "arcfour.h"
2356
2357 * arcfour.c: arcfour gss-api mech, get_mic/verify_mic working
2358
2359 * arcfour.h: arcfour gss-api mech, get_mic/verify_mic working
2360
23612003-08-26 Love Hörnquist Å
2362strand <lha@it.su.se>
2363
2364 * gssapi_locl.h: always include cfx.h add prototype for
2365 _gssapi_decapsulate
2366
2367 * cfx.[ch]: Implementation of draft-ietf-krb-wg-gssapi-cfx-00.txt
2368 from Luke Howard <lukeh@PADL.COM>
2369
2370 * decapsulate.c: add _gssapi_decapsulate, from Luke Howard
2371 <lukeh@PADL.COM>
2372
23732003-08-25 Love Hörnquist Å
2374strand <lha@it.su.se>
2375
2376 * unwrap.c: encap/decap now takes a oid if the enctype/keytype is
2377 arcfour, return error add hook for cfx
2378
2379 * verify_mic.c: encap/decap now takes a oid if the enctype/keytype
2380 is arcfour, return error add hook for cfx
2381
2382 * get_mic.c: encap/decap now takes a oid if the enctype/keytype is
2383 arcfour, return error add hook for cfx
2384
2385 * accept_sec_context.c: encap/decap now takes a oid
2386
2387 * init_sec_context.c: encap/decap now takes a oid
2388
2389 * gssapi_locl.h: include cfx.h if we need it lifetime is a
2390 OM_uint32, depend on gssapi interface add all new encap/decap
2391 functions
2392
2393 * decapsulate.c: add decap functions that doesn't take the token
2394 type also make all decap function take the oid mech that they
2395 should use
2396
2397 * encapsulate.c: add encap functions that doesn't take the token
2398 type also make all encap function take the oid mech that they
2399 should use
2400
2401 * sequence.c (elem_insert): fix a off by one index counter
2402
2403 * inquire_cred.c (gss_inquire_cred): handle cred_handle being
2404 GSS_C_NO_CREDENTIAL and use the default cred then.
2405
24062003-08-19 Love Hörnquist Å
2407strand <lha@it.su.se>
2408
2409 * gss_acquire_cred.3: break out extensions and document
2410 gsskrb5_register_acceptor_identity
2411
24122003-08-18 Love Hörnquist Å
2413strand <lha@it.su.se>
2414
2415 * test_acquire_cred.c (print_time): time is returned in seconds
2416 from now, not unix time
2417
24182003-08-17 Love Hörnquist Å
2419strand <lha@it.su.se>
2420
2421 * compat.c (check_compat): avoid leaking principal when finding a
2422 match
2423
2424 * address_to_krb5addr.c: sa_size argument to krb5_addr2sockaddr is
2425 a krb5_socklen_t
2426
2427 * acquire_cred.c (gss_acquire_cred): 4th argument to
2428 gss_test_oid_set_member is a int
2429
24302003-07-22 Love Hörnquist Å
2431strand <lha@it.su.se>
2432
2433 * init_sec_context.c (repl_mutual): don't set kerberos error where
2434 there was no kerberos error
2435
2436 * gssapi_locl.h: Add destruction/creation prototypes and structure
2437 for the thread specific storage.
2438
2439 * display_status.c: use thread specific storage to set/get the
2440 kerberos error message
2441
2442 * init.c: Provide locking around the creation of the global
2443 krb5_context. Add destruction/creation functions for the thread
2444 specific storage that the error string handling is using.
2445
24462003-07-20 Love Hörnquist Å
2447strand <lha@it.su.se>
2448
2449 * gss_acquire_cred.3: add missing prototype and missing .Ft
2450 arguments
2451
24522003-06-17 Love Hörnquist Å
2453strand <lha@it.su.se>
2454
2455 * verify_mic.c: reorder code so sequence numbers can can be used
2456
2457 * unwrap.c: reorder code so sequence numbers can can be used
2458
2459 * sequence.c: remove unused function, indent, add
2460 gssapi_msg_order_f that filter gss flags to gss_msg_order flags
2461
2462 * gssapi_locl.h: prototypes for
2463 gssapi_{encode_om_uint32,decode_om_uint32} add sequence number
2464 verifier prototypes
2465
2466 * delete_sec_context.c: destroy sequence number verifier
2467
2468 * init_sec_context.c: remember to free data use sequence number
2469 verifier
2470
2471 * accept_sec_context.c: don't clear output_token twice remember to
2472 free data use sequence number verifier
2473
2474 * 8003.c: export and rename encode_om_uint32/decode_om_uint32 and
2475 start to use them
2476
24772003-06-09 Johan Danielsson <joda@pdc.kth.se>
2478
2479 * Makefile.am: can't have sequence.c in two different places
2480
24812003-06-06 Love Hörnquist Å
2482strand <lha@it.su.se>
2483
2484 * test_sequence.c: check rollover, print summery
2485
2486 * wrap.c (sub_wrap_size): gss_wrap_size_limit() has
2487 req_output_size and max_input_size around the wrong way -- it
2488 returns the output token size for a given input size, rather than
2489 the maximum input size for a given output token size.
2490
2491 From: Luke Howard <lukeh@PADL.COM>
2492
24932003-06-05 Love Hörnquist Å
2494strand <lha@it.su.se>
2495
2496 * gssapi_locl.h: add prototypes for sequence.c
2497
2498 * Makefile.am (libgssapi_la_SOURCES): add sequence.c
2499 (test_sequence): build
2500
2501 * sequence.c: sequence number checks, order and replay
2502 * test_sequence.c: sequence number checks, order and replay
2503
25042003-06-03 Love Hörnquist Å
2505strand <lha@it.su.se>
2506
2507 * accept_sec_context.c (gss_accept_sec_context): make sure time is
2508 returned in seconds from now, not in kerberos time
2509
2510 * acquire_cred.c (gss_aquire_cred): make sure time is returned in
2511 seconds from now, not in kerberos time
2512
2513 * init_sec_context.c (init_auth): if the cred is expired before we
2514 tries to create a token, fail so the peer doesn't need reject us
2515 (*): make sure time is returned in seconds from now,
2516 not in kerberos time
2517 (repl_mutual): remember to unlock the context mutex
2518
2519 * context_time.c (gss_context_time): remove unused variable
2520
2521 * verify_mic.c: make sure minor_status is always set, pointed out
2522 by Luke Howard <lukeh@PADL.COM>
2523
25242003-05-21 Love Hörnquist Å
2525strand <lha@it.su.se>
2526
2527 * *.[ch]: do some basic locking (no reference counting so contexts
2528 can be removed while still used)
2529 - don't export gss_ctx_id_t_desc_struct and gss_cred_id_t_desc_struct
2530 - make sure all lifetime are returned in seconds left until expired,
2531 not in unix epoch
2532
2533 * gss_acquire_cred.3: document argument lifetime_rec to function
2534 gss_inquire_context
2535
25362003-05-17 Love Hörnquist Å
2537strand <lha@it.su.se>
2538
2539 * test_acquire_cred.c: test gss_add_cred more then once
2540
25412003-05-06 Love Hörnquist Å
2542strand <lha@it.su.se>
2543
2544 * gssapi.h: if __cplusplus, wrap the extern variable (just to be
2545 safe) and functions in extern "C" { }
2546
25472003-04-30 Love Hörnquist Å
2548strand <lha@it.su.se>
2549
2550 * gssapi.3: more about the des3 mic mess
2551
2552 * verify_mic.c (verify_mic_des3): always check if the mic is the
2553 correct mic or the mic that old heimdal would have generated
2554
25552003-04-28 Jacques Vidrine <nectar@kth.se>
2556
2557 * verify_mic.c (verify_mic_des3): If MIC verification fails,
2558 retry using the `old' MIC computation (with zero IV).
2559
25602003-04-26 Love Hörnquist Å
2561strand <lha@it.su.se>
2562
2563 * gss_acquire_cred.3: more about difference between comparing IN
2564 and MN
2565
2566 * gss_acquire_cred.3: more about name type and access control
2567
25682003-04-25 Love Hörnquist Å
2569strand <lha@it.su.se>
2570
2571 * gss_acquire_cred.3: document gss_context_time
2572
2573 * context_time.c: if lifetime of context have expired, set
2574 time_rec to 0 and return GSS_S_CONTEXT_EXPIRED
2575
2576 * gssapi.3: document [gssapi]correct_des3_mic
2577 [gssapi]broken_des3_mic
2578
2579 * gss_acquire_cred.3: document gss_krb5_compat_des3_mic
2580
2581 * compat.c (gss_krb5_compat_des3_mic): enable turning on/off des3
2582 mic compat
2583 (_gss_DES3_get_mic_compat): handle [gssapi]correct_des3_mic too
2584
2585 * gssapi.h (gss_krb5_compat_des3_mic): new function, turn on/off
2586 des3 mic compat
2587 (GSS_C_KRB5_COMPAT_DES3_MIC): cpp symbol that exists if
2588 gss_krb5_compat_des3_mic exists
2589
25902003-04-24 Love Hörnquist Å
2591strand <lha@it.su.se>
2592
2593 * Makefile.am: (libgssapi_la_LDFLAGS): update major
2594 version of gssapi for incompatiblity in 3des getmic support
2595
25962003-04-23 Love Hörnquist Å
2597strand <lha@it.su.se>
2598
2599 * Makefile.am: test_acquire_cred_LDADD: use libgssapi.la not
2600 ./libgssapi.la (make make -jN work)
2601
26022003-04-16 Love Hörnquist Å
2603strand <lha@it.su.se>
2604
2605 * gssapi.3: spelling
2606
2607 * gss_acquire_cred.3: Change .Fd #include <header.h> to .In
2608 header.h, from Thomas Klausner <wiz@netbsd.org>
2609
2610
26112003-04-06 Love Hörnquist Å
2612strand <lha@it.su.se>
2613
2614 * gss_acquire_cred.3: spelling
2615
2616 * Makefile.am: remove stuff that sneaked in with last commit
2617
2618 * acquire_cred.c (acquire_initiator_cred): if the requested name
2619 isn't in the ccache, also check keytab. Extact the krbtgt for the
2620 default realm to check how long the credentials will last.
2621
2622 * add_cred.c (gss_add_cred): don't create a new ccache, just open
2623 the old one; better check if output handle is compatible with new
2624 (copied) handle
2625
2626 * test_acquire_cred.c: test gss_add_cred too
2627
26282003-04-03 Love Hörnquist Å
2629strand <lha@it.su.se>
2630
2631 * Makefile.am: build test_acquire_cred
2632
2633 * test_acquire_cred.c: simple gss_acquire_cred test
2634
26352003-04-02 Love Hörnquist Å
2636strand <lha@it.su.se>
2637
2638 * gss_acquire_cred.3: s/gssapi/GSS-API/
2639
26402003-03-19 Love Hörnquist Å
2641strand <lha@it.su.se>
2642
2643 * gss_acquire_cred.3: document v1 interface (and that they are
2644 obsolete)
2645
26462003-03-18 Love Hörnquist Å
2647strand <lha@it.su.se>
2648
2649 * gss_acquire_cred.3: list supported mechanism and nametypes
2650
26512003-03-16 Love Hörnquist Å
2652strand <lha@it.su.se>
2653
2654 * gss_acquire_cred.3: text about gss_display_name
2655
2656 * Makefile.am (libgssapi_la_LDFLAGS): bump to 3:6:2
2657 (libgssapi_la_SOURCES): add all new functions
2658
2659 * gssapi.3: now that we have a functions, uncomment the missing
2660 ones
2661
2662 * gss_acquire_cred.3: now that we have a functions, uncomment the
2663 missing ones
2664
2665 * process_context_token.c: implement gss_process_context_token
2666
2667 * inquire_names_for_mech.c: implement gss_inquire_names_for_mech
2668
2669 * inquire_mechs_for_name.c: implement gss_inquire_mechs_for_name
2670
2671 * inquire_cred_by_mech.c: implement gss_inquire_cred_by_mech
2672
2673 * add_cred.c: implement gss_add_cred
2674
2675 * acquire_cred.c (gss_acquire_cred): more testing of input
2676 argument, make sure output arguments are ok, since we don't know
2677 the time_rec (for now), set it to time_req
2678
2679 * export_sec_context.c: send lifetime, also set minor_status
2680
2681 * get_mic.c: set minor_status
2682
2683 * import_sec_context.c (gss_import_sec_context): add error
2684 checking, pick up lifetime (if there is no lifetime, use
2685 GSS_C_INDEFINITE)
2686
2687 * init_sec_context.c: take care to set export value to something
2688 sane before we start so caller will have harmless values in them
2689 if then function fails
2690
2691 * release_buffer.c (gss_release_buffer): set minor_status
2692
2693 * wrap.c: make sure minor_status get set
2694
2695 * verify_mic.c (gss_verify_mic_internal): rename verify_mic to
2696 gss_verify_mic_internal and let it take the type as an argument,
2697 (gss_verify_mic): call gss_verify_mic_internal
2698 set minor_status
2699
2700 * unwrap.c: set minor_status
2701
2702 * test_oid_set_member.c (gss_test_oid_set_member): use
2703 gss_oid_equal
2704
2705 * release_oid_set.c (gss_release_oid_set): set minor_status
2706
2707 * release_name.c (gss_release_name): set minor_status
2708
2709 * release_cred.c (gss_release_cred): set minor_status
2710
2711 * add_oid_set_member.c (gss_add_oid_set_member): set minor_status
2712
2713 * compare_name.c (gss_compare_name): set minor_status
2714
2715 * compat.c (check_compat): make sure ret have a defined value
2716
2717 * context_time.c (gss_context_time): set minor_status
2718
2719 * copy_ccache.c (gss_krb5_copy_ccache): set minor_status
2720
2721 * create_emtpy_oid_set.c (gss_create_empty_oid_set): set
2722 minor_status
2723
2724 * delete_sec_context.c (gss_delete_sec_context): set minor_status
2725
2726 * display_name.c (gss_display_name): set minor_status
2727
2728 * display_status.c (gss_display_status): use gss_oid_equal, handle
2729 supplementary errors
2730
2731 * duplicate_name.c (gss_duplicate_name): set minor_status
2732
2733 * inquire_context.c (gss_inquire_context): set lifetime_rec now
2734 when we know it, set minor_status
2735
2736 * inquire_cred.c (gss_inquire_cred): take care to set export value
2737 to something sane before we start so caller will have harmless
2738 values in them if the function fails
2739
2740 * accept_sec_context.c (gss_accept_sec_context): take care to set
2741 export value to something sane before we start so caller will have
2742 harmless values in them if then function fails, set lifetime from
2743 ticket expiration date
2744
2745 * indicate_mechs.c (gss_indicate_mechs): use
2746 gss_create_empty_oid_set and gss_add_oid_set_member
2747
2748 * gssapi.h (gss_ctx_id_t_desc): store the lifetime in the cred,
2749 since there is no ticket transfered in the exported context
2750
2751 * export_name.c (gss_export_name): export name with
2752 GSS_C_NT_EXPORT_NAME wrapping, not just the principal
2753
2754 * import_name.c (import_export_name): new function, parses a
2755 GSS_C_NT_EXPORT_NAME
2756 (import_krb5_name): factor out common code of parsing krb5 name
2757 (gss_oid_equal): rename from oid_equal
2758
2759 * gssapi_locl.h: add prototypes for gss_oid_equal and
2760 gss_verify_mic_internal
2761
2762 * gssapi.h: comment out the argument names
2763
27642003-03-15 Love Hörnquist Å
2765strand <lha@it.su.se>
2766
2767 * gssapi.3: add LIST OF FUNCTIONS and copyright/license
2768
2769 * Makefile.am: s/gss_aquire_cred.3/gss_acquire_cred.3/
2770
2771 * Makefile.am: man_MANS += gss_aquire_cred.3
2772
27732003-03-14 Love Hörnquist Å
2774strand <lha@it.su.se>
2775
2776 * gss_aquire_cred.3: the gssapi api manpage
2777
27782003-03-03 Love Hörnquist Å
2779strand <lha@it.su.se>
2780
2781 * inquire_context.c: (gss_inquire_context): rename argument open
2782 to open_context
2783
2784 * gssapi.h (gss_inquire_context): rename argument open to open_context
2785
27862003-02-27 Love Hörnquist Å
2787strand <lha@it.su.se>
2788
2789 * init_sec_context.c (do_delegation): remove unused variable
2790 subkey
2791
2792 * gssapi.3: all 0.5.x version had broken token delegation
2793
27942003-02-21 Love Hörnquist Å
2795strand <lha@it.su.se>
2796
2797 * (init_auth): only generate one subkey
2798
27992003-01-27 Love Hörnquist Å
2800strand <lha@it.su.se>
2801
2802 * verify_mic.c (verify_mic_des3): fix 3des verify_mic to conform
2803 to rfc (and mit kerberos), provide backward compat hook
2804
2805 * get_mic.c (mic_des3): fix 3des get_mic to conform to rfc (and
2806 mit kerberos), provide backward compat hook
2807
2808 * init_sec_context.c (init_auth): check if we need compat for
2809 older get_mic/verify_mic
2810
2811 * gssapi_locl.h: add prototype for _gss_DES3_get_mic_compat
2812
2813 * gssapi.h (more_flags): add COMPAT_OLD_DES3
2814
2815 * Makefile.am: add gssapi.3 and compat.c
2816
2817 * gssapi.3: add gssapi COMPATIBILITY documentation
2818
2819 * accept_sec_context.c (gss_accept_sec_context): check if we need
2820 compat for older get_mic/verify_mic
2821
2822 * compat.c: check for compatiblity with other heimdal's 3des
2823 get_mic/verify_mic
2824
28252002-10-31 Johan Danielsson <joda@pdc.kth.se>
2826
2827 * check return value from gssapi_krb5_init
2828
2829 * 8003.c (gssapi_krb5_verify_8003_checksum): check size of input
2830
28312002-09-03 Johan Danielsson <joda@pdc.kth.se>
2832
2833 * wrap.c (wrap_des3): use ETYPE_DES3_CBC_NONE
2834
2835 * unwrap.c (unwrap_des3): use ETYPE_DES3_CBC_NONE
2836
28372002-09-02 Johan Danielsson <joda@pdc.kth.se>
2838
2839 * init_sec_context.c: we need to generate a local subkey here
2840
28412002-08-20 Jacques Vidrine <n@nectar.com>
2842
2843 * acquire_cred.c, inquire_cred.c, release_cred.c: Use default
2844 credential resolution if gss_acquire_cred is called with
2845 GSS_C_NO_NAME.
2846
28472002-06-20 Jacques Vidrine <n@nectar.com>
2848
2849 * import_name.c: Compare name types by value if pointers do
2850 not match. Reported by: "Douglas E. Engert" <deengert@anl.gov>
2851
28522002-05-20 Jacques Vidrine <n@nectar.com>
2853
2854 * verify_mic.c (gss_verify_mic), unwrap.c (gss_unwrap): initialize
2855 the qop_state parameter. from Doug Rabson <dfr@nlsystems.com>
2856
28572002-05-09 Jacques Vidrine <n@nectar.com>
2858
2859 * acquire_cred.c: handle GSS_C_INITIATE/GSS_C_ACCEPT/GSS_C_BOTH
2860
28612002-05-08 Jacques Vidrine <n@nectar.com>
2862
2863 * acquire_cred.c: initialize gssapi; handle null desired_name
2864
28652002-03-22 Johan Danielsson <joda@pdc.kth.se>
2866
2867 * Makefile.am: remove non-functional stuff accidentally committed
2868
28692002-03-11 Assar Westerlund <assar@sics.se>
2870
2871 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:5:2
2872 * 8003.c (gssapi_krb5_verify_8003_checksum): handle zero channel
2873 bindings
2874
28752001-10-31 Jacques Vidrine <n@nectar.com>
2876
2877 * get_mic.c (mic_des3): MIC computation using DES3/SHA1
2878 was bogusly appending the message buffer to the result,
2879 overwriting a heap buffer in the process.
2880
28812001-08-29 Assar Westerlund <assar@sics.se>
2882
2883 * 8003.c (gssapi_krb5_verify_8003_checksum,
2884 gssapi_krb5_create_8003_checksum): make more consistent by always
2885 returning an gssapi error and setting minor status. update
2886 callers
2887
28882001-08-28 Jacques Vidrine <n@nectar.com>
2889
2890 * accept_sec_context.c: Create a cache for delegated credentials
2891 when needed.
2892
28932001-08-28 Assar Westerlund <assar@sics.se>
2894
2895 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:4:2
2896
28972001-08-23 Assar Westerlund <assar@sics.se>
2898
2899 * *.c: handle minor_status more consistently
2900
2901 * display_status.c (gss_display_status): handle krb5_get_err_text
2902 failing
2903
29042001-08-15 Johan Danielsson <joda@pdc.kth.se>
2905
2906 * gssapi_locl.h: fix prototype for gssapi_krb5_init
2907
29082001-08-13 Johan Danielsson <joda@pdc.kth.se>
2909
2910 * accept_sec_context.c (gsskrb5_register_acceptor_identity): init
2911 context and check return value from kt_resolve
2912
2913 * init.c: return error code
2914
29152001-07-19 Assar Westerlund <assar@sics.se>
2916
2917 * Makefile.am (libgssapi_la_LDFLAGS): update to 3:3:2
2918
29192001-07-12 Assar Westerlund <assar@sics.se>
2920
2921 * Makefile.am (libgssapi_la_LIBADD): add required library
2922 dependencies
2923
29242001-07-06 Assar Westerlund <assar@sics.se>
2925
2926 * accept_sec_context.c (gsskrb5_register_acceptor_identity): set
2927 the keytab to be used for gss_acquire_cred too'
2928
29292001-07-03 Assar Westerlund <assar@sics.se>
2930
2931 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:2:2
2932
29332001-06-18 Assar Westerlund <assar@sics.se>
2934
2935 * wrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2936 and gss_krb5_get_remotekey
2937 * verify_mic.c: update krb5_auth_con function names use
2938 gss_krb5_get_remotekey
2939 * unwrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2940 and gss_krb5_get_remotekey
2941 * gssapi_locl.h (gss_krb5_get_remotekey, gss_krb5_get_localkey):
2942 add prototypes
2943 * get_mic.c: update krb5_auth_con function names. use
2944 gss_krb5_get_localkey
2945 * accept_sec_context.c: update krb5_auth_con function names
2946
29472001-05-17 Assar Westerlund <assar@sics.se>
2948
2949 * Makefile.am: bump version to 3:1:2
2950
29512001-05-14 Assar Westerlund <assar@sics.se>
2952
2953 * address_to_krb5addr.c: adapt to new address functions
2954
29552001-05-11 Assar Westerlund <assar@sics.se>
2956
2957 * try to return the error string from libkrb5 where applicable
2958
29592001-05-08 Assar Westerlund <assar@sics.se>
2960
2961 * delete_sec_context.c (gss_delete_sec_context): remember to free
2962 the memory used by the ticket itself. from <tmartin@mirapoint.com>
2963
29642001-05-04 Assar Westerlund <assar@sics.se>
2965
2966 * gssapi_locl.h: add config.h for completeness
2967 * gssapi.h: remove config.h, this is an installed header file
2968 sys/types.h is not needed either
2969
29702001-03-12 Assar Westerlund <assar@sics.se>
2971
2972 * acquire_cred.c (gss_acquire_cred): remove memory leaks. from
2973 Jason R Thorpe <thorpej@zembu.com>
2974
29752001-02-18 Assar Westerlund <assar@sics.se>
2976
2977 * accept_sec_context.c (gss_accept_sec_context): either return
2978 gss_name NULL-ed or set
2979
2980 * import_name.c: set minor_status in some cases where it was not
2981 done
2982
29832001-02-15 Assar Westerlund <assar@sics.se>
2984
2985 * wrap.c: use krb5_generate_random_block for the confounders
2986
29872001-01-30 Assar Westerlund <assar@sics.se>
2988
2989 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:0:2
2990 * acquire_cred.c, init_sec_context.c, release_cred.c: add support
2991 for getting creds from a keytab, from fvdl@netbsd.org
2992
2993 * copy_ccache.c: add gss_krb5_copy_ccache
2994
29952001-01-27 Assar Westerlund <assar@sics.se>
2996
2997 * get_mic.c: cast parameters to des function to non-const pointers
2998 to handle the case where these functions actually take non-const
2999 des_cblock *
3000
30012001-01-09 Assar Westerlund <assar@sics.se>
3002
3003 * accept_sec_context.c (gss_accept_sec_context): use krb5_rd_cred2
3004 instead of krb5_rd_cred
3005
30062000-12-11 Assar Westerlund <assar@sics.se>
3007
3008 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:3:1
3009
30102000-12-08 Assar Westerlund <assar@sics.se>
3011
3012 * wrap.c (wrap_des3): use the checksum as ivec when encrypting the
3013 sequence number
3014 * unwrap.c (unwrap_des3): use the checksum as ivec when encrypting
3015 the sequence number
3016 * init_sec_context.c (init_auth): always zero fwd_data
3017
30182000-12-06 Johan Danielsson <joda@pdc.kth.se>
3019
3020 * accept_sec_context.c: de-pointerise auth_context parameter to
3021 krb5_mk_rep
3022
30232000-11-15 Assar Westerlund <assar@sics.se>
3024
3025 * init_sec_context.c (init_auth): update to new
3026 krb5_build_authenticator
3027
30282000-09-19 Assar Westerlund <assar@sics.se>
3029
3030 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:2:1
3031
30322000-08-27 Assar Westerlund <assar@sics.se>
3033
3034 * init_sec_context.c: actually pay attention to `time_req'
3035 * init_sec_context.c: re-organize. leak less memory.
3036 * gssapi_locl.h (gssapi_krb5_encapsulate, gss_krb5_getsomekey):
3037 update prototypes add assert.h
3038 * gssapi.h (GSS_KRB5_CONF_C_QOP_DES, GSS_KRB5_CONF_C_QOP_DES3_KD):
3039 add
3040 * verify_mic.c: re-organize and add 3DES code
3041 * wrap.c: re-organize and add 3DES code
3042 * unwrap.c: re-organize and add 3DES code
3043 * get_mic.c: re-organize and add 3DES code
3044 * encapsulate.c (gssapi_krb5_encapsulate): do not free `in_data',
3045 let the caller do that. fix the callers.
3046
30472000-08-16 Assar Westerlund <assar@sics.se>
3048
3049 * Makefile.am: bump version to 2:1:1
3050
30512000-07-29 Assar Westerlund <assar@sics.se>
3052
3053 * decapsulate.c (gssapi_krb5_verify_header): sanity-check length
3054
30552000-07-25 Johan Danielsson <joda@pdc.kth.se>
3056
3057 * Makefile.am: bump version to 2:0:1
3058
30592000-07-22 Assar Westerlund <assar@sics.se>
3060
3061 * gssapi.h: update OID for GSS_C_NT_HOSTBASED_SERVICE and other
3062 details from rfc2744
3063
30642000-06-29 Assar Westerlund <assar@sics.se>
3065
3066 * address_to_krb5addr.c (gss_address_to_krb5addr): actually use
3067 `int' instead of `sa_family_t' for the address family.
3068
30692000-06-21 Assar Westerlund <assar@sics.se>
3070
3071 * add support for token delegation. From Daniel Kouril
3072 <kouril@ics.muni.cz> and Miroslav Ruda <ruda@ics.muni.cz>
3073
30742000-05-15 Assar Westerlund <assar@sics.se>
3075
3076 * Makefile.am (libgssapi_la_LDFLAGS): set version to 1:1:1
3077
30782000-04-12 Assar Westerlund <assar@sics.se>
3079
3080 * release_oid_set.c (gss_release_oid_set): clear set for
3081 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
3082 * release_name.c (gss_release_name): reset input_name for
3083 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
3084 * release_buffer.c (gss_release_buffer): set value to NULL to be
3085 more robust. From GOMBAS Gabor <gombasg@inf.elte.hu>
3086 * add_oid_set_member.c (gss_add_oid_set_member): actually check if
3087 the oid is a member first. leave the oid_set unchanged if realloc
3088 fails.
3089
30902000-02-13 Assar Westerlund <assar@sics.se>
3091
3092 * Makefile.am: set version to 1:0:1
3093
30942000-02-12 Assar Westerlund <assar@sics.se>
3095
3096 * gssapi_locl.h: add flags for import/export
3097 * import_sec_context.c (import_sec_context: add flags for what
3098 fields are included. do not include the authenticator for now.
3099 * export_sec_context.c (export_sec_context: add flags for what
3100 fields are included. do not include the authenticator for now.
3101 * accept_sec_context.c (gss_accept_sec_context): set target in
3102 context_handle
3103
31042000-02-11 Assar Westerlund <assar@sics.se>
3105
3106 * delete_sec_context.c (gss_delete_sec_context): set context to
3107 GSS_C_NO_CONTEXT
3108
3109 * Makefile.am: add {export,import}_sec_context.c
3110 * export_sec_context.c: new file
3111 * import_sec_context.c: new file
3112 * accept_sec_context.c (gss_accept_sec_context): set trans flag
3113
31142000-02-07 Assar Westerlund <assar@sics.se>
3115
3116 * Makefile.am: set version to 0:5:0
3117
31182000-01-26 Assar Westerlund <assar@sics.se>
3119
3120 * delete_sec_context.c (gss_delete_sec_context): handle a NULL
3121 output_token
3122
3123 * wrap.c: update to pseudo-standard APIs for md4,md5,sha. some
3124 changes to libdes calls to make them more portable.
3125 * verify_mic.c: update to pseudo-standard APIs for md4,md5,sha.
3126 some changes to libdes calls to make them more portable.
3127 * unwrap.c: update to pseudo-standard APIs for md4,md5,sha. some
3128 changes to libdes calls to make them more portable.
3129 * get_mic.c: update to pseudo-standard APIs for md4,md5,sha. some
3130 changes to libdes calls to make them more portable.
3131 * 8003.c: update to pseudo-standard APIs for md4,md5,sha.
3132
31332000-01-06 Assar Westerlund <assar@sics.se>
3134
3135 * Makefile.am: set version to 0:4:0
3136
31371999-12-26 Assar Westerlund <assar@sics.se>
3138
3139 * accept_sec_context.c (gss_accept_sec_context): always set
3140 `output_token'
3141 * init_sec_context.c (init_auth): always initialize `output_token'
3142 * delete_sec_context.c (gss_delete_sec_context): always set
3143 `output_token'
3144
31451999-12-06 Assar Westerlund <assar@sics.se>
3146
3147 * Makefile.am: bump version to 0:3:0
3148
31491999-10-20 Assar Westerlund <assar@sics.se>
3150
3151 * Makefile.am: set version to 0:2:0
3152
31531999-09-21 Assar Westerlund <assar@sics.se>
3154
3155 * init_sec_context.c (gss_init_sec_context): initialize `ticket'
3156
3157 * gssapi.h (gss_ctx_id_t_desc): add ticket in here. ick.
3158
3159 * delete_sec_context.c (gss_delete_sec_context): free ticket
3160
3161 * accept_sec_context.c (gss_accept_sec_context): stove away
3162 `krb5_ticket' in context so that ugly programs such as
3163 gss_nt_server can get at it. uck.
3164
31651999-09-20 Johan Danielsson <joda@pdc.kth.se>
3166
3167 * accept_sec_context.c: set minor_status
3168
31691999-08-04 Assar Westerlund <assar@sics.se>
3170
3171 * display_status.c (calling_error, routine_error): right shift the
3172 code to make it possible to index into the arrays
3173
31741999-07-28 Assar Westerlund <assar@sics.se>
3175
3176 * gssapi.h (GSS_C_AF_INET6): add
3177
3178 * import_name.c (import_hostbased_name): set minor_status
3179
31801999-07-26 Assar Westerlund <assar@sics.se>
3181
3182 * Makefile.am: set version to 0:1:0
3183
3184Wed Apr 7 14:05:15 1999 Johan Danielsson <joda@hella.pdc.kth.se>
3185
3186 * display_status.c: set minor_status
3187
3188 * init_sec_context.c: set minor_status
3189
3190 * lib/gssapi/init.c: remove donep (check gssapi_krb5_context
3191 directly)
3192
Note: See TracBrowser for help on using the repository browser.