diff options
Diffstat (limited to 'crypto/heimdal/ChangeLog.2006')
| -rw-r--r-- | crypto/heimdal/ChangeLog.2006 | 2047 |
1 files changed, 0 insertions, 2047 deletions
diff --git a/crypto/heimdal/ChangeLog.2006 b/crypto/heimdal/ChangeLog.2006 deleted file mode 100644 index f0e1ce9e966e0..0000000000000 --- a/crypto/heimdal/ChangeLog.2006 +++ /dev/null @@ -1,2047 +0,0 @@ -2006-12-28 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/process.c: Handle kx509 requests. - - * kdc/connect.c: Listen to 9878 if kca is turned on. - - * kdc/headers.h: Include <kx509_asn1.h>. - - * kdc/config.c: code to parse [kdc]enable-kx509 - - * kdc/kdc.h: add enable_kx509 - - * kdc/Makefile.am: add kx509.c - - * kdc/kx509.c: Kx509server (external certificate genration). - - * lib/krb5/ticket.c: add krb5_ticket_get_endtime - - * lib/krb5/krb5_ticket.3: Document krb5_ticket_get_endtime - - * kdc/digest.c: Remove <digest_asn.h>, its already included in - headers.h - - * kdc/digest.c: Return session key for the NTLMv2 case too - - * lib/krb5/digest.c (krb5_ntlm_rep_get_sessionkey): return value - is krb5_error_code - -2006-12-27 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/mk_req_ext.c (_krb5_mk_req_internal): use md5 for - des-cbc-md4 and des-cbc-md5. This is for (older) windows that - will be unhappy anything else. From Inna Bort-Shatsky - -2006-12-26 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/digest.c: Prefix internal symbol with _kdc_. - - * kdc/kdc.h: add digests_allowed - - * kdc/digest.c: return NTLM2 targetinfo structure. - - * lib/krb5/digest.c: Add krb5_ntlm_init_get_targetinfo. - - * kdc/config.c: Parse digest acl's - - * kdc/kdc_locl.h: forward decl; - - * kdc/digest.c: Add digest acl's - -2006-12-22 Love Hörnquist Åstrand <lha@it.su.se> - - * fix-export: build ntlm-private.h - -2006-12-20 Love Hörnquist Åstrand <lha@it.su.se> - - * include/make_crypto.c: Include <.../hmac.h>. - - * kdc/digest.c: reorder to show slot here ntlmv2 code will be - placed. - - * kdc/digest.c: Announce that we support key exchange and add bits - to detect when it wasn't used. - - * kdc/digest.c: Add support for generating NTLM2 session security - answer. - -2006-12-19 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/digest.c: Add sessionkey accessor functions. - -2006-12-18 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/digest.c: Unwrap the NTLM session key and return it to the - server. - -2006-12-17 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/store.c (krb5_ret_principal): Fix a bug in the malloc - failure part, noticed by Arnaud Lacombe in NetBSD coverity scan. - -2006-12-15 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/fcache.c (fcc_get_cache_next): avoid const warning. - - * kdc/digest.c: Support NTLM verification, note that the KDC does - no NTLM packet parsing, its all done by the client side, the KDC - just calculate and verify the digest and return the result to the - service. - - * kuser/kdigest.c: add ntlm-server-init - - * kuser/Makefile.am: kdigest depends on libheimntlm.la - - * kdc/headers.h: Include <heimntlm.h>. - - * kdc/Makefile.am: libkdc needs libheimntlm.la - - * autogen.sh: just run autoreconf -i -f - - * lib/Makefile.am: hook in ntlm - - * configure.in (AC_CONFIG_FILES): add lib/ntlm/Makefile - - * lib/krb5/digest.c: API to authenticate ntlm requests. - - * lib/krb5/fcache.c: Support "iteration" of file credential caches - by giving the user back the default file credential cache and only - that. - - * lib/krb5/krb5_locl.h: Expand the default root for some of the cc - type names. - -2006-12-14 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/init_creds_pw.c (free_paid): free the krb5_data - structure too. Bug report from Stefan Metzmacher. - -2006-12-12 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kinit.c: Read the appdefault configration before we try to - use the flags. Bug reported by Ingemar Nilsson. - - * kuser/kdigest.c: prefix digest commands with digest_ - - * kuser/kdigest-commands.in: prefix digest commands with digest- - -2006-12-10 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/hprop.c: Return error codes on failure, improve error - reporting. - -2006-12-08 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c: sprinkle more _krb5_pk_copy_error - - * lib/krb5/pkinit.c: Copy more hx509 error strings to krb5 error - strings - -2006-12-07 Love Hörnquist Åstrand <lha@it.su.se> - - * include/Makefile.am: CLEANFILES += vis.h - -2006-12-06 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos5.c (_kdc_as_rep): add AD-INITAL-VERIFIED-CAS to the - encrypted ticket - - * kdc/pkinit.c (_kdc_add_inital_verified_cas): new function, adds - an empty (for now) AD_INITIAL_VERIFIED_CAS to tell the clients - that we vouches for the CA. - - * kdc/kerberos5.c (_kdc_tkt_add_if_relevant_ad): new function. - - * lib/Makefile.am: Make the directories test automake conditional - so automake can include directories in make dist step. - - * kdc/pkinit.c (_kdc_pk_rd_padata): leak less memory for - ExternalPrincipalIdentifiers - - * kdc/pkinit.c: Parse and use PA-PK-AS-REQ.trustedCertifiers - - * kdc/pkinit.c: Add comment that the anchors in the signed data - really should be the trust anchors of the client. - - * kuser/generate-requests.c: Use strcspn to remove \n from - string returned by fgets. From Björn Sandell - - * kpasswd/kpasswd-generator.c: Use strcspn to remove \n from - string returned by fgets. From Björn Sandell - -2006-12-05 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/hdb-ldap.c: Clear errno before calling the strtol - functions. From Paul Stoeber to OpenBSD by Ray Lai and Björn - Sandell. - - * lib/krb5/config_file.c: Use strcspn to remove \n from fgets - result. Prompted by change by Ray Lai of OpenBSD via Björn - Sandell. - - * kdc/string2key.c: Use strcspn to remove \n from fgets - result. Prompted by change by Ray Lai of OpenBSD via Björn - Sandell. - -2006-11-30 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krbhst.c (plugin_get_hosts): be more paranoid and pass - in a NULLed plugin list - -2006-11-29 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/verify_krb5_conf.c: add more pkinit options. - - * lib/krb5/pkinit.c: Store what PK-INIT type we used to know reply - to expect, this avoids overwriting the real PK-INIT error from - just a failed requeat with a Windows PK-INIT error (that always - failes). - - * kdc/Makefile.am: Add LIB_pkinit to pacify AIX - - * lib/hdb/Makefile.am: Add LIB_com_err to pacify AIX - -2006-11-28 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/hdb-ldap.c: Make build again from the hdb_entry - wrapping. Patch from Andreas Hasenack. - - * kdc/pkinit.c: Need better code in the DH parameter rejection - case, add comment to that effect. - -2006-11-27 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/krb5tgs.c: Reply KRB5KRB_ERR_RESPONSE_TOO_BIG for too large - packets when using datagram based transports. - - * kdc/process.c: Pass down datagram_reply to _kdc_tgs_rep. - - * lib/krb5/pkinit.c (build_auth_pack): set supportedCMSTypes. - -2006-11-26 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c: Pass down hx509_peer_info. - - * kdc/pkinit.c (_kdc_pk_rd_padata): Pick up supportedCMSTypes and - pass in into hx509_cms_create_signed_1 via hx509_peer_info blob. - - * kdc/pkinit.c (_kdc_pk_rd_padata): Pick up supportedCMSTypes and - pass in into hx509_cms_create_signed_1 via hx509_peer_info blob. - -2006-11-24 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/send_to_kdc.c: Set the large_msg_size to 1400, lets not - fragment packets and avoid stupid linklayers that doesn't allow - fragmented packets (unix dgram sockets on Mac OS X) - -2006-11-23 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c (_krb5_pk_create_sign): stuff down the users - certs in the pool to make sure a path is returned, without this - proxy certificates wont work. - -2006-11-21 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/config.c: Make all pkinit options prefixed with pkinit_ - - * lib/krb5/log.c (krb5_get_warn_dest): return warn_dest from - krb5_context - - * lib/krb5/krb5_warn.3: document krb5_[gs]et_warn_dest - - * lib/krb5/krb5.h: Drop KRB5_KU_TGS_IMPERSONATE. - - * kdc/krb5tgs.c: Use KRB5_KU_OTHER_CKSUM for the impersonate - checksum. - - * lib/krb5/get_cred.c: Use KRB5_KU_OTHER_CKSUM for the impersonate - checksum. - -2006-11-20 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/verify_user.c: Make krb5_get_init_creds_opt_free take a - context argument. - - * lib/krb5/krb5_get_init_creds.3: Make - krb5_get_init_creds_opt_free take a context argument. - - * lib/krb5/init_creds_pw.c: Make krb5_get_init_creds_opt_free take - a context argument. - - * kuser/kinit.c: Make krb5_get_init_creds_opt_free take a context - argument. - - * kpasswd/kpasswd.c: Make krb5_get_init_creds_opt_free take a - context argument. - - * kpasswd/kpasswd-generator.c: Make krb5_get_init_creds_opt_free - take a context argument. - - * kdc/hprop.c: Make krb5_get_init_creds_opt_free take a context - argument. - - * lib/krb5/init_creds.c: Make krb5_get_init_creds_opt_free take a - context argument. - - * appl/gssmask/gssmask.c: Make krb5_get_init_creds_opt_free take a - context argument. - -2006-11-19 Love Hörnquist Åstrand <lha@it.su.se> - - * doc/setup.texi: fix pkinit option (s/-/_/) - - * kdc/config.c: revert the enable-pkinit change, and make it - consistant with all other other enable- options - -2006-11-17 Love Hörnquist Åstrand <lha@it.su.se> - - * doc/setup.texi: Make all pkinit options prefixed with pkinit_ - - * kdc/config.c: Make all pkinit options prefixed with pkinit_ - - * kdc/pkinit.c: Make app pkinit options prefixed with pkinit_ - - * lib/krb5/pkinit.c: Make app pkinit options prefixed with pkinit_ - - * lib/krb5/mit_glue.c (krb5_c_keylengths): make compile again. - - * lib/krb5/mit_glue.c (krb5_c_keylengths): rename. - - * lib/krb5/mit_glue.c (krb5_c_keylength): mit changed the api, - deal. - -2006-11-13 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pac.c (fill_zeros): stop using MIN. - - * kuser/kinit.c: Forward decl - - * lib/krb5/test_plugin.c: Use NOTHERE.H5L.SE. - - * lib/krb5/krbhst.c: Fill in hints for picky getaddrinfo()s. - - * lib/krb5/test_plugin.c: Set sin_len if it exists. - - * lib/krb5/krbhst.c: Use plugin for the other realm locate types - too. - -2006-11-12 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_locl.h: Add plugin api - - * lib/krb5/Makefile.am: Add plugin api. - - * lib/krb5/krbhst.c: Use the resolve plugin interface. - - * lib/krb5/locate_plugin.h: Add plugin interface for resolving - that is API compatible with MITs version. - - * lib/krb5/plugin.c: Add first version of the plugin interface. - - * lib/krb5/test_pac.c: Test signing. - - * lib/krb5/pac.c: Add code to sign PACs, only arcfour for now. - - * lib/krb5/krb5.h: Add struct krb5_pac. - -2006-11-09 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/test_pac.c: PAC testing. - - * lib/krb5/pac.c: Sprinkle error strings. - - * lib/krb5/pac.c: Verify LOGON_NAME. - - * kdc/pkinit.c (_kdc_pk_check_client): drop client_princ as an - argument - - * kdc/kerberos5.c (_kdc_as_rep): drop client_princ from - _kdc_pk_check_client since its not valid in canonicalize case - - * lib/krb5/krb5_c_make_checksum.3: Document krb5_c_keylength. - - * lib/krb5/mit_glue.c: Add krb5_c_keylength. - -2006-11-08 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pac.c: Almost enough code to do PAC parsing and - verification, missing in the unix2NTTIME and ucs2 corner. The - later will be adressed by finally adding libwind. - - * lib/krb5/krb5_init_context.3: document krb5_[gs]et_max_time_skew - - * kdc/hpropd.c: Remove support dumping to a kerberos 4 database. - -2006-11-07 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/context.c: rename krb5_[gs]et_time_wrap to - krb5_[gs]et_max_time_skew - - * kdc/pkinit.c: Catch error string from hx509_cms_verify_signed. - Check for id-pKKdcEkuOID and warn if its not there. - - * lib/krb5/rd_req.c: Add more krb5_rd_req_out_get functions. - -2006-11-06 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5.h: krb5_rd_req{,_in,_out}_ctx. - - * lib/krb5/rd_req.c (krb5_rd_req_ctx): Add context all singing-all - dancing version of the krb5_rd_req and implement krb5_rd_req and - krb5_rd_req_with_keyblock using it. - -2006-11-04 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos5.c (_kdc_as_rep): More verbose time skew logging. - -2006-11-03 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/expand_hostname.c: Rename various routines and - constants from canonize to canonicalize. From Andrew Bartlett - - * lib/krb5/context.c: Add krb5_[gs]et_time_wrap - - * lib/krb5/krb5_locl.h: Rename various routines and constants from - canonize to canonicalize. From Andrew Bartlett - - * appl/gssmask/common.c (add_list): fix alloc statement. - From Alex Deiter - -2006-10-25 Love Hörnquist Åstrand <lha@it.su.se> - - * include/Makefile.am: Move version.h and version.h.in to - DISTCLEANFILES. - -2006-10-24 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmask.c: Only log when there are resources left. - - * appl/gssmask/gssmask.c: make compile - - * appl/gssmask/gssmask.c (AcquireCreds): free - krb5_get_init_creds_opt - -2006-10-23 Love Hörnquist Åstrand <lha@it.su.se> - - * configure.in: heimdal 0.8-RC1 - -2006-10-22 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/digest.c: Try to not leak memory. - - * kdc/digest.c: Try to not leak memory. - - * Makefile.am: remove valgrind target, it doesn't belong here. - - * kuser/kinit.c: Try to not leak memory. - - * kuser/kgetcred.c: Try to not leak memory. - - * kdc/krb5tgs.c (check_KRB5SignedPath): free KRB5SignedPath on - successful completion too, not just the error cases. - - * fix-export: Make make fix-export less verbose. - - * kuser/kgetcred.c: Try to not leak memory. - - * lib/hdb/keys.c (hdb_generate_key_set): free list of enctype when - done. - - * lib/krb5/crypto.c: Allocate the memory we later use. - - * lib/krb5/test_princ.c: Try to not leak memory. - - * lib/krb5/test_crypto_wrapping.c: Try to not leak memory. - - * lib/krb5/test_cc.c: Try to not leak memory. - - * lib/krb5/addr_families.c (arange_free): Try to not leak memory. - - * lib/krb5/crypto.c (AES_string_to_key): Try to not leak memory. - -2006-10-21 Love Hörnquist Åstrand <lha@it.su.se> - - * tools/heimdal-build.sh: Add --test-environment - - * tools/heimdal-build.sh: Add --ccache-dir - - * lib/hdb/Makefile.am: remove dependency on et files covert_db - that now is removed - -2006-10-20 Love Hörnquist Åstrand <lha@it.su.se> - - * include/Makefile.am: add gssapi to subdirs - - * lib/hdb/hdb-ldap.c: Make compile. - - * configure.in: add include/gssapi/Makefile. - - * include/Makefile.am: clean more files - - * include/make_crypto.c: Avoid creating a file called --version. - - * include/bits.c: Avoid creating a file called --version. - - * appl/test/Makefile.am: add nt_gss_common.h - - * doc/Makefile.am: Disable TEXI2DVI for now. - - * tools/Makefile.am: more files - - * lib/krb5/context.c (krb5_free_context): free send_to_kdc context - - * doc/heimdal.texi: Put Heimdal in the dircategory Security. - - * lib/krb5/send_to_kdc.c: Add sent_to_kdc hook, from Andrew - Bartlet. - - * lib/krb5/krb5_locl.h: Add send_to_kdc hook. - - * lib/krb5/krb5.h: Add krb5_send_to_kdc_func prototype. - - * kcm/Makefile.am: more files - - * kdc/Makefile.am: more files - - * lib/hdb/Makefile.am: more files - - * lib/krb5/Makefile.am: add more files - -2006-10-19 Love Hörnquist Åstrand <lha@it.su.se> - - * tools/Makefile.am: Add heimdal-build.sh to EXTRA_DIST. - - * configure.in: Don't check for timegm, libroken provides it for - us. - - * lib/krb5/acache.c: Does function typecasts instead of void * - type-casts. - - * lib/krb5/krb5.h: Remove bonus , that Love sneeked in. - - * configure.in: make --disable-pk-init help text also negative - -2006-10-18 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kgetcred.c: Avoid memory leak. - - * tools/heimdal-build.sh: Add more verbose logging, add version of - script and heimdal to the mail. - - * lib/hdb/db3.c: Wrap function call pointer calls in (*func) to - avoid macros rewriting open and close. - - * lib/krb5/Makefile.am: Add test_princ. - - * lib/krb5/principal.c: More error strings, handle realm-less - printing. - - * lib/krb5/test_princ.c: Test principal parsing and unparsing. - -2006-10-17 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/get_host_realm.c (krb5_get_host_realm): make sure we - don't recurse - - * lib/krb5/get_host_realm.c (krb5_get_host_realm): no components - -> no dns. no mapping, try local realm and hope KDC knows better. - - * lib/krb5/krb5.h: Add flags for krb5_unparse_name_flags - - * lib/krb5/krb5_principal.3: Document - krb5_unparse_name{_fixed,}_flags. - - * lib/krb5/principal.c: Add krb5_unparse_name_flags and - krb5_unparse_name_fixed_flags. - - * lib/krb5/krb5_principal.3: Document krb5_parse_name_flags. - - * lib/krb5/principal.c: Add krb5_parse_name_flags. - - * lib/krb5/principal.c: Add krb5_parse_name_flags. - - * lib/krb5/krb5.h: Add krb5_parse_name_flags flags. - - * lib/krb5/krb5_locl.h: Hide krb5_context_data from public - exposure. - - * lib/krb5/krb5.h: Hide krb5_context_data from public exposure. - - * kuser/klist.c: Use krb5_get_kdc_sec_offset. - - * lib/krb5/context.c: Document krb5_get_kdc_sec_offset() - - * lib/krb5/krb5_init_context.3: Add krb5_get_kdc_sec_offset() - - * lib/krb5/krb5_init_context.3: Add krb5_set_dns_canonize_hostname - and krb5_get_dns_canonize_hostname - - * lib/krb5/verify_krb5_conf.c: - add [libdefaults]dns_canonize_hostname - - * lib/krb5/expand_hostname.c: use dns_canonize_hostname to - determin if we should talk to dns to find the canonical name of - the host. - - * lib/krb5/krb5.h (krb5_context): add dns_canonize_hostname. - - * tools/heimdal-build.sh: Set status. - - * appl/gssmask/gssmask.c: handle more bits - - * kdc/kerberos5.c: Prefix asn1 primitives with der_. - -2006-10-16 Love Hörnquist Åstrand <lha@it.su.se> - - * fix-export: Build lib/asn1/der-protos.h. - -2006-10-14 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/Makefile.am: Add explit depenency on libroken. - - * kdc/krb5tgs.c: Prefix der primitives with der_. - - * kdc/pkinit.c: Prefix der primitives with der_. - - * lib/hdb/ext.c: Prefix der primitives with der_. - - * lib/hdb/ext.c: Prefix der primitives with der_. - - * lib/krb5/crypto.c: Remove workaround from when there wasn't - always aes. - - * lib/krb5/ticket.c: Prefix der primitives with der_. - - * lib/krb5/digest.c: Prefix der primitives with der_. - - * lib/krb5/crypto.c: Prefix der primitives with der_. - - * lib/krb5/data.c: Prefix der primitives with der_. - -2006-10-12 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/pkinit.c (pk_mk_pa_reply_enckey): add missing break. From - Olga Kornievskaia. - - * kdc/kdc.8: document max-kdc-datagram-reply-length - - * include/bits.c: Include Xint64 types. - -2006-10-10 Love Hörnquist Åstrand <lha@it.su.se> - - * tools/heimdal-build.sh: Add socketwrapper and cputime limit. - - * kdc/connect.c (loop): Log that the kdc have started. - -2006-10-09 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/connect.c (do_request): tell krb5_kdc_process_request if its - a datagram reply or not - - * kdc/kerberos5.c: Reply KRB5KRB_ERR_RESPONSE_TOO_BIG error if its - a datagram reply and the datagram reply length limit is reached. - - * kdc/process.c: Rename krb5_kdc_process_generic_request to - krb5_kdc_process_request Add datagram_reply argument. - - * kdc/config.c: check for [kdc]max-kdc-datagram-reply-length - - * kdc/kdc.h (krb5_kdc_config): Add max_datagram_reply_length. - - * lib/hdb/keytab.c: Change || to |, From metze. - - * lib/hdb/keytab.c: Add back :file to sample format. - - * lib/hdb/keytab.c: Add more HDB_F flags to hdb_fetch. Pointed out - by Andrew Bartlet. - - * kdc/krb5tgs.c (tgs_parse_request): set cusec, not csec from - auth->cusec. - -2006-10-08 Love Hörnquist Åstrand <lha@it.su.se> - - * fix-export: dist_-ify libkadm5clnt_la_SOURCES too - - * doc/heimdal.texi: Update (c) years. - - * appl/gssmask/protocol.h: Clarify protocol. - - * kdc/hpropd.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - - * kdc/kerberos4.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - - * kdc/connect.c (handle_vanilla_tcp): shorten length when we - shorten the buffer, this matter im the PK-INIT encKey case where a - checksum is done over the whole packet. Reported by Olga - Kornievskaia - -2006-10-07 Love Hörnquist Åstrand <lha@it.su.se> - - * include/Makefile.am: crypto-headers.h is a nodist header - - * lib/krb5/aes-test.c: Make argument to PKCS5_PBKDF2_HMAC_SHA1 - unsigned char to make OpenSSL happy. - - * appl/kf/Makefile.am: Add man_MANS to EXTRA_DIST - - * kuser/Makefile.am: split build files into dist_ and noinst_ - SOURCES - - * lib/hdb/Makefile.am: split build files into dist_ and noinst_ - SOURCES - - * lib/krb5/Makefile.am: split build files into dist_ and noinst_ - SOURCES - - * kdc/kerberos5.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - -2006-10-06 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krbhst.c (common_init): don't try DNS when there is - realm w/o a dot. - - * kdc/524.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - - * kdc/krb5tgs.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - - * lib/krb5/get_in_tkt.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - - * lib/krb5/rd_cred.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - - * lib/krb5/rd_req.c: Adapt to signature change of - _krb5_principalname2krb5_principal. - - * lib/krb5/asn1_glue.c (_krb5_principalname2krb5_principal): add - krb5_context to signature. - - * kdc/524.c (_krb5_principalname2krb5_principal): adapt to - signature change - - * lib/hdb/keytab.c (hdb_get_entry): close and destroy the database - later, the hdb_entry_ex might still contain links to the database - that it expects to use. - - * kdc/digest.c: Make digest argument o MD5_final unsigned char to - help OpenSSL. - - * kuser/kdigest.c: Make digest argument o MD5_final unsigned char - to help OpenSSL. - - * appl/gssmask/common.h: Maybe include <sys/wait.h>. - -2006-10-05 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/common.h: disable ENABLE_PTHREAD_SUPPORT and - explain why - - * tools/heimdal-build.sh: Another mail header. - - * tools/heimdal-build.sh: small fixes - - * fix-export: More liberal parsing of AC_INIT - - * tools/heimdal-build.sh: first cut - -2006-10-04 Love Hörnquist Åstrand <lha@it.su.se> - - * configure.in: Call AB_INIT. - - * kuser/kinit.c: Add flag --pk-use-enckey. - - * kdc/pkinit.c: Sign the request in the encKey case. Bug reported - by Olga Kornievskaia of Umich. - - * lib/krb5/Makefile.am: man_MANS += krb5_digest.3 - - * lib/krb5/krb5_digest.3: Add all protos - -2006-10-03 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_digest.3: Basic krb5_digest manpage. - -2006-10-02 Love Hörnquist Åstrand <lha@it.su.se> - - * fix-export: build gssapi mech private files - - * lib/krb5/init_creds_pw.c: minimize layering and remove - krb5_kdc_flags - - * lib/krb5/get_in_tkt.c: Always use the kdc_flags in the right bit - order. - - * lib/krb5/init_creds_pw.c: Always use the kdc_flags in the right - bit order. - - * kuser/kdigest.c: Don't require --kerberos-realm. - - * lib/krb5/digest.c (digest_request): if NULL is passed in as - realm, use default realm. - - * fix-export: build gssapi mech private files - -2006-09-26 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmaestro.c: Handle FIRST_CALL in the context - building, better error handling. - - * appl/gssmask/gssmaestro.c: switch from wrap/unwrap to - encrypt/decrypt - - * appl/gssmask/gssmask.c: Don't announce spn if there is none. - - * appl/gssmask/gssmaestro.c: Check that the pre-wrapped data is - the same as afterward. - -2006-09-25 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmaestro.c: Remove stray GSS_C_DCE_STYLE. - - * appl/gssmask/gssmaestro.c: Add logsocket support. - -2006-09-22 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmaestro.c (build_context): print the step the - context exchange. - -2006-09-21 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmaestro.c: Add GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG - to all context flags - - * appl/gssmask/gssmaestro.c: Add wrap and mic tests for all - elements - - * appl/gssmask/gssmask.c: Add mic tests - - * appl/gssmask/gssmaestro.c: dont exit early then when context - is half built. - - * lib/krb5/rd_req.c: disable ETypeList parsing usage for now, cfx - seems broken and its not good to upgrade to a broken enctype. - -2006-09-20 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmask.c: Add wrap/unwrap ops - - * appl/gssmask/protocol.h: Add eGetVersionAndCapabilities flags - - * appl/gssmask/common.c: Add permutate_all (and support - functions). - - * appl/gssmask/common.h: Add permutate_all - - * appl/gssmask/gssmask.c: use new flags, return moniker - - * appl/gssmask/gssmaestro.c: test self context building and all - permutation of clients - -2006-09-19 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmask.c: add --logfile option, use htons() on - port number - - * appl/gssmask/gssmaestro.c: Log port in connection message. - - * configure.in: Make pk-init turned on by default. - -2006-09-18 Love Hörnquist Åstrand <lha@it.su.se> - - * fix-export: Build lib/hx509/{hx509-protos.h,hx509-private.h}. - - * kuser/Makefile.am: Add tool for printing tickets. - - * kuser/kimpersonate.1: Add tool for printing tickets. - - * kuser/kimpersonate.c: Add tool for printing tickets. - - * kdc/krb5tgs.c: Check the adtkt in the constrained delegation - case too. - -2006-09-16 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/main.c (sigterm): don't _exit, let loop() catch the signal - instead. - - * lib/krb5/krb5_timeofday.3: Fixes from Björn Sandell. - - * lib/krb5/krb5_get_init_creds.3: Fixes from Björn Sandell. - -2006-09-15 Love Hörnquist Åstrand <lha@it.su.se> - - * tools/krb5-config.in: Add "kafs" option. - -2006-09-12 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/db.c: By using full function calling conversion (*func) - we avoid problem when close(fd) is overridden using a macro. - - * lib/krb5/cache.c: By using full function calling - conversion (*func) we avoid problem when close(fd) is overridden - using a macro. - -2006-09-11 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos5.c: Signing outgoing tickets. - - * kdc/krb5tgs.c: Add signing and checking of tickets to s4u2self - works securely. - - * lib/krb5/pkinit.c: Adapt to new signature of - hx509_cms_unenvelope. - -2006-09-09 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c (pk_verify_host): set errorstrings in a - sensable way - -2006-09-08 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_init_context.3: Prevent a font generation warning, - from Jason McIntyre. - -2006-09-06 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/context.c (krb5_init_ets): Add the hx errortable - - * lib/krb5/krb5_locl.h: Include hx509_err.h. - - * lib/krb5/pkinit.c (_krb5_pk_verify_sign): catch the error string - from the hx509 lib - -2006-09-04 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/init_creds.c (krb5_get_init_creds_opt_set_default_flags): - fix argument to krb5_get_init_creds_opt_set_addressless. - - * lib/krb5/init_creds_pw.c (init_cred_loop): try to catch the - error when we actually have an error to catch. - - * lib/krb5/init_creds_pw.c: Remove debug printfs. - - * kuser/kinit.c: Remove debug printf - - * lib/krb5/krb5_get_init_creds.3: Document - krb5_get_init_creds_opt_set_addressless. - - * kuser/kinit.c: Use new function - krb5_get_init_creds_opt_set_addressless. - - * lib/krb5/krb5_locl.h: use new addressless, convert pa-pac option - to use the same tri-state option as the new addressless option. - - * lib/krb5/init_creds_pw.c: use new addressless, convert pa-pac - option to use the same tri-state option as the new addressless - option. - - * lib/krb5/init_creds.c (krb5_get_init_creds_opt_set_addressless): - used to control the address-lessness of the initial tickets - instead of passing in the empty set of address into - krb5_get_init_creds_opt_set_addresses. - -2006-09-01 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kinit.c (renew_validate): inherit the proxiable and - forwardable from the orignal ticket, pointed out by Bernard - Antoine of CERN. - - * doc/setup.texi: More text about the acl_file entry and - hdb-ldap-structural-object. From Rüdiger Ranft. - - * lib/krb5/krbhst.c (fallback_get_hosts): limit the fallback - lookups to 5. Patch from Wesley Craig, umich.edu - - * configure.in: Add special tests for <sys/ucred.h>, include test - for sys/param.h and sys/types.h - - * appl/test/tcp_server.c (proto): use keytab for krb5_recvauth - Patch from Ingemar Nilsson <init@pdc.kth.se> - -2006-08-28 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kdigest.c (help): use sl_slc_help(). - - * kdc/digest.c: Catch more error, add SASL DIGEST MD5. - - * lib/krb5/digest.c: Catch more error. - -2006-08-25 Love Hörnquist Åstrand <lha@it.su.se> - - * doc/setup.texi: language. - - * doc/heimdal.texi: Add last updated text. - - * doc/heimdal.css: make box around heimdal title - - * doc/heimdal.css: Inital Heimdal css for the info manual - - * lib/krb5/digest.c: In the case where we get a DigestError back, - save the error string and code. - -2006-08-24 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos5.c: Remove _kdc_find_etype(), its no longer used. - - * kdc/digest.c: Remove local error label and have just one exit - label, set error strings properly. - - * kdc/digest.c: Simply the disabled-service case. Check the - allow-digest flag in the HDB entry for the client. - - * kdc/process.c (krb5_kdc_process_generic_request): check if we - got a digest request and process it. - - * kdc/main.c: Register hdb keytab operations. - - * kdc/kdc.8: document [kdc]enable-digest=boolean - - * kdc/Makefile.am: add digest to libkdc - - * kdc/digest.c: Make a return a goto to avoid freeing un-inited - memory in cleanup code. - - * kdc/default_config.c (krb5_kdc_default_config): default to all - bits set to zero. - - * kdc/kdc.h (krb5_kdc_configuration): Add enable_digest - - * kdc/headers.h: Include <digest_asn1.h>. - - * lib/krb5/context.c (krb5_kerberos_enctypes): new function, - returns the list of Kerberos encryption types sorted in order of - most preferred to least preferred encryption type. - - * kdc/misc.c (_kdc_get_preferred_key): new function, Use the order - list of preferred encryption types and sort the available keys and - return the most preferred key. - - * kdc/krb5tgs.c: Adapt to the new sigature of _kdc_find_keys(). - - * kdc/kerberos5.c: Handle session key etype separately from the - tgt etype, now the krbtgt can be a aes-only key without the need - to support not-as-good etypes for the krbtgt. - -2006-08-23 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/misc.c: Change _kdc_db_fetch() to return the database - pointer to if needed by the consumer. - - * kdc/krb5tgs.c: Change _kdc_db_fetch() to return the database - pointer to if needed by the consumer. - - * kdc/kerberos5.c: Change _kdc_db_fetch() to return the database - pointer to if needed by the consumer. - - * kdc/kerberos4.c: Change _kdc_db_fetch() to return the database - pointer to if needed by the consumer. - - * kdc/kaserver.c: Change _kdc_db_fetch() to return the database - pointer to if needed by the consumer. - - * kdc/524.c: Change _kdc_db_fetch() to return the database pointer - to if needed by the consumer. - - * kuser/kdigest-commands.in: Add --kerberos-realm, add client - request command. - - * lib/krb5/Makefile.am: digest.c - - * lib/krb5/krb5.h: Add digest glue. - - * lib/krb5/digest.c (krb5_digest_set_authentication_user): use - krb5_principal - - * lib/krb5/digest.c: Add digest support to the client side. - -2006-08-21 Love Hörnquist Åstrand <lha@it.kth.se> - - * lib/krb5/rd_rep.c (krb5_rd_rep): free krb5_ap_rep_enc_part on - error and set return pointer to NULL - (krb5_free_ap_rep_enc_part): permit freeing of NULL - -2006-08-18 Love Hörnquist Åstrand <lha@it.kth.se> - - * kdc/{Makefile.am,kdigest.c,kdigest-commands.in}: - Frontend for remote digest service in KDC - - * lib/krb5/krb5_storage.3: Document krb5_{ret,store}_stringnl - functions. - - * lib/krb5/store.c: Add krb5_{ret,store}_stringnl functions, - stores/retrieves a \n terminated string. - - * lib/krb5/krb5_locl.h: Default to address-less tickets. - - * lib/krb5/init_creds.c (krb5_get_init_creds_opt_get_error): clear - error string on error. - -2006-07-20 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/crypto.c: remove aes-192 (CMS) - - * lib/krb5/crypto.c: Remove more CMS bits. - - * lib/krb5/crypto.c: Remove CMS symmetric encryption support. - -2006-07-13 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/pkinit.c (_kdc_pk_check_client): make it not crash when - there are no acl - - * kdc/pkinit.c (_kdc_pk_check_client): use the acl in the kerberos - database - - * lib/hdb/hdb.asn1: Rename HDB-Ext-PKINIT-certificate to - HDB-Ext-PKINIT-hash. Add trust anchor to HDB-Ext-PKINIT-acl. - - * lib/hdb/Makefile.am: rename asn1_HDB_Ext_PKINIT_certificate to - asn1_HDB_Ext_PKINIT_hash - - * lib/hdb/ext.c: Add hdb_entry_get_pkinit_hash(). - -2006-07-10 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kinit.c: If --password-file gets STDIN, read the password - from the standard input. - - * kuser/kinit.1: Document --password-file=STDIN. - - * lib/krb5/krb5_string_to_key.3: Remove duplicate to. - -2006-07-06 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/krb5tgs.c: (tgs_build_reply): when checking for removed - principals, check the second component of the krbtgt, otherwise - cross realm wont work. Prompted by report from Mattias Amnefelt. - -2006-07-05 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/connect.c (handle_vanilla_tcp): use unsigned integer for for - length - (handle_tcp): if the high bit it set in the unknown case, send - back a KRB_ERR_FIELD_TOOLONG - -2006-07-03 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmaestro.c: Add get_version_capa, cache - target_name. - - * appl/gssmask/gssmask.c: use utname() to find the local hostname - and version of operatingsystem - - * appl/gssmask/common.h: include <sys/utsname.h> - - * appl/gssmask/gssmask.c: break out creation of a client and make - handleServer pthread_create compatible - - * appl/gssmask/gssmaestro.c: break out out the build context - function - -2006-07-01 Love Hörnquist Åstrand <lha@it.su.se> - - * appl/gssmask/gssmaestro.c: externalize slave handling, add - GetTargetName glue - - * appl/gssmask/gssmaestro.c: externalize principal/password handling - - * lib/krb5/principal.c (krb5_parse_name): set *principal to NULL - the first thing we do, so that on failure its set to a known value - - * appl/gssmask/gssmask.c: AcquireCreds: set principal to NULL to - avoid memory corruption GetTargetName: always send a string, even - though we don't have a targetname - - * appl/gssmask: break out common function; add gssmaestro (that - only tests one context for now) - -2006-06-30 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/store_fd.c (krb5_storage_from_fd): don't leak fd on - malloc failure - - * appl/gssmask/gssmask.c: split out fetching of credentials for - easier reuse for pk-init testing - - * appl/gssmask: maggot replacement, handles context testing - - * lib/krb5/cache.c (krb5_cc_new_unique): use KRB5_DEFAULT_CCNAME - as the default prefix - -2006-06-28 Love Hörnquist Åstrand <lha@it.su.se> - - * doc/heimdal.texi: Add Doug Rabson's license - -2006-06-22 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/init_creds.c: Add storing and getting KRB-ERROR in the - krb5_get_init_creds_opt structure. - - * lib/krb5/init_creds_pw.c: Save KRB-ERROR on error. - - * lib/krb5/krb5_locl.h (_krb5_get_init_creds_opt_private): add - KRB-ERROR - -2006-06-21 Love Hörnquist Åstrand <lha@it.su.se> - - * doc/setup.texi: section about verify_krb5_conf and kadmin check - -2006-06-15 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/init_creds_pw.c (get_init_creds_common): drop cred - argument, its unused - - * lib/krb5/Makefile.am: install krb5_get_creds.3 - - * lib/krb5/krb5_get_creds.3: new file - -2006-06-14 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/hdb-ldap.c: don't use the sambaNTPassword if there is - ARCFOUR key already. Idea from Andreas Hasenack. While here, set - pw change time using sambaPwdLastSet - - * kdc/kerberos4.c: Use enable_v4_per_principal and check the new - hdb flag. - - * kdc/kdc.h: Add enable_v4_per_principal - -2006-06-12 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos5.c (_kdc_as_rep): if kdc_time + - config->kdc_warn_pwexpire is past pw_end, add expiration - message. From Bernard Antoine. - - * kdc/default_config.c (krb5_kdc_default_config): set - kdc_warn_pwexpire to 0 - - * kdc/kerberos5.c: indent. - -2006-06-07 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos5.c: constify - -2006-06-06 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/get_cred.c: Allow setting additional tickets in the - tgs-req - - * kuser/kgetcred.c: add --delegation-credential-cache - - * kdc/krb5tgs.c (tgs_build_reply): add constrained delegation. - - * kdc/krb5tgs.c: Add impersonation. - - * kuser/kgetcred.c: use new krb5_get_creds interface, add - impersonation. - - * lib/krb5/get_cred.c (krb5_get_creds): add - KRB5_GC_NO_TRANSIT_CHECK - - * lib/krb5/misc.c: Add impersonate support functions. - - * lib/krb5/get_cred.c: Add impersonate and new krb5_get_creds interface. - - * lib/hdb/hdb.asn1 (HDBFlags): add trusted-for-delegation - - * lib/krb5/krb5.h: Add krb5_get_creds_opt_data and some more - KRB5_GC flags. - -2006-06-01 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/ext.c (hdb_entry_get_ConstrainedDelegACL): new function. - - * lib/krb5/pkinit.c: Avoid more shadowing. - - * kdc/connect.c (do_request): clean reply with krb5_data_zero - - * kdc/krb5tgs.c: Split up the reverse cross krbtgt check and local - clien must exists test. - - * kdc/krb5tgs.c: Plug old memory leaks, unify all goto's. - - * kdc/krb5tgs.c: Split tgs_rep2 into tgs_parse_request and - tgs_build_reply. - - * kdc/kerberos5.c: split out krb5 tgs req to make it easier to - reorganize the code. - -2006-05-29 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_get_init_creds.3: spelling Björn Sandell - - * lib/krb5/krb5_get_in_cred.3: spelling Björn Sandell - -2006-05-13 Love Hörnquist Åstrand <lha@it.su.se> - - * kpasswd/kpasswdd.c (change): select the realm based on the - target principal From Gabor Gombas - - * lib/krb5/krb5_get_init_creds.3: Add KRB5_PROMPT_TYPE_INFO - - * lib/krb5/krb5.h: Add KRB5_PROMPT_TYPE_INFO - -2006-05-12 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c: Hidden field of hx509 prompter is removed. - Fix a warning. - - * doc/setup.texi: Point to more examples, hint that you have to - use openssl 0.9.8a or later. - - * doc/setup.texi: DIR now handles both PEM and DER. - - * kuser/kinit.c: Pass down prompter and password to - krb5_get_init_creds_opt_set_pkinit. - - * lib/krb5/pkinit.c (_krb5_pk_load_id): only use password if its - longer then 0 - - * doc/ack.texi: Add Jason McIntyre. - - * lib/krb5/krb5_acl_match_file.3: Various tweaks, from Jason - McIntyre. - -2006-05-11 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kinit.c: Move parsing of the PK-INIT configuration file to - the library so application doesn't need to deal with it. - - * lib/krb5/pkinit.c (krb5_get_init_creds_opt_set_pkinit): move - parsing of the configuration file to the library so application - doesn't need to deal with it. - - * lib/krb5/pkinit.c (_krb5_pk_load_id): pass the hx509_lock to - when trying to read the user certificate. - - * lib/krb5/pkinit.c (hx_pass_prompter): return 0 on success and 1 - on failure. Pointed out by Douglas E. Engert. - -2006-05-08 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/crypto.c: Catches both keyed checkout w/o crypto - context cases and doesn't reset the string, and corrects the - grammar. - - * lib/krb5/crypto.c: Drop aes-cbc, rc2 and CMS padding support, - its all containted in libhcrypto and libhx509 now. - -2006-05-07 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c (_krb5_pk_verify_sign): Use - hx509_get_one_cert. - - * lib/krb5/crypto.c (create_checksum): provide a error message - that a key checksum needs a key. From Andew Bartlett. - -2006-05-06 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c: Now that hcrypto supports DH, remove check - for hx509 null DH. - - * kdc/pkinit.c: Don't call DH_check_pubkey, it doesn't exists in - older OpenSSL. - - * doc/heimdal.texi: Add blob about imath. - - * doc/ack.texi: Add blob about imath. - - * include/make_crypto.c: Move up evp.h to please OpenSSL, from - Douglas E. Engert. - - * kcm/acl.c: Multicache kcm interation isn't done yet, let wait - with this enum. - -2006-05-05 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_set_default_realm.3: Spelling/mdoc from Björn - Sandell - - * lib/krb5/krb5_rcache.3: Spelling/mdoc from Björn Sandell - - * lib/krb5/krb5_keytab.3: Spelling/mdoc from Björn Sandell - - * lib/krb5/krb5_get_in_cred.3: Spelling/mdoc from Björn Sandell - - * lib/krb5/krb5_expand_hostname.3: Spelling/mdoc from Björn - Sandell - - * lib/krb5/krb5_c_make_checksum.3: Spelling/mdoc from Björn - Sandell - - * lib/krb5/keytab_file.c (fkt_next_entry_int): read the 32 bit - kvno if the reset of the data is longer then 4 bytes in hope to be - forward compatible. Pointed out by Michael B Allen. - - * doc/programming.texi: Add fileformats. - - * appl/test: Rename u_intXX_t to uintXX_t - - * kuser: Rename u_intXX_t to uintXX_t - - * kdc: Rename u_intXX_t to uintXX_t - - * lib/hdb: Rename u_intXX_t to uintXX_t - - * lib/45]: Rename u_intXX_t to uintXX_t - - * lib/krb5: Rename u_intXX_t to uintXX_t - - * lib/krb5/Makefile.am: Add test_store to TESTS - - * lib/krb5/pkinit.c: Catch using hx509 null DH and print a more - useful error message. - - * lib/krb5/store.c: Rewrite the krb5_ret_u as proposed by Johan. - -2006-05-04 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos4.c: Use the new unsigned integer storage types. - - * kdc/kaserver.c: Use the new unsigned integer storage - types. Sprinkle some error handling. - - * lib/krb5/krb5_storage.3: Document ret and store function for the - unsigned fixed size integer types. - - * lib/krb5/v4_glue.c: Use the new unsigned integer storage - types. Fail that the address doesn't match, not the reverse. - - * lib/krb5/store.c: Add ret and store function for the unsigned - fixed size integer types. - - * lib/krb5/test_store.c: Test the integer storage types. - -2006-05-03 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/store.c (krb5_store_principal): make it take a - krb5_const_principal, indent - - * lib/krb5/krb5_storage.3: krb5_store_principal takes a - krb5_const_principal - - * lib/krb5/pkinit.c: Deal with that hx509_prompt.reply is no - longer a pointer. - - * kdc/kdc.h (krb5_kdc_configuration): add pkinit_kdc_ocsp_file - - * kdc/config.c: read [kdc]pki-kdc-ocsp - -2006-05-02 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/pkinit.c (_kdc_pk_mk_pa_reply): send back ocsp response if - it seems to be valid, simplfy the pkinit-windows DH case (it - doesn't exists). - -2006-05-01 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_warn.3: Spelling/mdoc changes, from Björn Sandell. - - * lib/krb5/krb5_verify_user.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_verify_init_creds.3: Spelling/mdoc changes, from - Björn Sandell. - - * lib/krb5/krb5_timeofday.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_ticket.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_rd_safe.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_rcache.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_principal.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_parse_name.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_mk_safe.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_keyblock.3: Spelling/mdoc changes, from Björn - Sandell. - - * lib/krb5/krb5_is_thread_safe.3: Spelling/mdoc changes, from - Björn Sandell. - - * lib/krb5/krb5_generate_random_block.3: Spelling/mdoc changes, - from Björn Sandell. - - * lib/krb5/krb5_generate_random_block.3: Spelling/mdoc changes, - from Björn Sandell. - - * lib/krb5/krb5_expand_hostname.3: Spelling/mdoc changes, from - Björn Sandell. - - * lib/krb5/krb5_check_transited.3: Spelling/mdoc changes, from - Björn Sandell. - - * lib/krb5/krb5_c_make_checksum.3: Spelling/mdoc changes, from - Björn Sandell. - - * lib/krb5/krb5_address.3: Spelling/mdoc changes, from - Björn Sandell. - - * lib/krb5/krb5_acl_match_file.3: Spelling/mdoc changes, from - Björn Sandell. - - * lib/krb5/krb5.3: Spelling, from Björn Sandell. - - * doc/ack.texi: add Björn - -2006-04-30 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c (cert2epi): don't include subject if its null - -2006-04-29 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c: Send over what trust anchors the client have - configured. - - * lib/krb5/pkinit.c (pk_verify_host): set better error string, - only check kdc name/address when we got a hostname/address passed - in the the function. - - * kdc/pkinit.c (_kdc_pk_check_client): reorganize and make log - when a SAN matches. - -2006-04-28 Love Hörnquist Åstrand <lha@it.su.se> - - * doc/setup.texi: More options and some text about windows - clients, certificate and KDCs. - - * doc/setup.texi: notice about pki-mappings file space sensitive - - * doc/setup.texi: Example pki-mapping file. - - * lib/krb5/pkinit.c (pk_verify_host): verify hostname/address - - * lib/hdb/hdb.h: Bump hdb interface version to 4. - -2006-04-27 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kdestroy.1: Document --credential=principal. - - * kdc/kerberos5.c (tgs_rep2): check that the client exists in the - kerberos database if its local request. - - * kdc/{misc.c,524.c,kaserver.c,kerberos5.c}: pass down HDB_F_GET_ - flags as appropriate - - * kdc/kerberos4.c (_kdc_db_fetch4): pass down flags though - krb5_425_conv_principal_ext2 - - * kdc/misc.c (_kdc_db_fetch): Break out the that we request from - principal from the entry and pass it in as a seprate argument. - - * lib/hdb/keytab.c (hdb_get_entry): Break out the that we request - from principal from the entry and pass it in as a seprate - argument. - - * lib/hdb/common.c: Break out the that we request from principal - from the entry and pass it in as a seprate argument. - - * lib/hdb/hdb.h: Break out the that we request from principal from - the entry and pass it in as a seprate argument. Add more flags to - ->hdb_get(). Re-indent. - -2006-04-26 Love Hörnquist Åstrand <lha@it.su.se> - - * doc/setup.texi: document pki-allow-proxy-certificate - - * kdc/pkinit.c: Add option [kdc]pki-allow-proxy-certificate=bool - to allow using proxy certificate. - - * lib/krb5/pkinit.c (_krb5_pk_allow_proxy_certificates): expose - hx509_verify_set_proxy_certificate - - * kdc/pkinit.c (_kdc_pk_check_client): Use - hx509_cert_get_base_subject to get subject name of the - certificate, needed for proxy certificates. - - * kdc/kerberos5.c: Now that find_keys speaks for it self, remove - extra logging. - - * kdc/kerberos5.c (find_keys): add client_name and server_name - argument and use them, and adapt callers. - -2006-04-25 Love Hörnquist Åstrand <lha@it.su.se> - - * kuser/kinit.1: document option password-file - - * kuser/kinit.c: Add option password-file, read password from the - first line of a file. - - * configure.in: make tests/kdc/Makefile - - * kdc/kerberos5.c: Catch the case where the client sends no - encryption types or no pa-types. - - * lib/hdb/ext.c (hdb_replace_extension): set error message on - failure, not success. - - * lib/hdb/keys.c (parse_key_set): handle error case better - (hdb_generate_key_set): return better error - -2006-04-24 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/hdb.c (hdb_create): print out what we don't support - - * lib/krb5/principal.c: Remove a double free introduced in 1.93 - - * lib/krb5/log.c (log_file): reset pointer to freed memory - - * lib/krb5/keytab_keyfile.c (get_cell_and_realm): reset d->cell to - make sure its not refereced - - * tools/krb5-config.in: libhcrypto might depend on libasn1, switch - order - - * lib/krb5/recvauth.c: indent - - * doc/heimdal.texi: Add Setting up PK-INIT to Detailed Node - Listing. - - * lib/krb5/pkinit.c: Pass down realm to pk_verify_host so the - function can verify the certificate is from the right realm. - - * lib/krb5/init_creds_pw.c: Pass down realm to - _krb5_pk_rd_pa_reply - -2006-04-23 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c (pk_verify_host): Add begining of finding - subjectAltName_otherName pk-init-san and verifing it. - - * lib/krb5/sendauth.c: reindent - - * doc/Makefile.am: use --no-split to make one large file, mostly - for html - - * doc/setup.texi: "document" pkinit_require_eku and - pkinit_require_krbtgt_otherName - - * lib/krb5/pkinit.c: Add pkinit_require_eku and - pkinit_require_krbtgt_otherName - - * doc/setup.texi: Add text about pk-init - - * tools/kdc-log-analyze.pl: count v5 cross realms too - -2006-04-22 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/pkinit.c: Adapt to change in hx509_cms_create_signed_1. - - * lib/krb5/pkinit.c: Adapt to change in hx509_cms_create_signed_1. - -2006-04-20 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/pkinit.c (_kdc_pk_rd_padata): use - hx509_cms_unwrap_ContentInfo. - - * kdc/config.c: unbreak - - * lib/krb5/pkinit.c: Handle diffrences between libhcrypto and - libcrypto. - - * kdc/config.c: Rename pki-chain to pki-pool to match rest of - code. - -2006-04-12 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/rd_priv.c: Fix argument to krb5_data_zero. - - * kdc/config.c: Added certificate revoke information from - configuration file. - - * kdc/pkinit.c: Added certificate revoke information. - - * kuser/kinit.c: Added certificate revoke information from - configuration file. - - * lib/krb5/pkinit.c (_krb5_pk_load_id): Added certificate revoke - information, ie CRL's - -2006-04-10 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/replay.c (krb5_rc_resolve_full): make compile again. - - * lib/krb5/keytab_krb4.c (krb4_kt_start_seq_get_int): make compile - again. - - * lib/krb5/transited.c (make_path): make sure we return allocated - memory Coverity, NetBSD CID#1892 - - * lib/krb5/transited.c (make_path): make sure we return allocated - memory Coverity, NetBSD CID#1892 - - * lib/krb5/rd_req.c (krb5_verify_authenticator_checksum): on - protocol failure, avoid leaking memory Coverity, NetBSD CID#1900 - - * lib/krb5/principal.c (krb5_parse_name): remember to free realm - in case of error Coverity, NetBSD CID#1883 - - * lib/krb5/principal.c (krb5_425_conv_principal_ext2): remove - memory leak in case of weird formated dns replys. - Coverity, NetBSD CID#1885 - - * lib/krb5/replay.c (krb5_rc_resolve_full): don't return pointer - to a allocated krb5_rcache in case of error. - - * lib/krb5/log.c (krb5_addlog_dest): free fn in case of error - Coverity, NetBSD CID#1882 - - * lib/krb5/keytab_krb4.c: Fix deref before NULL check, fix error - handling. Coverity, NetBSD CID#2369 - - * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): - in_creds->client should always be set, assume so. - - * lib/krb5/keytab_any.c (any_next_entry): restructure to make it - easier to read Fixes Coverity, NetBSD CID#625 - - * lib/krb5/crypto.c (krb5_string_to_key_derived): deref after NULL - check. Coverity NetBSD CID#2367 - - * lib/krb5/build_auth.c (krb5_build_authenticator): use - calloc. removed check that was never really used. Coverity NetBSD - CID#2370 - -2006-04-09 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/rd_req.c (krb5_verify_ap_req2): make sure `ticket´ - points to NULL in case of error, add error handling, use calloc. - - * kpasswd/kpasswdd.c (doit): when done, close all fd in the - sockets array and free it. Coverity NetBSD CID#1916 - -2006-04-08 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/store.c (krb5_ret_principal): fix memory leak Coverity, - NetBSD CID#1695 - - * kdc/524.c (_kdc_do_524): Handle memory allocation failure - Coverity, NetBSD CID#2752 - -2006-04-07 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/keytab_file.c (krb5_kt_ret_principal): plug a memory - leak Coverity NetBSD CID#1890 - - * kdc/hprop.c (main): make sure type doesn't need to be set - - * kdc/mit_dump.c (mit_prop_dump): close fd when done processing - Coverity NetBSD CID#1955 - - * kdc/string2key.c (tokey): catch warnings, free memory after use. - Based on Coverity NetBSD CID#1894 - - * kdc/hprop.c (main): remove dead code. Coverity NetBSD CID#633 - -2006-04-04 Love Hörnquist Åstrand <lha@it.su.se> - - * kpasswd/kpasswd-generator.c (read_words): catch empty file case, - will cause PBE (division by zero) later. From Tobias Stoeckmann. - -2006-04-02 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/keytab.c: Remove a delta from last revision that should - have gone in later. - - * lib/krb5/krbhst.c: fix spelling - - * lib/krb5/send_to_kdc.c (send_and_recv_http): don't expose freed - pointer, found by IBM checker. - - * lib/krb5/rd_cred.c (krb5_rd_cred): don't expose freed pointer, - found by IBM checker. - - * lib/krb5/addr_families.c (krb5_make_addrport): clear return - value on error, found by IBM checker. - - * kdc/kerberos5.c (check_addresses): treat netbios as no addresses - - * kdc/{kerberos4,kaserver}.c: _kdc_check_flags takes hdb_entry_ex - - * kdc/kerberos5.c (_kdc_check_flags): make it take hdb_entry_ex to - avoid ?:'s at callers - - * lib/krb5/v4_glue.c: Avoid using free memory, found by IBM - checker. - - * lib/krb5/transited.c (expand_realm): avoid passing NULL to - strlen, found by IBM checker. - - * lib/krb5/rd_cred.c (krb5_rd_cred): avoid a memory leak on malloc - failure, found by IBM checker. - - * lib/krb5/krbhst.c (_krb5_krbhost_info_move): replace a strcpy - with a memcpy - - * lib/krb5/keytab_keyfile.c (get_cell_and_realm): plug a memory - leak, found by IBM checker. - - * lib/krb5/keytab_file.c (fkt_next_entry_int): remove a - dereferencing NULL pointer, found by IBM checker. - - * lib/krb5/init_creds_pw.c (init_creds_init_as_req): in AS-REQ the - cname must always be given, don't avoid that fact and remove a - cname == NULL case. Plugs a memory leak found by IBM checker. - - * lib/krb5/init_creds_pw.c (default_s2k_func): avoid exposing - free-ed memory on error. Found by IBM checker. - - * lib/krb5/init_creds.c (_krb5_get_init_creds_opt_copy): use - calloc to avoid uninitialized memory problem. - - * lib/krb5/data.c (krb5_copy_data): avoid exposing free-ed memory - on error. Found by IBM checker. - - * lib/krb5/fcache.c (fcc_gen_new): fix a use after free, found by - IBM checker. - - * lib/krb5/config_file.c (krb5_config_vget_strings): IBM checker - thought it found a memory leak, it didn't, but there was another - error in the code, lets fix that instead. - - * lib/krb5/cache.c (_krb5_expand_default_cc_name): plug memory - leak. Found by IBM checker. - - * lib/krb5/cache.c (_krb5_expand_default_cc_name): avoid return - pointer to freed memory in the error case. Found by IBM checker. - - * lib/hdb/keytab.c (hdb_resolve): off by one, found by IBM - checker. - - * lib/hdb/keys.c (hdb_generate_key_set): set ret_key_set before - going into the error clause and freeing key_set. Found by IBM - checker. Make sure ret == 0 after of parse error, we catch the - "no entries parsed" case later. - - * lib/krb5/log.c (krb5_addlog_dest): make string length match - strings in strcasecmp. Found by IBM checker. - -2006-03-30 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/hdb/hdb-ldap.c (LDAP_message2entry): in declaration set - variable_name as "hdb_entry_ex" - (hdb_ldap_common): change "arg" in condition (if) to "search_base" - (hdb_ldapi_create): change "serach_base" to "search_base" From - Alex V. Labuta. - - * lib/krb5/pkinit.c (krb5_get_init_creds_opt_set_pkinit); fix - prototype - - * kuser/kinit.c: Add pool of certificates to help certificate path - building for clients sending incomplete path in the signedData. - -2006-03-28 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/pkinit.c: Add pool of certificates to help certificate path - building for clients sending incomplete path in the signedData. - - * lib/krb5/pkinit.c: Add pool of certificates to help certificate - path building for clients sending incomplete path in the - signedData. - -2006-03-27 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/config.c: Allow passing in related certificates used to - build the chain. - - * kdc/pkinit.c: Allow passing in related certificates used to - build the chain. - - * kdc/kerberos5.c (log_patype): Add case for - KRB5_PADATA_PA_PK_OCSP_RESPONSE. - - * tools/Makefile.am: Spelling - - * tools/krb5-config.in: Add hx509 when using PK-INIT. - - * tools/Makefile.am: Add hx509 when using PK-INIT. - -2006-03-26 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/acache.c: Use ticket flags definition, might fix Mac OS - X Kerberos.app problems. - - * lib/krb5/krb5_ccapi.h: Add ticket flags definitions - - * lib/krb5/pkinit.c: Use less openssl, spell chelling. - - * kdc/pkinit.c (pk_mk_pa_reply_dh): encode the DH public key with - asn1 wrapping - - * configure.in (AC_CONFIG_FILES): add lib/hx509/Makefile - - * lib/Makefile.am: Add hx509. - - * lib/krb5/Makefile.am: Add libhx509.la when PKINIT is used. - - * configure.in: define automake PKINIT variable - - * kdc/pkinit.c: Switch to hx509. - - * lib/krb5/pkinit.c: Switch to hx509. - -2006-03-24 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/kerberos5.c (log_patypes): log the patypes requested by the - client - -2006-03-23 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c (_krb5_pk_rd_pa_reply): pass down the - req_buffer in the w2k case too. From Douglas E. Engert. - -2006-03-19 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/mk_req_ext.c (_krb5_mk_req_internal): on failure, goto - error handling. Fixes Coverity NetBSD CID 2591 by catching a - failing krb5_copy_keyblock() - -2006-03-17 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/addr_families.c (krb5_free_addresses): reset val,len in - address when free-ing. Fixes Coverity NetBSD bug #2605 - (krb5_parse_address): reset val,len before possibly return errors - Fixes Coverity NetBSD bug #2605 - -2006-03-07 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/send_to_kdc.c (recv_loop): it should never happen, but - make sure nbytes > 0 - - * lib/krb5/get_for_creds.c (add_addrs): handle the case where - addr->len == 0 and n == 0, then realloc might return NULL. - - * lib/krb5/crypto.c (decrypt_*): handle the case where the - plaintext is 0 bytes long, realloc might then return NULL. - -2006-02-28 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_string_to_key.3: Drop krb5_string_to_key_derived. - - * lib/krb5/krb5.3: Remove krb5_string_to_key_derived. - - * lib/krb5/crypto.c (AES_string_to_key): drop _krb5_PKCS5_PBKDF2 - and use PKCS5_PBKDF2_HMAC_SHA1 instead. - - * lib/krb5/aes-test.c: reformat, avoid free-ing un-init'd memory - - * lib/krb5/aes-test.c: Only use PKCS5_PBKDF2_HMAC_SHA1. - -2006-02-27 Johan Danielsson <joda@pdc.kth.se> - - * doc/setup.texi: remove cartouches - we don't use them anywhere - else, they should be around the example, not inside it, and - probably shouldn't be used in html at all - -2006-02-18 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_warn.3: Document that applications want to use - krb5_get_error_message, add example. - -2006-02-16 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/crypto.c (krb5_generate_random_block): check return - value from RAND_bytes - - * lib/krb5/error_string.c: Change indentation, update (c) - -2006-02-14 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c: Make struct krb5_dh_moduli available when - compiling w/o pkinit. - -2006-02-13 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/pkinit.c: update to new paChecksum definition, update - the dhgroup handling - - * kdc/pkinit.c: update to new paChecksum definition, use - hdb_entry_ex - -2006-02-09 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/krb5_locl.h: Move Configurable options to last in the - file. - - * lib/krb5/krb5_locl.h: Wrap KRB5_ADDRESSLESS_DEFAULT with #ifndef - -2006-02-03 Love Hörnquist Åstrand <lha@it.su.se> - - * kpasswd/kpasswdd.c: Send back a better error-message to the - client in case the password change was rejected. - - * lib/krb5/krb5_warn.3: Document krb5_get_error_message. - - * lib/krb5/error_string.c (krb5_get_error_message): new function, - and combination of krb5_get_error_string and krb5_get_err_text - - * lib/krb5/krb5.3: sort, and krb5_get_error_message - - * lib/hdb/hdb-ldap.c: Log the filter string to the error message - when doing searches. - - * lib/krb5/init_creds.c (krb5_get_init_creds_opt_set_default_flags): - Use KRB5_ADDRESSLESS_DEFAULT when - checking [appdefault]no-addresses. - - * lib/krb5/get_cred.c (get_cred_from_kdc_flags): Use - KRB5_ADDRESSLESS_DEFAULT when checking - [appdefault]no-addresses. - - * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): - Use [appdefault]no-addresses before checking if the krbtgt is - address-less, use KRB5_ADDRESSLESS_DEFAULT. - - * lib/krb5/krb5_locl.h: Introduce KRB5_ADDRESSLESS_DEFAULT that - controlls all address-less behavior. Defaults to false. - -2006-02-01 Love Hörnquist Åstrand <lha@it.su.se> - - * lib/krb5/n-fold-test.c: main is not a KRB5_LIB_FUNCTION - - * lib/krb5/mk_priv.c (krb5_mk_priv): abort if ASN1_MALLOC_ENCODE - failes to produce the matching lenghts. - -2006-01-27 Love Hörnquist Åstrand <lha@it.su.se> - - * kcm/protocol.c (kcm_op_retrieve): remove unused variable - -2006-01-15 Love Hörnquist Åstrand <lha@it.su.se> - - * tools/krb5-config.in: Move depenency on @LIB_dbopen@ to - kadm-server, kerberos library doesn't depend on db-library. - -2006-01-13 Love Hörnquist Åstrand <lha@it.su.se> - - * include/Makefile.am: Don't clean crypto headers, they now live - in hcrypto/. Add hcrypto to SUBDIRS. - - * include/hcrypto/Makefile.am: clean installed headers - - * include/make_crypto.c: include crypto headers from hcrypto/ - - * include/make_crypto.c: Include more crypto headerfiles. Remove - support for old hash names. - -2006-01-02 Love Hörnquist Åstrand <lha@it.su.se> - - * kdc/misc.c (_kdc_db_fetch): use calloc to allocate the entry, - from Andrew Bartlet. - - * Happy New Year. |