1 2007-12-08 Love Hörnquist Åstrand <lha@it.su.se>
3 * lib/krb5/rd_req.c: use KRB5_CTX_F_CHECK_PAC to init check_pac
4 field in the krb5_rd_req_in_ctx
6 * lib/krb5/expand_hostname.c: Adapt to changing
7 dns_canonicalize_hostname into flags field.
9 * lib/krb5/context.c: Adapt to changing dns_canonicalize_hostname
10 into flags field, add check-pac as an libdefaults option.
12 * lib/krb5/pkinit.c: Adapt to changes in hx509 interface.
14 * doc: add doxygen documentation to hcrypto
16 * doc/doxytmpl.dxy: generate links
18 2007-12-07 Love Hörnquist Åstrand <lha@it.su.se>
20 * lib/krb5/Makefile.am: build_HEADERZ += heim_threads.h
22 * lib/hdb/dbinfo.c (hdb_db_dir): Return the directory where the
25 * configure.in: Add --with-hdbdir to specify where the database is
28 * lib/krb5/crypto.c: revert previous patch, the problem is located
29 in the RAND_file_name() function that will cause recursive nss
30 lookups, can't fix that here.
32 2007-12-06 Love Hörnquist Åstrand <lha@it.su.se>
34 * lib/krb5/crypto.c (krb5_generate_random_block): try to avoid the
35 dead-lock in by not holding the lock while running
36 RAND_file_name. Prompted by Hai Zaar.
38 * lib/krb5/n-fold.c: spelling
40 2007-12-04 Love Hörnquist Åstrand <lha@it.su.se>
42 * kuser/kdigest.c (digest-probe): implement command.
44 * kuser/kdigest-commands.in (digest-probe): new command
46 * kdc/digest.c: Implement supportedMechs request.
48 * lib/krb5/error_string.c: Make krb5_get_error_string return an
49 allocated string to make the function indempotent. From
52 2007-12-03 Love Hörnquist Åstrand <lha@it.su.se>
54 * lib/krb5/krb5_locl.h (krb5_context_data): Flag if
55 default_cc_name was set by the user.
57 * lib/krb5/fcache.c (fcc_move): make sure ->version is uptodate.
59 * kcm/acquire.c: use krb5_free_cred_contents
61 * kuser/kimpersonate.c: use krb5_free_cred_contents
63 * kuser/kinit.c: Use krb5_cc_move to make an atomic switch of the
66 * lib/krb5/cache.c: Put back code that was needed, move gen_new
69 * lib/krb5/mcache.c (mcc_default_name): Remove const
71 * lib/krb5/krb5_locl.h: Add KRB5_DEFAULT_CCNAME_KCM, redefine
72 KRB5_DEFAULT_CCNAME to KRB5_DEFAULT_CCTYPE
74 * lib/krb5/cache.c: Use krb5_cc_ops->default_name to get the
77 * lib/krb5/kcm.c: Implement krb5_cc_ops->default_name.
79 * lib/krb5/mcache.c: Implement krb5_cc_ops->default_name.
81 * lib/krb5/fcache.c: Implement krb5_cc_ops->default_name.
83 * lib/krb5/krb5.h: Add krb5_cc_ops->default_name.
85 * lib/krb5/acache.c: Free context when done, implement
86 krb5_cc_ops->default_name.
88 * lib/krb5/kcm.c: implement dummy kcm_move
90 * lib/krb5/mcache.c: Implement the move operation.
92 * lib/krb5/version-script.map: export krb5_cc_move
94 * lib/krb5/cache.c: New function krb5_cc_move().
96 * lib/krb5/fcache.c: Implement the move operation.
98 * lib/krb5/krb5.h: Add move to the krb5_cc_ops, causes major
101 * lib/krb5/acache.c: Implement the move operation. Avoid using
102 cc_set_principal() since it broken on Mac OS X 10.5.0.
104 2007-12-02 Love Hörnquist Åstrand <lha@it.su.se>
106 * lib/krb5/krb5_ccapi.h: Drop variable names to avoid -Wshadow.
108 2007-11-14 Love Hörnquist Åstrand <lha@it.su.se>
110 * kdc/krb5tgs.c: Should pass different key usage constants
111 depending on whether or not optional sub-session key was passed by
112 the client for the check of authorization data. The constant is
113 used to derive "specific key" and its values are specified in
116 Patch from Andy Polyakov.
118 * kdc/krb5tgs.c: Don't send auth data in referrals, microsoft
119 clients have started to not like that. Thanks to Andy Polyakov for
122 2007-11-11 Love Hörnquist Åstrand <lha@it.su.se>
124 * lib/krb5/creds.c: use krb5_data_cmp
126 * lib/krb5/acache.c: use krb5_free_cred_contents
128 * lib/krb5/test_renew.c: use krb5_free_cred_contents
130 2007-11-10 Love Hörnquist Åstrand <lha@it.su.se>
132 * lib/krb5/acl.c: doxygen documentation
134 * lib/krb5/addr_families.c: doxygen documentation
138 * lib/krb5/plugin.c: doxygen documentation
140 * lib/krb5/kcm.c: doxygen documentation
142 * lib/krb5/fcache.c: doxygen documentation
144 * lib/krb5/cache.c: doxygen documentations
146 * lib/krb5/doxygen.c: doxygen introduction
148 * lib/krb5/error_string.c: Doxygen documentation.
150 2007-11-03 Love Hörnquist Åstrand <lha@it.su.se>
152 * lib/krb5/test_plugin.c: expose krb5_plugin_register
154 * lib/krb5/plugin.c: expose krb5_plugin_register
156 * lib/krb5/version-script.map: sort, expose krb5_plugin_register
158 2007-10-24 Love Hörnquist Åstrand <lha@it.su.se>
160 * kdc/kerberos5.c: Adding same enctype is enough one time. From
161 Andy Polyakov and Bjorn Sandell.
163 2007-10-18 Love <lha@stacken.kth.se>
165 * lib/krb5/cache.c (krb5_cc_retrieve_cred): check return value
166 from krb5_cc_start_seq_get. From Zeqing (Fred) Xia
168 * lib/krb5/fcache.c (init_fcc): provide better error codes
170 * kdc/kerberos5.c (get_pa_etype_info2): more paranoia, avoid
171 sending warning about pruned etypes.
173 * kdc/kerberos5.c (older_enctype): old windows enctypes (arcfour
174 based) "old", this to support windows 2000 clients (unjoined to a
175 domain). From Andy Polyakov.
177 2007-10-07 Love Hörnquist Åstrand <lha@it.su.se>
179 * doc/setup.texi: Spelling, from Mark Peoples via Bjorn Sandell.
181 2007-10-04 Love Hörnquist Åstrand <lha@it.su.se>
183 * kdc/krb5tgs.c: More prettier printing of enctype, from KAMADA
186 * lib/krb5/crypto.c (krb5_enctype_to_string): make sure string is
189 2007-10-03 Love Hörnquist Åstrand <lha@it.su.se>
191 * kdc/kdc-replay.c: Catch KRB5_PROG_ATYPE_NOSUPP from
192 krb5_addr2sockaddr and igore thte test is that case.
194 2007-09-29 Love Hörnquist Åstrand <lha@it.su.se>
196 * lib/krb5/context.c (krb5_free_context): free
197 default_cc_name_env, from Gunther Deschner.
199 2007-08-27 Love Hörnquist Åstrand <lha@it.su.se>
201 * lib/krb5/{krb5.h,pac.c,test_pac.c,send_to_kdc.c,rd_req.c}: Make
202 work with c++, reported by Hai Zaar
204 * lib/krb5/{digest.c,krb5.h}: Make work with c++, reported by Hai Zaar
206 2007-08-20 Love Hörnquist Åstrand <lha@it.su.se>
208 * lib/hdb/Makefile.am: EXTRA_DIST += hdb.schema
210 2007-07-31 Love Hörnquist Åstrand <lha@it.su.se>
212 * check return value of alloc functions, from Charles Longeau
214 * lib/krb5/principal.c: spelling.
216 * kadmin/kadmin.8: spelling
218 * lib/krb5/crypto.c: Check return values from alloc
219 functions. Prompted by patch of Charles Longeau.
221 * lib/krb5/n-fold.c: Make _krb5_n_fold return a error
222 code. Prompted by patch of Charles Longeau.
224 2007-07-27 Love Hörnquist Åstrand <lha@it.su.se>
226 * lib/krb5/init_creds.c: Always set the ticket options, use
227 KRB5_ADDRESSLESS_DEFAULT as the default value, this make the unset
228 tri-state not so useful.
230 2007-07-24 Love Hörnquist Åstrand <lha@it.su.se>
232 * tools/heimdal-gssapi.pc.in: Add LIB_pkinit to the list of
235 * tools/heimdal-gssapi.pc.in: pkg-config file for libgssapi in
238 * tools/Makefile.am: Add heimdal-gssapi.pc and install it into
241 2007-07-23 Love Hörnquist Åstrand <lha@it.su.se>
243 * lib/krb5/pkinit.c: Add RFC3526 modp group14 as a default.
245 2007-07-22 Love Hörnquist Åstrand <lha@it.su.se>
247 * lib/hdb/dbinfo.c (get_dbinfo): use dbname instead of realm as
248 key if the entry is a correct entry.
250 * lib/krb5/get_cred.c: Make krb5_get_renewed_creds work, from
253 * lib/krb5/Makefile.am: Add test_renew to noinst_PROGRAMS.
255 * lib/krb5/test_renew.c: Test for krb5_get_renewed_creds.
257 2007-07-21 Love Hörnquist Åstrand <lha@it.su.se>
259 * lib/hdb/keys.c: Make parse_key_set handle key set string "v5",
262 * kdc/kaserver.c: Don't ovewrite the error code, from Peter
265 2007-07-18 Love Hörnquist Åstrand <lha@it.su.se>
269 * Makefile.am: remove TODO-1.0
271 2007-07-17 Love Hörnquist Åstrand <lha@it.su.se>
273 * Heimdal 1.0 release branch cut here
275 * doc/hx509.texi: use version.texi
277 * doc/heimdal.texi: use version.texi
279 * doc/version.texi: version.texi
281 * lib/hdb/db3.c: avoid type-punned pointer warning.
283 * kdc/kx509.c: Use unsigned char * as argument to HMAC_Update to
284 please OpenSSL and gcc.
286 * kdc/digest.c: Use unsigned char * as argument to MD5_Update to
287 please OpenSSL and gcc.
289 2007-07-16 Love Hörnquist Åstrand <lha@it.su.se>
291 * include/Makefile.am: Add krb_err.h.
293 * kdc/set_dbinfo.c: Print acl file too.
295 * kdc/kerberos4.c: Error codes are just fine, remove XXX now.
297 * lib/krb5/krb5-v4compat.h: Drop duplicate error codes.
299 * kdc/kerberos4.c: switch to ET errors.
301 * lib/krb5/Makefile.am: Add krb_err.h to build_HEADERZ.
303 * lib/krb5/v4_glue.c: If its a Kerberos 4 error-code, remove the
306 2007-07-15 Love Hörnquist Åstrand <lha@it.su.se>
308 * lib/krb5/krb5-v4compat.h: Include "krb_err.h".
310 * lib/krb5/v4_glue.c: return more interesting error codes.
312 * lib/krb5/plugin.c: Prefix enum plugin_type.
314 * lib/krb5/krb5_locl.h: Expose plugin structures.
316 * lib/krb5/krb5.h: Add plugin structures.
318 * lib/krb5/krb_err.et: V4 errors.
320 * lib/krb5/version-script.map: First version of version script.
322 2007-07-13 Love Hörnquist Åstrand <lha@it.su.se>
324 * kdc/kerberos5.c: Java 1.6 expects the name to be the same type,
325 lets allow that for uncomplicated name-types.
327 2007-07-12 Love Hörnquist Åstrand <lha@it.su.se>
329 * lib/krb5/v4_glue.c (_krb5_krb_rd_req): if ticket contains
330 address 0, its ticket less and don't really care about
331 from_addr. return better error codes.
333 * kpasswd/kpasswdd.c: Fix pointer vs strict alias rules.
335 2007-07-11 Love Hörnquist Åstrand <lha@it.su.se>
337 * lib/hdb/hdb-ldap.c: When using sambaNTPassword, avoid adding
338 more then one enctype 23 to krb5EncryptionType.
340 * lib/krb5/cache.c: Spelling.
342 * kdc/kerberos5.c: Don't send newer enctypes in ETYPE-INFO.
343 (get_pa_etype_info2): return the enctypes as sorted in the
346 2007-07-10 Love Hörnquist Åstrand <lha@it.su.se>
348 * kuser/kinit.c: krb5-v4compat.h defines prototypes for
349 v4 (semiprivate functions) in libkrb5, don't include
350 krb5-private.h any longer.
352 * lib/krb5/krbhst.c: Set error string when there is no KDC for a
355 * lib/krb5/Makefile.am: New library version.
357 * kdc/Makefile.am: New library version.
359 * lib/krb5/krb5_locl.h: Add default_cc_name_env.
361 * lib/krb5/cache.c (enviroment_changed): return non-zero if
362 enviroment that will determine default krb5cc name has changed.
363 (krb5_cc_default_name): also check if cached value is uptodate.
365 * lib/krb5/krb5_locl.h: Drop pkinit_flags.
367 2007-07-05 Love Hörnquist Åstrand <lha@it.su.se>
369 * configure.in: add tests/java/Makefile
371 * lib/hdb/dbinfo.c: Add hdb_dbinfo_get_log_file.
373 2007-07-04 Love Hörnquist Åstrand <lha@it.su.se>
375 * kdc/kerberos5.c: Improve the default salt detection to avoid
376 returning v4 password salting to java that doesn't look at the
377 returning padata for salting.
379 * kdc: Split out krb5_kdc_set_dbinfo, From Andrew Bartlett
381 2007-07-02 Love Hörnquist Åstrand <lha@it.su.se>
383 * kdc/digest.c: Try harder to provide better error message for
386 * lib/krb5/Makefile.am: verify_krb5_conf_OBJECTS depends on
387 krb5-pr*.h, make -j finds this.
389 2007-06-28 Love Hörnquist Åstrand <lha@it.su.se>
391 * kdc/digest.c: On success, print username, not ip-adress.
393 2007-06-26 Love Hörnquist Åstrand <lha@it.su.se>
395 * lib/krb5/get_cred.c: Add krb5_get_renewed_creds.
397 * lib/krb5/krb5_get_credentials.3: add krb5_get_renewed_creds
399 * lib/krb5/pkinit.c: Use hx509_cms_unwrap_ContentInfo.
401 2007-06-25 Love Hörnquist Åstrand <lha@it.su.se>
403 * doc/setup.texi: Add example for pkinit_win2k_require_binding
406 * kdc/default_config.c: Rename require_binding to
407 win2k_require_binding to match client configuration.
409 * kdc/default_config.c: Add [kdc]pkinit_require_binding option.
411 * kdc/pkinit.c (pk_mk_pa_reply_enckey): only allow non-bound reply
414 * kdc/default_config.c: rename pkinit_princ_in_cert and add
415 pkinit_require_binding
417 * kdc/kdc.h: rename pkinit_princ_in_cert and add
418 pkinit_require_binding
420 * kdc/pkinit.c: rename pkinit_princ_in_cert
422 2007-06-24 Love Hörnquist Åstrand <lha@it.su.se>
424 * lib/krb5/pkinit.c: Adapt to hx509_verify_hostname change.
426 2007-06-21 Love Hörnquist Åstrand <lha@it.su.se>
428 * kdc/krb5tgs.c: Drop unused variable.
430 * kdc/krb5tgs.c: disable anonyous tgs requests
432 * kdc/krb5tgs.c: Don't check PAC on cross realm for now.
434 * kuser/kgetcred.c: Set KRB5_GC_CONSTRAINED_DELEGATION and parse
437 * lib/krb5/krb5_principal.3: Document krb5_parse_nametype.
439 * lib/krb5/principal.c (krb5_parse_nametype): parse nametype and
440 return their integer values.
442 * lib/krb5/krb5.h (krb5_get_creds): Add
443 KRB5_GC_CONSTRAINED_DELEGATION.
445 * lib/krb5/get_cred.c (krb5_get_creds): if
446 KRB5_GC_CONSTRAINED_DELEGATION is set, set both request_anonymous
447 and constrained_delegation.
449 2007-06-20 Love Hörnquist Åstrand <lha@it.su.se>
451 * kdc/digest.c: Return an error message instead of dropping the
452 packet for more failure cases.
454 * lib/krb5/krb5_principal.3: Add KRB5_PRINCIPAL_UNPARSE_DISPLAY.
456 * appl/gssmask/gssmask.c (AcquirePKInitCreds): fail more
459 2007-06-18 Love Hörnquist Åstrand <lha@it.su.se>
461 * lib/krb5/pac.c: make compile.
463 * lib/krb5/pac.c (verify_checksum): memset cksum to avoid using
466 * lib/krb5/plugin.c: Don't expose free pointer.
468 * lib/krb5/pkinit.c (_krb5_pk_load_id): fail directoy for first
471 * lib/krb5/pkinit.c (get_reply_key*): don't expose freed memory
473 * lib/krb5/krbhst.c: Host is static memory, don't free.
475 * lib/krb5/crypto.c (decrypt_internal_derived): make sure length
476 is longer then confounder + checksum.
478 * kdc: export get_dbinfo as krb5_kdc_set_dbinfo and call from
479 users. This to allows libkdc users to to specify their own
482 * lib/krb5/pkinit.c (pk_rd_pa_reply_enckey): simplify handling of
483 content data (and avoid leaking memory).
485 * kdc/misc.c (_kdc_db_fetch): set error string for failures.
487 2007-06-15 Love Hörnquist Åstrand <lha@it.su.se>
489 * kdc/pkinit.c: Use KRB5_AUTHDATA_INITIAL_VERIFIED_CAS.
491 2007-06-13 Love Hörnquist Åstrand <lha@it.su.se>
493 * kdc/pkinit.c: tell user when they got a pk-init request with
496 2007-06-12 Love Hörnquist Åstrand <lha@it.su.se>
498 * lib/krb5/principal.c: Rename UNPARSE_NO_QUOTE to
501 * lib/krb5/krb5.h: Rename UNPARSE_NO_QUOTE to UNPARSE_DISPLAY.
503 * lib/krb5/principal.c: Make no-quote mean replace strange chars
506 * lib/krb5/principal.c: Support KRB5_PRINCIPAL_UNPARSE_NO_QUOTE.
508 * lib/krb5/krb5.h: Add KRB5_PRINCIPAL_UNPARSE_NO_QUOTE.
510 * lib/krb5/test_princ.c: Test quoteing.
512 * lib/krb5/pkinit.c: update (c)
514 * lib/krb5/get_cred.c: use krb5_sendto_context to talk to the KDC.
516 * lib/krb5/send_to_kdc.c (_krb5_kdc_retry): check if the whole
517 process needs to restart or just skip this KDC.
519 * lib/krb5/init_creds_pw.c: Use krb5_sendto_context to talk to
522 * lib/krb5/krb5.h: Add sendto hooks and opaque structure.
524 * lib/krb5/krb5_rd_error.3: Update prototype.
526 * lib/krb5/send_to_kdc.c: Add hooks for processing the reply from
529 2007-06-11 Love Hörnquist Åstrand <lha@it.su.se>
531 * lib/krb5/krb5_err.et: Some new error codes from RFC 4120.
533 2007-06-09 Love Hörnquist Åstrand <lha@it.su.se>
535 * kdc/krb5tgs.c: Constify.
537 * kdc/kerberos5.c: Constify.
539 * kdc/pkinit.c: Check for KRB5-PADATA-PK-AS-09-BINDING. Constify.
541 2007-06-08 Love Hörnquist Åstrand <lha@it.su.se>
543 * include/Makefile.am: Make krb5-types.h nodist_include_HEADERS.
545 * kdc/Makefile.am: EXTRA_DIST += version-script.map.
547 2007-06-07 Love Hörnquist Åstrand <lha@it.su.se>
549 * Makefile.am (print-distdir): print name of dist
551 * kdc/pkinit.c: Break out loading of mappings file to a separate
552 function and remove warning that it can't open the mapping file,
553 there are now mappings in the db, maybe the users uses that
556 * lib/krb5/crypto.c: Require the raw key have the correct size and
557 do away with the minsize. Minsize was a thing that originated
558 from RC2, but since RC2 is done in the x509/cms subsystem now
559 there is no need to keep that around.
561 * lib/hdb/dbinfo.c: If there is no default dbname, also check for
562 unset mkey_file and set it default mkey name, make backward compat
565 * kdc/version-script.map: add new symbols
567 * kdc/kdc-replay.c: Also update krb5_context view of what the time
570 * configure.in: add tests/can/Makefile
572 * kdc/kdc-replay.c: Add --[version|help].
574 * kdc/pkinit.c: Push down the kdc time into the x509 library.
576 * kdc/connect.c: Move up krb5_kdc_save_request so we can catch the
579 * kdc/kdc-replay.c: verify reply by checking asn1 class, type and
580 tag of the reply if there is one.
582 * kdc/process.c: Save asn1 class, type and tag of the reply if
583 there is one. Used to verify the reply in kdc-replay.
585 2007-06-06 Love Hörnquist Åstrand <lha@it.su.se>
587 * kdc/kdc_locl.h: extern for request_log.
589 * kdc/Makefile.am: Add kdc-replay.
591 * kdc/kdc-replay.c: Replay kdc messages to the KDC library.
593 * kdc/config.c: Pick up request_log from [kdc]kdc-request-log.
595 * kdc/connect.c: Option to save the request to disk.
597 * kdc/process.c (krb5_kdc_save_request): save request to file.
599 * kdc/process.c (krb5_kdc_process*): dont update _kdc_time
601 (krb5_kdc_update_time): set or get current kdc-time.
603 * kdc/pkinit.c (_kdc_pk_rd_padata): accept both pkcs-7 and
604 pkauthdata as the signeddata oid
606 * kdc/pkinit.c (_kdc_pk_rd_padata): Try to log what went wrong.
608 2007-06-05 Love Hörnquist Åstrand <lha@it.su.se>
610 * kdc/pkinit.c: Use oid_id_pkcs7_data for pkinit-9 encKey reply to
611 match windows DC behavior better.
613 2007-06-04 Love Hörnquist Åstrand <lha@it.su.se>
615 * configure.in: use test for -framework Security
617 * appl/test/uu_server.c: Print status to stdout.
619 * kdc/digest.c (digest ntlm): provide log entires by setting ret
622 2007-06-03 Love Hörnquist Åstrand <lha@it.su.se>
624 * doc/hx509.texi: Indent crl-sign.
626 * doc/hx509.texi: One more crl-sign example.
628 * lib/krb5/test_princ.c: plug memory leaks.
630 * lib/krb5/pac.c: plug memory leaks.
632 * lib/krb5/test_pac.c: plug memory leaks.
634 * lib/krb5/test_prf.c: plug memory leak.
636 * lib/krb5/test_cc.c: plug memory leaks.
638 * doc/hx509.texi: Simple blob about publishing CRLs.
640 * doc/win2k.texi: drop text about enctypes.
642 2007-06-02 Love Hörnquist Åstrand <lha@it.su.se>
644 * kdc/pkinit.c: In case of OCSP verification failure, referash
645 every 5 min. In case of success, refreash 2 min before expiring or
648 2007-05-31 Love Hörnquist Åstrand <lha@it.su.se>
650 * lib/krb5/krb5_err.et: add error 68, WRONG_REALM
652 * kdc/pkinit.c: Handle the ms san in a propper way, still cheat
655 * kdc/kerberos5.c: If _kdc_pk_check_client failes, bail out
656 directly and hand the error back to the client.
658 * lib/krb5/krb5_err.et: Add missing REVOCATION_STATUS_UNAVAILABLE
659 and fix error message for CLIENT_NAME_MISMATCH.
661 * kdc/pkinit.c: More logging for pk-init client mismatch.
663 * kdc/kerberos5.c: Also add a KRB5_PADATA_PK_AS_REQ_WIN for
664 windows pk-init (-9) to make MIT clients happy.
666 2007-05-30 Love Hörnquist Åstrand <lha@it.su.se>
668 * kdc/pkinit.c: Force des3 for win2k.
670 * kdc/pkinit.c: Add wrapping to ContentInfo wrapping to
673 * lib/krb5/keytab_keyfile.c: Spelling.
675 * kdc/pkinit.c: Allow matching by MS UPN SAN, note that this delta
676 doesn't deal with case of realm.
678 2007-05-16 Love Hörnquist Åstrand <lha@it.su.se>
680 * lib/krb5/crypto.c (krb5_crypto_overhead): return static overhead
683 2007-05-10 Dave Love <fx@gnu.org>
685 * doc/win2k.texi: Update some URLs.
687 2007-05-13 Love Hörnquist Åstrand <lha@it.su.se>
689 * kuser/kimpersonate.c: Fix version number of ticket, it should be
692 2007-05-08 Love Hörnquist Åstrand <lha@it.su.se>
694 * doc/setup.texi: Salting is really Encryption types and salting.
696 2007-05-07 Love Hörnquist Åstrand <lha@it.su.se>
698 * doc/setup.texi: spelling, from Ronny Blomme
700 * doc/win2k.texi: Fix ksetup /SetComputerPassword, from Ronny
703 2007-05-02 Love Hörnquist Åstrand <lha@it.su.se>
705 * lib/hdb/dbinfo.c (hdb_get_dbinfo) If there are no database
706 specified, create one and let it use the defaults.
708 2007-04-27 Love Hörnquist Åstrand <lha@it.su.se>
710 * lib/hdb/test_dbinfo.c: test acl file
712 * lib/hdb/test_dbinfo.c: test acl file
714 * lib/hdb/dbinfo.c: add acl file
716 * etc: ignore Makefile.in
718 * Makefile.am: SUBDIRS += etc
720 * configure.in: Add etc/Makefile.
722 * etc/Makefile.am: make sure services.append is distributed
724 2007-04-24 Love Hörnquist Åstrand <lha@it.su.se>
726 * kdc: rename windc_init to krb5_kdc_windc_init
728 * kdc/version-script.map: version script for libkdc
730 * kdc/Makefile.am: version script for libkdc
732 2007-04-23 Love Hörnquist Åstrand <lha@it.su.se>
734 * lib/krb5/init_creds.c (krb5_get_init_creds_opt_get_error):
735 correct the order of the arguments.
737 * lib/hdb/Makefile.am: Add and test dbinfo.
739 * lib/hdb/hdb.h: Forward declaration for struct hdb_dbinfo;
741 * kdc/config.c: Use krb5_kdc_get_config and just fill in what the
742 users wanted differently.
744 * kdc/default_config.c: Make the default configuration fetch info
747 2007-04-22 Love Hörnquist Åstrand <lha@it.su.se>
749 * lib/krb5/store.c (krb5_store_creds_tag): use session.keytype to
750 determine if to send the session-key, for the second place in the
753 * tools/krb5-config.in: rename des to hcrypto
755 * kuser/Makefile.am: depend on libheimntlm
757 * kuser/kinit.c: Add --ntlm-domain that store the ntlm cred for
758 this domain if the Kerberos password auth worked.
760 * kuser/klist.c: add new option --hidden that doesn't display
761 principal that starts with @
763 * tools/krb5-config.in: Add heimntlm when we use gssapi.
765 * lib/krb5/krb5_ccache.3 (krb5_cc_retrieve_cred): document what to
768 * lib/krb5/cache.c (krb5_cc_retrieve_cred): document what to free
771 2007-04-21 Love Hörnquist Åstrand <lha@it.su.se>
773 * lib/krb5/store.c (krb5_store_creds_tag): use session.keytype to
774 determine if to send the session-key.
776 * kcm/client.c (kcm_ccache_new_client): make root be able to pass
777 the name constraints, not the opposite. From Bryan Jacobs.
779 2007-04-20 Love Hörnquist Åstrand <lha@it.su.se>
781 * kcm/acl.c: make compile again.
783 * kcm/client.c: fix warning.
785 * kcm: First, it allows root to ignore the naming conventions.
786 Second, it allows root to always perform any operation on any
787 ccache. Note that root could do this anyway with FILE ccaches.
790 * Rename libdes to libhcrypto.
792 2007-04-19 Love Hörnquist Åstrand <lha@it.su.se>
794 * kinit: remove code that depend on kerberos 4 library
796 * kdc: remove code that depend on kerberos 4 library
798 * configure.in: Drop kerberos 4 support.
800 * kdc/hpropd.c (main): free the message when done with it.
802 * lib/krb5/pkinit.c (_krb5_get_init_creds_opt_free_pkinit):
803 remember to free memory too.
805 * lib/krb5/pkinit.c (pk_rd_pa_reply_dh): free content-type when
808 * configure.in: test rk_VERSIONSCRIPT
810 2007-04-18 Love Hörnquist Åstrand <lha@it.su.se>
812 * fix-export: remove, all done by make dist now
814 2007-04-15 Love Hörnquist Åstrand <lha@it.su.se>
816 * lib/krb5/krb5_get_credentials.3: spelling, from Jason McIntyre
818 2007-04-11 Love Hörnquist Åstrand <lha@it.su.se>
820 * kdc/kstash.8: Spelling, from raga <raga@comcast.net>
823 * lib/krb5/store_mem.c: indent.
825 * lib/krb5/recvauth.c: Set error string.
827 * lib/krb5/rd_req.c: clear error strings.
829 * lib/krb5/rd_cred.c: clear error string.
831 * lib/krb5/pkinit.c: Set error strings.
833 * lib/krb5/get_cred.c: Tell what principal we are not finding for
834 all KRB5_CC_NOTFOUND.
836 2007-02-22 Love Hörnquist Åstrand <lha@it.su.se>
838 * kdc/kerberos5.c: Return the same error codes as a windows KDC.
840 * kuser/kinit.c: KRB5KDC_ERR_PREAUTH_FAILED is also a password
843 * kdc/kerberos5.c: Make handling of replying e_data more generic,
846 * kdc/kerberos5.c: Fix (string const and shadow) warnings, from
849 * lib/krb5/pac.c: Create the PAC element in the same order as
850 w2k3, maybe there's some broken code in windows which relies on
853 * kdc/kerberos5.c: Select a session enctype from the list of the
854 crypto systems supported enctype, is supported by the client and
855 is one of the enctype of the enctype of the krbtgt.
857 The later is used as a hint what enctype all KDC are supporting to
858 make sure a newer version of KDC wont generate a session enctype
859 that and older version of a KDC in the same realm can't decrypt.
861 But if the KDC admin is paranoid and doesn't want to have "no the
862 best" enctypes on the krbtgt, lets save the best pick from the
863 client list and hope that that will work for any other KDCs.
867 * kdc/hprop.c (propagate_database): on any failure, drop the
868 connection to the peer and try next one.
870 2007-02-18 Love Hörnquist Åstrand <lha@it.su.se>
872 * lib/krb5/krb5_get_init_creds.3: document new options.
874 * kdc/krb5tgs.c: Only check service key for cross realm PACs.
876 * lib/krb5/init_creds.c: use the new merged flags field.
877 (krb5_get_init_creds_opt_set_win2k): new function, turn on all w2k
880 * lib/krb5/init_creds_pw.c: use the new merged flags field.
882 * lib/krb5/krb5_locl.h: merge all flags into one entity
884 2007-02-11 Dave Love <fx@gnu.org>
886 * lib/krb5/krb5_aname_to_localname.3: Small fixes
888 * lib/krb5/krb5_digest.3: Small fixes
890 * kuser/kimpersonate.1: Small fixes
892 2007-02-17 Love Hörnquist Åstrand <lha@it.su.se>
894 * lib/krb5/init_creds_pw.c (find_pa_data): if there is no list,
897 * kdc/krb5tgs.c: Don't check PACs on cross realm requests.
899 * lib/krb5/krb5.h: add KRB5_KU_CANONICALIZED_NAMES.
901 * lib/krb5/init_creds_pw.c: Verify client referral data.
903 * kdc/kerberos5.c: switch some "return ret" to "goto out".
905 * kdc/kerberos5.c: Pass down canonicalize request to hdb layer,
906 sign client referrals.
908 * lib/hdb/hdb.h: Add HDB_F_CANON.
910 * lib/hdb: add simple alias support to the database backends
912 2007-02-16 Love Hörnquist Åstrand <lha@it.su.se>
914 * kuser/kinit.c: Add canonicalize flag.
916 * lib/krb5/init_creds_pw.c: Use EXTRACT_TICKET_* flags, support
919 * lib/krb5/init_creds.c (krb5_get_init_creds_opt_set_canonicalize):
922 * lib/krb5/get_cred.c: Use EXTRACT_TICKET_* flags.
924 * lib/krb5/get_in_tkt.c: Use EXTRACT_TICKET_* flags.
926 * lib/krb5/krb5_locl.h: Add EXTRACT_TICKET_* flags.
928 2007-02-15 Love Hörnquist Åstrand <lha@it.su.se>
930 * lib/krb5/test_princ.c: test parsing enterprise-names.
932 * lib/krb5/principal.c: Add support for parsing enterprise-names.
934 * lib/krb5/krb5.h: Add KRB5_PRINCIPAL_PARSE_ENTERPRISE.
936 * lib/hdb/hdb-ldap.c: Make work again.
938 2007-02-11 Dave Love <fx@gnu.org>
940 * kcm/client.c (kcm_ccache_new_client): Cast snprintf'ed value.
942 2007-02-10 Love Hörnquist Åstrand <lha@it.su.se>
944 * doc/setup.texi: prune trailing space
946 * lib/hdb/db.c: Be better at setting and clearing error string.
948 * lib/hdb/hdb.c: Be better at setting and clearing error string.
950 2007-02-09 Love Hörnquist Åstrand <lha@it.su.se>
952 * lib/krb5/keytab.c (krb5_kt_get_entry): Use krb5_kt_get_full_name
953 to print out the keytab name.
955 * doc/setup.texi: Spelling, from Guido Guenther
957 2007-02-08 Love Hörnquist Åstrand <lha@it.su.se>
959 * lib/krb5/rd_cred.c: Plug memory leak, from Michael B Allen.
961 2007-02-06 Love Hörnquist Åstrand <lha@it.su.se>
963 * lib/krb5/test_store.c (test_uint16): unsigned ints can't be
966 2007-02-03 Love Hörnquist Åstrand <lha@it.su.se>
968 * kdc/pkinit.c: pass extra flags for detached signatures.
970 * lib/krb5/pkinit.c: pass extra flags for detached signatures.
972 * kdc/digest.c: Remove debug output.
974 * kuser/kdigest.c: Add support for ms-chap-v2 client.
976 2007-02-02 Love Hörnquist Åstrand <lha@it.su.se>
978 * kdc/digest.c: Fix ms-chap-v2 get_masterkey
980 * kdc/digest.c: Fix ms-chap-v2 mutual response auth code.
982 * kuser/kdigest.c: Print session key if there is one.
984 * lib/krb5/digest.c: rename hash-a1 to session key
986 * kdc/digest.c: Add get_master from RFC 3079 3.4 for MS-CHAP-V2
988 * kuser/kdigest.c: print rsp if there is one, from Klas.
990 * kdc/digest.c: Use right size, from Klas Lindfors.
992 * kuser/kdigest.c: Set client nonce if avaible, from Klas.
994 * kdc/digest.c: First version from kllin.
996 * kuser/kdigest.c: Don't restrict the type.
998 2007-02-01 Love Hörnquist Åstrand <lha@it.su.se>
1000 * kuser/kdigest-commands.in: add --client-response
1002 * kuser/kdigest.c: Print status instead of response.
1004 * kdc/digest.c: Better logging and return status = FALSE when
1005 checksum doesn't match.
1007 * kdc/digest.c: Check the digest response in the KDC.
1009 * lib/krb5/digest.c: New functions to send in requestResponse to
1010 KDC and get status of the request.
1012 * kdc/digest.c: Add support for MS-CHAP v2.
1014 * lib/hdb/hdb-ldap.c: Set hdb->hdb_db for ldap.
1016 2007-01-31 Love Hörnquist Åstrand <lha@it.su.se>
1018 * fix-export: Make hx509.info too
1020 * kdc/digest.c: don't verify identifier in CHAP, its the client
1023 2007-01-23 Love Hörnquist Åstrand <lha@it.su.se>
1025 * lib/krb5/Makefile.am: Basic test of prf.
1027 * lib/krb5/test_prf.c: Basic test of prf.
1029 * lib/krb5/mit_glue.c: Add MIT glue for Kerberos RFC 3961 PRF
1032 * lib/krb5/crypto.c: Add Kerberos RFC 3961 PRF functions.
1034 * lib/krb5/krb5_data.3: Document krb5_data_cmp.
1036 * lib/krb5/data.c: Add krb5_data_cmp.
1038 2007-01-20 Love Hörnquist Åstrand <lha@it.su.se>
1040 * kdc/kx509.c: Don't use C99 syntax.
1042 2007-01-17 Love Hörnquist Åstrand <lha@it.su.se>
1044 * configure.in: its LIBADD_roken (and shouldn't really exist, our
1045 libtool usage it broken)
1047 * configure.in: Add an extra variable for roken, LIBADD, that
1048 should be used for library depencies.
1050 * lib/krb5/send_to_kdc.c (krb5_sendto): zero out receive buffer.
1052 * lib/krb5/krb5_init_context.3: fix mdoc errors
1054 * Heimdal 0.8 branch cut today
1056 * doc/hx509.texi: Spelling and more about proxy certificates.
1058 * configure.in: check for arc4random
1060 2007-01-16 Love Hörnquist Åstrand <lha@it.su.se>
1062 * lib/krb5/send_to_kdc.c (krb5_sendto): zero receive krb5_data
1065 * tools/heimdal-build.sh: make cvs keep quiet
1067 * kuser/kverify.c: Use argument as principal if passed an
1068 argument. Bug report from Douglas E. Engert
1070 2007-01-15 Love Hörnquist Åstrand <lha@it.su.se>
1072 * lib/krb5/rd_req.c (krb5_rd_req_ctx): The code failed to consider
1073 the enc_tkt_in_skey case, from Douglas E. Engert.
1075 * kdc/kx509.c: Issue certificates.
1077 * kdc/config.c: Parse kx509/kca configuration.
1079 * kdc/kdc.h: add kx509 config
1081 2007-01-14 Love Hörnquist Åstrand <lha@it.su.se>
1083 * kdc/kerberos5.c (_kdc_find_padata): if there is not padata,
1084 there is nothing find.
1086 * doc/hx509.texi: Examples for pk-init.
1088 * doc/hx509.texi: About extending ca lifetime and sub cas.
1090 2007-01-13 Love Hörnquist Åstrand <lha@it.su.se>
1092 * doc/hx509.texi: More about certificates.
1094 2007-01-12 Love Hörnquist Åstrand <lha@it.su.se>
1096 * doc/hx509.texi: add Application requirements and write about
1099 2007-01-11 Love Hörnquist Åstrand <lha@it.su.se>
1101 * doc/hx509.texi: More about issuing certificates.
1103 * doc/hx509.texi: Start of a x.509 manual.
1105 * include/Makefile.am: remove install headerfiles
1107 * lib/krb5/test_pac.c: Use more interesting data to cause more
1110 * include/Makefile.am: remove install headerfiles
1112 * lib/krb5/mcache.c: MCC_CURSOR not used, remove.
1114 * lib/krb5/crypto.c: macro kcrypto_oid_enc now longer used
1116 * lib/krb5/rd_safe.c (krb5_rd_safe): set length before trying to
1119 2007-01-10 Love Hörnquist Åstrand <lha@it.su.se>
1121 * doc/setup.texi: Hint about hxtool validate.
1123 * appl/test/uu_server.c: print both "server" and "client"
1125 * kdc/krb5tgs.c: Rename keys to be more obvious what they do.
1127 * kdc/kerberos5.c: Use other keys to sign PAC with. From Andrew
1130 * kdc/windc.c: ident, spelling.
1132 * kdc/windc_plugin.h: indent.
1134 * kdc/krb5tgs.c: Pass down server entry to verify_pac function.
1135 from Andrew Bartlett
1137 * kdc/windc.c: pass down server entry to verify_pac function, from
1140 * kdc/windc_plugin.h: pass down server entry to verify_pac
1141 function, from Andrew Bartlett
1143 * configure.in: Provide a automake symbol ENABLE_SHARED if shared
1144 libraries are built.
1146 * lib/krb5/rd_req.c (krb5_rd_req_ctx): Use the correct keyblock
1147 when verifying the PAC. From Andrew Bartlett.
1149 2007-01-09 Love Hörnquist Åstrand <lha@it.su.se>
1151 * lib/krb5/test_pac.c: move around to code test on real PAC.
1153 * lib/krb5/pac.c: A tiny 2 char diffrence that make the code work
1156 * lib/krb5/test_pac.c: Test more PAC (note that the values used in
1157 this test is wrong, they have to be fixed when the pac code is
1160 * doc/setup.texi: Update to new hxtool issue-certificate usage
1162 * lib/krb5/init_creds_pw.c: Make sure we don't sent both ENC-TS
1163 and PK-INIT pa data, no need to expose our password protecting our
1166 * kuser/klist.c (print_cred_verbose): include ticket length in the
1169 2007-01-08 Love Hörnquist Åstrand <lha@it.su.se>
1171 * lib/krb5/acache.c (loadlib): pass RTLD_LAZY to dlopen, without
1172 it linux is unhappy.
1174 * lib/krb5/plugin.c (loadlib): pass RTLD_LAZY to dlopen, without
1175 it linux is unhappy.
1177 * lib/krb5/name-45-test.c: One of the hosts I sometimes uses is
1178 named "bar.domain", this make one of the tests pass when it
1181 2007-01-05 Love Hörnquist Åstrand <lha@it.su.se>
1183 * doc/setup.texi: Change --key argument to --out-key.
1185 * kuser/kimpersonate.1: mangle my name
1187 2007-01-04 Love Hörnquist Åstrand <lha@it.su.se>
1189 * doc/setup.texi: describe how to use hx509 to create
1192 * tools/heimdal-build.sh: Add --distcheck.
1194 * kdc/kerberos5.c: Check for KRB5_PADATA_PA_PAC_REQUEST to check
1195 if we should include the PAC in the krbtgt.
1197 * kdc/pkinit.c (_kdc_as_rep): check if
1198 krb5_generate_random_keyblock failes.
1200 * kdc/kerberos5.c (_kdc_as_rep): check if
1201 krb5_generate_random_keyblock failes.
1203 * kdc/krb5tgs.c (tgs_build_reply): check if
1204 krb5_generate_random_keyblock failes.
1206 * kdc/krb5tgs.c: Scope etype.
1208 * lib/krb5/rd_req.c: Make it possible to turn off PAC check, its
1211 * lib/krb5/rd_req.c (krb5_rd_req_ctx): If there is a PAC, verify
1212 its server signature.
1214 * kdc/kerberos5.c (_kdc_as_rep): call windc client access hook.
1215 (_kdc_tkt_add_if_relevant_ad): constify in data argument.
1217 * kdc/windc_plugin.h: More comments add a client_access hook.
1219 * kdc/windc.c: Add _kdc_windc_client_access.
1221 * kdc/krb5tgs.c: rename functions after export some more pac
1224 * lib/krb5/test_pac.c: export some more pac functions.
1226 * lib/krb5/pac.c: export some more pac functions.
1228 * kdc/krb5tgs.c: Resign the PAC in tgsreq if we have a PAC.
1230 * configure.in: add tests/plugin/Makefile
1232 2007-01-03 Love Hörnquist Åstrand <lha@it.su.se>
1234 * kdc/krb5tgs.c: Get right key for PAC krbtgt verification.
1236 * kdc/config.c: spelling
1238 * lib/krb5/krb5.h: typedef for krb5_pac.
1240 * kdc/headers.h: Include <windc_plugin.h>.
1242 * kdc/Makefile.am: Include windc.c and use windc_plugin.h
1244 * kdc/krb5tgs.c: Call callbacks for emulating a Windows Domain
1247 * kdc/kerberos5.c: Call callbacks for emulating a Windows Domain
1248 Controller. Move the some of the log related stuff to its own
1251 * kdc/config.c: Init callbacks for emulating a Windows Domain
1254 * kdc/windc.c: Rename the init function to windc instead of pac.
1256 * kdc/windc.c: Callbacks specific to emulating a Windows Domain
1259 * kdc/windc_plugin.h: Callbacks specific to emulating a Windows
1262 * lib/krb5/Makefile.am: add krb5_HEADERS to build_HEADERZ
1264 * lib/krb5/pac.c: Support all keyed checksum types.
1266 2007-01-02 Love Hörnquist Åstrand <lha@it.su.se>
1268 * lib/krb5/pac.c (krb5_pac_get_types): Return list of types.
1270 * lib/krb5/test_pac.c: test krb5_pac_get_types
1272 * lib/krb5/krbhst.c: Add KRB5_KRBHST_KCA.
1274 * lib/krb5/krbhst.c: Add KRB5_KRBHST_KCA.
1276 * lib/krb5/krb5.h: Add KRB5_KRBHST_KCA.
1278 * lib/krb5/test_pac.c: test Add/remove pac buffer functions.
1280 * lib/krb5/pac.c: Add/remove pac buffer functions.
1282 * lib/krb5/pac.c: sprinkle const
1284 * lib/krb5/pac.c: rename DCHECK to CHECK