1 2008-05-05 Love Hörnquist Åstrand <lha@kth.se>
3 * spnego/spnego_locl.h: Add back "mech/utils.h", its needed for
6 2008-05-02 Love Hörnquist Åstrand <lha@it.su.se>
8 * spnego: Changes from doug barton to make spnego indepedant of
9 the heimdal version of the plugin system.
11 2008-04-27 Love Hörnquist Åstrand <lha@it.su.se>
13 * krb5: use DES_set_key_unchecked()
15 2008-04-17 Love Hörnquist Åstrand <lha@it.su.se>
17 * add __declspec() for windows.
19 2008-04-15 Love Hörnquist Åstrand <lha@it.su.se>
21 * krb5/import_sec_context.c: Use tmp to read ac->flags value to
24 2008-04-07 Love Hörnquist Åstrand <lha@it.su.se>
26 * mech/gss_mech_switch.c: Use unsigned where appropriate.
28 2008-03-14 Love Hörnquist Åstrand <lha@it.su.se>
30 * test_context.c: Add test for gsskrb5_register_acceptor_identity.
32 2008-03-09 Love Hörnquist Åstrand <lha@it.su.se>
34 * krb5/init_sec_context.c (init_auth): use right variable to
35 detect if we want to free or not.
37 2008-02-26 Love Hörnquist Åstrand <lha@it.su.se>
39 * Makefile.am: add missing \
41 * Makefile.am: reshuffle depenencies
43 * Add flag to krb5 to not add GSS-API INT|CONF to the negotiation
45 2008-02-21 Love Hörnquist Åstrand <lha@it.su.se>
47 * make the SPNEGO mech store the error itself instead, works for
48 everything except other stackable mechs
50 2008-02-18 Love Hörnquist Åstrand <lha@it.su.se>
52 * spnego/init_sec_context.c (spnego_reply): if the reply token was
53 of length 0, make it the same as no token. Pointed out by Zeqing
56 * krb5/acquire_cred.c (acquire_initiator_cred): handle the
57 credential cache better, use destroy/close when appriate and for
58 all cases. Thanks to Michael Allen for point out the memory-leak
61 2008-02-03 Love Hörnquist Åstrand <lha@it.su.se>
63 * spnego/accept_sec_context.c: Make error reporting somewhat more
66 2008-01-27 Love Hörnquist Åstrand <lha@it.su.se>
68 * test_common.c: Improve the error message.
70 2008-01-24 Love Hörnquist Åstrand <lha@it.su.se>
72 * ntlm/accept_sec_context.c: Avoid free-ing type1 message before
75 2008-01-13 Love Hörnquist Åstrand <lha@it.su.se>
77 * test_ntlm.c: Test source name (and make the acceptor in ntlm gss
80 2007-12-30 Love Hörnquist Åstrand <lha@it.su.se>
82 * ntlm/init_sec_context.c: Don't confuse target name and source
83 name, make regressiont tests pass again.
85 2007-12-29 Love Hörnquist Åstrand <lha@it.su.se>
87 * ntlm: clean up name handling
89 2007-12-04 Love Hörnquist Åstrand <lha@it.su.se>
91 * ntlm/init_sec_context.c: Use credential if it was passed in.
93 * ntlm/acquire_cred.c: Check if there is initial creds with
94 _gss_ntlm_get_user_cred().
96 * ntlm/init_sec_context.c: Add _gss_ntlm_get_user_info() that
97 return the user info so it can be used by external modules.
99 * ntlm/inquire_cred.c: use the right error code.
101 * ntlm/inquire_cred.c: Return GSS_C_NO_CREDENTIAL if there is no
102 credential, ntlm have (not yet) a default credential.
104 * mech/gss_release_oid_set.c: Avoid trying to deref NULL, from
107 2007-12-03 Love Hörnquist Åstrand <lha@it.su.se>
109 * test_acquire_cred.c: Always try to fetch cred (even with
112 2007-08-09 Love Hörnquist Åstrand <lha@it.su.se>
114 * mech/gss_krb5.c: Readd gss_krb5_get_tkt_flags.
116 2007-08-08 Love Hörnquist Åstrand <lha@it.su.se>
118 * spnego/compat.c (_gss_spnego_internal_delete_sec_context):
119 release ctx->target_name too From Rafal Malinowski.
121 2007-07-26 Love Hörnquist Åstrand <lha@it.su.se>
123 * mech/gss_mech_switch.c: Don't try to do dlopen if system doesn't
124 have dlopen. From Rune of Chalmers.
126 2007-07-10 Love Hörnquist Åstrand <lha@it.su.se>
128 * mech/gss_duplicate_name.c: New signature of _gss_find_mn.
130 * mech/gss_init_sec_context.c: New signature of _gss_find_mn.
132 * mech/gss_acquire_cred.c: New signature of _gss_find_mn.
134 * mech/name.h: New signature of _gss_find_mn.
136 * mech/gss_canonicalize_name.c: New signature of _gss_find_mn.
138 * mech/gss_compare_name.c: New signature of _gss_find_mn.
140 * mech/gss_add_cred.c: New signature of _gss_find_mn.
142 * mech/gss_names.c (_gss_find_mn): Return an error code for
145 * spnego/accept_sec_context.c: remove checks that are done by the
148 * Makefile.am: New library version.
150 2007-07-04 Love Hörnquist Åstrand <lha@it.su.se>
152 * mech/gss_oid_to_str.c: Refuse to print GSS_C_NULL_OID, from
155 * spnego/spnego.asn1: Indent and make NegTokenInit and
156 NegTokenResp extendable.
158 2007-06-21 Love Hörnquist Åstrand <lha@it.su.se>
160 * ntlm/inquire_cred.c: Implement _gss_ntlm_inquire_cred.
162 * mech/gss_display_status.c: Provide message for GSS_S_COMPLETE.
164 * mech/context.c: If the canned string is "", its no use to the
165 user, make it fall back to the default error string.
167 2007-06-20 Love Hörnquist Åstrand <lha@it.su.se>
169 * mech/gss_display_name.c (gss_display_name): no name ->
170 fail. From Rafal Malinswski.
172 * spnego/accept_sec_context.c: Wrap name in a spnego_name instead
173 of just a copy of the underlaying object. From Rafal Malinswski.
175 * spnego/accept_sec_context.c: Handle underlaying mech not
178 * mech/gss_accept_sec_context.c: Handle underlaying mech not
181 * spnego/accept_sec_context.c: Make sure src_name is always set to
182 GSS_C_NO_NAME when returning.
184 * krb5/acquire_cred.c (acquire_acceptor_cred): don't claim
185 everything is well on failure. From Phil Fisher.
187 * mech/gss_duplicate_name.c: catch error (and ignore it)
189 * ntlm/init_sec_context.c: Use heim_ntlm_calculate_ntlm2_sess.
191 * mech/gss_accept_sec_context.c: Only wrap the delegated cred if
192 we got a delegated mech cred. From Rafal Malinowski.
194 * spnego/accept_sec_context.c: Only wrap the delegated cred if we
195 are going to return it to the consumer. From Rafal Malinowski.
197 * spnego/accept_sec_context.c: Fixed memory leak pointed out by
198 Rafal Malinowski, also while here moved to use NegotiationToken
201 2007-06-18 Love Hörnquist Åstrand <lha@it.su.se>
203 * krb5/prf.c (_gsskrb5_pseudo_random): add missing break.
205 * krb5/release_name.c: Set *minor_status unconditionallty, its
208 * spnego/accept_sec_context.c: Init get_mic to 0.
210 * mech/gss_set_cred_option.c: Free memory in failure case, found
213 * mech/gss_inquire_context.c: Handle mech_type being NULL.
215 * mech/gss_inquire_cred_by_mech.c: Handle cred_name being NULL.
217 * mech/gss_krb5.c: Free memory in error case, found by beam.
219 2007-06-12 Love Hörnquist Åstrand <lha@it.su.se>
221 * ntlm/inquire_context.c: Use ctx->gssflags for flags.
223 * krb5/display_name.c: Use KRB5_PRINCIPAL_UNPARSE_DISPLAY, this is
224 not ment for machine consumption.
226 2007-06-09 Love Hörnquist Åstrand <lha@it.su.se>
228 * ntlm/digest.c (kdc_alloc): free memory on failure, pointed out
231 * ntlm/digest.c (kdc_destroy): free context when done, pointed out
234 * spnego/context_stubs.c (_gss_spnego_display_name): if input_name
235 is null, fail. From Rafal Malinowski.
237 2007-06-04 Love Hörnquist Åstrand <lha@it.su.se>
239 * ntlm/digest.c: Free memory when done.
241 2007-06-02 Love Hörnquist Åstrand <lha@it.su.se>
243 * test_ntlm.c: Test both with and without keyex.
245 * ntlm/digest.c: If we didn't set session key, don't expect one
248 * test_ntlm.c: Set keyex flag and calculate session key.
250 2007-05-31 Love Hörnquist Åstrand <lha@it.su.se>
252 * spnego/accept_sec_context.c: Use the return value before is
253 overwritten by later calls. From Rafal Malinowski
255 * krb5/release_cred.c: Give an minor_status argument to
256 gss_release_oid_set. From Rafal Malinowski
258 2007-05-30 Love Hörnquist Åstrand <lha@it.su.se>
260 * ntlm/accept_sec_context.c: Catch errors and return the up the
263 * test_kcred.c: more testing of lifetimes
265 2007-05-17 Love Hörnquist Åstrand <lha@it.su.se>
267 * Makefile.am: Drop the gss oid_set function for the krb5 mech,
268 use the mech glue versions instead. Pointed out by Rafal
271 * krb5: Use gss oid_set functions from mechglue
273 2007-05-14 Love Hörnquist Åstrand <lha@it.su.se>
275 * ntlm/accept_sec_context.c: Set session key only if we are
276 returned a session key. Found by David Love.
278 2007-05-13 Love Hörnquist Åstrand <lha@it.su.se>
280 * krb5/prf.c: switched MIN to min to make compile on solaris,
281 pointed out by David Love.
283 2007-05-09 Love Hörnquist Åstrand <lha@it.su.se>
285 * krb5/inquire_cred_by_mech.c: Fill in all of the variables if
286 they are passed in. Pointed out by Phil Fisher.
288 2007-05-08 Love Hörnquist Åstrand <lha@it.su.se>
290 * krb5/inquire_cred.c: Fix copy and paste error, bug spotted by
293 * mech: dont keep track of gc_usage, just figure it out at
294 gss_inquire_cred() time
296 * mech/gss_mech_switch.c (add_builtin): ok for
297 __gss_mech_initialize() to return NULL
299 * test_kcred.c: more correct tests
301 * spnego/cred_stubs.c (gss_inquire_cred*): wrap the name with a
304 * ntlm/inquire_cred.c: make ntlm gss_inquire_cred fail for now,
305 need to find default cred and friends.
307 * krb5/inquire_cred_by_mech.c: reimplement
309 2007-05-07 Love Hörnquist Åstrand <lha@it.su.se>
311 * ntlm/acquire_cred.c: drop unused variable.
313 * ntlm/acquire_cred.c: Reimplement.
315 * Makefile.am: add ntlm/digest.c
317 * ntlm: split out backend ntlm server processing
319 2007-04-24 Love Hörnquist Åstrand <lha@it.su.se>
321 * ntlm/delete_sec_context.c (_gss_ntlm_delete_sec_context): free
324 2007-04-22 Love Hörnquist Åstrand <lha@it.su.se>
326 * ntlm/init_sec_context.c: ntlm-key credential entry is prefix with @
328 * ntlm/init_sec_context.c (get_user_ccache): pick up the ntlm
329 creds from the krb5 credential cache.
331 2007-04-21 Love Hörnquist Åstrand <lha@it.su.se>
333 * ntlm/delete_sec_context.c: free the key stored in the context
335 * ntlm/ntlm.h: switch password for a key
337 * test_oid.c: Switch oid to one that is exported.
339 2007-04-20 Love Hörnquist Åstrand <lha@it.su.se>
341 * ntlm/init_sec_context.c: move where hash is calculated to make
342 it easier to add ccache support.
344 * Makefile.am: Add version-script.map to EXTRA_DIST.
346 2007-04-19 Love Hörnquist Åstrand <lha@it.su.se>
348 * Makefile.am: Unconfuse newer versions of automake that doesn't
349 know the diffrence between depenences and setting variables. foo:
352 * test_ntlm.c: delete sec context when done.
354 * version-script.map: export more symbols.
356 * Makefile.am: add version script if ld supports it
358 * version-script.map: add version script if ld supports it
360 2007-04-18 Love Hörnquist Åstrand <lha@it.su.se>
362 * Makefile.am: test_acquire_cred need test_common.[ch]
364 * test_acquire_cred.c: add more test options.
366 * krb5/external.c: add GSS_KRB5_CCACHE_NAME_X
368 * gssapi/gssapi_krb5.h: add GSS_KRB5_CCACHE_NAME_X
370 * krb5/set_sec_context_option.c: refactor code, implement
371 GSS_KRB5_CCACHE_NAME_X
373 * mech/gss_krb5.c: reimplement gss_krb5_ccache_name
375 2007-04-17 Love Hörnquist Åstrand <lha@it.su.se>
377 * spnego/cred_stubs.c: Need to import spnego name before we can
378 use it as a gss_name_t.
380 * test_acquire_cred.c: use this test as part of the regression
383 * mech/gss_acquire_cred.c (gss_acquire_cred): dont init
384 cred->gc_mc every time in the loop.
386 2007-04-15 Love Hörnquist Åstrand <lha@it.su.se>
388 * Makefile.am: add test_common.h
390 2007-02-16 Love Hörnquist Åstrand <lha@it.su.se>
392 * gss_acquire_cred.3: Add link for
393 gsskrb5_register_acceptor_identity.
395 2007-02-08 Love Hörnquist Åstrand <lha@it.su.se>
397 * krb5/copy_ccache.c: Try to leak less memory in the failure case.
399 2007-01-31 Love Hörnquist Åstrand <lha@it.su.se>
401 * mech/gss_display_status.c: Use right printf formater.
403 * test_*.[ch]: split out the error printing function and try to
406 2007-01-30 Love Hörnquist Åstrand <lha@it.su.se>
408 * krb5/init_sec_context.c: revert 1.75: (init_auth): only turn on
409 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
411 This is because Kerberos always support INT|CONF, matches behavior
412 with MS and MIT. The creates problems for the GSS-SPNEGO mech.
414 2007-01-24 Love Hörnquist Åstrand <lha@it.su.se>
416 * krb5/prf.c: constrain desired_output_len
418 * krb5/external.c (krb5_mech): add _gsskrb5_pseudo_random
420 * mech/gss_pseudo_random.c: Catch error from underlaying mech on
423 * Makefile.am: Add krb5/prf.c
425 * krb5/prf.c: gss_pseudo_random for krb5
427 * test_context.c: Checks for gss_pseudo_random.
429 * krb5/gkrb5_err.et: add KG_INPUT_TOO_LONG
431 * Makefile.am: Add mech/gss_pseudo_random.c
433 * gssapi/gssapi.h: try to load pseudo_random
435 * mech/gss_mech_switch.c: try to load pseudo_random
437 * mech/gss_pseudo_random.c: Add gss_pseudo_random.
439 * gssapi_mech.h: Add hook for gm_pseudo_random.
441 2007-01-17 Love Hörnquist Åstrand <lha@it.su.se>
443 * test_context.c: Don't assume bufer from gss_display_status is
446 * mech/gss_wrap_size_limit.c: Reset out variables.
448 * mech/gss_wrap.c: Reset out variables.
450 * mech/gss_verify_mic.c: Reset out variables.
452 * mech/gss_utils.c: Reset out variables.
454 * mech/gss_release_oid_set.c: Reset out variables.
456 * mech/gss_release_cred.c: Reset out variables.
458 * mech/gss_release_buffer.c: Reset variables.
460 * mech/gss_oid_to_str.c: Reset out variables.
462 * mech/gss_inquire_sec_context_by_oid.c: Fix reset out variables.
464 * mech/gss_mech_switch.c: Reset out variables.
466 * mech/gss_inquire_sec_context_by_oid.c: Reset out variables.
468 * mech/gss_inquire_names_for_mech.c: Reset out variables.
470 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
472 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
474 * mech/gss_inquire_cred_by_mech.c: Reset out variables.
476 * mech/gss_inquire_cred.c: Reset out variables, fix memory leak.
478 * mech/gss_inquire_context.c: Reset out variables.
480 * mech/gss_init_sec_context.c: Zero out outbuffer on failure.
482 * mech/gss_import_name.c: Reset out variables.
484 * mech/gss_import_name.c: Reset out variables.
486 * mech/gss_get_mic.c: Reset out variables.
488 * mech/gss_export_name.c: Reset out variables.
490 * mech/gss_encapsulate_token.c: Reset out variables.
492 * mech/gss_duplicate_oid.c: Reset out variables.
494 * mech/gss_duplicate_oid.c: Reset out variables.
496 * mech/gss_duplicate_name.c: Reset out variables.
498 * mech/gss_display_status.c: Reset out variables.
500 * mech/gss_display_name.c: Reset out variables.
502 * mech/gss_delete_sec_context.c: Reset out variables using propper
505 * mech/gss_decapsulate_token.c: Reset out variables using propper
508 * mech/gss_add_cred.c: Reset out variables.
510 * mech/gss_acquire_cred.c: Reset out variables.
512 * mech/gss_accept_sec_context.c: Reset out variables using propper
515 * mech/gss_init_sec_context.c: Reset out variables.
517 * mech/mech_locl.h (_mg_buffer_zero): new macro that zaps a
520 2007-01-16 Love Hörnquist Åstrand <lha@it.su.se>
522 * mech: sprinkel _gss_mg_error
524 * mech/gss_display_status.c (gss_display_status): use
525 _gss_mg_get_error to fetch the error from underlaying mech, if it
526 failes, let do the regular dance for GSS-CODE version and a
527 generic print-the-error code for MECH-CODE.
529 * mech/gss_oid_to_str.c: Don't include the NUL in the length of
532 * mech/context.h: Protoypes for _gss_mg_.
534 * mech/context.c: Glue to catch the error from the lower gss-api
535 layer and save that for later so gss_display_status() can show the
538 * gss.c: Detect NTLM.
540 2007-01-11 Love Hörnquist Åstrand <lha@it.su.se>
542 * mech/gss_accept_sec_context.c: spelling
544 2007-01-04 Love Hörnquist Åstrand <lha@it.su.se>
546 * Makefile.am: Include build (private) prototypes header files.
548 * Makefile.am (ntlmsrc): add ntlm/ntlm-private.h
550 2006-12-28 Love Hörnquist Åstrand <lha@it.su.se>
552 * ntlm/accept_sec_context.c: Pass signseal argument to
555 * ntlm/init_sec_context.c: Pass signseal argument to
558 * ntlm/crypto.c (_gss_ntlm_set_key): add signseal argument
560 * test_ntlm.c: add ntlmv2 test
562 * ntlm/ntlm.h: break out struct ntlmv2_key;
564 * ntlm/crypto.c (_gss_ntlm_set_key): set ntlm v2 keys.
566 * ntlm/accept_sec_context.c: Set dummy ntlmv2 keys and Check TI.
568 * ntlm/ntlm.h: NTLMv2 keys.
570 * ntlm/crypto.c: NTLMv2 sign and verify.
572 2006-12-20 Love Hörnquist Åstrand <lha@it.su.se>
574 * ntlm/accept_sec_context.c: Don't send targetinfo now.
576 * ntlm/init_sec_context.c: Build ntlmv2 answer buffer.
578 * ntlm/init_sec_context.c: Leak less memory.
580 * ntlm/init_sec_context.c: Announce that we support key exchange.
582 * ntlm/init_sec_context.c: Add NTLM_NEG_NTLM2_SESSION, NTLMv2
583 session security (disable because missing sign and seal).
585 2006-12-19 Love Hörnquist Åstrand <lha@it.su.se>
587 * ntlm/accept_sec_context.c: split RC4 send and recv keystreams
589 * ntlm/init_sec_context.c: split RC4 send and recv keystreams
591 * ntlm/ntlm.h: split RC4 send and recv keystreams
593 * ntlm/crypto.c: Implement SEAL.
595 * ntlm/crypto.c: move gss_wrap/gss_unwrap here
597 * test_context.c: request INT and CONF from the gss layer, test
600 * ntlm/ntlm.h: add crypto bits.
602 * ntlm/accept_sec_context.c: Save session master key.
604 * Makefile.am: Move get and verify mic to the same file (crypto.c)
605 since they share code.
607 * ntlm/crypto.c: Move get and verify mic to the same file since
608 they share code, implement NTLM v1 and dummy signatures.
610 * ntlm/init_sec_context.c: pass on GSS_C_CONF_FLAG and
611 GSS_C_INTEG_FLAG, save the session master key
613 * spnego/accept_sec_context.c: try using gss_accept_sec_context()
614 on the opportunistic token instead of guessing the acceptor name
615 and do gss_acquire_cred, this make SPNEGO work like before.
617 2006-12-18 Love Hörnquist Åstrand <lha@it.su.se>
619 * ntlm/init_sec_context.c: Calculate the NTLM version 1 "master"
622 * spnego/accept_sec_context.c: Resurect negHints for the acceptor
625 * Makefile.am: Add "windows" versions of the NegTokenInitWin and
628 * test_context.c: add --wrapunwrap flag
630 * spnego/compat.c: move _gss_spnego_indicate_mechtypelist() to
631 compat.c, use the sequence types of MechTypeList, make
632 add_mech_type() static.
634 * spnego/accept_sec_context.c: move
635 _gss_spnego_indicate_mechtypelist() to compat.c
637 * Makefile.am: Generate sequence code for MechTypeList
639 * spnego: check that the generated acceptor mechlist is acceptable too
641 * spnego/init_sec_context.c: Abstract out the initiator filter
642 function, it will be needed for the acceptor too.
644 * spnego/accept_sec_context.c: Abstract out the initiator filter
645 function, it will be needed for the acceptor too. Remove negHints.
647 * test_context.c: allow asserting return mech
649 * ntlm/accept_sec_context.c: add _gss_ntlm_allocate_ctx
651 * ntlm/acquire_cred.c: Check that the KDC seem to there and
652 answering us, we can't do better then that wen checking if we will
653 accept the credential.
655 * ntlm/get_mic.c: return GSS_S_UNAVAILABLE
657 * mech/utils.h: add _gss_free_oid, reverse of _gss_copy_oid
659 * mech/gss_utils.c: add _gss_free_oid, reverse of _gss_copy_oid
661 * spnego/spnego.asn1: Its very sad, but NegHints its are not part
662 of the NegTokenInit, this makes SPNEGO acceptor life a lot harder.
664 * spnego: try harder to handle names better. handle missing
665 acceptor and initator creds better (ie dont propose/accept mech
666 that there are no credentials for) split NegTokenInit and
667 NegTokenResp in acceptor
669 2006-12-16 Love Hörnquist Åstrand <lha@it.su.se>
671 * ntlm/import_name.c: Allocate the buffer from the right length.
673 2006-12-15 Love Hörnquist Åstrand <lha@it.su.se>
675 * ntlm/init_sec_context.c (init_sec_context): Tell the other side
676 what domain we think we are talking to.
678 * ntlm/delete_sec_context.c: free username and password
680 * ntlm/release_name.c (_gss_ntlm_release_name): free name.
682 * ntlm/import_name.c (_gss_ntlm_import_name): add support for
683 GSS_C_NT_HOSTBASED_SERVICE names
685 * ntlm/ntlm.h: Add ntlm_name.
687 * test_context.c: allow testing of ntlm.
689 * gssapi_mech.h: add __gss_ntlm_initialize
691 * ntlm/accept_sec_context.c (handle_type3): verify that the kdc
692 approved of the ntlm exchange too
694 * mech/gss_mech_switch.c: Add the builtin ntlm mech
696 * test_ntlm.c: NTLM test app.
698 * mech/gss_accept_sec_context.c: Add detection of NTLMSSP.
700 * gssapi/gssapi.h: add ntlm mech oid
702 * ntlm/external.c: Switch OID to the ms ntlmssp oid
704 * Makefile.am: Add ntlm gss-api module.
706 * ntlm/accept_sec_context.c: Catch more error errors.
708 * ntlm/accept_sec_context.c: Check after a credential to use.
710 2006-12-14 Love Hörnquist Åstrand <lha@it.su.se>
712 * krb5/set_sec_context_option.c (GSS_KRB5_SET_DEFAULT_REALM_X):
713 don't fail on success. Bug report from Stefan Metzmacher.
715 2006-12-13 Love Hörnquist Åstrand <lha@it.su.se>
717 * krb5/init_sec_context.c (init_auth): only turn on
718 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
719 From Stefan Metzmacher.
721 2006-12-11 Love Hörnquist Åstrand <lha@it.su.se>
723 * Makefile.am (libgssapi_la_OBJECTS): depends on gssapi_asn1.h
726 2006-11-20 Love Hörnquist Åstrand <lha@it.su.se>
728 * krb5/acquire_cred.c: Make krb5_get_init_creds_opt_free take a
731 2006-11-16 Love Hörnquist Åstrand <lha@it.su.se>
733 * test_context.c: Test that token keys are the same, return
736 2006-11-15 Love Hörnquist Åstrand <lha@it.su.se>
738 * spnego/spnego_locl.h: Make bitfields unsigned, add maybe_open.
740 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
741 encode CHOICE structure now that we can handle it.
743 * spnego/init_sec_context.c: Use ASN.1 encoder functions to encode
744 CHOICE structure now that we can handle it.
746 * spnego/accept_sec_context.c (_gss_spnego_accept_sec_context):
747 send back ad accept_completed when the security context is ->open,
748 w/o this the client doesn't know that the server have completed
751 * test_context.c: Add delegate flag and check that the delegated
754 * spnego/init_sec_context.c: Keep track of the opportunistic token
755 in the inital message, it might be a complete gss-api context, in
756 that case we'll get back accept_completed without any token. With
757 this change, krb5 w/o mutual authentication works.
759 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
760 encode CHOICE structure now that we can handle it.
762 * spnego/accept_sec_context.c: Filter out SPNEGO from the out
763 supported mechs list and make sure we don't select that for the
766 2006-11-14 Love Hörnquist Åstrand <lha@it.su.se>
768 * mech/gss_init_sec_context.c (_gss_mech_cred_find): break out the
769 cred finding to its own function
771 * krb5/wrap.c: Better error strings, from Andrew Bartlet.
773 2006-11-13 Love Hörnquist Åstrand <lha@it.su.se>
775 * test_context.c: Create our own krb5_context.
777 * krb5: Switch from using a specific error message context in the
778 TLS to have a whole krb5_context in TLS. This have some
779 interestion side-effekts for the configruration setting options
780 since they operate on per-thread basis now.
782 * mech/gss_set_cred_option.c: When calling ->gm_set_cred_option
783 and checking for success, use GSS_S_COMPLETE. From Andrew Bartlet.
785 2006-11-12 Love Hörnquist Åstrand <lha@it.su.se>
787 * Makefile.am: Help solaris make even more.
789 * Makefile.am: Help solaris make.
791 2006-11-09 Love Hörnquist Åstrand <lha@it.su.se>
793 * Makefile.am: remove include $(srcdir)/Makefile-digest.am for now
795 * mech/gss_accept_sec_context.c: Try better guessing what is mech
796 we are going to select by looking harder at the input_token, idea
797 from Luke Howard's mechglue branch.
799 * Makefile.am: libgssapi_la_OBJECTS: add depency on gkrb5_err.h
801 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X
803 * mech/gss_krb5.c: implement gss_krb5_set_allowable_enctypes
805 * gssapi/gssapi.h: GSS_KRB5_S_
807 * krb5/gsskrb5_locl.h: Include <gkrb5_err.h>.
809 * gssapi/gssapi_krb5.h: Add gss_krb5_set_allowable_enctypes.
811 * Makefile.am: Build and install gkrb5_err.h
813 * krb5/gkrb5_err.et: Move the GSS_KRB5_S error here.
815 2006-11-08 Love Hörnquist Åstrand <lha@it.su.se>
817 * mech/gss_krb5.c: Add gsskrb5_set_default_realm.
819 * krb5/set_sec_context_option.c: Support
820 GSS_KRB5_SET_DEFAULT_REALM_X.
822 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DEFAULT_REALM_X
824 * krb5/external.c: add GSS_KRB5_SET_DEFAULT_REALM_X
826 2006-11-07 Love Hörnquist Åstrand <lha@it.su.se>
828 * test_context.c: rename krb5_[gs]et_time_wrap to
829 krb5_[gs]et_max_time_skew
831 * krb5/copy_ccache.c: _gsskrb5_extract_authz_data_from_sec_context
832 no longer used, bye bye
834 * mech/gss_krb5.c: No depenency of the krb5 gssapi mech.
836 * mech/gss_krb5.c (gsskrb5_extract_authtime_from_sec_context): use
837 _gsskrb5_decode_om_uint32. From Andrew Bartlet.
839 * mech/gss_krb5.c: Add dummy gss_krb5_set_allowable_enctypes for
842 * spnego/spnego_locl.h: Include <roken.h> for compatiblity.
844 * krb5/arcfour.c: Use IS_DCE_STYLE flag. There is no padding in
845 DCE-STYLE, don't try to use to. From Andrew Bartlett.
847 * test_context.c: test wrap/unwrap, add flag for dce-style and
848 mutual auth, also support multi-roundtrip sessions
850 * krb5/gsskrb5_locl.h: Add IS_DCE_STYLE macro.
852 * krb5/accept_sec_context.c (gsskrb5_acceptor_start): use
855 * mech/gss_krb5.c (gsskrb5_get_subkey): return the per message
858 * krb5/inquire_sec_context_by_oid.c: check if there is any key at
861 2006-11-06 Love Hörnquist Åstrand <lha@it.su.se>
863 * krb5/inquire_sec_context_by_oid.c: Set more error strings, use
864 right enum for acceptor subkey. From Andrew Bartlett.
866 2006-11-04 Love Hörnquist Åstrand <lha@it.su.se>
868 * test_context.c: Test gsskrb5_extract_service_keyblock, needed in
869 PAC valication. From Andrew Bartlett
871 * mech/gss_krb5.c: Add gsskrb5_extract_authz_data_from_sec_context
872 and keyblock extraction functions.
874 * gssapi/gssapi_krb5.h: Add extraction of keyblock function, from
877 * krb5/external.c: Add GSS_KRB5_GET_SERVICE_KEYBLOCK_X
879 2006-11-03 Love Hörnquist Åstrand <lha@it.su.se>
881 * test_context.c: Rename various routines and constants from
882 canonize to canonicalize. From Andrew Bartlett
884 * mech/gss_krb5.c: Rename various routines and constants from
885 canonize to canonicalize. From Andrew Bartlett
887 * krb5/set_sec_context_option.c: Rename various routines and
888 constants from canonize to canonicalize. From Andrew Bartlett
890 * krb5/external.c: Rename various routines and constants from
891 canonize to canonicalize. From Andrew Bartlett
893 * gssapi/gssapi_krb5.h: Rename various routines and constants from
894 canonize to canonicalize. From Andrew Bartlett
896 2006-10-25 Love Hörnquist Åstrand <lha@it.su.se>
898 * krb5/accept_sec_context.c (gsskrb5_accept_delegated_token): need
901 2006-10-24 Love Hörnquist Åstrand <lha@it.su.se>
903 * test_context.c (loop): free target_name
905 * mech/gss_accept_sec_context.c: SLIST_INIT the ->gc_mc'
907 * mech/gss_acquire_cred.c : SLIST_INIT the ->gc_mc'
909 * krb5/init_sec_context.c: Avoid leaking memory.
911 * mech/gss_buffer_set.c (gss_release_buffer_set): don't leak the
914 * test_context.c: make compile
916 * krb5/cfx.c (_gssapi_verify_mic_cfx): always free crypto context.
918 * krb5/set_cred_option.c (import_cred): free sp
920 2006-10-22 Love Hörnquist Åstrand <lha@it.su.se>
922 * mech/gss_add_oid_set_member.c: Use old implementation of
923 gss_add_oid_set_member, it leaks less memory.
925 * krb5/test_cfx.c: free krb5_crypto.
927 * krb5/test_cfx.c: free krb5_context
929 * mech/gss_release_name.c (gss_release_name): free input_name
932 2006-10-21 Love Hörnquist Åstrand <lha@it.su.se>
934 * test_context.c: Call setprogname.
936 * mech/gss_krb5.c: Add gsskrb5_extract_authtime_from_sec_context.
938 * gssapi/gssapi_krb5.h: add
939 gsskrb5_extract_authtime_from_sec_context
941 2006-10-20 Love Hörnquist Åstrand <lha@it.su.se>
943 * krb5/inquire_sec_context_by_oid.c: Add get_authtime.
945 * krb5/external.c: add GSS_KRB5_GET_AUTHTIME_X
947 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_AUTHTIME_X
949 * krb5/set_sec_context_option.c: Implement GSS_KRB5_SEND_TO_KDC_X.
951 * mech/gss_krb5.c: Add gsskrb5_set_send_to_kdc
953 * gssapi/gssapi_krb5.h: Add GSS_KRB5_SEND_TO_KDC_X and
954 gsskrb5_set_send_to_kdc
956 * krb5/external.c: add GSS_KRB5_SEND_TO_KDC_X
958 * Makefile.am: more files
960 2006-10-19 Love Hörnquist Åstrand <lha@it.su.se>
962 * Makefile.am: remove spnego/gssapi_spnego.h, its now in gssapi/
964 * test_context.c: Allow specifing mech.
966 * krb5/external.c: add GSS_SASL_DIGEST_MD5_MECHANISM (for now)
968 * gssapi/gssapi.h: Rename GSS_DIGEST_MECHANISM to
969 GSS_SASL_DIGEST_MD5_MECHANISM
971 2006-10-18 Love Hörnquist Åstrand <lha@it.su.se>
973 * mech/gssapi.asn1: Make it into a heim_any_set, its doesn't
976 * mech/gssapi.asn1: GSSAPIContextToken is IMPLICIT SEQUENCE
978 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X
980 * krb5/external.c: Add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X.
982 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_INITIATOR_SUBKEY_X and
983 GSS_KRB5_GET_SUBKEY_X
985 * krb5/external.c: add GSS_KRB5_GET_INITIATOR_SUBKEY_X,
986 GSS_KRB5_GET_SUBKEY_X
988 2006-10-17 Love Hörnquist Åstrand <lha@it.su.se>
990 * test_context.c: Support switching on name type oid's
992 * test_context.c: add test for dns canon flag
994 * mech/gss_krb5.c: Add gsskrb5_set_dns_canonlize.
996 * gssapi/gssapi_krb5.h: remove gss_krb5_compat_des3_mic
998 * gssapi/gssapi_krb5.h: Add gsskrb5_set_dns_canonlize.
1000 * krb5/set_sec_context_option.c: implement
1001 GSS_KRB5_SET_DNS_CANONIZE_X
1003 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DNS_CANONIZE_X
1005 * krb5/external.c: add GSS_KRB5_SET_DNS_CANONIZE_X
1007 * mech/gss_krb5.c: add bits to make lucid context work
1009 2006-10-14 Love Hörnquist Åstrand <lha@it.su.se>
1011 * mech/gss_oid_to_str.c: Prefix der primitives with der_.
1013 * krb5/inquire_sec_context_by_oid.c: Prefix der primitives with
1016 * krb5/encapsulate.c: Prefix der primitives with der_.
1018 * mech/gss_oid_to_str.c: New der_print_heim_oid signature.
1020 2006-10-12 Love Hörnquist Åstrand <lha@it.su.se>
1022 * Makefile.am: add test_context
1024 * krb5/inquire_sec_context_by_oid.c: Make it work.
1026 * test_oid.c: Test lucid oid.
1028 * gssapi/gssapi.h: Add OM_uint64_t.
1030 * krb5/inquire_sec_context_by_oid.c: Add lucid interface.
1032 * krb5/external.c: Add lucid interface, renumber oids to my
1035 * mech/gss_krb5.c: Add lucid interface.
1037 * gssapi/gssapi_krb5.h: Add lucid interface.
1039 * spnego/spnego_locl.h: Maybe include <netdb.h>.
1041 2006-10-09 Love Hörnquist Åstrand <lha@it.su.se>
1043 * mech/gss_mech_switch.c: define RTLD_LOCAL to 0 if not defined.
1045 2006-10-08 Love Hörnquist Åstrand <lha@it.su.se>
1047 * Makefile.am: install gssapi_krb5.H and gssapi_spnego.h
1049 * gssapi/gssapi_krb5.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1051 * gssapi/gssapi.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1053 * Makefile.am: Drop some -I no longer needed.
1055 * gssapi/gssapi_spnego.h: Move gssapi_spengo.h over here.
1057 * krb5: reference all include files using 'krb5/'
1059 2006-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1061 * gssapi.h: Add file inclusion protection.
1063 * gssapi/gssapi.h: Correct header file inclusion protection.
1065 * gssapi/gssapi.h: Move the gssapi.h from lib/gssapi/ to
1066 lib/gssapi/gssapi/ to please automake.
1068 * spnego/spnego_locl.h: Maybe include <sys/types.h>.
1070 * mech/mech_locl.h: Include <roken.h>.
1072 * Makefile.am: split build files into dist_ and noinst_ SOURCES
1074 2006-10-06 Love Hörnquist Åstrand <lha@it.su.se>
1076 * gss.c: #if 0 out unused code.
1078 * mech/gss_mech_switch.c: Cast argument to ctype(3) functions
1081 2006-10-05 Love Hörnquist Åstrand <lha@it.su.se>
1083 * mech/name.h: remove <sys/queue.h>
1085 * mech/mech_switch.h: remove <sys/queue.h>
1087 * mech/cred.h: remove <sys/queue.h>
1089 2006-10-02 Love Hörnquist Åstrand <lha@it.su.se>
1091 * krb5/arcfour.c: Thinker more with header lengths.
1093 * krb5/arcfour.c: Improve the calcucation of header
1094 lengths. DCE-STYLE data is also padded so remove if (1 || ...)
1097 * krb5/wrap.c (_gsskrb5_wrap_size_limit): use
1098 _gssapi_wrap_size_arcfour for arcfour
1100 * krb5/arcfour.c: Move _gssapi_wrap_size_arcfour here.
1102 * Makefile.am: Split all mech to diffrent mechsrc variables.
1104 * spnego/context_stubs.c: Make internal function static (and
1107 2006-10-01 Love Hörnquist Åstrand <lha@it.su.se>
1109 * krb5/inquire_cred.c: Fix "if (x) lock(y)" bug. From Harald
1112 * spnego/spnego_locl.h: Include <sys/param.h> for MAXHOSTNAMELEN.
1114 2006-09-25 Love Hörnquist Åstrand <lha@it.su.se>
1116 * krb5/arcfour.c: Add wrap support, interrop with itself but not
1119 * krb5/gsskrb5_locl.h: move the arcfour specific stuff to the
1122 * krb5/arcfour.c: Support DCE-style unwrap, tested with
1125 * mech/gss_accept_sec_context.c (gss_accept_sec_context): if the
1126 token doesn't start with [APPLICATION 0] SEQUENCE, lets assume its
1127 a DCE-style kerberos 5 connection. XXX this needs to be made
1128 better in cause we get another GSS-API protocol violating
1129 protocol. It should be possible to detach the Kerberos DCE-style
1130 since it starts with a AP-REQ PDU, but that have to wait for now.
1132 2006-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1134 * gssapi.h: Add GSS_C flags from
1135 draft-brezak-win2k-krb-rc4-hmac-04.txt.
1137 * krb5/delete_sec_context.c: Free service_keyblock and fwd_data,
1140 * krb5/accept_sec_context.c: Merge of the acceptor part from the
1141 samba patch by Stefan Metzmacher and Andrew Bartlet.
1143 * krb5/init_sec_context.c: Add GSS_C_DCE_STYLE.
1145 * krb5/{init_sec_context.c,gsskrb5_locl.h}: merge most of the
1146 initiator part from the samba patch by Stefan Metzmacher and
1147 Andrew Bartlet (still missing DCE/RPC support)
1149 2006-08-28 Love Hörnquist Åstrand <lha@it.su.se>
1151 * gss.c (help): use sl_slc_help().
1153 2006-07-22 Love Hörnquist Åstrand <lha@it.su.se>
1155 * gss-commands.in: rename command to supported-mechanisms
1157 * Makefile.am: Make gss objects depend on the slc built
1160 2006-07-20 Love Hörnquist Åstrand <lha@it.su.se>
1162 * gss-commands.in: add slc commands for gss
1164 * krb5/gsskrb5_locl.h: Remove dup prototype of _gsskrb5_init()
1166 * Makefile.am: Add test_cfx
1168 * krb5/external.c: add GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1170 * krb5/set_sec_context_option.c: catch
1171 GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1173 * krb5/accept_sec_context.c: reimplement
1174 gsskrb5_register_acceptor_identity
1176 * mech/gss_krb5.c: implement gsskrb5_register_acceptor_identity
1178 * mech/gss_inquire_mechs_for_name.c: call _gss_load_mech
1180 * mech/gss_inquire_cred.c (gss_inquire_cred): call _gss_load_mech
1182 * mech/gss_mech_switch.c: Make _gss_load_mech() atomic and run
1183 only once, this have the side effect that _gss_mechs and
1184 _gss_mech_oids is only initialized once, so if just the users of
1185 these two global variables calls _gss_load_mech() first, it will
1186 act as a barrier and make sure the variables are never changed and
1187 we don't need to lock them.
1189 * mech/utils.h: no need to mark functions extern.
1191 * mech/name.h: no need to mark _gss_find_mn extern.
1193 2006-07-19 Love Hörnquist Åstrand <lha@it.su.se>
1195 * krb5/cfx.c: Redo the wrap length calculations.
1197 * krb5/test_cfx.c: test max_wrap_size in cfx.c
1199 * mech/gss_display_status.c: Handle more error codes.
1201 2006-07-07 Love Hörnquist Åstrand <lha@it.su.se>
1203 * mech/mech_locl.h: Include <krb5-types.h> and "mechqueue.h"
1205 * mech/mechqueue.h: Add SLIST macros.
1207 * krb5/inquire_context.c: Don't free return values on success.
1209 * krb5/inquire_cred.c (_gsskrb5_inquire_cred): When cred provided
1210 is the default cred, acquire the acceptor cred and initator cred
1211 in two diffrent steps and then query them for the information,
1212 this way, the code wont fail if there are no keytab, but there is
1215 * mech/gss_inquire_cred.c: move the check if we found any cred
1216 where it matter for both cases
1217 (default cred and provided cred)
1219 * mech/gss_init_sec_context.c: If the desired mechanism can't
1220 convert the name to a MN, fail with GSS_S_BAD_NAME rather then a
1223 2006-07-06 Love Hörnquist Åstrand <lha@it.su.se>
1225 * spnego/external.c: readd gss_spnego_inquire_names_for_mech
1227 * spnego/spnego_locl.h: reimplement
1228 gss_spnego_inquire_names_for_mech add support function
1229 _gss_spnego_supported_mechs
1231 * spnego/context_stubs.h: reimplement
1232 gss_spnego_inquire_names_for_mech add support function
1233 _gss_spnego_supported_mechs
1235 * spnego/context_stubs.c: drop gss_spnego_indicate_mechs
1237 * mech/gss_indicate_mechs.c: if the underlaying mech doesn't
1238 support gss_indicate_mechs, use the oid in the mechswitch
1241 * spnego/external.c: let the mech glue layer implement
1244 * spnego/cred_stubs.c (gss_spnego_acquire_cred): don't care about
1245 desired_mechs, get our own list with indicate_mechs and remove
1248 2006-07-05 Love Hörnquist Åstrand <lha@it.su.se>
1250 * spnego/external.c: remove gss_spnego_inquire_names_for_mech, let
1251 the mechglue layer implement it
1253 * spnego/context_stubs.c: remove gss_spnego_inquire_names_for_mech, let
1254 the mechglue layer implement it
1256 * spnego/spnego_locl.c: remove gss_spnego_inquire_names_for_mech, let
1257 the mechglue layer implement it
1259 2006-07-01 Love Hörnquist Åstrand <lha@it.su.se>
1261 * mech/gss_set_cred_option.c: fix argument to gss_release_cred
1263 2006-06-30 Love Hörnquist Åstrand <lha@it.su.se>
1265 * krb5/init_sec_context.c: Make work on compilers that are
1266 somewhat more picky then gcc4 (like gcc2.95)
1268 * krb5/init_sec_context.c (do_delegation): use KDCOptions2int to
1269 convert fwd_flags to an integer, since otherwise int2KDCOptions in
1270 krb5_get_forwarded_creds wont do the right thing.
1272 * mech/gss_set_cred_option.c (gss_set_cred_option): free memory on
1275 * krb5/set_sec_context_option.c (_gsskrb5_set_sec_context_option):
1276 init global kerberos context
1278 * krb5/set_cred_option.c (_gsskrb5_set_cred_option): init global
1281 * mech/gss_accept_sec_context.c: Insert the delegated sub cred on
1282 the delegated cred handle, not cred handle
1284 * mech/gss_accept_sec_context.c (gss_accept_sec_context): handle
1285 the case where ret_flags == NULL
1287 * mech/gss_mech_switch.c (add_builtin): set
1288 _gss_mech_switch->gm_mech_oid
1290 * mech/gss_set_cred_option.c (gss_set_cred_option): laod mechs
1292 * test_cred.c (gss_print_errors): don't try to print error when
1293 gss_display_status failed
1295 * Makefile.am: Add mech/gss_release_oid.c
1297 * mech/gss_release_oid.c: Add gss_release_oid, reverse of
1300 * spnego/compat.c: preferred_mech_type was allocated with
1301 gss_duplicate_oid in one place and assigned static varianbles a
1302 the second place. change that static assignement to
1303 gss_duplicate_oid and bring back gss_release_oid.
1305 * spnego/compat.c (_gss_spnego_delete_sec_context): don't release
1306 preferred_mech_type and negotiated_mech_type, they where never
1307 allocated from the begining.
1309 2006-06-29 Love Hörnquist Åstrand <lha@it.su.se>
1311 * mech/gss_import_name.c (gss_import_name): avoid
1312 type-punned/strict aliasing rules
1314 * mech/gss_add_cred.c: avoid type-punned/strict aliasing rules
1316 * gssapi.h: Make gss_name_t an opaque type.
1318 * krb5: make gss_name_t an opaque type
1320 * krb5/set_cred_option.c: Add
1322 * mech/gss_set_cred_option.c (gss_set_cred_option): support the
1323 case where *cred_handle == NULL
1325 * mech/gss_krb5.c (gss_krb5_import_cred): make sure cred is
1326 GSS_C_NO_CREDENTIAL on failure.
1328 * mech/gss_acquire_cred.c (gss_acquire_cred): if desired_mechs is
1329 NO_OID_SET, there is a need to load the mechs, so always do that.
1331 2006-06-28 Love Hörnquist Åstrand <lha@it.su.se>
1333 * krb5/inquire_cred_by_oid.c: Reimplement GSS_KRB5_COPY_CCACHE_X
1334 to instead pass a fullname to the credential, then resolve and
1335 copy out the content, and then close the cred.
1337 * mech/gss_krb5.c: Reimplement GSS_KRB5_COPY_CCACHE_X to instead
1338 pass a fullname to the credential, then resolve and copy out the
1339 content, and then close the cred.
1341 * krb5/inquire_cred_by_oid.c: make "work", GSS_KRB5_COPY_CCACHE_X
1342 interface needs to be re-done, currently its utterly broken.
1344 * mech/gss_set_cred_option.c: Make work.
1346 * krb5/external.c: Add _gsskrb5_set_{sec_context,cred}_option
1348 * mech/gss_krb5.c (gss_krb5_import_cred): implement
1350 * Makefile.am: Add gss_set_{sec_context,cred}_option and sort
1352 * mech/gss_set_{sec_context,cred}_option.c: add
1354 * gssapi.h: Add GSS_KRB5_IMPORT_CRED_X
1356 * test_*.c: make compile again
1358 * Makefile.am: Add lib dependencies and test programs
1360 * spnego: remove dependency on libkrb5
1362 * mech: Bug fixes, cleanup, compiler warnings, restructure code.
1364 * spnego: Rename gss_context_id_t and gss_cred_id_t to local names
1366 * krb5: repro copy the krb5 files here
1368 * mech: import Doug Rabson mechglue from freebsd
1370 * spnego: Import Luke Howard's SPNEGO from the mechglue branch
1372 2006-06-22 Love Hörnquist Åstrand <lha@it.su.se>
1374 * gssapi.h: Add oid_to_str.
1376 * Makefile.am: add oid_to_str and test_oid
1378 * oid_to_str.c: Add gss_oid_to_str
1380 * test_oid.c: Add test for gss_oid_to_str()
1382 2006-05-13 Love Hörnquist Åstrand <lha@it.su.se>
1384 * verify_mic.c: Less pointer signedness warnings.
1386 * unwrap.c: Less pointer signedness warnings.
1388 * arcfour.c: Less pointer signedness warnings.
1390 * gssapi_locl.h: Use const void * to instead of unsigned char * to
1391 avoid pointer signedness warnings.
1393 * encapsulate.c: Use const void * to instead of unsigned char * to
1394 avoid pointer signedness warnings.
1396 * decapsulate.c: Use const void * to instead of unsigned char * to
1397 avoid pointer signedness warnings.
1399 * decapsulate.c: Less pointer signedness warnings.
1401 * cfx.c: Less pointer signedness warnings.
1403 * init_sec_context.c: Less pointer signedness warnings (partly by
1404 using the new asn.1 CHOICE decoder)
1406 * import_sec_context.c: Less pointer signedness warnings.
1408 2006-05-09 Love Hörnquist Åstrand <lha@it.su.se>
1410 * accept_sec_context.c (gsskrb5_is_cfx): always set is_cfx. From
1413 2006-05-08 Love Hörnquist Åstrand <lha@it.su.se>
1415 * get_mic.c (mic_des3): make sure message_buffer doesn't point to
1416 free()ed memory on failure. Pointed out by IBM checker.
1418 2006-05-05 Love Hörnquist Åstrand <lha@it.su.se>
1420 * Rename u_intXX_t to uintXX_t
1422 2006-05-04 Love Hörnquist Åstrand <lha@it.su.se>
1424 * cfx.c: Less pointer signedness warnings.
1426 * arcfour.c: Avoid pointer signedness warnings.
1428 * gssapi_locl.h (gssapi_decode_*): make data argument const void *
1430 * 8003.c (gssapi_decode_*): make data argument const void *
1432 2006-04-12 Love Hörnquist Åstrand <lha@it.su.se>
1434 * export_sec_context.c: Export sequence order element. From Wynn
1435 Wilkes <wynn.wilkes@quest.com>.
1437 * import_sec_context.c: Import sequence order element. From Wynn
1438 Wilkes <wynn.wilkes@quest.com>.
1440 * sequence.c (_gssapi_msg_order_import,_gssapi_msg_order_export):
1441 New functions, used by {import,export}_sec_context. From Wynn
1442 Wilkes <wynn.wilkes@quest.com>.
1444 * test_sequence.c: Add test for import/export sequence.
1446 2006-04-09 Love Hörnquist Åstrand <lha@it.su.se>
1448 * add_cred.c: Check that cred != GSS_C_NO_CREDENTIAL, this is a
1449 standard conformance failure, but much better then a crash.
1451 2006-04-02 Love Hörnquist Åstrand <lha@it.su.se>
1453 * get_mic.c (get_mic*)_: make sure message_token is cleaned on
1454 error, found by IBM checker.
1456 * wrap.c (wrap*): Reset output_buffer on error, found by IBM
1459 2006-02-15 Love Hörnquist Åstrand <lha@it.su.se>
1461 * import_name.c: Accept both GSS_C_NT_HOSTBASED_SERVICE and
1462 GSS_C_NT_HOSTBASED_SERVICE_X as nametype for hostbased names.
1464 2006-01-16 Love Hörnquist Åstrand <lha@it.su.se>
1466 * delete_sec_context.c (gss_delete_sec_context): if the context
1467 handle is GSS_C_NO_CONTEXT, don't fall over.
1469 2005-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1471 * gss_acquire_cred.3: Replace gss_krb5_import_ccache with
1472 gss_krb5_import_cred and add more references
1474 2005-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1476 * gssapi.h: Change gss_krb5_import_ccache to gss_krb5_import_cred,
1477 it can handle keytabs too.
1479 * add_cred.c (gss_add_cred): avoid deadlock
1481 * context_time.c (gssapi_lifetime_left): define the 0 lifetime as
1484 2005-12-01 Love Hörnquist Åstrand <lha@it.su.se>
1486 * acquire_cred.c (acquire_acceptor_cred): only check if principal
1487 exists if we got called with principal as an argument.
1489 * acquire_cred.c (acquire_acceptor_cred): check that the acceptor
1490 exists in the keytab before returning ok.
1492 2005-11-29 Love Hörnquist Åstrand <lha@it.su.se>
1494 * copy_ccache.c (gss_krb5_import_cred): fix buglet, from Andrew
1497 2005-11-25 Love Hörnquist Åstrand <lha@it.su.se>
1499 * test_kcred.c: Rename gss_krb5_import_ccache to
1500 gss_krb5_import_cred.
1502 * copy_ccache.c: Rename gss_krb5_import_ccache to
1503 gss_krb5_import_cred and let it grow code to handle keytabs too.
1505 2005-11-02 Love Hörnquist Åstrand <lha@it.su.se>
1507 * init_sec_context.c: Change sematics of ok-as-delegate to match
1509 [gssapi]realm/ok-as-delegate=true is set, otherwise keep old
1512 * release_cred.c (gss_release_cred): use
1513 GSS_CF_DESTROY_CRED_ON_RELEASE to decide if the cache should be
1516 * acquire_cred.c (acquire_initiator_cred):
1517 GSS_CF_DESTROY_CRED_ON_RELEASE on created credentials.
1519 * accept_sec_context.c (gsskrb5_accept_delegated_token): rewrite
1520 to use gss_krb5_import_ccache
1522 2005-11-01 Love Hörnquist Åstrand <lha@it.su.se>
1524 * arcfour.c: Remove signedness warnings.
1526 2005-10-31 Love Hörnquist Åstrand <lha@it.su.se>
1528 * gss_acquire_cred.3: Document that gss_krb5_import_ccache is copy
1531 * copy_ccache.c (gss_krb5_import_ccache): Instead of making a copy
1532 of the ccache, make a reference by getting the name and resolving
1533 the name. This way the cache is shared, this flipp side is of
1534 course that if someone calls krb5_cc_destroy the cache is lost for
1537 * test_kcred.c: Remove memory leaks.
1539 2005-10-26 Love Hörnquist Åstrand <lha@it.su.se>
1541 * Makefile.am: build test_kcred
1543 * gss_acquire_cred.3: Document gss_krb5_import_ccache
1545 * gssapi.3: Sort and add gss_krb5_import_ccache.
1547 * acquire_cred.c (_gssapi_krb5_ccache_lifetime): break out code
1548 used to extract lifetime from a credential cache
1550 * gssapi_locl.h: Add _gssapi_krb5_ccache_lifetime, used to extract
1551 lifetime from a credential cache.
1553 * gssapi.h: add gss_krb5_import_ccache, reverse of
1554 gss_krb5_copy_ccache
1556 * copy_ccache.c: add gss_krb5_import_ccache, reverse of
1557 gss_krb5_copy_ccache
1559 * test_kcred.c: test gss_krb5_import_ccache
1561 2005-10-21 Love Hörnquist Åstrand <lha@it.su.se>
1563 * acquire_cred.c (acquire_initiator_cred): use krb5_cc_cache_match
1564 to find a matching creditial cache, if that failes, fallback to
1567 2005-10-12 Love Hörnquist Åstrand <lha@it.su.se>
1569 * gssapi_locl.h: Add gssapi_krb5_set_status and
1570 gssapi_krb5_clear_status
1572 * init_sec_context.c (spnego_reply): Don't pass back raw Kerberos
1573 errors, use GSS-API errors instead. From Michael B Allen.
1575 * display_status.c: Add gssapi_krb5_clear_status,
1576 gssapi_krb5_set_status for handling error messages.
1578 2005-08-23 Love Hörnquist Åstrand <lha@it.su.se>
1580 * external.c: Use rk_UNCONST to avoid const warning.
1582 * display_status.c: Constify strings to avoid warnings.
1584 2005-08-11 Love Hörnquist Åstrand <lha@it.su.se>
1586 * init_sec_context.c: avoid warnings, update (c)
1588 2005-07-13 Love Hörnquist Åstrand <lha@it.su.se>
1590 * init_sec_context.c (spnego_initial): use NegotiationToken
1591 encoder now that we have one with the new asn1. compiler.
1593 * Makefile.am: the new asn.1 compiler includes the modules name in
1596 2005-06-16 Love Hörnquist Åstrand <lha@it.su.se>
1598 * decapsulate.c: use rk_UNCONST
1600 * ccache_name.c: rename to avoid shadowing
1602 * gssapi_locl.h: give kret in GSSAPI_KRB5_INIT a more unique name
1604 * process_context_token.c: use rk_UNCONST to unconstify
1606 * test_cred.c: rename optind to optidx
1608 2005-05-30 Love Hörnquist Åstrand <lha@it.su.se>
1610 * init_sec_context.c (init_auth): honor ok-as-delegate if local
1611 configuration approves
1613 * gssapi_locl.h: prototype for _gss_check_compat
1615 * compat.c: export check_compat as _gss_check_compat
1617 2005-05-29 Love Hörnquist Åstrand <lha@it.su.se>
1619 * init_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1620 problems with system headerfiles that pollute the name space.
1622 * accept_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1623 problems with system headerfiles that pollute the name space.
1625 2005-05-17 Love Hörnquist Åstrand <lha@it.su.se>
1627 * init_sec_context.c (init_auth): set
1628 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED (for java compatibility),
1629 also while here, use krb5_auth_con_addflags
1631 2005-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1633 * arcfour.c (_gssapi_wrap_arcfour): fix calculating the encap
1634 length. From: Tom Maher <tmaher@eecs.berkeley.edu>
1636 2005-05-02 Dave Love <fx@gnu.org>
1638 * test_cred.c (main): Call setprogname.
1640 2005-04-27 Love Hörnquist Åstrand <lha@it.su.se>
1642 * prefix all sequence symbols with _, they are not part of the
1643 GSS-API api. By comment from Wynn Wilkes <wynnw@vintela.com>
1645 2005-04-10 Love Hörnquist Åstrand <lha@it.su.se>
1647 * accept_sec_context.c: break out the processing of the delegated
1648 credential to a separate function to make error handling easier,
1649 move the credential handling to after other setup is done
1651 * test_sequence.c: make less verbose in case of success
1653 * Makefile.am: add test_sequence to TESTS
1655 2005-04-01 Love Hörnquist Åstrand <lha@it.su.se>
1657 * 8003.c (gssapi_krb5_verify_8003_checksum): check that cksum
1658 isn't NULL From: Nicolas Pouvesle <npouvesle@tenablesecurity.com>
1660 2005-03-21 Love Hörnquist Åstrand <lha@it.su.se>
1662 * Makefile.am: use $(LIB_roken)
1664 2005-03-16 Love Hörnquist Åstrand <lha@it.su.se>
1666 * display_status.c (gssapi_krb5_set_error_string): pass in the
1667 krb5_context to krb5_free_error_string
1669 2005-03-15 Love Hörnquist Åstrand <lha@it.su.se>
1671 * display_status.c (gssapi_krb5_set_error_string): don't misuse
1672 the krb5_get_error_string api
1674 2005-03-01 Love Hörnquist Åstrand <lha@it.su.se>
1676 * compat.c (_gss_DES3_get_mic_compat): don't unlock mutex
1677 here. Bug reported by Stefan Metzmacher <metze@samba.org>
1679 2005-02-21 Luke Howard <lukeh@padl.com>
1681 * init_sec_context.c: don't call krb5_get_credentials() with
1682 KRB5_TC_MATCH_KEYTYPE, it can lead to the credentials cache
1683 growing indefinitely as no key is found with KEYTYPE_NULL
1685 * compat.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG, it is
1686 no longer used (however the mechListMIC behaviour is broken,
1687 rfc2478bis support requires the code in the mechglue branch)
1689 * init_sec_context.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1691 * gssapi.h: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1693 2005-01-05 Luke Howard <lukeh@padl.com>
1695 * 8003.c: use symbolic name for checksum type
1697 * accept_sec_context.c: allow client to indicate
1698 that subkey should be used
1700 * acquire_cred.c: plug leak
1702 * get_mic.c: use gss_krb5_get_subkey() instead
1703 of gss_krb5_get_{local,remote}key(), support
1706 * gssapi_local.c: use gss_krb5_get_subkey(),
1707 support KEYTYPE_ARCFOUR_56
1709 * import_sec_context.c: plug leak
1711 * unwrap.c: use gss_krb5_get_subkey(),
1712 support KEYTYPE_ARCFOUR_56
1714 * verify_mic.c: use gss_krb5_get_subkey(),
1715 support KEYTYPE_ARCFOUR_56
1717 * wrap.c: use gss_krb5_get_subkey(),
1718 support KEYTYPE_ARCFOUR_56
1720 2004-11-30 Love Hörnquist Åstrand <lha@it.su.se>
1722 * inquire_cred.c: Reverse order of HEIMDAL_MUTEX_unlock and
1723 gss_release_cred to avoid deadlock, from Luke Howard
1726 2004-09-06 Love Hörnquist Åstrand <lha@it.su.se>
1728 * gss_acquire_cred.3: gss_krb5_extract_authz_data_from_sec_context
1729 was renamed to gsskrb5_extract_authz_data_from_sec_context
1731 2004-08-07 Love Hörnquist Åstrand <lha@it.su.se>
1733 * unwrap.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1735 * arcfour.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1737 2004-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1739 * gssapi.3: spelling from Josef El-Rayes <josef@FreeBSD.org> while
1740 here, write some text about the SPNEGO situation
1742 2004-04-08 Love Hörnquist Åstrand <lha@it.su.se>
1744 * cfx.c: s/CTXAcceptorSubkey/CFXAcceptorSubkey/
1746 2004-04-07 Love Hörnquist Åstrand <lha@it.su.se>
1748 * gssapi.h: add GSS_C_EXPECTING_MECH_LIST_MIC_FLAG From: Luke
1749 Howard <lukeh@padl.com>
1751 * init_sec_context.c (spnego_reply): use
1752 _gss_spnego_require_mechlist_mic to figure out if we need to check
1753 MechListMIC; From: Luke Howard <lukeh@padl.com>
1755 * accept_sec_context.c (send_accept): use
1756 _gss_spnego_require_mechlist_mic to figure out if we need to send
1757 MechListMIC; From: Luke Howard <lukeh@padl.com>
1759 * gssapi_locl.h: add _gss_spnego_require_mechlist_mic
1760 From: Luke Howard <lukeh@padl.com>
1762 * compat.c: add _gss_spnego_require_mechlist_mic for compatibility
1763 with MS SPNEGO, From: Luke Howard <lukeh@padl.com>
1765 2004-04-05 Love Hörnquist Åstrand <lha@it.su.se>
1767 * accept_sec_context.c (gsskrb5_is_cfx): krb5_keyblock->keytype is
1768 an enctype, not keytype
1770 * accept_sec_context.c: use ASN1_MALLOC_ENCODE
1772 * init_sec_context.c: avoid the malloc loop and just allocate the
1773 propper amount of data
1775 * init_sec_context.c (spnego_initial): handle mech_token better
1777 2004-03-19 Love Hörnquist Åstrand <lha@it.su.se>
1779 * gssapi.h: add gss_krb5_get_tkt_flags
1781 * Makefile.am: add ticket_flags.c
1783 * ticket_flags.c: Get ticket-flags from acceptor ticket From: Luke
1784 Howard <lukeh@PADL.COM>
1786 * gss_acquire_cred.3: document gss_krb5_get_tkt_flags
1788 2004-03-14 Love Hörnquist Åstrand <lha@it.su.se>
1790 * acquire_cred.c (gss_acquire_cred): check usage before even
1791 bothering to process it, add both keytab and initial tgt if
1794 * wrap.c: support cfx, try to handle acceptor asserted subkey
1796 * unwrap.c: support cfx, try to handle acceptor asserted subkey
1798 * verify_mic.c: support cfx
1800 * get_mic.c: support cfx
1802 * test_sequence.c: handle changed signature of
1803 gssapi_msg_order_create
1805 * import_sec_context.c: handle acceptor asserted subkey
1807 * init_sec_context.c: handle acceptor asserted subkey
1809 * accept_sec_context.c: handle acceptor asserted subkey
1811 * sequence.c: add dummy use_64 argument to gssapi_msg_order_create
1813 * gssapi_locl.h: add partial support for CFX
1815 * Makefile.am (noinst_PROGRAMS) += test_cred
1817 * test_cred.c: gssapi credential testing
1819 * test_acquire_cred.c: fix comment
1821 2004-03-07 Love Hörnquist Åstrand <lha@it.su.se>
1823 * arcfour.h: drop structures for message formats, no longer used
1825 * arcfour.c: comment describing message formats
1827 * accept_sec_context.c (spnego_accept_sec_context): make sure the
1828 length of the choice element doesn't overrun us
1830 * init_sec_context.c (spnego_reply): make sure the length of the
1831 choice element doesn't overrun us
1833 * spnego.asn1: move NegotiationToken to avoid warning
1835 * spnego.asn1: uncomment NegotiationToken
1837 * Makefile.am: spnego_files += asn1_NegotiationToken.x
1839 2004-01-25 Love Hörnquist Åstrand <lha@it.su.se>
1841 * gssapi.h: add gss_krb5_ccache_name
1843 * Makefile.am (libgssapi_la_SOURCES): += ccache_name.c
1845 * ccache_name.c (gss_krb5_ccache_name): help function enable to
1846 set krb5 name, using out_name argument makes function no longer
1849 * gssapi.3: add missing gss_krb5_ references
1851 * gss_acquire_cred.3: document gss_krb5_ccache_name
1853 2003-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1855 * cfx.c: make rrc a modulus operation if its longer then the
1856 length of the message, noticed by Sam Hartman
1858 2003-12-07 Love Hörnquist Åstrand <lha@it.su.se>
1860 * accept_sec_context.c: use krb5_auth_con_addflags
1862 2003-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1864 * cfx.c: Wrap token id was in wrong order, found by Sam Hartman
1866 2003-12-04 Love Hörnquist Åstrand <lha@it.su.se>
1868 * cfx.c: add AcceptorSubkey (but no code understand it yet) ignore
1871 2003-11-22 Love Hörnquist Åstrand <lha@it.su.se>
1873 * accept_sec_context.c: Don't require timestamp to be set on
1874 delegated token, its already protected by the outer token (and
1875 windows doesn't alway send it) Pointed out by Zi-Bin Yang
1876 <zbyang@decru.com> on heimdal-discuss
1878 2003-11-14 Love Hörnquist Åstrand <lha@it.su.se>
1880 * cfx.c: fix {} error, pointed out by Liqiang Zhu
1882 2003-11-10 Love Hörnquist Åstrand <lha@it.su.se>
1884 * cfx.c: Sequence number should be stored in bigendian order From:
1885 Luke Howard <lukeh@padl.com>
1887 2003-11-09 Love Hörnquist Åstrand <lha@it.su.se>
1889 * delete_sec_context.c (gss_delete_sec_context): don't free
1890 ticket, krb5_free_ticket does that now
1892 2003-11-06 Love Hörnquist Åstrand <lha@it.su.se>
1894 * cfx.c: checksum the header last in MIC token, update to -03
1895 From: Luke Howard <lukeh@padl.com>
1897 2003-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1899 * add_cred.c: If its a MEMORY cc, make a copy. We need to do this
1900 since now gss_release_cred will destroy the cred. This should be
1901 really be solved a better way.
1903 * acquire_cred.c (gss_release_cred): if its a mcc, destroy it
1904 rather the just release it Found by: "Zi-Bin Yang"
1907 * acquire_cred.c (acquire_initiator_cred): use kret instead of ret
1910 2003-09-30 Love Hörnquist Åstrand <lha@it.su.se>
1912 * gss_acquire_cred.3: spelling
1913 From: jmc <jmc@prioris.mini.pw.edu.pl>
1915 2003-09-23 Love Hörnquist Åstrand <lha@it.su.se>
1917 * cfx.c: - EC and RRC are big-endian, not little-endian - The
1918 default is now to rotate regardless of GSS_C_DCE_STYLE. There are
1919 no longer any references to GSS_C_DCE_STYLE. - rrc_rotate()
1920 avoids allocating memory on the heap if rrc <= 256
1921 From: Luke Howard <lukeh@padl.com>
1923 2003-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1925 * cfx.[ch]: rrc_rotate() was untested and broken, fix it.
1926 Set and verify wrap Token->Filler.
1927 Correct token ID for wrap tokens,
1928 were accidentally swapped with delete tokens.
1929 From: Luke Howard <lukeh@PADL.COM>
1931 2003-09-21 Love Hörnquist Åstrand <lha@it.su.se>
1933 * cfx.[ch]: no ASN.1-ish header on per-message tokens
1934 From: Luke Howard <lukeh@PADL.COM>
1936 2003-09-19 Love Hörnquist Åstrand <lha@it.su.se>
1938 * arcfour.h: remove depenency on gss_arcfour_mic_token and
1939 gss_arcfour_warp_token
1941 * arcfour.c: remove depenency on gss_arcfour_mic_token and
1942 gss_arcfour_warp_token
1944 2003-09-18 Love Hörnquist Åstrand <lha@it.su.se>
1946 * 8003.c: remove #if 0'ed code
1948 2003-09-17 Love Hörnquist Åstrand <lha@it.su.se>
1950 * accept_sec_context.c (gsskrb5_accept_sec_context): set sequence
1951 number when not requesting mutual auth From: Luke Howard
1954 * init_sec_context.c (init_auth): set sequence number when not
1955 requesting mutual auth From: Luke Howard <lukeh@PADL.COM>
1957 2003-09-16 Love Hörnquist Åstrand <lha@it.su.se>
1959 * arcfour.c (*): set minor_status
1960 (gss_wrap): set conf_state to conf_req_flags on success
1961 From: Luke Howard <lukeh@PADL.COM>
1963 * wrap.c (gss_wrap_size_limit): use existing function From: Luke
1964 Howard <lukeh@PADL.COM>
1966 2003-09-12 Love Hörnquist Åstrand <lha@it.su.se>
1968 * indicate_mechs.c (gss_indicate_mechs): in case of error, free
1971 * indicate_mechs.c (gss_indicate_mechs): add SPNEGO
1973 2003-09-10 Love Hörnquist Åstrand <lha@it.su.se>
1975 * init_sec_context.c (spnego_initial): catch errors and return
1978 * init_sec_context.c (spnego_initial): add #if 0 out version of
1979 the CHOICE branch encoding, also where here, free no longer used
1982 2003-09-09 Love Hörnquist Åstrand <lha@it.su.se>
1984 * gss_acquire_cred.3: support GSS_SPNEGO_MECHANISM
1986 * accept_sec_context.c: SPNEGO doesn't include gss wrapping on
1987 SubsequentContextToken like the Kerberos 5 mech does.
1989 * init_sec_context.c (spnego_reply): SPNEGO doesn't include gss
1990 wrapping on SubsequentContextToken like the Kerberos 5 mech
1991 does. Lets check for it anyway.
1993 * accept_sec_context.c: Add support for SPNEGO on the initator
1994 side. Implementation initially from Assar Westerlund, passes
1995 though quite a lot of hands before I commited it.
1997 * init_sec_context.c: Add support for SPNEGO on the initator side.
1998 Tested with ldap server on a Windows 2000 DC. Implementation
1999 initially from Assar Westerlund, passes though quite a lot of
2000 hands before I commited it.
2002 * gssapi.h: export GSS_SPNEGO_MECHANISM
2004 * gssapi_locl.h: include spnego_as.h add prototype for
2005 gssapi_krb5_get_mech
2007 * decapsulate.c (gssapi_krb5_get_mech): make non static
2009 * Makefile.am: build SPNEGO file
2011 2003-09-08 Love Hörnquist Åstrand <lha@it.su.se>
2013 * external.c: SPENGO and IAKERB oids
2015 * spnego.asn1: SPENGO ASN1
2017 2003-09-05 Love Hörnquist Åstrand <lha@it.su.se>
2019 * cfx.c: RRC also need to be zero before wraping them
2020 From: Luke Howard <lukeh@PADL.COM>
2022 2003-09-04 Love Hörnquist Åstrand <lha@it.su.se>
2024 * encapsulate.c (gssapi_krb5_encap_length): don't return void
2026 2003-09-03 Love Hörnquist Åstrand <lha@it.su.se>
2028 * verify_mic.c: switch from the des_ to the DES_ api
2030 * get_mic.c: switch from the des_ to the DES_ api
2032 * unwrap.c: switch from the des_ to the DES_ api
2034 * wrap.c: switch from the des_ to the DES_ api
2036 * cfx.c: EC is not included in the checksum since the length might
2037 change depending on the data. From: Luke Howard <lukeh@PADL.COM>
2039 * acquire_cred.c: use
2040 krb5_get_init_creds_opt_alloc/krb5_get_init_creds_opt_free
2042 2003-09-01 Love Hörnquist Åstrand <lha@it.su.se>
2044 * copy_ccache.c: rename
2045 gss_krb5_extract_authz_data_from_sec_context to
2046 gsskrb5_extract_authz_data_from_sec_context
2048 * gssapi.h: rename gss_krb5_extract_authz_data_from_sec_context to
2049 gsskrb5_extract_authz_data_from_sec_context
2051 2003-08-31 Love Hörnquist Åstrand <lha@it.su.se>
2053 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2054 check that we have a ticket before we start to use it
2056 * gss_acquire_cred.3: document
2057 gss_krb5_extract_authz_data_from_sec_context
2059 * gssapi.h (gss_krb5_extract_authz_data_from_sec_context):
2060 return the kerberos authorizationdata, from idea of Luke Howard
2062 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2063 return the kerberos authorizationdata, from idea of Luke Howard
2065 * verify_mic.c (gss_verify_mic_internal): switch type and key
2068 2003-08-30 Love Hörnquist Åstrand <lha@it.su.se>
2070 * cfx.[ch]: draft-ietf-krb-wg-gssapi-cfx-01.txt implemetation
2071 From: Luke Howard <lukeh@PADL.COM>
2073 2003-08-28 Love Hörnquist Åstrand <lha@it.su.se>
2075 * arcfour.c (arcfour_mic_cksum): use free_Checksum to free the
2078 * arcfour.h: swap two last arguments to verify_mic for consistency
2081 * wrap.c,unwrap.c,get_mic.c,verify_mic.c,cfx.c,cfx.h:
2082 prefix cfx symbols with _gssapi_
2084 * arcfour.c: release the right buffer
2086 * arcfour.c: rename token structure in consistency with rest of
2087 GSS-API From: Luke Howard <lukeh@PADL.COM>
2089 * unwrap.c (unwrap_des3): use _gssapi_verify_pad
2090 (unwrap_des): use _gssapi_verify_pad
2092 * arcfour.c (_gssapi_wrap_arcfour): set the correct padding
2093 (_gssapi_unwrap_arcfour): verify and strip padding
2095 * gssapi_locl.h: added _gssapi_verify_pad
2097 * decapsulate.c (_gssapi_verify_pad): verify padding of a gss
2098 wrapped message and return its length
2100 * arcfour.c: support KEYTYPE_ARCFOUR_56 keys, from Luke Howard
2103 * arcfour.c: use right seal alg, inherit keytype from parent key
2105 * arcfour.c: include the confounder in the checksum use the right
2106 key usage number for warped/unwraped tokens
2108 * gssapi.h: add gss_krb5_nt_general_name as an mit compat glue
2109 (same as GSS_KRB5_NT_PRINCIPAL_NAME)
2111 * unwrap.c: hook in arcfour unwrap
2113 * wrap.c: hook in arcfour wrap
2115 * verify_mic.c: hook in arcfour verify_mic
2117 * get_mic.c: hook in arcfour get_mic
2119 * arcfour.c: implement wrap/unwarp
2121 * gssapi_locl.h: add gssapi_{en,de}code_be_om_uint32
2123 * 8003.c: add gssapi_{en,de}code_be_om_uint32
2125 2003-08-27 Love Hörnquist Åstrand <lha@it.su.se>
2127 * arcfour.c (_gssapi_verify_mic_arcfour): Do the checksum on right
2128 area. Swap filler check, it was reversed.
2130 * Makefile.am (libgssapi_la_SOURCES): += arcfour.c
2132 * gssapi_locl.h: include "arcfour.h"
2134 * arcfour.c: arcfour gss-api mech, get_mic/verify_mic working
2136 * arcfour.h: arcfour gss-api mech, get_mic/verify_mic working
2138 2003-08-26 Love Hörnquist Åstrand <lha@it.su.se>
2140 * gssapi_locl.h: always include cfx.h add prototype for
2143 * cfx.[ch]: Implementation of draft-ietf-krb-wg-gssapi-cfx-00.txt
2144 from Luke Howard <lukeh@PADL.COM>
2146 * decapsulate.c: add _gssapi_decapsulate, from Luke Howard
2149 2003-08-25 Love Hörnquist Åstrand <lha@it.su.se>
2151 * unwrap.c: encap/decap now takes a oid if the enctype/keytype is
2152 arcfour, return error add hook for cfx
2154 * verify_mic.c: encap/decap now takes a oid if the enctype/keytype
2155 is arcfour, return error add hook for cfx
2157 * get_mic.c: encap/decap now takes a oid if the enctype/keytype is
2158 arcfour, return error add hook for cfx
2160 * accept_sec_context.c: encap/decap now takes a oid
2162 * init_sec_context.c: encap/decap now takes a oid
2164 * gssapi_locl.h: include cfx.h if we need it lifetime is a
2165 OM_uint32, depend on gssapi interface add all new encap/decap
2168 * decapsulate.c: add decap functions that doesn't take the token
2169 type also make all decap function take the oid mech that they
2172 * encapsulate.c: add encap functions that doesn't take the token
2173 type also make all encap function take the oid mech that they
2176 * sequence.c (elem_insert): fix a off by one index counter
2178 * inquire_cred.c (gss_inquire_cred): handle cred_handle being
2179 GSS_C_NO_CREDENTIAL and use the default cred then.
2181 2003-08-19 Love Hörnquist Åstrand <lha@it.su.se>
2183 * gss_acquire_cred.3: break out extensions and document
2184 gsskrb5_register_acceptor_identity
2186 2003-08-18 Love Hörnquist Åstrand <lha@it.su.se>
2188 * test_acquire_cred.c (print_time): time is returned in seconds
2189 from now, not unix time
2191 2003-08-17 Love Hörnquist Åstrand <lha@it.su.se>
2193 * compat.c (check_compat): avoid leaking principal when finding a
2196 * address_to_krb5addr.c: sa_size argument to krb5_addr2sockaddr is
2199 * acquire_cred.c (gss_acquire_cred): 4th argument to
2200 gss_test_oid_set_member is a int
2202 2003-07-22 Love Hörnquist Åstrand <lha@it.su.se>
2204 * init_sec_context.c (repl_mutual): don't set kerberos error where
2205 there was no kerberos error
2207 * gssapi_locl.h: Add destruction/creation prototypes and structure
2208 for the thread specific storage.
2210 * display_status.c: use thread specific storage to set/get the
2211 kerberos error message
2213 * init.c: Provide locking around the creation of the global
2214 krb5_context. Add destruction/creation functions for the thread
2215 specific storage that the error string handling is using.
2217 2003-07-20 Love Hörnquist Åstrand <lha@it.su.se>
2219 * gss_acquire_cred.3: add missing prototype and missing .Ft
2222 2003-06-17 Love Hörnquist Åstrand <lha@it.su.se>
2224 * verify_mic.c: reorder code so sequence numbers can can be used
2226 * unwrap.c: reorder code so sequence numbers can can be used
2228 * sequence.c: remove unused function, indent, add
2229 gssapi_msg_order_f that filter gss flags to gss_msg_order flags
2231 * gssapi_locl.h: prototypes for
2232 gssapi_{encode_om_uint32,decode_om_uint32} add sequence number
2235 * delete_sec_context.c: destroy sequence number verifier
2237 * init_sec_context.c: remember to free data use sequence number
2240 * accept_sec_context.c: don't clear output_token twice remember to
2241 free data use sequence number verifier
2243 * 8003.c: export and rename encode_om_uint32/decode_om_uint32 and
2246 2003-06-09 Johan Danielsson <joda@pdc.kth.se>
2248 * Makefile.am: can't have sequence.c in two different places
2250 2003-06-06 Love Hörnquist Åstrand <lha@it.su.se>
2252 * test_sequence.c: check rollover, print summery
2254 * wrap.c (sub_wrap_size): gss_wrap_size_limit() has
2255 req_output_size and max_input_size around the wrong way -- it
2256 returns the output token size for a given input size, rather than
2257 the maximum input size for a given output token size.
2259 From: Luke Howard <lukeh@PADL.COM>
2261 2003-06-05 Love Hörnquist Åstrand <lha@it.su.se>
2263 * gssapi_locl.h: add prototypes for sequence.c
2265 * Makefile.am (libgssapi_la_SOURCES): add sequence.c
2266 (test_sequence): build
2268 * sequence.c: sequence number checks, order and replay
2269 * test_sequence.c: sequence number checks, order and replay
2271 2003-06-03 Love Hörnquist Åstrand <lha@it.su.se>
2273 * accept_sec_context.c (gss_accept_sec_context): make sure time is
2274 returned in seconds from now, not in kerberos time
2276 * acquire_cred.c (gss_aquire_cred): make sure time is returned in
2277 seconds from now, not in kerberos time
2279 * init_sec_context.c (init_auth): if the cred is expired before we
2280 tries to create a token, fail so the peer doesn't need reject us
2281 (*): make sure time is returned in seconds from now,
2282 not in kerberos time
2283 (repl_mutual): remember to unlock the context mutex
2285 * context_time.c (gss_context_time): remove unused variable
2287 * verify_mic.c: make sure minor_status is always set, pointed out
2288 by Luke Howard <lukeh@PADL.COM>
2290 2003-05-21 Love Hörnquist Åstrand <lha@it.su.se>
2292 * *.[ch]: do some basic locking (no reference counting so contexts
2293 can be removed while still used)
2294 - don't export gss_ctx_id_t_desc_struct and gss_cred_id_t_desc_struct
2295 - make sure all lifetime are returned in seconds left until expired,
2298 * gss_acquire_cred.3: document argument lifetime_rec to function
2301 2003-05-17 Love Hörnquist Åstrand <lha@it.su.se>
2303 * test_acquire_cred.c: test gss_add_cred more then once
2305 2003-05-06 Love Hörnquist Åstrand <lha@it.su.se>
2307 * gssapi.h: if __cplusplus, wrap the extern variable (just to be
2308 safe) and functions in extern "C" { }
2310 2003-04-30 Love Hörnquist Åstrand <lha@it.su.se>
2312 * gssapi.3: more about the des3 mic mess
2314 * verify_mic.c (verify_mic_des3): always check if the mic is the
2315 correct mic or the mic that old heimdal would have generated
2317 2003-04-28 Jacques Vidrine <nectar@kth.se>
2319 * verify_mic.c (verify_mic_des3): If MIC verification fails,
2320 retry using the `old' MIC computation (with zero IV).
2322 2003-04-26 Love Hörnquist Åstrand <lha@it.su.se>
2324 * gss_acquire_cred.3: more about difference between comparing IN
2327 * gss_acquire_cred.3: more about name type and access control
2329 2003-04-25 Love Hörnquist Åstrand <lha@it.su.se>
2331 * gss_acquire_cred.3: document gss_context_time
2333 * context_time.c: if lifetime of context have expired, set
2334 time_rec to 0 and return GSS_S_CONTEXT_EXPIRED
2336 * gssapi.3: document [gssapi]correct_des3_mic
2337 [gssapi]broken_des3_mic
2339 * gss_acquire_cred.3: document gss_krb5_compat_des3_mic
2341 * compat.c (gss_krb5_compat_des3_mic): enable turning on/off des3
2343 (_gss_DES3_get_mic_compat): handle [gssapi]correct_des3_mic too
2345 * gssapi.h (gss_krb5_compat_des3_mic): new function, turn on/off
2347 (GSS_C_KRB5_COMPAT_DES3_MIC): cpp symbol that exists if
2348 gss_krb5_compat_des3_mic exists
2350 2003-04-24 Love Hörnquist Åstrand <lha@it.su.se>
2352 * Makefile.am: (libgssapi_la_LDFLAGS): update major
2353 version of gssapi for incompatiblity in 3des getmic support
2355 2003-04-23 Love Hörnquist Åstrand <lha@it.su.se>
2357 * Makefile.am: test_acquire_cred_LDADD: use libgssapi.la not
2358 ./libgssapi.la (make make -jN work)
2360 2003-04-16 Love Hörnquist Åstrand <lha@it.su.se>
2362 * gssapi.3: spelling
2364 * gss_acquire_cred.3: Change .Fd #include <header.h> to .In
2365 header.h, from Thomas Klausner <wiz@netbsd.org>
2368 2003-04-06 Love Hörnquist Åstrand <lha@it.su.se>
2370 * gss_acquire_cred.3: spelling
2372 * Makefile.am: remove stuff that sneaked in with last commit
2374 * acquire_cred.c (acquire_initiator_cred): if the requested name
2375 isn't in the ccache, also check keytab. Extact the krbtgt for the
2376 default realm to check how long the credentials will last.
2378 * add_cred.c (gss_add_cred): don't create a new ccache, just open
2379 the old one; better check if output handle is compatible with new
2382 * test_acquire_cred.c: test gss_add_cred too
2384 2003-04-03 Love Hörnquist Åstrand <lha@it.su.se>
2386 * Makefile.am: build test_acquire_cred
2388 * test_acquire_cred.c: simple gss_acquire_cred test
2390 2003-04-02 Love Hörnquist Åstrand <lha@it.su.se>
2392 * gss_acquire_cred.3: s/gssapi/GSS-API/
2394 2003-03-19 Love Hörnquist Åstrand <lha@it.su.se>
2396 * gss_acquire_cred.3: document v1 interface (and that they are
2399 2003-03-18 Love Hörnquist Åstrand <lha@it.su.se>
2401 * gss_acquire_cred.3: list supported mechanism and nametypes
2403 2003-03-16 Love Hörnquist Åstrand <lha@it.su.se>
2405 * gss_acquire_cred.3: text about gss_display_name
2407 * Makefile.am (libgssapi_la_LDFLAGS): bump to 3:6:2
2408 (libgssapi_la_SOURCES): add all new functions
2410 * gssapi.3: now that we have a functions, uncomment the missing
2413 * gss_acquire_cred.3: now that we have a functions, uncomment the
2416 * process_context_token.c: implement gss_process_context_token
2418 * inquire_names_for_mech.c: implement gss_inquire_names_for_mech
2420 * inquire_mechs_for_name.c: implement gss_inquire_mechs_for_name
2422 * inquire_cred_by_mech.c: implement gss_inquire_cred_by_mech
2424 * add_cred.c: implement gss_add_cred
2426 * acquire_cred.c (gss_acquire_cred): more testing of input
2427 argument, make sure output arguments are ok, since we don't know
2428 the time_rec (for now), set it to time_req
2430 * export_sec_context.c: send lifetime, also set minor_status
2432 * get_mic.c: set minor_status
2434 * import_sec_context.c (gss_import_sec_context): add error
2435 checking, pick up lifetime (if there is no lifetime, use
2438 * init_sec_context.c: take care to set export value to something
2439 sane before we start so caller will have harmless values in them
2440 if then function fails
2442 * release_buffer.c (gss_release_buffer): set minor_status
2444 * wrap.c: make sure minor_status get set
2446 * verify_mic.c (gss_verify_mic_internal): rename verify_mic to
2447 gss_verify_mic_internal and let it take the type as an argument,
2448 (gss_verify_mic): call gss_verify_mic_internal
2451 * unwrap.c: set minor_status
2453 * test_oid_set_member.c (gss_test_oid_set_member): use
2456 * release_oid_set.c (gss_release_oid_set): set minor_status
2458 * release_name.c (gss_release_name): set minor_status
2460 * release_cred.c (gss_release_cred): set minor_status
2462 * add_oid_set_member.c (gss_add_oid_set_member): set minor_status
2464 * compare_name.c (gss_compare_name): set minor_status
2466 * compat.c (check_compat): make sure ret have a defined value
2468 * context_time.c (gss_context_time): set minor_status
2470 * copy_ccache.c (gss_krb5_copy_ccache): set minor_status
2472 * create_emtpy_oid_set.c (gss_create_empty_oid_set): set
2475 * delete_sec_context.c (gss_delete_sec_context): set minor_status
2477 * display_name.c (gss_display_name): set minor_status
2479 * display_status.c (gss_display_status): use gss_oid_equal, handle
2480 supplementary errors
2482 * duplicate_name.c (gss_duplicate_name): set minor_status
2484 * inquire_context.c (gss_inquire_context): set lifetime_rec now
2485 when we know it, set minor_status
2487 * inquire_cred.c (gss_inquire_cred): take care to set export value
2488 to something sane before we start so caller will have harmless
2489 values in them if the function fails
2491 * accept_sec_context.c (gss_accept_sec_context): take care to set
2492 export value to something sane before we start so caller will have
2493 harmless values in them if then function fails, set lifetime from
2494 ticket expiration date
2496 * indicate_mechs.c (gss_indicate_mechs): use
2497 gss_create_empty_oid_set and gss_add_oid_set_member
2499 * gssapi.h (gss_ctx_id_t_desc): store the lifetime in the cred,
2500 since there is no ticket transfered in the exported context
2502 * export_name.c (gss_export_name): export name with
2503 GSS_C_NT_EXPORT_NAME wrapping, not just the principal
2505 * import_name.c (import_export_name): new function, parses a
2506 GSS_C_NT_EXPORT_NAME
2507 (import_krb5_name): factor out common code of parsing krb5 name
2508 (gss_oid_equal): rename from oid_equal
2510 * gssapi_locl.h: add prototypes for gss_oid_equal and
2511 gss_verify_mic_internal
2513 * gssapi.h: comment out the argument names
2515 2003-03-15 Love Hörnquist Åstrand <lha@it.su.se>
2517 * gssapi.3: add LIST OF FUNCTIONS and copyright/license
2519 * Makefile.am: s/gss_aquire_cred.3/gss_acquire_cred.3/
2521 * Makefile.am: man_MANS += gss_aquire_cred.3
2523 2003-03-14 Love Hörnquist Åstrand <lha@it.su.se>
2525 * gss_aquire_cred.3: the gssapi api manpage
2527 2003-03-03 Love Hörnquist Åstrand <lha@it.su.se>
2529 * inquire_context.c: (gss_inquire_context): rename argument open
2532 * gssapi.h (gss_inquire_context): rename argument open to open_context
2534 2003-02-27 Love Hörnquist Åstrand <lha@it.su.se>
2536 * init_sec_context.c (do_delegation): remove unused variable
2539 * gssapi.3: all 0.5.x version had broken token delegation
2541 2003-02-21 Love Hörnquist Åstrand <lha@it.su.se>
2543 * (init_auth): only generate one subkey
2545 2003-01-27 Love Hörnquist Åstrand <lha@it.su.se>
2547 * verify_mic.c (verify_mic_des3): fix 3des verify_mic to conform
2548 to rfc (and mit kerberos), provide backward compat hook
2550 * get_mic.c (mic_des3): fix 3des get_mic to conform to rfc (and
2551 mit kerberos), provide backward compat hook
2553 * init_sec_context.c (init_auth): check if we need compat for
2554 older get_mic/verify_mic
2556 * gssapi_locl.h: add prototype for _gss_DES3_get_mic_compat
2558 * gssapi.h (more_flags): add COMPAT_OLD_DES3
2560 * Makefile.am: add gssapi.3 and compat.c
2562 * gssapi.3: add gssapi COMPATIBILITY documentation
2564 * accept_sec_context.c (gss_accept_sec_context): check if we need
2565 compat for older get_mic/verify_mic
2567 * compat.c: check for compatiblity with other heimdal's 3des
2570 2002-10-31 Johan Danielsson <joda@pdc.kth.se>
2572 * check return value from gssapi_krb5_init
2574 * 8003.c (gssapi_krb5_verify_8003_checksum): check size of input
2576 2002-09-03 Johan Danielsson <joda@pdc.kth.se>
2578 * wrap.c (wrap_des3): use ETYPE_DES3_CBC_NONE
2580 * unwrap.c (unwrap_des3): use ETYPE_DES3_CBC_NONE
2582 2002-09-02 Johan Danielsson <joda@pdc.kth.se>
2584 * init_sec_context.c: we need to generate a local subkey here
2586 2002-08-20 Jacques Vidrine <n@nectar.com>
2588 * acquire_cred.c, inquire_cred.c, release_cred.c: Use default
2589 credential resolution if gss_acquire_cred is called with
2592 2002-06-20 Jacques Vidrine <n@nectar.com>
2594 * import_name.c: Compare name types by value if pointers do
2595 not match. Reported by: "Douglas E. Engert" <deengert@anl.gov>
2597 2002-05-20 Jacques Vidrine <n@nectar.com>
2599 * verify_mic.c (gss_verify_mic), unwrap.c (gss_unwrap): initialize
2600 the qop_state parameter. from Doug Rabson <dfr@nlsystems.com>
2602 2002-05-09 Jacques Vidrine <n@nectar.com>
2604 * acquire_cred.c: handle GSS_C_INITIATE/GSS_C_ACCEPT/GSS_C_BOTH
2606 2002-05-08 Jacques Vidrine <n@nectar.com>
2608 * acquire_cred.c: initialize gssapi; handle null desired_name
2610 2002-03-22 Johan Danielsson <joda@pdc.kth.se>
2612 * Makefile.am: remove non-functional stuff accidentally committed
2614 2002-03-11 Assar Westerlund <assar@sics.se>
2616 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:5:2
2617 * 8003.c (gssapi_krb5_verify_8003_checksum): handle zero channel
2620 2001-10-31 Jacques Vidrine <n@nectar.com>
2622 * get_mic.c (mic_des3): MIC computation using DES3/SHA1
2623 was bogusly appending the message buffer to the result,
2624 overwriting a heap buffer in the process.
2626 2001-08-29 Assar Westerlund <assar@sics.se>
2628 * 8003.c (gssapi_krb5_verify_8003_checksum,
2629 gssapi_krb5_create_8003_checksum): make more consistent by always
2630 returning an gssapi error and setting minor status. update
2633 2001-08-28 Jacques Vidrine <n@nectar.com>
2635 * accept_sec_context.c: Create a cache for delegated credentials
2638 2001-08-28 Assar Westerlund <assar@sics.se>
2640 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:4:2
2642 2001-08-23 Assar Westerlund <assar@sics.se>
2644 * *.c: handle minor_status more consistently
2646 * display_status.c (gss_display_status): handle krb5_get_err_text
2649 2001-08-15 Johan Danielsson <joda@pdc.kth.se>
2651 * gssapi_locl.h: fix prototype for gssapi_krb5_init
2653 2001-08-13 Johan Danielsson <joda@pdc.kth.se>
2655 * accept_sec_context.c (gsskrb5_register_acceptor_identity): init
2656 context and check return value from kt_resolve
2658 * init.c: return error code
2660 2001-07-19 Assar Westerlund <assar@sics.se>
2662 * Makefile.am (libgssapi_la_LDFLAGS): update to 3:3:2
2664 2001-07-12 Assar Westerlund <assar@sics.se>
2666 * Makefile.am (libgssapi_la_LIBADD): add required library
2669 2001-07-06 Assar Westerlund <assar@sics.se>
2671 * accept_sec_context.c (gsskrb5_register_acceptor_identity): set
2672 the keytab to be used for gss_acquire_cred too'
2674 2001-07-03 Assar Westerlund <assar@sics.se>
2676 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:2:2
2678 2001-06-18 Assar Westerlund <assar@sics.se>
2680 * wrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2681 and gss_krb5_get_remotekey
2682 * verify_mic.c: update krb5_auth_con function names use
2683 gss_krb5_get_remotekey
2684 * unwrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2685 and gss_krb5_get_remotekey
2686 * gssapi_locl.h (gss_krb5_get_remotekey, gss_krb5_get_localkey):
2688 * get_mic.c: update krb5_auth_con function names. use
2689 gss_krb5_get_localkey
2690 * accept_sec_context.c: update krb5_auth_con function names
2692 2001-05-17 Assar Westerlund <assar@sics.se>
2694 * Makefile.am: bump version to 3:1:2
2696 2001-05-14 Assar Westerlund <assar@sics.se>
2698 * address_to_krb5addr.c: adapt to new address functions
2700 2001-05-11 Assar Westerlund <assar@sics.se>
2702 * try to return the error string from libkrb5 where applicable
2704 2001-05-08 Assar Westerlund <assar@sics.se>
2706 * delete_sec_context.c (gss_delete_sec_context): remember to free
2707 the memory used by the ticket itself. from <tmartin@mirapoint.com>
2709 2001-05-04 Assar Westerlund <assar@sics.se>
2711 * gssapi_locl.h: add config.h for completeness
2712 * gssapi.h: remove config.h, this is an installed header file
2713 sys/types.h is not needed either
2715 2001-03-12 Assar Westerlund <assar@sics.se>
2717 * acquire_cred.c (gss_acquire_cred): remove memory leaks. from
2718 Jason R Thorpe <thorpej@zembu.com>
2720 2001-02-18 Assar Westerlund <assar@sics.se>
2722 * accept_sec_context.c (gss_accept_sec_context): either return
2723 gss_name NULL-ed or set
2725 * import_name.c: set minor_status in some cases where it was not
2728 2001-02-15 Assar Westerlund <assar@sics.se>
2730 * wrap.c: use krb5_generate_random_block for the confounders
2732 2001-01-30 Assar Westerlund <assar@sics.se>
2734 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:0:2
2735 * acquire_cred.c, init_sec_context.c, release_cred.c: add support
2736 for getting creds from a keytab, from fvdl@netbsd.org
2738 * copy_ccache.c: add gss_krb5_copy_ccache
2740 2001-01-27 Assar Westerlund <assar@sics.se>
2742 * get_mic.c: cast parameters to des function to non-const pointers
2743 to handle the case where these functions actually take non-const
2746 2001-01-09 Assar Westerlund <assar@sics.se>
2748 * accept_sec_context.c (gss_accept_sec_context): use krb5_rd_cred2
2749 instead of krb5_rd_cred
2751 2000-12-11 Assar Westerlund <assar@sics.se>
2753 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:3:1
2755 2000-12-08 Assar Westerlund <assar@sics.se>
2757 * wrap.c (wrap_des3): use the checksum as ivec when encrypting the
2759 * unwrap.c (unwrap_des3): use the checksum as ivec when encrypting
2761 * init_sec_context.c (init_auth): always zero fwd_data
2763 2000-12-06 Johan Danielsson <joda@pdc.kth.se>
2765 * accept_sec_context.c: de-pointerise auth_context parameter to
2768 2000-11-15 Assar Westerlund <assar@sics.se>
2770 * init_sec_context.c (init_auth): update to new
2771 krb5_build_authenticator
2773 2000-09-19 Assar Westerlund <assar@sics.se>
2775 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:2:1
2777 2000-08-27 Assar Westerlund <assar@sics.se>
2779 * init_sec_context.c: actually pay attention to `time_req'
2780 * init_sec_context.c: re-organize. leak less memory.
2781 * gssapi_locl.h (gssapi_krb5_encapsulate, gss_krb5_getsomekey):
2782 update prototypes add assert.h
2783 * gssapi.h (GSS_KRB5_CONF_C_QOP_DES, GSS_KRB5_CONF_C_QOP_DES3_KD):
2785 * verify_mic.c: re-organize and add 3DES code
2786 * wrap.c: re-organize and add 3DES code
2787 * unwrap.c: re-organize and add 3DES code
2788 * get_mic.c: re-organize and add 3DES code
2789 * encapsulate.c (gssapi_krb5_encapsulate): do not free `in_data',
2790 let the caller do that. fix the callers.
2792 2000-08-16 Assar Westerlund <assar@sics.se>
2794 * Makefile.am: bump version to 2:1:1
2796 2000-07-29 Assar Westerlund <assar@sics.se>
2798 * decapsulate.c (gssapi_krb5_verify_header): sanity-check length
2800 2000-07-25 Johan Danielsson <joda@pdc.kth.se>
2802 * Makefile.am: bump version to 2:0:1
2804 2000-07-22 Assar Westerlund <assar@sics.se>
2806 * gssapi.h: update OID for GSS_C_NT_HOSTBASED_SERVICE and other
2807 details from rfc2744
2809 2000-06-29 Assar Westerlund <assar@sics.se>
2811 * address_to_krb5addr.c (gss_address_to_krb5addr): actually use
2812 `int' instead of `sa_family_t' for the address family.
2814 2000-06-21 Assar Westerlund <assar@sics.se>
2816 * add support for token delegation. From Daniel Kouril
2817 <kouril@ics.muni.cz> and Miroslav Ruda <ruda@ics.muni.cz>
2819 2000-05-15 Assar Westerlund <assar@sics.se>
2821 * Makefile.am (libgssapi_la_LDFLAGS): set version to 1:1:1
2823 2000-04-12 Assar Westerlund <assar@sics.se>
2825 * release_oid_set.c (gss_release_oid_set): clear set for
2826 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2827 * release_name.c (gss_release_name): reset input_name for
2828 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2829 * release_buffer.c (gss_release_buffer): set value to NULL to be
2830 more robust. From GOMBAS Gabor <gombasg@inf.elte.hu>
2831 * add_oid_set_member.c (gss_add_oid_set_member): actually check if
2832 the oid is a member first. leave the oid_set unchanged if realloc
2835 2000-02-13 Assar Westerlund <assar@sics.se>
2837 * Makefile.am: set version to 1:0:1
2839 2000-02-12 Assar Westerlund <assar@sics.se>
2841 * gssapi_locl.h: add flags for import/export
2842 * import_sec_context.c (import_sec_context: add flags for what
2843 fields are included. do not include the authenticator for now.
2844 * export_sec_context.c (export_sec_context: add flags for what
2845 fields are included. do not include the authenticator for now.
2846 * accept_sec_context.c (gss_accept_sec_context): set target in
2849 2000-02-11 Assar Westerlund <assar@sics.se>
2851 * delete_sec_context.c (gss_delete_sec_context): set context to
2854 * Makefile.am: add {export,import}_sec_context.c
2855 * export_sec_context.c: new file
2856 * import_sec_context.c: new file
2857 * accept_sec_context.c (gss_accept_sec_context): set trans flag
2859 2000-02-07 Assar Westerlund <assar@sics.se>
2861 * Makefile.am: set version to 0:5:0
2863 2000-01-26 Assar Westerlund <assar@sics.se>
2865 * delete_sec_context.c (gss_delete_sec_context): handle a NULL
2868 * wrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2869 changes to libdes calls to make them more portable.
2870 * verify_mic.c: update to pseudo-standard APIs for md4,md5,sha.
2871 some changes to libdes calls to make them more portable.
2872 * unwrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2873 changes to libdes calls to make them more portable.
2874 * get_mic.c: update to pseudo-standard APIs for md4,md5,sha. some
2875 changes to libdes calls to make them more portable.
2876 * 8003.c: update to pseudo-standard APIs for md4,md5,sha.
2878 2000-01-06 Assar Westerlund <assar@sics.se>
2880 * Makefile.am: set version to 0:4:0
2882 1999-12-26 Assar Westerlund <assar@sics.se>
2884 * accept_sec_context.c (gss_accept_sec_context): always set
2886 * init_sec_context.c (init_auth): always initialize `output_token'
2887 * delete_sec_context.c (gss_delete_sec_context): always set
2890 1999-12-06 Assar Westerlund <assar@sics.se>
2892 * Makefile.am: bump version to 0:3:0
2894 1999-10-20 Assar Westerlund <assar@sics.se>
2896 * Makefile.am: set version to 0:2:0
2898 1999-09-21 Assar Westerlund <assar@sics.se>
2900 * init_sec_context.c (gss_init_sec_context): initialize `ticket'
2902 * gssapi.h (gss_ctx_id_t_desc): add ticket in here. ick.
2904 * delete_sec_context.c (gss_delete_sec_context): free ticket
2906 * accept_sec_context.c (gss_accept_sec_context): stove away
2907 `krb5_ticket' in context so that ugly programs such as
2908 gss_nt_server can get at it. uck.
2910 1999-09-20 Johan Danielsson <joda@pdc.kth.se>
2912 * accept_sec_context.c: set minor_status
2914 1999-08-04 Assar Westerlund <assar@sics.se>
2916 * display_status.c (calling_error, routine_error): right shift the
2917 code to make it possible to index into the arrays
2919 1999-07-28 Assar Westerlund <assar@sics.se>
2921 * gssapi.h (GSS_C_AF_INET6): add
2923 * import_name.c (import_hostbased_name): set minor_status
2925 1999-07-26 Assar Westerlund <assar@sics.se>
2927 * Makefile.am: set version to 0:1:0
2929 Wed Apr 7 14:05:15 1999 Johan Danielsson <joda@hella.pdc.kth.se>
2931 * display_status.c: set minor_status
2933 * init_sec_context.c: set minor_status
2935 * lib/gssapi/init.c: remove donep (check gssapi_krb5_context