1 2008-04-17 Love Hörnquist Åstrand <lha@it.su.se>
3 * add __declspec() for windows.
5 2008-04-15 Love Hörnquist Åstrand <lha@it.su.se>
7 * krb5/import_sec_context.c: Use tmp to read ac->flags value to
10 2008-04-07 Love Hörnquist Åstrand <lha@it.su.se>
12 * mech/gss_mech_switch.c: Use unsigned where appropriate.
14 2008-03-14 Love Hörnquist Åstrand <lha@it.su.se>
16 * test_context.c: Add test for gsskrb5_register_acceptor_identity.
18 2008-03-09 Love Hörnquist Åstrand <lha@it.su.se>
20 * krb5/init_sec_context.c (init_auth): use right variable to
21 detect if we want to free or not.
23 2008-02-26 Love Hörnquist Åstrand <lha@it.su.se>
25 * Makefile.am: add missing \
27 * Makefile.am: reshuffle depenencies
29 * Add flag to krb5 to not add GSS-API INT|CONF to the negotiation
31 2008-02-21 Love Hörnquist Åstrand <lha@it.su.se>
33 * make the SPNEGO mech store the error itself instead, works for
34 everything except other stackable mechs
36 2008-02-18 Love Hörnquist Åstrand <lha@it.su.se>
38 * spnego/init_sec_context.c (spnego_reply): if the reply token was
39 of length 0, make it the same as no token. Pointed out by Zeqing
42 * krb5/acquire_cred.c (acquire_initiator_cred): handle the
43 credential cache better, use destroy/close when appriate and for
44 all cases. Thanks to Michael Allen for point out the memory-leak
47 2008-02-03 Love Hörnquist Åstrand <lha@it.su.se>
49 * spnego/accept_sec_context.c: Make error reporting somewhat more
52 2008-01-27 Love Hörnquist Åstrand <lha@it.su.se>
54 * test_common.c: Improve the error message.
56 2008-01-24 Love Hörnquist Åstrand <lha@it.su.se>
58 * ntlm/accept_sec_context.c: Avoid free-ing type1 message before
61 2008-01-13 Love Hörnquist Åstrand <lha@it.su.se>
63 * test_ntlm.c: Test source name (and make the acceptor in ntlm gss
66 2007-12-30 Love Hörnquist Åstrand <lha@it.su.se>
68 * ntlm/init_sec_context.c: Don't confuse target name and source
69 name, make regressiont tests pass again.
71 2007-12-29 Love Hörnquist Åstrand <lha@it.su.se>
73 * ntlm: clean up name handling
75 2007-12-04 Love Hörnquist Åstrand <lha@it.su.se>
77 * ntlm/init_sec_context.c: Use credential if it was passed in.
79 * ntlm/acquire_cred.c: Check if there is initial creds with
80 _gss_ntlm_get_user_cred().
82 * ntlm/init_sec_context.c: Add _gss_ntlm_get_user_info() that
83 return the user info so it can be used by external modules.
85 * ntlm/inquire_cred.c: use the right error code.
87 * ntlm/inquire_cred.c: Return GSS_C_NO_CREDENTIAL if there is no
88 credential, ntlm have (not yet) a default credential.
90 * mech/gss_release_oid_set.c: Avoid trying to deref NULL, from
93 2007-12-03 Love Hörnquist Åstrand <lha@it.su.se>
95 * test_acquire_cred.c: Always try to fetch cred (even with
98 2007-08-09 Love Hörnquist Åstrand <lha@it.su.se>
100 * mech/gss_krb5.c: Readd gss_krb5_get_tkt_flags.
102 2007-08-08 Love Hörnquist Åstrand <lha@it.su.se>
104 * spnego/compat.c (_gss_spnego_internal_delete_sec_context):
105 release ctx->target_name too From Rafal Malinowski.
107 2007-07-26 Love Hörnquist Åstrand <lha@it.su.se>
109 * mech/gss_mech_switch.c: Don't try to do dlopen if system doesn't
110 have dlopen. From Rune of Chalmers.
112 2007-07-10 Love Hörnquist Åstrand <lha@it.su.se>
114 * mech/gss_duplicate_name.c: New signature of _gss_find_mn.
116 * mech/gss_init_sec_context.c: New signature of _gss_find_mn.
118 * mech/gss_acquire_cred.c: New signature of _gss_find_mn.
120 * mech/name.h: New signature of _gss_find_mn.
122 * mech/gss_canonicalize_name.c: New signature of _gss_find_mn.
124 * mech/gss_compare_name.c: New signature of _gss_find_mn.
126 * mech/gss_add_cred.c: New signature of _gss_find_mn.
128 * mech/gss_names.c (_gss_find_mn): Return an error code for
131 * spnego/accept_sec_context.c: remove checks that are done by the
134 * Makefile.am: New library version.
136 2007-07-04 Love Hörnquist Åstrand <lha@it.su.se>
138 * mech/gss_oid_to_str.c: Refuse to print GSS_C_NULL_OID, from
141 * spnego/spnego.asn1: Indent and make NegTokenInit and
142 NegTokenResp extendable.
144 2007-06-21 Love Hörnquist Åstrand <lha@it.su.se>
146 * ntlm/inquire_cred.c: Implement _gss_ntlm_inquire_cred.
148 * mech/gss_display_status.c: Provide message for GSS_S_COMPLETE.
150 * mech/context.c: If the canned string is "", its no use to the
151 user, make it fall back to the default error string.
153 2007-06-20 Love Hörnquist Åstrand <lha@it.su.se>
155 * mech/gss_display_name.c (gss_display_name): no name ->
156 fail. From Rafal Malinswski.
158 * spnego/accept_sec_context.c: Wrap name in a spnego_name instead
159 of just a copy of the underlaying object. From Rafal Malinswski.
161 * spnego/accept_sec_context.c: Handle underlaying mech not
164 * mech/gss_accept_sec_context.c: Handle underlaying mech not
167 * spnego/accept_sec_context.c: Make sure src_name is always set to
168 GSS_C_NO_NAME when returning.
170 * krb5/acquire_cred.c (acquire_acceptor_cred): don't claim
171 everything is well on failure. From Phil Fisher.
173 * mech/gss_duplicate_name.c: catch error (and ignore it)
175 * ntlm/init_sec_context.c: Use heim_ntlm_calculate_ntlm2_sess.
177 * mech/gss_accept_sec_context.c: Only wrap the delegated cred if
178 we got a delegated mech cred. From Rafal Malinowski.
180 * spnego/accept_sec_context.c: Only wrap the delegated cred if we
181 are going to return it to the consumer. From Rafal Malinowski.
183 * spnego/accept_sec_context.c: Fixed memory leak pointed out by
184 Rafal Malinowski, also while here moved to use NegotiationToken
187 2007-06-18 Love Hörnquist Åstrand <lha@it.su.se>
189 * krb5/prf.c (_gsskrb5_pseudo_random): add missing break.
191 * krb5/release_name.c: Set *minor_status unconditionallty, its
194 * spnego/accept_sec_context.c: Init get_mic to 0.
196 * mech/gss_set_cred_option.c: Free memory in failure case, found
199 * mech/gss_inquire_context.c: Handle mech_type being NULL.
201 * mech/gss_inquire_cred_by_mech.c: Handle cred_name being NULL.
203 * mech/gss_krb5.c: Free memory in error case, found by beam.
205 2007-06-12 Love Hörnquist Åstrand <lha@it.su.se>
207 * ntlm/inquire_context.c: Use ctx->gssflags for flags.
209 * krb5/display_name.c: Use KRB5_PRINCIPAL_UNPARSE_DISPLAY, this is
210 not ment for machine consumption.
212 2007-06-09 Love Hörnquist Åstrand <lha@it.su.se>
214 * ntlm/digest.c (kdc_alloc): free memory on failure, pointed out
217 * ntlm/digest.c (kdc_destroy): free context when done, pointed out
220 * spnego/context_stubs.c (_gss_spnego_display_name): if input_name
221 is null, fail. From Rafal Malinowski.
223 2007-06-04 Love Hörnquist Åstrand <lha@it.su.se>
225 * ntlm/digest.c: Free memory when done.
227 2007-06-02 Love Hörnquist Åstrand <lha@it.su.se>
229 * test_ntlm.c: Test both with and without keyex.
231 * ntlm/digest.c: If we didn't set session key, don't expect one
234 * test_ntlm.c: Set keyex flag and calculate session key.
236 2007-05-31 Love Hörnquist Åstrand <lha@it.su.se>
238 * spnego/accept_sec_context.c: Use the return value before is
239 overwritten by later calls. From Rafal Malinowski
241 * krb5/release_cred.c: Give an minor_status argument to
242 gss_release_oid_set. From Rafal Malinowski
244 2007-05-30 Love Hörnquist Åstrand <lha@it.su.se>
246 * ntlm/accept_sec_context.c: Catch errors and return the up the
249 * test_kcred.c: more testing of lifetimes
251 2007-05-17 Love Hörnquist Åstrand <lha@it.su.se>
253 * Makefile.am: Drop the gss oid_set function for the krb5 mech,
254 use the mech glue versions instead. Pointed out by Rafal
257 * krb5: Use gss oid_set functions from mechglue
259 2007-05-14 Love Hörnquist Åstrand <lha@it.su.se>
261 * ntlm/accept_sec_context.c: Set session key only if we are
262 returned a session key. Found by David Love.
264 2007-05-13 Love Hörnquist Åstrand <lha@it.su.se>
266 * krb5/prf.c: switched MIN to min to make compile on solaris,
267 pointed out by David Love.
269 2007-05-09 Love Hörnquist Åstrand <lha@it.su.se>
271 * krb5/inquire_cred_by_mech.c: Fill in all of the variables if
272 they are passed in. Pointed out by Phil Fisher.
274 2007-05-08 Love Hörnquist Åstrand <lha@it.su.se>
276 * krb5/inquire_cred.c: Fix copy and paste error, bug spotted by
279 * mech: dont keep track of gc_usage, just figure it out at
280 gss_inquire_cred() time
282 * mech/gss_mech_switch.c (add_builtin): ok for
283 __gss_mech_initialize() to return NULL
285 * test_kcred.c: more correct tests
287 * spnego/cred_stubs.c (gss_inquire_cred*): wrap the name with a
290 * ntlm/inquire_cred.c: make ntlm gss_inquire_cred fail for now,
291 need to find default cred and friends.
293 * krb5/inquire_cred_by_mech.c: reimplement
295 2007-05-07 Love Hörnquist Åstrand <lha@it.su.se>
297 * ntlm/acquire_cred.c: drop unused variable.
299 * ntlm/acquire_cred.c: Reimplement.
301 * Makefile.am: add ntlm/digest.c
303 * ntlm: split out backend ntlm server processing
305 2007-04-24 Love Hörnquist Åstrand <lha@it.su.se>
307 * ntlm/delete_sec_context.c (_gss_ntlm_delete_sec_context): free
310 2007-04-22 Love Hörnquist Åstrand <lha@it.su.se>
312 * ntlm/init_sec_context.c: ntlm-key credential entry is prefix with @
314 * ntlm/init_sec_context.c (get_user_ccache): pick up the ntlm
315 creds from the krb5 credential cache.
317 2007-04-21 Love Hörnquist Åstrand <lha@it.su.se>
319 * ntlm/delete_sec_context.c: free the key stored in the context
321 * ntlm/ntlm.h: switch password for a key
323 * test_oid.c: Switch oid to one that is exported.
325 2007-04-20 Love Hörnquist Åstrand <lha@it.su.se>
327 * ntlm/init_sec_context.c: move where hash is calculated to make
328 it easier to add ccache support.
330 * Makefile.am: Add version-script.map to EXTRA_DIST.
332 2007-04-19 Love Hörnquist Åstrand <lha@it.su.se>
334 * Makefile.am: Unconfuse newer versions of automake that doesn't
335 know the diffrence between depenences and setting variables. foo:
338 * test_ntlm.c: delete sec context when done.
340 * version-script.map: export more symbols.
342 * Makefile.am: add version script if ld supports it
344 * version-script.map: add version script if ld supports it
346 2007-04-18 Love Hörnquist Åstrand <lha@it.su.se>
348 * Makefile.am: test_acquire_cred need test_common.[ch]
350 * test_acquire_cred.c: add more test options.
352 * krb5/external.c: add GSS_KRB5_CCACHE_NAME_X
354 * gssapi/gssapi_krb5.h: add GSS_KRB5_CCACHE_NAME_X
356 * krb5/set_sec_context_option.c: refactor code, implement
357 GSS_KRB5_CCACHE_NAME_X
359 * mech/gss_krb5.c: reimplement gss_krb5_ccache_name
361 2007-04-17 Love Hörnquist Åstrand <lha@it.su.se>
363 * spnego/cred_stubs.c: Need to import spnego name before we can
364 use it as a gss_name_t.
366 * test_acquire_cred.c: use this test as part of the regression
369 * mech/gss_acquire_cred.c (gss_acquire_cred): dont init
370 cred->gc_mc every time in the loop.
372 2007-04-15 Love Hörnquist Åstrand <lha@it.su.se>
374 * Makefile.am: add test_common.h
376 2007-02-16 Love Hörnquist Åstrand <lha@it.su.se>
378 * gss_acquire_cred.3: Add link for
379 gsskrb5_register_acceptor_identity.
381 2007-02-08 Love Hörnquist Åstrand <lha@it.su.se>
383 * krb5/copy_ccache.c: Try to leak less memory in the failure case.
385 2007-01-31 Love Hörnquist Åstrand <lha@it.su.se>
387 * mech/gss_display_status.c: Use right printf formater.
389 * test_*.[ch]: split out the error printing function and try to
392 2007-01-30 Love Hörnquist Åstrand <lha@it.su.se>
394 * krb5/init_sec_context.c: revert 1.75: (init_auth): only turn on
395 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
397 This is because Kerberos always support INT|CONF, matches behavior
398 with MS and MIT. The creates problems for the GSS-SPNEGO mech.
400 2007-01-24 Love Hörnquist Åstrand <lha@it.su.se>
402 * krb5/prf.c: constrain desired_output_len
404 * krb5/external.c (krb5_mech): add _gsskrb5_pseudo_random
406 * mech/gss_pseudo_random.c: Catch error from underlaying mech on
409 * Makefile.am: Add krb5/prf.c
411 * krb5/prf.c: gss_pseudo_random for krb5
413 * test_context.c: Checks for gss_pseudo_random.
415 * krb5/gkrb5_err.et: add KG_INPUT_TOO_LONG
417 * Makefile.am: Add mech/gss_pseudo_random.c
419 * gssapi/gssapi.h: try to load pseudo_random
421 * mech/gss_mech_switch.c: try to load pseudo_random
423 * mech/gss_pseudo_random.c: Add gss_pseudo_random.
425 * gssapi_mech.h: Add hook for gm_pseudo_random.
427 2007-01-17 Love Hörnquist Åstrand <lha@it.su.se>
429 * test_context.c: Don't assume bufer from gss_display_status is
432 * mech/gss_wrap_size_limit.c: Reset out variables.
434 * mech/gss_wrap.c: Reset out variables.
436 * mech/gss_verify_mic.c: Reset out variables.
438 * mech/gss_utils.c: Reset out variables.
440 * mech/gss_release_oid_set.c: Reset out variables.
442 * mech/gss_release_cred.c: Reset out variables.
444 * mech/gss_release_buffer.c: Reset variables.
446 * mech/gss_oid_to_str.c: Reset out variables.
448 * mech/gss_inquire_sec_context_by_oid.c: Fix reset out variables.
450 * mech/gss_mech_switch.c: Reset out variables.
452 * mech/gss_inquire_sec_context_by_oid.c: Reset out variables.
454 * mech/gss_inquire_names_for_mech.c: Reset out variables.
456 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
458 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
460 * mech/gss_inquire_cred_by_mech.c: Reset out variables.
462 * mech/gss_inquire_cred.c: Reset out variables, fix memory leak.
464 * mech/gss_inquire_context.c: Reset out variables.
466 * mech/gss_init_sec_context.c: Zero out outbuffer on failure.
468 * mech/gss_import_name.c: Reset out variables.
470 * mech/gss_import_name.c: Reset out variables.
472 * mech/gss_get_mic.c: Reset out variables.
474 * mech/gss_export_name.c: Reset out variables.
476 * mech/gss_encapsulate_token.c: Reset out variables.
478 * mech/gss_duplicate_oid.c: Reset out variables.
480 * mech/gss_duplicate_oid.c: Reset out variables.
482 * mech/gss_duplicate_name.c: Reset out variables.
484 * mech/gss_display_status.c: Reset out variables.
486 * mech/gss_display_name.c: Reset out variables.
488 * mech/gss_delete_sec_context.c: Reset out variables using propper
491 * mech/gss_decapsulate_token.c: Reset out variables using propper
494 * mech/gss_add_cred.c: Reset out variables.
496 * mech/gss_acquire_cred.c: Reset out variables.
498 * mech/gss_accept_sec_context.c: Reset out variables using propper
501 * mech/gss_init_sec_context.c: Reset out variables.
503 * mech/mech_locl.h (_mg_buffer_zero): new macro that zaps a
506 2007-01-16 Love Hörnquist Åstrand <lha@it.su.se>
508 * mech: sprinkel _gss_mg_error
510 * mech/gss_display_status.c (gss_display_status): use
511 _gss_mg_get_error to fetch the error from underlaying mech, if it
512 failes, let do the regular dance for GSS-CODE version and a
513 generic print-the-error code for MECH-CODE.
515 * mech/gss_oid_to_str.c: Don't include the NUL in the length of
518 * mech/context.h: Protoypes for _gss_mg_.
520 * mech/context.c: Glue to catch the error from the lower gss-api
521 layer and save that for later so gss_display_status() can show the
524 * gss.c: Detect NTLM.
526 2007-01-11 Love Hörnquist Åstrand <lha@it.su.se>
528 * mech/gss_accept_sec_context.c: spelling
530 2007-01-04 Love Hörnquist Åstrand <lha@it.su.se>
532 * Makefile.am: Include build (private) prototypes header files.
534 * Makefile.am (ntlmsrc): add ntlm/ntlm-private.h
536 2006-12-28 Love Hörnquist Åstrand <lha@it.su.se>
538 * ntlm/accept_sec_context.c: Pass signseal argument to
541 * ntlm/init_sec_context.c: Pass signseal argument to
544 * ntlm/crypto.c (_gss_ntlm_set_key): add signseal argument
546 * test_ntlm.c: add ntlmv2 test
548 * ntlm/ntlm.h: break out struct ntlmv2_key;
550 * ntlm/crypto.c (_gss_ntlm_set_key): set ntlm v2 keys.
552 * ntlm/accept_sec_context.c: Set dummy ntlmv2 keys and Check TI.
554 * ntlm/ntlm.h: NTLMv2 keys.
556 * ntlm/crypto.c: NTLMv2 sign and verify.
558 2006-12-20 Love Hörnquist Åstrand <lha@it.su.se>
560 * ntlm/accept_sec_context.c: Don't send targetinfo now.
562 * ntlm/init_sec_context.c: Build ntlmv2 answer buffer.
564 * ntlm/init_sec_context.c: Leak less memory.
566 * ntlm/init_sec_context.c: Announce that we support key exchange.
568 * ntlm/init_sec_context.c: Add NTLM_NEG_NTLM2_SESSION, NTLMv2
569 session security (disable because missing sign and seal).
571 2006-12-19 Love Hörnquist Åstrand <lha@it.su.se>
573 * ntlm/accept_sec_context.c: split RC4 send and recv keystreams
575 * ntlm/init_sec_context.c: split RC4 send and recv keystreams
577 * ntlm/ntlm.h: split RC4 send and recv keystreams
579 * ntlm/crypto.c: Implement SEAL.
581 * ntlm/crypto.c: move gss_wrap/gss_unwrap here
583 * test_context.c: request INT and CONF from the gss layer, test
586 * ntlm/ntlm.h: add crypto bits.
588 * ntlm/accept_sec_context.c: Save session master key.
590 * Makefile.am: Move get and verify mic to the same file (crypto.c)
591 since they share code.
593 * ntlm/crypto.c: Move get and verify mic to the same file since
594 they share code, implement NTLM v1 and dummy signatures.
596 * ntlm/init_sec_context.c: pass on GSS_C_CONF_FLAG and
597 GSS_C_INTEG_FLAG, save the session master key
599 * spnego/accept_sec_context.c: try using gss_accept_sec_context()
600 on the opportunistic token instead of guessing the acceptor name
601 and do gss_acquire_cred, this make SPNEGO work like before.
603 2006-12-18 Love Hörnquist Åstrand <lha@it.su.se>
605 * ntlm/init_sec_context.c: Calculate the NTLM version 1 "master"
608 * spnego/accept_sec_context.c: Resurect negHints for the acceptor
611 * Makefile.am: Add "windows" versions of the NegTokenInitWin and
614 * test_context.c: add --wrapunwrap flag
616 * spnego/compat.c: move _gss_spnego_indicate_mechtypelist() to
617 compat.c, use the sequence types of MechTypeList, make
618 add_mech_type() static.
620 * spnego/accept_sec_context.c: move
621 _gss_spnego_indicate_mechtypelist() to compat.c
623 * Makefile.am: Generate sequence code for MechTypeList
625 * spnego: check that the generated acceptor mechlist is acceptable too
627 * spnego/init_sec_context.c: Abstract out the initiator filter
628 function, it will be needed for the acceptor too.
630 * spnego/accept_sec_context.c: Abstract out the initiator filter
631 function, it will be needed for the acceptor too. Remove negHints.
633 * test_context.c: allow asserting return mech
635 * ntlm/accept_sec_context.c: add _gss_ntlm_allocate_ctx
637 * ntlm/acquire_cred.c: Check that the KDC seem to there and
638 answering us, we can't do better then that wen checking if we will
639 accept the credential.
641 * ntlm/get_mic.c: return GSS_S_UNAVAILABLE
643 * mech/utils.h: add _gss_free_oid, reverse of _gss_copy_oid
645 * mech/gss_utils.c: add _gss_free_oid, reverse of _gss_copy_oid
647 * spnego/spnego.asn1: Its very sad, but NegHints its are not part
648 of the NegTokenInit, this makes SPNEGO acceptor life a lot harder.
650 * spnego: try harder to handle names better. handle missing
651 acceptor and initator creds better (ie dont propose/accept mech
652 that there are no credentials for) split NegTokenInit and
653 NegTokenResp in acceptor
655 2006-12-16 Love Hörnquist Åstrand <lha@it.su.se>
657 * ntlm/import_name.c: Allocate the buffer from the right length.
659 2006-12-15 Love Hörnquist Åstrand <lha@it.su.se>
661 * ntlm/init_sec_context.c (init_sec_context): Tell the other side
662 what domain we think we are talking to.
664 * ntlm/delete_sec_context.c: free username and password
666 * ntlm/release_name.c (_gss_ntlm_release_name): free name.
668 * ntlm/import_name.c (_gss_ntlm_import_name): add support for
669 GSS_C_NT_HOSTBASED_SERVICE names
671 * ntlm/ntlm.h: Add ntlm_name.
673 * test_context.c: allow testing of ntlm.
675 * gssapi_mech.h: add __gss_ntlm_initialize
677 * ntlm/accept_sec_context.c (handle_type3): verify that the kdc
678 approved of the ntlm exchange too
680 * mech/gss_mech_switch.c: Add the builtin ntlm mech
682 * test_ntlm.c: NTLM test app.
684 * mech/gss_accept_sec_context.c: Add detection of NTLMSSP.
686 * gssapi/gssapi.h: add ntlm mech oid
688 * ntlm/external.c: Switch OID to the ms ntlmssp oid
690 * Makefile.am: Add ntlm gss-api module.
692 * ntlm/accept_sec_context.c: Catch more error errors.
694 * ntlm/accept_sec_context.c: Check after a credential to use.
696 2006-12-14 Love Hörnquist Åstrand <lha@it.su.se>
698 * krb5/set_sec_context_option.c (GSS_KRB5_SET_DEFAULT_REALM_X):
699 don't fail on success. Bug report from Stefan Metzmacher.
701 2006-12-13 Love Hörnquist Åstrand <lha@it.su.se>
703 * krb5/init_sec_context.c (init_auth): only turn on
704 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
705 From Stefan Metzmacher.
707 2006-12-11 Love Hörnquist Åstrand <lha@it.su.se>
709 * Makefile.am (libgssapi_la_OBJECTS): depends on gssapi_asn1.h
712 2006-11-20 Love Hörnquist Åstrand <lha@it.su.se>
714 * krb5/acquire_cred.c: Make krb5_get_init_creds_opt_free take a
717 2006-11-16 Love Hörnquist Åstrand <lha@it.su.se>
719 * test_context.c: Test that token keys are the same, return
722 2006-11-15 Love Hörnquist Åstrand <lha@it.su.se>
724 * spnego/spnego_locl.h: Make bitfields unsigned, add maybe_open.
726 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
727 encode CHOICE structure now that we can handle it.
729 * spnego/init_sec_context.c: Use ASN.1 encoder functions to encode
730 CHOICE structure now that we can handle it.
732 * spnego/accept_sec_context.c (_gss_spnego_accept_sec_context):
733 send back ad accept_completed when the security context is ->open,
734 w/o this the client doesn't know that the server have completed
737 * test_context.c: Add delegate flag and check that the delegated
740 * spnego/init_sec_context.c: Keep track of the opportunistic token
741 in the inital message, it might be a complete gss-api context, in
742 that case we'll get back accept_completed without any token. With
743 this change, krb5 w/o mutual authentication works.
745 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
746 encode CHOICE structure now that we can handle it.
748 * spnego/accept_sec_context.c: Filter out SPNEGO from the out
749 supported mechs list and make sure we don't select that for the
752 2006-11-14 Love Hörnquist Åstrand <lha@it.su.se>
754 * mech/gss_init_sec_context.c (_gss_mech_cred_find): break out the
755 cred finding to its own function
757 * krb5/wrap.c: Better error strings, from Andrew Bartlet.
759 2006-11-13 Love Hörnquist Åstrand <lha@it.su.se>
761 * test_context.c: Create our own krb5_context.
763 * krb5: Switch from using a specific error message context in the
764 TLS to have a whole krb5_context in TLS. This have some
765 interestion side-effekts for the configruration setting options
766 since they operate on per-thread basis now.
768 * mech/gss_set_cred_option.c: When calling ->gm_set_cred_option
769 and checking for success, use GSS_S_COMPLETE. From Andrew Bartlet.
771 2006-11-12 Love Hörnquist Åstrand <lha@it.su.se>
773 * Makefile.am: Help solaris make even more.
775 * Makefile.am: Help solaris make.
777 2006-11-09 Love Hörnquist Åstrand <lha@it.su.se>
779 * Makefile.am: remove include $(srcdir)/Makefile-digest.am for now
781 * mech/gss_accept_sec_context.c: Try better guessing what is mech
782 we are going to select by looking harder at the input_token, idea
783 from Luke Howard's mechglue branch.
785 * Makefile.am: libgssapi_la_OBJECTS: add depency on gkrb5_err.h
787 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X
789 * mech/gss_krb5.c: implement gss_krb5_set_allowable_enctypes
791 * gssapi/gssapi.h: GSS_KRB5_S_
793 * krb5/gsskrb5_locl.h: Include <gkrb5_err.h>.
795 * gssapi/gssapi_krb5.h: Add gss_krb5_set_allowable_enctypes.
797 * Makefile.am: Build and install gkrb5_err.h
799 * krb5/gkrb5_err.et: Move the GSS_KRB5_S error here.
801 2006-11-08 Love Hörnquist Åstrand <lha@it.su.se>
803 * mech/gss_krb5.c: Add gsskrb5_set_default_realm.
805 * krb5/set_sec_context_option.c: Support
806 GSS_KRB5_SET_DEFAULT_REALM_X.
808 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DEFAULT_REALM_X
810 * krb5/external.c: add GSS_KRB5_SET_DEFAULT_REALM_X
812 2006-11-07 Love Hörnquist Åstrand <lha@it.su.se>
814 * test_context.c: rename krb5_[gs]et_time_wrap to
815 krb5_[gs]et_max_time_skew
817 * krb5/copy_ccache.c: _gsskrb5_extract_authz_data_from_sec_context
818 no longer used, bye bye
820 * mech/gss_krb5.c: No depenency of the krb5 gssapi mech.
822 * mech/gss_krb5.c (gsskrb5_extract_authtime_from_sec_context): use
823 _gsskrb5_decode_om_uint32. From Andrew Bartlet.
825 * mech/gss_krb5.c: Add dummy gss_krb5_set_allowable_enctypes for
828 * spnego/spnego_locl.h: Include <roken.h> for compatiblity.
830 * krb5/arcfour.c: Use IS_DCE_STYLE flag. There is no padding in
831 DCE-STYLE, don't try to use to. From Andrew Bartlett.
833 * test_context.c: test wrap/unwrap, add flag for dce-style and
834 mutual auth, also support multi-roundtrip sessions
836 * krb5/gsskrb5_locl.h: Add IS_DCE_STYLE macro.
838 * krb5/accept_sec_context.c (gsskrb5_acceptor_start): use
841 * mech/gss_krb5.c (gsskrb5_get_subkey): return the per message
844 * krb5/inquire_sec_context_by_oid.c: check if there is any key at
847 2006-11-06 Love Hörnquist Åstrand <lha@it.su.se>
849 * krb5/inquire_sec_context_by_oid.c: Set more error strings, use
850 right enum for acceptor subkey. From Andrew Bartlett.
852 2006-11-04 Love Hörnquist Åstrand <lha@it.su.se>
854 * test_context.c: Test gsskrb5_extract_service_keyblock, needed in
855 PAC valication. From Andrew Bartlett
857 * mech/gss_krb5.c: Add gsskrb5_extract_authz_data_from_sec_context
858 and keyblock extraction functions.
860 * gssapi/gssapi_krb5.h: Add extraction of keyblock function, from
863 * krb5/external.c: Add GSS_KRB5_GET_SERVICE_KEYBLOCK_X
865 2006-11-03 Love Hörnquist Åstrand <lha@it.su.se>
867 * test_context.c: Rename various routines and constants from
868 canonize to canonicalize. From Andrew Bartlett
870 * mech/gss_krb5.c: Rename various routines and constants from
871 canonize to canonicalize. From Andrew Bartlett
873 * krb5/set_sec_context_option.c: Rename various routines and
874 constants from canonize to canonicalize. From Andrew Bartlett
876 * krb5/external.c: Rename various routines and constants from
877 canonize to canonicalize. From Andrew Bartlett
879 * gssapi/gssapi_krb5.h: Rename various routines and constants from
880 canonize to canonicalize. From Andrew Bartlett
882 2006-10-25 Love Hörnquist Åstrand <lha@it.su.se>
884 * krb5/accept_sec_context.c (gsskrb5_accept_delegated_token): need
887 2006-10-24 Love Hörnquist Åstrand <lha@it.su.se>
889 * test_context.c (loop): free target_name
891 * mech/gss_accept_sec_context.c: SLIST_INIT the ->gc_mc'
893 * mech/gss_acquire_cred.c : SLIST_INIT the ->gc_mc'
895 * krb5/init_sec_context.c: Avoid leaking memory.
897 * mech/gss_buffer_set.c (gss_release_buffer_set): don't leak the
900 * test_context.c: make compile
902 * krb5/cfx.c (_gssapi_verify_mic_cfx): always free crypto context.
904 * krb5/set_cred_option.c (import_cred): free sp
906 2006-10-22 Love Hörnquist Åstrand <lha@it.su.se>
908 * mech/gss_add_oid_set_member.c: Use old implementation of
909 gss_add_oid_set_member, it leaks less memory.
911 * krb5/test_cfx.c: free krb5_crypto.
913 * krb5/test_cfx.c: free krb5_context
915 * mech/gss_release_name.c (gss_release_name): free input_name
918 2006-10-21 Love Hörnquist Åstrand <lha@it.su.se>
920 * test_context.c: Call setprogname.
922 * mech/gss_krb5.c: Add gsskrb5_extract_authtime_from_sec_context.
924 * gssapi/gssapi_krb5.h: add
925 gsskrb5_extract_authtime_from_sec_context
927 2006-10-20 Love Hörnquist Åstrand <lha@it.su.se>
929 * krb5/inquire_sec_context_by_oid.c: Add get_authtime.
931 * krb5/external.c: add GSS_KRB5_GET_AUTHTIME_X
933 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_AUTHTIME_X
935 * krb5/set_sec_context_option.c: Implement GSS_KRB5_SEND_TO_KDC_X.
937 * mech/gss_krb5.c: Add gsskrb5_set_send_to_kdc
939 * gssapi/gssapi_krb5.h: Add GSS_KRB5_SEND_TO_KDC_X and
940 gsskrb5_set_send_to_kdc
942 * krb5/external.c: add GSS_KRB5_SEND_TO_KDC_X
944 * Makefile.am: more files
946 2006-10-19 Love Hörnquist Åstrand <lha@it.su.se>
948 * Makefile.am: remove spnego/gssapi_spnego.h, its now in gssapi/
950 * test_context.c: Allow specifing mech.
952 * krb5/external.c: add GSS_SASL_DIGEST_MD5_MECHANISM (for now)
954 * gssapi/gssapi.h: Rename GSS_DIGEST_MECHANISM to
955 GSS_SASL_DIGEST_MD5_MECHANISM
957 2006-10-18 Love Hörnquist Åstrand <lha@it.su.se>
959 * mech/gssapi.asn1: Make it into a heim_any_set, its doesn't
962 * mech/gssapi.asn1: GSSAPIContextToken is IMPLICIT SEQUENCE
964 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X
966 * krb5/external.c: Add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X.
968 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_INITIATOR_SUBKEY_X and
969 GSS_KRB5_GET_SUBKEY_X
971 * krb5/external.c: add GSS_KRB5_GET_INITIATOR_SUBKEY_X,
972 GSS_KRB5_GET_SUBKEY_X
974 2006-10-17 Love Hörnquist Åstrand <lha@it.su.se>
976 * test_context.c: Support switching on name type oid's
978 * test_context.c: add test for dns canon flag
980 * mech/gss_krb5.c: Add gsskrb5_set_dns_canonlize.
982 * gssapi/gssapi_krb5.h: remove gss_krb5_compat_des3_mic
984 * gssapi/gssapi_krb5.h: Add gsskrb5_set_dns_canonlize.
986 * krb5/set_sec_context_option.c: implement
987 GSS_KRB5_SET_DNS_CANONIZE_X
989 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DNS_CANONIZE_X
991 * krb5/external.c: add GSS_KRB5_SET_DNS_CANONIZE_X
993 * mech/gss_krb5.c: add bits to make lucid context work
995 2006-10-14 Love Hörnquist Åstrand <lha@it.su.se>
997 * mech/gss_oid_to_str.c: Prefix der primitives with der_.
999 * krb5/inquire_sec_context_by_oid.c: Prefix der primitives with
1002 * krb5/encapsulate.c: Prefix der primitives with der_.
1004 * mech/gss_oid_to_str.c: New der_print_heim_oid signature.
1006 2006-10-12 Love Hörnquist Åstrand <lha@it.su.se>
1008 * Makefile.am: add test_context
1010 * krb5/inquire_sec_context_by_oid.c: Make it work.
1012 * test_oid.c: Test lucid oid.
1014 * gssapi/gssapi.h: Add OM_uint64_t.
1016 * krb5/inquire_sec_context_by_oid.c: Add lucid interface.
1018 * krb5/external.c: Add lucid interface, renumber oids to my
1021 * mech/gss_krb5.c: Add lucid interface.
1023 * gssapi/gssapi_krb5.h: Add lucid interface.
1025 * spnego/spnego_locl.h: Maybe include <netdb.h>.
1027 2006-10-09 Love Hörnquist Åstrand <lha@it.su.se>
1029 * mech/gss_mech_switch.c: define RTLD_LOCAL to 0 if not defined.
1031 2006-10-08 Love Hörnquist Åstrand <lha@it.su.se>
1033 * Makefile.am: install gssapi_krb5.H and gssapi_spnego.h
1035 * gssapi/gssapi_krb5.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1037 * gssapi/gssapi.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1039 * Makefile.am: Drop some -I no longer needed.
1041 * gssapi/gssapi_spnego.h: Move gssapi_spengo.h over here.
1043 * krb5: reference all include files using 'krb5/'
1045 2006-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1047 * gssapi.h: Add file inclusion protection.
1049 * gssapi/gssapi.h: Correct header file inclusion protection.
1051 * gssapi/gssapi.h: Move the gssapi.h from lib/gssapi/ to
1052 lib/gssapi/gssapi/ to please automake.
1054 * spnego/spnego_locl.h: Maybe include <sys/types.h>.
1056 * mech/mech_locl.h: Include <roken.h>.
1058 * Makefile.am: split build files into dist_ and noinst_ SOURCES
1060 2006-10-06 Love Hörnquist Åstrand <lha@it.su.se>
1062 * gss.c: #if 0 out unused code.
1064 * mech/gss_mech_switch.c: Cast argument to ctype(3) functions
1067 2006-10-05 Love Hörnquist Åstrand <lha@it.su.se>
1069 * mech/name.h: remove <sys/queue.h>
1071 * mech/mech_switch.h: remove <sys/queue.h>
1073 * mech/cred.h: remove <sys/queue.h>
1075 2006-10-02 Love Hörnquist Åstrand <lha@it.su.se>
1077 * krb5/arcfour.c: Thinker more with header lengths.
1079 * krb5/arcfour.c: Improve the calcucation of header
1080 lengths. DCE-STYLE data is also padded so remove if (1 || ...)
1083 * krb5/wrap.c (_gsskrb5_wrap_size_limit): use
1084 _gssapi_wrap_size_arcfour for arcfour
1086 * krb5/arcfour.c: Move _gssapi_wrap_size_arcfour here.
1088 * Makefile.am: Split all mech to diffrent mechsrc variables.
1090 * spnego/context_stubs.c: Make internal function static (and
1093 2006-10-01 Love Hörnquist Åstrand <lha@it.su.se>
1095 * krb5/inquire_cred.c: Fix "if (x) lock(y)" bug. From Harald
1098 * spnego/spnego_locl.h: Include <sys/param.h> for MAXHOSTNAMELEN.
1100 2006-09-25 Love Hörnquist Åstrand <lha@it.su.se>
1102 * krb5/arcfour.c: Add wrap support, interrop with itself but not
1105 * krb5/gsskrb5_locl.h: move the arcfour specific stuff to the
1108 * krb5/arcfour.c: Support DCE-style unwrap, tested with
1111 * mech/gss_accept_sec_context.c (gss_accept_sec_context): if the
1112 token doesn't start with [APPLICATION 0] SEQUENCE, lets assume its
1113 a DCE-style kerberos 5 connection. XXX this needs to be made
1114 better in cause we get another GSS-API protocol violating
1115 protocol. It should be possible to detach the Kerberos DCE-style
1116 since it starts with a AP-REQ PDU, but that have to wait for now.
1118 2006-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1120 * gssapi.h: Add GSS_C flags from
1121 draft-brezak-win2k-krb-rc4-hmac-04.txt.
1123 * krb5/delete_sec_context.c: Free service_keyblock and fwd_data,
1126 * krb5/accept_sec_context.c: Merge of the acceptor part from the
1127 samba patch by Stefan Metzmacher and Andrew Bartlet.
1129 * krb5/init_sec_context.c: Add GSS_C_DCE_STYLE.
1131 * krb5/{init_sec_context.c,gsskrb5_locl.h}: merge most of the
1132 initiator part from the samba patch by Stefan Metzmacher and
1133 Andrew Bartlet (still missing DCE/RPC support)
1135 2006-08-28 Love Hörnquist Åstrand <lha@it.su.se>
1137 * gss.c (help): use sl_slc_help().
1139 2006-07-22 Love Hörnquist Åstrand <lha@it.su.se>
1141 * gss-commands.in: rename command to supported-mechanisms
1143 * Makefile.am: Make gss objects depend on the slc built
1146 2006-07-20 Love Hörnquist Åstrand <lha@it.su.se>
1148 * gss-commands.in: add slc commands for gss
1150 * krb5/gsskrb5_locl.h: Remove dup prototype of _gsskrb5_init()
1152 * Makefile.am: Add test_cfx
1154 * krb5/external.c: add GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1156 * krb5/set_sec_context_option.c: catch
1157 GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1159 * krb5/accept_sec_context.c: reimplement
1160 gsskrb5_register_acceptor_identity
1162 * mech/gss_krb5.c: implement gsskrb5_register_acceptor_identity
1164 * mech/gss_inquire_mechs_for_name.c: call _gss_load_mech
1166 * mech/gss_inquire_cred.c (gss_inquire_cred): call _gss_load_mech
1168 * mech/gss_mech_switch.c: Make _gss_load_mech() atomic and run
1169 only once, this have the side effect that _gss_mechs and
1170 _gss_mech_oids is only initialized once, so if just the users of
1171 these two global variables calls _gss_load_mech() first, it will
1172 act as a barrier and make sure the variables are never changed and
1173 we don't need to lock them.
1175 * mech/utils.h: no need to mark functions extern.
1177 * mech/name.h: no need to mark _gss_find_mn extern.
1179 2006-07-19 Love Hörnquist Åstrand <lha@it.su.se>
1181 * krb5/cfx.c: Redo the wrap length calculations.
1183 * krb5/test_cfx.c: test max_wrap_size in cfx.c
1185 * mech/gss_display_status.c: Handle more error codes.
1187 2006-07-07 Love Hörnquist Åstrand <lha@it.su.se>
1189 * mech/mech_locl.h: Include <krb5-types.h> and "mechqueue.h"
1191 * mech/mechqueue.h: Add SLIST macros.
1193 * krb5/inquire_context.c: Don't free return values on success.
1195 * krb5/inquire_cred.c (_gsskrb5_inquire_cred): When cred provided
1196 is the default cred, acquire the acceptor cred and initator cred
1197 in two diffrent steps and then query them for the information,
1198 this way, the code wont fail if there are no keytab, but there is
1201 * mech/gss_inquire_cred.c: move the check if we found any cred
1202 where it matter for both cases
1203 (default cred and provided cred)
1205 * mech/gss_init_sec_context.c: If the desired mechanism can't
1206 convert the name to a MN, fail with GSS_S_BAD_NAME rather then a
1209 2006-07-06 Love Hörnquist Åstrand <lha@it.su.se>
1211 * spnego/external.c: readd gss_spnego_inquire_names_for_mech
1213 * spnego/spnego_locl.h: reimplement
1214 gss_spnego_inquire_names_for_mech add support function
1215 _gss_spnego_supported_mechs
1217 * spnego/context_stubs.h: reimplement
1218 gss_spnego_inquire_names_for_mech add support function
1219 _gss_spnego_supported_mechs
1221 * spnego/context_stubs.c: drop gss_spnego_indicate_mechs
1223 * mech/gss_indicate_mechs.c: if the underlaying mech doesn't
1224 support gss_indicate_mechs, use the oid in the mechswitch
1227 * spnego/external.c: let the mech glue layer implement
1230 * spnego/cred_stubs.c (gss_spnego_acquire_cred): don't care about
1231 desired_mechs, get our own list with indicate_mechs and remove
1234 2006-07-05 Love Hörnquist Åstrand <lha@it.su.se>
1236 * spnego/external.c: remove gss_spnego_inquire_names_for_mech, let
1237 the mechglue layer implement it
1239 * spnego/context_stubs.c: remove gss_spnego_inquire_names_for_mech, let
1240 the mechglue layer implement it
1242 * spnego/spnego_locl.c: remove gss_spnego_inquire_names_for_mech, let
1243 the mechglue layer implement it
1245 2006-07-01 Love Hörnquist Åstrand <lha@it.su.se>
1247 * mech/gss_set_cred_option.c: fix argument to gss_release_cred
1249 2006-06-30 Love Hörnquist Åstrand <lha@it.su.se>
1251 * krb5/init_sec_context.c: Make work on compilers that are
1252 somewhat more picky then gcc4 (like gcc2.95)
1254 * krb5/init_sec_context.c (do_delegation): use KDCOptions2int to
1255 convert fwd_flags to an integer, since otherwise int2KDCOptions in
1256 krb5_get_forwarded_creds wont do the right thing.
1258 * mech/gss_set_cred_option.c (gss_set_cred_option): free memory on
1261 * krb5/set_sec_context_option.c (_gsskrb5_set_sec_context_option):
1262 init global kerberos context
1264 * krb5/set_cred_option.c (_gsskrb5_set_cred_option): init global
1267 * mech/gss_accept_sec_context.c: Insert the delegated sub cred on
1268 the delegated cred handle, not cred handle
1270 * mech/gss_accept_sec_context.c (gss_accept_sec_context): handle
1271 the case where ret_flags == NULL
1273 * mech/gss_mech_switch.c (add_builtin): set
1274 _gss_mech_switch->gm_mech_oid
1276 * mech/gss_set_cred_option.c (gss_set_cred_option): laod mechs
1278 * test_cred.c (gss_print_errors): don't try to print error when
1279 gss_display_status failed
1281 * Makefile.am: Add mech/gss_release_oid.c
1283 * mech/gss_release_oid.c: Add gss_release_oid, reverse of
1286 * spnego/compat.c: preferred_mech_type was allocated with
1287 gss_duplicate_oid in one place and assigned static varianbles a
1288 the second place. change that static assignement to
1289 gss_duplicate_oid and bring back gss_release_oid.
1291 * spnego/compat.c (_gss_spnego_delete_sec_context): don't release
1292 preferred_mech_type and negotiated_mech_type, they where never
1293 allocated from the begining.
1295 2006-06-29 Love Hörnquist Åstrand <lha@it.su.se>
1297 * mech/gss_import_name.c (gss_import_name): avoid
1298 type-punned/strict aliasing rules
1300 * mech/gss_add_cred.c: avoid type-punned/strict aliasing rules
1302 * gssapi.h: Make gss_name_t an opaque type.
1304 * krb5: make gss_name_t an opaque type
1306 * krb5/set_cred_option.c: Add
1308 * mech/gss_set_cred_option.c (gss_set_cred_option): support the
1309 case where *cred_handle == NULL
1311 * mech/gss_krb5.c (gss_krb5_import_cred): make sure cred is
1312 GSS_C_NO_CREDENTIAL on failure.
1314 * mech/gss_acquire_cred.c (gss_acquire_cred): if desired_mechs is
1315 NO_OID_SET, there is a need to load the mechs, so always do that.
1317 2006-06-28 Love Hörnquist Åstrand <lha@it.su.se>
1319 * krb5/inquire_cred_by_oid.c: Reimplement GSS_KRB5_COPY_CCACHE_X
1320 to instead pass a fullname to the credential, then resolve and
1321 copy out the content, and then close the cred.
1323 * mech/gss_krb5.c: Reimplement GSS_KRB5_COPY_CCACHE_X to instead
1324 pass a fullname to the credential, then resolve and copy out the
1325 content, and then close the cred.
1327 * krb5/inquire_cred_by_oid.c: make "work", GSS_KRB5_COPY_CCACHE_X
1328 interface needs to be re-done, currently its utterly broken.
1330 * mech/gss_set_cred_option.c: Make work.
1332 * krb5/external.c: Add _gsskrb5_set_{sec_context,cred}_option
1334 * mech/gss_krb5.c (gss_krb5_import_cred): implement
1336 * Makefile.am: Add gss_set_{sec_context,cred}_option and sort
1338 * mech/gss_set_{sec_context,cred}_option.c: add
1340 * gssapi.h: Add GSS_KRB5_IMPORT_CRED_X
1342 * test_*.c: make compile again
1344 * Makefile.am: Add lib dependencies and test programs
1346 * spnego: remove dependency on libkrb5
1348 * mech: Bug fixes, cleanup, compiler warnings, restructure code.
1350 * spnego: Rename gss_context_id_t and gss_cred_id_t to local names
1352 * krb5: repro copy the krb5 files here
1354 * mech: import Doug Rabson mechglue from freebsd
1356 * spnego: Import Luke Howard's SPNEGO from the mechglue branch
1358 2006-06-22 Love Hörnquist Åstrand <lha@it.su.se>
1360 * gssapi.h: Add oid_to_str.
1362 * Makefile.am: add oid_to_str and test_oid
1364 * oid_to_str.c: Add gss_oid_to_str
1366 * test_oid.c: Add test for gss_oid_to_str()
1368 2006-05-13 Love Hörnquist Åstrand <lha@it.su.se>
1370 * verify_mic.c: Less pointer signedness warnings.
1372 * unwrap.c: Less pointer signedness warnings.
1374 * arcfour.c: Less pointer signedness warnings.
1376 * gssapi_locl.h: Use const void * to instead of unsigned char * to
1377 avoid pointer signedness warnings.
1379 * encapsulate.c: Use const void * to instead of unsigned char * to
1380 avoid pointer signedness warnings.
1382 * decapsulate.c: Use const void * to instead of unsigned char * to
1383 avoid pointer signedness warnings.
1385 * decapsulate.c: Less pointer signedness warnings.
1387 * cfx.c: Less pointer signedness warnings.
1389 * init_sec_context.c: Less pointer signedness warnings (partly by
1390 using the new asn.1 CHOICE decoder)
1392 * import_sec_context.c: Less pointer signedness warnings.
1394 2006-05-09 Love Hörnquist Åstrand <lha@it.su.se>
1396 * accept_sec_context.c (gsskrb5_is_cfx): always set is_cfx. From
1399 2006-05-08 Love Hörnquist Åstrand <lha@it.su.se>
1401 * get_mic.c (mic_des3): make sure message_buffer doesn't point to
1402 free()ed memory on failure. Pointed out by IBM checker.
1404 2006-05-05 Love Hörnquist Åstrand <lha@it.su.se>
1406 * Rename u_intXX_t to uintXX_t
1408 2006-05-04 Love Hörnquist Åstrand <lha@it.su.se>
1410 * cfx.c: Less pointer signedness warnings.
1412 * arcfour.c: Avoid pointer signedness warnings.
1414 * gssapi_locl.h (gssapi_decode_*): make data argument const void *
1416 * 8003.c (gssapi_decode_*): make data argument const void *
1418 2006-04-12 Love Hörnquist Åstrand <lha@it.su.se>
1420 * export_sec_context.c: Export sequence order element. From Wynn
1421 Wilkes <wynn.wilkes@quest.com>.
1423 * import_sec_context.c: Import sequence order element. From Wynn
1424 Wilkes <wynn.wilkes@quest.com>.
1426 * sequence.c (_gssapi_msg_order_import,_gssapi_msg_order_export):
1427 New functions, used by {import,export}_sec_context. From Wynn
1428 Wilkes <wynn.wilkes@quest.com>.
1430 * test_sequence.c: Add test for import/export sequence.
1432 2006-04-09 Love Hörnquist Åstrand <lha@it.su.se>
1434 * add_cred.c: Check that cred != GSS_C_NO_CREDENTIAL, this is a
1435 standard conformance failure, but much better then a crash.
1437 2006-04-02 Love Hörnquist Åstrand <lha@it.su.se>
1439 * get_mic.c (get_mic*)_: make sure message_token is cleaned on
1440 error, found by IBM checker.
1442 * wrap.c (wrap*): Reset output_buffer on error, found by IBM
1445 2006-02-15 Love Hörnquist Åstrand <lha@it.su.se>
1447 * import_name.c: Accept both GSS_C_NT_HOSTBASED_SERVICE and
1448 GSS_C_NT_HOSTBASED_SERVICE_X as nametype for hostbased names.
1450 2006-01-16 Love Hörnquist Åstrand <lha@it.su.se>
1452 * delete_sec_context.c (gss_delete_sec_context): if the context
1453 handle is GSS_C_NO_CONTEXT, don't fall over.
1455 2005-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1457 * gss_acquire_cred.3: Replace gss_krb5_import_ccache with
1458 gss_krb5_import_cred and add more references
1460 2005-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1462 * gssapi.h: Change gss_krb5_import_ccache to gss_krb5_import_cred,
1463 it can handle keytabs too.
1465 * add_cred.c (gss_add_cred): avoid deadlock
1467 * context_time.c (gssapi_lifetime_left): define the 0 lifetime as
1470 2005-12-01 Love Hörnquist Åstrand <lha@it.su.se>
1472 * acquire_cred.c (acquire_acceptor_cred): only check if principal
1473 exists if we got called with principal as an argument.
1475 * acquire_cred.c (acquire_acceptor_cred): check that the acceptor
1476 exists in the keytab before returning ok.
1478 2005-11-29 Love Hörnquist Åstrand <lha@it.su.se>
1480 * copy_ccache.c (gss_krb5_import_cred): fix buglet, from Andrew
1483 2005-11-25 Love Hörnquist Åstrand <lha@it.su.se>
1485 * test_kcred.c: Rename gss_krb5_import_ccache to
1486 gss_krb5_import_cred.
1488 * copy_ccache.c: Rename gss_krb5_import_ccache to
1489 gss_krb5_import_cred and let it grow code to handle keytabs too.
1491 2005-11-02 Love Hörnquist Åstrand <lha@it.su.se>
1493 * init_sec_context.c: Change sematics of ok-as-delegate to match
1495 [gssapi]realm/ok-as-delegate=true is set, otherwise keep old
1498 * release_cred.c (gss_release_cred): use
1499 GSS_CF_DESTROY_CRED_ON_RELEASE to decide if the cache should be
1502 * acquire_cred.c (acquire_initiator_cred):
1503 GSS_CF_DESTROY_CRED_ON_RELEASE on created credentials.
1505 * accept_sec_context.c (gsskrb5_accept_delegated_token): rewrite
1506 to use gss_krb5_import_ccache
1508 2005-11-01 Love Hörnquist Åstrand <lha@it.su.se>
1510 * arcfour.c: Remove signedness warnings.
1512 2005-10-31 Love Hörnquist Åstrand <lha@it.su.se>
1514 * gss_acquire_cred.3: Document that gss_krb5_import_ccache is copy
1517 * copy_ccache.c (gss_krb5_import_ccache): Instead of making a copy
1518 of the ccache, make a reference by getting the name and resolving
1519 the name. This way the cache is shared, this flipp side is of
1520 course that if someone calls krb5_cc_destroy the cache is lost for
1523 * test_kcred.c: Remove memory leaks.
1525 2005-10-26 Love Hörnquist Åstrand <lha@it.su.se>
1527 * Makefile.am: build test_kcred
1529 * gss_acquire_cred.3: Document gss_krb5_import_ccache
1531 * gssapi.3: Sort and add gss_krb5_import_ccache.
1533 * acquire_cred.c (_gssapi_krb5_ccache_lifetime): break out code
1534 used to extract lifetime from a credential cache
1536 * gssapi_locl.h: Add _gssapi_krb5_ccache_lifetime, used to extract
1537 lifetime from a credential cache.
1539 * gssapi.h: add gss_krb5_import_ccache, reverse of
1540 gss_krb5_copy_ccache
1542 * copy_ccache.c: add gss_krb5_import_ccache, reverse of
1543 gss_krb5_copy_ccache
1545 * test_kcred.c: test gss_krb5_import_ccache
1547 2005-10-21 Love Hörnquist Åstrand <lha@it.su.se>
1549 * acquire_cred.c (acquire_initiator_cred): use krb5_cc_cache_match
1550 to find a matching creditial cache, if that failes, fallback to
1553 2005-10-12 Love Hörnquist Åstrand <lha@it.su.se>
1555 * gssapi_locl.h: Add gssapi_krb5_set_status and
1556 gssapi_krb5_clear_status
1558 * init_sec_context.c (spnego_reply): Don't pass back raw Kerberos
1559 errors, use GSS-API errors instead. From Michael B Allen.
1561 * display_status.c: Add gssapi_krb5_clear_status,
1562 gssapi_krb5_set_status for handling error messages.
1564 2005-08-23 Love Hörnquist Åstrand <lha@it.su.se>
1566 * external.c: Use rk_UNCONST to avoid const warning.
1568 * display_status.c: Constify strings to avoid warnings.
1570 2005-08-11 Love Hörnquist Åstrand <lha@it.su.se>
1572 * init_sec_context.c: avoid warnings, update (c)
1574 2005-07-13 Love Hörnquist Åstrand <lha@it.su.se>
1576 * init_sec_context.c (spnego_initial): use NegotiationToken
1577 encoder now that we have one with the new asn1. compiler.
1579 * Makefile.am: the new asn.1 compiler includes the modules name in
1582 2005-06-16 Love Hörnquist Åstrand <lha@it.su.se>
1584 * decapsulate.c: use rk_UNCONST
1586 * ccache_name.c: rename to avoid shadowing
1588 * gssapi_locl.h: give kret in GSSAPI_KRB5_INIT a more unique name
1590 * process_context_token.c: use rk_UNCONST to unconstify
1592 * test_cred.c: rename optind to optidx
1594 2005-05-30 Love Hörnquist Åstrand <lha@it.su.se>
1596 * init_sec_context.c (init_auth): honor ok-as-delegate if local
1597 configuration approves
1599 * gssapi_locl.h: prototype for _gss_check_compat
1601 * compat.c: export check_compat as _gss_check_compat
1603 2005-05-29 Love Hörnquist Åstrand <lha@it.su.se>
1605 * init_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1606 problems with system headerfiles that pollute the name space.
1608 * accept_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1609 problems with system headerfiles that pollute the name space.
1611 2005-05-17 Love Hörnquist Åstrand <lha@it.su.se>
1613 * init_sec_context.c (init_auth): set
1614 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED (for java compatibility),
1615 also while here, use krb5_auth_con_addflags
1617 2005-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1619 * arcfour.c (_gssapi_wrap_arcfour): fix calculating the encap
1620 length. From: Tom Maher <tmaher@eecs.berkeley.edu>
1622 2005-05-02 Dave Love <fx@gnu.org>
1624 * test_cred.c (main): Call setprogname.
1626 2005-04-27 Love Hörnquist Åstrand <lha@it.su.se>
1628 * prefix all sequence symbols with _, they are not part of the
1629 GSS-API api. By comment from Wynn Wilkes <wynnw@vintela.com>
1631 2005-04-10 Love Hörnquist Åstrand <lha@it.su.se>
1633 * accept_sec_context.c: break out the processing of the delegated
1634 credential to a separate function to make error handling easier,
1635 move the credential handling to after other setup is done
1637 * test_sequence.c: make less verbose in case of success
1639 * Makefile.am: add test_sequence to TESTS
1641 2005-04-01 Love Hörnquist Åstrand <lha@it.su.se>
1643 * 8003.c (gssapi_krb5_verify_8003_checksum): check that cksum
1644 isn't NULL From: Nicolas Pouvesle <npouvesle@tenablesecurity.com>
1646 2005-03-21 Love Hörnquist Åstrand <lha@it.su.se>
1648 * Makefile.am: use $(LIB_roken)
1650 2005-03-16 Love Hörnquist Åstrand <lha@it.su.se>
1652 * display_status.c (gssapi_krb5_set_error_string): pass in the
1653 krb5_context to krb5_free_error_string
1655 2005-03-15 Love Hörnquist Åstrand <lha@it.su.se>
1657 * display_status.c (gssapi_krb5_set_error_string): don't misuse
1658 the krb5_get_error_string api
1660 2005-03-01 Love Hörnquist Åstrand <lha@it.su.se>
1662 * compat.c (_gss_DES3_get_mic_compat): don't unlock mutex
1663 here. Bug reported by Stefan Metzmacher <metze@samba.org>
1665 2005-02-21 Luke Howard <lukeh@padl.com>
1667 * init_sec_context.c: don't call krb5_get_credentials() with
1668 KRB5_TC_MATCH_KEYTYPE, it can lead to the credentials cache
1669 growing indefinitely as no key is found with KEYTYPE_NULL
1671 * compat.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG, it is
1672 no longer used (however the mechListMIC behaviour is broken,
1673 rfc2478bis support requires the code in the mechglue branch)
1675 * init_sec_context.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1677 * gssapi.h: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1679 2005-01-05 Luke Howard <lukeh@padl.com>
1681 * 8003.c: use symbolic name for checksum type
1683 * accept_sec_context.c: allow client to indicate
1684 that subkey should be used
1686 * acquire_cred.c: plug leak
1688 * get_mic.c: use gss_krb5_get_subkey() instead
1689 of gss_krb5_get_{local,remote}key(), support
1692 * gssapi_local.c: use gss_krb5_get_subkey(),
1693 support KEYTYPE_ARCFOUR_56
1695 * import_sec_context.c: plug leak
1697 * unwrap.c: use gss_krb5_get_subkey(),
1698 support KEYTYPE_ARCFOUR_56
1700 * verify_mic.c: use gss_krb5_get_subkey(),
1701 support KEYTYPE_ARCFOUR_56
1703 * wrap.c: use gss_krb5_get_subkey(),
1704 support KEYTYPE_ARCFOUR_56
1706 2004-11-30 Love Hörnquist Åstrand <lha@it.su.se>
1708 * inquire_cred.c: Reverse order of HEIMDAL_MUTEX_unlock and
1709 gss_release_cred to avoid deadlock, from Luke Howard
1712 2004-09-06 Love Hörnquist Åstrand <lha@it.su.se>
1714 * gss_acquire_cred.3: gss_krb5_extract_authz_data_from_sec_context
1715 was renamed to gsskrb5_extract_authz_data_from_sec_context
1717 2004-08-07 Love Hörnquist Åstrand <lha@it.su.se>
1719 * unwrap.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1721 * arcfour.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1723 2004-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1725 * gssapi.3: spelling from Josef El-Rayes <josef@FreeBSD.org> while
1726 here, write some text about the SPNEGO situation
1728 2004-04-08 Love Hörnquist Åstrand <lha@it.su.se>
1730 * cfx.c: s/CTXAcceptorSubkey/CFXAcceptorSubkey/
1732 2004-04-07 Love Hörnquist Åstrand <lha@it.su.se>
1734 * gssapi.h: add GSS_C_EXPECTING_MECH_LIST_MIC_FLAG From: Luke
1735 Howard <lukeh@padl.com>
1737 * init_sec_context.c (spnego_reply): use
1738 _gss_spnego_require_mechlist_mic to figure out if we need to check
1739 MechListMIC; From: Luke Howard <lukeh@padl.com>
1741 * accept_sec_context.c (send_accept): use
1742 _gss_spnego_require_mechlist_mic to figure out if we need to send
1743 MechListMIC; From: Luke Howard <lukeh@padl.com>
1745 * gssapi_locl.h: add _gss_spnego_require_mechlist_mic
1746 From: Luke Howard <lukeh@padl.com>
1748 * compat.c: add _gss_spnego_require_mechlist_mic for compatibility
1749 with MS SPNEGO, From: Luke Howard <lukeh@padl.com>
1751 2004-04-05 Love Hörnquist Åstrand <lha@it.su.se>
1753 * accept_sec_context.c (gsskrb5_is_cfx): krb5_keyblock->keytype is
1754 an enctype, not keytype
1756 * accept_sec_context.c: use ASN1_MALLOC_ENCODE
1758 * init_sec_context.c: avoid the malloc loop and just allocate the
1759 propper amount of data
1761 * init_sec_context.c (spnego_initial): handle mech_token better
1763 2004-03-19 Love Hörnquist Åstrand <lha@it.su.se>
1765 * gssapi.h: add gss_krb5_get_tkt_flags
1767 * Makefile.am: add ticket_flags.c
1769 * ticket_flags.c: Get ticket-flags from acceptor ticket From: Luke
1770 Howard <lukeh@PADL.COM>
1772 * gss_acquire_cred.3: document gss_krb5_get_tkt_flags
1774 2004-03-14 Love Hörnquist Åstrand <lha@it.su.se>
1776 * acquire_cred.c (gss_acquire_cred): check usage before even
1777 bothering to process it, add both keytab and initial tgt if
1780 * wrap.c: support cfx, try to handle acceptor asserted subkey
1782 * unwrap.c: support cfx, try to handle acceptor asserted subkey
1784 * verify_mic.c: support cfx
1786 * get_mic.c: support cfx
1788 * test_sequence.c: handle changed signature of
1789 gssapi_msg_order_create
1791 * import_sec_context.c: handle acceptor asserted subkey
1793 * init_sec_context.c: handle acceptor asserted subkey
1795 * accept_sec_context.c: handle acceptor asserted subkey
1797 * sequence.c: add dummy use_64 argument to gssapi_msg_order_create
1799 * gssapi_locl.h: add partial support for CFX
1801 * Makefile.am (noinst_PROGRAMS) += test_cred
1803 * test_cred.c: gssapi credential testing
1805 * test_acquire_cred.c: fix comment
1807 2004-03-07 Love Hörnquist Åstrand <lha@it.su.se>
1809 * arcfour.h: drop structures for message formats, no longer used
1811 * arcfour.c: comment describing message formats
1813 * accept_sec_context.c (spnego_accept_sec_context): make sure the
1814 length of the choice element doesn't overrun us
1816 * init_sec_context.c (spnego_reply): make sure the length of the
1817 choice element doesn't overrun us
1819 * spnego.asn1: move NegotiationToken to avoid warning
1821 * spnego.asn1: uncomment NegotiationToken
1823 * Makefile.am: spnego_files += asn1_NegotiationToken.x
1825 2004-01-25 Love Hörnquist Åstrand <lha@it.su.se>
1827 * gssapi.h: add gss_krb5_ccache_name
1829 * Makefile.am (libgssapi_la_SOURCES): += ccache_name.c
1831 * ccache_name.c (gss_krb5_ccache_name): help function enable to
1832 set krb5 name, using out_name argument makes function no longer
1835 * gssapi.3: add missing gss_krb5_ references
1837 * gss_acquire_cred.3: document gss_krb5_ccache_name
1839 2003-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1841 * cfx.c: make rrc a modulus operation if its longer then the
1842 length of the message, noticed by Sam Hartman
1844 2003-12-07 Love Hörnquist Åstrand <lha@it.su.se>
1846 * accept_sec_context.c: use krb5_auth_con_addflags
1848 2003-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1850 * cfx.c: Wrap token id was in wrong order, found by Sam Hartman
1852 2003-12-04 Love Hörnquist Åstrand <lha@it.su.se>
1854 * cfx.c: add AcceptorSubkey (but no code understand it yet) ignore
1857 2003-11-22 Love Hörnquist Åstrand <lha@it.su.se>
1859 * accept_sec_context.c: Don't require timestamp to be set on
1860 delegated token, its already protected by the outer token (and
1861 windows doesn't alway send it) Pointed out by Zi-Bin Yang
1862 <zbyang@decru.com> on heimdal-discuss
1864 2003-11-14 Love Hörnquist Åstrand <lha@it.su.se>
1866 * cfx.c: fix {} error, pointed out by Liqiang Zhu
1868 2003-11-10 Love Hörnquist Åstrand <lha@it.su.se>
1870 * cfx.c: Sequence number should be stored in bigendian order From:
1871 Luke Howard <lukeh@padl.com>
1873 2003-11-09 Love Hörnquist Åstrand <lha@it.su.se>
1875 * delete_sec_context.c (gss_delete_sec_context): don't free
1876 ticket, krb5_free_ticket does that now
1878 2003-11-06 Love Hörnquist Åstrand <lha@it.su.se>
1880 * cfx.c: checksum the header last in MIC token, update to -03
1881 From: Luke Howard <lukeh@padl.com>
1883 2003-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1885 * add_cred.c: If its a MEMORY cc, make a copy. We need to do this
1886 since now gss_release_cred will destroy the cred. This should be
1887 really be solved a better way.
1889 * acquire_cred.c (gss_release_cred): if its a mcc, destroy it
1890 rather the just release it Found by: "Zi-Bin Yang"
1893 * acquire_cred.c (acquire_initiator_cred): use kret instead of ret
1896 2003-09-30 Love Hörnquist Åstrand <lha@it.su.se>
1898 * gss_acquire_cred.3: spelling
1899 From: jmc <jmc@prioris.mini.pw.edu.pl>
1901 2003-09-23 Love Hörnquist Åstrand <lha@it.su.se>
1903 * cfx.c: - EC and RRC are big-endian, not little-endian - The
1904 default is now to rotate regardless of GSS_C_DCE_STYLE. There are
1905 no longer any references to GSS_C_DCE_STYLE. - rrc_rotate()
1906 avoids allocating memory on the heap if rrc <= 256
1907 From: Luke Howard <lukeh@padl.com>
1909 2003-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1911 * cfx.[ch]: rrc_rotate() was untested and broken, fix it.
1912 Set and verify wrap Token->Filler.
1913 Correct token ID for wrap tokens,
1914 were accidentally swapped with delete tokens.
1915 From: Luke Howard <lukeh@PADL.COM>
1917 2003-09-21 Love Hörnquist Åstrand <lha@it.su.se>
1919 * cfx.[ch]: no ASN.1-ish header on per-message tokens
1920 From: Luke Howard <lukeh@PADL.COM>
1922 2003-09-19 Love Hörnquist Åstrand <lha@it.su.se>
1924 * arcfour.h: remove depenency on gss_arcfour_mic_token and
1925 gss_arcfour_warp_token
1927 * arcfour.c: remove depenency on gss_arcfour_mic_token and
1928 gss_arcfour_warp_token
1930 2003-09-18 Love Hörnquist Åstrand <lha@it.su.se>
1932 * 8003.c: remove #if 0'ed code
1934 2003-09-17 Love Hörnquist Åstrand <lha@it.su.se>
1936 * accept_sec_context.c (gsskrb5_accept_sec_context): set sequence
1937 number when not requesting mutual auth From: Luke Howard
1940 * init_sec_context.c (init_auth): set sequence number when not
1941 requesting mutual auth From: Luke Howard <lukeh@PADL.COM>
1943 2003-09-16 Love Hörnquist Åstrand <lha@it.su.se>
1945 * arcfour.c (*): set minor_status
1946 (gss_wrap): set conf_state to conf_req_flags on success
1947 From: Luke Howard <lukeh@PADL.COM>
1949 * wrap.c (gss_wrap_size_limit): use existing function From: Luke
1950 Howard <lukeh@PADL.COM>
1952 2003-09-12 Love Hörnquist Åstrand <lha@it.su.se>
1954 * indicate_mechs.c (gss_indicate_mechs): in case of error, free
1957 * indicate_mechs.c (gss_indicate_mechs): add SPNEGO
1959 2003-09-10 Love Hörnquist Åstrand <lha@it.su.se>
1961 * init_sec_context.c (spnego_initial): catch errors and return
1964 * init_sec_context.c (spnego_initial): add #if 0 out version of
1965 the CHOICE branch encoding, also where here, free no longer used
1968 2003-09-09 Love Hörnquist Åstrand <lha@it.su.se>
1970 * gss_acquire_cred.3: support GSS_SPNEGO_MECHANISM
1972 * accept_sec_context.c: SPNEGO doesn't include gss wrapping on
1973 SubsequentContextToken like the Kerberos 5 mech does.
1975 * init_sec_context.c (spnego_reply): SPNEGO doesn't include gss
1976 wrapping on SubsequentContextToken like the Kerberos 5 mech
1977 does. Lets check for it anyway.
1979 * accept_sec_context.c: Add support for SPNEGO on the initator
1980 side. Implementation initially from Assar Westerlund, passes
1981 though quite a lot of hands before I commited it.
1983 * init_sec_context.c: Add support for SPNEGO on the initator side.
1984 Tested with ldap server on a Windows 2000 DC. Implementation
1985 initially from Assar Westerlund, passes though quite a lot of
1986 hands before I commited it.
1988 * gssapi.h: export GSS_SPNEGO_MECHANISM
1990 * gssapi_locl.h: include spnego_as.h add prototype for
1991 gssapi_krb5_get_mech
1993 * decapsulate.c (gssapi_krb5_get_mech): make non static
1995 * Makefile.am: build SPNEGO file
1997 2003-09-08 Love Hörnquist Åstrand <lha@it.su.se>
1999 * external.c: SPENGO and IAKERB oids
2001 * spnego.asn1: SPENGO ASN1
2003 2003-09-05 Love Hörnquist Åstrand <lha@it.su.se>
2005 * cfx.c: RRC also need to be zero before wraping them
2006 From: Luke Howard <lukeh@PADL.COM>
2008 2003-09-04 Love Hörnquist Åstrand <lha@it.su.se>
2010 * encapsulate.c (gssapi_krb5_encap_length): don't return void
2012 2003-09-03 Love Hörnquist Åstrand <lha@it.su.se>
2014 * verify_mic.c: switch from the des_ to the DES_ api
2016 * get_mic.c: switch from the des_ to the DES_ api
2018 * unwrap.c: switch from the des_ to the DES_ api
2020 * wrap.c: switch from the des_ to the DES_ api
2022 * cfx.c: EC is not included in the checksum since the length might
2023 change depending on the data. From: Luke Howard <lukeh@PADL.COM>
2025 * acquire_cred.c: use
2026 krb5_get_init_creds_opt_alloc/krb5_get_init_creds_opt_free
2028 2003-09-01 Love Hörnquist Åstrand <lha@it.su.se>
2030 * copy_ccache.c: rename
2031 gss_krb5_extract_authz_data_from_sec_context to
2032 gsskrb5_extract_authz_data_from_sec_context
2034 * gssapi.h: rename gss_krb5_extract_authz_data_from_sec_context to
2035 gsskrb5_extract_authz_data_from_sec_context
2037 2003-08-31 Love Hörnquist Åstrand <lha@it.su.se>
2039 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2040 check that we have a ticket before we start to use it
2042 * gss_acquire_cred.3: document
2043 gss_krb5_extract_authz_data_from_sec_context
2045 * gssapi.h (gss_krb5_extract_authz_data_from_sec_context):
2046 return the kerberos authorizationdata, from idea of Luke Howard
2048 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2049 return the kerberos authorizationdata, from idea of Luke Howard
2051 * verify_mic.c (gss_verify_mic_internal): switch type and key
2054 2003-08-30 Love Hörnquist Åstrand <lha@it.su.se>
2056 * cfx.[ch]: draft-ietf-krb-wg-gssapi-cfx-01.txt implemetation
2057 From: Luke Howard <lukeh@PADL.COM>
2059 2003-08-28 Love Hörnquist Åstrand <lha@it.su.se>
2061 * arcfour.c (arcfour_mic_cksum): use free_Checksum to free the
2064 * arcfour.h: swap two last arguments to verify_mic for consistency
2067 * wrap.c,unwrap.c,get_mic.c,verify_mic.c,cfx.c,cfx.h:
2068 prefix cfx symbols with _gssapi_
2070 * arcfour.c: release the right buffer
2072 * arcfour.c: rename token structure in consistency with rest of
2073 GSS-API From: Luke Howard <lukeh@PADL.COM>
2075 * unwrap.c (unwrap_des3): use _gssapi_verify_pad
2076 (unwrap_des): use _gssapi_verify_pad
2078 * arcfour.c (_gssapi_wrap_arcfour): set the correct padding
2079 (_gssapi_unwrap_arcfour): verify and strip padding
2081 * gssapi_locl.h: added _gssapi_verify_pad
2083 * decapsulate.c (_gssapi_verify_pad): verify padding of a gss
2084 wrapped message and return its length
2086 * arcfour.c: support KEYTYPE_ARCFOUR_56 keys, from Luke Howard
2089 * arcfour.c: use right seal alg, inherit keytype from parent key
2091 * arcfour.c: include the confounder in the checksum use the right
2092 key usage number for warped/unwraped tokens
2094 * gssapi.h: add gss_krb5_nt_general_name as an mit compat glue
2095 (same as GSS_KRB5_NT_PRINCIPAL_NAME)
2097 * unwrap.c: hook in arcfour unwrap
2099 * wrap.c: hook in arcfour wrap
2101 * verify_mic.c: hook in arcfour verify_mic
2103 * get_mic.c: hook in arcfour get_mic
2105 * arcfour.c: implement wrap/unwarp
2107 * gssapi_locl.h: add gssapi_{en,de}code_be_om_uint32
2109 * 8003.c: add gssapi_{en,de}code_be_om_uint32
2111 2003-08-27 Love Hörnquist Åstrand <lha@it.su.se>
2113 * arcfour.c (_gssapi_verify_mic_arcfour): Do the checksum on right
2114 area. Swap filler check, it was reversed.
2116 * Makefile.am (libgssapi_la_SOURCES): += arcfour.c
2118 * gssapi_locl.h: include "arcfour.h"
2120 * arcfour.c: arcfour gss-api mech, get_mic/verify_mic working
2122 * arcfour.h: arcfour gss-api mech, get_mic/verify_mic working
2124 2003-08-26 Love Hörnquist Åstrand <lha@it.su.se>
2126 * gssapi_locl.h: always include cfx.h add prototype for
2129 * cfx.[ch]: Implementation of draft-ietf-krb-wg-gssapi-cfx-00.txt
2130 from Luke Howard <lukeh@PADL.COM>
2132 * decapsulate.c: add _gssapi_decapsulate, from Luke Howard
2135 2003-08-25 Love Hörnquist Åstrand <lha@it.su.se>
2137 * unwrap.c: encap/decap now takes a oid if the enctype/keytype is
2138 arcfour, return error add hook for cfx
2140 * verify_mic.c: encap/decap now takes a oid if the enctype/keytype
2141 is arcfour, return error add hook for cfx
2143 * get_mic.c: encap/decap now takes a oid if the enctype/keytype is
2144 arcfour, return error add hook for cfx
2146 * accept_sec_context.c: encap/decap now takes a oid
2148 * init_sec_context.c: encap/decap now takes a oid
2150 * gssapi_locl.h: include cfx.h if we need it lifetime is a
2151 OM_uint32, depend on gssapi interface add all new encap/decap
2154 * decapsulate.c: add decap functions that doesn't take the token
2155 type also make all decap function take the oid mech that they
2158 * encapsulate.c: add encap functions that doesn't take the token
2159 type also make all encap function take the oid mech that they
2162 * sequence.c (elem_insert): fix a off by one index counter
2164 * inquire_cred.c (gss_inquire_cred): handle cred_handle being
2165 GSS_C_NO_CREDENTIAL and use the default cred then.
2167 2003-08-19 Love Hörnquist Åstrand <lha@it.su.se>
2169 * gss_acquire_cred.3: break out extensions and document
2170 gsskrb5_register_acceptor_identity
2172 2003-08-18 Love Hörnquist Åstrand <lha@it.su.se>
2174 * test_acquire_cred.c (print_time): time is returned in seconds
2175 from now, not unix time
2177 2003-08-17 Love Hörnquist Åstrand <lha@it.su.se>
2179 * compat.c (check_compat): avoid leaking principal when finding a
2182 * address_to_krb5addr.c: sa_size argument to krb5_addr2sockaddr is
2185 * acquire_cred.c (gss_acquire_cred): 4th argument to
2186 gss_test_oid_set_member is a int
2188 2003-07-22 Love Hörnquist Åstrand <lha@it.su.se>
2190 * init_sec_context.c (repl_mutual): don't set kerberos error where
2191 there was no kerberos error
2193 * gssapi_locl.h: Add destruction/creation prototypes and structure
2194 for the thread specific storage.
2196 * display_status.c: use thread specific storage to set/get the
2197 kerberos error message
2199 * init.c: Provide locking around the creation of the global
2200 krb5_context. Add destruction/creation functions for the thread
2201 specific storage that the error string handling is using.
2203 2003-07-20 Love Hörnquist Åstrand <lha@it.su.se>
2205 * gss_acquire_cred.3: add missing prototype and missing .Ft
2208 2003-06-17 Love Hörnquist Åstrand <lha@it.su.se>
2210 * verify_mic.c: reorder code so sequence numbers can can be used
2212 * unwrap.c: reorder code so sequence numbers can can be used
2214 * sequence.c: remove unused function, indent, add
2215 gssapi_msg_order_f that filter gss flags to gss_msg_order flags
2217 * gssapi_locl.h: prototypes for
2218 gssapi_{encode_om_uint32,decode_om_uint32} add sequence number
2221 * delete_sec_context.c: destroy sequence number verifier
2223 * init_sec_context.c: remember to free data use sequence number
2226 * accept_sec_context.c: don't clear output_token twice remember to
2227 free data use sequence number verifier
2229 * 8003.c: export and rename encode_om_uint32/decode_om_uint32 and
2232 2003-06-09 Johan Danielsson <joda@pdc.kth.se>
2234 * Makefile.am: can't have sequence.c in two different places
2236 2003-06-06 Love Hörnquist Åstrand <lha@it.su.se>
2238 * test_sequence.c: check rollover, print summery
2240 * wrap.c (sub_wrap_size): gss_wrap_size_limit() has
2241 req_output_size and max_input_size around the wrong way -- it
2242 returns the output token size for a given input size, rather than
2243 the maximum input size for a given output token size.
2245 From: Luke Howard <lukeh@PADL.COM>
2247 2003-06-05 Love Hörnquist Åstrand <lha@it.su.se>
2249 * gssapi_locl.h: add prototypes for sequence.c
2251 * Makefile.am (libgssapi_la_SOURCES): add sequence.c
2252 (test_sequence): build
2254 * sequence.c: sequence number checks, order and replay
2255 * test_sequence.c: sequence number checks, order and replay
2257 2003-06-03 Love Hörnquist Åstrand <lha@it.su.se>
2259 * accept_sec_context.c (gss_accept_sec_context): make sure time is
2260 returned in seconds from now, not in kerberos time
2262 * acquire_cred.c (gss_aquire_cred): make sure time is returned in
2263 seconds from now, not in kerberos time
2265 * init_sec_context.c (init_auth): if the cred is expired before we
2266 tries to create a token, fail so the peer doesn't need reject us
2267 (*): make sure time is returned in seconds from now,
2268 not in kerberos time
2269 (repl_mutual): remember to unlock the context mutex
2271 * context_time.c (gss_context_time): remove unused variable
2273 * verify_mic.c: make sure minor_status is always set, pointed out
2274 by Luke Howard <lukeh@PADL.COM>
2276 2003-05-21 Love Hörnquist Åstrand <lha@it.su.se>
2278 * *.[ch]: do some basic locking (no reference counting so contexts
2279 can be removed while still used)
2280 - don't export gss_ctx_id_t_desc_struct and gss_cred_id_t_desc_struct
2281 - make sure all lifetime are returned in seconds left until expired,
2284 * gss_acquire_cred.3: document argument lifetime_rec to function
2287 2003-05-17 Love Hörnquist Åstrand <lha@it.su.se>
2289 * test_acquire_cred.c: test gss_add_cred more then once
2291 2003-05-06 Love Hörnquist Åstrand <lha@it.su.se>
2293 * gssapi.h: if __cplusplus, wrap the extern variable (just to be
2294 safe) and functions in extern "C" { }
2296 2003-04-30 Love Hörnquist Åstrand <lha@it.su.se>
2298 * gssapi.3: more about the des3 mic mess
2300 * verify_mic.c (verify_mic_des3): always check if the mic is the
2301 correct mic or the mic that old heimdal would have generated
2303 2003-04-28 Jacques Vidrine <nectar@kth.se>
2305 * verify_mic.c (verify_mic_des3): If MIC verification fails,
2306 retry using the `old' MIC computation (with zero IV).
2308 2003-04-26 Love Hörnquist Åstrand <lha@it.su.se>
2310 * gss_acquire_cred.3: more about difference between comparing IN
2313 * gss_acquire_cred.3: more about name type and access control
2315 2003-04-25 Love Hörnquist Åstrand <lha@it.su.se>
2317 * gss_acquire_cred.3: document gss_context_time
2319 * context_time.c: if lifetime of context have expired, set
2320 time_rec to 0 and return GSS_S_CONTEXT_EXPIRED
2322 * gssapi.3: document [gssapi]correct_des3_mic
2323 [gssapi]broken_des3_mic
2325 * gss_acquire_cred.3: document gss_krb5_compat_des3_mic
2327 * compat.c (gss_krb5_compat_des3_mic): enable turning on/off des3
2329 (_gss_DES3_get_mic_compat): handle [gssapi]correct_des3_mic too
2331 * gssapi.h (gss_krb5_compat_des3_mic): new function, turn on/off
2333 (GSS_C_KRB5_COMPAT_DES3_MIC): cpp symbol that exists if
2334 gss_krb5_compat_des3_mic exists
2336 2003-04-24 Love Hörnquist Åstrand <lha@it.su.se>
2338 * Makefile.am: (libgssapi_la_LDFLAGS): update major
2339 version of gssapi for incompatiblity in 3des getmic support
2341 2003-04-23 Love Hörnquist Åstrand <lha@it.su.se>
2343 * Makefile.am: test_acquire_cred_LDADD: use libgssapi.la not
2344 ./libgssapi.la (make make -jN work)
2346 2003-04-16 Love Hörnquist Åstrand <lha@it.su.se>
2348 * gssapi.3: spelling
2350 * gss_acquire_cred.3: Change .Fd #include <header.h> to .In
2351 header.h, from Thomas Klausner <wiz@netbsd.org>
2354 2003-04-06 Love Hörnquist Åstrand <lha@it.su.se>
2356 * gss_acquire_cred.3: spelling
2358 * Makefile.am: remove stuff that sneaked in with last commit
2360 * acquire_cred.c (acquire_initiator_cred): if the requested name
2361 isn't in the ccache, also check keytab. Extact the krbtgt for the
2362 default realm to check how long the credentials will last.
2364 * add_cred.c (gss_add_cred): don't create a new ccache, just open
2365 the old one; better check if output handle is compatible with new
2368 * test_acquire_cred.c: test gss_add_cred too
2370 2003-04-03 Love Hörnquist Åstrand <lha@it.su.se>
2372 * Makefile.am: build test_acquire_cred
2374 * test_acquire_cred.c: simple gss_acquire_cred test
2376 2003-04-02 Love Hörnquist Åstrand <lha@it.su.se>
2378 * gss_acquire_cred.3: s/gssapi/GSS-API/
2380 2003-03-19 Love Hörnquist Åstrand <lha@it.su.se>
2382 * gss_acquire_cred.3: document v1 interface (and that they are
2385 2003-03-18 Love Hörnquist Åstrand <lha@it.su.se>
2387 * gss_acquire_cred.3: list supported mechanism and nametypes
2389 2003-03-16 Love Hörnquist Åstrand <lha@it.su.se>
2391 * gss_acquire_cred.3: text about gss_display_name
2393 * Makefile.am (libgssapi_la_LDFLAGS): bump to 3:6:2
2394 (libgssapi_la_SOURCES): add all new functions
2396 * gssapi.3: now that we have a functions, uncomment the missing
2399 * gss_acquire_cred.3: now that we have a functions, uncomment the
2402 * process_context_token.c: implement gss_process_context_token
2404 * inquire_names_for_mech.c: implement gss_inquire_names_for_mech
2406 * inquire_mechs_for_name.c: implement gss_inquire_mechs_for_name
2408 * inquire_cred_by_mech.c: implement gss_inquire_cred_by_mech
2410 * add_cred.c: implement gss_add_cred
2412 * acquire_cred.c (gss_acquire_cred): more testing of input
2413 argument, make sure output arguments are ok, since we don't know
2414 the time_rec (for now), set it to time_req
2416 * export_sec_context.c: send lifetime, also set minor_status
2418 * get_mic.c: set minor_status
2420 * import_sec_context.c (gss_import_sec_context): add error
2421 checking, pick up lifetime (if there is no lifetime, use
2424 * init_sec_context.c: take care to set export value to something
2425 sane before we start so caller will have harmless values in them
2426 if then function fails
2428 * release_buffer.c (gss_release_buffer): set minor_status
2430 * wrap.c: make sure minor_status get set
2432 * verify_mic.c (gss_verify_mic_internal): rename verify_mic to
2433 gss_verify_mic_internal and let it take the type as an argument,
2434 (gss_verify_mic): call gss_verify_mic_internal
2437 * unwrap.c: set minor_status
2439 * test_oid_set_member.c (gss_test_oid_set_member): use
2442 * release_oid_set.c (gss_release_oid_set): set minor_status
2444 * release_name.c (gss_release_name): set minor_status
2446 * release_cred.c (gss_release_cred): set minor_status
2448 * add_oid_set_member.c (gss_add_oid_set_member): set minor_status
2450 * compare_name.c (gss_compare_name): set minor_status
2452 * compat.c (check_compat): make sure ret have a defined value
2454 * context_time.c (gss_context_time): set minor_status
2456 * copy_ccache.c (gss_krb5_copy_ccache): set minor_status
2458 * create_emtpy_oid_set.c (gss_create_empty_oid_set): set
2461 * delete_sec_context.c (gss_delete_sec_context): set minor_status
2463 * display_name.c (gss_display_name): set minor_status
2465 * display_status.c (gss_display_status): use gss_oid_equal, handle
2466 supplementary errors
2468 * duplicate_name.c (gss_duplicate_name): set minor_status
2470 * inquire_context.c (gss_inquire_context): set lifetime_rec now
2471 when we know it, set minor_status
2473 * inquire_cred.c (gss_inquire_cred): take care to set export value
2474 to something sane before we start so caller will have harmless
2475 values in them if the function fails
2477 * accept_sec_context.c (gss_accept_sec_context): take care to set
2478 export value to something sane before we start so caller will have
2479 harmless values in them if then function fails, set lifetime from
2480 ticket expiration date
2482 * indicate_mechs.c (gss_indicate_mechs): use
2483 gss_create_empty_oid_set and gss_add_oid_set_member
2485 * gssapi.h (gss_ctx_id_t_desc): store the lifetime in the cred,
2486 since there is no ticket transfered in the exported context
2488 * export_name.c (gss_export_name): export name with
2489 GSS_C_NT_EXPORT_NAME wrapping, not just the principal
2491 * import_name.c (import_export_name): new function, parses a
2492 GSS_C_NT_EXPORT_NAME
2493 (import_krb5_name): factor out common code of parsing krb5 name
2494 (gss_oid_equal): rename from oid_equal
2496 * gssapi_locl.h: add prototypes for gss_oid_equal and
2497 gss_verify_mic_internal
2499 * gssapi.h: comment out the argument names
2501 2003-03-15 Love Hörnquist Åstrand <lha@it.su.se>
2503 * gssapi.3: add LIST OF FUNCTIONS and copyright/license
2505 * Makefile.am: s/gss_aquire_cred.3/gss_acquire_cred.3/
2507 * Makefile.am: man_MANS += gss_aquire_cred.3
2509 2003-03-14 Love Hörnquist Åstrand <lha@it.su.se>
2511 * gss_aquire_cred.3: the gssapi api manpage
2513 2003-03-03 Love Hörnquist Åstrand <lha@it.su.se>
2515 * inquire_context.c: (gss_inquire_context): rename argument open
2518 * gssapi.h (gss_inquire_context): rename argument open to open_context
2520 2003-02-27 Love Hörnquist Åstrand <lha@it.su.se>
2522 * init_sec_context.c (do_delegation): remove unused variable
2525 * gssapi.3: all 0.5.x version had broken token delegation
2527 2003-02-21 Love Hörnquist Åstrand <lha@it.su.se>
2529 * (init_auth): only generate one subkey
2531 2003-01-27 Love Hörnquist Åstrand <lha@it.su.se>
2533 * verify_mic.c (verify_mic_des3): fix 3des verify_mic to conform
2534 to rfc (and mit kerberos), provide backward compat hook
2536 * get_mic.c (mic_des3): fix 3des get_mic to conform to rfc (and
2537 mit kerberos), provide backward compat hook
2539 * init_sec_context.c (init_auth): check if we need compat for
2540 older get_mic/verify_mic
2542 * gssapi_locl.h: add prototype for _gss_DES3_get_mic_compat
2544 * gssapi.h (more_flags): add COMPAT_OLD_DES3
2546 * Makefile.am: add gssapi.3 and compat.c
2548 * gssapi.3: add gssapi COMPATIBILITY documentation
2550 * accept_sec_context.c (gss_accept_sec_context): check if we need
2551 compat for older get_mic/verify_mic
2553 * compat.c: check for compatiblity with other heimdal's 3des
2556 2002-10-31 Johan Danielsson <joda@pdc.kth.se>
2558 * check return value from gssapi_krb5_init
2560 * 8003.c (gssapi_krb5_verify_8003_checksum): check size of input
2562 2002-09-03 Johan Danielsson <joda@pdc.kth.se>
2564 * wrap.c (wrap_des3): use ETYPE_DES3_CBC_NONE
2566 * unwrap.c (unwrap_des3): use ETYPE_DES3_CBC_NONE
2568 2002-09-02 Johan Danielsson <joda@pdc.kth.se>
2570 * init_sec_context.c: we need to generate a local subkey here
2572 2002-08-20 Jacques Vidrine <n@nectar.com>
2574 * acquire_cred.c, inquire_cred.c, release_cred.c: Use default
2575 credential resolution if gss_acquire_cred is called with
2578 2002-06-20 Jacques Vidrine <n@nectar.com>
2580 * import_name.c: Compare name types by value if pointers do
2581 not match. Reported by: "Douglas E. Engert" <deengert@anl.gov>
2583 2002-05-20 Jacques Vidrine <n@nectar.com>
2585 * verify_mic.c (gss_verify_mic), unwrap.c (gss_unwrap): initialize
2586 the qop_state parameter. from Doug Rabson <dfr@nlsystems.com>
2588 2002-05-09 Jacques Vidrine <n@nectar.com>
2590 * acquire_cred.c: handle GSS_C_INITIATE/GSS_C_ACCEPT/GSS_C_BOTH
2592 2002-05-08 Jacques Vidrine <n@nectar.com>
2594 * acquire_cred.c: initialize gssapi; handle null desired_name
2596 2002-03-22 Johan Danielsson <joda@pdc.kth.se>
2598 * Makefile.am: remove non-functional stuff accidentally committed
2600 2002-03-11 Assar Westerlund <assar@sics.se>
2602 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:5:2
2603 * 8003.c (gssapi_krb5_verify_8003_checksum): handle zero channel
2606 2001-10-31 Jacques Vidrine <n@nectar.com>
2608 * get_mic.c (mic_des3): MIC computation using DES3/SHA1
2609 was bogusly appending the message buffer to the result,
2610 overwriting a heap buffer in the process.
2612 2001-08-29 Assar Westerlund <assar@sics.se>
2614 * 8003.c (gssapi_krb5_verify_8003_checksum,
2615 gssapi_krb5_create_8003_checksum): make more consistent by always
2616 returning an gssapi error and setting minor status. update
2619 2001-08-28 Jacques Vidrine <n@nectar.com>
2621 * accept_sec_context.c: Create a cache for delegated credentials
2624 2001-08-28 Assar Westerlund <assar@sics.se>
2626 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:4:2
2628 2001-08-23 Assar Westerlund <assar@sics.se>
2630 * *.c: handle minor_status more consistently
2632 * display_status.c (gss_display_status): handle krb5_get_err_text
2635 2001-08-15 Johan Danielsson <joda@pdc.kth.se>
2637 * gssapi_locl.h: fix prototype for gssapi_krb5_init
2639 2001-08-13 Johan Danielsson <joda@pdc.kth.se>
2641 * accept_sec_context.c (gsskrb5_register_acceptor_identity): init
2642 context and check return value from kt_resolve
2644 * init.c: return error code
2646 2001-07-19 Assar Westerlund <assar@sics.se>
2648 * Makefile.am (libgssapi_la_LDFLAGS): update to 3:3:2
2650 2001-07-12 Assar Westerlund <assar@sics.se>
2652 * Makefile.am (libgssapi_la_LIBADD): add required library
2655 2001-07-06 Assar Westerlund <assar@sics.se>
2657 * accept_sec_context.c (gsskrb5_register_acceptor_identity): set
2658 the keytab to be used for gss_acquire_cred too'
2660 2001-07-03 Assar Westerlund <assar@sics.se>
2662 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:2:2
2664 2001-06-18 Assar Westerlund <assar@sics.se>
2666 * wrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2667 and gss_krb5_get_remotekey
2668 * verify_mic.c: update krb5_auth_con function names use
2669 gss_krb5_get_remotekey
2670 * unwrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2671 and gss_krb5_get_remotekey
2672 * gssapi_locl.h (gss_krb5_get_remotekey, gss_krb5_get_localkey):
2674 * get_mic.c: update krb5_auth_con function names. use
2675 gss_krb5_get_localkey
2676 * accept_sec_context.c: update krb5_auth_con function names
2678 2001-05-17 Assar Westerlund <assar@sics.se>
2680 * Makefile.am: bump version to 3:1:2
2682 2001-05-14 Assar Westerlund <assar@sics.se>
2684 * address_to_krb5addr.c: adapt to new address functions
2686 2001-05-11 Assar Westerlund <assar@sics.se>
2688 * try to return the error string from libkrb5 where applicable
2690 2001-05-08 Assar Westerlund <assar@sics.se>
2692 * delete_sec_context.c (gss_delete_sec_context): remember to free
2693 the memory used by the ticket itself. from <tmartin@mirapoint.com>
2695 2001-05-04 Assar Westerlund <assar@sics.se>
2697 * gssapi_locl.h: add config.h for completeness
2698 * gssapi.h: remove config.h, this is an installed header file
2699 sys/types.h is not needed either
2701 2001-03-12 Assar Westerlund <assar@sics.se>
2703 * acquire_cred.c (gss_acquire_cred): remove memory leaks. from
2704 Jason R Thorpe <thorpej@zembu.com>
2706 2001-02-18 Assar Westerlund <assar@sics.se>
2708 * accept_sec_context.c (gss_accept_sec_context): either return
2709 gss_name NULL-ed or set
2711 * import_name.c: set minor_status in some cases where it was not
2714 2001-02-15 Assar Westerlund <assar@sics.se>
2716 * wrap.c: use krb5_generate_random_block for the confounders
2718 2001-01-30 Assar Westerlund <assar@sics.se>
2720 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:0:2
2721 * acquire_cred.c, init_sec_context.c, release_cred.c: add support
2722 for getting creds from a keytab, from fvdl@netbsd.org
2724 * copy_ccache.c: add gss_krb5_copy_ccache
2726 2001-01-27 Assar Westerlund <assar@sics.se>
2728 * get_mic.c: cast parameters to des function to non-const pointers
2729 to handle the case where these functions actually take non-const
2732 2001-01-09 Assar Westerlund <assar@sics.se>
2734 * accept_sec_context.c (gss_accept_sec_context): use krb5_rd_cred2
2735 instead of krb5_rd_cred
2737 2000-12-11 Assar Westerlund <assar@sics.se>
2739 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:3:1
2741 2000-12-08 Assar Westerlund <assar@sics.se>
2743 * wrap.c (wrap_des3): use the checksum as ivec when encrypting the
2745 * unwrap.c (unwrap_des3): use the checksum as ivec when encrypting
2747 * init_sec_context.c (init_auth): always zero fwd_data
2749 2000-12-06 Johan Danielsson <joda@pdc.kth.se>
2751 * accept_sec_context.c: de-pointerise auth_context parameter to
2754 2000-11-15 Assar Westerlund <assar@sics.se>
2756 * init_sec_context.c (init_auth): update to new
2757 krb5_build_authenticator
2759 2000-09-19 Assar Westerlund <assar@sics.se>
2761 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:2:1
2763 2000-08-27 Assar Westerlund <assar@sics.se>
2765 * init_sec_context.c: actually pay attention to `time_req'
2766 * init_sec_context.c: re-organize. leak less memory.
2767 * gssapi_locl.h (gssapi_krb5_encapsulate, gss_krb5_getsomekey):
2768 update prototypes add assert.h
2769 * gssapi.h (GSS_KRB5_CONF_C_QOP_DES, GSS_KRB5_CONF_C_QOP_DES3_KD):
2771 * verify_mic.c: re-organize and add 3DES code
2772 * wrap.c: re-organize and add 3DES code
2773 * unwrap.c: re-organize and add 3DES code
2774 * get_mic.c: re-organize and add 3DES code
2775 * encapsulate.c (gssapi_krb5_encapsulate): do not free `in_data',
2776 let the caller do that. fix the callers.
2778 2000-08-16 Assar Westerlund <assar@sics.se>
2780 * Makefile.am: bump version to 2:1:1
2782 2000-07-29 Assar Westerlund <assar@sics.se>
2784 * decapsulate.c (gssapi_krb5_verify_header): sanity-check length
2786 2000-07-25 Johan Danielsson <joda@pdc.kth.se>
2788 * Makefile.am: bump version to 2:0:1
2790 2000-07-22 Assar Westerlund <assar@sics.se>
2792 * gssapi.h: update OID for GSS_C_NT_HOSTBASED_SERVICE and other
2793 details from rfc2744
2795 2000-06-29 Assar Westerlund <assar@sics.se>
2797 * address_to_krb5addr.c (gss_address_to_krb5addr): actually use
2798 `int' instead of `sa_family_t' for the address family.
2800 2000-06-21 Assar Westerlund <assar@sics.se>
2802 * add support for token delegation. From Daniel Kouril
2803 <kouril@ics.muni.cz> and Miroslav Ruda <ruda@ics.muni.cz>
2805 2000-05-15 Assar Westerlund <assar@sics.se>
2807 * Makefile.am (libgssapi_la_LDFLAGS): set version to 1:1:1
2809 2000-04-12 Assar Westerlund <assar@sics.se>
2811 * release_oid_set.c (gss_release_oid_set): clear set for
2812 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2813 * release_name.c (gss_release_name): reset input_name for
2814 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2815 * release_buffer.c (gss_release_buffer): set value to NULL to be
2816 more robust. From GOMBAS Gabor <gombasg@inf.elte.hu>
2817 * add_oid_set_member.c (gss_add_oid_set_member): actually check if
2818 the oid is a member first. leave the oid_set unchanged if realloc
2821 2000-02-13 Assar Westerlund <assar@sics.se>
2823 * Makefile.am: set version to 1:0:1
2825 2000-02-12 Assar Westerlund <assar@sics.se>
2827 * gssapi_locl.h: add flags for import/export
2828 * import_sec_context.c (import_sec_context: add flags for what
2829 fields are included. do not include the authenticator for now.
2830 * export_sec_context.c (export_sec_context: add flags for what
2831 fields are included. do not include the authenticator for now.
2832 * accept_sec_context.c (gss_accept_sec_context): set target in
2835 2000-02-11 Assar Westerlund <assar@sics.se>
2837 * delete_sec_context.c (gss_delete_sec_context): set context to
2840 * Makefile.am: add {export,import}_sec_context.c
2841 * export_sec_context.c: new file
2842 * import_sec_context.c: new file
2843 * accept_sec_context.c (gss_accept_sec_context): set trans flag
2845 2000-02-07 Assar Westerlund <assar@sics.se>
2847 * Makefile.am: set version to 0:5:0
2849 2000-01-26 Assar Westerlund <assar@sics.se>
2851 * delete_sec_context.c (gss_delete_sec_context): handle a NULL
2854 * wrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2855 changes to libdes calls to make them more portable.
2856 * verify_mic.c: update to pseudo-standard APIs for md4,md5,sha.
2857 some changes to libdes calls to make them more portable.
2858 * unwrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2859 changes to libdes calls to make them more portable.
2860 * get_mic.c: update to pseudo-standard APIs for md4,md5,sha. some
2861 changes to libdes calls to make them more portable.
2862 * 8003.c: update to pseudo-standard APIs for md4,md5,sha.
2864 2000-01-06 Assar Westerlund <assar@sics.se>
2866 * Makefile.am: set version to 0:4:0
2868 1999-12-26 Assar Westerlund <assar@sics.se>
2870 * accept_sec_context.c (gss_accept_sec_context): always set
2872 * init_sec_context.c (init_auth): always initialize `output_token'
2873 * delete_sec_context.c (gss_delete_sec_context): always set
2876 1999-12-06 Assar Westerlund <assar@sics.se>
2878 * Makefile.am: bump version to 0:3:0
2880 1999-10-20 Assar Westerlund <assar@sics.se>
2882 * Makefile.am: set version to 0:2:0
2884 1999-09-21 Assar Westerlund <assar@sics.se>
2886 * init_sec_context.c (gss_init_sec_context): initialize `ticket'
2888 * gssapi.h (gss_ctx_id_t_desc): add ticket in here. ick.
2890 * delete_sec_context.c (gss_delete_sec_context): free ticket
2892 * accept_sec_context.c (gss_accept_sec_context): stove away
2893 `krb5_ticket' in context so that ugly programs such as
2894 gss_nt_server can get at it. uck.
2896 1999-09-20 Johan Danielsson <joda@pdc.kth.se>
2898 * accept_sec_context.c: set minor_status
2900 1999-08-04 Assar Westerlund <assar@sics.se>
2902 * display_status.c (calling_error, routine_error): right shift the
2903 code to make it possible to index into the arrays
2905 1999-07-28 Assar Westerlund <assar@sics.se>
2907 * gssapi.h (GSS_C_AF_INET6): add
2909 * import_name.c (import_hostbased_name): set minor_status
2911 1999-07-26 Assar Westerlund <assar@sics.se>
2913 * Makefile.am: set version to 0:1:0
2915 Wed Apr 7 14:05:15 1999 Johan Danielsson <joda@hella.pdc.kth.se>
2917 * display_status.c: set minor_status
2919 * init_sec_context.c: set minor_status
2921 * lib/gssapi/init.c: remove donep (check gssapi_krb5_context