1 2007-12-30 Love Hörnquist Åstrand <lha@it.su.se>
3 * ntlm/init_sec_context.c: Don't confuse target name and source
4 name, make regressiont tests pass again.
6 2007-12-29 Love Hörnquist Åstrand <lha@it.su.se>
8 * ntlm: clean up name handling
10 2007-12-04 Love Hörnquist Åstrand <lha@it.su.se>
12 * ntlm/init_sec_context.c: Use credential if it was passed in.
14 * ntlm/acquire_cred.c: Check if there is initial creds with
15 _gss_ntlm_get_user_cred().
17 * ntlm/init_sec_context.c: Add _gss_ntlm_get_user_info() that
18 return the user info so it can be used by external modules.
20 * ntlm/inquire_cred.c: use the right error code.
22 * ntlm/inquire_cred.c: Return GSS_C_NO_CREDENTIAL if there is no
23 credential, ntlm have (not yet) a default credential.
25 * mech/gss_release_oid_set.c: Avoid trying to deref NULL, from
28 2007-12-03 Love Hörnquist Åstrand <lha@it.su.se>
30 * test_acquire_cred.c: Always try to fetch cred (even with
33 2007-08-09 Love Hörnquist Åstrand <lha@it.su.se>
35 * mech/gss_krb5.c: Readd gss_krb5_get_tkt_flags.
37 2007-08-08 Love Hörnquist Åstrand <lha@it.su.se>
39 * spnego/compat.c (_gss_spnego_internal_delete_sec_context):
40 release ctx->target_name too From Rafal Malinowski.
42 2007-07-26 Love Hörnquist Åstrand <lha@it.su.se>
44 * mech/gss_mech_switch.c: Don't try to do dlopen if system doesn't
45 have dlopen. From Rune of Chalmers.
47 2007-07-10 Love Hörnquist Åstrand <lha@it.su.se>
49 * mech/gss_duplicate_name.c: New signature of _gss_find_mn.
51 * mech/gss_init_sec_context.c: New signature of _gss_find_mn.
53 * mech/gss_acquire_cred.c: New signature of _gss_find_mn.
55 * mech/name.h: New signature of _gss_find_mn.
57 * mech/gss_canonicalize_name.c: New signature of _gss_find_mn.
59 * mech/gss_compare_name.c: New signature of _gss_find_mn.
61 * mech/gss_add_cred.c: New signature of _gss_find_mn.
63 * mech/gss_names.c (_gss_find_mn): Return an error code for
66 * spnego/accept_sec_context.c: remove checks that are done by the
69 * Makefile.am: New library version.
71 2007-07-04 Love Hörnquist Åstrand <lha@it.su.se>
73 * mech/gss_oid_to_str.c: Refuse to print GSS_C_NULL_OID, from
76 * spnego/spnego.asn1: Indent and make NegTokenInit and
77 NegTokenResp extendable.
79 2007-06-21 Love Hörnquist Åstrand <lha@it.su.se>
81 * ntlm/inquire_cred.c: Implement _gss_ntlm_inquire_cred.
83 * mech/gss_display_status.c: Provide message for GSS_S_COMPLETE.
85 * mech/context.c: If the canned string is "", its no use to the
86 user, make it fall back to the default error string.
88 2007-06-20 Love Hörnquist Åstrand <lha@it.su.se>
90 * mech/gss_display_name.c (gss_display_name): no name ->
91 fail. From Rafal Malinswski.
93 * spnego/accept_sec_context.c: Wrap name in a spnego_name instead
94 of just a copy of the underlaying object. From Rafal Malinswski.
96 * spnego/accept_sec_context.c: Handle underlaying mech not
99 * mech/gss_accept_sec_context.c: Handle underlaying mech not
102 * spnego/accept_sec_context.c: Make sure src_name is always set to
103 GSS_C_NO_NAME when returning.
105 * krb5/acquire_cred.c (acquire_acceptor_cred): don't claim
106 everything is well on failure. From Phil Fisher.
108 * mech/gss_duplicate_name.c: catch error (and ignore it)
110 * ntlm/init_sec_context.c: Use heim_ntlm_calculate_ntlm2_sess.
112 * mech/gss_accept_sec_context.c: Only wrap the delegated cred if
113 we got a delegated mech cred. From Rafal Malinowski.
115 * spnego/accept_sec_context.c: Only wrap the delegated cred if we
116 are going to return it to the consumer. From Rafal Malinowski.
118 * spnego/accept_sec_context.c: Fixed memory leak pointed out by
119 Rafal Malinowski, also while here moved to use NegotiationToken
122 2007-06-18 Love Hörnquist Åstrand <lha@it.su.se>
124 * krb5/prf.c (_gsskrb5_pseudo_random): add missing break.
126 * krb5/release_name.c: Set *minor_status unconditionallty, its
129 * spnego/accept_sec_context.c: Init get_mic to 0.
131 * mech/gss_set_cred_option.c: Free memory in failure case, found
134 * mech/gss_inquire_context.c: Handle mech_type being NULL.
136 * mech/gss_inquire_cred_by_mech.c: Handle cred_name being NULL.
138 * mech/gss_krb5.c: Free memory in error case, found by beam.
140 2007-06-12 Love Hörnquist Åstrand <lha@it.su.se>
142 * ntlm/inquire_context.c: Use ctx->gssflags for flags.
144 * krb5/display_name.c: Use KRB5_PRINCIPAL_UNPARSE_DISPLAY, this is
145 not ment for machine consumption.
147 2007-06-09 Love Hörnquist Åstrand <lha@it.su.se>
149 * ntlm/digest.c (kdc_alloc): free memory on failure, pointed out
152 * ntlm/digest.c (kdc_destroy): free context when done, pointed out
155 * spnego/context_stubs.c (_gss_spnego_display_name): if input_name
156 is null, fail. From Rafal Malinowski.
158 2007-06-04 Love Hörnquist Åstrand <lha@it.su.se>
160 * ntlm/digest.c: Free memory when done.
162 2007-06-02 Love Hörnquist Åstrand <lha@it.su.se>
164 * test_ntlm.c: Test both with and without keyex.
166 * ntlm/digest.c: If we didn't set session key, don't expect one
169 * test_ntlm.c: Set keyex flag and calculate session key.
171 2007-05-31 Love Hörnquist Åstrand <lha@it.su.se>
173 * spnego/accept_sec_context.c: Use the return value before is
174 overwritten by later calls. From Rafal Malinowski
176 * krb5/release_cred.c: Give an minor_status argument to
177 gss_release_oid_set. From Rafal Malinowski
179 2007-05-30 Love Hörnquist Åstrand <lha@it.su.se>
181 * ntlm/accept_sec_context.c: Catch errors and return the up the
184 * test_kcred.c: more testing of lifetimes
186 2007-05-17 Love Hörnquist Åstrand <lha@it.su.se>
188 * Makefile.am: Drop the gss oid_set function for the krb5 mech,
189 use the mech glue versions instead. Pointed out by Rafal
192 * krb5: Use gss oid_set functions from mechglue
194 2007-05-14 Love Hörnquist Åstrand <lha@it.su.se>
196 * ntlm/accept_sec_context.c: Set session key only if we are
197 returned a session key. Found by David Love.
199 2007-05-13 Love Hörnquist Åstrand <lha@it.su.se>
201 * krb5/prf.c: switched MIN to min to make compile on solaris,
202 pointed out by David Love.
204 2007-05-09 Love Hörnquist Åstrand <lha@it.su.se>
206 * krb5/inquire_cred_by_mech.c: Fill in all of the variables if
207 they are passed in. Pointed out by Phil Fisher.
209 2007-05-08 Love Hörnquist Åstrand <lha@it.su.se>
211 * krb5/inquire_cred.c: Fix copy and paste error, bug spotted by
214 * mech: dont keep track of gc_usage, just figure it out at
215 gss_inquire_cred() time
217 * mech/gss_mech_switch.c (add_builtin): ok for
218 __gss_mech_initialize() to return NULL
220 * test_kcred.c: more correct tests
222 * spnego/cred_stubs.c (gss_inquire_cred*): wrap the name with a
225 * ntlm/inquire_cred.c: make ntlm gss_inquire_cred fail for now,
226 need to find default cred and friends.
228 * krb5/inquire_cred_by_mech.c: reimplement
230 2007-05-07 Love Hörnquist Åstrand <lha@it.su.se>
232 * ntlm/acquire_cred.c: drop unused variable.
234 * ntlm/acquire_cred.c: Reimplement.
236 * Makefile.am: add ntlm/digest.c
238 * ntlm: split out backend ntlm server processing
240 2007-04-24 Love Hörnquist Åstrand <lha@it.su.se>
242 * ntlm/delete_sec_context.c (_gss_ntlm_delete_sec_context): free
245 2007-04-22 Love Hörnquist Åstrand <lha@it.su.se>
247 * ntlm/init_sec_context.c: ntlm-key credential entry is prefix with @
249 * ntlm/init_sec_context.c (get_user_ccache): pick up the ntlm
250 creds from the krb5 credential cache.
252 2007-04-21 Love Hörnquist Åstrand <lha@it.su.se>
254 * ntlm/delete_sec_context.c: free the key stored in the context
256 * ntlm/ntlm.h: switch password for a key
258 * test_oid.c: Switch oid to one that is exported.
260 2007-04-20 Love Hörnquist Åstrand <lha@it.su.se>
262 * ntlm/init_sec_context.c: move where hash is calculated to make
263 it easier to add ccache support.
265 * Makefile.am: Add version-script.map to EXTRA_DIST.
267 2007-04-19 Love Hörnquist Åstrand <lha@it.su.se>
269 * Makefile.am: Unconfuse newer versions of automake that doesn't
270 know the diffrence between depenences and setting variables. foo:
273 * test_ntlm.c: delete sec context when done.
275 * version-script.map: export more symbols.
277 * Makefile.am: add version script if ld supports it
279 * version-script.map: add version script if ld supports it
281 2007-04-18 Love Hörnquist Åstrand <lha@it.su.se>
283 * Makefile.am: test_acquire_cred need test_common.[ch]
285 * test_acquire_cred.c: add more test options.
287 * krb5/external.c: add GSS_KRB5_CCACHE_NAME_X
289 * gssapi/gssapi_krb5.h: add GSS_KRB5_CCACHE_NAME_X
291 * krb5/set_sec_context_option.c: refactor code, implement
292 GSS_KRB5_CCACHE_NAME_X
294 * mech/gss_krb5.c: reimplement gss_krb5_ccache_name
296 2007-04-17 Love Hörnquist Åstrand <lha@it.su.se>
298 * spnego/cred_stubs.c: Need to import spnego name before we can
299 use it as a gss_name_t.
301 * test_acquire_cred.c: use this test as part of the regression
304 * mech/gss_acquire_cred.c (gss_acquire_cred): dont init
305 cred->gc_mc every time in the loop.
307 2007-04-15 Love Hörnquist Åstrand <lha@it.su.se>
309 * Makefile.am: add test_common.h
311 2007-02-16 Love Hörnquist Åstrand <lha@it.su.se>
313 * gss_acquire_cred.3: Add link for
314 gsskrb5_register_acceptor_identity.
316 2007-02-08 Love Hörnquist Åstrand <lha@it.su.se>
318 * krb5/copy_ccache.c: Try to leak less memory in the failure case.
320 2007-01-31 Love Hörnquist Åstrand <lha@it.su.se>
322 * mech/gss_display_status.c: Use right printf formater.
324 * test_*.[ch]: split out the error printing function and try to
327 2007-01-30 Love Hörnquist Åstrand <lha@it.su.se>
329 * krb5/init_sec_context.c: revert 1.75: (init_auth): only turn on
330 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
332 This is because Kerberos always support INT|CONF, matches behavior
333 with MS and MIT. The creates problems for the GSS-SPNEGO mech.
335 2007-01-24 Love Hörnquist Åstrand <lha@it.su.se>
337 * krb5/prf.c: constrain desired_output_len
339 * krb5/external.c (krb5_mech): add _gsskrb5_pseudo_random
341 * mech/gss_pseudo_random.c: Catch error from underlaying mech on
344 * Makefile.am: Add krb5/prf.c
346 * krb5/prf.c: gss_pseudo_random for krb5
348 * test_context.c: Checks for gss_pseudo_random.
350 * krb5/gkrb5_err.et: add KG_INPUT_TOO_LONG
352 * Makefile.am: Add mech/gss_pseudo_random.c
354 * gssapi/gssapi.h: try to load pseudo_random
356 * mech/gss_mech_switch.c: try to load pseudo_random
358 * mech/gss_pseudo_random.c: Add gss_pseudo_random.
360 * gssapi_mech.h: Add hook for gm_pseudo_random.
362 2007-01-17 Love Hörnquist Åstrand <lha@it.su.se>
364 * test_context.c: Don't assume bufer from gss_display_status is
367 * mech/gss_wrap_size_limit.c: Reset out variables.
369 * mech/gss_wrap.c: Reset out variables.
371 * mech/gss_verify_mic.c: Reset out variables.
373 * mech/gss_utils.c: Reset out variables.
375 * mech/gss_release_oid_set.c: Reset out variables.
377 * mech/gss_release_cred.c: Reset out variables.
379 * mech/gss_release_buffer.c: Reset variables.
381 * mech/gss_oid_to_str.c: Reset out variables.
383 * mech/gss_inquire_sec_context_by_oid.c: Fix reset out variables.
385 * mech/gss_mech_switch.c: Reset out variables.
387 * mech/gss_inquire_sec_context_by_oid.c: Reset out variables.
389 * mech/gss_inquire_names_for_mech.c: Reset out variables.
391 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
393 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
395 * mech/gss_inquire_cred_by_mech.c: Reset out variables.
397 * mech/gss_inquire_cred.c: Reset out variables, fix memory leak.
399 * mech/gss_inquire_context.c: Reset out variables.
401 * mech/gss_init_sec_context.c: Zero out outbuffer on failure.
403 * mech/gss_import_name.c: Reset out variables.
405 * mech/gss_import_name.c: Reset out variables.
407 * mech/gss_get_mic.c: Reset out variables.
409 * mech/gss_export_name.c: Reset out variables.
411 * mech/gss_encapsulate_token.c: Reset out variables.
413 * mech/gss_duplicate_oid.c: Reset out variables.
415 * mech/gss_duplicate_oid.c: Reset out variables.
417 * mech/gss_duplicate_name.c: Reset out variables.
419 * mech/gss_display_status.c: Reset out variables.
421 * mech/gss_display_name.c: Reset out variables.
423 * mech/gss_delete_sec_context.c: Reset out variables using propper
426 * mech/gss_decapsulate_token.c: Reset out variables using propper
429 * mech/gss_add_cred.c: Reset out variables.
431 * mech/gss_acquire_cred.c: Reset out variables.
433 * mech/gss_accept_sec_context.c: Reset out variables using propper
436 * mech/gss_init_sec_context.c: Reset out variables.
438 * mech/mech_locl.h (_mg_buffer_zero): new macro that zaps a
441 2007-01-16 Love Hörnquist Åstrand <lha@it.su.se>
443 * mech: sprinkel _gss_mg_error
445 * mech/gss_display_status.c (gss_display_status): use
446 _gss_mg_get_error to fetch the error from underlaying mech, if it
447 failes, let do the regular dance for GSS-CODE version and a
448 generic print-the-error code for MECH-CODE.
450 * mech/gss_oid_to_str.c: Don't include the NUL in the length of
453 * mech/context.h: Protoypes for _gss_mg_.
455 * mech/context.c: Glue to catch the error from the lower gss-api
456 layer and save that for later so gss_display_status() can show the
459 * gss.c: Detect NTLM.
461 2007-01-11 Love Hörnquist Åstrand <lha@it.su.se>
463 * mech/gss_accept_sec_context.c: spelling
465 2007-01-04 Love Hörnquist Åstrand <lha@it.su.se>
467 * Makefile.am: Include build (private) prototypes header files.
469 * Makefile.am (ntlmsrc): add ntlm/ntlm-private.h
471 2006-12-28 Love Hörnquist Åstrand <lha@it.su.se>
473 * ntlm/accept_sec_context.c: Pass signseal argument to
476 * ntlm/init_sec_context.c: Pass signseal argument to
479 * ntlm/crypto.c (_gss_ntlm_set_key): add signseal argument
481 * test_ntlm.c: add ntlmv2 test
483 * ntlm/ntlm.h: break out struct ntlmv2_key;
485 * ntlm/crypto.c (_gss_ntlm_set_key): set ntlm v2 keys.
487 * ntlm/accept_sec_context.c: Set dummy ntlmv2 keys and Check TI.
489 * ntlm/ntlm.h: NTLMv2 keys.
491 * ntlm/crypto.c: NTLMv2 sign and verify.
493 2006-12-20 Love Hörnquist Åstrand <lha@it.su.se>
495 * ntlm/accept_sec_context.c: Don't send targetinfo now.
497 * ntlm/init_sec_context.c: Build ntlmv2 answer buffer.
499 * ntlm/init_sec_context.c: Leak less memory.
501 * ntlm/init_sec_context.c: Announce that we support key exchange.
503 * ntlm/init_sec_context.c: Add NTLM_NEG_NTLM2_SESSION, NTLMv2
504 session security (disable because missing sign and seal).
506 2006-12-19 Love Hörnquist Åstrand <lha@it.su.se>
508 * ntlm/accept_sec_context.c: split RC4 send and recv keystreams
510 * ntlm/init_sec_context.c: split RC4 send and recv keystreams
512 * ntlm/ntlm.h: split RC4 send and recv keystreams
514 * ntlm/crypto.c: Implement SEAL.
516 * ntlm/crypto.c: move gss_wrap/gss_unwrap here
518 * test_context.c: request INT and CONF from the gss layer, test
521 * ntlm/ntlm.h: add crypto bits.
523 * ntlm/accept_sec_context.c: Save session master key.
525 * Makefile.am: Move get and verify mic to the same file (crypto.c)
526 since they share code.
528 * ntlm/crypto.c: Move get and verify mic to the same file since
529 they share code, implement NTLM v1 and dummy signatures.
531 * ntlm/init_sec_context.c: pass on GSS_C_CONF_FLAG and
532 GSS_C_INTEG_FLAG, save the session master key
534 * spnego/accept_sec_context.c: try using gss_accept_sec_context()
535 on the opportunistic token instead of guessing the acceptor name
536 and do gss_acquire_cred, this make SPNEGO work like before.
538 2006-12-18 Love Hörnquist Åstrand <lha@it.su.se>
540 * ntlm/init_sec_context.c: Calculate the NTLM version 1 "master"
543 * spnego/accept_sec_context.c: Resurect negHints for the acceptor
546 * Makefile.am: Add "windows" versions of the NegTokenInitWin and
549 * test_context.c: add --wrapunwrap flag
551 * spnego/compat.c: move _gss_spnego_indicate_mechtypelist() to
552 compat.c, use the sequence types of MechTypeList, make
553 add_mech_type() static.
555 * spnego/accept_sec_context.c: move
556 _gss_spnego_indicate_mechtypelist() to compat.c
558 * Makefile.am: Generate sequence code for MechTypeList
560 * spnego: check that the generated acceptor mechlist is acceptable too
562 * spnego/init_sec_context.c: Abstract out the initiator filter
563 function, it will be needed for the acceptor too.
565 * spnego/accept_sec_context.c: Abstract out the initiator filter
566 function, it will be needed for the acceptor too. Remove negHints.
568 * test_context.c: allow asserting return mech
570 * ntlm/accept_sec_context.c: add _gss_ntlm_allocate_ctx
572 * ntlm/acquire_cred.c: Check that the KDC seem to there and
573 answering us, we can't do better then that wen checking if we will
574 accept the credential.
576 * ntlm/get_mic.c: return GSS_S_UNAVAILABLE
578 * mech/utils.h: add _gss_free_oid, reverse of _gss_copy_oid
580 * mech/gss_utils.c: add _gss_free_oid, reverse of _gss_copy_oid
582 * spnego/spnego.asn1: Its very sad, but NegHints its are not part
583 of the NegTokenInit, this makes SPNEGO acceptor life a lot harder.
585 * spnego: try harder to handle names better. handle missing
586 acceptor and initator creds better (ie dont propose/accept mech
587 that there are no credentials for) split NegTokenInit and
588 NegTokenResp in acceptor
590 2006-12-16 Love Hörnquist Åstrand <lha@it.su.se>
592 * ntlm/import_name.c: Allocate the buffer from the right length.
594 2006-12-15 Love Hörnquist Åstrand <lha@it.su.se>
596 * ntlm/init_sec_context.c (init_sec_context): Tell the other side
597 what domain we think we are talking to.
599 * ntlm/delete_sec_context.c: free username and password
601 * ntlm/release_name.c (_gss_ntlm_release_name): free name.
603 * ntlm/import_name.c (_gss_ntlm_import_name): add support for
604 GSS_C_NT_HOSTBASED_SERVICE names
606 * ntlm/ntlm.h: Add ntlm_name.
608 * test_context.c: allow testing of ntlm.
610 * gssapi_mech.h: add __gss_ntlm_initialize
612 * ntlm/accept_sec_context.c (handle_type3): verify that the kdc
613 approved of the ntlm exchange too
615 * mech/gss_mech_switch.c: Add the builtin ntlm mech
617 * test_ntlm.c: NTLM test app.
619 * mech/gss_accept_sec_context.c: Add detection of NTLMSSP.
621 * gssapi/gssapi.h: add ntlm mech oid
623 * ntlm/external.c: Switch OID to the ms ntlmssp oid
625 * Makefile.am: Add ntlm gss-api module.
627 * ntlm/accept_sec_context.c: Catch more error errors.
629 * ntlm/accept_sec_context.c: Check after a credential to use.
631 2006-12-14 Love Hörnquist Åstrand <lha@it.su.se>
633 * krb5/set_sec_context_option.c (GSS_KRB5_SET_DEFAULT_REALM_X):
634 don't fail on success. Bug report from Stefan Metzmacher.
636 2006-12-13 Love Hörnquist Åstrand <lha@it.su.se>
638 * krb5/init_sec_context.c (init_auth): only turn on
639 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
640 From Stefan Metzmacher.
642 2006-12-11 Love Hörnquist Åstrand <lha@it.su.se>
644 * Makefile.am (libgssapi_la_OBJECTS): depends on gssapi_asn1.h
647 2006-11-20 Love Hörnquist Åstrand <lha@it.su.se>
649 * krb5/acquire_cred.c: Make krb5_get_init_creds_opt_free take a
652 2006-11-16 Love Hörnquist Åstrand <lha@it.su.se>
654 * test_context.c: Test that token keys are the same, return
657 2006-11-15 Love Hörnquist Åstrand <lha@it.su.se>
659 * spnego/spnego_locl.h: Make bitfields unsigned, add maybe_open.
661 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
662 encode CHOICE structure now that we can handle it.
664 * spnego/init_sec_context.c: Use ASN.1 encoder functions to encode
665 CHOICE structure now that we can handle it.
667 * spnego/accept_sec_context.c (_gss_spnego_accept_sec_context):
668 send back ad accept_completed when the security context is ->open,
669 w/o this the client doesn't know that the server have completed
672 * test_context.c: Add delegate flag and check that the delegated
675 * spnego/init_sec_context.c: Keep track of the opportunistic token
676 in the inital message, it might be a complete gss-api context, in
677 that case we'll get back accept_completed without any token. With
678 this change, krb5 w/o mutual authentication works.
680 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
681 encode CHOICE structure now that we can handle it.
683 * spnego/accept_sec_context.c: Filter out SPNEGO from the out
684 supported mechs list and make sure we don't select that for the
687 2006-11-14 Love Hörnquist Åstrand <lha@it.su.se>
689 * mech/gss_init_sec_context.c (_gss_mech_cred_find): break out the
690 cred finding to its own function
692 * krb5/wrap.c: Better error strings, from Andrew Bartlet.
694 2006-11-13 Love Hörnquist Åstrand <lha@it.su.se>
696 * test_context.c: Create our own krb5_context.
698 * krb5: Switch from using a specific error message context in the
699 TLS to have a whole krb5_context in TLS. This have some
700 interestion side-effekts for the configruration setting options
701 since they operate on per-thread basis now.
703 * mech/gss_set_cred_option.c: When calling ->gm_set_cred_option
704 and checking for success, use GSS_S_COMPLETE. From Andrew Bartlet.
706 2006-11-12 Love Hörnquist Åstrand <lha@it.su.se>
708 * Makefile.am: Help solaris make even more.
710 * Makefile.am: Help solaris make.
712 2006-11-09 Love Hörnquist Åstrand <lha@it.su.se>
714 * Makefile.am: remove include $(srcdir)/Makefile-digest.am for now
716 * mech/gss_accept_sec_context.c: Try better guessing what is mech
717 we are going to select by looking harder at the input_token, idea
718 from Luke Howard's mechglue branch.
720 * Makefile.am: libgssapi_la_OBJECTS: add depency on gkrb5_err.h
722 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X
724 * mech/gss_krb5.c: implement gss_krb5_set_allowable_enctypes
726 * gssapi/gssapi.h: GSS_KRB5_S_
728 * krb5/gsskrb5_locl.h: Include <gkrb5_err.h>.
730 * gssapi/gssapi_krb5.h: Add gss_krb5_set_allowable_enctypes.
732 * Makefile.am: Build and install gkrb5_err.h
734 * krb5/gkrb5_err.et: Move the GSS_KRB5_S error here.
736 2006-11-08 Love Hörnquist Åstrand <lha@it.su.se>
738 * mech/gss_krb5.c: Add gsskrb5_set_default_realm.
740 * krb5/set_sec_context_option.c: Support
741 GSS_KRB5_SET_DEFAULT_REALM_X.
743 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DEFAULT_REALM_X
745 * krb5/external.c: add GSS_KRB5_SET_DEFAULT_REALM_X
747 2006-11-07 Love Hörnquist Åstrand <lha@it.su.se>
749 * test_context.c: rename krb5_[gs]et_time_wrap to
750 krb5_[gs]et_max_time_skew
752 * krb5/copy_ccache.c: _gsskrb5_extract_authz_data_from_sec_context
753 no longer used, bye bye
755 * mech/gss_krb5.c: No depenency of the krb5 gssapi mech.
757 * mech/gss_krb5.c (gsskrb5_extract_authtime_from_sec_context): use
758 _gsskrb5_decode_om_uint32. From Andrew Bartlet.
760 * mech/gss_krb5.c: Add dummy gss_krb5_set_allowable_enctypes for
763 * spnego/spnego_locl.h: Include <roken.h> for compatiblity.
765 * krb5/arcfour.c: Use IS_DCE_STYLE flag. There is no padding in
766 DCE-STYLE, don't try to use to. From Andrew Bartlett.
768 * test_context.c: test wrap/unwrap, add flag for dce-style and
769 mutual auth, also support multi-roundtrip sessions
771 * krb5/gsskrb5_locl.h: Add IS_DCE_STYLE macro.
773 * krb5/accept_sec_context.c (gsskrb5_acceptor_start): use
776 * mech/gss_krb5.c (gsskrb5_get_subkey): return the per message
779 * krb5/inquire_sec_context_by_oid.c: check if there is any key at
782 2006-11-06 Love Hörnquist Åstrand <lha@it.su.se>
784 * krb5/inquire_sec_context_by_oid.c: Set more error strings, use
785 right enum for acceptor subkey. From Andrew Bartlett.
787 2006-11-04 Love Hörnquist Åstrand <lha@it.su.se>
789 * test_context.c: Test gsskrb5_extract_service_keyblock, needed in
790 PAC valication. From Andrew Bartlett
792 * mech/gss_krb5.c: Add gsskrb5_extract_authz_data_from_sec_context
793 and keyblock extraction functions.
795 * gssapi/gssapi_krb5.h: Add extraction of keyblock function, from
798 * krb5/external.c: Add GSS_KRB5_GET_SERVICE_KEYBLOCK_X
800 2006-11-03 Love Hörnquist Åstrand <lha@it.su.se>
802 * test_context.c: Rename various routines and constants from
803 canonize to canonicalize. From Andrew Bartlett
805 * mech/gss_krb5.c: Rename various routines and constants from
806 canonize to canonicalize. From Andrew Bartlett
808 * krb5/set_sec_context_option.c: Rename various routines and
809 constants from canonize to canonicalize. From Andrew Bartlett
811 * krb5/external.c: Rename various routines and constants from
812 canonize to canonicalize. From Andrew Bartlett
814 * gssapi/gssapi_krb5.h: Rename various routines and constants from
815 canonize to canonicalize. From Andrew Bartlett
817 2006-10-25 Love Hörnquist Åstrand <lha@it.su.se>
819 * krb5/accept_sec_context.c (gsskrb5_accept_delegated_token): need
822 2006-10-24 Love Hörnquist Åstrand <lha@it.su.se>
824 * test_context.c (loop): free target_name
826 * mech/gss_accept_sec_context.c: SLIST_INIT the ->gc_mc'
828 * mech/gss_acquire_cred.c : SLIST_INIT the ->gc_mc'
830 * krb5/init_sec_context.c: Avoid leaking memory.
832 * mech/gss_buffer_set.c (gss_release_buffer_set): don't leak the
835 * test_context.c: make compile
837 * krb5/cfx.c (_gssapi_verify_mic_cfx): always free crypto context.
839 * krb5/set_cred_option.c (import_cred): free sp
841 2006-10-22 Love Hörnquist Åstrand <lha@it.su.se>
843 * mech/gss_add_oid_set_member.c: Use old implementation of
844 gss_add_oid_set_member, it leaks less memory.
846 * krb5/test_cfx.c: free krb5_crypto.
848 * krb5/test_cfx.c: free krb5_context
850 * mech/gss_release_name.c (gss_release_name): free input_name
853 2006-10-21 Love Hörnquist Åstrand <lha@it.su.se>
855 * test_context.c: Call setprogname.
857 * mech/gss_krb5.c: Add gsskrb5_extract_authtime_from_sec_context.
859 * gssapi/gssapi_krb5.h: add
860 gsskrb5_extract_authtime_from_sec_context
862 2006-10-20 Love Hörnquist Åstrand <lha@it.su.se>
864 * krb5/inquire_sec_context_by_oid.c: Add get_authtime.
866 * krb5/external.c: add GSS_KRB5_GET_AUTHTIME_X
868 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_AUTHTIME_X
870 * krb5/set_sec_context_option.c: Implement GSS_KRB5_SEND_TO_KDC_X.
872 * mech/gss_krb5.c: Add gsskrb5_set_send_to_kdc
874 * gssapi/gssapi_krb5.h: Add GSS_KRB5_SEND_TO_KDC_X and
875 gsskrb5_set_send_to_kdc
877 * krb5/external.c: add GSS_KRB5_SEND_TO_KDC_X
879 * Makefile.am: more files
881 2006-10-19 Love Hörnquist Åstrand <lha@it.su.se>
883 * Makefile.am: remove spnego/gssapi_spnego.h, its now in gssapi/
885 * test_context.c: Allow specifing mech.
887 * krb5/external.c: add GSS_SASL_DIGEST_MD5_MECHANISM (for now)
889 * gssapi/gssapi.h: Rename GSS_DIGEST_MECHANISM to
890 GSS_SASL_DIGEST_MD5_MECHANISM
892 2006-10-18 Love Hörnquist Åstrand <lha@it.su.se>
894 * mech/gssapi.asn1: Make it into a heim_any_set, its doesn't
897 * mech/gssapi.asn1: GSSAPIContextToken is IMPLICIT SEQUENCE
899 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X
901 * krb5/external.c: Add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X.
903 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_INITIATOR_SUBKEY_X and
904 GSS_KRB5_GET_SUBKEY_X
906 * krb5/external.c: add GSS_KRB5_GET_INITIATOR_SUBKEY_X,
907 GSS_KRB5_GET_SUBKEY_X
909 2006-10-17 Love Hörnquist Åstrand <lha@it.su.se>
911 * test_context.c: Support switching on name type oid's
913 * test_context.c: add test for dns canon flag
915 * mech/gss_krb5.c: Add gsskrb5_set_dns_canonlize.
917 * gssapi/gssapi_krb5.h: remove gss_krb5_compat_des3_mic
919 * gssapi/gssapi_krb5.h: Add gsskrb5_set_dns_canonlize.
921 * krb5/set_sec_context_option.c: implement
922 GSS_KRB5_SET_DNS_CANONIZE_X
924 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DNS_CANONIZE_X
926 * krb5/external.c: add GSS_KRB5_SET_DNS_CANONIZE_X
928 * mech/gss_krb5.c: add bits to make lucid context work
930 2006-10-14 Love Hörnquist Åstrand <lha@it.su.se>
932 * mech/gss_oid_to_str.c: Prefix der primitives with der_.
934 * krb5/inquire_sec_context_by_oid.c: Prefix der primitives with
937 * krb5/encapsulate.c: Prefix der primitives with der_.
939 * mech/gss_oid_to_str.c: New der_print_heim_oid signature.
941 2006-10-12 Love Hörnquist Åstrand <lha@it.su.se>
943 * Makefile.am: add test_context
945 * krb5/inquire_sec_context_by_oid.c: Make it work.
947 * test_oid.c: Test lucid oid.
949 * gssapi/gssapi.h: Add OM_uint64_t.
951 * krb5/inquire_sec_context_by_oid.c: Add lucid interface.
953 * krb5/external.c: Add lucid interface, renumber oids to my
956 * mech/gss_krb5.c: Add lucid interface.
958 * gssapi/gssapi_krb5.h: Add lucid interface.
960 * spnego/spnego_locl.h: Maybe include <netdb.h>.
962 2006-10-09 Love Hörnquist Åstrand <lha@it.su.se>
964 * mech/gss_mech_switch.c: define RTLD_LOCAL to 0 if not defined.
966 2006-10-08 Love Hörnquist Åstrand <lha@it.su.se>
968 * Makefile.am: install gssapi_krb5.H and gssapi_spnego.h
970 * gssapi/gssapi_krb5.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
972 * gssapi/gssapi.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
974 * Makefile.am: Drop some -I no longer needed.
976 * gssapi/gssapi_spnego.h: Move gssapi_spengo.h over here.
978 * krb5: reference all include files using 'krb5/'
980 2006-10-07 Love Hörnquist Åstrand <lha@it.su.se>
982 * gssapi.h: Add file inclusion protection.
984 * gssapi/gssapi.h: Correct header file inclusion protection.
986 * gssapi/gssapi.h: Move the gssapi.h from lib/gssapi/ to
987 lib/gssapi/gssapi/ to please automake.
989 * spnego/spnego_locl.h: Maybe include <sys/types.h>.
991 * mech/mech_locl.h: Include <roken.h>.
993 * Makefile.am: split build files into dist_ and noinst_ SOURCES
995 2006-10-06 Love Hörnquist Åstrand <lha@it.su.se>
997 * gss.c: #if 0 out unused code.
999 * mech/gss_mech_switch.c: Cast argument to ctype(3) functions
1002 2006-10-05 Love Hörnquist Åstrand <lha@it.su.se>
1004 * mech/name.h: remove <sys/queue.h>
1006 * mech/mech_switch.h: remove <sys/queue.h>
1008 * mech/cred.h: remove <sys/queue.h>
1010 2006-10-02 Love Hörnquist Åstrand <lha@it.su.se>
1012 * krb5/arcfour.c: Thinker more with header lengths.
1014 * krb5/arcfour.c: Improve the calcucation of header
1015 lengths. DCE-STYLE data is also padded so remove if (1 || ...)
1018 * krb5/wrap.c (_gsskrb5_wrap_size_limit): use
1019 _gssapi_wrap_size_arcfour for arcfour
1021 * krb5/arcfour.c: Move _gssapi_wrap_size_arcfour here.
1023 * Makefile.am: Split all mech to diffrent mechsrc variables.
1025 * spnego/context_stubs.c: Make internal function static (and
1028 2006-10-01 Love Hörnquist Åstrand <lha@it.su.se>
1030 * krb5/inquire_cred.c: Fix "if (x) lock(y)" bug. From Harald
1033 * spnego/spnego_locl.h: Include <sys/param.h> for MAXHOSTNAMELEN.
1035 2006-09-25 Love Hörnquist Åstrand <lha@it.su.se>
1037 * krb5/arcfour.c: Add wrap support, interrop with itself but not
1040 * krb5/gsskrb5_locl.h: move the arcfour specific stuff to the
1043 * krb5/arcfour.c: Support DCE-style unwrap, tested with
1046 * mech/gss_accept_sec_context.c (gss_accept_sec_context): if the
1047 token doesn't start with [APPLICATION 0] SEQUENCE, lets assume its
1048 a DCE-style kerberos 5 connection. XXX this needs to be made
1049 better in cause we get another GSS-API protocol violating
1050 protocol. It should be possible to detach the Kerberos DCE-style
1051 since it starts with a AP-REQ PDU, but that have to wait for now.
1053 2006-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1055 * gssapi.h: Add GSS_C flags from
1056 draft-brezak-win2k-krb-rc4-hmac-04.txt.
1058 * krb5/delete_sec_context.c: Free service_keyblock and fwd_data,
1061 * krb5/accept_sec_context.c: Merge of the acceptor part from the
1062 samba patch by Stefan Metzmacher and Andrew Bartlet.
1064 * krb5/init_sec_context.c: Add GSS_C_DCE_STYLE.
1066 * krb5/{init_sec_context.c,gsskrb5_locl.h}: merge most of the
1067 initiator part from the samba patch by Stefan Metzmacher and
1068 Andrew Bartlet (still missing DCE/RPC support)
1070 2006-08-28 Love Hörnquist Åstrand <lha@it.su.se>
1072 * gss.c (help): use sl_slc_help().
1074 2006-07-22 Love Hörnquist Åstrand <lha@it.su.se>
1076 * gss-commands.in: rename command to supported-mechanisms
1078 * Makefile.am: Make gss objects depend on the slc built
1081 2006-07-20 Love Hörnquist Åstrand <lha@it.su.se>
1083 * gss-commands.in: add slc commands for gss
1085 * krb5/gsskrb5_locl.h: Remove dup prototype of _gsskrb5_init()
1087 * Makefile.am: Add test_cfx
1089 * krb5/external.c: add GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1091 * krb5/set_sec_context_option.c: catch
1092 GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1094 * krb5/accept_sec_context.c: reimplement
1095 gsskrb5_register_acceptor_identity
1097 * mech/gss_krb5.c: implement gsskrb5_register_acceptor_identity
1099 * mech/gss_inquire_mechs_for_name.c: call _gss_load_mech
1101 * mech/gss_inquire_cred.c (gss_inquire_cred): call _gss_load_mech
1103 * mech/gss_mech_switch.c: Make _gss_load_mech() atomic and run
1104 only once, this have the side effect that _gss_mechs and
1105 _gss_mech_oids is only initialized once, so if just the users of
1106 these two global variables calls _gss_load_mech() first, it will
1107 act as a barrier and make sure the variables are never changed and
1108 we don't need to lock them.
1110 * mech/utils.h: no need to mark functions extern.
1112 * mech/name.h: no need to mark _gss_find_mn extern.
1114 2006-07-19 Love Hörnquist Åstrand <lha@it.su.se>
1116 * krb5/cfx.c: Redo the wrap length calculations.
1118 * krb5/test_cfx.c: test max_wrap_size in cfx.c
1120 * mech/gss_display_status.c: Handle more error codes.
1122 2006-07-07 Love Hörnquist Åstrand <lha@it.su.se>
1124 * mech/mech_locl.h: Include <krb5-types.h> and "mechqueue.h"
1126 * mech/mechqueue.h: Add SLIST macros.
1128 * krb5/inquire_context.c: Don't free return values on success.
1130 * krb5/inquire_cred.c (_gsskrb5_inquire_cred): When cred provided
1131 is the default cred, acquire the acceptor cred and initator cred
1132 in two diffrent steps and then query them for the information,
1133 this way, the code wont fail if there are no keytab, but there is
1136 * mech/gss_inquire_cred.c: move the check if we found any cred
1137 where it matter for both cases
1138 (default cred and provided cred)
1140 * mech/gss_init_sec_context.c: If the desired mechanism can't
1141 convert the name to a MN, fail with GSS_S_BAD_NAME rather then a
1144 2006-07-06 Love Hörnquist Åstrand <lha@it.su.se>
1146 * spnego/external.c: readd gss_spnego_inquire_names_for_mech
1148 * spnego/spnego_locl.h: reimplement
1149 gss_spnego_inquire_names_for_mech add support function
1150 _gss_spnego_supported_mechs
1152 * spnego/context_stubs.h: reimplement
1153 gss_spnego_inquire_names_for_mech add support function
1154 _gss_spnego_supported_mechs
1156 * spnego/context_stubs.c: drop gss_spnego_indicate_mechs
1158 * mech/gss_indicate_mechs.c: if the underlaying mech doesn't
1159 support gss_indicate_mechs, use the oid in the mechswitch
1162 * spnego/external.c: let the mech glue layer implement
1165 * spnego/cred_stubs.c (gss_spnego_acquire_cred): don't care about
1166 desired_mechs, get our own list with indicate_mechs and remove
1169 2006-07-05 Love Hörnquist Åstrand <lha@it.su.se>
1171 * spnego/external.c: remove gss_spnego_inquire_names_for_mech, let
1172 the mechglue layer implement it
1174 * spnego/context_stubs.c: remove gss_spnego_inquire_names_for_mech, let
1175 the mechglue layer implement it
1177 * spnego/spnego_locl.c: remove gss_spnego_inquire_names_for_mech, let
1178 the mechglue layer implement it
1180 2006-07-01 Love Hörnquist Åstrand <lha@it.su.se>
1182 * mech/gss_set_cred_option.c: fix argument to gss_release_cred
1184 2006-06-30 Love Hörnquist Åstrand <lha@it.su.se>
1186 * krb5/init_sec_context.c: Make work on compilers that are
1187 somewhat more picky then gcc4 (like gcc2.95)
1189 * krb5/init_sec_context.c (do_delegation): use KDCOptions2int to
1190 convert fwd_flags to an integer, since otherwise int2KDCOptions in
1191 krb5_get_forwarded_creds wont do the right thing.
1193 * mech/gss_set_cred_option.c (gss_set_cred_option): free memory on
1196 * krb5/set_sec_context_option.c (_gsskrb5_set_sec_context_option):
1197 init global kerberos context
1199 * krb5/set_cred_option.c (_gsskrb5_set_cred_option): init global
1202 * mech/gss_accept_sec_context.c: Insert the delegated sub cred on
1203 the delegated cred handle, not cred handle
1205 * mech/gss_accept_sec_context.c (gss_accept_sec_context): handle
1206 the case where ret_flags == NULL
1208 * mech/gss_mech_switch.c (add_builtin): set
1209 _gss_mech_switch->gm_mech_oid
1211 * mech/gss_set_cred_option.c (gss_set_cred_option): laod mechs
1213 * test_cred.c (gss_print_errors): don't try to print error when
1214 gss_display_status failed
1216 * Makefile.am: Add mech/gss_release_oid.c
1218 * mech/gss_release_oid.c: Add gss_release_oid, reverse of
1221 * spnego/compat.c: preferred_mech_type was allocated with
1222 gss_duplicate_oid in one place and assigned static varianbles a
1223 the second place. change that static assignement to
1224 gss_duplicate_oid and bring back gss_release_oid.
1226 * spnego/compat.c (_gss_spnego_delete_sec_context): don't release
1227 preferred_mech_type and negotiated_mech_type, they where never
1228 allocated from the begining.
1230 2006-06-29 Love Hörnquist Åstrand <lha@it.su.se>
1232 * mech/gss_import_name.c (gss_import_name): avoid
1233 type-punned/strict aliasing rules
1235 * mech/gss_add_cred.c: avoid type-punned/strict aliasing rules
1237 * gssapi.h: Make gss_name_t an opaque type.
1239 * krb5: make gss_name_t an opaque type
1241 * krb5/set_cred_option.c: Add
1243 * mech/gss_set_cred_option.c (gss_set_cred_option): support the
1244 case where *cred_handle == NULL
1246 * mech/gss_krb5.c (gss_krb5_import_cred): make sure cred is
1247 GSS_C_NO_CREDENTIAL on failure.
1249 * mech/gss_acquire_cred.c (gss_acquire_cred): if desired_mechs is
1250 NO_OID_SET, there is a need to load the mechs, so always do that.
1252 2006-06-28 Love Hörnquist Åstrand <lha@it.su.se>
1254 * krb5/inquire_cred_by_oid.c: Reimplement GSS_KRB5_COPY_CCACHE_X
1255 to instead pass a fullname to the credential, then resolve and
1256 copy out the content, and then close the cred.
1258 * mech/gss_krb5.c: Reimplement GSS_KRB5_COPY_CCACHE_X to instead
1259 pass a fullname to the credential, then resolve and copy out the
1260 content, and then close the cred.
1262 * krb5/inquire_cred_by_oid.c: make "work", GSS_KRB5_COPY_CCACHE_X
1263 interface needs to be re-done, currently its utterly broken.
1265 * mech/gss_set_cred_option.c: Make work.
1267 * krb5/external.c: Add _gsskrb5_set_{sec_context,cred}_option
1269 * mech/gss_krb5.c (gss_krb5_import_cred): implement
1271 * Makefile.am: Add gss_set_{sec_context,cred}_option and sort
1273 * mech/gss_set_{sec_context,cred}_option.c: add
1275 * gssapi.h: Add GSS_KRB5_IMPORT_CRED_X
1277 * test_*.c: make compile again
1279 * Makefile.am: Add lib dependencies and test programs
1281 * spnego: remove dependency on libkrb5
1283 * mech: Bug fixes, cleanup, compiler warnings, restructure code.
1285 * spnego: Rename gss_context_id_t and gss_cred_id_t to local names
1287 * krb5: repro copy the krb5 files here
1289 * mech: import Doug Rabson mechglue from freebsd
1291 * spnego: Import Luke Howard's SPNEGO from the mechglue branch
1293 2006-06-22 Love Hörnquist Åstrand <lha@it.su.se>
1295 * gssapi.h: Add oid_to_str.
1297 * Makefile.am: add oid_to_str and test_oid
1299 * oid_to_str.c: Add gss_oid_to_str
1301 * test_oid.c: Add test for gss_oid_to_str()
1303 2006-05-13 Love Hörnquist Åstrand <lha@it.su.se>
1305 * verify_mic.c: Less pointer signedness warnings.
1307 * unwrap.c: Less pointer signedness warnings.
1309 * arcfour.c: Less pointer signedness warnings.
1311 * gssapi_locl.h: Use const void * to instead of unsigned char * to
1312 avoid pointer signedness warnings.
1314 * encapsulate.c: Use const void * to instead of unsigned char * to
1315 avoid pointer signedness warnings.
1317 * decapsulate.c: Use const void * to instead of unsigned char * to
1318 avoid pointer signedness warnings.
1320 * decapsulate.c: Less pointer signedness warnings.
1322 * cfx.c: Less pointer signedness warnings.
1324 * init_sec_context.c: Less pointer signedness warnings (partly by
1325 using the new asn.1 CHOICE decoder)
1327 * import_sec_context.c: Less pointer signedness warnings.
1329 2006-05-09 Love Hörnquist Åstrand <lha@it.su.se>
1331 * accept_sec_context.c (gsskrb5_is_cfx): always set is_cfx. From
1334 2006-05-08 Love Hörnquist Åstrand <lha@it.su.se>
1336 * get_mic.c (mic_des3): make sure message_buffer doesn't point to
1337 free()ed memory on failure. Pointed out by IBM checker.
1339 2006-05-05 Love Hörnquist Åstrand <lha@it.su.se>
1341 * Rename u_intXX_t to uintXX_t
1343 2006-05-04 Love Hörnquist Åstrand <lha@it.su.se>
1345 * cfx.c: Less pointer signedness warnings.
1347 * arcfour.c: Avoid pointer signedness warnings.
1349 * gssapi_locl.h (gssapi_decode_*): make data argument const void *
1351 * 8003.c (gssapi_decode_*): make data argument const void *
1353 2006-04-12 Love Hörnquist Åstrand <lha@it.su.se>
1355 * export_sec_context.c: Export sequence order element. From Wynn
1356 Wilkes <wynn.wilkes@quest.com>.
1358 * import_sec_context.c: Import sequence order element. From Wynn
1359 Wilkes <wynn.wilkes@quest.com>.
1361 * sequence.c (_gssapi_msg_order_import,_gssapi_msg_order_export):
1362 New functions, used by {import,export}_sec_context. From Wynn
1363 Wilkes <wynn.wilkes@quest.com>.
1365 * test_sequence.c: Add test for import/export sequence.
1367 2006-04-09 Love Hörnquist Åstrand <lha@it.su.se>
1369 * add_cred.c: Check that cred != GSS_C_NO_CREDENTIAL, this is a
1370 standard conformance failure, but much better then a crash.
1372 2006-04-02 Love Hörnquist Åstrand <lha@it.su.se>
1374 * get_mic.c (get_mic*)_: make sure message_token is cleaned on
1375 error, found by IBM checker.
1377 * wrap.c (wrap*): Reset output_buffer on error, found by IBM
1380 2006-02-15 Love Hörnquist Åstrand <lha@it.su.se>
1382 * import_name.c: Accept both GSS_C_NT_HOSTBASED_SERVICE and
1383 GSS_C_NT_HOSTBASED_SERVICE_X as nametype for hostbased names.
1385 2006-01-16 Love Hörnquist Åstrand <lha@it.su.se>
1387 * delete_sec_context.c (gss_delete_sec_context): if the context
1388 handle is GSS_C_NO_CONTEXT, don't fall over.
1390 2005-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1392 * gss_acquire_cred.3: Replace gss_krb5_import_ccache with
1393 gss_krb5_import_cred and add more references
1395 2005-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1397 * gssapi.h: Change gss_krb5_import_ccache to gss_krb5_import_cred,
1398 it can handle keytabs too.
1400 * add_cred.c (gss_add_cred): avoid deadlock
1402 * context_time.c (gssapi_lifetime_left): define the 0 lifetime as
1405 2005-12-01 Love Hörnquist Åstrand <lha@it.su.se>
1407 * acquire_cred.c (acquire_acceptor_cred): only check if principal
1408 exists if we got called with principal as an argument.
1410 * acquire_cred.c (acquire_acceptor_cred): check that the acceptor
1411 exists in the keytab before returning ok.
1413 2005-11-29 Love Hörnquist Åstrand <lha@it.su.se>
1415 * copy_ccache.c (gss_krb5_import_cred): fix buglet, from Andrew
1418 2005-11-25 Love Hörnquist Åstrand <lha@it.su.se>
1420 * test_kcred.c: Rename gss_krb5_import_ccache to
1421 gss_krb5_import_cred.
1423 * copy_ccache.c: Rename gss_krb5_import_ccache to
1424 gss_krb5_import_cred and let it grow code to handle keytabs too.
1426 2005-11-02 Love Hörnquist Åstrand <lha@it.su.se>
1428 * init_sec_context.c: Change sematics of ok-as-delegate to match
1430 [gssapi]realm/ok-as-delegate=true is set, otherwise keep old
1433 * release_cred.c (gss_release_cred): use
1434 GSS_CF_DESTROY_CRED_ON_RELEASE to decide if the cache should be
1437 * acquire_cred.c (acquire_initiator_cred):
1438 GSS_CF_DESTROY_CRED_ON_RELEASE on created credentials.
1440 * accept_sec_context.c (gsskrb5_accept_delegated_token): rewrite
1441 to use gss_krb5_import_ccache
1443 2005-11-01 Love Hörnquist Åstrand <lha@it.su.se>
1445 * arcfour.c: Remove signedness warnings.
1447 2005-10-31 Love Hörnquist Åstrand <lha@it.su.se>
1449 * gss_acquire_cred.3: Document that gss_krb5_import_ccache is copy
1452 * copy_ccache.c (gss_krb5_import_ccache): Instead of making a copy
1453 of the ccache, make a reference by getting the name and resolving
1454 the name. This way the cache is shared, this flipp side is of
1455 course that if someone calls krb5_cc_destroy the cache is lost for
1458 * test_kcred.c: Remove memory leaks.
1460 2005-10-26 Love Hörnquist Åstrand <lha@it.su.se>
1462 * Makefile.am: build test_kcred
1464 * gss_acquire_cred.3: Document gss_krb5_import_ccache
1466 * gssapi.3: Sort and add gss_krb5_import_ccache.
1468 * acquire_cred.c (_gssapi_krb5_ccache_lifetime): break out code
1469 used to extract lifetime from a credential cache
1471 * gssapi_locl.h: Add _gssapi_krb5_ccache_lifetime, used to extract
1472 lifetime from a credential cache.
1474 * gssapi.h: add gss_krb5_import_ccache, reverse of
1475 gss_krb5_copy_ccache
1477 * copy_ccache.c: add gss_krb5_import_ccache, reverse of
1478 gss_krb5_copy_ccache
1480 * test_kcred.c: test gss_krb5_import_ccache
1482 2005-10-21 Love Hörnquist Åstrand <lha@it.su.se>
1484 * acquire_cred.c (acquire_initiator_cred): use krb5_cc_cache_match
1485 to find a matching creditial cache, if that failes, fallback to
1488 2005-10-12 Love Hörnquist Åstrand <lha@it.su.se>
1490 * gssapi_locl.h: Add gssapi_krb5_set_status and
1491 gssapi_krb5_clear_status
1493 * init_sec_context.c (spnego_reply): Don't pass back raw Kerberos
1494 errors, use GSS-API errors instead. From Michael B Allen.
1496 * display_status.c: Add gssapi_krb5_clear_status,
1497 gssapi_krb5_set_status for handling error messages.
1499 2005-08-23 Love Hörnquist Åstrand <lha@it.su.se>
1501 * external.c: Use rk_UNCONST to avoid const warning.
1503 * display_status.c: Constify strings to avoid warnings.
1505 2005-08-11 Love Hörnquist Åstrand <lha@it.su.se>
1507 * init_sec_context.c: avoid warnings, update (c)
1509 2005-07-13 Love Hörnquist Åstrand <lha@it.su.se>
1511 * init_sec_context.c (spnego_initial): use NegotiationToken
1512 encoder now that we have one with the new asn1. compiler.
1514 * Makefile.am: the new asn.1 compiler includes the modules name in
1517 2005-06-16 Love Hörnquist Åstrand <lha@it.su.se>
1519 * decapsulate.c: use rk_UNCONST
1521 * ccache_name.c: rename to avoid shadowing
1523 * gssapi_locl.h: give kret in GSSAPI_KRB5_INIT a more unique name
1525 * process_context_token.c: use rk_UNCONST to unconstify
1527 * test_cred.c: rename optind to optidx
1529 2005-05-30 Love Hörnquist Åstrand <lha@it.su.se>
1531 * init_sec_context.c (init_auth): honor ok-as-delegate if local
1532 configuration approves
1534 * gssapi_locl.h: prototype for _gss_check_compat
1536 * compat.c: export check_compat as _gss_check_compat
1538 2005-05-29 Love Hörnquist Åstrand <lha@it.su.se>
1540 * init_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1541 problems with system headerfiles that pollute the name space.
1543 * accept_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1544 problems with system headerfiles that pollute the name space.
1546 2005-05-17 Love Hörnquist Åstrand <lha@it.su.se>
1548 * init_sec_context.c (init_auth): set
1549 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED (for java compatibility),
1550 also while here, use krb5_auth_con_addflags
1552 2005-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1554 * arcfour.c (_gssapi_wrap_arcfour): fix calculating the encap
1555 length. From: Tom Maher <tmaher@eecs.berkeley.edu>
1557 2005-05-02 Dave Love <fx@gnu.org>
1559 * test_cred.c (main): Call setprogname.
1561 2005-04-27 Love Hörnquist Åstrand <lha@it.su.se>
1563 * prefix all sequence symbols with _, they are not part of the
1564 GSS-API api. By comment from Wynn Wilkes <wynnw@vintela.com>
1566 2005-04-10 Love Hörnquist Åstrand <lha@it.su.se>
1568 * accept_sec_context.c: break out the processing of the delegated
1569 credential to a separate function to make error handling easier,
1570 move the credential handling to after other setup is done
1572 * test_sequence.c: make less verbose in case of success
1574 * Makefile.am: add test_sequence to TESTS
1576 2005-04-01 Love Hörnquist Åstrand <lha@it.su.se>
1578 * 8003.c (gssapi_krb5_verify_8003_checksum): check that cksum
1579 isn't NULL From: Nicolas Pouvesle <npouvesle@tenablesecurity.com>
1581 2005-03-21 Love Hörnquist Åstrand <lha@it.su.se>
1583 * Makefile.am: use $(LIB_roken)
1585 2005-03-16 Love Hörnquist Åstrand <lha@it.su.se>
1587 * display_status.c (gssapi_krb5_set_error_string): pass in the
1588 krb5_context to krb5_free_error_string
1590 2005-03-15 Love Hörnquist Åstrand <lha@it.su.se>
1592 * display_status.c (gssapi_krb5_set_error_string): don't misuse
1593 the krb5_get_error_string api
1595 2005-03-01 Love Hörnquist Åstrand <lha@it.su.se>
1597 * compat.c (_gss_DES3_get_mic_compat): don't unlock mutex
1598 here. Bug reported by Stefan Metzmacher <metze@samba.org>
1600 2005-02-21 Luke Howard <lukeh@padl.com>
1602 * init_sec_context.c: don't call krb5_get_credentials() with
1603 KRB5_TC_MATCH_KEYTYPE, it can lead to the credentials cache
1604 growing indefinitely as no key is found with KEYTYPE_NULL
1606 * compat.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG, it is
1607 no longer used (however the mechListMIC behaviour is broken,
1608 rfc2478bis support requires the code in the mechglue branch)
1610 * init_sec_context.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1612 * gssapi.h: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1614 2005-01-05 Luke Howard <lukeh@padl.com>
1616 * 8003.c: use symbolic name for checksum type
1618 * accept_sec_context.c: allow client to indicate
1619 that subkey should be used
1621 * acquire_cred.c: plug leak
1623 * get_mic.c: use gss_krb5_get_subkey() instead
1624 of gss_krb5_get_{local,remote}key(), support
1627 * gssapi_local.c: use gss_krb5_get_subkey(),
1628 support KEYTYPE_ARCFOUR_56
1630 * import_sec_context.c: plug leak
1632 * unwrap.c: use gss_krb5_get_subkey(),
1633 support KEYTYPE_ARCFOUR_56
1635 * verify_mic.c: use gss_krb5_get_subkey(),
1636 support KEYTYPE_ARCFOUR_56
1638 * wrap.c: use gss_krb5_get_subkey(),
1639 support KEYTYPE_ARCFOUR_56
1641 2004-11-30 Love Hörnquist Åstrand <lha@it.su.se>
1643 * inquire_cred.c: Reverse order of HEIMDAL_MUTEX_unlock and
1644 gss_release_cred to avoid deadlock, from Luke Howard
1647 2004-09-06 Love Hörnquist Åstrand <lha@it.su.se>
1649 * gss_acquire_cred.3: gss_krb5_extract_authz_data_from_sec_context
1650 was renamed to gsskrb5_extract_authz_data_from_sec_context
1652 2004-08-07 Love Hörnquist Åstrand <lha@it.su.se>
1654 * unwrap.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1656 * arcfour.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1658 2004-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1660 * gssapi.3: spelling from Josef El-Rayes <josef@FreeBSD.org> while
1661 here, write some text about the SPNEGO situation
1663 2004-04-08 Love Hörnquist Åstrand <lha@it.su.se>
1665 * cfx.c: s/CTXAcceptorSubkey/CFXAcceptorSubkey/
1667 2004-04-07 Love Hörnquist Åstrand <lha@it.su.se>
1669 * gssapi.h: add GSS_C_EXPECTING_MECH_LIST_MIC_FLAG From: Luke
1670 Howard <lukeh@padl.com>
1672 * init_sec_context.c (spnego_reply): use
1673 _gss_spnego_require_mechlist_mic to figure out if we need to check
1674 MechListMIC; From: Luke Howard <lukeh@padl.com>
1676 * accept_sec_context.c (send_accept): use
1677 _gss_spnego_require_mechlist_mic to figure out if we need to send
1678 MechListMIC; From: Luke Howard <lukeh@padl.com>
1680 * gssapi_locl.h: add _gss_spnego_require_mechlist_mic
1681 From: Luke Howard <lukeh@padl.com>
1683 * compat.c: add _gss_spnego_require_mechlist_mic for compatibility
1684 with MS SPNEGO, From: Luke Howard <lukeh@padl.com>
1686 2004-04-05 Love Hörnquist Åstrand <lha@it.su.se>
1688 * accept_sec_context.c (gsskrb5_is_cfx): krb5_keyblock->keytype is
1689 an enctype, not keytype
1691 * accept_sec_context.c: use ASN1_MALLOC_ENCODE
1693 * init_sec_context.c: avoid the malloc loop and just allocate the
1694 propper amount of data
1696 * init_sec_context.c (spnego_initial): handle mech_token better
1698 2004-03-19 Love Hörnquist Åstrand <lha@it.su.se>
1700 * gssapi.h: add gss_krb5_get_tkt_flags
1702 * Makefile.am: add ticket_flags.c
1704 * ticket_flags.c: Get ticket-flags from acceptor ticket From: Luke
1705 Howard <lukeh@PADL.COM>
1707 * gss_acquire_cred.3: document gss_krb5_get_tkt_flags
1709 2004-03-14 Love Hörnquist Åstrand <lha@it.su.se>
1711 * acquire_cred.c (gss_acquire_cred): check usage before even
1712 bothering to process it, add both keytab and initial tgt if
1715 * wrap.c: support cfx, try to handle acceptor asserted subkey
1717 * unwrap.c: support cfx, try to handle acceptor asserted subkey
1719 * verify_mic.c: support cfx
1721 * get_mic.c: support cfx
1723 * test_sequence.c: handle changed signature of
1724 gssapi_msg_order_create
1726 * import_sec_context.c: handle acceptor asserted subkey
1728 * init_sec_context.c: handle acceptor asserted subkey
1730 * accept_sec_context.c: handle acceptor asserted subkey
1732 * sequence.c: add dummy use_64 argument to gssapi_msg_order_create
1734 * gssapi_locl.h: add partial support for CFX
1736 * Makefile.am (noinst_PROGRAMS) += test_cred
1738 * test_cred.c: gssapi credential testing
1740 * test_acquire_cred.c: fix comment
1742 2004-03-07 Love Hörnquist Åstrand <lha@it.su.se>
1744 * arcfour.h: drop structures for message formats, no longer used
1746 * arcfour.c: comment describing message formats
1748 * accept_sec_context.c (spnego_accept_sec_context): make sure the
1749 length of the choice element doesn't overrun us
1751 * init_sec_context.c (spnego_reply): make sure the length of the
1752 choice element doesn't overrun us
1754 * spnego.asn1: move NegotiationToken to avoid warning
1756 * spnego.asn1: uncomment NegotiationToken
1758 * Makefile.am: spnego_files += asn1_NegotiationToken.x
1760 2004-01-25 Love Hörnquist Åstrand <lha@it.su.se>
1762 * gssapi.h: add gss_krb5_ccache_name
1764 * Makefile.am (libgssapi_la_SOURCES): += ccache_name.c
1766 * ccache_name.c (gss_krb5_ccache_name): help function enable to
1767 set krb5 name, using out_name argument makes function no longer
1770 * gssapi.3: add missing gss_krb5_ references
1772 * gss_acquire_cred.3: document gss_krb5_ccache_name
1774 2003-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1776 * cfx.c: make rrc a modulus operation if its longer then the
1777 length of the message, noticed by Sam Hartman
1779 2003-12-07 Love Hörnquist Åstrand <lha@it.su.se>
1781 * accept_sec_context.c: use krb5_auth_con_addflags
1783 2003-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1785 * cfx.c: Wrap token id was in wrong order, found by Sam Hartman
1787 2003-12-04 Love Hörnquist Åstrand <lha@it.su.se>
1789 * cfx.c: add AcceptorSubkey (but no code understand it yet) ignore
1792 2003-11-22 Love Hörnquist Åstrand <lha@it.su.se>
1794 * accept_sec_context.c: Don't require timestamp to be set on
1795 delegated token, its already protected by the outer token (and
1796 windows doesn't alway send it) Pointed out by Zi-Bin Yang
1797 <zbyang@decru.com> on heimdal-discuss
1799 2003-11-14 Love Hörnquist Åstrand <lha@it.su.se>
1801 * cfx.c: fix {} error, pointed out by Liqiang Zhu
1803 2003-11-10 Love Hörnquist Åstrand <lha@it.su.se>
1805 * cfx.c: Sequence number should be stored in bigendian order From:
1806 Luke Howard <lukeh@padl.com>
1808 2003-11-09 Love Hörnquist Åstrand <lha@it.su.se>
1810 * delete_sec_context.c (gss_delete_sec_context): don't free
1811 ticket, krb5_free_ticket does that now
1813 2003-11-06 Love Hörnquist Åstrand <lha@it.su.se>
1815 * cfx.c: checksum the header last in MIC token, update to -03
1816 From: Luke Howard <lukeh@padl.com>
1818 2003-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1820 * add_cred.c: If its a MEMORY cc, make a copy. We need to do this
1821 since now gss_release_cred will destroy the cred. This should be
1822 really be solved a better way.
1824 * acquire_cred.c (gss_release_cred): if its a mcc, destroy it
1825 rather the just release it Found by: "Zi-Bin Yang"
1828 * acquire_cred.c (acquire_initiator_cred): use kret instead of ret
1831 2003-09-30 Love Hörnquist Åstrand <lha@it.su.se>
1833 * gss_acquire_cred.3: spelling
1834 From: jmc <jmc@prioris.mini.pw.edu.pl>
1836 2003-09-23 Love Hörnquist Åstrand <lha@it.su.se>
1838 * cfx.c: - EC and RRC are big-endian, not little-endian - The
1839 default is now to rotate regardless of GSS_C_DCE_STYLE. There are
1840 no longer any references to GSS_C_DCE_STYLE. - rrc_rotate()
1841 avoids allocating memory on the heap if rrc <= 256
1842 From: Luke Howard <lukeh@padl.com>
1844 2003-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1846 * cfx.[ch]: rrc_rotate() was untested and broken, fix it.
1847 Set and verify wrap Token->Filler.
1848 Correct token ID for wrap tokens,
1849 were accidentally swapped with delete tokens.
1850 From: Luke Howard <lukeh@PADL.COM>
1852 2003-09-21 Love Hörnquist Åstrand <lha@it.su.se>
1854 * cfx.[ch]: no ASN.1-ish header on per-message tokens
1855 From: Luke Howard <lukeh@PADL.COM>
1857 2003-09-19 Love Hörnquist Åstrand <lha@it.su.se>
1859 * arcfour.h: remove depenency on gss_arcfour_mic_token and
1860 gss_arcfour_warp_token
1862 * arcfour.c: remove depenency on gss_arcfour_mic_token and
1863 gss_arcfour_warp_token
1865 2003-09-18 Love Hörnquist Åstrand <lha@it.su.se>
1867 * 8003.c: remove #if 0'ed code
1869 2003-09-17 Love Hörnquist Åstrand <lha@it.su.se>
1871 * accept_sec_context.c (gsskrb5_accept_sec_context): set sequence
1872 number when not requesting mutual auth From: Luke Howard
1875 * init_sec_context.c (init_auth): set sequence number when not
1876 requesting mutual auth From: Luke Howard <lukeh@PADL.COM>
1878 2003-09-16 Love Hörnquist Åstrand <lha@it.su.se>
1880 * arcfour.c (*): set minor_status
1881 (gss_wrap): set conf_state to conf_req_flags on success
1882 From: Luke Howard <lukeh@PADL.COM>
1884 * wrap.c (gss_wrap_size_limit): use existing function From: Luke
1885 Howard <lukeh@PADL.COM>
1887 2003-09-12 Love Hörnquist Åstrand <lha@it.su.se>
1889 * indicate_mechs.c (gss_indicate_mechs): in case of error, free
1892 * indicate_mechs.c (gss_indicate_mechs): add SPNEGO
1894 2003-09-10 Love Hörnquist Åstrand <lha@it.su.se>
1896 * init_sec_context.c (spnego_initial): catch errors and return
1899 * init_sec_context.c (spnego_initial): add #if 0 out version of
1900 the CHOICE branch encoding, also where here, free no longer used
1903 2003-09-09 Love Hörnquist Åstrand <lha@it.su.se>
1905 * gss_acquire_cred.3: support GSS_SPNEGO_MECHANISM
1907 * accept_sec_context.c: SPNEGO doesn't include gss wrapping on
1908 SubsequentContextToken like the Kerberos 5 mech does.
1910 * init_sec_context.c (spnego_reply): SPNEGO doesn't include gss
1911 wrapping on SubsequentContextToken like the Kerberos 5 mech
1912 does. Lets check for it anyway.
1914 * accept_sec_context.c: Add support for SPNEGO on the initator
1915 side. Implementation initially from Assar Westerlund, passes
1916 though quite a lot of hands before I commited it.
1918 * init_sec_context.c: Add support for SPNEGO on the initator side.
1919 Tested with ldap server on a Windows 2000 DC. Implementation
1920 initially from Assar Westerlund, passes though quite a lot of
1921 hands before I commited it.
1923 * gssapi.h: export GSS_SPNEGO_MECHANISM
1925 * gssapi_locl.h: include spnego_as.h add prototype for
1926 gssapi_krb5_get_mech
1928 * decapsulate.c (gssapi_krb5_get_mech): make non static
1930 * Makefile.am: build SPNEGO file
1932 2003-09-08 Love Hörnquist Åstrand <lha@it.su.se>
1934 * external.c: SPENGO and IAKERB oids
1936 * spnego.asn1: SPENGO ASN1
1938 2003-09-05 Love Hörnquist Åstrand <lha@it.su.se>
1940 * cfx.c: RRC also need to be zero before wraping them
1941 From: Luke Howard <lukeh@PADL.COM>
1943 2003-09-04 Love Hörnquist Åstrand <lha@it.su.se>
1945 * encapsulate.c (gssapi_krb5_encap_length): don't return void
1947 2003-09-03 Love Hörnquist Åstrand <lha@it.su.se>
1949 * verify_mic.c: switch from the des_ to the DES_ api
1951 * get_mic.c: switch from the des_ to the DES_ api
1953 * unwrap.c: switch from the des_ to the DES_ api
1955 * wrap.c: switch from the des_ to the DES_ api
1957 * cfx.c: EC is not included in the checksum since the length might
1958 change depending on the data. From: Luke Howard <lukeh@PADL.COM>
1960 * acquire_cred.c: use
1961 krb5_get_init_creds_opt_alloc/krb5_get_init_creds_opt_free
1963 2003-09-01 Love Hörnquist Åstrand <lha@it.su.se>
1965 * copy_ccache.c: rename
1966 gss_krb5_extract_authz_data_from_sec_context to
1967 gsskrb5_extract_authz_data_from_sec_context
1969 * gssapi.h: rename gss_krb5_extract_authz_data_from_sec_context to
1970 gsskrb5_extract_authz_data_from_sec_context
1972 2003-08-31 Love Hörnquist Åstrand <lha@it.su.se>
1974 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
1975 check that we have a ticket before we start to use it
1977 * gss_acquire_cred.3: document
1978 gss_krb5_extract_authz_data_from_sec_context
1980 * gssapi.h (gss_krb5_extract_authz_data_from_sec_context):
1981 return the kerberos authorizationdata, from idea of Luke Howard
1983 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
1984 return the kerberos authorizationdata, from idea of Luke Howard
1986 * verify_mic.c (gss_verify_mic_internal): switch type and key
1989 2003-08-30 Love Hörnquist Åstrand <lha@it.su.se>
1991 * cfx.[ch]: draft-ietf-krb-wg-gssapi-cfx-01.txt implemetation
1992 From: Luke Howard <lukeh@PADL.COM>
1994 2003-08-28 Love Hörnquist Åstrand <lha@it.su.se>
1996 * arcfour.c (arcfour_mic_cksum): use free_Checksum to free the
1999 * arcfour.h: swap two last arguments to verify_mic for consistency
2002 * wrap.c,unwrap.c,get_mic.c,verify_mic.c,cfx.c,cfx.h:
2003 prefix cfx symbols with _gssapi_
2005 * arcfour.c: release the right buffer
2007 * arcfour.c: rename token structure in consistency with rest of
2008 GSS-API From: Luke Howard <lukeh@PADL.COM>
2010 * unwrap.c (unwrap_des3): use _gssapi_verify_pad
2011 (unwrap_des): use _gssapi_verify_pad
2013 * arcfour.c (_gssapi_wrap_arcfour): set the correct padding
2014 (_gssapi_unwrap_arcfour): verify and strip padding
2016 * gssapi_locl.h: added _gssapi_verify_pad
2018 * decapsulate.c (_gssapi_verify_pad): verify padding of a gss
2019 wrapped message and return its length
2021 * arcfour.c: support KEYTYPE_ARCFOUR_56 keys, from Luke Howard
2024 * arcfour.c: use right seal alg, inherit keytype from parent key
2026 * arcfour.c: include the confounder in the checksum use the right
2027 key usage number for warped/unwraped tokens
2029 * gssapi.h: add gss_krb5_nt_general_name as an mit compat glue
2030 (same as GSS_KRB5_NT_PRINCIPAL_NAME)
2032 * unwrap.c: hook in arcfour unwrap
2034 * wrap.c: hook in arcfour wrap
2036 * verify_mic.c: hook in arcfour verify_mic
2038 * get_mic.c: hook in arcfour get_mic
2040 * arcfour.c: implement wrap/unwarp
2042 * gssapi_locl.h: add gssapi_{en,de}code_be_om_uint32
2044 * 8003.c: add gssapi_{en,de}code_be_om_uint32
2046 2003-08-27 Love Hörnquist Åstrand <lha@it.su.se>
2048 * arcfour.c (_gssapi_verify_mic_arcfour): Do the checksum on right
2049 area. Swap filler check, it was reversed.
2051 * Makefile.am (libgssapi_la_SOURCES): += arcfour.c
2053 * gssapi_locl.h: include "arcfour.h"
2055 * arcfour.c: arcfour gss-api mech, get_mic/verify_mic working
2057 * arcfour.h: arcfour gss-api mech, get_mic/verify_mic working
2059 2003-08-26 Love Hörnquist Åstrand <lha@it.su.se>
2061 * gssapi_locl.h: always include cfx.h add prototype for
2064 * cfx.[ch]: Implementation of draft-ietf-krb-wg-gssapi-cfx-00.txt
2065 from Luke Howard <lukeh@PADL.COM>
2067 * decapsulate.c: add _gssapi_decapsulate, from Luke Howard
2070 2003-08-25 Love Hörnquist Åstrand <lha@it.su.se>
2072 * unwrap.c: encap/decap now takes a oid if the enctype/keytype is
2073 arcfour, return error add hook for cfx
2075 * verify_mic.c: encap/decap now takes a oid if the enctype/keytype
2076 is arcfour, return error add hook for cfx
2078 * get_mic.c: encap/decap now takes a oid if the enctype/keytype is
2079 arcfour, return error add hook for cfx
2081 * accept_sec_context.c: encap/decap now takes a oid
2083 * init_sec_context.c: encap/decap now takes a oid
2085 * gssapi_locl.h: include cfx.h if we need it lifetime is a
2086 OM_uint32, depend on gssapi interface add all new encap/decap
2089 * decapsulate.c: add decap functions that doesn't take the token
2090 type also make all decap function take the oid mech that they
2093 * encapsulate.c: add encap functions that doesn't take the token
2094 type also make all encap function take the oid mech that they
2097 * sequence.c (elem_insert): fix a off by one index counter
2099 * inquire_cred.c (gss_inquire_cred): handle cred_handle being
2100 GSS_C_NO_CREDENTIAL and use the default cred then.
2102 2003-08-19 Love Hörnquist Åstrand <lha@it.su.se>
2104 * gss_acquire_cred.3: break out extensions and document
2105 gsskrb5_register_acceptor_identity
2107 2003-08-18 Love Hörnquist Åstrand <lha@it.su.se>
2109 * test_acquire_cred.c (print_time): time is returned in seconds
2110 from now, not unix time
2112 2003-08-17 Love Hörnquist Åstrand <lha@it.su.se>
2114 * compat.c (check_compat): avoid leaking principal when finding a
2117 * address_to_krb5addr.c: sa_size argument to krb5_addr2sockaddr is
2120 * acquire_cred.c (gss_acquire_cred): 4th argument to
2121 gss_test_oid_set_member is a int
2123 2003-07-22 Love Hörnquist Åstrand <lha@it.su.se>
2125 * init_sec_context.c (repl_mutual): don't set kerberos error where
2126 there was no kerberos error
2128 * gssapi_locl.h: Add destruction/creation prototypes and structure
2129 for the thread specific storage.
2131 * display_status.c: use thread specific storage to set/get the
2132 kerberos error message
2134 * init.c: Provide locking around the creation of the global
2135 krb5_context. Add destruction/creation functions for the thread
2136 specific storage that the error string handling is using.
2138 2003-07-20 Love Hörnquist Åstrand <lha@it.su.se>
2140 * gss_acquire_cred.3: add missing prototype and missing .Ft
2143 2003-06-17 Love Hörnquist Åstrand <lha@it.su.se>
2145 * verify_mic.c: reorder code so sequence numbers can can be used
2147 * unwrap.c: reorder code so sequence numbers can can be used
2149 * sequence.c: remove unused function, indent, add
2150 gssapi_msg_order_f that filter gss flags to gss_msg_order flags
2152 * gssapi_locl.h: prototypes for
2153 gssapi_{encode_om_uint32,decode_om_uint32} add sequence number
2156 * delete_sec_context.c: destroy sequence number verifier
2158 * init_sec_context.c: remember to free data use sequence number
2161 * accept_sec_context.c: don't clear output_token twice remember to
2162 free data use sequence number verifier
2164 * 8003.c: export and rename encode_om_uint32/decode_om_uint32 and
2167 2003-06-09 Johan Danielsson <joda@pdc.kth.se>
2169 * Makefile.am: can't have sequence.c in two different places
2171 2003-06-06 Love Hörnquist Åstrand <lha@it.su.se>
2173 * test_sequence.c: check rollover, print summery
2175 * wrap.c (sub_wrap_size): gss_wrap_size_limit() has
2176 req_output_size and max_input_size around the wrong way -- it
2177 returns the output token size for a given input size, rather than
2178 the maximum input size for a given output token size.
2180 From: Luke Howard <lukeh@PADL.COM>
2182 2003-06-05 Love Hörnquist Åstrand <lha@it.su.se>
2184 * gssapi_locl.h: add prototypes for sequence.c
2186 * Makefile.am (libgssapi_la_SOURCES): add sequence.c
2187 (test_sequence): build
2189 * sequence.c: sequence number checks, order and replay
2190 * test_sequence.c: sequence number checks, order and replay
2192 2003-06-03 Love Hörnquist Åstrand <lha@it.su.se>
2194 * accept_sec_context.c (gss_accept_sec_context): make sure time is
2195 returned in seconds from now, not in kerberos time
2197 * acquire_cred.c (gss_aquire_cred): make sure time is returned in
2198 seconds from now, not in kerberos time
2200 * init_sec_context.c (init_auth): if the cred is expired before we
2201 tries to create a token, fail so the peer doesn't need reject us
2202 (*): make sure time is returned in seconds from now,
2203 not in kerberos time
2204 (repl_mutual): remember to unlock the context mutex
2206 * context_time.c (gss_context_time): remove unused variable
2208 * verify_mic.c: make sure minor_status is always set, pointed out
2209 by Luke Howard <lukeh@PADL.COM>
2211 2003-05-21 Love Hörnquist Åstrand <lha@it.su.se>
2213 * *.[ch]: do some basic locking (no reference counting so contexts
2214 can be removed while still used)
2215 - don't export gss_ctx_id_t_desc_struct and gss_cred_id_t_desc_struct
2216 - make sure all lifetime are returned in seconds left until expired,
2219 * gss_acquire_cred.3: document argument lifetime_rec to function
2222 2003-05-17 Love Hörnquist Åstrand <lha@it.su.se>
2224 * test_acquire_cred.c: test gss_add_cred more then once
2226 2003-05-06 Love Hörnquist Åstrand <lha@it.su.se>
2228 * gssapi.h: if __cplusplus, wrap the extern variable (just to be
2229 safe) and functions in extern "C" { }
2231 2003-04-30 Love Hörnquist Åstrand <lha@it.su.se>
2233 * gssapi.3: more about the des3 mic mess
2235 * verify_mic.c (verify_mic_des3): always check if the mic is the
2236 correct mic or the mic that old heimdal would have generated
2238 2003-04-28 Jacques Vidrine <nectar@kth.se>
2240 * verify_mic.c (verify_mic_des3): If MIC verification fails,
2241 retry using the `old' MIC computation (with zero IV).
2243 2003-04-26 Love Hörnquist Åstrand <lha@it.su.se>
2245 * gss_acquire_cred.3: more about difference between comparing IN
2248 * gss_acquire_cred.3: more about name type and access control
2250 2003-04-25 Love Hörnquist Åstrand <lha@it.su.se>
2252 * gss_acquire_cred.3: document gss_context_time
2254 * context_time.c: if lifetime of context have expired, set
2255 time_rec to 0 and return GSS_S_CONTEXT_EXPIRED
2257 * gssapi.3: document [gssapi]correct_des3_mic
2258 [gssapi]broken_des3_mic
2260 * gss_acquire_cred.3: document gss_krb5_compat_des3_mic
2262 * compat.c (gss_krb5_compat_des3_mic): enable turning on/off des3
2264 (_gss_DES3_get_mic_compat): handle [gssapi]correct_des3_mic too
2266 * gssapi.h (gss_krb5_compat_des3_mic): new function, turn on/off
2268 (GSS_C_KRB5_COMPAT_DES3_MIC): cpp symbol that exists if
2269 gss_krb5_compat_des3_mic exists
2271 2003-04-24 Love Hörnquist Åstrand <lha@it.su.se>
2273 * Makefile.am: (libgssapi_la_LDFLAGS): update major
2274 version of gssapi for incompatiblity in 3des getmic support
2276 2003-04-23 Love Hörnquist Åstrand <lha@it.su.se>
2278 * Makefile.am: test_acquire_cred_LDADD: use libgssapi.la not
2279 ./libgssapi.la (make make -jN work)
2281 2003-04-16 Love Hörnquist Åstrand <lha@it.su.se>
2283 * gssapi.3: spelling
2285 * gss_acquire_cred.3: Change .Fd #include <header.h> to .In
2286 header.h, from Thomas Klausner <wiz@netbsd.org>
2289 2003-04-06 Love Hörnquist Åstrand <lha@it.su.se>
2291 * gss_acquire_cred.3: spelling
2293 * Makefile.am: remove stuff that sneaked in with last commit
2295 * acquire_cred.c (acquire_initiator_cred): if the requested name
2296 isn't in the ccache, also check keytab. Extact the krbtgt for the
2297 default realm to check how long the credentials will last.
2299 * add_cred.c (gss_add_cred): don't create a new ccache, just open
2300 the old one; better check if output handle is compatible with new
2303 * test_acquire_cred.c: test gss_add_cred too
2305 2003-04-03 Love Hörnquist Åstrand <lha@it.su.se>
2307 * Makefile.am: build test_acquire_cred
2309 * test_acquire_cred.c: simple gss_acquire_cred test
2311 2003-04-02 Love Hörnquist Åstrand <lha@it.su.se>
2313 * gss_acquire_cred.3: s/gssapi/GSS-API/
2315 2003-03-19 Love Hörnquist Åstrand <lha@it.su.se>
2317 * gss_acquire_cred.3: document v1 interface (and that they are
2320 2003-03-18 Love Hörnquist Åstrand <lha@it.su.se>
2322 * gss_acquire_cred.3: list supported mechanism and nametypes
2324 2003-03-16 Love Hörnquist Åstrand <lha@it.su.se>
2326 * gss_acquire_cred.3: text about gss_display_name
2328 * Makefile.am (libgssapi_la_LDFLAGS): bump to 3:6:2
2329 (libgssapi_la_SOURCES): add all new functions
2331 * gssapi.3: now that we have a functions, uncomment the missing
2334 * gss_acquire_cred.3: now that we have a functions, uncomment the
2337 * process_context_token.c: implement gss_process_context_token
2339 * inquire_names_for_mech.c: implement gss_inquire_names_for_mech
2341 * inquire_mechs_for_name.c: implement gss_inquire_mechs_for_name
2343 * inquire_cred_by_mech.c: implement gss_inquire_cred_by_mech
2345 * add_cred.c: implement gss_add_cred
2347 * acquire_cred.c (gss_acquire_cred): more testing of input
2348 argument, make sure output arguments are ok, since we don't know
2349 the time_rec (for now), set it to time_req
2351 * export_sec_context.c: send lifetime, also set minor_status
2353 * get_mic.c: set minor_status
2355 * import_sec_context.c (gss_import_sec_context): add error
2356 checking, pick up lifetime (if there is no lifetime, use
2359 * init_sec_context.c: take care to set export value to something
2360 sane before we start so caller will have harmless values in them
2361 if then function fails
2363 * release_buffer.c (gss_release_buffer): set minor_status
2365 * wrap.c: make sure minor_status get set
2367 * verify_mic.c (gss_verify_mic_internal): rename verify_mic to
2368 gss_verify_mic_internal and let it take the type as an argument,
2369 (gss_verify_mic): call gss_verify_mic_internal
2372 * unwrap.c: set minor_status
2374 * test_oid_set_member.c (gss_test_oid_set_member): use
2377 * release_oid_set.c (gss_release_oid_set): set minor_status
2379 * release_name.c (gss_release_name): set minor_status
2381 * release_cred.c (gss_release_cred): set minor_status
2383 * add_oid_set_member.c (gss_add_oid_set_member): set minor_status
2385 * compare_name.c (gss_compare_name): set minor_status
2387 * compat.c (check_compat): make sure ret have a defined value
2389 * context_time.c (gss_context_time): set minor_status
2391 * copy_ccache.c (gss_krb5_copy_ccache): set minor_status
2393 * create_emtpy_oid_set.c (gss_create_empty_oid_set): set
2396 * delete_sec_context.c (gss_delete_sec_context): set minor_status
2398 * display_name.c (gss_display_name): set minor_status
2400 * display_status.c (gss_display_status): use gss_oid_equal, handle
2401 supplementary errors
2403 * duplicate_name.c (gss_duplicate_name): set minor_status
2405 * inquire_context.c (gss_inquire_context): set lifetime_rec now
2406 when we know it, set minor_status
2408 * inquire_cred.c (gss_inquire_cred): take care to set export value
2409 to something sane before we start so caller will have harmless
2410 values in them if the function fails
2412 * accept_sec_context.c (gss_accept_sec_context): take care to set
2413 export value to something sane before we start so caller will have
2414 harmless values in them if then function fails, set lifetime from
2415 ticket expiration date
2417 * indicate_mechs.c (gss_indicate_mechs): use
2418 gss_create_empty_oid_set and gss_add_oid_set_member
2420 * gssapi.h (gss_ctx_id_t_desc): store the lifetime in the cred,
2421 since there is no ticket transfered in the exported context
2423 * export_name.c (gss_export_name): export name with
2424 GSS_C_NT_EXPORT_NAME wrapping, not just the principal
2426 * import_name.c (import_export_name): new function, parses a
2427 GSS_C_NT_EXPORT_NAME
2428 (import_krb5_name): factor out common code of parsing krb5 name
2429 (gss_oid_equal): rename from oid_equal
2431 * gssapi_locl.h: add prototypes for gss_oid_equal and
2432 gss_verify_mic_internal
2434 * gssapi.h: comment out the argument names
2436 2003-03-15 Love Hörnquist Åstrand <lha@it.su.se>
2438 * gssapi.3: add LIST OF FUNCTIONS and copyright/license
2440 * Makefile.am: s/gss_aquire_cred.3/gss_acquire_cred.3/
2442 * Makefile.am: man_MANS += gss_aquire_cred.3
2444 2003-03-14 Love Hörnquist Åstrand <lha@it.su.se>
2446 * gss_aquire_cred.3: the gssapi api manpage
2448 2003-03-03 Love Hörnquist Åstrand <lha@it.su.se>
2450 * inquire_context.c: (gss_inquire_context): rename argument open
2453 * gssapi.h (gss_inquire_context): rename argument open to open_context
2455 2003-02-27 Love Hörnquist Åstrand <lha@it.su.se>
2457 * init_sec_context.c (do_delegation): remove unused variable
2460 * gssapi.3: all 0.5.x version had broken token delegation
2462 2003-02-21 Love Hörnquist Åstrand <lha@it.su.se>
2464 * (init_auth): only generate one subkey
2466 2003-01-27 Love Hörnquist Åstrand <lha@it.su.se>
2468 * verify_mic.c (verify_mic_des3): fix 3des verify_mic to conform
2469 to rfc (and mit kerberos), provide backward compat hook
2471 * get_mic.c (mic_des3): fix 3des get_mic to conform to rfc (and
2472 mit kerberos), provide backward compat hook
2474 * init_sec_context.c (init_auth): check if we need compat for
2475 older get_mic/verify_mic
2477 * gssapi_locl.h: add prototype for _gss_DES3_get_mic_compat
2479 * gssapi.h (more_flags): add COMPAT_OLD_DES3
2481 * Makefile.am: add gssapi.3 and compat.c
2483 * gssapi.3: add gssapi COMPATIBILITY documentation
2485 * accept_sec_context.c (gss_accept_sec_context): check if we need
2486 compat for older get_mic/verify_mic
2488 * compat.c: check for compatiblity with other heimdal's 3des
2491 2002-10-31 Johan Danielsson <joda@pdc.kth.se>
2493 * check return value from gssapi_krb5_init
2495 * 8003.c (gssapi_krb5_verify_8003_checksum): check size of input
2497 2002-09-03 Johan Danielsson <joda@pdc.kth.se>
2499 * wrap.c (wrap_des3): use ETYPE_DES3_CBC_NONE
2501 * unwrap.c (unwrap_des3): use ETYPE_DES3_CBC_NONE
2503 2002-09-02 Johan Danielsson <joda@pdc.kth.se>
2505 * init_sec_context.c: we need to generate a local subkey here
2507 2002-08-20 Jacques Vidrine <n@nectar.com>
2509 * acquire_cred.c, inquire_cred.c, release_cred.c: Use default
2510 credential resolution if gss_acquire_cred is called with
2513 2002-06-20 Jacques Vidrine <n@nectar.com>
2515 * import_name.c: Compare name types by value if pointers do
2516 not match. Reported by: "Douglas E. Engert" <deengert@anl.gov>
2518 2002-05-20 Jacques Vidrine <n@nectar.com>
2520 * verify_mic.c (gss_verify_mic), unwrap.c (gss_unwrap): initialize
2521 the qop_state parameter. from Doug Rabson <dfr@nlsystems.com>
2523 2002-05-09 Jacques Vidrine <n@nectar.com>
2525 * acquire_cred.c: handle GSS_C_INITIATE/GSS_C_ACCEPT/GSS_C_BOTH
2527 2002-05-08 Jacques Vidrine <n@nectar.com>
2529 * acquire_cred.c: initialize gssapi; handle null desired_name
2531 2002-03-22 Johan Danielsson <joda@pdc.kth.se>
2533 * Makefile.am: remove non-functional stuff accidentally committed
2535 2002-03-11 Assar Westerlund <assar@sics.se>
2537 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:5:2
2538 * 8003.c (gssapi_krb5_verify_8003_checksum): handle zero channel
2541 2001-10-31 Jacques Vidrine <n@nectar.com>
2543 * get_mic.c (mic_des3): MIC computation using DES3/SHA1
2544 was bogusly appending the message buffer to the result,
2545 overwriting a heap buffer in the process.
2547 2001-08-29 Assar Westerlund <assar@sics.se>
2549 * 8003.c (gssapi_krb5_verify_8003_checksum,
2550 gssapi_krb5_create_8003_checksum): make more consistent by always
2551 returning an gssapi error and setting minor status. update
2554 2001-08-28 Jacques Vidrine <n@nectar.com>
2556 * accept_sec_context.c: Create a cache for delegated credentials
2559 2001-08-28 Assar Westerlund <assar@sics.se>
2561 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:4:2
2563 2001-08-23 Assar Westerlund <assar@sics.se>
2565 * *.c: handle minor_status more consistently
2567 * display_status.c (gss_display_status): handle krb5_get_err_text
2570 2001-08-15 Johan Danielsson <joda@pdc.kth.se>
2572 * gssapi_locl.h: fix prototype for gssapi_krb5_init
2574 2001-08-13 Johan Danielsson <joda@pdc.kth.se>
2576 * accept_sec_context.c (gsskrb5_register_acceptor_identity): init
2577 context and check return value from kt_resolve
2579 * init.c: return error code
2581 2001-07-19 Assar Westerlund <assar@sics.se>
2583 * Makefile.am (libgssapi_la_LDFLAGS): update to 3:3:2
2585 2001-07-12 Assar Westerlund <assar@sics.se>
2587 * Makefile.am (libgssapi_la_LIBADD): add required library
2590 2001-07-06 Assar Westerlund <assar@sics.se>
2592 * accept_sec_context.c (gsskrb5_register_acceptor_identity): set
2593 the keytab to be used for gss_acquire_cred too'
2595 2001-07-03 Assar Westerlund <assar@sics.se>
2597 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:2:2
2599 2001-06-18 Assar Westerlund <assar@sics.se>
2601 * wrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2602 and gss_krb5_get_remotekey
2603 * verify_mic.c: update krb5_auth_con function names use
2604 gss_krb5_get_remotekey
2605 * unwrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2606 and gss_krb5_get_remotekey
2607 * gssapi_locl.h (gss_krb5_get_remotekey, gss_krb5_get_localkey):
2609 * get_mic.c: update krb5_auth_con function names. use
2610 gss_krb5_get_localkey
2611 * accept_sec_context.c: update krb5_auth_con function names
2613 2001-05-17 Assar Westerlund <assar@sics.se>
2615 * Makefile.am: bump version to 3:1:2
2617 2001-05-14 Assar Westerlund <assar@sics.se>
2619 * address_to_krb5addr.c: adapt to new address functions
2621 2001-05-11 Assar Westerlund <assar@sics.se>
2623 * try to return the error string from libkrb5 where applicable
2625 2001-05-08 Assar Westerlund <assar@sics.se>
2627 * delete_sec_context.c (gss_delete_sec_context): remember to free
2628 the memory used by the ticket itself. from <tmartin@mirapoint.com>
2630 2001-05-04 Assar Westerlund <assar@sics.se>
2632 * gssapi_locl.h: add config.h for completeness
2633 * gssapi.h: remove config.h, this is an installed header file
2634 sys/types.h is not needed either
2636 2001-03-12 Assar Westerlund <assar@sics.se>
2638 * acquire_cred.c (gss_acquire_cred): remove memory leaks. from
2639 Jason R Thorpe <thorpej@zembu.com>
2641 2001-02-18 Assar Westerlund <assar@sics.se>
2643 * accept_sec_context.c (gss_accept_sec_context): either return
2644 gss_name NULL-ed or set
2646 * import_name.c: set minor_status in some cases where it was not
2649 2001-02-15 Assar Westerlund <assar@sics.se>
2651 * wrap.c: use krb5_generate_random_block for the confounders
2653 2001-01-30 Assar Westerlund <assar@sics.se>
2655 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:0:2
2656 * acquire_cred.c, init_sec_context.c, release_cred.c: add support
2657 for getting creds from a keytab, from fvdl@netbsd.org
2659 * copy_ccache.c: add gss_krb5_copy_ccache
2661 2001-01-27 Assar Westerlund <assar@sics.se>
2663 * get_mic.c: cast parameters to des function to non-const pointers
2664 to handle the case where these functions actually take non-const
2667 2001-01-09 Assar Westerlund <assar@sics.se>
2669 * accept_sec_context.c (gss_accept_sec_context): use krb5_rd_cred2
2670 instead of krb5_rd_cred
2672 2000-12-11 Assar Westerlund <assar@sics.se>
2674 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:3:1
2676 2000-12-08 Assar Westerlund <assar@sics.se>
2678 * wrap.c (wrap_des3): use the checksum as ivec when encrypting the
2680 * unwrap.c (unwrap_des3): use the checksum as ivec when encrypting
2682 * init_sec_context.c (init_auth): always zero fwd_data
2684 2000-12-06 Johan Danielsson <joda@pdc.kth.se>
2686 * accept_sec_context.c: de-pointerise auth_context parameter to
2689 2000-11-15 Assar Westerlund <assar@sics.se>
2691 * init_sec_context.c (init_auth): update to new
2692 krb5_build_authenticator
2694 2000-09-19 Assar Westerlund <assar@sics.se>
2696 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:2:1
2698 2000-08-27 Assar Westerlund <assar@sics.se>
2700 * init_sec_context.c: actually pay attention to `time_req'
2701 * init_sec_context.c: re-organize. leak less memory.
2702 * gssapi_locl.h (gssapi_krb5_encapsulate, gss_krb5_getsomekey):
2703 update prototypes add assert.h
2704 * gssapi.h (GSS_KRB5_CONF_C_QOP_DES, GSS_KRB5_CONF_C_QOP_DES3_KD):
2706 * verify_mic.c: re-organize and add 3DES code
2707 * wrap.c: re-organize and add 3DES code
2708 * unwrap.c: re-organize and add 3DES code
2709 * get_mic.c: re-organize and add 3DES code
2710 * encapsulate.c (gssapi_krb5_encapsulate): do not free `in_data',
2711 let the caller do that. fix the callers.
2713 2000-08-16 Assar Westerlund <assar@sics.se>
2715 * Makefile.am: bump version to 2:1:1
2717 2000-07-29 Assar Westerlund <assar@sics.se>
2719 * decapsulate.c (gssapi_krb5_verify_header): sanity-check length
2721 2000-07-25 Johan Danielsson <joda@pdc.kth.se>
2723 * Makefile.am: bump version to 2:0:1
2725 2000-07-22 Assar Westerlund <assar@sics.se>
2727 * gssapi.h: update OID for GSS_C_NT_HOSTBASED_SERVICE and other
2728 details from rfc2744
2730 2000-06-29 Assar Westerlund <assar@sics.se>
2732 * address_to_krb5addr.c (gss_address_to_krb5addr): actually use
2733 `int' instead of `sa_family_t' for the address family.
2735 2000-06-21 Assar Westerlund <assar@sics.se>
2737 * add support for token delegation. From Daniel Kouril
2738 <kouril@ics.muni.cz> and Miroslav Ruda <ruda@ics.muni.cz>
2740 2000-05-15 Assar Westerlund <assar@sics.se>
2742 * Makefile.am (libgssapi_la_LDFLAGS): set version to 1:1:1
2744 2000-04-12 Assar Westerlund <assar@sics.se>
2746 * release_oid_set.c (gss_release_oid_set): clear set for
2747 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2748 * release_name.c (gss_release_name): reset input_name for
2749 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2750 * release_buffer.c (gss_release_buffer): set value to NULL to be
2751 more robust. From GOMBAS Gabor <gombasg@inf.elte.hu>
2752 * add_oid_set_member.c (gss_add_oid_set_member): actually check if
2753 the oid is a member first. leave the oid_set unchanged if realloc
2756 2000-02-13 Assar Westerlund <assar@sics.se>
2758 * Makefile.am: set version to 1:0:1
2760 2000-02-12 Assar Westerlund <assar@sics.se>
2762 * gssapi_locl.h: add flags for import/export
2763 * import_sec_context.c (import_sec_context: add flags for what
2764 fields are included. do not include the authenticator for now.
2765 * export_sec_context.c (export_sec_context: add flags for what
2766 fields are included. do not include the authenticator for now.
2767 * accept_sec_context.c (gss_accept_sec_context): set target in
2770 2000-02-11 Assar Westerlund <assar@sics.se>
2772 * delete_sec_context.c (gss_delete_sec_context): set context to
2775 * Makefile.am: add {export,import}_sec_context.c
2776 * export_sec_context.c: new file
2777 * import_sec_context.c: new file
2778 * accept_sec_context.c (gss_accept_sec_context): set trans flag
2780 2000-02-07 Assar Westerlund <assar@sics.se>
2782 * Makefile.am: set version to 0:5:0
2784 2000-01-26 Assar Westerlund <assar@sics.se>
2786 * delete_sec_context.c (gss_delete_sec_context): handle a NULL
2789 * wrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2790 changes to libdes calls to make them more portable.
2791 * verify_mic.c: update to pseudo-standard APIs for md4,md5,sha.
2792 some changes to libdes calls to make them more portable.
2793 * unwrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2794 changes to libdes calls to make them more portable.
2795 * get_mic.c: update to pseudo-standard APIs for md4,md5,sha. some
2796 changes to libdes calls to make them more portable.
2797 * 8003.c: update to pseudo-standard APIs for md4,md5,sha.
2799 2000-01-06 Assar Westerlund <assar@sics.se>
2801 * Makefile.am: set version to 0:4:0
2803 1999-12-26 Assar Westerlund <assar@sics.se>
2805 * accept_sec_context.c (gss_accept_sec_context): always set
2807 * init_sec_context.c (init_auth): always initialize `output_token'
2808 * delete_sec_context.c (gss_delete_sec_context): always set
2811 1999-12-06 Assar Westerlund <assar@sics.se>
2813 * Makefile.am: bump version to 0:3:0
2815 1999-10-20 Assar Westerlund <assar@sics.se>
2817 * Makefile.am: set version to 0:2:0
2819 1999-09-21 Assar Westerlund <assar@sics.se>
2821 * init_sec_context.c (gss_init_sec_context): initialize `ticket'
2823 * gssapi.h (gss_ctx_id_t_desc): add ticket in here. ick.
2825 * delete_sec_context.c (gss_delete_sec_context): free ticket
2827 * accept_sec_context.c (gss_accept_sec_context): stove away
2828 `krb5_ticket' in context so that ugly programs such as
2829 gss_nt_server can get at it. uck.
2831 1999-09-20 Johan Danielsson <joda@pdc.kth.se>
2833 * accept_sec_context.c: set minor_status
2835 1999-08-04 Assar Westerlund <assar@sics.se>
2837 * display_status.c (calling_error, routine_error): right shift the
2838 code to make it possible to index into the arrays
2840 1999-07-28 Assar Westerlund <assar@sics.se>
2842 * gssapi.h (GSS_C_AF_INET6): add
2844 * import_name.c (import_hostbased_name): set minor_status
2846 1999-07-26 Assar Westerlund <assar@sics.se>
2848 * Makefile.am: set version to 0:1:0
2850 Wed Apr 7 14:05:15 1999 Johan Danielsson <joda@hella.pdc.kth.se>
2852 * display_status.c: set minor_status
2854 * init_sec_context.c: set minor_status
2856 * lib/gssapi/init.c: remove donep (check gssapi_krb5_context