1 2008-01-13 Love Hörnquist Åstrand <lha@it.su.se>
3 * test_ntlm.c: Test source name (and make the acceptor in ntlm gss
6 2007-12-30 Love Hörnquist Åstrand <lha@it.su.se>
8 * ntlm/init_sec_context.c: Don't confuse target name and source
9 name, make regressiont tests pass again.
11 2007-12-29 Love Hörnquist Åstrand <lha@it.su.se>
13 * ntlm: clean up name handling
15 2007-12-04 Love Hörnquist Åstrand <lha@it.su.se>
17 * ntlm/init_sec_context.c: Use credential if it was passed in.
19 * ntlm/acquire_cred.c: Check if there is initial creds with
20 _gss_ntlm_get_user_cred().
22 * ntlm/init_sec_context.c: Add _gss_ntlm_get_user_info() that
23 return the user info so it can be used by external modules.
25 * ntlm/inquire_cred.c: use the right error code.
27 * ntlm/inquire_cred.c: Return GSS_C_NO_CREDENTIAL if there is no
28 credential, ntlm have (not yet) a default credential.
30 * mech/gss_release_oid_set.c: Avoid trying to deref NULL, from
33 2007-12-03 Love Hörnquist Åstrand <lha@it.su.se>
35 * test_acquire_cred.c: Always try to fetch cred (even with
38 2007-08-09 Love Hörnquist Åstrand <lha@it.su.se>
40 * mech/gss_krb5.c: Readd gss_krb5_get_tkt_flags.
42 2007-08-08 Love Hörnquist Åstrand <lha@it.su.se>
44 * spnego/compat.c (_gss_spnego_internal_delete_sec_context):
45 release ctx->target_name too From Rafal Malinowski.
47 2007-07-26 Love Hörnquist Åstrand <lha@it.su.se>
49 * mech/gss_mech_switch.c: Don't try to do dlopen if system doesn't
50 have dlopen. From Rune of Chalmers.
52 2007-07-10 Love Hörnquist Åstrand <lha@it.su.se>
54 * mech/gss_duplicate_name.c: New signature of _gss_find_mn.
56 * mech/gss_init_sec_context.c: New signature of _gss_find_mn.
58 * mech/gss_acquire_cred.c: New signature of _gss_find_mn.
60 * mech/name.h: New signature of _gss_find_mn.
62 * mech/gss_canonicalize_name.c: New signature of _gss_find_mn.
64 * mech/gss_compare_name.c: New signature of _gss_find_mn.
66 * mech/gss_add_cred.c: New signature of _gss_find_mn.
68 * mech/gss_names.c (_gss_find_mn): Return an error code for
71 * spnego/accept_sec_context.c: remove checks that are done by the
74 * Makefile.am: New library version.
76 2007-07-04 Love Hörnquist Åstrand <lha@it.su.se>
78 * mech/gss_oid_to_str.c: Refuse to print GSS_C_NULL_OID, from
81 * spnego/spnego.asn1: Indent and make NegTokenInit and
82 NegTokenResp extendable.
84 2007-06-21 Love Hörnquist Åstrand <lha@it.su.se>
86 * ntlm/inquire_cred.c: Implement _gss_ntlm_inquire_cred.
88 * mech/gss_display_status.c: Provide message for GSS_S_COMPLETE.
90 * mech/context.c: If the canned string is "", its no use to the
91 user, make it fall back to the default error string.
93 2007-06-20 Love Hörnquist Åstrand <lha@it.su.se>
95 * mech/gss_display_name.c (gss_display_name): no name ->
96 fail. From Rafal Malinswski.
98 * spnego/accept_sec_context.c: Wrap name in a spnego_name instead
99 of just a copy of the underlaying object. From Rafal Malinswski.
101 * spnego/accept_sec_context.c: Handle underlaying mech not
104 * mech/gss_accept_sec_context.c: Handle underlaying mech not
107 * spnego/accept_sec_context.c: Make sure src_name is always set to
108 GSS_C_NO_NAME when returning.
110 * krb5/acquire_cred.c (acquire_acceptor_cred): don't claim
111 everything is well on failure. From Phil Fisher.
113 * mech/gss_duplicate_name.c: catch error (and ignore it)
115 * ntlm/init_sec_context.c: Use heim_ntlm_calculate_ntlm2_sess.
117 * mech/gss_accept_sec_context.c: Only wrap the delegated cred if
118 we got a delegated mech cred. From Rafal Malinowski.
120 * spnego/accept_sec_context.c: Only wrap the delegated cred if we
121 are going to return it to the consumer. From Rafal Malinowski.
123 * spnego/accept_sec_context.c: Fixed memory leak pointed out by
124 Rafal Malinowski, also while here moved to use NegotiationToken
127 2007-06-18 Love Hörnquist Åstrand <lha@it.su.se>
129 * krb5/prf.c (_gsskrb5_pseudo_random): add missing break.
131 * krb5/release_name.c: Set *minor_status unconditionallty, its
134 * spnego/accept_sec_context.c: Init get_mic to 0.
136 * mech/gss_set_cred_option.c: Free memory in failure case, found
139 * mech/gss_inquire_context.c: Handle mech_type being NULL.
141 * mech/gss_inquire_cred_by_mech.c: Handle cred_name being NULL.
143 * mech/gss_krb5.c: Free memory in error case, found by beam.
145 2007-06-12 Love Hörnquist Åstrand <lha@it.su.se>
147 * ntlm/inquire_context.c: Use ctx->gssflags for flags.
149 * krb5/display_name.c: Use KRB5_PRINCIPAL_UNPARSE_DISPLAY, this is
150 not ment for machine consumption.
152 2007-06-09 Love Hörnquist Åstrand <lha@it.su.se>
154 * ntlm/digest.c (kdc_alloc): free memory on failure, pointed out
157 * ntlm/digest.c (kdc_destroy): free context when done, pointed out
160 * spnego/context_stubs.c (_gss_spnego_display_name): if input_name
161 is null, fail. From Rafal Malinowski.
163 2007-06-04 Love Hörnquist Åstrand <lha@it.su.se>
165 * ntlm/digest.c: Free memory when done.
167 2007-06-02 Love Hörnquist Åstrand <lha@it.su.se>
169 * test_ntlm.c: Test both with and without keyex.
171 * ntlm/digest.c: If we didn't set session key, don't expect one
174 * test_ntlm.c: Set keyex flag and calculate session key.
176 2007-05-31 Love Hörnquist Åstrand <lha@it.su.se>
178 * spnego/accept_sec_context.c: Use the return value before is
179 overwritten by later calls. From Rafal Malinowski
181 * krb5/release_cred.c: Give an minor_status argument to
182 gss_release_oid_set. From Rafal Malinowski
184 2007-05-30 Love Hörnquist Åstrand <lha@it.su.se>
186 * ntlm/accept_sec_context.c: Catch errors and return the up the
189 * test_kcred.c: more testing of lifetimes
191 2007-05-17 Love Hörnquist Åstrand <lha@it.su.se>
193 * Makefile.am: Drop the gss oid_set function for the krb5 mech,
194 use the mech glue versions instead. Pointed out by Rafal
197 * krb5: Use gss oid_set functions from mechglue
199 2007-05-14 Love Hörnquist Åstrand <lha@it.su.se>
201 * ntlm/accept_sec_context.c: Set session key only if we are
202 returned a session key. Found by David Love.
204 2007-05-13 Love Hörnquist Åstrand <lha@it.su.se>
206 * krb5/prf.c: switched MIN to min to make compile on solaris,
207 pointed out by David Love.
209 2007-05-09 Love Hörnquist Åstrand <lha@it.su.se>
211 * krb5/inquire_cred_by_mech.c: Fill in all of the variables if
212 they are passed in. Pointed out by Phil Fisher.
214 2007-05-08 Love Hörnquist Åstrand <lha@it.su.se>
216 * krb5/inquire_cred.c: Fix copy and paste error, bug spotted by
219 * mech: dont keep track of gc_usage, just figure it out at
220 gss_inquire_cred() time
222 * mech/gss_mech_switch.c (add_builtin): ok for
223 __gss_mech_initialize() to return NULL
225 * test_kcred.c: more correct tests
227 * spnego/cred_stubs.c (gss_inquire_cred*): wrap the name with a
230 * ntlm/inquire_cred.c: make ntlm gss_inquire_cred fail for now,
231 need to find default cred and friends.
233 * krb5/inquire_cred_by_mech.c: reimplement
235 2007-05-07 Love Hörnquist Åstrand <lha@it.su.se>
237 * ntlm/acquire_cred.c: drop unused variable.
239 * ntlm/acquire_cred.c: Reimplement.
241 * Makefile.am: add ntlm/digest.c
243 * ntlm: split out backend ntlm server processing
245 2007-04-24 Love Hörnquist Åstrand <lha@it.su.se>
247 * ntlm/delete_sec_context.c (_gss_ntlm_delete_sec_context): free
250 2007-04-22 Love Hörnquist Åstrand <lha@it.su.se>
252 * ntlm/init_sec_context.c: ntlm-key credential entry is prefix with @
254 * ntlm/init_sec_context.c (get_user_ccache): pick up the ntlm
255 creds from the krb5 credential cache.
257 2007-04-21 Love Hörnquist Åstrand <lha@it.su.se>
259 * ntlm/delete_sec_context.c: free the key stored in the context
261 * ntlm/ntlm.h: switch password for a key
263 * test_oid.c: Switch oid to one that is exported.
265 2007-04-20 Love Hörnquist Åstrand <lha@it.su.se>
267 * ntlm/init_sec_context.c: move where hash is calculated to make
268 it easier to add ccache support.
270 * Makefile.am: Add version-script.map to EXTRA_DIST.
272 2007-04-19 Love Hörnquist Åstrand <lha@it.su.se>
274 * Makefile.am: Unconfuse newer versions of automake that doesn't
275 know the diffrence between depenences and setting variables. foo:
278 * test_ntlm.c: delete sec context when done.
280 * version-script.map: export more symbols.
282 * Makefile.am: add version script if ld supports it
284 * version-script.map: add version script if ld supports it
286 2007-04-18 Love Hörnquist Åstrand <lha@it.su.se>
288 * Makefile.am: test_acquire_cred need test_common.[ch]
290 * test_acquire_cred.c: add more test options.
292 * krb5/external.c: add GSS_KRB5_CCACHE_NAME_X
294 * gssapi/gssapi_krb5.h: add GSS_KRB5_CCACHE_NAME_X
296 * krb5/set_sec_context_option.c: refactor code, implement
297 GSS_KRB5_CCACHE_NAME_X
299 * mech/gss_krb5.c: reimplement gss_krb5_ccache_name
301 2007-04-17 Love Hörnquist Åstrand <lha@it.su.se>
303 * spnego/cred_stubs.c: Need to import spnego name before we can
304 use it as a gss_name_t.
306 * test_acquire_cred.c: use this test as part of the regression
309 * mech/gss_acquire_cred.c (gss_acquire_cred): dont init
310 cred->gc_mc every time in the loop.
312 2007-04-15 Love Hörnquist Åstrand <lha@it.su.se>
314 * Makefile.am: add test_common.h
316 2007-02-16 Love Hörnquist Åstrand <lha@it.su.se>
318 * gss_acquire_cred.3: Add link for
319 gsskrb5_register_acceptor_identity.
321 2007-02-08 Love Hörnquist Åstrand <lha@it.su.se>
323 * krb5/copy_ccache.c: Try to leak less memory in the failure case.
325 2007-01-31 Love Hörnquist Åstrand <lha@it.su.se>
327 * mech/gss_display_status.c: Use right printf formater.
329 * test_*.[ch]: split out the error printing function and try to
332 2007-01-30 Love Hörnquist Åstrand <lha@it.su.se>
334 * krb5/init_sec_context.c: revert 1.75: (init_auth): only turn on
335 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
337 This is because Kerberos always support INT|CONF, matches behavior
338 with MS and MIT. The creates problems for the GSS-SPNEGO mech.
340 2007-01-24 Love Hörnquist Åstrand <lha@it.su.se>
342 * krb5/prf.c: constrain desired_output_len
344 * krb5/external.c (krb5_mech): add _gsskrb5_pseudo_random
346 * mech/gss_pseudo_random.c: Catch error from underlaying mech on
349 * Makefile.am: Add krb5/prf.c
351 * krb5/prf.c: gss_pseudo_random for krb5
353 * test_context.c: Checks for gss_pseudo_random.
355 * krb5/gkrb5_err.et: add KG_INPUT_TOO_LONG
357 * Makefile.am: Add mech/gss_pseudo_random.c
359 * gssapi/gssapi.h: try to load pseudo_random
361 * mech/gss_mech_switch.c: try to load pseudo_random
363 * mech/gss_pseudo_random.c: Add gss_pseudo_random.
365 * gssapi_mech.h: Add hook for gm_pseudo_random.
367 2007-01-17 Love Hörnquist Åstrand <lha@it.su.se>
369 * test_context.c: Don't assume bufer from gss_display_status is
372 * mech/gss_wrap_size_limit.c: Reset out variables.
374 * mech/gss_wrap.c: Reset out variables.
376 * mech/gss_verify_mic.c: Reset out variables.
378 * mech/gss_utils.c: Reset out variables.
380 * mech/gss_release_oid_set.c: Reset out variables.
382 * mech/gss_release_cred.c: Reset out variables.
384 * mech/gss_release_buffer.c: Reset variables.
386 * mech/gss_oid_to_str.c: Reset out variables.
388 * mech/gss_inquire_sec_context_by_oid.c: Fix reset out variables.
390 * mech/gss_mech_switch.c: Reset out variables.
392 * mech/gss_inquire_sec_context_by_oid.c: Reset out variables.
394 * mech/gss_inquire_names_for_mech.c: Reset out variables.
396 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
398 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
400 * mech/gss_inquire_cred_by_mech.c: Reset out variables.
402 * mech/gss_inquire_cred.c: Reset out variables, fix memory leak.
404 * mech/gss_inquire_context.c: Reset out variables.
406 * mech/gss_init_sec_context.c: Zero out outbuffer on failure.
408 * mech/gss_import_name.c: Reset out variables.
410 * mech/gss_import_name.c: Reset out variables.
412 * mech/gss_get_mic.c: Reset out variables.
414 * mech/gss_export_name.c: Reset out variables.
416 * mech/gss_encapsulate_token.c: Reset out variables.
418 * mech/gss_duplicate_oid.c: Reset out variables.
420 * mech/gss_duplicate_oid.c: Reset out variables.
422 * mech/gss_duplicate_name.c: Reset out variables.
424 * mech/gss_display_status.c: Reset out variables.
426 * mech/gss_display_name.c: Reset out variables.
428 * mech/gss_delete_sec_context.c: Reset out variables using propper
431 * mech/gss_decapsulate_token.c: Reset out variables using propper
434 * mech/gss_add_cred.c: Reset out variables.
436 * mech/gss_acquire_cred.c: Reset out variables.
438 * mech/gss_accept_sec_context.c: Reset out variables using propper
441 * mech/gss_init_sec_context.c: Reset out variables.
443 * mech/mech_locl.h (_mg_buffer_zero): new macro that zaps a
446 2007-01-16 Love Hörnquist Åstrand <lha@it.su.se>
448 * mech: sprinkel _gss_mg_error
450 * mech/gss_display_status.c (gss_display_status): use
451 _gss_mg_get_error to fetch the error from underlaying mech, if it
452 failes, let do the regular dance for GSS-CODE version and a
453 generic print-the-error code for MECH-CODE.
455 * mech/gss_oid_to_str.c: Don't include the NUL in the length of
458 * mech/context.h: Protoypes for _gss_mg_.
460 * mech/context.c: Glue to catch the error from the lower gss-api
461 layer and save that for later so gss_display_status() can show the
464 * gss.c: Detect NTLM.
466 2007-01-11 Love Hörnquist Åstrand <lha@it.su.se>
468 * mech/gss_accept_sec_context.c: spelling
470 2007-01-04 Love Hörnquist Åstrand <lha@it.su.se>
472 * Makefile.am: Include build (private) prototypes header files.
474 * Makefile.am (ntlmsrc): add ntlm/ntlm-private.h
476 2006-12-28 Love Hörnquist Åstrand <lha@it.su.se>
478 * ntlm/accept_sec_context.c: Pass signseal argument to
481 * ntlm/init_sec_context.c: Pass signseal argument to
484 * ntlm/crypto.c (_gss_ntlm_set_key): add signseal argument
486 * test_ntlm.c: add ntlmv2 test
488 * ntlm/ntlm.h: break out struct ntlmv2_key;
490 * ntlm/crypto.c (_gss_ntlm_set_key): set ntlm v2 keys.
492 * ntlm/accept_sec_context.c: Set dummy ntlmv2 keys and Check TI.
494 * ntlm/ntlm.h: NTLMv2 keys.
496 * ntlm/crypto.c: NTLMv2 sign and verify.
498 2006-12-20 Love Hörnquist Åstrand <lha@it.su.se>
500 * ntlm/accept_sec_context.c: Don't send targetinfo now.
502 * ntlm/init_sec_context.c: Build ntlmv2 answer buffer.
504 * ntlm/init_sec_context.c: Leak less memory.
506 * ntlm/init_sec_context.c: Announce that we support key exchange.
508 * ntlm/init_sec_context.c: Add NTLM_NEG_NTLM2_SESSION, NTLMv2
509 session security (disable because missing sign and seal).
511 2006-12-19 Love Hörnquist Åstrand <lha@it.su.se>
513 * ntlm/accept_sec_context.c: split RC4 send and recv keystreams
515 * ntlm/init_sec_context.c: split RC4 send and recv keystreams
517 * ntlm/ntlm.h: split RC4 send and recv keystreams
519 * ntlm/crypto.c: Implement SEAL.
521 * ntlm/crypto.c: move gss_wrap/gss_unwrap here
523 * test_context.c: request INT and CONF from the gss layer, test
526 * ntlm/ntlm.h: add crypto bits.
528 * ntlm/accept_sec_context.c: Save session master key.
530 * Makefile.am: Move get and verify mic to the same file (crypto.c)
531 since they share code.
533 * ntlm/crypto.c: Move get and verify mic to the same file since
534 they share code, implement NTLM v1 and dummy signatures.
536 * ntlm/init_sec_context.c: pass on GSS_C_CONF_FLAG and
537 GSS_C_INTEG_FLAG, save the session master key
539 * spnego/accept_sec_context.c: try using gss_accept_sec_context()
540 on the opportunistic token instead of guessing the acceptor name
541 and do gss_acquire_cred, this make SPNEGO work like before.
543 2006-12-18 Love Hörnquist Åstrand <lha@it.su.se>
545 * ntlm/init_sec_context.c: Calculate the NTLM version 1 "master"
548 * spnego/accept_sec_context.c: Resurect negHints for the acceptor
551 * Makefile.am: Add "windows" versions of the NegTokenInitWin and
554 * test_context.c: add --wrapunwrap flag
556 * spnego/compat.c: move _gss_spnego_indicate_mechtypelist() to
557 compat.c, use the sequence types of MechTypeList, make
558 add_mech_type() static.
560 * spnego/accept_sec_context.c: move
561 _gss_spnego_indicate_mechtypelist() to compat.c
563 * Makefile.am: Generate sequence code for MechTypeList
565 * spnego: check that the generated acceptor mechlist is acceptable too
567 * spnego/init_sec_context.c: Abstract out the initiator filter
568 function, it will be needed for the acceptor too.
570 * spnego/accept_sec_context.c: Abstract out the initiator filter
571 function, it will be needed for the acceptor too. Remove negHints.
573 * test_context.c: allow asserting return mech
575 * ntlm/accept_sec_context.c: add _gss_ntlm_allocate_ctx
577 * ntlm/acquire_cred.c: Check that the KDC seem to there and
578 answering us, we can't do better then that wen checking if we will
579 accept the credential.
581 * ntlm/get_mic.c: return GSS_S_UNAVAILABLE
583 * mech/utils.h: add _gss_free_oid, reverse of _gss_copy_oid
585 * mech/gss_utils.c: add _gss_free_oid, reverse of _gss_copy_oid
587 * spnego/spnego.asn1: Its very sad, but NegHints its are not part
588 of the NegTokenInit, this makes SPNEGO acceptor life a lot harder.
590 * spnego: try harder to handle names better. handle missing
591 acceptor and initator creds better (ie dont propose/accept mech
592 that there are no credentials for) split NegTokenInit and
593 NegTokenResp in acceptor
595 2006-12-16 Love Hörnquist Åstrand <lha@it.su.se>
597 * ntlm/import_name.c: Allocate the buffer from the right length.
599 2006-12-15 Love Hörnquist Åstrand <lha@it.su.se>
601 * ntlm/init_sec_context.c (init_sec_context): Tell the other side
602 what domain we think we are talking to.
604 * ntlm/delete_sec_context.c: free username and password
606 * ntlm/release_name.c (_gss_ntlm_release_name): free name.
608 * ntlm/import_name.c (_gss_ntlm_import_name): add support for
609 GSS_C_NT_HOSTBASED_SERVICE names
611 * ntlm/ntlm.h: Add ntlm_name.
613 * test_context.c: allow testing of ntlm.
615 * gssapi_mech.h: add __gss_ntlm_initialize
617 * ntlm/accept_sec_context.c (handle_type3): verify that the kdc
618 approved of the ntlm exchange too
620 * mech/gss_mech_switch.c: Add the builtin ntlm mech
622 * test_ntlm.c: NTLM test app.
624 * mech/gss_accept_sec_context.c: Add detection of NTLMSSP.
626 * gssapi/gssapi.h: add ntlm mech oid
628 * ntlm/external.c: Switch OID to the ms ntlmssp oid
630 * Makefile.am: Add ntlm gss-api module.
632 * ntlm/accept_sec_context.c: Catch more error errors.
634 * ntlm/accept_sec_context.c: Check after a credential to use.
636 2006-12-14 Love Hörnquist Åstrand <lha@it.su.se>
638 * krb5/set_sec_context_option.c (GSS_KRB5_SET_DEFAULT_REALM_X):
639 don't fail on success. Bug report from Stefan Metzmacher.
641 2006-12-13 Love Hörnquist Åstrand <lha@it.su.se>
643 * krb5/init_sec_context.c (init_auth): only turn on
644 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
645 From Stefan Metzmacher.
647 2006-12-11 Love Hörnquist Åstrand <lha@it.su.se>
649 * Makefile.am (libgssapi_la_OBJECTS): depends on gssapi_asn1.h
652 2006-11-20 Love Hörnquist Åstrand <lha@it.su.se>
654 * krb5/acquire_cred.c: Make krb5_get_init_creds_opt_free take a
657 2006-11-16 Love Hörnquist Åstrand <lha@it.su.se>
659 * test_context.c: Test that token keys are the same, return
662 2006-11-15 Love Hörnquist Åstrand <lha@it.su.se>
664 * spnego/spnego_locl.h: Make bitfields unsigned, add maybe_open.
666 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
667 encode CHOICE structure now that we can handle it.
669 * spnego/init_sec_context.c: Use ASN.1 encoder functions to encode
670 CHOICE structure now that we can handle it.
672 * spnego/accept_sec_context.c (_gss_spnego_accept_sec_context):
673 send back ad accept_completed when the security context is ->open,
674 w/o this the client doesn't know that the server have completed
677 * test_context.c: Add delegate flag and check that the delegated
680 * spnego/init_sec_context.c: Keep track of the opportunistic token
681 in the inital message, it might be a complete gss-api context, in
682 that case we'll get back accept_completed without any token. With
683 this change, krb5 w/o mutual authentication works.
685 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
686 encode CHOICE structure now that we can handle it.
688 * spnego/accept_sec_context.c: Filter out SPNEGO from the out
689 supported mechs list and make sure we don't select that for the
692 2006-11-14 Love Hörnquist Åstrand <lha@it.su.se>
694 * mech/gss_init_sec_context.c (_gss_mech_cred_find): break out the
695 cred finding to its own function
697 * krb5/wrap.c: Better error strings, from Andrew Bartlet.
699 2006-11-13 Love Hörnquist Åstrand <lha@it.su.se>
701 * test_context.c: Create our own krb5_context.
703 * krb5: Switch from using a specific error message context in the
704 TLS to have a whole krb5_context in TLS. This have some
705 interestion side-effekts for the configruration setting options
706 since they operate on per-thread basis now.
708 * mech/gss_set_cred_option.c: When calling ->gm_set_cred_option
709 and checking for success, use GSS_S_COMPLETE. From Andrew Bartlet.
711 2006-11-12 Love Hörnquist Åstrand <lha@it.su.se>
713 * Makefile.am: Help solaris make even more.
715 * Makefile.am: Help solaris make.
717 2006-11-09 Love Hörnquist Åstrand <lha@it.su.se>
719 * Makefile.am: remove include $(srcdir)/Makefile-digest.am for now
721 * mech/gss_accept_sec_context.c: Try better guessing what is mech
722 we are going to select by looking harder at the input_token, idea
723 from Luke Howard's mechglue branch.
725 * Makefile.am: libgssapi_la_OBJECTS: add depency on gkrb5_err.h
727 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X
729 * mech/gss_krb5.c: implement gss_krb5_set_allowable_enctypes
731 * gssapi/gssapi.h: GSS_KRB5_S_
733 * krb5/gsskrb5_locl.h: Include <gkrb5_err.h>.
735 * gssapi/gssapi_krb5.h: Add gss_krb5_set_allowable_enctypes.
737 * Makefile.am: Build and install gkrb5_err.h
739 * krb5/gkrb5_err.et: Move the GSS_KRB5_S error here.
741 2006-11-08 Love Hörnquist Åstrand <lha@it.su.se>
743 * mech/gss_krb5.c: Add gsskrb5_set_default_realm.
745 * krb5/set_sec_context_option.c: Support
746 GSS_KRB5_SET_DEFAULT_REALM_X.
748 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DEFAULT_REALM_X
750 * krb5/external.c: add GSS_KRB5_SET_DEFAULT_REALM_X
752 2006-11-07 Love Hörnquist Åstrand <lha@it.su.se>
754 * test_context.c: rename krb5_[gs]et_time_wrap to
755 krb5_[gs]et_max_time_skew
757 * krb5/copy_ccache.c: _gsskrb5_extract_authz_data_from_sec_context
758 no longer used, bye bye
760 * mech/gss_krb5.c: No depenency of the krb5 gssapi mech.
762 * mech/gss_krb5.c (gsskrb5_extract_authtime_from_sec_context): use
763 _gsskrb5_decode_om_uint32. From Andrew Bartlet.
765 * mech/gss_krb5.c: Add dummy gss_krb5_set_allowable_enctypes for
768 * spnego/spnego_locl.h: Include <roken.h> for compatiblity.
770 * krb5/arcfour.c: Use IS_DCE_STYLE flag. There is no padding in
771 DCE-STYLE, don't try to use to. From Andrew Bartlett.
773 * test_context.c: test wrap/unwrap, add flag for dce-style and
774 mutual auth, also support multi-roundtrip sessions
776 * krb5/gsskrb5_locl.h: Add IS_DCE_STYLE macro.
778 * krb5/accept_sec_context.c (gsskrb5_acceptor_start): use
781 * mech/gss_krb5.c (gsskrb5_get_subkey): return the per message
784 * krb5/inquire_sec_context_by_oid.c: check if there is any key at
787 2006-11-06 Love Hörnquist Åstrand <lha@it.su.se>
789 * krb5/inquire_sec_context_by_oid.c: Set more error strings, use
790 right enum for acceptor subkey. From Andrew Bartlett.
792 2006-11-04 Love Hörnquist Åstrand <lha@it.su.se>
794 * test_context.c: Test gsskrb5_extract_service_keyblock, needed in
795 PAC valication. From Andrew Bartlett
797 * mech/gss_krb5.c: Add gsskrb5_extract_authz_data_from_sec_context
798 and keyblock extraction functions.
800 * gssapi/gssapi_krb5.h: Add extraction of keyblock function, from
803 * krb5/external.c: Add GSS_KRB5_GET_SERVICE_KEYBLOCK_X
805 2006-11-03 Love Hörnquist Åstrand <lha@it.su.se>
807 * test_context.c: Rename various routines and constants from
808 canonize to canonicalize. From Andrew Bartlett
810 * mech/gss_krb5.c: Rename various routines and constants from
811 canonize to canonicalize. From Andrew Bartlett
813 * krb5/set_sec_context_option.c: Rename various routines and
814 constants from canonize to canonicalize. From Andrew Bartlett
816 * krb5/external.c: Rename various routines and constants from
817 canonize to canonicalize. From Andrew Bartlett
819 * gssapi/gssapi_krb5.h: Rename various routines and constants from
820 canonize to canonicalize. From Andrew Bartlett
822 2006-10-25 Love Hörnquist Åstrand <lha@it.su.se>
824 * krb5/accept_sec_context.c (gsskrb5_accept_delegated_token): need
827 2006-10-24 Love Hörnquist Åstrand <lha@it.su.se>
829 * test_context.c (loop): free target_name
831 * mech/gss_accept_sec_context.c: SLIST_INIT the ->gc_mc'
833 * mech/gss_acquire_cred.c : SLIST_INIT the ->gc_mc'
835 * krb5/init_sec_context.c: Avoid leaking memory.
837 * mech/gss_buffer_set.c (gss_release_buffer_set): don't leak the
840 * test_context.c: make compile
842 * krb5/cfx.c (_gssapi_verify_mic_cfx): always free crypto context.
844 * krb5/set_cred_option.c (import_cred): free sp
846 2006-10-22 Love Hörnquist Åstrand <lha@it.su.se>
848 * mech/gss_add_oid_set_member.c: Use old implementation of
849 gss_add_oid_set_member, it leaks less memory.
851 * krb5/test_cfx.c: free krb5_crypto.
853 * krb5/test_cfx.c: free krb5_context
855 * mech/gss_release_name.c (gss_release_name): free input_name
858 2006-10-21 Love Hörnquist Åstrand <lha@it.su.se>
860 * test_context.c: Call setprogname.
862 * mech/gss_krb5.c: Add gsskrb5_extract_authtime_from_sec_context.
864 * gssapi/gssapi_krb5.h: add
865 gsskrb5_extract_authtime_from_sec_context
867 2006-10-20 Love Hörnquist Åstrand <lha@it.su.se>
869 * krb5/inquire_sec_context_by_oid.c: Add get_authtime.
871 * krb5/external.c: add GSS_KRB5_GET_AUTHTIME_X
873 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_AUTHTIME_X
875 * krb5/set_sec_context_option.c: Implement GSS_KRB5_SEND_TO_KDC_X.
877 * mech/gss_krb5.c: Add gsskrb5_set_send_to_kdc
879 * gssapi/gssapi_krb5.h: Add GSS_KRB5_SEND_TO_KDC_X and
880 gsskrb5_set_send_to_kdc
882 * krb5/external.c: add GSS_KRB5_SEND_TO_KDC_X
884 * Makefile.am: more files
886 2006-10-19 Love Hörnquist Åstrand <lha@it.su.se>
888 * Makefile.am: remove spnego/gssapi_spnego.h, its now in gssapi/
890 * test_context.c: Allow specifing mech.
892 * krb5/external.c: add GSS_SASL_DIGEST_MD5_MECHANISM (for now)
894 * gssapi/gssapi.h: Rename GSS_DIGEST_MECHANISM to
895 GSS_SASL_DIGEST_MD5_MECHANISM
897 2006-10-18 Love Hörnquist Åstrand <lha@it.su.se>
899 * mech/gssapi.asn1: Make it into a heim_any_set, its doesn't
902 * mech/gssapi.asn1: GSSAPIContextToken is IMPLICIT SEQUENCE
904 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X
906 * krb5/external.c: Add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X.
908 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_INITIATOR_SUBKEY_X and
909 GSS_KRB5_GET_SUBKEY_X
911 * krb5/external.c: add GSS_KRB5_GET_INITIATOR_SUBKEY_X,
912 GSS_KRB5_GET_SUBKEY_X
914 2006-10-17 Love Hörnquist Åstrand <lha@it.su.se>
916 * test_context.c: Support switching on name type oid's
918 * test_context.c: add test for dns canon flag
920 * mech/gss_krb5.c: Add gsskrb5_set_dns_canonlize.
922 * gssapi/gssapi_krb5.h: remove gss_krb5_compat_des3_mic
924 * gssapi/gssapi_krb5.h: Add gsskrb5_set_dns_canonlize.
926 * krb5/set_sec_context_option.c: implement
927 GSS_KRB5_SET_DNS_CANONIZE_X
929 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DNS_CANONIZE_X
931 * krb5/external.c: add GSS_KRB5_SET_DNS_CANONIZE_X
933 * mech/gss_krb5.c: add bits to make lucid context work
935 2006-10-14 Love Hörnquist Åstrand <lha@it.su.se>
937 * mech/gss_oid_to_str.c: Prefix der primitives with der_.
939 * krb5/inquire_sec_context_by_oid.c: Prefix der primitives with
942 * krb5/encapsulate.c: Prefix der primitives with der_.
944 * mech/gss_oid_to_str.c: New der_print_heim_oid signature.
946 2006-10-12 Love Hörnquist Åstrand <lha@it.su.se>
948 * Makefile.am: add test_context
950 * krb5/inquire_sec_context_by_oid.c: Make it work.
952 * test_oid.c: Test lucid oid.
954 * gssapi/gssapi.h: Add OM_uint64_t.
956 * krb5/inquire_sec_context_by_oid.c: Add lucid interface.
958 * krb5/external.c: Add lucid interface, renumber oids to my
961 * mech/gss_krb5.c: Add lucid interface.
963 * gssapi/gssapi_krb5.h: Add lucid interface.
965 * spnego/spnego_locl.h: Maybe include <netdb.h>.
967 2006-10-09 Love Hörnquist Åstrand <lha@it.su.se>
969 * mech/gss_mech_switch.c: define RTLD_LOCAL to 0 if not defined.
971 2006-10-08 Love Hörnquist Åstrand <lha@it.su.se>
973 * Makefile.am: install gssapi_krb5.H and gssapi_spnego.h
975 * gssapi/gssapi_krb5.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
977 * gssapi/gssapi.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
979 * Makefile.am: Drop some -I no longer needed.
981 * gssapi/gssapi_spnego.h: Move gssapi_spengo.h over here.
983 * krb5: reference all include files using 'krb5/'
985 2006-10-07 Love Hörnquist Åstrand <lha@it.su.se>
987 * gssapi.h: Add file inclusion protection.
989 * gssapi/gssapi.h: Correct header file inclusion protection.
991 * gssapi/gssapi.h: Move the gssapi.h from lib/gssapi/ to
992 lib/gssapi/gssapi/ to please automake.
994 * spnego/spnego_locl.h: Maybe include <sys/types.h>.
996 * mech/mech_locl.h: Include <roken.h>.
998 * Makefile.am: split build files into dist_ and noinst_ SOURCES
1000 2006-10-06 Love Hörnquist Åstrand <lha@it.su.se>
1002 * gss.c: #if 0 out unused code.
1004 * mech/gss_mech_switch.c: Cast argument to ctype(3) functions
1007 2006-10-05 Love Hörnquist Åstrand <lha@it.su.se>
1009 * mech/name.h: remove <sys/queue.h>
1011 * mech/mech_switch.h: remove <sys/queue.h>
1013 * mech/cred.h: remove <sys/queue.h>
1015 2006-10-02 Love Hörnquist Åstrand <lha@it.su.se>
1017 * krb5/arcfour.c: Thinker more with header lengths.
1019 * krb5/arcfour.c: Improve the calcucation of header
1020 lengths. DCE-STYLE data is also padded so remove if (1 || ...)
1023 * krb5/wrap.c (_gsskrb5_wrap_size_limit): use
1024 _gssapi_wrap_size_arcfour for arcfour
1026 * krb5/arcfour.c: Move _gssapi_wrap_size_arcfour here.
1028 * Makefile.am: Split all mech to diffrent mechsrc variables.
1030 * spnego/context_stubs.c: Make internal function static (and
1033 2006-10-01 Love Hörnquist Åstrand <lha@it.su.se>
1035 * krb5/inquire_cred.c: Fix "if (x) lock(y)" bug. From Harald
1038 * spnego/spnego_locl.h: Include <sys/param.h> for MAXHOSTNAMELEN.
1040 2006-09-25 Love Hörnquist Åstrand <lha@it.su.se>
1042 * krb5/arcfour.c: Add wrap support, interrop with itself but not
1045 * krb5/gsskrb5_locl.h: move the arcfour specific stuff to the
1048 * krb5/arcfour.c: Support DCE-style unwrap, tested with
1051 * mech/gss_accept_sec_context.c (gss_accept_sec_context): if the
1052 token doesn't start with [APPLICATION 0] SEQUENCE, lets assume its
1053 a DCE-style kerberos 5 connection. XXX this needs to be made
1054 better in cause we get another GSS-API protocol violating
1055 protocol. It should be possible to detach the Kerberos DCE-style
1056 since it starts with a AP-REQ PDU, but that have to wait for now.
1058 2006-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1060 * gssapi.h: Add GSS_C flags from
1061 draft-brezak-win2k-krb-rc4-hmac-04.txt.
1063 * krb5/delete_sec_context.c: Free service_keyblock and fwd_data,
1066 * krb5/accept_sec_context.c: Merge of the acceptor part from the
1067 samba patch by Stefan Metzmacher and Andrew Bartlet.
1069 * krb5/init_sec_context.c: Add GSS_C_DCE_STYLE.
1071 * krb5/{init_sec_context.c,gsskrb5_locl.h}: merge most of the
1072 initiator part from the samba patch by Stefan Metzmacher and
1073 Andrew Bartlet (still missing DCE/RPC support)
1075 2006-08-28 Love Hörnquist Åstrand <lha@it.su.se>
1077 * gss.c (help): use sl_slc_help().
1079 2006-07-22 Love Hörnquist Åstrand <lha@it.su.se>
1081 * gss-commands.in: rename command to supported-mechanisms
1083 * Makefile.am: Make gss objects depend on the slc built
1086 2006-07-20 Love Hörnquist Åstrand <lha@it.su.se>
1088 * gss-commands.in: add slc commands for gss
1090 * krb5/gsskrb5_locl.h: Remove dup prototype of _gsskrb5_init()
1092 * Makefile.am: Add test_cfx
1094 * krb5/external.c: add GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1096 * krb5/set_sec_context_option.c: catch
1097 GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1099 * krb5/accept_sec_context.c: reimplement
1100 gsskrb5_register_acceptor_identity
1102 * mech/gss_krb5.c: implement gsskrb5_register_acceptor_identity
1104 * mech/gss_inquire_mechs_for_name.c: call _gss_load_mech
1106 * mech/gss_inquire_cred.c (gss_inquire_cred): call _gss_load_mech
1108 * mech/gss_mech_switch.c: Make _gss_load_mech() atomic and run
1109 only once, this have the side effect that _gss_mechs and
1110 _gss_mech_oids is only initialized once, so if just the users of
1111 these two global variables calls _gss_load_mech() first, it will
1112 act as a barrier and make sure the variables are never changed and
1113 we don't need to lock them.
1115 * mech/utils.h: no need to mark functions extern.
1117 * mech/name.h: no need to mark _gss_find_mn extern.
1119 2006-07-19 Love Hörnquist Åstrand <lha@it.su.se>
1121 * krb5/cfx.c: Redo the wrap length calculations.
1123 * krb5/test_cfx.c: test max_wrap_size in cfx.c
1125 * mech/gss_display_status.c: Handle more error codes.
1127 2006-07-07 Love Hörnquist Åstrand <lha@it.su.se>
1129 * mech/mech_locl.h: Include <krb5-types.h> and "mechqueue.h"
1131 * mech/mechqueue.h: Add SLIST macros.
1133 * krb5/inquire_context.c: Don't free return values on success.
1135 * krb5/inquire_cred.c (_gsskrb5_inquire_cred): When cred provided
1136 is the default cred, acquire the acceptor cred and initator cred
1137 in two diffrent steps and then query them for the information,
1138 this way, the code wont fail if there are no keytab, but there is
1141 * mech/gss_inquire_cred.c: move the check if we found any cred
1142 where it matter for both cases
1143 (default cred and provided cred)
1145 * mech/gss_init_sec_context.c: If the desired mechanism can't
1146 convert the name to a MN, fail with GSS_S_BAD_NAME rather then a
1149 2006-07-06 Love Hörnquist Åstrand <lha@it.su.se>
1151 * spnego/external.c: readd gss_spnego_inquire_names_for_mech
1153 * spnego/spnego_locl.h: reimplement
1154 gss_spnego_inquire_names_for_mech add support function
1155 _gss_spnego_supported_mechs
1157 * spnego/context_stubs.h: reimplement
1158 gss_spnego_inquire_names_for_mech add support function
1159 _gss_spnego_supported_mechs
1161 * spnego/context_stubs.c: drop gss_spnego_indicate_mechs
1163 * mech/gss_indicate_mechs.c: if the underlaying mech doesn't
1164 support gss_indicate_mechs, use the oid in the mechswitch
1167 * spnego/external.c: let the mech glue layer implement
1170 * spnego/cred_stubs.c (gss_spnego_acquire_cred): don't care about
1171 desired_mechs, get our own list with indicate_mechs and remove
1174 2006-07-05 Love Hörnquist Åstrand <lha@it.su.se>
1176 * spnego/external.c: remove gss_spnego_inquire_names_for_mech, let
1177 the mechglue layer implement it
1179 * spnego/context_stubs.c: remove gss_spnego_inquire_names_for_mech, let
1180 the mechglue layer implement it
1182 * spnego/spnego_locl.c: remove gss_spnego_inquire_names_for_mech, let
1183 the mechglue layer implement it
1185 2006-07-01 Love Hörnquist Åstrand <lha@it.su.se>
1187 * mech/gss_set_cred_option.c: fix argument to gss_release_cred
1189 2006-06-30 Love Hörnquist Åstrand <lha@it.su.se>
1191 * krb5/init_sec_context.c: Make work on compilers that are
1192 somewhat more picky then gcc4 (like gcc2.95)
1194 * krb5/init_sec_context.c (do_delegation): use KDCOptions2int to
1195 convert fwd_flags to an integer, since otherwise int2KDCOptions in
1196 krb5_get_forwarded_creds wont do the right thing.
1198 * mech/gss_set_cred_option.c (gss_set_cred_option): free memory on
1201 * krb5/set_sec_context_option.c (_gsskrb5_set_sec_context_option):
1202 init global kerberos context
1204 * krb5/set_cred_option.c (_gsskrb5_set_cred_option): init global
1207 * mech/gss_accept_sec_context.c: Insert the delegated sub cred on
1208 the delegated cred handle, not cred handle
1210 * mech/gss_accept_sec_context.c (gss_accept_sec_context): handle
1211 the case where ret_flags == NULL
1213 * mech/gss_mech_switch.c (add_builtin): set
1214 _gss_mech_switch->gm_mech_oid
1216 * mech/gss_set_cred_option.c (gss_set_cred_option): laod mechs
1218 * test_cred.c (gss_print_errors): don't try to print error when
1219 gss_display_status failed
1221 * Makefile.am: Add mech/gss_release_oid.c
1223 * mech/gss_release_oid.c: Add gss_release_oid, reverse of
1226 * spnego/compat.c: preferred_mech_type was allocated with
1227 gss_duplicate_oid in one place and assigned static varianbles a
1228 the second place. change that static assignement to
1229 gss_duplicate_oid and bring back gss_release_oid.
1231 * spnego/compat.c (_gss_spnego_delete_sec_context): don't release
1232 preferred_mech_type and negotiated_mech_type, they where never
1233 allocated from the begining.
1235 2006-06-29 Love Hörnquist Åstrand <lha@it.su.se>
1237 * mech/gss_import_name.c (gss_import_name): avoid
1238 type-punned/strict aliasing rules
1240 * mech/gss_add_cred.c: avoid type-punned/strict aliasing rules
1242 * gssapi.h: Make gss_name_t an opaque type.
1244 * krb5: make gss_name_t an opaque type
1246 * krb5/set_cred_option.c: Add
1248 * mech/gss_set_cred_option.c (gss_set_cred_option): support the
1249 case where *cred_handle == NULL
1251 * mech/gss_krb5.c (gss_krb5_import_cred): make sure cred is
1252 GSS_C_NO_CREDENTIAL on failure.
1254 * mech/gss_acquire_cred.c (gss_acquire_cred): if desired_mechs is
1255 NO_OID_SET, there is a need to load the mechs, so always do that.
1257 2006-06-28 Love Hörnquist Åstrand <lha@it.su.se>
1259 * krb5/inquire_cred_by_oid.c: Reimplement GSS_KRB5_COPY_CCACHE_X
1260 to instead pass a fullname to the credential, then resolve and
1261 copy out the content, and then close the cred.
1263 * mech/gss_krb5.c: Reimplement GSS_KRB5_COPY_CCACHE_X to instead
1264 pass a fullname to the credential, then resolve and copy out the
1265 content, and then close the cred.
1267 * krb5/inquire_cred_by_oid.c: make "work", GSS_KRB5_COPY_CCACHE_X
1268 interface needs to be re-done, currently its utterly broken.
1270 * mech/gss_set_cred_option.c: Make work.
1272 * krb5/external.c: Add _gsskrb5_set_{sec_context,cred}_option
1274 * mech/gss_krb5.c (gss_krb5_import_cred): implement
1276 * Makefile.am: Add gss_set_{sec_context,cred}_option and sort
1278 * mech/gss_set_{sec_context,cred}_option.c: add
1280 * gssapi.h: Add GSS_KRB5_IMPORT_CRED_X
1282 * test_*.c: make compile again
1284 * Makefile.am: Add lib dependencies and test programs
1286 * spnego: remove dependency on libkrb5
1288 * mech: Bug fixes, cleanup, compiler warnings, restructure code.
1290 * spnego: Rename gss_context_id_t and gss_cred_id_t to local names
1292 * krb5: repro copy the krb5 files here
1294 * mech: import Doug Rabson mechglue from freebsd
1296 * spnego: Import Luke Howard's SPNEGO from the mechglue branch
1298 2006-06-22 Love Hörnquist Åstrand <lha@it.su.se>
1300 * gssapi.h: Add oid_to_str.
1302 * Makefile.am: add oid_to_str and test_oid
1304 * oid_to_str.c: Add gss_oid_to_str
1306 * test_oid.c: Add test for gss_oid_to_str()
1308 2006-05-13 Love Hörnquist Åstrand <lha@it.su.se>
1310 * verify_mic.c: Less pointer signedness warnings.
1312 * unwrap.c: Less pointer signedness warnings.
1314 * arcfour.c: Less pointer signedness warnings.
1316 * gssapi_locl.h: Use const void * to instead of unsigned char * to
1317 avoid pointer signedness warnings.
1319 * encapsulate.c: Use const void * to instead of unsigned char * to
1320 avoid pointer signedness warnings.
1322 * decapsulate.c: Use const void * to instead of unsigned char * to
1323 avoid pointer signedness warnings.
1325 * decapsulate.c: Less pointer signedness warnings.
1327 * cfx.c: Less pointer signedness warnings.
1329 * init_sec_context.c: Less pointer signedness warnings (partly by
1330 using the new asn.1 CHOICE decoder)
1332 * import_sec_context.c: Less pointer signedness warnings.
1334 2006-05-09 Love Hörnquist Åstrand <lha@it.su.se>
1336 * accept_sec_context.c (gsskrb5_is_cfx): always set is_cfx. From
1339 2006-05-08 Love Hörnquist Åstrand <lha@it.su.se>
1341 * get_mic.c (mic_des3): make sure message_buffer doesn't point to
1342 free()ed memory on failure. Pointed out by IBM checker.
1344 2006-05-05 Love Hörnquist Åstrand <lha@it.su.se>
1346 * Rename u_intXX_t to uintXX_t
1348 2006-05-04 Love Hörnquist Åstrand <lha@it.su.se>
1350 * cfx.c: Less pointer signedness warnings.
1352 * arcfour.c: Avoid pointer signedness warnings.
1354 * gssapi_locl.h (gssapi_decode_*): make data argument const void *
1356 * 8003.c (gssapi_decode_*): make data argument const void *
1358 2006-04-12 Love Hörnquist Åstrand <lha@it.su.se>
1360 * export_sec_context.c: Export sequence order element. From Wynn
1361 Wilkes <wynn.wilkes@quest.com>.
1363 * import_sec_context.c: Import sequence order element. From Wynn
1364 Wilkes <wynn.wilkes@quest.com>.
1366 * sequence.c (_gssapi_msg_order_import,_gssapi_msg_order_export):
1367 New functions, used by {import,export}_sec_context. From Wynn
1368 Wilkes <wynn.wilkes@quest.com>.
1370 * test_sequence.c: Add test for import/export sequence.
1372 2006-04-09 Love Hörnquist Åstrand <lha@it.su.se>
1374 * add_cred.c: Check that cred != GSS_C_NO_CREDENTIAL, this is a
1375 standard conformance failure, but much better then a crash.
1377 2006-04-02 Love Hörnquist Åstrand <lha@it.su.se>
1379 * get_mic.c (get_mic*)_: make sure message_token is cleaned on
1380 error, found by IBM checker.
1382 * wrap.c (wrap*): Reset output_buffer on error, found by IBM
1385 2006-02-15 Love Hörnquist Åstrand <lha@it.su.se>
1387 * import_name.c: Accept both GSS_C_NT_HOSTBASED_SERVICE and
1388 GSS_C_NT_HOSTBASED_SERVICE_X as nametype for hostbased names.
1390 2006-01-16 Love Hörnquist Åstrand <lha@it.su.se>
1392 * delete_sec_context.c (gss_delete_sec_context): if the context
1393 handle is GSS_C_NO_CONTEXT, don't fall over.
1395 2005-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1397 * gss_acquire_cred.3: Replace gss_krb5_import_ccache with
1398 gss_krb5_import_cred and add more references
1400 2005-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1402 * gssapi.h: Change gss_krb5_import_ccache to gss_krb5_import_cred,
1403 it can handle keytabs too.
1405 * add_cred.c (gss_add_cred): avoid deadlock
1407 * context_time.c (gssapi_lifetime_left): define the 0 lifetime as
1410 2005-12-01 Love Hörnquist Åstrand <lha@it.su.se>
1412 * acquire_cred.c (acquire_acceptor_cred): only check if principal
1413 exists if we got called with principal as an argument.
1415 * acquire_cred.c (acquire_acceptor_cred): check that the acceptor
1416 exists in the keytab before returning ok.
1418 2005-11-29 Love Hörnquist Åstrand <lha@it.su.se>
1420 * copy_ccache.c (gss_krb5_import_cred): fix buglet, from Andrew
1423 2005-11-25 Love Hörnquist Åstrand <lha@it.su.se>
1425 * test_kcred.c: Rename gss_krb5_import_ccache to
1426 gss_krb5_import_cred.
1428 * copy_ccache.c: Rename gss_krb5_import_ccache to
1429 gss_krb5_import_cred and let it grow code to handle keytabs too.
1431 2005-11-02 Love Hörnquist Åstrand <lha@it.su.se>
1433 * init_sec_context.c: Change sematics of ok-as-delegate to match
1435 [gssapi]realm/ok-as-delegate=true is set, otherwise keep old
1438 * release_cred.c (gss_release_cred): use
1439 GSS_CF_DESTROY_CRED_ON_RELEASE to decide if the cache should be
1442 * acquire_cred.c (acquire_initiator_cred):
1443 GSS_CF_DESTROY_CRED_ON_RELEASE on created credentials.
1445 * accept_sec_context.c (gsskrb5_accept_delegated_token): rewrite
1446 to use gss_krb5_import_ccache
1448 2005-11-01 Love Hörnquist Åstrand <lha@it.su.se>
1450 * arcfour.c: Remove signedness warnings.
1452 2005-10-31 Love Hörnquist Åstrand <lha@it.su.se>
1454 * gss_acquire_cred.3: Document that gss_krb5_import_ccache is copy
1457 * copy_ccache.c (gss_krb5_import_ccache): Instead of making a copy
1458 of the ccache, make a reference by getting the name and resolving
1459 the name. This way the cache is shared, this flipp side is of
1460 course that if someone calls krb5_cc_destroy the cache is lost for
1463 * test_kcred.c: Remove memory leaks.
1465 2005-10-26 Love Hörnquist Åstrand <lha@it.su.se>
1467 * Makefile.am: build test_kcred
1469 * gss_acquire_cred.3: Document gss_krb5_import_ccache
1471 * gssapi.3: Sort and add gss_krb5_import_ccache.
1473 * acquire_cred.c (_gssapi_krb5_ccache_lifetime): break out code
1474 used to extract lifetime from a credential cache
1476 * gssapi_locl.h: Add _gssapi_krb5_ccache_lifetime, used to extract
1477 lifetime from a credential cache.
1479 * gssapi.h: add gss_krb5_import_ccache, reverse of
1480 gss_krb5_copy_ccache
1482 * copy_ccache.c: add gss_krb5_import_ccache, reverse of
1483 gss_krb5_copy_ccache
1485 * test_kcred.c: test gss_krb5_import_ccache
1487 2005-10-21 Love Hörnquist Åstrand <lha@it.su.se>
1489 * acquire_cred.c (acquire_initiator_cred): use krb5_cc_cache_match
1490 to find a matching creditial cache, if that failes, fallback to
1493 2005-10-12 Love Hörnquist Åstrand <lha@it.su.se>
1495 * gssapi_locl.h: Add gssapi_krb5_set_status and
1496 gssapi_krb5_clear_status
1498 * init_sec_context.c (spnego_reply): Don't pass back raw Kerberos
1499 errors, use GSS-API errors instead. From Michael B Allen.
1501 * display_status.c: Add gssapi_krb5_clear_status,
1502 gssapi_krb5_set_status for handling error messages.
1504 2005-08-23 Love Hörnquist Åstrand <lha@it.su.se>
1506 * external.c: Use rk_UNCONST to avoid const warning.
1508 * display_status.c: Constify strings to avoid warnings.
1510 2005-08-11 Love Hörnquist Åstrand <lha@it.su.se>
1512 * init_sec_context.c: avoid warnings, update (c)
1514 2005-07-13 Love Hörnquist Åstrand <lha@it.su.se>
1516 * init_sec_context.c (spnego_initial): use NegotiationToken
1517 encoder now that we have one with the new asn1. compiler.
1519 * Makefile.am: the new asn.1 compiler includes the modules name in
1522 2005-06-16 Love Hörnquist Åstrand <lha@it.su.se>
1524 * decapsulate.c: use rk_UNCONST
1526 * ccache_name.c: rename to avoid shadowing
1528 * gssapi_locl.h: give kret in GSSAPI_KRB5_INIT a more unique name
1530 * process_context_token.c: use rk_UNCONST to unconstify
1532 * test_cred.c: rename optind to optidx
1534 2005-05-30 Love Hörnquist Åstrand <lha@it.su.se>
1536 * init_sec_context.c (init_auth): honor ok-as-delegate if local
1537 configuration approves
1539 * gssapi_locl.h: prototype for _gss_check_compat
1541 * compat.c: export check_compat as _gss_check_compat
1543 2005-05-29 Love Hörnquist Åstrand <lha@it.su.se>
1545 * init_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1546 problems with system headerfiles that pollute the name space.
1548 * accept_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1549 problems with system headerfiles that pollute the name space.
1551 2005-05-17 Love Hörnquist Åstrand <lha@it.su.se>
1553 * init_sec_context.c (init_auth): set
1554 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED (for java compatibility),
1555 also while here, use krb5_auth_con_addflags
1557 2005-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1559 * arcfour.c (_gssapi_wrap_arcfour): fix calculating the encap
1560 length. From: Tom Maher <tmaher@eecs.berkeley.edu>
1562 2005-05-02 Dave Love <fx@gnu.org>
1564 * test_cred.c (main): Call setprogname.
1566 2005-04-27 Love Hörnquist Åstrand <lha@it.su.se>
1568 * prefix all sequence symbols with _, they are not part of the
1569 GSS-API api. By comment from Wynn Wilkes <wynnw@vintela.com>
1571 2005-04-10 Love Hörnquist Åstrand <lha@it.su.se>
1573 * accept_sec_context.c: break out the processing of the delegated
1574 credential to a separate function to make error handling easier,
1575 move the credential handling to after other setup is done
1577 * test_sequence.c: make less verbose in case of success
1579 * Makefile.am: add test_sequence to TESTS
1581 2005-04-01 Love Hörnquist Åstrand <lha@it.su.se>
1583 * 8003.c (gssapi_krb5_verify_8003_checksum): check that cksum
1584 isn't NULL From: Nicolas Pouvesle <npouvesle@tenablesecurity.com>
1586 2005-03-21 Love Hörnquist Åstrand <lha@it.su.se>
1588 * Makefile.am: use $(LIB_roken)
1590 2005-03-16 Love Hörnquist Åstrand <lha@it.su.se>
1592 * display_status.c (gssapi_krb5_set_error_string): pass in the
1593 krb5_context to krb5_free_error_string
1595 2005-03-15 Love Hörnquist Åstrand <lha@it.su.se>
1597 * display_status.c (gssapi_krb5_set_error_string): don't misuse
1598 the krb5_get_error_string api
1600 2005-03-01 Love Hörnquist Åstrand <lha@it.su.se>
1602 * compat.c (_gss_DES3_get_mic_compat): don't unlock mutex
1603 here. Bug reported by Stefan Metzmacher <metze@samba.org>
1605 2005-02-21 Luke Howard <lukeh@padl.com>
1607 * init_sec_context.c: don't call krb5_get_credentials() with
1608 KRB5_TC_MATCH_KEYTYPE, it can lead to the credentials cache
1609 growing indefinitely as no key is found with KEYTYPE_NULL
1611 * compat.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG, it is
1612 no longer used (however the mechListMIC behaviour is broken,
1613 rfc2478bis support requires the code in the mechglue branch)
1615 * init_sec_context.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1617 * gssapi.h: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1619 2005-01-05 Luke Howard <lukeh@padl.com>
1621 * 8003.c: use symbolic name for checksum type
1623 * accept_sec_context.c: allow client to indicate
1624 that subkey should be used
1626 * acquire_cred.c: plug leak
1628 * get_mic.c: use gss_krb5_get_subkey() instead
1629 of gss_krb5_get_{local,remote}key(), support
1632 * gssapi_local.c: use gss_krb5_get_subkey(),
1633 support KEYTYPE_ARCFOUR_56
1635 * import_sec_context.c: plug leak
1637 * unwrap.c: use gss_krb5_get_subkey(),
1638 support KEYTYPE_ARCFOUR_56
1640 * verify_mic.c: use gss_krb5_get_subkey(),
1641 support KEYTYPE_ARCFOUR_56
1643 * wrap.c: use gss_krb5_get_subkey(),
1644 support KEYTYPE_ARCFOUR_56
1646 2004-11-30 Love Hörnquist Åstrand <lha@it.su.se>
1648 * inquire_cred.c: Reverse order of HEIMDAL_MUTEX_unlock and
1649 gss_release_cred to avoid deadlock, from Luke Howard
1652 2004-09-06 Love Hörnquist Åstrand <lha@it.su.se>
1654 * gss_acquire_cred.3: gss_krb5_extract_authz_data_from_sec_context
1655 was renamed to gsskrb5_extract_authz_data_from_sec_context
1657 2004-08-07 Love Hörnquist Åstrand <lha@it.su.se>
1659 * unwrap.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1661 * arcfour.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1663 2004-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1665 * gssapi.3: spelling from Josef El-Rayes <josef@FreeBSD.org> while
1666 here, write some text about the SPNEGO situation
1668 2004-04-08 Love Hörnquist Åstrand <lha@it.su.se>
1670 * cfx.c: s/CTXAcceptorSubkey/CFXAcceptorSubkey/
1672 2004-04-07 Love Hörnquist Åstrand <lha@it.su.se>
1674 * gssapi.h: add GSS_C_EXPECTING_MECH_LIST_MIC_FLAG From: Luke
1675 Howard <lukeh@padl.com>
1677 * init_sec_context.c (spnego_reply): use
1678 _gss_spnego_require_mechlist_mic to figure out if we need to check
1679 MechListMIC; From: Luke Howard <lukeh@padl.com>
1681 * accept_sec_context.c (send_accept): use
1682 _gss_spnego_require_mechlist_mic to figure out if we need to send
1683 MechListMIC; From: Luke Howard <lukeh@padl.com>
1685 * gssapi_locl.h: add _gss_spnego_require_mechlist_mic
1686 From: Luke Howard <lukeh@padl.com>
1688 * compat.c: add _gss_spnego_require_mechlist_mic for compatibility
1689 with MS SPNEGO, From: Luke Howard <lukeh@padl.com>
1691 2004-04-05 Love Hörnquist Åstrand <lha@it.su.se>
1693 * accept_sec_context.c (gsskrb5_is_cfx): krb5_keyblock->keytype is
1694 an enctype, not keytype
1696 * accept_sec_context.c: use ASN1_MALLOC_ENCODE
1698 * init_sec_context.c: avoid the malloc loop and just allocate the
1699 propper amount of data
1701 * init_sec_context.c (spnego_initial): handle mech_token better
1703 2004-03-19 Love Hörnquist Åstrand <lha@it.su.se>
1705 * gssapi.h: add gss_krb5_get_tkt_flags
1707 * Makefile.am: add ticket_flags.c
1709 * ticket_flags.c: Get ticket-flags from acceptor ticket From: Luke
1710 Howard <lukeh@PADL.COM>
1712 * gss_acquire_cred.3: document gss_krb5_get_tkt_flags
1714 2004-03-14 Love Hörnquist Åstrand <lha@it.su.se>
1716 * acquire_cred.c (gss_acquire_cred): check usage before even
1717 bothering to process it, add both keytab and initial tgt if
1720 * wrap.c: support cfx, try to handle acceptor asserted subkey
1722 * unwrap.c: support cfx, try to handle acceptor asserted subkey
1724 * verify_mic.c: support cfx
1726 * get_mic.c: support cfx
1728 * test_sequence.c: handle changed signature of
1729 gssapi_msg_order_create
1731 * import_sec_context.c: handle acceptor asserted subkey
1733 * init_sec_context.c: handle acceptor asserted subkey
1735 * accept_sec_context.c: handle acceptor asserted subkey
1737 * sequence.c: add dummy use_64 argument to gssapi_msg_order_create
1739 * gssapi_locl.h: add partial support for CFX
1741 * Makefile.am (noinst_PROGRAMS) += test_cred
1743 * test_cred.c: gssapi credential testing
1745 * test_acquire_cred.c: fix comment
1747 2004-03-07 Love Hörnquist Åstrand <lha@it.su.se>
1749 * arcfour.h: drop structures for message formats, no longer used
1751 * arcfour.c: comment describing message formats
1753 * accept_sec_context.c (spnego_accept_sec_context): make sure the
1754 length of the choice element doesn't overrun us
1756 * init_sec_context.c (spnego_reply): make sure the length of the
1757 choice element doesn't overrun us
1759 * spnego.asn1: move NegotiationToken to avoid warning
1761 * spnego.asn1: uncomment NegotiationToken
1763 * Makefile.am: spnego_files += asn1_NegotiationToken.x
1765 2004-01-25 Love Hörnquist Åstrand <lha@it.su.se>
1767 * gssapi.h: add gss_krb5_ccache_name
1769 * Makefile.am (libgssapi_la_SOURCES): += ccache_name.c
1771 * ccache_name.c (gss_krb5_ccache_name): help function enable to
1772 set krb5 name, using out_name argument makes function no longer
1775 * gssapi.3: add missing gss_krb5_ references
1777 * gss_acquire_cred.3: document gss_krb5_ccache_name
1779 2003-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1781 * cfx.c: make rrc a modulus operation if its longer then the
1782 length of the message, noticed by Sam Hartman
1784 2003-12-07 Love Hörnquist Åstrand <lha@it.su.se>
1786 * accept_sec_context.c: use krb5_auth_con_addflags
1788 2003-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1790 * cfx.c: Wrap token id was in wrong order, found by Sam Hartman
1792 2003-12-04 Love Hörnquist Åstrand <lha@it.su.se>
1794 * cfx.c: add AcceptorSubkey (but no code understand it yet) ignore
1797 2003-11-22 Love Hörnquist Åstrand <lha@it.su.se>
1799 * accept_sec_context.c: Don't require timestamp to be set on
1800 delegated token, its already protected by the outer token (and
1801 windows doesn't alway send it) Pointed out by Zi-Bin Yang
1802 <zbyang@decru.com> on heimdal-discuss
1804 2003-11-14 Love Hörnquist Åstrand <lha@it.su.se>
1806 * cfx.c: fix {} error, pointed out by Liqiang Zhu
1808 2003-11-10 Love Hörnquist Åstrand <lha@it.su.se>
1810 * cfx.c: Sequence number should be stored in bigendian order From:
1811 Luke Howard <lukeh@padl.com>
1813 2003-11-09 Love Hörnquist Åstrand <lha@it.su.se>
1815 * delete_sec_context.c (gss_delete_sec_context): don't free
1816 ticket, krb5_free_ticket does that now
1818 2003-11-06 Love Hörnquist Åstrand <lha@it.su.se>
1820 * cfx.c: checksum the header last in MIC token, update to -03
1821 From: Luke Howard <lukeh@padl.com>
1823 2003-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1825 * add_cred.c: If its a MEMORY cc, make a copy. We need to do this
1826 since now gss_release_cred will destroy the cred. This should be
1827 really be solved a better way.
1829 * acquire_cred.c (gss_release_cred): if its a mcc, destroy it
1830 rather the just release it Found by: "Zi-Bin Yang"
1833 * acquire_cred.c (acquire_initiator_cred): use kret instead of ret
1836 2003-09-30 Love Hörnquist Åstrand <lha@it.su.se>
1838 * gss_acquire_cred.3: spelling
1839 From: jmc <jmc@prioris.mini.pw.edu.pl>
1841 2003-09-23 Love Hörnquist Åstrand <lha@it.su.se>
1843 * cfx.c: - EC and RRC are big-endian, not little-endian - The
1844 default is now to rotate regardless of GSS_C_DCE_STYLE. There are
1845 no longer any references to GSS_C_DCE_STYLE. - rrc_rotate()
1846 avoids allocating memory on the heap if rrc <= 256
1847 From: Luke Howard <lukeh@padl.com>
1849 2003-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1851 * cfx.[ch]: rrc_rotate() was untested and broken, fix it.
1852 Set and verify wrap Token->Filler.
1853 Correct token ID for wrap tokens,
1854 were accidentally swapped with delete tokens.
1855 From: Luke Howard <lukeh@PADL.COM>
1857 2003-09-21 Love Hörnquist Åstrand <lha@it.su.se>
1859 * cfx.[ch]: no ASN.1-ish header on per-message tokens
1860 From: Luke Howard <lukeh@PADL.COM>
1862 2003-09-19 Love Hörnquist Åstrand <lha@it.su.se>
1864 * arcfour.h: remove depenency on gss_arcfour_mic_token and
1865 gss_arcfour_warp_token
1867 * arcfour.c: remove depenency on gss_arcfour_mic_token and
1868 gss_arcfour_warp_token
1870 2003-09-18 Love Hörnquist Åstrand <lha@it.su.se>
1872 * 8003.c: remove #if 0'ed code
1874 2003-09-17 Love Hörnquist Åstrand <lha@it.su.se>
1876 * accept_sec_context.c (gsskrb5_accept_sec_context): set sequence
1877 number when not requesting mutual auth From: Luke Howard
1880 * init_sec_context.c (init_auth): set sequence number when not
1881 requesting mutual auth From: Luke Howard <lukeh@PADL.COM>
1883 2003-09-16 Love Hörnquist Åstrand <lha@it.su.se>
1885 * arcfour.c (*): set minor_status
1886 (gss_wrap): set conf_state to conf_req_flags on success
1887 From: Luke Howard <lukeh@PADL.COM>
1889 * wrap.c (gss_wrap_size_limit): use existing function From: Luke
1890 Howard <lukeh@PADL.COM>
1892 2003-09-12 Love Hörnquist Åstrand <lha@it.su.se>
1894 * indicate_mechs.c (gss_indicate_mechs): in case of error, free
1897 * indicate_mechs.c (gss_indicate_mechs): add SPNEGO
1899 2003-09-10 Love Hörnquist Åstrand <lha@it.su.se>
1901 * init_sec_context.c (spnego_initial): catch errors and return
1904 * init_sec_context.c (spnego_initial): add #if 0 out version of
1905 the CHOICE branch encoding, also where here, free no longer used
1908 2003-09-09 Love Hörnquist Åstrand <lha@it.su.se>
1910 * gss_acquire_cred.3: support GSS_SPNEGO_MECHANISM
1912 * accept_sec_context.c: SPNEGO doesn't include gss wrapping on
1913 SubsequentContextToken like the Kerberos 5 mech does.
1915 * init_sec_context.c (spnego_reply): SPNEGO doesn't include gss
1916 wrapping on SubsequentContextToken like the Kerberos 5 mech
1917 does. Lets check for it anyway.
1919 * accept_sec_context.c: Add support for SPNEGO on the initator
1920 side. Implementation initially from Assar Westerlund, passes
1921 though quite a lot of hands before I commited it.
1923 * init_sec_context.c: Add support for SPNEGO on the initator side.
1924 Tested with ldap server on a Windows 2000 DC. Implementation
1925 initially from Assar Westerlund, passes though quite a lot of
1926 hands before I commited it.
1928 * gssapi.h: export GSS_SPNEGO_MECHANISM
1930 * gssapi_locl.h: include spnego_as.h add prototype for
1931 gssapi_krb5_get_mech
1933 * decapsulate.c (gssapi_krb5_get_mech): make non static
1935 * Makefile.am: build SPNEGO file
1937 2003-09-08 Love Hörnquist Åstrand <lha@it.su.se>
1939 * external.c: SPENGO and IAKERB oids
1941 * spnego.asn1: SPENGO ASN1
1943 2003-09-05 Love Hörnquist Åstrand <lha@it.su.se>
1945 * cfx.c: RRC also need to be zero before wraping them
1946 From: Luke Howard <lukeh@PADL.COM>
1948 2003-09-04 Love Hörnquist Åstrand <lha@it.su.se>
1950 * encapsulate.c (gssapi_krb5_encap_length): don't return void
1952 2003-09-03 Love Hörnquist Åstrand <lha@it.su.se>
1954 * verify_mic.c: switch from the des_ to the DES_ api
1956 * get_mic.c: switch from the des_ to the DES_ api
1958 * unwrap.c: switch from the des_ to the DES_ api
1960 * wrap.c: switch from the des_ to the DES_ api
1962 * cfx.c: EC is not included in the checksum since the length might
1963 change depending on the data. From: Luke Howard <lukeh@PADL.COM>
1965 * acquire_cred.c: use
1966 krb5_get_init_creds_opt_alloc/krb5_get_init_creds_opt_free
1968 2003-09-01 Love Hörnquist Åstrand <lha@it.su.se>
1970 * copy_ccache.c: rename
1971 gss_krb5_extract_authz_data_from_sec_context to
1972 gsskrb5_extract_authz_data_from_sec_context
1974 * gssapi.h: rename gss_krb5_extract_authz_data_from_sec_context to
1975 gsskrb5_extract_authz_data_from_sec_context
1977 2003-08-31 Love Hörnquist Åstrand <lha@it.su.se>
1979 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
1980 check that we have a ticket before we start to use it
1982 * gss_acquire_cred.3: document
1983 gss_krb5_extract_authz_data_from_sec_context
1985 * gssapi.h (gss_krb5_extract_authz_data_from_sec_context):
1986 return the kerberos authorizationdata, from idea of Luke Howard
1988 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
1989 return the kerberos authorizationdata, from idea of Luke Howard
1991 * verify_mic.c (gss_verify_mic_internal): switch type and key
1994 2003-08-30 Love Hörnquist Åstrand <lha@it.su.se>
1996 * cfx.[ch]: draft-ietf-krb-wg-gssapi-cfx-01.txt implemetation
1997 From: Luke Howard <lukeh@PADL.COM>
1999 2003-08-28 Love Hörnquist Åstrand <lha@it.su.se>
2001 * arcfour.c (arcfour_mic_cksum): use free_Checksum to free the
2004 * arcfour.h: swap two last arguments to verify_mic for consistency
2007 * wrap.c,unwrap.c,get_mic.c,verify_mic.c,cfx.c,cfx.h:
2008 prefix cfx symbols with _gssapi_
2010 * arcfour.c: release the right buffer
2012 * arcfour.c: rename token structure in consistency with rest of
2013 GSS-API From: Luke Howard <lukeh@PADL.COM>
2015 * unwrap.c (unwrap_des3): use _gssapi_verify_pad
2016 (unwrap_des): use _gssapi_verify_pad
2018 * arcfour.c (_gssapi_wrap_arcfour): set the correct padding
2019 (_gssapi_unwrap_arcfour): verify and strip padding
2021 * gssapi_locl.h: added _gssapi_verify_pad
2023 * decapsulate.c (_gssapi_verify_pad): verify padding of a gss
2024 wrapped message and return its length
2026 * arcfour.c: support KEYTYPE_ARCFOUR_56 keys, from Luke Howard
2029 * arcfour.c: use right seal alg, inherit keytype from parent key
2031 * arcfour.c: include the confounder in the checksum use the right
2032 key usage number for warped/unwraped tokens
2034 * gssapi.h: add gss_krb5_nt_general_name as an mit compat glue
2035 (same as GSS_KRB5_NT_PRINCIPAL_NAME)
2037 * unwrap.c: hook in arcfour unwrap
2039 * wrap.c: hook in arcfour wrap
2041 * verify_mic.c: hook in arcfour verify_mic
2043 * get_mic.c: hook in arcfour get_mic
2045 * arcfour.c: implement wrap/unwarp
2047 * gssapi_locl.h: add gssapi_{en,de}code_be_om_uint32
2049 * 8003.c: add gssapi_{en,de}code_be_om_uint32
2051 2003-08-27 Love Hörnquist Åstrand <lha@it.su.se>
2053 * arcfour.c (_gssapi_verify_mic_arcfour): Do the checksum on right
2054 area. Swap filler check, it was reversed.
2056 * Makefile.am (libgssapi_la_SOURCES): += arcfour.c
2058 * gssapi_locl.h: include "arcfour.h"
2060 * arcfour.c: arcfour gss-api mech, get_mic/verify_mic working
2062 * arcfour.h: arcfour gss-api mech, get_mic/verify_mic working
2064 2003-08-26 Love Hörnquist Åstrand <lha@it.su.se>
2066 * gssapi_locl.h: always include cfx.h add prototype for
2069 * cfx.[ch]: Implementation of draft-ietf-krb-wg-gssapi-cfx-00.txt
2070 from Luke Howard <lukeh@PADL.COM>
2072 * decapsulate.c: add _gssapi_decapsulate, from Luke Howard
2075 2003-08-25 Love Hörnquist Åstrand <lha@it.su.se>
2077 * unwrap.c: encap/decap now takes a oid if the enctype/keytype is
2078 arcfour, return error add hook for cfx
2080 * verify_mic.c: encap/decap now takes a oid if the enctype/keytype
2081 is arcfour, return error add hook for cfx
2083 * get_mic.c: encap/decap now takes a oid if the enctype/keytype is
2084 arcfour, return error add hook for cfx
2086 * accept_sec_context.c: encap/decap now takes a oid
2088 * init_sec_context.c: encap/decap now takes a oid
2090 * gssapi_locl.h: include cfx.h if we need it lifetime is a
2091 OM_uint32, depend on gssapi interface add all new encap/decap
2094 * decapsulate.c: add decap functions that doesn't take the token
2095 type also make all decap function take the oid mech that they
2098 * encapsulate.c: add encap functions that doesn't take the token
2099 type also make all encap function take the oid mech that they
2102 * sequence.c (elem_insert): fix a off by one index counter
2104 * inquire_cred.c (gss_inquire_cred): handle cred_handle being
2105 GSS_C_NO_CREDENTIAL and use the default cred then.
2107 2003-08-19 Love Hörnquist Åstrand <lha@it.su.se>
2109 * gss_acquire_cred.3: break out extensions and document
2110 gsskrb5_register_acceptor_identity
2112 2003-08-18 Love Hörnquist Åstrand <lha@it.su.se>
2114 * test_acquire_cred.c (print_time): time is returned in seconds
2115 from now, not unix time
2117 2003-08-17 Love Hörnquist Åstrand <lha@it.su.se>
2119 * compat.c (check_compat): avoid leaking principal when finding a
2122 * address_to_krb5addr.c: sa_size argument to krb5_addr2sockaddr is
2125 * acquire_cred.c (gss_acquire_cred): 4th argument to
2126 gss_test_oid_set_member is a int
2128 2003-07-22 Love Hörnquist Åstrand <lha@it.su.se>
2130 * init_sec_context.c (repl_mutual): don't set kerberos error where
2131 there was no kerberos error
2133 * gssapi_locl.h: Add destruction/creation prototypes and structure
2134 for the thread specific storage.
2136 * display_status.c: use thread specific storage to set/get the
2137 kerberos error message
2139 * init.c: Provide locking around the creation of the global
2140 krb5_context. Add destruction/creation functions for the thread
2141 specific storage that the error string handling is using.
2143 2003-07-20 Love Hörnquist Åstrand <lha@it.su.se>
2145 * gss_acquire_cred.3: add missing prototype and missing .Ft
2148 2003-06-17 Love Hörnquist Åstrand <lha@it.su.se>
2150 * verify_mic.c: reorder code so sequence numbers can can be used
2152 * unwrap.c: reorder code so sequence numbers can can be used
2154 * sequence.c: remove unused function, indent, add
2155 gssapi_msg_order_f that filter gss flags to gss_msg_order flags
2157 * gssapi_locl.h: prototypes for
2158 gssapi_{encode_om_uint32,decode_om_uint32} add sequence number
2161 * delete_sec_context.c: destroy sequence number verifier
2163 * init_sec_context.c: remember to free data use sequence number
2166 * accept_sec_context.c: don't clear output_token twice remember to
2167 free data use sequence number verifier
2169 * 8003.c: export and rename encode_om_uint32/decode_om_uint32 and
2172 2003-06-09 Johan Danielsson <joda@pdc.kth.se>
2174 * Makefile.am: can't have sequence.c in two different places
2176 2003-06-06 Love Hörnquist Åstrand <lha@it.su.se>
2178 * test_sequence.c: check rollover, print summery
2180 * wrap.c (sub_wrap_size): gss_wrap_size_limit() has
2181 req_output_size and max_input_size around the wrong way -- it
2182 returns the output token size for a given input size, rather than
2183 the maximum input size for a given output token size.
2185 From: Luke Howard <lukeh@PADL.COM>
2187 2003-06-05 Love Hörnquist Åstrand <lha@it.su.se>
2189 * gssapi_locl.h: add prototypes for sequence.c
2191 * Makefile.am (libgssapi_la_SOURCES): add sequence.c
2192 (test_sequence): build
2194 * sequence.c: sequence number checks, order and replay
2195 * test_sequence.c: sequence number checks, order and replay
2197 2003-06-03 Love Hörnquist Åstrand <lha@it.su.se>
2199 * accept_sec_context.c (gss_accept_sec_context): make sure time is
2200 returned in seconds from now, not in kerberos time
2202 * acquire_cred.c (gss_aquire_cred): make sure time is returned in
2203 seconds from now, not in kerberos time
2205 * init_sec_context.c (init_auth): if the cred is expired before we
2206 tries to create a token, fail so the peer doesn't need reject us
2207 (*): make sure time is returned in seconds from now,
2208 not in kerberos time
2209 (repl_mutual): remember to unlock the context mutex
2211 * context_time.c (gss_context_time): remove unused variable
2213 * verify_mic.c: make sure minor_status is always set, pointed out
2214 by Luke Howard <lukeh@PADL.COM>
2216 2003-05-21 Love Hörnquist Åstrand <lha@it.su.se>
2218 * *.[ch]: do some basic locking (no reference counting so contexts
2219 can be removed while still used)
2220 - don't export gss_ctx_id_t_desc_struct and gss_cred_id_t_desc_struct
2221 - make sure all lifetime are returned in seconds left until expired,
2224 * gss_acquire_cred.3: document argument lifetime_rec to function
2227 2003-05-17 Love Hörnquist Åstrand <lha@it.su.se>
2229 * test_acquire_cred.c: test gss_add_cred more then once
2231 2003-05-06 Love Hörnquist Åstrand <lha@it.su.se>
2233 * gssapi.h: if __cplusplus, wrap the extern variable (just to be
2234 safe) and functions in extern "C" { }
2236 2003-04-30 Love Hörnquist Åstrand <lha@it.su.se>
2238 * gssapi.3: more about the des3 mic mess
2240 * verify_mic.c (verify_mic_des3): always check if the mic is the
2241 correct mic or the mic that old heimdal would have generated
2243 2003-04-28 Jacques Vidrine <nectar@kth.se>
2245 * verify_mic.c (verify_mic_des3): If MIC verification fails,
2246 retry using the `old' MIC computation (with zero IV).
2248 2003-04-26 Love Hörnquist Åstrand <lha@it.su.se>
2250 * gss_acquire_cred.3: more about difference between comparing IN
2253 * gss_acquire_cred.3: more about name type and access control
2255 2003-04-25 Love Hörnquist Åstrand <lha@it.su.se>
2257 * gss_acquire_cred.3: document gss_context_time
2259 * context_time.c: if lifetime of context have expired, set
2260 time_rec to 0 and return GSS_S_CONTEXT_EXPIRED
2262 * gssapi.3: document [gssapi]correct_des3_mic
2263 [gssapi]broken_des3_mic
2265 * gss_acquire_cred.3: document gss_krb5_compat_des3_mic
2267 * compat.c (gss_krb5_compat_des3_mic): enable turning on/off des3
2269 (_gss_DES3_get_mic_compat): handle [gssapi]correct_des3_mic too
2271 * gssapi.h (gss_krb5_compat_des3_mic): new function, turn on/off
2273 (GSS_C_KRB5_COMPAT_DES3_MIC): cpp symbol that exists if
2274 gss_krb5_compat_des3_mic exists
2276 2003-04-24 Love Hörnquist Åstrand <lha@it.su.se>
2278 * Makefile.am: (libgssapi_la_LDFLAGS): update major
2279 version of gssapi for incompatiblity in 3des getmic support
2281 2003-04-23 Love Hörnquist Åstrand <lha@it.su.se>
2283 * Makefile.am: test_acquire_cred_LDADD: use libgssapi.la not
2284 ./libgssapi.la (make make -jN work)
2286 2003-04-16 Love Hörnquist Åstrand <lha@it.su.se>
2288 * gssapi.3: spelling
2290 * gss_acquire_cred.3: Change .Fd #include <header.h> to .In
2291 header.h, from Thomas Klausner <wiz@netbsd.org>
2294 2003-04-06 Love Hörnquist Åstrand <lha@it.su.se>
2296 * gss_acquire_cred.3: spelling
2298 * Makefile.am: remove stuff that sneaked in with last commit
2300 * acquire_cred.c (acquire_initiator_cred): if the requested name
2301 isn't in the ccache, also check keytab. Extact the krbtgt for the
2302 default realm to check how long the credentials will last.
2304 * add_cred.c (gss_add_cred): don't create a new ccache, just open
2305 the old one; better check if output handle is compatible with new
2308 * test_acquire_cred.c: test gss_add_cred too
2310 2003-04-03 Love Hörnquist Åstrand <lha@it.su.se>
2312 * Makefile.am: build test_acquire_cred
2314 * test_acquire_cred.c: simple gss_acquire_cred test
2316 2003-04-02 Love Hörnquist Åstrand <lha@it.su.se>
2318 * gss_acquire_cred.3: s/gssapi/GSS-API/
2320 2003-03-19 Love Hörnquist Åstrand <lha@it.su.se>
2322 * gss_acquire_cred.3: document v1 interface (and that they are
2325 2003-03-18 Love Hörnquist Åstrand <lha@it.su.se>
2327 * gss_acquire_cred.3: list supported mechanism and nametypes
2329 2003-03-16 Love Hörnquist Åstrand <lha@it.su.se>
2331 * gss_acquire_cred.3: text about gss_display_name
2333 * Makefile.am (libgssapi_la_LDFLAGS): bump to 3:6:2
2334 (libgssapi_la_SOURCES): add all new functions
2336 * gssapi.3: now that we have a functions, uncomment the missing
2339 * gss_acquire_cred.3: now that we have a functions, uncomment the
2342 * process_context_token.c: implement gss_process_context_token
2344 * inquire_names_for_mech.c: implement gss_inquire_names_for_mech
2346 * inquire_mechs_for_name.c: implement gss_inquire_mechs_for_name
2348 * inquire_cred_by_mech.c: implement gss_inquire_cred_by_mech
2350 * add_cred.c: implement gss_add_cred
2352 * acquire_cred.c (gss_acquire_cred): more testing of input
2353 argument, make sure output arguments are ok, since we don't know
2354 the time_rec (for now), set it to time_req
2356 * export_sec_context.c: send lifetime, also set minor_status
2358 * get_mic.c: set minor_status
2360 * import_sec_context.c (gss_import_sec_context): add error
2361 checking, pick up lifetime (if there is no lifetime, use
2364 * init_sec_context.c: take care to set export value to something
2365 sane before we start so caller will have harmless values in them
2366 if then function fails
2368 * release_buffer.c (gss_release_buffer): set minor_status
2370 * wrap.c: make sure minor_status get set
2372 * verify_mic.c (gss_verify_mic_internal): rename verify_mic to
2373 gss_verify_mic_internal and let it take the type as an argument,
2374 (gss_verify_mic): call gss_verify_mic_internal
2377 * unwrap.c: set minor_status
2379 * test_oid_set_member.c (gss_test_oid_set_member): use
2382 * release_oid_set.c (gss_release_oid_set): set minor_status
2384 * release_name.c (gss_release_name): set minor_status
2386 * release_cred.c (gss_release_cred): set minor_status
2388 * add_oid_set_member.c (gss_add_oid_set_member): set minor_status
2390 * compare_name.c (gss_compare_name): set minor_status
2392 * compat.c (check_compat): make sure ret have a defined value
2394 * context_time.c (gss_context_time): set minor_status
2396 * copy_ccache.c (gss_krb5_copy_ccache): set minor_status
2398 * create_emtpy_oid_set.c (gss_create_empty_oid_set): set
2401 * delete_sec_context.c (gss_delete_sec_context): set minor_status
2403 * display_name.c (gss_display_name): set minor_status
2405 * display_status.c (gss_display_status): use gss_oid_equal, handle
2406 supplementary errors
2408 * duplicate_name.c (gss_duplicate_name): set minor_status
2410 * inquire_context.c (gss_inquire_context): set lifetime_rec now
2411 when we know it, set minor_status
2413 * inquire_cred.c (gss_inquire_cred): take care to set export value
2414 to something sane before we start so caller will have harmless
2415 values in them if the function fails
2417 * accept_sec_context.c (gss_accept_sec_context): take care to set
2418 export value to something sane before we start so caller will have
2419 harmless values in them if then function fails, set lifetime from
2420 ticket expiration date
2422 * indicate_mechs.c (gss_indicate_mechs): use
2423 gss_create_empty_oid_set and gss_add_oid_set_member
2425 * gssapi.h (gss_ctx_id_t_desc): store the lifetime in the cred,
2426 since there is no ticket transfered in the exported context
2428 * export_name.c (gss_export_name): export name with
2429 GSS_C_NT_EXPORT_NAME wrapping, not just the principal
2431 * import_name.c (import_export_name): new function, parses a
2432 GSS_C_NT_EXPORT_NAME
2433 (import_krb5_name): factor out common code of parsing krb5 name
2434 (gss_oid_equal): rename from oid_equal
2436 * gssapi_locl.h: add prototypes for gss_oid_equal and
2437 gss_verify_mic_internal
2439 * gssapi.h: comment out the argument names
2441 2003-03-15 Love Hörnquist Åstrand <lha@it.su.se>
2443 * gssapi.3: add LIST OF FUNCTIONS and copyright/license
2445 * Makefile.am: s/gss_aquire_cred.3/gss_acquire_cred.3/
2447 * Makefile.am: man_MANS += gss_aquire_cred.3
2449 2003-03-14 Love Hörnquist Åstrand <lha@it.su.se>
2451 * gss_aquire_cred.3: the gssapi api manpage
2453 2003-03-03 Love Hörnquist Åstrand <lha@it.su.se>
2455 * inquire_context.c: (gss_inquire_context): rename argument open
2458 * gssapi.h (gss_inquire_context): rename argument open to open_context
2460 2003-02-27 Love Hörnquist Åstrand <lha@it.su.se>
2462 * init_sec_context.c (do_delegation): remove unused variable
2465 * gssapi.3: all 0.5.x version had broken token delegation
2467 2003-02-21 Love Hörnquist Åstrand <lha@it.su.se>
2469 * (init_auth): only generate one subkey
2471 2003-01-27 Love Hörnquist Åstrand <lha@it.su.se>
2473 * verify_mic.c (verify_mic_des3): fix 3des verify_mic to conform
2474 to rfc (and mit kerberos), provide backward compat hook
2476 * get_mic.c (mic_des3): fix 3des get_mic to conform to rfc (and
2477 mit kerberos), provide backward compat hook
2479 * init_sec_context.c (init_auth): check if we need compat for
2480 older get_mic/verify_mic
2482 * gssapi_locl.h: add prototype for _gss_DES3_get_mic_compat
2484 * gssapi.h (more_flags): add COMPAT_OLD_DES3
2486 * Makefile.am: add gssapi.3 and compat.c
2488 * gssapi.3: add gssapi COMPATIBILITY documentation
2490 * accept_sec_context.c (gss_accept_sec_context): check if we need
2491 compat for older get_mic/verify_mic
2493 * compat.c: check for compatiblity with other heimdal's 3des
2496 2002-10-31 Johan Danielsson <joda@pdc.kth.se>
2498 * check return value from gssapi_krb5_init
2500 * 8003.c (gssapi_krb5_verify_8003_checksum): check size of input
2502 2002-09-03 Johan Danielsson <joda@pdc.kth.se>
2504 * wrap.c (wrap_des3): use ETYPE_DES3_CBC_NONE
2506 * unwrap.c (unwrap_des3): use ETYPE_DES3_CBC_NONE
2508 2002-09-02 Johan Danielsson <joda@pdc.kth.se>
2510 * init_sec_context.c: we need to generate a local subkey here
2512 2002-08-20 Jacques Vidrine <n@nectar.com>
2514 * acquire_cred.c, inquire_cred.c, release_cred.c: Use default
2515 credential resolution if gss_acquire_cred is called with
2518 2002-06-20 Jacques Vidrine <n@nectar.com>
2520 * import_name.c: Compare name types by value if pointers do
2521 not match. Reported by: "Douglas E. Engert" <deengert@anl.gov>
2523 2002-05-20 Jacques Vidrine <n@nectar.com>
2525 * verify_mic.c (gss_verify_mic), unwrap.c (gss_unwrap): initialize
2526 the qop_state parameter. from Doug Rabson <dfr@nlsystems.com>
2528 2002-05-09 Jacques Vidrine <n@nectar.com>
2530 * acquire_cred.c: handle GSS_C_INITIATE/GSS_C_ACCEPT/GSS_C_BOTH
2532 2002-05-08 Jacques Vidrine <n@nectar.com>
2534 * acquire_cred.c: initialize gssapi; handle null desired_name
2536 2002-03-22 Johan Danielsson <joda@pdc.kth.se>
2538 * Makefile.am: remove non-functional stuff accidentally committed
2540 2002-03-11 Assar Westerlund <assar@sics.se>
2542 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:5:2
2543 * 8003.c (gssapi_krb5_verify_8003_checksum): handle zero channel
2546 2001-10-31 Jacques Vidrine <n@nectar.com>
2548 * get_mic.c (mic_des3): MIC computation using DES3/SHA1
2549 was bogusly appending the message buffer to the result,
2550 overwriting a heap buffer in the process.
2552 2001-08-29 Assar Westerlund <assar@sics.se>
2554 * 8003.c (gssapi_krb5_verify_8003_checksum,
2555 gssapi_krb5_create_8003_checksum): make more consistent by always
2556 returning an gssapi error and setting minor status. update
2559 2001-08-28 Jacques Vidrine <n@nectar.com>
2561 * accept_sec_context.c: Create a cache for delegated credentials
2564 2001-08-28 Assar Westerlund <assar@sics.se>
2566 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:4:2
2568 2001-08-23 Assar Westerlund <assar@sics.se>
2570 * *.c: handle minor_status more consistently
2572 * display_status.c (gss_display_status): handle krb5_get_err_text
2575 2001-08-15 Johan Danielsson <joda@pdc.kth.se>
2577 * gssapi_locl.h: fix prototype for gssapi_krb5_init
2579 2001-08-13 Johan Danielsson <joda@pdc.kth.se>
2581 * accept_sec_context.c (gsskrb5_register_acceptor_identity): init
2582 context and check return value from kt_resolve
2584 * init.c: return error code
2586 2001-07-19 Assar Westerlund <assar@sics.se>
2588 * Makefile.am (libgssapi_la_LDFLAGS): update to 3:3:2
2590 2001-07-12 Assar Westerlund <assar@sics.se>
2592 * Makefile.am (libgssapi_la_LIBADD): add required library
2595 2001-07-06 Assar Westerlund <assar@sics.se>
2597 * accept_sec_context.c (gsskrb5_register_acceptor_identity): set
2598 the keytab to be used for gss_acquire_cred too'
2600 2001-07-03 Assar Westerlund <assar@sics.se>
2602 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:2:2
2604 2001-06-18 Assar Westerlund <assar@sics.se>
2606 * wrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2607 and gss_krb5_get_remotekey
2608 * verify_mic.c: update krb5_auth_con function names use
2609 gss_krb5_get_remotekey
2610 * unwrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2611 and gss_krb5_get_remotekey
2612 * gssapi_locl.h (gss_krb5_get_remotekey, gss_krb5_get_localkey):
2614 * get_mic.c: update krb5_auth_con function names. use
2615 gss_krb5_get_localkey
2616 * accept_sec_context.c: update krb5_auth_con function names
2618 2001-05-17 Assar Westerlund <assar@sics.se>
2620 * Makefile.am: bump version to 3:1:2
2622 2001-05-14 Assar Westerlund <assar@sics.se>
2624 * address_to_krb5addr.c: adapt to new address functions
2626 2001-05-11 Assar Westerlund <assar@sics.se>
2628 * try to return the error string from libkrb5 where applicable
2630 2001-05-08 Assar Westerlund <assar@sics.se>
2632 * delete_sec_context.c (gss_delete_sec_context): remember to free
2633 the memory used by the ticket itself. from <tmartin@mirapoint.com>
2635 2001-05-04 Assar Westerlund <assar@sics.se>
2637 * gssapi_locl.h: add config.h for completeness
2638 * gssapi.h: remove config.h, this is an installed header file
2639 sys/types.h is not needed either
2641 2001-03-12 Assar Westerlund <assar@sics.se>
2643 * acquire_cred.c (gss_acquire_cred): remove memory leaks. from
2644 Jason R Thorpe <thorpej@zembu.com>
2646 2001-02-18 Assar Westerlund <assar@sics.se>
2648 * accept_sec_context.c (gss_accept_sec_context): either return
2649 gss_name NULL-ed or set
2651 * import_name.c: set minor_status in some cases where it was not
2654 2001-02-15 Assar Westerlund <assar@sics.se>
2656 * wrap.c: use krb5_generate_random_block for the confounders
2658 2001-01-30 Assar Westerlund <assar@sics.se>
2660 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:0:2
2661 * acquire_cred.c, init_sec_context.c, release_cred.c: add support
2662 for getting creds from a keytab, from fvdl@netbsd.org
2664 * copy_ccache.c: add gss_krb5_copy_ccache
2666 2001-01-27 Assar Westerlund <assar@sics.se>
2668 * get_mic.c: cast parameters to des function to non-const pointers
2669 to handle the case where these functions actually take non-const
2672 2001-01-09 Assar Westerlund <assar@sics.se>
2674 * accept_sec_context.c (gss_accept_sec_context): use krb5_rd_cred2
2675 instead of krb5_rd_cred
2677 2000-12-11 Assar Westerlund <assar@sics.se>
2679 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:3:1
2681 2000-12-08 Assar Westerlund <assar@sics.se>
2683 * wrap.c (wrap_des3): use the checksum as ivec when encrypting the
2685 * unwrap.c (unwrap_des3): use the checksum as ivec when encrypting
2687 * init_sec_context.c (init_auth): always zero fwd_data
2689 2000-12-06 Johan Danielsson <joda@pdc.kth.se>
2691 * accept_sec_context.c: de-pointerise auth_context parameter to
2694 2000-11-15 Assar Westerlund <assar@sics.se>
2696 * init_sec_context.c (init_auth): update to new
2697 krb5_build_authenticator
2699 2000-09-19 Assar Westerlund <assar@sics.se>
2701 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:2:1
2703 2000-08-27 Assar Westerlund <assar@sics.se>
2705 * init_sec_context.c: actually pay attention to `time_req'
2706 * init_sec_context.c: re-organize. leak less memory.
2707 * gssapi_locl.h (gssapi_krb5_encapsulate, gss_krb5_getsomekey):
2708 update prototypes add assert.h
2709 * gssapi.h (GSS_KRB5_CONF_C_QOP_DES, GSS_KRB5_CONF_C_QOP_DES3_KD):
2711 * verify_mic.c: re-organize and add 3DES code
2712 * wrap.c: re-organize and add 3DES code
2713 * unwrap.c: re-organize and add 3DES code
2714 * get_mic.c: re-organize and add 3DES code
2715 * encapsulate.c (gssapi_krb5_encapsulate): do not free `in_data',
2716 let the caller do that. fix the callers.
2718 2000-08-16 Assar Westerlund <assar@sics.se>
2720 * Makefile.am: bump version to 2:1:1
2722 2000-07-29 Assar Westerlund <assar@sics.se>
2724 * decapsulate.c (gssapi_krb5_verify_header): sanity-check length
2726 2000-07-25 Johan Danielsson <joda@pdc.kth.se>
2728 * Makefile.am: bump version to 2:0:1
2730 2000-07-22 Assar Westerlund <assar@sics.se>
2732 * gssapi.h: update OID for GSS_C_NT_HOSTBASED_SERVICE and other
2733 details from rfc2744
2735 2000-06-29 Assar Westerlund <assar@sics.se>
2737 * address_to_krb5addr.c (gss_address_to_krb5addr): actually use
2738 `int' instead of `sa_family_t' for the address family.
2740 2000-06-21 Assar Westerlund <assar@sics.se>
2742 * add support for token delegation. From Daniel Kouril
2743 <kouril@ics.muni.cz> and Miroslav Ruda <ruda@ics.muni.cz>
2745 2000-05-15 Assar Westerlund <assar@sics.se>
2747 * Makefile.am (libgssapi_la_LDFLAGS): set version to 1:1:1
2749 2000-04-12 Assar Westerlund <assar@sics.se>
2751 * release_oid_set.c (gss_release_oid_set): clear set for
2752 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2753 * release_name.c (gss_release_name): reset input_name for
2754 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2755 * release_buffer.c (gss_release_buffer): set value to NULL to be
2756 more robust. From GOMBAS Gabor <gombasg@inf.elte.hu>
2757 * add_oid_set_member.c (gss_add_oid_set_member): actually check if
2758 the oid is a member first. leave the oid_set unchanged if realloc
2761 2000-02-13 Assar Westerlund <assar@sics.se>
2763 * Makefile.am: set version to 1:0:1
2765 2000-02-12 Assar Westerlund <assar@sics.se>
2767 * gssapi_locl.h: add flags for import/export
2768 * import_sec_context.c (import_sec_context: add flags for what
2769 fields are included. do not include the authenticator for now.
2770 * export_sec_context.c (export_sec_context: add flags for what
2771 fields are included. do not include the authenticator for now.
2772 * accept_sec_context.c (gss_accept_sec_context): set target in
2775 2000-02-11 Assar Westerlund <assar@sics.se>
2777 * delete_sec_context.c (gss_delete_sec_context): set context to
2780 * Makefile.am: add {export,import}_sec_context.c
2781 * export_sec_context.c: new file
2782 * import_sec_context.c: new file
2783 * accept_sec_context.c (gss_accept_sec_context): set trans flag
2785 2000-02-07 Assar Westerlund <assar@sics.se>
2787 * Makefile.am: set version to 0:5:0
2789 2000-01-26 Assar Westerlund <assar@sics.se>
2791 * delete_sec_context.c (gss_delete_sec_context): handle a NULL
2794 * wrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2795 changes to libdes calls to make them more portable.
2796 * verify_mic.c: update to pseudo-standard APIs for md4,md5,sha.
2797 some changes to libdes calls to make them more portable.
2798 * unwrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2799 changes to libdes calls to make them more portable.
2800 * get_mic.c: update to pseudo-standard APIs for md4,md5,sha. some
2801 changes to libdes calls to make them more portable.
2802 * 8003.c: update to pseudo-standard APIs for md4,md5,sha.
2804 2000-01-06 Assar Westerlund <assar@sics.se>
2806 * Makefile.am: set version to 0:4:0
2808 1999-12-26 Assar Westerlund <assar@sics.se>
2810 * accept_sec_context.c (gss_accept_sec_context): always set
2812 * init_sec_context.c (init_auth): always initialize `output_token'
2813 * delete_sec_context.c (gss_delete_sec_context): always set
2816 1999-12-06 Assar Westerlund <assar@sics.se>
2818 * Makefile.am: bump version to 0:3:0
2820 1999-10-20 Assar Westerlund <assar@sics.se>
2822 * Makefile.am: set version to 0:2:0
2824 1999-09-21 Assar Westerlund <assar@sics.se>
2826 * init_sec_context.c (gss_init_sec_context): initialize `ticket'
2828 * gssapi.h (gss_ctx_id_t_desc): add ticket in here. ick.
2830 * delete_sec_context.c (gss_delete_sec_context): free ticket
2832 * accept_sec_context.c (gss_accept_sec_context): stove away
2833 `krb5_ticket' in context so that ugly programs such as
2834 gss_nt_server can get at it. uck.
2836 1999-09-20 Johan Danielsson <joda@pdc.kth.se>
2838 * accept_sec_context.c: set minor_status
2840 1999-08-04 Assar Westerlund <assar@sics.se>
2842 * display_status.c (calling_error, routine_error): right shift the
2843 code to make it possible to index into the arrays
2845 1999-07-28 Assar Westerlund <assar@sics.se>
2847 * gssapi.h (GSS_C_AF_INET6): add
2849 * import_name.c (import_hostbased_name): set minor_status
2851 1999-07-26 Assar Westerlund <assar@sics.se>
2853 * Makefile.am: set version to 0:1:0
2855 Wed Apr 7 14:05:15 1999 Johan Danielsson <joda@hella.pdc.kth.se>
2857 * display_status.c: set minor_status
2859 * init_sec_context.c: set minor_status
2861 * lib/gssapi/init.c: remove donep (check gssapi_krb5_context