1 2008-03-14 Love Hörnquist Åstrand <lha@it.su.se>
3 * test_context.c: Add test for gsskrb5_register_acceptor_identity.
5 2008-03-09 Love Hörnquist Åstrand <lha@it.su.se>
7 * krb5/init_sec_context.c (init_auth): use right variable to
8 detect if we want to free or not.
10 2008-02-26 Love Hörnquist Åstrand <lha@it.su.se>
12 * Makefile.am: add missing \
14 * Makefile.am: reshuffle depenencies
16 * Add flag to krb5 to not add GSS-API INT|CONF to the negotiation
18 2008-02-21 Love Hörnquist Åstrand <lha@it.su.se>
20 * make the SPNEGO mech store the error itself instead, works for
21 everything except other stackable mechs
23 2008-02-18 Love Hörnquist Åstrand <lha@it.su.se>
25 * spnego/init_sec_context.c (spnego_reply): if the reply token was
26 of length 0, make it the same as no token. Pointed out by Zeqing
29 * krb5/acquire_cred.c (acquire_initiator_cred): handle the
30 credential cache better, use destroy/close when appriate and for
31 all cases. Thanks to Michael Allen for point out the memory-leak
34 2008-02-03 Love Hörnquist Åstrand <lha@it.su.se>
36 * spnego/accept_sec_context.c: Make error reporting somewhat more
39 2008-01-27 Love Hörnquist Åstrand <lha@it.su.se>
41 * test_common.c: Improve the error message.
43 2008-01-24 Love Hörnquist Åstrand <lha@it.su.se>
45 * ntlm/accept_sec_context.c: Avoid free-ing type1 message before
48 2008-01-13 Love Hörnquist Åstrand <lha@it.su.se>
50 * test_ntlm.c: Test source name (and make the acceptor in ntlm gss
53 2007-12-30 Love Hörnquist Åstrand <lha@it.su.se>
55 * ntlm/init_sec_context.c: Don't confuse target name and source
56 name, make regressiont tests pass again.
58 2007-12-29 Love Hörnquist Åstrand <lha@it.su.se>
60 * ntlm: clean up name handling
62 2007-12-04 Love Hörnquist Åstrand <lha@it.su.se>
64 * ntlm/init_sec_context.c: Use credential if it was passed in.
66 * ntlm/acquire_cred.c: Check if there is initial creds with
67 _gss_ntlm_get_user_cred().
69 * ntlm/init_sec_context.c: Add _gss_ntlm_get_user_info() that
70 return the user info so it can be used by external modules.
72 * ntlm/inquire_cred.c: use the right error code.
74 * ntlm/inquire_cred.c: Return GSS_C_NO_CREDENTIAL if there is no
75 credential, ntlm have (not yet) a default credential.
77 * mech/gss_release_oid_set.c: Avoid trying to deref NULL, from
80 2007-12-03 Love Hörnquist Åstrand <lha@it.su.se>
82 * test_acquire_cred.c: Always try to fetch cred (even with
85 2007-08-09 Love Hörnquist Åstrand <lha@it.su.se>
87 * mech/gss_krb5.c: Readd gss_krb5_get_tkt_flags.
89 2007-08-08 Love Hörnquist Åstrand <lha@it.su.se>
91 * spnego/compat.c (_gss_spnego_internal_delete_sec_context):
92 release ctx->target_name too From Rafal Malinowski.
94 2007-07-26 Love Hörnquist Åstrand <lha@it.su.se>
96 * mech/gss_mech_switch.c: Don't try to do dlopen if system doesn't
97 have dlopen. From Rune of Chalmers.
99 2007-07-10 Love Hörnquist Åstrand <lha@it.su.se>
101 * mech/gss_duplicate_name.c: New signature of _gss_find_mn.
103 * mech/gss_init_sec_context.c: New signature of _gss_find_mn.
105 * mech/gss_acquire_cred.c: New signature of _gss_find_mn.
107 * mech/name.h: New signature of _gss_find_mn.
109 * mech/gss_canonicalize_name.c: New signature of _gss_find_mn.
111 * mech/gss_compare_name.c: New signature of _gss_find_mn.
113 * mech/gss_add_cred.c: New signature of _gss_find_mn.
115 * mech/gss_names.c (_gss_find_mn): Return an error code for
118 * spnego/accept_sec_context.c: remove checks that are done by the
121 * Makefile.am: New library version.
123 2007-07-04 Love Hörnquist Åstrand <lha@it.su.se>
125 * mech/gss_oid_to_str.c: Refuse to print GSS_C_NULL_OID, from
128 * spnego/spnego.asn1: Indent and make NegTokenInit and
129 NegTokenResp extendable.
131 2007-06-21 Love Hörnquist Åstrand <lha@it.su.se>
133 * ntlm/inquire_cred.c: Implement _gss_ntlm_inquire_cred.
135 * mech/gss_display_status.c: Provide message for GSS_S_COMPLETE.
137 * mech/context.c: If the canned string is "", its no use to the
138 user, make it fall back to the default error string.
140 2007-06-20 Love Hörnquist Åstrand <lha@it.su.se>
142 * mech/gss_display_name.c (gss_display_name): no name ->
143 fail. From Rafal Malinswski.
145 * spnego/accept_sec_context.c: Wrap name in a spnego_name instead
146 of just a copy of the underlaying object. From Rafal Malinswski.
148 * spnego/accept_sec_context.c: Handle underlaying mech not
151 * mech/gss_accept_sec_context.c: Handle underlaying mech not
154 * spnego/accept_sec_context.c: Make sure src_name is always set to
155 GSS_C_NO_NAME when returning.
157 * krb5/acquire_cred.c (acquire_acceptor_cred): don't claim
158 everything is well on failure. From Phil Fisher.
160 * mech/gss_duplicate_name.c: catch error (and ignore it)
162 * ntlm/init_sec_context.c: Use heim_ntlm_calculate_ntlm2_sess.
164 * mech/gss_accept_sec_context.c: Only wrap the delegated cred if
165 we got a delegated mech cred. From Rafal Malinowski.
167 * spnego/accept_sec_context.c: Only wrap the delegated cred if we
168 are going to return it to the consumer. From Rafal Malinowski.
170 * spnego/accept_sec_context.c: Fixed memory leak pointed out by
171 Rafal Malinowski, also while here moved to use NegotiationToken
174 2007-06-18 Love Hörnquist Åstrand <lha@it.su.se>
176 * krb5/prf.c (_gsskrb5_pseudo_random): add missing break.
178 * krb5/release_name.c: Set *minor_status unconditionallty, its
181 * spnego/accept_sec_context.c: Init get_mic to 0.
183 * mech/gss_set_cred_option.c: Free memory in failure case, found
186 * mech/gss_inquire_context.c: Handle mech_type being NULL.
188 * mech/gss_inquire_cred_by_mech.c: Handle cred_name being NULL.
190 * mech/gss_krb5.c: Free memory in error case, found by beam.
192 2007-06-12 Love Hörnquist Åstrand <lha@it.su.se>
194 * ntlm/inquire_context.c: Use ctx->gssflags for flags.
196 * krb5/display_name.c: Use KRB5_PRINCIPAL_UNPARSE_DISPLAY, this is
197 not ment for machine consumption.
199 2007-06-09 Love Hörnquist Åstrand <lha@it.su.se>
201 * ntlm/digest.c (kdc_alloc): free memory on failure, pointed out
204 * ntlm/digest.c (kdc_destroy): free context when done, pointed out
207 * spnego/context_stubs.c (_gss_spnego_display_name): if input_name
208 is null, fail. From Rafal Malinowski.
210 2007-06-04 Love Hörnquist Åstrand <lha@it.su.se>
212 * ntlm/digest.c: Free memory when done.
214 2007-06-02 Love Hörnquist Åstrand <lha@it.su.se>
216 * test_ntlm.c: Test both with and without keyex.
218 * ntlm/digest.c: If we didn't set session key, don't expect one
221 * test_ntlm.c: Set keyex flag and calculate session key.
223 2007-05-31 Love Hörnquist Åstrand <lha@it.su.se>
225 * spnego/accept_sec_context.c: Use the return value before is
226 overwritten by later calls. From Rafal Malinowski
228 * krb5/release_cred.c: Give an minor_status argument to
229 gss_release_oid_set. From Rafal Malinowski
231 2007-05-30 Love Hörnquist Åstrand <lha@it.su.se>
233 * ntlm/accept_sec_context.c: Catch errors and return the up the
236 * test_kcred.c: more testing of lifetimes
238 2007-05-17 Love Hörnquist Åstrand <lha@it.su.se>
240 * Makefile.am: Drop the gss oid_set function for the krb5 mech,
241 use the mech glue versions instead. Pointed out by Rafal
244 * krb5: Use gss oid_set functions from mechglue
246 2007-05-14 Love Hörnquist Åstrand <lha@it.su.se>
248 * ntlm/accept_sec_context.c: Set session key only if we are
249 returned a session key. Found by David Love.
251 2007-05-13 Love Hörnquist Åstrand <lha@it.su.se>
253 * krb5/prf.c: switched MIN to min to make compile on solaris,
254 pointed out by David Love.
256 2007-05-09 Love Hörnquist Åstrand <lha@it.su.se>
258 * krb5/inquire_cred_by_mech.c: Fill in all of the variables if
259 they are passed in. Pointed out by Phil Fisher.
261 2007-05-08 Love Hörnquist Åstrand <lha@it.su.se>
263 * krb5/inquire_cred.c: Fix copy and paste error, bug spotted by
266 * mech: dont keep track of gc_usage, just figure it out at
267 gss_inquire_cred() time
269 * mech/gss_mech_switch.c (add_builtin): ok for
270 __gss_mech_initialize() to return NULL
272 * test_kcred.c: more correct tests
274 * spnego/cred_stubs.c (gss_inquire_cred*): wrap the name with a
277 * ntlm/inquire_cred.c: make ntlm gss_inquire_cred fail for now,
278 need to find default cred and friends.
280 * krb5/inquire_cred_by_mech.c: reimplement
282 2007-05-07 Love Hörnquist Åstrand <lha@it.su.se>
284 * ntlm/acquire_cred.c: drop unused variable.
286 * ntlm/acquire_cred.c: Reimplement.
288 * Makefile.am: add ntlm/digest.c
290 * ntlm: split out backend ntlm server processing
292 2007-04-24 Love Hörnquist Åstrand <lha@it.su.se>
294 * ntlm/delete_sec_context.c (_gss_ntlm_delete_sec_context): free
297 2007-04-22 Love Hörnquist Åstrand <lha@it.su.se>
299 * ntlm/init_sec_context.c: ntlm-key credential entry is prefix with @
301 * ntlm/init_sec_context.c (get_user_ccache): pick up the ntlm
302 creds from the krb5 credential cache.
304 2007-04-21 Love Hörnquist Åstrand <lha@it.su.se>
306 * ntlm/delete_sec_context.c: free the key stored in the context
308 * ntlm/ntlm.h: switch password for a key
310 * test_oid.c: Switch oid to one that is exported.
312 2007-04-20 Love Hörnquist Åstrand <lha@it.su.se>
314 * ntlm/init_sec_context.c: move where hash is calculated to make
315 it easier to add ccache support.
317 * Makefile.am: Add version-script.map to EXTRA_DIST.
319 2007-04-19 Love Hörnquist Åstrand <lha@it.su.se>
321 * Makefile.am: Unconfuse newer versions of automake that doesn't
322 know the diffrence between depenences and setting variables. foo:
325 * test_ntlm.c: delete sec context when done.
327 * version-script.map: export more symbols.
329 * Makefile.am: add version script if ld supports it
331 * version-script.map: add version script if ld supports it
333 2007-04-18 Love Hörnquist Åstrand <lha@it.su.se>
335 * Makefile.am: test_acquire_cred need test_common.[ch]
337 * test_acquire_cred.c: add more test options.
339 * krb5/external.c: add GSS_KRB5_CCACHE_NAME_X
341 * gssapi/gssapi_krb5.h: add GSS_KRB5_CCACHE_NAME_X
343 * krb5/set_sec_context_option.c: refactor code, implement
344 GSS_KRB5_CCACHE_NAME_X
346 * mech/gss_krb5.c: reimplement gss_krb5_ccache_name
348 2007-04-17 Love Hörnquist Åstrand <lha@it.su.se>
350 * spnego/cred_stubs.c: Need to import spnego name before we can
351 use it as a gss_name_t.
353 * test_acquire_cred.c: use this test as part of the regression
356 * mech/gss_acquire_cred.c (gss_acquire_cred): dont init
357 cred->gc_mc every time in the loop.
359 2007-04-15 Love Hörnquist Åstrand <lha@it.su.se>
361 * Makefile.am: add test_common.h
363 2007-02-16 Love Hörnquist Åstrand <lha@it.su.se>
365 * gss_acquire_cred.3: Add link for
366 gsskrb5_register_acceptor_identity.
368 2007-02-08 Love Hörnquist Åstrand <lha@it.su.se>
370 * krb5/copy_ccache.c: Try to leak less memory in the failure case.
372 2007-01-31 Love Hörnquist Åstrand <lha@it.su.se>
374 * mech/gss_display_status.c: Use right printf formater.
376 * test_*.[ch]: split out the error printing function and try to
379 2007-01-30 Love Hörnquist Åstrand <lha@it.su.se>
381 * krb5/init_sec_context.c: revert 1.75: (init_auth): only turn on
382 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
384 This is because Kerberos always support INT|CONF, matches behavior
385 with MS and MIT. The creates problems for the GSS-SPNEGO mech.
387 2007-01-24 Love Hörnquist Åstrand <lha@it.su.se>
389 * krb5/prf.c: constrain desired_output_len
391 * krb5/external.c (krb5_mech): add _gsskrb5_pseudo_random
393 * mech/gss_pseudo_random.c: Catch error from underlaying mech on
396 * Makefile.am: Add krb5/prf.c
398 * krb5/prf.c: gss_pseudo_random for krb5
400 * test_context.c: Checks for gss_pseudo_random.
402 * krb5/gkrb5_err.et: add KG_INPUT_TOO_LONG
404 * Makefile.am: Add mech/gss_pseudo_random.c
406 * gssapi/gssapi.h: try to load pseudo_random
408 * mech/gss_mech_switch.c: try to load pseudo_random
410 * mech/gss_pseudo_random.c: Add gss_pseudo_random.
412 * gssapi_mech.h: Add hook for gm_pseudo_random.
414 2007-01-17 Love Hörnquist Åstrand <lha@it.su.se>
416 * test_context.c: Don't assume bufer from gss_display_status is
419 * mech/gss_wrap_size_limit.c: Reset out variables.
421 * mech/gss_wrap.c: Reset out variables.
423 * mech/gss_verify_mic.c: Reset out variables.
425 * mech/gss_utils.c: Reset out variables.
427 * mech/gss_release_oid_set.c: Reset out variables.
429 * mech/gss_release_cred.c: Reset out variables.
431 * mech/gss_release_buffer.c: Reset variables.
433 * mech/gss_oid_to_str.c: Reset out variables.
435 * mech/gss_inquire_sec_context_by_oid.c: Fix reset out variables.
437 * mech/gss_mech_switch.c: Reset out variables.
439 * mech/gss_inquire_sec_context_by_oid.c: Reset out variables.
441 * mech/gss_inquire_names_for_mech.c: Reset out variables.
443 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
445 * mech/gss_inquire_cred_by_oid.c: Reset out variables.
447 * mech/gss_inquire_cred_by_mech.c: Reset out variables.
449 * mech/gss_inquire_cred.c: Reset out variables, fix memory leak.
451 * mech/gss_inquire_context.c: Reset out variables.
453 * mech/gss_init_sec_context.c: Zero out outbuffer on failure.
455 * mech/gss_import_name.c: Reset out variables.
457 * mech/gss_import_name.c: Reset out variables.
459 * mech/gss_get_mic.c: Reset out variables.
461 * mech/gss_export_name.c: Reset out variables.
463 * mech/gss_encapsulate_token.c: Reset out variables.
465 * mech/gss_duplicate_oid.c: Reset out variables.
467 * mech/gss_duplicate_oid.c: Reset out variables.
469 * mech/gss_duplicate_name.c: Reset out variables.
471 * mech/gss_display_status.c: Reset out variables.
473 * mech/gss_display_name.c: Reset out variables.
475 * mech/gss_delete_sec_context.c: Reset out variables using propper
478 * mech/gss_decapsulate_token.c: Reset out variables using propper
481 * mech/gss_add_cred.c: Reset out variables.
483 * mech/gss_acquire_cred.c: Reset out variables.
485 * mech/gss_accept_sec_context.c: Reset out variables using propper
488 * mech/gss_init_sec_context.c: Reset out variables.
490 * mech/mech_locl.h (_mg_buffer_zero): new macro that zaps a
493 2007-01-16 Love Hörnquist Åstrand <lha@it.su.se>
495 * mech: sprinkel _gss_mg_error
497 * mech/gss_display_status.c (gss_display_status): use
498 _gss_mg_get_error to fetch the error from underlaying mech, if it
499 failes, let do the regular dance for GSS-CODE version and a
500 generic print-the-error code for MECH-CODE.
502 * mech/gss_oid_to_str.c: Don't include the NUL in the length of
505 * mech/context.h: Protoypes for _gss_mg_.
507 * mech/context.c: Glue to catch the error from the lower gss-api
508 layer and save that for later so gss_display_status() can show the
511 * gss.c: Detect NTLM.
513 2007-01-11 Love Hörnquist Åstrand <lha@it.su.se>
515 * mech/gss_accept_sec_context.c: spelling
517 2007-01-04 Love Hörnquist Åstrand <lha@it.su.se>
519 * Makefile.am: Include build (private) prototypes header files.
521 * Makefile.am (ntlmsrc): add ntlm/ntlm-private.h
523 2006-12-28 Love Hörnquist Åstrand <lha@it.su.se>
525 * ntlm/accept_sec_context.c: Pass signseal argument to
528 * ntlm/init_sec_context.c: Pass signseal argument to
531 * ntlm/crypto.c (_gss_ntlm_set_key): add signseal argument
533 * test_ntlm.c: add ntlmv2 test
535 * ntlm/ntlm.h: break out struct ntlmv2_key;
537 * ntlm/crypto.c (_gss_ntlm_set_key): set ntlm v2 keys.
539 * ntlm/accept_sec_context.c: Set dummy ntlmv2 keys and Check TI.
541 * ntlm/ntlm.h: NTLMv2 keys.
543 * ntlm/crypto.c: NTLMv2 sign and verify.
545 2006-12-20 Love Hörnquist Åstrand <lha@it.su.se>
547 * ntlm/accept_sec_context.c: Don't send targetinfo now.
549 * ntlm/init_sec_context.c: Build ntlmv2 answer buffer.
551 * ntlm/init_sec_context.c: Leak less memory.
553 * ntlm/init_sec_context.c: Announce that we support key exchange.
555 * ntlm/init_sec_context.c: Add NTLM_NEG_NTLM2_SESSION, NTLMv2
556 session security (disable because missing sign and seal).
558 2006-12-19 Love Hörnquist Åstrand <lha@it.su.se>
560 * ntlm/accept_sec_context.c: split RC4 send and recv keystreams
562 * ntlm/init_sec_context.c: split RC4 send and recv keystreams
564 * ntlm/ntlm.h: split RC4 send and recv keystreams
566 * ntlm/crypto.c: Implement SEAL.
568 * ntlm/crypto.c: move gss_wrap/gss_unwrap here
570 * test_context.c: request INT and CONF from the gss layer, test
573 * ntlm/ntlm.h: add crypto bits.
575 * ntlm/accept_sec_context.c: Save session master key.
577 * Makefile.am: Move get and verify mic to the same file (crypto.c)
578 since they share code.
580 * ntlm/crypto.c: Move get and verify mic to the same file since
581 they share code, implement NTLM v1 and dummy signatures.
583 * ntlm/init_sec_context.c: pass on GSS_C_CONF_FLAG and
584 GSS_C_INTEG_FLAG, save the session master key
586 * spnego/accept_sec_context.c: try using gss_accept_sec_context()
587 on the opportunistic token instead of guessing the acceptor name
588 and do gss_acquire_cred, this make SPNEGO work like before.
590 2006-12-18 Love Hörnquist Åstrand <lha@it.su.se>
592 * ntlm/init_sec_context.c: Calculate the NTLM version 1 "master"
595 * spnego/accept_sec_context.c: Resurect negHints for the acceptor
598 * Makefile.am: Add "windows" versions of the NegTokenInitWin and
601 * test_context.c: add --wrapunwrap flag
603 * spnego/compat.c: move _gss_spnego_indicate_mechtypelist() to
604 compat.c, use the sequence types of MechTypeList, make
605 add_mech_type() static.
607 * spnego/accept_sec_context.c: move
608 _gss_spnego_indicate_mechtypelist() to compat.c
610 * Makefile.am: Generate sequence code for MechTypeList
612 * spnego: check that the generated acceptor mechlist is acceptable too
614 * spnego/init_sec_context.c: Abstract out the initiator filter
615 function, it will be needed for the acceptor too.
617 * spnego/accept_sec_context.c: Abstract out the initiator filter
618 function, it will be needed for the acceptor too. Remove negHints.
620 * test_context.c: allow asserting return mech
622 * ntlm/accept_sec_context.c: add _gss_ntlm_allocate_ctx
624 * ntlm/acquire_cred.c: Check that the KDC seem to there and
625 answering us, we can't do better then that wen checking if we will
626 accept the credential.
628 * ntlm/get_mic.c: return GSS_S_UNAVAILABLE
630 * mech/utils.h: add _gss_free_oid, reverse of _gss_copy_oid
632 * mech/gss_utils.c: add _gss_free_oid, reverse of _gss_copy_oid
634 * spnego/spnego.asn1: Its very sad, but NegHints its are not part
635 of the NegTokenInit, this makes SPNEGO acceptor life a lot harder.
637 * spnego: try harder to handle names better. handle missing
638 acceptor and initator creds better (ie dont propose/accept mech
639 that there are no credentials for) split NegTokenInit and
640 NegTokenResp in acceptor
642 2006-12-16 Love Hörnquist Åstrand <lha@it.su.se>
644 * ntlm/import_name.c: Allocate the buffer from the right length.
646 2006-12-15 Love Hörnquist Åstrand <lha@it.su.se>
648 * ntlm/init_sec_context.c (init_sec_context): Tell the other side
649 what domain we think we are talking to.
651 * ntlm/delete_sec_context.c: free username and password
653 * ntlm/release_name.c (_gss_ntlm_release_name): free name.
655 * ntlm/import_name.c (_gss_ntlm_import_name): add support for
656 GSS_C_NT_HOSTBASED_SERVICE names
658 * ntlm/ntlm.h: Add ntlm_name.
660 * test_context.c: allow testing of ntlm.
662 * gssapi_mech.h: add __gss_ntlm_initialize
664 * ntlm/accept_sec_context.c (handle_type3): verify that the kdc
665 approved of the ntlm exchange too
667 * mech/gss_mech_switch.c: Add the builtin ntlm mech
669 * test_ntlm.c: NTLM test app.
671 * mech/gss_accept_sec_context.c: Add detection of NTLMSSP.
673 * gssapi/gssapi.h: add ntlm mech oid
675 * ntlm/external.c: Switch OID to the ms ntlmssp oid
677 * Makefile.am: Add ntlm gss-api module.
679 * ntlm/accept_sec_context.c: Catch more error errors.
681 * ntlm/accept_sec_context.c: Check after a credential to use.
683 2006-12-14 Love Hörnquist Åstrand <lha@it.su.se>
685 * krb5/set_sec_context_option.c (GSS_KRB5_SET_DEFAULT_REALM_X):
686 don't fail on success. Bug report from Stefan Metzmacher.
688 2006-12-13 Love Hörnquist Åstrand <lha@it.su.se>
690 * krb5/init_sec_context.c (init_auth): only turn on
691 GSS_C_CONF_FLAG and GSS_C_INT_FLAG if the caller requseted it.
692 From Stefan Metzmacher.
694 2006-12-11 Love Hörnquist Åstrand <lha@it.su.se>
696 * Makefile.am (libgssapi_la_OBJECTS): depends on gssapi_asn1.h
699 2006-11-20 Love Hörnquist Åstrand <lha@it.su.se>
701 * krb5/acquire_cred.c: Make krb5_get_init_creds_opt_free take a
704 2006-11-16 Love Hörnquist Åstrand <lha@it.su.se>
706 * test_context.c: Test that token keys are the same, return
709 2006-11-15 Love Hörnquist Åstrand <lha@it.su.se>
711 * spnego/spnego_locl.h: Make bitfields unsigned, add maybe_open.
713 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
714 encode CHOICE structure now that we can handle it.
716 * spnego/init_sec_context.c: Use ASN.1 encoder functions to encode
717 CHOICE structure now that we can handle it.
719 * spnego/accept_sec_context.c (_gss_spnego_accept_sec_context):
720 send back ad accept_completed when the security context is ->open,
721 w/o this the client doesn't know that the server have completed
724 * test_context.c: Add delegate flag and check that the delegated
727 * spnego/init_sec_context.c: Keep track of the opportunistic token
728 in the inital message, it might be a complete gss-api context, in
729 that case we'll get back accept_completed without any token. With
730 this change, krb5 w/o mutual authentication works.
732 * spnego/accept_sec_context.c: Use ASN.1 encoder functions to
733 encode CHOICE structure now that we can handle it.
735 * spnego/accept_sec_context.c: Filter out SPNEGO from the out
736 supported mechs list and make sure we don't select that for the
739 2006-11-14 Love Hörnquist Åstrand <lha@it.su.se>
741 * mech/gss_init_sec_context.c (_gss_mech_cred_find): break out the
742 cred finding to its own function
744 * krb5/wrap.c: Better error strings, from Andrew Bartlet.
746 2006-11-13 Love Hörnquist Åstrand <lha@it.su.se>
748 * test_context.c: Create our own krb5_context.
750 * krb5: Switch from using a specific error message context in the
751 TLS to have a whole krb5_context in TLS. This have some
752 interestion side-effekts for the configruration setting options
753 since they operate on per-thread basis now.
755 * mech/gss_set_cred_option.c: When calling ->gm_set_cred_option
756 and checking for success, use GSS_S_COMPLETE. From Andrew Bartlet.
758 2006-11-12 Love Hörnquist Åstrand <lha@it.su.se>
760 * Makefile.am: Help solaris make even more.
762 * Makefile.am: Help solaris make.
764 2006-11-09 Love Hörnquist Åstrand <lha@it.su.se>
766 * Makefile.am: remove include $(srcdir)/Makefile-digest.am for now
768 * mech/gss_accept_sec_context.c: Try better guessing what is mech
769 we are going to select by looking harder at the input_token, idea
770 from Luke Howard's mechglue branch.
772 * Makefile.am: libgssapi_la_OBJECTS: add depency on gkrb5_err.h
774 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_ALLOWABLE_ENCTYPES_X
776 * mech/gss_krb5.c: implement gss_krb5_set_allowable_enctypes
778 * gssapi/gssapi.h: GSS_KRB5_S_
780 * krb5/gsskrb5_locl.h: Include <gkrb5_err.h>.
782 * gssapi/gssapi_krb5.h: Add gss_krb5_set_allowable_enctypes.
784 * Makefile.am: Build and install gkrb5_err.h
786 * krb5/gkrb5_err.et: Move the GSS_KRB5_S error here.
788 2006-11-08 Love Hörnquist Åstrand <lha@it.su.se>
790 * mech/gss_krb5.c: Add gsskrb5_set_default_realm.
792 * krb5/set_sec_context_option.c: Support
793 GSS_KRB5_SET_DEFAULT_REALM_X.
795 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DEFAULT_REALM_X
797 * krb5/external.c: add GSS_KRB5_SET_DEFAULT_REALM_X
799 2006-11-07 Love Hörnquist Åstrand <lha@it.su.se>
801 * test_context.c: rename krb5_[gs]et_time_wrap to
802 krb5_[gs]et_max_time_skew
804 * krb5/copy_ccache.c: _gsskrb5_extract_authz_data_from_sec_context
805 no longer used, bye bye
807 * mech/gss_krb5.c: No depenency of the krb5 gssapi mech.
809 * mech/gss_krb5.c (gsskrb5_extract_authtime_from_sec_context): use
810 _gsskrb5_decode_om_uint32. From Andrew Bartlet.
812 * mech/gss_krb5.c: Add dummy gss_krb5_set_allowable_enctypes for
815 * spnego/spnego_locl.h: Include <roken.h> for compatiblity.
817 * krb5/arcfour.c: Use IS_DCE_STYLE flag. There is no padding in
818 DCE-STYLE, don't try to use to. From Andrew Bartlett.
820 * test_context.c: test wrap/unwrap, add flag for dce-style and
821 mutual auth, also support multi-roundtrip sessions
823 * krb5/gsskrb5_locl.h: Add IS_DCE_STYLE macro.
825 * krb5/accept_sec_context.c (gsskrb5_acceptor_start): use
828 * mech/gss_krb5.c (gsskrb5_get_subkey): return the per message
831 * krb5/inquire_sec_context_by_oid.c: check if there is any key at
834 2006-11-06 Love Hörnquist Åstrand <lha@it.su.se>
836 * krb5/inquire_sec_context_by_oid.c: Set more error strings, use
837 right enum for acceptor subkey. From Andrew Bartlett.
839 2006-11-04 Love Hörnquist Åstrand <lha@it.su.se>
841 * test_context.c: Test gsskrb5_extract_service_keyblock, needed in
842 PAC valication. From Andrew Bartlett
844 * mech/gss_krb5.c: Add gsskrb5_extract_authz_data_from_sec_context
845 and keyblock extraction functions.
847 * gssapi/gssapi_krb5.h: Add extraction of keyblock function, from
850 * krb5/external.c: Add GSS_KRB5_GET_SERVICE_KEYBLOCK_X
852 2006-11-03 Love Hörnquist Åstrand <lha@it.su.se>
854 * test_context.c: Rename various routines and constants from
855 canonize to canonicalize. From Andrew Bartlett
857 * mech/gss_krb5.c: Rename various routines and constants from
858 canonize to canonicalize. From Andrew Bartlett
860 * krb5/set_sec_context_option.c: Rename various routines and
861 constants from canonize to canonicalize. From Andrew Bartlett
863 * krb5/external.c: Rename various routines and constants from
864 canonize to canonicalize. From Andrew Bartlett
866 * gssapi/gssapi_krb5.h: Rename various routines and constants from
867 canonize to canonicalize. From Andrew Bartlett
869 2006-10-25 Love Hörnquist Åstrand <lha@it.su.se>
871 * krb5/accept_sec_context.c (gsskrb5_accept_delegated_token): need
874 2006-10-24 Love Hörnquist Åstrand <lha@it.su.se>
876 * test_context.c (loop): free target_name
878 * mech/gss_accept_sec_context.c: SLIST_INIT the ->gc_mc'
880 * mech/gss_acquire_cred.c : SLIST_INIT the ->gc_mc'
882 * krb5/init_sec_context.c: Avoid leaking memory.
884 * mech/gss_buffer_set.c (gss_release_buffer_set): don't leak the
887 * test_context.c: make compile
889 * krb5/cfx.c (_gssapi_verify_mic_cfx): always free crypto context.
891 * krb5/set_cred_option.c (import_cred): free sp
893 2006-10-22 Love Hörnquist Åstrand <lha@it.su.se>
895 * mech/gss_add_oid_set_member.c: Use old implementation of
896 gss_add_oid_set_member, it leaks less memory.
898 * krb5/test_cfx.c: free krb5_crypto.
900 * krb5/test_cfx.c: free krb5_context
902 * mech/gss_release_name.c (gss_release_name): free input_name
905 2006-10-21 Love Hörnquist Åstrand <lha@it.su.se>
907 * test_context.c: Call setprogname.
909 * mech/gss_krb5.c: Add gsskrb5_extract_authtime_from_sec_context.
911 * gssapi/gssapi_krb5.h: add
912 gsskrb5_extract_authtime_from_sec_context
914 2006-10-20 Love Hörnquist Åstrand <lha@it.su.se>
916 * krb5/inquire_sec_context_by_oid.c: Add get_authtime.
918 * krb5/external.c: add GSS_KRB5_GET_AUTHTIME_X
920 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_AUTHTIME_X
922 * krb5/set_sec_context_option.c: Implement GSS_KRB5_SEND_TO_KDC_X.
924 * mech/gss_krb5.c: Add gsskrb5_set_send_to_kdc
926 * gssapi/gssapi_krb5.h: Add GSS_KRB5_SEND_TO_KDC_X and
927 gsskrb5_set_send_to_kdc
929 * krb5/external.c: add GSS_KRB5_SEND_TO_KDC_X
931 * Makefile.am: more files
933 2006-10-19 Love Hörnquist Åstrand <lha@it.su.se>
935 * Makefile.am: remove spnego/gssapi_spnego.h, its now in gssapi/
937 * test_context.c: Allow specifing mech.
939 * krb5/external.c: add GSS_SASL_DIGEST_MD5_MECHANISM (for now)
941 * gssapi/gssapi.h: Rename GSS_DIGEST_MECHANISM to
942 GSS_SASL_DIGEST_MD5_MECHANISM
944 2006-10-18 Love Hörnquist Åstrand <lha@it.su.se>
946 * mech/gssapi.asn1: Make it into a heim_any_set, its doesn't
949 * mech/gssapi.asn1: GSSAPIContextToken is IMPLICIT SEQUENCE
951 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X
953 * krb5/external.c: Add GSS_KRB5_GET_ACCEPTOR_SUBKEY_X.
955 * gssapi/gssapi_krb5.h: add GSS_KRB5_GET_INITIATOR_SUBKEY_X and
956 GSS_KRB5_GET_SUBKEY_X
958 * krb5/external.c: add GSS_KRB5_GET_INITIATOR_SUBKEY_X,
959 GSS_KRB5_GET_SUBKEY_X
961 2006-10-17 Love Hörnquist Åstrand <lha@it.su.se>
963 * test_context.c: Support switching on name type oid's
965 * test_context.c: add test for dns canon flag
967 * mech/gss_krb5.c: Add gsskrb5_set_dns_canonlize.
969 * gssapi/gssapi_krb5.h: remove gss_krb5_compat_des3_mic
971 * gssapi/gssapi_krb5.h: Add gsskrb5_set_dns_canonlize.
973 * krb5/set_sec_context_option.c: implement
974 GSS_KRB5_SET_DNS_CANONIZE_X
976 * gssapi/gssapi_krb5.h: add GSS_KRB5_SET_DNS_CANONIZE_X
978 * krb5/external.c: add GSS_KRB5_SET_DNS_CANONIZE_X
980 * mech/gss_krb5.c: add bits to make lucid context work
982 2006-10-14 Love Hörnquist Åstrand <lha@it.su.se>
984 * mech/gss_oid_to_str.c: Prefix der primitives with der_.
986 * krb5/inquire_sec_context_by_oid.c: Prefix der primitives with
989 * krb5/encapsulate.c: Prefix der primitives with der_.
991 * mech/gss_oid_to_str.c: New der_print_heim_oid signature.
993 2006-10-12 Love Hörnquist Åstrand <lha@it.su.se>
995 * Makefile.am: add test_context
997 * krb5/inquire_sec_context_by_oid.c: Make it work.
999 * test_oid.c: Test lucid oid.
1001 * gssapi/gssapi.h: Add OM_uint64_t.
1003 * krb5/inquire_sec_context_by_oid.c: Add lucid interface.
1005 * krb5/external.c: Add lucid interface, renumber oids to my
1008 * mech/gss_krb5.c: Add lucid interface.
1010 * gssapi/gssapi_krb5.h: Add lucid interface.
1012 * spnego/spnego_locl.h: Maybe include <netdb.h>.
1014 2006-10-09 Love Hörnquist Åstrand <lha@it.su.se>
1016 * mech/gss_mech_switch.c: define RTLD_LOCAL to 0 if not defined.
1018 2006-10-08 Love Hörnquist Åstrand <lha@it.su.se>
1020 * Makefile.am: install gssapi_krb5.H and gssapi_spnego.h
1022 * gssapi/gssapi_krb5.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1024 * gssapi/gssapi.h: Move krb5 stuff to <gssapi/gssapi_krb5.h>.
1026 * Makefile.am: Drop some -I no longer needed.
1028 * gssapi/gssapi_spnego.h: Move gssapi_spengo.h over here.
1030 * krb5: reference all include files using 'krb5/'
1032 2006-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1034 * gssapi.h: Add file inclusion protection.
1036 * gssapi/gssapi.h: Correct header file inclusion protection.
1038 * gssapi/gssapi.h: Move the gssapi.h from lib/gssapi/ to
1039 lib/gssapi/gssapi/ to please automake.
1041 * spnego/spnego_locl.h: Maybe include <sys/types.h>.
1043 * mech/mech_locl.h: Include <roken.h>.
1045 * Makefile.am: split build files into dist_ and noinst_ SOURCES
1047 2006-10-06 Love Hörnquist Åstrand <lha@it.su.se>
1049 * gss.c: #if 0 out unused code.
1051 * mech/gss_mech_switch.c: Cast argument to ctype(3) functions
1054 2006-10-05 Love Hörnquist Åstrand <lha@it.su.se>
1056 * mech/name.h: remove <sys/queue.h>
1058 * mech/mech_switch.h: remove <sys/queue.h>
1060 * mech/cred.h: remove <sys/queue.h>
1062 2006-10-02 Love Hörnquist Åstrand <lha@it.su.se>
1064 * krb5/arcfour.c: Thinker more with header lengths.
1066 * krb5/arcfour.c: Improve the calcucation of header
1067 lengths. DCE-STYLE data is also padded so remove if (1 || ...)
1070 * krb5/wrap.c (_gsskrb5_wrap_size_limit): use
1071 _gssapi_wrap_size_arcfour for arcfour
1073 * krb5/arcfour.c: Move _gssapi_wrap_size_arcfour here.
1075 * Makefile.am: Split all mech to diffrent mechsrc variables.
1077 * spnego/context_stubs.c: Make internal function static (and
1080 2006-10-01 Love Hörnquist Åstrand <lha@it.su.se>
1082 * krb5/inquire_cred.c: Fix "if (x) lock(y)" bug. From Harald
1085 * spnego/spnego_locl.h: Include <sys/param.h> for MAXHOSTNAMELEN.
1087 2006-09-25 Love Hörnquist Åstrand <lha@it.su.se>
1089 * krb5/arcfour.c: Add wrap support, interrop with itself but not
1092 * krb5/gsskrb5_locl.h: move the arcfour specific stuff to the
1095 * krb5/arcfour.c: Support DCE-style unwrap, tested with
1098 * mech/gss_accept_sec_context.c (gss_accept_sec_context): if the
1099 token doesn't start with [APPLICATION 0] SEQUENCE, lets assume its
1100 a DCE-style kerberos 5 connection. XXX this needs to be made
1101 better in cause we get another GSS-API protocol violating
1102 protocol. It should be possible to detach the Kerberos DCE-style
1103 since it starts with a AP-REQ PDU, but that have to wait for now.
1105 2006-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1107 * gssapi.h: Add GSS_C flags from
1108 draft-brezak-win2k-krb-rc4-hmac-04.txt.
1110 * krb5/delete_sec_context.c: Free service_keyblock and fwd_data,
1113 * krb5/accept_sec_context.c: Merge of the acceptor part from the
1114 samba patch by Stefan Metzmacher and Andrew Bartlet.
1116 * krb5/init_sec_context.c: Add GSS_C_DCE_STYLE.
1118 * krb5/{init_sec_context.c,gsskrb5_locl.h}: merge most of the
1119 initiator part from the samba patch by Stefan Metzmacher and
1120 Andrew Bartlet (still missing DCE/RPC support)
1122 2006-08-28 Love Hörnquist Åstrand <lha@it.su.se>
1124 * gss.c (help): use sl_slc_help().
1126 2006-07-22 Love Hörnquist Åstrand <lha@it.su.se>
1128 * gss-commands.in: rename command to supported-mechanisms
1130 * Makefile.am: Make gss objects depend on the slc built
1133 2006-07-20 Love Hörnquist Åstrand <lha@it.su.se>
1135 * gss-commands.in: add slc commands for gss
1137 * krb5/gsskrb5_locl.h: Remove dup prototype of _gsskrb5_init()
1139 * Makefile.am: Add test_cfx
1141 * krb5/external.c: add GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1143 * krb5/set_sec_context_option.c: catch
1144 GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_X
1146 * krb5/accept_sec_context.c: reimplement
1147 gsskrb5_register_acceptor_identity
1149 * mech/gss_krb5.c: implement gsskrb5_register_acceptor_identity
1151 * mech/gss_inquire_mechs_for_name.c: call _gss_load_mech
1153 * mech/gss_inquire_cred.c (gss_inquire_cred): call _gss_load_mech
1155 * mech/gss_mech_switch.c: Make _gss_load_mech() atomic and run
1156 only once, this have the side effect that _gss_mechs and
1157 _gss_mech_oids is only initialized once, so if just the users of
1158 these two global variables calls _gss_load_mech() first, it will
1159 act as a barrier and make sure the variables are never changed and
1160 we don't need to lock them.
1162 * mech/utils.h: no need to mark functions extern.
1164 * mech/name.h: no need to mark _gss_find_mn extern.
1166 2006-07-19 Love Hörnquist Åstrand <lha@it.su.se>
1168 * krb5/cfx.c: Redo the wrap length calculations.
1170 * krb5/test_cfx.c: test max_wrap_size in cfx.c
1172 * mech/gss_display_status.c: Handle more error codes.
1174 2006-07-07 Love Hörnquist Åstrand <lha@it.su.se>
1176 * mech/mech_locl.h: Include <krb5-types.h> and "mechqueue.h"
1178 * mech/mechqueue.h: Add SLIST macros.
1180 * krb5/inquire_context.c: Don't free return values on success.
1182 * krb5/inquire_cred.c (_gsskrb5_inquire_cred): When cred provided
1183 is the default cred, acquire the acceptor cred and initator cred
1184 in two diffrent steps and then query them for the information,
1185 this way, the code wont fail if there are no keytab, but there is
1188 * mech/gss_inquire_cred.c: move the check if we found any cred
1189 where it matter for both cases
1190 (default cred and provided cred)
1192 * mech/gss_init_sec_context.c: If the desired mechanism can't
1193 convert the name to a MN, fail with GSS_S_BAD_NAME rather then a
1196 2006-07-06 Love Hörnquist Åstrand <lha@it.su.se>
1198 * spnego/external.c: readd gss_spnego_inquire_names_for_mech
1200 * spnego/spnego_locl.h: reimplement
1201 gss_spnego_inquire_names_for_mech add support function
1202 _gss_spnego_supported_mechs
1204 * spnego/context_stubs.h: reimplement
1205 gss_spnego_inquire_names_for_mech add support function
1206 _gss_spnego_supported_mechs
1208 * spnego/context_stubs.c: drop gss_spnego_indicate_mechs
1210 * mech/gss_indicate_mechs.c: if the underlaying mech doesn't
1211 support gss_indicate_mechs, use the oid in the mechswitch
1214 * spnego/external.c: let the mech glue layer implement
1217 * spnego/cred_stubs.c (gss_spnego_acquire_cred): don't care about
1218 desired_mechs, get our own list with indicate_mechs and remove
1221 2006-07-05 Love Hörnquist Åstrand <lha@it.su.se>
1223 * spnego/external.c: remove gss_spnego_inquire_names_for_mech, let
1224 the mechglue layer implement it
1226 * spnego/context_stubs.c: remove gss_spnego_inquire_names_for_mech, let
1227 the mechglue layer implement it
1229 * spnego/spnego_locl.c: remove gss_spnego_inquire_names_for_mech, let
1230 the mechglue layer implement it
1232 2006-07-01 Love Hörnquist Åstrand <lha@it.su.se>
1234 * mech/gss_set_cred_option.c: fix argument to gss_release_cred
1236 2006-06-30 Love Hörnquist Åstrand <lha@it.su.se>
1238 * krb5/init_sec_context.c: Make work on compilers that are
1239 somewhat more picky then gcc4 (like gcc2.95)
1241 * krb5/init_sec_context.c (do_delegation): use KDCOptions2int to
1242 convert fwd_flags to an integer, since otherwise int2KDCOptions in
1243 krb5_get_forwarded_creds wont do the right thing.
1245 * mech/gss_set_cred_option.c (gss_set_cred_option): free memory on
1248 * krb5/set_sec_context_option.c (_gsskrb5_set_sec_context_option):
1249 init global kerberos context
1251 * krb5/set_cred_option.c (_gsskrb5_set_cred_option): init global
1254 * mech/gss_accept_sec_context.c: Insert the delegated sub cred on
1255 the delegated cred handle, not cred handle
1257 * mech/gss_accept_sec_context.c (gss_accept_sec_context): handle
1258 the case where ret_flags == NULL
1260 * mech/gss_mech_switch.c (add_builtin): set
1261 _gss_mech_switch->gm_mech_oid
1263 * mech/gss_set_cred_option.c (gss_set_cred_option): laod mechs
1265 * test_cred.c (gss_print_errors): don't try to print error when
1266 gss_display_status failed
1268 * Makefile.am: Add mech/gss_release_oid.c
1270 * mech/gss_release_oid.c: Add gss_release_oid, reverse of
1273 * spnego/compat.c: preferred_mech_type was allocated with
1274 gss_duplicate_oid in one place and assigned static varianbles a
1275 the second place. change that static assignement to
1276 gss_duplicate_oid and bring back gss_release_oid.
1278 * spnego/compat.c (_gss_spnego_delete_sec_context): don't release
1279 preferred_mech_type and negotiated_mech_type, they where never
1280 allocated from the begining.
1282 2006-06-29 Love Hörnquist Åstrand <lha@it.su.se>
1284 * mech/gss_import_name.c (gss_import_name): avoid
1285 type-punned/strict aliasing rules
1287 * mech/gss_add_cred.c: avoid type-punned/strict aliasing rules
1289 * gssapi.h: Make gss_name_t an opaque type.
1291 * krb5: make gss_name_t an opaque type
1293 * krb5/set_cred_option.c: Add
1295 * mech/gss_set_cred_option.c (gss_set_cred_option): support the
1296 case where *cred_handle == NULL
1298 * mech/gss_krb5.c (gss_krb5_import_cred): make sure cred is
1299 GSS_C_NO_CREDENTIAL on failure.
1301 * mech/gss_acquire_cred.c (gss_acquire_cred): if desired_mechs is
1302 NO_OID_SET, there is a need to load the mechs, so always do that.
1304 2006-06-28 Love Hörnquist Åstrand <lha@it.su.se>
1306 * krb5/inquire_cred_by_oid.c: Reimplement GSS_KRB5_COPY_CCACHE_X
1307 to instead pass a fullname to the credential, then resolve and
1308 copy out the content, and then close the cred.
1310 * mech/gss_krb5.c: Reimplement GSS_KRB5_COPY_CCACHE_X to instead
1311 pass a fullname to the credential, then resolve and copy out the
1312 content, and then close the cred.
1314 * krb5/inquire_cred_by_oid.c: make "work", GSS_KRB5_COPY_CCACHE_X
1315 interface needs to be re-done, currently its utterly broken.
1317 * mech/gss_set_cred_option.c: Make work.
1319 * krb5/external.c: Add _gsskrb5_set_{sec_context,cred}_option
1321 * mech/gss_krb5.c (gss_krb5_import_cred): implement
1323 * Makefile.am: Add gss_set_{sec_context,cred}_option and sort
1325 * mech/gss_set_{sec_context,cred}_option.c: add
1327 * gssapi.h: Add GSS_KRB5_IMPORT_CRED_X
1329 * test_*.c: make compile again
1331 * Makefile.am: Add lib dependencies and test programs
1333 * spnego: remove dependency on libkrb5
1335 * mech: Bug fixes, cleanup, compiler warnings, restructure code.
1337 * spnego: Rename gss_context_id_t and gss_cred_id_t to local names
1339 * krb5: repro copy the krb5 files here
1341 * mech: import Doug Rabson mechglue from freebsd
1343 * spnego: Import Luke Howard's SPNEGO from the mechglue branch
1345 2006-06-22 Love Hörnquist Åstrand <lha@it.su.se>
1347 * gssapi.h: Add oid_to_str.
1349 * Makefile.am: add oid_to_str and test_oid
1351 * oid_to_str.c: Add gss_oid_to_str
1353 * test_oid.c: Add test for gss_oid_to_str()
1355 2006-05-13 Love Hörnquist Åstrand <lha@it.su.se>
1357 * verify_mic.c: Less pointer signedness warnings.
1359 * unwrap.c: Less pointer signedness warnings.
1361 * arcfour.c: Less pointer signedness warnings.
1363 * gssapi_locl.h: Use const void * to instead of unsigned char * to
1364 avoid pointer signedness warnings.
1366 * encapsulate.c: Use const void * to instead of unsigned char * to
1367 avoid pointer signedness warnings.
1369 * decapsulate.c: Use const void * to instead of unsigned char * to
1370 avoid pointer signedness warnings.
1372 * decapsulate.c: Less pointer signedness warnings.
1374 * cfx.c: Less pointer signedness warnings.
1376 * init_sec_context.c: Less pointer signedness warnings (partly by
1377 using the new asn.1 CHOICE decoder)
1379 * import_sec_context.c: Less pointer signedness warnings.
1381 2006-05-09 Love Hörnquist Åstrand <lha@it.su.se>
1383 * accept_sec_context.c (gsskrb5_is_cfx): always set is_cfx. From
1386 2006-05-08 Love Hörnquist Åstrand <lha@it.su.se>
1388 * get_mic.c (mic_des3): make sure message_buffer doesn't point to
1389 free()ed memory on failure. Pointed out by IBM checker.
1391 2006-05-05 Love Hörnquist Åstrand <lha@it.su.se>
1393 * Rename u_intXX_t to uintXX_t
1395 2006-05-04 Love Hörnquist Åstrand <lha@it.su.se>
1397 * cfx.c: Less pointer signedness warnings.
1399 * arcfour.c: Avoid pointer signedness warnings.
1401 * gssapi_locl.h (gssapi_decode_*): make data argument const void *
1403 * 8003.c (gssapi_decode_*): make data argument const void *
1405 2006-04-12 Love Hörnquist Åstrand <lha@it.su.se>
1407 * export_sec_context.c: Export sequence order element. From Wynn
1408 Wilkes <wynn.wilkes@quest.com>.
1410 * import_sec_context.c: Import sequence order element. From Wynn
1411 Wilkes <wynn.wilkes@quest.com>.
1413 * sequence.c (_gssapi_msg_order_import,_gssapi_msg_order_export):
1414 New functions, used by {import,export}_sec_context. From Wynn
1415 Wilkes <wynn.wilkes@quest.com>.
1417 * test_sequence.c: Add test for import/export sequence.
1419 2006-04-09 Love Hörnquist Åstrand <lha@it.su.se>
1421 * add_cred.c: Check that cred != GSS_C_NO_CREDENTIAL, this is a
1422 standard conformance failure, but much better then a crash.
1424 2006-04-02 Love Hörnquist Åstrand <lha@it.su.se>
1426 * get_mic.c (get_mic*)_: make sure message_token is cleaned on
1427 error, found by IBM checker.
1429 * wrap.c (wrap*): Reset output_buffer on error, found by IBM
1432 2006-02-15 Love Hörnquist Åstrand <lha@it.su.se>
1434 * import_name.c: Accept both GSS_C_NT_HOSTBASED_SERVICE and
1435 GSS_C_NT_HOSTBASED_SERVICE_X as nametype for hostbased names.
1437 2006-01-16 Love Hörnquist Åstrand <lha@it.su.se>
1439 * delete_sec_context.c (gss_delete_sec_context): if the context
1440 handle is GSS_C_NO_CONTEXT, don't fall over.
1442 2005-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1444 * gss_acquire_cred.3: Replace gss_krb5_import_ccache with
1445 gss_krb5_import_cred and add more references
1447 2005-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1449 * gssapi.h: Change gss_krb5_import_ccache to gss_krb5_import_cred,
1450 it can handle keytabs too.
1452 * add_cred.c (gss_add_cred): avoid deadlock
1454 * context_time.c (gssapi_lifetime_left): define the 0 lifetime as
1457 2005-12-01 Love Hörnquist Åstrand <lha@it.su.se>
1459 * acquire_cred.c (acquire_acceptor_cred): only check if principal
1460 exists if we got called with principal as an argument.
1462 * acquire_cred.c (acquire_acceptor_cred): check that the acceptor
1463 exists in the keytab before returning ok.
1465 2005-11-29 Love Hörnquist Åstrand <lha@it.su.se>
1467 * copy_ccache.c (gss_krb5_import_cred): fix buglet, from Andrew
1470 2005-11-25 Love Hörnquist Åstrand <lha@it.su.se>
1472 * test_kcred.c: Rename gss_krb5_import_ccache to
1473 gss_krb5_import_cred.
1475 * copy_ccache.c: Rename gss_krb5_import_ccache to
1476 gss_krb5_import_cred and let it grow code to handle keytabs too.
1478 2005-11-02 Love Hörnquist Åstrand <lha@it.su.se>
1480 * init_sec_context.c: Change sematics of ok-as-delegate to match
1482 [gssapi]realm/ok-as-delegate=true is set, otherwise keep old
1485 * release_cred.c (gss_release_cred): use
1486 GSS_CF_DESTROY_CRED_ON_RELEASE to decide if the cache should be
1489 * acquire_cred.c (acquire_initiator_cred):
1490 GSS_CF_DESTROY_CRED_ON_RELEASE on created credentials.
1492 * accept_sec_context.c (gsskrb5_accept_delegated_token): rewrite
1493 to use gss_krb5_import_ccache
1495 2005-11-01 Love Hörnquist Åstrand <lha@it.su.se>
1497 * arcfour.c: Remove signedness warnings.
1499 2005-10-31 Love Hörnquist Åstrand <lha@it.su.se>
1501 * gss_acquire_cred.3: Document that gss_krb5_import_ccache is copy
1504 * copy_ccache.c (gss_krb5_import_ccache): Instead of making a copy
1505 of the ccache, make a reference by getting the name and resolving
1506 the name. This way the cache is shared, this flipp side is of
1507 course that if someone calls krb5_cc_destroy the cache is lost for
1510 * test_kcred.c: Remove memory leaks.
1512 2005-10-26 Love Hörnquist Åstrand <lha@it.su.se>
1514 * Makefile.am: build test_kcred
1516 * gss_acquire_cred.3: Document gss_krb5_import_ccache
1518 * gssapi.3: Sort and add gss_krb5_import_ccache.
1520 * acquire_cred.c (_gssapi_krb5_ccache_lifetime): break out code
1521 used to extract lifetime from a credential cache
1523 * gssapi_locl.h: Add _gssapi_krb5_ccache_lifetime, used to extract
1524 lifetime from a credential cache.
1526 * gssapi.h: add gss_krb5_import_ccache, reverse of
1527 gss_krb5_copy_ccache
1529 * copy_ccache.c: add gss_krb5_import_ccache, reverse of
1530 gss_krb5_copy_ccache
1532 * test_kcred.c: test gss_krb5_import_ccache
1534 2005-10-21 Love Hörnquist Åstrand <lha@it.su.se>
1536 * acquire_cred.c (acquire_initiator_cred): use krb5_cc_cache_match
1537 to find a matching creditial cache, if that failes, fallback to
1540 2005-10-12 Love Hörnquist Åstrand <lha@it.su.se>
1542 * gssapi_locl.h: Add gssapi_krb5_set_status and
1543 gssapi_krb5_clear_status
1545 * init_sec_context.c (spnego_reply): Don't pass back raw Kerberos
1546 errors, use GSS-API errors instead. From Michael B Allen.
1548 * display_status.c: Add gssapi_krb5_clear_status,
1549 gssapi_krb5_set_status for handling error messages.
1551 2005-08-23 Love Hörnquist Åstrand <lha@it.su.se>
1553 * external.c: Use rk_UNCONST to avoid const warning.
1555 * display_status.c: Constify strings to avoid warnings.
1557 2005-08-11 Love Hörnquist Åstrand <lha@it.su.se>
1559 * init_sec_context.c: avoid warnings, update (c)
1561 2005-07-13 Love Hörnquist Åstrand <lha@it.su.se>
1563 * init_sec_context.c (spnego_initial): use NegotiationToken
1564 encoder now that we have one with the new asn1. compiler.
1566 * Makefile.am: the new asn.1 compiler includes the modules name in
1569 2005-06-16 Love Hörnquist Åstrand <lha@it.su.se>
1571 * decapsulate.c: use rk_UNCONST
1573 * ccache_name.c: rename to avoid shadowing
1575 * gssapi_locl.h: give kret in GSSAPI_KRB5_INIT a more unique name
1577 * process_context_token.c: use rk_UNCONST to unconstify
1579 * test_cred.c: rename optind to optidx
1581 2005-05-30 Love Hörnquist Åstrand <lha@it.su.se>
1583 * init_sec_context.c (init_auth): honor ok-as-delegate if local
1584 configuration approves
1586 * gssapi_locl.h: prototype for _gss_check_compat
1588 * compat.c: export check_compat as _gss_check_compat
1590 2005-05-29 Love Hörnquist Åstrand <lha@it.su.se>
1592 * init_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1593 problems with system headerfiles that pollute the name space.
1595 * accept_sec_context.c: Prefix Der_class with ASN1_C_ to avoid
1596 problems with system headerfiles that pollute the name space.
1598 2005-05-17 Love Hörnquist Åstrand <lha@it.su.se>
1600 * init_sec_context.c (init_auth): set
1601 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED (for java compatibility),
1602 also while here, use krb5_auth_con_addflags
1604 2005-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1606 * arcfour.c (_gssapi_wrap_arcfour): fix calculating the encap
1607 length. From: Tom Maher <tmaher@eecs.berkeley.edu>
1609 2005-05-02 Dave Love <fx@gnu.org>
1611 * test_cred.c (main): Call setprogname.
1613 2005-04-27 Love Hörnquist Åstrand <lha@it.su.se>
1615 * prefix all sequence symbols with _, they are not part of the
1616 GSS-API api. By comment from Wynn Wilkes <wynnw@vintela.com>
1618 2005-04-10 Love Hörnquist Åstrand <lha@it.su.se>
1620 * accept_sec_context.c: break out the processing of the delegated
1621 credential to a separate function to make error handling easier,
1622 move the credential handling to after other setup is done
1624 * test_sequence.c: make less verbose in case of success
1626 * Makefile.am: add test_sequence to TESTS
1628 2005-04-01 Love Hörnquist Åstrand <lha@it.su.se>
1630 * 8003.c (gssapi_krb5_verify_8003_checksum): check that cksum
1631 isn't NULL From: Nicolas Pouvesle <npouvesle@tenablesecurity.com>
1633 2005-03-21 Love Hörnquist Åstrand <lha@it.su.se>
1635 * Makefile.am: use $(LIB_roken)
1637 2005-03-16 Love Hörnquist Åstrand <lha@it.su.se>
1639 * display_status.c (gssapi_krb5_set_error_string): pass in the
1640 krb5_context to krb5_free_error_string
1642 2005-03-15 Love Hörnquist Åstrand <lha@it.su.se>
1644 * display_status.c (gssapi_krb5_set_error_string): don't misuse
1645 the krb5_get_error_string api
1647 2005-03-01 Love Hörnquist Åstrand <lha@it.su.se>
1649 * compat.c (_gss_DES3_get_mic_compat): don't unlock mutex
1650 here. Bug reported by Stefan Metzmacher <metze@samba.org>
1652 2005-02-21 Luke Howard <lukeh@padl.com>
1654 * init_sec_context.c: don't call krb5_get_credentials() with
1655 KRB5_TC_MATCH_KEYTYPE, it can lead to the credentials cache
1656 growing indefinitely as no key is found with KEYTYPE_NULL
1658 * compat.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG, it is
1659 no longer used (however the mechListMIC behaviour is broken,
1660 rfc2478bis support requires the code in the mechglue branch)
1662 * init_sec_context.c: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1664 * gssapi.h: remove GSS_C_EXPECTING_MECH_LIST_MIC_FLAG
1666 2005-01-05 Luke Howard <lukeh@padl.com>
1668 * 8003.c: use symbolic name for checksum type
1670 * accept_sec_context.c: allow client to indicate
1671 that subkey should be used
1673 * acquire_cred.c: plug leak
1675 * get_mic.c: use gss_krb5_get_subkey() instead
1676 of gss_krb5_get_{local,remote}key(), support
1679 * gssapi_local.c: use gss_krb5_get_subkey(),
1680 support KEYTYPE_ARCFOUR_56
1682 * import_sec_context.c: plug leak
1684 * unwrap.c: use gss_krb5_get_subkey(),
1685 support KEYTYPE_ARCFOUR_56
1687 * verify_mic.c: use gss_krb5_get_subkey(),
1688 support KEYTYPE_ARCFOUR_56
1690 * wrap.c: use gss_krb5_get_subkey(),
1691 support KEYTYPE_ARCFOUR_56
1693 2004-11-30 Love Hörnquist Åstrand <lha@it.su.se>
1695 * inquire_cred.c: Reverse order of HEIMDAL_MUTEX_unlock and
1696 gss_release_cred to avoid deadlock, from Luke Howard
1699 2004-09-06 Love Hörnquist Åstrand <lha@it.su.se>
1701 * gss_acquire_cred.3: gss_krb5_extract_authz_data_from_sec_context
1702 was renamed to gsskrb5_extract_authz_data_from_sec_context
1704 2004-08-07 Love Hörnquist Åstrand <lha@it.su.se>
1706 * unwrap.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1708 * arcfour.c: mutex buglet, From: Luke Howard <lukeh@PADL.COM>
1710 2004-05-06 Love Hörnquist Åstrand <lha@it.su.se>
1712 * gssapi.3: spelling from Josef El-Rayes <josef@FreeBSD.org> while
1713 here, write some text about the SPNEGO situation
1715 2004-04-08 Love Hörnquist Åstrand <lha@it.su.se>
1717 * cfx.c: s/CTXAcceptorSubkey/CFXAcceptorSubkey/
1719 2004-04-07 Love Hörnquist Åstrand <lha@it.su.se>
1721 * gssapi.h: add GSS_C_EXPECTING_MECH_LIST_MIC_FLAG From: Luke
1722 Howard <lukeh@padl.com>
1724 * init_sec_context.c (spnego_reply): use
1725 _gss_spnego_require_mechlist_mic to figure out if we need to check
1726 MechListMIC; From: Luke Howard <lukeh@padl.com>
1728 * accept_sec_context.c (send_accept): use
1729 _gss_spnego_require_mechlist_mic to figure out if we need to send
1730 MechListMIC; From: Luke Howard <lukeh@padl.com>
1732 * gssapi_locl.h: add _gss_spnego_require_mechlist_mic
1733 From: Luke Howard <lukeh@padl.com>
1735 * compat.c: add _gss_spnego_require_mechlist_mic for compatibility
1736 with MS SPNEGO, From: Luke Howard <lukeh@padl.com>
1738 2004-04-05 Love Hörnquist Åstrand <lha@it.su.se>
1740 * accept_sec_context.c (gsskrb5_is_cfx): krb5_keyblock->keytype is
1741 an enctype, not keytype
1743 * accept_sec_context.c: use ASN1_MALLOC_ENCODE
1745 * init_sec_context.c: avoid the malloc loop and just allocate the
1746 propper amount of data
1748 * init_sec_context.c (spnego_initial): handle mech_token better
1750 2004-03-19 Love Hörnquist Åstrand <lha@it.su.se>
1752 * gssapi.h: add gss_krb5_get_tkt_flags
1754 * Makefile.am: add ticket_flags.c
1756 * ticket_flags.c: Get ticket-flags from acceptor ticket From: Luke
1757 Howard <lukeh@PADL.COM>
1759 * gss_acquire_cred.3: document gss_krb5_get_tkt_flags
1761 2004-03-14 Love Hörnquist Åstrand <lha@it.su.se>
1763 * acquire_cred.c (gss_acquire_cred): check usage before even
1764 bothering to process it, add both keytab and initial tgt if
1767 * wrap.c: support cfx, try to handle acceptor asserted subkey
1769 * unwrap.c: support cfx, try to handle acceptor asserted subkey
1771 * verify_mic.c: support cfx
1773 * get_mic.c: support cfx
1775 * test_sequence.c: handle changed signature of
1776 gssapi_msg_order_create
1778 * import_sec_context.c: handle acceptor asserted subkey
1780 * init_sec_context.c: handle acceptor asserted subkey
1782 * accept_sec_context.c: handle acceptor asserted subkey
1784 * sequence.c: add dummy use_64 argument to gssapi_msg_order_create
1786 * gssapi_locl.h: add partial support for CFX
1788 * Makefile.am (noinst_PROGRAMS) += test_cred
1790 * test_cred.c: gssapi credential testing
1792 * test_acquire_cred.c: fix comment
1794 2004-03-07 Love Hörnquist Åstrand <lha@it.su.se>
1796 * arcfour.h: drop structures for message formats, no longer used
1798 * arcfour.c: comment describing message formats
1800 * accept_sec_context.c (spnego_accept_sec_context): make sure the
1801 length of the choice element doesn't overrun us
1803 * init_sec_context.c (spnego_reply): make sure the length of the
1804 choice element doesn't overrun us
1806 * spnego.asn1: move NegotiationToken to avoid warning
1808 * spnego.asn1: uncomment NegotiationToken
1810 * Makefile.am: spnego_files += asn1_NegotiationToken.x
1812 2004-01-25 Love Hörnquist Åstrand <lha@it.su.se>
1814 * gssapi.h: add gss_krb5_ccache_name
1816 * Makefile.am (libgssapi_la_SOURCES): += ccache_name.c
1818 * ccache_name.c (gss_krb5_ccache_name): help function enable to
1819 set krb5 name, using out_name argument makes function no longer
1822 * gssapi.3: add missing gss_krb5_ references
1824 * gss_acquire_cred.3: document gss_krb5_ccache_name
1826 2003-12-12 Love Hörnquist Åstrand <lha@it.su.se>
1828 * cfx.c: make rrc a modulus operation if its longer then the
1829 length of the message, noticed by Sam Hartman
1831 2003-12-07 Love Hörnquist Åstrand <lha@it.su.se>
1833 * accept_sec_context.c: use krb5_auth_con_addflags
1835 2003-12-05 Love Hörnquist Åstrand <lha@it.su.se>
1837 * cfx.c: Wrap token id was in wrong order, found by Sam Hartman
1839 2003-12-04 Love Hörnquist Åstrand <lha@it.su.se>
1841 * cfx.c: add AcceptorSubkey (but no code understand it yet) ignore
1844 2003-11-22 Love Hörnquist Åstrand <lha@it.su.se>
1846 * accept_sec_context.c: Don't require timestamp to be set on
1847 delegated token, its already protected by the outer token (and
1848 windows doesn't alway send it) Pointed out by Zi-Bin Yang
1849 <zbyang@decru.com> on heimdal-discuss
1851 2003-11-14 Love Hörnquist Åstrand <lha@it.su.se>
1853 * cfx.c: fix {} error, pointed out by Liqiang Zhu
1855 2003-11-10 Love Hörnquist Åstrand <lha@it.su.se>
1857 * cfx.c: Sequence number should be stored in bigendian order From:
1858 Luke Howard <lukeh@padl.com>
1860 2003-11-09 Love Hörnquist Åstrand <lha@it.su.se>
1862 * delete_sec_context.c (gss_delete_sec_context): don't free
1863 ticket, krb5_free_ticket does that now
1865 2003-11-06 Love Hörnquist Åstrand <lha@it.su.se>
1867 * cfx.c: checksum the header last in MIC token, update to -03
1868 From: Luke Howard <lukeh@padl.com>
1870 2003-10-07 Love Hörnquist Åstrand <lha@it.su.se>
1872 * add_cred.c: If its a MEMORY cc, make a copy. We need to do this
1873 since now gss_release_cred will destroy the cred. This should be
1874 really be solved a better way.
1876 * acquire_cred.c (gss_release_cred): if its a mcc, destroy it
1877 rather the just release it Found by: "Zi-Bin Yang"
1880 * acquire_cred.c (acquire_initiator_cred): use kret instead of ret
1883 2003-09-30 Love Hörnquist Åstrand <lha@it.su.se>
1885 * gss_acquire_cred.3: spelling
1886 From: jmc <jmc@prioris.mini.pw.edu.pl>
1888 2003-09-23 Love Hörnquist Åstrand <lha@it.su.se>
1890 * cfx.c: - EC and RRC are big-endian, not little-endian - The
1891 default is now to rotate regardless of GSS_C_DCE_STYLE. There are
1892 no longer any references to GSS_C_DCE_STYLE. - rrc_rotate()
1893 avoids allocating memory on the heap if rrc <= 256
1894 From: Luke Howard <lukeh@padl.com>
1896 2003-09-22 Love Hörnquist Åstrand <lha@it.su.se>
1898 * cfx.[ch]: rrc_rotate() was untested and broken, fix it.
1899 Set and verify wrap Token->Filler.
1900 Correct token ID for wrap tokens,
1901 were accidentally swapped with delete tokens.
1902 From: Luke Howard <lukeh@PADL.COM>
1904 2003-09-21 Love Hörnquist Åstrand <lha@it.su.se>
1906 * cfx.[ch]: no ASN.1-ish header on per-message tokens
1907 From: Luke Howard <lukeh@PADL.COM>
1909 2003-09-19 Love Hörnquist Åstrand <lha@it.su.se>
1911 * arcfour.h: remove depenency on gss_arcfour_mic_token and
1912 gss_arcfour_warp_token
1914 * arcfour.c: remove depenency on gss_arcfour_mic_token and
1915 gss_arcfour_warp_token
1917 2003-09-18 Love Hörnquist Åstrand <lha@it.su.se>
1919 * 8003.c: remove #if 0'ed code
1921 2003-09-17 Love Hörnquist Åstrand <lha@it.su.se>
1923 * accept_sec_context.c (gsskrb5_accept_sec_context): set sequence
1924 number when not requesting mutual auth From: Luke Howard
1927 * init_sec_context.c (init_auth): set sequence number when not
1928 requesting mutual auth From: Luke Howard <lukeh@PADL.COM>
1930 2003-09-16 Love Hörnquist Åstrand <lha@it.su.se>
1932 * arcfour.c (*): set minor_status
1933 (gss_wrap): set conf_state to conf_req_flags on success
1934 From: Luke Howard <lukeh@PADL.COM>
1936 * wrap.c (gss_wrap_size_limit): use existing function From: Luke
1937 Howard <lukeh@PADL.COM>
1939 2003-09-12 Love Hörnquist Åstrand <lha@it.su.se>
1941 * indicate_mechs.c (gss_indicate_mechs): in case of error, free
1944 * indicate_mechs.c (gss_indicate_mechs): add SPNEGO
1946 2003-09-10 Love Hörnquist Åstrand <lha@it.su.se>
1948 * init_sec_context.c (spnego_initial): catch errors and return
1951 * init_sec_context.c (spnego_initial): add #if 0 out version of
1952 the CHOICE branch encoding, also where here, free no longer used
1955 2003-09-09 Love Hörnquist Åstrand <lha@it.su.se>
1957 * gss_acquire_cred.3: support GSS_SPNEGO_MECHANISM
1959 * accept_sec_context.c: SPNEGO doesn't include gss wrapping on
1960 SubsequentContextToken like the Kerberos 5 mech does.
1962 * init_sec_context.c (spnego_reply): SPNEGO doesn't include gss
1963 wrapping on SubsequentContextToken like the Kerberos 5 mech
1964 does. Lets check for it anyway.
1966 * accept_sec_context.c: Add support for SPNEGO on the initator
1967 side. Implementation initially from Assar Westerlund, passes
1968 though quite a lot of hands before I commited it.
1970 * init_sec_context.c: Add support for SPNEGO on the initator side.
1971 Tested with ldap server on a Windows 2000 DC. Implementation
1972 initially from Assar Westerlund, passes though quite a lot of
1973 hands before I commited it.
1975 * gssapi.h: export GSS_SPNEGO_MECHANISM
1977 * gssapi_locl.h: include spnego_as.h add prototype for
1978 gssapi_krb5_get_mech
1980 * decapsulate.c (gssapi_krb5_get_mech): make non static
1982 * Makefile.am: build SPNEGO file
1984 2003-09-08 Love Hörnquist Åstrand <lha@it.su.se>
1986 * external.c: SPENGO and IAKERB oids
1988 * spnego.asn1: SPENGO ASN1
1990 2003-09-05 Love Hörnquist Åstrand <lha@it.su.se>
1992 * cfx.c: RRC also need to be zero before wraping them
1993 From: Luke Howard <lukeh@PADL.COM>
1995 2003-09-04 Love Hörnquist Åstrand <lha@it.su.se>
1997 * encapsulate.c (gssapi_krb5_encap_length): don't return void
1999 2003-09-03 Love Hörnquist Åstrand <lha@it.su.se>
2001 * verify_mic.c: switch from the des_ to the DES_ api
2003 * get_mic.c: switch from the des_ to the DES_ api
2005 * unwrap.c: switch from the des_ to the DES_ api
2007 * wrap.c: switch from the des_ to the DES_ api
2009 * cfx.c: EC is not included in the checksum since the length might
2010 change depending on the data. From: Luke Howard <lukeh@PADL.COM>
2012 * acquire_cred.c: use
2013 krb5_get_init_creds_opt_alloc/krb5_get_init_creds_opt_free
2015 2003-09-01 Love Hörnquist Åstrand <lha@it.su.se>
2017 * copy_ccache.c: rename
2018 gss_krb5_extract_authz_data_from_sec_context to
2019 gsskrb5_extract_authz_data_from_sec_context
2021 * gssapi.h: rename gss_krb5_extract_authz_data_from_sec_context to
2022 gsskrb5_extract_authz_data_from_sec_context
2024 2003-08-31 Love Hörnquist Åstrand <lha@it.su.se>
2026 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2027 check that we have a ticket before we start to use it
2029 * gss_acquire_cred.3: document
2030 gss_krb5_extract_authz_data_from_sec_context
2032 * gssapi.h (gss_krb5_extract_authz_data_from_sec_context):
2033 return the kerberos authorizationdata, from idea of Luke Howard
2035 * copy_ccache.c (gss_krb5_extract_authz_data_from_sec_context):
2036 return the kerberos authorizationdata, from idea of Luke Howard
2038 * verify_mic.c (gss_verify_mic_internal): switch type and key
2041 2003-08-30 Love Hörnquist Åstrand <lha@it.su.se>
2043 * cfx.[ch]: draft-ietf-krb-wg-gssapi-cfx-01.txt implemetation
2044 From: Luke Howard <lukeh@PADL.COM>
2046 2003-08-28 Love Hörnquist Åstrand <lha@it.su.se>
2048 * arcfour.c (arcfour_mic_cksum): use free_Checksum to free the
2051 * arcfour.h: swap two last arguments to verify_mic for consistency
2054 * wrap.c,unwrap.c,get_mic.c,verify_mic.c,cfx.c,cfx.h:
2055 prefix cfx symbols with _gssapi_
2057 * arcfour.c: release the right buffer
2059 * arcfour.c: rename token structure in consistency with rest of
2060 GSS-API From: Luke Howard <lukeh@PADL.COM>
2062 * unwrap.c (unwrap_des3): use _gssapi_verify_pad
2063 (unwrap_des): use _gssapi_verify_pad
2065 * arcfour.c (_gssapi_wrap_arcfour): set the correct padding
2066 (_gssapi_unwrap_arcfour): verify and strip padding
2068 * gssapi_locl.h: added _gssapi_verify_pad
2070 * decapsulate.c (_gssapi_verify_pad): verify padding of a gss
2071 wrapped message and return its length
2073 * arcfour.c: support KEYTYPE_ARCFOUR_56 keys, from Luke Howard
2076 * arcfour.c: use right seal alg, inherit keytype from parent key
2078 * arcfour.c: include the confounder in the checksum use the right
2079 key usage number for warped/unwraped tokens
2081 * gssapi.h: add gss_krb5_nt_general_name as an mit compat glue
2082 (same as GSS_KRB5_NT_PRINCIPAL_NAME)
2084 * unwrap.c: hook in arcfour unwrap
2086 * wrap.c: hook in arcfour wrap
2088 * verify_mic.c: hook in arcfour verify_mic
2090 * get_mic.c: hook in arcfour get_mic
2092 * arcfour.c: implement wrap/unwarp
2094 * gssapi_locl.h: add gssapi_{en,de}code_be_om_uint32
2096 * 8003.c: add gssapi_{en,de}code_be_om_uint32
2098 2003-08-27 Love Hörnquist Åstrand <lha@it.su.se>
2100 * arcfour.c (_gssapi_verify_mic_arcfour): Do the checksum on right
2101 area. Swap filler check, it was reversed.
2103 * Makefile.am (libgssapi_la_SOURCES): += arcfour.c
2105 * gssapi_locl.h: include "arcfour.h"
2107 * arcfour.c: arcfour gss-api mech, get_mic/verify_mic working
2109 * arcfour.h: arcfour gss-api mech, get_mic/verify_mic working
2111 2003-08-26 Love Hörnquist Åstrand <lha@it.su.se>
2113 * gssapi_locl.h: always include cfx.h add prototype for
2116 * cfx.[ch]: Implementation of draft-ietf-krb-wg-gssapi-cfx-00.txt
2117 from Luke Howard <lukeh@PADL.COM>
2119 * decapsulate.c: add _gssapi_decapsulate, from Luke Howard
2122 2003-08-25 Love Hörnquist Åstrand <lha@it.su.se>
2124 * unwrap.c: encap/decap now takes a oid if the enctype/keytype is
2125 arcfour, return error add hook for cfx
2127 * verify_mic.c: encap/decap now takes a oid if the enctype/keytype
2128 is arcfour, return error add hook for cfx
2130 * get_mic.c: encap/decap now takes a oid if the enctype/keytype is
2131 arcfour, return error add hook for cfx
2133 * accept_sec_context.c: encap/decap now takes a oid
2135 * init_sec_context.c: encap/decap now takes a oid
2137 * gssapi_locl.h: include cfx.h if we need it lifetime is a
2138 OM_uint32, depend on gssapi interface add all new encap/decap
2141 * decapsulate.c: add decap functions that doesn't take the token
2142 type also make all decap function take the oid mech that they
2145 * encapsulate.c: add encap functions that doesn't take the token
2146 type also make all encap function take the oid mech that they
2149 * sequence.c (elem_insert): fix a off by one index counter
2151 * inquire_cred.c (gss_inquire_cred): handle cred_handle being
2152 GSS_C_NO_CREDENTIAL and use the default cred then.
2154 2003-08-19 Love Hörnquist Åstrand <lha@it.su.se>
2156 * gss_acquire_cred.3: break out extensions and document
2157 gsskrb5_register_acceptor_identity
2159 2003-08-18 Love Hörnquist Åstrand <lha@it.su.se>
2161 * test_acquire_cred.c (print_time): time is returned in seconds
2162 from now, not unix time
2164 2003-08-17 Love Hörnquist Åstrand <lha@it.su.se>
2166 * compat.c (check_compat): avoid leaking principal when finding a
2169 * address_to_krb5addr.c: sa_size argument to krb5_addr2sockaddr is
2172 * acquire_cred.c (gss_acquire_cred): 4th argument to
2173 gss_test_oid_set_member is a int
2175 2003-07-22 Love Hörnquist Åstrand <lha@it.su.se>
2177 * init_sec_context.c (repl_mutual): don't set kerberos error where
2178 there was no kerberos error
2180 * gssapi_locl.h: Add destruction/creation prototypes and structure
2181 for the thread specific storage.
2183 * display_status.c: use thread specific storage to set/get the
2184 kerberos error message
2186 * init.c: Provide locking around the creation of the global
2187 krb5_context. Add destruction/creation functions for the thread
2188 specific storage that the error string handling is using.
2190 2003-07-20 Love Hörnquist Åstrand <lha@it.su.se>
2192 * gss_acquire_cred.3: add missing prototype and missing .Ft
2195 2003-06-17 Love Hörnquist Åstrand <lha@it.su.se>
2197 * verify_mic.c: reorder code so sequence numbers can can be used
2199 * unwrap.c: reorder code so sequence numbers can can be used
2201 * sequence.c: remove unused function, indent, add
2202 gssapi_msg_order_f that filter gss flags to gss_msg_order flags
2204 * gssapi_locl.h: prototypes for
2205 gssapi_{encode_om_uint32,decode_om_uint32} add sequence number
2208 * delete_sec_context.c: destroy sequence number verifier
2210 * init_sec_context.c: remember to free data use sequence number
2213 * accept_sec_context.c: don't clear output_token twice remember to
2214 free data use sequence number verifier
2216 * 8003.c: export and rename encode_om_uint32/decode_om_uint32 and
2219 2003-06-09 Johan Danielsson <joda@pdc.kth.se>
2221 * Makefile.am: can't have sequence.c in two different places
2223 2003-06-06 Love Hörnquist Åstrand <lha@it.su.se>
2225 * test_sequence.c: check rollover, print summery
2227 * wrap.c (sub_wrap_size): gss_wrap_size_limit() has
2228 req_output_size and max_input_size around the wrong way -- it
2229 returns the output token size for a given input size, rather than
2230 the maximum input size for a given output token size.
2232 From: Luke Howard <lukeh@PADL.COM>
2234 2003-06-05 Love Hörnquist Åstrand <lha@it.su.se>
2236 * gssapi_locl.h: add prototypes for sequence.c
2238 * Makefile.am (libgssapi_la_SOURCES): add sequence.c
2239 (test_sequence): build
2241 * sequence.c: sequence number checks, order and replay
2242 * test_sequence.c: sequence number checks, order and replay
2244 2003-06-03 Love Hörnquist Åstrand <lha@it.su.se>
2246 * accept_sec_context.c (gss_accept_sec_context): make sure time is
2247 returned in seconds from now, not in kerberos time
2249 * acquire_cred.c (gss_aquire_cred): make sure time is returned in
2250 seconds from now, not in kerberos time
2252 * init_sec_context.c (init_auth): if the cred is expired before we
2253 tries to create a token, fail so the peer doesn't need reject us
2254 (*): make sure time is returned in seconds from now,
2255 not in kerberos time
2256 (repl_mutual): remember to unlock the context mutex
2258 * context_time.c (gss_context_time): remove unused variable
2260 * verify_mic.c: make sure minor_status is always set, pointed out
2261 by Luke Howard <lukeh@PADL.COM>
2263 2003-05-21 Love Hörnquist Åstrand <lha@it.su.se>
2265 * *.[ch]: do some basic locking (no reference counting so contexts
2266 can be removed while still used)
2267 - don't export gss_ctx_id_t_desc_struct and gss_cred_id_t_desc_struct
2268 - make sure all lifetime are returned in seconds left until expired,
2271 * gss_acquire_cred.3: document argument lifetime_rec to function
2274 2003-05-17 Love Hörnquist Åstrand <lha@it.su.se>
2276 * test_acquire_cred.c: test gss_add_cred more then once
2278 2003-05-06 Love Hörnquist Åstrand <lha@it.su.se>
2280 * gssapi.h: if __cplusplus, wrap the extern variable (just to be
2281 safe) and functions in extern "C" { }
2283 2003-04-30 Love Hörnquist Åstrand <lha@it.su.se>
2285 * gssapi.3: more about the des3 mic mess
2287 * verify_mic.c (verify_mic_des3): always check if the mic is the
2288 correct mic or the mic that old heimdal would have generated
2290 2003-04-28 Jacques Vidrine <nectar@kth.se>
2292 * verify_mic.c (verify_mic_des3): If MIC verification fails,
2293 retry using the `old' MIC computation (with zero IV).
2295 2003-04-26 Love Hörnquist Åstrand <lha@it.su.se>
2297 * gss_acquire_cred.3: more about difference between comparing IN
2300 * gss_acquire_cred.3: more about name type and access control
2302 2003-04-25 Love Hörnquist Åstrand <lha@it.su.se>
2304 * gss_acquire_cred.3: document gss_context_time
2306 * context_time.c: if lifetime of context have expired, set
2307 time_rec to 0 and return GSS_S_CONTEXT_EXPIRED
2309 * gssapi.3: document [gssapi]correct_des3_mic
2310 [gssapi]broken_des3_mic
2312 * gss_acquire_cred.3: document gss_krb5_compat_des3_mic
2314 * compat.c (gss_krb5_compat_des3_mic): enable turning on/off des3
2316 (_gss_DES3_get_mic_compat): handle [gssapi]correct_des3_mic too
2318 * gssapi.h (gss_krb5_compat_des3_mic): new function, turn on/off
2320 (GSS_C_KRB5_COMPAT_DES3_MIC): cpp symbol that exists if
2321 gss_krb5_compat_des3_mic exists
2323 2003-04-24 Love Hörnquist Åstrand <lha@it.su.se>
2325 * Makefile.am: (libgssapi_la_LDFLAGS): update major
2326 version of gssapi for incompatiblity in 3des getmic support
2328 2003-04-23 Love Hörnquist Åstrand <lha@it.su.se>
2330 * Makefile.am: test_acquire_cred_LDADD: use libgssapi.la not
2331 ./libgssapi.la (make make -jN work)
2333 2003-04-16 Love Hörnquist Åstrand <lha@it.su.se>
2335 * gssapi.3: spelling
2337 * gss_acquire_cred.3: Change .Fd #include <header.h> to .In
2338 header.h, from Thomas Klausner <wiz@netbsd.org>
2341 2003-04-06 Love Hörnquist Åstrand <lha@it.su.se>
2343 * gss_acquire_cred.3: spelling
2345 * Makefile.am: remove stuff that sneaked in with last commit
2347 * acquire_cred.c (acquire_initiator_cred): if the requested name
2348 isn't in the ccache, also check keytab. Extact the krbtgt for the
2349 default realm to check how long the credentials will last.
2351 * add_cred.c (gss_add_cred): don't create a new ccache, just open
2352 the old one; better check if output handle is compatible with new
2355 * test_acquire_cred.c: test gss_add_cred too
2357 2003-04-03 Love Hörnquist Åstrand <lha@it.su.se>
2359 * Makefile.am: build test_acquire_cred
2361 * test_acquire_cred.c: simple gss_acquire_cred test
2363 2003-04-02 Love Hörnquist Åstrand <lha@it.su.se>
2365 * gss_acquire_cred.3: s/gssapi/GSS-API/
2367 2003-03-19 Love Hörnquist Åstrand <lha@it.su.se>
2369 * gss_acquire_cred.3: document v1 interface (and that they are
2372 2003-03-18 Love Hörnquist Åstrand <lha@it.su.se>
2374 * gss_acquire_cred.3: list supported mechanism and nametypes
2376 2003-03-16 Love Hörnquist Åstrand <lha@it.su.se>
2378 * gss_acquire_cred.3: text about gss_display_name
2380 * Makefile.am (libgssapi_la_LDFLAGS): bump to 3:6:2
2381 (libgssapi_la_SOURCES): add all new functions
2383 * gssapi.3: now that we have a functions, uncomment the missing
2386 * gss_acquire_cred.3: now that we have a functions, uncomment the
2389 * process_context_token.c: implement gss_process_context_token
2391 * inquire_names_for_mech.c: implement gss_inquire_names_for_mech
2393 * inquire_mechs_for_name.c: implement gss_inquire_mechs_for_name
2395 * inquire_cred_by_mech.c: implement gss_inquire_cred_by_mech
2397 * add_cred.c: implement gss_add_cred
2399 * acquire_cred.c (gss_acquire_cred): more testing of input
2400 argument, make sure output arguments are ok, since we don't know
2401 the time_rec (for now), set it to time_req
2403 * export_sec_context.c: send lifetime, also set minor_status
2405 * get_mic.c: set minor_status
2407 * import_sec_context.c (gss_import_sec_context): add error
2408 checking, pick up lifetime (if there is no lifetime, use
2411 * init_sec_context.c: take care to set export value to something
2412 sane before we start so caller will have harmless values in them
2413 if then function fails
2415 * release_buffer.c (gss_release_buffer): set minor_status
2417 * wrap.c: make sure minor_status get set
2419 * verify_mic.c (gss_verify_mic_internal): rename verify_mic to
2420 gss_verify_mic_internal and let it take the type as an argument,
2421 (gss_verify_mic): call gss_verify_mic_internal
2424 * unwrap.c: set minor_status
2426 * test_oid_set_member.c (gss_test_oid_set_member): use
2429 * release_oid_set.c (gss_release_oid_set): set minor_status
2431 * release_name.c (gss_release_name): set minor_status
2433 * release_cred.c (gss_release_cred): set minor_status
2435 * add_oid_set_member.c (gss_add_oid_set_member): set minor_status
2437 * compare_name.c (gss_compare_name): set minor_status
2439 * compat.c (check_compat): make sure ret have a defined value
2441 * context_time.c (gss_context_time): set minor_status
2443 * copy_ccache.c (gss_krb5_copy_ccache): set minor_status
2445 * create_emtpy_oid_set.c (gss_create_empty_oid_set): set
2448 * delete_sec_context.c (gss_delete_sec_context): set minor_status
2450 * display_name.c (gss_display_name): set minor_status
2452 * display_status.c (gss_display_status): use gss_oid_equal, handle
2453 supplementary errors
2455 * duplicate_name.c (gss_duplicate_name): set minor_status
2457 * inquire_context.c (gss_inquire_context): set lifetime_rec now
2458 when we know it, set minor_status
2460 * inquire_cred.c (gss_inquire_cred): take care to set export value
2461 to something sane before we start so caller will have harmless
2462 values in them if the function fails
2464 * accept_sec_context.c (gss_accept_sec_context): take care to set
2465 export value to something sane before we start so caller will have
2466 harmless values in them if then function fails, set lifetime from
2467 ticket expiration date
2469 * indicate_mechs.c (gss_indicate_mechs): use
2470 gss_create_empty_oid_set and gss_add_oid_set_member
2472 * gssapi.h (gss_ctx_id_t_desc): store the lifetime in the cred,
2473 since there is no ticket transfered in the exported context
2475 * export_name.c (gss_export_name): export name with
2476 GSS_C_NT_EXPORT_NAME wrapping, not just the principal
2478 * import_name.c (import_export_name): new function, parses a
2479 GSS_C_NT_EXPORT_NAME
2480 (import_krb5_name): factor out common code of parsing krb5 name
2481 (gss_oid_equal): rename from oid_equal
2483 * gssapi_locl.h: add prototypes for gss_oid_equal and
2484 gss_verify_mic_internal
2486 * gssapi.h: comment out the argument names
2488 2003-03-15 Love Hörnquist Åstrand <lha@it.su.se>
2490 * gssapi.3: add LIST OF FUNCTIONS and copyright/license
2492 * Makefile.am: s/gss_aquire_cred.3/gss_acquire_cred.3/
2494 * Makefile.am: man_MANS += gss_aquire_cred.3
2496 2003-03-14 Love Hörnquist Åstrand <lha@it.su.se>
2498 * gss_aquire_cred.3: the gssapi api manpage
2500 2003-03-03 Love Hörnquist Åstrand <lha@it.su.se>
2502 * inquire_context.c: (gss_inquire_context): rename argument open
2505 * gssapi.h (gss_inquire_context): rename argument open to open_context
2507 2003-02-27 Love Hörnquist Åstrand <lha@it.su.se>
2509 * init_sec_context.c (do_delegation): remove unused variable
2512 * gssapi.3: all 0.5.x version had broken token delegation
2514 2003-02-21 Love Hörnquist Åstrand <lha@it.su.se>
2516 * (init_auth): only generate one subkey
2518 2003-01-27 Love Hörnquist Åstrand <lha@it.su.se>
2520 * verify_mic.c (verify_mic_des3): fix 3des verify_mic to conform
2521 to rfc (and mit kerberos), provide backward compat hook
2523 * get_mic.c (mic_des3): fix 3des get_mic to conform to rfc (and
2524 mit kerberos), provide backward compat hook
2526 * init_sec_context.c (init_auth): check if we need compat for
2527 older get_mic/verify_mic
2529 * gssapi_locl.h: add prototype for _gss_DES3_get_mic_compat
2531 * gssapi.h (more_flags): add COMPAT_OLD_DES3
2533 * Makefile.am: add gssapi.3 and compat.c
2535 * gssapi.3: add gssapi COMPATIBILITY documentation
2537 * accept_sec_context.c (gss_accept_sec_context): check if we need
2538 compat for older get_mic/verify_mic
2540 * compat.c: check for compatiblity with other heimdal's 3des
2543 2002-10-31 Johan Danielsson <joda@pdc.kth.se>
2545 * check return value from gssapi_krb5_init
2547 * 8003.c (gssapi_krb5_verify_8003_checksum): check size of input
2549 2002-09-03 Johan Danielsson <joda@pdc.kth.se>
2551 * wrap.c (wrap_des3): use ETYPE_DES3_CBC_NONE
2553 * unwrap.c (unwrap_des3): use ETYPE_DES3_CBC_NONE
2555 2002-09-02 Johan Danielsson <joda@pdc.kth.se>
2557 * init_sec_context.c: we need to generate a local subkey here
2559 2002-08-20 Jacques Vidrine <n@nectar.com>
2561 * acquire_cred.c, inquire_cred.c, release_cred.c: Use default
2562 credential resolution if gss_acquire_cred is called with
2565 2002-06-20 Jacques Vidrine <n@nectar.com>
2567 * import_name.c: Compare name types by value if pointers do
2568 not match. Reported by: "Douglas E. Engert" <deengert@anl.gov>
2570 2002-05-20 Jacques Vidrine <n@nectar.com>
2572 * verify_mic.c (gss_verify_mic), unwrap.c (gss_unwrap): initialize
2573 the qop_state parameter. from Doug Rabson <dfr@nlsystems.com>
2575 2002-05-09 Jacques Vidrine <n@nectar.com>
2577 * acquire_cred.c: handle GSS_C_INITIATE/GSS_C_ACCEPT/GSS_C_BOTH
2579 2002-05-08 Jacques Vidrine <n@nectar.com>
2581 * acquire_cred.c: initialize gssapi; handle null desired_name
2583 2002-03-22 Johan Danielsson <joda@pdc.kth.se>
2585 * Makefile.am: remove non-functional stuff accidentally committed
2587 2002-03-11 Assar Westerlund <assar@sics.se>
2589 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:5:2
2590 * 8003.c (gssapi_krb5_verify_8003_checksum): handle zero channel
2593 2001-10-31 Jacques Vidrine <n@nectar.com>
2595 * get_mic.c (mic_des3): MIC computation using DES3/SHA1
2596 was bogusly appending the message buffer to the result,
2597 overwriting a heap buffer in the process.
2599 2001-08-29 Assar Westerlund <assar@sics.se>
2601 * 8003.c (gssapi_krb5_verify_8003_checksum,
2602 gssapi_krb5_create_8003_checksum): make more consistent by always
2603 returning an gssapi error and setting minor status. update
2606 2001-08-28 Jacques Vidrine <n@nectar.com>
2608 * accept_sec_context.c: Create a cache for delegated credentials
2611 2001-08-28 Assar Westerlund <assar@sics.se>
2613 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:4:2
2615 2001-08-23 Assar Westerlund <assar@sics.se>
2617 * *.c: handle minor_status more consistently
2619 * display_status.c (gss_display_status): handle krb5_get_err_text
2622 2001-08-15 Johan Danielsson <joda@pdc.kth.se>
2624 * gssapi_locl.h: fix prototype for gssapi_krb5_init
2626 2001-08-13 Johan Danielsson <joda@pdc.kth.se>
2628 * accept_sec_context.c (gsskrb5_register_acceptor_identity): init
2629 context and check return value from kt_resolve
2631 * init.c: return error code
2633 2001-07-19 Assar Westerlund <assar@sics.se>
2635 * Makefile.am (libgssapi_la_LDFLAGS): update to 3:3:2
2637 2001-07-12 Assar Westerlund <assar@sics.se>
2639 * Makefile.am (libgssapi_la_LIBADD): add required library
2642 2001-07-06 Assar Westerlund <assar@sics.se>
2644 * accept_sec_context.c (gsskrb5_register_acceptor_identity): set
2645 the keytab to be used for gss_acquire_cred too'
2647 2001-07-03 Assar Westerlund <assar@sics.se>
2649 * Makefile.am (libgssapi_la_LDFLAGS): set version to 3:2:2
2651 2001-06-18 Assar Westerlund <assar@sics.se>
2653 * wrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2654 and gss_krb5_get_remotekey
2655 * verify_mic.c: update krb5_auth_con function names use
2656 gss_krb5_get_remotekey
2657 * unwrap.c: replace gss_krb5_getsomekey with gss_krb5_get_localkey
2658 and gss_krb5_get_remotekey
2659 * gssapi_locl.h (gss_krb5_get_remotekey, gss_krb5_get_localkey):
2661 * get_mic.c: update krb5_auth_con function names. use
2662 gss_krb5_get_localkey
2663 * accept_sec_context.c: update krb5_auth_con function names
2665 2001-05-17 Assar Westerlund <assar@sics.se>
2667 * Makefile.am: bump version to 3:1:2
2669 2001-05-14 Assar Westerlund <assar@sics.se>
2671 * address_to_krb5addr.c: adapt to new address functions
2673 2001-05-11 Assar Westerlund <assar@sics.se>
2675 * try to return the error string from libkrb5 where applicable
2677 2001-05-08 Assar Westerlund <assar@sics.se>
2679 * delete_sec_context.c (gss_delete_sec_context): remember to free
2680 the memory used by the ticket itself. from <tmartin@mirapoint.com>
2682 2001-05-04 Assar Westerlund <assar@sics.se>
2684 * gssapi_locl.h: add config.h for completeness
2685 * gssapi.h: remove config.h, this is an installed header file
2686 sys/types.h is not needed either
2688 2001-03-12 Assar Westerlund <assar@sics.se>
2690 * acquire_cred.c (gss_acquire_cred): remove memory leaks. from
2691 Jason R Thorpe <thorpej@zembu.com>
2693 2001-02-18 Assar Westerlund <assar@sics.se>
2695 * accept_sec_context.c (gss_accept_sec_context): either return
2696 gss_name NULL-ed or set
2698 * import_name.c: set minor_status in some cases where it was not
2701 2001-02-15 Assar Westerlund <assar@sics.se>
2703 * wrap.c: use krb5_generate_random_block for the confounders
2705 2001-01-30 Assar Westerlund <assar@sics.se>
2707 * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:0:2
2708 * acquire_cred.c, init_sec_context.c, release_cred.c: add support
2709 for getting creds from a keytab, from fvdl@netbsd.org
2711 * copy_ccache.c: add gss_krb5_copy_ccache
2713 2001-01-27 Assar Westerlund <assar@sics.se>
2715 * get_mic.c: cast parameters to des function to non-const pointers
2716 to handle the case where these functions actually take non-const
2719 2001-01-09 Assar Westerlund <assar@sics.se>
2721 * accept_sec_context.c (gss_accept_sec_context): use krb5_rd_cred2
2722 instead of krb5_rd_cred
2724 2000-12-11 Assar Westerlund <assar@sics.se>
2726 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:3:1
2728 2000-12-08 Assar Westerlund <assar@sics.se>
2730 * wrap.c (wrap_des3): use the checksum as ivec when encrypting the
2732 * unwrap.c (unwrap_des3): use the checksum as ivec when encrypting
2734 * init_sec_context.c (init_auth): always zero fwd_data
2736 2000-12-06 Johan Danielsson <joda@pdc.kth.se>
2738 * accept_sec_context.c: de-pointerise auth_context parameter to
2741 2000-11-15 Assar Westerlund <assar@sics.se>
2743 * init_sec_context.c (init_auth): update to new
2744 krb5_build_authenticator
2746 2000-09-19 Assar Westerlund <assar@sics.se>
2748 * Makefile.am (libgssapi_la_LDFLAGS): bump to 2:2:1
2750 2000-08-27 Assar Westerlund <assar@sics.se>
2752 * init_sec_context.c: actually pay attention to `time_req'
2753 * init_sec_context.c: re-organize. leak less memory.
2754 * gssapi_locl.h (gssapi_krb5_encapsulate, gss_krb5_getsomekey):
2755 update prototypes add assert.h
2756 * gssapi.h (GSS_KRB5_CONF_C_QOP_DES, GSS_KRB5_CONF_C_QOP_DES3_KD):
2758 * verify_mic.c: re-organize and add 3DES code
2759 * wrap.c: re-organize and add 3DES code
2760 * unwrap.c: re-organize and add 3DES code
2761 * get_mic.c: re-organize and add 3DES code
2762 * encapsulate.c (gssapi_krb5_encapsulate): do not free `in_data',
2763 let the caller do that. fix the callers.
2765 2000-08-16 Assar Westerlund <assar@sics.se>
2767 * Makefile.am: bump version to 2:1:1
2769 2000-07-29 Assar Westerlund <assar@sics.se>
2771 * decapsulate.c (gssapi_krb5_verify_header): sanity-check length
2773 2000-07-25 Johan Danielsson <joda@pdc.kth.se>
2775 * Makefile.am: bump version to 2:0:1
2777 2000-07-22 Assar Westerlund <assar@sics.se>
2779 * gssapi.h: update OID for GSS_C_NT_HOSTBASED_SERVICE and other
2780 details from rfc2744
2782 2000-06-29 Assar Westerlund <assar@sics.se>
2784 * address_to_krb5addr.c (gss_address_to_krb5addr): actually use
2785 `int' instead of `sa_family_t' for the address family.
2787 2000-06-21 Assar Westerlund <assar@sics.se>
2789 * add support for token delegation. From Daniel Kouril
2790 <kouril@ics.muni.cz> and Miroslav Ruda <ruda@ics.muni.cz>
2792 2000-05-15 Assar Westerlund <assar@sics.se>
2794 * Makefile.am (libgssapi_la_LDFLAGS): set version to 1:1:1
2796 2000-04-12 Assar Westerlund <assar@sics.se>
2798 * release_oid_set.c (gss_release_oid_set): clear set for
2799 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2800 * release_name.c (gss_release_name): reset input_name for
2801 robustness. From GOMBAS Gabor <gombasg@inf.elte.hu>
2802 * release_buffer.c (gss_release_buffer): set value to NULL to be
2803 more robust. From GOMBAS Gabor <gombasg@inf.elte.hu>
2804 * add_oid_set_member.c (gss_add_oid_set_member): actually check if
2805 the oid is a member first. leave the oid_set unchanged if realloc
2808 2000-02-13 Assar Westerlund <assar@sics.se>
2810 * Makefile.am: set version to 1:0:1
2812 2000-02-12 Assar Westerlund <assar@sics.se>
2814 * gssapi_locl.h: add flags for import/export
2815 * import_sec_context.c (import_sec_context: add flags for what
2816 fields are included. do not include the authenticator for now.
2817 * export_sec_context.c (export_sec_context: add flags for what
2818 fields are included. do not include the authenticator for now.
2819 * accept_sec_context.c (gss_accept_sec_context): set target in
2822 2000-02-11 Assar Westerlund <assar@sics.se>
2824 * delete_sec_context.c (gss_delete_sec_context): set context to
2827 * Makefile.am: add {export,import}_sec_context.c
2828 * export_sec_context.c: new file
2829 * import_sec_context.c: new file
2830 * accept_sec_context.c (gss_accept_sec_context): set trans flag
2832 2000-02-07 Assar Westerlund <assar@sics.se>
2834 * Makefile.am: set version to 0:5:0
2836 2000-01-26 Assar Westerlund <assar@sics.se>
2838 * delete_sec_context.c (gss_delete_sec_context): handle a NULL
2841 * wrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2842 changes to libdes calls to make them more portable.
2843 * verify_mic.c: update to pseudo-standard APIs for md4,md5,sha.
2844 some changes to libdes calls to make them more portable.
2845 * unwrap.c: update to pseudo-standard APIs for md4,md5,sha. some
2846 changes to libdes calls to make them more portable.
2847 * get_mic.c: update to pseudo-standard APIs for md4,md5,sha. some
2848 changes to libdes calls to make them more portable.
2849 * 8003.c: update to pseudo-standard APIs for md4,md5,sha.
2851 2000-01-06 Assar Westerlund <assar@sics.se>
2853 * Makefile.am: set version to 0:4:0
2855 1999-12-26 Assar Westerlund <assar@sics.se>
2857 * accept_sec_context.c (gss_accept_sec_context): always set
2859 * init_sec_context.c (init_auth): always initialize `output_token'
2860 * delete_sec_context.c (gss_delete_sec_context): always set
2863 1999-12-06 Assar Westerlund <assar@sics.se>
2865 * Makefile.am: bump version to 0:3:0
2867 1999-10-20 Assar Westerlund <assar@sics.se>
2869 * Makefile.am: set version to 0:2:0
2871 1999-09-21 Assar Westerlund <assar@sics.se>
2873 * init_sec_context.c (gss_init_sec_context): initialize `ticket'
2875 * gssapi.h (gss_ctx_id_t_desc): add ticket in here. ick.
2877 * delete_sec_context.c (gss_delete_sec_context): free ticket
2879 * accept_sec_context.c (gss_accept_sec_context): stove away
2880 `krb5_ticket' in context so that ugly programs such as
2881 gss_nt_server can get at it. uck.
2883 1999-09-20 Johan Danielsson <joda@pdc.kth.se>
2885 * accept_sec_context.c: set minor_status
2887 1999-08-04 Assar Westerlund <assar@sics.se>
2889 * display_status.c (calling_error, routine_error): right shift the
2890 code to make it possible to index into the arrays
2892 1999-07-28 Assar Westerlund <assar@sics.se>
2894 * gssapi.h (GSS_C_AF_INET6): add
2896 * import_name.c (import_hostbased_name): set minor_status
2898 1999-07-26 Assar Westerlund <assar@sics.se>
2900 * Makefile.am: set version to 0:1:0
2902 Wed Apr 7 14:05:15 1999 Johan Danielsson <joda@hella.pdc.kth.se>
2904 * display_status.c: set minor_status
2906 * init_sec_context.c: set minor_status
2908 * lib/gssapi/init.c: remove donep (check gssapi_krb5_context