/ ChangeLog.2001
ChangeLog.2001
1 2001-12-20 Johan Danielsson <joda@pdc.kth.se> 2 3 * lib/krb5/crypto.c: use our own des string-to-key function, since 4 the one from openssl sometimes generates wrong output 5 6 2001-12-05 Jacques Vidrine <n@nectar.cc> 7 8 * lib/hdb/mkey.c: fix a bug in which kstash would crash if 9 there were no /etc/krb5.conf 10 11 2001-11-09 Johan Danielsson <joda@pdc.kth.se> 12 13 * lib/krb5/krb5_verify_user.3: sort references (from Thomas 14 Klausner) 15 16 * lib/krb5/krb5_principal_get_realm.3: add section to reference 17 (from Thomas Klausner) 18 19 * lib/krb5/krb5_krbhst_init.3: sort references (from Thomas 20 Klausner) 21 22 * lib/krb5/krb5_keytab.3: white space fixes (from Thomas Klausner) 23 24 * lib/krb5/krb5_get_krbhst.3: remove extra white space (from 25 Thomas Klausner) 26 27 * lib/krb5/krb5_get_all_client_addrs.3: add section to reference 28 (from Thomas Klausner) 29 30 2001-10-29 Jacques Vidrine <n@nectar.com> 31 32 * admin/get.c: fix a bug in which a reference to a data 33 structure on the stack was being kept after the containing 34 function's lifetime, resulting in a segfault during `ktutil 35 get'. 36 37 2001-10-22 Assar Westerlund <assar@sics.se> 38 39 * lib/krb5/crypto.c: make all high-level encrypting and decrypting 40 functions check the return value of the underlying function and 41 handle errors more consistently. noted by Sam Hartman 42 <hartmans@mit.edu> 43 44 2001-10-21 Assar Westerlund <assar@sics.se> 45 46 * lib/krb5/crypto.c (enctype_arcfour_hmac_md5): actually use a 47 non-keyed checksum when it should be non-keyed 48 49 2001-09-29 Assar Westerlund <assar@sics.se> 50 51 * kuser/kinit.1: add the kauth alias 52 * kuser/kinit.c: allow specification of afslog in krb5.conf, noted 53 by jhutz@cs.cmu.edu 54 55 2001-09-27 Assar Westerlund <assar@sics.se> 56 57 * lib/asn1/gen.c: remove the need for libasn1.h, also make 58 generated files include all files from IMPORTed modules 59 60 * lib/krb5/krb5.h (KRB5_KPASSWD_*): set correct values 61 * kpasswd/kpasswd.c: improve error message printing 62 * lib/krb5/changepw.c (krb5_passwd_result_to_string): add change 63 to use sequence numbers connect the udp socket so that we can 64 figure out the local address 65 66 2001-09-25 Assar Westerlund <assar@sics.se> 67 68 * lib/asn1: implement OBJECT IDENTIFIER and ENUMERATED 69 70 2001-09-20 Johan Danielsson <joda@pdc.kth.se> 71 72 * lib/krb5/principal.c (krb5_425_conv_principal_ext): try using 73 lower case realm as domain, but only when given a verification 74 function 75 76 2001-09-20 Assar Westerlund <assar@sics.se> 77 78 * lib/asn1/der_put.c (der_put_length): do not even try writing 79 anything when len == 0 80 81 2001-09-18 Johan Danielsson <joda@pdc.kth.se> 82 83 * kdc/hpropd.c: add realm override option 84 85 * lib/krb5/set_default_realm.c (krb5_set_default_realm): make 86 realm parameter const 87 88 * kdc/hprop.c: more free's 89 90 * lib/krb5/init_creds_pw.c (krb5_get_init_creds_keytab): free key 91 proc data 92 93 * lib/krb5/expand_hostname.c (krb5_expand_hostname_realms): free 94 addrinfo 95 96 * lib/hdb/mkey.c (hdb_set_master_keyfile): clear error string when 97 not returning error 98 99 2001-09-16 Assar Westerlund <assar@sics.se> 100 101 * lib/krb5/appdefault.c (krb5_appdefault_{boolean,string,time): 102 make realm const 103 104 * lib/krb5/crypto.c: use des functions to avoid generating 105 warnings with openssl's prototypes 106 107 2001-09-05 Johan Danielsson <joda@pdc.kth.se> 108 109 * configure.in: check for termcap.h 110 111 * lib/asn1/lex.l: add another undef ECHO to keep AIX lex happy 112 113 2001-09-03 Assar Westerlund <assar@sics.se> 114 115 * lib/krb5/addr_families.c (krb5_print_address): handle snprintf 116 returning < 0. noticed by hin@stacken.kth.se 117 118 2001-09-03 Assar Westerlund <assar@sics.se> 119 120 * Release 0.4e 121 122 2001-09-02 Johan Danielsson <joda@pdc.kth.se> 123 124 * kuser/Makefile.am: install kauth as a symlink to kinit 125 126 * kuser/kinit.c: get v4_tickets by default 127 128 * lib/asn1/Makefile.am: fix for broken automake 129 130 2001-08-31 Johan Danielsson <joda@pdc.kth.se> 131 132 * lib/hdb/hdb-ldap.c: some pretty much untested changes from Luke 133 Howard 134 135 * kuser/kinit.1: remove references to kauth 136 137 * kuser/Makefile.am: kauth is no more 138 139 * kuser/kinit.c: use appdefaults for everything. defaults are now 140 as in kauth. 141 142 * lib/krb5/appdefault.c: also check libdefaults, and realms/realm 143 144 * lib/krb5/context.c (krb5_free_context): free more stuff 145 146 2001-08-30 Johan Danielsson <joda@pdc.kth.se> 147 148 * lib/krb5/verify_krb5_conf.c: do some checks of the values in the 149 file 150 151 * lib/krb5/krb5.conf.5: remove srv_try_txt, fix spelling 152 153 * lib/krb5/context.c: don't init srv_try_txt, since it isn't used 154 anymore 155 156 2001-08-29 Jacques Vidrine <n@nectar.com> 157 158 * configure.in: Check for already-installed com_err. 159 160 2001-08-28 Assar Westerlund <assar@sics.se> 161 162 * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): set versoin to 18:2:1 163 164 2001-08-24 Assar Westerlund <assar@sics.se> 165 166 * kuser/Makefile.am: remove CHECK_LOCAL - non bin programs require 167 no special treatment now 168 169 * kuser/generate-requests.c: parse arguments in a useful way 170 * kuser/kverify.c: add --help/--verify 171 172 2001-08-22 Assar Westerlund <assar@sics.se> 173 174 * configure.in: bump prereq to 2.52 remove unused test_LIB_KRB4 175 176 * configure.in: re-write the handling of crypto libraries. try to 177 use the one of openssl's libcrypto or krb4's libdes that has all 178 the required functionality (md4, md5, sha1, des, rc4). if there 179 is no such library, the included lib/des is built. 180 181 * kdc/headers.h: include libutil.h if it exists 182 * kpasswd/kpasswd_locl.h: include libutil.h if it exists 183 * kdc/kerberos4.c (get_des_key): check for null keys even if 184 is_server 185 186 2001-08-21 Assar Westerlund <assar@sics.se> 187 188 * lib/asn1/asn1_print.c: print some size_t correctly 189 * configure.in: remove extra space after -L check for libutil.h 190 191 2001-08-17 Johan Danielsson <joda@pdc.kth.se> 192 193 * kdc/kdc_locl.h: fix prototype for get_des_key 194 195 * kdc/kaserver.c: fix call to get_des_key 196 197 * kdc/524.c: fix call to get_des_key 198 199 * kdc/kerberos4.c (get_des_key): if getting a key for a server, 200 return any des-key not just keys that can be string-to-keyed by 201 the client 202 203 2001-08-10 Assar Westerlund <assar@sics.se> 204 205 * Release 0.4d 206 207 2001-08-10 Assar Westerlund <assar@sics.se> 208 209 * configure.in: check for openpty 210 * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): update to 7:4:0 211 212 2001-08-08 Assar Westerlund <assar@sics.se> 213 214 * configure.in: just add -L (if required) from krb4 when testing 215 for libdes/libcrypto 216 217 2001-08-04 Assar Westerlund <assar@sics.se> 218 219 * lib/krb5/Makefile.am (man_MANS): add some missing man pages 220 * fix-export: fix the sed expression for finding the man pages 221 222 2001-07-31 Assar Westerlund <assar@sics.se> 223 224 * kpasswd/kpasswd-generator.c (main): implement --version and 225 --help 226 227 * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): update version to 228 18:1:1 229 230 2001-07-27 Assar Westerlund <assar@sics.se> 231 232 * lib/krb5/context.c (init_context_from_config_file): check 233 parsing of addresses 234 235 2001-07-26 Assar Westerlund <assar@sics.se> 236 237 * lib/krb5/sock_principal.c (krb5_sock_to_principal): rename 238 sa_len -> salen to avoid the macro that's defined on irix. noted 239 by "Jacques A. Vidrine" <n@nectar.com> 240 241 2001-07-24 Johan Danielsson <joda@pdc.kth.se> 242 243 * lib/krb5/addr_families.c: add support for type 244 KRB5_ADDRESS_ADDRPORT 245 246 * lib/krb5/addr_families.c (krb5_address_order): complain about 247 unsuppored address types 248 249 2001-07-23 Johan Danielsson <joda@pdc.kth.se> 250 251 * admin/get.c: don't open connection to server until we loop over 252 the principals, at that time we know the realm of the (first) 253 principal and we can default to that admin server 254 255 * admin: add a rename command 256 257 2001-07-19 Assar Westerlund <assar@sics.se> 258 259 * kdc/hprop.c (usage): clarify a tiny bit 260 261 2001-07-19 Assar Westerlund <assar@sics.se> 262 263 * Release 0.4c 264 265 2001-07-19 Assar Westerlund <assar@sics.se> 266 267 * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump version to 268 18:0:1 269 270 * lib/krb5/get_for_creds.c (krb5_fwd_tgt_creds): make it behave 271 the same way as the MIT function 272 273 * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): update to 7:3:0 274 * lib/krb5/sock_principal.c (krb5_sock_to_principal): use 275 getnameinfo 276 277 * lib/krb5/krbhst.c (srv_find_realm): handle port numbers 278 consistenly in local byte order 279 280 * lib/krb5/get_default_realm.c (krb5_get_default_realm): set an 281 error string 282 283 * kuser/kinit.c (renew_validate): invert condition correctly. get 284 v4 tickets if we succeed renewing 285 * lib/krb5/principal.c (krb5_principal_get_type): add 286 (default_v4_name_convert): add "smtp" 287 288 2001-07-13 Assar Westerlund <assar@sics.se> 289 290 * configure.in: remove make-print-version from LIBOBJS, it's no 291 longer in lib/roken but always built in lib/vers 292 293 2001-07-12 Johan Danielsson <joda@pdc.kth.se> 294 295 * lib/hdb/mkey.c: more set_error_string 296 297 2001-07-12 Assar Westerlund <assar@sics.se> 298 299 * lib/hdb/Makefile.am (libhdb_la_LIBADD): add required library 300 dependencies 301 302 * lib/asn1/Makefile.am (libasn1_la_LIBADD): add required library 303 dependencies 304 305 2001-07-11 Johan Danielsson <joda@pdc.kth.se> 306 307 * kdc/hprop.c: remove v4 master key handling; remove old v4-db and 308 ka-db flags; add defaults for v4_realm and afs_cell 309 310 2001-07-09 Assar Westerlund <assar@sics.se> 311 312 * lib/krb5/sock_principal.c (krb5_sock_to_principal): copy hname 313 before calling krb5_sname_to_principal. from "Jacques A. Vidrine" 314 <n@nectar.com> 315 316 2001-07-08 Johan Danielsson <joda@pdc.kth.se> 317 318 * lib/krb5/context.c: use krb5_copy_addresses instead of 319 copy_HostAddresses 320 321 2001-07-06 Assar Westerlund <assar@sics.se> 322 323 * configure.in (LIB_des_a, LIB_des_so): add these so that they can 324 be used by lib/auth/sia 325 326 * kuser/kinit.c: re-do some of the v4 fallbacks: look at 327 get-tokens flag do not print extra errors do not try to do 524 if 328 we got tickets from a v4 server 329 330 2001-07-03 Assar Westerlund <assar@sics.se> 331 332 * lib/krb5/replay.c (krb5_get_server_rcache): cast argument to 333 printf 334 335 * lib/krb5/get_addrs.c (find_all_addresses): call free_addresses 336 on ignore_addresses correctly 337 * lib/krb5/init_creds.c 338 (krb5_get_init_creds_opt_set_default_flags): change to take a 339 const realm 340 341 * lib/krb5/principal.c (krb5_425_conv_principal_ext): if the 342 instance is the first component of the local hostname, the 343 converted host should be the long hostname. from 344 <shadow@dementia.org> 345 346 2001-07-02 Johan Danielsson <joda@pdc.kth.se> 347 348 * lib/krb5/Makefile.am: address.c is no more; add a couple of 349 manpages 350 351 * lib/krb5/krb5_timeofday.3: new manpage 352 353 * lib/krb5/krb5_get_all_client_addrs.3: new manpage 354 355 * lib/krb5/get_in_tkt.c (init_as_req): treat no addresses as 356 wildcard 357 358 * lib/krb5/get_cred.c (get_cred_kdc_la): treat no addresses as 359 wildcard 360 361 * lib/krb5/get_addrs.c: don't include client addresses that match 362 ignore_addresses 363 364 * lib/krb5/context.c: initialise ignore_addresses 365 366 * lib/krb5/addr_families.c: add new `arange' fake address type, 367 that matches more than one address; this required some internal 368 changes to many functions, so all of address.c got moved here 369 (wasn't much left there) 370 371 * lib/krb5/krb5.h: add list of ignored addresses to context 372 373 2001-07-03 Assar Westerlund <assar@sics.se> 374 375 * Release 0.4b 376 377 2001-07-03 Assar Westerlund <assar@sics.se> 378 379 * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): set version to 17:0:0 380 * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): set version to 7:2:0 381 382 2001-07-03 Assar Westerlund <assar@sics.se> 383 384 * Release 0.4a 385 386 2001-07-02 Johan Danielsson <joda@pdc.kth.se> 387 388 * kuser/kinit.c: make this compile without krb4 support 389 390 * lib/krb5/write_message.c: remove priv parameter from 391 write_safe_message; don't know why it was there in the first place 392 393 * doc/install.texi: remove kaserver switches, it's always compiled 394 in now 395 396 * kdc/hprop.c: always include kadb support 397 398 * kdc/kaserver.c: always include kaserver support 399 400 2001-07-02 Assar Westerlund <assar@sics.se> 401 402 * kpasswd/kpasswdd.c (doit): make failing to bind a socket a 403 non-fatal error, and abort if no sockets were bound 404 405 2001-07-01 Assar Westerlund <assar@sics.se> 406 407 * lib/krb5/krbhst.c: remember the real port number when falling 408 back from kpasswd -> kadmin, and krb524 -> kdc 409 410 2001-06-29 Assar Westerlund <assar@sics.se> 411 412 * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): if 413 no_addresses is set, do not add any local addresses to KRB_CRED 414 415 * kuser/kinit.c: remove extra clearing of password and some 416 redundant code 417 418 2001-06-29 Johan Danielsson <joda@pdc.kth.se> 419 420 * kuser/kinit.c: move ticket conversion code to separate function, 421 and call that from a couple of places, like when renewing a 422 ticket; also add a flag for just converting a ticket 423 424 * lib/krb5/init_creds_pw.c: set renew-life to some sane value 425 426 * kdc/524.c: don't send more data than required 427 428 2001-06-24 Assar Westerlund <assar@sics.se> 429 430 * lib/krb5/store_fd.c (krb5_storage_from_fd): check malloc returns 431 432 * lib/krb5/keytab_any.c (any_resolve); improving parsing of ANY: 433 (any_start_seq_get): remove a double free 434 (any_next_entry): iterate over all (sub) keytabs and avoid leave data 435 around to be freed again 436 437 * kdc/kdc_locl.h: add a define for des_new_random_key when using 438 openssl's libcrypto 439 440 * configure.in: move v6 tests down 441 442 * lib/krb5/krb5.h (krb5_context_data): remove srv_try_rfc2052 443 444 * update to libtool 1.4 and autoconf 2.50 445 446 2001-06-22 Johan Danielsson <joda@pdc.kth.se> 447 448 * lib/hdb/hdb.c: use krb5_add_et_list 449 450 2001-06-21 Johan Danielsson <joda@pdc.kth.se> 451 452 * lib/hdb/Makefile.am: add generation number 453 * lib/hdb/common.c: add generation number code 454 * lib/hdb/hdb.asn1: add generation number 455 * lib/hdb/print.c: use krb5_storage to make it more dynamic 456 457 2001-06-21 Assar Westerlund <assar@sics.se> 458 459 * lib/krb5/krb5.conf.5: update to changed names used by 460 krb5_get_init_creds_opt_set_default_flags 461 * lib/krb5/init_creds.c 462 (krb5_get_init_creds_opt_set_default_flags): make the appdefault 463 keywords have the same names 464 465 * configure.in: only add -L and -R to the krb4 libdir if we are 466 actually using it 467 468 * lib/krb5/krbhst.c (fallback_get_hosts): do not copy trailing 469 dot of hostname add some comments 470 * lib/krb5/krbhst.c: use getaddrinfo instead of dns_lookup when 471 testing for kerberos.REALM. this allows reusing that information 472 when actually contacting the server and thus avoids one DNS lookup 473 474 2001-06-20 Johan Danielsson <joda@pdc.kth.se> 475 476 * lib/krb5/krb5.h: include k524_err.h 477 478 * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): don't test 479 for keytype, the server will do this for us if it has anything to 480 complain about 481 482 * lib/krb5/context.c: add protocol compatible krb524 error codes 483 484 * lib/krb5/Makefile.am: add protocol compatible krb524 error codes 485 486 * lib/krb5/k524_err.et: add protocol compatible krb524 error codes 487 488 * lib/krb5/krb5_principal_get_realm.3: manpage 489 490 * lib/krb5/principal.c: add functions `krb5_principal_get_realm' 491 and `krb5_principal_get_comp_string' that returns parts of a 492 principal; this is a replacement for the internal 493 `krb5_princ_realm' and `krb5_princ_component' macros that everyone 494 seem to use 495 496 2001-06-19 Assar Westerlund <assar@sics.se> 497 498 * kuser/kinit.c (main): dereference result from krb5_princ_realm. 499 from Thomas Nystrom <thn@saeab.se> 500 501 2001-06-18 Johan Danielsson <joda@pdc.kth.se> 502 503 * lib/krb5/mk_req.c (krb5_mk_req_exact): free creds when done 504 * lib/krb5/crypto.c (krb5_string_to_key_derived): fix memory leak 505 * lib/krb5/krbhst.c (config_get_hosts): free hostlist 506 * kuser/kinit.c: free principal 507 508 2001-06-18 Assar Westerlund <assar@sics.se> 509 510 * lib/krb5/send_to_kdc.c (krb5_sendto): remove an extra 511 freeaddrinfo 512 513 * lib/krb5/convert_creds.c (krb524_convert_creds_kdc_ccache): 514 remove some unused variables 515 516 * lib/krb5/krbhst.c (admin_get_next): spell kerberos correctly 517 * kdc/kerberos5.c: update to new krb5_auth_con* names 518 * kdc/hpropd.c: update to new krb5_auth_con* names 519 * lib/krb5/rd_req.c (krb5_rd_req): use krb5_auth_con* functions 520 and remove some comments 521 * lib/krb5/rd_safe.c (krb5_rd_safe): pick the keys in the right 522 order: remote - local - session 523 * lib/krb5/rd_rep.c (krb5_rd_rep): save the remote sub key in the 524 auth_context 525 * lib/krb5/rd_priv.c (krb5_rd_priv): pick keys in the correct 526 order: remote - local - session 527 * lib/krb5/mk_safe.c (krb5_mk_safe): pick keys in the right order, 528 local - remote - session 529 530 2001-06-18 Johan Danielsson <joda@pdc.kth.se> 531 532 * lib/krb5/convert_creds.c: use starttime instead of authtime, 533 from Chris Chiappa 534 535 * lib/krb5/convert_creds.c: make krb524_convert_creds_kdc match 536 the MIT function by the same name; add 537 krb524_convert_creds_kdc_ccache that does what the old version did 538 539 * admin/list.c (do_list): make sure list of keys is NULL 540 terminated; similar to patch sent by Chris Chiappa 541 542 2001-06-18 Assar Westerlund <assar@sics.se> 543 544 * lib/krb5/mcache.c (mcc_remove_cred): use 545 krb5_free_creds_contents 546 547 * lib/krb5/auth_context.c: name function krb5_auth_con more 548 consistenly 549 * lib/krb5/rd_req.c (krb5_verify_authenticator_checksum): use 550 renamed krb5_auth_con_getauthenticator 551 552 * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): update to 553 use krb5_krbhst API 554 * lib/krb5/changepw.c (krb5_change_password): update to use 555 krb5_krbhst API 556 * lib/krb5/send_to_kdc.c: update to use krb5_krbhst API 557 * lib/krb5/krbhst.c (krb5_krbhst_get_addrinfo): add set def_port 558 in krb5_krbhst_info 559 (krb5_krbhst_free): free everything 560 561 * lib/krb5/krb5.h (KRB5_VERIFY_NO_ADDRESSES): add 562 (krb5_krbhst_info): add def_port (default port for this service) 563 564 * lib/krb5/krbhst-test.c: make it more verbose and useful 565 * lib/krb5/krbhst.c: remove some more memory leaks do not try any 566 dns operations if there is local configuration admin: fallback to 567 kerberos.REALM 524: fallback to kdcs kpasswd: fallback to admin 568 add some comments 569 570 * configure.in: remove initstate and setstate, they should be in 571 cf/roken-frag.m4 572 573 * lib/krb5/Makefile.am (noinst_PROGRAMS): add krbhst-test 574 * lib/krb5/krbhst-test.c: new program for testing krbhst 575 * lib/krb5/krbhst.c (common_init): remove memory leak 576 (main): move test program into krbhst-test 577 578 2001-06-17 Johan Danielsson <joda@pdc.kth.se> 579 580 * lib/krb5/krb5_krbhst_init.3: manpage 581 582 * lib/krb5/krb5_get_krbhst.3: manpage 583 584 2001-06-16 Johan Danielsson <joda@pdc.kth.se> 585 586 * lib/krb5/krb5.h: add opaque krb5_krbhst_handle type 587 588 * lib/krb5/krbhst.c: change void* to krb5_krbhst_handle 589 590 * lib/krb5/krb5.h: types for new krbhst api 591 592 * lib/krb5/krbhst.c: implement a new api that looks up one host at 593 a time, instead of making a list of hosts 594 595 2001-06-09 Johan Danielsson <joda@pdc.kth.se> 596 597 * configure.in: test for initstate and setstate 598 599 * lib/krb5/krbhst.c: remove rfc2052 support 600 601 2001-06-08 Johan Danielsson <joda@pdc.kth.se> 602 603 * fix some manpages for broken mdoc.old grog test 604 605 2001-05-28 Assar Westerlund <assar@sics.se> 606 607 * lib/krb5/krb5.conf.5: add [appdefaults] 608 * lib/krb5/init_creds_pw.c: remove configuration reading that is 609 now done in krb5_get_init_creds_opt_set_default_flags 610 * lib/krb5/init_creds.c 611 (krb5_get_init_creds_opt_set_default_flags): add reading of 612 libdefaults versions of these and add no_addresses 613 614 * lib/krb5/get_in_tkt.c (krb5_get_in_cred): clear error string 615 when preauth was required and we retry 616 617 2001-05-25 Assar Westerlund <assar@sics.se> 618 619 * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): call 620 krb5_get_krb524hst 621 * lib/krb5/krbhst.c (krb5_get_krb524hst): add and restructure the 622 support functions 623 624 2001-05-22 Assar Westerlund <assar@sics.se> 625 626 * kdc/kerberos5.c (tgs_rep2): alloc and free csec and cusec 627 properly 628 629 2001-05-17 Assar Westerlund <assar@sics.se> 630 631 * Release 0.3f 632 633 2001-05-17 Assar Westerlund <assar@sics.se> 634 635 * lib/krb5/Makefile.am: bump version to 16:0:0 636 * lib/hdb/Makefile.am: bump version to 7:1:0 637 * lib/asn1/Makefile.am: bump version to 5:0:0 638 * lib/krb5/keytab_krb4.c: add SRVTAB as an alias for krb4 639 * lib/krb5/codec.c: remove dead code 640 641 2001-05-17 Johan Danielsson <joda@pdc.kth.se> 642 643 * kdc/config.c: actually check the ticket addresses 644 645 2001-05-15 Assar Westerlund <assar@sics.se> 646 647 * lib/krb5/rd_error.c (krb5_error_from_rd_error): use correct 648 parenthesis 649 650 * lib/krb5/eai_to_heim_errno.c (krb5_eai_to_heim_errno): add 651 `errno' (called system_error) to allow callers to make sure they 652 pass the current and relevant value. update callers 653 654 2001-05-14 Johan Danielsson <joda@pdc.kth.se> 655 656 * lib/krb5/verify_user.c: krb5_verify_user_opt 657 658 * lib/krb5/krb5.h: verify_opt 659 660 * kdc/kerberos5.c: pass context to krb5_domain_x500_decode 661 662 2001-05-14 Assar Westerlund <assar@sics.se> 663 664 * kpasswd/kpasswdd.c: adapt to new address functions 665 * kdc/kerberos5.c: adapt to changing address functions use LR_TYPE 666 * kdc/connect.c: adapt to changing address functions 667 * kdc/config.c: new krb5_config_parse_file 668 * kdc/524.c: new krb5_sockaddr2address 669 * lib/krb5/*: add some krb5_{set,clear}_error_string 670 671 * lib/asn1/k5.asn1 (LR_TYPE): add 672 * lib/asn1/Makefile.am (gen_files): add asn1_LR_TYPE.x 673 674 2001-05-11 Assar Westerlund <assar@sics.se> 675 676 * kdc/kerberos5.c (tsg_rep): fix typo in variable name 677 678 * kpasswd/kpasswd-generator.c (nop_prompter): update prototype 679 * lib/krb5/init_creds_pw.c: update to new prompter, use prompter 680 types and send two prompts at once when changning password 681 * lib/krb5/prompter_posix.c (krb5_prompter_posix): add name 682 * lib/krb5/krb5.h (krb5_prompt): add type 683 (krb5_prompter_fct): add anem 684 685 * lib/krb5/cache.c (krb5_cc_next_cred): transpose last two 686 paramaters to krb5_cc_next_cred (as MIT does, and not as they 687 document). From "Jacques A. Vidrine" <n@nectar.com> 688 689 2001-05-11 Johan Danielsson <joda@pdc.kth.se> 690 691 * lib/krb5/Makefile.am: store-test 692 693 * lib/krb5/store-test.c: simple bit storage test 694 695 * lib/krb5/store.c: add more byteorder storage flags 696 697 * lib/krb5/krb5.h: add more byteorder storage flags 698 699 * kdc/kerberos5.c: don't use NULL where we mean 0 700 701 * kdc/kerberos5.c: put referral test code in separate function, 702 and test for KRB5_NT_SRV_INST 703 704 2001-05-10 Assar Westerlund <assar@sics.se> 705 706 * admin/list.c (do_list): do not close the keytab if opening it 707 failed 708 * admin/list.c (do_list): always print complete names. print 709 everything to stdout. 710 * admin/list.c: print both v5 and v4 list by default 711 * admin/remove.c (kt_remove): reorganize some. open the keytab 712 (defaulting to the modify one). 713 * admin/purge.c (kt_purge): reorganize some. open the keytab 714 (defaulting to the modify one). correct usage strings 715 * admin/list.c (kt_list): reorganize some. open the keytab 716 * admin/get.c (kt_get): reorganize some. open the keytab 717 (defaulting to the modify one) 718 * admin/copy.c (kt_copy): default to modify key name. re-organise 719 * admin/change.c (kt_change): reorganize some. open the keytab 720 (defaulting to the modify one) 721 * admin/add.c (kt_add): reorganize some. open the keytab 722 (defaulting to the modify one) 723 * admin/ktutil.c (main): do not open the keytab, let every 724 sub-function handle it 725 726 * kdc/config.c (configure): call free_getarg_strings 727 728 * lib/krb5/get_in_tkt.c (krb5_get_in_cred): set error strings for 729 a few more errors 730 731 * lib/krb5/get_host_realm.c (krb5_get_host_realm_int): make 732 `use_dns' parameter boolean 733 734 * lib/krb5/krb5.h (krb5_context_data): add default_keytab_modify 735 * lib/krb5/context.c (init_context_from_config_file): set 736 default_keytab_modify 737 * lib/krb5/krb5_locl.h (KEYTAB_DEFAULT): change to 738 ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab 739 (KEYTAB_DEFAULT_MODIFY): add 740 * lib/krb5/keytab.c (krb5_kt_default_modify_name): add 741 (krb5_kt_resolve): set error string for failed keytab type 742 743 2001-05-08 Assar Westerlund <assar@sics.se> 744 745 * lib/krb5/crypto.c (encryption_type): make field names more 746 consistent 747 (create_checksum): separate usage and type 748 (krb5_create_checksum): add a separate type parameter 749 (encrypt_internal): only free once on mismatched checksum length 750 751 * lib/krb5/send_to_kdc.c (krb5_sendto_kdc2): try to tell what 752 realm we didn't manage to reach any KDC for in the error string 753 754 * lib/krb5/generate_seq_number.c (krb5_generate_seq_number): free 755 the entire subkey. from <tmartin@mirapoint.com> 756 757 2001-05-07 Johan Danielsson <joda@pdc.kth.se> 758 759 * lib/krb5/keytab_keyfile.c (akf_start_seq_get): return 760 KT_NOTFOUND if the file is empty 761 762 2001-05-07 Assar Westerlund <assar@sics.se> 763 764 * lib/krb5/fcache.c: call krb5_set_error_string when open fails 765 fatally 766 * lib/krb5/keytab_file.c: call krb5_set_error_string when open 767 fails fatally 768 769 * lib/krb5/warn.c (_warnerr): print error_string in context in 770 preference to error string derived from error code 771 * kuser/kinit.c (main): try to print the error string 772 * lib/krb5/get_in_tkt.c (krb5_get_in_cred): set some sensible 773 error strings for errors 774 775 * lib/krb5/krb5.h (krb5_context_data): add error_string and 776 error_buf 777 * lib/krb5/Makefile.am (libkrb5_la_SOURCES): add error_string.c 778 * lib/krb5/error_string.c: new file 779 780 2001-05-02 Johan Danielsson <joda@pdc.kth.se> 781 782 * lib/krb5/time.c: krb5_string_to_deltat 783 784 * lib/krb5/sock_principal.c: one less data copy 785 786 * lib/krb5/eai_to_heim_errno.c: conversion function for h_errno's 787 788 * lib/krb5/get_default_principal.c: change this slightly 789 790 * lib/krb5/crypto.c: make checksum_types into an array of pointers 791 792 * lib/krb5/convert_creds.c: make sure we always use a des-cbc-crc 793 ticket 794 795 2001-04-29 Assar Westerlund <assar@sics.se> 796 797 * kdc/kerberos5.c (tgs_rep2): return a reference to a krbtgt for 798 the right realm if we fail to find a non-krbtgt service in the 799 database and the second component does a succesful non-dns lookup 800 to get the real realm (which has to be different from the 801 originally-supplied realm). this should help windows 2000 clients 802 that always start their lookups in `their' realm and do not have 803 any idea of how to map hostnames into realms 804 * kdc/kerberos5.c (is_krbtgt): rename to get_krbtgt_realm 805 806 2001-04-27 Johan Danielsson <joda@pdc.kth.se> 807 808 * lib/krb5/get_host_realm.c (krb5_get_host_realm_int): add extra 809 parameter to request use of dns or not 810 811 2001-04-25 Assar Westerlund <assar@sics.se> 812 813 * admin/get.c (kt_get): allow specification of encryption types 814 * lib/krb5/verify_init.c (krb5_verify_init_creds): do not try to 815 close an unopened ccache, noted by <marc@mit.edu> 816 817 * lib/krb5/krb5.h (krb5_any_ops): add declaration 818 * lib/krb5/context.c (init_context_from_config_file): register 819 krb5_any_ops 820 821 * lib/krb5/keytab_any.c: new file, implementing union of keytabs 822 * lib/krb5/Makefile.am (libkrb5_la_SOURCES): add keytab_any.c 823 824 * lib/krb5/init_creds_pw.c (get_init_creds_common): handle options 825 == NULL. noted by <marc@mit.edu> 826 827 2001-04-19 Johan Danielsson <joda@pdc.kth.se> 828 829 * lib/krb5/rd_cred.c: set ret_creds to NULL before doing anything 830 else, from Jacques Vidrine 831 832 2001-04-18 Johan Danielsson <joda@pdc.kth.se> 833 834 * lib/hdb/libasn1.h: asn1.h -> krb5_asn1.h 835 836 * lib/asn1/Makefile.am: add asn1_ENCTYPE.x 837 838 * lib/krb5/krb5.h: adapt to asn1 changes 839 840 * lib/asn1/k5.asn1: move enctypes here 841 842 * lib/asn1/libasn1.h: rename asn1.h to krb5_asn1.h to avoid 843 conflicts 844 845 * lib/asn1/Makefile.am: rename asn1.h to krb5_asn1.h to avoid 846 conflicts 847 848 * lib/asn1/lex.l: use strtol to parse constants 849 850 2001-04-06 Johan Danielsson <joda@pdc.kth.se> 851 852 * kuser/kinit.c: add simple support for running commands 853 854 2001-03-26 Assar Westerlund <assar@sics.se> 855 856 * lib/hdb/hdb-ldap.c: change order of includes to allow it to work 857 with more versions of openldap 858 859 * kdc/kerberos5.c (tgs_rep2): try to set sec and usec in error 860 replies 861 (*): update callers of krb5_km_error 862 (check_tgs_flags): handle renews requesting non-renewable tickets 863 864 * lib/krb5/mk_error.c (krb5_mk_error): allow specifying both ctime 865 and cusec 866 867 * lib/krb5/krb5.h (krb5_checksum, krb5_keyusage): add 868 compatibility names 869 870 * lib/krb5/crypto.c (create_checksum): change so that `type == 0' 871 means pick from the `crypto' (context) and otherwise use that 872 type. this is not a large change in practice and allows callers 873 to specify the exact checksum algorithm to use 874 875 2001-03-13 Assar Westerlund <assar@sics.se> 876 877 * lib/krb5/get_cred.c (get_cred_kdc): add support for falling back 878 to KRB5_KU_AP_REQ_AUTH when KRB5_KU_TGS_REQ_AUTH gives `bad 879 integrity'. this helps for talking to old (pre 0.3d) KDCs 880 881 2001-03-12 Assar Westerlund <assar@pdc.kth.se> 882 883 * lib/krb5/crypto.c (krb5_derive_key): new function, used by 884 derived-key-test.c 885 * lib/krb5/string-to-key-test.c: add new test vectors posted by 886 Ken Raeburn <raeburn@mit.edu> in <tx1bsra8919.fsf@raeburn.org> to 887 ietf-krb-wg@anl.gov 888 * lib/krb5/n-fold-test.c: more test vectors from same source 889 * lib/krb5/derived-key-test.c: more tests from same source 890 891 2001-03-06 Assar Westerlund <assar@sics.se> 892 893 * acconfig.h: include roken_rename.h when appropriate 894 895 2001-03-06 Assar Westerlund <assar@sics.se> 896 897 * lib/krb5/krb5.h (krb5_enctype): remove trailing comma 898 899 2001-03-04 Assar Westerlund <assar@sics.se> 900 901 * lib/krb5/krb5.h (krb5_enctype): add ENCTYPE_* aliases for 902 compatibility with MIT krb5 903 904 2001-03-02 Assar Westerlund <assar@sics.se> 905 906 * kuser/kinit.c (main): only request a renewable ticket when 907 explicitly requested. it still gets a renewable one if the renew 908 life is specified 909 * kuser/kinit.c (renew_validate): treat -1 as flags not being set 910 911 2001-02-28 Johan Danielsson <joda@pdc.kth.se> 912 913 * lib/krb5/context.c (krb5_init_ets): use krb5_add_et_list 914 915 2001-02-27 Johan Danielsson <joda@pdc.kth.se> 916 917 * lib/krb5/get_cred.c: implement krb5_get_cred_from_kdc_opt 918 919 2001-02-25 Assar Westerlund <assar@sics.se> 920 921 * configure.in: do not use -R when testing for des functions 922 923 2001-02-14 Assar Westerlund <assar@sics.se> 924 925 * configure.in: test for lber.h when trying to link against 926 openldap to handle openldap v1, from Sumit Bose 927 <sumit.bose@suse.de> 928 929 2001-02-19 Assar Westerlund <assar@sics.se> 930 931 * lib/asn1/libasn1.h: add string.h (for memset) 932 933 2001-02-15 Assar Westerlund <assar@sics.se> 934 935 * lib/krb5/warn.c (_warnerr): add printf attributes 936 * lib/krb5/send_to_kdc.c (krb5_sendto): loop over all address 937 returned by getaddrinfo before trying the next kdc. from 938 thorpej@netbsd.org 939 940 * lib/krb5/krb5.conf.5: fix default_realm in example 941 942 * kdc/connect.c: fix a few kdc_log format types 943 944 * configure.in: try to handle libdes/libcrypto ont requiring -L 945 946 2001-02-10 Assar Westerlund <assar@sics.se> 947 948 * lib/asn1/gen_decode.c (generate_type_decode): zero the data at 949 the beginning of the generated function, and add a label `fail' 950 that the code jumps to in case of errors that frees all allocated 951 data 952 953 2001-02-07 Assar Westerlund <assar@sics.se> 954 955 * configure.in: aix dce: fix misquotes, from Ake Sandgren 956 <ake@cs.umu.se> 957 958 * configure.in (dpagaix_LDFLAGS): try to add export file 959 960 2001-02-05 Assar Westerlund <assar@sics.se> 961 962 * lib/krb5/krb5_keytab.3: new man page, contributed by 963 <lha@stacken.kth.se> 964 965 * kdc/kaserver.c: update to new db_fetch4 966 967 2001-02-05 Assar Westerlund <assar@assaris.sics.se> 968 969 * Release 0.3e 970 971 2001-01-30 Assar Westerlund <assar@sics.se> 972 973 * kdc/hprop.c (v4_get_masterkey): check kdb_verify_master_key 974 properly 975 (kdb_prop): decrypt key properly 976 * kdc/hprop.c: handle building with KRB4 always try to decrypt v4 977 data with the master key leave it up to the v5 how to encrypt with 978 that master key 979 980 * kdc/kstash.c: include file name in error messages 981 * kdc/hprop.c: fix a typo and check some more return values 982 * lib/hdb/hdb-ldap.c (LDAP__lookup_princ): call ldap_search_s 983 correctly. From Jacques Vidrine <n@nectar.com> 984 * kdc/misc.c (db_fetch): HDB_ERR_NOENTRY makes more sense than 985 ENOENT 986 987 * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump version to 988 15:0:0 989 * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): bump version to 7:0:0 990 * lib/asn1/Makefile.am (libasn1_la_LDFLAGS): bump version to 4:0:2 991 * kdc/misc.c (db_fetch): return an error code. change callers to 992 look at this and try to print it in log messages 993 994 * lib/krb5/crypto.c (decrypt_internal_derived): check that there's 995 enough data 996 997 2001-01-29 Assar Westerlund <assar@sics.se> 998 999 * kdc/hprop.c (realm_buf): move it so it becomes properly 1000 conditional on KRB4 1001 1002 * lib/hdb/mkey.c (hdb_unseal_keys_mkey, hdb_seal_keys_mkey, 1003 hdb_unseal_keys, hdb_seal_keys): check that we have the correct 1004 master key and that we manage to decrypt the key properly, 1005 returning an error code. fix all callers to check return value. 1006 1007 * tools/krb5-config.in: use @LIB_des_appl@ 1008 * tools/Makefile.am (krb5-config): add LIB_des_appl 1009 * configure.in (LIB_des): set correctly 1010 (LIB_des_appl): add for the use by krb5-config.in 1011 1012 * lib/krb5/store_fd.c (fd_fetch, fd_store): use net_{read,write} 1013 to make sure of not dropping data when doing it over a socket. 1014 (this might break when used with ordinary files on win32) 1015 1016 * lib/hdb/hdb_err.et (NO_MKEY): add 1017 1018 * kdc/kerberos5.c (as_rep): be paranoid and check 1019 krb5_enctype_to_string for failure, noted by <lha@stacken.kth.se> 1020 1021 * lib/krb5/krb5_init_context.3, lib/krb5/krb5_context.3, 1022 lib/krb5/krb5_auth_context.3: add new man pages, contributed by 1023 <lha@stacken.kth.se> 1024 1025 * use the openssl api for md4/md5/sha and handle openssl/*.h 1026 1027 * kdc/kaserver.c (do_getticket): check length of ticket. noted by 1028 <lha@stacken.kth.se> 1029 1030 2001-01-28 Assar Westerlund <assar@sics.se> 1031 1032 * configure.in: send -R instead of -rpath to libtool to set 1033 runtime library paths 1034 1035 * lib/krb5/Makefile.am: remove all dependencies on libkrb 1036 1037 2001-01-27 Assar Westerlund <assar@sics.se> 1038 1039 * appl/rcp: add port of bsd rcp changed to use existing rsh, 1040 contributed by Richard Nyberg <rnyberg@it.su.se> 1041 1042 2001-01-27 Johan Danielsson <joda@pdc.kth.se> 1043 1044 * lib/krb5/get_port.c: don't warn if the port name can't be found, 1045 nobody cares anyway 1046 1047 2001-01-26 Johan Danielsson <joda@pdc.kth.se> 1048 1049 * kdc/hprop.c: make it possible to convert a v4 dump file without 1050 having any v4 libraries; the kdb backend still require them 1051 1052 * kdc/v4_dump.c: include shadow definition of kdb Principal, so we 1053 don't have to depend on any v4 libraries 1054 1055 * kdc/hprop.h: include shadow definition of kdb Principal, so we 1056 don't have to depend on any v4 libraries 1057 1058 * lib/hdb/print.c: reduce number of memory allocations 1059 1060 * lib/hdb/mkey.c: add support for reading krb4 /.k files 1061 1062 2001-01-19 Assar Westerlund <assar@sics.se> 1063 1064 * lib/krb5/krb5.conf.5: document admin_server and kpasswd_server 1065 for realms document capath better 1066 1067 * lib/krb5/krbhst.c (krb5_get_krb_changepw_hst): preferably look 1068 at kpasswd_server before admin_server 1069 1070 * lib/krb5/get_cred.c (get_cred_from_kdc_flags): look in 1071 [libdefaults]capath for better hint of realm to send request to. 1072 this allows the client to specify `realm routing information' in 1073 case it cannot be done at the server (which is preferred) 1074 1075 * lib/krb5/rd_priv.c (krb5_rd_priv): handle no sequence number as 1076 zero when we were expecting a sequence number. MIT krb5 cannot 1077 generate a sequence number of zero, instead generating no sequence 1078 number 1079 * lib/krb5/rd_safe.c (krb5_rd_safe): dito 1080 1081 2001-01-11 Assar Westerlund <assar@sics.se> 1082 1083 * kpasswd/kpasswdd.c: add --port option 1084 1085 2001-01-10 Assar Westerlund <assar@sics.se> 1086 1087 * lib/krb5/appdefault.c (krb5_appdefault_string): fix condition 1088 just before returning 1089 1090 2001-01-09 Assar Westerlund <assar@sics.se> 1091 1092 * appl/kf/kfd.c (proto): use krb5_rd_cred2 instead of krb5_rd_cred 1093 1094 2001-01-05 Johan Danielsson <joda@pdc.kth.se> 1095 1096 * kuser/kinit.c: call a time `time', and not `seconds' 1097 1098 * lib/krb5/init_creds.c: not much point in setting the anonymous 1099 flag here 1100 1101 * lib/krb5/krb5_appdefault.3: document appdefault_time 1102 1103 2001-01-04 Johan Danielsson <joda@pdc.kth.se> 1104 1105 * lib/krb5/verify_user.c: use 1106 krb5_get_init_creds_opt_set_default_flags 1107 1108 * kuser/kinit.c: use krb5_get_init_creds_opt_set_default_flags 1109 1110 * lib/krb5/init_creds.c: new function 1111 krb5_get_init_creds_opt_set_default_flags to set options from 1112 krb5.conf 1113 1114 * lib/krb5/rd_cred.c: make this match the MIT function 1115 1116 * lib/krb5/appdefault.c (krb5_appdefault_string): handle NULL 1117 def_val 1118 (krb5_appdefault_time): new function 1119 1120 2001-01-03 Assar Westerlund <assar@sics.se> 1121 1122 * kdc/hpropd.c (main): handle EOF when reading from stdin