branch krb5-1-9

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24450 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24452, r24453, r24454 from trunk

 ------------------------------------------------------------------------
 r24454 | ghudson | 2010-10-13 13:20:36 -0400 (Wed, 13 Oct 2010) | 2 lines

 Whitespace.

 ------------------------------------------------------------------------
 r24453 | hartmans | 2010-10-12 21:19:20 -0400 (Tue, 12 Oct 2010) | 2 lines

 Adjust valgrind support to assume a modern valgrind that requires %p in log files.

 ------------------------------------------------------------------------
 r24452 | hartmans | 2010-10-12 21:19:14 -0400 (Tue, 12 Oct 2010) | 14 lines

 ticket: 6801
 target_version: 1.9
 Subject: Fix leaks in get_init_creds interface

 In Debian Bug 598032, Bastian Blank points out that there are two
 leaks in the get_init_creds interface:

 * Free ctx->request->padata after sending the KDC request so it is not
 overwritten the next time around the loop.

 * If options is NULL passed into krb5_get_init_creds_init, then set up
 a non-extended options structure so that krb5_get_init_creds_free will
 free the options.

ticket: 6801
version_fixed: 1.9

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24456 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24455 from trunk

 ------------------------------------------------------------------------
 r24455 | tlyu | 2010-10-14 18:49:11 -0400 (Thu, 14 Oct 2010) | 9 lines

 ticket: 6802
 tags: pullup
 subject: copyright notice updates
 target_version: 1.9

 Update copyright.texinfo.  Move full copyright notices to appendices
 of documentation.  New rules to generate top-level NOTICE file from
 copyright.texinfo.  Regenerate NOTICE file.

ticket: 6802
version_fixed: 1.9

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24457 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24462 from trunk

 ------------------------------------------------------------------------
 r24462 | tlyu | 2010-10-18 18:52:28 -0400 (Mon, 18 Oct 2010) | 5 lines

 ticket: 6802

 Adjust copyright.texinfo to fix some TeX output issues.  Also do minor
 cleanup.

ticket: 6802

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24463 dc483132-0cff-0310-8789-dd5450dbe970
Update README and patchlevel.h

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24490 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24464 from trunk

 ------------------------------------------------------------------------
 r24464 | ghudson | 2010-10-19 15:08:38 -0400 (Tue, 19 Oct 2010) | 9 lines

 ticket: 6804
 subject: Remove KDC replay cache
 target_version: 1.9
 tags: pullup

 Now that SAM1 support has been removed, the KDC does not need a replay
 replay cache.  Remove all code within USE_RCACHE and associated support.
 Rename --disable-kdc-replay-cache to --disable-kdc-lookaside-cache.

ticket: 6804
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24491 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24465 from trunk

 ------------------------------------------------------------------------
 r24465 | hartmans | 2010-10-19 15:50:37 -0400 (Tue, 19 Oct 2010) | 19 lines

 ticket: 6805
 subject: securID code fixes
 target_version: 1.9
 tags: pullup

 Fixes to get securID preauth plugin working. A separate patch will
 address error handling and build issues.

 * Permit a preauth plugin to return KRB5KDC_ERR_PREAUTH_REQUIRED from
   the verify entry point.

 * If verify_securid2 fails, save the return value and return that
   rather than success after dealing with encoding the out_edata

 * Use the client key not the securid principal key for the sam
   checksum

 * indicate that securID is hardware authentication

ticket: 6805
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24492 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24466 from trunk

 ------------------------------------------------------------------------
 r24466 | hartmans | 2010-10-19 15:50:42 -0400 (Tue, 19 Oct 2010) | 8 lines

 ticket: 6806
 subject: securID error handling fix
 target_version: 1.9
 tags: pullup

 In porting forward, I incorrectly used krb5_set_error_message instead of com_err.
 This commit reverts that change.

ticket: 6806
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24493 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24467 from trunk

 ------------------------------------------------------------------------
 r24467 | hartmans | 2010-10-19 15:50:48 -0400 (Tue, 19 Oct 2010) | 8 lines

 ticket: 6807
 subject: SecurID build support
 target_version: 1.9
 tags: pullup

 Integrate SecurID into the build if libaceclnt is found.
 Add a README file with an example of how to build it.

ticket: 6807
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24494 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24470 from trunk

 ------------------------------------------------------------------------
 r24470 | ghudson | 2010-10-22 20:38:17 -0400 (Fri, 22 Oct 2010) | 10 lines

 ticket: 6810
 subject: Better	libk5crypto NSS	fork safety
 target_version:	1.9
 tags: pullup

 Use SECMOD_RestartModules() from the forthcoming NSS 3.12.9 release to
 make the libk5crypto back end work after a fork.  Add a test program
 to exercise fork detection in the NSS back end.  Add a configure-time
 version check to ensure that we're using NSS 3.12.9 or later.

ticket: 6810
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24495 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24480 from trunk

 ------------------------------------------------------------------------
 r24480 | ghudson | 2010-10-25 15:37:03 -0400 (Mon, 25 Oct 2010) | 8 lines

 ticket: 6793
 target_version: 1.9
 tags: pullup

 In acquire_init_cred in the GSS krb5 mech, don't intern cred->name,
 since it's not used as an output parameter.  Fixes a memory leak.
 Reported by aberry@likewise.com.

ticket: 6793
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24496 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24482 from trunk

 ------------------------------------------------------------------------
 r24482 | ghudson | 2010-10-25 17:55:54 -0400 (Mon, 25 Oct 2010) | 8 lines

 ticket: 6787
 target_version: 1.9
 tags: pullup

 When we create a temporary memory ccache for use within a
 krb5_gss_cred_id_rec, set a flag to indicate that the ccache should be
 destroyed rather than closed.  Patch from aberry@likewise.com.

ticket: 6787
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24497 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24483 from trunk

 ------------------------------------------------------------------------
 r24483 | ghudson | 2010-10-26 10:17:38 -0400 (Tue, 26 Oct 2010) | 8 lines

 ticket: 6809
 target_version: 1.9
 tags: pullup

 Set *conf_state on successful return from
 gss_krb5int_make_seal_token_v3_iov, fixing a case where it wasn't
 always set by gss_wrap_iov.  Patch from aberry@likewise.com.

ticket: 6809
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24498 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24481 from trunk

 ------------------------------------------------------------------------
 r24481 | ghudson | 2010-10-25 16:17:54 -0400 (Mon, 25 Oct 2010) | 7 lines

 ticket: 6796
 target_version: 1.9
 tags: pullup

 Use safer output parameter handling in
 krb5_gss_acquire_cred_impersonate_name and its subsidiary helpers.

ticket: 6796
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24499 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24486 from trunk

 ------------------------------------------------------------------------
 r24486 | ghudson | 2010-10-26 13:34:41 -0400 (Tue, 26 Oct 2010) | 8 lines

 ticket: 6811
 subject: Mark Camellia-CCM code as experimental
 target_version: 1.9
 tags: pullup

 Add a comment noting that the Camellia-CCM code in 1.9 is
 experimental.

ticket: 6811
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24500 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24488 from trunk

 ------------------------------------------------------------------------
 r24488 | ghudson | 2010-10-27 13:05:05 -0400 (Wed, 27 Oct 2010) | 5 lines

 ticket: 6812

 Don't fail out from krb5_get_credentials() if we can't store a ticket
 into the ccache.

ticket: 6812
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24501 dc483132-0cff-0310-8789-dd5450dbe970
README and patchlevel.h for krb5-1.9-beta1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24502 dc483132-0cff-0310-8789-dd5450dbe970
krb5-1.9-beta1-postrelease

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24504 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24538 from trunk

 ------------------------------------------------------------------------
 r24538 | ghudson | 2010-11-30 16:20:49 -0500 (Tue, 30 Nov 2010) | 27 lines

 ticket: 6827
 subject: SA-2010-007 Checksum vulnerabilities (CVE-2010-1324 and others)

 Fix multiple checksum handling bugs, as described in:
   CVE-2010-1324
   CVE-2010-1323
   CVE-2010-4020
   CVE-2010-4021

 * Return the correct (keyed) checksums as the mandatory checksum type
   for DES enctypes.
 * Restrict simplified-profile checksums to their corresponding etypes.
 * Add internal checks to reduce the risk of stream ciphers being used
   with simplified-profile key derivation or other algorithms relying
   on the block encryption primitive.
 * Use the mandatory checksum type for the PKINIT KDC signature,
   instead of the first-listed keyed checksum.
 * Use the mandatory checksum type when sending KRB-SAFE messages by
   default, instead of the first-listed keyed checksum.
 * Use the mandatory checksum type for the t_kperf test program.
 * Use the mandatory checksum type (without additional logic) for the
   FAST request checksum.
 * Preserve the existing checksum choices (unkeyed checksums for DES
   enctypes) for the authenticator checksum, using explicit logic.
 * Ensure that SAM checksums received from the KDC are keyed.
 * Ensure that PAC checksums are keyed.

ticket: 6827
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24540 dc483132-0cff-0310-8789-dd5450dbe970
pull up r24518 from trunk

 ------------------------------------------------------------------------
 r24518 | ghudson | 2010-11-15 21:30:16 -0500 (Mon, 15 Nov 2010) | 12 lines

 ticket: 6819
 subject: Handle referral realm in kprop client principal
 target_version: 1.9
 tags: pullup

 kprop uses krb5_sname_to_principal() to determine its client
 principal.  If the local hostname cannot be mapped to a realm based on
 the profile's domain_realm section, krb5_sname_to_principal() will (as
 of 1.6) return a principal with the referral realm (""), which does
 not work in a client principal.  Handle this by substituting the
 default realm.

ticket: 6819
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24541 dc483132-0cff-0310-8789-dd5450dbe970