krb5-1.8-postrelease

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23762 dc483132-0cff-0310-8789-dd5450dbe970
Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "logging"

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23795 dc483132-0cff-0310-8789-dd5450dbe970
Revert KRB5_CONF_ macro change intended for trunk

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23797 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23767 from trunk

 ------------------------------------------------------------------------
 r23767 | ghudson | 2010-03-05 14:19:42 -0500 (Fri, 05 Mar 2010) | 7 lines

 ticket: 6661
 target_version: 1.8.1
 tags: pullup

 Add IPv6 support to changepw.c (reverting r21004 since it is no longer
 necessary).  Patch from Submit Bose <sbose@redhat.com>.

ticket: 6661
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23806 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23749 from trunk

 ------------------------------------------------------------------------
 r23749 | ghudson | 2010-02-24 13:57:08 -0500 (Wed, 24 Feb 2010) | 9 lines

 ticket: 6668
 subject: Two problems in kadm5_get_principal mask handling
 target_version: 1.8
 tags: pullup

 KADM5_MOD_NAME was being applied to entry->principal instead of
 entry->mod_name.  KADM5_MKVNO was not being applied to entry->mkvno.
 Patch from Marcus Watts <mdw@umich.edu>.

ticket: 6668
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23807 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23772 from trunk

 ------------------------------------------------------------------------
 r23772 | ghudson | 2010-03-05 15:35:26 -0500 (Fri, 05 Mar 2010) | 7 lines

 ticket: 6674
 target_version: 1.8.1
 tags: pullup

 Release the internal_name field of a SPNEGO context if it has not been
 claimed for a caller argument.

ticket: 6674
status: resolved
version_fixed: 1.8.1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23808 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23766 from trunk

 ------------------------------------------------------------------------
 r23766 | ghudson | 2010-03-05 12:45:46 -0500 (Fri, 05 Mar 2010) | 10 lines

 ticket: 6676
 subject: Ignore improperly encoded signedpath AD elements
 target_version: 1.8.1
 tags: pullup

 We have some reason to believe Microsoft and Heimdal are both using
 the authdata value 142 for different purposes, leading to failures in
 verify_ad_signedpath().  For better interoperability, treat such
 tickets as unsigned, rather than invalid.

ticket: 6676
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23809 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23810 from trunk

 ------------------------------------------------------------------------
 r23810 | tlyu | 2010-03-16 12:14:33 -0700 (Tue, 16 Mar 2010) | 8 lines

 ticket: 6685
 target_version: 1.8.1
 subject: handle NT_SRV_INST in service principal referrals

 Handle NT_SRV_INST in service principal cross-realm referrals, as
 Windows apparently uses that instead of NT_SRV_HST for at least some
 service principals.

ticket: 6685
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23824 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23815 from trunk

 ------------------------------------------------------------------------
 r23815 | ghudson | 2010-03-17 14:10:10 -0700 (Wed, 17 Mar 2010) | 7 lines

 ticket: 6681
 target_version: 1.8.1
 tags: pullup

 When checking for KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT, don't
 dereference options if it's NULL.

ticket: 6681
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23825 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23819 from trunk

 ------------------------------------------------------------------------
 r23819 | ghudson | 2010-03-18 10:37:31 -0700 (Thu, 18 Mar 2010) | 7 lines

 ticket: 6683
 target_version: 1.8.1
 tags: pullup

 Fix the kpasswd fallback from the ccache principal name to the
 username in the case where the ccache doesn't exist.

ticket: 6683
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23826 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23820 from trunk

 ------------------------------------------------------------------------
 r23820 | ghudson | 2010-03-19 09:17:05 -0700 (Fri, 19 Mar 2010) | 7 lines

 ticket: 6680
 target_version: 1.8.1
 tags: pullup

 Document the ticket_lifetime libdefaults setting (which was added in
 r16656, #2656).  Based on a patch from nalin@redhat.com.

ticket: 6680
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23827 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23821 from trunk

 ------------------------------------------------------------------------
 r23821 | ghudson | 2010-03-19 20:50:06 -0700 (Fri, 19 Mar 2010) | 17 lines

 ticket: 6687
 subject: Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512
 target_version: 1.8.1
 tags: pullup

 KRB5_AUTHDATA_SIGNTICKET, originally a Heimdal authorization data
 type, was used to implement PAC-less constrained delegation in krb5
 1.8.  Unfortunately, it was found that Microsoft was using 142 for
 other purposes, which could result in a ticket issued by an MIT or
 Heimdal KDC being rejected by a Windows Server 2008 R2 application
 server.  Because KRB5_AUTHDATA_SIGNTICKET is only used to communicate
 among a realm's KDCs, it is relatively easy to change the number, so
 MIT and Heimdal are both migrating to a new number.  This change will
 cause a transitional interoperability issue when a realm mixes MIT
 krb5 1.8 (or Heimdal 1.3.1) KDCs with MIT krb5 1.8.1 (or Heimdal
 1.3.2) KDCs, but only for constrained delegation evidence tickets.

ticket: 6687
version_fixed: 1.8.1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23828 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23829 from trunk

 ------------------------------------------------------------------------
 r23829 | tlyu | 2010-03-22 23:09:02 -0700 (Mon, 22 Mar 2010) | 10 lines

 ticket: 6689
 target_version: 1.8.1
 tags: pullup
 subject: krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX

 Move krb5_typed_data to krb5.hin from k5-int-pkinit.h because
 krb5int_fast_process_error was assuming that it was safe to cast it to
 krb5_pa_data.  It's not safe to do the cast on 64-bit MacOSX because
 krb5.hin uses #pragma pack on that platform.

ticket: 6689
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23830 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23832 from trunk

 ------------------------------------------------------------------------
 r23832 | tlyu | 2010-03-23 11:53:52 -0700 (Tue, 23 Mar 2010) | 8 lines

 ticket: 6690
 target_version: 1.8.1
 tags: pullup
 subject: MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO

 The SPNEGO implementation in krb5-1.7 and later could crash due to
 assertion failure when receiving some sorts of invalid GSS-API tokens.

ticket: 6690
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23833 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23834 from trunk

 ------------------------------------------------------------------------
 r23834 | tlyu | 2010-03-23 15:00:13 -0700 (Tue, 23 Mar 2010) | 7 lines

 ticket: 6678
 target_version: 1.8.1
 tags: pullup

 Apply patch from Arlene Berry to not use freed memory in
 gss_import_sec_context in some error paths.

ticket: 6678
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23835 dc483132-0cff-0310-8789-dd5450dbe970
README and patchlevel for krb5-1.8.1-beta1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23839 dc483132-0cff-0310-8789-dd5450dbe970
krb5-1.8.1-beta1-postrelease

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23841 dc483132-0cff-0310-8789-dd5450dbe970
pull up r23844 from trunk

 ------------------------------------------------------------------------
 r23844 | ghudson | 2010-03-29 18:08:21 -0400 (Mon, 29 Mar 2010) | 9 lines

 ticket: 6693
 subject: Fix backwards flag output in krb5_init_creds_step()
 tags: pullup
 target_version: 1.8.1

 krb5_init_creds_step() is taken from Heimdal, which sets *flags to 1
 for "continue" and 0 for "stop".  Unfortunately, we got it backwards
 in 1.8; fix it for 1.8.1.

ticket: 6693
version_fixed: 1.8.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23845 dc483132-0cff-0310-8789-dd5450dbe970
make depend

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23846 dc483132-0cff-0310-8789-dd5450dbe970
README and patchlevel for krb5-1.8.1-beta2

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23847 dc483132-0cff-0310-8789-dd5450dbe970