krb5-1.10-beta1-postrelease

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25647 dc483132-0cff-0310-8789-dd5450dbe970
LIBS should not include PKINIT_CRYPTO_IMPL_LIBS

Pull up r25491 from trunk

 ------------------------------------------------------------------------
 r25491 | hartmans | 2011-11-29 16:22:21 -0500 (Tue, 29 Nov 2011) | 6 lines

 ticket: new Subject: LIBS should not include PKINIT_CRYPTO_IMPL_LIBS tags: pullup target_version: 1.10

 AC_CHECK_LIB should put -lcrypto in PKINIT_CRYPTO_IMPL_LIBS not LIBS
 for pkinit.  A similar problem exists for crypto_impl and is not
 addressed by this patch.

ticket: 7077
version_fixed: 1.10
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25655 dc483132-0cff-0310-8789-dd5450dbe970
Use INSTALL_DATA to install message catalogues

Pull up r25492 from trunk

 ------------------------------------------------------------------------
 r25492 | hartmans | 2011-11-29 16:22:26 -0500 (Tue, 29 Nov 2011) | 4 lines

 ticket: new target_version: 1.10 tags: pullup subject: Use INSTALL_DATA to install message catalogues

 Use INSTALL_DATA to avoid marking .mo files executable

ticket: 7078
version_fixed: 1.10
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25656 dc483132-0cff-0310-8789-dd5450dbe970
README and patchlevel.h for krb5-1.10

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25662 dc483132-0cff-0310-8789-dd5450dbe970
krb5-1.10-postrelease

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25664 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25659 from trunk

 ------------------------------------------------------------------------
 r25659 | ghudson | 2012-01-26 12:01:05 -0500 (Thu, 26 Jan 2012) | 10 lines

 ticket: 7081
 subject: Don't use stack variable address in as_req state
 target_version: 1.10
 tags: pullup

 The KDC's process_as_req was storing the address of a stack variable
 (client_princ), which fails if the request is not immediately
 serviced.  Move that variable to the state structure so its address
 remains valid for the lifetime of the request.

ticket: 7081
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25680 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25660 from trunk

 ------------------------------------------------------------------------
 r25660 | ghudson | 2012-01-26 16:56:16 -0500 (Thu, 26 Jan 2012) | 22 lines

 ticket: 7082
 subject: Various lookaside cache fixes
 target_version: 1.10
 tags: pullup

 Don't touch the lookaside cache if we're responding with a lookaside
 cache entry.  Also, leave the null entry behind if we're deliberately
 dropping a request (a rare case) so that we don't have to process it
 again.  Fixes several lookaside problems in 1.10:

 * When dropping a request because it was already being processed, we
   were erroneously removing the null entry, causing us to process the
   request again upon a second retransmit.

 * When responding to a finished request with a lookaside entry, we
   were removing and re-adding the entry to the cache, resetting its
   time and performing unnecessary work.

 * We were not caching responses we couldn't deliver because they were
   too big for UDP, causing us to re-process the request when it came
   in again via TCP instead of simply delivering the cached response.

ticket: 7082
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25681 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25666 from trunk

 ------------------------------------------------------------------------
 r25666 | ghudson | 2012-01-31 16:35:34 -0500 (Tue, 31 Jan 2012) | 12 lines

 ticket: 7084
 subject: Don't check mech in krb5_gss_inquire_cred_by_mech
 target_version: 1.10.1
 tags: pullup

 krb5_gss_inquire_cred_by_mech checks its mech argument against two of
 the four mechs a krb5 cred might have (the krb5 mech and the old krb5
 mech, but not the wrong Microsoft mech or the IAKERB mech), so would
 spuriously fail for the other two mechs.  There is no reason to check
 the mechanism if we assume a reasonable mechglue is interpreting
 application gss_inquire_cred_by_mech calls, so just remove the check.

ticket: 7084
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25682 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25679 from trunk

 ------------------------------------------------------------------------
 r25679 | ghudson | 2012-02-07 10:45:59 -0500 (Tue, 07 Feb 2012) | 9 lines

 ticket: 7088
 subject: Fix uninitialized variable warning in trval.c
 target_version: 1.10.1
 tags: pullup

 gcc -O3 is agressive enough to detect that do_cons() doesn't always
 set the value of rlen2, so trval2() gets a maybe-uninitialized
 warning.  Squash it by initializing rlen2.

ticket: 7088
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25683 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25674 from trunk

 ------------------------------------------------------------------------
 r25674 | ghudson | 2012-02-06 18:19:08 -0500 (Mon, 06 Feb 2012) | 18 lines

 ticket: 7087
 status: open
 target_version: 1.10.1
 tags: pullup

 Set display_value in krb5_gss_get_name_attribute

 A backwards conditional in r25358 caused krb5_gss_get_name_attribute
 not to set display_value on success.  Fix the sense of the
 conditional.

 We still don't quite correctly handle the cases where data_to_gss()
 fails, but those should be rare and the problem in those cases isn't
 severe, so it can be fixed separately.

 Also, value and display_value should probably be initialized to null
 buffers on failure, as is common with GSS interfaces.

ticket: 7087
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25707 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25700 from trunk

 ------------------------------------------------------------------------
 r25700 | ghudson | 2012-02-14 13:26:50 -0500 (Tue, 14 Feb 2012) | 9 lines

 ticket: 7089
 subject: Initialize gss_get_name_attribute output buffers
 target_version: 1.10.1
 tags: pullup

 GSS functions which accept gss_buffer_t output arguments should
 initialize those buffers to empty on startup (see gss_wrap, for
 instance).  Do so for gss_get_name_attribute in the mechglue.

ticket: 7089
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25708 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25704 from trunk

 ------------------------------------------------------------------------
 r25704 | ghudson | 2012-02-21 14:14:47 -0500 (Tue, 21 Feb 2012) | 15 lines

 ticket: 7093
 subject: Access controls for string RPCs [CVE-2012-1012]
 target_version: 1.10.1
 tags: pullup

 In the kadmin protocol, make the access controls for
 get_strings/set_string mirror those of get_principal/modify_principal.
 Previously, anyone with global list privileges could get or modify
 string attributes on any principal.  The impact of this depends on how
 generous the kadmind acl is with list permission and whether string
 attributes are used in a deployment (nothing in the core code uses
 them yet).

 CVSSv2 vector: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:H/RL:O/RC:C

ticket: 7093
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25709 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25716 from trunk

 ------------------------------------------------------------------------
 r25716 | tlyu | 2012-02-27 13:31:50 -0500 (Mon, 27 Feb 2012) | 6 lines

 ticket: 7074
 target_version: 1.10.1
 tags: pullup

 Patch from Richard Basch to work around Solaris 8 lacking isblank().

ticket: 7074
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25738 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25725 from trunk, along with backport of r25703

 ------------------------------------------------------------------------
 r25725 | tlyu | 2012-03-02 17:24:38 -0500 (Fri, 02 Mar 2012) | 4 lines

 ticket: 7092

 Add test cases for Windows RODC kvno compatibility

 ------------------------------------------------------------------------
 r25703 | ghudson | 2012-02-21 13:57:44 -0500 (Tue, 21 Feb 2012) | 15 lines

 ticket: 7092
 subject: kvno ASN.1 encoding interop with Windows RODCs

 RFC 4120 defines the EncryptedData kvno field as an integer in the
 range of unsigned 32-bit numbers.  Windows encodes and decodes the
 field as a signed 32-bit integer.  Historically we do the same in our
 encoder in 1.6 and prior, and in our decoder through 1.10.  (Actually,
 our decoder through 1.10 decoded the value as a long and then cast the
 result to unsigned int, so it would accept positive values >= 2^31 on
 64-bit platforms but not on 32-bit platforms.)

 kvno values that large (or negative) are only likely to appear in the
 context of Windows read-only domain controllers.  So do what Windows
 does instead of what RFC 4120 says.

ticket: 7092
status: resolved
version_fixed: 1.10.1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25739 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25723 from trunk

 ------------------------------------------------------------------------
 r25723 | ghudson | 2012-03-01 15:49:17 -0500 (Thu, 01 Mar 2012) | 16 lines

 ticket: 7096
 subject: Fix KDB iteration when callback does write calls
 target_version: 1.10.1
 tags: pullup

 kdb_db2's ctx_iterate makes an convenience alias to dbc->db in order
 to call more invoke call the DB's seq method.  This alias may become
 invalidated if the callback writes to the DB, since ctx_lock() may
 re-open the DB in order to acquire a write lock.  Fix the bug by
 getting rid of the convenience alias.

 Most KDB iteration operations in the code base do not write to the DB,
 but kdb5_util update_princ_encryption does.

 Bug discovered and diagnosed by will.fiveash@oracle.com.

ticket: 7096
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25740 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r25730 from trunk

 ------------------------------------------------------------------------
 r25730 | ghudson | 2012-03-05 12:35:14 -0500 (Mon, 05 Mar 2012) | 15 lines

 ticket: 7098
 subject: Fix spurious password expiry warning
 target_version: 1.9.4
 tags: pullup

 r24241 (#6755) introduced a bug where if the KDC sends a LastReq entry
 containing an account expiry time, we send a prompter warning for
 password expiry even if there was no entry containing a password
 expiry time.  Typically, this results in the message "Warning: Your
 password will expire in less than one hour on Thu Jan  1 12:00:00
 1970".

 Fix this by explicitly checking for pw_exp == 0 in warn_pw_expiry()
 after we've gotten past the conditional for invoking the callback.

ticket: 7098
version_fixed: 1.10.1
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25741 dc483132-0cff-0310-8789-dd5450dbe970
Adam Bernstein reported this bug and helped with analysis

ticket: 7092
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25752 dc483132-0cff-0310-8789-dd5450dbe970
Mark Davies reported the password expiry message bug

ticket: 7098
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25753 dc483132-0cff-0310-8789-dd5450dbe970
Ian Abbott reported the bug where krb5_gss_get_name_attribute fails to
set display_value.

ticket: 7087
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25754 dc483132-0cff-0310-8789-dd5450dbe970
README and patchlevel.h for krb5-1.10.1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25755 dc483132-0cff-0310-8789-dd5450dbe970