GitHub PushEvent at 2014-06-17 16:04:36
Repository: krb5
Actor: greghudson
Payload: {"shas":[["a12a0e57a8b9c752059fd0ee370c93ea589e4b7b","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Remove stub pkinit_mapping_file code\n\nAs contributed, the PKINIT code contained code to read a mapping\nfilename, but never used the resulting structure variable.  Get rid of\nthe structure field and the code to populate it.","Greg Hudson",false],["8da21b0ec18cf9306a8c1b3410d5c6ab36acdd21","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Do not document pkinit_mapping_file\n\nThis feature was never implemented in the PKINIT code as it was\ncontributed; there was only stub support for reading the filename.\n\nticket: 7928 (new)\ntarget_version: 1.12.2\ntags: pullup","Greg Hudson",false],["ac98187641f6943ae571606c0b6a97f236f9b60c","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Read /etc/gss/mech if no mech.d/*.conf found\n\nAlways read /etc/gss/mech, even if globbing /etc/gss/mech.d/*.conf\ndoesn't work.  Doing this using GLOB_DOOFFS proved error-prone, so use\na simpler approach: factor out the per-pathname handling into a helper\nfunction load_if_changed, call it with MECH_CONF before the glob, then\npass each glob result through the helper.\n\nticket: 7925","Greg Hudson",false],["ba2879ca8f8ba84d2431a9a40de4ac7ee1e758f8","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Remove DEBUG_ERROR_LOCATIONS support\n\nIt wasn't being used and it added too much complexity to the\nerror-handling functions.","Greg Hudson",false],["06b91d1e2341601e5bdc70a15737187545d68196","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Define k5_setmsg internal alias\n\nThis is just a shorter internal name for krb5_set_error_message.  The\nfull name is so long that we have to wrap error messages more than\nwe'd like.","Greg Hudson",false],["a7b5808b5df9e54ef8a8a7ac24e5faad458ddbce","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Use k5_setmsg\n\nReplace most calls to krb5_set_error_message with k5_setmsg for\nbrevity.  Leave alone plugin sources where we don't include k5-int.h\n(mostly PKINIT).","Greg Hudson",false],["1825455ede7e61ab934b16262fb5b12b78a52f1a","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Always include salt in LDAP KrbKey encoding\n\nIn the LDAP KDB module, ensure that every krb5_key_data we pass to\nasn1_encode_sequence_of_keys includes a salt type, for compatibility\nwith the decoder in unpatched krb5 1.11 and 1.12.\n\nThis is not a behavior change by itself; since 1.7 the encoder has\nalways included a KrbKey salt field because it erroneously treats that\nfield as non-optional.  (Luckily, the encoded salt always happens to\nhave salt type 0 because krb5_key_data constructors start with zeroed\nmemory.)  The next commit will fix the encoder and decoder to properly\ntreat the KrbKey salt field as optional, so we need this change to\nensure that our encodings remain compatible.\n\nAlso fix the ASN.1 tests to set key_data_ver correctly for the sample\ntest key data.\n\nticket: 7919","Greg Hudson",false],["fb5cd8df0dbd04dac4f610e68cba5b80a3cb8d48","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Treat LDAP KrbKey salt field as optional\n\nPer the ASN.1 definition, the KrbKey salt field is optional.  Since\n1.7, we have been treating it as mandatory in the encoder; since 1.11,\nwe have been treating it as mandatory in the decoder.  Mostly by luck,\nwe have been encoding a salt type of 0 when key_data_ver is 1, but we\nreally should not be looking at key_data_type[1] or key_data_length[1]\nin this situation.  Treat the salt field as optional in the encoder\nand decoder.  Although the previous commit ensures that we continue to\nalways encode a salt (without any dangerous assumptions about\nkrb5_key_data constructors), this change will allow us to decode key\ndata encoded by 1.6 without salt fields.\n\nThis also fixes issue #7918, by properly setting key_data_ver to 2 if\na salt type but no salt value is present.  It is difficult to get the\ndecoder to actually assign 2 to key_data_ver just because the salt\nfield is there, so take care of that in asn1_decode_sequence_of_keys.\n\nAdjust kdbtest.c to match the new behavior by setting key_data_ver to\n2 in both test keys.\n\nticket: 7919\ntarget_version: 1.12.2\ntags: pullup","Greg Hudson",false],["41d38531043b99e8daa334f2b6ddf376adf1e878","d501a55a9276da296f2438bf734e21c9acf52e38@debian.org","Do not loop on add_cred_from and other new methods\n\nSeveral new GSS-API methods were added but GSSAPI_ADD_METHOD was\ncalled to add them rather than GSSAPI_ADD_METHOD_NOLOOP.  This means\nthat the implementation from the GSS-API mechglue would be used if the\nmechanism had no implementation.  As a result, the mechglue will call\ninto itself exhausting the call stack in an endless loop when one of\nthese methods is called.\n\nticket: 7926\ntarget_version: 1.12.2\ntags: pullup","Sam Hartman",false],["f07516a9f65207b1fb2f9f07b1ec7d3caa51c6be","a949c530710f9fca76b45776267c68967fa891e7@tardis.internal.bright-prospects.com","In KDC, log client principal in bad header ticket\n\nFix KDC logging to include client principal in TGS_REQ logging even\nduring error conditions such as \"Ticket expired\".  As long as the\nTGS_REQ can be decrypted and the client principal is available, it\nshould be included in the log, regardless of other errors which might\nbe detected.\n\nkrb5_rd_req_decoded and krb5_rd_req_decoded_anyflag (not public\ninterfaces) now leave the decrypted ticket in req->ticket->enc_part2\non success or failure, if the ticket was successfully decrypted.  This\ndoes not affect the behavior of krb5_rd_req.\n\n[ghudson@mit.edu: removed extraneous change, added commit message\nsummary and description of internal API change, fixed possible memory\nleak, removed comment and #if 0 code block of purely historical\ninterest]\n\nticket: 7910","rbasch",false],["4799121941cfd846f9d3d7a905ac4c84342ff306","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Add test for KDC client logging\n\nAdd a test case which performed a TGS request with an expired ticket\nand checks that the client principal is logged.\n\nticket: 7910","Greg Hudson",false],["02de9935648c307098fb69da26f74424da8dde64","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Simplify ticket retrieval from AP-REQs\n\nAfter krb5_rd_req_decoded or krb5_rd_req_decoded_anyflag, the ticket\n(with enc_part2 if we could decrypt it) is accessible via\nrequest->ticket; there is no need to copy it.  Stop using the ticket\nparameter of those functions.  Where we need to save the ticket beyond\nthe lifetime of the krb5_ap_req, steal the pointer before freeing the\nrequest.","Greg Hudson",false],["dc1a76ccc5d3a6972d0f21d38389ff39e54f283a","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Add missing profile functions to libkrb5 exports\n\nprofile_flush_to_buffer, profile_flush_to_file, profile_free_buffer,\nprofile_init_flags, and profile_init_vtable are all public profile\nfunctions, but are inaccessible to libkrb5 applications on some\nplatforms because they were never added to the export list.  Add them\nnow.\n\n(libprofile functions have never been part of the Windows DLL export\nlist, so do not change krb5_32.def at this time.)\n\nticket: 7930 (new)\ntarget_version: 1.12.2\ntags: pullup","Greg Hudson",false],["08bdd2e94157146ed35384c4d01639338d766f0f","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Remove stub pkinit_win2k code\n\nAs contributed, the PKINIT module contained code to read the\npkinit_win2k variable, but never used it.  Get rid of the structure\nfield and the code to populate it.","Greg Hudson",false],["e161636590429aa78a3f04a8bbe0a36dda48a8ab","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Do not document pkinit_win2k\n\nThis variable was never used in the PKINIT code as it was contributed;\nthere was only code to read its value.\n\nticket: 7932 (new)\ntarget_version: 1.12.2\ntags: pullup","Greg Hudson",false],["b6ec31e4e599db867ff19beef3be9b0bfa5b70eb","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Simplify and fix k5_check_cert_address\n\nGet rid of the address union.  Store the result of get_cert_cn in a\nsigned variable so we can meaningfully check for negative results.\nMake get_cert_cn return int for consistency with\nX509_NAME_get_text_by_NID and its two callers.\n\nAlso add an emacs mode line to the top of the file.\n\nticket: 7929","Greg Hudson",false],["677c7753923e5efa078074611d4474fbcc10f6a1","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Improve PKINIT certificate documentation\n\nDescribe how to use a commercially-issued server certificate for\nanonymous PKINIT.  Separate the KDC and client configuration\ninstructions so that the steps necessary for anonymous PKINIT are not\ncombined with the additional steps necessary for regular PKINIT.\nDescribe kpServerAuth as the EKU used in commercially issued server\ncertificates, not as the value used by Microsoft (which does not\nappear to be true according to [MS-PKCA]).\n\nticket: 7931 (new)\ntarget_version: 1.12.2\ntags: pullup","Greg Hudson",false],["cd06659844f9671d6ca9955fa6d3ee6e0806c7f1","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Remove PKINIT longhorn compatibility option\n\nRemove the PKINIT Windows Server 2008 beta compatibility code\nconditionalized under the \"longhorn\" variable.  It is not required to\ninteroperate with any released version of Windows.\n\nticket: 7934 (new)","Greg Hudson",false],["823bad7f3f314647feb14284bc36fa231c9c7875","5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","Remove pkinit_win2k_require_binding option\n\nWhen constructing a draft9 PKINIT request, always include\nKRB5_PADATA_AS_CHECKSUM padata to ask for an RFC 4556 ReplyKeyPack.\nDo not accept a draft9 ReplyKeyPack in the KDC response.\n\nFor now, retain the krb5_reply_key_pack_draft9 ASN.1 codec and the KDC\nsupport for generating a draft9 ReplyKeyPack when a draft9 PKINIT\nrequest does not contain KRB5_PADATA_AS_CHECKSUM.\n\nticket: 7933","Greg Hudson",false],["70b2ba4852913ceb2bdc9a57edd487da8230f813","b34e9dc3dd24827b45bb22e8b76cde1bcb413b0e@mit.edu","Update the kadm5.acl example\n\nMake the example and documentation a closer match to reality.\nIn particular, the list permission is all-or-nothing; it is not\nrestricted in scope by the target_principal field.  Change the\ntable entry to try and indicate this fact, and do not put list\npermissions on any example line that is scoped by a target_principal\npattern.\n\nWhile here, remove the nonsensical granting of global inquire\npermissions to */* (inaccurately described as \"all principals\"),\nand the granting of privileges to foreign-realm principals.\nIt is not possible to obtain an initial ticket (as required by\nthe kadmin service) for a principal in a different realm, and\nthe current kadmind implementation can serve only a single realm\nat a time -- this permission literally has no effect.  Replace\nit with a (presumably automated) \"Service Management System\"\nexample, where it might make sense to limit the principals which\nare automatically created.\n\nticket: 7939","Ben Kaduk",true]],"size":27,"ref":"refs/heads/ldapsasl","head":"ac108ff94c0f388a0884932530239d37841b8b8a"}