[AuthHub/krb5-1-8: 91/111] ticket: 6750 version_fixed: 1.8.3 status: resolved
by sbose
commit 256fde166deb74b2b40a5afdaa14729624430aa8
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Jul 20 22:28:48 2010 +0000
ticket: 6750
version_fixed: 1.8.3
status: resolved
pull up r24176 from trunk
------------------------------------------------------------------------
r24176 | ghudson | 2010-07-07 16:52:06 -0400 (Wed, 07 Jul 2010) | 7 lines
ticket: 6750
target_version: 1.8.3
tags: pullup
Add a missing break in the parsing of krb5kdc's -P option. Reported
by nalin(a)redhat.com.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24197 dc483132-0cff-0310-8789-dd5450dbe970
src/kdc/main.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/src/kdc/main.c b/src/kdc/main.c
index 9d8022a..c739964 100644
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -728,6 +728,7 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
break;
case 'P':
pid_file = optarg;
+ break;
case 'p':
if (default_udp_ports)
free(default_udp_ports);
12 years
[AuthHub/krb5-1-8: 90/111] ticket: 6745 version_fixed: 1.8.3 status: resolved
by sbose
commit c49301ae36e35d5ebf07798a82a805b982403144
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Jul 20 22:28:44 2010 +0000
ticket: 6745
version_fixed: 1.8.3
status: resolved
pull up r24139 from trunk
------------------------------------------------------------------------
r24139 | ghudson | 2010-06-21 11:18:37 -0400 (Mon, 21 Jun 2010) | 12 lines
ticket: 6745
subject: Add correct error table when initializing gss-krb5
target_version: 1.8.3
tags: pullup
gss_krb5int_lib_init was adding the generic GSS error table (again)
instead of the krb5 error table, which could lead to crashes on
library unload. This bug was introduced in krb5 1.7; the fix is also
applicable there.
Patch from Leonardo Chiquitto <leonardo.lists(a)gmail.com>.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24196 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/gssapi/krb5/gssapi_krb5.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c
index 9e5ba76..0420085 100644
--- a/src/lib/gssapi/krb5/gssapi_krb5.c
+++ b/src/lib/gssapi/krb5/gssapi_krb5.c
@@ -740,7 +740,7 @@ int gss_krb5int_lib_init(void)
printf("gss_krb5int_lib_init\n");
#endif
- add_error_table(&et_ggss_error_table);
+ add_error_table(&et_k5g_error_table);
#ifndef LEAN_CLIENT
err = k5_mutex_finish_init(&gssint_krb5_keytab_lock);
12 years
[AuthHub/krb5-1-8: 89/111] ticket: 6744 version_fixed: 1.8.3 status: resolved
by sbose
commit 1898f9f52ae2c6897b9f6f61205aa9b5d9e0520e
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Jul 20 22:28:41 2010 +0000
ticket: 6744
version_fixed: 1.8.3
status: resolved
pull up r24138 from trunk
------------------------------------------------------------------------
r24138 | tlyu | 2010-06-18 15:41:48 -0400 (Fri, 18 Jun 2010) | 13 lines
ticket: 6744
subject: only test t_locate_kdc if known-good DNS name is present
target_version: 1.8.3
tags: pullup
Running "make check" while offline or on a firewalled network may
result in failure in lib/krb5/os because the invocation of
t_locate_kdc requires that the DNS servers for ATHENA.MIT.EDU be
reachable. Autodetect DNS utilities "dig" and "nslookup", and use
them to check for existence of the known-good DNS name. Also
parameterize the test so that the known-good DNS name can be
overridden on the make command line.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24195 dc483132-0cff-0310-8789-dd5450dbe970
src/configure.in | 5 +++++
src/lib/krb5/os/Makefile.in | 26 ++++++++++++++++++++------
2 files changed, 25 insertions(+), 6 deletions(-)
---
diff --git a/src/configure.in b/src/configure.in
index d4647cb..e353065 100644
--- a/src/configure.in
+++ b/src/configure.in
@@ -662,6 +662,11 @@ int main () {
AC_MSG_RESULT($ac_cv_printf_positional)
+# for t_locate_kdc test
+
+AC_PATH_PROG(DIG, dig, false)
+AC_PATH_PROG(NSLOOKUP, nslookup, false)
+
# for kadmin
AC_PROG_YACC
diff --git a/src/lib/krb5/os/Makefile.in b/src/lib/krb5/os/Makefile.in
index 6a1ffd1..4da3ebf 100644
--- a/src/lib/krb5/os/Makefile.in
+++ b/src/lib/krb5/os/Makefile.in
@@ -189,7 +189,9 @@ lclint-localaddr: localaddr.c
$(LCLINT) $(LCLINTOPTS) $(CPPFLAGS) $(LOCALINCLUDES) $(DEFS) \
-DTEST $(srcdir)/localaddr.c
-check-unix:: $(TEST_PROGS)
+check-unix:: check-unix-stdconf check-unix-locate check-unix-antoln
+
+check-unix-stdconf:: t_std_conf
KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\
$(KRB5_RUN_ENV) $(VALGRIND) ./t_std_conf -d -s NEW.DEFAULT.REALM -d \
-k IGGY.ORG -k DEFAULT_REALM.TST \
@@ -198,17 +200,29 @@ check-unix:: $(TEST_PROGS)
-r pgp.good.idea -r no_domain > test.out
cmp test.out $(srcdir)/ref_std_conf.out
$(RM) test.out
- KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\
- if test "$(OFFLINE)" != yes; then \
- $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc ATHENA.MIT.EDU; \
+
+# The following can be overriden on the make command line if needed:
+LOCREALM = ATHENA.MIT.EDU
+SRVNAME = _kerberos._udp.athena.mit.edu.
+DIGPAT = '^_kerberos.*srv'
+NSPAT = '^_kerberos.*service'
+DIG = @DIG@
+NSLOOKUP = @NSLOOKUP@
+
+check-unix-locate:: t_locate_kdc
+ if [ "$(OFFLINE)" = no ] && \
+ $(DIG) $(SRVNAME) srv | grep -i $(DIGPAT) || \
+ $(NSLOOKUP) -q=srv $(SRVNAME) | grep -i $(NSPAT); then \
+ KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\
+ $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc $(LOCREALM); \
else \
- echo SKIPPING t_locate_kdc TEST WHILE OFFLINE; \
+ echo '*** WARNING: skipped t_locate_kdc test: known DNS name not found'; \
fi
#
# Do some aname-to-lname testing.
#
-check-unix::
+check-unix-antoln:: t_an_to_ln
echo '[libdefaults]' > ./t_an.conf
echo ' default_realm = r' >> ./t_an.conf
echo '[realms]' >> ./t_an.conf
12 years
[AuthHub/krb5-1-8: 88/111] ticket: 6738 version_fixed: 1.8.3 status: resolved
by sbose
commit 80833cb9e6d3f6a1d61b168af91c26c5f7a07178
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Jul 20 22:28:35 2010 +0000
ticket: 6738
version_fixed: 1.8.3
status: resolved
pull up r24137 from trunk
------------------------------------------------------------------------
r24137 | ghudson | 2010-06-14 16:46:27 -0400 (Mon, 14 Jun 2010) | 7 lines
ticket: 6738
target_version: 1.8.3
tags: pullup
In PKINIT, notice if DH_compute_key() returns a value less than the
buffer size, and pad it on the left if so.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24194 dc483132-0cff-0310-8789-dd5450dbe970
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 20 ++++++++++++++++++--
1 files changed, 18 insertions(+), 2 deletions(-)
---
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index d000466..af09d69 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2092,6 +2092,22 @@ cleanup:
return retval;
}
+/* Call DH_compute_key() and ensure that we left-pad short results instead of
+ * leaving junk bytes at the end of the buffer. */
+static void
+compute_dh(unsigned char *buf, int size, BIGNUM *server_pub_key, DH *dh)
+{
+ int len, pad;
+
+ len = DH_compute_key(buf, server_pub_key, dh);
+ assert(len >= 0 && len <= size);
+ if (len < size) {
+ pad = size - len;
+ memmove(buf + pad, buf, len);
+ memset(buf, 0, pad);
+ }
+}
+
krb5_error_code
client_create_dh(krb5_context context,
pkinit_plg_crypto_context plg_cryptoctx,
@@ -2243,7 +2259,7 @@ client_process_dh(krb5_context context,
if ((server_pub_key = ASN1_INTEGER_to_BN(pub_key, NULL)) == NULL)
goto cleanup;
- DH_compute_key(*client_key, server_pub_key, cryptoctx->dh);
+ compute_dh(*client_key, *client_key_len, server_pub_key, cryptoctx->dh);
#ifdef DEBUG_DH
print_pubkey(server_pub_key, "server's pub_key=");
pkiDebug("client secret key (%d)= ", *client_key_len);
@@ -2378,7 +2394,7 @@ server_process_dh(krb5_context context,
*server_key_len = DH_size(dh_server);
if ((*server_key = malloc(*server_key_len)) == NULL)
goto cleanup;
- DH_compute_key(*server_key, dh->pub_key, dh_server);
+ compute_dh(*server_key, *server_key_len, dh->pub_key, dh_server);
#ifdef DEBUG_DH
print_dh(dh_server, "client&server's DH params\n");
12 years
[AuthHub/krb5-1-8: 87/111] ticket: 6740 version_fixed: 1.8.3 status: resolved
by sbose
commit 6cf770c1f98e5747e187481fe504ff7f29b32591
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jun 10 21:14:34 2010 +0000
ticket: 6740
version_fixed: 1.8.3
status: resolved
pull up r24123 from trunk
------------------------------------------------------------------------
r24123 | ghudson | 2010-06-08 14:18:03 -0400 (Tue, 08 Jun 2010) | 11 lines
ticket: 6740
subject: kadmin ktadd may display wrong name of default keytab
target_version: 1.8.2
tags: pullup
kadmin's ktadd (and ktrem) displays WRFILE:/etc/krb5.keytab whenever
it uses the default keytab, even if the default has been overridden
(e.g. by KRB5_KTNAME). Use krb5_kt_get_name to get the correct name
of the default cache instead of displaying the string we think was
used to open it.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24131 dc483132-0cff-0310-8789-dd5450dbe970
src/kadmin/cli/kadmin.h | 1 -
src/kadmin/cli/keytab.c | 10 +++++++---
2 files changed, 7 insertions(+), 4 deletions(-)
---
diff --git a/src/kadmin/cli/kadmin.h b/src/kadmin/cli/kadmin.h
index 5c9decc..9f657a6 100644
--- a/src/kadmin/cli/kadmin.h
+++ b/src/kadmin/cli/kadmin.h
@@ -68,7 +68,6 @@ extern time_t get_date(char *);
/* Yucky global variables */
extern krb5_context context;
-extern char *krb5_defkeyname;
extern char *whoami;
extern void *handle;
diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c
index 8d14f86..1f81032 100644
--- a/src/kadmin/cli/keytab.c
+++ b/src/kadmin/cli/keytab.c
@@ -84,9 +84,7 @@ process_keytab(krb5_context my_context, char **keytab_str,
char *name = *keytab_str;
if (name == NULL) {
- /* XXX krb5_defkeyname is an internal library global and
- should go away */
- name = strdup(krb5_defkeyname);
+ name = malloc(BUFSIZ);
if (!name) {
com_err(whoami, ENOMEM, "while creating keytab name");
return 1;
@@ -97,6 +95,12 @@ process_keytab(krb5_context my_context, char **keytab_str,
free(name);
return 1;
}
+ code = krb5_kt_get_name(my_context, *keytab, name, BUFSIZ);
+ if (code != 0) {
+ com_err(whoami, code, "while getting keytab name");
+ free(name);
+ return 1;
+ }
} else {
if (strchr(name, ':') != NULL)
name = strdup(name);
12 years
[AuthHub/krb5-1-8: 86/111] ticket: 6739 version_fixed: 1.8.3 status: resolved
by sbose
commit 67952a359d7008eedfa7d488886048460732c853
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jun 10 21:14:26 2010 +0000
ticket: 6739
version_fixed: 1.8.3
status: resolved
pull up r24120, r24121 from trunk
------------------------------------------------------------------------
r24120 | ghudson | 2010-06-08 12:14:24 -0400 (Tue, 08 Jun 2010) | 12 lines
ticket: 6739
target_version: 1.8.2
tags: pullup
Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech. Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires. In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24130 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/gssapi/krb5/k5seal.c | 9 +--------
src/lib/gssapi/krb5/k5sealiov.c | 12 ++----------
src/lib/gssapi/krb5/k5unseal.c | 11 -----------
src/lib/gssapi/krb5/k5unsealiov.c | 14 --------------
4 files changed, 3 insertions(+), 43 deletions(-)
---
diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c
index 51faaaa..18c83df 100644
--- a/src/lib/gssapi/krb5/k5seal.c
+++ b/src/lib/gssapi/krb5/k5seal.c
@@ -328,7 +328,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req,
{
krb5_gss_ctx_id_rec *ctx;
krb5_error_code code;
- krb5_timestamp now;
krb5_context context;
output_message_buffer->length = 0;
@@ -359,12 +358,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req,
}
context = ctx->k5_context;
- if ((code = krb5_timeofday(context, &now))) {
- *minor_status = code;
- save_error_info(*minor_status, context);
- return(GSS_S_FAILURE);
- }
-
switch (ctx->proto)
{
case 0:
@@ -396,5 +389,5 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req,
*conf_state = conf_req_flag;
*minor_status = 0;
- return((ctx->krb_times.endtime < now)?GSS_S_CONTEXT_EXPIRED:GSS_S_COMPLETE);
+ return(GSS_S_COMPLETE);
}
diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c
index 9ff823e..c15e4e7 100644
--- a/src/lib/gssapi/krb5/k5sealiov.c
+++ b/src/lib/gssapi/krb5/k5sealiov.c
@@ -279,7 +279,6 @@ kg_seal_iov(OM_uint32 *minor_status,
{
krb5_gss_ctx_id_rec *ctx;
krb5_error_code code;
- krb5_timestamp now;
krb5_context context;
if (qop_req != 0) {
@@ -298,19 +297,12 @@ kg_seal_iov(OM_uint32 *minor_status,
return GSS_S_NO_CONTEXT;
}
- context = ctx->k5_context;
- code = krb5_timeofday(context, &now);
- if (code != 0) {
- *minor_status = code;
- save_error_info(*minor_status, context);
- return GSS_S_FAILURE;
- }
-
if (conf_req_flag && kg_integ_only_iov(iov, iov_count)) {
/* may be more sensible to return an error here */
conf_req_flag = FALSE;
}
+ context = ctx->k5_context;
switch (ctx->proto) {
case 0:
code = make_seal_token_v1_iov(context, ctx, conf_req_flag,
@@ -333,7 +325,7 @@ kg_seal_iov(OM_uint32 *minor_status,
*minor_status = 0;
- return (ctx->krb_times.endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE;
+ return GSS_S_COMPLETE;
}
#define INIT_IOV_DATA(_iov) do { (_iov)->buffer.value = NULL; \
diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c
index b56cd2d..5fa52fe 100644
--- a/src/lib/gssapi/krb5/k5unseal.c
+++ b/src/lib/gssapi/krb5/k5unseal.c
@@ -79,7 +79,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
krb5_checksum md5cksum;
krb5_data plaind;
char *data_ptr;
- krb5_timestamp now;
unsigned char *plain;
unsigned int cksum_len = 0;
size_t plainlen;
@@ -441,16 +440,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
if (qop_state)
*qop_state = GSS_C_QOP_DEFAULT;
- if ((code = krb5_timeofday(context, &now))) {
- *minor_status = code;
- return(GSS_S_FAILURE);
- }
-
- if (now > ctx->krb_times.endtime) {
- *minor_status = 0;
- return(GSS_S_CONTEXT_EXPIRED);
- }
-
/* do sequencing checks */
if ((ctx->initiate && direction != 0xff) ||
diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c
index a489f0d..2be7b82 100644
--- a/src/lib/gssapi/krb5/k5unsealiov.c
+++ b/src/lib/gssapi/krb5/k5unsealiov.c
@@ -52,7 +52,6 @@ kg_unseal_v1_iov(krb5_context context,
int signalg;
krb5_checksum cksum;
krb5_checksum md5cksum;
- krb5_timestamp now;
size_t cksum_len = 0;
size_t conflen = 0;
int direction;
@@ -280,19 +279,6 @@ kg_unseal_v1_iov(krb5_context context,
if (qop_state != NULL)
*qop_state = GSS_C_QOP_DEFAULT;
- code = krb5_timeofday(context, &now);
- if (code != 0) {
- *minor_status = code;
- retval = GSS_S_FAILURE;
- goto cleanup;
- }
-
- if (now > ctx->krb_times.endtime) {
- *minor_status = 0;
- retval = GSS_S_CONTEXT_EXPIRED;
- goto cleanup;
- }
-
if ((ctx->initiate && direction != 0xff) ||
(!ctx->initiate && direction != 0)) {
*minor_status = (OM_uint32)G_BAD_DIRECTION;
12 years
[AuthHub/krb5-1-8: 85/111] krb5-1.8.2-postrelease
by sbose
commit 7b6f4e1a0e819ed80c3e474a67f9371baa7ed1c0
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jun 10 18:29:35 2010 +0000
krb5-1.8.2-postrelease
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24129 dc483132-0cff-0310-8789-dd5450dbe970
src/patchlevel.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/patchlevel.h b/src/patchlevel.h
index e8a08c0..72e202b 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 2
-/* #undef KRB5_RELTAIL */
+#define KRB5_RELTAIL "postrelease"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "tags/krb5-1-8-2-final"
+#define KRB5_RELTAG "branches/krb5-1-8"
12 years
[AuthHub/krb5-1-8: 84/111] README and patchlevel for krb5-1.8.2
by sbose
commit 482967a673cede9d0140d8b5ead78a2e6397bdcb
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jun 10 18:14:11 2010 +0000
README and patchlevel for krb5-1.8.2
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24127 dc483132-0cff-0310-8789-dd5450dbe970
README | 2 ++
src/patchlevel.h | 4 ++--
2 files changed, 4 insertions(+), 2 deletions(-)
---
diff --git a/README b/README
index fddc00b..9310c2d 100644
--- a/README
+++ b/README
@@ -324,6 +324,7 @@ Past and present Sponsors of the MIT Kerberos Consortium:
Microsoft
The National Aeronautics and Space Administration
of the United States of America (NASA)
+ Network Appliance (NetApp)
Nippon Telephone and Telegraph (NTT)
Oracle
Pennsylvania State University
@@ -332,6 +333,7 @@ Past and present Sponsors of the MIT Kerberos Consortium:
TeamF1, Inc.
The University of Alaska
The University of Michigan
+ The University of Pennsylvania
Past and present members of the Kerberos Team at MIT:
diff --git a/src/patchlevel.h b/src/patchlevel.h
index f84a0c9..e8a08c0 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 2
-#define KRB5_RELTAIL "beta1-postrelease"
+/* #undef KRB5_RELTAIL */
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "branches/krb5-1-8"
+#define KRB5_RELTAG "tags/krb5-1-8-2-final"
12 years
[AuthHub/krb5-1-8: 83/111] krb5-1.8.2-beta1-postrelease
by sbose
commit 590e098f27a61cabc3b9ebd41dee5d15100bc6b3
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri May 28 23:00:02 2010 +0000
krb5-1.8.2-beta1-postrelease
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24114 dc483132-0cff-0310-8789-dd5450dbe970
src/patchlevel.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/patchlevel.h b/src/patchlevel.h
index 44bc2d3..f84a0c9 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 2
-#define KRB5_RELTAIL "beta1"
+#define KRB5_RELTAIL "beta1-postrelease"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "tags/krb5-1-8-2-beta1"
+#define KRB5_RELTAG "branches/krb5-1-8"
12 years
[AuthHub/krb5-1-8: 82/111] README and patchlevel.h for krb5-1.8.2-beta1
by sbose
commit d4bf438c50dd6c659f8cfea343e3893a58c6e9a9
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri May 28 22:55:45 2010 +0000
README and patchlevel.h for krb5-1.8.2-beta1
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24112 dc483132-0cff-0310-8789-dd5450dbe970
README | 34 +++++++++++++++++++++++++++++++++-
src/patchlevel.h | 6 +++---
2 files changed, 36 insertions(+), 4 deletions(-)
---
diff --git a/README b/README
index 924710c..fddc00b 100644
--- a/README
+++ b/README
@@ -82,6 +82,35 @@ additional measures include:
crypto
* easier kadmin history key changes
+Major changes in 1.8.2
+----------------------
+
+This is primarily a bugfix release.
+
+* Fix vulnerabilities:
+ ** CVE-2010-1320 KDC double free caused by ticket renewal
+ (MITKRB5-SA-2010-004)
+ ** CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
+
+* Allow numeric IPv6 addresses for configuring KDC locations.
+
+krb5-1.8.2 changes by ticket ID
+-------------------------------
+
+6562 kinit not working if kdc is configured with numerical IPv6 address
+6696 gss_accept_sec_context doesn't produce error tokens
+6697 segfault caused by dlerror returning NULL
+6698 kproplog displays incorrect iprop timestamps on 64-bit platforms
+6702 CVE-2010-1320 KDC double free caused by ticket renewal
+ (MITKRB5-SA-2010-004)
+6711 memory leak in process_tgs_req in r23724
+6718 Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP
+6722 Error handling bug in krb5_init_creds_init()
+6725 CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
+6726 SPNEGO doesn't interoperate with Windows 2000
+6730 kdc_tcp_ports not documented in kdc.conf.M
+6734 FAST negotiation could erroneously succeed
+
Major changes in 1.8.1
----------------------
@@ -362,6 +391,7 @@ reports, suggestions, and valuable resources:
Brandon Allbery
Russell Allbery
+ Brian Almeida
Michael B Allen
Derek Atkins
David Bantz
@@ -405,6 +435,7 @@ reports, suggestions, and valuable resources:
Jeffrey Hutzelman
Wyllys Ingersoll
Holger Isenberg
+ Joel Johnson
Mikkel Kruse
Volker Lendecke
Jan iankko Lieskovsky
@@ -420,9 +451,9 @@ reports, suggestions, and valuable resources:
Ezra Peisach
W. Michael Petullo
Mark Phalan
- Xu Qiang
Robert Relyea
Martin Rex
+ Jason Rogers
Guillaume Rousse
Tom Shaw
Peter Shoults
@@ -437,6 +468,7 @@ reports, suggestions, and valuable resources:
Simon Wilkinson
Nicolas Williams
Ross Wilper
+ Xu Qiang
Hanz van Zijst
The above is not an exhaustive list; many others have contributed in
diff --git a/src/patchlevel.h b/src/patchlevel.h
index 904d40a..44bc2d3 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -52,7 +52,7 @@
*/
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
-#define KRB5_PATCHLEVEL 1
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 2
+#define KRB5_RELTAIL "beta1"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "branches/krb5-1-8"
+#define KRB5_RELTAG "tags/krb5-1-8-2-beta1"
12 years