[AuthHub/krb5-1-8: 51/111] ticket: 6668 version_fixed: 1.8.1 status: resolved
by sbose
commit 5d0be00079af34e0442a11c2a1bb19c031a4f9c1
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Mon Mar 15 23:50:46 2010 +0000
ticket: 6668
version_fixed: 1.8.1
status: resolved
pull up r23749 from trunk
------------------------------------------------------------------------
r23749 | ghudson | 2010-02-24 13:57:08 -0500 (Wed, 24 Feb 2010) | 9 lines
ticket: 6668
subject: Two problems in kadm5_get_principal mask handling
target_version: 1.8
tags: pullup
KADM5_MOD_NAME was being applied to entry->principal instead of
entry->mod_name. KADM5_MKVNO was not being applied to entry->mkvno.
Patch from Marcus Watts <mdw(a)umich.edu>.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23807 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/kadm5/srv/svr_principal.c | 14 ++++++++------
1 files changed, 8 insertions(+), 6 deletions(-)
---
diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
index 3cb3b6b..469a8e8 100644
--- a/src/lib/kadm5/srv/svr_principal.c
+++ b/src/lib/kadm5/srv/svr_principal.c
@@ -858,8 +858,8 @@ kadm5_get_principal(void *server_handle, krb5_principal principal,
if (! (mask & KADM5_MOD_TIME))
entry->mod_date = 0;
if (! (mask & KADM5_MOD_NAME)) {
- krb5_free_principal(handle->context, entry->principal);
- entry->principal = NULL;
+ krb5_free_principal(handle->context, entry->mod_name);
+ entry->mod_name = NULL;
}
}
@@ -871,10 +871,12 @@ kadm5_get_principal(void *server_handle, krb5_principal principal,
if (kdb.key_data[i].key_data_kvno > entry->kvno)
entry->kvno = kdb.key_data[i].key_data_kvno;
- ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist,
- &entry->mkvno);
- if (ret)
- goto done;
+ if (mask & KADM5_MKVNO) {
+ ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist,
+ &entry->mkvno);
+ if (ret)
+ goto done;
+ }
if (mask & KADM5_MAX_RLIFE)
entry->max_renewable_life = kdb.max_renewable_life;
13 years, 1 month
[AuthHub/krb5-1-8: 50/111] ticket: 6661 version_fixed: 1.8.1 status: resolved
by sbose
commit 407a20de4e615b612a53538c7bc78ad6ced498d4
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Mon Mar 15 23:50:40 2010 +0000
ticket: 6661
version_fixed: 1.8.1
status: resolved
pull up r23767 from trunk
------------------------------------------------------------------------
r23767 | ghudson | 2010-03-05 14:19:42 -0500 (Fri, 05 Mar 2010) | 7 lines
ticket: 6661
target_version: 1.8.1
tags: pullup
Add IPv6 support to changepw.c (reverting r21004 since it is no longer
necessary). Patch from Submit Bose <sbose(a)redhat.com>.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23806 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/os/changepw.c | 33 ++++++++++++++++++++++++++-------
1 files changed, 26 insertions(+), 7 deletions(-)
---
diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c
index 46bb828..7cab0d6 100644
--- a/src/lib/krb5/os/changepw.c
+++ b/src/lib/krb5/os/changepw.c
@@ -65,20 +65,23 @@ locate_kpasswd(krb5_context context, const krb5_data *realm,
int sockType = (useTcp ? SOCK_STREAM : SOCK_DGRAM);
code = krb5int_locate_server (context, realm, addrlist,
- locate_service_kpasswd, sockType, AF_INET);
+ locate_service_kpasswd, sockType, AF_UNSPEC);
if (code == KRB5_REALM_CANT_RESOLVE || code == KRB5_REALM_UNKNOWN) {
code = krb5int_locate_server (context, realm, addrlist,
locate_service_kadmin, SOCK_STREAM,
- AF_INET);
+ AF_UNSPEC);
if (!code) {
/* Success with admin_server but now we need to change the
port number to use DEFAULT_KPASSWD_PORT and the socktype. */
size_t i;
for (i=0; i<addrlist->naddrs; i++) {
struct addrinfo *a = addrlist->addrs[i].ai;
+ krb5_ui_2 kpasswd_port = htons(DEFAULT_KPASSWD_PORT);
if (a->ai_family == AF_INET)
- sa2sin (a->ai_addr)->sin_port = htons(DEFAULT_KPASSWD_PORT);
+ sa2sin (a->ai_addr)->sin_port = kpasswd_port;
+ if (a->ai_family == AF_INET6)
+ sa2sin6 (a->ai_addr)->sin6_port = kpasswd_port;
if (sockType != SOCK_STREAM)
a->ai_socktype = sockType;
}
@@ -131,10 +134,16 @@ kpasswd_sendto_msg_callback(struct conn_state *conn,
/* some brain-dead OS's don't return useful information from
* the getsockname call. Namely, windows and solaris. */
- if (ss2sin(&local_addr)->sin_addr.s_addr != 0) {
+ if (local_addr.ss_family == AF_INET &&
+ ss2sin(&local_addr)->sin_addr.s_addr != 0) {
local_kaddr.addrtype = ADDRTYPE_INET;
local_kaddr.length = sizeof(ss2sin(&local_addr)->sin_addr);
local_kaddr.contents = (krb5_octet *) &ss2sin(&local_addr)->sin_addr;
+ } else if (local_addr.ss_family == AF_INET6 &&
+ ss2sin6(&local_addr)->sin6_addr.s6_addr != 0) {
+ local_kaddr.addrtype = ADDRTYPE_INET6;
+ local_kaddr.length = sizeof(ss2sin6(&local_addr)->sin6_addr);
+ local_kaddr.contents = (krb5_octet *) &ss2sin6(&local_addr)->sin6_addr;
} else {
krb5_address **addrs;
@@ -278,9 +287,19 @@ change_set_password(krb5_context context,
break;
}
- remote_kaddr.addrtype = ADDRTYPE_INET;
- remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr);
- remote_kaddr.contents = (krb5_octet *) &ss2sin(&remote_addr)->sin_addr;
+ if (remote_addr.ss_family == AF_INET) {
+ remote_kaddr.addrtype = ADDRTYPE_INET;
+ remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr);
+ remote_kaddr.contents =
+ (krb5_octet *) &ss2sin(&remote_addr)->sin_addr;
+ } else if (remote_addr.ss_family == AF_INET6) {
+ remote_kaddr.addrtype = ADDRTYPE_INET6;
+ remote_kaddr.length = sizeof(ss2sin6(&remote_addr)->sin6_addr);
+ remote_kaddr.contents =
+ (krb5_octet *) &ss2sin6(&remote_addr)->sin6_addr;
+ } else {
+ break;
+ }
if ((code = krb5_auth_con_setaddrs(callback_ctx.context,
callback_ctx.auth_context,
13 years, 1 month
[AuthHub/krb5-1-8: 49/111] Revert KRB5_CONF_ macro change intended for trunk.
by sbose
commit aab50b5b7c039979c80ddc7639e4e5687effe0f7
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed Mar 10 20:33:05 2010 +0000
Revert KRB5_CONF_ macro change intended for trunk.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23797 dc483132-0cff-0310-8789-dd5450dbe970
src/include/k5-int.h | 8 +++-----
src/lib/kadm5/logger.c | 6 +++---
2 files changed, 6 insertions(+), 8 deletions(-)
---
diff --git a/src/include/k5-int.h b/src/include/k5-int.h
index fa0fc29..43b780e 100644
--- a/src/include/k5-int.h
+++ b/src/include/k5-int.h
@@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64;
#define KRB5_CONF_DATABASE_NAME "database_name"
#define KRB5_CONF_DB_MODULE_DIR "db_module_dir"
#define KRB5_CONF_DB_MODULES "db_modules"
+#define KRB5_CONF_DOMAIN_REALM "domain_realm"
#define KRB5_CONF_DEFAULT_REALM "default_realm"
-#define KRB5_CONF_DEFAULT "default"
#define KRB5_CONF_DEFAULT_DOMAIN "default_domain"
#define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes"
#define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes"
@@ -206,7 +206,6 @@ typedef INT64_TYPE krb5_int64;
#define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc"
#define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm"
#define KRB5_CONF_DNS_FALLBACK "dns_fallback"
-#define KRB5_CONF_DOMAIN_REALM "domain_realm"
#define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses"
#define KRB5_CONF_FORWARDABLE "forwardable"
#define KRB5_CONF_HOST_BASED_SERVICES "host_based_services"
@@ -228,21 +227,20 @@ typedef INT64_TYPE krb5_int64;
#define KRB5_CONF_KEY_STASH_FILE "key_stash_file"
#define KRB5_CONF_KPASSWD_PORT "kpasswd_port"
#define KRB5_CONF_KPASSWD_SERVER "kpasswd_server"
+#define KRB5_CONF_LIBDEFAULTS "libdefaults"
#define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn"
#define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn"
#define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file"
#define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file"
#define KRB5_CONF_LDAP_SERVERS "ldap_servers"
#define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server"
-#define KRB5_CONF_LIBDEFAULTS "libdefaults"
-#define KRB5_CONF_LOGGING "logging"
+#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral"
#define KRB5_CONF_MASTER_KEY_NAME "master_key_name"
#define KRB5_CONF_MASTER_KEY_TYPE "master_key_type"
#define KRB5_CONF_MASTER_KDC "master_kdc"
#define KRB5_CONF_MAX_LIFE "max_life"
#define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life"
#define KRB5_CONF_NOADDRESSES "noaddresses"
-#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral"
#define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes"
#define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir"
#define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types"
diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
index b43a96f..384e7a8 100644
--- a/src/lib/kadm5/logger.c
+++ b/src/lib/kadm5/logger.c
@@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
* Look up [logging]-><ename> in the profile. If that doesn't
* succeed, then look for [logging]->default.
*/
- logging_profent[0] = KRB5_CONF_LOGGING;
+ logging_profent[0] = "logging";
logging_profent[1] = ename;
logging_profent[2] = (char *) NULL;
- logging_defent[0] = KRB5_CONF_LOGGING;
- logging_defent[1] = KRB5_CONF_DEFAULT;
+ logging_defent[0] = "logging";
+ logging_defent[1] = "default";
logging_defent[2] = (char *) NULL;
logging_specs = (char **) NULL;
ngood = 0;
13 years, 1 month
[AuthHub/krb5-1-8: 48/111] Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "loggi
by sbose
commit a4b7b5f3407f922e66c675efd90c21feab2fcca7
Author: tsitkova <tsitkova@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed Mar 10 15:59:30 2010 +0000
Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "logging"
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23795 dc483132-0cff-0310-8789-dd5450dbe970
src/include/k5-int.h | 8 +++++---
src/lib/kadm5/logger.c | 6 +++---
2 files changed, 8 insertions(+), 6 deletions(-)
---
diff --git a/src/include/k5-int.h b/src/include/k5-int.h
index 43b780e..fa0fc29 100644
--- a/src/include/k5-int.h
+++ b/src/include/k5-int.h
@@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64;
#define KRB5_CONF_DATABASE_NAME "database_name"
#define KRB5_CONF_DB_MODULE_DIR "db_module_dir"
#define KRB5_CONF_DB_MODULES "db_modules"
-#define KRB5_CONF_DOMAIN_REALM "domain_realm"
#define KRB5_CONF_DEFAULT_REALM "default_realm"
+#define KRB5_CONF_DEFAULT "default"
#define KRB5_CONF_DEFAULT_DOMAIN "default_domain"
#define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes"
#define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes"
@@ -206,6 +206,7 @@ typedef INT64_TYPE krb5_int64;
#define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc"
#define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm"
#define KRB5_CONF_DNS_FALLBACK "dns_fallback"
+#define KRB5_CONF_DOMAIN_REALM "domain_realm"
#define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses"
#define KRB5_CONF_FORWARDABLE "forwardable"
#define KRB5_CONF_HOST_BASED_SERVICES "host_based_services"
@@ -227,20 +228,21 @@ typedef INT64_TYPE krb5_int64;
#define KRB5_CONF_KEY_STASH_FILE "key_stash_file"
#define KRB5_CONF_KPASSWD_PORT "kpasswd_port"
#define KRB5_CONF_KPASSWD_SERVER "kpasswd_server"
-#define KRB5_CONF_LIBDEFAULTS "libdefaults"
#define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn"
#define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn"
#define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file"
#define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file"
#define KRB5_CONF_LDAP_SERVERS "ldap_servers"
#define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server"
-#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral"
+#define KRB5_CONF_LIBDEFAULTS "libdefaults"
+#define KRB5_CONF_LOGGING "logging"
#define KRB5_CONF_MASTER_KEY_NAME "master_key_name"
#define KRB5_CONF_MASTER_KEY_TYPE "master_key_type"
#define KRB5_CONF_MASTER_KDC "master_kdc"
#define KRB5_CONF_MAX_LIFE "max_life"
#define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life"
#define KRB5_CONF_NOADDRESSES "noaddresses"
+#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral"
#define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes"
#define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir"
#define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types"
diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
index 384e7a8..b43a96f 100644
--- a/src/lib/kadm5/logger.c
+++ b/src/lib/kadm5/logger.c
@@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
* Look up [logging]-><ename> in the profile. If that doesn't
* succeed, then look for [logging]->default.
*/
- logging_profent[0] = "logging";
+ logging_profent[0] = KRB5_CONF_LOGGING;
logging_profent[1] = ename;
logging_profent[2] = (char *) NULL;
- logging_defent[0] = "logging";
- logging_defent[1] = "default";
+ logging_defent[0] = KRB5_CONF_LOGGING;
+ logging_defent[1] = KRB5_CONF_DEFAULT;
logging_defent[2] = (char *) NULL;
logging_specs = (char **) NULL;
ngood = 0;
13 years, 1 month
[AuthHub/krb5-1-8: 47/111] krb5-1.8-postrelease
by sbose
commit 206926d82fc23d4a4036e1e111bd556b4073a63f
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Mar 2 18:21:06 2010 +0000
krb5-1.8-postrelease
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23762 dc483132-0cff-0310-8789-dd5450dbe970
src/patchlevel.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/patchlevel.h b/src/patchlevel.h
index 2a5126f..aadebb9 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 0
-/* #undef KRB5_RELTAIL */
+#define KRB5_RELTAIL "postrelease"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "tags/krb5-1-8-final"
+#define KRB5_RELTAG "branches/krb5-1-8"
13 years, 1 month
[AuthHub/krb5-1-8: 46/111] README and patchlevel.h for krb5-1.8 final
by sbose
commit 0c1ad197fd4a5e4ea06d4d57ddce7dca9e0a84f7
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Mar 2 18:13:43 2010 +0000
README and patchlevel.h for krb5-1.8 final
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23760 dc483132-0cff-0310-8789-dd5450dbe970
README | 8 +++++++-
src/patchlevel.h | 4 ++--
2 files changed, 9 insertions(+), 3 deletions(-)
---
diff --git a/README b/README
index 1135b8f..8063109 100644
--- a/README
+++ b/README
@@ -74,7 +74,13 @@ krb5-1.7 release contains measures to encourage sites to migrate away
from using single-DES cryptosystems. Among these is a configuration
variable that enables "weak" enctypes, which now defaults to "false"
beginning with krb5-1.8. The krb5-1.8 release includes additional
-measures to ease the transition away from single-DES.
+measures to ease the transition away from single-DES. These
+additional measures include:
+
+* enctype config enhancements (so you can do "DEFAULT +des", etc.)
+* new API to allow applications (e.g. AFS) to explicitly reenable weak
+ crypto
+* easier kadmin history key changes
Major changes in 1.8
--------------------
diff --git a/src/patchlevel.h b/src/patchlevel.h
index c151756..2a5126f 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 0
-#define KRB5_RELTAIL "beta2-postrelease"
+/* #undef KRB5_RELTAIL */
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "branches/krb5-1-8"
+#define KRB5_RELTAG "tags/krb5-1-8-final"
13 years, 1 month
[AuthHub/krb5-1-8: 45/111] krb5-1.8-beta2-postrelease
by sbose
commit e75e264f1b2bc9271256904533a31aa53c8edc03
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Feb 25 21:28:29 2010 +0000
krb5-1.8-beta2-postrelease
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23755 dc483132-0cff-0310-8789-dd5450dbe970
src/patchlevel.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/patchlevel.h b/src/patchlevel.h
index 1dd918e..c151756 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 0
-#define KRB5_RELTAIL "beta2"
+#define KRB5_RELTAIL "beta2-postrelease"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "tags/krb5-1-8-beta2"
+#define KRB5_RELTAG "branches/krb5-1-8"
13 years, 1 month
[AuthHub/krb5-1-8: 44/111] README and patchlevel.h for krb5-1.8-beta2
by sbose
commit b34189eb4d7899db3a17b402e09636ad135d2cf3
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Feb 25 21:28:22 2010 +0000
README and patchlevel.h for krb5-1.8-beta2
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23754 dc483132-0cff-0310-8789-dd5450dbe970
README | 15 +++++++++++++--
src/patchlevel.h | 4 ++--
2 files changed, 15 insertions(+), 4 deletions(-)
---
diff --git a/README b/README
index 26e516b..1135b8f 100644
--- a/README
+++ b/README
@@ -64,6 +64,11 @@ and logging in as "guest" with password "guest".
DES transition
--------------
+The krb5-1.8 release disables single-DES cryptosystems by default. As
+a result, you may need to add the libdefaults setting
+"allow_weak_crypto = true" to communicate with existing Kerberos
+infrastructures if they do not support stronger ciphers.
+
The Data Encryption Standard (DES) is widely recognized as weak. The
krb5-1.7 release contains measures to encourage sites to migrate away
from using single-DES cryptosystems. Among these is a configuration
@@ -192,6 +197,7 @@ krb5-1.8 changes by ticket ID
6599 memory leak in krb5_rd_req_decrypt_tkt_part
6600 gss_inquire_context cannot handle no target name from mechanism
6601 gsssspi_set_cred_option cannot handle mech specific option
+6603 issues with SPNEGO
6605 PKINIT client should validate SAN for TGS, not service principal
6606 allow testing when offline
6607 anonymous PKINIT
@@ -202,7 +208,8 @@ krb5-1.8 changes by ticket ID
6622 kinit_fast fails if weak enctype is among client principal keys
6623 Always treat anonymous as preauth required
6624 automated tests for anonymous pkinit
-6625 yarrow code does not initialize keyblock enctype and uses unitialized value
+6625 yarrow code does not initialize keyblock enctype and uses
+ unitialized value
6626 Restore interoperability with 1.6 addprinc -randkey
6627 Set enctype in crypto_tests to prevent memory leaks
6628 krb5int_dk_string_to_key fails to set enctype
@@ -217,7 +224,8 @@ krb5-1.8 changes by ticket ID
6645 Add krb5_allow_weak_crypto API
6648 define MIN() in lib/gssapi/krb5/prf.c
6649 Get rid of kdb_ext.h and allow out-of-tree KDB plugins
-6651 Handle migration from pre-1.7 databases with master key kvno != 1 (1.8 pullup)
+6651 Handle migration from pre-1.7 databases with master key
+ kvno != 1 (1.8 pullup)
6652 Make decryption of master key list more robust
6653 set_default_enctype_var should filter not reject weak enctypes
6654 Fix greet_server build
@@ -225,9 +233,12 @@ krb5-1.8 changes by ticket ID
6656 krb5int_fast_free_state segfaults if state is null
6657 enc_padata can include empty sequence
6658 Implement gss_set_neg_mechs
+6659 Additional memory leaks in kdc
6660 Minimal support for updating history key
6662 MITKRB5-SA-2010-001 CVE-2010-0283 KDC denial of service
6663 update mkrel to deal with changed source layout
+6665 Fix cipher state chaining in OpenSSL back end
+6669 doc updates for allow_weak_crypto
Acknowledgements
----------------
diff --git a/src/patchlevel.h b/src/patchlevel.h
index 7b8dc9f..1dd918e 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 0
-#define KRB5_RELTAIL "beta1-postrelease"
+#define KRB5_RELTAIL "beta2"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "branches/krb5-1-8"
+#define KRB5_RELTAG "tags/krb5-1-8-beta2"
13 years, 1 month
[AuthHub/krb5-1-8: 43/111] ticket: 6669 version_fixed: 1.8 status: resolved
by sbose
commit 1f1506d37300ac8ed3100641702135355e929fe1
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Feb 25 20:14:21 2010 +0000
ticket: 6669
version_fixed: 1.8
status: resolved
pull up r23750 from trunk
------------------------------------------------------------------------
r23750 | tlyu | 2010-02-25 15:09:45 -0500 (Thu, 25 Feb 2010) | 7 lines
ticket: 6669
target_version: 1.8
tags: pullup
subject: doc updates for allow_weak_crypto
Update documentation to be more helpful about allow_weak_crypto.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23751 dc483132-0cff-0310-8789-dd5450dbe970
doc/admin.texinfo | 7 +++++--
src/config-files/krb5.conf.M | 8 ++++++++
2 files changed, 13 insertions(+), 2 deletions(-)
---
diff --git a/doc/admin.texinfo b/doc/admin.texinfo
index b7c87ac..5e80af3 100644
--- a/doc/admin.texinfo
+++ b/doc/admin.texinfo
@@ -456,8 +456,11 @@ key encryption. The default value for this tag is
@itemx allow_weak_crypto
If this is set to 0 (for false), then weak encryption types will be
filtered out of the previous three lists (as noted in @ref{Supported
-Encryption Types}). The default value for this tag is true, but that
-default may change in the future.
+Encryption Types}). The default value for this tag is false, which
+may cause authentication failures in existing Kerberos infrastructures
+that do not support strong crypto. Users in affected environments
+should set this tag to true until their infrastructure adopts stronger
+ciphers.
@itemx clockskew
Sets the maximum allowable amount of clockskew in seconds that the
diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M
index b60836f..9778e81 100644
--- a/src/config-files/krb5.conf.M
+++ b/src/config-files/krb5.conf.M
@@ -128,6 +128,14 @@ types that should be requested by the client, in the same format.
This relation identifies the permitted list of session key encryption
types.
+.IP allow_weak_crypto
+If this is set to 0 (for false), then weak encryption types will be
+filtered out of the previous three lists. The default value for this
+tag is false, which may cause authentication failures in existing
+Kerberos infrastructures that do not support strong crypto. Users in
+affected environments should set this tag to true until their
+infrastructure adopts stronger ciphers.
+
.IP clockskew
This relation sets the maximum allowable amount of clockskew in seconds
that the library will tolerate before assuming that a Kerberos message
13 years, 1 month
[AuthHub/krb5-1-8: 42/111] ticket: 6603 version_fixed: 1.8 status: resolved
by sbose
commit 0a70aed9791deab5ece6b173f4c116091328f835
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Feb 23 00:25:58 2010 +0000
ticket: 6603
version_fixed: 1.8
status: resolved
pull up r23742 from trunk
------------------------------------------------------------------------
r23742 | ghudson | 2010-02-21 23:52:30 -0500 (Sun, 21 Feb 2010) | 24 lines
ticket: 6603
target_version: 1.8
tags: pullup
Fix two unrelated problems in SPNEGO which don't crop up with the krb5
mechanism.
1. The third call to spnego_init_accept_context uses faulty logic to
determine if the exchange is complete, preventing a third mech token
from being sent to the acceptor if no MIC exchange is required.
Follow the logic used in the second call (in init_ctx_nego), which is
correct.
2. If the acceptor selects a mech other than the optimistic mech, it
sets sc->mic_reqd to 1 whether or not the selected mech supports MICs
(which isn't known until the mech completes). Most code outside of
handle_mic checks sc->mic_reqd along with (sc->ctx_flags &
GSS_C_INTEG_FLAG), but the code in acc_ctx_call_acc neglected to do
so, so it could improperly delegate responsibility for deciding when
the negotiation was finished to handle_mic--which never gets called if
(sc->ctx_flags & GSS_C_INTEG_FLAG) is false. Fix acc_ctx_call_acc to
check sc->ctx_flags so that mechs which don't support integrity
protection can complete if they are selected non-optimistically.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23748 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/gssapi/spnego/spnego_mech.c | 26 ++++++++++++++++----------
1 files changed, 16 insertions(+), 10 deletions(-)
---
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index 60fadd5..cb286bc 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -448,8 +448,9 @@ create_spnego_ctx(void)
}
/*
- * Both initiator and acceptor call here to verify and/or create
- * mechListMIC, and to consistency-check the MIC state.
+ * Both initiator and acceptor call here to verify and/or create mechListMIC,
+ * and to consistency-check the MIC state. handle_mic is invoked only if the
+ * negotiated mech has completed and supports MICs.
*/
static OM_uint32
handle_mic(OM_uint32 *minor_status, gss_buffer_t mic_in,
@@ -658,18 +659,20 @@ init_ctx_cont(OM_uint32 *minor_status, gss_ctx_id_t *ctx, gss_buffer_t buf,
supportedMech, responseToken,
mechListMIC,
negState, tokflag);
- } else if (!sc->mech_complete &&
- *responseToken == GSS_C_NO_BUFFER) {
- /*
- * mech not finished and mech token missing
- */
+ } else if ((!sc->mech_complete && *responseToken == GSS_C_NO_BUFFER) ||
+ (sc->mech_complete && *responseToken != GSS_C_NO_BUFFER)) {
+ /* Missing or spurious token from acceptor. */
ret = GSS_S_DEFECTIVE_TOKEN;
- } else if (sc->mic_reqd &&
- (sc->ctx_flags & GSS_C_INTEG_FLAG)) {
+ } else if (!sc->mech_complete ||
+ (sc->mic_reqd &&
+ (sc->ctx_flags & GSS_C_INTEG_FLAG))) {
+ /* Not obviously done; we may decide we're done later in
+ * init_ctx_call_init or handle_mic. */
*negState = ACCEPT_INCOMPLETE;
*tokflag = CONT_TOKEN_SEND;
ret = GSS_S_CONTINUE_NEEDED;
} else {
+ /* mech finished on last pass and no MIC required, so done. */
*negState = ACCEPT_COMPLETE;
*tokflag = NO_TOKEN_SEND;
ret = GSS_S_COMPLETE;
@@ -1535,10 +1538,13 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc,
if (ret_flags != NULL)
*ret_flags = sc->ctx_flags;
- if (!sc->mic_reqd) {
+ if (!sc->mic_reqd ||
+ !(sc->ctx_flags & GSS_C_INTEG_FLAG)) {
+ /* No MIC exchange required, so we're done. */
*negState = ACCEPT_COMPLETE;
ret = GSS_S_COMPLETE;
} else {
+ /* handle_mic will decide if we're done. */
ret = GSS_S_CONTINUE_NEEDED;
}
} else if (ret != GSS_S_CONTINUE_NEEDED) {
13 years, 1 month