[AuthHub/krb5-1-8: 11/111] ticket: 6629 version_fixed: 1.8 status: resolved
by sbose
commit 79a270363856a18c14073a2e777f8b6a4377410c
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Mon Jan 11 21:44:13 2010 +0000
ticket: 6629
version_fixed: 1.8
status: resolved
pull up r23608 from trunk
------------------------------------------------------------------------
r23608 | epeisach | 2010-01-07 20:51:19 -0500 (Thu, 07 Jan 2010) | 23 lines
subject: krb5int_derive_key results in cache with uninitialized values
krb5int_derive_key creates a temporary keyblock to add to the derived cache.
krb5_k_free_key will iterate over the derived keys and for ones with cache will
lookup the enctype for the key_cleanup handler.
Unfortunatly, there isn't a keyblock init function that does not allocate the
keyblock - as I suspect this problem will appear in other places.
The valgrind log of this problem is:
==7281== Conditional jump or move depends on uninitialised value(s)
==7281== at 0x40E9AE8: find_enctype (etypes.h:81)
==7281== by 0x40E9C96: krb5_k_free_key (key.c:91)
==7281== by 0x40E9C52: krb5_k_free_key (key.c:86)
==7281== by 0x40EBB00: krb5_c_prf (prf.c:87)
==7281== by 0x40E7B1B: prf_plus (cf2.c:77)
==7281== by 0x40E7CE6: krb5_c_fx_cf2_simple (cf2.c:125)
==7281== by 0x804899C: main (t_cf2.c:70)
==7281==
with memory leaks.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23626 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/crypto/krb/dk/derive.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/crypto/krb/dk/derive.c b/src/lib/crypto/krb/dk/derive.c
index 384a5e4..5fd8876 100644
--- a/src/lib/crypto/krb/dk/derive.c
+++ b/src/lib/crypto/krb/dk/derive.c
@@ -183,6 +183,10 @@ krb5int_derive_key(const struct krb5_enc_provider *enc,
/* Derive into a temporary keyblock. */
keyblock.length = enc->keylength;
keyblock.contents = malloc(keyblock.length);
+ /* Set the enctype as the krb5_k_free_key will iterate over list
+ or derived keys and invoke krb5_k_free_key which will lookup
+ the enctype for key_cleanup handler */
+ keyblock.enctype = inkey->keyblock.enctype;
if (keyblock.contents == NULL)
return ENOMEM;
ret = krb5int_derive_keyblock(enc, inkey, &keyblock, in_constant);
13 years, 1 month
[AuthHub/krb5-1-8: 10/111] ticket: 6628 version_fixed: 1.8 status: resolved
by sbose
commit b9f9860dfea5b1a958f2ceaf8c2a28cc563b8d99
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri Jan 8 23:43:18 2010 +0000
ticket: 6628
version_fixed: 1.8
status: resolved
pull up r23612 from trunk
------------------------------------------------------------------------
r23612 | epeisach | 2010-01-08 09:54:04 -0500 (Fri, 08 Jan 2010) | 7 lines
ticket: 6628
subject: krb5int_dk_string_to_key fails to set enctype
tags: pullup
Failure to set the enctype before invoking krb5_k_create_key results in
potential memory leak.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23621 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/crypto/krb/dk/stringtokey.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/crypto/krb/dk/stringtokey.c b/src/lib/crypto/krb/dk/stringtokey.c
index 9a49187..4c7206c 100644
--- a/src/lib/crypto/krb/dk/stringtokey.c
+++ b/src/lib/crypto/krb/dk/stringtokey.c
@@ -72,6 +72,7 @@ krb5int_dk_string_to_key(const struct krb5_keytypes *ktp,
indata.data = (char *) foldstring;
foldkeyblock.length = keylength;
foldkeyblock.contents = foldkeydata;
+ foldkeyblock.enctype = ktp->etype;
ret = enc->make_key(&indata, &foldkeyblock);
if (ret != 0)
13 years, 1 month
[AuthHub/krb5-1-8: 9/111] ticket: 6627 version_fixed: 1.8 status: resolved
by sbose
commit b0f769f982bc7b94f6dcc57df0fcc3cd85f1dd5b
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri Jan 8 23:43:15 2010 +0000
ticket: 6627
version_fixed: 1.8
status: resolved
pull up r23611 from trunk
------------------------------------------------------------------------
r23611 | epeisach | 2010-01-07 22:43:37 -0500 (Thu, 07 Jan 2010) | 7 lines
subject: Set enctype in crypto_tests to prevent memory leaks
ticket: 6627
tags: pullup
The key caching is causing memory leaks if enctype is not set as the
enctype specific cleanup handlers are not called.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23620 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/crypto/crypto_tests/aes-test.c | 14 ++++++++------
src/lib/crypto/crypto_tests/t_cts.c | 16 +++++-----------
2 files changed, 13 insertions(+), 17 deletions(-)
---
diff --git a/src/lib/crypto/crypto_tests/aes-test.c b/src/lib/crypto/crypto_tests/aes-test.c
index 714d08e..4c0618a 100644
--- a/src/lib/crypto/crypto_tests/aes-test.c
+++ b/src/lib/crypto/crypto_tests/aes-test.c
@@ -74,11 +74,12 @@ static void set_bit(char *ptr, int bitnum)
}
/* Variable-Key tests */
-static void vk_test_1(int len)
+static void vk_test_1(int len, krb5_enctype etype)
{
int i;
enc_key.length = len;
+ enc_key.enctype = etype;
printf("\nKEYSIZE=%d\n\n", len * 8);
memset(plain, 0, sizeof(plain));
hexdump("PT", plain, 16);
@@ -94,16 +95,17 @@ static void vk_test_1(int len)
}
static void vk_test()
{
- vk_test_1(16);
- vk_test_1(32);
+ vk_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96);
+ vk_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96);
}
/* Variable-Text tests */
-static void vt_test_1(int len)
+static void vt_test_1(int len, krb5_enctype etype)
{
int i;
enc_key.length = len;
+ enc_key.enctype = etype;
printf("\nKEYSIZE=%d\n\n", len * 8);
memset(key, 0, len);
hexdump("KEY", key, len);
@@ -119,8 +121,8 @@ static void vt_test_1(int len)
}
static void vt_test()
{
- vt_test_1(16);
- vt_test_1(32);
+ vt_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96);
+ vt_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96);
}
diff --git a/src/lib/crypto/crypto_tests/t_cts.c b/src/lib/crypto/crypto_tests/t_cts.c
index 9f7b5e7..da697bd 100644
--- a/src/lib/crypto/crypto_tests/t_cts.c
+++ b/src/lib/crypto/crypto_tests/t_cts.c
@@ -43,6 +43,7 @@
const char *whoami;
+#if 0
static void printhex (size_t len, const char *p)
{
while (len--)
@@ -54,19 +55,14 @@ static void printstringhex (const char *p) { printhex (strlen (p), p); }
static void printdata (krb5_data *d) { printhex (d->length, d->data); }
static void printkey (krb5_keyblock *k) { printhex (k->length, k->contents); }
+#endif
#define JURISIC "Juri\305\241i\304\207" /* hi Miro */
#define ESZETT "\303\237"
#define GCLEF "\360\235\204\236" /* outside BMP, woo hoo! */
-static void
-keyToData (krb5_keyblock *k, krb5_data *d)
-{
- d->length = k->length;
- d->data = k->contents;
-}
-
+#if 0
static void
check_error (int r, int line) {
if (r != 0) {
@@ -76,10 +72,7 @@ check_error (int r, int line) {
}
}
#define CHECK check_error(r, __LINE__)
-
-extern struct krb5_enc_provider krb5int_enc_des3;
-struct krb5_enc_provider *enc = &krb5int_enc_des3;
-extern struct krb5_enc_provider krb5int_enc_aes128, krb5int_enc_aes256;
+#endif
static void printd (const char *descr, krb5_data *d) {
int i, j;
@@ -133,6 +126,7 @@ static void test_cts()
deciv.data = decivbuf;
keyblock.contents = aeskey;
keyblock.length = 16;
+ keyblock.enctype = ENCTYPE_AES128_CTS_HMAC_SHA1_96;
err = krb5_k_create_key(NULL, &keyblock, &key);
if (err) {
13 years, 1 month
[AuthHub/krb5-1-8: 8/111] ticket: 6626 version_fixed: 1.8 status: resolved
by sbose
commit 8d23b6a2a343abb25eef3085accff29793f87938
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri Jan 8 23:43:12 2010 +0000
ticket: 6626
version_fixed: 1.8
status: resolved
pull up r23610 from trunk
------------------------------------------------------------------------
r23610 | ghudson | 2010-01-07 21:43:21 -0500 (Thu, 07 Jan 2010) | 10 lines
ticket: 6626
subject: Restore interoperability with 1.6 addprinc -randkey
tags: pullup
target_version: 1.8
The arcfour string-to-key operation in krb5 1.7 (or later) disagrees
with the dummy password used by the addprinc -randkey operation in
krb5 1.6's kadmin client, because it's not valid UTF-8. Recognize the
1.6 dummy password and use a random password instead.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23619 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/kadm5/srv/svr_principal.c | 28 ++++++++++++++++++++++++++++
1 files changed, 28 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
index a58c798..2f2faaa 100644
--- a/src/lib/kadm5/srv/svr_principal.c
+++ b/src/lib/kadm5/srv/svr_principal.c
@@ -186,6 +186,32 @@ static void cleanup_key_data(context, count, data)
krb5_db_free(context, data);
}
+/*
+ * Set *passptr to NULL if the request looks like the first part of a krb5 1.6
+ * addprinc -randkey operation. The krb5 1.6 dummy password for these requests
+ * was invalid UTF-8, which runs afoul of the arcfour string-to-key.
+ */
+static void
+check_1_6_dummy(kadm5_principal_ent_t entry, long mask,
+ int n_ks_tuple, krb5_key_salt_tuple *ks_tuple, char **passptr)
+{
+ int i;
+ char *password = *passptr;
+
+ /* Old-style randkey operations disallowed tickets to start. */
+ if (!(mask & KADM5_ATTRIBUTES) ||
+ !(entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX))
+ return;
+
+ /* The 1.6 dummy password was the octets 1..255. */
+ for (i = 0; (unsigned char) password[i] == i + 1; i++);
+ if (password[i] != '\0' || i != 255)
+ return;
+
+ /* This will make the caller use a random password instead. */
+ *passptr = NULL;
+}
+
kadm5_ret_t
kadm5_create_principal(void *server_handle,
kadm5_principal_ent_t entry, long mask,
@@ -215,6 +241,8 @@ kadm5_create_principal_3(void *server_handle,
krb5_clear_error_message(handle->context);
+ check_1_6_dummy(entry, mask, n_ks_tuple, ks_tuple, &password);
+
/*
* Argument sanity checking, and opening up the DB
*/
13 years, 1 month
[AuthHub/krb5-1-8: 7/111] ticket: 6625 version_fixed: 1.8 status: resolved
by sbose
commit 38c4051ec35c7748c58e073dca7f5872e9ea04af
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri Jan 8 23:43:09 2010 +0000
ticket: 6625
version_fixed: 1.8
status: resolved
pull up r23609 from trunk
------------------------------------------------------------------------
r23609 | epeisach | 2010-01-07 21:12:24 -0500 (Thu, 07 Jan 2010) | 23 lines
subject: yarrow code does not initialize keyblock enctype and uses unitialized value
ticket: 6625
tags: pullup
The yarrow code uses a keyblock that is partially initialized. This results
in krb5_k_free_key trying to look up the enctype to call the free handler.
One of the valgrind reports: (there are several paths)
==26701== Conditional jump or move depends on uninitialised value(s)
==26701== at 0x40E9AF0: find_enctype (etypes.h:81)
==26701== by 0x40E9C9E: krb5_k_free_key (key.c:91)
==26701== by 0x40D641A: krb5int_yarrow_cipher_init (ycipher.c:49)
==26701== by 0x40D593A: yarrow_gate_locked (yarrow.c:578)
==26701== by 0x40D5349: krb5int_yarrow_output_Block (yarrow.c:423)
==26701== by 0x40D581B: yarrow_output_locked (yarrow.c:553)
==26701== by 0x40D5667: krb5int_yarrow_output (yarrow.c:513)
==26701== by 0x40EBD2D: krb5_c_random_make_octets (prng.c:112)
==26701== by 0x40D4119: krb5int_old_encrypt (old_aead.c:97)
==26701== by 0x40E9696: krb5_k_encrypt_iov (encrypt_iov.c:42)
==26701== by 0x8049554: main (t_encrypt.c:206)
==26701==
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23618 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/crypto/krb/yarrow/ycipher.c | 1 +
src/lib/crypto/krb/yarrow/ycipher.h | 1 +
2 files changed, 2 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/crypto/krb/yarrow/ycipher.c b/src/lib/crypto/krb/yarrow/ycipher.c
index 71b89b0..7222d94 100644
--- a/src/lib/crypto/krb/yarrow/ycipher.c
+++ b/src/lib/crypto/krb/yarrow/ycipher.c
@@ -50,6 +50,7 @@ krb5int_yarrow_cipher_init(CIPHER_CTX *ctx, unsigned const char * key)
ctx->key = NULL;
keyblock.contents = malloc(keylength);
keyblock.length = keylength;
+ keyblock.enctype = yarrow_enc_type;
if (keyblock.contents == NULL)
return (YARROW_NOMEM);
randombits.data = (char *) key;
diff --git a/src/lib/crypto/krb/yarrow/ycipher.h b/src/lib/crypto/krb/yarrow/ycipher.h
index 21151bd..4d7dc9d 100644
--- a/src/lib/crypto/krb/yarrow/ycipher.h
+++ b/src/lib/crypto/krb/yarrow/ycipher.h
@@ -18,6 +18,7 @@ typedef struct
*/
#define yarrow_enc_provider krb5int_enc_aes256
+#define yarrow_enc_type ENCTYPE_AES256_CTS_HMAC_SHA1_96
#define CIPHER_BLOCK_SIZE 16
#define CIPHER_KEY_SIZE 32
13 years, 1 month
[AuthHub/krb5-1-8: 6/111] ticket: 6624 version_fixed: 1.8 status: resolved
by sbose
commit 59a2662206d6d49007f4a242ab1f2e25fd5b3960
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri Jan 8 23:43:05 2010 +0000
ticket: 6624
version_fixed: 1.8
status: resolved
pull up r23602, r23604, r23605 from trunk
------------------------------------------------------------------------
r23605 | hartmans | 2010-01-07 13:35:15 -0500 (Thu, 07 Jan 2010) | 4 lines
ticket: 6624
Revert change to Makefile.in that ended up not being needed
------------------------------------------------------------------------
r23604 | hartmans | 2010-01-07 13:32:20 -0500 (Thu, 07 Jan 2010) | 10 lines
Subject: automated tests for anonymous pkinit
ticket: 6624
target_version: 1.8
tags: pullup
Implement tests for anonymous pkinit. A certificate and private key
are checked in; these tests will stop working in 2023.
Note that r23602 needs to be pulled up before this ticket.
------------------------------------------------------------------------
r23602 | ghudson | 2010-01-07 12:26:58 -0500 (Thu, 07 Jan 2010) | 4 lines
Make preauth_module_dir override, rather than supplement, the
built-in path list, to avoid problems with running the same preauth
module twice.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23617 dc483132-0cff-0310-8789-dd5450dbe970
src/kdc/kdc_preauth.c | 41 +++++-----------------
src/lib/krb5/krb/preauth2.c | 43 +++++-----------------
src/tests/dejagnu/config/default.exp | 22 ++++++++++++
src/tests/dejagnu/krb-standalone/standalone.exp | 11 ++++++
src/tests/dejagnu/pkinit-certs/ca.pem | 29 +++++++++++++++
src/tests/dejagnu/pkinit-certs/kdc.pem | 25 +++++++++++++
src/tests/dejagnu/pkinit-certs/privkey.pem | 27 ++++++++++++++
7 files changed, 133 insertions(+), 65 deletions(-)
---
diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index 18052cf..c5dfb1f 100644
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -391,45 +391,22 @@ static struct plugin_dir_handle preauth_plugins;
/* Open plugin directories for preauth modules. */
static krb5_error_code
-open_preauth_plugin_dirs(krb5_context kcontext)
+open_preauth_plugin_dirs(krb5_context ctx)
{
static const char *path[] = {
KRB5_CONF_LIBDEFAULTS, KRB5_CONF_PREAUTH_MODULE_DIR, NULL,
};
char **profpath = NULL;
- const char **plugindirs = NULL;
- size_t nprofdirs, nobjdirs;
- krb5_error_code retval;
-
- /* Fetch the list of paths specified in the profile, if any. */
- retval = profile_get_values(kcontext->profile, path, &profpath);
- if (retval != 0 && retval != PROF_NO_RELATION)
- return retval;
-
- /* Count the number of profile dirs. */
- nprofdirs = 0;
- if (profpath) {
- while (profpath[nprofdirs] != NULL)
- nprofdirs++;
- }
-
- nobjdirs = sizeof(objdirs) / sizeof(*objdirs);
- plugindirs = k5alloc((nprofdirs + nobjdirs) * sizeof(char *), &retval);
- if (retval != 0)
- goto cleanup;
-
- /* Concatenate the profile and hardcoded directory lists. */
- if (profpath)
- memcpy(plugindirs, profpath, nprofdirs * sizeof(char *));
- memcpy(plugindirs + nprofdirs, objdirs, nobjdirs * sizeof(char *));
-
- retval = krb5int_open_plugin_dirs(plugindirs, NULL, &preauth_plugins,
- &kcontext->err);
-
-cleanup:
+ const char **dirs;
+ krb5_error_code ret;
+
+ ret = profile_get_values(ctx->profile, path, &profpath);
+ if (ret != 0 && ret != PROF_NO_RELATION)
+ return ret;
+ dirs = (profpath != NULL) ? (const char **) profpath : objdirs;
+ ret = krb5int_open_plugin_dirs(dirs, NULL, &preauth_plugins, &ctx->err);
profile_free_list(profpath);
- free(plugindirs);
- return retval;
+ return ret;
}
krb5_error_code
diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
index d1d2827..cf99a29 100644
--- a/src/lib/krb5/krb/preauth2.c
+++ b/src/lib/krb5/krb/preauth2.c
@@ -72,46 +72,23 @@ typedef struct _pa_types_t {
/* Open plugin directories for preauth modules. */
static krb5_error_code
-open_preauth_plugin_dirs(krb5_context kcontext)
+open_preauth_plugin_dirs(krb5_context ctx)
{
static const char *path[] = {
KRB5_CONF_LIBDEFAULTS, KRB5_CONF_PREAUTH_MODULE_DIR, NULL,
};
char **profpath = NULL;
- const char **plugindirs = NULL;
- size_t nprofdirs, nobjdirs;
- krb5_error_code retval;
-
- /* Fetch the list of paths specified in the profile, if any. */
- retval = profile_get_values(kcontext->profile, path, &profpath);
- if (retval != 0 && retval != PROF_NO_RELATION)
- return retval;
-
- /* Count the number of profile dirs. */
- nprofdirs = 0;
- if (profpath) {
- while (profpath[nprofdirs] != NULL)
- nprofdirs++;
- }
-
- nobjdirs = sizeof(objdirs) / sizeof(*objdirs);
- plugindirs = k5alloc((nprofdirs + nobjdirs) * sizeof(char *), &retval);
- if (retval != 0)
- goto cleanup;
-
- /* Concatenate the profile and hardcoded directory lists. */
- if (profpath)
- memcpy(plugindirs, profpath, nprofdirs * sizeof(char *));
- memcpy(plugindirs + nprofdirs, objdirs, nobjdirs * sizeof(char *));
-
- retval = krb5int_open_plugin_dirs(plugindirs, NULL,
- &kcontext->preauth_plugins,
- &kcontext->err);
+ const char **dirs;
+ krb5_error_code ret;
-cleanup:
+ ret = profile_get_values(ctx->profile, path, &profpath);
+ if (ret != 0 && ret != PROF_NO_RELATION)
+ return ret;
+ dirs = (profpath != NULL) ? (const char **) profpath : objdirs;
+ ret = krb5int_open_plugin_dirs(dirs, NULL, &ctx->preauth_plugins,
+ &ctx->err);
profile_free_list(profpath);
- free(plugindirs);
- return retval;
+ return ret;
}
/* Create the per-krb5_context context. This means loading the modules
diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
index 8e540b3..98a9a43 100644
--- a/src/tests/dejagnu/config/default.exp
+++ b/src/tests/dejagnu/config/default.exp
@@ -960,7 +960,9 @@ proc setup_krb5_conf { {type client} } {
global portbase
global KRB5_DB_MODULE_DIR
global KRB5_PA_MODULE_DIR
+ global srcdir
+ set pkinit_certs [findfile "[pwd]/$srcdir/pkinit-certs" "[pwd]/$srcdir/pkinit-certs" "$srcdir/pkinit-certs"]
# Create a krb5.conf file.
if { ![file exists $tmppwd/krb5.$type.conf] \
|| $last_passname_conf != $multipass_name } {
@@ -973,6 +975,7 @@ proc setup_krb5_conf { {type client} } {
} else {
puts $conffile " allow_weak_crypto = true"
}
+ puts $conffile " pkinit_anchors = FILE:$pkinit_certs/ca.pem"
if [info exists default_tgs_enctypes($type)] {
puts $conffile \
" default_tgs_enctypes = $default_tgs_enctypes($type)"
@@ -1000,6 +1003,8 @@ proc setup_krb5_conf { {type client} } {
# failures. If we were running the client and KDC on different
# hosts, this would be okay....
#puts $conffile " kdc = $hostname:[expr 6 + $portbase]"
+ puts $conffile " pkinit_identity = FILE:$pkinit_certs/kdc.pem,$pkinit_certs/privkey.pem"
+ puts $conffile " pkinit_anchors = FILE:$pkinit_certs/ca.pem"
puts $conffile " kdc = $hostname:[expr 1 + $portbase]"
puts $conffile " admin_server = $hostname:[expr 4 + $portbase]"
puts $conffile " kpasswd_server = $hostname:[expr 5 + $portbase]"
@@ -2257,6 +2262,23 @@ proc kinit_fast { name pass standalone } {
return 1
}
+proc kinit_anonymous { name } {
+ global REALMNAME
+ global KINIT
+ global spawn_id
+
+ # Use kinit to get a ticket.
+ #
+ spawn $KINIT -5 -f -n $name@$REALMNAME
+ expect eof
+ if ![check_exit_status kinit] {
+ fail "kinit anonymous"
+ }
+
+ pass "kinit anonymous"
+ return 1
+}
+
proc kinit_kt { name keytab standalone testname } {
global REALMNAME
global KINIT
diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/dejagnu/krb-standalone/standalone.exp
index 068495f..c511798 100644
--- a/src/tests/dejagnu/krb-standalone/standalone.exp
+++ b/src/tests/dejagnu/krb-standalone/standalone.exp
@@ -138,6 +138,8 @@ proc doit { } {
global KRBIV
global portbase
global mode
+ global tmppwd
+ global KRB5_PA_MODULE_DIR
setup_kerberos_env kdc
@@ -224,6 +226,15 @@ proc doit { } {
# Double check that the ticket was destroyed.
if ![do_klist_err "klist after destroy"] { return }
+ if ![add_random_key WELLKNOWN/ANONYMOUS 0] {
+ return
+ }
+
+ # If we have anonymous then test it
+ if [file exists "$tmppwd/../../../util/fakedest$KRB5_PA_MODULE_DIR/pkinit.so" ] {
+ kinit_anonymous "WELLKNOWN/ANONYMOUS"
+ }
+
if ![add_random_key foo/bar 1] {
return
}
diff --git a/src/tests/dejagnu/pkinit-certs/ca.pem b/src/tests/dejagnu/pkinit-certs/ca.pem
new file mode 100644
index 0000000..55fe02c
--- /dev/null
+++ b/src/tests/dejagnu/pkinit-certs/ca.pem
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE5TCCA82gAwIBAgIJANsFDWp1HgAaMA0GCSqGSIb3DQEBBQUAMIGnMQswCQYD
+VQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czESMBAGA1UEBxMJQ2FtYnJp
+ZGdlMQwwCgYDVQQKEwNNSVQxKTAnBgNVBAsTIEluc2VjdXJlIFBraW5pdCBLZXJi
+ZXJvcyB0ZXN0IENBMTMwMQYDVQQDFCpwa2luaXQgdGVzdCBzdWl0ZSBDQTsgZG8g
+bm90IHVzZSBvdGhlcndpc2UwHhcNMTAwMTA2MTQ1MTI3WhcNMjMwOTE1MTQ1MTI3
+WjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNV
+BAcTCUNhbWJyaWRnZTEMMAoGA1UEChMDTUlUMSkwJwYDVQQLEyBJbnNlY3VyZSBQ
+a2luaXQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAxQqcGtpbml0IHRlc3Qgc3Vp
+dGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmn
+ZejPSKdNMyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6K
+ueerevR3pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY7
+5NbXGIE488iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc
+5dBSqBwVcjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOW
+riIRmsqq81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABo4IBEDCCAQwwHQYDVR0O
+BBYEFFn82RUKgTvkFn0cgwyCQpNeWCxYMIHcBgNVHSMEgdQwgdGAFFn82RUKgTvk
+Fn0cgwyCQpNeWCxYoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFz
+c2FjaHVzZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMQwwCgYDVQQKEwNNSVQxKTAn
+BgNVBAsTIEluc2VjdXJlIFBraW5pdCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQD
+FCpwa2luaXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCCQDb
+BQ1qdR4AGjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBVL2Q6Xubs
+gm881cAy6esku17/BSTZur7hCLHTGof1ZKNcCXALjmwNYNC3tl6owqpX8CSdBdsD
+Bw/Vs9p3mqnaVEoZc8uW8zS6LoAQbcqiYdQHdEXMh3ec8uvAfmdlQsIsm5Ux8q8L
+NM6bKnUOqOFOHme+RC4FGOLb8JqnnuQdwyIZaUyQP6hXbw4zyDphfgo1ZlZn20xh
+I555kPfAZKEi/d3WY0oN4k+sfCs9tWRNjmqZfKkH1OqRpjCFGG0b0vY77MFRMuPz
+YtN2iD3plgla7KkUMljp9th/Z8Ok79uA1TNLYKzoBjlAX0vToxfa8rrSNo1dHFKT
+e5Tj7+29DE4I
+-----END CERTIFICATE-----
diff --git a/src/tests/dejagnu/pkinit-certs/kdc.pem b/src/tests/dejagnu/pkinit-certs/kdc.pem
new file mode 100644
index 0000000..5575ab5
--- /dev/null
+++ b/src/tests/dejagnu/pkinit-certs/kdc.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEMjCCAxqgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBpzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcTCUNhbWJyaWRnZTEMMAoG
+A1UEChMDTUlUMSkwJwYDVQQLEyBJbnNlY3VyZSBQa2luaXQgS2VyYmVyb3MgdGVz
+dCBDQTEzMDEGA1UEAxQqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+b3RoZXJ3aXNlMB4XDTEwMDEwNjE0NTgwOFoXDTIzMDkxNTE0NTgwOFowSjELMAkG
+A1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxFTATBgNVBAoTDEtSQlRF
+U1QuQ09NIDEMMAoGA1UECxMDS0RDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmnZejPSKdN
+MyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6KueerevR3
+pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY75NbXGIE4
+88iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc5dBSqBwV
+cjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOWriIRmsqq
+81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABo4HEMIHBMAkGA1UdEwQCMAAwCwYD
+VR0PBAQDAgPoMBIGA1UdJQQLMAkGBysGAQUCAwUwHQYDVR0OBBYEFFn82RUKgTvk
+Fn0cgwyCQpNeWCxYMB8GA1UdIwQYMBaAFFn82RUKgTvkFn0cgwyCQpNeWCxYMAkG
+A1UdEgQCMAAwSAYDVR0RBEEwP6A9BgYrBgEFAgKgMzAxoA0bC0tSQlRFU1QuQ09N
+oSAwHqADAgEBoRcwFRsGa3JidGd0GwtLUkJURVNULkNPTTANBgkqhkiG9w0BAQUF
+AAOCAQEAP0byILHLWPyGlv/1HN34DfIpLdVkgGar2yceMtZ2v/7UjeA5PlZc8DFM
+20bTq/vIN0eWDTPLI57e+MzQTMxs2UHsic4su0m5DG0cvQTsBXRK51CW/qUF+4n0
+qSEORULiDF6LNoo8akoLukNBhzBh+aqYt4aB46hhsmDmNZTDP1CXsNGHQI9/L52l
+oqpUGx8tBpKIFos95PSajXrQn2u66rSMMi4aawitM2igurHPDMbC+XvEYMtXpOS5
+3PEzXEYiSV3TWLTzIE9ytswHeZyHCbp7XHx0LVZFxzqtIe4qmwJJOGhlbH21Izr4
+feF5h5e2ZrOVREY4cKkJmJhEwsqBVA==
+-----END CERTIFICATE-----
diff --git a/src/tests/dejagnu/pkinit-certs/privkey.pem b/src/tests/dejagnu/pkinit-certs/privkey.pem
new file mode 100644
index 0000000..1825dec
--- /dev/null
+++ b/src/tests/dejagnu/pkinit-certs/privkey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmn
+ZejPSKdNMyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6K
+ueerevR3pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY7
+5NbXGIE488iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc
+5dBSqBwVcjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOW
+riIRmsqq81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABAoIBAQCSMh5Tu9S2yUwM
+dEZmZiGxhuf+anAZZAOjqT4QeLI/Fmu3yBNM7rq+p7JrAabyp6pOq46EsXXyWtWS
+SB742wWUk2quGMNVQAj0TAJyhNgGstr+XJu8k8BBPnlycobhF0lP/oH+uQifl0KR
+iSoWLjEG5JTOoXs/UAD6nQMBDDhv9TweEwSyIY9jq1J5Q3wVXm/Nr/FJ/8O53guJ
+/TQeo6dtdx6x2+oxKkeWinfxmy2nSoEZd0eb3WUNPZswijO7QgSJolOo83VNqFcn
+lj8hYT41zUM4chple8kGnuSV4ql4a1w/52dSTLKJbgukIqvxeDtKNost344eQqkS
+Lwcc+NO5AoGBAM0bR8TmFlbP4RJAEOOilXTYgP6Ttd1r1mRXGi3DRPyv4EWGT7WW
+MmBHsqU6Mqz+fcoD/AIy1BBdenhaYrrwyCSvitJpoHPjqzOJDX33wUcrnYeincQ3
+PVzpF41O45vTmm692DSJ8t/uR8DhGpCzf/kxuA9ixvdKgMPgBHYeb5zlAoGBAMSY
+KZvgwbtlRR25CGaUgOCHtW76puaPcyxEeCbJEKkJO1vZDAf8vi1zXOM4e/gorKHm
+349ZrBQfFCrvtZG//KvI12MpjBs0Z/ijSCwS4EkYJaSH+Hm+1ygLdArwWEFkNncL
+qQ+Wme1OUoDiAAxRiBKUxUF/pAQqn7X+0MGa2th3AoGBAJ8kRaFu7XJaRUZF01Ts
+d4571kqxDXFKFMUyGCvd0Q9G33rSZdJ9QYUW3HP7HgrAQ5WVVdnW2lgAT+BGMUjf
+PkvIsKvmLQr+YX3RH1jX/W1dWBM/h64RNll6uj14Mn5bxv2Z68GIL5y0Y5QylMwl
+mmwdubSmbb6+Xf6dOJj1sKBJAoGBAJwP0tAMHp6daL2Mmk+cSaZz9KJx1bYnYB1f
+CSZ47IHTc0yZQ0S/7VR1ROKXf0njOA+aEBRi8ghTF5ZyDefyySixWdI9NByQgIzP
+Sca7AVLlGVTAH4694VzHosngO59FZzsfhYh7XBwW1cW8Ip+kxWlCskgphFFOaNR3
+wM5AGMRHAoGAJELs9VYPRJd7h4dPUa2RqfVPlYkcMwvoLYykY0wE5mjoNaJkQbUr
+W5aKhidh4h48fImt2rpB6OYSofYC4yu3VDEr/Kl2nSb8UPE5qEd1pvmdkHSxMNkh
+M2diIqot6s2v20lE/6UCqLXonlquRK1MAlyfPw9yZHP9meCvlBsYZXc=
+-----END RSA PRIVATE KEY-----
13 years, 1 month
[AuthHub/krb5-1-8: 5/111] ticket: 6623 version_fixed: 1.8 status: resolved
by sbose
commit 7b0b25e873f9760e13a32864fb58a04409f2e917
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri Jan 8 23:43:02 2010 +0000
ticket: 6623
version_fixed: 1.8
status: resolved
pull up r23603 from trunk
------------------------------------------------------------------------
r23603 | hartmans | 2010-01-07 13:32:15 -0500 (Thu, 07 Jan 2010) | 7 lines
subject: Always treat anonymous as preauth required
ticket: 6623
target_version: 1.8
tags: pullup
Always treat the WELLKNOWN/ANONYMOUS principal as requiring pre-authentication. The anonymous draft depends on a pre-auth exchange to invoke pkinit.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23616 dc483132-0cff-0310-8789-dd5450dbe970
src/kdc/do_as_req.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index 55493ba..83d3101 100644
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -407,6 +407,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
goto errout;
}
enc_tkt_reply.client = request->client;
+ setflag(client.attributes, KRB5_KDB_REQUIRES_PRE_AUTH);
}
/*
* Check the preauthentication if it is there.
13 years, 1 month
[AuthHub/krb5-1-8: 4/111] ticket: 6622 version_fixed: 1.8 status: resolved
by sbose
commit 304150c43c968b8023e1d65d3d7a28dff2b07f2e
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri Jan 8 23:42:59 2010 +0000
ticket: 6622
version_fixed: 1.8
status: resolved
pull up r23597, r23599 from trunk
------------------------------------------------------------------------
r23599 | ghudson | 2010-01-06 18:44:04 -0500 (Wed, 06 Jan 2010) | 4 lines
Make krb5_dbe_def_search_enctype more consistent about when it returns
KRB5_KDB_NO_PERMITTED_KEY. Now it will return that error if it sees
any non-permitted enctypes which match the search criteria.
------------------------------------------------------------------------
r23597 | ghudson | 2010-01-06 18:14:14 -0500 (Wed, 06 Jan 2010) | 8 lines
ticket: 6622
target_version: 1.8
tags: pullup
Don't return KRB5_KDB_NO_PERMITTED_KEY from
krb5_dbe_def_search_enctype if we previously returned results (i.e. if
*start > 0).
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23615 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/kdb/kdb_default.c | 49 +++++++++++++++++++++-----------------------
1 files changed, 23 insertions(+), 26 deletions(-)
---
diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c
index ea24d36..4a4cf87 100644
--- a/src/lib/kdb/kdb_default.c
+++ b/src/lib/kdb/kdb_default.c
@@ -61,6 +61,7 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap)
int maxkvno;
krb5_key_data *datap;
krb5_error_code ret;
+ krb5_boolean saw_non_permitted = FALSE;
ret = 0;
if (kvno == -1 && stype == -1 && ktype == -1)
@@ -88,42 +89,38 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap)
db_stype = KRB5_KDB_SALTTYPE_NORMAL;
}
- /*
- * Filter out non-permitted enctypes.
- */
- if (!krb5_is_permitted_enctype(kcontext,
- dbentp->key_data[i].key_data_type[0])) {
- ret = KRB5_KDB_NO_PERMITTED_KEY;
- continue;
- }
-
-
+ /* Match this entry against the arguments. */
if (ktype != -1) {
if ((ret = krb5_c_enctype_compare(kcontext, (krb5_enctype) ktype,
dbentp->key_data[i].key_data_type[0],
&similar)))
return(ret);
+ if (!similar)
+ continue;
}
+ if (stype >= 0 && db_stype != stype)
+ continue;
+ if (kvno >= 0 && dbentp->key_data[i].key_data_kvno != kvno)
+ continue;
- if (((ktype == -1) || similar) &&
- ((db_stype == stype) || (stype < 0))) {
- if (kvno >= 0) {
- if (kvno == dbentp->key_data[i].key_data_kvno) {
- datap = &dbentp->key_data[i];
- idx = i;
- maxkvno = kvno;
- break;
- }
- } else {
- if (dbentp->key_data[i].key_data_kvno > maxkvno) {
- maxkvno = dbentp->key_data[i].key_data_kvno;
- datap = &dbentp->key_data[i];
- idx = i;
- }
- }
+ /* Filter out non-permitted enctypes. */
+ if (!krb5_is_permitted_enctype(kcontext,
+ dbentp->key_data[i].key_data_type[0])) {
+ saw_non_permitted = TRUE;
+ continue;
+ }
+
+ if (dbentp->key_data[i].key_data_kvno > maxkvno) {
+ maxkvno = dbentp->key_data[i].key_data_kvno;
+ datap = &dbentp->key_data[i];
+ idx = i;
}
}
+ /* If we scanned the whole set of keys and matched only non-permitted
+ * enctypes, indicate that. */
+ if (maxkvno < 0 && *start == 0 && saw_non_permitted)
+ ret = KRB5_KDB_NO_PERMITTED_KEY;
if (maxkvno < 0)
return ret ? ret : KRB5_KDB_NO_MATCHING_KEY;
*kdatap = datap;
13 years, 1 month
[AuthHub/krb5-1-8: 3/111] krb5-1.8-alpha1-postrelease
by sbose
commit 8d3f352360f44456dd8e0cf8b27bb02d0002226b
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed Jan 6 23:11:52 2010 +0000
krb5-1.8-alpha1-postrelease
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23596 dc483132-0cff-0310-8789-dd5450dbe970
src/patchlevel.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/patchlevel.h b/src/patchlevel.h
index c538abc..1b2a0c6 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 0
-#define KRB5_RELTAIL "alpha1"
+#define KRB5_RELTAIL "alpha1-postrelease"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "tags/krb5-1-8-alpha1"
+#define KRB5_RELTAG "branches/krb5-1-8"
13 years, 1 month
[AuthHub/krb5-1-8: 2/111] README, patchlevel, etc. for krb5-1.8-alpha1
by sbose
commit 4d08f5da33a352f3361b9518d598c90ca8065d56
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed Jan 6 22:58:45 2010 +0000
README, patchlevel, etc. for krb5-1.8-alpha1
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23594 dc483132-0cff-0310-8789-dd5450dbe970
README | 103 +++++++++++++++++++++++++++++++++++++++++++++++
doc/definitions.texinfo | 4 +-
src/patchlevel.h | 4 +-
3 files changed, 107 insertions(+), 4 deletions(-)
---
diff --git a/README b/README
index a05bc9f..c1eabc5 100644
--- a/README
+++ b/README
@@ -71,9 +71,112 @@ beginning with krb5-1.8.
Major changes in 1.8
--------------------
+The krb5-1.8 release contains a large number of changes, featuring
+improvements in the following broad areas:
+
+* Code quality
+* Modularity
+* Performance
+* End-user experience
+* Administrator experience
+* Protocol evolution
+
+Code quality:
+
+* Move toward test-driven development -- new features have test code,
+ or at least written testing procedures.
+
+* Increase conformance to coding style
+
+ + "The great reindent"
+
+ + Selective refactoring
+
+Modularity:
+
+* Crypto modularity -- vendors can more easily substitute their own
+ crypto implementations, which might be hardware-accelerated or
+ validated to FIPS 140, for the builtin crypto implementation that
+ has historically shipped as part of MIT Kerberos. Currently, only
+ an OpenSSL provider is included, but others are possible.
+
+* Move toward improved KDB interface
+
+* Improved API for verifying and interrogating authorization data
+
+Performance:
+
+* Investigate and remedy repeatedly-reported performance bottlenecks.
+
+* Encryption performance -- new crypto API with opaque key structures,
+ to allow for optimizations such as caching of derived keys
+
+End-user experience:
+
+* Reduce DNS dependence by implementing an interface that allows
+ client library to track whether a KDC supports service principal
+ referrals.
+
+Administrator experience:
+
+* Disable DES by default -- this reduces security exposure from using
+ an increasingly insecure cipher.
+
+* More versatile crypto configuration, to simplify migration away from
+ DES -- new configuration syntax to allow inclusion and exclusion of
+ specific algorithms relative to a default set.
+
+* Account lockout for repeated login failures -- mitigates online
+ password guessing attacks, and helps with some enterprise regulatory
+ compliance.
+
+Protocol evolution:
+
+* FAST enhancements -- preauthentication framework enhancements
+
+* Microsoft Services for User (S4U) compatibility: S4U2Self, also
+ known as "protocol transition", allows for service to ask a KDC for
+ a ticket to themselves on behalf of a client authenticated via a
+ different means; S4U2Proxy allows a service to ask a KDC for a
+ ticket to another service on behalf of a client.
+
+* Anonymous PKINIT -- allows the use of public-key cryptography to
+ anonymously authenticate to a realm
+
krb5-1.8 changes by ticket ID
-----------------------------
+5468 delete kadmin v1 support
+6206 new API for storing extra per-principal data in ccache
+6434 krb5_cc_resolve() will crash if a null name param is provided
+6454 Make krb5_mkt_resolve error handling work
+6510 Restore limited support for static linking
+6539 Enctype list configuration enhancements
+6547 Modify kadm5 initializers to accept krb5 contexts
+6563 Implement s4u extensions
+6564 s4u extensions integration broke test suite...
+6565 HP-UX IA64 wrong endian
+6572 Implement GSS naming extensions and authdata verification
+6576 Implement new APIs to allow improved crypto performance
+6577 Account lockout for repeated login failures
+6578 Heimdal DB bridge plugin for KDC back end
+6580 Constrained delegation without PAC support
+6582 Memory leak in _kadm5_init_any introduced with ipropd
+6583 Unbundle applications into separate repository
+6586 libkrb5 support for non-blocking AS requests
+6590 allow testing even if name->addr->name mapping doesn't work
+6591 fix slow behavior on Mac OS X with link-local addresses
+6593 Remove dependency on /bin/csh in test suite
+6595 FAST (preauth framework) negotiation
+6597 Add GSS extensions to store credentials, generate random bits
+6605 PKINIT client should validate SAN for TGS, not service principal
+6606 allow testing when offline
+6607 anonymous PKINIT
+6616 Fix spelling and hyphen errors in man pages
+6618 Support optional creation of PID files for krb5kdc and kadmind
+6620 kdc_supported_enctypes does nothing; eradicate mentions thereof
+6621 disable weak crypto by default
+
Copyright and Other Legal Notices
---------------------------------
diff --git a/doc/definitions.texinfo b/doc/definitions.texinfo
index 2db0add..9032a9d 100644
--- a/doc/definitions.texinfo
+++ b/doc/definitions.texinfo
@@ -19,8 +19,8 @@
@set RANDOMUSER johndoe
@set RANDOMUSER1 jennifer
@set RANDOMUSER2 david
-@set RELEASE 1.6
-@set PREVRELEASE 1.5
+@set RELEASE 1.8
+@set PREVRELEASE 1.7
@set INSTALLDIR /usr/@value{LCPRODUCT}
@set PREVINSTALLDIR @value{INSTALLDIR}
@set ROOTDIR /usr/local
diff --git a/src/patchlevel.h b/src/patchlevel.h
index e1b179e..c538abc 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -53,6 +53,6 @@
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 8
#define KRB5_PATCHLEVEL 0
-#define KRB5_RELTAIL "prerelease"
+#define KRB5_RELTAIL "alpha1"
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "branches/krb5-1-8"
+#define KRB5_RELTAG "tags/krb5-1-8-alpha1"
13 years, 1 month