authhub-commits

authhub-commits@lists.fedorahosted.org

93 discussions

[AuthHub/krb5-1-8: 91/111] ticket: 6750 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 256fde166deb74b2b40a5afdaa14729624430aa8 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:48 2010 +0000 ticket: 6750 version_fixed: 1.8.3 status: resolved pull up r24176 from trunk ------------------------------------------------------------------------ r24176 | ghudson | 2010-07-07 16:52:06 -0400 (Wed, 07 Jul 2010) | 7 lines ticket: 6750 target_version: 1.8.3 tags: pullup Add a missing break in the parsing of krb5kdc's -P option. Reported by nalin(a)redhat.com. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24197 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/main.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/main.c b/src/kdc/main.c index 9d8022a..c739964 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c @@ -728,6 +728,7 @@ initialize_realms(krb5_context kcontext, int argc, char **argv) break; case 'P': pid_file = optarg; + break; case 'p': if (default_udp_ports) free(default_udp_ports);

1 0

[AuthHub/krb5-1-8: 90/111] ticket: 6745 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit c49301ae36e35d5ebf07798a82a805b982403144 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:44 2010 +0000 ticket: 6745 version_fixed: 1.8.3 status: resolved pull up r24139 from trunk ------------------------------------------------------------------------ r24139 | ghudson | 2010-06-21 11:18:37 -0400 (Mon, 21 Jun 2010) | 12 lines ticket: 6745 subject: Add correct error table when initializing gss-krb5 target_version: 1.8.3 tags: pullup gss_krb5int_lib_init was adding the generic GSS error table (again) instead of the krb5 error table, which could lead to crashes on library unload. This bug was introduced in krb5 1.7; the fix is also applicable there. Patch from Leonardo Chiquitto <leonardo.lists(a)gmail.com>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24196 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/gssapi_krb5.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c index 9e5ba76..0420085 100644 --- a/src/lib/gssapi/krb5/gssapi_krb5.c +++ b/src/lib/gssapi/krb5/gssapi_krb5.c @@ -740,7 +740,7 @@ int gss_krb5int_lib_init(void) printf("gss_krb5int_lib_init\n"); #endif - add_error_table(&et_ggss_error_table); + add_error_table(&et_k5g_error_table); #ifndef LEAN_CLIENT err = k5_mutex_finish_init(&gssint_krb5_keytab_lock);

1 0

[AuthHub/krb5-1-8: 89/111] ticket: 6744 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1898f9f52ae2c6897b9f6f61205aa9b5d9e0520e Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:41 2010 +0000 ticket: 6744 version_fixed: 1.8.3 status: resolved pull up r24138 from trunk ------------------------------------------------------------------------ r24138 | tlyu | 2010-06-18 15:41:48 -0400 (Fri, 18 Jun 2010) | 13 lines ticket: 6744 subject: only test t_locate_kdc if known-good DNS name is present target_version: 1.8.3 tags: pullup Running "make check" while offline or on a firewalled network may result in failure in lib/krb5/os because the invocation of t_locate_kdc requires that the DNS servers for ATHENA.MIT.EDU be reachable. Autodetect DNS utilities "dig" and "nslookup", and use them to check for existence of the known-good DNS name. Also parameterize the test so that the known-good DNS name can be overridden on the make command line. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24195 dc483132-0cff-0310-8789-dd5450dbe970 src/configure.in | 5 +++++ src/lib/krb5/os/Makefile.in | 26 ++++++++++++++++++++------ 2 files changed, 25 insertions(+), 6 deletions(-) --- diff --git a/src/configure.in b/src/configure.in index d4647cb..e353065 100644 --- a/src/configure.in +++ b/src/configure.in @@ -662,6 +662,11 @@ int main () { AC_MSG_RESULT($ac_cv_printf_positional) +# for t_locate_kdc test + +AC_PATH_PROG(DIG, dig, false) +AC_PATH_PROG(NSLOOKUP, nslookup, false) + # for kadmin AC_PROG_YACC diff --git a/src/lib/krb5/os/Makefile.in b/src/lib/krb5/os/Makefile.in index 6a1ffd1..4da3ebf 100644 --- a/src/lib/krb5/os/Makefile.in +++ b/src/lib/krb5/os/Makefile.in @@ -189,7 +189,9 @@ lclint-localaddr: localaddr.c $(LCLINT) $(LCLINTOPTS) $(CPPFLAGS) $(LOCALINCLUDES) $(DEFS) \ -DTEST $(srcdir)/localaddr.c -check-unix:: $(TEST_PROGS) +check-unix:: check-unix-stdconf check-unix-locate check-unix-antoln + +check-unix-stdconf:: t_std_conf KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ $(KRB5_RUN_ENV) $(VALGRIND) ./t_std_conf -d -s NEW.DEFAULT.REALM -d \ -k IGGY.ORG -k DEFAULT_REALM.TST \ @@ -198,17 +200,29 @@ check-unix:: $(TEST_PROGS) -r pgp.good.idea -r no_domain > test.out cmp test.out $(srcdir)/ref_std_conf.out $(RM) test.out - KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ - if test "$(OFFLINE)" != yes; then \ - $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc ATHENA.MIT.EDU; \ + +# The following can be overriden on the make command line if needed: +LOCREALM = ATHENA.MIT.EDU +SRVNAME = _kerberos._udp.athena.mit.edu. +DIGPAT = '^_kerberos.*srv' +NSPAT = '^_kerberos.*service' +DIG = @DIG@ +NSLOOKUP = @NSLOOKUP@ + +check-unix-locate:: t_locate_kdc + if [ "$(OFFLINE)" = no ] && \ + $(DIG) $(SRVNAME) srv | grep -i $(DIGPAT) || \ + $(NSLOOKUP) -q=srv $(SRVNAME) | grep -i $(NSPAT); then \ + KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ + $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc $(LOCREALM); \ else \ - echo SKIPPING t_locate_kdc TEST WHILE OFFLINE; \ + echo '*** WARNING: skipped t_locate_kdc test: known DNS name not found'; \ fi # # Do some aname-to-lname testing. # -check-unix:: +check-unix-antoln:: t_an_to_ln echo '[libdefaults]' > ./t_an.conf echo ' default_realm = r' >> ./t_an.conf echo '[realms]' >> ./t_an.conf

1 0

[AuthHub/krb5-1-8: 88/111] ticket: 6738 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 80833cb9e6d3f6a1d61b168af91c26c5f7a07178 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:35 2010 +0000 ticket: 6738 version_fixed: 1.8.3 status: resolved pull up r24137 from trunk ------------------------------------------------------------------------ r24137 | ghudson | 2010-06-14 16:46:27 -0400 (Mon, 14 Jun 2010) | 7 lines ticket: 6738 target_version: 1.8.3 tags: pullup In PKINIT, notice if DH_compute_key() returns a value less than the buffer size, and pad it on the left if so. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24194 dc483132-0cff-0310-8789-dd5450dbe970 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) --- diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c index d000466..af09d69 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -2092,6 +2092,22 @@ cleanup: return retval; } +/* Call DH_compute_key() and ensure that we left-pad short results instead of + * leaving junk bytes at the end of the buffer. */ +static void +compute_dh(unsigned char *buf, int size, BIGNUM *server_pub_key, DH *dh) +{ + int len, pad; + + len = DH_compute_key(buf, server_pub_key, dh); + assert(len >= 0 && len <= size); + if (len < size) { + pad = size - len; + memmove(buf + pad, buf, len); + memset(buf, 0, pad); + } +} + krb5_error_code client_create_dh(krb5_context context, pkinit_plg_crypto_context plg_cryptoctx, @@ -2243,7 +2259,7 @@ client_process_dh(krb5_context context, if ((server_pub_key = ASN1_INTEGER_to_BN(pub_key, NULL)) == NULL) goto cleanup; - DH_compute_key(*client_key, server_pub_key, cryptoctx->dh); + compute_dh(*client_key, *client_key_len, server_pub_key, cryptoctx->dh); #ifdef DEBUG_DH print_pubkey(server_pub_key, "server's pub_key="); pkiDebug("client secret key (%d)= ", *client_key_len); @@ -2378,7 +2394,7 @@ server_process_dh(krb5_context context, *server_key_len = DH_size(dh_server); if ((*server_key = malloc(*server_key_len)) == NULL) goto cleanup; - DH_compute_key(*server_key, dh->pub_key, dh_server); + compute_dh(*server_key, *server_key_len, dh->pub_key, dh_server); #ifdef DEBUG_DH print_dh(dh_server, "client&server's DH params\n");

1 0

[AuthHub/krb5-1-8: 87/111] ticket: 6740 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 6cf770c1f98e5747e187481fe504ff7f29b32591 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 21:14:34 2010 +0000 ticket: 6740 version_fixed: 1.8.3 status: resolved pull up r24123 from trunk ------------------------------------------------------------------------ r24123 | ghudson | 2010-06-08 14:18:03 -0400 (Tue, 08 Jun 2010) | 11 lines ticket: 6740 subject: kadmin ktadd may display wrong name of default keytab target_version: 1.8.2 tags: pullup kadmin's ktadd (and ktrem) displays WRFILE:/etc/krb5.keytab whenever it uses the default keytab, even if the default has been overridden (e.g. by KRB5_KTNAME). Use krb5_kt_get_name to get the correct name of the default cache instead of displaying the string we think was used to open it. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24131 dc483132-0cff-0310-8789-dd5450dbe970 src/kadmin/cli/kadmin.h | 1 - src/kadmin/cli/keytab.c | 10 +++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) --- diff --git a/src/kadmin/cli/kadmin.h b/src/kadmin/cli/kadmin.h index 5c9decc..9f657a6 100644 --- a/src/kadmin/cli/kadmin.h +++ b/src/kadmin/cli/kadmin.h @@ -68,7 +68,6 @@ extern time_t get_date(char *); /* Yucky global variables */ extern krb5_context context; -extern char *krb5_defkeyname; extern char *whoami; extern void *handle; diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c index 8d14f86..1f81032 100644 --- a/src/kadmin/cli/keytab.c +++ b/src/kadmin/cli/keytab.c @@ -84,9 +84,7 @@ process_keytab(krb5_context my_context, char **keytab_str, char *name = *keytab_str; if (name == NULL) { - /* XXX krb5_defkeyname is an internal library global and - should go away */ - name = strdup(krb5_defkeyname); + name = malloc(BUFSIZ); if (!name) { com_err(whoami, ENOMEM, "while creating keytab name"); return 1; @@ -97,6 +95,12 @@ process_keytab(krb5_context my_context, char **keytab_str, free(name); return 1; } + code = krb5_kt_get_name(my_context, *keytab, name, BUFSIZ); + if (code != 0) { + com_err(whoami, code, "while getting keytab name"); + free(name); + return 1; + } } else { if (strchr(name, ':') != NULL) name = strdup(name);

1 0

[AuthHub/krb5-1-8: 86/111] ticket: 6739 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 67952a359d7008eedfa7d488886048460732c853 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 21:14:26 2010 +0000 ticket: 6739 version_fixed: 1.8.3 status: resolved pull up r24120, r24121 from trunk ------------------------------------------------------------------------ r24120 | ghudson | 2010-06-08 12:14:24 -0400 (Tue, 08 Jun 2010) | 12 lines ticket: 6739 target_version: 1.8.2 tags: pullup Stop checking the current time against the context expiration time in the message wrap/unwrap functions in the krb5 GSS mech. Heimdal doesn't do it, and it generally results in poor app behavior when a ticket expires. In exchange, it doesn't provide much security benefit since it's not enforced across the board--for example, ssh sessions can persist beyond ticket expiration time since they don't use GSS to wrap payload data. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24130 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/k5seal.c | 9 +-------- src/lib/gssapi/krb5/k5sealiov.c | 12 ++---------- src/lib/gssapi/krb5/k5unseal.c | 11 ----------- src/lib/gssapi/krb5/k5unsealiov.c | 14 -------------- 4 files changed, 3 insertions(+), 43 deletions(-) --- diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c index 51faaaa..18c83df 100644 --- a/src/lib/gssapi/krb5/k5seal.c +++ b/src/lib/gssapi/krb5/k5seal.c @@ -328,7 +328,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, { krb5_gss_ctx_id_rec *ctx; krb5_error_code code; - krb5_timestamp now; krb5_context context; output_message_buffer->length = 0; @@ -359,12 +358,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, } context = ctx->k5_context; - if ((code = krb5_timeofday(context, &now))) { - *minor_status = code; - save_error_info(*minor_status, context); - return(GSS_S_FAILURE); - } - switch (ctx->proto) { case 0: @@ -396,5 +389,5 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, *conf_state = conf_req_flag; *minor_status = 0; - return((ctx->krb_times.endtime < now)?GSS_S_CONTEXT_EXPIRED:GSS_S_COMPLETE); + return(GSS_S_COMPLETE); } diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c index 9ff823e..c15e4e7 100644 --- a/src/lib/gssapi/krb5/k5sealiov.c +++ b/src/lib/gssapi/krb5/k5sealiov.c @@ -279,7 +279,6 @@ kg_seal_iov(OM_uint32 *minor_status, { krb5_gss_ctx_id_rec *ctx; krb5_error_code code; - krb5_timestamp now; krb5_context context; if (qop_req != 0) { @@ -298,19 +297,12 @@ kg_seal_iov(OM_uint32 *minor_status, return GSS_S_NO_CONTEXT; } - context = ctx->k5_context; - code = krb5_timeofday(context, &now); - if (code != 0) { - *minor_status = code; - save_error_info(*minor_status, context); - return GSS_S_FAILURE; - } - if (conf_req_flag && kg_integ_only_iov(iov, iov_count)) { /* may be more sensible to return an error here */ conf_req_flag = FALSE; } + context = ctx->k5_context; switch (ctx->proto) { case 0: code = make_seal_token_v1_iov(context, ctx, conf_req_flag, @@ -333,7 +325,7 @@ kg_seal_iov(OM_uint32 *minor_status, *minor_status = 0; - return (ctx->krb_times.endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; + return GSS_S_COMPLETE; } #define INIT_IOV_DATA(_iov) do { (_iov)->buffer.value = NULL; \ diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c index b56cd2d..5fa52fe 100644 --- a/src/lib/gssapi/krb5/k5unseal.c +++ b/src/lib/gssapi/krb5/k5unseal.c @@ -79,7 +79,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, krb5_checksum md5cksum; krb5_data plaind; char *data_ptr; - krb5_timestamp now; unsigned char *plain; unsigned int cksum_len = 0; size_t plainlen; @@ -441,16 +440,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, if (qop_state) *qop_state = GSS_C_QOP_DEFAULT; - if ((code = krb5_timeofday(context, &now))) { - *minor_status = code; - return(GSS_S_FAILURE); - } - - if (now > ctx->krb_times.endtime) { - *minor_status = 0; - return(GSS_S_CONTEXT_EXPIRED); - } - /* do sequencing checks */ if ((ctx->initiate && direction != 0xff) || diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c index a489f0d..2be7b82 100644 --- a/src/lib/gssapi/krb5/k5unsealiov.c +++ b/src/lib/gssapi/krb5/k5unsealiov.c @@ -52,7 +52,6 @@ kg_unseal_v1_iov(krb5_context context, int signalg; krb5_checksum cksum; krb5_checksum md5cksum; - krb5_timestamp now; size_t cksum_len = 0; size_t conflen = 0; int direction; @@ -280,19 +279,6 @@ kg_unseal_v1_iov(krb5_context context, if (qop_state != NULL) *qop_state = GSS_C_QOP_DEFAULT; - code = krb5_timeofday(context, &now); - if (code != 0) { - *minor_status = code; - retval = GSS_S_FAILURE; - goto cleanup; - } - - if (now > ctx->krb_times.endtime) { - *minor_status = 0; - retval = GSS_S_CONTEXT_EXPIRED; - goto cleanup; - } - if ((ctx->initiate && direction != 0xff) || (!ctx->initiate && direction != 0)) { *minor_status = (OM_uint32)G_BAD_DIRECTION;

1 0

[AuthHub/krb5-1-8: 85/111] krb5-1.8.2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 7b6f4e1a0e819ed80c3e474a67f9371baa7ed1c0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 18:29:35 2010 +0000 krb5-1.8.2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24129 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index e8a08c0..72e202b 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-2-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 84/111] README and patchlevel for krb5-1.8.2
by sbose 15 Mar '11

15 Mar '11

commit 482967a673cede9d0140d8b5ead78a2e6397bdcb Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 18:14:11 2010 +0000 README and patchlevel for krb5-1.8.2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24127 dc483132-0cff-0310-8789-dd5450dbe970 README | 2 ++ src/patchlevel.h | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) --- diff --git a/README b/README index fddc00b..9310c2d 100644 --- a/README +++ b/README @@ -324,6 +324,7 @@ Past and present Sponsors of the MIT Kerberos Consortium: Microsoft The National Aeronautics and Space Administration of the United States of America (NASA) + Network Appliance (NetApp) Nippon Telephone and Telegraph (NTT) Oracle Pennsylvania State University @@ -332,6 +333,7 @@ Past and present Sponsors of the MIT Kerberos Consortium: TeamF1, Inc. The University of Alaska The University of Michigan + The University of Pennsylvania Past and present members of the Kerberos Team at MIT: diff --git a/src/patchlevel.h b/src/patchlevel.h index f84a0c9..e8a08c0 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -#define KRB5_RELTAIL "beta1-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-2-final"

1 0

[AuthHub/krb5-1-8: 83/111] krb5-1.8.2-beta1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 590e098f27a61cabc3b9ebd41dee5d15100bc6b3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 23:00:02 2010 +0000 krb5-1.8.2-beta1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24114 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 44bc2d3..f84a0c9 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -#define KRB5_RELTAIL "beta1" +#define KRB5_RELTAIL "beta1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-2-beta1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 82/111] README and patchlevel.h for krb5-1.8.2-beta1
by sbose 15 Mar '11

15 Mar '11

commit d4bf438c50dd6c659f8cfea343e3893a58c6e9a9 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 22:55:45 2010 +0000 README and patchlevel.h for krb5-1.8.2-beta1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24112 dc483132-0cff-0310-8789-dd5450dbe970 README | 34 +++++++++++++++++++++++++++++++++- src/patchlevel.h | 6 +++--- 2 files changed, 36 insertions(+), 4 deletions(-) --- diff --git a/README b/README index 924710c..fddc00b 100644 --- a/README +++ b/README @@ -82,6 +82,35 @@ additional measures include: crypto * easier kadmin history key changes +Major changes in 1.8.2 +---------------------- + +This is primarily a bugfix release. + +* Fix vulnerabilities: + ** CVE-2010-1320 KDC double free caused by ticket renewal + (MITKRB5-SA-2010-004) + ** CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) + +* Allow numeric IPv6 addresses for configuring KDC locations. + +krb5-1.8.2 changes by ticket ID +------------------------------- + +6562 kinit not working if kdc is configured with numerical IPv6 address +6696 gss_accept_sec_context doesn't produce error tokens +6697 segfault caused by dlerror returning NULL +6698 kproplog displays incorrect iprop timestamps on 64-bit platforms +6702 CVE-2010-1320 KDC double free caused by ticket renewal + (MITKRB5-SA-2010-004) +6711 memory leak in process_tgs_req in r23724 +6718 Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP +6722 Error handling bug in krb5_init_creds_init() +6725 CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) +6726 SPNEGO doesn't interoperate with Windows 2000 +6730 kdc_tcp_ports not documented in kdc.conf.M +6734 FAST negotiation could erroneously succeed + Major changes in 1.8.1 ---------------------- @@ -362,6 +391,7 @@ reports, suggestions, and valuable resources: Brandon Allbery Russell Allbery + Brian Almeida Michael B Allen Derek Atkins David Bantz @@ -405,6 +435,7 @@ reports, suggestions, and valuable resources: Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg + Joel Johnson Mikkel Kruse Volker Lendecke Jan iankko Lieskovsky @@ -420,9 +451,9 @@ reports, suggestions, and valuable resources: Ezra Peisach W. Michael Petullo Mark Phalan - Xu Qiang Robert Relyea Martin Rex + Jason Rogers Guillaume Rousse Tom Shaw Peter Shoults @@ -437,6 +468,7 @@ reports, suggestions, and valuable resources: Simon Wilkinson Nicolas Williams Ross Wilper + Xu Qiang Hanz van Zijst The above is not an exhaustive list; many others have contributed in diff --git a/src/patchlevel.h b/src/patchlevel.h index 904d40a..44bc2d3 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -52,7 +52,7 @@ */ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 -#define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "postrelease" +#define KRB5_PATCHLEVEL 2 +#define KRB5_RELTAIL "beta1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-2-beta1"

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits