Thu Aug 03 12:22:34 1995 Chris Provenzano (proven@mit.edu) * do_as_req.c : Fix bug from new kdb changes. * kerberos_v4.c : Use new db format. Thu Aug 3 11:49:35 EDT 1995 Paul Park (pjpark@mit.edu) * do_as_req.c - Ensure that padata is null with normal salt. * kerberos_v4.c - Give the compiler something to compile when Kerberos V4 is disabled. Thu Jul 27 15:10:58 EDT 1995 Paul Park (pjpark@mit.edu) * configure.in - Add --with-vague-errors and --with-kdc-kdb-update which define KRBCONF_VAGUE_ERRORS and KRBCONF_KDC_MODIFIES_KDB which replace the definitions that used to be in k5-config.h. * kdc_util.c - Cast argument to fetch_asn1_field which caused a compiler moan. * kerberos_v4.c - Use KRB5_PROTOTYPE for v4_klog which is set correctly for the compiler. Some compilers (e.g. OSF/1 native) understand prototypes even when not in STDC mode. Also use KRB5_MIT_DES_KEYSIZE instead of MIT_DES_KEYSIZE. Thu Jul 27 02:59:05 1995 Chris Provenzano (proven@mit.edu) * do_as_req.c do_tgs_req.c kdc_util.c main.c : Use new kdb format. Mon Jul 17 15:13:09 EDT 1995 Paul Park (pjpark@mit.edu) * main.c - Gut KDC profile handling logic and move it to lib/kadm/ alt_prof.c because it's now used by admin and kadmin programs. Remove explicit stash file handling logic and supply stash file name to krb5_db_fetch_mkey() since it can now handle a non-default stash file name. Thu Jul 13 19:51:33 1995 Sam Hartman * main.c: Include netinet/in.h if we're using IP. Wed Jul 12 12:19:44 EDT 1995 Paul Park (pjpark@mit.edu) * main.c - Reorganize KDC profile handling so that the hierarchy for locating per-realm data is [realms]->realm->tag. Add [kdcdefaults] section with primary_ports and secondary_ports to list ports to listen on. Consolidate all port location here from network.c. Add -s flag and change meaning of -p flag to be the default if none specified in KDC or Kerberos profile. * network.c - Open list of primary ports and then per-realm ports. Handle secondary ports just like primary ports except that bind failures are only warnings. Support more than one secondary port. * extern,kdc_util.h - Add supporting definitions. * krb5kdc.M - update description of -p and add description of -s. Tue Jul 11 07:35:12 1995 Ezra Peisach * kerberos_v4.c: Add prototype for set_tgtkey Mon Jul 10 17:01:15 1995 Ezra Peisach * kerberos_v4.c: Add prototypes for compat_decrypt_key, kerb_get_principal, check_princ, v4_klog * network.c (process_packet): Make prog a const char *. * main.c: Add prototypes for find_realm_data, setup_server_realm, usage, request_exit, setup_signal_handlers, initialize_realms, finish_realms. * kdc_util.h: Add prototypes for against_local_policy_as, against_local_policy_tgs, validate_as_request, validate_tgs_request, fetch_asn1_field, kdc_initialize_rcache, process_packet. Sat Jul 8 17:40:10 1995 Theodore Y. Ts'o (tytso@dcl) * kerberos_v4.c (v4_klog): Also log L_KRB_PERR error messages, so we know when there are protocol problems. Fri Jul 7 16:05:57 EDT 1995 Paul Park (pjpark@mit.edu) * Makefile.in - Remove all explicit library handling and LDFLAGS. * configure.in - Add USE_ and KRB5_LIBRARIES. * kdc_util.c(comp_cksum) - Use krb5_verify_checksum to verify cksum. Fri Jun 30 14:38:09 EDT 1995 Paul Park (pjpark@mit.edu) * configure.in - Add --with-dbm to select between Berkeley and DBM KDC database format. Thu Jun 29 06:50:08 1995 Mark Eichin * kerberos_v4.c (check_princ): delete master_key_version check, since we never actually set it. (main): elide original V4 server code to avoid confusion when looking for variable references. (type_2_v5err): reformat for 79 columns instead of 80 and conditionalize out since it is unused (though still informative.) Tue Jun 27 15:59:48 EDT 1995 Paul Park (pjpark@mit.edu) * main.c - Change profile name hierarchy storage to const char *. Add signal name argument to signal handler to conform to prototype. * kerberos_v4.c - Cast key to (char *) to conform to prototype. Thu Jun 22 15:24:16 EDT 1995 Paul Park (pjpark@mit.edu) * main.c - Change option parsing logic to support multiple realms. Use alternate profile routines from libkadm to support reading values from it. * dispatch.c - Setup global realm context before calling process_as_ req(). * do_as_req.c - Change KDB_CONVERT_KEY_OUTOF_DB to decrypt_key call. * do_tgs_req.c - Setup global realm context from our service principal name. * extern.c - Remove per-realm global data. Replace this with list of per-realm data with a pointer to the active request's realm. * extern.h - Change per-realm global data names to #define's. This is to avoid having to rewrite everything to pass a pointer to the active realm. * kdc_util.c - Change "kdc_context" to "kcontext" because of #defines in extern.h. Also add logic after call to rd_req_decoded to see if it failed because of a rcache error. If so, then reinitialize the replay cache and retry it. Also change KDB_CONVERT_KEY_OUTOF_DB to decrypt_key. * kerberos_v4.c - Remove extraneous definition of master_encblock. * krb5kdc.M - Add definition of -p, add vague reference to kdc.conf manpage and describe multiple realms briefly. * network.c - Change udp_port_fd to a list of fds to support having multiple ports to listen on. Thu Jun 15 17:55:21 EDT 1995 Paul Park (pjpark@mit.edu) * Makefile.in - Change explicit library names to -l form, and change target link line to use $(LD) and associated flags. Also, remove DBMLIB, it was not used. Also, for K4, use KRB4_LIB and KRB4_CRYPTO_LIB, these were split out. * configure.in - Remove dbm library checks, these are no longer needed with the Berkeley database code. Also, add shared library usage check. Tue Jun 13 12:44:20 1995 Sam Hartman * network.c: Base inclusion of sys/select.h on whether it exists instead of a specific test for AIX. * configure.in: Test for sys/select.h Mon Jun 12 20:01:23 1995 Ezra Peisach * kdc_util.c (kdc_process_tgs_req): Set the auth_context rcache to null before freeing auth_context. This keeps the rcache valid. Sat Jun 10 23:04:31 1995 Tom Yu (tlyu@dragons-lair) * kdc_util.c: krb5_auth_context redefinitions Fri Jun 9 19:13:08 1995 * dispatch.c, kdc_util.h, kerberos_v4.c: Use KRB5_KRB4_COMPAT instead of KRB4 for determining whether to compile in Kerberos V4 backwards compatibility * configure.in: Remove standardized set of autoconf macros, which are now handled by CONFIG_RULES. Thu Jun 8 23:35:27 1995 * do_as_req.c, do_tgs_req.c, kdc_util.c, kerberos_v4.c, main.c, network.c: Fix -Wall nits. Thu Jun 8 14:52:40 EDT 1995 Paul Park (pjpark@mit.edu) * Makefile.in - Add libkadm. * dispatch.c, do_as_req.c, do_tgs_req.c, kdc_util.c, kerberos_v4.c main.c - Include adm_proto.h and change syslog calls to calls to krb5_klog_syslog. Fri May 26 17:50:39 EDT 1995 Paul Park (pjpark@mit.edu) * Makefile.in - Define KDBDEPLIB. Sat May 20 22:28:52 1995 Ezra Peisach * kerberos_v4.c: Port to OSF/1. (change longs to KRB4_32) Sat Apr 29 00:13:16 1995 Theodore Y. Ts'o * kdc_util.c (kdc_process_tgs_req): Make sure apreq->ticket gets freed, since it isn't being passed back to the caller (anymore). Fri Apr 28 21:28:45 1995 Theodore Y. Ts'o * do_tgs_req.c (process_tgs_req): Free header_ticket when we're done with it. (Prevents massive memory leak). * Makefile.in (depend): Use $(LD) instead of $(CC) so that we can do purify checking. Fri Apr 28 18:05:52 1995 Mark Eichin * Makefile.in (KLIB): put KRB4_LIB inside KLIB. Thu Apr 27 13:52:22 1995 Mark Eichin * Makefile.in (krb5kdc): use KRB4_LIB directly. * configure.in: use WITH_KRB4 as-is. Wed Apr 26 11:23:11 1995 Mark Eichin * configure.in: need HAS_ANSI_VOLATILE for signal_requests_exit. Sat Apr 22 00:36:37 1995 Theodore Y. Ts'o (tytso@dcl) * network.c (setup_network): Don't rely on krb5_kdc_portname and krb5_kdc_sec_portname anymore. Use the #define'd versions. Fri Mar 31 16:50:07 1995 Theodore Y. Ts'o (tytso@dcl) * main.c (main): Make sure the context is initialized before it is used. Mon Mar 27 07:56:26 1995 Chris Provenzano (proven@mit.edu) * kdc_util.c Use new calling conventions for krb5_rd_req_decoded(). Fri Mar 24 14:58:07 1995 * replay.c: The KDC replay cache needs to store the database modification time, so that if the database is modified in between when it receives a request and when it receives a replay of the same request, it knows to throw away the replay cache entry and generate a new response (since the record in the database on which the response is based may have been modified). * main.c (kdc_com_err_proc): Use syslog() instead of vsyslog(). Sat Mar 18 18:59:45 1995 John Gilmore (gnu at toad.com) * kerberos_v4.c: Replace STDARG_PROTOTYPES with HAVE_STDARG_H. Tue Mar 14 15:25:38 1995 * configure.in, Makefile.in: Use the libdes425 library so that the DES code doesn't get dragged in twice. * kdc_util.c (validate_as_request): Allow a client to obtain a password changing ticket, even if the client's key is expired. * main.c (usage, process_args, main): The KDC will disassociate itself from the terminal by default, unless the -n option is given. Thu Mar 2 12:16:50 1995 Theodore Y. Ts'o * Makefile.in (ISODELIB): Remove reference to $(ISODELIB). Wed Mar 1 16:30:27 1995 Theodore Y. Ts'o * configure.in: Remove ISODE_INCLUDE and ISODE_DEFS, replace check for -lsocket and -lnsl with WITH_NETLIB check. Tue Feb 28 02:27:11 1995 John Gilmore (gnu at toad.com) * *.[ch]: Avoid and includes. Fri Feb 10 14:35:42 1995 Theodore Y. Ts'o * do_tgs_req.c (process_tgs_req): krb5_use_keytype() was being called when the argument was a encryption type. Change use to krb5_use_cstype(). Actually, any use of krb5_use_keytype() is a bug by definition. Wed Feb 01 21:07:03 1995 Chris Provenzano (proven@mit.edu) * kdc_util.c (kdc_rdreq_keyproc()) Add krb5_keytype() arg. Wed Jan 25 23:20:07 1995 Theodore Y. Ts'o (tytso@dcl) * network.c (setup_network), main.c (process_args): Allow the primary port that the KDC listens on be configurable on the command line. If the appropriate /etc/services entries aren't found, use compiled in defaults. Wed Jan 25 16:54:40 1995 Chris Provenzano (proven@mit.edu) * Removed all narrow types and references to wide.h and narrow.h Fri Jan 13 15:23:47 1995 Chris Provenzano (proven@mit.edu) * Added krb5_context to all krb5_routines Thu Dec 8 00:33:05 1994 * do_tgs_req.c (prepare_error_tgs): Don't free the passed in ticket; it will be freed as part of other structures. * do_tgs_req.c (process_tgs_req): Set the encryption type in the reply structure, and set the eblock type accordingly. Wed Dec 7 13:36:34 1994 * do_as_req.c (process_as_req): Set the encryption type in the reply_encpart structure. * kdc_util.c (validate_as_request): * policy.c (against_local_policy_as): Move requirement that an AS request must include the addresses field to the local policy routine. (Not required by RFC). * main.c (setup_com_err): Initialize the kdc5 error table (the kdb5 error table is already initialized) Wed Nov 30 16:37:26 1994 Theodore Y. Ts'o (tytso@dcl) * confiugre.in: Add appropriate help text for --with-krb4 option. Mon Nov 21 17:23:50 1994 Theodore Y. Ts'o (tytso@dcl) * do_tgs_req.c (process_tgs_req): * do_as_req.c (process_as_req): Use the list of encryption types passed as part of the KDC request to determine which encryption to use for encrypting the ticket. The encryption must be one that is supported by the KDC, as well as being one which is marked as being supported by the server of the ticket. In a AS request, also use this encryption for encrypting the KDC response. In a TGS request, use the encryption type of the TGT authenticator to determine how to encrypt the KDC response. Tue Nov 8 17:51:30 1994 Theodore Y. Ts'o (tytso@dcl) * do_tgs_req.c (process_tgs_req): Use published interface to call krb5_random_key(). Mon Nov 7 22:11:01 1994 Theodore Y. Ts'o (tytso@dcl) * kerberos_v4.c: Don't define functions manually, but pull in the appropriate include files (com_err.h, krb5/ext-proto.h, krb5/los-proto.h, etc.) * kdc_util.c (kdc_process_tgs_req): Fix lineage check so that we don't fail if we're cross-authenticating with a realm with the same length as our own. ('||' should have been '&&') Fri Nov 4 17:47:46 1994 Theodore Y. Ts'o (tytso@dcl) * do_as_req.c (process_as_req): Use published interface to call krb5_random_key(). Fri Oct 14 00:31:14 1994 Theodore Y. Ts'o (tytso@dcl) * main.c (process_args): Select the cryptosystem to be used using krb5_use_cstype() instead of using a implementation specific assignment. Also, allow the encryption type to be specified using a command line option. Tue Oct 11 22:11:09 1994 Theodore Y. Ts'o (tytso@dcl) * do_as_req.c (process_as_req): Don't assume that the request server's realm name is null terminated. Compare the request server against changepw/kerberos using krb5_principal_compare. Tue Oct 4 16:42:16 1994 Theodore Y. Ts'o (tytso@dcl) * kdc_util.c (kdc_rdreq_keyproc): Add widen.h and narrow.h around keyproc call so that the argument types are widened. Mon Oct 3 13:13:48 1994 Theodore Y. Ts'o (tytso@dcl) * Makefile.in: Use $(srcdir) to find manual page for make install. * Makefile.in: Remove krb5kdc on make clean Fri Sep 30 22:13:13 1994 Theodore Y. Ts'o (tytso@dcl) * extern.c: Add placeholder for magic number Thu Sep 29 00:03:59 1994 Theodore Y. Ts'o (tytso@dcl) * Makefile.in: Relink executable when library changes. Wed Sep 21 17:40:56 1994 Theodore Y. Ts'o (tytso@dcl) * kdc_util.c, kdc_util.h (realm_compare): Change realm_compare so that both arguments are principals. This makes it less confusing.... * kdc_util.c (add_to_transited): Folded in Tony Andrea's changes so that add_to_transited doesn't assume that the contents of a krb5_data->data are null terminated. * do_tgs_req.c (process_tgs_req): Add the realm of the presented tgt if it is different from the local realm (cross-realm) and it is different than the realm of the client (since the realm of the client is already implicitly part of the transited list and should not be explicitly listed). Thu Aug 18 18:17:59 1994 Theodore Y. Ts'o (tytso at tsx-11) * configure.in: * Makefile.in: Move optional link with $(KRB4)/lib/libdes.a to configure.in. Thu Aug 4 15:13:27 1994 Tom Yu (tlyu@dragons-lair) * configure.in: * kerberos_v4.c: don't include if POSIX_TERMIOS is defined. Sat Jul 16 09:16:33 1994 Tom Yu (tlyu at dragons-lair) * configure.in: hopefully make dbm libs dtrt Sat Jul 16 01:59:02 1994 Theodore Y. Ts'o (tytso at tsx-11) * do_as_req.c: Sanitie error return codes * kdc_util.c (validate_tgs_request): Fix error handling for bogus TGS renew/forward/etc. requests. Sanitize error return codes. Fri Jul 8 00:33:45 1994 Tom Yu (tlyu at dragons-lair) * configure.in: * Makefile.in: back out changes because of possible breakage under Ultrix, among other things Wed Jul 6 22:54:59 1994 Tom Yu (tlyu at dragons-lair) * configure.in: * Makefile.in: fixes to suck in -lndbm or -ldbm if needed Tue Jun 28 19:43:54 1994 Tom Yu (tlyu at dragons-lair) * main.c: fix explicit calls to initialize_foo_error_table * do_tgs_req.c: * configure.in: folding in Harry's changes