path: root/src/kdc/ChangeLog

Sun Sep 10 10:51:29 1995  Ezra Peisach  <epeisach@kangaroo.mit.edu>

	* main.c (init_realm): When checking for master key in valid
		enctypes, do not stop after checking only the first type.

Wed Sep 06 14:20:57 1995   Chris Provenzano (proven@mit.edu)

        * do_as_req.c, do_tgs_req.c, kdc_util.c, kerberos_v4.c, main.c : 
		s/keytype/enctype/g, s/KEYTYPE/ENCTYPE/g

Tue Sep 05 22:10:34 1995   Chris Provenzano (proven@mit.edu)

        * do_as_req.c, do_tgs_req.c, kerberos_v4.c, main.c: Remove krb5_enctype
		references, and replace with krb5_keytype where appropriate.

Mon Sep  4 14:10:26 1995  Ezra Peisach  <epeisach@kangaroo.mit.edu>

	* do_as_req.c, do_tgs_req.c, kdc_util.c, kdc_util.h, policy.c: Add
		const declarations to variables pointing to error strings
		in order to make everything self consistant.

Fri Sep  1 23:28:29 1995  Theodore Y. Ts'o  <tytso@dcl>

	* kdc_preauth.c: New file, to contain the server-side
		preauthentication routines.

	* do_as_req.c (process_as_req): Move preauthentication code to
		kdc_preauth.c, for better modularity.

	* do_as_req.c (prepare_error_as): Add new argument to this
		function so that the e_data field may be passed in and
		included in the KRB_ERROR messsage which is passed back to
		the user.

Mon Aug 21 17:03:53 EDT 1995	Paul Park	(pjpark@mit.edu)
	* main.c - Interpret -k and -e arguments as strings instead of string
		representations of integers (e.g. -e des-cbc-md5).
	* krb5kdc.M - Remove "ascii representation of a decimal number".


Thu Aug 17 13:49:14 EDT 1995	Paul Park	(pjpark@mit.edu)
	* do_as_req.c - Close and re-open the database after performing a
		database update.  This is the cleanest way to flush out the
		update without reorganizing the code.

Wed Aug 16 02:45:19 1995  Chris Provenzano <proven@mit.edu>

        * do_as_req.c: Pass fds to krb5_lock_file() and krb5_unlock_file()
	* do_as_req.c: Add a missing #ifdef KRBCONF_KDC_MODIFIES_KDB
		for update_client and updating the database.

Tue Aug 15 14:32:54 EDT 1995	Paul Park	(pjpark@mit.edu)
	* extern.h - Add key/salt list to per-realm data.
	* main.c - Save or generate per-realm key/salt list.  Use this list
		to determine which key to use from the list of server keys.
		Fix gcc -Wall complaints.
	* do_as_req.c - Batch KRBCONF_KDC_MODIFIES_KDB updates after the
		response is issued.  Use krb5_dbe_find_keytype() to find the
		appropriate key in the list of keys.  Find appropriate client
		key instead of using the key in slot 0.  Fix gcc -Wall moans.
	* kdc_util.c - Use per-realm key/salt list to determine which key to
		use from the list of server keys.  Fix gcc -Wall complaints.
	* kerberos_v4.c - Use krb5_dbe_find_keytype() to find appropriate key.
		Fix gcc -Wall complaints.

Thu Aug 10 14:52:24 EDT 1995	Paul Park	(pjpark@mit.edu)
	* do_as_req.c - Add missing variable when KRBCONF_KDC_MODIFIES_KDB on.


Thu Aug 03 12:22:34 1995 Chris Provenzano (proven@mit.edu)

	* do_as_req.c : Fix bug from new kdb changes.
	* kerberos_v4.c : Use new db format.

Thu Aug 3 11:49:35 EDT 1995	Paul Park	(pjpark@mit.edu)
	* do_as_req.c - Ensure that padata is null with normal salt.
	* kerberos_v4.c - Give the compiler something to compile when Kerberos
		V4 is disabled.

Thu Jul 27 15:10:58 EDT 1995	Paul Park	(pjpark@mit.edu)
	* configure.in - Add --with-vague-errors and --with-kdc-kdb-update
		which define KRBCONF_VAGUE_ERRORS and KRBCONF_KDC_MODIFIES_KDB
		which replace the definitions that used to be in k5-config.h.
	* kdc_util.c - Cast argument to fetch_asn1_field which caused a
		compiler moan.
	* kerberos_v4.c - Use KRB5_PROTOTYPE for v4_klog which is set correctly
		for the compiler.  Some compilers (e.g. OSF/1 native) understand
		prototypes even when not in STDC mode.
		Also use KRB5_MIT_DES_KEYSIZE instead of MIT_DES_KEYSIZE.


Thu Jul 27 02:59:05 1995 Chris Provenzano (proven@mit.edu)

        * do_as_req.c do_tgs_req.c kdc_util.c main.c : Use new kdb format.

Mon Jul 17 15:13:09 EDT 1995	Paul Park	(pjpark@mit.edu)
	* main.c - Gut KDC profile handling logic and move it to lib/kadm/
		alt_prof.c because it's now used by admin and kadmin programs.
		Remove explicit stash file handling logic and supply stash
		file name to krb5_db_fetch_mkey() since it can now handle a
		non-default stash file name.

Thu Jul 13 19:51:33 1995  Sam Hartman  <hartmans@tertius.mit.edu>

	* main.c: Include netinet/in.h if we're using IP.

Wed Jul 12 12:19:44 EDT 1995	Paul Park	(pjpark@mit.edu)
	* main.c - Reorganize KDC profile handling so that the hierarchy for
		locating per-realm data is [realms]->realm->tag.  Add
		[kdcdefaults] section with primary_ports and secondary_ports
		to list ports to listen on.  Consolidate all port location here
		from network.c.  Add -s flag and change meaning of -p flag to
		be the default if none specified in KDC or Kerberos profile.
	* network.c - Open list of primary ports and then per-realm ports.
		Handle secondary ports just like primary ports except that
		bind failures are only warnings.  Support more than one
		secondary port.
	* extern,kdc_util.h - Add supporting definitions.
	* krb5kdc.M - update description of -p and add description of -s.

Tue Jul 11 07:35:12 1995  Ezra Peisach  <epeisach@kangaroo.mit.edu>

	* kerberos_v4.c: Add prototype for set_tgtkey

Mon Jul 10 17:01:15 1995  Ezra Peisach  <epeisach@kangaroo.mit.edu>

	* kerberos_v4.c: Add prototypes for compat_decrypt_key,
		kerb_get_principal, check_princ, v4_klog

	* network.c (process_packet): Make prog a const char *. 

	* main.c: Add prototypes for find_realm_data, setup_server_realm,
		usage, request_exit, setup_signal_handlers, initialize_realms,
			finish_realms. 

	* kdc_util.h: Add prototypes for against_local_policy_as,
		against_local_policy_tgs, validate_as_request,
		validate_tgs_request, fetch_asn1_field,
		kdc_initialize_rcache, process_packet.

Sat Jul  8 17:40:10 1995  Theodore Y. Ts'o  (tytso@dcl)

	* kerberos_v4.c (v4_klog): Also log L_KRB_PERR error messages, so
		we know when there are protocol problems.

Fri Jul 7 16:05:57 EDT 1995	Paul Park	(pjpark@mit.edu)
	* Makefile.in - Remove all explicit library handling and LDFLAGS.
	* configure.in - Add USE_<mumble> and KRB5_LIBRARIES.
	* kdc_util.c(comp_cksum) - Use krb5_verify_checksum to verify cksum.


Fri Jun 30 14:38:09 EDT 1995	Paul Park	(pjpark@mit.edu)
	* configure.in - Add --with-dbm to select between Berkeley and DBM
		KDC database format.

Thu Jun 29 06:50:08 1995  Mark Eichin  <eichin@cygnus.com>

	* kerberos_v4.c (check_princ): delete master_key_version check,
	since we never actually set it.
	(main): elide original V4 server code to avoid confusion when
	looking for variable references.
	(type_2_v5err): reformat for 79 columns instead of 80 and
	conditionalize out since it is unused (though still informative.)

Tue Jun 27 15:59:48 EDT 1995	Paul Park	(pjpark@mit.edu)
	* main.c - Change profile name hierarchy storage to const char *.  Add
		signal name argument to signal handler to conform to prototype.
	* kerberos_v4.c - Cast key to (char *) to conform to prototype.


Thu Jun 22 15:24:16 EDT 1995	Paul Park	(pjpark@mit.edu)
	* main.c - Change option parsing logic to support multiple realms.
		Use alternate profile routines from libkadm to support reading
		values from it.
	* dispatch.c - Setup global realm context before calling process_as_
		req().
	* do_as_req.c - Change KDB_CONVERT_KEY_OUTOF_DB to decrypt_key call.
	* do_tgs_req.c - Setup global realm context from our service principal
		name.
	* extern.c - Remove per-realm global data.  Replace this with list
		of per-realm data with a pointer to the active request's realm.
	* extern.h - Change per-realm global data names to #define's.  This
		is to avoid having to rewrite everything to pass a pointer to
		the active realm.
	* kdc_util.c - Change "kdc_context" to "kcontext" because of #defines
		in extern.h.  Also add logic after call to rd_req_decoded
		to see if it failed because of a rcache error.  If so, then
		reinitialize the replay cache and retry it.
		Also change KDB_CONVERT_KEY_OUTOF_DB to decrypt_key.
	* kerberos_v4.c - Remove extraneous definition of master_encblock.
	* krb5kdc.M - Add definition of -p, add vague reference to kdc.conf
		manpage and describe multiple realms briefly.
	* network.c - Change udp_port_fd to a list of fds to support having
		multiple ports to listen on.


Thu Jun 15 17:55:21 EDT 1995	Paul Park	(pjpark@mit.edu)
	* Makefile.in - Change explicit library names to -l<lib> form, and
		change target link line to use $(LD) and associated flags.
		Also, remove DBMLIB, it was not used. Also, for K4, use
		KRB4_LIB and KRB4_CRYPTO_LIB, these were
                split out.
	* configure.in - Remove dbm library checks, these are no longer needed
		with the Berkeley database code.  Also, add shared library
		usage check.

Tue Jun 13 12:44:20 1995  Sam Hartman  <hartmans@tardis.MIT.EDU>

	* network.c: Base inclusion of sys/select.h on whether it exists
        instead of a specific test for AIX.

	* configure.in: Test for sys/select.h

Mon Jun 12 20:01:23 1995  Ezra Peisach  <epeisach@kangaroo.mit.edu>

	* kdc_util.c (kdc_process_tgs_req): Set the auth_context rcache to
		null before freeing auth_context. This keeps the rcache
		valid. 

Sat Jun 10 23:04:31 1995  Tom Yu  (tlyu@dragons-lair)

	* kdc_util.c: krb5_auth_context redefinitions

Fri Jun  9 19:13:08 1995    <tytso@rsx-11.mit.edu>

	* dispatch.c, kdc_util.h, kerberos_v4.c: Use KRB5_KRB4_COMPAT
		instead of KRB4 for determining whether to compile in
		Kerberos V4 backwards compatibility

	* configure.in: Remove standardized set of autoconf macros, which
		are now handled by CONFIG_RULES.

Thu Jun  8 23:35:27 1995    <tytso@rsx-11.mit.edu>

	* do_as_req.c, do_tgs_req.c, kdc_util.c, kerberos_v4.c, main.c,
		network.c: Fix -Wall nits.

Thu Jun 8 14:52:40 EDT 1995	Paul Park	(pjpark@mit.edu)
	* Makefile.in - Add libkadm.
	* dispatch.c, do_as_req.c, do_tgs_req.c, kdc_util.c, kerberos_v4.c
		main.c - Include adm_proto.h and change syslog calls to
		calls to krb5_klog_syslog.

Fri May 26 17:50:39 EDT 1995	Paul Park	(pjpark@mit.edu)
	* Makefile.in	- Define KDBDEPLIB.

Sat May 20 22:28:52 1995  Ezra Peisach  <epeisach@kangaroo.mit.edu>

	* kerberos_v4.c: Port to OSF/1. (change longs to KRB4_32)

Sat Apr 29 00:13:16 1995  Theodore Y. Ts'o  <tytso@dcl>

	* kdc_util.c (kdc_process_tgs_req): Make sure apreq->ticket gets
		freed, since it isn't being passed back to the caller 
		(anymore).

Fri Apr 28 21:28:45 1995  Theodore Y. Ts'o  <tytso@dcl>

	* do_tgs_req.c (process_tgs_req): Free header_ticket when we're
		done with it.  (Prevents massive memory leak).

	* Makefile.in (depend): Use $(LD) instead of $(CC) so that we can
		do purify checking.

Fri Apr 28 18:05:52 1995  Mark Eichin  <eichin@cygnus.com>

	* Makefile.in (KLIB): put KRB4_LIB inside KLIB.

Thu Apr 27 13:52:22 1995  Mark Eichin  <eichin@cygnus.com>

	* Makefile.in (krb5kdc): use KRB4_LIB directly.
	* configure.in: use WITH_KRB4 as-is.

Wed Apr 26 11:23:11 1995  Mark Eichin  <eichin@cygnus.com>

	* configure.in: need HAS_ANSI_VOLATILE for signal_requests_exit.

Sat Apr 22 00:36:37 1995  Theodore Y. Ts'o  (tytso@dcl)

	* network.c (setup_network): Don't rely on krb5_kdc_portname and
		krb5_kdc_sec_portname anymore.  Use the #define'd versions.

Fri Mar 31 16:50:07 1995  Theodore Y. Ts'o  (tytso@dcl)

	* main.c (main): Make sure the context is initialized before it is
	  	used.

Mon Mar 27 07:56:26 1995 Chris Provenzano (proven@mit.edu)

	* kdc_util.c Use new calling conventions for krb5_rd_req_decoded().

Fri Mar 24 14:58:07 1995    <tytso@rsx-11.mit.edu>

	* replay.c: The KDC replay cache needs to store the database
		modification time, so that if the database is modified in
		between when it receives a request and when it receives a
		replay of the same request, it knows to throw away the
		replay cache entry and generate a new response (since the
		record in the database on which the response is based may
		have been modified). 

	* main.c (kdc_com_err_proc): Use syslog() instead of vsyslog().

Sat Mar 18 18:59:45 1995  John Gilmore  (gnu at toad.com)

	* kerberos_v4.c:  Replace STDARG_PROTOTYPES with HAVE_STDARG_H.

Tue Mar 14 15:25:38 1995    <tytso@rsx-11.mit.edu>

	* configure.in, Makefile.in: Use the libdes425 library so that the
		DES code doesn't get dragged in twice.

	* kdc_util.c (validate_as_request): Allow a client to obtain a
		password changing ticket, even if the client's key is
		expired.

	* main.c (usage, process_args, main): The KDC will disassociate
		itself from the terminal by default, unless the -n option
		is given.

Thu Mar  2 12:16:50 1995  Theodore Y. Ts'o  <tytso@dcl>

	* Makefile.in (ISODELIB): Remove reference to $(ISODELIB).

Wed Mar  1 16:30:27 1995  Theodore Y. Ts'o  <tytso@dcl>

	* configure.in: Remove ISODE_INCLUDE and ISODE_DEFS, replace check
		for -lsocket and -lnsl with WITH_NETLIB check.

Tue Feb 28 02:27:11 1995  John Gilmore  (gnu at toad.com)

	* *.[ch]:  Avoid <krb5/...> and <com_err.h> includes.

Fri Feb 10 14:35:42 1995  Theodore Y. Ts'o  <tytso@dcl>

	* do_tgs_req.c (process_tgs_req): krb5_use_keytype() was being
		called when the argument was a encryption type.   Change
		use to krb5_use_cstype().  Actually, any use of
		krb5_use_keytype() is a bug by definition.

Wed Feb 01 21:07:03 1995  Chris Provenzano (proven@mit.edu)

	* kdc_util.c (kdc_rdreq_keyproc()) Add krb5_keytype() arg.

Wed Jan 25 23:20:07 1995  Theodore Y. Ts'o  (tytso@dcl)

	* network.c (setup_network), main.c (process_args): Allow the
		primary port that the KDC listens on be configurable on the
		command line.  If the appropriate /etc/services entries
		aren't found, use compiled in defaults.

Wed Jan 25 16:54:40 1995  Chris Provenzano (proven@mit.edu)

        * Removed all narrow types and references to wide.h and narrow.h

Fri Jan 13 15:23:47 1995  Chris Provenzano (proven@mit.edu)

    * Added krb5_context to all krb5_routines

Thu Dec  8 00:33:05 1994    <tytso@rsx-11.mit.edu>

	* do_tgs_req.c (prepare_error_tgs): Don't free the passed in
		ticket; it will be freed as part of other structures.

	* do_tgs_req.c (process_tgs_req): Set the encryption type in the
		reply structure, and set the eblock type accordingly.

Wed Dec  7 13:36:34 1994    <tytso@rsx-11.mit.edu>

	* do_as_req.c (process_as_req): Set the encryption type in the
		reply_encpart structure.

	* kdc_util.c (validate_as_request): 
	* policy.c (against_local_policy_as): Move requirement that an AS
		request must include the addresses field to the local
		policy routine.  (Not required by RFC).

	* main.c (setup_com_err): Initialize the kdc5 error table (the
		kdb5 error table is already initialized)

Wed Nov 30 16:37:26 1994  Theodore Y. Ts'o  (tytso@dcl)

	* confiugre.in: Add appropriate help text for --with-krb4
		option.

Mon Nov 21 17:23:50 1994  Theodore Y. Ts'o  (tytso@dcl)

	* do_tgs_req.c (process_tgs_req):
	* do_as_req.c (process_as_req): Use the list of encryption types
		passed as part of the KDC request to determine which
		encryption to use for encrypting the ticket.  The
		encryption must be one that is supported by the KDC, as
		well as being one which is marked as being supported by
		the server of the ticket.  In a AS request, also use this
		encryption for encrypting the KDC response.  In a TGS
		request, use the encryption type of the TGT authenticator
		to determine how to encrypt the KDC response. 

Tue Nov  8 17:51:30 1994  Theodore Y. Ts'o  (tytso@dcl)

	* do_tgs_req.c (process_tgs_req): Use published interface to call
		krb5_random_key().

Mon Nov  7 22:11:01 1994  Theodore Y. Ts'o  (tytso@dcl)

	* kerberos_v4.c: Don't define functions manually, but pull in the
	appropriate include files (com_err.h, krb5/ext-proto.h,
	krb5/los-proto.h, etc.)

	* kdc_util.c (kdc_process_tgs_req): Fix lineage check so that we
		don't fail if we're cross-authenticating with a realm with
		the same length as our own.  ('||' should have been '&&')

Fri Nov  4 17:47:46 1994  Theodore Y. Ts'o  (tytso@dcl)

	* do_as_req.c (process_as_req): Use published interface to call
		krb5_random_key().

Fri Oct 14 00:31:14 1994  Theodore Y. Ts'o  (tytso@dcl)

	* main.c (process_args): Select the cryptosystem to be used using
		krb5_use_cstype() instead of using a implementation
		specific assignment.  Also, allow the encryption type to
		be specified using a command line option.

Tue Oct 11 22:11:09 1994  Theodore Y. Ts'o  (tytso@dcl)

	* do_as_req.c (process_as_req): Don't assume that the request
		server's realm name is null terminated.  Compare the
		request server against changepw/kerberos using
		krb5_principal_compare.

Tue Oct  4 16:42:16 1994  Theodore Y. Ts'o  (tytso@dcl)

	* kdc_util.c (kdc_rdreq_keyproc): Add widen.h and narrow.h around
		keyproc call so that the argument types are widened.

Mon Oct  3 13:13:48 1994  Theodore Y. Ts'o  (tytso@dcl)

	* Makefile.in: Use $(srcdir) to find manual page for make install.

	* Makefile.in: Remove krb5kdc on make clean

Fri Sep 30 22:13:13 1994  Theodore Y. Ts'o  (tytso@dcl)

	* extern.c: Add placeholder for magic number

Thu Sep 29 00:03:59 1994  Theodore Y. Ts'o  (tytso@dcl)

	* Makefile.in: Relink executable when library changes.

Wed Sep 21 17:40:56 1994  Theodore Y. Ts'o  (tytso@dcl)

	* kdc_util.c, kdc_util.h (realm_compare): Change realm_compare so
		that both arguments are principals.  This makes it less
		confusing....

	* kdc_util.c (add_to_transited): Folded in Tony Andrea's changes
		so that add_to_transited doesn't assume that the contents
		of a krb5_data->data are null terminated.

	* do_tgs_req.c (process_tgs_req): Add the realm of the presented
	  tgt if it is different from the local realm (cross-realm) and it
	  is different than the realm of the client (since the realm of
	  the client is already implicitly part of the transited list and
	  should not be explicitly listed).

Thu Aug 18 18:17:59 1994  Theodore Y. Ts'o  (tytso at tsx-11)

	* configure.in:
	* Makefile.in: Move optional link with $(KRB4)/lib/libdes.a to
	configure.in.

Thu Aug  4 15:13:27 1994  Tom Yu  (tlyu@dragons-lair)

	* configure.in:
	* kerberos_v4.c: don't include <sgtty.h> if POSIX_TERMIOS is
	defined.

Sat Jul 16 09:16:33 1994  Tom Yu  (tlyu at dragons-lair)

	* configure.in: hopefully make dbm libs dtrt

Sat Jul 16 01:59:02 1994  Theodore Y. Ts'o  (tytso at tsx-11)

	* do_as_req.c: Sanitie error return codes
	* kdc_util.c (validate_tgs_request): Fix error handling for bogus
	TGS renew/forward/etc. requests.  Sanitize error return codes.

Fri Jul  8 00:33:45 1994  Tom Yu  (tlyu at dragons-lair)

	* configure.in:
	* Makefile.in: back out changes because of possible breakage under
	Ultrix, among other things

Wed Jul  6 22:54:59 1994  Tom Yu  (tlyu at dragons-lair)

	* configure.in:
	* Makefile.in: fixes to suck in -lndbm or -ldbm if needed

Tue Jun 28 19:43:54 1994  Tom Yu  (tlyu at dragons-lair)

	* main.c: fix explicit calls to initialize_foo_error_table

	* do_tgs_req.c:
	* configure.in: folding in Harry's changes