6ce504ad84
kdc/kdc.8: move a comma
2026-05-22 20:33:08 -05:00
378a367c9e
kdc: Allow KDC plugin to handle attempts to authenticate without using hardware authentication
...
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz >
2026-05-20 11:47:28 -05:00
6d2d9632da
kdc: Check return value of pa_enc_ts_decrypt_kvno()
...
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz >
2026-05-20 11:47:28 -05:00
c65cd331e4
gsskrb5: Correctly check EVP_Cipher() return value for RC4
...
If the flag EVP_CIPH_FLAG_CUSTOM_CIPHER is set for the cipher, EVP_Cipher()
returns the number of bytes written to ‘out’.
2026-05-20 11:46:35 -05:00
f93aeb3f8f
krb5: Correctly check if RC4 enctype is valid
...
krb5_enctype_valid() returns zero on success.
2026-05-20 11:45:57 -05:00
dafc36e26c
krb5: Promote AES SHA2 enctypes to preferred
2026-05-20 11:45:57 -05:00
b7f4f62dfa
krb5: Fix non‐RC4 build
...
The function _krb5_usage2arcfour() is only declared if Heimdal is built with
RC4. Put calls to this function behind #ifdef guards so that the build can
succeed.
2026-05-20 11:43:53 -05:00
31c514e3b2
kdc: Adjust error code mapping
...
Commit cbe156d927
2026-05-20 11:43:18 -05:00
356b2111ba
dbutils: fix order of libraries for static build
2026-05-20 11:42:14 -05:00
93bbac45f9
Install heim_threads.h
2026-05-19 12:02:18 -05:00
e4a885074b
krb5: make KRB5_TRACE default to tracing not just debugging
2026-05-19 12:01:42 -05:00
ffb01963fc
lib:roken: allow large fragmented UDP replies from glibc resolver
...
glibc resolver returns same answer length as buffer size when
buffer is too small for the answer.
Signed-off-by: Ivan Korytov <toreonify@altlinux.org >
2026-05-19 11:52:18 -05:00
8dba1f4810
add a bit more logging in gss mechglue
2026-05-19 11:14:39 -05:00
e11f8a8823
Eliminate \n from _gss_mg_log() calls
2026-05-19 11:14:39 -05:00
abd35b246a
kdc: support pkinit_kdc_revoke for pkinit anchors
...
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz >
2026-02-11 16:14:53 +13:00
bddc275275
ktutil: Collect entries then add/delete when renaming principals ( fix #1319 )
2026-02-08 01:35:58 -06:00
609e36de13
krb5: Only lock keytabs to write to them ( fix #1319 )
2026-02-08 01:30:28 -06:00
8ec31e4926
GHA: Shorten the OS X test timeout
2026-02-08 00:36:43 -06:00
0a9f1c3f11
GHA: Get diagnostics data from hanging check-context test (OS X)
2026-02-07 23:56:02 -06:00
4fe0ad8e2c
GHA: Get diagnostics data from hanging check-context test
2026-02-07 22:45:45 -06:00
c999e5a33a
GHA: Set a timeout on tests
2026-02-07 18:40:19 -06:00
ce85c64b84
iprop: Make ipropd-master not lock the log ( fix #1308 )
2026-02-07 17:59:03 -06:00
c76a096a28
roken: Add pread() for Windows
2026-02-07 17:59:03 -06:00
8a22366b55
roken: Don't define flock() ops if HAVE_FLOCK ( fix #1313 )
2026-02-07 17:46:19 -06:00
1a7e3c4a5c
kadm5: Fix client-side double-free ( fix #1315 )
2026-02-07 17:46:19 -06:00
df0e15fcdf
tests: Disable cheeck-iprop until fix is ready
2026-01-24 14:42:38 -06:00
8a67a1f77c
Revert "kpasswdd: Allow password changes through NATs ( fix #1286 )"
...
This reverts commit f37749adc7
2026-01-23 00:40:39 -06:00
26dca502be
kpasswdd: Allow password changes through NATs ( fix #1286 again)
2026-01-23 00:37:44 -06:00
cc272a4838
krb5: Try up to all kpasswdd IPs ( fix #1304 )
2026-01-22 23:38:42 -06:00
dedeea1b6a
sqlite: Fix warnings ( fix #1306 )
2026-01-22 23:32:14 -06:00
7dec4d7f02
bx509d: Stop taking unnecessary flock ( fix #1308 )
2026-01-22 22:26:10 -06:00
961370d49f
krb5: Add support for "Directional" host address type
...
Currently the Directional host address type is pretty useless,
since it's only useful in application protocols that a) use
KRB-PRIV/KRB-SAFE messages (so: not GSS-API applications), and b)
state in their specs to use Directional, or otherwise provide for
negotiation of host address types. There are no such protocols
that we care about except -since we control it- iprop. But even
for iprop it'd be better to switch to GSS-API.
2026-01-22 22:26:10 -06:00
f37749adc7
kpasswdd: Allow password changes through NATs ( fix #1286 )
2026-01-22 22:25:45 -06:00
c83b1a12aa
roken: Use OFD locks, flock, or POSIX locking, same as MIT
2026-01-22 18:06:28 -06:00
7772534587
krb5: Add missing hunk for #1204 ( fix #1305 )
2026-01-22 17:39:19 -06:00
f47b578ce2
krb5: Add MEMORY threaded test (and fix bugs)
2026-01-22 14:05:26 -06:00
d9e98b2773
asn1: Remove non-existent symbols (fix Windows build)
2026-01-22 13:34:13 -06:00
bb4476ebe1
GHA: Trigger Linux and Windows builds when .map and .def files change
2026-01-22 13:15:23 -06:00
81b293d66b
asn1: Don't export template DATAs (fix Windows build)
2026-01-22 13:09:11 -06:00
1fb3689061
NEWS: Add upgrade/downgrade considerations to release notes
2026-01-22 11:39:05 -06:00
86b20d9544
kdc: Always apply maximum ticket lifetime and renew time when non-NULL
...
This allows a lifetime of zero to work.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2026-01-22 11:39:05 -06:00
add30d09f9
kadmin: Make maximum ticket lifetime and renew time signed integers
2026-01-22 11:39:05 -06:00
96a5c0b82a
hdb: Make maximum ticket lifetime and renew time signed integers
...
This allows for negative lifetimes to be encoded, and fits in better
with our use elsewhere of time_t, which in POSIX is a signed integer
type.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2026-01-22 11:39:05 -06:00
55287b56bc
sqlite: Fix Windows build
2026-01-22 11:38:51 -06:00
bab1bca910
sqlite: Don't rename types / macros
2026-01-22 11:31:34 -06:00
8961f81de7
sqlite: Add gen-sqlite3-namespace.sh script for upgrades
2026-01-22 11:23:57 -06:00
118004e85c
Revert "tests: Speed up tests/gss/check-gssmask"
...
This reverts commit 366016b1f6
2026-01-22 10:48:59 -06:00
474f07cfa9
NEWS: Fix formatting
2026-01-22 00:02:05 -06:00
a1220ce6d2
sqlite: Rename symbols ( fix #1142 )
2026-01-22 00:02:05 -06:00
41591932b8
krb5: Nonces in krb5.asn1 should be unsigned
2026-01-22 00:02:05 -06:00
Roland C. Dowdeswell