rpms/krb5
7
0
Fork 0
Code Issues Pull Requests Releases Activity
1,072 Commits 9 Branches 46 Tags 7.8 MiB
9f3201c4bc
Commit Graph

859 Commits

Author SHA1 Message Date
Nalin Dahyabhai
6c46043c16 Do the horrible hostname check _before_ faking it 2013-08-15 01:50:42 -04:00
Nalin Dahyabhai
ee18500d9b Fix error detection when starting kpropd/kadmind 
- drop a patch we're not applying
- wrap kadmind and kpropd in scripts which check for the presence/absence
  of files which dictate particular exit codes before exec'ing the actual
  binaries, instead of trying to use ConditionPathExists in the unit files
  to accomplish that, so that we exit with failure properly when what we
  expect isn't actually in effect on the system (#800343)
 2013-08-15 00:10:24 -04:00
Nalin Dahyabhai
272aaeef17 Assume 32 when __isa_bits isn't defined 2013-07-29 17:47:21 -04:00
Nalin Dahyabhai
d6a5b8b7d7 fixup for UnversionedDocdirs 
- attempt to account for UnversionedDocdirs for the -libs subpackage
 2013-07-29 17:00:25 -04:00
Nalin Dahyabhai
4c8469c258 tweak configs used by tests 
- tweak configuration files used during tests to try to reduce the number
  of conflicts encountered when builds for multiple arches land on the same
  builder
 2013-07-26 18:47:03 -04:00
Nalin Dahyabhai
66d9928651 Backport from RT#7682 
- pull up changes to allow GSSAPI modules to provide more functions (RT#7682, #986564/#986565)
 2013-07-22 14:23:24 -04:00
Nalin Dahyabhai
36dbacb706 Use LD_PRELOAD to be able to run more self-tests 
Use nss_wrapper (from cwrap.org) to be able to run more of the
self-tests during %%check.  Help it along a little bit by being
more emphatic about cutting off access to DNS.
 2013-07-19 15:52:31 -04:00
Nalin Dahyabhai
909ac318c3 Use %%{?_isa} when hard-coding deps on krb5-libs 
- specify dependencies on the same arch of krb5-libs by using the %%{?_isa}
  suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155)
 2013-07-01 11:48:17 -04:00
Nalin Dahyabhai
d00d276a47 Bring back "Back out the krb5-1.11-run_user_0.patch" 
This reverts commit 8a5a8d492c.

Special-case /run/user/0, attempting to create it when resolving a
directory cache below it fails due to ENOENT and we find that it doesn't
already exist, either, before attempting to create the directory cache
(maybe helping, maybe just making things more confusing for #961235).
 2013-06-13 13:23:54 -04:00
Nalin Dahyabhai
7b66f600ef update to 1.11.3 
- update to 1.11.3
  - drop patch for RT#7605, fixed in this release
  - drop patch for CVE-2002-2443, fixed in this release
  - drop patch for RT#7369, fixed in this release
- pull upstream fix for breaking t_skew.py by adding the patch for #961221
 2013-06-04 11:13:25 -04:00
Nalin Dahyabhai
ff0ee94342 Respin with updated version of patch for RT#7650 
Respin with updated version of patch for RT#7650, and don't forget to
keep track of the bug ID (#969331).
 2013-05-31 14:29:57 -04:00
Nalin Dahyabhai
8a5a8d492c Back out the krb5-1.11-run_user_0.patch 
It's not a complete fix, and it may only muddy things further on systems
that are having the kind of trouble it's trying to avoid, so hold off.
For now, at least.
 2013-05-30 15:10:35 -04:00
Nalin Dahyabhai
202006a85f Pull a fix for kinit going on an only-masters path 
- pull in proposed fix for attempts to get initial creds, which end up
  following referrals, incorrectly trying to always use master KDCs if
  they talked to a master at any point (should fix RT#7650)
 2013-05-30 12:32:10 -04:00
Nalin Dahyabhai
dc293b3d84 Add a hackish attempt at a workaround for #961235 
Add a patch to create /run/user/0 if we're trying to resolve a
DIR: ccache somewhere below it and neither the target location
nor /run/user/0 exist yet.
The better workaround is to set the location's owner to "linger"
via logind, since even after we do what we're doing here, if
the user logs in and logs back out, our location is still removed.
 2013-05-30 12:26:42 -04:00
Nalin Dahyabhai
559c78a30a Label DIR: ccache directories when we create them 
- don't forget to set the SELinux label when creating the directory for
  a DIR: ccache
 2013-05-30 09:18:15 -04:00
Nalin Dahyabhai
11a4bca1fa Turn off some tests that master stopped doing 
- pull in patches from master to not test GSSRPC-over-UDP and to not
  depend on the portmapper, which are areas where our build systems
  often give us trouble, too
 2013-05-30 08:53:30 -04:00
Nalin Dahyabhai
bafcf02fa5 Actually bump the release number 2013-05-28 18:18:55 -04:00
Nalin Dahyabhai
e98d94d2bc Add proposed fix for handling AS client clock skew 
In addition to basing the contents of an encrypted-timestamp preauth
data item on the server's idea of the current time, go ahead and do the
same for the times in the request.
 2013-05-28 18:18:23 -04:00
Nalin Dahyabhai
827a48f7cc Fix handling of empty passwords in get-init-creds 2013-05-28 17:21:45 -04:00
Nalin Dahyabhai
2fdc61e398 Fix transited realm checks in GSSAPI servers 
- backport fix for not being able to verify the list of transited realms
  in GSS acceptors (RT#7639, #959685)
 2013-05-28 17:16:52 -04:00
Nalin Dahyabhai
325dca9ce4 Note the corresponding EL6 bug ID for reference 2013-05-28 17:13:23 -04:00
Nalin Dahyabhai
ee36e9e6b4 fix to make some use of DIR::... KRB5CCNAME values 
- pull in upstream fix to start treating a KRB5CCNAME value that begins
  with DIR:: the same as it would a DIR: value with just one ccache file
  in it (RT#7172, #965574)
 2013-05-21 13:51:51 -04:00
Nalin Dahyabhai
fbd06d348b pull up fix for kpasswd service ping-pong attack 
- pull up fix for UDP ping-pong flaw in kpasswd service (CVE-2002-2443,
  #962531,#962534)
 2013-05-13 18:32:51 -04:00
Nathaniel McCallum
c0d2f3b96d Update otp patch; add keycheck patch 2013-05-03 17:04:40 -04:00
Nalin Dahyabhai
fcc98d5403 make the default ccname change affect f19, too 
- pull the changing of the compiled-in default ccache location to
  DIR:/run/user/%%{uid}/krb5cc back into F19, in line with SSSD and
  the most recent pam_krb5 build
 2013-04-23 17:39:34 -04:00
Nalin Dahyabhai
d54b8d87c6 correct some configuration file paths 
Correct some configuration file paths which the KDC_DIR patch
inadvertently changed.
 2013-04-17 10:42:46 -04:00
Nalin Dahyabhai
3ba00c4edc keep track of the message type of FAST requests 
- pull in fix for keeping track of the message type when parsing FAST requests
  in the KDC (RT#7605, #951843)
 2013-04-15 11:06:55 -04:00
Nalin Dahyabhai
61043181c7 update to 1.11.2 
- update to 1.11.2
  - drop pulled in patch for RT#7586, included in this release
  - drop pulled in patch for RT#7592, included in this release
 2013-04-15 11:06:15 -04:00
Nalin Dahyabhai
fd7717242f set DEFCCNAME to DIR:/run/user/%{uid}/krb5cc 
- move the compiled-in default ccache location from the previous default of
  FILE:/tmp/krb5cc_%{uid} to DIR:/run/user/%{uid}/krb5cc (part of #949588)
 2013-04-12 09:24:16 -04:00
Nathaniel McCallum
8d291c8c0a Update otp plugin backport patches 2013-04-09 14:06:33 -04:00
Nalin Dahyabhai
ffcebd6c2b trying to get more of the tests to run on builders 
- when testing the RPC library, treat denials from the local portmapper the
  same as a portmapper-not-running situation, to allow other library tests
  to be run while building the package
 2013-04-03 17:23:58 -04:00
Nalin Dahyabhai
46d5c735d6 add RT number for most recent patch 2013-04-01 10:23:20 -04:00
Nalin Dahyabhai
7b92138ee8 teach gss_acquire_cred_from() about "client_keytab" 
- pull in Simo's patch to recognize "client_keytab" as a key type which can
  be passed in to gss_acquire_cred_from()
 2013-03-28 16:13:41 -04:00
Nalin Dahyabhai
30e39857ae package the right client keytab directory 
- create and own /var/kerberos/krb5/user instead of /var/kerberos/kdc/user,
  since that's what the libraries actually look for
- add buildrequires on nss-myhostname, in an attempt to get more of the tests
  to run properly during builds
 2013-03-28 16:12:30 -04:00
Nalin Dahyabhai
e7b662f81f pull in arm 64 (aarch64) build tweaks 
- go back to using reconf to run autoconf and autoheader (part of #925640)
- add temporary patch to use newer config.guess/config.sub (more of #925640)
 2013-03-26 16:48:29 -04:00
Nalin Dahyabhai
9d52c1d370 specify backup suffixes, like we do 2013-03-26 16:34:37 -04:00
Nalin Dahyabhai
c761eb0da7 pull up patch to mark imported gss contexts right 
- pull up Simo's patch to mark the correct mechanism on imported GSSAPI
  contexts (RT#7592)
 2013-03-26 16:32:29 -04:00
Nalin Dahyabhai
557835fdb3 tweak buildrequires conditionals for el7 builds 
- fix a version comparison to expect newer texlive build requirements when
  %%{_rhel} > 6 rather than when it's > 7
 2013-03-18 10:28:51 -04:00
Nathaniel McCallum
0efba32c47 first round of the otp plugin 2013-03-11 16:26:50 -04:00
Nalin Dahyabhai
6fdbb463fc fix a memory leak when obtaining creds via keytabs 
- fix a memory leak when acquiring credentials using a keytab (RT#7586, #911110)
 2013-02-28 16:37:33 -05:00
Nalin Dahyabhai
abff2e5117 escape uses of macros in comments (more of 884065) 
escape uses of macros in comments (more of #884065)
 2013-02-27 18:16:30 -05:00
Nalin Dahyabhai
a47a2acb30 drop the kerberos-iv portreserve file 
drop the kerberos-iv portreserve file (long overdue), and drop the rest
on systemd systems, since we don't currently poke portreserve when we're
starting a service
 2013-02-27 18:15:26 -05:00
Nalin Dahyabhai
460c5ab8b7 prebuild PDF docs to reduce multilib differences 
prebuild PDF docs to reduce multilib differences (internal tooling, #884065)
 2013-02-27 14:59:35 -05:00
Nalin Dahyabhai
0c2dcfe3ef update to 1.11.1 
update to 1.11.1
- drop patch for noticing negative timeouts being passed to the poll()
  wrapper in the client transmit functions
 2013-02-25 12:44:43 -05:00
Nalin Dahyabhai
977a60b72c set "rdns = false" in the default krb5.conf 
set "rdns = false" in the default krb5.conf (#908323)
 2013-02-08 10:29:14 -05:00
Nalin Dahyabhai
0597014fa8 update to 1.11 release 
- update to the 1.11 final release
- drop the rawbuild tag from a couple of patches which we don't actually
  need to apply to get things to compile the way the package expects
 2012-12-18 10:37:36 -05:00
Nalin Dahyabhai
9e98fec59e update to 1.11 beta 2 2012-12-13 10:57:00 -05:00
Nalin Dahyabhai
38b95e7b3e move a non-system libverto to the -libs subpackage 
- when building with our bundled copy of libverto, package it in with -libs
  rather than with -server (#886049)
 2012-12-13 10:27:19 -05:00
Nalin Dahyabhai
78b3a524da update to 1.11 beta 1 2012-11-21 15:56:57 -05:00
Nalin Dahyabhai
282fb3c1e0 packaging tweaks 
- handle releases where texlive packaging wasn't yet as complicated as it
  is in Fedora 18
- fix an uninitialized-variable error building one of the test programs
 2012-11-16 17:19:59 -05:00
Nalin Dahyabhai
8cf49572ea more tweaks to try to get doc building working 2012-11-16 15:58:51 -05:00
Nalin Dahyabhai
d97833d1ef just drop package-level deps on tex altogether 2012-11-16 14:56:42 -05:00
Nalin Dahyabhai
b1e19fe613 sure, okay. 2012-11-16 14:51:53 -05:00
Nalin Dahyabhai
5816919080 require pdflatex and makeindex 2012-11-16 14:36:59 -05:00
Nalin Dahyabhai
d8fb585c09 don't dummy up required stylesheets, require them 2012-11-16 13:35:21 -05:00
Nalin Dahyabhai
9f497eac9f also note the multilib impact in the docs 2012-11-16 13:14:55 -05:00
Nalin Dahyabhai
7404a3c685 more packaging fixups 
- move the rather large pile of html and pdf docs to -workstation, so
  that just having something that links to the libraries won't drag
  them onto a system
- actually create %%{_var}/kerberos/kdc/user, so that it can be packaged
- correct the list of packaged man pages
 2012-11-16 13:01:56 -05:00
Nalin Dahyabhai
777f196e39 drop patches to fixup paths in man pages 2012-11-16 13:01:56 -05:00
Nalin Dahyabhai
d0f6217945 own /var/kerberos/kdc/user 2012-11-16 13:01:56 -05:00
Nalin Dahyabhai
18bdbb99e3 drop the only-weak-keys checker 2012-11-16 13:01:56 -05:00
Nalin Dahyabhai
0efe966105 update heed-nsaccountlock patch 
We lost explicit support for eDirectory per se, so just add a toggle to
enable heeding the one native attribute that 389 adds to the mix.
 2012-11-16 13:01:56 -05:00
Nalin Dahyabhai
8a943cb6b5 update selinux labeling patch 2012-11-16 13:01:55 -05:00
Nalin Dahyabhai
423d0d2f67 update the paths-in-man-pages patch 2012-11-15 18:03:30 -05:00
Nalin Dahyabhai
34c8bac7e3 drop backported fix for clock skew errors 
- drop backported fix for avoiding spurious clock skew when a TGT is
  decrypted long after the KDC sent it to the client which decrypts it
 2012-11-15 15:23:18 -05:00
Nalin Dahyabhai
e5f60e0625 drop backports of patch for keytab-based kinit 
- drop backported patches to make keytab-based authentication attempts
  work better when the client tells the KDC that it supports a particular
  cipher, but doesn't have a key for it in the keytab
 2012-11-15 15:21:19 -05:00
Nalin Dahyabhai
b47c708afc drop backported PKINIT fix: directly-trusted KDCs 
- drop backported fix for teaching PKINIT clients which trust the KDC's
  certificate directly to verify signed-data messages that are signed with
  the KDC's certificate, when the blobs don't include a copy of the KDC's
  certificate
 2012-11-15 15:19:00 -05:00
Nalin Dahyabhai
f1f0baeb82 drop backported patch for disabling replay caches 
- drop backported fix for disabling use of a replay cache when verifying
  initial credentials
 2012-11-15 15:18:12 -05:00
Nalin Dahyabhai
e4244fc907 drop backported build patch 2012-11-15 15:15:47 -05:00
Nalin Dahyabhai
d86f9ffaaf the new docs system generates PDFs, so we can stop 2012-11-15 15:14:28 -05:00
Nalin Dahyabhai
03522e1559 drop backported patches for RT #7406,#7407,#7408 
- drop backported patch for RT #7406
- drop backported patch for RT #7407
- drop backported patch for RT #7408
 2012-11-15 15:04:38 -05:00
Nalin Dahyabhai
6baa28a80d start moving to 1.11 2012-11-15 15:03:00 -05:00
Nalin Dahyabhai
c7b12ecdfa tag a couple more patches for %%{?_rawbuild} 
- tag a couple of other patches which we still need to be applied during
  %%{?_rawbuild} builds (zmraz)
 2012-10-17 17:36:50 -04:00
Nalin Dahyabhai
51b608140a - actually pull up the patch for RT#7063, and not some other ticket (#773496) 2012-09-25 02:02:35 -04:00
Nalin Dahyabhai
3e1f3982d4 revise Filip's patch so that it more closely mimics the select() path 2012-09-10 18:47:48 -04:00
Nalin Dahyabhai
a4ad97ae22 abort the current transmit attempt if our timeout is negative 
- add patch from Filip Krska to abort a transmit attempt when we've given
  poll() a negative timeout (#838548)
 2012-09-10 16:30:11 -04:00
Nalin Dahyabhai
4c51c8bc7e more backported fixes for keytab-doesn't-have-all-key-types cases 
- add a backport of more patches to set the client's list of supported enctypes
  when using a keytab to be the list of types of keys in the keytab, plus the
  list of other types the client supports but for which it doesn't have keys,
  in that order, so that KDCs have a better chance of being able to issue
  tickets with session keys of types that the client can use (#837855)
 2012-09-07 16:10:45 -04:00
Nalin Dahyabhai
e39bc82589 pull up patch for RT#7063 - KDC/client time skew 
- pull up patch for RT#7063, in which not noticing a prompt for a long
  time throws the client library's idea of the time difference between it
  and the KDC really far out of whack (#773496)
 2012-09-07 14:05:10 -04:00
Nalin Dahyabhai
9a4c3f763b conflict with broken libsmbclient builds on EL6, so that we don't break them 
- on EL6, conflict with libsmbclient before 3.5.10-124, which is when it
  stopped linking with a symbol which we no longer export (#771687)
 2012-09-07 12:50:09 -04:00
Nalin Dahyabhai
cf693a2998 cut out an extraneous label configuration reload 
- cut down the number of times we load SELinux labeling configuration from
  a minimum of two times to actually one (more of #845125)
 2012-09-06 18:42:40 -04:00
Nalin Dahyabhai
7f06579f48 backport patch from RT#7229 
- backport patch to disable replay detection in krb5_verify_init_creds()
  while reading the AP-REQ that's generated in the same function (RT#7229)
 2012-08-30 14:22:23 -04:00
Nalin Dahyabhai
ec0380bcae merge and conditionalize some EL6isms 
- undo rename from krb5-pkinit-openssl to krb5-pkinit on EL6
- version the Obsoletes: on the krb5-pkinit-openssl to krb5-pkinit rename
- reintroduce the init scripts for non-systemd releases
- forward-port %%{_?rawbuild} annotations from EL6 packaging
 2012-08-30 14:06:23 -04:00
Nalin Dahyabhai
81ca63cffc - update to 1.10.3, rolling in MITKRB5-SA-2012-001 2012-08-09 11:11:24 -04:00
Nalin Dahyabhai
5d6308abab cache the selabel context between uses (dwalsh) 
- selinux: hang on to the list of selinux contexts, freeing and reloading
  it only when the file we read it from is modified, freeing it when the
  shared library is being unloaded (#845125)
 2012-08-02 18:50:32 -04:00
Nalin Dahyabhai
38e22af414 undo file-move fixes on Fedora 17 
- go back to not messing with library file paths on Fedora 17: it breaks
  file path dependencies in other packages, and since Fedora 17 is already
  released, breaking that is our fault
 2012-08-02 11:15:21 -04:00
Nalin Dahyabhai
899e166076 update bug numbers for this update 2012-07-31 14:34:09 -04:00
Nalin Dahyabhai
718a1573e1 fixes for MITKRB5-SA-2012-001 and .so symlinks 
- add upstream patch to fix freeing an uninitialized pointer and dereferencing
  another uninitialized pointer in the KDC (MITKRB5-SA-2012-001, CVE-2012-1014
  and CVE-2012-1015, #838012)
- fix a thinko in whether or not we mess around with devel .so symlinks on
  systems without a separate /usr (sbose)
 2012-07-31 14:14:12 -04:00
Dennis Gilmore
a020fb0304 Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild 2012-07-27 00:46:48 -05:00
Nalin Dahyabhai
f60e9ef28c backport RT#7183 
- backport a fix to allow a PKINIT client to handle SignedData from a KDC
  that's signed with a certificate that isn't in the SignedData, but which
  is available as an anchor or intermediate on the client (RT#7183)
 2012-06-22 14:07:46 -04:00
Nalin Dahyabhai
16a5c7affc back out the recent labeling change, per dwalsh 
- back out this labeling change (dwalsh):
  - when building the new label for a file we're about to create, also mix
    in the current range, in addition to the current user
 2012-06-05 16:24:15 -04:00
Nalin Dahyabhai
6e8c2c396c add explicit buildrequires: on 'hostname' and 'net-tools' 
- add explicit buildrequires: on 'hostname', for the tests, on systems where
  it's in its own package, and require net-tools, which used to provide the
  command, everywhere
 2012-06-01 16:31:50 -04:00
Nalin Dahyabhai
f06298144d no-separate-/usr means we don't have to move shlibs 
- don't shuffle around any shared libraries on releases with
  no-separate-/usr, since /lib and /usr/lib are the same anyway
 2012-06-01 15:41:01 -04:00
Nalin Dahyabhai
037ab925da backport a fix for keytabs which don't have keys for all enctypes 
- add a backport of Stef's patch to set the client's list of supported
  enctypes to match the types of keys that we have when we are using a
  keytab to try to get initial credentials, so that a KDC won't send us
  an AS reply that we can't encrypt (RT#2131, #748528)
 2012-06-01 15:24:41 -04:00
Nalin Dahyabhai
b8b71859bb update to 1.10.2 
- when building the new label for a file we're about to create, also mix
  in the current range, in addition to the current user
- also package the PDF format admin, user, and install guides
- drop some PDFs that no longer get built right
 2012-06-01 14:05:55 -04:00
Nalin Dahyabhai
cd92a2cbb4 - skip the setfscreatecon() if fopen() is passed "rb" as the open mode (part of #819115) 2012-05-07 17:28:51 -04:00
Nalin Dahyabhai
2057747130 - have -server require /usr/share/dict/words, which we set as the default dict_file in kdc.conf (#817089) 2012-05-01 11:44:13 -04:00
Nalin Dahyabhai
f2a7c1df57 - comment out example.com examples in default krb5.conf (Stef Walter, #805320) 2012-03-20 18:21:01 -04:00
Nalin Dahyabhai
f8503cf35b - changelog that last change 2012-03-20 18:20:08 -04:00
Nalin Dahyabhai
70240d81c8 - update to 1.10.1 
- drop the KDC crash fix
  - drop the KDC lookaside cache fix
  - drop the fix for kadmind RPC ACLs (CVE-2012-1012)
 2012-03-09 18:37:47 -05:00
Nalin Dahyabhai
4093154587 - when removing -workstation, remove our files from the info index while the file is still there, in %%preun, rather than %%postun, and use the compressed file's name (#801035) 2012-03-07 12:04:24 -05:00
Nathaniel McCallum
b44189a932 Fix string RPC ACLs (RT#7093); CVE-2012-1012 2012-02-21 15:40:50 -05:00
Nathaniel McCallum
1b8eb90a4f add upstream lookaside cache fix RT#7082 2012-01-31 13:42:23 -05:00
Nalin Dahyabhai
9e5f5995cd - add patch to accept keytab entries with vno==0 as matches when we're searching for an entry with a specific name/kvno (#230382/#782211,RT#3349) 2012-01-30 19:49:10 -05:00
Nalin Dahyabhai
6ac0d24fa5 - note the RT number 2012-01-30 12:51:02 -05:00
Nalin Dahyabhai
fbe4130509 - update to 1.10 final 2012-01-30 10:28:53 -05:00
Nathaniel McCallum
767944b7d8 fix release number 2012-01-26 12:17:35 -05:00
Nathaniel McCallum
a134a66915 add upstream crashfix patch 2012-01-26 11:58:18 -05:00
Nalin Dahyabhai
a04da4baa4 - note the RT number 2012-01-23 18:21:02 -05:00
Nalin Dahyabhai
cf65017ae3 - update to beta 1 2012-01-12 18:47:18 -05:00
Nalin Dahyabhai
3e2b8913b0 - add missing changelog item 2012-01-12 16:11:04 -05:00
Peter Robinson
c5fead3d7e mktemp was long obsoleted by coreutils 2012-01-11 10:36:49 +00:00
Nalin Dahyabhai
620baf13cd - modify the deltat grammar to also tell gcc (4.7) to suppress "maybe-uninitialized" warnings in addition to the "uninitialized" warnings it's already being told to suppress 2012-01-04 13:52:34 -05:00
Nalin Dahyabhai
2496d7a5c9 - update to alpha 2 
- drop a couple of patches which were integrated for alpha 2
 2011-12-20 13:18:27 -05:00
Nalin Dahyabhai
f28b57af20 - pull in patch for RT#7048: allow PAC verification to only bother trying to 
verify the signature with keys that it's given (still more of #761317)
 2011-12-13 10:50:02 -05:00
Nalin Dahyabhai
6d68d342c9 - pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached 
(more of #761317)
 2011-12-13 10:48:28 -05:00
Nalin Dahyabhai
fb7c02faff - pull in patch for RT#7046: tag a ccache containing credentials obtained via 
S4U2Proxy with the principal name of the proxying principal (part of #761317)
 2011-12-13 10:47:31 -05:00
Nalin Dahyabhai
03e76d7832 - apply upstream patch to fix a null pointer dereference when processing TGS requests (CVE-2011-1530, #753748) 2011-12-06 14:12:15 -05:00
Nalin Dahyabhai
4584a88e40 correct the release to match the changelog 2011-11-30 15:13:54 -05:00
Nalin Dahyabhai
635a422817 - correct a bug in the fix for #754001 so that the file creation context is consistently reset 2011-11-30 15:03:45 -05:00
Nalin Dahyabhai
a45a82724d - require libverto-module-base at build- and runtime so that tests which 
use verto can work properly
 2011-11-15 13:32:43 -05:00
Nalin Dahyabhai
1110ccd873 - bump to 1.10 alpha 1 2011-11-15 12:45:44 -05:00
Dennis Gilmore
39cc62dcc1 - Rebuilt for glibc bug#747377 2011-10-26 19:09:40 -05:00
Nalin Dahyabhai
af8b546790 - apply upstream patch to fix a null pointer dereference with the LDAP kdb backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb backends (CVE-2011-1528), and a null pointer dereference with multiple kdb backends (CVE-2011-1529) (#737711) 2011-10-18 14:28:08 -04:00
Nalin Dahyabhai
73b7dd3ece - pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and 
make it public (#745533)
 2011-10-13 15:31:36 -04:00
Nalin Dahyabhai
28837545d5 - handle a harder-to-trigger assertion failure that starts cropping up when we 
exit the transmit loop on time (#739853)
 2011-10-07 16:29:28 -04:00
Nalin Dahyabhai
098a308f7e - kadmin.service: fix #723723 again 
- kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command
  lines, because systemd parsing doesn't handle alternate value shell variable
  syntax
- kprop.service: add missing Type=forking so that systemd doesn't assume simple
- kprop.service: expect the ACL configuration to be there, not absent
 2011-10-07 15:10:35 -04:00
Tom "spot" Callaway
e645180a9a hardcode pid file path as option to krb5kdc.service 2011-10-02 15:05:51 +02:00
Tom "spot" Callaway
3545dd2571 fix typo 2011-09-30 12:20:58 +02:00
Tom "spot" Callaway
82129e3a0d convert to systemd 2011-09-19 14:45:57 -04:00
Nalin Dahyabhai
207fa55d00 - pull in upstream patch for RT#6952, confusion following referrals for cross-realm auth (#734341) 2011-09-06 00:19:38 -04:00
Nalin Dahyabhai
a26dd7c42c - switch to the upstream patch for #727829 2011-09-01 09:29:29 -04:00
Nalin Dahyabhai
57d5eabb48 - bump the release number 2011-08-31 13:33:23 -04:00
Nalin Dahyabhai
db0e796a50 - handle an assertion failure that starts cropping up when the patch for using poll (#701446) meets servers that aren't running KDCs or against which the connection fails for other reasons (#727829, #734172) 2011-08-31 13:31:58 -04:00
Nalin Dahyabhai
0ad36e9c38 - override the default build rules to not delete temporary y.tab.c files, 
so that they can be packaged, allowing debuginfo files which point to them
  do so usefully (#729044)
 2011-08-08 18:39:55 -04:00
Nalin Dahyabhai
ad0dcf5042 - pull in a patch to fix losing track of the replay cache FD, from SVN by way of Kevin Coffman 2011-07-22 16:57:35 -04:00
Nalin Dahyabhai
2202e378de - build shared libraries with partial RELRO support (#723995) 
- filter out potentially multiple instances of -Wl,-z,relro from krb5-config
  output, now that it's in the buildroot's default LDFLAGS
 2011-07-22 16:29:06 -04:00
Nalin Dahyabhai
a0e423054a - kadmind.init: drop the attempt to detect no-database-present errors (#723723) 2011-07-20 17:58:20 -04:00
Nalin Dahyabhai
4e66f1237b - backport RT#6905: use poll() so that we can use higher descriptor numbers when the client is talking to a KDC 2011-07-19 14:54:29 -04:00
Nalin Dahyabhai
ba9d039a3a - have a bug number for this now 2011-06-28 14:08:13 -04:00
Nalin Dahyabhai
da69bf39fa - pull a fix from SVN to use AI_ADDRCONFIG more often (RT#6923) 2011-06-23 16:07:40 -04:00
Nalin Dahyabhai
4a5ca5b2d3 - pull a fix from SVN to try to avoid triggering a PTR lookup in getaddrinfo() 
during krb5_sname_to_principal(), and to let getaddrinfo() decide whether or
  not to ask for an IPv6 address based on the set of configured interfaces
  (RT#6922)
 2011-06-23 16:05:54 -04:00
Nalin Dahyabhai
23ef754340 - fix that bug ID 2011-06-21 18:38:01 -04:00
Nalin Dahyabhai
092982212a - apply upstream patch by way of Burt Holzman to fall back to a non-referral 
method in cases where we might be derailed by a KDC that rejects the
  canonicalize option (for example, those from the RHEL 2.1 or 3 era) (#713518)
 2011-06-20 13:34:21 -04:00
Nalin Dahyabhai
e1fdb93038 - don't burn a release number 2011-06-14 14:44:36 -04:00
Nalin Dahyabhai
17c9104b1d - pull a fix from SVN to get libgssrpc clients (e.g. kadmin) authenticating 
using the old protocol over IPv4 again (RT#6920)
 2011-06-14 14:25:28 -04:00
Nalin Dahyabhai
6a7a118058 - incorporate a fix to teach the file labeling bits about when replay caches are expunged (#576093) 2011-06-14 14:15:55 -04:00
Nalin Dahyabhai
20266fd9d7 switch to the upstream patch for #707145 2011-05-26 10:55:11 -04:00
Nalin Dahyabhai
e14f89fa17 klist: don't trip over referral entries when invoked with -s (#707145, RT#6915) 2011-05-25 16:55:39 -04:00
Nalin Dahyabhai
7368cf9d38 - fixup URL in a comment 
- when built with NSS, require 3.12.10 rather than 3.12.9
 2011-05-06 10:09:53 -04:00
Nalin Dahyabhai
ac127d5263 - update to 1.9.1: 
- drop no-longer-needed patches for CVE-2010-4022, CVE-2011-0281,
    CVE-2011-0282, CVE-2011-0283, CVE-2011-0284, CVE-2011-0285
 2011-05-05 19:03:10 -04:00
Nalin Dahyabhai
d2ffb0c7c5 add the bug ID for that last fix 2011-04-13 17:21:33 -04:00
Nalin Dahyabhai
301c9d3ae2 - kadmind: add upstream patch to fix free() on an invalid pointer (MITKRB5-SA-2011-004, CVE-2011-0285) 2011-04-13 15:38:22 -04:00
Nalin Dahyabhai
5ad8efcad5 - don't discard the error code from an error message received in response 
to a change-password request (#658871, RT#6893)
 2011-04-04 19:04:05 -04:00
Nalin Dahyabhai
2ee39c5e61 - override INSTALL_SETUID at build-time so that ksu is installed into 
the buildroot with the right permissions (part of #225974)
 2011-04-01 15:52:29 -04:00
Nalin Dahyabhai
27e969332f - backport change from SVN to fix a computed-value-not-used warning in 
kpropd (#684065)
 2011-03-18 13:23:22 -04:00
Nalin Dahyabhai
41bc7a0e62 - turn off NSS as the backend for libk5crypto for now to work around its 
DES string2key not working (#679012)
- add revised upstream patch to fix double-free in KDC while returning
  typed-data with errors (CVE-2011-0284, #674325)
 2011-03-15 14:25:01 -04:00
Nalin Dahyabhai
cbdf0e37a6 - throw in a not-applied-by-default patch to try to make pkinit debugging into a run-time boolean option named "pkinit_debug" 2011-02-17 11:31:49 -05:00
Nalin Dahyabhai
b77e5a0e35 turn on NSS as the backend for libk5crypto, adding nss-devel as a build dependency when that switch is flipped 2011-02-16 19:05:39 -05:00
Nalin Dahyabhai
08f510b379 - krb5kdc init script: prototype some changes to do a quick spot-check 
of the TGS and kadmind keys and warn if there aren't any non-weak keys
  on file for them (to flush out parts of #651466)
 2011-02-09 15:25:17 -05:00
Nalin Dahyabhai
62cb58fe6f reference the raw hide bug ID for CVE-2011-0283 in the changelog 2011-02-08 16:38:16 -05:00
Nalin Dahyabhai
be633bbbb2 - add upstream patches to fix standalone kpropd exiting if the per-client 
child process exits with an error (MITKRB5-SA-2011-001), a hang or crash
  in the KDC when using the LDAP kdb backend, and an uninitialized pointer
  use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, #664009,
  CVE-2011-0281, #668719, CVE-2011-0282, #668726, CVE-2011-0283, #670567)
 2011-02-08 14:37:19 -05:00
Dennis Gilmore
4fe1ed04f8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild 2011-02-07 21:09:16 -06:00
Nalin Dahyabhai
9fed313d79 fix a compile error in the SELinux labeling patch when -DDEBUG is used (Sumit Bose) 2011-02-07 11:24:03 -05:00
Nalin Dahyabhai
293e1a6e51 - properly advertise that the kpropd init script now supports force-reload (Zbysek Mraz #630587) 2011-02-01 10:38:05 -05:00
Nalin Dahyabhai
3442cb8a33 - pkinit: when verifying signed data, use the CMS APIs for better interoperability (#636985, RT#6851) 2011-01-26 13:59:56 -05:00
Nalin Dahyabhai
8c3bae0303 update to 1.9 final 2010-12-22 17:22:08 -05:00
Nalin Dahyabhai
09a9ac8a63 - fix link flags and permissions on shared libraries (ausil) 2010-12-20 15:20:01 -05:00
Nalin Dahyabhai
ce5e3836b2 - update to 1.9 beta 3 2010-12-16 14:43:53 -05:00
Nalin Dahyabhai
695c21dd42 - update to beta 2 2010-12-06 16:55:35 -05:00
Nalin Dahyabhai
478f86fe1e add tweaks for initial whitespace that cause 389-ds to choke on the schema ldif 2010-12-06 16:55:34 -05:00
Nalin Dahyabhai
eb90866aa9 - drop not-needed-since-1.8 build dependency on rsh (ssorce) 2010-12-06 16:55:34 -05:00
Nalin Dahyabhai
b9f9657a15 - if WITH_NSS is set, built with --with-crypto-impl=nss (requires NSS 3.12.9) 2010-12-06 16:55:34 -05:00
Nalin Dahyabhai
66b6f44b6c - initial jump to 1.9 beta 1 2010-12-06 16:55:33 -05:00
Nalin Dahyabhai
5faba5957f - right, renamed the patch 2010-11-30 14:28:42 -05:00
Nalin Dahyabhai
786702d87a add upstream patch to fix various issues from MITKRB5-SA-2010-007 2010-11-30 12:00:23 -05:00
Nalin Dahyabhai
60f5ea8eaf - incorporate upstream patch to fix uninitialized pointer crash in the KDC's authorization data handling (CVE-2010-1322, #636335) 2010-10-05 15:29:32 -04:00
Nalin Dahyabhai
e84327e216 - pull down patches from trunk to implement k5login_authoritative and k5login_directory settings for krb5.conf (#539423) 2010-10-04 19:01:38 -04:00
Jesse Keating
82f4c7f41e - Rebuilt for gcc bug 634757 2010-09-29 14:34:57 -07:00
Nalin Dahyabhai
f44b554d1b - fix reading of keyUsage extensions when attempting to select pkinit client certs (part of #629022, RT#6775) 
- fix selection of pkinit client certs when one or more don't include a subjectAltName extension (part of #629022, RT#6774)
 2010-09-16 19:32:06 -04:00
Nalin Dahyabhai
3f5343a0b9 - build with -fstack-protector-all instead of the default -fstack-protector, 
so that we add checking to more functions (i.e., all of them) (#629950)
 2010-09-03 13:50:17 -04:00
Nalin Dahyabhai
a7376e1a41 - also link binaries with -Wl,-z,relro,-z,now (part of #629950) 2010-09-03 13:08:45 -04:00
Nalin Dahyabhai
6130f43a46 - fix a logic bug in computing key expiration times (RT#6762, #627022) 2010-08-24 18:29:42 -04:00
Nalin Dahyabhai
0c20d8744b - update to 1.8.3 
- drop backports of fixes for gss context expiration and error table
    registration/deregistration mismatch
  - drop patch for upstream #6750
 2010-08-04 18:22:20 -04:00
Nalin Dahyabhai
eed65b02ae - fix a typo in the changelog 2010-07-15 15:47:39 +00:00
Nalin Dahyabhai
45b591b3eb - fix parsing of the pidfile option in the KDC (upstream #6750) 2010-07-07 20:56:07 +00:00
Nalin Dahyabhai
8b8653b9be - add logrotate configuration files for krb5kdc and kadmind (#462658) 2010-07-07 18:09:05 +00:00
Nalin Dahyabhai
a0ca6e4d98 - tell krb5kdc and kadmind to create pid files, since they can 2010-07-07 17:41:39 +00:00
Nalin Dahyabhai
cb407c5fa1 - libgssapi: pull in patch from svn to stop returning context-expired 
errors when the ticket which was used to set up the context expires
    (#605366, upstream #6739)
 2010-06-21 18:26:35 +00:00
Nalin Dahyabhai
da92cbb7b4 - pull up fix for upstream #6745, in which the gssapi library would add the 
wrong error table but subsequently attempt to unload the right one
 2010-06-21 18:11:40 +00:00
Nalin Dahyabhai
e067cf87fe - update to 1.8.2 
- drop patches for CVE-2010-1320, CVE-2010-1321
 2010-06-10 22:21:43 +00:00
Nalin Dahyabhai
1313c14673 - reference the right bug -- this wasn't a problem until the revision 2010-05-27 21:10:28 +00:00
Nalin Dahyabhai
17238354c3 don't skip the PAM account check for root or the same user (more of 
#477033)
 2010-05-27 20:53:30 +00:00
Nalin Dahyabhai
ccdc4a4228 - ksu: move session management calls to before we drop privileges, like su 
does (#596887)
 2010-05-27 20:01:43 +00:00
Nalin Dahyabhai
b60e63ef2b - that -fno-strict-aliasing change merits a rebuild 2010-05-24 22:15:15 +00:00
Nalin Dahyabhai
ab9e2985db - go back to building without strict aliasing (compiler warnings in gssrpc) 2010-05-24 21:31:38 +00:00
Nalin Dahyabhai
5d72216a22 - drop explicit linking with libtinfo for applications that use libss, now 
that readline itself links with libtinfo (as of readline-5.2-3, since
    fedora 7 or so)
 2010-05-24 20:42:04 +00:00
Nalin Dahyabhai
c430745262 - make krb5-server-ldap also depend on the same version-release of 
krb5-libs, as the other subpackages do, if only to make it clearer than
    it is when we just do it through krb5-server
 2010-05-24 20:07:09 +00:00
Nalin Dahyabhai
b3e836cce9 - add patch to correct GSSAPI library null pointer dereference which could 
be triggered by malformed client requests (CVE-2010-1321, #582466)
 2010-05-18 18:14:30 +00:00
Nalin Dahyabhai
59f0148016 - fix output of kprop's init script's "status" and "reload" commands 
(#588222)
 2010-05-04 19:32:52 +00:00
Nalin Dahyabhai
98bc7d7d76 - incorporate patch to fix double-free in the KDC (CVE-2010-1320, #581922) 2010-04-20 18:26:39 +00:00
Nalin Dahyabhai
044f184f7a - fix a typo in kerberos.ldif 2010-04-14 14:28:32 +00:00
Nalin Dahyabhai
b48f2bcb58 - update to 1.8.1 
- no longer need patches for #555875, #561174, #563431, RT#6661,
    CVE-2010-0628
- replace buildrequires on tetex-latex with one on texlive-latex, which is
    the package that provides it now
 2010-04-09 13:44:05 +00:00
Nalin Dahyabhai
6b3df78771 - kdc.conf: no more need to suggest a v4 mode, or listening on the v4 port 2010-04-08 21:27:15 +00:00
Nalin Dahyabhai
8d606a93f5 - drop patch to suppress key expiration warnings sent from the KDC in the 
last-req field, as the KDC is expected to just be configured to either
    send them or not as a particular key approaches expiration (#556495)
 2010-04-08 19:14:31 +00:00
Nalin Dahyabhai
665fa22b0f - add bug numbers for the fix for CVE-2010-0628 2010-03-23 22:56:35 +00:00
Nalin Dahyabhai
cac63d2dfa - kdc.conf: no more need to suggest keeping keys with v4-compatible salting 2010-03-23 18:18:32 +00:00
Nalin Dahyabhai
4a2bf7dc5d - add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628) 2010-03-23 18:07:13 +00:00
Nalin Dahyabhai
1f83fab4c7 - remove the krb5-appl bits (the -workstation-clients and 
-workstation-servers subpackages) now that krb5-appl is its own package
 2010-03-19 21:15:33 +00:00
Nalin Dahyabhai
39cf8a4b2d - whoops, -p level off by one 2010-03-12 22:26:03 +00:00
Nalin Dahyabhai
fe99267cdf - add documentation for the ticket_lifetime option (#561174) 2010-03-12 20:44:02 +00:00
Nalin Dahyabhai
daa38f9cf3 - drop this; we're not going to worry about it 2010-03-11 19:24:17 +00:00
Nalin Dahyabhai
e03499409a - drop this; it's not sufficient any more anyway 2010-03-11 19:20:22 +00:00
Nalin Dahyabhai
0f6f154014 - correct a few typos 
- note the review bug for splitting out krb5-appl
 2010-03-08 20:10:52 +00:00
Nalin Dahyabhai
a32fda650f - this patch is no longer needed; at some point between 1.7 and 1.8 this 
was fixed in SVN
 2010-03-08 18:16:23 +00:00
Nalin Dahyabhai
516763ea91 - pull up patch to get the client libraries to correctly perform password 
changes over IPv6 (Sumit Bose, RT#6661)
 2010-03-08 16:47:24 +00:00
Nalin Dahyabhai
75b08040ff - update to 1.8 
- temporarily bundling the krb5-appl package (split upstream as of 1.8)
    until its package review is complete
- profile.d scriptlets are now only needed by -workstation-clients
- adjust paths in init scripts
- drop upstreamed fix for KDC denial of service (CVE-2010-0283)
- drop patch to check the user's password correctly using crypt(), which
    isn't a code path we hit when we're using PAM
 2010-03-05 22:19:38 +00:00
Nalin Dahyabhai
9c84ef7b56 - whoops, revert inadvertent not-working version bump 2010-03-03 16:16:35 +00:00
Nalin Dahyabhai
5ee10a1ffb - fix a null pointer dereference and crash introduced in our PAM patch that 
would happen if ftpd was given the name of a user who wasn't known to
    the local system, limited to being triggerable by gssapi-authenticated
    clients by the default xinetd config (Olivier Fourdan, #569472)
 2010-03-03 16:09:47 +00:00
Nalin Dahyabhai
d605c80ae2 - fix a regression (not labeling a kdb database lock file correctly, 
#569902)
 2010-03-02 23:01:23 +00:00
Nalin Dahyabhai
669a15d24b - move the package changelog to the end to match the usual style (jdennis) 
- scrub out references to $RPM_SOURCE_DIR (jdennis)
- include a symlink to the readme with the name LICENSE so that people can
    find it more easily (jdennis)
 2010-02-25 23:00:23 +00:00
Nalin Dahyabhai
33efa14da1 - pull up the change to make kpasswd's behavior better match the docs when 
there's no ccache (#563431)
 2010-02-17 23:25:50 +00:00
Nalin Dahyabhai
20683b0e60 - whoops, that's the wrong filename for the patch 2010-02-16 22:15:46 +00:00
Nalin Dahyabhai
c84cd0185b - apply patch from upstream to fix KDC denial of service (CVE-2010-0283, 
#566002)
 2010-02-16 21:45:25 +00:00
Nalin Dahyabhai
edcbea8d17 - update to 1.7.1 
- don't trip AD lockout on wrong password (#542687, #554351)
- incorporates fixes for CVE-2009-4212 and CVE-2009-3295
- fixes gss_krb5_copy_ccache() when SPNEGO is used
- move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to
    the devel subpackage, better lining up with the expected krb5/krb5-appl
    split in 1.8
- drop kvno,kadmin,k5srvutil,ktutil from -workstation-servers, as it
    already depends on -workstation which also includes them
 2010-02-03 17:11:35 +00:00
Nalin Dahyabhai
f20db54891 - tighten up default permissions on kdc.conf and kadm5.acl (#558343) 2010-01-25 16:58:14 +00:00
Nalin Dahyabhai
9a31789f24 - use portreserve correctly -- portrelease takes the basename of the file 
whose entries should be released, so we need three files, not one
 2010-01-22 15:08:24 +00:00
Nalin Dahyabhai
304c10003d - suppress warnings of impending password expiration if expiration is more 
than seven days away when the KDC reports it via the last-req field,
    just as we already do when it reports expiration via the key-expiration
    field (#556495)
- link with libtinfo rather than libncurses, when we can, in future RHEL
 2010-01-18 20:13:04 +00:00
Nalin Dahyabhai
da536a5974 - krb5_get_init_creds_password: check opte->flags instead of options->flags 
when checking whether or not we get to use the prompter callback
    (#555875)
 2010-01-15 20:24:36 +00:00
Nalin Dahyabhai
2baf72c02f - use portreserve to make sure the KDC can always bind to the kerberos-iv 
port, kpropd can always bind to the krb5_prop port, and that kadmind
    can always bind to the kerberos-adm port (#555279)
- correct inadvertent use of macros in the changelog (rpmlint)
 2010-01-14 21:14:26 +00:00
Nalin Dahyabhai
60b2cbeb09 - fix the description of the problem 2010-01-12 19:27:00 +00:00
Nalin Dahyabhai
c81c7789b7 - add upstream patches for KDC crash during AES and RC4 decryption 
(CVE-2009-4212), via Tom Yu (#545015)
 2010-01-12 19:24:24 +00:00
Nalin Dahyabhai
3ad86e219a - back down to the earlier version of the patch for #551764; the backported 
alternate version was incomplete
 2010-01-06 23:54:23 +00:00
Nalin Dahyabhai
abd49c944b - put the conditional back for the -devel subpackage 2010-01-06 20:05:00 +00:00
Nalin Dahyabhai
b199476767 - pull up proposed patch for creating previously-not-there lock files for 
kdb databases when 'kdb5_util' is called to 'load' (#551764)
 2010-01-05 22:55:55 +00:00
Nalin Dahyabhai
65631fa1bb - use %%global instead of %%define 
- fix conditional for future RHEL
 2010-01-05 22:55:30 +00:00
Nalin Dahyabhai
14efc0c6dd - add tracking bug ID for the latest security patch 2010-01-04 15:59:00 +00:00
Nalin Dahyabhai
795e5e14a6 - add upstream patch for KDC crash during referral processing 
(CVE-2009-3295), via Tom Yu
 2010-01-04 15:56:24 +00:00
Nalin Dahyabhai
a019df8a50 - fix a typo 2009-12-21 19:41:25 +00:00
Nalin Dahyabhai
cc8c049fe1 refresh patch for #542868 from trunk 2009-12-21 19:27:25 +00:00
Nalin Dahyabhai
ec702e8192 - move man pages that live in the -libs subpackage into the regular 
%%{_mandir} tree where they'll still be found if that package is the
    only one %installed (#529319)
 2009-12-10 22:50:50 +00:00
Nalin Dahyabhai
bfccd3939a - re-enable this change: 
- try to make gss_krb5_copy_ccache() work correctly for spnego (#542868)
 2009-12-09 21:40:48 +00:00
Nalin Dahyabhai
f21202d6a4 back that last change out 2009-12-08 20:51:25 +00:00
Nalin Dahyabhai
2358ad9bad - try to make gss_krb5_copy_ccache() work correctly for spnego (#542868) 2009-12-08 20:05:41 +00:00
Nalin Dahyabhai
d59dcd39c0 - make krb5-config suppress CFLAGS output when called with --libs (#544391) 2009-12-04 22:16:38 +00:00
Nalin Dahyabhai
19b0f85a6e - configure with --enable-dns-for-realm instead of --enable-dns, which 
isn't recognized any more
 2009-12-03 23:26:02 +00:00
Nalin Dahyabhai
fd8edea8d9 - move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation, 
where it's actually needed (#538703)
 2009-11-20 16:09:35 +00:00
Nalin Dahyabhai
c6f29fd1c4 add some conditional logic to simplify building on older Fedora releases 2009-10-23 20:29:53 +00:00
Nalin Dahyabhai
0abe2288c5 - don't forget the readme file 2009-10-13 15:49:29 +00:00
Nalin Dahyabhai
d2ad657773 - specify the location of the subsystem lock when using the status() 
function in the kadmind and kpropd init scripts, so that we get the
    right error when we're dead but have a lock file - requires initscripts
    8.99 (#521772)
 2009-09-14 17:18:59 +00:00
Nalin Dahyabhai
060205dbf8 - if the init script fails to start krb5kdc/kadmind/kpropd because it's 
already running (according to status()), return 0 (part of #521772)
 2009-09-08 19:08:28 +00:00
Nalin Dahyabhai
51ff876d52 - work around a compile problem with new openssl 2009-08-24 15:51:36 +00:00
Tomáš Mráz
c297ec78d9 - rebuilt with new openssl 2009-08-21 14:11:01 +00:00
Jesse Keating
dd62488dfd - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild 2009-07-25 04:46:50 +00:00
Nalin Dahyabhai
e1e3b07810 - simplify the man pages patch by only preprocessing the files we care 
about and moving shared configure.in logic into a shared function
 2009-07-06 22:56:11 +00:00
Nalin Dahyabhai
9e296310c6 - catch the case of ftpd printing file sizes using %i, when they might be 
bigger than an int now
 2009-07-06 22:54:34 +00:00
Nalin Dahyabhai
6f1fb7d51e - try to merge and clean up all the large file support for ftp and rcp 2009-07-01 17:52:16 +00:00
Nalin Dahyabhai
c835c2a921 - switch buildrequires: and requires: on e2fsprogs-devel into 
buildrequires: and requires: on libss-devel, libcom_err-devel, per
    sandeen on fedora-devel-list
 2009-06-29 19:28:01 +00:00
Nalin Dahyabhai
3f291ca045 - selinux labeling: use selabel_open() family of functions rather than 
matchpathcon(), bail on it if attempting to get the mutex lock fails
 2009-06-26 21:45:54 +00:00
Nalin Dahyabhai
84ade2f840 - fix a type mismatch in krb5_copy_error_message() 
- ftp: fix some odd use of strlen()
 2009-06-26 21:36:54 +00:00
Nalin Dahyabhai
1d6f8b9bad - compile with %%{?_smp_mflags} (Steve Grubb) 
- drop the bit where we munge part of the error table header, as it's not
    needed any more
 2009-06-16 21:29:37 +00:00
Nalin Dahyabhai
aecce15d40 add and own %%{_libdir}/krb5/plugins/authdata 2009-06-05 15:18:29 +00:00
Nalin Dahyabhai
34072014a1 remove obsolete files 2009-06-04 22:38:18 +00:00
Nalin Dahyabhai
2f1613d440 - update to 1.7, second pass 2009-06-04 22:09:07 +00:00
Nalin Dahyabhai
3c1272ff63 - add an auth stack to ksu's PAM configuration so that pam_setcred() calls 
won't just fail
 2009-05-19 23:21:48 +00:00
Nalin Dahyabhai
06c77ea1cd - make PAM support for ksu also set PAM_RUSER 2009-05-11 18:19:08 +00:00
Nalin Dahyabhai
df43b1e2b6 yeah, actually bump the release number 2009-04-23 22:51:25 +00:00
Nalin Dahyabhai
5ebd815122 - extend PAM support to ksu: perform account and session management for the 
target user
- pull up and merge James Leddy's changes to also set PAM_RHOST in
    PAM-aware network-facing services
 2009-04-23 22:43:26 +00:00
Nalin Dahyabhai
d3b2b69619 - fix a typo in a ksu error message (Marek Mahut) 2009-04-21 18:46:52 +00:00
Nalin Dahyabhai
f0389e0488 note why we don't just run make check here 2009-04-20 21:15:12 +00:00
Nalin Dahyabhai
724545eab6 - add LSB-style informational headers to the init scripts 2009-04-20 20:32:02 +00:00
Nalin Dahyabhai
980855a07a - explicitly run the pdf generation script using sh (part of #225974) 2009-04-17 13:29:41 +00:00
Nalin Dahyabhai
f51ed46fff - remove obsolete patch for CVE-2009-0845 
- add patches for read overflow and null pointer dereference in the
    implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
- add patch for attempt to free uninitialized pointer in libkrb5
    (CVE-2009-0846)
- add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
 2009-04-07 18:16:28 +00:00
Nalin Dahyabhai
d43a03520f - make the kpropd init script treat reload as restart (part of #225974) 2009-04-06 20:33:44 +00:00
Nalin Dahyabhai
45bffcbf45 - take the execute bit off of the protocol docs (part of #225974) 
- unflag init scripts as configuration files (part of #225974)
 2009-04-06 18:22:58 +00:00
Nalin Dahyabhai
303d2c20d2 - fixup summary texts (part of #225974) 2009-04-06 18:00:53 +00:00
Nalin Dahyabhai
fa314d1962 - escape possible macros in the changelog (part of #225974) 2009-04-06 17:52:21 +00:00
Nalin Dahyabhai
5ee95cc082 - clean up buildprereq/prereqs, explicit mktemp requires, and add the 
ldconfig for the -server-ldap subpackage (part of #225974)
 2009-04-06 17:45:29 +00:00
Nalin Dahyabhai
98a3610002 - make splitting up of the workstation bits unconditional 2009-04-06 16:46:35 +00:00
Nalin Dahyabhai
1644a79505 - move the libraries to /%{_lib}, but leave --libdir alone so that plugins 
get installed and are searched for in the same locations (#473333)
 2009-04-06 16:22:45 +00:00
Nalin Dahyabhai
e61be4fa97 - turn off krb4 support (it won't be part of the 1.7 release, but do it 
now)
- use triggeruns to properly shut down and disable krb524d when -server and
-workstation-servers gets upgraded, because it's gone now
 2009-04-06 15:56:45 +00:00
Nalin Dahyabhai
434cefd85a - libgssapi_krb5: backport fix for some errors which can occur when we fail 
to set up the server half of a context (CVE-2009-0845)
 2009-03-17 22:26:27 +00:00
Jesse Keating
78b02cd911 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild 2009-02-25 11:58:27 +00:00
Nalin Dahyabhai
4c798e4ee7 aargh, what year is it? 2009-01-16 16:19:02 +00:00
Nalin Dahyabhai
2bf7daea40 rebuild 2009-01-16 16:17:56 +00:00
Nalin Dahyabhai
b1efb9b86d - if we successfully change the user's password during an attempt to get 
initial credentials, but then fail to get initial creds from a
    non-master using the new password, retry against the master (#432334)
 2008-09-04 15:13:51 +00:00
Tom Callaway
bb9aa2106c fix license tag 2008-08-05 17:46:07 +00:00
Nalin Dahyabhai
2352d208e3 - define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep 
building
 2008-07-16 21:54:24 +00:00
Nalin Dahyabhai
b5dfa8576a quote %%{__cc} where needed because it includes whitespace now 2008-07-16 18:40:35 +00:00
Nalin Dahyabhai
6197407f58 - clear fuzz out of patches, dropping a man page patch which is no longer 
necessary
 2008-07-16 18:09:47 +00:00
Nalin Dahyabhai
14f675bab9 - build with -fno-strict-aliasing, which is needed because the library 
triggers these warnings
 2008-07-11 15:16:54 +00:00
Nalin Dahyabhai
37b6c5e715 - rework how labeling is handled to avoid a bootstrapping problem in 
headers
- don't forget to label the principal database lock file
 2008-07-11 15:14:57 +00:00
Tom Callaway
f06f7f1e03 generate include/krb5/krb5.h before building, fix conditional for sparcv9 2008-06-14 18:22:01 +00:00
Nalin Dahyabhai
9f105b4df2 - ftp: use the correct local filename during mget when the 'case' option is 
enabled (#442713)
 2008-04-16 18:54:08 +00:00
Nalin Dahyabhai
af9bedd61a - stop exporting kadmin keys to a keytab file when kadmind starts -- the 
daemon's been able to use the database directly for a long long time
    now
- belatedly add aes128,aes256 to the default set of supported key types
 2008-04-04 21:29:53 +00:00
Nalin Dahyabhai
f56b6ee2db bump for build 2008-04-01 20:54:54 +00:00
Nalin Dahyabhai
ddde7d0f6e - libgssapi_krb5: properly export the acceptor subkey when creating a lucid 
context (Kevin Coffman, via the nfs4 mailing list)
 2008-04-01 20:53:54 +00:00
Nalin Dahyabhai
7668599d1d - add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer 
when v4 compatibility is enabled on the KDC (CVE-2008-0062,
    CVE-2008-0063, #432620, #432621)
- add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
    high-numbered descriptors are used (CVE-2008-0947, #433596)
- add backport bug fix for an attempt to free non-heap memory in
    libgssapi_krb5 (CVE-2007-5901, #415321)
- add backport bug fix for a double-free in out-of-memory situations in
    libgssapi_krb5 (CVE-2007-5971, #415351)
 2008-03-18 18:13:22 +00:00
Nalin Dahyabhai
638efe585f - rework file labeling patch to not depend on fragile preprocessor 
trickery, in another attempt at fixing #428355 and friends
 2008-03-18 15:35:39 +00:00
Nalin Dahyabhai
723980d239 bump release number for rebuild 2008-02-26 21:48:24 +00:00
Nalin Dahyabhai
d4963922a8 - ftp: add patch to fix "runique on" case when globbing fixes applied 
- stop adding a redundant but harmless call to initialize the gssapi
    internals
 2008-02-26 21:18:38 +00:00
Nalin Dahyabhai
2a567feda3 - add the bug ID, close the bug 2008-02-25 20:55:41 +00:00
Nalin Dahyabhai
d5971d2776 - add patch to suppress double-processing of /etc/krb5.conf when we build 
with --sysconfdir=/etc, thereby suppressing double-logging (#231147)
 2008-02-25 20:53:41 +00:00
Nalin Dahyabhai
d73fcc15fb - remove a patch to fix problems with interfaces which are "up" but which 
have no address assigned which conflicted with a change to fix the same
    problem in 1.5 (#200979)
 2008-02-25 19:58:51 +00:00
Nalin Dahyabhai
2cc4303bbc - ftp: don't lose track of a descriptor on passive get when the server 
fails to open a file
 2008-02-25 19:50:42 +00:00
Nalin Dahyabhai
a7d42c7b03 - in login, allow PAM to interact with the user when they've been strongly 
authenticated
- in login, signal PAM when we're changing an expired password that it's an
    expired password, so that when cracklib flags a password as being weak
    it's treated as an error even if we're running as root
 2008-02-25 18:33:34 +00:00
Nalin Dahyabhai
8e9e1c07b0 - drop netdb patch 
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
    the DISALLOW_ALL_TIX flag is set on an entry, for better interop with
    Fedora, Netscape, Red Hat Directory Server (Simo Sorce)
 2008-02-18 18:44:39 +00:00
Nalin Dahyabhai
a77ce35c52 - avoid depending on <netdb.h> to define NI_MAXHOST and NI_MAXSERV for us 2008-02-13 23:10:32 +00:00
Nalin Dahyabhai
e4d2a874a4 - enable patch for key-expiration reporting 
- enable patch to make kpasswd fall back to TCP if UDP fails
- enable patch to make kpasswd use the right sequence number on retransmit
- enable patch to allow mech-specific creds delegated under spnego to be
    found when searching for creds
 2008-02-12 16:22:38 +00:00
Nalin Dahyabhai
3d4d8cf991 - note RT numbers for reference 
- include but don't apply the other suggested patch for
    kpasswd-doesn't-use-tcp
 2008-01-23 18:27:03 +00:00
Nalin Dahyabhai
dcfbb5995a - revise to reference a different patch which we also don't apply 2008-01-03 16:51:53 +00:00
Nalin Dahyabhai
f25a7f96a5 - reference unapplied patch to fix password-changing with servers other 
than the first one we try to contact
- reference bug 242502 (rawhide) instead of 242500 (rhel)
 2008-01-03 15:47:35 +00:00
Nalin Dahyabhai
1343fd1973 - bump the release 2008-01-02 17:06:19 +00:00
Nalin Dahyabhai
48872e3b7b - right, new year 2008-01-02 17:05:02 +00:00
Nalin Dahyabhai
f072055a76 - some init script cleanups 
- drop unquoted check and silent exit for "$NETWORKING" (#426852, #242500)
- krb524: don't barf on missing database if it looks like we're using
    kldap, same as for kadmin
- return non-zero status for missing files which cause startup to fail
 2008-01-02 17:03:38 +00:00
Nalin Dahyabhai
0aaa920daa - allocate space for the nul-terminator in the local pathname when looking 
up a file context, and properly free a previous context (Jose Plans,
    #426085)
 2007-12-18 18:34:06 +00:00
Nalin Dahyabhai
ea868608c1 rebuild 2007-12-05 15:21:20 +00:00
Nalin Dahyabhai
6c3186e173 note the CVE for needing the revised patch 2007-11-13 21:58:04 +00:00
Nalin Dahyabhai
4ba98f8eab add duplicate bug id 2007-11-13 21:41:20 +00:00
Nalin Dahyabhai
276a481e88 - update to 1.6.3, dropping now-integrated patches for CVE-2007-3999 and 
CVE-2007-4000 (the new pkinit module is built conditionally and goes
    into the -pkinit-openssl package, at least for now, to make a buildreq
    loop with openssl avoidable)
 2007-10-23 19:40:45 +00:00
Nalin Dahyabhai
a0f391756d - make proper use of pam_loginuid and pam_selinux in rshd and ftpd 2007-10-17 17:48:52 +00:00
Nalin Dahyabhai
528eff0ac5 - make krb5.conf %%verify(not md5 size mtime) in addition to 
%%config(noreplace), like /etc/nsswitch.conf (#329811)
 2007-10-12 18:32:28 +00:00
Nalin Dahyabhai
6e3299423a - proposed fix for not being able to find delegated krb5 creds when using 
spnego
 2007-10-04 22:08:39 +00:00
Nalin Dahyabhai
1dd0ff3e30 - proposed patch to fix receipt of delegated creds in mod_auth_kerb 2007-10-01 19:40:47 +00:00
Nalin Dahyabhai
14a08486e8 - add the bug ID to the kadmind fixes, note Fran's patch was identical to 
the one I thought we were already using in the F-7 branch
 2007-09-17 20:47:02 +00:00
Nalin Dahyabhai
2688de92f1 - move the db2 kdb plugin from -server to -libs, because a multilib libkdb 
might need it
 2007-09-11 20:52:15 +00:00
Nalin Dahyabhai
83381c77e7 - also perform PAM session and credential management when ftpd accepts a 
client using strong authentication, missed earlier
- also label kadmind log files and files created by the db2 plugin
 2007-09-11 14:12:38 +00:00
Nalin Dahyabhai
251df090d0 bump the revision 2007-09-06 20:09:14 +00:00
Nalin Dahyabhai
07adde54fa - incorporate updated fix for CVE-2007-3999 2007-09-06 20:08:19 +00:00
Nalin Dahyabhai
b54c6a0718 - incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000) 2007-09-04 18:10:23 +00:00
Nalin Dahyabhai
929680a650 add missing gawk buildrequirement 2007-08-25 05:12:34 +00:00
Nalin Dahyabhai
8499d2199c - actually bump the release number 2007-08-25 04:33:13 +00:00
Nalin Dahyabhai
5502d6651d - cover more cases in labeling files on creation 2007-08-25 04:31:34 +00:00
Nalin Dahyabhai
e0443e5457 - experimental ok-as-delegate setting patch (not applied) 2007-08-25 04:28:10 +00:00
Nalin Dahyabhai
79f8a98d4f rebuild 2007-08-23 20:50:42 +00:00
Nalin Dahyabhai
2f7dffc0f3 - include but don't apply 2007-07-26 19:08:20 +00:00
Nalin Dahyabhai
fbe8865459 - kdc.conf: default to listening for TCP clients, too (#248415) 2007-07-26 18:36:57 +00:00
Nalin Dahyabhai
34ce3fe705 - add a preliminary patch for #231147. initially not applied. 2007-07-23 21:01:33 +00:00
Nalin Dahyabhai
c0cd730c79 - update to 1.6.2 
- add "buildrequires: texinfo-tex" to get texi2pdf
 2007-07-19 16:50:28 +00:00
Nalin Dahyabhai
147635188d add CVE identifiers to the more recent changelog 2007-06-27 18:39:06 +00:00
Nalin Dahyabhai
cd3f50fb19 - incorporate fixes for MITKRB5-SA-2007-004 and MITKRB5-SA-2007-005 2007-06-27 06:08:01 +00:00
Nalin Dahyabhai
196ea67f06 - add missing pam-devel build requirement, force selinux-or-fail build 2007-06-25 01:16:51 +00:00
Nalin Dahyabhai
cb76d1ea2b rebuild 2007-06-25 00:56:37 +00:00
Nalin Dahyabhai
d360ed53e4 - label all files at creation-time according to the SELinux policy 
(#228157)
 2007-06-25 00:55:25 +00:00
Nalin Dahyabhai
e773dcc288 - um, maybe not just yet 2007-06-22 22:33:07 +00:00
Nalin Dahyabhai
2ecf4e22d8 nope, we don't provide that file 2007-06-22 22:15:03 +00:00
Nalin Dahyabhai
70ccd082ae - oops, note that pam changes went in, too 2007-06-22 22:10:15 +00:00
Nalin Dahyabhai
117cdbbea7 - preprocess kerberos.ldif into a format FDS will like better, and include 
that as a doc file as well
 2007-06-22 22:06:27 +00:00
Nalin Dahyabhai
37416c24a6 - switch man pages to being generated with the right paths in them 
- drop old, incomplete SELinux patch
- add patch from Greg Hudson to make srvtab routines report missing-file
    errors at same point that keytab routines do (#241805)
 2007-06-22 22:04:38 +00:00
Nalin Dahyabhai
ad9d82cb5c - pull patch from svn to undo unintentional chattiness in ftp 
- pull patch from svn to handle NULL krb5_get_init_creds_opt structures
    better in a couple of places where they're expected
 2007-05-24 15:43:24 +00:00
Nalin Dahyabhai
3f30bc2d6d bump release number 2007-05-23 22:06:26 +00:00
Nalin Dahyabhai
7877c27fc3 - bump to 1.6.1 2007-05-23 21:48:27 +00:00
Nalin Dahyabhai
a9c20b1574 - kadmind.init: don't fail outright if the default principal database isn't 
there if it looks like we might be using the kldap plugin
- kadmind.init: attempt to extract the key for the host-specific kadmin
    service when we try to create the keytab
 2007-05-18 22:16:16 +00:00
Nalin Dahyabhai
ea9e19241a - omit dependent libraries from the krb5-config --libs output, as using 
shared libraries (no more static libraries) makes them unnecessary and
    they're not part of the libkrb5 interface (patch by Rex Dieter,
    #240220) (strips out libkeyutils, libresolv, libdl)
 2007-05-16 19:48:19 +00:00
Nalin Dahyabhai
a7114b4891 - pull in keyutils as a build requirement to get the "KEYRING:" ccache 
type, because we've merged
 2007-05-04 19:03:00 +00:00
Nalin Dahyabhai
a321e486d2 - fix an uninitialized length value which could cause a crash when parsing 
key data coming from a directory server
- correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")
 2007-05-04 18:10:01 +00:00
Nalin Dahyabhai
1739ef7213 - move the default acl_file, dict_file, and admin_keytab settings to the 
part of the default/example kdc.conf where they'll actually have an
    effect (#236417)
 2007-04-13 19:07:25 +00:00
Nalin Dahyabhai
471b4b51f3 - add patch to correct unauthorized access via krb5-aware telnet daemon 
(#229782, CVE-2007-0956)
- add patch to fix buffer overflow in krb5kdc and kadmind (#231528,
    CVE-2007-0957)
- add patch to fix double-free in kadmind (#231537, CVE-2007-1216)
 2007-04-03 18:46:41 +00:00
Nalin Dahyabhai
598e71ffbc - add a couple of ldap-specific data files as documentation, so that admins 
have the needed schema for their directory servers
 2007-04-03 18:43:05 +00:00
Nalin Dahyabhai
aece600301 whoops, that won't work - can't do core -> extras deps 2007-03-22 20:17:58 +00:00
Nalin Dahyabhai
5c8daeafa2 - add buildrequires: on keyutils-libs-devel to enable use of keyring 
ccaches, dragging keyutils-libs in as a dependency for everyone
 2007-03-22 19:37:26 +00:00
Nalin Dahyabhai
da1eb7f057 - add patch to build semi-useful static libraries, but don't apply it 
unless we need them
 2007-02-28 20:35:53 +00:00
Nalin Dahyabhai
4aefd50874 - make profile.d scriptlets mode 644 instead of 755 (#225974) 2007-02-19 21:28:07 +00:00
Nalin Dahyabhai
3299c4b519 mock says "no resolv.conf for you!" 2007-01-30 21:21:21 +00:00
Nalin Dahyabhai
cb68887273 - clean up quoting of command-line arguments passed to the krsh/krlogin 
wrapper scripts
 2007-01-30 21:01:21 +00:00
Nalin Dahyabhai
6e6adec726 - initial update to 1.6, making the package-split optional 
- move workstation daemons to a new subpackage (#81836, #216356, #217301),
    and make the new subpackage require xinetd (#211885)
We don't get static libraries any more. Holding off on build until
    verification that this doesn't kill other things, or until we get them
    building in a semi-useful way.
 2007-01-23 22:14:15 +00:00
Nalin Dahyabhai
160a188e65 - merge back changes made between fc6 and rawhide to date 
- somewhere in here we fixed the spelling of James's last name
 2007-01-22 21:27:49 +00:00
Nalin Dahyabhai
f3820b972d - preserve timestamps on profile.d shell scriptlets 
- first cut at making RPM scriptlets failproof for install-info
- pull up pre-generated PDF docs so that we don't have multiarch
    differences due to document IDs, timestamps, and compressed data,
- pull up the script to make sure that the PDF matches its source to guard
    against the package maintainer forgetting to update when we move to a
    new release
 2007-01-22 21:23:54 +00:00
Nalin Dahyabhai
a9e6df4ffc - apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456) 
- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)
    Related: #218456
 2007-01-09 19:31:40 +00:00
Nalin Dahyabhai
3ffdc43878 - don't bail from the KDC init script if there's no database, it may be in 
a different location than the default (fenlason)
- remove the [kdc] section from the default krb5.conf -- doesn't seem to
    have been applicable for a while
 2006-10-23 20:23:05 +00:00
Nalin Dahyabhai
54faf41556 add newlines after new errors 2006-10-18 21:36:40 +00:00
Nalin Dahyabhai
74169f4b3c - way-late application of added error info in kadmind.init (#65853) 2006-10-18 16:02:47 +00:00
Nalin Dahyabhai
acad7e7e15 call autoheader when needed 2006-10-13 21:23:35 +00:00
Nalin Dahyabhai
0b70aa4de2 - provide docs in PDF format instead of as tex source (Enrico Scholz, 
#209943)
 2006-10-09 16:38:39 +00:00
Nalin Dahyabhai
6f6f8aff91 - add missing shebang headers to krsh and krlogin wrapper scripts (#209238) 2006-10-04 14:16:41 +00:00
Nalin Dahyabhai
ee98daaf74 actually bump the release 2006-09-06 20:28:20 +00:00
Nalin Dahyabhai
2ad1703afb set SS_LIB at configure-time so that libss-using apps get working readline 
support (#197044)
 2006-09-06 20:28:01 +00:00
Nalin Dahyabhai
d859fd0556 - switch to the updated patch for MITKRB-SA-2006-001 2006-08-18 16:50:54 +00:00
Nalin Dahyabhai
2bc5a13d2a - apply patch to address MITKRB-SA-2006-001 (CVE-2006-3084) 2006-08-08 22:43:10 +00:00
Nalin Dahyabhai
8c4df25456 - ensure that the gssapi library's been initialized before walking the 
internal mechanism list in gss_release_oid(), needed if called from
    gss_release_name() right after a gss_import_name() (#198092)
 2006-08-07 17:52:52 +00:00
Nalin Dahyabhai
92a65fb1b1 rebuild 2006-07-25 17:55:38 +00:00
Nalin Dahyabhai
30f6a9b1cb - pull up latest revision of patch to reduce lockups in rsh/rshd 2006-07-25 15:52:36 +00:00
Nalin Dahyabhai
ece8aeb4c7 rebuild 2006-07-17 14:36:02 +00:00
Jesse Keating
12232351f7 bumped for rebuild 2006-07-12 06:43:08 +00:00
Nalin Dahyabhai
574f4b1c31 finally think all the ducks are lined up 2006-07-06 21:25:26 +00:00
Nalin Dahyabhai
28c66f7806 - update to 1.5 2006-07-06 15:56:38 +00:00
Nalin Dahyabhai
2802804a49 actually bump the release number 2006-06-23 15:51:41 +00:00
Nalin Dahyabhai
b6fc39f13d - mark profile.d config files noreplace (Laurent Rineau, #196447) 2006-06-23 15:49:20 +00:00
Nalin Dahyabhai
a230e5aaed - add buildprereq for autoconf 2006-06-08 21:42:52 +00:00
Nalin Dahyabhai
a7215484dc - further munge krb5-config so that 'libdir=/usr/lib' is given even on 
64-bit architectures, to avoid multilib conflicts; other changes will
    conspire to strip out the -L flag which uses this, so it should be
    harmless (#192692)
 2006-05-22 23:04:06 +00:00
Nalin Dahyabhai
b3724c4388 - adjust the patch which removes the use of rpath to also produce a 
krb5-config which is okay in multilib environments (#190118)
- make the name-of-the-tempfile comment which compile_et adds to error code
    headers always list the same file to avoid conflicts on multilib
    installations
- strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib
    boxes
- strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on
    mulitlib boxes
 2006-05-08 21:47:26 +00:00
skasal
6944b2e68a Change the release number. 2006-04-14 11:25:22 +00:00
skasal
8216ee6b75 - Fix formatting typo in kinit.1 (krb5-kinit-man-typo.patch) 2006-04-14 11:21:50 +00:00
Jesse Keating
77bf5aa481 bump for bug in double-long on ppc(64) 2006-02-11 03:49:47 +00:00
Nalin Dahyabhai
2118c17c6b - give a little bit more information to the user when kinit gets the 
catch-all I/O error (#180175)
 2006-02-06 20:04:44 +00:00
Nalin Dahyabhai
5bf2d7bd12 - rebuild properly when pthread_mutexattr_setrobust_np() is defined but not 
declared, such as with recent glibc when _GNU_SOURCE isn't being used
 2006-01-20 00:28:41 +00:00
Matthias Clasen
a6fb2997f1 Use full paths in krb5.sh to avoid path lookups 2006-01-19 18:05:28 +00:00
Jesse Keating
29b9703f11 gcc update bump 2005-12-09 22:41:14 +00:00
Nalin Dahyabhai
f817e39736 - login: don't truncate passwords before passing them into crypt(), in case 
they're significant (#149476)
 2005-12-02 01:46:50 +00:00
Nalin Dahyabhai
4584045a70 - conditionalize installation of the new autoconf macro 2005-11-17 19:23:05 +00:00
Nalin Dahyabhai
f54e522bb9 - update to 1.4.3 
- make ksu setuid again (#137934, others)
 2005-11-17 18:43:13 +00:00
Nalin Dahyabhai
c82cff7d10 bump release 2005-09-13 20:27:12 +00:00
Nalin Dahyabhai
1237c021c7 - mark %%{krb5prefix}/man so that files which are packaged within it are 
flagged as %%doc (#168163)
 2005-09-13 20:26:57 +00:00
Nalin Dahyabhai
552acc8a70 - add an xinetd configuration file for encryption-only telnetd, 
parallelling the kshell/ekshell pair (#167535)
 2005-09-06 14:05:59 +00:00
Nalin Dahyabhai
fd0f8c753b bump release 2005-08-31 19:38:08 +00:00
Nalin Dahyabhai
1fcd49e050 - change the default configured encryption type for KDC databases to the 
compiled-in default of des3-hmac-sha1 (#57847)
 2005-08-31 19:37:54 +00:00
Nalin Dahyabhai
f5b93c728e update to 1.4.2 2005-08-11 22:06:35 +00:00
Nalin Dahyabhai
80238a2fd8 merge fixes for MITKRB5-SA-2005-002 and MITKRB5-SA-2005-003 2005-07-12 18:09:21 +00:00
Nalin Dahyabhai
73316152b6 - fix double-close in keytab handling 
- add port of fixes for CAN-2004-0175 to krb5-aware rcp
 2005-06-24 20:28:25 +00:00
Nalin Dahyabhai
77a40621a2 - prevent spurious EBADF in krshd when stdin is closed by the client while 
the command is running (#151111)
 2005-05-13 23:16:55 +00:00
Martin Stransky
ebda005fa9 add deadlock patch, removed old patch 2005-05-13 11:36:41 +00:00
Nalin Dahyabhai
2e8f6b3b97 - update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469 
- when starting the KDC or kadmind, if KRB5REALM is set via the
    /etc/sysconfig file for the service, pass it as an argument for the -r
    flag
 2005-05-06 20:16:06 +00:00
Nalin Dahyabhai
9142032a6f - add draft fix from Tom Yu for slc_add_reply() buffer overflow 
(CAN-2005-0469)
- add draft fix from Tom Yu for env_opt_add() buffer overflow
    (CAN-2005-0468)
will need to re-roll if the draft fix isn't the same as the final one *
 2005-03-28 18:25:19 +00:00
Nalin Dahyabhai
fe186e59d9 - don't include <term.h> into the telnet client when we're not using curses 2005-03-16 22:59:54 +00:00
Nalin Dahyabhai
d46e1d65be - use libncurses instead of libtermcap for the telnet client, because it 
provides setupterm(), which we can use instead of the internal version
 2005-03-16 00:21:35 +00:00
Nalin Dahyabhai
3759eb0ddd note to self: krb5_init_ets disappeared 2005-03-01 00:05:15 +00:00
Nalin Dahyabhai
6cf61960fa - add a doc file 2005-02-24 23:31:35 +00:00
Nalin Dahyabhai
708fedd9ea - update to 1.4 
- v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
    flag to specify that it should communicate with the server using the
    older protocol
- new libkrb5support library
- v5passwdd and kadmind4 are gone
- versioned symbols
- pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
    it on to krb5kdc
- pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
    it on to kadmind
- pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
    it on to krb524d *instead of* "-m"
- set "forwardable" in [libdefaults] in the default krb5.conf to match the
    default setting which we supply for pam_krb5
- set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting
    the compiled-in default
 2005-02-24 23:16:08 +00:00
Nalin Dahyabhai
e7236e5850 rebuild 2004-12-20 23:42:32 +00:00
Nalin Dahyabhai
712b0183e7 - 1.3.6 is out, obsoleting the patch. aargh! i mean, yay! 2004-12-20 23:30:28 +00:00
Nalin Dahyabhai
ad18b8355f - unscrew up martin's changelog date 
- incorporate fix for MITKRB5-SA-2004-004
 2004-12-20 23:24:09 +00:00
Nalin Dahyabhai
6580269909 - fixup comments 2004-12-20 23:17:34 +00:00
Martin Stransky
8f54e95678 - fix deadlock during file transfer via rsync/krsh 
- thanks goes to James Antil for hint
 2004-12-20 09:31:41 +00:00
Nalin Dahyabhai
d402e6c91a use a release number which is not already taken 2004-11-26 17:31:47 +00:00
Nalin Dahyabhai
cd44405ec2 - bump release to allow tagging of new file 2004-11-26 17:30:12 +00:00
Nalin Dahyabhai
36dc58b327 - fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, 
#140036)
- silence compiler warning in kprop by using an in-memory ccache with a
    fixed name instead of an on-disk ccache with a name generated by
    tmpnam()
 2004-11-23 05:09:46 +00:00
Nalin Dahyabhai
bd5b8f0617 fix globbing patch port mode (#139075) 2004-11-17 00:42:19 +00:00
Nalin Dahyabhai
cfebff4939 - correctly check for errors from gethostbyname_r (#129059) 2004-11-02 00:30:48 +00:00
Nalin Dahyabhai
310f94b436 - update to 1.3.5, rolling in the last set of advisories 2004-09-13 19:47:24 +00:00
cvsdist
6576f38483 auto-import changelog data from krb5-1.3.4-7.src.rpm 
Tue Aug 31 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-7
- rebuild
Tue Aug 24 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-6
- rebuild
Tue Aug 24 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-5
- incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644,
    CAN-2004-0772
Mon Aug 23 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-4
- rebuild
Mon Aug 23 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-3
- incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
    (MITKRB5-SA-2004-002, #130732)
- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003,
    #130732)
 2004-09-09 07:21:49 +00:00
cvsdist
347d5c0161 auto-import changelog data from krb5-1.3.4-2.src.rpm 
Tue Jul 27 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-2
- fix indexing error in server sorting patch (#127336)
 2004-09-09 07:21:01 +00:00
cvsdist
b6c4f1f7b6 auto-import changelog data from krb5-1.3.4-1.src.rpm 
Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
- rebuilt
Mon Jun 14 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-0.1
- update to 1.3.4 final
 2004-09-09 07:20:54 +00:00
cvsdist
970a8dcb56 auto-import changelog data from krb5-1.3.3-8.src.rpm 
Mon Jun 07 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-8
- rebuild
Fri Jun 04 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-7
- rebuild
Fri Jun 04 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-6
- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
Tue Jun 01 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-5
- rebuild
Tue Jun 01 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-4
- apply patch from MITKRB5-SA-2004-001 (#125001)
 2004-09-09 07:20:43 +00:00
cvsdist
d4f2fb9dc3 auto-import changelog data from krb5-1.3.3-3.src.rpm 
Wed May 12 2004 Thomas Woerner <twoerner@redhat.com> 1.3.3-3
- removed rpath
Thu Apr 15 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-2
- re-enable large file support, fell out in 1.3-1
- patch rcp to use long long and %lld format specifiers when reporting file
    sizes on large files
 2004-09-09 07:18:32 +00:00
cvsdist
7ebd8dc643 auto-import changelog data from krb5-1.3.3-1.src.rpm 
Tue Apr 13 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-1
- update to 1.3.3
 2004-09-09 07:17:58 +00:00
cvsdist
68d4ec48b7 auto-import changelog data from krb5-1.3.2-1.src.rpm 
Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.2-1
- update to 1.3.2
Mon Mar 08 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-12
- rebuild
Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com> 1.3.1-11.1
- rebuilt
Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com> 1.3.1-11
- rebuilt
Mon Feb 09 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-10
- catch krb4 send_to_kdc cases in kdc preference patch
Mon Feb 02 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-9
- remove patch to set TERM in klogind which, combined with the upstream fix
    in
1.3.1, actually produces the bug now (#114762)
Mon Jan 19 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-8
- when iterating over lists of interfaces which are "up" from getifaddrs(),
    skip over those which have no address (#113347)
Mon Jan 12 2004 Nalin Dahyabhai <nalin@redhat.com>
- prefer the kdc which last replied to a request when sending requests to
    kdcs
 2004-09-09 07:17:04 +00:00
cvsdist
dc2fe09903 auto-import changelog data from krb5-1.3.1-7.src.rpm 
Mon Nov 24 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-7
- fix combination of --with-netlib and --enable-dns
Tue Nov 18 2003 Nalin Dahyabhai <nalin@redhat.com>
- remove libdefault ticket_lifetime option from the default krb5.conf, it
    is ignored by libkrb5
 2004-09-09 07:16:33 +00:00
cvsdist
0b77dc9b0b auto-import changelog data from krb5-1.3.1-6.src.rpm 
Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-6
- fix bug in patch to make rlogind start login with a clean environment a
    la netkit rlogin, spotted and fixed by Scott McClung
Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-5
- include profile.d scriptlets in krb5-devel so that krb5-config will be in
    the path, reported by Kir Kolyshkin
Mon Sep 08 2003 Nalin Dahyabhai <nalin@redhat.com>
- add more etypes (arcfour) to the default enctype list in kdc.conf
- don't apply previous patch, refused upstream
Fri Sep 05 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-4
- fix 32/64-bit bug storing and retrieving the issue_date in v4 credentials
Wed Sep 03 2003 Dan Walsh <dwalsh@redhat.com> 1.3.1-3
- Don't check for write access on /etc/krb5.conf if SELinux
Tue Aug 26 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-2
- fixup some int/pointer varargs wackiness
Tue Aug 05 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-1
- rebuild
Mon Aug 04 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-0
- update to 1.3.1
Thu Jul 24 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-2
- pull fix for non-compliant encoding of salt field in etype-info2 preauth
    data from 1.3.1 beta 1, until 1.3.1 is released.
Mon Jul 21 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-1
- update to 1.3
Mon Jul 07 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.8-4
- correctly use stdargs
Wed Jun 18 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-0.beta.4
- test update to 1.3 beta 4
- ditch statglue build option
- krb5-devel requires e2fsprogs-devel, which now provides libss and
    libcom_err
Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
- rebuilt
Wed May 21 2003 Jeremy Katz <katzj@redhat.com> 1.2.8-2
- gcc 3.3 doesn't implement varargs.h, include stdarg.h instead
Wed Apr 09 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.8-1
- update to 1.2.8
 2004-09-09 07:16:22 +00:00
cvsdist
f241d93ce5 auto-import changelog data from krb5-1.2.7-14.src.rpm 
Mon Mar 31 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-14
- fix double-free of enc_part2 in krb524d
 2004-09-09 07:14:47 +00:00
cvsdist
296235f0b6 auto-import krb5-1.2.7-13 from krb5-1.2.7-13.src.rpm 2004-09-09 07:14:41 +00:00
cvsdist
1812066274 auto-import krb5-1.2.7-12 from krb5-1.2.7-12.src.rpm 2004-09-09 07:14:02 +00:00
cvsdist
933db59774 auto-import krb5-1.2.7-10 from krb5-1.2.7-10.src.rpm 2004-09-09 07:13:54 +00:00
cvsdist
5a9c9af87e auto-import krb5-1.2.7-8 from krb5-1.2.7-8.src.rpm 2004-09-09 07:13:00 +00:00
cvsdist
6c39abc07b auto-import krb5-1.2.5-15 from krb5-1.2.5-15.src.rpm 2004-09-09 07:12:53 +00:00
cvsdist
60ad4b4c27 auto-import krb5-1.2.5-7 from krb5-1.2.5-7.src.rpm 2004-09-09 07:12:37 +00:00
cvsdist
ac15fdb729 auto-import krb5-1.2.5-6 from krb5-1.2.5-6.src.rpm 2004-09-09 07:12:11 +00:00
cvsdist
07595710c6 auto-import krb5-1.2.5-5 from krb5-1.2.5-5.src.rpm 2004-09-09 07:12:05 +00:00
cvsdist
e438a6ddbd auto-import krb5-1.2.4-11 from krb5-1.2.4-11.src.rpm 2004-09-09 07:11:54 +00:00
cvsdist
d017cb2b5d auto-import krb5-1.2.4-4 from krb5-1.2.4-4.src.rpm 2004-09-09 07:11:50 +00:00
cvsdist
280a055a99 auto-import krb5-1.2.4-3 from krb5-1.2.4-3.src.rpm 2004-09-09 07:11:36 +00:00
cvsdist
9a77231fd9 auto-import krb5-1.2.4-2 from krb5-1.2.4-2.src.rpm 2004-09-09 07:11:31 +00:00
cvsdist
a422b0be58 auto-import krb5-1.2.4-1 from krb5-1.2.4-1.src.rpm 2004-09-09 07:11:28 +00:00