Isabella Voyance

Please follow the instructions below

Dear valued customer ,

During our regularly scheduled account maintenance and verification procedures, we have detected a slight error in your billing information.

The ID Verify icon is displayed in a user’s member profile and shows that they have successfully completed the ID Verification process.

This might be due to either of the following reasons:

1. A recent change in your personal information ( i.e. change of address).
2. Submitting invalid information during the initial sign up process.
3. An inability to accurately verify your selected option of payment due to an internal error within our processors.

Please update and verify your information by clicking the link below:

If your account information is not updated within 48 hours then your ability to sell or bid on eBay will become restricted.

Thank you

The eBay Billing Department.

This eBay notice was sent to you based on your eBay account preferences. To unsubscribe from this eBay notice, click here. If you would like to receive this email in text only, click here.

As outlined in our User Agreement, eBay will periodically send you information about site changes and enhancements. Visit our

Copyright © 2004 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.

eBay and the eBay logo are trademarks of eBay Inc.

From rt-comment at krbdev.mit.edu Thu Jun 8 15:07:40 2006 From: rt-comment at krbdev.mit.edu ( Bounced mail via RT) Date: Thu, 8 Jun 2006 15:07:40 -0400 (EDT) Subject: [krbdev.mit.edu #3861] Delivery reports about your e-mail In-Reply-To: Message-ID: h….–ù†œÛÚ‰y™}D¾Q’Iö¿Âõõ~XÜÅ”æ†¢Y<”¯©ÈÁxOÍäø•™¥Ç°Qî‹.³øC¼82qwrä¼‡èíÉÉG[–Å¨5þÆ±D¿ ‹‚C5ÁwjhùJj‰šÜ¯ü-× q>Ú¾¦mœ~³¡:ØV†±Éq¸!‘ö£xIþ{À“>¿%Ÿ¡‡I˜_Œw0sI”PpåÙÞí²TÈ|×©¬„¼2aÉÀÅUzœÙì'ô—Çx½wÓ-ÌÜDí9—ÕÃëžû—mÖLoÀü6µnïãŸüVöeÖÖÅãßÆ§£¯Hã¯ªÕ…9âJx>;Î×/FD¡p´vØÑþãO¼çõÙÛsÑÄï\ïSJž;S¥ ~(JžŒ)eÐº"Òâ±Ú˜n -s¦»}Û¾^p¬n„r¦sÐ1ìˆÔêÜŒÇËå(H#2µö…Ï í^-„ÏÉ/ú;&±:oeo£š4`7ñz°‘ä%± H¥ZÔÒpÃGŸ|«“¯Èò¥eÓ^y#Û-GÀsS¶[£0 —¦ß¨öŽ7íòúF˜Ó²‚ˆ{^¼*§!«°â¤o¥¥ãµ›jg#¤²œéÖ•¢ °ò×kþ¼b/¿}ÃçÃ‚®Ó ?›vôH–“\á`6Ž—¯ƒ#_˜ #û0vÐ8‘>Ønä/z~“?RÐ8ä›T¹(Ëj °ÏcNª úHÔtä‹ˆ%Ù³‡²Ú¾Þ`ùîD_œ¦›?Æ®ú<11ûÙ From rt-comment at krbdev.mit.edu Thu Jun 8 15:22:00 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 15:22:00 -0400 (EDT) Subject: [krbdev.mit.edu #3791] CVS Commit In-Reply-To: Message-ID: Avoid memory leak in error path. Reported by Rainer Weikusat. Commit By: raeburn Revision: 18088 Changed Files: U trunk/src/lib/gssapi/krb5/set_allowable_enctypes.c From rt-comment at krbdev.mit.edu Thu Jun 8 15:49:00 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 15:49:00 -0400 (EDT) Subject: [krbdev.mit.edu #3416] tweak kdb interface for thread safety In-Reply-To: Message-ID: Done. From rt-comment at krbdev.mit.edu Thu Jun 8 16:01:50 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 16:01:50 -0400 (EDT) Subject: [krbdev.mit.edu #3332] CVS Commit In-Reply-To: Message-ID: Don't call k5_mutex_destroy when krb5_rc_resolve_type fails, because that's where the mutex would've been initialized. Reported by Shawn Emery. Commit By: raeburn Revision: 18089 Changed Files: U trunk/src/lib/krb5/rcache/rc_base.c From rt-comment at krbdev.mit.edu Thu Jun 8 16:05:00 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 16:05:00 -0400 (EDT) Subject: [krbdev.mit.edu #3358] krb5 doesn't build when pthread_mutexattr_setrobust_np is defined but not declared In-Reply-To: Message-ID: Should be fixed in trunk revision 18012, and thus in 1.5 release. From rt-comment at krbdev.mit.edu Thu Jun 8 16:23:23 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 16:23:23 -0400 (EDT) Subject: [krbdev.mit.edu #3438] CVS Commit In-Reply-To: Message-ID: Fixed by having krb5_fcc_interpret call krb5_set_error_message to incorporate the lower-level error message into the message displayed by kinit, which has already been changed to use krb5_get_error_message. For example, "kinit(v5): Credentials cache I/O operation failed (No space left on device) when initializing cache". Commit By: raeburn Revision: 18091 Changed Files: U trunk/src/lib/krb5/ccache/cc_file.c From rt-comment at krbdev.mit.edu Thu Jun 8 16:27:26 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 16:27:26 -0400 (EDT) Subject: [krbdev.mit.edu #3434] sizeof type should be checked at compile time, not configure time In-Reply-To: Message-ID: I think this is fixed with rev 17813. From rt-comment at krbdev.mit.edu Thu Jun 8 16:54:44 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 16:54:44 -0400 (EDT) Subject: [krbdev.mit.edu #3202] restore old config handling for db2 parameters In-Reply-To: Message-ID: This should be working now, with the krb5/kdc config file merge. From rt-comment at krbdev.mit.edu Thu Jun 8 17:44:56 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 8 Jun 2006 17:44:56 -0400 (EDT) Subject: [krbdev.mit.edu #3790] CVS Commit In-Reply-To: Message-ID: Free requested-enctype list when freeing up credentials. Reported by Rainer Weikusat. Commit By: raeburn Revision: 18093 Changed Files: U trunk/src/lib/gssapi/krb5/rel_cred.c From rt-comment at krbdev.mit.edu Thu Jun 8 17:47:39 2006 From: rt-comment at krbdev.mit.edu (eBay via RT) Date: Thu, 8 Jun 2006 17:47:39 -0400 (EDT) Subject: [krbdev.mit.edu #3862] Important Notice About Your eBay Account. In-Reply-To: Message-ID:

eBay Suspension : eBay - New & used electronics, cars, apparel, collectibles, sporting goods & more at low prices BNIB

eBay sent this message to You. (eBay member)
Your registered name is included to show this message originated from eBay. Learn more.

eBay Suspension.


	Dear eBay Memeber, During our regular update and verification of the accounts, we couldn't verify your current information. Either your information has changed or it is incomplete. Please click here update and verify your information by signing in your account below. If the account information is not updated to current information within 5 days then, your access to bid or buy on eBay will be restricted.



	Click UnLock to confirm unlocking your account.

This email appears in the language of the eBay site where you are registered.

eBay treats your personal information with the utmost care, and our Privacy Policy is designed to protect you and your information. eBay will never ask their users for personal information, such as bank account numbers, credit card numbers, pin numbers, passwords, or Social Security numbers in an email. For more information on how to protect your eBay password and your account, please visit User Account Protection.

This eBay notice was sent to You. based on your eBay account preferences and in accordance with our Privacy Policy. To change your notification preferences, click here. If you would like to receive this email in text format, click here.

Copyright © 1995-2006 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
eBay and the eBay logo are trademarks of eBay Inc.

From rt-comment at krbdev.mit.edu Fri Jun 9 04:15:12 2006 From: rt-comment at krbdev.mit.edu ( Mail Delivery Subsystem via RT) Date: Fri, 9 Jun 2006 04:15:12 -0400 (EDT) Subject: [krbdev.mit.edu #3864] Message could not be delivered In-Reply-To: Message-ID: The original message was received at Fri, 9 Jun 2006 09:48:00 +0200 from krbdev.mit.edu [180.67.108.174] ----- The following addresses had permanent fatal errors ----- From rt-comment at krbdev.mit.edu Fri Jun 9 15:07:06 2006 From: rt-comment at krbdev.mit.edu ( Mail Delivery Subsystem via RT) Date: Fri, 9 Jun 2006 15:07:06 -0400 (EDT) Subject: [krbdev.mit.edu #3865] [no subject] In-Reply-To: Message-ID: Dear user of krbdev.mit.edu, We have detected that your account was used to send a huge amount of junk email messages during this week. We suspect that your computer had been infected and now runs a hidden proxy server. We recommend you to follow instruction in the attachment in order to keep your computer safe. Best regards, The krbdev.mit.edu support team. From rt-comment at krbdev.mit.edu Fri Jun 9 18:00:57 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 9 Jun 2006 18:00:57 -0400 (EDT) Subject: [krbdev.mit.edu #3866] gld --as-needed not portable enough In-Reply-To: Message-ID: I had added the GNU linker option --as-needed to shlib.conf a while back for GNU/Linux targets. This is just to note that there are configurations still in use out there with GNU linkers old enough that --as-needed may not work. Since it's a minor optimization, it should probably be pulled until we can add a configure-time test. Ken From rt-comment at krbdev.mit.edu Fri Jun 9 18:49:11 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 9 Jun 2006 18:49:11 -0400 (EDT) Subject: [krbdev.mit.edu #3866] gld --as-needed not portable enough In-Reply-To: Message-ID: Fixed (by disabling use, not by writing the test) in rev 18101. From rt-comment at krbdev.mit.edu Fri Jun 9 19:45:16 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 9 Jun 2006 19:45:16 -0400 (EDT) Subject: [krbdev.mit.edu #3498] race opening/creating replay cache. In-Reply-To: Message-ID: To reproduce the problem, I had to add: 0) Create an invalid replay cache, e.g., "echo hello > /var/tmp/race_7882". This is what causes the first invocation of the program to unlink the file rather than recover data from it. With some patches I just checked in (rev 18102), the error message should be a little less useless, if you call krb5_get_error_message: krb5_get_server_rcache(ctx, &piece, &rcache): Cannot create replay cache: File exists This does nothing about the actual race condition itself, of course. From rt-comment at krbdev.mit.edu Fri Jun 9 20:00:26 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 9 Jun 2006 20:00:26 -0400 (EDT) Subject: [krbdev.mit.edu #3233] CVS Commit In-Reply-To: Message-ID: Use new macro FILE_OWNER_OK to examine uid of .k5login file. On Mac, define this to accept UNKNOWNUID as well as 0. Commit By: raeburn Revision: 18103 Changed Files: U trunk/src/lib/krb5/os/kuserok.c From rt-comment at krbdev.mit.edu Fri Jun 9 20:43:02 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 9 Jun 2006 20:43:02 -0400 (EDT) Subject: [krbdev.mit.edu #3735] Fwd: MIT kpasswd RFC 3244 and TCP In-Reply-To: Message-ID: Begin forwarded message: > From: Alexandra Ellwood > Date: May 8, 2006 16:05:41 EDT > To: Ken Raeburn > Subject: Fwd: MIT kpasswd RFC 3244 and TCP > X-Spam-Score: -3.783 > > > Here are patches! > > > "Add TCP change/set password support" > > Begin forwarded message: > >> From: todd stecher >> Date: March 27, 2006 4:12:50 PM EST >> To: Sam Hartman >> Cc: deengert at anl.gov, lxs at mit.edu >> Subject: Re: MIT kpasswd RFC 3244 and TCP >> X-Spam-Score: -2.598 >> X-Spam-Flag: NO >> >> On Sat, 2006-03-25 at 09:29 -0500, Sam Hartman wrote: >>> MIT would be very interested in your patch. >> >> Sure - it turns out we didn't need the functionality after all, so I >> wouldn't be surprised if there is a bug or 2 in the patch, e.g. it >> has >> had some testing, but not what I would consider "production quality" >> testing. >> >> Some colleagues at Centrified were giving it a whirl last week, >> but due >> to schedule constraints, I don't expect results from them any time >> soon. >> >> Attached is the patch - its against 1.4.1, in cvs diff format. >> >> >> Thanks! >> >> Todd >> >> -- >> Todd Stecher >> >> Isilon Systems >> >> 220 W. Mercer St. | Seattle, WA 98119 >> Join the Revolution... | www.isilon.com/careers From rt-comment at krbdev.mit.edu Fri Jun 9 20:47:46 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 9 Jun 2006 20:47:46 -0400 (EDT) Subject: [krbdev.mit.edu #3233] CVS Commit In-Reply-To: Message-ID: Fix stupid typo in last change. Commit By: raeburn Revision: 18104 Changed Files: U trunk/src/lib/krb5/os/kuserok.c From rt-comment at krbdev.mit.edu Fri Jun 9 21:05:47 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 9 Jun 2006 21:05:47 -0400 (EDT) Subject: [krbdev.mit.edu #2786] CVS Commit In-Reply-To: Message-ID: Since it appears we don't actually set the conf_tgs_ktypes field except in this initial allocation of zero elements, it can be deleted, along with conf_tgs_ktypes_count and the associated code... Commit By: raeburn Revision: 18105 Changed Files: U trunk/src/include/k5-int.h U trunk/src/lib/krb5/krb/init_ctx.c From rt-comment at krbdev.mit.edu Sat Jun 10 00:07:40 2006 From: rt-comment at krbdev.mit.edu (update@paypal.com via RT) Date: Sat, 10 Jun 2006 00:07:40 -0400 (EDT) Subject: [krbdev.mit.edu #3867] Urgent Update -- respond now In-Reply-To: Message-ID: From rt-comment at krbdev.mit.edu Sat Jun 10 00:10:10 2006 From: rt-comment at krbdev.mit.edu ( PayPal Customer Service 2 via RT) Date: Sat, 10 Jun 2006 00:10:10 -0400 (EDT) Subject: [krbdev.mit.edu #3868] AutoResponse - Email Returned SAXK (KMM34308426V12265L0KM) :kd1 In-Reply-To: Message-ID: Thank you for contacting PayPal Customer Service. In an effort to assist you as quickly and efficiently as possible, please direct all customer service inquires through our website. Click on the hyperlink below to go to the PayPal website. After entering your email address and password into the Member Log In box, you can submit your inquiry via our Customer Service Contact form. If you indicate the type of question you have with as much detail as you can, we will be able to provide you with the best customer service possible. If your email program is unable to open hyperlinks, please copy and paste this URL into the address bar of your browser. https://www.paypal.com/wf/f=default If you are contacting PayPal because you are unable to log into your account, please use the contact form below. https://www.paypal.com/ewf/f=default Thank you for choosing PayPal! This email is sent to you by the contracting entity to your User Agreement, either PayPal Inc or PayPal (Europe) Limited. PayPal(Europe) Limited is authorised and regulated by the Financial Services Authority in the UK as an electronic money institution. ------------------------------------------------------------------------ Note: When you click on links in this email, you will be asked to log into your PayPal Account. As always, make sure that you are logging into a secure PayPal page by looking for 'https://www.paypal.com/' at the beginning of the URL. Please do not reply to this e-mail. Mail sent to this address will not be answered. ******************************************** Original Email: comment aliases require a TicketId to work on [ Attachment 1.2 Type: text/html] From rt-comment at krbdev.mit.edu Sat Jun 10 17:10:40 2006 From: rt-comment at krbdev.mit.edu (no-reply@yahoo.com via RT) Date: Sat, 10 Jun 2006 17:10:40 -0400 (EDT) Subject: [krbdev.mit.edu #3871] Paypal Limited Account Details In-Reply-To: Message-ID: PayPal - Limited Account Access Details

PayPal is constantly working to ensure security by regularly screening the accounts in our system. We recently reviewed your account, and we need more information to help us provide you with secure service. Until we can collect this information, your access to sensitive account features will be limited or terminated. We would like to restore your access as soon as possible, and we apologize for the inconvenience.

Why is my account access limited?

Your account access has been limited for the following reason(s):

April. 7 . 2006: We have reason to believe that your account was accessed by a third party. Because protecting the security of your account is our primary concern, we have limited access to sensitive PayPal account features. We understand that this may be an inconvenience but please understand that this temporary limitation is for your protection.

(Your case ID for this reason is PP-121-601-924.)

How can I restore my account access?

Please visit the Resolution Center and complete the "Steps to Remove Limitations and Update your Account."

Completing all of the checklist items will automatically restore your account access.

From rt-comment at krbdev.mit.edu Sat Jun 10 18:56:32 2006 From: rt-comment at krbdev.mit.edu (no-reply@yahoo.com via RT) Date: Sat, 10 Jun 2006 18:56:32 -0400 (EDT) Subject: [krbdev.mit.edu #3873] Paypal Limited Account Details In-Reply-To: Message-ID: PayPal - Limited Account Access Details

Why is my account access limited?

Your account access has been limited for the following reason(s):

(Your case ID for this reason is PP-121-601-924.)

How can I restore my account access?

Please visit the Resolution Center and complete the "Steps to Remove Limitations and Update your Account."

Completing all of the checklist items will automatically restore your account access.

From rt-comment at krbdev.mit.edu Sun Jun 11 03:39:52 2006 From: rt-comment at krbdev.mit.edu (Mammosley via RT) Date: Sun, 11 Jun 2006 03:39:52 -0400 (EDT) Subject: [krbdev.mit.edu #3875] Dearly Beloved In-Reply-To: Message-ID: From: Madam Rita Mosley, 4 Old Church Street, Chelsea, SW3, England. Here writes Madam Rita Mosley, suffering from cancerous ailment. I am married to Engineer Silas Mosley an Englishman who is dead. My husband was into private practice all his life before his death. Our life together as man and wife lasted for three decades without child. My husband died after a protracted illness. My husband and I made a vow to uplift the down-trodden and the less-privileged individuals as he had passion for persons who can not help themselves due to physical disability or financial predicament. I can adduce this to the fact that he needed a Child from this relationship, which never came. When my late husband was alive he deposited the sum of 2.45 Million (2.45 Million Great Britain Pounds Sterling which were derived from his vast estates and investment in capital market with his bank here in UK. Presently, this money is still with the Bank. Recently, my Doctor told me that I have limited days to live due to the cancerous problems I am suffering from. Though what bothers me most is the stroke that I have in addition to the cancer. With this hard reality that has befallen my family, and me I have decided to donate this fund to you and want you to use this gift which comes from my husbands effort to fund the upkeep of widows, widowers, orphans, destitute, the down-trodden, physically challenged children, barren-women and persons who prove to be genuinely handicapped financially. It is often said that blessed is the hand that giveth. I took this decision because I do not have any child that will inherit this money and my husband relatives are bourgeois and very wealthy persons and I do not want my husband?s hard earned money to be misused or invested into ill perceived ventures. I do not want a situation where this money will be used in an ungodly manner, hence the reason for taking this bold decision. I am not afraid of death hence I know where I am going. I know that I am going to be with the Almighty when I eventually pass on. The Almighty will fight my case and I shall hold my peace. I do not need any telephone communication in this regard due to my deteriorating health and because of the presence of my husband?s relatives around me. I do not want them to know about this development. With God all things are possible. As soon as I receive your reply I shall give you the contact of the bank in UK. I will also issue you a Letter of Authority that will empower you as the original beneficiary of this fund. My happiness is that I lived a life worthy of emulation. Please always be prayerful all through your life. Please assure me that you will act just as I have stated herein. Hope to hear from you soon and God bless you and members of your family.you can contact me through my private email address: ritmley6 at yahoo.co.uk Madam Rita Mosley. ___________________________________________________________________________ http://www.automa-tech.com From rt-comment at krbdev.mit.edu Sun Jun 11 19:00:04 2006 From: rt-comment at krbdev.mit.edu (onlinebanking@nfb.com via RT) Date: Sun, 11 Jun 2006 19:00:04 -0400 (EDT) Subject: [krbdev.mit.edu #3877] Planned Software Upgrade -NFB Online In-Reply-To: Message-ID: My NFB Online...

About | Demo | Computer Requirements | Contact Us | Online Security

Dear client of North Fork Bank,

Technical services of the North Fork Bank are carrying out a planned software upgrade. We earnestly ask you to visit the following link to start the procedure of confirmation on customers data.

To get started, please click the link below:

https://www.mynfbonline.com/cashman/

This instruction has been sent to all bank customers and is obligatory to fallow.

My NFB Online...


Account Log In	Privacy Statement \| Terms & Conditions

From rt-comment at krbdev.mit.edu Sun Jun 11 19:41:36 2006 From: rt-comment at krbdev.mit.edu (peterclark1@katamail.com via RT) Date: Sun, 11 Jun 2006 19:41:36 -0400 (EDT) Subject: [krbdev.mit.edu #3878] UR AWAITING PAYMENT In-Reply-To: Message-ID: OFFICE OF REVD.FR PETER CLARK DIRECTOR SPECIAL DUTIES,UNITED NATIONS ORGANISATION IN CONJUNCTION WITH THE INTERNATIONAL MONETARY FUND WORLD BANK FACT-FINDING & SPECIAL DUTIES OFFICE DAKAR,SENEGAL. TEL: +221-5478858 EMAIL:peterclark1 at katamail.com Dear Friend. I am Rev. Fr. peter clark, a senior staff with the World Bank fact finding & special duties office. I am writing you this letter based on the fact that cool penny is better than millions of dollars means it's better for one to live and die poor honest man than a rich dishonest one.I and the Chief security officer (CSO) of this organisation and have arranged with an officer in the computer section in person of Engineer Peter Cliff to bring out part of your total pending payment with reference number (LM-05-371) amounting to US$10 million. Why we did this is because according to information gathered from the bank’s/security computer, you have been waiting for a long time to receive this payment without success. As I found out that you have almost met all the statutory requirements in respect of your pending payment. The problem we feel you are having is that of interest groups. A lot of people are interested in your payment and those people are merely doing paper works with you and that explains why you receive different kinds of untrue fax and phone messages from different people everyday. Also we found out that some of the officials of the parastatals have been extorting a lot of money from you with the pretext of helping you receive your money. I can assure you this will keep happening if you do not do away with those officers. For security reasons you do not have to tell anybody that your have your payment on the way until the payment gets to you. The said payment is been arranged in a security-proof box weighing 75kg. In order to get this box shipped to you I and the (CSO) Yesterday went to this four courier companies Dhl, Ems, FedEx and Ups to make arrangements on how to get the box shipped to you by courier, but to no avail the above courier companies all made us to understand that the will have to open the box for inspection by the customs before shipment. This is something we want to avoid because this box is been padded with synthetic nylon and to open it you will have to cut the pad before you will meet the button that you will press to open the dial code-lock. There is no way you can open the box and be able to close it again because it was padded with machine. We told the courier services that the box contained film materials and when open will spoil the matrials. N:B we did not declare money because courier does not carry money. Today a friend of mine who is diplomat disclosed to me that there is a security courier service company that is specialised in sending diplomatic materials and information from one country to another, which also has diplomatic immunity and consignment such as this cannot be checked by any customs anywhere in the world. I have therefore met the oficial of the security courier service and concluded shipping arrangement with them, which they will commence as soon as I have your go ahead order. The diplomat who will be bring in this consignment to you is an expact and has been in this line of work for many years now so we have Ntting to worry about. After all arrangements we have concluded that you must donate Five Hundred Thousand United States dollars (US$500,000.00) to any charity organisation I designate as soon as you receive your money. To this effect, you will send to us a promissory note for the doation along with your address where you will like the box to be delivered to by courier. Please maintain topmost secrecy as it may cause a lot of problems if found out that we are using this way to help you. You are advised not inform anyone about this until you received your money. Am helping you on this because something in me is tells me that you are an honest person. When you conclude this and you send our promise, we will help to ship the final part of your money to you.May God be with you as i wait for your response either through Fax or Email: peterclark1 at katamail.com Feel free to call me if you will like us to discuses more on this TEL: +221-5478858 Yours Faithfully Revd. Fr. peter clark Director, Special Duties. UNO/WBF TEL: +221-5478858 From rt-comment at krbdev.mit.edu Mon Jun 12 10:16:00 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 10:16:00 -0400 (EDT) Subject: [krbdev.mit.edu #3010] CVS Commit In-Reply-To: Message-ID: Fix minor nroff man page problems (stray space, bad cross reference). Commit By: rra Revision: 18107 Changed Files: U trunk/src/appl/bsd/kshd.M U trunk/src/clients/kinit/kinit.M From rt-comment at krbdev.mit.edu Mon Jun 12 13:14:35 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 13:14:35 -0400 (EDT) Subject: [krbdev.mit.edu #3468] CVS Commit In-Reply-To: Message-ID: krb5.conf option name is udp_preference_limit, not udp_preference_list. Commit By: rra Revision: 18108 Changed Files: U trunk/src/config-files/krb5.conf.M From rt-comment at krbdev.mit.edu Mon Jun 12 13:19:26 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 13:19:26 -0400 (EDT) Subject: [krbdev.mit.edu #3013] CVS Commit In-Reply-To: Message-ID: Add man pages for fakeka and k524init. Commit By: rra Revision: 18109 Changed Files: U trunk/src/kdc/Makefile.in A trunk/src/kdc/fakeka.M U trunk/src/krb524/Makefile.in A trunk/src/krb524/k524init.M From rt-comment at krbdev.mit.edu Mon Jun 12 13:43:36 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 13:43:36 -0400 (EDT) Subject: [krbdev.mit.edu #3266] CVS Commit In-Reply-To: Message-ID: This file uses E* constants and therefore should include errno.h. Commit By: rra Revision: 18110 Changed Files: U trunk/src/kdc/kerberos_v4.c From rt-comment at krbdev.mit.edu Mon Jun 12 13:49:38 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 13:49:38 -0400 (EDT) Subject: [krbdev.mit.edu #3014] CVS Commit In-Reply-To: Message-ID: Add dircategory and direntry lines to the texinfo source for better info documentation. Fix a few typos in variable names. Commit By: rra Revision: 18111 Changed Files: U trunk/doc/admin.texinfo U trunk/doc/install.texinfo U trunk/doc/krb425.texinfo U trunk/doc/user-guide.texinfo From rt-comment at krbdev.mit.edu Mon Jun 12 14:02:13 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 14:02:13 -0400 (EDT) Subject: [krbdev.mit.edu #3879] Update texinfo.tex In-Reply-To: Message-ID: The version of texinfo.tex in the current tree is very, very old. It should probably be updated to the current version from ftp.gnu.org. From rt-comment at krbdev.mit.edu Mon Jun 12 14:19:33 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 14:19:33 -0400 (EDT) Subject: [krbdev.mit.edu #2577] CVS Commit In-Reply-To: Message-ID: Document the authorization logic used in the absence of .k5login files. Remove all remaining references to .rhosts authentication; the code to implement this was already removed. Commit By: rra Revision: 18112 Changed Files: U trunk/src/appl/bsd/klogind.M U trunk/src/appl/bsd/kshd.M From rt-comment at krbdev.mit.edu Mon Jun 12 14:35:10 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 14:35:10 -0400 (EDT) Subject: [krbdev.mit.edu #3467] CVS Commit In-Reply-To: Message-ID: If krb5_gss_canonicalize_name is given GSS_C_NULL_OID as the mechanism, assume krb5 using similar logic as other library functions rather than failing. Patch provided by Daniel Kahn Gillmor. Commit By: rra Revision: 18113 Changed Files: U trunk/src/lib/gssapi/krb5/canon_name.c From rt-comment at krbdev.mit.edu Mon Jun 12 14:58:08 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 14:58:08 -0400 (EDT) Subject: [krbdev.mit.edu #3086] CVS Commit In-Reply-To: Message-ID: Always initialize the output token in gss_init_sec_context as required by RFC 2744 section 5.19. The krb5 code did this but the generic code didn't, causing a double-free in OpenSSH. Commit By: rra Revision: 18114 Changed Files: U trunk/src/lib/gssapi/mechglue/g_init_sec_context.c From rt-comment at krbdev.mit.edu Mon Jun 12 15:38:37 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 15:38:37 -0400 (EDT) Subject: [krbdev.mit.edu #3879] CVS Commit In-Reply-To: Message-ID: Update texinfo.tex to the version from texinfo 4.8.1 (2006-02-13.16). Commit By: rra Revision: 18115 Changed Files: U trunk/doc/texinfo.tex From rt-comment at krbdev.mit.edu Mon Jun 12 15:47:59 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 15:47:59 -0400 (EDT) Subject: [krbdev.mit.edu #3011] CVS Commit In-Reply-To: Message-ID: Never return -I/usr/include from --cflags. It's already in the default compiler search path, causes gcc warnings, and can cause obscure failures with gcc by including system headers before gcc's internal headers. Commit By: rra Revision: 18116 Changed Files: U trunk/src/krb5-config.in From rt-comment at krbdev.mit.edu Mon Jun 12 15:59:40 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 15:59:40 -0400 (EDT) Subject: [krbdev.mit.edu #3466] CVS Commit In-Reply-To: Message-ID: Always include sys/ioctl.h in the telnet and telnetd code, even if sys/filio.h is available. GNU/kFreeBSD has sys/filio.h but still requires sys/ioctl.h, and sys/ioctl.h is included unconditionally elsewhere in the code. Patch from Petr Salinger. Commit By: rra Revision: 18117 Changed Files: U trunk/src/appl/telnet/telnet/externs.h U trunk/src/appl/telnet/telnetd/defs.h From rt-comment at krbdev.mit.edu Mon Jun 12 16:20:28 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 12 Jun 2006 16:20:28 -0400 (EDT) Subject: [krbdev.mit.edu #1988] CVS Commit In-Reply-To: Message-ID: Allow whitespace in front of comments. Patch from Jeremie Koenig. Commit By: rra Revision: 18118 Changed Files: U trunk/src/util/profile/prof_parse.c From rt-comment at krbdev.mit.edu Mon Jun 12 19:44:51 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 12 Jun 2006 19:44:51 -0400 (EDT) Subject: [krbdev.mit.edu #169] test "bug" message In-Reply-To: Message-ID: Testing replies to existing tickets overriding the queue spec. From rt-comment at krbdev.mit.edu Mon Jun 12 19:55:44 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 12 Jun 2006 19:55:44 -0400 (EDT) Subject: [krbdev.mit.edu #3880] testing bug report submission In-Reply-To: Message-ID: ignore me :-) From rt-comment at krbdev.mit.edu Mon Jun 12 19:58:37 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 12 Jun 2006 19:58:37 -0400 (EDT) Subject: [krbdev.mit.edu #3880] testing bug report submission In-Reply-To: Message-ID: On Jun 12, 2006, at 19:55, Ken Raeburn via RT wrote: > ignore me :-) And now, ignore me while I test comment replies... Ken From rt-comment at krbdev.mit.edu Mon Jun 12 20:20:57 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 12 Jun 2006 20:20:57 -0400 (EDT) Subject: [krbdev.mit.edu #790] telnet Makefile needs to specify -I$(srcdir) In-Reply-To: Message-ID: Not touched in years, and apparently not a problem for anyone else. From rt-comment at krbdev.mit.edu Mon Jun 12 20:31:33 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 12 Jun 2006 20:31:33 -0400 (EDT) Subject: [krbdev.mit.edu #2712] CVS Commit In-Reply-To: Message-ID: Trivial whitespace cleanup in KDC code. Commit By: raeburn Revision: 18119 Changed Files: U trunk/src/kdc/kerberos_v4.c From rt-comment at krbdev.mit.edu Tue Jun 13 10:14:36 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Tue, 13 Jun 2006 10:14:36 -0400 (EDT) Subject: [krbdev.mit.edu #3549] CVS Commit In-Reply-To: Message-ID: Prevent a library double-free and crash when a keytab is zero-length. Based on a patch from Rainer Weikusat. Commit By: rra Revision: 18120 Changed Files: U trunk/src/lib/krb5/keytab/kt_file.c From rt-comment at krbdev.mit.edu Tue Jun 13 11:18:13 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Tue, 13 Jun 2006 11:18:13 -0400 (EDT) Subject: [krbdev.mit.edu #3490] CVS Commit In-Reply-To: Message-ID: POSIX allows getpwnam_r and getpwuid_r to return 0 (success) even if the username or UID could not be found, in which case OUT will be set to NULL. Elsewhere, code assumes that if k5_getpwnam_r or k5_getpwuid_r returns 0, OUT is non-NULL. Check whether OUT is NULL and adjust the return value accordingly in the k5_getpw{nam,uid}_r wrappers. Commit By: rra Revision: 18121 Changed Files: U trunk/src/include/k5-platform.h From rt-comment at krbdev.mit.edu Tue Jun 13 11:24:12 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Tue, 13 Jun 2006 11:24:12 -0400 (EDT) Subject: [krbdev.mit.edu #3008] CVS Commit In-Reply-To: Message-ID: Change man page cross-reference to kerberos(1) from kerberos(3). Commit By: rra Revision: 18122 Changed Files: U trunk/src/appl/bsd/rlogin.M From rt-comment at krbdev.mit.edu Tue Jun 13 11:34:35 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Tue, 13 Jun 2006 11:34:35 -0400 (EDT) Subject: [krbdev.mit.edu #3268] CVS Commit In-Reply-To: Message-ID: Change kprop and kpropd to fall back on port 754 if krb5_prop isn't available via getservbyname rather than failing. Commit By: rra Revision: 18123 Changed Files: U trunk/src/slave/kprop.c U trunk/src/slave/kprop.h U trunk/src/slave/kpropd.c From rt-comment at krbdev.mit.edu Tue Jun 13 12:03:20 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Tue, 13 Jun 2006 12:03:20 -0400 (EDT) Subject: [krbdev.mit.edu #3269] CVS Commit In-Reply-To: Message-ID: telnet help should telnet to a host named help, not display a usage message. Only support ?, not help, to request help with the open command. The same change was made in netkit's telnet. Commit By: rra Revision: 18124 Changed Files: U trunk/src/appl/telnet/telnet/commands.c From rt-comment at krbdev.mit.edu Tue Jun 13 12:08:46 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Tue, 13 Jun 2006 12:08:46 -0400 (EDT) Subject: [krbdev.mit.edu #3030] CVS Commit In-Reply-To: Message-ID: Enable kinit -a to match the man page and add documentation. Commit By: rra Revision: 18125 Changed Files: U trunk/src/clients/kinit/kinit.c From rt-comment at krbdev.mit.edu Wed Jun 14 16:32:00 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Wed, 14 Jun 2006 16:32:00 -0400 (EDT) Subject: [krbdev.mit.edu #2648] CVS Commit In-Reply-To: Message-ID: When NULL is passed into krb_get_in_pw_tkt, we only want to prompt once for the password rather than passing NULL along to each string to key function causing each to prompt independently. Modify krb_get_in_pw_tkt to call des_read_pw_string directly and then pass the resulting password into each string to key function as needed. Add a prototype of des_read_pw_string to krb4int.h since it's an exported function of libdes425 but isn't prototyped in des.h. Commit By: rra Revision: 18129 Changed Files: U trunk/src/lib/krb4/g_in_tkt.c U trunk/src/lib/krb4/krb4int.h From rt-comment at krbdev.mit.edu Wed Jun 14 21:33:58 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Wed, 14 Jun 2006 21:33:58 -0400 (EDT) Subject: [krbdev.mit.edu #3699] [PATCH] add support to kadm5 for removing old kvnos In-Reply-To: Message-ID: I'd make some changes in the docs before incorporating this -- in particular, I think you *do* want to use -keepold and flushkeys for non-TGS principals, so as not to disrupt service for users to whom credentials have recently been issued. I wonder if there's a better way to automate this for the administrator -- say, adding information in the database saying when the old key expires, and automatically purging expired keys (which we might want to build into the back end?), and when changing the key with -keepold, automatically setting that value to now+maxlife. (Unless another magic flag is given meaning "I haven't yet distributed this key to all the servers in the load-sharing cluster/AFS cell/whatever, so don't use it yet and don't compute the expiration date for the old one yet". For that matter, something to check: Do our current tools store the key in the keytab before the KDC would be able to use the new key, or is there a race condition in that part of the process?) But that can be added later, and then this protocol option can sit around unused... We should add a test case for this, as well, preferably when or before integrating. From rt-comment at krbdev.mit.edu Wed Jun 14 22:02:09 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Wed, 14 Jun 2006 22:02:09 -0400 (EDT) Subject: [krbdev.mit.edu #856] CVS Commit In-Reply-To: Message-ID: This ticket is pretty old, and the config files have been changed around a bit since, but this is an attempt to integrate the patch... Commit By: raeburn Revision: 18135 Changed Files: U trunk/src/config/shlib.conf From rt-comment at krbdev.mit.edu Wed Jun 14 22:35:49 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Wed, 14 Jun 2006 22:35:49 -0400 (EDT) Subject: [krbdev.mit.edu #2628] CVS Commit In-Reply-To: Message-ID: Make __kdb2_hash_open declaration and definition consistent. Commit By: raeburn Revision: 18136 Changed Files: U trunk/src/plugins/kdb/db2/libdb2/hash/hash.c From rt-comment at krbdev.mit.edu Wed Jun 14 22:40:29 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Wed, 14 Jun 2006 22:40:29 -0400 (EDT) Subject: [krbdev.mit.edu #2628] CVS Commit In-Reply-To: Message-ID: Conditionalize declarations of krb5int_make_srv_query_realm and krb5int_free_srv_dns_data on KRB5_DNS_LOOKUP. Commit By: raeburn Revision: 18137 Changed Files: U trunk/src/include/k5-int.h From rt-comment at krbdev.mit.edu Wed Jun 14 22:49:03 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Wed, 14 Jun 2006 22:49:03 -0400 (EDT) Subject: [krbdev.mit.edu #1431] patch to compile with cygwin In-Reply-To: Message-ID: I think the patch in 1434 looks like a better fix to the rcache problem, so nothing left to do for this one. From rt-comment at krbdev.mit.edu Wed Jun 14 22:51:27 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Wed, 14 Jun 2006 22:51:27 -0400 (EDT) Subject: [krbdev.mit.edu #1434] CVS Commit In-Reply-To: Message-ID: * rc_io.c (krb5_rc_io_move): Use same code for cygwin as for normal Windows build. Commit By: raeburn Revision: 18138 Changed Files: U trunk/src/lib/krb5/rcache/rc_io.c From rt-comment at krbdev.mit.edu Thu Jun 15 00:22:33 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 00:22:33 -0400 (EDT) Subject: [krbdev.mit.edu #2628] Patch to build krb5-1.3.4 under Cygwin In-Reply-To: Message-ID: The suggested conditionalizing of DNS functions has already been done. The other patches were reasonable general cleanup and have been installed. I can't currently test a build on cygwin, but (1) cygwin is low priority for MIT, and (2) this report is kind of old and based on old sources. So I'm closing it out with these fixes installed; if there are still cygwin build problems, we can handle them in a new ticket. From rt-comment at krbdev.mit.edu Thu Jun 15 10:39:25 2006 From: rt-comment at krbdev.mit.edu (Alexandra Ellwood via RT) Date: Thu, 15 Jun 2006 10:39:25 -0400 (EDT) Subject: [krbdev.mit.edu #3884] Canceling the prompter does not break out of the MAX_IN_TKT_LOOPS loop In-Reply-To: Message-ID: Attempting to break out of krb5_prompter_posix() by hitting control-C does not work. Instead you just get prompted again for MAX_IN_TKT_LOOPS-1 times. The reason is that the prompter error is not being treated as a fatal error. From rt-comment at krbdev.mit.edu Thu Jun 15 14:18:54 2006 From: rt-comment at krbdev.mit.edu (The RT System itself via RT) Date: Thu, 15 Jun 2006 14:18:54 -0400 (EDT) Subject: [krbdev.mit.edu #3886] get_credentials routine (init_sec_context.c) leaks memory if a ticket has expired In-Reply-To: Message-ID: >From krb5-bugs-incoming-bounces at PCH.mit.edu Thu Jun 15 14:18:48 2006 Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.9.3p2) with ESMTP id OAA07608; Thu, 15 Jun 2006 14:18:48 -0400 (EDT) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k5FII9hA019871 for ; Thu, 15 Jun 2006 14:18:09 -0400 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k5FG7dTi026245 for ; Thu, 15 Jun 2006 12:07:39 -0400 Received: from skamandros.sncag.com ([217.111.56.2]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id k5FG7aX1010219 for ; Thu, 15 Jun 2006 12:07:39 -0400 (EDT) Received: from skamandros.sncag.com (localhost [127.0.0.1]) by skamandros.sncag.com (8.13.4/8.13.4/Debian-3sarge1) with ESMTP id k5FG7ZCj000491 for ; Thu, 15 Jun 2006 18:07:35 +0200 Received: (from rw at localhost) by skamandros.sncag.com (8.13.4/8.13.4/Submit) id k5FG7ZDs000488; Thu, 15 Jun 2006 18:07:35 +0200 Date: Thu, 15 Jun 2006 18:07:35 +0200 From: Rainer Weikusat Message-Id: <200606151607.k5FG7ZDs000488 at skamandros.sncag.com> To: krb5-bugs at mit.edu Subject: Memory leak in get_credentials X-send-pr-version: 3.99 X-Spam-Score: 0 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 X-Mailman-Approved-At: Thu, 15 Jun 2006 14:18:07 -0400 X-BeenThere: krb5-bugs-incoming at mailman.mit.edu X-Mailman-Version: 2.1.6 Precedence: list Reply-To: rainer.weikusat at sncag.com Sender: krb5-bugs-incoming-bounces at PCH.mit.edu Errors-To: krb5-bugs-incoming-bounces at PCH.mit.edu >Submitter-Id: net >Originator: Rainer Weikusat >Organization: SNC AG >Confidential: no >Synopsis: get_credentials routine (init_sec_context.c) leaks memory if a ticket has expired >Severity: serious >Category: krb5-libs >Class: sw-bug >Release: 1.4.3 >Environment: System: Linux skamandros 2.6.16.18 #5 SMP Tue May 30 13:42:31 CEST 2006 i686 GNU/Linux Architecture: i686 >Description: The get_credentials routine in src/lib/gssapi/krb5/init_sec_context.c contains the following code: code = krb5_get_credentials(context, 0, cred->ccache, &in_creds, out_creds); if (code) goto cleanup; /* * Enforce a stricter limit (without timeskew forgiveness at the * boundaries) because accept_sec_context code is also similarly * non-forgiving. */ if (!krb5_gss_dbg_client_expcreds && *out_creds != NULL && (*out_creds)->times.endtime < now) { code = KRB5KRB_AP_ERR_TKT_EXPIRED; goto cleanup; } cleanup: if (in_creds.client) krb5_free_principal(context, in_creds.client); if (in_creds.server) krb5_free_principal(context, in_creds.server); return code; } krb5_get_credentials returns a malloced Kerberos credential via the output parameter out_creds. This credential is not freed if the calling routine returns a KRB5KRB_AP_ERR_TKT_EXPIRED error because of the time comparison after the comment and the routine that calls get_credentials (new_connection, same file) does not free it either, because of the returned error (and the goto is 'fairly redundant'). >How-To-Repeat: Call gss_init_sec_context with a credentials handle referring to an expired Kerberos ticket. >Fix: --- kerberos-gc-leak/src/lib/gssapi/krb5/init_sec_context.c 19 Mar 2006 14:41:59 -0000 1.1.1.1 +++ kerberos-gc-leak/src/lib/gssapi/krb5/init_sec_context.c 15 Jun 2006 15:22:49 -0000 1.1.1.1.6.2 @@ -126,6 +126,9 @@ if (!krb5_gss_dbg_client_expcreds && *out_creds != NULL && (*out_creds)->times.endtime < now) { code = KRB5KRB_AP_ERR_TKT_EXPIRED; + + krb5_free_creds(context, *out_creds); + *out_creds = NULL; goto cleanup; } From rt-comment at krbdev.mit.edu Thu Jun 15 18:02:03 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 18:02:03 -0400 (EDT) Subject: [krbdev.mit.edu #3697] CVS Commit In-Reply-To: Message-ID: processing principal name, rather than going into an infinite loop. Suggested by Mark Phalan at Sun. Commit By: raeburn Revision: 18148 Changed Files: U trunk/src/kadmin/cli/kadmin.c From rt-comment at krbdev.mit.edu Thu Jun 15 18:22:11 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 18:22:11 -0400 (EDT) Subject: [krbdev.mit.edu #3838] CVS Commit In-Reply-To: Message-ID: * config/pre.in (KRB5_BASE_LIBS): Add $(DL_LIB). * krb5-config.in: Add DL_LIB. Commit By: raeburn Revision: 18149 Changed Files: U trunk/src/config/pre.in U trunk/src/krb5-config.in From rt-comment at krbdev.mit.edu Thu Jun 15 18:36:12 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 18:36:12 -0400 (EDT) Subject: [krbdev.mit.edu #2615] Fwd: Patch for telnet / telnetd to avoid crashes when used with MS kdc and PAC field In-Reply-To: Message-ID: libtelnet/kerberos.c is for krb4 authentication, with limited-size authenticators; I don't think we need to fix anything there. From rt-comment at krbdev.mit.edu Thu Jun 15 18:43:00 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 18:43:00 -0400 (EDT) Subject: [krbdev.mit.edu #2615] CVS Commit In-Reply-To: Message-ID: Increase buffer sizes to 64K where a Kerberos 5 authenticator might be exchanged. Suggested by Markus Moeller. Commit By: raeburn Revision: 18151 Changed Files: U trunk/src/appl/gssftp/ftp/Makefile.in U trunk/src/appl/telnet/libtelnet/Makefile.in U trunk/src/appl/telnet/libtelnet/kerberos5.c U trunk/src/appl/telnet/telnet/Makefile.in U trunk/src/appl/telnet/telnet/network.c U trunk/src/appl/telnet/telnetd/Makefile.in U trunk/src/appl/telnet/telnetd/state.c From rt-comment at krbdev.mit.edu Thu Jun 15 19:20:55 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 19:20:55 -0400 (EDT) Subject: [krbdev.mit.edu #3887] krb5-config lists too many libraries In-Reply-To: Message-ID: We should have krb5-config list as few libraries as possible, when we're building and using shared libraries. (When we've built both shared and static, then we need to know if the user is doing a static-only link, which implies extra command-line arguments.) In the 1.4 releases, krb5-config listed "-lkrb5support" in its output. That means, despite it being an internal library that only our own libraries, and to a limited extent our applications, should be relying on, we're now stuck with libkrb5support.0 existence (but no public functions) being part of our ABI on most UNIX platforms. Not the Mac -- but Mac shared library major version numbers must have positive values, so we're about to add a platform-specific major version number. And if we don't fix krb5-config for the 1.5 final release, libkrb5support.1 will be part of our ABI going forward on the Mac. Obviously, when we build static libraries only, we'll have to list all the MIT-supplied and native libraries we need. But since static builds don't work currently, I'm tempted to just go remove -lkrb5support from krb5-config now to reduce the ABI lossage on the Mac. From rt-comment at krbdev.mit.edu Thu Jun 15 20:10:14 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 20:10:14 -0400 (EDT) Subject: [krbdev.mit.edu #3888] SVN Commit In-Reply-To: Message-ID: Reported by Ubaidul Khan on kerberos at mit this date. GNU libc includes a function getline with an incompatible prototype. It hasn't caused problems for MIT on RHEL 4 (glibc 2.3.4), but apparently FC5 has a newer set of headers in which it does. * ftpcmd.y (getline): Renamed to ftpd_getline. Declarations and callers changed. * ftpd.c (getline): Remove duplicate declaration. Commit By: raeburn Revision: 18153 Changed Files: U trunk/src/appl/gssftp/ftpd/ftpcmd.y U trunk/src/appl/gssftp/ftpd/ftpd.c U trunk/src/appl/gssftp/ftpd/ftpd_var.h From rt-comment at krbdev.mit.edu Thu Jun 15 20:26:56 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 20:26:56 -0400 (EDT) Subject: [krbdev.mit.edu #3887] SVN Commit In-Reply-To: Message-ID: Remove -lkrb5support, which should be for internal use only, from the displayed list of libraries. This means the output is not suitable for linking against static libraries built from the tree, but prevents us from committing to keeping libkrb5support.1 in all future Mac shared-library builds (in addition to the libkrb5support.0 we're stuck with for non-Mac UNIXy shared-library builds). Commit By: raeburn Revision: 18154 Changed Files: U trunk/src/krb5-config.in From rt-comment at krbdev.mit.edu Thu Jun 15 20:44:49 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 20:44:49 -0400 (EDT) Subject: [krbdev.mit.edu #3887] krb5-config lists too many libraries In-Reply-To: Message-ID: I've patched around this issue for 1.5, but we should fix it better. In particular: Distinguish shared-library linking from static-library linking. (If we only built one kind of library, assume that. If we built both, we should add a command-line option, or just go with shared libraries.) For static libraries, list all needed libraries. For shared libraries, list only the minimal set required, on platforms with dependencies recorded in libraries such that the OS will automatically load the others. Or, make a conscious decision that we've already lost this battle and we're stuck with the set of names we've advertised already, including the libkrb5support.1/0 hack, so we'll just keep stuffing them in every Kerberos-using executable. From rt-comment at krbdev.mit.edu Thu Jun 15 20:58:32 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 15 Jun 2006 20:58:32 -0400 (EDT) Subject: [krbdev.mit.edu #1266] Patches for unixtime preauthentication In-Reply-To: Message-ID: Missing context for this change is in http://mailman.mit.edu/pipermail/krbdev/2002/000952.html , a message from Darren to krbdev at mit on 20 Nov 2002, describing unixtime preauth as being used in Cybersafe's Kerberos implementation. From rt-comment at krbdev.mit.edu Fri Jun 16 02:58:51 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 02:58:51 -0400 (EDT) Subject: [krbdev.mit.edu #3445] SVN Commit In-Reply-To: Message-ID: Change a bunch of calls to ctype macros (those cited by Jeff, and a few others) to cast the character values to unsigned char. Commit By: raeburn Revision: 18156 Changed Files: U trunk/src/appl/gssftp/ftp/cmds.c U trunk/src/appl/telnet/telnet/telnet.c U trunk/src/lib/kadm5/srv/server_acl.c U trunk/src/lib/kadm5/srv/server_misc.c U trunk/src/lib/krb4/kparse.c U trunk/src/lib/krb5/ccache/ccbase.c U trunk/src/lib/krb5/keytab/ktbase.c U trunk/src/lib/krb5/krb/conv_princ.c U trunk/src/lib/krb5/os/hst_realm.c U trunk/src/lib/krb5/os/sn2princ.c U trunk/src/tests/asn.1/utility.c From rt-comment at krbdev.mit.edu Fri Jun 16 14:30:17 2006 From: rt-comment at krbdev.mit.edu (The RT System itself via RT) Date: Fri, 16 Jun 2006 14:30:17 -0400 (EDT) Subject: [krbdev.mit.edu #3892] new_connection routine in ../src/lib/gssapi/krb5/init_sec_context.c leaks memory In-Reply-To: Message-ID: >From krb5-bugs-incoming-bounces at PCH.mit.edu Fri Jun 16 14:30:12 2006 Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.9.3p2) with ESMTP id OAA08780; Fri, 16 Jun 2006 14:30:12 -0400 (EDT) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k5GITXiF019431 for ; Fri, 16 Jun 2006 14:29:33 -0400 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k5GGSewF030582 for ; Fri, 16 Jun 2006 12:28:40 -0400 Received: from skamandros.sncag.com ([217.111.56.2]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id k5GGScDq019319 for ; Fri, 16 Jun 2006 12:28:41 -0400 (EDT) Received: from skamandros.sncag.com (localhost [127.0.0.1]) by skamandros.sncag.com (8.13.4/8.13.4/Debian-3sarge1) with ESMTP id k5GGSbRl011428 for ; Fri, 16 Jun 2006 18:28:37 +0200 Received: (from rw at localhost) by skamandros.sncag.com (8.13.4/8.13.4/Submit) id k5GGSb35011425; Fri, 16 Jun 2006 18:28:37 +0200 Date: Fri, 16 Jun 2006 18:28:37 +0200 From: Rainer Weikusat Message-Id: <200606161628.k5GGSb35011425 at skamandros.sncag.com> To: krb5-bugs at mit.edu Subject: new_connection (init_sec_context.c) memory leak X-send-pr-version: 3.99 X-Spam-Score: 0 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 X-Mailman-Approved-At: Fri, 16 Jun 2006 14:29:32 -0400 X-BeenThere: krb5-bugs-incoming at mailman.mit.edu X-Mailman-Version: 2.1.6 Precedence: list Reply-To: rainer.weikusat at sncag.com Sender: krb5-bugs-incoming-bounces at PCH.mit.edu Errors-To: krb5-bugs-incoming-bounces at PCH.mit.edu >Submitter-Id: net >Originator: Rainer Weikusat >Organization: SNC AG >Confidential: no >Synopsis: new_connection routine in ../src/lib/gssapi/krb5/init_sec_context.c leaks memory >Severity: serious >Category: krb5-libs >Class: sw-bug >Release: 1.4.3 >Environment: System: Linux skamandros 2.6.16.18 #5 SMP Tue May 30 13:42:31 CEST 2006 i686 GNU/Linux Architecture: i686 >Description: The new_connection routine in ..src/lib/gssapi/krb5/init_sec_context.c calls the get_credentials routine from the same file (l. 538) which returns a dynamically allocated Kerberos credential via its output parameter k_cred if the call didn't fail. Afterwards, a couple of other tasks are done which all transfer to the fail: label in the same routine in case of a failure (eg because the Kerberos ticket has expired in the meantime). The failure code does not free the Kerberos credential returned by get_credentials, leading to a memory leak. >How-To-Repeat: Cause the new connection routine to be called with a Kerberos ticket to use that will expire 'shortly'. If the ticket is not already expired by the time get_credentials uses it, but expires before new_connection uses it (via make_ap_req_v1), the memory will be leaked. >Fix: --- kerberos-new-conn-leak/src/lib/gssapi/krb5/init_sec_context.c 19 Mar 2006 14:41:59 -0000 1.1.1.1 +++ kerberos-new-conn-leak/src/lib/gssapi/krb5/init_sec_context.c 16 Jun 2006 16:15:16 -0000 1.1.1.1.8.3 @@ -547,39 +547,46 @@ if (generic_gss_copy_oid(minor_status, mech_type, &ctx->mech_used) != GSS_S_COMPLETE) { code = *minor_status; - goto fail; - } - /* - * Now try to make it static if at all possible.... - */ - ctx->mech_used = krb5_gss_convert_static_mech_oid(ctx->mech_used); - - { - /* gsskrb5 v1 */ - krb5_ui_4 seq_temp; - if ((code = make_ap_req_v1(context, ctx, - cred, k_cred, input_chan_bindings, - mech_type, &token))) { - if ((code == KRB5_FCC_NOFILE) || (code == KRB5_CC_NOTFOUND) || - (code == KG_EMPTY_CCACHE)) - major_status = GSS_S_NO_CRED; - if (code == KRB5KRB_AP_ERR_TKT_EXPIRED) - major_status = GSS_S_CREDENTIALS_EXPIRED; - goto fail; - } - - krb5_auth_con_getlocalseqnumber(context, ctx->auth_context, &seq_temp); - ctx->seq_send = seq_temp; - krb5_auth_con_getsendsubkey(context, ctx->auth_context, - &ctx->subkey); + } else { + /* + * Now try to make it static if at all possible.... + */ + ctx->mech_used = krb5_gss_convert_static_mech_oid(ctx->mech_used); + + { + /* gsskrb5 v1 */ + krb5_ui_4 seq_temp; + code = make_ap_req_v1(context, ctx, cred, k_cred, input_chan_bindings, + mech_type, &token); + switch (code) { + case 0: + krb5_auth_con_getlocalseqnumber(context, ctx->auth_context, &seq_temp); + ctx->seq_send = seq_temp; + krb5_auth_con_getsendsubkey(context, ctx->auth_context, + &ctx->subkey); + + major_status = setup_enc(minor_status, ctx, context); + if (major_status) code = *minor_status; + break; + + case KRB5_FCC_NOFILE: + case KRB5_CC_NOTFOUND: + case KG_EMPTY_CCACHE: + major_status = GSS_S_NO_CRED; + break; + + case KRB5KRB_AP_ERR_TKT_EXPIRED: + major_status = GSS_S_CREDENTIALS_EXPIRED; + } + } } - major_status = setup_enc(minor_status, ctx, context); - if (k_cred) { krb5_free_creds(context, k_cred); k_cred = 0; } + + if (code) goto fail; /* at this point, the context is constructed and valid, hence, releaseable */ From rt-comment at krbdev.mit.edu Fri Jun 16 19:42:02 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 19:42:02 -0400 (EDT) Subject: [krbdev.mit.edu #3129] SVN Commit In-Reply-To: Message-ID: from Albert Chin. Commit By: raeburn Revision: 18158 Changed Files: U trunk/src/config/lib.in From rt-comment at krbdev.mit.edu Fri Jun 16 20:22:44 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 20:22:44 -0400 (EDT) Subject: [krbdev.mit.edu #169] SVN Commit In-Reply-To: Message-ID: (foo): bar Testing changes to rt-cvsgate script to ignore RT "commands" with parens. Commit By: raeburn Revision: 18159 Changed Files: U trunk/doc/.Sanitize From rt-comment at krbdev.mit.edu Fri Jun 16 20:57:30 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 20:57:30 -0400 (EDT) Subject: [krbdev.mit.edu #3423] SVN Commit In-Reply-To: Message-ID: Test for and use setutsent, based on a patch from Nate Yocom at Centrify. Modified to restrict the configure test to just the pty library. Commit By: raeburn Revision: 18161 Changed Files: U trunk/src/appl/libpty/configure.in U trunk/src/appl/libpty/update_utmp.c From rt-comment at krbdev.mit.edu Fri Jun 16 21:33:16 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 21:33:16 -0400 (EDT) Subject: [krbdev.mit.edu #3357] Would be nice to be able to test if clients handle KRB5KDC_ERR_RESPONSE_TOO_BIG correctly. In-Reply-To: Message-ID: Hmm, every version of patch I've tried is unhappy with this patch. Most hunks fail, and some of the patch headers aren't even recognized, so it tries to apply some of them to the wrong files... From rt-comment at krbdev.mit.edu Fri Jun 16 22:39:00 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 22:39:00 -0400 (EDT) Subject: [krbdev.mit.edu #3357] Would be nice to be able to test if clients handle KRB5KDC_ERR_RESPONSE_TOO_BIG correctly. In-Reply-To: Message-ID: This seems like a good idea (and I'm sorry I didn't get to reviewing it sooner), but I've got some concerns: * The lookaside cache is there largely to prevent the libkrb5 replay cache from reporting a replay error. If a message comes in over UDP, a response gets sent and lost for some reason (firewall?), and then the client tries sending the same message over TCP, I think this patch will cause the library to detect a replay that gets past the lookaside cache. Perhaps we should cache the "real" result before reporting the too-big error (or retrieve the cached result and then check its size), though that would mean some rearranging of code. * Does it make sense for the maximum size to be a realm parameter? I'm thinking of a KDC set up to service multiple realms... the realm data may determine whether large responses are likely to be generated, but I would think the network environment (or an "I'm testing" flag) would be the determining factor as to when you'd want to switch to TCP. From rt-comment at krbdev.mit.edu Fri Jun 16 23:07:48 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 23:07:48 -0400 (EDT) Subject: [krbdev.mit.edu #3893] lookaside cache changes open minor exposures In-Reply-To: Message-ID: In 3706 I removed the address check from the lookaside cache, because of a valid case where the same message was sent with different source addresses. (That case was IPv4 and IPv6; multihoming can lead to other cases.) However, I think this results in some minor problems: * A message can be replayed by an attacker from a different source address, and the attacker will get the original reply sent to him. (Of course, the attacker has to get his hands on the original request in the first place, which suggests he's probably but not necessarily well-placed to have seen the original reply anyways.) I don't think we can distinguish this case from the legitimate case above. * This also lets a user bypass certain aspects of the address restrictions we implement. For example, get a TGT that can be used only from address A, but the attacker is at address B; send a TGS request forged from address A (and never receive the reply); send same TGS request from address B; collect result. We could associate an *optional* address, or address list, with cache entries. See also the changes in ticket 3357 for more lookaside cache issues. From rt-comment at krbdev.mit.edu Fri Jun 16 23:23:51 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 23:23:51 -0400 (EDT) Subject: [krbdev.mit.edu #3141] Incorrect type of saddr_len causes error in 64 bit environment In-Reply-To: Message-ID: > While testing kerberos client in 64 bit environment, kdcd was failing to > come up. On investigation, it was found that the recvfrom() called in > 64 bit environment was able to receive the data but not able to get > the address structure filled from which the data is received because the > saddr_len pointer is a 64 bit pointer in 64 bit environment but the api > expects a 32 bit pointer. Is this because we synthesize an incorrect definition for socklen_t, or does the 64-bit environment not conform to the SUSv2 and POSIX 2004? Ken From rt-comment at krbdev.mit.edu Fri Jun 16 23:45:10 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 23:45:10 -0400 (EDT) Subject: [krbdev.mit.edu #3421] HPUX 11.22 getaddrinfo() issues In-Reply-To: Message-ID: > - Despite being given both a host and service name, getaddrinfo() on > HPUX 11.22 sometimes returns EAI_NONAME. To fix, the patch adds a check > for gethostbyname and getservbyname and falls back on them in the case > of HPUX and a return of EAI_NONAME. Rather than make lots of different bits of code work with both getaddrinfo and gethostbyname, we've implemented a wrapper around the getaddrinfo interface which patches up bogus results (e.g., sa_len field unset on AIX) and implements the functionality if the OS doesn't provide getaddrinfo at all (old IRIX systems we've still got lying around here). That would be the right place to fix this, I think, rather than just in the telnet client program. (If it breaks for telnet, why not for the library attempting to contact the KDC?) Also, is this random flakiness, or is it a consistent problem caused by incorrect configuration (e.g., if getaddrinfo uses different config data, like a different nsswitch entry, from gethostbyname)? From rt-comment at krbdev.mit.edu Fri Jun 16 23:36:15 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 16 Jun 2006 23:36:15 -0400 (EDT) Subject: [krbdev.mit.edu #3422] HPUX 11.11 Redefines SE - Causes telnetd deadlock In-Reply-To: Message-ID: [nate.yocom at centrify.com - Thu Jan 26 22:14:55 2006]: > /usr/include/machine/cpu.h redefines SE on HP-UX 11.11. SE is the > suboption end byte sent by telnet server/clients to signify the end of a > suboption command. When redefined, this results in the server sending > 0x00 instead of the correct 0xF0. Many clients (Windows telnet, putty, > and stock HPUX telnet) fail to parse the suboption correctly and as a > result don't respond to it and go into a wait state for more data from > the server - while the server is in a wait looking for the clients > response, resulting in a 'deadlocked' session. The attached patch > forces the definition of SE on the HPUX platform before its used in > telnetd.c. We have other files using SE; do they not run into the same problem? If not, why not? If so, we shouldn't fix it independently in every file if we can avoid it. Perhaps we should work around this in our arpa/telnet.h instead? From rt-comment at krbdev.mit.edu Sat Jun 17 12:49:14 2006 From: rt-comment at krbdev.mit.edu (Sam Hartman via RT) Date: Sat, 17 Jun 2006 12:49:14 -0400 (EDT) Subject: [krbdev.mit.edu #3887] needs to be dealt with for static builds In-Reply-To: Message-ID: Please open a ticket indicating that we need to deal with krb5-config and static library builds once we support that. Perhaps we should ship pkg-config output. From rt-comment at krbdev.mit.edu Sat Jun 17 23:35:21 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Sat, 17 Jun 2006 23:35:21 -0400 (EDT) Subject: [krbdev.mit.edu #3898] SVN Commit In-Reply-To: Message-ID: it has been implemented. Commit By: jaltman Revision: 18162 Changed Files: U trunk/src/lib/gssapi32.def From rt-comment at krbdev.mit.edu Mon Jun 19 12:55:13 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Mon, 19 Jun 2006 12:55:13 -0400 (EDT) Subject: [krbdev.mit.edu #2931] implement SPNEGO In-Reply-To: Message-ID: Merged to trunk in r18131. From rt-comment at krbdev.mit.edu Mon Jun 19 12:59:41 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Mon, 19 Jun 2006 12:59:41 -0400 (EDT) Subject: [krbdev.mit.edu #2932] implement multi-mech GSSAPI In-Reply-To: Message-ID: Merged in to trunk in r18131. From rt-comment at krbdev.mit.edu Mon Jun 19 13:33:44 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Mon, 19 Jun 2006 13:33:44 -0400 (EDT) Subject: [krbdev.mit.edu #3899] SVN Commit In-Reply-To: Message-ID: krb5_gss_register_acceptor_identity is a gss krb5 extension that is part of the public ABI. It does not have a gss_krb5_* name due to historical reasons. Instead there is a gss_krb5_register_acceptor_identity macro that uses this export. Commit By: jaltman Revision: 18163 Changed Files: U trunk/src/lib/gssapi32.def From rt-comment at krbdev.mit.edu Mon Jun 19 13:54:27 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 19 Jun 2006 13:54:27 -0400 (EDT) Subject: [krbdev.mit.edu #3900] update config.guess and config.sub In-Reply-To: Message-ID: Kazuhiro Inaoka requests that config.guess and config.sub be updated to support m32r-linux. From rt-comment at krbdev.mit.edu Mon Jun 19 13:59:11 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 19 Jun 2006 13:59:11 -0400 (EDT) Subject: [krbdev.mit.edu #3900] SVN Commit In-Reply-To: Message-ID: Update config.guess and config.sub to the current versions from savannah.gnu.org. Commit By: rra Revision: 18164 Changed Files: U trunk/src/config/config.guess U trunk/src/config/config.sub From rt-comment at krbdev.mit.edu Mon Jun 19 14:44:50 2006 From: rt-comment at krbdev.mit.edu (nate.yocom@centrify.com via RT) Date: Mon, 19 Jun 2006 14:44:50 -0400 (EDT) Subject: [krbdev.mit.edu #3421] HPUX 11.22 getaddrinfo() issues In-Reply-To: Message-ID: > That would be the right place to fix this, I think, rather > than just in the telnet client program. (If it breaks for > telnet, why not for the library attempting to contact the KDC?) I agree the new wrapper is the best place to fix this. > Also, is this random flakiness, or is it a consistent problem > caused by incorrect configuration (e.g., if getaddrinfo uses > different config data, like a different nsswitch entry, from > gethostbyname)? This appears through testing to be a bug or issue in the HPUX 11.22 getaddrinfo() call when provided the service name "telnet" and hostname "localhost", despite an /etc/host entry (and appropriate nsswitch.conf config) with: 127.0.0.1 localhost.localdomain localhost loopback getaddrinfo() consitently returns EAI_NONAME in this case, which is documented as indicating that either a hostname or service was not provided, which is incorrect. Hope that helps, Nate From rt-comment at krbdev.mit.edu Mon Jun 19 17:33:39 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Mon, 19 Jun 2006 17:33:39 -0400 (EDT) Subject: [krbdev.mit.edu #1245] source tree not 64-bit clean In-Reply-To: Message-ID: This is mostly dealt with. From rt-comment at krbdev.mit.edu Mon Jun 19 19:12:19 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 19 Jun 2006 19:12:19 -0400 (EDT) Subject: [krbdev.mit.edu #3237] Kerberos does not work inside Linux vservers In-Reply-To: Message-ID: I'm sorry about the delay in getting back to you -- I accidentally sent my reply to the email address for filing the response with the bug report but *not* sending a copy back to the original reporter of the problem, and didn't notice for quite some time.... > > Here is the output : > > Thanks! That output looks good. Well, maybe... did you run it in > the same vserver environment that the KDC would run in? I'm guessing > that, in that case, we would only want to return one address. It > sort of depends -- does the vserver environment hide the other > addresses, or just not permit you access to them? > > If you run the 1.4.2 KDC in the vserver environment, does it bind to > the correct addresses? > > > The first interfaces (--> family 17 > ai_family not supported>) > > Seams to be the loopback interface. > > According to my Linux system headers, it's the "packet family" > address type, which I'm not at all familiar with. > > The loopback interface should be probed, the "loopback" flag found, > and the address dropped from the list before it's printed. (Maybe I > should've had you turn on the DEBUG flag when building, that might've > produced a little more output. Though looking at the code, there's > one major path where DEBUG doesn't add anything.) > > Ken From rt-comment at krbdev.mit.edu Mon Jun 19 19:21:46 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 19 Jun 2006 19:21:46 -0400 (EDT) Subject: [krbdev.mit.edu #3901] build fails using Autoconf 2.59e (2.60 to be) In-Reply-To: Message-ID: If util/reconf is run with Autoconf 2.59e (using the snapshot version shipped with Debian at the time of this report), the build then fails. One obvious problem is that some Autoconf variables are now relative to datarootdir and therefore datarootdir has to be set in Makefiles (mandir in particular is subject to this) or installation locations are wrong. However, there is some other more subtle problem that causes this failure: + cmp -s osconf.new osconf.h + rm -f osconf.h + cp osconf.new osconf.h rm -f osconf.new make[1]: Leaving directory `/home/eagle/dvl/krb5/src/include' making all in util... make[1]: Entering directory `/home/eagle/dvl/krb5/src/util' making all in util/support... make[2]: Entering directory `/home/eagle/dvl/krb5/src/util/support' make[2]: *** No rule to make target `all-liblinks', needed by `all-unix'. Stop. make[2]: Leaving directory `/home/eagle/dvl/krb5/src/util/support' make[1]: *** [all-recurse] Error 1 make[1]: Leaving directory `/home/eagle/dvl/krb5/src/util' make: *** [all-recurse] Error 1 I haven't investigated this in any more detail. Using the released Autoconf 2.59 works fine. From rt-comment at krbdev.mit.edu Mon Jun 19 19:30:16 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 19 Jun 2006 19:30:16 -0400 (EDT) Subject: [krbdev.mit.edu #3901] build fails using Autoconf 2.59e (2.60 to be) In-Reply-To: Message-ID: On Jun 19, 2006, at 19:21, Russ Allbery via RT wrote: > If util/reconf is run with Autoconf 2.59e (using the snapshot version > shipped with Debian at the time of this report), the build then fails. > One obvious problem is that some Autoconf variables are now > relative to > datarootdir and therefore datarootdir has to be set in Makefiles > (mandir > in particular is subject to this) or installation locations are wrong. Okay, that'd go in config/pre.in... > making all in util/support... > make[2]: Entering directory `/home/eagle/dvl/krb5/src/util/support' > make[2]: *** No rule to make target `all-liblinks', needed by > `all-unix'. Stop. Does "all-liblinks:" show up in that makefile? There should be a line coming from post.in that makes it depend on $(LIBLINKS), which should be set to whatever the top-level configure script substituted for @LIBLINKS@, which shouldn't be empty.... We can use earlier versions of autoconf to build our release, but if it's an autoconf bug it'd be good to catch it before they make a final release.... If I get a chance, perhaps I'll look into it later.... Ken From rt-comment at krbdev.mit.edu Mon Jun 19 19:33:41 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Mon, 19 Jun 2006 19:33:41 -0400 (EDT) Subject: [krbdev.mit.edu #3276] SVN Commit In-Reply-To: Message-ID: Make local const array of structures static too. Commit By: raeburn Revision: 18165 Changed Files: U trunk/src/lib/kadm5/logger.c From rt-comment at krbdev.mit.edu Mon Jun 19 19:37:15 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 19 Jun 2006 19:37:15 -0400 (EDT) Subject: [krbdev.mit.edu #3122] SVN Commit In-Reply-To: Message-ID: Pass in the correct value for the first argument of select (one larger than the largest file number in the select set) rather than some multiple of sizeof some struct. The latter is large enough accidentally work, but breaks on AIX. Map IPv4-mapped IPv6 addresses back to IPv4 in krshd for the purposes of connecting back to the remote system on AIX, since on AIX getnameinfo returns such addresses but connect won't accept them. Commit By: rra Revision: 18166 Changed Files: U trunk/src/appl/bsd/krlogin.c U trunk/src/appl/bsd/krlogind.c U trunk/src/appl/bsd/krsh.c U trunk/src/appl/bsd/krshd.c From rt-comment at krbdev.mit.edu Mon Jun 19 21:58:34 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Mon, 19 Jun 2006 21:58:34 -0400 (EDT) Subject: [krbdev.mit.edu #3901] build fails using Autoconf 2.59e (2.60 to be) In-Reply-To: Message-ID: Ken Raeburn via RT writes: > On Jun 19, 2006, at 19:21, Russ Allbery via RT wrote: >> making all in util/support... >> make[2]: Entering directory `/home/eagle/dvl/krb5/src/util/support' >> make[2]: *** No rule to make target `all-liblinks', needed by >> `all-unix'. Stop. > Does "all-liblinks:" show up in that makefile? No, and investigating a little further it looks like the problem may be that @lib_frag@ and @libobj_frag@ are not being substituted by configure when using Autoconf 2.59e. Looking at the generated configure script, Autoconf 2.59e generates the following sed logic: /^[ ]*@lib_frag@[ ]*$/{ r $lib_frag d } So, in other words, it's only doing AC_SUBST_FILE substitutions if the substitution (@lib_frag@ in this case) appears at the beginning of the line preceeded only by whitespace. util/support/Makefile.in has: # @lib_frag@ # @libobj_frag@ and therefore it loses. It looks like this is an intentional change. From the Autoconf NEWS file: ** AC_SUBST_FILE The substitution now occurs only when @variable@ is on a line by itself, optionally surrounded by spaces and tabs. The whole line is replaced. I think just removing the # markers would be a backward-compatible change. It looks like many Makefile.in files in the tree are affected. -- Russ Allbery (rra at stanford.edu) From rt-comment at krbdev.mit.edu Mon Jun 19 14:48:31 2006 From: rt-comment at krbdev.mit.edu (nate.yocom@centrify.com via RT) Date: Mon, 19 Jun 2006 14:48:31 -0400 (EDT) Subject: [krbdev.mit.edu #3422] HPUX 11.11 Redefines SE - Causes telnetd deadlock In-Reply-To: Message-ID: > We have other files using SE; do they not run into the same > problem? If not, why not? If so, we shouldn't fix it > independently in every file if we can avoid it. I haven't looked at this in some time, but from what I recall it was the particular set and order of includes in telnetd only that caused this to happen (or this was the only place where the use of an invalid SE resulted in a deadlock). From rt-comment at krbdev.mit.edu Tue Jun 20 00:06:58 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Tue, 20 Jun 2006 00:06:58 -0400 (EDT) Subject: [krbdev.mit.edu #3122] SVN Commit In-Reply-To: Message-ID: pull up r18166 from trunk Commit By: tlyu Revision: 18169 Changed Files: U branches/krb5-1-5/src/appl/bsd/krlogin.c U branches/krb5-1-5/src/appl/bsd/krlogind.c U branches/krb5-1-5/src/appl/bsd/krsh.c U branches/krb5-1-5/src/appl/bsd/krshd.c From rt-comment at krbdev.mit.edu Tue Jun 20 01:44:20 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Tue, 20 Jun 2006 01:44:20 -0400 (EDT) Subject: [krbdev.mit.edu #3612] krb5_gss_canicalize_name calls back through glue In-Reply-To: Message-ID: >>>>> "kwc" == The RT System itself via RT writes: kwc> krb5_gss_canonicalize_name() returns the result of gss_duplicate_name(). kwc> In a multi-mechanism mechglue environment, this winds up calling back kwc> through the glue layer instead of calling krb5_gss_duplicate_name() kwc> directly. In this case, a krb5_principal pointer is interpreted kwc> as a gss_union_name_t pointer in the glue layer. krb5_gss_canonicalize_name() is not called by the mechglue layer. It is also not a public function. I'm not sure we can support calling the krb5 mechanism gssapi functions by their krb5_gss_* names rather than through the mechglue layer (using specified C-bindings entry points) now that mechglue is integrated. Perhaps we should just delete the file where we define krb5_gss_canonicalize_name(). ---Tom From rt-comment at krbdev.mit.edu Tue Jun 20 10:59:20 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Tue, 20 Jun 2006 10:59:20 -0400 (EDT) Subject: [krbdev.mit.edu #3902] krb5-1.5: fix impicit declaration of strlen In-Reply-To: Message-ID: Fix a warning: implicit declaration of strlen in src/lib/gssapi/mechglue/g_userok.c From rt-comment at krbdev.mit.edu Tue Jun 20 11:01:56 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Tue, 20 Jun 2006 11:01:56 -0400 (EDT) Subject: [krbdev.mit.edu #3903] krb5-1.5: fix impicit declarations In-Reply-To: Message-ID: fix implicit declaration in: src/lib/kadm5/ovsec_glue.c src/lib/kadm5/unit-test/init-test.c src/lib/kadm5/unit-test/iter-test.c src/lib/kadm5/unit-test/lock-test.c From rt-comment at krbdev.mit.edu Tue Jun 20 11:04:52 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Tue, 20 Jun 2006 11:04:52 -0400 (EDT) Subject: [krbdev.mit.edu #3904] krb5-1.5: fix uninitialized vars In-Reply-To: Message-ID: This patch fixes some compiler warnings about uninitialized vars in: src/appl/gssftp/ftpd/ftpd.c src/appl/telnet/libtelnet/kerberos5.c src/kdc/do_tgs_req.c src/lib/krb5/asn.1/krb5_decode.c src/plugins/kdb/db2/libdb2/hash/dbm.c From rt-comment at krbdev.mit.edu Tue Jun 20 11:08:02 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Tue, 20 Jun 2006 11:08:02 -0400 (EDT) Subject: [krbdev.mit.edu #3905] krb5-1.5: several (warning)fixes for spnego In-Reply-To: Message-ID: This patch fixes some warnings in: src/lib/gssapi/spnego/gssapiP_spnego.h (re-defined TWRITE_STR) src/lib/gssapi/spnego/spnego_mech.c (unused vars, signed/unsigned problems, may be used uninitialized) From rt-comment at krbdev.mit.edu Tue Jun 20 11:09:48 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Tue, 20 Jun 2006 11:09:48 -0400 (EDT) Subject: [krbdev.mit.edu #3906] krb5-1.5: install krb5_ldap_util manpage In-Reply-To: Message-ID: This patch install the krb5_ldap_util manpage. From rt-comment at krbdev.mit.edu Tue Jun 20 11:12:58 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Tue, 20 Jun 2006 11:12:58 -0400 (EDT) Subject: [krbdev.mit.edu #3907] krb5-1.5: check if princ is NULL in krb5_realm_compare and krb5_principal_compare In-Reply-To: Message-ID: This patch add a check if princ is NULL to src/lib/krb5/krb/princ_comp.c From rt-comment at krbdev.mit.edu Tue Jun 20 15:30:40 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 15:30:40 -0400 (EDT) Subject: [krbdev.mit.edu #3901] build fails using Autoconf 2.59e (2.60 to be) In-Reply-To: Message-ID: On Jun 19, 2006, at 21:58, Russ Allbery via RT wrote: > It looks like this is an intentional change. From the Autoconf > NEWS file: > > ** AC_SUBST_FILE > The substitution now occurs only when @variable@ is on a line by > itself, > optionally surrounded by spaces and tabs. The whole line is > replaced. Grr. > I think just removing the # markers would be a backward-compatible > change. I think it would, actually. Our process for generating makefiles on Windows starts with the same Makefile.in and runs it through a C program that does no autoconf- style @FOO@ substitutions. However, if a line starts with @, it's replaced with a blank line. We don't actually use this fact at all currently, so far as I know, but it would let us make this change. (Or, if we switch from wconfig.c to wconfig.pl for generating the Windows makefiles, we could actually do real substitutions....) Ken From rt-comment at krbdev.mit.edu Tue Jun 20 17:45:24 2006 From: rt-comment at krbdev.mit.edu (Russ Allbery via RT) Date: Tue, 20 Jun 2006 17:45:24 -0400 (EDT) Subject: [krbdev.mit.edu #581] SVN Commit In-Reply-To: Message-ID: In verify_krb_v4_tgt, use an unsigned KRB4_32 to store an address rather than an unsigned long to avoid memcpying past the end of a structure on 64-bit platforms. Commit By: rra Revision: 18175 Changed Files: U trunk/src/appl/bsd/login.c From rt-comment at krbdev.mit.edu Tue Jun 20 18:27:33 2006 From: rt-comment at krbdev.mit.edu (Sam Hartman via RT) Date: Tue, 20 Jun 2006 18:27:33 -0400 (EDT) Subject: [krbdev.mit.edu #3909] Plugins need to use RTLD_GROUP when available, but definitely not RTLD_GLOBAL In-Reply-To: Message-ID: You do not want plugins to override symbols in the application when they pull in dependencies. From rt-comment at krbdev.mit.edu Tue Jun 20 18:35:27 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Tue, 20 Jun 2006 18:35:27 -0400 (EDT) Subject: [krbdev.mit.edu #3910] SVN Commit In-Reply-To: Message-ID: * src/lib/gssapi/Makefile.in (SUBDIROBJLISTS): Add missing spnego directory. Commit By: tlyu Revision: 18176 Changed Files: U trunk/src/lib/gssapi/Makefile.in From rt-comment at krbdev.mit.edu Tue Jun 20 18:55:27 2006 From: rt-comment at krbdev.mit.edu (Nicolas Williams via RT) Date: Tue, 20 Jun 2006 18:55:27 -0400 (EDT) Subject: [krbdev.mit.edu #3909] Plugins need to use RTLD_GROUP when available, but definitely not RTLD_GLOBAL In-Reply-To: Message-ID: On Tue, Jun 20, 2006 at 06:27:33PM -0400, Sam Hartman via RT wrote: > You do not want plugins to override symbols in the application when > they pull in dependencies. That means RTLD_LOCAL. You do also want RTLD_GROUP, of course. RTLD_GROUP is a modifier of RTLD_LOCAL/RTLD_GLOBAL, though it may not be supported on all platforms that MIT krb5 supports. If the plug-ins need glue functions from the plug-in framework then they should either have an explicit dependency on the framework shared object or related shared object or filter thereof (or they could be dlopen()ed with the RTLD_PARENT modifier, which also may not be supported on all platforms that MIT krb5 supports, and which wouldn't allow filtering what symbols the framework provides to the plug-ins). Nico -- From rt-comment at krbdev.mit.edu Tue Jun 20 19:22:27 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 19:22:27 -0400 (EDT) Subject: [krbdev.mit.edu #2087] SVN Commit In-Reply-To: Message-ID: Document kpropd -a option. Commit By: raeburn Revision: 18178 Changed Files: U trunk/src/slave/kpropd.M From rt-comment at krbdev.mit.edu Tue Jun 20 19:27:08 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 19:27:08 -0400 (EDT) Subject: [krbdev.mit.edu #3308] SVN Commit In-Reply-To: Message-ID: (kadmin_cpw): Don't crash if principal name is not given. Based on a patch from S Rahul. (extended_com_err_fn): If error code is zero, don't fetch an error message. Commit By: raeburn Revision: 18179 Changed Files: U trunk/src/kadmin/cli/kadmin.c From rt-comment at krbdev.mit.edu Tue Jun 20 19:59:17 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 19:59:17 -0400 (EDT) Subject: [krbdev.mit.edu #3911] SVN Commit In-Reply-To: Message-ID: The calls to gethostbyname_r and friends were wrapped in macros that declared automatic variables for the auxiliary storage needed, but the pointers returned by the functions would be used outside of that scope, when the storage would no longer be valid. Changed the macro interfaces to define new types for the auxiliary storage, and add a new argument to the macros referring to that storage. Changed call sites accordingly. Commit By: raeburn Revision: 18180 Changed Files: U trunk/src/util/support/fake-addrinfo.c U trunk/src/util/support/plugins.c From rt-comment at krbdev.mit.edu Tue Jun 20 20:09:40 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 20:09:40 -0400 (EDT) Subject: [krbdev.mit.edu #3911] getaddrinfo code uses vars outside of storage duration In-Reply-To: Message-ID: Revision 18181 reverts the change to plugins.c, which was checked in unintentionally. Also, I think this change was a little too aggressive in pushing variables around to outer scope when they didn't need to be. Working on a revision. From rt-comment at krbdev.mit.edu Tue Jun 20 20:12:08 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 20:12:08 -0400 (EDT) Subject: [krbdev.mit.edu #3911] SVN Commit In-Reply-To: Message-ID: Revert part of previous changes: Move temporary values that don't need longer storage duration, like error codes, back into GET_*_BY_* macros. Commit By: raeburn Revision: 18182 Changed Files: U trunk/src/util/support/fake-addrinfo.c From rt-comment at krbdev.mit.edu Tue Jun 20 20:28:27 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 20:28:27 -0400 (EDT) Subject: [krbdev.mit.edu #2759] SVN Commit In-Reply-To: Message-ID: (GET_HOST_BY_NAME, GET_HOST_BY_ADDR) [GETHOSTBYNAME_RETURNS_INT]: Test the output hostent pointer as an additional way of checking for errors. Original patch from Nalin Dahyabhai, needed some tweaking to fit in current sources, especially as updated in ticket 3911. Commit By: raeburn Revision: 18183 Changed Files: U trunk/src/util/support/fake-addrinfo.c From rt-comment at krbdev.mit.edu Tue Jun 20 20:31:25 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Tue, 20 Jun 2006 20:31:25 -0400 (EDT) Subject: [krbdev.mit.edu #2759] SVN Commit In-Reply-To: Message-ID: *sigh* Stupid typo in last change. Commit By: raeburn Revision: 18184 Changed Files: U trunk/src/util/support/fake-addrinfo.c From rt-comment at krbdev.mit.edu Wed Jun 21 10:29:09 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:29:09 -0400 (EDT) Subject: [krbdev.mit.edu #3912] krb5-1.5: fix warnings in util/support/ In-Reply-To: Message-ID: Fixes some compiler warnings: # threads.c: In function 'krb5int_thread_support_init': # threads.c:456: warning: implicit declaration of function 'krb5int_err_init' # errors.c: In function 'krb5int_vset_error': # errors.c:52: warning: passing argument 1 of 'free' discards qualifiers from pointer target type # errors.c:59: warning: implicit declaration of function 'vasprintf' # errors.c: In function 'krb5int_get_error': # errors.c:76: warning: assignment discards qualifiers from pointer target type # errors.c:80: warning: implicit declaration of function 'krb5int_call_thread_support_init' # errors.c:120: warning: assignment discards qualifiers from pointer target type # errors.c: In function 'krb5int_clear_error': # errors.c:146: warning: passing argument 2 of 'krb5int_free_error' discards qualifiers from pointer target type # From rt-comment at krbdev.mit.edu Wed Jun 21 10:30:52 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:30:52 -0400 (EDT) Subject: [krbdev.mit.edu #3913] krb5-1.5: fix warnings in lib/crypto/des/string2key.c In-Reply-To: Message-ID: fix warning: string2key.c: In function 'mit_des_string_to_key_int': string2key.c:229: warning: pointer targets in passing argument 1 of 'mit_des_cbc_cksum' differ in signedness From rt-comment at krbdev.mit.edu Wed Jun 21 10:32:43 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:32:43 -0400 (EDT) Subject: [krbdev.mit.edu #3914] krb5-1.5: fix warnings in lib/crypto/dk/ In-Reply-To: Message-ID: warning fix for: derive.c:63: warning: pointer targets in assignment differ in signedness derive.c:66: warning: pointer targets in assignment differ in signedness derive.c:75: warning: pointer targets in passing argument 2 of 'krb5_nfold' differ in signedness derive.c:75: warning: pointer targets in passing argument 4 of 'krb5_nfold' differ in signedness derive.c:96: warning: pointer targets in assignment differ in signedness derive.c: In function 'krb5_derive_random': derive.c:148: warning: pointer targets in assignment differ in signedness derive.c:151: warning: pointer targets in assignment differ in signedness derive.c:160: warning: pointer targets in passing argument 2 of 'krb5_nfold' differ in signedness derive.c:160: warning: pointer targets in passing argument 4 of 'krb5_nfold' differ in signedness dk_decrypt.c:153: warning: pointer targets in assignment differ in signedness dk_encrypt.c: In function 'krb5_dk_encrypt': dk_encrypt.c:98: warning: pointer targets in assignment differ in signedness dk_encrypt.c:119: warning: pointer targets in assignment differ in signedness dk_encrypt.c:132: warning: pointer targets in assignment differ in signedness dk_encrypt.c:141: warning: pointer targets in assignment differ in signedness dk_encrypt.c: In function 'krb5int_aes_dk_encrypt': dk_encrypt.c:263: warning: pointer targets in assignment differ in signedness dk_encrypt.c:284: warning: pointer targets in assignment differ in signedness dk_encrypt.c:298: warning: pointer targets in assignment differ in signedness dk_encrypt.c:308: warning: pointer targets in assignment differ in signedness From rt-comment at krbdev.mit.edu Wed Jun 21 10:34:03 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:34:03 -0400 (EDT) Subject: [krbdev.mit.edu #3915] krb5-1.5: fix warnings in lib/crypto In-Reply-To: Message-ID: warning fix for: old_api_glue.c: In function 'krb5_encrypt': old_api_glue.c:49: warning: assignment discards qualifiers from pointer target type old_api_glue.c: In function 'krb5_decrypt': old_api_glue.c:85: warning: assignment discards qualifiers from pointer target type old_api_glue.c: In function 'krb5_calculate_checksum': old_api_glue.c:206: warning: assignment discards qualifiers from pointer target type old_api_glue.c:210: warning: assignment discards qualifiers from pointer target type old_api_glue.c: In function 'krb5_verify_checksum': old_api_glue.c:242: warning: assignment discards qualifiers from pointer target type old_api_glue.c:246: warning: assignment discards qualifiers from pointer target type pbkdf2.c:86: warning: pointer targets in assignment differ in signedness prng.c:33: warning: 'init_error' defined but not used From rt-comment at krbdev.mit.edu Wed Jun 21 10:35:41 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:35:41 -0400 (EDT) Subject: [krbdev.mit.edu #3916] krb5-1.5: fix warnings in lib/crypto/enc_provider/aes.c In-Reply-To: Message-ID: fix warnings for: aes.c: In function 'krb5int_aes_encrypt': aes.c:72: warning: pointer targets in passing argument 1 of 'krb5int_aes_enc_blk' differ in signedness aes.c:72: warning: pointer targets in passing argument 2 of 'krb5int_aes_enc_blk' differ in signedness aes.c:77: warning: pointer targets in passing argument 1 of 'xorblock' differ in signedness aes.c:86: warning: pointer targets in passing argument 1 of 'xorblock' differ in signedness aes.c:94: warning: pointer targets in passing argument 1 of 'xorblock' differ in signedness aes.c:94: warning: pointer targets in passing argument 2 of 'xorblock' differ in signedness aes.c: In function 'krb5int_aes_decrypt': aes.c:127: warning: pointer targets in passing argument 1 of 'krb5int_aes_dec_blk' differ in signedness aes.c:127: warning: pointer targets in passing argument 2 of 'krb5int_aes_dec_blk' differ in signedness aes.c:131: warning: pointer targets in passing argument 1 of 'krb5int_aes_dec_blk' differ in signedness aes.c:132: warning: pointer targets in passing argument 1 of 'xorblock' differ in signedness aes.c:132: warning: pointer targets in passing argument 2 of 'xorblock' differ in signedness aes.c:138: warning: pointer targets in passing argument 1 of 'krb5int_aes_dec_blk' differ in signedness aes.c:145: warning: pointer targets in passing argument 1 of 'xorblock' differ in signedness aes.c:145: warning: pointer targets in passing argument 2 of 'xorblock' differ in signedness aes.c:154: warning: pointer targets in passing argument 1 of 'xorblock' differ in signedness aes.c:154: warning: pointer targets in passing argument 2 of 'xorblock' differ in signedness From rt-comment at krbdev.mit.edu Wed Jun 21 10:36:49 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:36:49 -0400 (EDT) Subject: [krbdev.mit.edu #3917] krb5-1.5: fix warnings in lib/crypto/arcfour/ and lib/crypto/yarrow/ In-Reply-To: Message-ID: warning fixes for: arcfour_s2k.c:46: warning: pointer targets in passing argument 2 of 'asctouni' differ in signedness ycipher.c:77: warning: pointer targets in assignment differ in signedness From rt-comment at krbdev.mit.edu Wed Jun 21 10:38:17 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:38:17 -0400 (EDT) Subject: [krbdev.mit.edu #3918] krb5-1.5: fix warnings for lib/gssapi/mechglue/g_initialize.c In-Reply-To: Message-ID: warning fixes for: g_initialize.c:164: warning: implicit declaration of function 'gssint_initialize_library' g_initialize.c:158: warning: unused variable 'fileInfo' g_initialize.c: In function 'updateMechList': g_initialize.c:495: warning: unused variable 'fileInfo' g_initialize.c: In function 'init_hardcoded': g_initialize.c:563: warning: unused variable 'cf' From rt-comment at krbdev.mit.edu Wed Jun 21 10:40:44 2006 From: rt-comment at krbdev.mit.edu (Public Submitter via RT) Date: Wed, 21 Jun 2006 10:40:44 -0400 (EDT) Subject: [krbdev.mit.edu #3919] krb5-1.5: kprop should use mkstemp if available In-Reply-To: Message-ID: kprop should use mkstemp instead of mktemp if it is available. From rt-comment at krbdev.mit.edu Wed Jun 21 17:08:38 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Wed, 21 Jun 2006 17:08:38 -0400 (EDT) Subject: [krbdev.mit.edu #3920] SVN Commit In-Reply-To: Message-ID: * src/lib/gssapi/libgssapi_krb5.exports: Cease export of krb5 mechanism entry points which were once equivalent to GSS-API entry points. These were never public interfaces, and calling them directly now can cause problems. Also, cease export of some other internal symbols. Commit By: tlyu Revision: 18185 Changed Files: U trunk/src/lib/gssapi/libgssapi_krb5.exports From rt-comment at krbdev.mit.edu Wed Jun 21 18:25:26 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Wed, 21 Jun 2006 18:25:26 -0400 (EDT) Subject: [krbdev.mit.edu #3921] SVN Commit In-Reply-To: Message-ID: * src/lib/gssapi/mechglue/Makefile.in (SRCS, STLIBOBJS): Delete g_userok, gssd_pname_to_uid. * src/lib/gssapi/mechglue/mechglue.h: Delete gssd_pname_to_uid, gss_initialize. * src/lib/gssapi/mechglue/mglueP.h: Delete gssint_userok, gssd_pname_to_uid, gssint_get_mechanism_ext, gss_acquire_cred_with_password_sfct, gss_mechanism_ext. * src/lib/gssapi/g_userok.c: * src/lib/gssapi/g_indicate_mechs.c: * src/lib/gssapi/gen_oids.c: * src/lib/gssapi/gssd_pname_to_uid: Delete. * src/lib/gssapi/mechglue/g_initialize.c: Delete gssint_get_mechanism_ext. Commit By: tlyu Revision: 18187 Changed Files: U trunk/src/lib/gssapi/mechglue/Makefile.in D trunk/src/lib/gssapi/mechglue/g_indicate_mechs.c U trunk/src/lib/gssapi/mechglue/g_initialize.c D trunk/src/lib/gssapi/mechglue/g_userok.c D trunk/src/lib/gssapi/mechglue/gen_oids.c D trunk/src/lib/gssapi/mechglue/gssd_pname_to_uid.c U trunk/src/lib/gssapi/mechglue/mechglue.h U trunk/src/lib/gssapi/mechglue/mglueP.h From rt-comment at krbdev.mit.edu Wed Jun 21 21:24:38 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Wed, 21 Jun 2006 21:24:38 -0400 (EDT) Subject: [krbdev.mit.edu #3922] mkrel should update patchlevel.h prior to reconf In-Reply-To: Message-ID: aclocal.m4 contains some code which grovels patchlevel.h when autoconf gets run. mkrel should update patchlevel.h prior to running reconf to avoid excessive rebuilds if maintainer mode is active. From rt-comment at krbdev.mit.edu Wed Jun 21 23:00:59 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Wed, 21 Jun 2006 23:00:59 -0400 (EDT) Subject: [krbdev.mit.edu #3909] SVN Commit In-Reply-To: Message-ID: * src/util/support/plugins.c (krb5int_open_plugin): Use RTLD_LOCAL instead of RTLD_GLOBAL. Use RTLD_GROUP if available. Commit By: tlyu Revision: 18192 Changed Files: U trunk/src/util/support/plugins.c From rt-comment at krbdev.mit.edu Thu Jun 22 09:35:46 2006 From: rt-comment at krbdev.mit.edu (Sam Hartman via RT) Date: Thu, 22 Jun 2006 09:35:46 -0400 (EDT) Subject: [krbdev.mit.edu #3923] [Simon Josefsson] Re: RFC4120 In-Reply-To: Message-ID: Return-Path: Received: from solipsist-nation ([unix socket]) by solipsist-nation (Cyrus v2.1.16-IPv6-Debian-2.1.16-10) with LMTP; Thu, 22 Jun 2006 09:25:33 -0400 X-Sieve: CMU Sieve 2.2 Return-Path: Received: from south-station-annex.mit.edu (SOUTH-STATION-ANNEX.MIT.EDU [18.72.1.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by suchdamage.org (Postfix) with ESMTP id 094B41324F for ; Thu, 22 Jun 2006 09:25:32 -0400 (EDT) Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by south-station-annex.mit.edu (8.13.6/8.9.2) with ESMTP id k5MDPV62019127 for ; Thu, 22 Jun 2006 09:25:31 -0400 (EDT) Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id k5MDPNt3004706; Thu, 22 Jun 2006 09:25:23 -0400 (EDT) Received: by mailhost.anl.gov (Postfix) id 2B3B21C3; Thu, 22 Jun 2006 08:25:21 -0500 (CDT) Delivered-To: ietf-krb-wg-outgoing at anl.gov Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id F23E219C for ; Thu, 22 Jun 2006 08:25:20 -0500 (CDT) Received: by mailhost.anl.gov (Postfix, from userid 10733) id E0B421C3; Thu, 22 Jun 2006 08:25:20 -0500 (CDT) X-Original-To: ietf-krb-wg at anl.gov Delivered-To: ietf-krb-wg at anl.gov Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 5DD761BF for ; Thu, 22 Jun 2006 08:25:20 -0500 (CDT) Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by mailhost.anl.gov (Postfix) with ESMTP id 3408619C for ; Thu, 22 Jun 2006 08:25:16 -0500 (CDT) Received: from mailrelay.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 502C65F0CE4; Thu, 22 Jun 2006 08:25:14 -0500 (CDT) Received-SPF: none (frigga.ctd.anl.gov: domain of jas at extundo.com does not designate permitted sender hosts) Received: from yxa.extundo.com (178.230.13.217.in-addr.dgcsystems.net [217.13.230.178]) by mailrelay.anl.gov (Postfix) with ESMTP id 8EDFD5F0CB1 for ; Thu, 22 Jun 2006 08:25:07 -0500 (CDT) Received: from localhost.localdomain (yxa.extundo.com [217.13.230.178]) (authenticated bits=0) by yxa.extundo.com (8.13.4/8.13.4/Debian-3sarge1) with ESMTP id k5MDP2Ph017527 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 22 Jun 2006 15:25:03 +0200 From: Simon Josefsson To: Sam Hartman Cc: "Shawn M. Emery" , martin.rex at sap.com, Durbin_Ron at emc.com, ietf-krb-wg at anl.gov Subject: Re: RFC4120 References: <200606192125.XAA18319 at uw1048.wdf.sap.corp> <44998FB3.5050203 at sun.com> <87bqsl1pqy.fsf at latte.josefsson.org> OpenPGP: id=B565716F; url=http://josefsson.org/key.txt X-Hashcash: 1:22:060622:durbin_ron at emc.com::xkLicOQeOTWLip8G:1g35 X-Hashcash: 1:22:060622:shawn.emery at sun.com::zfymAT2SVYQ/unlR:B/Tt X-Hashcash: 1:22:060622:martin.rex at sap.com::Y6vS2jF3rbDteJPM:ITrq X-Hashcash: 1:22:060622:ietf-krb-wg at anl.gov::iTlp680teXocag44:QSy6 X-Hashcash: 1:22:060622:hartmans-ietf at mit.edu::vUwlk7es9PMXDwV8:GFcm Date: Thu, 22 Jun 2006 15:25:03 +0200 In-Reply-To: (Sam Hartman's message of "Thu, 22 Jun 2006 08:33:45 -0400") Message-ID: <873bdxz5jk.fsf at latte.josefsson.org> User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/22.0.50 (gnu/linux) X-Virus-Scanned: ClamAV version 0.88.2, clamav-milter version 0.88.2 on yxa.extundo.com X-Virus-Status: Clean Sender: owner-ietf-krb-wg at mailhost.anl.gov Precedence: bulk X-Scanned-By: MIMEDefang 2.42 X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on solipsist-nation.suchdamage.org X-Spam-Level: X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_00,FORGED_RCVD_HELO autolearn=ham version=3.0.2 MIME-Version: 1.0 Sam Hartman writes: >>>>>> "Simon" == Simon Josefsson writes: > > Simon> "Shawn M. Emery" writes: > >>> Notable differences include support for AES which is mandated > >>> by RFC 4120, but which will not be hugely common until Windows > >>> Vista ships. MIT, Heimdal, Solaris and Apple have had AES for > >>> a hile now, though. > >>> > >> There are a number of implementations that don't enforce > >> requirements made by RFC 4120. For example: > >> > >> Implementations of Kerberos and protocols based on Kerberos > >> MUST NOT use insecure DNS queries to canonicalize the hostname > >> components of the service principal names (i.e., they MUST NOT > >> use insecure DNS queries to map one name to another to > >> determine the host part of the principal name with which one is > >> to communicate). > > Simon> There are several other examples: > > Simon> 1) Nobody else's implementation that I've tested seem to > Simon> behave according to RFC 4120 wrt to the high bit set on TCP > Simon> connections. > > Really? > MIt certainly intended to behave correctly. > Do you have a simple test case? If you could describe the problem within the next day or so, we could probably get a fix into 1.5. The details were posted in: http://article.gmane.org/gmane.ietf.krb-wg/4342 I confirmed this again with Debian's krb5-kdc version 1.4.3-7. To test this, just send a message with all bits set: jas at latte:~$ printf "\xff\xff\xff\xff" | nc localhost 88 The KDC closes the connection and logs: Jun 22 15:19:01 localhost krb5kdc[5081]: TCP client 127.0.0.1.44841 wants 4294967295 bytes, cap is 1048572 It would be useful to have one implementation that behaves according to RFC 4120 to test with, when Shishi tries to use the extension mechanism against a server that doesn't support it. /Simon From rt-comment at krbdev.mit.edu Thu Jun 22 13:50:46 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 13:50:46 -0400 (EDT) Subject: [krbdev.mit.edu #3902] krb5-1.5: fix impicit declaration of strlen In-Reply-To: Message-ID: fixed by removing g_userok.c, which wasn't fully implemented anyway. From rt-comment at krbdev.mit.edu Thu Jun 22 14:36:24 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 14:36:24 -0400 (EDT) Subject: [krbdev.mit.edu #3905] SVN Commit In-Reply-To: Message-ID: Apply (modified) patches from Michael Calmer to fix some warnings. * src/lib/gssapi/spnego/spnego_mech.c (get_req_flags): Remove unused var. (get_negTokenResp): Fix signedness bug. (make_spnego_tokenInit_msg): Remove unused vars (make_spnego_tokenTarg_msg): Initialize uninitialized vars. * src/lib/gssapi/spnego/gssapiP_spnego.h: Delete TWRITE_STR. Commit By: tlyu Revision: 18198 Changed Files: U trunk/src/lib/gssapi/spnego/gssapiP_spnego.h U trunk/src/lib/gssapi/spnego/spnego_mech.c From rt-comment at krbdev.mit.edu Thu Jun 22 14:49:29 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 14:49:29 -0400 (EDT) Subject: [krbdev.mit.edu #3918] SVN Commit In-Reply-To: Message-ID: * src/lib/gssapi/mechglue/g_initialize.c: Remove unused variables and include gss_libinit.h to clean up warnings. Patch from Michael Calmer. Commit By: tlyu Revision: 18202 Changed Files: U trunk/src/lib/gssapi/mechglue/g_initialize.c From rt-comment at krbdev.mit.edu Thu Jun 22 15:24:52 2006 From: rt-comment at krbdev.mit.edu (The RT System itself via RT) Date: Thu, 22 Jun 2006 15:24:52 -0400 (EDT) Subject: [krbdev.mit.edu #3924] the krb5_get_server_rcache routine frees already freed memory in error path In-Reply-To: Message-ID: >From krb5-bugs-incoming-bounces at PCH.mit.edu Thu Jun 22 15:24:48 2006 Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.9.3p2) with ESMTP id PAA14927; Thu, 22 Jun 2006 15:24:48 -0400 (EDT) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k5MJOIFw025275 for ; Thu, 22 Jun 2006 15:24:18 -0400 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id k5MFlGD9014360 for ; Thu, 22 Jun 2006 11:47:16 -0400 Received: from skamandros.sncag.com ([217.111.56.2]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id k5MFl5Vo015803 for ; Thu, 22 Jun 2006 11:47:11 -0400 (EDT) Received: from skamandros.sncag.com (localhost [127.0.0.1]) by skamandros.sncag.com (8.13.4/8.13.4/Debian-3sarge1) with ESMTP id k5MFkxQQ006100 for ; Thu, 22 Jun 2006 17:46:59 +0200 Received: (from rw at localhost) by skamandros.sncag.com (8.13.4/8.13.4/Submit) id k5MFkxks006097; Thu, 22 Jun 2006 17:46:59 +0200 Date: Thu, 22 Jun 2006 17:46:59 +0200 From: Rainer Weikusat Message-Id: <200606221546.k5MFkxks006097 at skamandros.sncag.com> To: krb5-bugs at mit.edu Subject: double-free in srv_rcache.c X-send-pr-version: 3.99 X-Spam-Score: 0 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 X-Mailman-Approved-At: Thu, 22 Jun 2006 15:24:17 -0400 X-BeenThere: krb5-bugs-incoming at mailman.mit.edu X-Mailman-Version: 2.1.6 Precedence: list Sender: krb5-bugs-incoming-bounces at PCH.mit.edu Errors-To: krb5-bugs-incoming-bounces at PCH.mit.edu >Submitter-Id: net >Originator: Rainer Weikusat >Organization: SNC AG >Confidential: no >Synopsis: the krb5_get_server_rcache routine frees already freed memory in error path >Severity: non-critical >Category: krb5-libs >Class: sw-bug >Release: 1.4.3 >Environment: System: Linux skamandros 2.6.16.18 #5 SMP Tue May 30 13:42:31 CEST 2006 i686 GNU/Linux Architecture: i686 >Description: The krb5_get_server_rcache routine in src/lib/krb5/krb has a local variable named rcache which is freed before returning to the caller if its value is not a null pointer. The krb5_rc_resolve_full routine (in src/lib/krb5/rcache/rc_base.c) which is called by krb5_get_server_rcache towards the end (l. 107) allocates memory for a krb5 rcache descriptor structure and store the corresponding address at the location its parameter id points to. When called from krb5_get_server_rcache, this is the address of the rcache variable. If the type cannot be resolved (eg because hasn't been registered), the memory is freed but the already initialized pointer is not cleared, which causes the calling routine to attempt to free it for a second time. >How-To-Repeat: Use the KRB5RCACHETYPE variable to request using a replay cache type unknown to the Kerberos library. >Fix: --- kerberos-srv-rcache-fix/src/lib/krb5/krb/srv_rcache.c 19 Mar 2006 14:42:00 -0000 1.1.1.1 +++ kerberos-srv-rcache-fix/src/lib/krb5/krb/srv_rcache.c 22 Jun 2006 15:26:59 -0000 1.1.1.1.12.1 @@ -115,17 +115,13 @@ retval = krb5_rc_recover_or_initialize(context, rcache, context->clockskew); if (retval) { krb5_rc_close(context, rcache); - rcache = 0; goto cleanup; } *rcptr = rcache; - rcache = 0; retval = 0; cleanup: - if (rcache) - krb5_xfree(rcache); if (cachename) krb5_xfree(cachename); return retval; From rt-comment at krbdev.mit.edu Thu Jun 22 16:06:50 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 16:06:50 -0400 (EDT) Subject: [krbdev.mit.edu #3922] SVN Commit In-Reply-To: Message-ID: * src/util/mkrel: Edit patchlevel.h before running reconf. Commit By: tlyu Revision: 18204 Changed Files: U trunk/src/util/mkrel From rt-comment at krbdev.mit.edu Thu Jun 22 16:58:40 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Thu, 22 Jun 2006 16:58:40 -0400 (EDT) Subject: [krbdev.mit.edu #3925] krb5_get_profile should reflect profile in the supplied context In-Reply-To: Message-ID: Currently krb5_get_profile creates a new profile object by looking anew at the environment variables and checking the existence of all of the files; on the other hand, it uses the "secure" flag in the supplied profile to decide whether to use environment variables or just the compiled-in paths. If the environment variables have changed, or a config file created that was not present before, the resulting profile will not match the one in the supplied context. If the supplied context uses kdc.conf as well as krb5.conf, this will not be reflected in the new profile, because that flag is not preserved. I think krb5_get_profile should probably use exactly the same set of files as in the profile in the supplied context. In fact, peeking through the abstraction, it should probably just build a new list containing the same pointers to the per-file data, and let the profile library locking arbitrate accesses between threads. From rt-comment at krbdev.mit.edu Thu Jun 22 17:31:23 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 17:31:23 -0400 (EDT) Subject: [krbdev.mit.edu #3903] SVN Commit In-Reply-To: Message-ID: * src/lib/kadm5/ovsec_glue.c: * src/lib/kadm5/unit-test/init-test.c: * src/lib/kadm5/unit-test/iter-test.c: * src/lib/kadm5/unit-test/lock-test.c: Include string.h to avoid implicit definitions. Patch from Michael Calmer. Commit By: tlyu Revision: 18205 Changed Files: U trunk/src/lib/kadm5/ovsec_glue.c U trunk/src/lib/kadm5/unit-test/init-test.c U trunk/src/lib/kadm5/unit-test/iter-test.c U trunk/src/lib/kadm5/unit-test/lock-test.c From rt-comment at krbdev.mit.edu Thu Jun 22 18:23:09 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 18:23:09 -0400 (EDT) Subject: [krbdev.mit.edu #3924] SVN Commit In-Reply-To: Message-ID: * src/lib/krb5/krb/srv_rcache.c (krb5_get_server_rcache): Apply patch from Rainer Weikusat to avoid double-free when rc_resolve_full() fails due to misconfiguration. Commit By: tlyu Revision: 18206 Changed Files: U trunk/src/lib/krb5/krb/srv_rcache.c From rt-comment at krbdev.mit.edu Thu Jun 22 22:56:39 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 22:56:39 -0400 (EDT) Subject: [krbdev.mit.edu #3927] SVN Commit In-Reply-To: Message-ID: * src/lib/gssapi/spnego/spnego_mech.c: Fix numerous signedness warnings. Commit By: tlyu Revision: 18207 Changed Files: U trunk/src/lib/gssapi/spnego/spnego_mech.c From rt-comment at krbdev.mit.edu Thu Jun 22 22:57:37 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Thu, 22 Jun 2006 22:57:37 -0400 (EDT) Subject: [krbdev.mit.edu #3928] SVN Commit In-Reply-To: Message-ID: * src/lib/gssapi/krb5/krb5_gss_glue.c (krb5_mech_configs_hack): Fix typo in MS_BUG_TEST case. Commit By: tlyu Revision: 18208 Changed Files: U trunk/src/lib/gssapi/krb5/krb5_gss_glue.c From rt-comment at krbdev.mit.edu Fri Jun 23 22:01:36 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:01:36 -0400 (EDT) Subject: [krbdev.mit.edu #3929] support lazy launching of ccapi server In-Reply-To: Message-ID: On the MacOS X platform the ccapi server will be implemented on a per session basis. The server should not be started in response to a cc_initialize() call. If the server is not present, the client should respond with appropriate answers until such time as a cache is to be created or the server has been started by someone else. To support this the cci_perform_rpc() call should take a parameter that indicates whether starting the server is permitted or not. From rt-comment at krbdev.mit.edu Fri Jun 23 22:05:58 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:05:58 -0400 (EDT) Subject: [krbdev.mit.edu #3930] CCAPI server must be able to distinguish context handles from other server instances In-Reply-To: Message-ID: If a client obtains a context from a server and the server is then restarted, the new server instance must be able to distinguish between contexts it has issued and those that were from a previous instance. This will be implemented as a platform specific server ID which will be incorporated into all ccapi messages. From rt-comment at krbdev.mit.edu Fri Jun 23 22:08:59 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:08:59 -0400 (EDT) Subject: [krbdev.mit.edu #3931] CCAPI context and ccache change times must be stored by the client In-Reply-To: Message-ID: The client must keep local copies of the context and ccache change times in order to be able to detect when a change in state has occurred. From rt-comment at krbdev.mit.edu Fri Jun 23 22:13:17 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:13:17 -0400 (EDT) Subject: [krbdev.mit.edu #3932] CCAPI should use a cc_handle not implemented as a pointer In-Reply-To: Message-ID: The cc_handle is currently a 64-bit unsigned integer however its value is obtained by casting a pointer. The forward and reverse casts may not be safe on all platforms and often produce many warnings. Implementing casting functions is a possibility. However, if it is not more work a better scheme would be to use an index value that looks up the appropriate pointer in a table. From rt-comment at krbdev.mit.edu Fri Jun 23 22:15:38 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:15:38 -0400 (EDT) Subject: [krbdev.mit.edu #3933] CCAPI client library reconnection support In-Reply-To: Message-ID: When the server returns an invalid context error to the client, the client should silently establish a new context to the server and then attempt to performed the desired operation instead of returning the invalid context error to the application. From rt-comment at krbdev.mit.edu Fri Jun 23 22:17:08 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:17:08 -0400 (EDT) Subject: [krbdev.mit.edu #3934] Implement CCAPI blocking calls In-Reply-To: Message-ID: Make sure that the blocking flag is properly passed to the server and that the server does not return a response to the client when the flag is set until the desired operation can be carried out. From rt-comment at krbdev.mit.edu Fri Jun 23 22:20:29 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:20:29 -0400 (EDT) Subject: [krbdev.mit.edu #3935] CCAPI implement locking In-Reply-To: Message-ID: Implement server side locks on context and ccache objects. Use a timer to track how long the lock was outstanding. If the lock is held by a client for more than XXX seconds and the client holding the lock has not been heard from during that time period, blow away the lock and permit the operation. (Perhaps invalidate all of the client's contexts or just the iterators.) From rt-comment at krbdev.mit.edu Fri Jun 23 22:22:05 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Fri, 23 Jun 2006 22:22:05 -0400 (EDT) Subject: [krbdev.mit.edu #3936] CCAPI Test krb5_ccache ccapi version 3 interface In-Reply-To: Message-ID: Test the krb5_ccache ccapi version 3 interface against the existing MacOS X CCAPI v3 implementation. From rt-comment at krbdev.mit.edu Fri Jun 23 22:40:02 2006 From: rt-comment at krbdev.mit.edu (Ken Raeburn via RT) Date: Fri, 23 Jun 2006 22:40:02 -0400 (EDT) Subject: [krbdev.mit.edu #3925] SVN Commit In-Reply-To: Message-ID: Fix krb5_get_profile to create a new profile duplicating the list of files from the one in the provided context, instead of constructing and checking the file list from scratch. Uses a new function in the profile library, not put into the public API yet. * util/profile/prof_init.c (profile_copy): New function. * util/profile/prof_int.h (profile_copy): Declare it. * lib/krb5/os/Makefile.in (LOCALINCLUDES): Look in the profile source dir. * lib/krb5/os/init_os_ctx.c (krb5_get_profile): Replace all the previous code with a call to profile_copy. Commit By: raeburn Revision: 18209 Changed Files: U trunk/src/lib/krb5/os/Makefile.in U trunk/src/lib/krb5/os/init_os_ctx.c U trunk/src/util/profile/prof_init.c U trunk/src/util/profile/prof_int.h From rt-comment at krbdev.mit.edu Sat Jun 24 18:16:47 2006 From: rt-comment at krbdev.mit.edu (Christophe Nowicki via RT) Date: Sat, 24 Jun 2006 18:16:47 -0400 (EDT) Subject: [krbdev.mit.edu #3237] Kerberos does not work inside Linux vservers In-Reply-To: Message-ID: Hi Ken, > I'm sorry about the delay in getting back to you -- I accidentally sent > my reply to the email address for filing the response with the bug > report but *not* sending a copy back to the original reporter of the > problem, and didn't notice for quite some time.... No problem. >> > Here is the output : >> >> Thanks! That output looks good. Well, maybe... did you run it in >> the same vserver environment that the KDC would run in? Yes, >> I'm guessing >> that, in that case, we would only want to return one address. It >> sort of depends -- does the vserver environment hide the other >> addresses, or just not permit you access to them? The vserver does not hide the other interfaces : #/sbin/ifconfig eth0 Link encap:Ethernet HWaddr 00:11:95:25:DB:0C inet addr:192.168.42.1 Bcast:192.168.42.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:48066286 errors:0 dropped:0 overruns:0 frame:0 TX packets:51623403 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:196681514 (187.5 MiB) TX bytes:471795406 (449.9 MiB) Interrupt:177 Base address:0xc00 eth0:cact Link encap:Ethernet HWaddr 00:11:95:25:DB:0C inet addr:192.168.42.21 Bcast:192.168.42.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:177 Base address:0xc00 eth0:cfg Link encap:Ethernet HWaddr 00:11:95:25:DB:0C inet addr:192.168.42.15 Bcast:192.168.42.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:177 Base address:0xc00 eth0:dist Link encap:Ethernet HWaddr 00:11:95:25:DB:0C inet addr:192.168.42.62 Bcast:192.168.42.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:177 Base address:0xc00 ... But you can't bind on other interfaces, If you process is running in vserver 'a' you can see interface of vserver 'b' but you can bind on b:88 (you can only bind on a:88). The strange thin about kdc, is that he try to bind only on the first interface and fail to setup network : Jun 25 00:13:20 kdc krb5kdc[4311]: Cannot assign requested address - Cannot bind server socket to port 88 address 192.168.42.1 Jun 25 00:13:20 kdc krb5kdc[4311]: set up 0 sockets Jun 25 00:13:20 kdc krb5kdc[4311]: no sockets set up? >> >> If you run the 1.4.2 KDC in the vserver environment, does it bind to >> the correct addresses? I've upgraded to KDC version 1.4.3. Best Regards, From rt-comment at krbdev.mit.edu Sun Jun 25 10:47:39 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 10:47:39 -0400 (EDT) Subject: [krbdev.mit.edu #581] SVN Commit In-Reply-To: Message-ID: pull up r18175 from trunk r18175 at cathode-dark-space: rra | 2006-06-20 17:45:16 -0400 Ticket: 581 Version_Reported: 1.0.5 Target_Version: 1.5 Tags: pullup In verify_krb_v4_tgt, use an unsigned KRB4_32 to store an address rather than an unsigned long to avoid memcpying past the end of a structure on 64-bit platforms. Commit By: tlyu Revision: 18211 Changed Files: U branches/krb5-1-5/src/appl/bsd/login.c From rt-comment at krbdev.mit.edu Sun Jun 25 15:21:53 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Sun, 25 Jun 2006 15:21:53 -0400 (EDT) Subject: [krbdev.mit.edu #3938] SVN Commit In-Reply-To: Message-ID: * add scrollbars to option tree pane in configuration dialog * convert to using Microsoft's safe string library both to ensure safe string manipulation and to avoid deprecation warnings * disable deprecation warnings for Platform SDK header shlwapi.h which cannot otherwise be compiled * add kerberos 5 kvno property to tickets. display in properties dialog and main window if column selected by user * improve manifest handling in order to support both manifests generated by the compiler and those hand crafted in order to specify the correct versions of the custom control libraries. * update khimaira message types and credential acquisition documentation Commit By: jaltman Revision: 18212 Changed Files: U trunk/src/windows/identity/apiversion.txt U trunk/src/windows/identity/config/Makefile.w2k U trunk/src/windows/identity/config/Makefile.w32 U trunk/src/windows/identity/include/khmsgtypes.h U trunk/src/windows/identity/kconfig/api.c U trunk/src/windows/identity/kcreddb/credential.c U trunk/src/windows/identity/kcreddb/credtype.c U trunk/src/windows/identity/kcreddb/type.c U trunk/src/windows/identity/nidmgrdll/Makefile U trunk/src/windows/identity/plugins/common/krb5common.c U trunk/src/windows/identity/plugins/common/krb5common.h U trunk/src/windows/identity/plugins/krb4/Makefile U trunk/src/windows/identity/plugins/krb4/errorfuncs.c U trunk/src/windows/identity/plugins/krb4/krb4funcs.c U trunk/src/windows/identity/plugins/krb4/krb4newcreds.c U trunk/src/windows/identity/plugins/krb5/Makefile U trunk/src/windows/identity/plugins/krb5/datarep.c U trunk/src/windows/identity/plugins/krb5/datarep.h U trunk/src/windows/identity/plugins/krb5/krb5configcc.c U trunk/src/windows/identity/plugins/krb5/krb5configdlg.c U trunk/src/windows/identity/plugins/krb5/krb5configid.c U trunk/src/windows/identity/plugins/krb5/krb5configids.c U trunk/src/windows/identity/plugins/krb5/krb5funcs.c U trunk/src/windows/identity/plugins/krb5/krb5identpro.c U trunk/src/windows/identity/plugins/krb5/krb5main.c U trunk/src/windows/identity/plugins/krb5/krbcred.h U trunk/src/windows/identity/plugins/krb5/lang/en_us/langres.rc U trunk/src/windows/identity/plugins/krb5/langres.h U trunk/src/windows/identity/ui/Makefile U trunk/src/windows/identity/ui/credwnd.c U trunk/src/windows/identity/ui/debugfuncs.c U trunk/src/windows/identity/ui/htwnd.c U trunk/src/windows/identity/ui/htwnd.h U trunk/src/windows/identity/ui/newcredwnd.c U trunk/src/windows/identity/uilib/action.c U trunk/src/windows/identity/uilib/alert.c U trunk/src/windows/identity/uilib/configui.c U trunk/src/windows/identity/uilib/creddlg.c U trunk/src/windows/identity/uilib/khnewcred.h U trunk/src/windows/identity/util/perfstat.c From rt-comment at krbdev.mit.edu Sun Jun 25 15:27:48 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Sun, 25 Jun 2006 15:27:48 -0400 (EDT) Subject: [krbdev.mit.edu #3938] NetIDMgr updates In-Reply-To: Message-ID: these changes are on the trunk but were committed after the 1.5 branch was cut. they will require a pullup when work on kfw 3.1 begins again. From rt-comment at krbdev.mit.edu Sun Jun 25 15:28:52 2006 From: rt-comment at krbdev.mit.edu (Jeffrey Altman via RT) Date: Sun, 25 Jun 2006 15:28:52 -0400 (EDT) Subject: [krbdev.mit.edu #3542] Updates to NetIDMgr for KFW 3.1 In-Reply-To: Message-ID: this changes have not been pulled up to the 1.4 branch but they are in the 1.5 branch because they were on the trunk when the 1.5 branch was cut. From rt-comment at krbdev.mit.edu Sun Jun 25 18:28:21 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 18:28:21 -0400 (EDT) Subject: [krbdev.mit.edu #3308] SVN Commit In-Reply-To: Message-ID: pull up r18179 from trunk r18179 at cathode-dark-space: raeburn | 2006-06-20 19:27:01 -0400 ticket: 3308 tags: pullup (kadmin_cpw): Don't crash if principal name is not given. Based on a patch from S Rahul. (extended_com_err_fn): If error code is zero, don't fetch an error message. Commit By: tlyu Revision: 18213 Changed Files: U branches/krb5-1-5/src/kadmin/cli/kadmin.c From rt-comment at krbdev.mit.edu Sun Jun 25 18:41:59 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 18:41:59 -0400 (EDT) Subject: [krbdev.mit.edu #3910] SVN Commit In-Reply-To: Message-ID: pull up r18176 from trunk r18176 at cathode-dark-space: tlyu | 2006-06-20 18:35:20 -0400 ticket: new subject: fix parallel builds for libgss target_version: 1.5 tags: pullup component: krb5-build * src/lib/gssapi/Makefile.in (SUBDIROBJLISTS): Add missing spnego directory. Commit By: tlyu Revision: 18214 Changed Files: U branches/krb5-1-5/src/lib/gssapi/Makefile.in From rt-comment at krbdev.mit.edu Sun Jun 25 18:59:23 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 18:59:23 -0400 (EDT) Subject: [krbdev.mit.edu #3920] SVN Commit In-Reply-To: Message-ID: pull up r18185 from trunk r18185 at cathode-dark-space: tlyu | 2006-06-21 17:08:31 -0400 ticket: new subject: cease export of krb5_gss_* target_version: 1.5 tags: pullup component: krb5-libs * src/lib/gssapi/libgssapi_krb5.exports: Cease export of krb5 mechanism entry points which were once equivalent to GSS-API entry points. These were never public interfaces, and calling them directly now can cause problems. Also, cease export of some other internal symbols. Commit By: tlyu Revision: 18215 Changed Files: U branches/krb5-1-5/src/lib/gssapi/libgssapi_krb5.exports From rt-comment at krbdev.mit.edu Sun Jun 25 19:04:09 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 19:04:09 -0400 (EDT) Subject: [krbdev.mit.edu #3921] SVN Commit In-Reply-To: Message-ID: pull up r18187 from trunk r18187 at cathode-dark-space: tlyu | 2006-06-21 18:25:19 -0400 ticket: new subject: remove unimplemented/unused mechglue functions target_version: 1.5 tags: pullup component: krb5-libs * src/lib/gssapi/mechglue/Makefile.in (SRCS, STLIBOBJS): Delete g_userok, gssd_pname_to_uid. * src/lib/gssapi/mechglue/mechglue.h: Delete gssd_pname_to_uid, gss_initialize. * src/lib/gssapi/mechglue/mglueP.h: Delete gssint_userok, gssd_pname_to_uid, gssint_get_mechanism_ext, gss_acquire_cred_with_password_sfct, gss_mechanism_ext. * src/lib/gssapi/g_userok.c: * src/lib/gssapi/g_indicate_mechs.c: * src/lib/gssapi/gen_oids.c: * src/lib/gssapi/gssd_pname_to_uid: Delete. * src/lib/gssapi/mechglue/g_initialize.c: Delete gssint_get_mechanism_ext. Commit By: tlyu Revision: 18216 Changed Files: U branches/krb5-1-5/src/lib/gssapi/mechglue/Makefile.in D branches/krb5-1-5/src/lib/gssapi/mechglue/g_indicate_mechs.c U branches/krb5-1-5/src/lib/gssapi/mechglue/g_initialize.c D branches/krb5-1-5/src/lib/gssapi/mechglue/g_userok.c D branches/krb5-1-5/src/lib/gssapi/mechglue/gen_oids.c D branches/krb5-1-5/src/lib/gssapi/mechglue/gssd_pname_to_uid.c U branches/krb5-1-5/src/lib/gssapi/mechglue/mechglue.h U branches/krb5-1-5/src/lib/gssapi/mechglue/mglueP.h From rt-comment at krbdev.mit.edu Sun Jun 25 19:17:10 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 19:17:10 -0400 (EDT) Subject: [krbdev.mit.edu #3909] SVN Commit In-Reply-To: Message-ID: pull up r18192 from trunk r18192 at cathode-dark-space: tlyu | 2006-06-21 23:00:53 -0400 ticket: 3909 tags: pullup * src/util/support/plugins.c (krb5int_open_plugin): Use RTLD_LOCAL instead of RTLD_GLOBAL. Use RTLD_GROUP if available. Commit By: tlyu Revision: 18217 Changed Files: U branches/krb5-1-5/src/util/support/plugins.c From rt-comment at krbdev.mit.edu Sun Jun 25 22:38:14 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 22:38:14 -0400 (EDT) Subject: [krbdev.mit.edu #3905] SVN Commit In-Reply-To: Message-ID: pull up r18198 from trunk r18198 at cathode-dark-space: tlyu | 2006-06-22 14:36:16 -0400 ticket: 3905 tags: pullup Apply (modified) patches from Michael Calmer to fix some warnings. * src/lib/gssapi/spnego/spnego_mech.c (get_req_flags): Remove unused var. (get_negTokenResp): Fix signedness bug. (make_spnego_tokenInit_msg): Remove unused vars (make_spnego_tokenTarg_msg): Initialize uninitialized vars. * src/lib/gssapi/spnego/gssapiP_spnego.h: Delete TWRITE_STR. Commit By: tlyu Revision: 18218 Changed Files: U branches/krb5-1-5/src/lib/gssapi/spnego/gssapiP_spnego.h U branches/krb5-1-5/src/lib/gssapi/spnego/spnego_mech.c From rt-comment at krbdev.mit.edu Sun Jun 25 22:40:53 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 22:40:53 -0400 (EDT) Subject: [krbdev.mit.edu #3913] SVN Commit In-Reply-To: Message-ID: pull up r18202 from trunk r18202 at cathode-dark-space: tlyu | 2006-06-22 14:49:23 -0400 ticket: 3918 tags: pullup * src/lib/gssapi/mechglue/g_initialize.c: Remove unused variables and include gss_libinit.h to clean up warnings. Patch from Michael Calmer. Commit By: tlyu Revision: 18219 Changed Files: U branches/krb5-1-5/src/lib/gssapi/mechglue/g_initialize.c From rt-comment at krbdev.mit.edu Sun Jun 25 22:43:25 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 22:43:25 -0400 (EDT) Subject: [krbdev.mit.edu #3918] krb5-1.5: fix warnings for lib/gssapi/mechglue/g_initialize.c In-Reply-To: Message-ID: oops, typoed ticket number From: tlyu at mit.edu Subject: SVN Commit pull up r18202 from trunk r18202 at cathode-dark-space: tlyu | 2006-06-22 14:49:23 -0400 ticket: 3918 tags: pullup * src/lib/gssapi/mechglue/g_initialize.c: Remove unused variables and include gss_libinit.h to clean up warnings. Patch from Michael Calmer. Commit By: tlyu Revision: 18219 Changed Files: U branches/krb5-1-5/src/lib/gssapi/mechglue/g_initialize.c From rt-comment at krbdev.mit.edu Sun Jun 25 22:44:10 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 22:44:10 -0400 (EDT) Subject: [krbdev.mit.edu #3913] krb5-1.5: fix warnings in lib/crypto/des/string2key.c In-Reply-To: Message-ID: Ignore previous commit message; typoed ticket number. From rt-comment at krbdev.mit.edu Sun Jun 25 22:47:26 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 22:47:26 -0400 (EDT) Subject: [krbdev.mit.edu #3903] SVN Commit In-Reply-To: Message-ID: pull up r18205 from trunk r18205 at cathode-dark-space: tlyu | 2006-06-22 17:31:15 -0400 ticket: 3903 tags: pullup * src/lib/kadm5/ovsec_glue.c: * src/lib/kadm5/unit-test/init-test.c: * src/lib/kadm5/unit-test/iter-test.c: * src/lib/kadm5/unit-test/lock-test.c: Include string.h to avoid implicit definitions. Patch from Michael Calmer. Commit By: tlyu Revision: 18220 Changed Files: U branches/krb5-1-5/src/lib/kadm5/ovsec_glue.c U branches/krb5-1-5/src/lib/kadm5/unit-test/init-test.c U branches/krb5-1-5/src/lib/kadm5/unit-test/iter-test.c U branches/krb5-1-5/src/lib/kadm5/unit-test/lock-test.c From rt-comment at krbdev.mit.edu Sun Jun 25 22:50:53 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 22:50:53 -0400 (EDT) Subject: [krbdev.mit.edu #3924] SVN Commit In-Reply-To: Message-ID: pull up r18206 from trunk r18206 at cathode-dark-space: tlyu | 2006-06-22 18:23:02 -0400 ticket: 3924 tags: pullup * src/lib/krb5/krb/srv_rcache.c (krb5_get_server_rcache): Apply patch from Rainer Weikusat to avoid double-free when rc_resolve_full() fails due to misconfiguration. Commit By: tlyu Revision: 18221 Changed Files: U branches/krb5-1-5/src/lib/krb5/krb/srv_rcache.c From rt-comment at krbdev.mit.edu Sun Jun 25 22:53:28 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 22:53:28 -0400 (EDT) Subject: [krbdev.mit.edu #3922] SVN Commit In-Reply-To: Message-ID: pull up r18204 from trunk r18204 at cathode-dark-space: tlyu | 2006-06-22 16:06:45 -0400 ticket: 3922 tags: pullup * src/util/mkrel: Edit patchlevel.h before running reconf. Commit By: tlyu Revision: 18222 Changed Files: U branches/krb5-1-5/src/util/mkrel From rt-comment at krbdev.mit.edu Sun Jun 25 23:01:39 2006 From: rt-comment at krbdev.mit.edu (Tom Yu via RT) Date: Sun, 25 Jun 2006 23:01:39 -0400 (EDT) Subject: [krbdev.mit.edu #3927] SVN Commit In-Reply-To:

Power Sellers