{"push_id":608419467,"size":13,"distinct_size":4,"ref":"refs/heads/loadtgt","head":"4da32334de7d37886ccfc88484eca14274e94a0c","before":"6289c7b4c3a50037dfde3864dca538deb64b3e44","commits":[{"sha":"2dc19c3899a98e23378c19d91594470f7350756c","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Process TGS authdata after transited in KDC\n\nThe CAMMAC authorization data container requires a checksum over the\nencrypted part of the issued ticket, with the CAMMAC contents\nsubstituted for the authdata field.  For this to work, we must\nfinalize the non-authdata fields of the encrypted ticket part before\nadding authdata.  Call handle_authdata() after checking and modifying\nthe transited field and potentially setting the\ntransited-policy-checked flag.\n\nAlso remove a redundant and inoperative conditional change to\nenc_tkt_reply.times.starttime which happens after the ticket is\nencrypted.  We do the same thing right after setting up the ticket\ntimes.","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/2dc19c3899a98e23378c19d91594470f7350756c"},{"sha":"8a62bef7cd97a87081ec5a033483760ae7b4d7f4","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Get rid of static KDC authdata systems\n\nRemove the static_authdata_systems table from kdc_authdata.c and\ninstead call the relevant functions explicitly in handle_authdata.\nEliminate the flags field from krb5_authdata_systems as it is no\nlonger used.  Rename the functions to be more descriptive.  Move\nsimple conditionals on authdata processing to handle_authdata for\nclarity.  Move handle_authdata to the end of the file to avoid the\nneed for static function declarations.\n\n[For review purposes, renaming functions and moving handle_authdata\nare split out into separate commits.  They will be squashed into this\ncommit before pushing.]","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/8a62bef7cd97a87081ec5a033483760ae7b4d7f4"},{"sha":"d9475e2e8033a15a44b90a597a8e02e9b923a80f","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Rename/simplify KDC authdata functions\n\n[This will be squashed into the previous commit.  It covers renaming\nthe authdata functions, removing unused parameters, and moving simple\nconditionals into handle_authdata.]","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/d9475e2e8033a15a44b90a597a8e02e9b923a80f"},{"sha":"3bfbe834846812593fe1bea18cb8a461c36d1c87","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Move handle_authdata to end\n\n[This will be squashed with the previous commit.  It covers moving\nhandle_authdata to the end of the file and removing the forward\ndeclaration of handle_signticket.]","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/3bfbe834846812593fe1bea18cb8a461c36d1c87"},{"sha":"5b6af9d57b40035f2860570c3e42d326e77f0862","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add declarations for new KDC authdata interface\n\nAdd a pluggable interface for KDC authdata using the current plugin\ninfrastructure, mirroring the KDC functionality of authdata_plugin.h.\nLike the old interface, this one isn't yet public.","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/5b6af9d57b40035f2860570c3e42d326e77f0862"},{"sha":"ddb7cd77c14b973322452329b6bb334bd7e7a476","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Use new KDC authdata interface in kdc_authdata.c\n\nRemove the server authdata interface declarations from authdata.h and\nthe code to load and invoke old KDC authdata modules.  Add code to\nload and invoke authdata modules using the new kdcauthdata pluggable\ninterface.","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/ddb7cd77c14b973322452329b6bb334bd7e7a476"},{"sha":"4c7058b08076e3dacd4ad4de1a9d05f936940dbf","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Modernize kdc_authdata.c\n\nAdjust whitespace, identifier names, and in some cases flow control.\nNo functional changes.","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/4c7058b08076e3dacd4ad4de1a9d05f936940dbf"},{"sha":"9d9b071fad6b2621299d0ddfcaec84dcc842599c","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Update test KDC authdata module to new interface\n\nRemove plugins/authdata/greet, which was a v0 KDC module.  Modify\nplugins/authdata/greet_server to use the new interface.  Within\ngreet_auth.c, remove the unused function greet_kdc_verify.  Build the\ngreet_client and greet_server modules by default, but do not install\nthem.","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/9d9b071fad6b2621299d0ddfcaec84dcc842599c"},{"sha":"d7b5c86f4b69f2a5b83fa08457a46144b921fbc4","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add KDC authdata tests\n\nAdd a new test script t_authdata.py and a C harness adata.c to test\nKDC authdata handling logic.  KDB module authdata is not currently\ntested.","distinct":false,"url":"https://api.github.com/repos/greghudson/krb5/commits/d7b5c86f4b69f2a5b83fa08457a46144b921fbc4"},{"sha":"f55a48c14a7f1ceb49957a0bd2c1ca0c49b63a6f","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Rename krbtgt variable in KDC code\n\nIn a TGS request, the header ticket server is usually a local or\ncross-realm TGS principal, but for ticket modification requests it\ndoesn't have to be.  Similarly, the server for an AS request is\nusually a krbtgt principal, but in some cases it is not.  Since the\nKDC code must consider all possibilities, avoid using the name\n\"krbtgt\" for entries which aren't necessarily TGTs.\n\nIn process_tgs_req(), rename krbtgt to header_server and tgskey to\nheader_key.  In handle_authdata(), rename the parameters similarly and\npass NULL from process_as_req() for the header_server and header_key\nparameters; the code which uses those parameters is adjusted to match.\nIn validate_transit_path(), rename krbtgt to header_srv.\n\nDo not change the semantics of the sign_authdata DAL method at this\ntime, but more accurately document the krbtgt and krbtgt_key\nparameters.","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/f55a48c14a7f1ceb49957a0bd2c1ca0c49b63a6f"},{"sha":"1d750fc9884bea4a49970e1fc82d012dada4aecc","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Load local TGT in KDC requests\n\nEnsure that we have the server realm TGT principal entry at hand for\nAS and TGS requests.  In the common case, this is the same as the AS\nserver or TGS header server principal, but in less common cases\n(direct AS requests for service tickets, cross-realm TGS requests) we\nwill need to explicitly load it.\n\nThe local TGT entry is not used in this commit.  In the short term, it\nwill be used to verify and sign CAMMACs and to shore up some edge\ncases in AD-SIGNTICKET.  In the longer term, we might allow realm\nconfiguration variables to be stored in local TGT tl-data.","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/1d750fc9884bea4a49970e1fc82d012dada4aecc"},{"sha":"d69c1a6d90f73e3fb401474580350881354f7ffa","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Use local TGT for AD-SIGNTICKET processing\n\nAlways use the first key of the local TGT to create the AD-SIGNTICKET\nchecksum, and try the first key of the last three kvnos of the local\nTGT to verify the checksum.\n\nticket: 8139","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/d69c1a6d90f73e3fb401474580350881354f7ffa"},{"sha":"4da32334de7d37886ccfc88484eca14274e94a0c","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add tests for AD-SIGNTICKET corner cases\n\nTest situations where the previous AD-SIGNTICKET logic would not use\nthe same key to create and verify the AD-SIGNTICKET data.  Also test a\ncase which forces the new verification logic to try multiple krbtgt\nversions.\n\nticket: 8139","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/4da32334de7d37886ccfc88484eca14274e94a0c"}]}