{"push_id":771172873,"size":9,"distinct_size":9,"ref":"refs/heads/more_etypeinfo","head":"6172e7c99cb58b5ca42b36f78f10e33e06067108","before":"29be097c21c9755b145d55b9b25fada146dea556","commits":[{"sha":"53cc103b176b2141fbe4b92b433a516ac06a1ff4","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Adjust SPNEGO Microsoft krb5 OID tests\n\nIn the Microsoft krb5 OID tests in t_spnego.c, use the proper krb5 OID\nfor the framing of the mech token, which better reflects the behavior\nof Microsoft clients that use the wrong OID.  Move the test to a\nseparate function and run it twice, once with an acceptor cred and\nonce without.\n\nAlso add a comment noting that the reselection test no longer\nexercises what it was designed to.  We can't really fix that until we\nadd gss_acquire_cred_with_cred() or similar.","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/53cc103b176b2141fbe4b92b433a516ac06a1ff4"},{"sha":"382556f580e3b7fb8469976988c50b67bba51f26","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Check mech in gss_accept_sec_context w/ no cred\n\nIf no verifier_cred_handle is passed to gss_accept_sec_context(),\naccept the same mechs as we would with a default acceptor\ncredential--that is, not those which assert the GSS_C_MA_DEPRECATED or\nGSS_C_MA_NOT_DFLT_MECH attributes.\n\nticket: 8021","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/382556f580e3b7fb8469976988c50b67bba51f26"},{"sha":"c8e9758db1d8a536a1404187b5911a96f7cdbea3","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Update SPNEGO hintName value to current spec\n\n[MS-SPNG] currently specifies that the hintName field of NegHints\nshould contain \"not_defined_in_RFC4178@please_ignore\".  Heimdal\nimplements this behavior, but we instead try to include a display\nname.  Implement the currently specified behavior, and add a test to\nt_spnego.c to verify that the expected hint token is generated.\n\nFurther cleanup is possible; the negHints encoding is now constant (so\nit does not need to be generated dynamically), and we could avoid\nabusing the mechListMIC parameter of make_spnego_tokenInit_msg() to\ntransport it.\n\nticket: 8236 (new)","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/c8e9758db1d8a536a1404187b5911a96f7cdbea3"},{"sha":"312b3bc29a0c52a0a82055f566241964532c2128","author":{"email":"e21db6bc36e69d5a94280d3a0834a03dc3be66b1@redhat.com","name":"Nathaniel McCallum"},"message":"Add ASN.1 encoder and decoder for secure cookie\n\nAdd an internal type declaration, ASN.1 encoder and decoder functions,\nan internal free function, and ASN.1 tests for krb5_secure_cookie.\nThe reference DER encoding was constructed by hand.\n\nTo save on space, we don't use context tags, and use an integer rather\nthan a KerberosTime for the timestamp.  The timestamp is stored in a\ntime_t; this requires a bugfix to the 64-bit case in\nasn1_encode.c:store_int().\n\n[ghudson@mit.edu: reference encoding; decode test; minor adustments to\nfree functions; added comments; alterations for space savings; commit\nmessage]","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/312b3bc29a0c52a0a82055f566241964532c2128"},{"sha":"4e15c03b54464b661c6578f78de3bd348163fc07","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add secure cookie support\n\nRemove the existing support for creating trivial cookies.  Add new\nfunctions to fast_util.c for reading and generating secure cookies.\nAdd new kdcpreauth callbacks \"get_cookie\" and \"set_cookie\" to allow\npreauth mechs to retrieve and set cookie values.\n\nBased on a patch by Nathaniel McCallum.\n\nticket: 8233 (new)","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/4e15c03b54464b661c6578f78de3bd348163fc07"},{"sha":"379239d98a05b271bbd6127f98bdb64646958b4c","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add cookie tests\n\nAdd cookie and KDC_ERR_MORE_PREAUTH_DATA_REQUIRED functionality to the\ntest preauth plugins modules.  Create a new test script t_preauth.py\nand move a test there from t_etype_info.py which is only marginally\nrelated to etype-info.  Add a new test which exercises a multi-hop\npreauth scenario and generates different cookies for each KDC error.\n\nticket: 8233","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/379239d98a05b271bbd6127f98bdb64646958b4c"},{"sha":"752574e288c8322001d1b4e62f5fd99c579a3403","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Document secure cookie format and callbacks\n\nIn kdcpreauth.rst, describe the set_cookie and get_cookie callbacks\nand explain how to generate a KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error\nfor multi-round-trip mechanisms.  Add a new file formats/cookie.rst\ndocumenting the secure cookie format.\n\nticket: 8233","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/752574e288c8322001d1b4e62f5fd99c579a3403"},{"sha":"4b1c4dc22ae83e7b83d0f279f9b699a6a81f97d2","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Refactor finish_check_padata() in KDC\n\nUse a helper function to filter the error codes from preauth modules.\nUse a cleanup handler so that we aren't separately considering the\ndisposition of state and state->pa_e_data along different exit paths.","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/4b1c4dc22ae83e7b83d0f279f9b699a6a81f97d2"},{"sha":"6172e7c99cb58b5ca42b36f78f10e33e06067108","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add etype-info2 to MORE_PREAUTH_DATA_REQUIRED\n\nA multi-round-trip preauth mechanism may require key information, but\nnot for the initial message from the client.  To support optimistic\npreauth for such mechanisms, make the KDC include etype-info2\ninformation in a MORE_PREAUTH_DATA_REQUIRED error if the client didn't\ninclude a PA-FX-COOKIE in its request.\n\nAdd optimistic preauth support to the test preauth module and to\netinfo.c, and add a test case to t_etype_info.py to verify that\netype-info2 is included in the optimistic multi-hop scenario.\n\nticket: 8234 (new)","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/6172e7c99cb58b5ca42b36f78f10e33e06067108"}]}