{"push_id":696004484,"size":4,"distinct_size":4,"ref":"refs/heads/loadtgt","head":"1f2060ee1793f1acea81acefa6a8b1e0da4203ce","before":"ef662153a409648dc0b26ca96929015e71dfb3c4","commits":[{"sha":"7cad84e1df664f9a1513a2899661bf2b62908dd7","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Rename krbtgt variable in KDC code\n\nIn a TGS request, the header ticket server is usually a local or\ncross-realm TGS principal, but for ticket modification requests it\ndoesn't have to be.  Similarly, the server for an AS request is\nusually a krbtgt principal, but in some cases it is not.  Since the\nKDC code must consider all possibilities, avoid using the name\n\"krbtgt\" for entries which aren't necessarily TGTs.\n\nIn process_tgs_req(), rename krbtgt to header_server and tgskey to\nheader_key.  In handle_authdata(), rename the parameters similarly and\npass NULL from process_as_req() for the header_server and header_key\nparameters; the code which uses those parameters is adjusted to match.\nIn validate_transit_path(), rename krbtgt to header_srv.\n\nDo not change the semantics of the sign_authdata DAL method at this\ntime, but more accurately document the krbtgt and krbtgt_key\nparameters.","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/7cad84e1df664f9a1513a2899661bf2b62908dd7"},{"sha":"39548a5b17bbda9eeb63625a201cfd19b9de1c5b","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Load local TGT in KDC requests\n\nEnsure that we have the server realm TGT principal entry at hand for\nAS and TGS requests.  In the common case, this is the same as the AS\nserver or TGS header server principal, but in less common cases\n(direct AS requests for service tickets, cross-realm TGS requests) we\nwill need to explicitly load it.\n\nThe local TGT entry is not used in this commit.  In the short term, it\nwill be used to verify and sign CAMMACs and to shore up some edge\ncases in AD-SIGNTICKET.  In the longer term, we might allow realm\nconfiguration variables to be stored in local TGT tl-data.","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/39548a5b17bbda9eeb63625a201cfd19b9de1c5b"},{"sha":"0c6498b2b9f4f4ad8b9f224714c84714425f2ca3","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Use local TGT for AD-SIGNTICKET processing\n\nAlways use the first key of the local TGT to create the AD-SIGNTICKET\nchecksum, and try the first key of the last three kvnos of the local\nTGT to verify the checksum.\n\nticket: 8139","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/0c6498b2b9f4f4ad8b9f224714c84714425f2ca3"},{"sha":"1f2060ee1793f1acea81acefa6a8b1e0da4203ce","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add tests for AD-SIGNTICKET corner cases\n\nTest situations where the previous AD-SIGNTICKET logic would not use\nthe same key to create and verify the AD-SIGNTICKET data.  Also test a\ncase which forces the new verification logic to try multiple krbtgt\nversions.\n\nticket: 8139","distinct":true,"url":"https://api.github.com/repos/greghudson/krb5/commits/1f2060ee1793f1acea81acefa6a8b1e0da4203ce"}]}