| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
His comments are:
This patch fixes the problem of modern Kerberos using "derived keys"
to encrypt the authenticator by disabling the authenticator check
for all derived keys enctypes.
I think I've got all the bugfixes that Jeffrey and I discussed rolled
into this. There were some problems with Jeffrey's code to convert
the authenticator's Kerberos timestring into struct tm (e.g. Z, -1900;
it helps to have an actual decryptable authenticator to play with).
So I've shamelessly pushed in my code, while stealing some bits from
Jeffrey.
|
| |
|
|
| |
Submitted by Jeffrey Altman <jaltman@columbia.edu>
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
His comments are:
. adds use of replay cache to protect against replay attacks
. adds functions kssl_tgt_is_available() and
kssl_keytab_is_available() which are used within s3_lib.c
and ssl_lib.c to determine at runtime whether or not
KRB5 ciphers can be supported during the current session.
|
| |
|
|
|
|
|
|
| |
Jeffrey Altman <jaltman@columbia.edu>
(Really, the time that's being parsed is a GeneralizedTime, so if
ASN1_GENERALIZEDTIME_get() ever gets implemented, it should be used
instead)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
His comments are:
. Fixed all of the Windows dynamic loading functions, prototypes, etc.
. Corrected all of the unsigned/signed comparison warnings
. Replaced the references to krb5_cksumarray[] for two reasons.
First, it was an internal variable that should not have been
referenced outside the library; nor could it have been with
a shared library with restricted exports. Second, the
variable is no longer used in current Kerberos implementations.
I replaced the code with equivalent functionality using functions
that are exported from the library.
|
| |
|
|
| |
things will work much more smoothly.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
SSL according to RFC 2712. His comment is:
This is a patch to openssl-SNAP-20010702 to support Kerberized SSL
authentication. I'm expecting to have the full kssl-0.5 kit up on
sourceforge by the end of the week. The full kit includes patches
for mod-ssl, apache, and a few text clients. The sourceforge URL
is http://sourceforge.net/projects/kssl/ .
Thanks to a note from Simon Wilkinson I've replaced my KRB5 AP_REQ
message with a real KerberosWrapper struct. I think this is fully
RFC 2712 compliant now, including support for the optional
authenticator field. I also added openssl-style ASN.1 macros for
a few Kerberos structs; see crypto/krb5/ if you're interested.
|
| | |
|
| |
|
|
|
|
|
| |
missed any.
This compiles and runs on Linux, and external applications have no
problems with it. The definite test will be to build this on VMS.
|
| |
|
|
| |
It's still inconsistent - probably better to undo the whole OPENSSL_NO_* thing.
|
| | |
|
| | |
|
| |
|
|
| |
Implemented by Vern Staats <staatsvr@asc.hpc.mil>, further hacked and distributed by Jeffrey Altman <jaltnab@columbia.edu>
|
|
|
4 times it's size when bn_sqr_recursive() won't look farther than the
original length. Thereby, constification is no longer a problem.
|
