Updates for krb5-1.11.3

diff --git a/README b/README
index 118ebc7c4011d38965a87ca0b0a6e52799739e7f..9c5704da6045c01a6c4e1679a9482cdd1a2d96df 100644 (file)
--- a/README
+++ b/README
@@ -77,6 +77,30 @@ from using single-DES cryptosystems.  Among these is a configuration
 variable that enables "weak" enctypes, which defaults to "false"
 beginning with krb5-1.8.
 
+Major changes in 1.11.3 (2013-06-03)
+------------------------------------
+
+* Fix a UDP ping-pong vulnerability in the kpasswd (password changing)
+  service.  [CVE-2002-2443]
+
+* Improve interoperability with some Windows native PKINIT clients.
+
+krb5-1.11.3 changes by ticket ID
+--------------------------------
+
+7596    PKINIT should allow missing DH param Q
+7602    allow dh_min_bits >= 1024
+7605    Set msg_type when decoding FAST requests
+7626    Rename internal Camellia symbols
+7637    Fix kpasswd UDP ping-pong [CVE-2002-2443]
+7639    Transited realm checks sometimes fail for GSSAPI
+7640    Clarify that kdc.conf and krb5.conf are merged
+7641    Clarify krb5_rd_req documentation
+7644    Sphinx doc build leaves python bytecode (.pyc) in release tarball
+7653    Document preauth flags for service principals
+7654    Clarify retiring-des based on user feedback
+7655    Clean up dangling antecedent in allow_weak_crypto
+
 Major changes in 1.11.2 (2013-04-12)
 ------------------------------------
 
@@ -590,6 +614,7 @@ reports, suggestions, and valuable resources:
     Joel Johnson
     W. Trevor King
     Mikkel Kruse
+    Reinhard Kugler
     Volker Lendecke
     Jan iankko Lieskovsky
     Oliver Loch

diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index 387355f022e4a58069d3b2f73625968587688b8c..b14fd093c462cc00b3d54acaefb95cfca57d4aa6 100644 (file)
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -1,4 +1,4 @@
-.TH "K5IDENTITY" "5" " " "1.11.2" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 k5identity \- Kerberos V5 client principal selection rules
 .

diff --git a/src/man/k5login.man b/src/man/k5login.man
index 913f696bfc36bc44eeb9b99ae8546dd1e199159a..f3c634a53c3eb5c145b18e1193ba37bee21e9153 100644 (file)
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -1,4 +1,4 @@
-.TH "K5LOGIN" "5" " " "1.11.2" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 k5login \- Kerberos V5 acl file for host access
 .

diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index d076541f24a782ff4f4c48a68ee2dd8ba3228c4b..8845053aacf53b3431db4830fa0dce93b0840ff3 100644 (file)
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -1,4 +1,4 @@
-.TH "K5SRVUTIL" "1" " " "1.11.2" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 k5srvutil \- host key table (keytab) manipulation utility
 .

diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index d8a3d13cc42584477370d7c7adb48e504867106e..607653c804152e142563ddec6dd4b8b87123c224 100644 (file)
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -1,4 +1,4 @@
-.TH "KADM5.ACL" "5" " " "1.11.2" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kadm5.acl \- Kerberos ACL file
 .

diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index 307a91350c8c6ee764b8a6653e0701dd64ced088..df75fae559c0f7f6a371a9c85c507f998bc8d7b7 100644 (file)
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -1,4 +1,4 @@
-.TH "KADMIN" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kadmin \- Kerberos V5 database administration program
 .
@@ -250,12 +250,18 @@ key for another user.  \fB+allow_dup_skey\fP clears this flag.
 .B {\-|+}\fBrequires_preauth\fP
 \fB+requires_preauth\fP requires this principal to preauthenticate
 before being allowed to kinit.  \fB\-requires_preauth\fP clears this
-flag.
+flag.  When \fB+requires_preauth\fP is set on a service principal,
+the KDC will only issue service tickets for that service principal
+if the client\(aqs initial authentication was performed using
+preauthentication.
 .TP
 .B {\-|+}\fBrequires_hwauth\fP
 \fB+requires_hwauth\fP requires this principal to preauthenticate
 using a hardware device before being allowed to kinit.
-\fB\-requires_hwauth\fP clears this flag.
+\fB\-requires_hwauth\fP clears this flag.  When \fB+requires_hwauth\fP is
+set on a service principal, the KDC will only issue service tickets
+for that service principal if the client\(aqs initial authentication was
+performed using a hardware device to preauthenticate.
 .TP
 .B {\-|+}\fBok_as_delegate\fP
 \fB+ok_as_delegate\fP sets the \fBokay as delegate\fP flag on tickets

diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index 6e3561fdab2a7547ec5ce2f824333f58cb7270ca..e348fc015a936354d2c7a203fed002f21f082553 100644 (file)
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -1,4 +1,4 @@
-.TH "KADMIND" "8" " " "1.11.2" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kadmind \- KADM5 administration server
 .

diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index b26557fc76db9740e24d3ca2c08a84041b682a93..6bb86978ed9f104a9d65f4060148100b5a9906f7 100644 (file)
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -1,4 +1,4 @@
-.TH "KDB5_LDAP_UTIL" "8" " " "1.11.2" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kdb5_ldap_util \- Kerberos configuration utility
 .

diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index c9f4bbef602f90bfe91198dff933af120f481a1e..8aa82413458ea9d73914b8b3e4d4baa31dc7e119 100644 (file)
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -1,4 +1,4 @@
-.TH "KDB5_UTIL" "8" " " "1.11.2" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kdb5_util \- Kerberos database maintenance utility
 .

diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index ae15b560aed863ba7668d8264e8a9f99451c6d67..d98198aa818263f43df68df1ddb323229ae42709 100644 (file)
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,4 +1,4 @@
-.TH "KDC.CONF" "5" " " "1.11.2" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kdc.conf \- Kerberos V5 KDC configuration file
 .
@@ -34,7 +34,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 The kdc.conf file supplements \fIkrb5.conf(5)\fP for programs which
 are typically only used on a KDC, such as the \fIkrb5kdc(8)\fP and
 \fIkadmind(8)\fP daemons and the \fIkdb5_util(8)\fP program.
-Relations documented here may also be specified in krb5.conf.
+Relations documented here may also be specified in krb5.conf; for the
+KDC programs mentioned, krb5.conf and kdc.conf will be merged into a
+single configuration profile.
 .sp
 Normally, the kdc.conf file is found in the KDC state directory,
 \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP.  You can override the default location by setting the

diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index 828724c076b4fbc54465b8249c52701d0f978a99..c647ec073952e6f4169f9468799eef1aa8b5b2ad 100644 (file)
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -1,4 +1,4 @@
-.TH "KDESTROY" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kdestroy \- destroy Kerberos tickets
 .

diff --git a/src/man/kinit.man b/src/man/kinit.man
index 4c9ee1e6c56eec46ceed129d09456078eb79fa7e..6a8f32b76fd3a0138ba2de530e93bedc3a127fb3 100644 (file)
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -1,4 +1,4 @@
-.TH "KINIT" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kinit \- obtain and cache Kerberos ticket-granting ticket
 .

diff --git a/src/man/klist.man b/src/man/klist.man
index 1a7a4cfb8469b3d4996ce85a36e23c5f2e21f6a0..598c7790bbb1b16f0906482874c3bd78a9706a78 100644 (file)
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -1,4 +1,4 @@
-.TH "KLIST" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 klist \- list cached Kerberos tickets
 .

diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index 45b8c285aa7e818f7c2b098cab94b2cf939fc9c8..c890562f6f13a4e44f17992916bed05931728e8c 100644 (file)
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -1,4 +1,4 @@
-.TH "KPASSWD" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kpasswd \- change a user's Kerberos password
 .

diff --git a/src/man/kprop.man b/src/man/kprop.man
index 597d80aa9b292c477a70e9566383b8550cbb6de4..389fd6121e14112b1e9ea36f140c07bf8d5a19e6 100644 (file)
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -1,4 +1,4 @@
-.TH "KPROP" "8" " " "1.11.2" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kprop \- propagate a Kerberos V5 principal database to a slave server
 .

diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index 7a108d4527b321570d7d3e312b062d014c001450..a244f497a7cf544a01c6800f8a079ac25c883997 100644 (file)
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -1,4 +1,4 @@
-.TH "KPROPD" "8" " " "1.11.2" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kpropd \- Kerberos V5 slave KDC update server
 .

diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index 212419fcafbedb3ebc14a7c20ce5550d0805636d..34dc812127cef2be0288571c7a67b254ff07ffae 100644 (file)
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -1,4 +1,4 @@
-.TH "KPROPLOG" "8" " " "1.11.2" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kproplog \- display the contents of the Kerberos principal update log
 .

diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index 53f03dc6a9bd209c459fd73ee241c94d4512b4a9..74e5cfbbfdf829f01ea70041ffdfedb37a77910d 100644 (file)
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -1,4 +1,4 @@
-.TH "KRB5-CONFIG" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 krb5-config \- tool for linking against MIT Kerberos libraries
 .

diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index f672594f88e54ec25017aada5ef347c75d882fd3..bdf35853fcdb79aa893d11be669b40961352ef29 100644 (file)
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1,4 +1,4 @@
-.TH "KRB5.CONF" "5" " " "1.11.2" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 krb5.conf \- Kerberos configuration file
 .
@@ -178,12 +178,12 @@ The libdefaults section may contain any of the following relations:
 .INDENT 0.0
 .TP
 .B \fBallow_weak_crypto\fP
-If this flag is set to false, then weak encryption types will be
-filtered out of the previous three lists (as noted in
-\fIEncryption_and_salt_types\fP in \fIkdc.conf(5)\fP).  The
-default value for this tag is false, which may cause
-authentication failures in existing Kerberos infrastructures that
-do not support strong crypto.  Users in affected environments
+If this flag is set to false, then weak encryption types (as noted in
+\fIEncryption_and_salt_types\fP in \fIkdc.conf(5)\fP) will be filtered
+out of the lists \fBdefault_tgs_enctypes\fP, \fBdefault_tkt_enctypes\fP, and
+\fBpermitted_enctypes\fP.  The default value for this tag is false, which
+may cause authentication failures in existing Kerberos infrastructures
+that do not support strong crypto.  Users in affected environments
 should set this tag to true until their infrastructure adopts
 stronger ciphers.
 .TP

diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index 3a052cbbb97bfbfb270bc619dc2e05d26cef7f79..f8fdc60bf8338feee4cb7cacf7affec529313929 100644 (file)
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -1,4 +1,4 @@
-.TH "KRB5KDC" "8" " " "1.11.2" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 krb5kdc \- Kerberos V5 KDC
 .

diff --git a/src/man/ksu.man b/src/man/ksu.man
index 72a0f926be33437477b7e5119c8da4b83dcd6a3b..02318b9f1af837a4f80f6456c10f9a08be2a5bbe 100644 (file)
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -1,4 +1,4 @@
-.TH "KSU" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KSU" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 ksu \- Kerberized super-user
 .

diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 0b1ca2abd3f1fda0c0d646ff675ae48d305898e7..20e0190565bd176f227b45427a79114fb1dc763b 100644 (file)
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -1,4 +1,4 @@
-.TH "KSWITCH" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kswitch \- switch primary ticket cache
 .

diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index 86aa4d6143138bf3061d9f2a45d0590157f17c36..064c50612fd669076db149417253291340f5d699 100644 (file)
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -1,4 +1,4 @@
-.TH "KTUTIL" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 ktutil \- Kerberos keytab file maintenance utility
 .

diff --git a/src/man/kvno.man b/src/man/kvno.man
index 8186a2b31d803cf96fc6c58c8cbe8b98ea7b984f..df3d27970ede2302c4da98623f2e7b9fd0896682 100644 (file)
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -1,4 +1,4 @@
-.TH "KVNO" "1" " " "1.11.2" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 kvno \- print key version numbers of Kerberos principals
 .

diff --git a/src/man/sclient.man b/src/man/sclient.man
index 3d3936ae8d3f04e6df7234949666a5db2eeb06b4..6684b2890b6988de80bd13c393c4ad4da77bf531 100644 (file)
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -1,4 +1,4 @@
-.TH "SCLIENT" "1" " " "1.11.2" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 sclient \- sample Kerberos version 5 client
 .

diff --git a/src/man/sserver.man b/src/man/sserver.man
index 8acb1910fe6bef7657f15e969ada8047ef8c17cc..325ace60b92c9b7830d6790ae28e45ed58ff27e4 100644 (file)
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -1,4 +1,4 @@
-.TH "SSERVER" "8" " " "1.11.2" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.11.3" "MIT Kerberos"
 .SH NAME
 sserver \- sample Kerberos version 5 server
 .

diff --git a/src/patchlevel.h b/src/patchlevel.h
index 949ff76becbfb9ca1717cdf0f4e77c528555c8fa..b6ed140107bae326cba696285d7bb22c1b4a470f 100644 (file)
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
  */
 #define KRB5_MAJOR_RELEASE 1
 #define KRB5_MINOR_RELEASE 11
-#define KRB5_PATCHLEVEL 2
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 3
+/* #undef KRB5_RELTAIL */
 /* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "krb5-1.11"
+#define KRB5_RELTAG "krb5-1.11.3-final"