[Heimdal-source-changes] [heimdal/heimdal] 579393: Optionally prune old keys when setting new keys.

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: 579393c8b9951611757f52edc9b519bf153aeec2
      https://github.com/heimdal/heimdal/commit/579393c8b9951611757f52edc9b519bf153aeec2
  Author: Viktor Dukhovni <viktor at twosigma.com>
  Date:   2016-02-26 (Fri, 26 Feb 2016)

  Changed paths:
    M lib/hdb/keys.c
    M lib/hdb/libhdb-exports.def
    M lib/hdb/version-script.map
    M lib/kadm5/Makefile.am
    M lib/kadm5/ad.c
    M lib/kadm5/common_glue.c
    M lib/kadm5/context_s.c
    M lib/kadm5/get_s.c
    M lib/kadm5/init_c.c
    M lib/kadm5/private.h
    A lib/kadm5/setkey3_s.c
    M lib/krb5/krb5.conf.5

  Log Message:
  -----------
  Optionally prune old keys when setting new keys.

When new keys are added (typically via kadm5_setkey_principal_3),
truncate the key history to remove old keys, that is keys older than
the newest key which was in effect prior longer ago than the principal's
maximum ticket lifetime.  This feature is controlled via the "[kadmin]"
section's "prune-key-history" boolean parameter, which defaults to false.

Currently this happens only when kadm5_setkey_principal_3()
is called directly on the server, the client API simulates
kadm5_setkey_principal_3() via a get, update, modify sequence that does
not prune the key history.  The plan is to add a new kadm5 protocol RPC
and convert clients to call that instead.

In setkey_principal_3 seal keys after entry key update

Also, for now, don't check the return value of kadm5_log_modify() in
the new kadm5_s_setkey_principal_3().  This has to be addressed more
globally.

Censor stale keys in kadm5_s_get_principal


  Commit: c3eb3341c2bc853ace83b56925fe667c72c47c19
      https://github.com/heimdal/heimdal/commit/c3eb3341c2bc853ace83b56925fe667c72c47c19
  Author: Viktor Dukhovni <viktor at twosigma.com>
  Date:   2016-02-26 (Fri, 26 Feb 2016)

  Changed paths:
    M lib/krb5/get_host_realm.c
    M tests/kdc/check-referral.in

  Log Message:
  -----------
  Implement and test referrals for host:port


  Commit: 54d37fdba6a79956fb73c9b4d24f831fd527b36a
      https://github.com/heimdal/heimdal/commit/54d37fdba6a79956fb73c9b4d24f831fd527b36a
  Author: Viktor Dukhovni <viktor at twosigma.com>
  Date:   2016-02-26 (Fri, 26 Feb 2016)

  Changed paths:
    M kdc/krb5tgs.c

  Log Message:
  -----------
  Fix memory leak


  Commit: 8fe294d0d7feb35615d182ff84f49a24b178a468
      https://github.com/heimdal/heimdal/commit/8fe294d0d7feb35615d182ff84f49a24b178a468
  Author: Viktor Dukhovni <viktor at twosigma.com>
  Date:   2016-02-26 (Fri, 26 Feb 2016)

  Changed paths:
    M lib/kadm5/ipropd_slave.c

  Log Message:
  -----------
  Add SO_KEEPALIVE to iprop clients (slaves)


Compare: https://github.com/heimdal/heimdal/compare/047daa077ac2...8fe294d0d7fe