[Heimdal-announce] Heimdal 7.7 bug fix release announcement

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[Heimdal-announce] Heimdal 7.7 bug fix release announcement

Jeffrey Altman-2
Dear Heimdal Community,

A team consisting of staff from Two Sigma Open Source and AuriStor are
pleased to announce the release of Heimdal 7.7.

The release download page is:


The source tarball can be downloaded from:



    SHA1(heimdal-7.7.0.tar.gz)= 5dd16703be7255f66a4d65440f0c622aeeca60d9

The signature key fingerprint is: E659 41B7 1CF3 C459 A34F  A89C 45E7
572A 28CD 8CC8

Bug fixes

    PKCS#11 hcrypto back-end
    . initialize the p11_module_load function list
    . verify that not only is a mechanism present but that its mechanism
    info states that it offers the required encryption, decryption or
    digest services

    . Starting with 7.6, Heimdal permitted requesting authenticated
      anonymous tickets. However, it did not verify that a KDC in fact
      returned an anonymous ticket when one was requested.
    . Cease setting the KDCOption reaquest_anonymous flag when issuing
      S4UProxy (constrained delegation) TGS requests.
    . when the Win2K PKINIT compatibility option is set, do
      not require krbtgt otherName to match when validating KDC
    . set PKINIT_BTMM flag per Apple implementation
    . use memset_s() instead of memset()

    . When generating KRB5SignedPath in the AS, use the reply client
      name rather than the one from the request, so validation will
      work correctly in the TGS.
    . allow checksum of PA-FOR-USER to be HMAC_MD5. Even if TGT used
      an enctype with a different checksum. Per [MS-SFU] 2.2.1
      PA-FOR-USER the checksum is always HMAC_MD5, and that's what
      Windows and MIT clients send.

      In Heimdal both the client and kdc use instead the
      checksum of the TGT, and therefore work with each other
      but Windows and MIT clients fail against Heimdal KDC.

      Both Windows and MIT KDC would allow any keyed checksum
      to be used so Heimdal client work fine against it.

      Change Heimdal KDC to allow HMAC_MD5 even for non RC4
      based TGT in order to support per-spec clients.
    . use memset_s() instead of memset()
    . Detect Heimdal 1.0 through 7.6 clients that issue S4UProxy
      (constrained delegation) TGS Requests with the request
      anonymous flag set. These requests will be treated as
      S4UProxy requests and not anonymous requests.

    . Set SQLite3 backend default page size to 8KB.
    . Add hdb_set_sync() method

    . disable HDB sync during database load avoiding unnecessary
      disk i/o.

    . disable HDB sync during receive_everything. Doing an fsync
      per-record when receiving the complete HDB is a performance
      disaster. Among other things, if the HDB is very large, then
      one slave receving a full HDB can cause other slaves to timeout
      and, if HDB write activity is high enough to cause iprop log
      truncation, then also need full syncs, which leads to a cycle of
      full syncs for all slaves until HDB write activity drops.
      Allowing the iprop log to be larger helps, but improving
      receive_everything() performance helps even more.

    . Anonymous PKINIT tickets discard the realm information used
      to locate the issuing AS. Store the issuing realm in the
      credentials cache in order to locate a KDC which can renew them.
    . Do not leak the result of krb5_cc_get_config() when determining
      anonymous PKINIT start realm.

    . Show transited-policy-checked, ok-as-delegate and anonymous
      flags when listing credentials.

    . Regenerate certs so that they expire before the 2038 armageddon
      so the test suite will pass on 32-bit operating systems until the
      underlying issues can be resolved.

    . Define _STDC_C11_BCI for memset_s prototype

    build tooling:
    . Convert from python 2 to python 3

    . rename verify-password to verify-password-quality
    . hprop default mode is encrypt
    . kadmind "all" permission does not include "get-keys"
    . verify-password-quality might not be stateless

   The Heimdal Release Team.

Heimdal-announce mailing list
[hidden email]

smime.p7s (5K) Download Attachment