Comment 1 for bug 739392

Upstream ChangeLog:

2010-11-20 ludovic.rousseau

 * [r475] configure.in: release 0.6.6

2010-11-18 ludovic.rousseau

 * [r474] src/tools/Makefile.am, src/tools/card_eventmgr.c,
   src/tools/pkcs11_eventmgr.c: Use daemon implementation from
   daemon.c when needed (for example on
   Solaris 10)

   See
   http://www.opensc-project.org/pipermail/opensc-user/2010-November/004331.html
 * [r473] src/tools/daemon.c: Use config.h instead of includes.h

   Define _PATH_DEVNULL if needed. It was defined in includes.h in
   OpenSSH
 * [r472] src/tools/daemon.c: new file from OpenSSH version 5.6p1
   openssh-5.6p1/openbsd-compat/daemon.c

   The licence is BSD 3-clause so compatible with the LGPL v2+ used
   by
   pam_pkcs11

2010-10-25 ludovic.rousseau

 * [r471] configure.in: Fix the change in revision 470

   Thanks (again) to Arfrever Frehtes Taifersar Arahesis
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015175.html
 * [r470] configure.in: Default is to use pcsc-lite. The argument is
   --without-pcsclite to
   disable pcsc-lite use/support

   Thanks to Arfrever Frehtes Taifersar Arahesis for the bug report
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015172.html

2010-10-23 ludovic.rousseau

 * [r469] doc/pam_pkcs11.xml: rename make_hash_link.sh in
   pkcs11_make_hash_link
 * [r468] configure.in: Display ${libdir} value
 * [r467] tools/Makefile.am, tools/make_hash_link.sh,
   tools/pkcs11_make_hash_link: rename make_hash_link.sh to
   pkcs11_make_hash_link to match the manpage
   name

2010-10-19 ludovic.rousseau

 * [r465] src/pam_pkcs11/pam_pkcs11.c: Unload the mapper also on
   success

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015150.html
 * [r464] doc/doxygen.conf.in: Update from doxygen version 1.5.6 to
   1.7.1
 * [r463] configure.in: release 0.6.5
 * [r462] po/de.po, po/fr.po, po/nl.po, po/pam_pkcs11.pot, po/pl.po,
   po/pt_br.po, po/ru.po: regenerate
 * [r461] src/common/Makefile.am: Add the missing strndup.h file
 * [r460] src/common/uri.c: get_http(): check if complete message
   was transmitted

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
 * [r459] src/common/uri.c: get_http(): allocate enough memory to
   fit http-request

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
 * [r458] src/common/uri.c: get_http(): add missing return statement

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
 * [r457] configure.in: If dlopen() is not found in libdl we try to
   find it without specifying a
   library before exiting in error.

   I don't remember why I used this code. Maybe dlopen() is not in
   libdl on
   some systems.

2010-10-16 ludovic.rousseau

 * [r456] po/fr.po: Translate a string
 * [r455] po/de.po, po/fr.po, po/nl.po, po/pam_pkcs11.pot, po/pl.po,
   po/pt_br.po, po/ru.po: Regenerate
 * [r454] src/pam_pkcs11/pam_pkcs11.c: Replace "Found the %s." by
   "%s found."

   Thanks to Mr Dash Four for the bug report
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015135.html

2010-10-15 ludovic.rousseau

 * [r453] src/common/pkcs11_lib.c: crypto_init(): fix a typo in log
   message

2010-09-22 ludovic.rousseau

 * [r452] src/common/pkcs11_lib.c: pkcs11_pass_login(): check if the
   PIN returned by getpass is NULL

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014976.html
 * [r451] src/common/pkcs11_lib.c: pkcs11_pass_login(): log an error
   if pkcs11_login() fails

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014964.html
 * [r450] src/common/pkcs11_lib.c: pkcs11_pass_login(): do not clean
   a zero length PIN

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014964.html
 * [r449] src/common/pkcs11_lib.c, src/pam_pkcs11/pam_pkcs11.c: Show
   PIN code in debug output only if DEBUG_SHOW_PASSWORD is defined
   (not defined by default)

   Thanks to Andre Zepezauer for the bug report
   http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014964.html

2010-09-21 ludovic.rousseau

 * [r448] src/pam_pkcs11/pam_config.c: parse_config_file(): get the
   debug value from the configuration file

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014949.html

2010-08-25 ludovic.rousseau

 * [r447] src/tools/card_eventmgr.c: Do not call
   SCardEstablishContext() before daemonize since pcsc-lite
   handles are invalid after a fork.

   Thanks to Patrik Martinsson for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-August/014632.html

2010-08-19 ludovic.rousseau

 * [r446] src/tools/card_eventmgr.c: Use SCARD_READERSTATE instead
   of SCARD_READERSTATE_A since it was
   removed in pcsc-lite >= 1.6.2

2010-08-14 ludovic.rousseau

 * [r445] src/mappers/cn_mapper.c, src/mappers/digest_mapper.c,
   src/mappers/generic_mapper.c, src/mappers/krb_mapper.c,
   src/mappers/ldap_mapper.c, src/mappers/mail_mapper.c,
   src/mappers/mapper.c, src/mappers/mapper.h,
   src/mappers/ms_mapper.c, src/mappers/null_mapper.c,
   src/mappers/opensc_mapper.c, src/mappers/openssh_mapper.c,
   src/mappers/pwent_mapper.c, src/mappers/subject_mapper.c,
   src/mappers/uid_mapper.c, src/pam_pkcs11/mapper_mgr.c,
   src/tools/pklogin_finder.c: Patch for #239 and #240 (handle more
   than one cert/pattern matching)

   Thanks to Wolf Geldmacher for the patch.
   http://www.opensc-project.org/pipermail/opensc-devel/2010-June/014405.html

   " Here's a patch to solve the issues I've encountered using
   pam_pkcs11.

   In regards to #239 (pam_pkcs11 only looks at first certificate on
   token):

   The fix for this turns out to be somewhat problematic, and I'm
   not at
   all sure, whether my implementation of the fix is a valid one.

   The basic problem (as I understood it from analyzing the code) is
   that
   finder functions of the mappers return a char*, allowing for a
   single
   value (NULL) to signalize failure and return the key if no
   mapping (i.e.
   no value associated with the key) was found (cf. comment for
   mapfile_find in src/mappers/mapper.c). Thus a caller (i.e.
   find_user in
   src/pam_pkcs11/mapper_mgr.c) cannot distinguish between a mapping
   or a
   key being returned and thus will prematurely terminate on the
   first
   certificate that passes the other validity tests.

   The fix provided changes the finder function interface by
   requiring an
   additional out parameter that is set to 1, if a real mapping
   value was
   returned and remains unchanged otherwise. This fix breaks
   existing
   loadable mappers.

   I considered overloading of the value returned (e.g. having a
   byte/substring as first character of the value returned to be
   able to
   distinguish between a value and a key being returned) which would
   preserve the interface to the mappers, but refrained from
   implementing
   it that way as I believe this to be unclean and prone to
   difficult to
   track errors.

   Another solution I considered was the addition of another entry
   to the
   structure encapsulating the mappers (e.g. a finder2 method), but
   as this
   is no better in breaking the interface for loadable mappers and
   duplicates code I forfeited this solution, too.

   If somebody could look into the problem and come up with a
   solution that
   preserves the interface to external mappers while allowing the
   distinction between keys and values, I'd be more than happy to
   implement
   it.

   It might also may make sense to add a new configuration parameter
   for
   the new behaviour of find_user, allowing existing applications to
   continue to work with keys being returned instead of values
   (Feedback
   anyone? The comment for find_user actually states that a mapping
   value
   is returned).

   In regards to #240 (Allow pattern matching in pam_pkcs11):

   I restricted this to only work for mapfiles and the
   implementation
   turned out to be quite simple - it's essentially an 11 line
   change in
   src/mappers/mapper.c - and is triggered by the specification of a
   fully
   anchored (i.e. *must* have initial "^" and *must* end in "$")
   pattern as
   key in a mapfile.

   This now allows syntax like
   ^.*/serialNumber=xxx-xxx-xxx-xxx$ -> username
   in all mapfiles.

   The patch attached contains the changes for both issues.

   Cheers,
   Wolf "

2010-08-13 ludovic.rousseau

 * [r444] src/pam_pkcs11/pam_pkcs11.c: Do not use a variadic
   parameter for pam_prompt. It is not supported on
   FreeBSD.

2010-08-12 ludovic.rousseau

 * [r443] src/common/strndup.h, src/tools/pkcs11_setup.c: Add a new
   header file to define strndup if needed.

   pkcs11_setup.c: In function ‘scconf_replace_str_list’:
   pkcs11_setup.c:73: warning: implicit declaration of function
   â€˜strndup’
   pkcs11_setup.c:73: warning: incompatible implicit declaration of
   built-in function ‘strndup’
 * [r441] src/pam_pkcs11/pam_config.c, src/tools/pkcs11_inspect.c,
   src/tools/pkcs11_listcerts.c, src/tools/pklogin_finder.c: Revert
   changeset 301 parsing arguments in pam_config.c but skip the
   first argument in command line tools.

   Thanks to halfline for the patch. Closes ticket #29