FreeBSD source tree https://cgit-dev.freebsd.org/src-test/atom?h=main 2018-10-05T16:35:24Z 2018-10-05T16:35:24Z John Baldwin jhb@FreeBSD.org 2018-10-05T16:35:24Z urn:sha1:e4456411a8c2d4a9bfbccd60f2cf914fd402f817 Existing work is underway to import a newer version of heimdal, but this patchset gets us to a fully working tree to enable more wide spread testing of OpenSSL 1.1 for now. I've also enabled WARNS=1 for kerberos (which is the reason for the change in libroken). Having -Werror enabled was useful during the 1.1 updates and we probably should have warnings enabled by default for kerberos anyway. This passes make tinderbox, and I have also done some very light runtime testing on amd64. Reviewed by: bjk, jkim, emaste Differential Revision: https://reviews.freebsd.org/D17276 2013-12-13T03:09:29Z Benjamin Kaduk bjk@FreeBSD.org 2013-12-13T03:09:29Z urn:sha1:0782240958117692ab9861abb5483c9e64f6bc39 RFC 4402 specifies the implementation of the gss_pseudo_random() function for the krb5 mechanism (and the C bindings therein). The implementation uses a PRF+ function that concatenates the output of individual krb5 pseudo-random operations produced with a counter and seed. The original implementation of this function in Heimdal incorrectly encoded the counter as a little-endian integer, but the RFC specifies the counter encoding as big-endian. The implementation initializes the counter to zero, so the first block of output (16 octets, for the modern AES enctypes 17 and 18) is unchanged. (RFC 4402 specifies that the counter should begin at 1, but both existing implementations begin with zero and it looks like the standard will be re-issued, with test vectors, to begin at zero.) This is upstream's commit f85652af868e64811f2b32b815d4198e7f9017f6, from 13 October, 2013: % Fix krb5's gss_pseudo_random() (n is big-endian) % % The first enctype RFC3961 prf output length's bytes are correct because % the little- and big-endian representations of unsigned zero are the % same. The second block of output was wrong because the counter was not % being encoded as big-endian. % % This change could break applications. But those applications would not % have been interoperating with other implementations anyways (in % particular: MIT's). Approved by: hrs (mentor, src committer) MFC after: 3 days 2013-06-30T07:46:22Z Hiroki Sato hrs@FreeBSD.org 2013-06-30T07:46:22Z urn:sha1:3fbceebb4af85423548ff31c942629c8aac07dfe Reviewed by: dfr 2012-04-08T08:19:17Z Stanislav Sedov stas@FreeBSD.org 2012-04-08T08:19:17Z urn:sha1:cf771f223b1a69e11fd1b70b0a274a73fe844335 release, which fixes a DoS issue in libkrb5. 2012-03-22T08:48:42Z Stanislav Sedov stas@FreeBSD.org 2012-03-22T08:48:42Z urn:sha1:ae77177087c655fc883075af4f425b37e032cd05 several new kerberos related libraries and applications to FreeBSD: o kgetcred(1) allows one to manually get a ticket for a particular service. o kf(1) securily forwards ticket to another host through an authenticated and encrypted stream. o kcc(1) is an umbrella program around klist(1), kswitch(1), kgetcred(1) and other user kerberos operations. klist and kswitch are just symlinks to kcc(1) now. o kswitch(1) allows you to easily switch between kerberos credentials if you're running KCM. o hxtool(1) is a certificate management tool to use with PKINIT. o string2key(1) maps a password into key. o kdigest(8) is a userland tool to access the KDC's digest interface. o kimpersonate(8) creates a "fake" ticket for a service. We also now install manpages for some lirbaries that were not installed before, libheimntlm and libhx509. - The new HEIMDAL version no longer supports Kerberos 4. All users are recommended to switch to Kerberos 5. - Weak ciphers are now disabled by default. To enable DES support (used by telnet(8)), use "allow_weak_crypto" option in krb5.conf. - libtelnet, pam_ksu and pam_krb5 are now compiled with error on warnings disabled due to the function they use (krb5_get_err_text(3)) being deprecated. I plan to work on this next. - Heimdal's KDC now require sqlite to operate. We use the bundled version and install it as libheimsqlite. If some other FreeBSD components will require it in the future we can rename it to libbsdsqlite and use for these components as well. - This is not a latest Heimdal version, the new one was released while I was working on the update. I will update it to 1.5.2 soon, as it fixes some important bugs and security issues. 2011-09-29T05:23:57Z Stanislav Sedov stas@FreeBSD.org 2011-09-29T05:23:57Z urn:sha1:31f1e9c17ffae440059e8cc532fa26b92d534f7b 2008-05-07T13:53:12Z Doug Rabson dfr@FreeBSD.org 2008-05-07T13:53:12Z urn:sha1:33f12199250a09b573f7a518b523fdac3f120b8f all non-style changes made by heimdal to our own libgssapi. 2008-05-07T13:39:42Z Doug Rabson dfr@FreeBSD.org 2008-05-07T13:39:42Z urn:sha1:c19800e8cd5640693f36f2040db4ab5e8d738146 2008-05-07T13:39:42Z Doug Rabson dfr@FreeBSD.org 2008-05-07T13:39:42Z urn:sha1:4fe54d7c6acb302aacc6ac18798804b26c882c13 which included commits to RCS files with non-trunk default branches. 2006-01-02T11:28:42Z Doug Rabson dfr@FreeBSD.org 2006-01-02T11:28:42Z urn:sha1:17ed18fef3ee30b72f8f88ef7b43d082ae8d8bf1 heimdal GSS-API mechanism uses its own version of gssapi.h, including all the implementation-dependant pollution contained therein. This moves the file off the vendor branch, sadly. Submitted by: bz