summaryrefslogtreecommitdiff
path: root/crypto/heimdal
Commit message (Collapse)AuthorAgeFilesLines
* Fix trailing-comma-related typos in the tree when the Xr macro is usedMateusz Piotrowski2020-06-271-1/+1
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=362676
* Complete LOCAL_PEERCRED support. Cache pid of the remote process in theDmitry Chagin2019-05-301-1/+1
| | | | | | | | | | | | struct xucred. Do not bump XUCRED_VERSION as struct layout is not changed. PR: 215202 Reviewed by: tijl MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D20415 Notes: svn path=/head/; revision=348419
* Remove unused sqlite3 bundled with heimdal.Cy Schubert2019-01-096-139196/+0
| | | | | | | Reported by: delphij@ Notes: svn path=/head/; revision=342871
* Update the existing heimdal implementation for OpenSSL 1.1.John Baldwin2018-10-0524-258/+557
| | | | | | | | | | | | | | | | | | | | Existing work is underway to import a newer version of heimdal, but this patchset gets us to a fully working tree to enable more wide spread testing of OpenSSL 1.1 for now. I've also enabled WARNS=1 for kerberos (which is the reason for the change in libroken). Having -Werror enabled was useful during the 1.1 updates and we probably should have warnings enabled by default for kerberos anyway. This passes make tinderbox, and I have also done some very light runtime testing on amd64. Reviewed by: bjk, jkim, emaste Differential Revision: https://reviews.freebsd.org/D17276 Notes: svn path=/projects/openssl111/; revision=339198
* Avoid printing extraneous function names when searching man pageCy Schubert2018-08-291-3/+2
| | | | | | | | | | | | | database (apropos, man -k). This commit Replaces .SS with .SH, similar to the man page provided by original heimdal (as in port). PR: 230573 Submitted by: yuripv@yuripv.net Approved by: re (rgrimes@) MFC after: 3 days Notes: svn path=/head/; revision=338367
* Update userland arc4random() with OpenBSD's Chacha20 based arc4random().Xin LI2018-08-191-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ObsoleteFiles.inc: Remove manual pages for arc4random_addrandom(3) and arc4random_stir(3). contrib/ntp/lib/isc/random.c: contrib/ntp/sntp/libevent/evutil_rand.c: Eliminate in-tree usage of arc4random_addrandom(). crypto/heimdal/lib/roken/rand.c: crypto/openssh/config.h: Eliminate in-tree usage of arc4random_stir(). include/stdlib.h: Remove arc4random_stir() and arc4random_addrandom() prototypes, provide temporary shims for transistion period. lib/libc/gen/Makefile.inc: Hook arc4random-compat.c to build, add hint for Chacha20 source for kernel, and remove arc4random_addrandom(3) and arc4random_stir(3) links. lib/libc/gen/arc4random.c: Adopt OpenBSD arc4random.c,v 1.54 with bare minimum changes, use the sys/crypto/chacha20 implementation of keystream. lib/libc/gen/Symbol.map: Remove arc4random_stir and arc4random_addrandom interfaces. lib/libc/gen/arc4random.h: Adopt OpenBSD arc4random.h,v 1.4 but provide _ARC4_LOCK of our own. lib/libc/gen/arc4random.3: Adopt OpenBSD arc4random.3,v 1.35 but keep FreeBSD r114444 and r118247. lib/libc/gen/arc4random-compat.c: Compatibility shims for arc4random_stir and arc4random_addrandom functions to preserve ABI. Log once when called but do nothing otherwise. lib/libc/gen/getentropy.c: lib/libc/include/libc_private.h: Fold __arc4_sysctl into getentropy.c (renamed to arnd_sysctl). Remove from libc_private.h as a result. sys/crypto/chacha20/chacha.c: sys/crypto/chacha20/chacha.h: Make it possible to use the kernel implementation in libc. PR: 182610 Reviewed by: cem, markm Obtained from: OpenBSD Relnotes: yes Differential Revision: https://reviews.freebsd.org/D16760 Notes: svn path=/head/; revision=338059
* MFV r320905: Import upstream fix for CVE-2017-11103.Xin LI2017-07-121-2/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | In _krb5_extract_ticket() the KDC-REP service name must be obtained from encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unecrypted version provides an opportunity for successful server impersonation and other attacks. Submitted by: hrs Obtained from: Heimdal Security: FreeBSD-SA-17:05.heimdal Security: CVE-2017-11103 Notes: svn path=/head/; revision=320906
* | Renumber copyright clause 4Warner Losh2017-02-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* | Remove duplicate symbol from libhx509 version-script.mapEd Maste2016-08-221-1/+0
| | | | | | | | | | | | | | | | | | Upstream commit r21331 (7758a5d0) added semiprivate function _hx509_request_to_pkcs10 twice. This change has been committed upstream as 8ef0071d. Notes: svn path=/head/; revision=304624
* | Remove duplicate symbols from libroken version-script.mapEd Maste2016-07-211-6/+0
| | | | | | | | | | | | | | | | | | Upstream commit r24759 (efed563) prefixed some symbols with rk_, but introduced 6 duplicate symbols in the version script (because the rk_-prefixed versions of the symbols were already present). Notes: svn path=/head/; revision=303156
* | libkrb5: Fix potential double-freeConrad Meyer2016-05-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed memory and then be double-freed. After freeing it the first time, initialize it to NULL, which causes subsequent krb5_free_principal calls to do the right thing. Reported by: Coverity CID: 1273430 Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=299495
* | Include the gssapi_krb5 library in KRB5_LDFLAGS.Glen Barber2014-09-081-1/+1
| | | | | | | | | | | | | | | | | | PR: 156245 MFC after: 3 days Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=271284
* | NO_MAN= has been deprecated in favor of MAN= for some time, go aheadWarner Losh2014-04-135-5/+5
| | | | | | | | | | | | | | | | | | and finish the job. ncurses is now the only Makefile in the tree that uses it since it wasn't a simple mechanical change, and will be addressed in a future commit. Notes: svn path=/head/; revision=264400
* | Apply patch from upstream Heimdal for encoding fixBenjamin Kaduk2013-12-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 4402 specifies the implementation of the gss_pseudo_random() function for the krb5 mechanism (and the C bindings therein). The implementation uses a PRF+ function that concatenates the output of individual krb5 pseudo-random operations produced with a counter and seed. The original implementation of this function in Heimdal incorrectly encoded the counter as a little-endian integer, but the RFC specifies the counter encoding as big-endian. The implementation initializes the counter to zero, so the first block of output (16 octets, for the modern AES enctypes 17 and 18) is unchanged. (RFC 4402 specifies that the counter should begin at 1, but both existing implementations begin with zero and it looks like the standard will be re-issued, with test vectors, to begin at zero.) This is upstream's commit f85652af868e64811f2b32b815d4198e7f9017f6, from 13 October, 2013: % Fix krb5's gss_pseudo_random() (n is big-endian) % % The first enctype RFC3961 prf output length's bytes are correct because % the little- and big-endian representations of unsigned zero are the % same. The second block of output was wrong because the counter was not % being encoded as big-endian. % % This change could break applications. But those applications would not % have been interoperating with other implementations anyways (in % particular: MIT's). Approved by: hrs (mentor, src committer) MFC after: 3 days Notes: svn path=/head/; revision=259286
* | Fix gssapi/gssapi_krb5.h after Heimdal 1.5.1 import.Hiroki Sato2013-06-301-1/+1
| | | | | | | | | | | | | | Reviewed by: dfr Notes: svn path=/head/; revision=252409
* | Have the ipropd-master listen on an IPv6 socket in addition to an IPv4Bjoern A. Zeeb2013-05-181-6/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | socket to allow propagation of changes to a Heimdal Kerberos database from the KDC master to the slave(s) work on IPv6 as well. Update the stats logging to also handle IPv6 addresses. Reported by: peter (found on FreeBSD cluster) X-to-be-tested-by: peter MFC after: 3 weeks Notes: svn path=/head/; revision=250782
* | Import change 6d783560e4aad1e680097d11e89755647a5aba87 from upstreamDimitry Andric2013-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | heimdal: fix sizeof(uuid) Found by: clang ToT Reviewed by: stas Notes: svn path=/head/; revision=247002
* | Clean some 'svn:executable' properties in the tree.Pedro F. Giffuni2013-01-261-0/+0
| | | | | | | | | | | | | | | | Submitted by: Christoph Mallon MFC after: 3 days Notes: svn path=/head/; revision=245952
* | Clean up hardcoded ar(1) flags in the tree to use the global ARFLAGS inEitan Adler2012-12-062-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | share/mk/sys.mk instead. This is part of a medium term project to permit deterministic builds of FreeBSD. Submitted by: Erik Cederstrand <erik@cederstrand.dk> Reviewed by: imp, toolchain@ Approved by: cperciva MFC after: 2 weeks Notes: svn path=/head/; revision=243933
* | In crypto/heimdal/lib/sl/slc-lex.l, don't define YY_NO_INPUT, sinceDimitry Andric2012-11-141-2/+0
| | | | | | | | | | | | | | | | | | %option nounput is already specified. MFC after: 3 days Notes: svn path=/head/; revision=243034
* | - Update FreeBSD's Heimdal distribution to 1.5.2. This is a bugfixStanislav Sedov2012-04-08220-394/+385
|\| | | | | | | | | | | | | release, which fixes a DoS issue in libkrb5. Notes: svn path=/head/; revision=234027
* | - Update FreeBSD Heimdal distribution to version 1.5.1. This also bringsStanislav Sedov2012-03-222720-162456/+415899
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | several new kerberos related libraries and applications to FreeBSD: o kgetcred(1) allows one to manually get a ticket for a particular service. o kf(1) securily forwards ticket to another host through an authenticated and encrypted stream. o kcc(1) is an umbrella program around klist(1), kswitch(1), kgetcred(1) and other user kerberos operations. klist and kswitch are just symlinks to kcc(1) now. o kswitch(1) allows you to easily switch between kerberos credentials if you're running KCM. o hxtool(1) is a certificate management tool to use with PKINIT. o string2key(1) maps a password into key. o kdigest(8) is a userland tool to access the KDC's digest interface. o kimpersonate(8) creates a "fake" ticket for a service. We also now install manpages for some lirbaries that were not installed before, libheimntlm and libhx509. - The new HEIMDAL version no longer supports Kerberos 4. All users are recommended to switch to Kerberos 5. - Weak ciphers are now disabled by default. To enable DES support (used by telnet(8)), use "allow_weak_crypto" option in krb5.conf. - libtelnet, pam_ksu and pam_krb5 are now compiled with error on warnings disabled due to the function they use (krb5_get_err_text(3)) being deprecated. I plan to work on this next. - Heimdal's KDC now require sqlite to operate. We use the bundled version and install it as libheimsqlite. If some other FreeBSD components will require it in the future we can rename it to libbsdsqlite and use for these components as well. - This is not a latest Heimdal version, the new one was released while I was working on the update. I will update it to 1.5.2 soon, as it fixes some important bugs and security issues. Notes: svn path=/head/; revision=233294
| * - Flatten the vendor heimdal tree.Stanislav Sedov2011-09-291592-515730/+0
| | | | | | | | Notes: svn path=/vendor-crypto/heimdal/dist/; revision=225864
* | Fix a problem whereby a corrupt DNS record can cause named to crash. [11:06]Colin Percival2011-12-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add an API for alerting internal libc routines to the presence of "unsafe" paths post-chroot, and use it in ftpd. [11:07] Fix a buffer overflow in telnetd. [11:08] Make pam_ssh ignore unpassphrased keys unless the "nullok" option is specified. [11:09] Add sanity checking of service names in pam_start. [11:10] Approved by: so (cperciva) Approved by: re (bz) Security: FreeBSD-SA-11:06.bind Security: FreeBSD-SA-11:07.chroot Security: FreeBSD-SA-11:08.telnetd Security: FreeBSD-SA-11:09.pam_ssh Security: FreeBSD-SA-11:10.pam Notes: svn path=/head/; revision=228843
* | Fix clang warning (why is there nowhere yyparse() is declared?).Ben Laurie2011-05-181-0/+1
| | | | | | | | | | | | | | Approved by: philip (mentor) Notes: svn path=/head/; revision=222081
* | The size of credential messages is limited by CMGROUP_MAX rather thanBrooks Davis2010-01-031-1/+1
| | | | | | | | | | | | | | | | | | NGROUPS. MFC after: 1 week Notes: svn path=/head/; revision=201444
* | Fix conflicts after heimdal-1.1 import and add build infrastructure. ImportDoug Rabson2008-05-0782-13786/+1343
| | | | | | | | | | | | | | all non-style changes made by heimdal to our own libgssapi. Notes: svn path=/head/; revision=178828
* | This commit was generated by cvs2svn to compensate for changes in r178825,Doug Rabson2008-05-071483-48403/+252590
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=178826
| * Vendor import of Heimdal 1.1Doug Rabson2008-05-071493-49127/+253906
| | | | | | | | Notes: svn path=/vendor-crypto/heimdal/dist/; revision=178825
* | Remove _FREEFALL_CONFIG hacks. su+pam_ksu works well enough to use onPeter Wemm2007-10-182-18/+2
| | | | | | | | | | | | | | the freebsd.org cluster. Notes: svn path=/head/; revision=172765
* | Fix the amd64 (and presumably ia64) lib32 build by ensuring that theDoug Rabson2006-01-021-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | heimdal GSS-API mechanism uses its own version of gssapi.h, including all the implementation-dependant pollution contained therein. This moves the file off the vendor branch, sadly. Submitted by: bz Notes: svn path=/head/; revision=153969
* | This is sort of an MFS. Peter made these changes to the RELENG_*Ken Smith2005-07-072-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | branches but missed HEAD. This patch extends his a little bit, setting it up via the Makefiles so that adding _FREEFALL_CONFIG to /etc/make.conf is the only thing needed to cluster-ize things (current setup also requires overriding CFLAGS). From Peter's commit to the RELENG_* branches: > Add the freebsd.org custer's source modifications under #ifdefs to aid > keeping things in sync. For ksu: > * install suid-root by default > * don't fall back to asking for a unix password (ie: be pure kerberos) > * allow custom user instances for things like www and not just root The Makefile tweaks will be MFC-ed, the rest is already done. MFC after: 3 days Approved by: re (dwhite) Notes: svn path=/head/; revision=147810
* | This commit was generated by cvs2svn to compensate for changes in r142403,Jacques Vidrine2005-02-2489-9398/+9041
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=142404
| * Vendor import of Heimdal 0.6.3.vendor/heimdal/0.6.3Jacques Vidrine2005-02-2489-9398/+9041
| | | | | | | | | | Notes: svn path=/vendor-crypto/heimdal/dist/; revision=142403 svn path=/vendor-crypto/heimdal/0.6.3/; revision=142405; tag=vendor/heimdal/0.6.3
| * Remove lib/kdfs from vendor branch: we do not build it, and it will notJacques Vidrine2005-02-244-1119/+0
| | | | | | | | | | | | | | be included in future imports. Notes: svn path=/vendor-crypto/heimdal/dist/; revision=142401
| * Clean up the Heimdal vendor branch by removing files not included inJacques Vidrine2005-02-24383-227627/+0
| | | | | | | | | | | | | | | | | | | | | | any import for several years. If memory serves, this was Suggested by: ru an awfully long time ago-- sorry for the delay! Notes: svn path=/vendor-crypto/heimdal/dist/; revision=142400
* | Do not include lib/kdfs in future imports.Jacques Vidrine2005-02-241-0/+1
| | | | | | | | Notes: svn path=/head/; revision=142402
* | Resolve conflicts after import of Heimdal 0.6.1.Jacques Vidrine2004-04-0330-3470/+196
| | | | | | | | Notes: svn path=/head/; revision=127811
* | This commit was generated by cvs2svn to compensate for changes in r127808,Jacques Vidrine2004-04-03190-18275/+47053
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=127809
| * Vendor import of Heimdal 0.6.1.Jacques Vidrine2004-04-03193-18479/+47473
| | | | | | | | Notes: svn path=/vendor-crypto/heimdal/dist/; revision=127808
* | This commit was generated by cvs2svn to compensate for changes in r120952,Jacques Vidrine2003-10-091-3/+3
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=120953
| * Correct badly-formed code (missing quote) within `#if 0' section.Jacques Vidrine2003-10-091-3/+3
| | | | | | | | | | | | | | | | | | Newer versions of GCC error in such situations. Obtained from: Heimdal CVS Notes: svn path=/vendor-crypto/heimdal/dist/; revision=120952
* | Resolve conflicts after import of Heimdal 0.6.Jacques Vidrine2003-10-091-27/+479
| | | | | | | | Notes: svn path=/head/; revision=120948
* | This commit was generated by cvs2svn to compensate for changes in r120945,Jacques Vidrine2003-10-09304-3696/+13274
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=120946
| * Vendor import of Heimdal 0.6.Jacques Vidrine2003-10-09306-3741/+13767
| | | | | | | | Notes: svn path=/vendor-crypto/heimdal/dist/; revision=120945
* | Add list of files to remove from the Heimdal distribution prior toJacques Vidrine2003-10-091-0/+13
| | | | | | | | | | | | | | each import. Notes: svn path=/head/; revision=120944
* | This commit was generated by cvs2svn to compensate for changes in r109641,Jacques Vidrine2003-01-211-1/+2
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=109642
| * Add a missing include, needed to get a prototype for `des_read_pw_string'.Jacques Vidrine2003-01-211-1/+2
| | | | | | | | | | | | | | | | | | This is particularly important for OpenSSL 0.9.7, as `des_read_pw_string' is a macro there. (This fix brought in on the vendor branch, because I already committed it to Heimdal's CVS.) Notes: svn path=/vendor-crypto/heimdal/dist/; revision=109641
* | This commit was generated by cvs2svn to compensate for changes in r107207,Jacques Vidrine2002-11-24110-1442/+1246
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=107208
| * Import of Heimdal 0.5.1.Jacques Vidrine2002-11-24110-1442/+1246
| | | | | | | | | | | | | | Approved by: re Notes: svn path=/vendor-crypto/heimdal/dist/; revision=107207
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-20 23:48:49 +0000