aboutsummaryrefslogtreecommitdiff
path: root/kerberos5/lib
Commit message (Collapse)AuthorAgeFilesLines
* heimdal-kadmin: Add support for the -f dump optionRick Macklem2025-10-051-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "-f" dump option allows a dump of the Heimdal KDC in a format that the MIT kdb5_util command can load into a MIT KDC's database. This makes transitioning from the Heimdal KDC to the current MIT one feasible without having to re-create the KDC database from scratch. glebius@ did the initial work, cherry picking these commits from the Heimdal sources on github and then doing extensive merge conflict resolution and other fixes so that it would build. Heimdal commit fca5399 authored by Nico Williams: Initial commit for second approach for multiple kvno. NOT TESTED! Heimdal commit 57f1545 authored by Nico Williams: Add support for writing to KDB and dumping HDB to MIT KDB dump format Before this change Heimdal could read KDBs. Now it can write to them too. Heimdal can now also dump HDBs (including KDBs) in MIT format, which can then be imported with kdb5_util load. This is intended to help in migrations from MIT to Heimdal by allowing migrations from Heimdal to MIT so that it is possible to rollback from Heimdal to MIT should there be any issues. The idea is to allow a) running Heimdal kdc/kadmind with a KDB, or b) running Heimdal with an HDB converted from a KDB and then rollback by dumping the HDB and loading a KDB. Note that not all TL data types are supported, only two: last password change and modify-by. This is the minimum necessary. PKINIT users may need to add support for KRB5_TL_USER_CERTIFICATE, and for databases with K/M history we may need to add KRB5_TL_MKVNO support. This resulted in a Heimdal kadmin that would dump the KDC database in MIT format. However, there were issues when this dump was loaded into the current MIT KDC in FreeBSD current/15.0. The changes I did to make the dump more useful are listed below: When "-f MIT" is used for "kadmin -l dump" it writes the dump out in MIT format. This dump format is understood by the MIT kdb5_util command. The patch modifies the above so that the MIT KDC's master key keytab file can be provided as the argument to "-f" so that the principals are re-encrypted in it. This allows any principal with at least one strong encryption type key to work without needing a change_password. The strong encryption types supported by the Heimdal KDC are: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 The issues my changes address are: - If there are weak encryption keys in a principal's entry, MIT's kadmin.local will report that the principcal's entry is incomplete or corrupted. - The keys are encrypted in Heimdal's master key. The "-d" option can be used on the "kadmin -l dump" to de-encrypt them, but the passwords will not work on the current MIT KDC. To try and deal with the above issues, this patch modied the above to: - Does not dump the weak keys. - Re-encrypts the strong keys in MIT's master key if the argument to "-f" is actually a filename which holds the MIT KDC's master key keytab and not "MIT". - For principals that only have weak keys, it generates a fake strong key. This key will not work on the MIT KDC, but the principal entry will work once a change_password is done to it. - It always generates a "modified_by" entry, faking one if not already present in the Heimdal KDC database. This was necessary, since the MIT kadmin will report that the principal entry is "incomplete or corrupted" without one. It also fixed a problem where "get principal" no longer worked after the initial patch was applied. A man page update will be done as a separate commit. I believe this commit is acceptable since the Heimdal sources are now essentially deprecated in favor of the MIT sources and that this new "-f" patch simplifies the transition to the MIT KDC. Discussed with: glebius, cy MFC after: 3 days
* kerberos5: Fix the Heimdal pkgbase buildLexi Winter2025-09-0420-38/+2
| | | | | | | | | | | | | | | | | | When LIB_PACKAGE was added, MIT Kerberos was updated to use it but Heimdal was not, so it still used PACKAGE=kerberos-lib. Since we deleted kerberos-lib-all.ucl, this caused update-packages to fail when WITHOUT_MITKRB5 is set. Change the Heimdal libraries to use LIB_PACKAGE by setting this in kerberos5/lib/Makefile.inc, and remove PACKAGE=kerberos-lib from the individual Makefiles for each library. This means Heimdal gets the same set of packages as MIT Kerberos, except for kerberos-kdc which we don't create for Heimdal. Fixes: 929f5966a9fd ("packages: Improve handling of -lib packages") Reported by: jlduran Reviewed by: jlduran, cy Differential Revision: https://reviews.freebsd.org/D52371
* heimdal: fix wrt OpenSSL 3.5Gleb Smirnoff2025-08-251-6/+1
| | | | | | | | | - Bump the library version. - Don't load the legacy provider. It is no longer enabled by default and looks like kdc doesn't actually need it. Reviewed by: cy Differential Revision: https://reviews.freebsd.org/D52114
* Remove MK_GSSAPILexi Winter2025-08-201-2/+0
| | | | | | | | | | | | | | | For MIT Kerberos, MK_GSSAPI has no meaning: GSSAPI is a required part of Kerberos and is always built if MK_KERBEROS is enabled. Backport this behaviour to Heimdal so it works the same way. While here, change Heimdal's libcom_err and compile_et to be selected by MK_KERBEROS, not MK_KERBEROS_SUPPORT, since these are part of Kerberos and third-party users might need it even if Kerberos support is disabled in the base system. This means MK_KERBEROS_SUPPORT installs the same files with both MIT and Heimdal. Reviewed by: cy Differential Revision: https://reviews.freebsd.org/D51859
* kerberos5, libcom_err, others: append to LDFLAGS instead of replacingChuck Silvers2025-04-0514-14/+14
| | | | | Reviewed by: imp, emaste Differential Revision: https://reviews.freebsd.org/D49548
* Remove residual blank line at start of MakefileWarner Losh2024-07-1521-21/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* kerberos5: Mitigate the possibility of using an old libcryptoCy Schubert2024-01-181-1/+2
| | | | | | | | | | By using the full library name (libcrypto.so.30) we avoid the exposure of using an old, possibly vulnerable, library. Reported by: jrtc27 MFC after: 3 days X-MFC with: 476d63e091c2 Fixes: 476d63e091c2
* kerberos: Fix numerous segfaults when using weak cryptoCy Schubert2024-01-182-2/+83
| | | | | | | | | | | | | | | | | | | | Weak crypto is provided by the openssl legacy provider which is not load by default. Load the legacy providers as needed. When the legacy provider is loaded into the default context the default provider will no longer be automatically loaded. Without the default provider the various kerberos applicaions and functions will abort(). This is the second attempt at this patch. Instead of linking secure/lib/libcrypto at build time we now link it at runtime, avoiding buildworld failures under Linux and MacOS. This is because TARGET_ENDIANNESS is undefined at pre-build time. PR: 272835 MFC after: 3 days X-MFC: only to stable/14 Tested by: netchild Joerg Pulz <Joerg.Pulz@frm2.tum.de> (previous version)
* Revert "kerberos: Fix numerous segfaults when using weak crypto"Cy Schubert2024-01-122-49/+3
| | | | | | | | | | | | | | | | This revision breaks Linux and MacOS cross builds because TARGET_ENDIANNESS is not define during bootstrapping on these platforms. I think the correct approach would be to separate the new fbsd_ossl_provider_load() and unload functions into their own library (instead of libroken). This avoids the less desirable option of including bsd.cpu.mk in secure/lib/Makefile.common, which does build but could complicate future work. Reported by: jrtc27 This reverts commit cb350ba7bf7ca7c4cb97ed2c20ab45af60382cfb.
* kerberos: Fix numerous segfaults when using weak cryptoCy Schubert2024-01-112-3/+49
| | | | | | | | | | | | | | Weak crypto is provided by the openssl legacy provider which is not load by default. Load the legacy providers as needed. When the legacy provider is loaded into the default context the default provider will no longer be automatically loaded. Without the default provider the various kerberos applicaions and functions will abort(). PR: 272835 MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D43009 Tested by: netchild, Joerg Pulz <Joerg.Pulz@frm2.tum.de>
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-1642-42/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: one-line .c comment patternWarner Losh2023-08-162-2/+0
| | | | Remove /^/[*/]\s*\$FreeBSD\$.*\n/
* Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-164-8/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* kerberos: Request the OpenSSL 1.1 APIPierre Pronchery2023-06-236-0/+6
| | | | | | | This is needed to build with OpenSSL 3.0; a future update should switch to using native OpenSSL 3 APIs. Sponsored by: The FreeBSD Foundation
* spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDWarner Losh2023-05-125-5/+5
| | | | | | | | | The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
* Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-194-4/+0
|
* heimdal: Do not build a redundant source fileCy Schubert2023-04-021-1/+0
| | | | | | | | Heimdal's lib/hdb/db3.c is only built if DB3 is enabled, i.e. #if HAVE_DB3. FreeBSD's bdb is DB1. Therefore the entire db3.c file is #ifdef'd out. Let's avoid building a file that results in a useless object file. MFC after: 1 week
* pkgbase: split kerberos binaries and libsDoug Rabson2022-08-0319-19/+19
| | | | | | | | | | | | | | | | | | | | Summary: This allows installing packages that depend on kerberos libraries without pulling in all the binaries. It also moves libgssapi to runtime to allow installing kerbereos libraries without adding a dependancy on the large utilities package. It makes sense to put libgssapi in runtime rather than kerberos-lib since this is a plugin layer which is intended to support any GSS-API mechanisms, not just kerberos. A good example of a package which uses kerberos libraries without needing the kerberos utilities is sshd. This uses the kerberos GSS-API libraries to implement its GSSAPIAuthentication option. MFC after: 2 weeks Subscribers: imp Differential Revision: https://reviews.freebsd.org/D36028
* pkgbase: Create a FreeBSD-kerberos packageEmmanuel Vadot2021-09-0719-0/+38
| | | | | | | This allows users to install or not kerberos related utilities and libs. Differential Revision: https://reviews.freebsd.org/D31801
* kerberos5: fix the WITH_OPENLDAP buildKyle Evans2021-01-301-0/+2
| | | | | | | Restore WARNS to its former glory prior to the global WARNS change to fix the build. MFC-after: 3 days
* Update Makefile.depend filesSimon J. Gerraty2019-12-1113-14/+0
| | | | | | | | | | | | | Update a bunch of Makefile.depend files as a result of adding Makefile.depend.options files Reviewed by: bdrewery MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22494 Notes: svn path=/head/; revision=355617
* Use ${SRCTOP}/contrib/com_err/com_err.h instead of the installed com_err.h.Yoshihiro Takahashi2019-01-1410-9/+21
| | | | | | | | | | This fixes build when com_err.h is not installed. PR: 234691 MFC after: 1 week Notes: svn path=/head/; revision=343011
* various: general adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-275-0/+10
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 2-Clause license, however the tool I was using misidentified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. No functional change intended. Notes: svn path=/head/; revision=326276
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-3117-18/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* krb5_err.h is generated from a .et file in kerberos5/lib/libkrb5.Cy Schubert2017-08-061-1/+1
| | | | | | | | | | As kerberos5/lib/krb5 include files are already referenced it makes no sense to generate it again here. MFC after: 1 month Notes: svn path=/head/; revision=322112
* Remove trailing slash (/) for consistency.Cy Schubert2017-07-261-1/+1
| | | | Notes: svn path=/head/; revision=321504
* Disconnect heimdal version of qsort.c from build because we are alreadyXin LI2017-05-261-1/+0
| | | | | | | | | | | using libc's version of qsort. PR: bin/213922 MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D10814 Notes: svn path=/head/; revision=318917
* kerberos5: normalize paths using SRCTOP-relative paths or :H when possibleEnji Cooper2017-03-046-8/+8
| | | | | | | | | | This simplifies make logic/output MFC after: 1 month Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314657
* libgssapi_{krb5,ntlm,spnego} requires MK_GSSAPI != no; conditionalizeEnji Cooper2017-01-021-2/+9
| | | | | | | | | their building on the knob MFC after: 1 week Notes: svn path=/head/; revision=311112
* WITH_META_MODE: Don't expect meta files for side-effect generated files.Bryan Drewery2016-06-034-0/+14
| | | | | | | | | | | | The first file in these lists will generate everything else so only it should be getting a .meta file. With bmake's missing=yes meta feature these would otherwise cause a rebuild without the .NOMETA hint. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=301285
* We don't have a CPPFLAGS, COPTS or CPUFLAGS.Bryan Drewery2016-03-261-1/+0
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=297282
* DIRDEPS_BUILD: Regenerate without local dependencies.Bryan Drewery2016-02-2412-2519/+0
| | | | | | | | | | | These are no longer needed after the recent 'beforebuild: depend' changes and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports skipping 'make depend'. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295989
* FAST_DEPEND: Always run depend via beforebuild which removes many hacks.Bryan Drewery2016-02-244-16/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will generate dependencies rather than depending on the previous behavior of depending on the guessed OBJS: *.h dependecies or a user running 'make depend'. Experimentation showed that depending only on headers was not enough and prone to .ORDER errors. Downstream users may also have added dependencies into beforedepend or afterdepend targets. The safest way to ensure dependencies are generated before build is to run 'make depend' beforehand rather than just depending on DPSRCS+SRCS. Note that the OBJS_DEPEND_GUESS mechanism (a.k.a .if !exists(.depend) then foo.o: *.h) is still useful as it improves incremental builds with missing .depend.* files and allows 'make foo.o' to usually work, while this 'beforebuild: depend' ensures that the build will always find all dependencies. The 'make foo.o' case has no means of a 'beforebuild' hook. This also removes several hacks in the DIRDEPS_BUILD: - NO_INSTALL_INCLUDES is no longer needed as it mostly was to work around .ORDER problems with building the needed headers early. - DIRDEPS_BUILD: It is no longer necesarry to track "local dependencies" in Makefile.depend. These were only in Makefile.depend for 'clean builds' since nothing would generate the files due to skipping 'make depend' and early dependency bugs that have been fixed, such as adding headers into SRCS for the OBJS_DEPEND_GUESS mechanism. Normally if a .depend file does not exist then a dependency is added by bsd.lib.mk/bsd.prog.mk from OBJS: *.h. However, meta.autodep.mk creates a .depend file from created meta files and inserts that into Makefile.depend. It also only tracks *.[ch] files though which can miss some dependencies that are hooked into 'make depend'. This .depend that is created then breaks incremental builds due to the !exists(.depend) checks for OBJS_DEPEND_GUESS. The goal was to skip 'make depend' yet it only really works the first time. After that files are not generated as expected, which r288966 tried to address but was using buildfiles: rather than beforebuild: and was reverted in r291725. As noted previously, depending only on headers in beforebuild: would create .ORDER errors in some cases. meta.autodep.mk is still used to generate Makefile.depend though via: gendirdeps: Makefile.depend .END: gendirdeps This commit allows removing all of the "local dependencies" in Makefile.depend which cuts down on churn and removes some of the arch-dependent Makefile.depend files. The "local dependencies" were also problematic for bootstrapping. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295988
* DIRDEPS_BUILD: Add some missing build dependencies for kerberos5.Bryan Drewery2016-02-2413-0/+16
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295979
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2015-12-078-8/+0
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=291972
* META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.Bryan Drewery2015-11-2517-17/+0
| | | | | | | | | | | This both avoids some dependencies on xinstall.host and allows bootstrapping on older releases to work due to lack of at least 'install -l' support. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=291307
* Partially revert r288266: Remove SUBDIR_PARALLEL from kerberos5/lib.Bryan Drewery2015-10-131-1/+0
| | | | | | | | | I intended to remove this before committing r288266. It works but is clearly wrong and working by accident due to the dependencies listed in the root Makefile.inc1 file. Notes: svn path=/head/; revision=289251
* Add more SUBDIR_PARALLEL.Bryan Drewery2015-09-261-0/+2
| | | | | | | | MFC after: 3 weeks Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=288266
* Make it buildable with WITH_OPENLDAP, again.Hajimu UMEMOTO2015-08-271-1/+2
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=287208
* Fix a typo introduced in r262209.Jung-uk Kim2015-06-181-1/+1
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=284578
* new dependsSimon J. Gerraty2015-06-167-0/+8
| | | | Notes: svn path=/head/; revision=284481
* Add META_MODE support.Simon J. Gerraty2015-06-1322-1/+2992
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | Off by default, build behaves normally. WITH_META_MODE we get auto objdir creation, the ability to start build from anywhere in the tree. Still need to add real targets under targets/ to build packages. Differential Revision: D2796 Reviewed by: brooks imp Notes: svn path=/head/; revision=284345
| * Explain why NO_BEFOREBUILD_INCLUDES is neededSimon J. Gerraty2015-06-101-0/+3
| | | | | | | | Notes: svn path=/projects/bmake/; revision=284242
| * Explain why NO_BEFOREBUILD_INCLUDES is neededSimon J. Gerraty2015-06-101-0/+3
| | | | | | | | Notes: svn path=/projects/bmake/; revision=284241
| * Explain why NO_BEFOREBUILD_INCLUDES is neededSimon J. Gerraty2015-06-101-0/+3
| | | | | | | | Notes: svn path=/projects/bmake/; revision=284206
| * dirdeps.mk now sets DEP_RELDIRSimon J. Gerraty2015-06-0819-38/+0
| | | | | | | | Notes: svn path=/projects/bmake/; revision=284172
| * Merge sync of headSimon J. Gerraty2015-05-2729-82/+38
| |\ | | | | | | | | | Notes: svn path=/projects/bmake/; revision=283595
| * \ Merge from head@274682Simon J. Gerraty2014-11-192-3/+3
| |\ \ | | | | | | | | | | | | Notes: svn path=/projects/bmake/; revision=274683
| * | | Supress beforebuild dependency on buildincludesSimon J. Gerraty2014-05-163-1/+8
| | | | | | | | | | | | | | | | Notes: svn path=/projects/bmake/; revision=266222
| * | | Updated dependenciesSimon J. Gerraty2014-05-1618-6/+30
| | | | | | | | | | | | | | | | Notes: svn path=/projects/bmake/; revision=266219
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-25 15:31:41 +0000