aboutsummaryrefslogtreecommitdiff
path: root/kerberos5
Commit message (Collapse)AuthorAgeFilesLines
* kerberos5: Mitigate the possibility of using an old libcryptoCy Schubert2024-01-181-1/+2
| | | | | | | | | | By using the full library name (libcrypto.so.30) we avoid the exposure of using an old, possibly vulnerable, library. Reported by: jrtc27 MFC after: 3 days X-MFC with: 476d63e091c2 Fixes: 476d63e091c2
* kerberos: Fix numerous segfaults when using weak cryptoCy Schubert2024-01-184-2/+91
| | | | | | | | | | | | | | | | | | | | Weak crypto is provided by the openssl legacy provider which is not load by default. Load the legacy providers as needed. When the legacy provider is loaded into the default context the default provider will no longer be automatically loaded. Without the default provider the various kerberos applicaions and functions will abort(). This is the second attempt at this patch. Instead of linking secure/lib/libcrypto at build time we now link it at runtime, avoiding buildworld failures under Linux and MacOS. This is because TARGET_ENDIANNESS is undefined at pre-build time. PR: 272835 MFC after: 3 days X-MFC: only to stable/14 Tested by: netchild Joerg Pulz <Joerg.Pulz@frm2.tum.de> (previous version)
* Revert "kerberos: Fix numerous segfaults when using weak crypto"Cy Schubert2024-01-125-58/+4
| | | | | | | | | | | | | | | | This revision breaks Linux and MacOS cross builds because TARGET_ENDIANNESS is not define during bootstrapping on these platforms. I think the correct approach would be to separate the new fbsd_ossl_provider_load() and unload functions into their own library (instead of libroken). This avoids the less desirable option of including bsd.cpu.mk in secure/lib/Makefile.common, which does build but could complicate future work. Reported by: jrtc27 This reverts commit cb350ba7bf7ca7c4cb97ed2c20ab45af60382cfb.
* kerberos: Fix numerous segfaults when using weak cryptoCy Schubert2024-01-115-4/+58
| | | | | | | | | | | | | | Weak crypto is provided by the openssl legacy provider which is not load by default. Load the legacy providers as needed. When the legacy provider is loaded into the default context the default provider will no longer be automatically loaded. Without the default provider the various kerberos applicaions and functions will abort(). PR: 272835 MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D43009 Tested by: netchild, Joerg Pulz <Joerg.Pulz@frm2.tum.de>
* sccs: Manual changesWarner Losh2023-11-271-2/+1
| | | | | | | | | | | | | | | For the uncommon items: Go through the tree and remove sccs tags that didn't fit any nice pattern. If in the neighborhood, other SCM tags were removed when they were detritis of long-ago CVS somehow in the early mists of the project. Some adjacent copyrights stringswere removed (they duplicated the copyright notices in the file). This also removed non-standard formations of omission of SCCS tags (usually by adding an extra #if 0 somewhere. After this commit, a number of strings tagged with the 'what' @(#) prefix remain, but they are primarily copyright notices. Sponsored by: Netflix
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-16112-112/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: one-line .c comment patternWarner Losh2023-08-166-6/+0
| | | | Remove /^/[*/]\s*\$FreeBSD\$.*\n/
* Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-164-8/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* kerberos5: Migrate from COMPAT_32BIT to generic COMPAT_LIBCOMPATJessica Clarke2023-07-091-1/+1
| | | | | | | | See commit 8fad2cda93c7 ("bsd.compat.mk: Provide new CPP and sub-make variables") for the context behind this change. Reviewed by: emaste, imp, brooks, jhb Differential Revision: https://reviews.freebsd.org/D40926
* kerberos: Request the OpenSSL 1.1 APIPierre Pronchery2023-06-237-0/+7
| | | | | | | This is needed to build with OpenSSL 3.0; a future update should switch to using native OpenSSL 3 APIs. Sponsored by: The FreeBSD Foundation
* spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDWarner Losh2023-05-125-5/+5
| | | | | | | | | The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
* Update/fix Makefile.depend for userlandSimon J. Gerraty2023-04-1933-205/+0
|
* heimdal: Do not build a redundant source fileCy Schubert2023-04-021-1/+0
| | | | | | | | Heimdal's lib/hdb/db3.c is only built if DB3 is enabled, i.e. #if HAVE_DB3. FreeBSD's bdb is DB1. Therefore the entire db3.c file is #ifdef'd out. Let's avoid building a file that results in a useless object file. MFC after: 1 week
* kerberos5: retire now-unused MIPS supportEd Maste2022-11-021-1/+1
|
* pkgbase: split kerberos binaries and libsDoug Rabson2022-08-0319-19/+19
| | | | | | | | | | | | | | | | | | | | Summary: This allows installing packages that depend on kerberos libraries without pulling in all the binaries. It also moves libgssapi to runtime to allow installing kerbereos libraries without adding a dependancy on the large utilities package. It makes sense to put libgssapi in runtime rather than kerberos-lib since this is a plugin layer which is intended to support any GSS-API mechanisms, not just kerberos. A good example of a package which uses kerberos libraries without needing the kerberos utilities is sshd. This uses the kerberos GSS-API libraries to implement its GSSAPIAuthentication option. MFC after: 2 weeks Subscribers: imp Differential Revision: https://reviews.freebsd.org/D36028
* pkgbase: Create a FreeBSD-kerberos packageEmmanuel Vadot2021-09-0749-0/+98
| | | | | | | This allows users to install or not kerberos related utilities and libs. Differential Revision: https://reviews.freebsd.org/D31801
* kerberos5: fix the WITH_OPENLDAP buildKyle Evans2021-01-301-0/+2
| | | | | | | Restore WARNS to its former glory prior to the global WARNS change to fix the build. MFC-after: 3 days
* kerberos5: Silence compiler warningsAlex Richardson2021-01-272-2/+3
| | | | | | | | | Building the kerberos5 subdirectory currently produces lots of warnings. Since there are many instances of these warnings and it's contrib code, this change silences the warnings instead of fixing them. Reviewed By: jhb, cy, bjk Differential Revision: https://reviews.freebsd.org/D28025
* Fix more -Wundef warnings during bootstrapAlex Richardson2020-10-141-1/+1
| | | | Notes: svn path=/head/; revision=366699
* Fix a noisy -Wundef warning when bootstrapping toolsAlex Richardson2020-09-101-1/+1
| | | | Notes: svn path=/head/; revision=365581
* Update Makefile.depend filesSimon J. Gerraty2019-12-1113-14/+0
| | | | | | | | | | | | | Update a bunch of Makefile.depend files as a result of adding Makefile.depend.options files Reviewed by: bdrewery MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22494 Notes: svn path=/head/; revision=355617
* Fix generation of krb5-config with LC_CTYPE=*.UTF-8Alex Richardson2019-07-011-1/+5
| | | | | | | | | | | When building on MacOS with a UTF-8 locale sed will fail when reading krb-config.in due to invalid characters. Forcing the "C" locale fixes this. Reviewed By: emaste, cy Differential Revision: https://reviews.freebsd.org/D16849 Notes: svn path=/head/; revision=349576
* Add WITH_PIE knob to build Position Independent ExecutablesEd Maste2019-02-152-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Building binaries as PIE allows the executable itself to be loaded at a random address when ASLR is enabled (not just its shared libraries). With this change PIE objects have a .pieo extension and INTERNALLIB libraries libXXX_pie.a. MK_PIE is disabled for some kerberos5 tools, Clang, and Subversion, as they explicitly reference .a libraries in their Makefiles. These can be addressed on an individual basis later. MK_PIE is also disabled for rtld-elf because it is already position-independent using bespoke Makefile rules. Currently only dynamically linked binaries will be built as PIE. Discussed with: dim Reviewed by: kib MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D18423 Notes: svn path=/head/; revision=344179
* Use ${SRCTOP}/contrib/com_err/com_err.h instead of the installed com_err.h.Yoshihiro Takahashi2019-01-1420-18/+36
| | | | | | | | | | This fixes build when com_err.h is not installed. PR: 234691 MFC after: 1 week Notes: svn path=/head/; revision=343011
* Update the existing heimdal implementation for OpenSSL 1.1.John Baldwin2018-10-052-4/+4
| | | | | | | | | | | | | | | | | | | | Existing work is underway to import a newer version of heimdal, but this patchset gets us to a fully working tree to enable more wide spread testing of OpenSSL 1.1 for now. I've also enabled WARNS=1 for kerberos (which is the reason for the change in libroken). Having -Werror enabled was useful during the 1.1 updates and we probably should have warnings enabled by default for kerberos anyway. This passes make tinderbox, and I have also done some very light runtime testing on amd64. Reviewed by: bjk, jkim, emaste Differential Revision: https://reviews.freebsd.org/D17276 Notes: svn path=/projects/openssl111/; revision=339198
* krb5-config build: Remove gratuitous escapingKyle Evans2018-08-121-14/+14
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=337665
* Remove redundant space.Cy Schubert2018-07-101-1/+1
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=336151
* various: general adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-275-0/+10
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 2-Clause license, however the tool I was using misidentified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. No functional change intended. Notes: svn path=/head/; revision=326276
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-3146-47/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* Replace the include path using CURDIR with KRB5DIR. This is consistentCy Schubert2017-08-211-1/+1
| | | | | | | | | with the rest of the Makefiles in kerberos5/. MFC after: 1 week Notes: svn path=/head/; revision=322749
* Remove dead target introduced in r178828.Cy Schubert2017-08-061-3/+0
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=322113
* krb5_err.h is generated from a .et file in kerberos5/lib/libkrb5.Cy Schubert2017-08-061-1/+1
| | | | | | | | | | As kerberos5/lib/krb5 include files are already referenced it makes no sense to generate it again here. MFC after: 1 month Notes: svn path=/head/; revision=322112
* Remove trailing slash (/) for consistency.Cy Schubert2017-07-261-1/+1
| | | | Notes: svn path=/head/; revision=321504
* Disconnect heimdal version of qsort.c from build because we are alreadyXin LI2017-05-261-1/+0
| | | | | | | | | | | using libc's version of qsort. PR: bin/213922 MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D10814 Notes: svn path=/head/; revision=318917
* kerberos5: normalize paths using SRCTOP-relative paths or :H when possibleEnji Cooper2017-03-0412-17/+17
| | | | | | | | | | This simplifies make logic/output MFC after: 1 month Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314657
* Conditionalize adding ${KRB5DIR}/lib/gssapi/krb5/gkrb5_err.et to ETSRCSEnji Cooper2017-01-021-1/+4
| | | | | | | | | if MK_GSSAPI != "no" MFC after: 1 week Notes: svn path=/head/; revision=311115
* Build libexec/kadmind when MK_GSSAPI != no because it requires gssapiEnji Cooper2017-01-021-1/+7
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=311114
* libgssapi_{krb5,ntlm,spnego} requires MK_GSSAPI != no; conditionalizeEnji Cooper2017-01-021-2/+9
| | | | | | | | | their building on the knob MFC after: 1 week Notes: svn path=/head/; revision=311112
* DIRDEPS_BUILD: Update dependenciesBryan Drewery2016-06-141-0/+1
| | | | | | | | Approved by: re (gjb) Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=301891
* Define targets in same order as .ORDERBryan Drewery2016-06-141-1/+1
| | | | | | | | | | This is a NOP but is done for style and to reduce confusion. Approved by: re (implicit) Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=301883
* WITH_META_MODE: Don't expect meta files for side-effect generated files.Bryan Drewery2016-06-035-0/+15
| | | | | | | | | | | | The first file in these lists will generate everything else so only it should be getting a .meta file. With bmake's missing=yes meta feature these would otherwise cause a rebuild without the .NOMETA hint. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=301285
* DIRDEPS_BUILD: Connect new directories and update dependencies.Bryan Drewery2016-06-031-1/+0
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=301283
* Remove the old depend (mkdep) code and make FAST_DEPEND the one true way.Bryan Drewery2016-03-301-2/+0
| | | | | | | | | | Reviewed by: emaste, hselasky (partial), brooks (brief) Discussed on: arch@ Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5742 Notes: svn path=/head/; revision=297434
* We don't have a CPPFLAGS, COPTS or CPUFLAGS.Bryan Drewery2016-03-261-1/+0
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=297282
* DIRDEPS_BUILD: Regenerate without local dependencies.Bryan Drewery2016-02-2423-2663/+0
| | | | | | | | | | | These are no longer needed after the recent 'beforebuild: depend' changes and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports skipping 'make depend'. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295989
* FAST_DEPEND: Always run depend via beforebuild which removes many hacks.Bryan Drewery2016-02-244-16/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will generate dependencies rather than depending on the previous behavior of depending on the guessed OBJS: *.h dependecies or a user running 'make depend'. Experimentation showed that depending only on headers was not enough and prone to .ORDER errors. Downstream users may also have added dependencies into beforedepend or afterdepend targets. The safest way to ensure dependencies are generated before build is to run 'make depend' beforehand rather than just depending on DPSRCS+SRCS. Note that the OBJS_DEPEND_GUESS mechanism (a.k.a .if !exists(.depend) then foo.o: *.h) is still useful as it improves incremental builds with missing .depend.* files and allows 'make foo.o' to usually work, while this 'beforebuild: depend' ensures that the build will always find all dependencies. The 'make foo.o' case has no means of a 'beforebuild' hook. This also removes several hacks in the DIRDEPS_BUILD: - NO_INSTALL_INCLUDES is no longer needed as it mostly was to work around .ORDER problems with building the needed headers early. - DIRDEPS_BUILD: It is no longer necesarry to track "local dependencies" in Makefile.depend. These were only in Makefile.depend for 'clean builds' since nothing would generate the files due to skipping 'make depend' and early dependency bugs that have been fixed, such as adding headers into SRCS for the OBJS_DEPEND_GUESS mechanism. Normally if a .depend file does not exist then a dependency is added by bsd.lib.mk/bsd.prog.mk from OBJS: *.h. However, meta.autodep.mk creates a .depend file from created meta files and inserts that into Makefile.depend. It also only tracks *.[ch] files though which can miss some dependencies that are hooked into 'make depend'. This .depend that is created then breaks incremental builds due to the !exists(.depend) checks for OBJS_DEPEND_GUESS. The goal was to skip 'make depend' yet it only really works the first time. After that files are not generated as expected, which r288966 tried to address but was using buildfiles: rather than beforebuild: and was reverted in r291725. As noted previously, depending only on headers in beforebuild: would create .ORDER errors in some cases. meta.autodep.mk is still used to generate Makefile.depend though via: gendirdeps: Makefile.depend .END: gendirdeps This commit allows removing all of the "local dependencies" in Makefile.depend which cuts down on churn and removes some of the arch-dependent Makefile.depend files. The "local dependencies" were also problematic for bootstrapping. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295988
* DIRDEPS_BUILD: Add some missing build dependencies for kerberos5.Bryan Drewery2016-02-2423-0/+27
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295979
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2015-12-078-8/+0
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=291972
* META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.Bryan Drewery2015-11-2517-17/+0
| | | | | | | | | | | This both avoids some dependencies on xinstall.host and allows bootstrapping on older releases to work due to lack of at least 'install -l' support. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=291307
* Partially revert r288266: Remove SUBDIR_PARALLEL from kerberos5/lib.Bryan Drewery2015-10-131-1/+0
| | | | | | | | | I intended to remove this before committing r288266. It works but is clearly wrong and working by accident due to the dependencies listed in the root Makefile.inc1 file. Notes: svn path=/head/; revision=289251
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-21 09:47:40 +0000