2594691dfd
Define HAVE_DB_185_H if db_185.h is present
2026-06-06 23:46:07 +01:00
a735b65b70
gssapi: avoid putenv use-after-free in store_cred
...
Fixes #1163
2026-06-06 23:38:21 +01:00
1f0f31c954
roken: Don't define any global vars in the pidfile namespace.
...
Newer util.h from NetBSD defines pidfile_path() which conflicts
here.
2026-05-30 12:06:31 -05:00
e1ab030717
kdc: reject kx509 requests when disabled
...
Fixes #1378 .
2026-05-28 21:30:06 -05:00
421c40c73e
kadm5: make ipropd-master listen on IPv6
...
Fixes #1330 .
2026-05-27 14:11:04 -05:00
de7aa57362
treewide: fix many null dereference reports
...
Add defensive handling for several NULL allocation and formatting paths reported across issues #820-#829.
Fixes #820 , fixes #821 , fixes #822 , fixes #823 , fixes #825 , fixes #828
2026-05-27 13:47:41 -05:00
9a9da70626
krb5: clean up get_cred_kdc on send context failure
...
Fixes #1207
2026-05-27 12:12:03 -05:00
e3a59b65d3
kadmin: generate stronger random passwords
...
Generate 12 random bytes and encode them with Heimdal base64url, producing
16-character random passwords with 96 bits of entropy.
This avoids punctuation and quoting issues while still raising generated
password entropy substantially from the old roughly 55-bit generator.
Fixes #1145
2026-05-27 12:06:14 -05:00
98d6fcacb4
krb5: fix ap_req_nofail documentation
...
Fixes #1371
2026-05-27 11:56:23 -05:00
4f147f5e1b
doc: trim krb5_verify_user xrefs
...
Fixes #1127
2026-05-27 16:01:16 +01:00
ef3860d6c3
doc: clean up krb5_init_context man page
...
Fixes #1125
2026-05-27 15:42:57 +01:00
20d4e914e3
gss: Fix NULL minor_status arguments
2026-05-27 14:30:27 +01:00
cdd22b6061
refactor(changepw): replace select() with poll()
...
Issue #1338
2026-05-27 14:16:23 +01:00
73acb1df8e
refactor(send_to_kdc): replace select() with poll()
...
Issue #1338
2026-05-27 14:16:23 +01:00
abec12ef7f
ipropd-slave: get a TGT before authenticating
...
Do not request an iprop/<master> initial ticket directly. With
name_canon_rules = as-is: this can leave the acquired credential
mismatched with what krb5_sendauth() later asks for. Get a normal TGT
and let sendauth acquire the service ticket.
Fixes #1332 .
2026-05-26 17:20:15 -05:00
2e3bb95430
Add KDC-free GSS tests
2026-05-25 20:18:06 -05:00
a66cb84e70
In krb5.conf make underscores and dashes equivalent
2026-05-25 20:14:36 -05:00
e89417f2a1
tests: cover MEMORY ccache cursor invalidation for #547
2026-05-25 20:09:20 -05:00
a105e8e117
tests: cover MEMORY gss_store_cred storage for #132
2026-05-25 20:01:05 -05:00
56b55e7c9b
add CI/CD for libedit and readline
2026-05-25 20:00:24 -05:00
e836e36d06
Remove duplicated libedit, find/use installed version
2026-05-25 20:00:24 -05:00
19325d4252
lib/gssapi/test_context.c: fix typo
2026-05-25 19:59:28 -05:00
3ff4191ba9
krb5: fail krb5_verify_user() early if service key missing
...
Fixes #1157 .
2026-05-25 19:42:40 -05:00
73bab3fea5
tests/kdc/leaks-kill.sh: typo
2026-05-25 17:32:30 -05:00
d47f526f55
ipc: serialize mig generated files
2026-05-25 17:32:05 -05:00
6efb8b405e
roken: provide poll fallback
2026-05-25 17:31:26 -05:00
6ce504ad84
kdc/kdc.8: move a comma
2026-05-22 20:33:08 -05:00
378a367c9e
kdc: Allow KDC plugin to handle attempts to authenticate without using hardware authentication
...
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz >
2026-05-20 11:47:28 -05:00
6d2d9632da
kdc: Check return value of pa_enc_ts_decrypt_kvno()
...
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz >
2026-05-20 11:47:28 -05:00
c65cd331e4
gsskrb5: Correctly check EVP_Cipher() return value for RC4
...
If the flag EVP_CIPH_FLAG_CUSTOM_CIPHER is set for the cipher, EVP_Cipher()
returns the number of bytes written to ‘out’.
2026-05-20 11:46:35 -05:00
f93aeb3f8f
krb5: Correctly check if RC4 enctype is valid
...
krb5_enctype_valid() returns zero on success.
2026-05-20 11:45:57 -05:00
dafc36e26c
krb5: Promote AES SHA2 enctypes to preferred
2026-05-20 11:45:57 -05:00
b7f4f62dfa
krb5: Fix non‐RC4 build
...
The function _krb5_usage2arcfour() is only declared if Heimdal is built with
RC4. Put calls to this function behind #ifdef guards so that the build can
succeed.
2026-05-20 11:43:53 -05:00
31c514e3b2
kdc: Adjust error code mapping
...
Commit cbe156d927
2026-05-20 11:43:18 -05:00
356b2111ba
dbutils: fix order of libraries for static build
2026-05-20 11:42:14 -05:00
93bbac45f9
Install heim_threads.h
2026-05-19 12:02:18 -05:00
e4a885074b
krb5: make KRB5_TRACE default to tracing not just debugging
2026-05-19 12:01:42 -05:00
ffb01963fc
lib:roken: allow large fragmented UDP replies from glibc resolver
...
glibc resolver returns same answer length as buffer size when
buffer is too small for the answer.
Signed-off-by: Ivan Korytov <toreonify@altlinux.org >
2026-05-19 11:52:18 -05:00
8dba1f4810
add a bit more logging in gss mechglue
2026-05-19 11:14:39 -05:00
e11f8a8823
Eliminate \n from _gss_mg_log() calls
2026-05-19 11:14:39 -05:00
abd35b246a
kdc: support pkinit_kdc_revoke for pkinit anchors
...
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz >
2026-02-11 16:14:53 +13:00
bddc275275
ktutil: Collect entries then add/delete when renaming principals ( fix #1319 )
2026-02-08 01:35:58 -06:00
609e36de13
krb5: Only lock keytabs to write to them ( fix #1319 )
2026-02-08 01:30:28 -06:00
8ec31e4926
GHA: Shorten the OS X test timeout
2026-02-08 00:36:43 -06:00
0a9f1c3f11
GHA: Get diagnostics data from hanging check-context test (OS X)
2026-02-07 23:56:02 -06:00
4fe0ad8e2c
GHA: Get diagnostics data from hanging check-context test
2026-02-07 22:45:45 -06:00
c999e5a33a
GHA: Set a timeout on tests
2026-02-07 18:40:19 -06:00
ce85c64b84
iprop: Make ipropd-master not lock the log ( fix #1308 )
2026-02-07 17:59:03 -06:00
c76a096a28
roken: Add pread() for Windows
2026-02-07 17:59:03 -06:00
8a22366b55
roken: Don't define flock() ops if HAVE_FLOCK ( fix #1313 )
2026-02-07 17:46:19 -06:00
Ihar Hrachyshka