a735b65b70
gssapi: avoid putenv use-after-free in store_cred
...
Fixes #1163
2026-06-06 23:38:21 +01:00
1f0f31c954
roken: Don't define any global vars in the pidfile namespace.
...
Newer util.h from NetBSD defines pidfile_path() which conflicts
here.
2026-05-30 12:06:31 -05:00
421c40c73e
kadm5: make ipropd-master listen on IPv6
...
Fixes #1330 .
2026-05-27 14:11:04 -05:00
de7aa57362
treewide: fix many null dereference reports
...
Add defensive handling for several NULL allocation and formatting paths reported across issues #820-#829.
Fixes #820 , fixes #821 , fixes #822 , fixes #823 , fixes #825 , fixes #828
2026-05-27 13:47:41 -05:00
9a9da70626
krb5: clean up get_cred_kdc on send context failure
...
Fixes #1207
2026-05-27 12:12:03 -05:00
98d6fcacb4
krb5: fix ap_req_nofail documentation
...
Fixes #1371
2026-05-27 11:56:23 -05:00
4f147f5e1b
doc: trim krb5_verify_user xrefs
...
Fixes #1127
2026-05-27 16:01:16 +01:00
ef3860d6c3
doc: clean up krb5_init_context man page
...
Fixes #1125
2026-05-27 15:42:57 +01:00
20d4e914e3
gss: Fix NULL minor_status arguments
2026-05-27 14:30:27 +01:00
cdd22b6061
refactor(changepw): replace select() with poll()
...
Issue #1338
2026-05-27 14:16:23 +01:00
73acb1df8e
refactor(send_to_kdc): replace select() with poll()
...
Issue #1338
2026-05-27 14:16:23 +01:00
abec12ef7f
ipropd-slave: get a TGT before authenticating
...
Do not request an iprop/<master> initial ticket directly. With
name_canon_rules = as-is: this can leave the acquired credential
mismatched with what krb5_sendauth() later asks for. Get a normal TGT
and let sendauth acquire the service ticket.
Fixes #1332 .
2026-05-26 17:20:15 -05:00
a66cb84e70
In krb5.conf make underscores and dashes equivalent
2026-05-25 20:14:36 -05:00
e89417f2a1
tests: cover MEMORY ccache cursor invalidation for #547
2026-05-25 20:09:20 -05:00
a105e8e117
tests: cover MEMORY gss_store_cred storage for #132
2026-05-25 20:01:05 -05:00
e836e36d06
Remove duplicated libedit, find/use installed version
2026-05-25 20:00:24 -05:00
19325d4252
lib/gssapi/test_context.c: fix typo
2026-05-25 19:59:28 -05:00
3ff4191ba9
krb5: fail krb5_verify_user() early if service key missing
...
Fixes #1157 .
2026-05-25 19:42:40 -05:00
d47f526f55
ipc: serialize mig generated files
2026-05-25 17:32:05 -05:00
6efb8b405e
roken: provide poll fallback
2026-05-25 17:31:26 -05:00
c65cd331e4
gsskrb5: Correctly check EVP_Cipher() return value for RC4
...
If the flag EVP_CIPH_FLAG_CUSTOM_CIPHER is set for the cipher, EVP_Cipher()
returns the number of bytes written to ‘out’.
2026-05-20 11:46:35 -05:00
f93aeb3f8f
krb5: Correctly check if RC4 enctype is valid
...
krb5_enctype_valid() returns zero on success.
2026-05-20 11:45:57 -05:00
dafc36e26c
krb5: Promote AES SHA2 enctypes to preferred
2026-05-20 11:45:57 -05:00
b7f4f62dfa
krb5: Fix non‐RC4 build
...
The function _krb5_usage2arcfour() is only declared if Heimdal is built with
RC4. Put calls to this function behind #ifdef guards so that the build can
succeed.
2026-05-20 11:43:53 -05:00
e4a885074b
krb5: make KRB5_TRACE default to tracing not just debugging
2026-05-19 12:01:42 -05:00
ffb01963fc
lib:roken: allow large fragmented UDP replies from glibc resolver
...
glibc resolver returns same answer length as buffer size when
buffer is too small for the answer.
Signed-off-by: Ivan Korytov <toreonify@altlinux.org >
2026-05-19 11:52:18 -05:00
8dba1f4810
add a bit more logging in gss mechglue
2026-05-19 11:14:39 -05:00
e11f8a8823
Eliminate \n from _gss_mg_log() calls
2026-05-19 11:14:39 -05:00
609e36de13
krb5: Only lock keytabs to write to them ( fix #1319 )
2026-02-08 01:30:28 -06:00
ce85c64b84
iprop: Make ipropd-master not lock the log ( fix #1308 )
2026-02-07 17:59:03 -06:00
c76a096a28
roken: Add pread() for Windows
2026-02-07 17:59:03 -06:00
8a22366b55
roken: Don't define flock() ops if HAVE_FLOCK ( fix #1313 )
2026-02-07 17:46:19 -06:00
1a7e3c4a5c
kadm5: Fix client-side double-free ( fix #1315 )
2026-02-07 17:46:19 -06:00
26dca502be
kpasswdd: Allow password changes through NATs ( fix #1286 again)
2026-01-23 00:37:44 -06:00
cc272a4838
krb5: Try up to all kpasswdd IPs ( fix #1304 )
2026-01-22 23:38:42 -06:00
dedeea1b6a
sqlite: Fix warnings ( fix #1306 )
2026-01-22 23:32:14 -06:00
961370d49f
krb5: Add support for "Directional" host address type
...
Currently the Directional host address type is pretty useless,
since it's only useful in application protocols that a) use
KRB-PRIV/KRB-SAFE messages (so: not GSS-API applications), and b)
state in their specs to use Directional, or otherwise provide for
negotiation of host address types. There are no such protocols
that we care about except -since we control it- iprop. But even
for iprop it'd be better to switch to GSS-API.
2026-01-22 22:26:10 -06:00
c83b1a12aa
roken: Use OFD locks, flock, or POSIX locking, same as MIT
2026-01-22 18:06:28 -06:00
7772534587
krb5: Add missing hunk for #1204 ( fix #1305 )
2026-01-22 17:39:19 -06:00
f47b578ce2
krb5: Add MEMORY threaded test (and fix bugs)
2026-01-22 14:05:26 -06:00
d9e98b2773
asn1: Remove non-existent symbols (fix Windows build)
2026-01-22 13:34:13 -06:00
81b293d66b
asn1: Don't export template DATAs (fix Windows build)
2026-01-22 13:09:11 -06:00
96a5c0b82a
hdb: Make maximum ticket lifetime and renew time signed integers
...
This allows for negative lifetimes to be encoded, and fits in better
with our use elsewhere of time_t, which in POSIX is a signed integer
type.
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz >
2026-01-22 11:39:05 -06:00
55287b56bc
sqlite: Fix Windows build
2026-01-22 11:38:51 -06:00
bab1bca910
sqlite: Don't rename types / macros
2026-01-22 11:31:34 -06:00
8961f81de7
sqlite: Add gen-sqlite3-namespace.sh script for upgrades
2026-01-22 11:23:57 -06:00
a1220ce6d2
sqlite: Rename symbols ( fix #1142 )
2026-01-22 00:02:05 -06:00
41591932b8
krb5: Nonces in krb5.asn1 should be unsigned
2026-01-22 00:02:05 -06:00
fdf107353e
hdb: Get LDAP backend building again
2026-01-22 00:02:05 -06:00
82f7b8072c
Nix bashisms.
...
This isn't fully POSIX shell, because POSIX shell still doesn't have
`local' variable declarations, but at least it is reasonably portable
now.
fix https://github.com/heimdal/heimdal/issues/1299
2026-01-21 12:40:26 -06:00
Roland C. Dowdeswell