Permit an explicit version of signtool.exe to be specified via an
environment variable. Now that sha256 signatures are required the version
of signtool.exe that matches the SDK or Visual Studio version might not
be sufficient to apply code signatures.
Change-Id: I694e2b319bd692d6358ae7ce3d241da2da7648f8
Move roken.h to the top of the header after config.h and remove the
includes that are duplicated by roken.h.
Change-Id: I33e29736519177f17c36e5c5948d7022011ab2b2
All source files must start with
include <config.h>
include <roken.h>
when krb5_locl.h or kdc_locl.h are includes, they must come before
other Heimdal include files.
Do not include stdint.h when roken.h is included.
Do not include config.h more than once.
Change-Id: I0baecb5d48317996f48b1a6c41b051f42f2fde61
In verify() if krb5_unparse_name() fails 'sname' will be used
unitialized in the subsequent krb5_warnx() and free() calls.
Change-Id: I5a49bf06879eb5a77cf2d1d3f0d4b9c6549aeff8
Coverity complains about the leakage of 'handle' when the identifier
goes out of scope. Change handle into a static global to hold the
value instead of a stack variable.
Change-Id: I040707ac731558f7d523f128a006a80b98d45b79
The Windows and PKCS#11 backends do this. The Common Crypto (OS X)
backend does not. Ideally this should be a ./configure option, and that
might be the next step, but right now we need this fallback in order to
get tests passing in Travis-CI.
The resolver plugin doesn't have a way to say "and stop here", so the
lookup done in lib/krb5/test_plugin.c can produce more results than used
to be expected, and indeed nowadays it does. The fix is to ensure that
we have the desired results and ignore the others.
This adds a new backend for libhcrypto: the OpenSSL backend.
Now libhcrypto has these backends:
- hcrypto itself (i.e., the algorithms coded in lib/hcrypto)
- Common Crypto (OS X)
- PKCS#11 (specifically for Solaris, but not Solaris-specific)
- Windows CNG (Windows)
- OpenSSL (generic)
The ./configure --with-openssl=... option no longer disables the use of
hcrypto. Instead it enables the use of OpenSSL as a (and the default)
backend in libhcrypto. The libhcrypto framework is now always used.
OpenSSL should no longer be used directly within Heimdal, except in the
OpenSSL hcrypto backend itself, and files where elliptic curve (EC)
crypto is needed.
Because libhcrypto's EC support is incomplete, we can only use OpenSSL
for EC. Currently that means separating all EC-using code so that it
does not use hcrypto, thus the libhx509/hxtool and PKINIT EC code has
been moved out of the files it used to be in.
Also, zero return means "success", non-zero means "failure" and the
non-zero value is a system error. That's how it is for the other
platforms' thread primitives.
(The no-threads defaults are still wrong though, as then are macros that
expand into do..while, which can't be used as expressions and don't
"return" values.)
The error string
missing @ or \ in name
must have the backslash double quoted as
missing @ or \\\\ in name
because of how compile_et parses the input and generates its output.
Otherwise, when compiling the generated ntlm_err.c a warning will
be produced because of invalid quoting of a space.
Change-Id: I994d3eb896098914702e418a0ef5cad783d16a5a
In srv_find_realm() the conditional for testing whether an entry
is the invalid gTLD response was inverted. Refactor the conditional
into a helper function is_invalid_tld_srv_target(). Use the helper
to simplify the conditional making it easier to confirm that the
test is correct.
Change-Id: I3220753b5585ac535862c4617030377c7a1f4bbe
The function _krb5_put_int() is a private function exported from
lib/krb5. Its declaration should come from krb5-private.h. A local
declaration will not result in the proper import qualifiers on
Windows.
See also: e1a244f Make it possible to include krb5_locl.h in kadm5
Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
krb5_locl.h cannot be included from within lib/kadm5 in the
current UNIX builds. Reverting this change which is necessary
to properly build on Windows until an alternate solution is
agreed upon.
This reverts commit ffc525aad1.
The hdb_method functions cannot be KRB5_LIB_CALL as lib/hdb is not
lib/krb5. KRB5_LIB_CALL will be inconsistently defined.
This inconsistency resulted in crashes of test_hdbplugin on 32-bit
Windows.
Change-Id: I4cf8d3ef76f31a3cae923df234a19610d956e7ee
The function _krb5_put_int() is a private function exported from
lib/krb5. Its declaration should come from krb5-private.h. A local
declaration will not result in the proper import qualifiers on
Windows.
Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
If there is no MSLSA: credential cache principal, then try to
fallback to the MIT default MIT credential cache name, API:krb5cc.
Change-Id: I8f981c5401b4f962cf808e7b0dc782e42bc03023
If there is no default credential cache obtained from the registry
or from configuration files, then check to see if there is a valid
principal available from the MSLSA: credential cache. If so, use
"MSLSA:" as the default credential cache. This will simply configuration
for users on domain joined Windows machines when logged in using a
domain account.
Change-Id: I4c4392e0fdcec89aff3d258ce1b753e6458e3eec
Remove unnecessary levels of indentation.
Switch the conditional from "(e == NULL)" to "(p == NULL)" since it
the variable 'p' that is actually used to store the name of the
default credential cache.
Change-Id: Id884e2cd80b42e47d3c219ac3777161087467a14
Windows queries the default ccache name via the registry. Prior
to this change only the HKEY_CURRENT_USER hive. Fallback to
HKEY_LOCAL_MACHINE if there is no "ccname" value specified for the
user. This permits system or domain administrators to set the
default ccache to MSLSA: for all users.
Change-Id: Ide3b51358f8fc6944ca698e4a68295be9463d4e0
