Use calloc instead of malloc when allocating data structures while
importing a dump in hprop. Fixes a crash in hprop when reading MIT
dump files due unintialized memory in the Salt data structure, plus
will be more robust against any future changes to the data model.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
If a Berkeley DB database is used as the underlying database, renaming
the database before closing it can produce error messages like the
following on close:
/var/lib/heimdal-kdc/heimdal~.db: unable to flush: No such file or directory
since the underlying database library caches the old file name. There
is a rename() method in the Berkeley DB API, but it also invalidates
the database handle and requires that it be reopened. Since the
hdb_rename implementation does not require that the database be open,
close the database before renaming it to avoid this problem.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
Dump formats 5 and 6 differ from the supported version 4 dump format
only in that they include policy information for each principal in an
extension that the dump parsing code already knows how to ignore and
that they include policy lines. Ignore the policy information, since
there isn't a corresponding concept in Heimdal, and accept the new
dump format versions.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
If the MIT dump file includes a last password change date, allocate
a database extension structure to hold that information and include
it in the corresponding Heimdal database entry.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
hprop may be decrypting an old database encrypted with a DES master
key, in which case it shouldn't fail because DES is disabled by default.
This could permit weak enctypes to be used when authenticating to a
remote hpropd, although stronger enctypes are still preferred.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
* h-github/master: (64 commits)
refix socket wrappers with rk_
Patch from Secure Endpoints/Asanka Herath for windows support
unset KRB5CCNAME
its really just LIBADD more most of them
correct quoting
Use -lpthread for modern freebsd instead
clean KRB5CCNAME and KRB5_CONFIG, require test to reset them
more up ${env_setup}
use PTHREADS_LIBADD for freebsd6 and newer
add PTHREAD_LIBADD
add PTHREAD_LIBADD
add PTHREAD_LIBADD
switch to PTHREADS_LIBADD
log what the error string say too
More debug logging
sprinkle more 'echo "test failed"'
sprinkle 'echo "test failed"'
use calloc(), indent more prettier
in sh, equal compare is really = for strings, not ==
Check for duplicates, already loaded mechs
...
Conflicts (resolved):
lib/krb5/auth_context.c
lib/krb5/changepw.c
lib/krb5/context.c
lib/krb5/error_string.c
lib/krb5/kuserok.c
lib/krb5/libkrb5-exports.def.in
lib/krb5/net_write.c
lib/krb5/store_fd.c
lib/krb5/test_cc.c
lib/roken/strerror_r.c
Pick the replykey to be the same as the preauth key, this allows
us to delay the picking of client key to when its needed, this
means that we can have a reply keys for PKINIT that is independant
of what keys the client have.
