OpenSSL_add_all_algorithms() should only be run once per application
or it will cause data structures to expand. It's not a classic
memory leak as all of the memory will be free(3)d when EVP_cleanup()
is called but as we are a library we cannot call this. We provide
a short term fix here which is using heim_base_once_f() to ensure
that we only call it once.
But the long term fix should be to stop using OpenSSL_add_all_algorithms()
entirely because it both has side effects outside our library and
the caller may destroy our OpenSSL global variables by calling
EVP_cleanup() on his own. It is suboptimal to have potential
interactions between our library and other code in this way.
Currently the Heimdal code calls connect(2) on TCP connexions to
the KDC without setting O_NONBLOCK. This code implements a
timed_connect() function which will in the case of SOCK_STREAM
sockets put the socket into non-blocking mode prior to calling
connect and use select(2) to apply the configured timeout to connect
completion. This does not entirely solve the problem of potential
timeouts in the code as it is still possible to block while writing
to the socket. A proper implementation would also likely start
new connexions after a short interval before timing out existing
connexions and return the results from the first KDC which successfully
responds but we did not do that yet.
This patch is from heimdal-1-5-branch patches:
5b55e4429caed27b32aac4bc5930f2672a43f273
6b66321b271ee4672e70ad349ec796dd755cf897
2e12c7f3e8dca7e1696ebd92199617ce413565e7
Squashed together along with a quick shadowed variable warning fix
to allow it to compile with --enable-developer.
krb5_enomem() is a wrapper around krb5_set_error_message() which
is used throughout the lib/krb5 sources. Some of the lib/krb5
sources are imported into third party projects and those projects
must be able to pull in krb5_enomem() without other baggage.
Create a new source file lib/krb5/enomem.c.
Change-Id: Id109386d48e3e2988b705b82525adf4f1fa5ea98
Windows applications become very unhappy when memory is allocated
in one module (exe or dll) and deallocated in another. This is
because each of the C run time library instances uses its own
heap. Mixing allocating in one heap and deallocating in another
will lead to memory leaks and heap corruption. For modules that
build against roken avoid this problem by sharing roken's allocator
with the module that uses it.
Change-Id: I31e35c600a78350b168a281811160696dc327544
This reverts commit cb6f7ea40e.
stdint.h can be included everywhere now that the Windows
platform generates and installs a stdint.h when Visual
Studio does not provide one.
Change-Id: Ia3cab28d7f5806203cd45227765debda54ac7472
The lib/krb5 export lists contained the following functions
that are no longer in the tree:
krb5_425_conv_principal
krb5_425_conv_principal_ext2
krb5_425_conv_principal_ext
krb5_524_conv_principal
_krb5_krb_tf_setup
_krb5_krb_dest_tkt
_krb5_krb_life_to_time
_krb5_krb_decomp_ticket
_krb5_krb_create_ticket
_krb5_krb_create_ciph
_krb5_krb_create_auth_reply
_krb5_krb_rd_req
_krb5_krb_free_auth_data
_krb5_krb_time_to_life
_krb5_krb_cr_err_reply
Change-Id: I1f73768de2f7e9243e4e7a623b54af282ec54641
synchronize the export lists on Windows and UNIX.
When new functions are exported on UNIX or Windows,
the "test" build target on Windows will verify if
the export lists are in sync.
Change-Id: I9df3607983b03ee8dc6fa7cd22f85b07a6cee784
heim_abort and heim_assert are not exported from heimdal.dll.
must link against heimbase to use them.
Change-Id: I57a29b90360f9036723c114f03a95684a4802529
cc-1028 cc: ERROR File = ../source4/heimdal/lib/asn1/gen_template.c, Line = 548
The expression used must have a constant value.
struct templatehead template = { 0L, &(template). tqh_first };
^
If this really fixes the IRIX build, we'll propose this for heimdal upstream.
metze
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
EAFNOSUPPORT is defined by VS2010 errno.h. Use the VS2010
value instead of WSAEAFNOSUPPORT if EAFNOSUPPORT is not defined.
Change-Id: Ie641fd8f212ea1be11811dbb2e0def9fdbac795f
Looks like they defined basename() in string.h and ntohs/htonl are
implemented in terms of __bswap16() which is a macro with tmp
variables and so one cannot embed one call to ntohs/htons in another.
Not good but we workaround this limitation in glibc.
This wasn't having the intended effect because after we #include
config.h and #undef ENABLE_PTHREAD_SUPPORT we then #include other
headers that also #include config.h. I've moved this lower so that
it has the effect that appears to be intended but the correct answer
may be to make it work but this will require #including pthread.h
as the build fails with -Werror when pthread functions are called.
We should not hold locks on the master's database while waiting
for network I/O which may take a terribly long time to complete as
this will block out all writers and could therefore be slightly
problematic. ipropd-master was holding a shared lock on the database
while sending a complete propation to slaves which are out of sync
with the log file. We fix this by writing what we intend to send
in record format into a file hdb_db_dir()/ipropd.dumpfile while
holding a shared lock on the database and then we send the contents
of the file after releasing the lock. We also save and re-use the file
that we generated during future complete propagation events as long
as the log is long enough to get us back to the state previously
dumped.
We can't use O_TRUNC on open because (without O_EXLOCK which is
not portable) we would be modifying the file without an exclusive
lock. So, we drop the use of O_TRUNC and use ftruncate(2) after
obtaining the lock via flock(2).
On NetBSD /bin/sh with vfork() is noticeably faster than /bin/bash,
and in particular the reader manages to read the the database before
slave replication completes.
We add a function to cause krb5_storage's to be sync'd to their backing
store. For memory backed storages, this is a NOP. For files, it calls
fsync on the file descriptor.
