oysteikt/heimdal
0
0
Fork 0
Code Issues 4 Pull Requests Releases Activity

Compare commits

merge into: oysteikt/heimdal:sdnotify-nix-testing
Branches Tags
oysteikt/heimdal:master oysteikt/heimdal:sdnotify-nix-testing oysteikt/heimdal:systemd-support oysteikt/heimdal:kadmin-get-printf-debugging oysteikt/heimdal:sd-notify
oysteikt/heimdal:git2svn-syncpoint-master oysteikt/heimdal:switch-from-svn-to-git
..
pull from: oysteikt/heimdal:systemd-support
Branches Tags
oysteikt/heimdal:sdnotify-nix-testing oysteikt/heimdal:master oysteikt/heimdal:systemd-support oysteikt/heimdal:kadmin-get-printf-debugging oysteikt/heimdal:sd-notify
oysteikt/heimdal:git2svn-syncpoint-master oysteikt/heimdal:switch-from-svn-to-git

3 Commits
sdnotify-nix-testing .. systemd-support

Author SHA1 Message Date
oysteikt 3a17ecb3e5 WIP 2026-02-08 16:07:33 +09:00
oysteikt 19156b61f1 Set up nix tooling 2026-02-08 15:58:06 +09:00
oysteikt 63ad2a7931 zed: set tab width 2026-02-08 15:58:01 +09:00
196 changed files with 29065 additions and 5138 deletions
Expand all files Collapse all files
.github/workflows/coverage.yml
-1
View File
@@ -3,7 +3,6 @@ name: Test Coverage
on:
push:
branches:
- 'master'
- 'coverage-*'
jobs:
.github/workflows/coverity.yml
+2 -1
View File
@@ -49,7 +49,8 @@ jobs:
cd build
../configure --srcdir=`dirname "$PWD"` --enable-maintainer-mode --enable-developer --with-ldap $CONFIGURE_OPTS --prefix=$HOME/inst CFLAGS="-Wno-error=shadow -Wno-error=bad-function-cast -Wno-error=unused-function -Wno-error=unused-result -Wno-error=deprecated-declarations"
ulimit -c unlimited
# We don't want to scan-build SQLite3 because ETOOSLOW
# We don't want to scan-build libedit nor SQLite3 because ETOOSLOW
(cd lib/libedit && make -j4)
(cd lib/sqlite && make -j4)
cov-build --dir cov-int make -j4
tar czvf ../heimdal.tgz cov-int
.github/workflows/linux.yml
+1 -76
View File
@@ -5,7 +5,6 @@ on:
branches:
- 'master'
- 'heimdal-7-1-branch'
- 'test-ILP32'
paths:
- '!docs/**'
- '!**.md'
@@ -64,7 +63,6 @@ jobs:
os: ubuntu-22.04
compiler: gcc
cflags: '-Wnonnull'
configureopts: '--with-readline=yes'
steps:
- name: Clone repository
uses: actions/checkout@v4
@@ -75,7 +73,7 @@ jobs:
sudo apt-get install -y bison comerr-dev flex doxygen
sudo apt-get install -y libcap-ng-dev libdb-dev libedit-dev libjson-perl
sudo apt-get install -y libldap2-dev libncurses5-dev libperl4-corelibs-perl
sudo apt-get install -y libsqlite3-dev libkeyutils-dev libreadline-dev pkg-config python3
sudo apt-get install -y libsqlite3-dev libkeyutils-dev pkg-config python3
sudo apt-get install -y ss-dev texinfo unzip netbase keyutils ldap-utils
sudo apt-get install -y gdb apport curl libmicrohttpd-dev jq valgrind
# Temporary workaround for:
@@ -85,7 +83,6 @@ jobs:
env:
CC: ${{ matrix.compiler }}
MAKEVARS: ${{ matrix.makevars }}
CONFIGURE_OPTS: ${{ matrix.configureopts }}
run: |
/bin/sh ./autogen.sh
mkdir build
@@ -172,75 +169,3 @@ jobs:
with:
name: Test Logs (${{ matrix.name }})
path: '~/logs-linux-${{ matrix.compiler }}.tgz'
linux-i386:
name: linux-i386 (${{ matrix.name }})
# Run if no [only X] tag, or if [only linux] is present (check both push commits and PR titles)
if: >-
(!contains(github.event.head_commit.message, '[only ') &&
!contains(github.event.pull_request.title, '[only ')) ||
contains(github.event.head_commit.message, '[only linux]') ||
contains(github.event.pull_request.title, '[only linux]')
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
include:
- name: time32
image: i386/debian:bookworm
year2038_configure: ""
time_t_size: 4
- name: year2038
image: i386/debian:trixie
year2038_configure: --enable-year2038
time_t_size: 8
steps:
- name: Clone repository
uses: actions/checkout@v4
- name: Build and test on Debian i386
run: |
docker run --security-opt seccomp=unconfined --platform linux/386 --rm \
-v "$PWD:/src:ro" \
-e YEAR2038_CONFIGURE="${{ matrix.year2038_configure }}" \
-e EXPECT_TIME_T_SIZE="${{ matrix.time_t_size }}" \
${{ matrix.image }} \
/bin/bash -euxc '
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y --no-install-recommends \
autoconf automake bison build-essential ca-certificates \
comerr-dev curl doxygen flex gdb git iproute2 jq keyutils \
ldap-utils libcap-ng-dev libdb-dev libedit-dev libjson-perl \
libkeyutils-dev libldap2-dev liblmdb-dev libmicrohttpd-dev libncurses5-dev \
libperl4-corelibs-perl libreadline-dev libsqlite3-dev libssl-dev \
libtool make netbase pkg-config procps python3 ss-dev tar \
texinfo unzip valgrind xz-utils
cp -a /src /tmp/heimdal-src
git config --global --add safe.directory /tmp/heimdal-src
cd /tmp/heimdal-src
/bin/sh ./autogen.sh
mkdir build
cd build
../configure --srcdir=`dirname "$PWD"` \
--enable-maintainer-mode \
--enable-developer \
${YEAR2038_CONFIGURE} \
--with-ldap \
--with-readline=yes \
--with-db-type-preference=lmdb \
--prefix=/tmp/heimdal-i386-inst \
CFLAGS="-Wnonnull -Wno-error=shadow -Wno-error=bad-function-cast -Wno-error=unused-function -Wno-error=unused-result -Wno-error=deprecated-declarations"
printf "%s\n" \
"#include \"include/config.h\"" \
"#include <stdio.h>" \
"#include <time.h>" \
"int main(void) { unsigned long s = sizeof(time_t); printf(\"sizeof(time_t)=%lu\n\", s); return s == EXPECT_TIME_T_SIZE ? 0 : 1; }" \
> check-time-t.c
cc -I. -I.. -DEXPECT_TIME_T_SIZE="$EXPECT_TIME_T_SIZE" -o check-time-t check-time-t.c
./check-time-t
make -j4
make -C lib/asn1 check
make -C lib/hx509 check TESTS=test_cert_binary
make DESTDIR=/tmp/heimdal-i386-root install
'
.github/workflows/osx.yml
-1
View File
@@ -62,7 +62,6 @@ jobs:
- name: osx-clang
os: macos-latest
compiler: clang
configureopts: '--with-libedit=yes'
steps:
- name: Install packages
run: |
.github/workflows/scanbuild.yml
+2 -1
View File
@@ -44,7 +44,8 @@ jobs:
cd build
../configure --srcdir=`dirname "$PWD"` --enable-maintainer-mode --enable-developer --with-ldap $CONFIGURE_OPTS --prefix=$HOME/inst CFLAGS="-Wno-error=shadow -Wno-error=bad-function-cast -Wno-error=unused-function -Wno-error=unused-result -Wno-error=deprecated-declarations"
ulimit -c unlimited
# We don't want to scan-build SQLite3 because ETOOSLOW
# We don't want to scan-build libedit nor SQLite3 because ETOOSLOW
(cd lib/libedit && make -j4)
(cd lib/sqlite && make -j4)
scan-build --keep-going make -j4
- name: Test
.gitignore
+26 -3
View File
@@ -64,6 +64,32 @@ asn1_*_asn1.c
/tmp.h
/ylwrap
/lib/libedit/aclocal.m4
/lib/libedit/autom4te.cache
/lib/libedit/compile
/lib/libedit/config.guess
/lib/libedit/config.h
/lib/libedit/config.log
/lib/libedit/config.status
/lib/libedit/config.sub
/lib/libedit/configure
/lib/libedit/depcomp
/lib/libedit/install-sh
/lib/libedit/libtool
/lib/libedit/ltmain.sh
/lib/libedit/missing
/lib/libedit/setupbuild.cmd
/lib/libedit/ylwrap
/lib/libedit/src/common.h
/lib/libedit/src/emacs.h
/lib/libedit/src/fcns.c
/lib/libedit/src/fcns.h
/lib/libedit/src/func.h
/lib/libedit/src/help.c
/lib/libedit/src/help.h
/lib/libedit/src/vi.h
/lib/libedit/stamp-h1
# Files in subdirectories.
/admin/ktutil
@@ -694,6 +720,3 @@ asn1_*_asn1.c
/tools/krb5-gssapi.pc
/tools/krb5.pc
/tools/krb5-config
result
result-*
.zed/settings.json
+8
View File
@@ -0,0 +1,8 @@
// Folder-specific settings
//
// For a full list of overridable settings, and general information on folder-specific settings,
// see the documentation: https://zed.dev/docs/configuring-zed#settings-files
{
"tab_size": 8,
"hard_tabs": false
}
NEWS
-1
View File
@@ -7,7 +7,6 @@ Release Notes - Heimdal - Version Heimdal 8.0 (future)
- Errors found by the LLVM scan-build static analyzer.
- Errors found by the valgrind memory debugger.
- Fix out-of-tree SQLite3 ccache permissions / umask issues.
- Clamp far-future ASN.1 times on 32-bit time_t platforms instead of wrapping.
- iprop bugs, race conditions, and performance
- Many misc. bugs
README.md
-2
View File
@@ -1,7 +1,6 @@
[![GitHub Build Workflow](https://github.com/heimdal/heimdal/actions/workflows/linux.yml/badge.svg)](https://github.com/heimdal/heimdal/actions?query=workflow%3Alinux)
[![GitHub Build Workflow](https://github.com/heimdal/heimdal/actions/workflows/osx.yml/badge.svg)](https://github.com/heimdal/heimdal/actions?query=workflow%3Aosx)
[![GitHub Build Workflow](https://github.com/heimdal/heimdal/actions/workflows/windows.yml/badge.svg)](https://github.com/heimdal/heimdal/actions?query=workflow%3Awindows)
[![Coverage Status](https://coveralls.io/repos/github/heimdal/heimdal/badge.svg?branch=master)](https://coveralls.io/github/heimdal/heimdal?branch=master)
Heimdal
=======
@@ -34,4 +33,3 @@ Build Status
[![GitHub Build Workflow](https://github.com/heimdal/heimdal/actions/workflows/linux.yml/badge.svg)](https://github.com/heimdal/heimdal/actions?query=workflow%3Alinux)
[![GitHub Build Workflow](https://github.com/heimdal/heimdal/actions/workflows/osx.yml/badge.svg)](https://github.com/heimdal/heimdal/actions?query=workflow%3Aosx)
[![GitHub Build Workflow](https://github.com/heimdal/heimdal/actions/workflows/windows.yml/badge.svg)](https://github.com/heimdal/heimdal/actions?query=workflow%3Awindows)
[![Coverage Status](https://coveralls.io/repos/github/heimdal/heimdal/badge.svg?branch=master)](https://coveralls.io/github/heimdal/heimdal?branch=master)
admin/rename.c
+27 -50
View File
@@ -43,9 +43,6 @@ kt_rename(struct rename_options *opt, int argc, char **argv)
krb5_keytab keytab;
krb5_kt_cursor cursor;
krb5_principal from_princ, to_princ;
krb5_keytab_entry *entries = NULL;
size_t num_entries = 0;
size_t i;
ret = krb5_parse_name(context, argv[0], &from_princ);
if(ret != 0) {
@@ -66,14 +63,6 @@ kt_rename(struct rename_options *opt, int argc, char **argv)
return 1;
}
/*
* Collect matching entries first, then close the cursor before
* adding/removing. We must not call krb5_kt_add_entry() or
* krb5_kt_remove_entry() while holding the seq_get cursor because
* the cursor holds a shared file lock and the add/remove operations
* need an exclusive lock -- with per-fd locking (BSD flock, OFD locks)
* this self-deadlocks.
*/
ret = krb5_kt_start_seq_get(context, keytab, &cursor);
if(ret) {
krb5_kt_close(context, keytab);
@@ -81,52 +70,40 @@ kt_rename(struct rename_options *opt, int argc, char **argv)
krb5_free_principal(context, to_princ);
return 1;
}
while((ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0) {
if(krb5_principal_compare(context, entry.principal, from_princ)) {
krb5_keytab_entry *tmp;
tmp = realloc(entries, (num_entries + 1) * sizeof(*entries));
if (tmp == NULL) {
krb5_kt_free_entry(context, &entry);
ret = krb5_enomem(context);
break;
}
entries = tmp;
krb5_free_principal(context, entry.principal);
entry.principal = NULL;
entries[num_entries++] = entry;
} else {
krb5_kt_free_entry(context, &entry);
}
}
if(ret == KRB5_CC_END || ret == KRB5_KT_END)
ret = 0;
else if(ret)
krb5_warn(context, ret, "getting entry from keytab");
krb5_kt_end_seq_get(context, keytab, &cursor);
for (i = 0; ret == 0 && i < num_entries; i++) {
entries[i].principal = to_princ;
ret = krb5_kt_add_entry(context, keytab, &entries[i]);
if(ret) {
krb5_warn(context, ret, "adding entry");
while(1) {
ret = krb5_kt_next_entry(context, keytab, &entry, &cursor);
if(ret != 0) {
if(ret != KRB5_CC_END && ret != KRB5_KT_END)
krb5_warn(context, ret, "getting entry from keytab");
else
ret = 0;
break;
}
if (opt->delete_flag) {
entries[i].principal = from_princ;
ret = krb5_kt_remove_entry(context, keytab, &entries[i]);
if(krb5_principal_compare(context, entry.principal, from_princ)) {
krb5_free_principal(context, entry.principal);
entry.principal = to_princ;
ret = krb5_kt_add_entry(context, keytab, &entry);
if(ret) {
krb5_warn(context, ret, "removing entry");
entry.principal = NULL;
krb5_kt_free_entry(context, &entry);
krb5_warn(context, ret, "adding entry");
break;
}
if (opt->delete_flag) {
entry.principal = from_princ;
ret = krb5_kt_remove_entry(context, keytab, &entry);
if(ret) {
entry.principal = NULL;
krb5_kt_free_entry(context, &entry);
krb5_warn(context, ret, "removing entry");
break;
}
}
entry.principal = NULL;
}
krb5_kt_free_entry(context, &entry);
}
for (i = 0; i < num_entries; i++) {
entries[i].principal = NULL;
krb5_kt_free_entry(context, &entries[i]);
}
free(entries);
krb5_kt_end_seq_get(context, keytab, &cursor);
krb5_free_principal(context, from_princ);
krb5_free_principal(context, to_princ);
appl/dbutils/Makefile.am
+1 -1
View File
@@ -10,4 +10,4 @@ man_MANS = bsearch.1
EXTRA_DIST = NTMakefile $(man_MANS)
LDADD = $(LIB_vers) $(LIB_heimbase) $(LIB_roken)
LDADD = $(LIB_roken) $(LIB_vers) $(LIB_heimbase)
cf/db.m4
-3
View File
@@ -57,9 +57,6 @@ AS_IF([test "x$with_berkeley_db" != xno],
db.h \
])])
dnl detect if compat db_185.h is present
AC_CHECK_HEADERS([db_185.h])
dnl db_create is used by db3 and db4 and db5 and db6
AC_FIND_FUNC_NO_LIBS(db_create, [$dbheader] db-6 db-5 db4 db3 db, [
cf/krb-readline.m4
+11 -71
View File
@@ -9,80 +9,20 @@ AC_DEFUN([KRB_READLINE],[
dnl readline
readline_requested="${with_readline-unset}"
libedit_requested="${with_libedit-unset}"
have_readline=no
rk_TEST_PACKAGE(readline,
[#include <stdio.h>
#if defined(HAVE_READLINE_READLINE_H)
#include <readline/readline.h>
#elif defined(HAVE_READLINE_H)
#include <readline.h>
#endif
],-lreadline,[$LIB_tgetent],,[READLINE],, [readline.h readline/readline.h])
rk_TEST_PACKAGE(libedit,
[#include <stdio.h>
#if defined(HAVE_EDITLINE_READLINE_H)
#include <editline/readline.h>
#elif defined(HAVE_READLINE_READLINE_H)
#include <readline/readline.h>
#elif defined(HAVE_READLINE_H)
#include <readline.h>
#endif
],-ledit,[$LIB_tgetent],,[READLINE],,
[readline.h readline/readline.h editline/readline.h])
ac_foo=no
build_editline=no
if test "$with_readline" = yes; then
have_readline=yes
:
elif test "$with_libedit" = yes; then
INCLUDE_readline="${INCLUDE_libedit}"
LIB_readline="${LIB_libedit}"
have_readline=yes
elif test "$readline_requested" != no; then
rk_readline_header=no
AC_CHECK_HEADERS([readline/readline.h readline.h],
[rk_readline_header=yes])
if test "$rk_readline_header" = yes; then
AC_CHECK_LIB(readline, readline, [
LIB_readline="-lreadline"
if test "x$LIB_tgetent" != x; then
LIB_readline="$LIB_readline $LIB_tgetent"
fi
have_readline=yes
with_readline=yes
], [], [$LIB_tgetent])
fi
fi
if test "$have_readline" != yes && test "$libedit_requested" != no; then
rk_libedit_header=no
AC_CHECK_HEADERS([editline/readline.h readline/readline.h readline.h],
[rk_libedit_header=yes])
if test "$rk_libedit_header" = yes; then
AC_CHECK_LIB(edit, readline, [
LIB_readline="-ledit"
if test "x$LIB_tgetent" != x; then
LIB_readline="$LIB_readline $LIB_tgetent"
fi
have_readline=yes
with_libedit=yes
], [], [$LIB_tgetent])
fi
fi
if test "$have_readline" = yes; then
AC_DEFINE(HAVE_READLINE, 1,
[Define if you have a readline compatible library.])dnl
AC_DEFINE(READLINE, 1, [Define if you have the readline package.])dnl
LIB_readline="${LIB_libedit}"
elif test "$ac_cv_func_readline" = yes; then
:
else
INCLUDE_readline=
LIB_readline=
AC_MSG_NOTICE([readline/libedit not found; command line editing disabled])
build_libedit=yes
LIB_readline="\$(top_builddir)/lib/libedit/src/libheimedit.la \$(LIB_tgetent)"
fi
AC_SUBST(INCLUDE_readline)
AC_SUBST(LIB_readline)
AM_CONDITIONAL(LIBEDIT, test "$build_libedit" = yes)
AC_DEFINE(HAVE_READLINE, 1,
[Define if you have a readline compatible library.])dnl
])
cf/largefile.m4
-6
View File
@@ -19,10 +19,4 @@ if test "$enable_largefile" != no; then
[CPPFLAGS="$CPPFLAGS $ac_cv_sys_largefile_opts"])
fi
fi
if test "$enable_year2038" != no; then
if test -n "$ac_cv_sys_year2038_opts"; then
AS_CASE([$ac_cv_sys_year2038_opts],[-D_TIME_BITS=*|-D__MINGW_USE_VC2005_COMPAT],
[CPPFLAGS="$CPPFLAGS $ac_cv_sys_year2038_opts"])
fi
fi
])
cf/roken-frag.m4
+1 -1
View File
@@ -192,6 +192,7 @@ AC_CHECK_FUNCS([ \
mkdtemp \
mkostemp \
on_exit \
poll \
random \
secure_getenv \
setprogname \
@@ -359,7 +360,6 @@ AC_BROKEN([ \
mergesort \
mergesort_r \
mkstemp \
poll \
pread \
putenv \
rcmd \
cf/test-package.m4
+4 -4
View File
@@ -24,8 +24,8 @@ AC_ARG_WITH($1-config,
AS_HELP_STRING([--with-$1-config=path],[config program for $1]))
m4_ifval([$6],
[m4_define([rk_pkgname], [$6])],
[m4_define([rk_pkgname], [AS_TR_CPP($1)])])
m4_define([rk_pkgname], $6),
m4_define([rk_pkgname], AS_TR_CPP($1)))
AC_MSG_CHECKING(for $1)
@@ -91,7 +91,7 @@ if test "$with_$1" != no; then
if test "$[]$1_cflags" -a "$[]$1_libs"; then
CFLAGS="$[]$1_cflags $save_CFLAGS"
LIBS="$[]$1_libs $save_LIBS"
m4_ifval([$8],[AC_CHECK_HEADERS([$8])])
m4_ifval([$8],[AC_CHECK_HEADERS([[$8]])])
AC_LINK_IFELSE([AC_LANG_PROGRAM([[$2]],[[]])],[
INCLUDE_$1="$[]$1_cflags"
LIB_$1="$[]$1_libs"
@@ -102,7 +102,7 @@ if test "$with_$1" != no; then
ires= lres=
for i in $header_dirs; do
CFLAGS="-I$i $save_CFLAGS"
m4_ifval([$8],[AC_CHECK_HEADERS([$8])])
m4_ifval([$8],[AC_CHECK_HEADERS([[$8]])])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[$2]],[[]])],[ires=$i;break])
done
for i in $lib_dirs; do
configure.ac
+37 -16
View File
@@ -196,22 +196,6 @@ AM_CONDITIONAL([HAVE_CAPNG], [test "$with_capng" != "no"])
AC_SUBST([CAPNG_CFLAGS])
AC_SUBST([CAPNG_LIBS])
dnl libsystemd
AC_ARG_WITH([systemd],
AC_HELP_STRING([--with-systemd], [use libsystemd for sd_notify service notifications @<:@default=check@:>@]),
[],
[with_systemd=check])
if test "$with_systemd" != "no"; then
PKG_CHECK_MODULES([SYSTEMD], [libsystemd],
[with_systemd=yes],[with_systemd=no])
fi
if test "$with_systemd" = "yes"; then
AC_DEFINE_UNQUOTED([HAVE_SYSTEMD], 1, [whether libsystemd is available for sd_notify])
fi
AM_CONDITIONAL([HAVE_SYSTEMD], [test "$with_systemd" != "no"])
AC_SUBST([SYSTEMD_CFLAGS])
AC_SUBST([SYSTEMD_LIBS])
dnl mitdb
AC_ARG_WITH([mitdb],
AC_HELP_STRING([--with-mitdb], [Path to MIT Kerberos DB include header and shared object]),
@@ -246,6 +230,21 @@ AM_CONDITIONAL([HAVE_MICROHTTPD], [test "$with_microhttpd" != "no"])
AC_SUBST([MICROHTTPD_CFLAGS])
AC_SUBST([MICROHTTPD_LIBS])
dnl systemd sd_notify support
AC_ARG_WITH([systemd],
AC_HELP_STRING([--with-systemd], [use systemd sd_notify for readiness @<:@default=check@:>@]),
[],
[with_systemd=check])
if test "$with_systemd" != "no"; then
PKG_CHECK_MODULES([SYSTEMD], [libsystemd], [with_systemd=yes],[with_systemd=no])
fi
if test "$with_systemd" = "yes"; then
AC_DEFINE_UNQUOTED([HAVE_SYSTEMD], 1, [Define if libsystemd sd_notify is available])
fi
AM_CONDITIONAL([HAVE_SYSTEMD], [test "$with_systemd" != "no"])
AC_SUBST([SYSTEMD_CFLAGS])
AC_SUBST([SYSTEMD_LIBS])
dnl mitkrb5
AC_ARG_WITH([mitkrb5],
AC_HELP_STRING([--with-mitkrb5=PATH], [Path to MIT Kerberos for interop testing]),
@@ -398,6 +397,28 @@ AC_SUBST(ENABLE_AFS_STRING_TO_KEY)dnl
rk_CHECK_MAN
rk_TEST_PACKAGE(readline,
[#include <stdio.h>
#if defined(HAVE_READLINE_READLINE_H)
#include <readline/readline.h>
#elif defined(HAVE_READLINE_H)
#include <readline.h>
#endif
],-lreadline,,, READLINE,, [readline.h readline/readline.h])
rk_TEST_PACKAGE(libedit,
[#include <stdio.h>
#if defined(HAVE_READLINE_READLINE_H)
#include <readline/readline.h>
#elif defined(HAVE_READLINE_H)
#include <readline.h>
#elif defined(HAVE_EDITLINE_READLINE_H)
#include <editline/readline.h>
#endif
],-ledit,,, READLINE,, [readline.h readline/readline.h editline/readline.h])
AC_CONFIG_SUBDIRS([lib/libedit])
KRB_C_BIGENDIAN
AC_C_INLINE
doc/ack.texi
+3
View File
@@ -13,6 +13,9 @@ The @code{popper} was also a Berkeley program initially.
Some of the functions in @file{libroken} also come from Berkeley by way
of NetBSD/FreeBSD.
@code{editline} was written by Simmule Turner and Rich Salz. Heimdal
contains a modifed copy.
The @code{getifaddrs} implementation for Linux was written by Hideaki
YOSHIFUJI for the Usagi project.
doc/copyright.texi
+42
View File
@@ -123,6 +123,48 @@ SUCH DAMAGE.
@end verbatim
@copynext
@heading The Regents of the University of California.
libedit
@verbatim
SPDX-License-Identifier: BSD-3-Clause
Copyright (c) 1992, 1993
The Regents of the University of California. All rights reserved.
This code is derived from software contributed to Berkeley by
Christos Zoulas of Cornell University.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. Neither the name of the University nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
@end verbatim
@copynext
@copynext
@heading Doug Rabson
GSS-API mechglue layer.
flake.lock
Generated
+3 -3
View File
@@ -2,11 +2,11 @@
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1770380644,
"narHash": "sha256-P7dWMHRUWG5m4G+06jDyThXO7kwSk46C1kgjEWcybkE=",
"lastModified": 1769740369,
"narHash": "sha256-xKPyJoMoXfXpDM5DFDZDsi9PHArf2k5BJjvReYXoFpM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "ae67888ff7ef9dff69b3cf0cc0fbfbcd3a722abe",
"rev": "6308c3b21396534d8aaeac46179c14c439a89b8a",
"type": "github"
},
"original": {
flake.nix
+4 -17
View File
@@ -22,26 +22,13 @@
default = pkgs.callPackage ./nix/shell.nix { };
});
packages = forAllSystems (system: pkgs: let
src = lib.fileset.toSource {
root = ./.;
fileset = lib.fileset.difference ./. (lib.fileset.unions [
./.github
./.gitignore
./flake.nix
./flake.lock
./nix
]);
};
in {
packages = forAllSystems (system: pkgs: with pkgs; {
default = self.packages.${system}.heimdal;
src = pkgs.runCommand "heimdal-src" {} "ln -s ${src} \"$out\"";
heimdal = pkgs.callPackage ./nix/heimdal/package.nix {
inherit src;
heimdal = pkgs.callPackage ./nix/heimdal {
src = lib.cleanSource ./.;
inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
autoreconfHook = pkgs.buildPackages.autoreconfHook271;
autoreconfHook = pkgs.buildPackages.autoreconfHook269;
};
nixosTest = pkgs.testers.runNixOSTest (import ./nix/nixosTest.nix { inherit nixpkgs; });
include/Makefile.am
+2 -3
View File
@@ -9,11 +9,9 @@ CHECK_LOCAL = no-check-local
AM_CPPFLAGS += -DHOST=\"$(CANONICAL_HOST)\"
include_HEADERS = heim_threads.h
nodist_include_HEADERS = krb5-types.h
noinst_HEADERS = heimqueue.h crypto-headers.h
noinst_HEADERS = heimqueue.h heim_threads.h crypto-headers.h
EXTRA_DIST = NTMakefile krb5-types.cross config.h.w32
@@ -50,6 +48,7 @@ CLEANFILES = \
der.h \
digest_asn1.h \
digest_template_asn1.h \
editline.h \
err.h \
getarg.h \
glob.h \
kadmin/Makefile.am
+2 -5
View File
@@ -54,7 +54,7 @@ kadmind_SOURCES = \
add_random_users_SOURCES = add-random-users.c
test_util_SOURCES = test_util.c util.c random_password.c
test_util_SOURCES = test_util.c util.c
TESTS = test_util
@@ -72,10 +72,7 @@ kadmind_LDADD = $(top_builddir)/lib/kadm5/libkadm5srv.la \
../lib/gssapi/libgssapi.la \
$(LDADD_common) \
$(LIB_pidfile) \
$(LIB_dlopen) \
$(SYSTEMD_LIBS)
kadmind_CFLAGS = $(SYSTEMD_CFLAGS)
$(LIB_dlopen)
kadmin_LDADD = \
$(top_builddir)/lib/kadm5/libkadm5clnt.la \
kadmin/kadm_conn.c
+12 -66
View File
@@ -37,8 +37,6 @@
#endif
#ifdef HAVE_SYSTEMD
#include <systemd/sd-daemon.h>
/* how often (seconds) to refresh the sd_notify STATUS line while idle */
#define STATUS_INTERVAL 30
#endif
extern int daemon_child;
@@ -208,52 +206,22 @@ wait_for_connection(krb5_context contextp,
signal(SIGINT, terminate);
signal(SIGCHLD, sigchld);
{
struct timeval *tmoutp = NULL;
#ifdef HAVE_SYSTEMD
unsigned long nconns = 0;
struct timeval tmout;
tmoutp = &tmout;
sd_notify(0, "READY=1");
sd_notifyf(0, "STATUS=Serving; %lu connection(s) accepted", nconns);
#endif
while (term_flag == 0) {
read_set = orig_read_set;
#ifdef HAVE_SYSTEMD
tmout.tv_sec = STATUS_INTERVAL;
tmout.tv_usec = 0;
#endif
e = select(max_fd + 1, &read_set, NULL, NULL, tmoutp);
e = select(max_fd + 1, &read_set, NULL, NULL, NULL);
if(rk_IS_SOCKET_ERROR(e)) {
if(rk_SOCK_ERRNO != EINTR)
krb5_warn(contextp, rk_SOCK_ERRNO, "select");
} else if(e == 0) {
#ifdef HAVE_SYSTEMD
/* select timed out: refresh our systemd status line */
sd_notifyf(0, "STATUS=Serving; %lu connection(s) accepted", nconns);
#else
} else if(e == 0)
krb5_warnx(contextp, "select returned 0");
#endif
} else {
else {
for(i = 0; i < num_socks; i++) {
if(FD_ISSET(socks[i], &read_set)) {
if(FD_ISSET(socks[i], &read_set))
if(spawn_child(contextp, socks, num_socks, i) == 0)
return;
#ifdef HAVE_SYSTEMD
nconns++;
#endif
}
}
}
}
}
#ifdef HAVE_SYSTEMD
sd_notify(0, "STOPPING=1");
#endif
signal(SIGCHLD, SIG_IGN);
while ((waitpid(-1, &status, WNOHANG)) > 0)
@@ -273,37 +241,12 @@ start_server(krb5_context contextp, const char *port_str)
unsigned int num_socks = 0;
int i;
#ifdef HAVE_SYSTEMD
{
char **names = NULL;
int sd_n, j;
if (port_str == NULL)
port_str = "+";
sd_n = sd_listen_fds_with_names(0, &names);
if (sd_n < 0)
krb5_err(contextp, 1, -sd_n, "sd_listen_fds_with_names");
if (sd_n > 0) {
socks = malloc(sd_n * sizeof(*socks));
if (socks == NULL)
krb5_err(contextp, 1, errno, "malloc");
for (j = 0; j < sd_n; j++) {
if (names != NULL && names[j] != NULL &&
strncmp(names[j], "kadmind", 7) == 0)
socks[num_socks++] = SD_LISTEN_FDS_START + j;
}
}
for (j = 0; names != NULL && names[j] != NULL; j++)
free(names[j]);
free(names);
}
#endif /* HAVE_SYSTEMD */
parse_ports(contextp, port_str);
if (num_socks == 0) {
if (port_str == NULL)
port_str = "+";
parse_ports(contextp, port_str);
for(p = kadm_ports; p; p = p->next) {
for(p = kadm_ports; p; p = p->next) {
struct addrinfo hints, *ai, *ap;
char portstr[32];
memset (&hints, 0, sizeof(hints));
@@ -359,12 +302,15 @@ start_server(krb5_context contextp, const char *port_str)
socks[num_socks++] = s;
}
freeaddrinfo (ai);
}
}
if(num_socks == 0)
krb5_errx(contextp, 1, "no sockets to listen to - exiting");
roken_detach_finish(NULL, daemon_child);
#ifdef HAVE_SYSTEMD
if (getenv("NOTIFY_SOCKET") != NULL)
sd_notify(0, "READY=1");
#endif
wait_for_connection(contextp, socks, num_socks);
free(socks);
kadmin/random_password.c
+120 -19
View File
@@ -32,30 +32,131 @@
*/
#include "kadmin_locl.h"
#include <base64.h>
#define RANDOM_PASSWORD_BYTES 12
/* This file defines some a function that generates a random password,
that can be used when creating a large amount of principals (such
as for a batch of students). Since this is a political matter, you
should think about how secure generated passwords has to be.
Both methods defined here will give you at least 55 bits of
entropy.
*/
/* If you want OTP-style passwords, define OTP_STYLE */
#ifdef OTP_STYLE
#include <otp.h>
#else
static void generate_password(char **pw, int num_classes, ...);
#endif
void
random_password(char *pw, size_t len)
{
unsigned char random[RANDOM_PASSWORD_BYTES];
char *password = NULL;
size_t password_len;
#ifdef OTP_STYLE
{
OtpKey newkey;
if (len == 0)
return;
krb5_generate_random_block(random, sizeof(random));
if (rk_base64url_encode(random, sizeof(random), &password) < 0 ||
password == NULL) {
memset_s(random, sizeof(random), 0, sizeof(random));
krb5_abortx(NULL, "Failed to encode random password");
krb5_generate_random_block(&newkey, sizeof(newkey));
otp_print_stddict (newkey, pw, len);
strlwr(pw);
}
password_len = strlen(password);
strlcpy(pw, password, len);
memset_s(random, sizeof(random), 0, sizeof(random));
memset_s(password, password_len, 0, password_len);
free(password);
#else
char *pass;
generate_password(&pass, 3,
"abcdefghijklmnopqrstuvwxyz", 7,
"ABCDEFGHIJKLMNOPQRSTUVWXYZ", 2,
"@$%&*()-+=:,/<>1234567890", 1);
strlcpy(pw, pass, len);
len = strlen(pass);
memset_s(pass, len, 0, len);
free(pass);
#endif
}
/* some helper functions */
#ifndef OTP_STYLE
/* return a random value in range 0-127 */
static int
RND(unsigned char *key, int keylen, int *left)
{
if(*left == 0){
krb5_generate_random_block(key, keylen);
*left = keylen;
}
(*left)--;
return ((unsigned char*)key)[*left];
}
/* This a helper function that generates a random password with a
number of characters from a set of character classes.
If there are n classes, and the size of each class is Pi, and the
number of characters from each class is Ni, the number of possible
passwords are (given that the character classes are disjoint):
n n
----- / ---- \
| | Ni | \ |
| | Pi | \ Ni| !
| | ---- * | / |
| | Ni! | /___ |
i=1 \ i=1 /
Since it uses the RND function above, neither the size of each
class, nor the total length of the generated password should be
larger than 127 (without fixing RND).
*/
static void
generate_password(char **pw, int num_classes, ...)
{
struct {
const char *str;
int len;
int freq;
} *classes;
va_list ap;
int len, i;
unsigned char rbuf[8]; /* random buffer */
int rleft = 0;
*pw = NULL;
classes = malloc(num_classes * sizeof(*classes));
if(classes == NULL)
return;
va_start(ap, num_classes);
len = 0;
for(i = 0; i < num_classes; i++){
classes[i].str = va_arg(ap, const char*);
classes[i].len = strlen(classes[i].str);
classes[i].freq = va_arg(ap, int);
len += classes[i].freq;
}
va_end(ap);
*pw = malloc(len + 1);
if(*pw == NULL) {
free(classes);
return;
}
for(i = 0; i < len; i++) {
int j;
int x = RND(rbuf, sizeof(rbuf), &rleft) % (len - i);
int t = 0;
for(j = 0; j < num_classes; j++) {
if(x < t + classes[j].freq) {
(*pw)[i] = classes[j].str[RND(rbuf, sizeof(rbuf), &rleft)
% classes[j].len];
classes[j].freq--;
break;
}
t += classes[j].freq;
}
}
(*pw)[len] = '\0';
memset_s(rbuf, sizeof(rbuf), 0, sizeof(rbuf));
free(classes);
}
#endif
kadmin/test_util.c
+1 -44
View File
@@ -68,49 +68,6 @@ test_time(void)
return errors;
}
static int
test_random_password(void)
{
static const char alphabet[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
char pw[128];
char small[5];
char zero[1] = { 'x' };
size_t i, j;
int errors = 0;
for (i = 0; i < 128; i++) {
random_password(pw, sizeof(pw));
if (strlen(pw) != 16) {
printf("wrong random password length: %lu\n",
(unsigned long)strlen(pw));
errors++;
}
for (j = 0; pw[j] != '\0'; j++) {
if (strchr(alphabet, pw[j]) == NULL) {
printf("random password contains invalid byte: 0x%02x\n",
(unsigned char)pw[j]);
errors++;
}
}
}
random_password(small, sizeof(small));
if (strlen(small) != sizeof(small) - 1) {
printf("wrong short random password length: %lu\n",
(unsigned long)strlen(small));
errors++;
}
random_password(zero, 0);
if (zero[0] != 'x') {
printf("zero-length random password buffer was modified\n");
errors++;
}
return errors;
}
int
main(int argc, char **argv)
@@ -125,9 +82,9 @@ main(int argc, char **argv)
ret = 0;
ret += test_time();
ret += test_random_password();
krb5_free_context(context);
return ret;
}
kdc/Makefile.am
+4 -4
View File
@@ -4,7 +4,7 @@ include $(top_srcdir)/Makefile.am.common
WFLAGS += $(WFLAGS_ENUM_CONV)
AM_CPPFLAGS += $(INCLUDE_libintl) $(INCLUDE_openssl_crypto) -I$(srcdir)/../lib/krb5
AM_CPPFLAGS += $(INCLUDE_libintl) $(INCLUDE_openssl_crypto) -I$(srcdir)/../lib/krb5 $(SYSTEMD_CFLAGS)
lib_LTLIBRARIES = ipc_csr_authorizer.la \
libkdc.la
@@ -174,7 +174,7 @@ hpropd_LDADD = \
$(LIB_kdb) \
$(top_builddir)/lib/asn1/libasn1.la \
$(LIB_roken) \
$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB) $(SYSTEMD_LIBS)
if PKINIT
LIB_pkinit = $(top_builddir)/lib/hx509/libhx509.la
@@ -198,12 +198,12 @@ LDADD = $(top_builddir)/lib/hdb/libhdb.la \
$(LIB_roken) \
$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
kdc_LDADD = libkdc.la $(LDADD) $(LIB_pidfile) $(CAPNG_LIBS) $(SYSTEMD_LIBS)
kdc_LDADD = libkdc.la $(LDADD) $(LIB_pidfile) $(CAPNG_LIBS)
if FRAMEWORK_SECURITY
kdc_LDFLAGS = -framework SystemConfiguration -framework CoreFoundation
endif
kdc_CFLAGS = $(CAPNG_CFLAGS) $(SYSTEMD_CFLAGS)
kdc_CFLAGS = $(CAPNG_CFLAGS)
kdc_replay_LDADD = libkdc.la $(LDADD) $(LIB_pidfile)
kdc_tester_LDADD = libkdc.la $(LDADD) $(LIB_pidfile) $(LIB_heimbase)
kdc/connect.c
+5 -87
View File
@@ -32,7 +32,6 @@
*/
#include "kdc_locl.h"
#ifdef HAVE_SYSTEMD
#include <systemd/sd-daemon.h>
#endif
@@ -299,69 +298,6 @@ init_socket(krb5_context context,
socket_set_keepalive(d->s, 1);
}
#ifdef HAVE_SYSTEMD
/*
* Allocate descriptors for the sockets handed to us via systemd socket
* activation whose FileDescriptorName is "kdc", and return then number of
* them (0 if we were not socket-activated).
*/
static int
init_sockets_sd(krb5_context context,
krb5_kdc_configuration *config,
struct descr **desc)
{
char **names = NULL;
struct descr *d;
int n, i, num = 0;
n = sd_listen_fds_with_names(0, &names);
if (n < 0)
krb5_err(context, 1, -n, "sd_listen_fds_with_names");
if (n == 0)
return 0;
d = malloc(n * sizeof(*d));
if (d == NULL)
krb5_errx(context, 1, "malloc(%lu) failed",
(unsigned long)n * sizeof(*d));
for (i = 0; i < n; i++) {
int fd = SD_LISTEN_FDS_START + i;
int type;
socklen_t tlen = sizeof(type);
if (names == NULL || names[i] == NULL ||
strncmp(names[i], "kdc", 3) != 0)
continue;
if (getsockopt(fd, SOL_SOCKET, SO_TYPE, &type, &tlen) < 0) {
krb5_warn(context, errno,
"getsockopt(SO_TYPE) on socket-activated fd %d", fd);
continue;
}
init_descr(&d[num]);
d[num].s = fd;
d[num].type = type;
socket_set_nonblocking(fd, 1);
kdc_log(context, config, 3, "listening on socket-activated fd %d (%s)",
fd, (type == SOCK_STREAM) ? "tcp" : "udp");
num++;
}
for (i = 0; names != NULL && names[i] != NULL; i++)
free(names[i]);
free(names);
if (num == 0) {
free(d);
return 0;
}
reinit_descrs(d, num);
*desc = d;
return num;
}
#endif /* HAVE_SYSTEMD */
/*
* Allocate descriptors for all the sockets that we should listen on
* and return the number of them.
@@ -1258,12 +1194,7 @@ start_kdc(krb5_context context,
socket_set_nonblocking(islive[1], 1);
#endif
ndescr = 0;
#ifdef HAVE_SYSTEMD
ndescr = init_sockets_sd(context, config, &d);
#endif
if (ndescr <= 0)
ndescr = init_sockets(context, config, &d);
ndescr = init_sockets(context, config, &d);
if(ndescr <= 0)
krb5_errx(context, 1, "No sockets!");
@@ -1280,10 +1211,11 @@ start_kdc(krb5_context context,
#endif
roken_detach_finish(NULL, daemon_child);
#ifdef HAVE_SYSTEMD
sd_notify(0, "READY=1");
sd_notify(0, "STATUS=Serving requests");
/* If built with systemd support and running under systemd, notify readiness.
We check NOTIFY_SOCKET to avoid unnecessary calls when not under systemd. */
if (getenv("NOTIFY_SOCKET") != NULL)
sd_notify(0, "READY=1");
#endif
#ifdef HAVE_FORK
@@ -1327,20 +1259,12 @@ start_kdc(krb5_context context,
kdc_log(context, config, 3, "KDC worker process started: %d",
pid);
num_kdcs++;
#ifdef HAVE_SYSTEMD
sd_notifyf(0, "STATUS=Serving requests; %d of %d KDC worker "
"process(es) running", num_kdcs, max_kdcs);
#endif
/* Slow down the creation of KDCs... */
select_sleep(12500);
break;
}
}
#ifdef HAVE_SYSTEMD
sd_notify(0, "STOPPING=1");
#endif
/* Closing these sockets should cause the kids to die... */
close(islive[0]);
@@ -1392,17 +1316,11 @@ start_kdc(krb5_context context,
kdc_log(context, config, 3, "KDC master process exiting");
} else {
loop(context, config, &d, &ndescr, -1);
#ifdef HAVE_SYSTEMD
sd_notify(0, "STOPPING=1");
#endif
kdc_log(context, config, 3, "KDC exiting");
}
free(pids);
#else
loop(context, config, &d, &ndescr, -1);
#ifdef HAVE_SYSTEMD
sd_notify(0, "STOPPING=1");
#endif
kdc_log(context, config, 3, "KDC exiting");
#endif
kdc/fast.c
+4 -6
View File
@@ -460,7 +460,6 @@ fast_unwrap_request(astgs_request_t r,
char *armor_client_principal_name = NULL;
char *armor_server_principal_name = NULL;
PA_FX_FAST_REQUEST fxreq;
krb5_auth_context free_ac = NULL;
krb5_auth_context ac = NULL;
krb5_ticket *ticket = NULL;
krb5_flags ap_req_options;
@@ -582,7 +581,7 @@ fast_unwrap_request(astgs_request_t r,
goto out;
}
ret = krb5_verify_ap_req2(r->context, &free_ac,
ret = krb5_verify_ap_req2(r->context, &ac,
&ap_req,
armor_server_principal,
&r->armor_key->key,
@@ -594,8 +593,6 @@ fast_unwrap_request(astgs_request_t r,
if (ret)
goto out;
ac = free_ac;
ret = krb5_unparse_name(r->context, armor_server_principal,
&armor_server_principal_name);
if (ret)
@@ -624,6 +621,7 @@ fast_unwrap_request(astgs_request_t r,
"<out of memory>");
if (ac->remote_subkey == NULL) {
krb5_auth_con_free(r->context, ac);
kdc_log(r->context, r->config, 2,
"FAST AP-REQ remote subkey missing");
ret = KRB5KDC_ERR_PREAUTH_FAILED;
@@ -749,8 +747,8 @@ fast_unwrap_request(astgs_request_t r,
kdc_log(r->context, r->config, 5, "Client selected FAST");
out:
if (free_ac)
krb5_auth_con_free(r->context, free_ac);
if (ac && ac != tgs_ac)
krb5_auth_con_free(r->context, ac);
krb5_free_principal(r->context, armor_server_principal);
krb5_xfree(armor_client_principal_name);
kdc/hpropd.c
+8
View File
@@ -32,6 +32,9 @@
*/
#include "hprop.h"
#ifdef HAVE_SYSTEMD
#include <systemd/sd-daemon.h>
#endif
static int inetd_flag = -1;
static int help_flag;
@@ -156,6 +159,11 @@ main(int argc, char **argv)
mini_inetd (krb5_getportbyname (context, "hprop", "tcp",
HPROP_PORT), &sock);
}
#ifdef HAVE_SYSTEMD
/* Notify systemd that the service is ready when running standalone */
if (getenv("NOTIFY_SOCKET") != NULL)
sd_notify(0, "READY=1");
#endif
socket_set_keepalive(sock, 1);
sin_len = sizeof(ss);
if (getpeername(sock, sa, &sin_len) < 0)
kdc/kdc-plugin.c
+1 -28
View File
@@ -51,7 +51,7 @@ static const char *kdc_plugin_deps[] = {
static struct heim_plugin_data kdc_plugin_data = {
"krb5",
"kdc",
KRB5_PLUGIN_KDC_VERSION_11,
KRB5_PLUGIN_KDC_VERSION_10,
kdc_plugin_deps,
kdc_get_instance
};
@@ -239,33 +239,6 @@ _kdc_referral_policy(astgs_request_t r)
return ret;
}
static krb5_error_code KRB5_LIB_CALL
hwauth_policy(krb5_context context, const void *plug, void *plugctx, void *userctx)
{
const krb5plugin_kdc_ftable *ft = plug;
if (ft->hwauth_policy == NULL) {
return KRB5_PLUGIN_NO_HANDLE;
}
return ft->hwauth_policy(rk_UNCONST(plug), userctx);
}
krb5_error_code
_kdc_hwauth_policy(astgs_request_t r)
{
krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
if (have_plugin) {
ret = _krb5_plugin_run_f(r->context, &kdc_plugin_data, 0, r, hwauth_policy);
}
if (ret != KRB5_PLUGIN_NO_HANDLE) {
return ret;
}
return r->client->flags.require_hwauth ? KRB5KDC_ERR_POLICY : 0;
}
static krb5_error_code KRB5_LIB_CALL
finalize_reply(krb5_context context, const void *plug, void *plugctx, void *userctx)
{
kdc/kdc-plugin.h
+1 -12
View File
@@ -95,16 +95,6 @@ typedef krb5_error_code
typedef krb5_error_code
(KRB5_CALLCONV *krb5plugin_kdc_referral_policy)(void *, astgs_request_t);
/*
* A hardware authentication policy plugin can indicate what is to
* happen when a client authenticates using a method other than
* hardware authentication. It can return zero to allow the
* authentication, or an appropriate error code to deny it.
*/
typedef krb5_error_code
(KRB5_CALLCONV *krb5plugin_kdc_hwauth_policy)(void *, astgs_request_t);
/*
* Update the AS or TGS reply immediately prior to encoding.
*/
@@ -127,7 +117,7 @@ typedef krb5_error_code
* Plugins should carefully check API contract notes for changes
* between plugin API versions.
*/
#define KRB5_PLUGIN_KDC_VERSION_11 11
#define KRB5_PLUGIN_KDC_VERSION_10 10
typedef struct krb5plugin_kdc_ftable {
HEIM_PLUGIN_FTABLE_COMMON_ELEMENTS(krb5_context);
@@ -135,7 +125,6 @@ typedef struct krb5plugin_kdc_ftable {
krb5plugin_kdc_pac_verify pac_verify;
krb5plugin_kdc_client_access client_access;
krb5plugin_kdc_referral_policy referral_policy;
krb5plugin_kdc_hwauth_policy hwauth_policy;
krb5plugin_kdc_finalize_reply finalize_reply;
krb5plugin_kdc_audit audit;
} krb5plugin_kdc_ftable;
kdc/kdc.8
+1 -1
View File
@@ -228,5 +228,5 @@ There should be a way to specify protocol, port, and address triplets,
not just addresses and protocol, port tuples.
.Sh SEE ALSO
.Xr kinit 1 ,
.Xr krb5.conf 5 ,
.Xr krb5.conf 5,
.Xr getservbyname 3
kdc/kerberos5.c
+13 -19
View File
@@ -37,15 +37,16 @@
#if SIZEOF_TIME_T == 4
#define MAX_TIME ((time_t)INT32_MAX)
#elif SIZEOF_TIME_T == 8
#define MAX_TIME ((time_t)INT64_MAX)
#define MAX_TIME ((time_t)INT32_MAX)
#else
#error "Unexpected sizeof(time_t)"
#endif
#else
#if SIZEOF_TIME_T == 4
#define MAX_TIME ((time_t)UINT32_MAX)
#define MAX_TIME ((time_t)INT32_MAX)
#else
#define MAX_TIME ((time_t)UINT64_MAX)
#define MAX_TIME ((time_t)INT32_MAX)
#endif
#endif
@@ -535,11 +536,7 @@ pa_pkinit_validate(astgs_request_t r, const PA_DATA *pa)
ret = _kdc_pk_rd_padata(r, pa, &pkp);
if (ret || pkp == NULL) {
if (ret == KRB5_KDC_ERR_REVOKED_CERTIFICATE) {
ret = KRB5_KDC_ERR_CLIENT_NOT_TRUSTED;
} else {
ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
}
ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
_kdc_r_log(r, 4, "Failed to decode PKINIT PA-DATA -- %s",
r->cname);
goto out;
@@ -938,9 +935,6 @@ pa_enc_ts_validate(astgs_request_t r, const PA_DATA *pa)
goto out;
}
free_EncryptedData(&enc_data);
if (ret) {
goto out;
}
ret = decode_PA_ENC_TS_ENC(ts_data.data,
ts_data.length,
&p,
@@ -952,7 +946,7 @@ pa_enc_ts_validate(astgs_request_t r, const PA_DATA *pa)
r->cname);
goto out;
}
if (krb5_time_abs(kdc_time, p.patimestamp) > r->context->max_skew) {
if (labs(kdc_time - p.patimestamp) > r->context->max_skew) {
char client_time[100];
krb5_format_time(r->context, p.patimestamp,
@@ -962,7 +956,7 @@ pa_enc_ts_validate(astgs_request_t r, const PA_DATA *pa)
_kdc_r_log(r, 4, "Too large time skew, "
"client time %s is out by %u > %u seconds -- %s",
client_time,
(unsigned)krb5_time_abs(kdc_time, p.patimestamp),
(unsigned)labs(kdc_time - p.patimestamp),
r->context->max_skew,
r->cname);
kdc_audit_setkv_number((kdc_request_t)r, KDC_REQUEST_KV_AUTH_EVENT,
@@ -2269,12 +2263,12 @@ _kdc_as_rep(astgs_request_t r)
ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
goto out;
}
if (!(pat[n].flags & PA_HARDWARE_AUTH)) {
ret = _kdc_hwauth_policy(r);
if (ret) {
kdc_log(r->context, config, 4, "Hardware authentication required for %s", r->cname);
goto out;
}
if (r->client->flags.require_hwauth &&
!(pat[n].flags & PA_HARDWARE_AUTH)) {
kdc_log(r->context, config, 4, "Hardware authentication required for %s", r->cname);
ret = KRB5KDC_ERR_POLICY;
goto out;
}
kdc_audit_addkv((kdc_request_t)r, KDC_AUDIT_VIS, "pa", "%s",
pat[n].name);
kdc/kx509.c
+19 -12
View File
@@ -399,6 +399,7 @@ mk_error_response(krb5_context context,
Kx509Response rep;
const char *msg;
char *freeme0 = NULL;
char *freeme1 = NULL;
va_list ap;
if (code != 0) {
@@ -416,6 +417,9 @@ mk_error_response(krb5_context context,
va_end(ap);
}
if (!reqctx->config->enable_kx509)
code = KRB5KDC_ERR_POLICY;
/* Make sure we only send RFC4120 and friends wire protocol error codes */
if (code) {
if (code == KX509_ERR_NONE) {
@@ -437,6 +441,12 @@ mk_error_response(krb5_context context,
msg = freeme0;
va_end(ap);
if (!reqctx->config->enable_kx509 &&
asprintf(&freeme1, "kx509 service is disabled (%s)", msg) > -1 &&
freeme1 != NULL) {
msg = freeme1;
}
rep.hash = NULL;
rep.certificate = NULL;
rep.error_code = code;
@@ -458,6 +468,7 @@ mk_error_response(krb5_context context,
free(rep.e_text);
free(rep.hash);
free(freeme0);
free(freeme1);
return ret;
}
@@ -889,15 +900,14 @@ _kdc_do_kx509(kx509_req_context r)
if (r->req.authenticator.length == 0) {
/*
* Unauthenticated kx509 service availability probe.
*
* mk_error_response() will check whether the service is enabled and
* possibly change the error code and message.
*/
is_probe = 1;
kdc_audit_addkv((kdc_request_t)r, 0, "probe", "unauthenticated");
if (!r->config->enable_kx509)
ret = mk_error_response(r->context, r, 4, KRB5KDC_ERR_POLICY,
"kx509 service is disabled");
else
ret = mk_error_response(r->context, r, 4, 0,
"kx509 service is available");
ret = mk_error_response(r->context, r, 4, 0,
"kx509 service is available");
goto out;
}
@@ -928,12 +938,6 @@ _kdc_do_kx509(kx509_req_context r)
* Provided we got the session key, errors past this point will be
* authenticated.
*/
if (ret == 0 && !r->config->enable_kx509) {
ret = mk_error_response(r->context, r, 4, KRB5KDC_ERR_POLICY,
"kx509 service is disabled");
goto out;
}
if (ret == 0)
ret = krb5_ticket_get_client(r->context, ticket, &cprincipal);
@@ -979,6 +983,9 @@ _kdc_do_kx509(kx509_req_context r)
if (r->req.pk_key.length == 0) {
/*
* The request is an authenticated kx509 service availability probe.
*
* mk_error_response() will check whether the service is enabled and
* possibly change the error code and message.
*/
is_probe = 1;
kdc_audit_addkv((kdc_request_t)r, 0, "probe", "authenticated");
kdc/pkinit.c
+2 -4
View File
@@ -432,7 +432,7 @@ pk_check_pkauthenticator_win2k(krb5_context context,
krb5_timeofday (context, &now);
/* XXX cusec */
if (a->ctime == 0 || krb5_time_abs(a->ctime, now) > context->max_skew) {
if (a->ctime == 0 || labs(a->ctime - now) > context->max_skew) {
krb5_clear_error_message(context);
return KRB5KRB_AP_ERR_SKEW;
}
@@ -451,7 +451,7 @@ pk_check_pkauthenticator(krb5_context context,
krb5_timeofday (context, &now);
/* XXX cusec */
if (a->ctime == 0 || krb5_time_abs(a->ctime, now) > context->max_skew) {
if (a->ctime == 0 || labs(a->ctime - now) > context->max_skew) {
krb5_clear_error_message(context);
return KRB5KRB_AP_ERR_SKEW;
}
@@ -797,8 +797,6 @@ _kdc_pk_rd_padata(astgs_request_t priv,
hx509_verify_attach_anchors(cp->verify_ctx, trust_anchors);
hx509_certs_free(&trust_anchors);
hx509_verify_attach_revoke(cp->verify_ctx, kdc_identity->revokectx);
if (config->pkinit_allow_proxy_certs)
hx509_verify_set_proxy_certificate(cp->verify_ctx, 1);
kpasswd/Makefile.am
+1 -4
View File
@@ -24,10 +24,7 @@ kpasswdd_LDADD = \
$(LDADD) \
$(LIB_pidfile) \
$(LIB_dlopen) \
$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB) \
$(SYSTEMD_LIBS)
kpasswdd_CFLAGS = $(SYSTEMD_CFLAGS)
$(DB3LIB) $(DB1LIB) $(LMDBLIB) $(NDBMLIB)
LDADD = $(top_builddir)/lib/krb5/libkrb5.la \
$(top_builddir)/lib/asn1/libasn1.la \
kpasswd/kpasswdd.c
+70 -152
View File
@@ -41,11 +41,6 @@ RCSID("$Id$");
#include <hdb.h>
#include <kadm5/private.h>
#include <kadm5/kadm5_err.h>
#ifdef HAVE_SYSTEMD
#include <systemd/sd-daemon.h>
/* how often (seconds) to refresh the sd_notify STATUS line while idle */
#define STATUS_INTERVAL 30
#endif
static krb5_context context;
static krb5_log_facility *log_facility;
@@ -706,167 +701,90 @@ doit(krb5_keytab keytab, int port)
fd_set real_fdset;
struct sockaddr_storage __ss;
struct sockaddr *sa = (struct sockaddr *)&__ss;
int sd_activated = 0;
#ifdef HAVE_SYSTEMD
{
char **names = NULL;
int sd_n, j;
sd_n = sd_listen_fds_with_names(0, &names);
if (sd_n < 0)
krb5_err(context, 1, -sd_n, "sd_listen_fds_with_names");
if (sd_n > 0) {
sd_activated = 1;
sockets = malloc(sd_n * sizeof(*sockets));
if (sockets == NULL)
krb5_errx(context, 1, "out of memory");
memset(&addrs, 0, sizeof(addrs));
addrs.val = malloc(sd_n * sizeof(*addrs.val));
if (addrs.val == NULL)
krb5_errx(context, 1, "out of memory");
n = 0;
maxfd = -1;
FD_ZERO(&real_fdset);
for (j = 0; j < sd_n; j++) {
int fd = SD_LISTEN_FDS_START + j;
krb5_socklen_t sa_size = sizeof(__ss);
if (names == NULL || names[j] == NULL ||
strncmp(names[j], "kpasswdd", 8) != 0)
continue;
if (getsockname(fd, sa, &sa_size) < 0) {
krb5_warn(context, errno,
"getsockname on socket-activated fd %d", fd);
continue;
}
if (krb5_sockaddr2address(context, sa, &addrs.val[n]) != 0)
continue;
sockets[n] = fd;
maxfd = max(maxfd, fd);
if (maxfd >= FD_SETSIZE)
krb5_errx(context, 1, "fd too large");
FD_SET(fd, &real_fdset);
n++;
}
addrs.len = n;
}
for (j = 0; names != NULL && names[j] != NULL; j++)
free(names[j]);
free(names);
if (explicit_addresses.len) {
addrs = explicit_addresses;
} else {
ret = krb5_get_all_server_addrs(context, &addrs);
if (ret)
krb5_err(context, 1, ret, "krb5_get_all_server_addrs");
}
#endif /* HAVE_SYSTEMD */
n = addrs.len;
if (!sd_activated) {
if (explicit_addresses.len) {
addrs = explicit_addresses;
} else {
ret = krb5_get_all_server_addrs(context, &addrs);
sockets = malloc(n * sizeof(*sockets));
if (sockets == NULL)
krb5_errx(context, 1, "out of memory");
maxfd = -1;
FD_ZERO(&real_fdset);
for (i = 0; i < n; ++i) {
krb5_socklen_t sa_size = sizeof(__ss);
krb5_addr2sockaddr(context, &addrs.val[i], sa, &sa_size, port);
sockets[i] = socket(__ss.ss_family, SOCK_DGRAM, 0);
if (sockets[i] < 0)
krb5_err(context, 1, errno, "socket");
if (bind(sockets[i], sa, sa_size) < 0) {
char str[128];
size_t len;
int save_errno = errno;
ret = krb5_print_address(&addrs.val[i], str, sizeof(str), &len);
if (ret)
krb5_err(context, 1, ret, "krb5_get_all_server_addrs");
}
n = addrs.len;
sockets = malloc(n * sizeof(*sockets));
if (sockets == NULL)
krb5_errx(context, 1, "out of memory");
maxfd = -1;
FD_ZERO(&real_fdset);
for (i = 0; i < n; ++i) {
krb5_socklen_t sa_size = sizeof(__ss);
krb5_addr2sockaddr(context, &addrs.val[i], sa, &sa_size, port);
sockets[i] = socket(__ss.ss_family, SOCK_DGRAM, 0);
if (sockets[i] < 0)
krb5_err(context, 1, errno, "socket");
if (bind(sockets[i], sa, sa_size) < 0) {
char str[128];
size_t len;
int save_errno = errno;
ret = krb5_print_address(&addrs.val[i], str, sizeof(str), &len);
if (ret)
strlcpy(str, "unknown address", sizeof(str));
krb5_warn(context, save_errno, "bind(%s)", str);
continue;
}
maxfd = max(maxfd, sockets[i]);
if (maxfd >= FD_SETSIZE)
krb5_errx(context, 1, "fd too large");
FD_SET(sockets[i], &real_fdset);
strlcpy(str, "unknown address", sizeof(str));
krb5_warn(context, save_errno, "bind(%s)", str);
continue;
}
maxfd = max(maxfd, sockets[i]);
if (maxfd >= FD_SETSIZE)
krb5_errx(context, 1, "fd too large");
FD_SET(sockets[i], &real_fdset);
}
if (maxfd == -1)
krb5_errx(context, 1, "No sockets!");
roken_detach_finish(NULL, daemon_child);
{
struct timeval *tmoutp = NULL;
#ifdef HAVE_SYSTEMD
unsigned long nrequests = 0;
struct timeval tmout;
tmoutp = &tmout;
sd_notify(0, "READY=1");
sd_notifyf(0, "STATUS=Serving; %lu password change request(s) processed",
nrequests);
#endif
while (exit_flag == 0) {
krb5_ssize_t retx;
fd_set fdset = real_fdset;
#ifdef HAVE_SYSTEMD
tmout.tv_sec = STATUS_INTERVAL;
tmout.tv_usec = 0;
#endif
retx = select(maxfd + 1, &fdset, NULL, NULL, tmoutp);
if (retx < 0) {
if (errno == EINTR)
continue;
else
krb5_err(context, 1, errno, "select");
}
#ifdef HAVE_SYSTEMD
if (retx == 0) {
/* select timed out: refresh our systemd status line */
sd_notifyf(0, "STATUS=Serving; %lu password change request(s) "
"processed", nrequests);
continue;
}
#endif
for (i = 0; i < n; ++i)
if (FD_ISSET(sockets[i], &fdset)) {
u_char buf[BUFSIZ];
socklen_t addrlen = sizeof(__ss);
retx = recvfrom(sockets[i], buf, sizeof(buf), 0,
sa, &addrlen);
if (retx < 0) {
if (errno == EINTR)
break;
else
krb5_err(context, 1, errno, "recvfrom");
}
process(keytab, sockets[i],
&addrs.val[i],
sa, addrlen,
buf, retx);
#ifdef HAVE_SYSTEMD
nrequests++;
#endif
}
}
/* If built with systemd support and running under systemd, notify readiness.
We check NOTIFY_SOCKET to avoid unnecessary calls when not under systemd. */
if (getenv("NOTIFY_SOCKET") != NULL) {
extern int sd_notify(int, const char *);
(void) sd_notify(0, "READY=1");
}
#ifdef HAVE_SYSTEMD
sd_notify(0, "STOPPING=1");
#endif
while (exit_flag == 0) {
krb5_ssize_t retx;
fd_set fdset = real_fdset;
retx = select(maxfd + 1, &fdset, NULL, NULL, NULL);
if (retx < 0) {
if (errno == EINTR)
continue;
else
krb5_err(context, 1, errno, "select");
}
for (i = 0; i < n; ++i)
if (FD_ISSET(sockets[i], &fdset)) {
u_char buf[BUFSIZ];
socklen_t addrlen = sizeof(__ss);
retx = recvfrom(sockets[i], buf, sizeof(buf), 0,
sa, &addrlen);
if (retx < 0) {
if (errno == EINTR)
break;
else
krb5_err(context, 1, errno, "recvfrom");
}
process(keytab, sockets[i],
&addrs.val[i],
sa, addrlen,
buf, retx);
}
}
for (i = 0; i < n; ++i)
close(sockets[i]);
free(sockets);
kuser/kinit.c
+2 -4
View File
@@ -1104,8 +1104,7 @@ get_new_tickets(krb5_context context,
}
if (ticket_life != 0) {
if (krb5_time_abs(cred.times.endtime - cred.times.starttime,
ticket_life) > 30) {
if (labs(cred.times.endtime - cred.times.starttime - ticket_life) > 30) {
char life[64];
unparse_time_approx(cred.times.endtime - cred.times.starttime,
life, sizeof(life));
@@ -1113,8 +1112,7 @@ get_new_tickets(krb5_context context,
}
}
if (renew_life) {
if (krb5_time_abs(cred.times.renew_till - cred.times.starttime,
renew) > 30) {
if (labs(cred.times.renew_till - cred.times.starttime - renew) > 30) {
char life[64];
unparse_time_approx(cred.times.renew_till - cred.times.starttime,
life, sizeof(life));
lib/Makefile.am
+4
View File
@@ -1,5 +1,8 @@
include $(top_srcdir)/Makefile.am.common
if LIBEDIT
dir_editline = libedit
endif
if DCE
dir_dce = kdfs
endif
@@ -18,6 +21,7 @@ SUBDIRS = \
vers \
$(dir_com_err) \
base \
$(dir_editline) \
sl \
wind \
asn1 \
lib/asn1/der_format.c
+1 -3
View File
@@ -97,10 +97,8 @@ der_print_hex_heim_integer (const heim_integer *data, char **p)
if (data->negative) {
len = asprintf(&q, "-%s", *p);
free(*p);
if (len < 0) {
*p = NULL;
if (len < 0)
return ENOMEM;
}
*p = q;
}
return 0;
lib/asn1/gen.c
-3
View File
@@ -191,7 +191,6 @@ init_generate (const char *filename, const char *base)
fprintf (headerfile,
"#include <stddef.h>\n"
"#include <stdint.h>\n"
"#include <errno.h>\n"
"#include <time.h>\n\n");
fprintf (headerfile,
"#ifndef __asn1_common_definitions__\n"
@@ -600,8 +599,6 @@ generate_constant (const Symbol *s)
/* header file */
gen_upper = strdup(s->gen_name);
if (gen_upper == NULL)
errx(1, "malloc");
len = strlen(gen_upper);
for (i = 0; i < len; i++)
gen_upper[i] = toupper((unsigned char)s->gen_name[i]);
lib/asn1/gen_template.c
-6
View File
@@ -289,11 +289,7 @@ static struct tlist *
tlist_new(const char *name)
{
struct tlist *tl = calloc(1, sizeof(*tl));
if (tl == NULL)
errx(1, "malloc");
tl->name = strdup(name);
if (tl->name == NULL)
errx(1, "malloc");
HEIM_TAILQ_INIT(&tl->template);
return tl;
}
@@ -425,8 +421,6 @@ add_line(struct templatehead *t, const char *fmt, ...)
{
struct template *q = calloc(1, sizeof(*q));
va_list ap;
if (q == NULL)
errx(1, "malloc");
va_start(ap, fmt);
if (vasprintf(&q->line, fmt, ap) < 0 || q->line == NULL)
errx(1, "malloc");
lib/asn1/template.c
+14 -22
View File
@@ -38,26 +38,12 @@
#include <vis.h>
#include <vis-extras.h>
#include <heimbase.h>
#include <errno.h>
#ifndef ENOTSUP
/* Very old MSVC CRTs don't have ENOTSUP */
#define ENOTSUP EINVAL
#endif
static int
int32_ptr_equal(int32_t i, const void *ptr)
{
const intptr_t v = (intptr_t)ptr;
#if INTPTR_MAX > INT32_MAX || INTPTR_MIN < INT32_MIN
if (v > INT32_MAX || v < INT32_MIN)
return 0;
#endif
return i == (int32_t)v;
}
struct asn1_type_func asn1_template_prim[A1T_NUM_ENTRY] = {
#define el(name, type) { \
(asn1_type_encode)der_put_##name, \
@@ -1507,7 +1493,9 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
} else if (tdefval->tt & A1_DV_INTEGER32) {
const int32_t *i = el;
if (int32_ptr_equal(*i, tdefval->ptr))
if ((int64_t)(intptr_t)tdefval->ptr <= INT_MAX &&
(int64_t)(intptr_t)tdefval->ptr >= INT_MIN &&
*i == (int32_t)(intptr_t)tdefval->ptr)
break;
} else if (tdefval->tt & A1_DV_INTEGER) {
const struct heim_integer *i = el;
@@ -1579,7 +1567,9 @@ _asn1_encode(const struct asn1_template *t, unsigned char *p, size_t len, const
} else if (tdefval->tt & A1_DV_INTEGER32) {
const int32_t *i = data;
if (int32_ptr_equal(*i, tdefval->ptr))
if ((int64_t)(intptr_t)tdefval->ptr <= INT_MAX &&
(int64_t)(intptr_t)tdefval->ptr >= INT_MIN &&
*i == (int32_t)(intptr_t)tdefval->ptr)
exclude = 1;
} else if (tdefval->tt & A1_DV_INTEGER) {
const struct heim_integer *i = data;
@@ -2082,7 +2072,9 @@ _asn1_length(const struct asn1_template *t, const void *data)
} else if (tdefval->tt & A1_DV_INTEGER32) {
const int32_t *i = el;
if (int32_ptr_equal(*i, tdefval->ptr))
if ((int64_t)(intptr_t)tdefval->ptr <= INT_MAX &&
(int64_t)(intptr_t)tdefval->ptr >= INT_MIN &&
*i == (int32_t)(intptr_t)tdefval->ptr)
break;
} else if (tdefval->tt & A1_DV_INTEGER) {
const struct heim_integer *i = el;
@@ -2139,7 +2131,9 @@ _asn1_length(const struct asn1_template *t, const void *data)
} else if (tdefval->tt & A1_DV_INTEGER32) {
const int32_t *i = data;
if (int32_ptr_equal(*i, tdefval->ptr))
if ((int64_t)(intptr_t)tdefval->ptr <= INT_MAX &&
(int64_t)(intptr_t)tdefval->ptr >= INT_MIN &&
*i == (int32_t)(intptr_t)tdefval->ptr)
exclude = 1;
} else if (tdefval->tt & A1_DV_INTEGER) {
const struct heim_integer *i = data;
@@ -2489,10 +2483,8 @@ _asn1_print_open_type(const struct asn1_template *t, /* object set template */
}
if (!(t->tt & A1_OS_OT_IS_ARRAY)) {
size_t offset = t->offset + sizeof(*elementp);
offset += (sizeof(void *) - offset % sizeof(void *)) % sizeof(void *);
dp = DPOC(data, offset);
unsigned align = 8 - ((t->offset + sizeof(*elementp)) & 0x7);
dp = DPOC(data, t->offset + sizeof(*elementp) + align);
if (*dp) {
struct rk_strpool *r2 = NULL;
char *s = NULL;
lib/asn1/timegm.c
+2 -17
View File
@@ -46,21 +46,6 @@ static const unsigned ndays[2][12] ={
{31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31},
{31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31}};
static time_t
_clamp_time_t(uint64_t t)
{
#if SIZEOF_TIME_T < 8
#ifdef TIME_T_UNSIGNED
#define MAX_TIME ((UINT64_C(1) << (SIZEOF_TIME_T * 8)) - 1)
#else
#define MAX_TIME ((UINT64_C(1) << ((SIZEOF_TIME_T * 8) - 1)) - 1)
#endif
return t < MAX_TIME ? t : MAX_TIME;
#else
return t;
#endif
}
/*
* This is a simplifed version of timegm(3) that doesn't accept out of
* bound values that timegm(3) normally accepts but those are not
@@ -70,7 +55,7 @@ _clamp_time_t(uint64_t t)
time_t
_der_timegm (struct tm *tm)
{
uint64_t res = 0;
time_t res = 0;
int i;
/*
@@ -104,7 +89,7 @@ _der_timegm (struct tm *tm)
res += tm->tm_min;
res *= 60;
res += tm->tm_sec;
return _clamp_time_t(res);
return res;
}
struct tm *
lib/base/config_file.c
+3 -23
View File
@@ -86,26 +86,6 @@ static heim_error_code parse_list(struct fileptr *f, unsigned *lineno,
heim_config_binding **parent,
const char **err_message);
static int
todash(int c)
{
if (c == '_')
return '-';
return c;
}
static int
strcmp_du(const char *s1, const char *s2)
{
while (todash((unsigned char)*s1) == todash((unsigned char)*s2)) {
if (*s1 == '\0')
return 0;
s1++;
s2++;
}
return todash((unsigned char)*s1) - todash((unsigned char)*s2);
}
heim_config_section *
heim_config_get_entry(heim_config_section **parent, const char *name, int type)
{
@@ -114,7 +94,7 @@ heim_config_get_entry(heim_config_section **parent, const char *name, int type)
for (q = parent; *q != NULL; q = &(*q)->next)
if (type == heim_config_list &&
(unsigned)type == (*q)->type &&
strcmp_du(name, (*q)->name) == 0)
strcmp(name, (*q)->name) == 0)
return *q;
*q = calloc(1, sizeof(**q));
if (*q == NULL)
@@ -808,7 +788,7 @@ vget_next(heim_context context,
const char *p = va_arg(args, const char *);
while (b != NULL) {
if (strcmp_du(b->name, name) == 0) {
if (strcmp(b->name, name) == 0) {
if (b->type == (unsigned)type && p == NULL) {
*pointer = b;
return b->u.generic;
@@ -846,7 +826,7 @@ heim_config_vget_next(heim_context context,
/* we were called again, so just look for more entries with the
same name and type */
for (b = (*pointer)->next; b != NULL; b = b->next) {
if(strcmp_du(b->name, (*pointer)->name) == 0 && b->type == (unsigned)type) {
if(strcmp(b->name, (*pointer)->name) == 0 && b->type == (unsigned)type) {
*pointer = b;
return b->u.generic;
}
lib/base/log.c
+9 -28
View File
@@ -355,12 +355,11 @@ open_file(heim_context context, heim_log_facility *fac, int min, int max,
return ret;
}
static heim_error_code
addlog_dest(heim_context context, heim_log_facility *f,
const char *orig, int default_min, int default_max)
heim_error_code
heim_addlog_dest(heim_context context, heim_log_facility *f, const char *orig)
{
heim_error_code ret = 0;
int min = default_min, max = default_max, n;
int min = 0, max = 3, n;
char c;
const char *p = orig;
#ifdef _WIN32
@@ -394,6 +393,8 @@ addlog_dest(heim_context context, heim_log_facility *f,
return HEIM_ERR_LOG_PARSE;
}
p++;
} else {
max = 5;
}
if (strcmp(p, "STDERR") == 0) {
ret = open_file(context, f, min, max, NULL, "a", stderr,
@@ -444,12 +445,6 @@ addlog_dest(heim_context context, heim_log_facility *f,
return ret;
}
heim_error_code
heim_addlog_dest(heim_context context, heim_log_facility *f, const char *orig)
{
return addlog_dest(context, f, orig, 0, 5);
}
heim_error_code
heim_openlog(heim_context context,
const char *program,
@@ -653,9 +648,9 @@ heim_add_warn_dest(heim_context context, const char *program,
return 0;
}
static heim_error_code
add_debug_dest(heim_context context, const char *program,
const char *log_spec, int default_min, int default_max)
heim_error_code
heim_add_debug_dest(heim_context context, const char *program,
const char *log_spec)
{
heim_log_facility *fac;
heim_error_code ret;
@@ -667,26 +662,12 @@ add_debug_dest(heim_context context, const char *program,
heim_set_debug_dest(context, fac);
}
ret = addlog_dest(context, fac, log_spec, default_min, default_max);
ret = heim_addlog_dest(context, fac, log_spec);
if (ret)
return ret;
return 0;
}
heim_error_code
heim_add_debug_dest(heim_context context, const char *program,
const char *log_spec)
{
return add_debug_dest(context, program, log_spec, 0, 5);
}
heim_error_code
heim_add_trace_dest(heim_context context, const char *program,
const char *log_spec)
{
return add_debug_dest(context, program, log_spec, 0, -1);
}
struct heim_audit_kv_tuple {
heim_string_t key;
heim_object_t value;
lib/base/test_base.c
-78
View File
@@ -142,83 +142,6 @@ test_rwlock(void)
return 0;
}
static int
file_contains(const char *filename, const char *needle)
{
char buf[1024];
FILE *f;
int found = 0;
f = fopen(filename, "r");
if (f == NULL)
return 0;
while (fgets(buf, sizeof(buf), f) != NULL) {
if (strstr(buf, needle) != NULL) {
found = 1;
break;
}
}
fclose(f);
return found;
}
static int
test_log_dest(void)
{
const char *normal = "test-log-dest.log";
const char *trace = "test-trace-dest.log";
const char *explicit = "test-trace-explicit-dest.log";
heim_log_facility *fac = NULL;
heim_context context;
int ret;
unlink(normal);
unlink(trace);
unlink(explicit);
context = heim_context_init();
heim_assert(context != NULL, "heim_context_init failed");
ret = heim_initlog(context, "test_base", &fac);
heim_assert(ret == 0, "heim_initlog failed");
ret = heim_addlog_dest(context, fac, normal);
heim_assert(ret == 0, "heim_addlog_dest failed");
heim_log(context, fac, 10, "normal level 10");
heim_log(context, fac, 5, "normal level 5");
heim_closelog(context, fac);
heim_assert(!file_contains(normal, "normal level 10"),
"normal log destination traced level 10 by default");
heim_assert(file_contains(normal, "normal level 5"),
"normal log destination did not log level 5 by default");
ret = heim_add_trace_dest(context, "test_base", trace);
heim_assert(ret == 0, "heim_add_trace_dest failed");
ret = heim_add_trace_dest(context, "test_base",
"5/FILE:test-trace-explicit-dest.log");
heim_assert(ret == 0, "heim_add_trace_dest with explicit level failed");
heim_debug(context, 10, "trace level 10");
heim_debug(context, 5, "trace level 5");
heim_assert(file_contains(trace, "trace level 10"),
"trace log destination did not trace level 10 by default");
heim_assert(!file_contains(explicit, "trace level 10"),
"explicit trace destination ignored its level filter");
heim_assert(file_contains(explicit, "trace level 5"),
"explicit trace destination did not log matching level");
heim_context_free(&context);
unlink(normal);
unlink(trace);
unlink(explicit);
return 0;
}
static int
test_dict(void)
{
@@ -1442,7 +1365,6 @@ main(int argc, char **argv)
res |= test_memory();
res |= test_mutex();
res |= test_rwlock();
res |= test_log_dest();
res |= test_dict();
res |= test_auto_release();
res |= test_string();
lib/base/version-script.map
-1
View File
@@ -10,7 +10,6 @@ HEIMDAL_BASE_1.0 {
heim_abort;
heim_abortv;
heim_add_debug_dest;
heim_add_trace_dest;
heim_add_et_list;
heim_addlog_dest;
heim_addlog_func;
lib/gssapi/gss-token.1
-6
View File
@@ -15,7 +15,6 @@
.Fl r
.Op Fl MNln
.Op Fl C Ar ccache
.Op Fl L Ar localuser
.Op Fl S Ar maxsize
.Op Fl c count
.Op Fl m mech
@@ -36,11 +35,6 @@ write an accepted delegated credential into
This only makes sense if
.Fl r
is specified.
.It Fl L Ar localuser
try to authorize as
.Ar localuser
with
.Fn gss_authorize_localname .
.It Fl D
delegate credentials.
This only makes sense as a client, that is when
lib/gssapi/gss-token.c
+7 -37
View File
@@ -435,13 +435,11 @@ initiate_many(gss_name_t service, int delegate, int negotiate, int memcache,
}
static int
accept_one(gss_name_t service, const char *ccname, const char *localuser,
int negotiate)
accept_one(gss_name_t service, const char *ccname, int negotiate)
{
gss_cred_id_t cred = NULL;
gss_cred_id_t deleg_creds = NULL;
gss_name_t client = GSS_C_NO_NAME;
gss_name_t lname = GSS_C_NO_NAME;
gss_name_t client;
gss_OID mech_oid;
gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
gss_buffer_desc in = GSS_C_EMPTY_BUFFER;
@@ -497,23 +495,8 @@ accept_one(gss_name_t service, const char *ccname, const char *localuser,
printf("Authenticated: %.*s\n", (int)dname.length,
(char *)dname.value);
(void) gss_release_buffer(&min, &dname);
if (localuser) {
gss_buffer_desc lnamebuf;
lnamebuf.length = strlen(localuser);
lnamebuf.value = rk_UNCONST(localuser);
maj = gss_import_name(&min, &lnamebuf,
GSS_C_NT_USER_NAME, &lname);
GBAIL("gss_import_name", maj, min);
maj = gss_authorize_localname(&min, client, lname);
GBAIL("gss_authorize_localname", maj, min);
if (!nflag)
printf("Authorized: %s\n", localuser);
}
(void) gss_release_name(&min, &client);
(void) gss_delete_sec_context(&min, &ctx, GSS_C_NO_BUFFER);
if (ccname) {
#ifdef HAVE_GSS_STORE_CRED_INTO
@@ -549,12 +532,6 @@ bail:
gss_release_cred(&min, &cred);
if (deleg_creds)
gss_release_cred(&min, &deleg_creds);
if (lname)
gss_release_name(&min, &lname);
if (client)
gss_release_name(&min, &client);
if (ctx != GSS_C_NO_CONTEXT)
gss_delete_sec_context(&min, &ctx, GSS_C_NO_BUFFER);
free(in.value);
@@ -608,8 +585,8 @@ usage(int ecode)
{
FILE *f = ecode == 0 ? stdout : stderr;
fprintf(f, "Usage: gss-token [-DNn] [-c count] service@host\n");
fprintf(f, " gss-token -r [-Nln] [-C ccache] [-L localuser] "
"[-c count] [service@host]\n");
fprintf(f, " gss-token -r [-Nln] [-C ccache] [-c count] "
"[service@host]\n");
exit(ecode);
}
@@ -629,14 +606,12 @@ main(int argc, char **argv)
int ret = 0;
int optidx = 0;
char *ccname = NULL;
char *localuser = NULL;
char *mech = NULL;
struct getargs args[] = {
{ "help", 'h', arg_flag, &hflag, NULL, NULL },
{ "version", 0, arg_flag, &version_flag, NULL, NULL },
{ NULL, 'C', arg_string, &ccname, NULL, NULL },
{ NULL, 'D', arg_flag, &Dflag, NULL, NULL },
{ NULL, 'L', arg_string, &localuser, NULL, NULL },
{ NULL, 'M', arg_flag, &Mflag, NULL, NULL },
{ NULL, 'N', arg_flag, &Nflag, NULL, NULL },
{ NULL, 'S', arg_integer, &Sflag, NULL, NULL },
@@ -687,11 +662,6 @@ main(int argc, char **argv)
"make sense without -r.\n");
usage(1);
}
if (localuser) {
fprintf(stderr, "Specifying a local user doesn't make "
"sense without -r.\n");
usage(1);
}
ret = initiate_many(service, Dflag, Nflag, Mflag, count);
goto done;
}
@@ -703,7 +673,7 @@ main(int argc, char **argv)
}
do {
ret = accept_one(service, ccname, localuser, Nflag);
ret = accept_one(service, ccname, Nflag);
} while (lflag && !ret && !feof(stdin));
done:
lib/gssapi/krb5/acquire_cred.c
+1 -1
View File
@@ -926,7 +926,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_acquire_cred_from
NULL, time_rec, NULL, actual_mechs);
if (ret != GSS_S_COMPLETE) {
if (handle->mechanisms != NULL)
gss_release_oid_set(minor_status, &handle->mechanisms);
gss_release_oid_set(NULL, &handle->mechanisms);
HEIMDAL_MUTEX_destroy(&handle->cred_id_mutex);
krb5_free_principal(context, handle->principal);
free(handle);
lib/gssapi/krb5/add_cred.c
+1 -2
View File
@@ -238,7 +238,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred_from (
failure:
if (handle) {
OM_uint32 tmp_status;
if (handle->principal)
krb5_free_principal(context, handle->principal);
if (handle->keytab)
@@ -246,7 +245,7 @@ failure:
if (handle->ccache)
krb5_cc_destroy(context, handle->ccache);
if (handle->mechanisms)
gss_release_oid_set(&tmp_status, &handle->mechanisms);
gss_release_oid_set(NULL, &handle->mechanisms);
free(handle);
}
if (cred && output_cred_handle)
lib/gssapi/krb5/arcfour.c
+15 -15
View File
@@ -308,7 +308,7 @@ _gssapi_get_mic_arcfour(OM_uint32 * minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
EVP_Cipher(rc4_key, p, p, 8) != 8) {
EVP_Cipher(rc4_key, p, p, 8) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -392,7 +392,7 @@ _gssapi_verify_mic_arcfour(OM_uint32 * minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, (void *)k6_data, NULL, 0) != 1 ||
EVP_Cipher(rc4_key, SND_SEQ, p, 8) != 8) {
EVP_Cipher(rc4_key, SND_SEQ, p, 8) != 1) {
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
return GSS_S_FAILURE;
@@ -553,7 +553,7 @@ _gssapi_wrap_arcfour(OM_uint32 * minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
EVP_Cipher(rc4_key, p0 + 24, p0 + 24, 8 + datalen) != 8 + datalen) {
EVP_Cipher(rc4_key, p0 + 24, p0 + 24, 8 + datalen) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -581,7 +581,7 @@ _gssapi_wrap_arcfour(OM_uint32 * minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
EVP_Cipher(rc4_key, p0 + 8, p0 + 8 /* SND_SEQ */, 8) != 8) {
EVP_Cipher(rc4_key, p0 + 8, p0 + 8 /* SND_SEQ */, 8) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -690,7 +690,7 @@ OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
EVP_Cipher(rc4_key, SND_SEQ, p0 + 8, 8) != 8) {
EVP_Cipher(rc4_key, SND_SEQ, p0 + 8, 8) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not decrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -747,8 +747,8 @@ OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
EVP_Cipher(rc4_key, Confounder, p0 + 24, 8) != 8 ||
EVP_Cipher(rc4_key, output_message_buffer->value, p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE, datalen) != datalen) {
EVP_Cipher(rc4_key, Confounder, p0 + 24, 8) != 1 ||
EVP_Cipher(rc4_key, output_message_buffer->value, p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE, datalen) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not decrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1149,7 +1149,7 @@ _gssapi_wrap_iov_arcfour(OM_uint32 *minor_status,
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
/* Confounder */
EVP_Cipher(rc4_key, p0 + 24, p0 + 24, 8) != 8) {
EVP_Cipher(rc4_key, p0 + 24, p0 + 24, 8) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1166,7 +1166,7 @@ _gssapi_wrap_iov_arcfour(OM_uint32 *minor_status,
}
if (EVP_Cipher(rc4_key, iov[i].buffer.value,
iov[i].buffer.value, iov[i].buffer.length) != iov[i].buffer.length) {
iov[i].buffer.value, iov[i].buffer.length) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1177,7 +1177,7 @@ _gssapi_wrap_iov_arcfour(OM_uint32 *minor_status,
/* Padding */
if (padding &&
EVP_Cipher(rc4_key, padding->buffer.value,
padding->buffer.value, padding->buffer.length) != padding->buffer.length) {
padding->buffer.value, padding->buffer.length) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1206,7 +1206,7 @@ _gssapi_wrap_iov_arcfour(OM_uint32 *minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
EVP_Cipher(rc4_key, p0 + 8, p0 + 8, 8) != 8 /* SND_SEQ */) {
EVP_Cipher(rc4_key, p0 + 8, p0 + 8, 8) != 1 /* SND_SEQ */) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1357,7 +1357,7 @@ _gssapi_unwrap_iov_arcfour(OM_uint32 *minor_status,
}
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
EVP_Cipher(rc4_key, snd_seq, p0 + 8, 8) != 8 /* SND_SEQ */) {
EVP_Cipher(rc4_key, snd_seq, p0 + 8, 8) != 1 /* SND_SEQ */) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not decrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1410,7 +1410,7 @@ _gssapi_unwrap_iov_arcfour(OM_uint32 *minor_status,
if (EVP_CIPHER_CTX_init(rc4_key) != 1 ||
EVP_CipherInit_ex(rc4_key, context->ossl->rc4, NULL, k6_data, NULL, 1) != 1 ||
/* Confounder */
EVP_Cipher(rc4_key, Confounder, p0 + 24, 8) != 8) {
EVP_Cipher(rc4_key, Confounder, p0 + 24, 8) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not decrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1427,7 +1427,7 @@ _gssapi_unwrap_iov_arcfour(OM_uint32 *minor_status,
}
if (EVP_Cipher(rc4_key, iov[i].buffer.value,
iov[i].buffer.value, iov[i].buffer.length) != iov[i].buffer.length) {
iov[i].buffer.value, iov[i].buffer.length) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not decrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
@@ -1438,7 +1438,7 @@ _gssapi_unwrap_iov_arcfour(OM_uint32 *minor_status,
/* Padding */
if (padding &&
EVP_Cipher(rc4_key, padding->buffer.value,
padding->buffer.value, padding->buffer.length) != padding->buffer.length) {
padding->buffer.value, padding->buffer.length) != 1) {
EVP_CIPHER_CTX_free(rc4_key);
_krb5_debug_openssl(context, 4, "Could not encrypt with RC4 with OpenSSL");
*minor_status = KRB5_CRYPTO_INTERNAL;
lib/gssapi/krb5/inquire_context.c
+3 -4
View File
@@ -100,12 +100,11 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_context (
return GSS_S_COMPLETE;
failed:
{ OM_uint32 tmp_status;
if (src_name)
_gsskrb5_release_name(&tmp_status, src_name);
_gsskrb5_release_name(NULL, src_name);
if (targ_name)
_gsskrb5_release_name(&tmp_status, targ_name);
}
_gsskrb5_release_name(NULL, targ_name);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
return ret;
}
lib/gssapi/krb5/inquire_mechs_for_name.c
+1 -2
View File
@@ -40,7 +40,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_mechs_for_name (
)
{
OM_uint32 ret;
OM_uint32 tmp_status;
ret = gss_create_empty_oid_set(minor_status, mech_types);
if (ret)
@@ -50,7 +49,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_mechs_for_name (
GSS_KRB5_MECHANISM,
mech_types);
if (ret)
gss_release_oid_set(&tmp_status, mech_types);
gss_release_oid_set(NULL, mech_types);
return ret;
}
lib/gssapi/krb5/inquire_names_for_mech.c
+1 -2
View File
@@ -48,7 +48,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_names_for_mech (
)
{
OM_uint32 ret;
OM_uint32 tmp_status;
int i;
*minor_status = 0;
@@ -72,7 +71,7 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_inquire_names_for_mech (
}
if (ret != GSS_S_COMPLETE)
gss_release_oid_set(&tmp_status, name_types);
gss_release_oid_set(NULL, name_types);
return GSS_S_COMPLETE;
}
lib/gssapi/krb5/store_cred.c
+2 -19
View File
@@ -83,25 +83,8 @@ set_proc(OM_uint32 *minor, gss_buffer_set_t env)
#ifndef WIN32
size_t i;
for (i = 0; i < env->count; i++) {
char *var = (char *)env->elements[i].value;
char *eq = strchr(var, '=');
char *val;
int e;
if (eq == NULL) {
*minor = EINVAL;
return GSS_S_FAILURE;
}
val = eq + 1;
*eq = '\0';
e = setenv(var, val, 1);
*eq = '=';
if (e != 0) {
*minor = errno ? errno : EINVAL;
return GSS_S_FAILURE;
}
}
for (i = 0; i < env->count; i++)
putenv(env->elements[i].value);
#endif
return GSS_S_COMPLETE;
}
lib/gssapi/mech/gss_accept_sec_context.c
+1 -10
View File
@@ -265,14 +265,12 @@ gss_accept_sec_context(OM_uint32 *minor_status,
*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
_mg_buffer_zero(output_token);
_gss_mg_log(10, "gss-asc: enter ctx=%p", ctx);
if (!*context_handle) {
ctx = calloc(1, sizeof(*ctx));
if (!ctx) {
*minor_status = ENOMEM;
return (GSS_S_DEFECTIVE_TOKEN);
}
_gss_mg_log(10, "gss-asc: allocated ctx=%p", ctx);
*context_handle = (gss_ctx_id_t)ctx;
ctx->gc_initial = 1;
}
@@ -320,9 +318,6 @@ gss_accept_sec_context(OM_uint32 *minor_status,
&mech_ret_flags,
time_rec,
&delegated_mc);
_gss_mg_log(10, "gss-asc: ctx=%p tried \"%s\", "
"returned %u", ctx, m->gm_name,
major_status);
if (major_status == GSS_S_DEFECTIVE_TOKEN) {
/*
* Try to retain and output one error token for
@@ -365,9 +360,6 @@ gss_accept_sec_context(OM_uint32 *minor_status,
&mech_ret_flags,
time_rec,
&delegated_mc);
_gss_mg_log(10, "gss-asc: ctx=%p tried \"%s\", "
"returned %u", ctx, m->gm_name,
major_status);
if (major_status == GSS_S_DEFECTIVE_TOKEN) {
if (output_token->length &&
defective_token_error.length == 0) {
@@ -518,8 +510,7 @@ got_one:
}
}
_gss_mg_log(10, "gss-asc: ctx=%p return %d/%d", ctx,
(int)major_status, (int)*minor_status);
_gss_mg_log(10, "gss-asc: return %d/%d", (int)major_status, (int)*minor_status);
if (ret_flags)
*ret_flags = mech_ret_flags;
lib/gssapi/mech/gss_display_name.c
-3
View File
@@ -38,7 +38,6 @@ gss_display_name(OM_uint32 *minor_status,
struct _gss_name *name = rk_UNCONST(input_name);
struct _gss_mechanism_name *mn;
_gss_mg_log(10, "gdn: enter gss_display_name: %p", input_name);
_mg_buffer_zero(output_name_buffer);
if (output_name_type)
*output_name_type = GSS_C_NO_OID;
@@ -69,8 +68,6 @@ gss_display_name(OM_uint32 *minor_status,
return (GSS_S_COMPLETE);
} else {
HEIM_TAILQ_FOREACH(mn, &name->gn_mn, gmn_link) {
_gss_mg_log(10, "gdn: trying mech \"%s\"",
mn->gmn_mech->gm_name);
major_status = mn->gmn_mech->gm_display_name(
minor_status, mn->gmn_name,
output_name_buffer,
lib/gssapi/mech/gss_import_name.c
-34
View File
@@ -28,8 +28,6 @@
#include "mech_locl.h"
#include <vis.h>
static OM_uint32
_gss_import_export_name(OM_uint32 *minor_status,
const gss_buffer_t input_name_buffer,
@@ -46,8 +44,6 @@ _gss_import_export_name(OM_uint32 *minor_status,
gss_name_t new_canonical_name;
int composite = 0;
_gss_mg_log(10, "gin: importing exported name");
*minor_status = 0;
*output_name = 0;
@@ -173,32 +169,6 @@ _gss_import_export_name(OM_uint32 *minor_status,
return (GSS_S_COMPLETE);
}
static void
log_import_name(gss_buffer_t input_name_buffer)
{
char *name;
size_t len;
if (!_gss_mg_log_level(10))
return;
if (input_name_buffer->length > (SIZE_MAX - 1) / 4) {
_gss_mg_log(10, "gin: importing name (%zu bytes)",
input_name_buffer->length);
return;
}
len = input_name_buffer->length * 4 + 1;
name = malloc(len);
if (name == NULL)
return;
strsvisx(name, input_name_buffer->value, input_name_buffer->length,
VIS_CSTYLE | VIS_TAB | VIS_NL, "\"");
_gss_mg_log(10, "gin: importing name \"%s\"", name);
free(name);
}
/**
* Convert a GGS-API name from contiguous string to internal form.
*
@@ -260,7 +230,6 @@ gss_import_name(OM_uint32 *minor_status,
name_type, output_name);
}
log_import_name(input_name_buffer);
*minor_status = 0;
name = _gss_create_name(NULL, NULL);
@@ -293,9 +262,6 @@ gss_import_name(OM_uint32 *minor_status,
HEIM_TAILQ_FOREACH(m, &_gss_mechs, gm_link) {
int present = 0;
_gss_mg_log(10, "gin: attempting mech \"%s\"",
m->gm_mech.gm_name);
if ((m->gm_mech.gm_flags & GM_USE_MG_NAME))
continue;
lib/gssapi/mech/gss_mech_switch.c
+2 -5
View File
@@ -167,8 +167,7 @@ do { \
m->gm_mech.gm_ ## name = (_gss_##name##_t *)dlsym(so, "gss_" #name); \
if (!m->gm_mech.gm_ ## name || \
m->gm_mech.gm_ ##name == gss_ ## name) { \
_gss_mg_log(1, "can't find symbol gss_" #name \
" in %s", lib); \
_gss_mg_log(1, "can't find symbol gss_" #name "\n"); \
goto bad; \
} \
} while (0)
@@ -335,11 +334,9 @@ _gss_load_mech(void)
/*
* Check for duplicates, already loaded mechs.
*/
_gss_mg_log(10, "loading \"%s\"", name);
found = 0;
HEIM_TAILQ_FOREACH(m, &_gss_mechs, gm_link) {
if (gss_oid_equal(&m->gm_mech.gm_mech_oid, mech_oid)) {
_gss_mg_log(10, "duplicate mech, not loading");
found = 1;
break;
}
@@ -349,7 +346,7 @@ _gss_load_mech(void)
so = dlopen(lib, RTLD_LAZY | RTLD_LOCAL | RTLD_GROUP);
if (so == NULL) {
_gss_mg_log(1, "dlopen: %s", dlerror());
_gss_mg_log(1, "dlopen: %s\n", dlerror());
goto bad;
}
lib/gssapi/test_add_store_cred.c
+21 -168
View File
@@ -99,8 +99,6 @@ static int help_flag = 0;
static int env_flag = 0;
static int def_flag = 0;
static int overwrite_flag = 0;
static int store_cred_flag = 0;
static char *password = NULL;
static struct getargs args[] = {
{"version", 0, arg_flag, &version_flag, "print version", NULL },
@@ -111,133 +109,16 @@ static struct getargs args[] = {
"switch credential store default principal", NULL },
{"overwrite", 0, arg_flag, &overwrite_flag,
"overwrite matching credential", NULL },
{"store-cred", 0, arg_flag, &store_cred_flag,
"use gss_store_cred instead of gss_store_cred_into2", NULL },
{"password", 0, arg_string, &password,
"acquire source credential with this password", "password" },
};
static void
usage(int ret)
{
arg_printusage(args, sizeof(args)/sizeof(*args),
NULL, "from_ccache to_ccache | source_name target_name");
NULL, "from_ccache to_ccache");
exit(ret);
}
static void
add_krb5_mech(gss_OID_set *mechs)
{
OM_uint32 major, minor;
major = gss_create_empty_oid_set(&minor, mechs);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_C_NO_OID,
"failed to create OID set");
major = gss_add_oid_set_member(&minor, GSS_KRB5_MECHANISM, mechs);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_C_NO_OID,
"failed to add krb5 mechanism to OID set");
}
static void
acquire_from_password(const char *source_name,
const char *source_password,
gss_cred_id_t *cred)
{
OM_uint32 major, minor;
gss_buffer_desc namebuf, pwbuf;
gss_name_t name = GSS_C_NO_NAME;
gss_OID_set mechs = GSS_C_NO_OID_SET;
namebuf.value = rk_UNCONST(source_name);
namebuf.length = strlen(source_name);
major = gss_import_name(&minor, &namebuf, GSS_C_NT_USER_NAME, &name);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_C_NO_OID,
"failed to import source name %s", source_name);
pwbuf.value = rk_UNCONST(source_password);
pwbuf.length = strlen(source_password);
add_krb5_mech(&mechs);
major = gss_acquire_cred_with_password(&minor, name, &pwbuf,
GSS_C_INDEFINITE, mechs,
GSS_C_INITIATE, cred, NULL, NULL);
(void) gss_release_oid_set(&minor, &mechs);
(void) gss_release_name(&minor, &name);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_KRB5_MECHANISM,
"failed to acquire creds with password for %s", source_name);
}
static void
check_init_sec_context(gss_cred_id_t cred, const char *target)
{
OM_uint32 major, minor;
gss_buffer_desc namebuf;
gss_buffer_desc output_token = { 0, NULL };
gss_name_t target_name = GSS_C_NO_NAME;
gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
namebuf.value = rk_UNCONST(target);
namebuf.length = strlen(target);
major = gss_import_name(&minor, &namebuf, GSS_C_NT_HOSTBASED_SERVICE,
&target_name);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_C_NO_OID,
"failed to import target name %s", target);
major = gss_init_sec_context(&minor, cred, &ctx, target_name,
GSS_KRB5_MECHANISM, 0, GSS_C_INDEFINITE,
GSS_C_NO_CHANNEL_BINDINGS,
GSS_C_NO_BUFFER, NULL, &output_token,
NULL, NULL);
(void) gss_release_buffer(&minor, &output_token);
(void) gss_delete_sec_context(&minor, &ctx, GSS_C_NO_BUFFER);
(void) gss_release_name(&minor, &target_name);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_KRB5_MECHANISM,
"failed to use source cred for %s after storing", target);
}
static void
acquire_from_ccache(const char *ccache, gss_cred_id_t *cred)
{
OM_uint32 major, minor;
gss_key_value_element_desc element;
gss_key_value_set_desc store;
element.key = "ccache";
element.value = ccache;
store.count = 1;
store.elements = &element;
major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,
GSS_KRB5_MECHANISM, GSS_C_INITIATE,
GSS_C_INDEFINITE, GSS_C_INDEFINITE,
&store, cred, NULL, NULL, NULL);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_KRB5_MECHANISM,
"failed to acquire stored creds from %s", ccache);
}
static void
check_default_ccache(gss_cred_id_t from_cred, const char *target)
{
OM_uint32 minor;
const char *ccache = getenv("KRB5CCNAME");
gss_cred_id_t to_cred = GSS_C_NO_CREDENTIAL;
if (ccache == NULL)
errx(1, "KRB5CCNAME not set");
acquire_from_ccache(ccache, &to_cred);
check_init_sec_context(from_cred, target);
check_init_sec_context(to_cred, target);
(void) gss_release_cred(&minor, &to_cred);
}
int
main(int argc, char **argv)
{
@@ -276,42 +157,30 @@ main(int argc, char **argv)
if (argc > 2)
errx(1, "too many arguments");
if (password) {
if (!store_cred_flag)
errx(1, "--password requires --store-cred");
acquire_from_password(argv[0], password, &from_cred);
} else {
from_elements.key = "ccache";
from_elements.value = argv[0];
from.count = 1;
from.elements = &from_elements;
from_elements.key = "ccache";
from_elements.value = argv[0];
from.count = 1;
from.elements = &from_elements;
major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,
GSS_KRB5_MECHANISM, GSS_C_INITIATE,
GSS_C_INDEFINITE, GSS_C_INDEFINITE,
&from, &from_cred, NULL, NULL, NULL);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_KRB5_MECHANISM,
"failed to acquire creds from %s", argv[0]);
}
to_elements.key = "ccache";
to_elements.value = argv[1];
to.count = 1;
to.elements = &to_elements;
if (store_cred_flag) {
major = gss_store_cred(&minor, from_cred, GSS_C_INITIATE,
GSS_KRB5_MECHANISM, overwrite_flag, def_flag,
NULL, NULL);
} else {
to_elements.key = "ccache";
to_elements.value = argv[1];
to.count = 1;
to.elements = &to_elements;
major = gss_store_cred_into2(&minor, from_cred, GSS_C_INITIATE,
GSS_KRB5_MECHANISM, store_flags, &to, NULL,
NULL, env_flag ? &env : NULL);
}
major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,
GSS_KRB5_MECHANISM, GSS_C_INITIATE,
GSS_C_INDEFINITE, GSS_C_INDEFINITE,
&from, &from_cred, NULL, NULL, NULL);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_KRB5_MECHANISM,
"failed to store creds");
"failed to acquire creds from %s", argv[0]);
major = gss_store_cred_into2(&minor, from_cred, GSS_C_INITIATE,
GSS_KRB5_MECHANISM, store_flags, &to, NULL,
NULL, env_flag ? &env : NULL);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_KRB5_MECHANISM,
"failed to store creds into %s", argv[1]);
if (env_flag) {
size_t i;
@@ -335,22 +204,6 @@ main(int argc, char **argv)
"gss_store_cred_into2()");
}
if (password)
check_default_ccache(from_cred, argv[1]);
if (store_cred_flag) {
(void) gss_release_cred(&minor, &from_cred);
return 0;
}
major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,
GSS_KRB5_MECHANISM, GSS_C_INITIATE,
GSS_C_INDEFINITE, GSS_C_INDEFINITE,
&to, &to_cred, NULL, NULL, NULL);
if (major != GSS_S_COMPLETE)
gss_err(1, major, minor, GSS_KRB5_MECHANISM,
"failed to acquire stored creds from %s", argv[1]);
(void) gss_release_cred(&minor, &from_cred);
(void) gss_release_cred(&minor, &to_cred);
lib/gssapi/test_context.c
+1 -1
View File
@@ -483,7 +483,7 @@ loop(gss_OID mechoid,
if (*deleg_cred != GSS_C_NO_CREDENTIAL)
errx(1, "got delegated cred but didn't expect one");
} else if (*deleg_cred == GSS_C_NO_CREDENTIAL)
errx(1, "asked for delegated cred but did get one");
errx(1, "asked for delegarated cred but did get one");
} else if (*deleg_cred != GSS_C_NO_CREDENTIAL)
errx(1, "got deleg_cred cred but didn't ask");
lib/hx509/Makefile.am
+1 -5
View File
@@ -169,15 +169,12 @@ fuzz_jose_SOURCES = fuzz_jose.c
fuzz_jose_LDADD = libhx509.la $(LIB_roken) $(top_builddir)/lib/base/libheimbase.la
fuzz_jose.$(OBJEXT): $(HX509_PROTOS) $(nodist_include_HEADERS)
test_expr_LDADD = libhx509.la $(LIB_roken) $(top_builddir)/lib/asn1/libasn1.la
test_cert_binary_CPPFLAGS = $(AM_CPPFLAGS) -DSRCDIR=\"$(srcdir)\"
test_cert_binary_LDADD = libhx509.la $(LIB_roken) $(top_builddir)/lib/asn1/libasn1.la
TESTS = $(SCRIPT_TESTS) $(PROGRAM_TESTS)
PROGRAM_TESTS = \
test_name \
test_expr \
test_cert_binary
test_expr
SCRIPT_TESTS = \
test_ca \
@@ -339,7 +336,6 @@ EXTRA_DIST = \
data/key2.der \
data/nist-data \
data/nist-data2 \
data/notafter-2338.pem \
data/no-proxy-test.crt \
data/no-proxy-test.key \
data/ocsp-req1.der \
lib/hx509/ca.c
+2 -14
View File
@@ -66,18 +66,6 @@ struct hx509_ca_tbs {
AlgorithmIdentifier *sigalg;
};
static int
use_utc_time(time_t t)
{
if (t < 1)
return 1;
#if SIZEOF_TIME_T > 4 || defined(TIME_T_UNSIGNED)
if ((uint64_t)t >= 2524608000ULL)
return 0;
#endif
return 1;
}
/**
* Allocate an to-be-signed certificate object that will be converted
* into an certificate.
@@ -1785,13 +1773,13 @@ ca_sign(hx509_context context,
*
* Both, ...u.generalTime and ...u..utcTime are time_t.
*/
if (use_utc_time(notBefore))
if (notBefore < 1 || (int64_t)notBefore < 2524608000)
tbsc->validity.notBefore.element = choice_Time_utcTime;
else
tbsc->validity.notBefore.element = choice_Time_generalTime;
tbsc->validity.notBefore.u.generalTime = notBefore;
if (use_utc_time(notAfter))
if (notAfter < 1 || (int64_t)notAfter < 2524608000)
tbsc->validity.notAfter.element = choice_Time_utcTime;
else
tbsc->validity.notAfter.element = choice_Time_generalTime;
lib/hx509/cert.c
+1 -38
View File
@@ -78,7 +78,6 @@ struct hx509_cert_data {
unsigned int ref;
char *friendlyname;
Certificate *data;
heim_octet_string encoding;
hx509_private_key private_key;
struct _hx509_cert_attrs attrs;
hx509_name basename;
@@ -636,8 +635,6 @@ cert_init(hx509_context context, heim_error_t *error)
cert->release = NULL;
cert->ctx = NULL;
cert->data= NULL;
cert->encoding.data = NULL;
cert->encoding.length = 0;
return cert;
}
@@ -696,23 +693,7 @@ hx509_cert_copy_no_private_key(hx509_context context,
hx509_cert src,
heim_error_t *error)
{
hx509_cert cert;
int ret;
cert = hx509_cert_init(context, src->data, error);
if (cert == NULL)
return NULL;
ret = der_copy_octet_string(&src->encoding, &cert->encoding);
if (ret) {
hx509_cert_free(cert);
if (error)
*error = heim_error_create_enomem();
errno = ret;
return NULL;
}
return cert;
return hx509_cert_init(context, src->data, error);
}
/**
@@ -766,7 +747,6 @@ hx509_cert_init_data(hx509_context context,
heim_error_t *error)
{
hx509_cert cert;
heim_octet_string os;
Certificate t;
size_t size;
int ret;
@@ -789,19 +769,6 @@ hx509_cert_init_data(hx509_context context,
cert = hx509_cert_init(context, &t, error);
free_Certificate(&t);
if (cert == NULL)
return NULL;
os.length = len;
os.data = rk_UNCONST(ptr);
ret = der_copy_octet_string(&os, &cert->encoding);
if (ret) {
hx509_cert_free(cert);
if (error)
*error = heim_error_create_enomem();
errno = ret;
return NULL;
}
return cert;
}
@@ -857,7 +824,6 @@ hx509_cert_free(hx509_cert cert)
if (cert->data)
free_Certificate(cert->data);
free(cert->data);
der_free_octet_string(&cert->encoding);
for (i = 0; i < cert->attrs.len; i++) {
der_free_octet_string(&cert->attrs.val[i]->data);
@@ -4091,9 +4057,6 @@ hx509_cert_binary(hx509_context context, hx509_cert c, heim_octet_string *os)
os->data = NULL;
os->length = 0;
if (c->encoding.data != NULL)
return der_copy_octet_string(&c->encoding, os);
ASN1_MALLOC_ENCODE(Certificate, os->data, os->length,
_hx509_get_cert(c), &size, ret);
if (ret) {
lib/hx509/data/notafter-2338.pem
-25
View File
@@ -1,25 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIFATCCAumgAwIBAgIBAjANBgkqhkiG9w0BAQUFADAqMRswGQYDVQQDDBJoeDUwOSBUZXN0IFJv
b3QgQ0ExCzAJBgNVBAYTAlNFMCAXDTE5MDMyMjIyMjUwMloYDzIzMzgwMTE5MDMxNDA4WjAhMQsw
CQYDVQQGEwJTRTESMBAGA1UEAwwJVGVzdCBjZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
CgKCAgEA2h1NylGd8Z/XpHpF+HWYZrLFfVPeQjV0gc0en/ND16eDf/uizjxEN4BPITam9slRdJ7i
m7+t5OtyEWQ2iLOpkWPH7jjE9YwGceUJt+tXXb/bW3IHxSnobzOzoifvH1DwVTNjQSPgsvchd0ur
nXMqu7ZOiH985cY3PrYgwVc+bVd47w1H6UHn+rYtMj9CBY1Wr/XEuG6ZGucH1aE/KX3OsjmmqwZ6
4iY52JaeO8iveT6aJE5Lsq/kBw5x3C9wJ5c8ovppm1dLxVNeKAywx1cforImD1+/00V4kFos/Gpn
M7bBfs0XwFieuoXFFVpaZ9u/LwXNONmUyZV/m2iwYv83ks/Yd77Lcj0PuYBEV8DJEAH9ByUw69hI
Ba+Y+sRkbVmmao0b1EvzB5ho47tZySH4EbSighsN6IzgpeEcccrDLZBDw+6ZLH1BSDnIAHINgDkj
oTon7QfKMo80yrudZxN9Me1K2zV6zrOJ42SdPkdO07e9qxIWELtm6Bp3TCrguRZpZhSDTkrzb6uF
anDGm86Tq3U2o6Wqn0XWon8Xx2/59ec1UaV1xQe+Js57Pyk6dGsXeU7PTAppdVjb66jd8ebMoxhT
pcWlWqHPN2qxn9PU6w8CQNKuaM68xUbj7viXiO7IpwF6oSOv8zEsKm8Sd9w8UZ1A9Joqe4UpHz7D
1TeObgkCAwEAAaM5MDcwCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwHQYDVR0OBBYEFBv07DRCuotn
rFXyN120aKnYXlh7MA0GCSqGSIb3DQEBBQUAA4ICAQCV9xyZckJP0726P3p1uwE6rc5re7c9XTtG
UeqaNpRwNhw7/Lqdiw1ENgitpnOCvCPt+VoJj51iEcGUfGFmH4u5Ctw6tesiVN6j5YqUEB+EUm3+
J8jly6WOqYMWlQ1sPleF4eyCBUdtKK0NhPpAoJb0hKrR4Qu3keJHTwWX+BCg6Fe97UhlVXXa5TTo
8SCV1kCMQr+02VXIMOjVztgdMGWQOevig+0RA80HwOHEkYSgl45tIuZ1dyF8MotI7dayGS6vJq19
bM4J4Xi2cmFgIpK430JrNGtfNe/x08Z/kgU80Ah3AWb3V7hl3tPSsb+TsYyjJ+bU4iubzZ2+MYJb
U91avTkFX4xW8n+bt+/mB5a/itmNu2KYht6qkcP+57unH/D9H2ymBATwwlGhkYya7vmHQjd+nCdy
WdxgqI7RgZfxFcPYqU6aCemBdjk2swih5V6XN7pDjwYacGk7/nmmXi0mBOm8X1fJ0IDCDUvHDt0E
5RVJndf/7qMcBFZ94qDTORpZvYWw61TqgYvhF5Sl/uMM0HRC7kr0ZpBJS2S8RzX1smCOdAXQptKU
tOAPSz816irgJFjBbtBlblj34ZACrkAjJemAmtKn6l38bfhFD9tTkVUyRuNqwFQKWkzoGh6mMz7+
7batz2o8L7JsR3XxKUMxacMMQlZb2biZe/8rUIc0Lg==
-----END CERTIFICATE-----
lib/hx509/test_cert.in
-17
View File
@@ -47,23 +47,6 @@ for a in $srcdir/data/*.crt; do
${hxtool} print --content FILE:"$a" > /dev/null 2>/dev/null
done
echo "print certificate with 2338 notAfter"
${hxtool} print --content FILE:$srcdir/data/notafter-2338.pem > cert-2338.tmp || exit 1
config=$objdir/../../include/config.h
if grep '^#define SIZEOF_TIME_T 4$' "$config" > /dev/null; then
if grep '^#define TIME_T_UNSIGNED' "$config" > /dev/null; then
notafter='notAfter 2106-02-07 06:28:15'
else
notafter='notAfter 2038-01-19 03:14:07'
fi
else
notafter='notAfter 2338-01-19 03:14:08'
fi
grep "$notafter" cert-2338.tmp > /dev/null || {
cat cert-2338.tmp
exit 1
}
echo "print NULL"
${hxtool} print --content NULL: > /dev/null || exit 1
lib/hx509/test_cert_binary.c
-179
View File
@@ -1,179 +0,0 @@
#include "hx_locl.h"
#include <err.h>
#ifndef SRCDIR
#define SRCDIR "."
#endif
struct pem_cert {
heim_octet_string der;
int found;
};
static int
pem_cert_reader(hx509_context context, const char *type,
const hx509_pem_header *headers,
const void *data, size_t length, void *ctx)
{
struct pem_cert *pem = ctx;
(void)context;
(void)headers;
if (strcmp(type, "CERTIFICATE") != 0)
return 0;
if (pem->found)
return 0;
pem->der.data = malloc(length);
if (pem->der.data == NULL)
return ENOMEM;
memcpy(pem->der.data, data, length);
pem->der.length = length;
pem->found = 1;
return 0;
}
static void
read_cert_der(hx509_context context, const char *path, heim_octet_string *der)
{
struct pem_cert pem;
FILE *f;
int ret;
memset(&pem, 0, sizeof(pem));
f = fopen(path, "r");
if (f == NULL)
err(1, "fopen: %s", path);
ret = hx509_pem_read(context, f, pem_cert_reader, &pem);
fclose(f);
if (ret)
hx509_err(context, 1, ret, "hx509_pem_read: %s", path);
if (!pem.found)
errx(1, "did not find a certificate in %s", path);
*der = pem.der;
}
static void
compare_octet_string(const char *what,
const heim_octet_string *expected,
const heim_octet_string *actual)
{
if (actual->length != expected->length)
errx(1, "%s length changed from %lu to %lu",
what, (unsigned long)expected->length,
(unsigned long)actual->length);
if (memcmp(actual->data, expected->data, expected->length) != 0)
errx(1, "%s data changed", what);
}
static void
check_cert_binary(hx509_context context, const heim_octet_string *der)
{
heim_octet_string os;
hx509_cert cert;
int ret;
memset(&os, 0, sizeof(os));
cert = hx509_cert_init_data(context, der->data, der->length, NULL);
if (cert == NULL)
err(1, "hx509_cert_init_data");
ret = hx509_cert_binary(context, cert, &os);
if (ret)
hx509_err(context, 1, ret, "hx509_cert_binary");
compare_octet_string("certificate encoding", der, &os);
der_free_octet_string(&os);
hx509_cert_free(cert);
}
static char *
make_store_name(void)
{
char *store_name = NULL;
if (asprintf(&store_name, "FILE:%s/data/test.crt,%s/data/test.key",
SRCDIR, SRCDIR) == -1 || store_name == NULL)
err(1, "asprintf");
return store_name;
}
static void
check_keyless_store_cert_encoding(hx509_context context,
const heim_octet_string *der)
{
heim_octet_string os;
hx509_certs certs = NULL;
hx509_cert cert = NULL;
char *store_name;
int ret;
memset(&os, 0, sizeof(os));
ret = hx509_certs_init(context, "MEMORY:test-keyless-certs",
HX509_CERTS_NO_PRIVATE_KEYS, NULL, &certs);
if (ret)
hx509_err(context, 1, ret, "hx509_certs_init");
store_name = make_store_name();
ret = hx509_certs_append(context, certs, NULL, store_name);
free(store_name);
if (ret)
hx509_err(context, 1, ret, "hx509_certs_append");
ret = hx509_get_one_cert(context, certs, &cert);
if (ret)
hx509_err(context, 1, ret, "hx509_get_one_cert");
if (hx509_cert_have_private_key(cert))
errx(1, "HX509_CERTS_NO_PRIVATE_KEYS store kept a private key");
ret = hx509_cert_binary(context, cert, &os);
if (ret)
hx509_err(context, 1, ret, "hx509_cert_binary on keyless cert");
compare_octet_string("keyless store certificate encoding", der, &os);
der_free_octet_string(&os);
hx509_cert_free(cert);
hx509_certs_free(&certs);
}
int
main(int argc, char **argv)
{
heim_octet_string der;
hx509_context context;
char *cert_path = NULL;
int ret;
(void)argc;
(void)argv;
memset(&der, 0, sizeof(der));
ret = hx509_context_init(&context);
if (ret)
errx(1, "hx509_context_init failed with %d", ret);
if (asprintf(&cert_path, "%s/data/test.crt", SRCDIR) == -1 ||
cert_path == NULL)
err(1, "asprintf");
read_cert_der(context, cert_path, &der);
free(cert_path);
check_cert_binary(context, &der);
check_keyless_store_cert_encoding(context, &der);
der_free_octet_string(&der);
hx509_context_free(&context);
return 0;
}
lib/ipc/Makefile.am
+3 -13
View File
@@ -46,23 +46,14 @@ if have_gcd
# stops building on recent OS X releases unless we disable this warning.
WFLAGS += -Wno-deprecated-declarations
heim_ipc.stamp: heim_ipc.defs
heim_ipc.h heim_ipcUser.c heim_ipcServer.c heim_ipcServer.h: heim_ipc.defs
mig -header heim_ipc.h -user heim_ipcUser.c -sheader heim_ipcServer.h -server heim_ipcServer.c -I$(srcdir) $(srcdir)/heim_ipc.defs
touch $@
heim_ipc.h heim_ipcUser.c heim_ipcServer.c heim_ipcServer.h: heim_ipc.stamp
heim_ipc_async.stamp: heim_ipc_async.defs
heim_ipc_async.h heim_ipc_asyncUser.c heim_ipc_asyncServer.c heim_ipc_asyncServer.h: heim_ipc_async.defs
mig -header heim_ipc_async.h -user heim_ipc_asyncUser.c -sheader heim_ipc_asyncServer.h -server heim_ipc_asyncServer.c -I$(srcdir) $(srcdir)/heim_ipc_async.defs
touch $@
heim_ipc_async.h heim_ipc_asyncUser.c heim_ipc_asyncServer.c heim_ipc_asyncServer.h: heim_ipc_async.stamp
heim_ipc_reply.stamp: heim_ipc_reply.defs
heim_ipc_reply.h heim_ipc_replyUser.c: heim_ipc_reply.defs
mig -header heim_ipc_reply.h -user heim_ipc_replyUser.c -sheader /dev/null -server /dev/null -I$(srcdir) $(srcdir)/heim_ipc_reply.defs
touch $@
heim_ipc_reply.h heim_ipc_replyUser.c: heim_ipc_reply.stamp
built_ipcc = heim_ipc.h heim_ipcUser.c
built_ipcc += heim_ipc_asyncServer.c heim_ipc_asyncServer.h
@@ -78,7 +69,6 @@ nodist_libheim_ipcs_la_SOURCES = $(built_ipcs)
libheim_ipcs_la_LIBADD += -lbsm
CLEANFILES = $(built_ipcc) $(built_ipcs)
CLEANFILES += heim_ipc.stamp heim_ipc_async.stamp heim_ipc_reply.stamp
$(srcdir)/client.c: $(built_ipcc)
$(srcdir)/server.c: $(built_ipcs)
lib/ipc/hi_locl.h
+2
View File
@@ -41,6 +41,8 @@
#include <sys/un.h>
#endif
#include <poll.h>
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
lib/kadm5/ipropd_master.c
+38 -111
View File
@@ -86,46 +86,37 @@ make_signal_socket (krb5_context context)
#endif
}
static int
listen_port(krb5_context context, const char *port_str)
{
int port;
if (port_str) {
port = krb5_getportbyname(context, port_str, "tcp", 0);
if (port == 0) {
char *ptr;
long num;
num = strtol(port_str, &ptr, 10);
if (num == 0 && ptr == port_str)
krb5_errx(context, 1, "bad port `%s'", port_str);
port = htons(num);
}
} else {
port = krb5_getportbyname(context, IPROP_SERVICE,
"tcp", IPROP_PORT);
}
return port;
}
static krb5_socket_t
make_listen_socket(krb5_context context, int port)
make_listen_socket (krb5_context context, const char *port_str)
{
krb5_socket_t fd;
int one = 1;
struct sockaddr_in addr;
fd = socket(AF_INET, SOCK_STREAM, 0);
fd = socket (AF_INET, SOCK_STREAM, 0);
if (rk_IS_BAD_SOCKET(fd))
krb5_err (context, 1, rk_SOCK_ERRNO, "socket AF_INET");
(void) setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (void *)&one, sizeof(one));
memset (&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_port = port;
addr.sin_addr.s_addr = htonl(INADDR_ANY);
if (port_str) {
addr.sin_port = krb5_getportbyname (context,
port_str, "tcp",
0);
if (addr.sin_port == 0) {
char *ptr;
long port;
port = strtol (port_str, &ptr, 10);
if (port == 0 && ptr == port_str)
krb5_errx (context, 1, "bad port `%s'", port_str);
addr.sin_port = htons(port);
}
} else {
addr.sin_port = krb5_getportbyname (context, IPROP_SERVICE,
"tcp", IPROP_PORT);
}
if(bind(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0)
krb5_err (context, 1, errno, "bind");
if (listen(fd, SOMAXCONN) < 0)
@@ -133,64 +124,10 @@ make_listen_socket(krb5_context context, int port)
return fd;
}
#ifdef AF_INET6
static krb5_socket_t
make_listen_socket6(krb5_context context, int port)
{
krb5_socket_t fd;
int one = 1;
struct sockaddr_in6 addr;
fd = socket(AF_INET6, SOCK_STREAM, 0);
if (rk_IS_BAD_SOCKET(fd)) {
#ifdef EAFNOSUPPORT
if (rk_SOCK_ERRNO != EAFNOSUPPORT)
#endif
krb5_warn(context, rk_SOCK_ERRNO, "socket AF_INET6");
return rk_INVALID_SOCKET;
}
(void) setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (void *)&one, sizeof(one));
socket_set_ipv6only(fd, 1);
memset(&addr, 0, sizeof(addr));
addr.sin6_family = AF_INET6;
addr.sin6_port = port;
addr.sin6_addr = in6addr_any;
if (bind(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
krb5_warn(context, errno, "bind AF_INET6");
rk_closesocket(fd);
return rk_INVALID_SOCKET;
}
if (listen(fd, SOMAXCONN) < 0) {
krb5_warn (context, errno, "listen AF_INET6");
rk_closesocket(fd);
return rk_INVALID_SOCKET;
}
return fd;
}
#endif
static void
make_listen_sockets(krb5_context context, const char *port_str,
krb5_socket_t *fds, int *num_fds)
{
krb5_socket_t fd;
int port = listen_port(context, port_str);
*num_fds = 0;
#ifdef AF_INET6
fd = make_listen_socket6(context, port);
if (!rk_IS_BAD_SOCKET(fd))
fds[(*num_fds)++] = fd;
#endif
fds[(*num_fds)++] = make_listen_socket(context, port);
}
struct slave {
krb5_socket_t fd;
struct sockaddr_storage addr;
struct sockaddr_in addr;
char *name;
krb5_auth_context ac;
uint32_t version;
@@ -1677,14 +1614,13 @@ main(int argc, char **argv)
void *kadm_handle;
kadm5_server_context *server_context;
kadm5_config_params conf;
krb5_socket_t signal_fd, listen_fds[2];
krb5_socket_t signal_fd, listen_fd;
slave *slaves = NULL;
uint32_t current_version = 0, old_version = 0;
krb5_keytab keytab;
char **files;
int aret;
int optidx = 0;
int num_listen_fds = 0;
int restarter_fd = -1;
struct stat st;
@@ -1794,7 +1730,7 @@ main(int argc, char **argv)
&current_version, NULL);
signal_fd = make_signal_socket (context);
make_listen_sockets(context, port_str, listen_fds, &num_listen_fds);
listen_fd = make_listen_socket (context, port_str);
krb5_warnx(context, "ipropd-master started at version: %lu",
(unsigned long)current_version);
@@ -1806,28 +1742,22 @@ main(int argc, char **argv)
slave *p;
fd_set readset, writeset;
int max_fd = 0;
int nready;
int i;
struct timeval to = {30, 0};
uint32_t vers;
struct stat st2;
#ifndef NO_LIMIT_FD_SETSIZE
if (signal_fd >= FD_SETSIZE || restarter_fd >= FD_SETSIZE)
if (signal_fd >= FD_SETSIZE || listen_fd >= FD_SETSIZE ||
restarter_fd >= FD_SETSIZE)
krb5_errx (context, IPROPD_RESTART, "fd too large");
for (i = 0; i < num_listen_fds; i++)
if (listen_fds[i] >= FD_SETSIZE)
krb5_errx (context, IPROPD_RESTART, "fd too large");
#endif
FD_ZERO(&readset);
FD_ZERO(&writeset);
FD_SET(signal_fd, &readset);
max_fd = max(max_fd, signal_fd);
for (i = 0; i < num_listen_fds; i++) {
FD_SET(listen_fds[i], &readset);
max_fd = max(max_fd, listen_fds[i]);
}
FD_SET(listen_fd, &readset);
max_fd = max(max_fd, listen_fd);
if (restarter_fd > -1) {
FD_SET(restarter_fd, &readset);
max_fd = max(max_fd, restarter_fd);
@@ -1849,7 +1779,6 @@ main(int argc, char **argv)
else
krb5_err (context, IPROPD_RESTART, errno, "select");
}
nready = ret;
if (stat(server_context->log_context.log_file, &st2) == -1) {
krb5_warn(context, errno, "could not stat log file by path");
@@ -1872,7 +1801,7 @@ main(int argc, char **argv)
&current_version, NULL);
}
if (nready == 0) {
if (ret == 0) {
kadm5_log_get_version_fd(server_context, -1, LOG_VERSION_LAST,
&current_version, NULL);
@@ -1896,12 +1825,12 @@ main(int argc, char **argv)
}
}
if (nready && restarter_fd > -1 && FD_ISSET(restarter_fd, &readset)) {
if (ret && FD_ISSET(restarter_fd, &readset)) {
exit_flag = SIGTERM;
break;
}
if (nready && FD_ISSET(signal_fd, &readset)) {
if (ret && FD_ISSET(signal_fd, &readset)) {
#ifndef NO_UNIX_SOCKETS
struct sockaddr_un peer_addr;
#else
@@ -1914,8 +1843,8 @@ main(int argc, char **argv)
krb5_warn (context, errno, "recvfrom");
continue;
}
--nready;
assert(nready >= 0);
--ret;
assert(ret >= 0);
old_version = current_version;
kadm5_log_get_version_fd(server_context, -1, LOG_VERSION_LAST,
&current_version, NULL);
@@ -1972,9 +1901,9 @@ main(int argc, char **argv)
for(p = slaves; p != NULL; p = p->next) {
if (p->flags & SLAVE_F_DEAD)
continue;
if (nready && FD_ISSET(p->fd, &readset)) {
--nready;
assert(nready >= 0);
if (ret && FD_ISSET(p->fd, &readset)) {
--ret;
assert(ret >= 0);
ret = process_msg(server_context, p, database,
current_version);
if (ret && ret != EWOULDBLOCK) {
@@ -1987,12 +1916,10 @@ main(int argc, char **argv)
send_are_you_there (context, p);
}
for (i = 0; nready && i < num_listen_fds; i++) {
if (FD_ISSET(listen_fds[i], &readset)) {
add_slave(context, keytab, &slaves, listen_fds[i]);
--nready;
assert(nready >= 0);
}
if (ret && FD_ISSET(listen_fd, &readset)) {
add_slave (context, keytab, &slaves, listen_fd);
--ret;
assert(ret >= 0);
}
write_stats(context, slaves, current_version);
}
lib/kadm5/ipropd_slave.c
+11 -4
View File
@@ -124,14 +124,16 @@ connect_to_master (krb5_context context, const char *master,
}
static void
get_creds(krb5_context context, krb5_ccache *cache)
get_creds(krb5_context context, krb5_ccache *cache, const char *serverhost)
{
krb5_keytab keytab;
krb5_principal client;
krb5_error_code ret;
krb5_get_init_creds_opt *init_opts;
krb5_creds creds;
char *server;
char keytab_buf[256];
int aret;
if (no_keytab_flag) {
/* We're using an externally refreshed ccache */
@@ -174,8 +176,13 @@ get_creds(krb5_context context, krb5_ccache *cache)
ret = krb5_get_init_creds_opt_alloc(context, &init_opts);
if (ret) krb5_err(context, 1, ret, "krb5_get_init_creds_opt_alloc");
aret = asprintf (&server, "%s/%s", IPROP_NAME, serverhost);
if (aret == -1 || server == NULL)
krb5_errx (context, 1, "malloc: no memory");
ret = krb5_get_init_creds_keytab(context, &creds, client, keytab,
0, NULL, init_opts);
0, server, init_opts);
free (server);
krb5_get_init_creds_opt_free(context, init_opts);
if(ret) krb5_err(context, 1, ret, "krb5_get_init_creds");
@@ -883,7 +890,7 @@ main(int argc, char **argv)
if (ret)
krb5_err(context, 1, ret, "db->close");
get_creds(context, &ccache);
get_creds(context, &ccache, master);
ret = krb5_sname_to_principal (context, master, IPROP_NAME,
KRB5_NT_SRV_HST, &server);
@@ -949,7 +956,7 @@ main(int argc, char **argv)
krb5_auth_con_free(context, auth_context);
auth_context = NULL;
}
get_creds(context, &ccache);
get_creds(context, &ccache, master);
if (verbose)
krb5_warnx(context, "authenticating to master");
ret = krb5_sendauth (context, &auth_context, &master_fd,
lib/krb5/changepw.c
+30 -33
View File
@@ -704,30 +704,25 @@ change_password_loop (krb5_context context,
* do the SOCKS4a I/O.
*/
while (!_krb5_socks4a_connected(socks4a)) {
struct pollfd pfd;
fd_set readfds, writefds;
int nready;
pfd.fd = sock;
pfd.events = 0;
pfd.revents = 0;
FD_ZERO(&readfds);
FD_ZERO(&writefds);
if (_krb5_socks4a_reading(socks4a))
pfd.events |= POLLIN;
FD_SET(sock, &readfds);
if (_krb5_socks4a_writing(socks4a))
pfd.events |= POLLOUT;
nready = poll(&pfd, 1, -1); /* blocking */
if (nready < 0) {
if (errno == EINTR)
continue;
FD_SET(sock, &writefds);
nready = select(sock + 1, &readfds, &writefds,
/*exceptfds*/NULL, /*timeout*/NULL);
if (nready == -1) {
ret = errno;
break;
}
if (nready == 0) {
if (nready <= 0) {
ret = EIO; /* timeout should be impossible */
break;
}
ret = _krb5_socks4a_io(socks4a);
if (ret)
break;
@@ -738,6 +733,9 @@ change_password_loop (krb5_context context,
}
for (i = 0; !done && i < 5; ++i) {
fd_set fdset;
struct timeval tv;
if (!replied) {
replied = 0;
@@ -755,28 +753,27 @@ change_password_loop (krb5_context context,
}
}
struct pollfd pfd;
int timeout_ms;
timeout_ms = (1 + (1 << i)) * 1000;
pfd.fd = sock;
pfd.events = POLLIN;
pfd.revents = 0;
ret = poll(&pfd, 1, timeout_ms);
if (ret < 0) {
if (errno == EINTR)
continue;
rk_closesocket(sock);
ret = errno;
goto out;
#ifndef NO_LIMIT_FD_SETSIZE
if (sock >= FD_SETSIZE) {
ret = ERANGE;
krb5_set_error_message(context, ret,
"fd %d too large", sock);
rk_closesocket (sock);
goto out;
}
#endif
if (ret == 0) {
ret = KRB5_KDC_UNREACH;
continue;
FD_ZERO(&fdset);
FD_SET(sock, &fdset);
tv.tv_usec = 0;
tv.tv_sec = 1 + (1 << i);
ret = select (sock + 1, &fdset, NULL, NULL, &tv);
if (rk_IS_SOCKET_ERROR(ret) && rk_SOCK_ERRNO != EINTR) {
rk_closesocket(sock);
goto out;
}
if (pfd.revents & (POLLIN | POLLERR | POLLHUP | POLLNVAL)) {
if (ret == 1) {
ret = (*proc->process_rep) (context,
auth_context,
is_stream,
lib/krb5/context.c
+4 -4
View File
@@ -489,7 +489,7 @@ init_context_from_config_file(krb5_context context)
tmp = secure_getenv("KRB5_TRACE");
if (tmp)
heim_add_trace_dest(context->hcontext, "libkrb5", tmp);
heim_add_debug_dest(context->hcontext, "libkrb5", tmp);
s = krb5_config_get_strings(context, NULL, "logging", "krb5", NULL);
if (s) {
char **p;
@@ -1108,15 +1108,15 @@ krb5_kerberos_enctypes(krb5_context context)
};
static const krb5_enctype weak[] = {
ETYPE_AES256_CTS_HMAC_SHA384_192,
ETYPE_AES128_CTS_HMAC_SHA256_128,
ETYPE_AES256_CTS_HMAC_SHA1_96,
ETYPE_AES128_CTS_HMAC_SHA1_96,
ETYPE_AES256_CTS_HMAC_SHA384_192,
ETYPE_AES128_CTS_HMAC_SHA256_128,
ETYPE_ARCFOUR_HMAC_MD5,
ETYPE_NULL
};
if (krb5_enctype_valid(context, ETYPE_ARCFOUR_HMAC_MD5) == 0)
if (krb5_enctype_valid(context, ETYPE_ARCFOUR_HMAC_MD5))
return weak;
return strong;
lib/krb5/crypto.c
-16
View File
@@ -608,12 +608,8 @@ krb5_create_checksum(krb5_context context,
}
if (arcfour_checksum_p(ct, crypto)) {
#ifdef HEIM_ARCFOUR
keyusage = usage;
_krb5_usage2arcfour(context, &keyusage);
#else
return KRB5_PROG_SUMTYPE_NOSUPP;
#endif /* HEIM_ARCFOUR */
} else
keyusage = CHECKSUM_USAGE(usage);
@@ -742,12 +738,8 @@ krb5_verify_checksum(krb5_context context,
}
if (arcfour_checksum_p(ct, crypto)) {
#ifdef HEIM_ARCFOUR
keyusage = usage;
_krb5_usage2arcfour(context, &keyusage);
#else
return KRB5_PROG_SUMTYPE_NOSUPP;
#endif /* HEIM_ARCFOUR */
} else
keyusage = CHECKSUM_USAGE(usage);
@@ -2075,12 +2067,8 @@ krb5_create_checksum_iov(krb5_context context,
}
if (arcfour_checksum_p(ct, crypto)) {
#ifdef HEIM_ARCFOUR
keyusage = usage;
_krb5_usage2arcfour(context, &keyusage);
#else
return KRB5_PROG_SUMTYPE_NOSUPP;
#endif /* HEIM_ARCFOUR */
} else
keyusage = CHECKSUM_USAGE(usage);
@@ -2146,12 +2134,8 @@ krb5_verify_checksum_iov(krb5_context context,
}
if (arcfour_checksum_p(ct, crypto)) {
#ifdef HEIM_ARCFOUR
keyusage = usage;
_krb5_usage2arcfour(context, &keyusage);
#else
return KRB5_PROG_SUMTYPE_NOSUPP;
#endif /* HEIM_ARCFOUR */
} else
keyusage = CHECKSUM_USAGE(usage);
lib/krb5/fcache.c
+1 -1
View File
@@ -1081,6 +1081,7 @@ cred_delete(krb5_context context,
ret = krb5_storage_to_data(sp, &orig_cred_data);
if (ret)
goto out;
krb5_storage_free(sp);
cred_data_in_file = malloc(orig_cred_data.length);
if (cred_data_in_file == NULL)
@@ -1102,7 +1103,6 @@ cred_delete(krb5_context context,
goto out;
}
krb5_storage_free(sp);
sp = krb5_storage_emem();
if (sp == NULL)
goto out;
lib/krb5/get_cred.c
+1 -1
View File
@@ -645,7 +645,7 @@ get_cred_kdc(krb5_context context,
krb5_sendto_ctx stctx;
ret = krb5_sendto_ctx_alloc(context, &stctx);
if (ret)
goto out;
return ret;
krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
if (kdc_hostname)
lib/krb5/keytab_file.c
+4 -6
View File
@@ -381,12 +381,10 @@ fkt_start_seq_get_int(krb5_context context,
return ret;
}
rk_cloexec(c->fd);
if (exclusive) {
ret = _krb5_xlock(context, c->fd, exclusive, d->filename);
if (ret) {
close(c->fd);
return ret;
}
ret = _krb5_xlock(context, c->fd, exclusive, d->filename);
if (ret) {
close(c->fd);
return ret;
}
if ((flags & O_ACCMODE) == O_RDWR && (flags & O_APPEND))
stdio_mode = "ab+";
lib/krb5/krb5_init_context.3
+26 -6
View File
@@ -35,6 +35,7 @@
.Dt KRB5_CONTEXT 3
.Os HEIMDAL
.Sh NAME
.Nm krb5_add_et_list ,
.Nm krb5_add_extra_addresses ,
.Nm krb5_add_ignore_addresses ,
.Nm krb5_context ,
@@ -47,7 +48,7 @@
.Nm krb5_get_ignore_addresses ,
.Nm krb5_get_kdc_sec_offset ,
.Nm krb5_get_max_time_skew ,
.Nm krb5_get_use_admin_kdc ,
.Nm krb5_get_use_admin_kdc
.Nm krb5_init_context ,
.Nm krb5_init_ets ,
.Nm krb5_prepend_config_files ,
@@ -58,7 +59,7 @@
.Nm krb5_set_fcache_version ,
.Nm krb5_set_ignore_addresses ,
.Nm krb5_set_max_time_skew ,
.Nm krb5_set_use_admin_kdc
.Nm krb5_set_use_admin_kdc ,
.Nd create, modify and delete krb5_context structures
.Sh LIBRARY
Kerberos 5 Library (libkrb5, -lkrb5)
@@ -80,6 +81,11 @@ Kerberos 5 Library (libkrb5, -lkrb5)
.Fa "krb5_context context"
.Fc
.Ft krb5_error_code
.Fo krb5_add_et_list
.Fa "krb5_context context"
.Fa "void (*func)(struct et_list **)"
.Fc
.Ft krb5_error_code
.Fo krb5_add_extra_addresses
.Fa "krb5_context context"
.Fa "krb5_addresses *addresses"
@@ -198,11 +204,23 @@ or that Kerberos should not be used
.Bq ENXIO .
.Pp
.Fn krb5_init_ets
is retained for ABI compatibility.
It does not perform any action.
Any initialization it used to provide is done by
adds all
.Xr com_err 3
libs to
.Fa context .
This is done by
.Fn krb5_init_context .
.Pp
.Fn krb5_add_et_list
adds a
.Xr com_err 3
error-code handler
.Fa func
to the specified
.Fa context .
The error handler must generated by the the re-rentrant version of the
.Xr compile_et 1
program.
.Fn krb5_add_extra_addresses
add a list of addresses that should be added when requesting tickets.
.Pp
@@ -284,5 +302,7 @@ and
get and sets the maximum allowed time skew between client and server.
.Sh SEE ALSO
.Xr errno 2 ,
.Xr krb5.conf 5 ,
.Xr krb5 3 ,
.Xr krb5_config 3 ,
.Xr krb5_context 3 ,
.Xr kerberos 8
lib/krb5/krb5_verify_init_creds.3
+4 -6
View File
@@ -91,13 +91,11 @@ cleans the the structure, must be used before trying to pass it in to
.Fn krb5_verify_init_creds .
.Pp
.Fn krb5_verify_init_creds_opt_set_ap_req_nofail
controls the behavior if
controls controls the behavior if
.Fa ap_req_server
does not exist in the local keytab or in the KDC's database.
If it is true, those errors will not be ignored.
Errors from AP_REQ verification with a present key, such as an integrity
check failure, are always returned.
Note that ignoring the error is possibly insecure.
doesn't exists in the local keytab or in the KDC's database, if it's
true, the error will be ignored. Note that this use is possible
insecure.
.Sh SEE ALSO
.Xr krb5 3 ,
.Xr krb5_get_init_creds 3 ,
lib/krb5/krb5_verify_user.3
+5
View File
@@ -231,6 +231,11 @@ main(int argc, char **argv)
}
.Ed
.Sh SEE ALSO
.Xr krb5_cc_gen_new 3 ,
.Xr krb5_cc_initialize 3 ,
.Xr krb5_cc_resolve 3 ,
.Xr krb5_err 3 ,
.Xr krb5_free_principal 3 ,
.Xr krb5_init_context 3 ,
.Xr krb5_kt_default 3 ,
.Xr krb5.conf 5
lib/krb5/krcache.c
+19 -25
View File
@@ -1193,35 +1193,29 @@ krcc_get_next(krb5_context context,
if (krcursor == NULL)
return KRB5_CC_END;
for (;;) {
if (krcursor->currkey >= krcursor->numkeys)
return KRB5_CC_END;
/*
* If we're pointing at the entry with the principal, or at the key
* with the time offsets, skip it.
*/
while (krcursor->keys[krcursor->currkey] == krcursor->princ_id ||
krcursor->keys[krcursor->currkey] == krcursor->offsets_id) {
krcursor->currkey++;
if (krcursor->currkey >= krcursor->numkeys)
return KRB5_CC_END;
/*
* If we're pointing at the entry with the principal, or at the key
* with the time offsets, skip it.
*/
while (krcursor->keys[krcursor->currkey] == krcursor->princ_id ||
krcursor->keys[krcursor->currkey] == krcursor->offsets_id) {
krcursor->currkey++;
if (krcursor->currkey >= krcursor->numkeys)
return KRB5_CC_END;
}
ret = keyctl_read_krb5_data(krcursor->keys[krcursor->currkey],
&payload);
krcursor->currkey++;
if (ret == KRB5_FCC_NOFILE)
continue;
if (ret) {
_krb5_debug(context, 10, "Error reading key %d: %s\n",
krcursor->keys[krcursor->currkey - 1],
strerror(errno));
return ret;
}
break;
}
ret = keyctl_read_krb5_data(krcursor->keys[krcursor->currkey], &payload);
if (ret) {
_krb5_debug(context, 10, "Error reading key %d: %s\n",
krcursor->keys[krcursor->currkey],
strerror(errno));
return ret;
}
krcursor->currkey++;
sp = krb5_storage_from_data(&payload);
if (sp == NULL) {
ret = KRB5_CC_IO;
lib/krb5/send_to_kdc.c
+53 -69
View File
@@ -1084,6 +1084,13 @@ submit_request(krb5_context context, krb5_sendto_ctx ctx, krb5_krbhst_info *hi)
continue;
rk_cloexec(fd);
#ifndef NO_LIMIT_FD_SETSIZE
if (fd >= FD_SETSIZE) {
_krb5_debug(context, 0, "fd too large for select");
rk_closesocket(fd);
continue;
}
#endif
socket_set_nonblocking(fd, 1);
host = heim_alloc(sizeof(*host), "sendto-host", deallocate_host);
@@ -1155,11 +1162,9 @@ submit_request(krb5_context context, krb5_sendto_ctx ctx, krb5_krbhst_info *hi)
struct wait_ctx {
krb5_context context;
krb5_sendto_ctx ctx;
struct pollfd *pfds;
struct host **hosts;
nfds_t nfds;
fd_set rfds;
fd_set wfds;
rk_socket_t max_fd;
int got_reply;
time_t timenow;
};
@@ -1170,8 +1175,6 @@ wait_setup(heim_object_t obj, void *iter_ctx, int *stop)
struct wait_ctx *wait_ctx = iter_ctx;
struct host *h = (struct host *)obj;
short events = 0;
if (h->state == CONNECT) {
if (h->timeout >= wait_ctx->timenow)
return;
@@ -1195,32 +1198,31 @@ wait_setup(heim_object_t obj, void *iter_ctx, int *stop)
host_connected(wait_ctx->context, wait_ctx->ctx, h);
}
}
#ifndef NO_LIMIT_FD_SETSIZE
heim_assert(h->fd < FD_SETSIZE, "fd too large");
#endif
switch (h->state) {
case WAITING_REPLY:
events |= POLLIN;
FD_SET(h->fd, &wait_ctx->rfds);
break;
case CONNECTING:
case CONNECTED:
events |= POLLIN | POLLOUT;
FD_SET(h->fd, &wait_ctx->rfds);
FD_SET(h->fd, &wait_ctx->wfds);
break;
case PROXYING:
if (_krb5_socks4a_reading(h->socks4a))
events |= POLLIN;
FD_SET(h->fd, &wait_ctx->rfds);
if (_krb5_socks4a_writing(h->socks4a))
events |= POLLOUT;
FD_SET(h->fd, &wait_ctx->wfds);
break;
default:
debug_host(wait_ctx->context, 5, h, "invalid sendto host state");
heim_abort("invalid sendto host state");
}
wait_ctx->pfds[wait_ctx->nfds].fd = h->fd;
wait_ctx->pfds[wait_ctx->nfds].events = events;
wait_ctx->pfds[wait_ctx->nfds].revents = 0;
wait_ctx->hosts[wait_ctx->nfds] = h;
wait_ctx->nfds++;
if (h->fd > wait_ctx->max_fd || wait_ctx->max_fd == rk_INVALID_SOCKET)
wait_ctx->max_fd = h->fd;
}
static int
@@ -1240,39 +1242,39 @@ wait_accelerate(heim_object_t obj, void *ctx, int *stop)
}
static void
wait_process(struct wait_ctx *wait_ctx)
wait_process(heim_object_t obj, void *ctx, int *stop)
{
for (nfds_t i = 0; i < wait_ctx->nfds; i++) {
struct host *h = wait_ctx->hosts[i];
struct pollfd *pfd = &wait_ctx->pfds[i];
struct wait_ctx *wait_ctx = ctx;
struct host *h = (struct host *)obj;
int readable, writeable;
heim_assert(h->state != DEAD, "dead host resurected");
int readable = pfd->revents & (POLLIN | POLLERR | POLLHUP | POLLNVAL);
int writeable = pfd->revents & POLLOUT;
#ifndef NO_LIMIT_FD_SETSIZE
heim_assert(h->fd < FD_SETSIZE, "fd too large");
#endif
readable = FD_ISSET(h->fd, &wait_ctx->rfds);
writeable = FD_ISSET(h->fd, &wait_ctx->wfds);
if (readable || writeable || h->state == CONNECT)
wait_ctx->got_reply |= eval_host_state(
wait_ctx->context,
wait_ctx->ctx,
h,
readable,
writeable
);
if (readable || writeable || h->state == CONNECT)
wait_ctx->got_reply |= eval_host_state(wait_ctx->context, wait_ctx->ctx, h, readable, writeable);
if (wait_ctx->got_reply)
return;
}
/* if there is already a reply, just fall though the array */
if (wait_ctx->got_reply)
*stop = 1;
}
static krb5_error_code
wait_response(krb5_context context, int *action, krb5_sendto_ctx ctx)
{
struct wait_ctx wait_ctx;
struct timeval tv;
int ret;
memset(&wait_ctx, 0, sizeof(wait_ctx));
wait_ctx.context = context;
wait_ctx.ctx = ctx;
FD_ZERO(&wait_ctx.rfds);
FD_ZERO(&wait_ctx.wfds);
wait_ctx.max_fd = rk_INVALID_SOCKET;
/* oh, we have a reply, it must be a plugin that got it for us */
if (ctx->response.length) {
@@ -1282,8 +1284,10 @@ wait_response(krb5_context context, int *action, krb5_sendto_ctx ctx)
wait_ctx.timenow = time(NULL);
size_t max_hosts = heim_array_get_length(ctx->hosts);
if (max_hosts == 0) {
heim_array_iterate_f(ctx->hosts, &wait_ctx, wait_setup);
heim_array_filter_f(ctx->hosts, &wait_ctx, wait_filter_dead);
if (heim_array_get_length(ctx->hosts) == 0) {
if (ctx->stateflags & KRBHST_COMPLETED) {
_krb5_debug(context, 5, "no more hosts to send/recv packets to/from "
"trying to pulling more hosts");
@@ -1296,18 +1300,7 @@ wait_response(krb5_context context, int *action, krb5_sendto_ctx ctx)
return 0;
}
wait_ctx.pfds = calloc(max_hosts, sizeof(struct pollfd));
wait_ctx.hosts = calloc(max_hosts, sizeof(struct host *));
if (!wait_ctx.pfds || !wait_ctx.hosts) {
free(wait_ctx.pfds);
free(wait_ctx.hosts);
return ENOMEM;
}
heim_array_filter_f(ctx->hosts, &wait_ctx, wait_filter_dead);
heim_array_iterate_f(ctx->hosts, &wait_ctx, wait_setup);
if (wait_ctx.nfds == 0) {
if (wait_ctx.max_fd == rk_INVALID_SOCKET) {
/*
* If we don't find a host which can make progress, then
* we accelerate the process by moving all of the contestants
@@ -1315,36 +1308,27 @@ wait_response(krb5_context context, int *action, krb5_sendto_ctx ctx)
*/
_krb5_debug(context, 5, "wait_response: moving the contestants forward");
heim_array_iterate_f(ctx->hosts, &wait_ctx, wait_accelerate);
free(wait_ctx.pfds);
free(wait_ctx.hosts);
return 0;
}
ret = poll(wait_ctx.pfds, wait_ctx.nfds, 1000); /* 1s */
tv.tv_sec = 1;
tv.tv_usec = 0;
if (ret < 0) {
free(wait_ctx.pfds);
free(wait_ctx.hosts);
return errno;
}
ret = select(wait_ctx.max_fd + 1, &wait_ctx.rfds, &wait_ctx.wfds, NULL, &tv);
if (ret < 0)
return errno;
if (ret == 0) {
*action = KRB5_SENDTO_TIMEOUT;
free(wait_ctx.pfds);
free(wait_ctx.hosts);
return 0;
*action = KRB5_SENDTO_TIMEOUT;
return 0;
}
wait_ctx.got_reply = 0;
wait_process(&wait_ctx);
heim_array_iterate_f(ctx->hosts, &wait_ctx, wait_process);
if (wait_ctx.got_reply)
*action = KRB5_SENDTO_FILTER;
else
*action = KRB5_SENDTO_CONTINUE;
free(wait_ctx.pfds);
free(wait_ctx.hosts);
return 0;
}
lib/krb5/test_cc.c
+1 -2294
View File
File diff suppressed because it is too large Load Diff
lib/krb5/test_config.c
-37
View File
@@ -239,47 +239,10 @@ check_escaped_strings(void)
krb5_free_context(context);
}
static void
check_dash_underscore(void)
{
krb5_context context;
krb5_config_section *c = NULL;
krb5_error_code ret;
const char *s;
char **ps;
ret = krb5_init_context(&context);
if (ret)
errx(1, "krb5_init_context %d", ret);
ret = krb5_config_parse_file(context, "test_config_strings.out", &c);
if (ret)
krb5_errx(context, 1, "krb5_config_parse_file()");
s = krb5_config_get_string(context, c, "dash-test", "final-value", NULL);
if (s == NULL || strcmp(s, "through-section") != 0)
errx(1, "dash/underscore lookup failed");
ps = krb5_config_get_strings(context, c, "dash-test", "same-name", NULL);
if (ps == NULL ||
ps[0] == NULL || strcmp(ps[0], "first") != 0 ||
ps[1] == NULL || strcmp(ps[1], "second") != 0 ||
ps[2] != NULL)
errx(1, "dash/underscore iteration failed");
krb5_config_free_strings(ps);
ret = krb5_config_file_free(context, c);
if (ret)
krb5_errx(context, 1, "krb5_config_file_free()");
krb5_free_context(context);
}
int
main(int argc, char **argv)
{
check_config_files();
check_escaped_strings();
check_dash_underscore();
return 0;
}
lib/krb5/test_config_strings.cfg
-5
View File
@@ -10,8 +10,3 @@
internal2 = "TownOf Sandwich: Massachusetts"Oldest Town In "Cape Cod"
internal3 = "Begins and"ends In One String
longer_strings = "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:" "1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer." "2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution." "3. Neither the name of the Institute nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission." "THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." "Why do we test with such long strings? Because some people have config files" That look "Like this."
[dash_test]
final_value = through-section
same_name = first
same-name = second
lib/krb5/test_keytab.c
-90
View File
@@ -63,89 +63,6 @@ test_empty_keytab(krb5_context context, const char *keytab)
krb5_err(context, 1, ret, "krb5_kt_close");
}
static void
test_verify_user_empty_keytab(krb5_context context, const char *keytab)
{
krb5_error_code ret;
krb5_keytab id;
krb5_principal principal;
krb5_verify_opt opt;
ret = krb5_kt_resolve(context, keytab, &id);
if (ret)
krb5_err(context, 1, ret, "krb5_kt_resolve");
ret = krb5_parse_name(context, "lha@SU.SE", &principal);
if (ret)
krb5_err(context, 1, ret, "krb5_parse_name");
krb5_verify_opt_init(&opt);
krb5_verify_opt_set_keytab(&opt, id);
ret = krb5_verify_user_opt(context, principal, "password", &opt);
if (ret != KRB5_KT_NOTFOUND)
krb5_errx(context, 1,
"krb5_verify_user_opt returned %d, expected %d",
(int)ret, (int)KRB5_KT_NOTFOUND);
krb5_free_principal(context, principal);
ret = krb5_kt_close(context, id);
if (ret)
krb5_err(context, 1, ret, "krb5_kt_close");
}
static void
test_verify_user_wrong_keytab(krb5_context context, const char *keytab)
{
krb5_error_code ret;
krb5_keytab id;
krb5_keytab_entry entry;
krb5_principal principal;
krb5_verify_opt opt;
ret = krb5_kt_resolve(context, keytab, &id);
if (ret)
krb5_err(context, 1, ret, "krb5_kt_resolve");
memset(&entry, 0, sizeof(entry));
ret = krb5_parse_name(context, "not-host/foo@SU.SE", &entry.principal);
if (ret)
krb5_err(context, 1, ret, "krb5_parse_name");
entry.vno = 1;
ret = krb5_generate_random_keyblock(context,
ETYPE_AES256_CTS_HMAC_SHA1_96,
&entry.keyblock);
if (ret)
krb5_err(context, 1, ret, "krb5_generate_random_keyblock");
ret = krb5_kt_add_entry(context, id, &entry);
if (ret)
krb5_err(context, 1, ret, "krb5_kt_add_entry");
ret = krb5_parse_name(context, "lha@SU.SE", &principal);
if (ret)
krb5_err(context, 1, ret, "krb5_parse_name");
krb5_verify_opt_init(&opt);
krb5_verify_opt_set_keytab(&opt, id);
ret = krb5_verify_user_opt(context, principal, "password", &opt);
if (ret != KRB5_KT_NOTFOUND)
krb5_errx(context, 1,
"krb5_verify_user_opt returned %d, expected %d",
(int)ret, (int)KRB5_KT_NOTFOUND);
krb5_free_principal(context, principal);
krb5_kt_remove_entry(context, id, &entry);
krb5_free_principal(context, entry.principal);
krb5_free_keyblock_contents(context, &entry.keyblock);
ret = krb5_kt_close(context, id);
if (ret)
krb5_err(context, 1, ret, "krb5_kt_close");
}
/*
* Test that memory keytab are refcounted.
*/
@@ -364,13 +281,6 @@ main(int argc, char **argv)
test_empty_keytab(context, "MEMORY:foo");
test_empty_keytab(context, "FILE:foo");
ret = krb5_set_default_realm(context, "SU.SE");
if (ret)
krb5_err(context, 1, ret, "krb5_set_default_realm");
test_verify_user_empty_keytab(context, "MEMORY:verify-user-empty");
test_verify_user_wrong_keytab(context, "MEMORY:verify-user-wrong");
test_memory_keytab(context, "MEMORY:foo", "MEMORY:foo2");
}
lib/krb5/test_time.c
+2 -2
View File
@@ -57,8 +57,8 @@ check_set_time(krb5_context context)
diff2 = krb5_time_abs(sec, tv.tv_sec);
if (diff2 < 9 || diff > 11)
krb5_errx(context, 1, "set time error: diff: %lld",
(long long)krb5_time_abs(sec, tv.tv_sec));
krb5_errx(context, 1, "set time error: diff: %ld",
krb5_time_abs(sec, tv.tv_sec));
}
lib/krb5/verify_user.c
+1 -44
View File
@@ -33,40 +33,6 @@
#include "krb5_locl.h"
static krb5_error_code
check_server_keytab(krb5_context context, krb5_keytab keytab,
const char *service)
{
krb5_error_code ret, ret2;
krb5_keytab_entry entry;
krb5_keytab kt = keytab;
krb5_principal server;
ret = krb5_sname_to_principal(context, NULL, service, KRB5_NT_SRV_HST,
&server);
if (ret)
return ret;
if (kt == NULL) {
ret = krb5_kt_default(context, &kt);
if (ret)
goto out;
}
ret = krb5_kt_get_entry(context, kt, server, 0, 0, &entry);
if (ret == 0)
krb5_kt_free_entry(context, &entry);
if (keytab == NULL) {
ret2 = krb5_kt_close(context, kt);
if (ret == 0)
ret = ret2;
}
out:
krb5_free_principal(context, server);
return ret;
}
static krb5_error_code
verify_common (krb5_context context,
krb5_principal principal,
@@ -219,16 +185,7 @@ krb5_verify_user_opt(krb5_context context,
const char *password,
krb5_verify_opt *opt)
{
krb5_error_code ret = 0;
#define OPT(V, D) ((opt && (opt->V)) ? (opt->V) : (D))
if (opt == NULL || opt->secure) {
ret = check_server_keytab(context, OPT(keytab, NULL),
OPT(service, "host"));
}
#undef OPT
if (ret)
return ret;
krb5_error_code ret;
if(opt && (opt->flags & KRB5_VERIFY_LREALMS)) {
krb5_realm *realms, *r;
lib/libedit/COPYING
+30
View File
@@ -0,0 +1,30 @@
Copyright (c) 1992, 1993
The Regents of the University of California. All rights reserved.
This code is derived from software contributed to Berkeley by
Christos Zoulas of Cornell University.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. Neither the name of the University nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
lib/libedit/ChangeLog
+300
View File
@@ -0,0 +1,300 @@
* See also NetBSD changelog:
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libedit
2011-02-27 Jess Thrysoee
* version-info: 0:36:0
* all: sync with upstream source.
2010-04-24 Jess Thrysoee
* version-info: 0:35:0
* all: sync with upstream source.
Now with UTF-8 support. To enable this run 'configure --enable-widec'.
For now an UTF-32 encoded wchar_t is required.
This requirement is met on NetBSD, Solaris and OS X for any UTF-8 locale,
and any system that define __STDC_ISO_10646__ (e.g. GNU libc on Linux).
2009-09-23 Jess Thrysoee
* version-info: 0:34:0
* all: apply Apple patches from:
http://opensource.apple.com/source/libedit/libedit-11/patches
2009-09-05 Jess Thrysoee
* version-info: 0:33:0
* all: Use predefined macro __sun to identify Solaris
* src/el.c: Ignore comment lines in .editrc
2009-07-23 Jess Thrysoee
* version-info: 0:32:0
* all: sync with upstream source.
2009-06-10 Jess Thrysoee
* version-info: 0:31:0
* all: sync with upstream source.
2009-05-03 Jess Thrysoee
* version-info: 0:30:0
* all: sync with upstream source.
2009-04-05 Jess Thrysoee
* version-info: 0:29:0
* all: sync with upstream source.
2009-01-11 Jess Thrysoee
* version-info: 0:28:0
* all: sync with upstream source. MAJOR.MINOR version is now 3.0.
This is due to NetBSD changing time_t and dev_t to 64 bits. It does
not really effect this package.
* configure.ac: Remove '--enable-debug' configure flag. The autoconf way
to control flags is by specifying them when running configure,
e.g. 'CFLAGS="-O0 -g" ./configure'
2008-07-12 Jess Thrysoee
* version-info: 0:27:0
* configure.ac: Added '--enable-debug' configure flag, to produce debugging
information.
* examples/fileman.c: cast stat struct members, st_nlink and st_size,
appropriately (see also 'man 2 stat'). Patch by Alex Elder.
* all: sync with upstream source. MINOR version is now 11.
2007-08-31 Jess Thrysoee
* version-info: 0:26:0
* libedit.pc.in,Makefile.am,configure.ac,patches/extra_dist_list.sh:
Added pkg-config support for libedit. Patch by Masatake YAMATO.
2007-08-13 Jess Thrysoee
* version-info: 0:25:0
* all: sync with upstream source.
2007-03-02 Jess Thrysoee
* version-info: 0:24:0
* all: sync with upstream source.
2006-10-22 Jess Thrysoee
* version-info: 0:23:0
* src/shlib_version: Upstream bumped minor version from 9 to 10.
* all: sync with upstream source. More readline functions.
2006-10-22 Jess Thrysoee
* version-info: 0:22:0
* all: sync with upstream source.
2006-08-29 Jess Thrysoee
* version-info: 0:21:0
* all: License cleanup. All 4-clause advertising BSD licenses has been
changed to the 3-clause version by upstream.
* src/fgetln.c: use src/tools/compat/fgetln.c instead of
othersrc/libexec/tnftpd/libnetbsd/fgetln.c
2006-08-16 Jess Thrysoee
* version-info: 0:20:0
* all: sync with upstream source.
2006-06-03 Jess Thrysoee
* version-info: 0:19:0
* COPYING: added global license file
* all: sync with upstream source.
2006-02-13 Jess Thrysoee
* version-info: 0:18:0
* src/readline.c: Partial rl_getc_function support, patch by Kjeld Borch
Egevang.
* src/readline.c: Make write_history and read_history returncode readline
compatible. Upstream patch.
2006-01-03 Jess Thrysoee
* version-info: 0:17:0
* patches/cvs_export.sh: strlcat.c and strlcpy.c was moved to
src/common/lib/libc/string in the upstream cvs repository.
* all: sync with upstream source.
2005-10-22 Jess Thrysoee
* version-info: 0:16:0
* patches/*.patch, configure.ac: define SCCSID, undef LIBC_SCCS. Remove
fourteen cosmetic patches.
* all: sync with upstream source.
2005-09-11 Jess Thrysoee
* version-info: 0:15:0
* src/Makefile.am: fix typo that meant generated files were distributes,
and make generated file targets dependent on the the 'makelist' input
files.
* all: sync with upstream source. This is just a manpage update
2005-08-28 Jess Thrysoee
* version-info: 0:14:0
* src/sys.h: include config.h to avoid "redefinition of
`u_int32_t'". Patch by Norihiko Murase.
* src/search.c: explicitly include sys/types.h, because regex.h on
FreeBSD needs it and does not include it itself. Patch by Norihiko Murase.
* acinclude.m4: added EL_GETPW_R_DRAFT test and use AC_TRY_LINK instead
of AC_TRY_COMPILE. Suggested by Norihiko Murase.
* all: sync with upstream source.
2005-08-16 Jess Thrysoee
* version-info: 0:13:0
* all: sync with upstream source.
2005-08-05 Jess Thrysoee
* version-info: 0:12:0
* all: sync with upstream source.
2005-07-24 Jess Thrysoee
* version-info: 0:11:0
* histedit.h, histedit.c, readline.c, editline/readline.h: From
upstream; added remove_history().
2005-07-07 Jess Thrysoee
* version-info: 0:10:0
* history.c, key.c: From upstream source; Fix memory leaks found by
valgrind.
2005-06-28 Jess Thrysoee
* version-info: 0:9:0
* src/readline.c: getpwent_r is not POSIX, always use getpwent.
Reported by Gerrit P. Haase.
* src/Makefile.am: Added libtool -no-undefined. This is needed on Cygwin
to get a shared editline library. Should not affect other platforms.
Suggested by Gerrit P. Haase.
2005-06-15 Jess Thrysoee
* version-info: 0:8:0
* all: sync with upstream source.
2005-06-01 Jess Thrysoee
* version-info: 0:7:0
* all: sync with upstream source.
* src/readline.c, src/filecomplete.c: Solaris use POSIX draft versions
of getpwent_r, getpwnam_r and getpwuid_r which return 'struct passwd *'.
Define HAVE_GETPW_R_POSIX if these functions are (non draft) POSIX
compatible. Patch by Julien Torrès.
2005-05-28 Jess Thrysoee
* version-info: 0:6:0
* all: sync with upstream source.
2005-03-11 Jess Thrysoee
* version-info: 0:5:0
* all: sync with upstream source.
2004-12-07 Jess Thrysoee
* version-info: 0:4:0
* src/readline.c: d_namlen (in struct dirent) is not portable, always
use strlen. Patch by Scott Rankin.
2004-11-27 Jess Thrysoee
* version-info: 0:3:0
* src/history.c: bug #26785 fixed upstream, removed local patch.
2004-11-06 Jess Thrysoee
* version-info: 0:2:0
* all: sync with upstream source.
* doc/Makefile.am: If mdoc2man fails, remove empty file. Patch by
Darren Tucker.
2004-10-14 Jess Thrysoee
* version-info: 0:1:0
* doc/Makefile.am: 'make install' twice fails. Remove old links before
trying to link the man pages. Patch by Rick Richardson.
2004-09-28 Jess Thrysoee
* version-info: 0:0:0
* acinclude.m4 configure.ac src/Makefile.am: Adhere to
LibTools library interface versions recommendation.
http://www.gnu.org/software/libtool/manual.html#SEC32
* doc/Makefile.am: name all manpage links as el_* (e.g. el_history.3)
to avoid conflicts.
2004-09-08 Jess Thrysoee
* all: Initial package.
lib/libedit/INSTALL
+229
View File
@@ -0,0 +1,229 @@
Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002 Free Software
Foundation, Inc.
This file is free documentation; the Free Software Foundation gives
unlimited permission to copy, distribute and modify it.
Basic Installation
==================
These are generic installation instructions.
The `configure' shell script attempts to guess correct values for
various system-dependent variables used during compilation. It uses
those values to create a `Makefile' in each directory of the package.
It may also create one or more `.h' files containing system-dependent
definitions. Finally, it creates a shell script `config.status' that
you can run in the future to recreate the current configuration, and a
file `config.log' containing compiler output (useful mainly for
debugging `configure').
It can also use an optional file (typically called `config.cache'
and enabled with `--cache-file=config.cache' or simply `-C') that saves
the results of its tests to speed up reconfiguring. (Caching is
disabled by default to prevent problems with accidental use of stale
cache files.)
If you need to do unusual things to compile the package, please try
to figure out how `configure' could check whether to do them, and mail
diffs or instructions to the address given in the `README' so they can
be considered for the next release. If you are using the cache, and at
some point `config.cache' contains results you don't want to keep, you
may remove or edit it.
The file `configure.ac' (or `configure.in') is used to create
`configure' by a program called `autoconf'. You only need
`configure.ac' if you want to change it or regenerate `configure' using
a newer version of `autoconf'.
The simplest way to compile this package is:
1. `cd' to the directory containing the package's source code and type
`./configure' to configure the package for your system. If you're
using `csh' on an old version of System V, you might need to type
`sh ./configure' instead to prevent `csh' from trying to execute
`configure' itself.
Running `configure' takes awhile. While running, it prints some
messages telling which features it is checking for.
2. Type `make' to compile the package.
3. Optionally, type `make check' to run any self-tests that come with
the package.
4. Type `make install' to install the programs and any data files and
documentation.
5. You can remove the program binaries and object files from the
source code directory by typing `make clean'. To also remove the
files that `configure' created (so you can compile the package for
a different kind of computer), type `make distclean'. There is
also a `make maintainer-clean' target, but that is intended mainly
for the package's developers. If you use it, you may have to get
all sorts of other programs in order to regenerate files that came
with the distribution.
Compilers and Options
=====================
Some systems require unusual options for compilation or linking that
the `configure' script does not know about. Run `./configure --help'
for details on some of the pertinent environment variables.
You can give `configure' initial values for configuration parameters
by setting variables in the command line or in the environment. Here
is an example:
./configure CC=c89 CFLAGS=-O2 LIBS=-lposix
*Note Defining Variables::, for more details.
Compiling For Multiple Architectures
====================================
You can compile the package for more than one kind of computer at the
same time, by placing the object files for each architecture in their
own directory. To do this, you must use a version of `make' that
supports the `VPATH' variable, such as GNU `make'. `cd' to the
directory where you want the object files and executables to go and run
the `configure' script. `configure' automatically checks for the
source code in the directory that `configure' is in and in `..'.
If you have to use a `make' that does not support the `VPATH'
variable, you have to compile the package for one architecture at a
time in the source code directory. After you have installed the
package for one architecture, use `make distclean' before reconfiguring
for another architecture.
Installation Names
==================
By default, `make install' will install the package's files in
`/usr/local/bin', `/usr/local/man', etc. You can specify an
installation prefix other than `/usr/local' by giving `configure' the
option `--prefix=PATH'.
You can specify separate installation prefixes for
architecture-specific files and architecture-independent files. If you
give `configure' the option `--exec-prefix=PATH', the package will use
PATH as the prefix for installing programs and libraries.
Documentation and other data files will still use the regular prefix.
In addition, if you use an unusual directory layout you can give
options like `--bindir=PATH' to specify different values for particular
kinds of files. Run `configure --help' for a list of the directories
you can set and what kinds of files go in them.
If the package supports it, you can cause programs to be installed
with an extra prefix or suffix on their names by giving `configure' the
option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
Optional Features
=================
Some packages pay attention to `--enable-FEATURE' options to
`configure', where FEATURE indicates an optional part of the package.
They may also pay attention to `--with-PACKAGE' options, where PACKAGE
is something like `gnu-as' or `x' (for the X Window System). The
`README' should mention any `--enable-' and `--with-' options that the
package recognizes.
For packages that use the X Window System, `configure' can usually
find the X include and library files automatically, but if it doesn't,
you can use the `configure' options `--x-includes=DIR' and
`--x-libraries=DIR' to specify their locations.
Specifying the System Type
==========================
There may be some features `configure' cannot figure out
automatically, but needs to determine by the type of machine the package
will run on. Usually, assuming the package is built to be run on the
_same_ architectures, `configure' can figure that out, but if it prints
a message saying it cannot guess the machine type, give it the
`--build=TYPE' option. TYPE can either be a short name for the system
type, such as `sun4', or a canonical name which has the form:
CPU-COMPANY-SYSTEM
where SYSTEM can have one of these forms:
OS KERNEL-OS
See the file `config.sub' for the possible values of each field. If
`config.sub' isn't included in this package, then this package doesn't
need to know the machine type.
If you are _building_ compiler tools for cross-compiling, you should
use the `--target=TYPE' option to select the type of system they will
produce code for.
If you want to _use_ a cross compiler, that generates code for a
platform different from the build platform, you should specify the
"host" platform (i.e., that on which the generated programs will
eventually be run) with `--host=TYPE'.
Sharing Defaults
================
If you want to set default values for `configure' scripts to share,
you can create a site shell script called `config.site' that gives
default values for variables like `CC', `cache_file', and `prefix'.
`configure' looks for `PREFIX/share/config.site' if it exists, then
`PREFIX/etc/config.site' if it exists. Or, you can set the
`CONFIG_SITE' environment variable to the location of the site script.
A warning: not all `configure' scripts look for a site script.
Defining Variables
==================
Variables not defined in a site shell script can be set in the
environment passed to `configure'. However, some packages may run
configure again during the build, and the customized values of these
variables may be lost. In order to avoid this problem, you should set
them in the `configure' command line, using `VAR=value'. For example:
./configure CC=/usr/local2/bin/gcc
will cause the specified gcc to be used as the C compiler (unless it is
overridden in the site shell script).
`configure' Invocation
======================
`configure' recognizes the following options to control how it
operates.
`--help'
`-h'
Print a summary of the options to `configure', and exit.
`--version'
`-V'
Print the version of Autoconf used to generate the `configure'
script, and exit.
`--cache-file=FILE'
Enable the cache: use and save the results of the tests in FILE,
traditionally `config.cache'. FILE defaults to `/dev/null' to
disable caching.
`--config-cache'
`-C'
Alias for `--cache-file=config.cache'.
`--quiet'
`--silent'
`-q'
Do not print messages saying which checks are being made. To
suppress all normal output, redirect it to `/dev/null' (any error
messages will still be shown).
`--srcdir=DIR'
Look for the package's source code in directory DIR. Usually
`configure' can determine that directory automatically.
`configure' also accepts some other, not widely useful, options. Run
`configure --help' for more details.
lib/libedit/Makefile.am
+9
View File
@@ -0,0 +1,9 @@
AUTOMAKE_OPTIONS = foreign
#SUBDIRS = src examples doc
SUBDIRS = src
#EXTRA_DIST = libedit.pc.in
#pkgconfigdir = $(libdir)/pkgconfig
#pkgconfig_DATA = libedit.pc
lib/libedit/THANKS
+1
View File
@@ -0,0 +1 @@
Thanks to the NetBSD Project maintainers of libedit!
lib/libedit/acinclude.m4
+66
View File
@@ -0,0 +1,66 @@
dnl
dnl read lib version from file (and trim trailing newline)
dnl
define([EL_RELEASE], [patsubst(esyscmd([. src/shlib_version; echo $major.$minor]), [
])])
dnl
dnl read cvsexport timestamp from file (and trim trailing newline)
dnl
define([EL_TIMESTAMP], [patsubst(esyscmd([date +"%Y%m%d"]), [
])])
dnl
dnl NetBSD use the -mdoc macro package for manpages, but e.g.
dnl AIX and Solaris only support the -man package.
dnl
AC_DEFUN([EL_MANTYPE],
[
MANTYPE=
TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
if ${NROFF} -mdoc ${srcdir}/doc/editrc.5.roff >/dev/null 2>&1; then
MANTYPE=mdoc
fi
AC_SUBST(MANTYPE)
])
dnl
dnl Check if getpwnam_r and getpwuid_r are POSIX.1 compatible
dnl POSIX draft version returns 'struct passwd *' (used on Solaris)
dnl NOTE: getpwent_r is not POSIX so we always use getpwent
dnl
AC_DEFUN([EL_GETPW_R_POSIX],
[
AC_MSG_CHECKING([whether getpwnam_r and getpwuid_r are posix like])
# The prototype for the POSIX version is:
# int getpwnam_r(char *, struct passwd *, char *, size_t, struct passwd **)
# int getpwuid_r(uid_t, struct passwd *, char *, size_t, struct passwd **);
AC_TRY_LINK([#include <stdlib.h>
#include <sys/types.h>
#include <pwd.h>],
[getpwnam_r(NULL, NULL, NULL, (size_t)0, NULL);
getpwuid_r((uid_t)0, NULL, NULL, (size_t)0, NULL);],
[AC_DEFINE([HAVE_GETPW_R_POSIX], 1, [Define to 1 if you have getpwnam_r and getpwuid_r that are POSIX.1 compatible.])
AC_MSG_RESULT(yes)],
[AC_MSG_RESULT(no)])
])
AC_DEFUN([EL_GETPW_R_DRAFT],
[
AC_MSG_CHECKING([whether getpwnam_r and getpwuid_r are posix _draft_ like])
# The prototype for the POSIX draft version is:
# struct passwd *getpwuid_r(uid_t, struct passwd *, char *, int);
# struct passwd *getpwnam_r(char *, struct passwd *, char *, int);
AC_TRY_LINK([#include <stdlib.h>
#include <sys/types.h>
#include <pwd.h>],
[getpwnam_r(NULL, NULL, NULL, (size_t)0);
getpwuid_r((uid_t)0, NULL, NULL, (size_t)0);],
[AC_DEFINE([HAVE_GETPW_R_DRAFT], 1, [Define to 1 if you have getpwnam_r and getpwuid_r that are draft POSIX.1 versions.])
AC_MSG_RESULT(yes)],
[AC_MSG_RESULT(no)])
])
lib/libedit/config.h.in
+282
View File
@@ -0,0 +1,282 @@
/* config.h.in. Generated from configure.ac by autoheader. */
/* Define to 1 if you have the <curses.h> header file. */
#undef HAVE_CURSES_H
/* Define to 1 if you have the <dirent.h> header file, and it defines `DIR'.
*/
#undef HAVE_DIRENT_H
/* Define to 1 if you have the <dlfcn.h> header file. */
#undef HAVE_DLFCN_H
/* Define to 1 if you have the <fcntl.h> header file. */
#undef HAVE_FCNTL_H
/* Define to 1 if you have the `fork' function. */
#undef HAVE_FORK
/* Define to 1 if you have the `getline' function. */
#undef HAVE_GETLINE
/* Define to 1 if you have getpwnam_r and getpwuid_r that are draft POSIX.1
versions. */
#undef HAVE_GETPW_R_DRAFT
/* Define to 1 if you have getpwnam_r and getpwuid_r that are POSIX.1
compatible. */
#undef HAVE_GETPW_R_POSIX
/* Define to 1 if you have the <inttypes.h> header file. */
#undef HAVE_INTTYPES_H
/* Define to 1 if you have the `isascii' function. */
#undef HAVE_ISASCII
/* Define to 1 if you have the `issetugid' function. */
#undef HAVE_ISSETUGID
/* Define to 1 if you have the `curses' library (-lcurses). */
#undef HAVE_LIBCURSES
/* Define to 1 if you have the `ncurses' library (-lncurses). */
#undef HAVE_LIBNCURSES
/* Define to 1 if you have the `tinfo' library (-ltinfo). */
#undef HAVE_LIBTINFO
/* Define to 1 if you have the <limits.h> header file. */
#undef HAVE_LIMITS_H
/* Define to 1 if you have the <minix/config.h> header file. */
#undef HAVE_MINIX_CONFIG_H
/* Define to 1 if you have the <ncurses.h> header file. */
#undef HAVE_NCURSES_H
/* Define to 1 if you have the <ndir.h> header file, and it defines `DIR'. */
#undef HAVE_NDIR_H
/* Define to 1 if if your system has SIZE_MAX */
#undef HAVE_SIZE_MAX
/* Define to 1 if `stat' has the bug that it succeeds when given the
zero-length file name argument. */
#undef HAVE_STAT_EMPTY_STRING_BUG
/* Define to 1 if you have the <stdint.h> header file. */
#undef HAVE_STDINT_H
/* Define to 1 if you have the <stdio.h> header file. */
#undef HAVE_STDIO_H
/* Define to 1 if you have the <stdlib.h> header file. */
#undef HAVE_STDLIB_H
/* Define to 1 if you have the <strings.h> header file. */
#undef HAVE_STRINGS_H
/* Define to 1 if you have the <string.h> header file. */
#undef HAVE_STRING_H
/* Define to 1 if struct dirent has member d_namlen */
#undef HAVE_STRUCT_DIRENT_D_NAMLEN
/* Define to 1 if you have the <sys/cdefs.h> header file. */
#undef HAVE_SYS_CDEFS_H
/* Define to 1 if you have the <sys/dir.h> header file, and it defines `DIR'.
*/
#undef HAVE_SYS_DIR_H
/* Define to 1 if you have the <sys/ioctl.h> header file. */
#undef HAVE_SYS_IOCTL_H
/* Define to 1 if you have the <sys/ndir.h> header file, and it defines `DIR'.
*/
#undef HAVE_SYS_NDIR_H
/* Define to 1 if you have the <sys/param.h> header file. */
#undef HAVE_SYS_PARAM_H
/* Define to 1 if you have the <sys/stat.h> header file. */
#undef HAVE_SYS_STAT_H
/* Define to 1 if you have the <sys/types.h> header file. */
#undef HAVE_SYS_TYPES_H
/* Define to 1 if you have <sys/wait.h> that is POSIX.1 compatible. */
#undef HAVE_SYS_WAIT_H
/* Define to 1 if you have the <term.h> header file. */
#undef HAVE_TERM_H
/* Define to 1 if you have the <unistd.h> header file. */
#undef HAVE_UNISTD_H
/* Define to 1 if the system has the type `u_int32_t'. */
#undef HAVE_U_INT32_T
/* Define to 1 if you have the `vfork' function. */
#undef HAVE_VFORK
/* Define to 1 if you have the <vfork.h> header file. */
#undef HAVE_VFORK_H
/* Define to 1 if you have the <wchar.h> header file. */
#undef HAVE_WCHAR_H
/* Define to 1 if you have the `wcsdup' function. */
#undef HAVE_WCSDUP
/* Define to 1 if `fork' works. */
#undef HAVE_WORKING_FORK
/* Define to 1 if `vfork' works. */
#undef HAVE_WORKING_VFORK
/* Define to 1 if `lstat' dereferences a symlink specified with a trailing
slash. */
#undef LSTAT_FOLLOWS_SLASHED_SYMLINK
/* Define to the sub-directory where libtool stores uninstalled libraries. */
#undef LT_OBJDIR
/* Name of package */
#undef PACKAGE
/* Define to the address where bug reports for this package should be sent. */
#undef PACKAGE_BUGREPORT
/* Define to the full name of this package. */
#undef PACKAGE_NAME
/* Define to the full name and version of this package. */
#undef PACKAGE_STRING
/* Define to the one symbol short name of this package. */
#undef PACKAGE_TARNAME
/* Define to the home page for this package. */
#undef PACKAGE_URL
/* Define to the version of this package. */
#undef PACKAGE_VERSION
/* Define as the return type of signal handlers (`int' or `void'). */
#undef RETSIGTYPE
/* Define to 1 if all of the C90 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
backward compatibility; new code need not use it. */
#undef STDC_HEADERS
/* Enable extensions on AIX 3, Interix. */
#ifndef _ALL_SOURCE
# undef _ALL_SOURCE
#endif
/* Enable general extensions on macOS. */
#ifndef _DARWIN_C_SOURCE
# undef _DARWIN_C_SOURCE
#endif
/* Enable general extensions on Solaris. */
#ifndef __EXTENSIONS__
# undef __EXTENSIONS__
#endif
/* Enable GNU extensions on systems that have them. */
#ifndef _GNU_SOURCE
# undef _GNU_SOURCE
#endif
/* Enable X/Open compliant socket functions that do not require linking
with -lxnet on HP-UX 11.11. */
#ifndef _HPUX_ALT_XOPEN_SOCKET_API
# undef _HPUX_ALT_XOPEN_SOCKET_API
#endif
/* Identify the host operating system as Minix.
This macro does not affect the system headers' behavior.
A future release of Autoconf may stop defining this macro. */
#ifndef _MINIX
# undef _MINIX
#endif
/* Enable general extensions on NetBSD.
Enable NetBSD compatibility extensions on Minix. */
#ifndef _NETBSD_SOURCE
# undef _NETBSD_SOURCE
#endif
/* Enable OpenBSD compatibility extensions on NetBSD.
Oddly enough, this does nothing on OpenBSD. */
#ifndef _OPENBSD_SOURCE
# undef _OPENBSD_SOURCE
#endif
/* Define to 1 if needed for POSIX-compatible behavior. */
#ifndef _POSIX_SOURCE
# undef _POSIX_SOURCE
#endif
/* Define to 2 if needed for POSIX-compatible behavior. */
#ifndef _POSIX_1_SOURCE
# undef _POSIX_1_SOURCE
#endif
/* Enable POSIX-compatible threading on Solaris. */
#ifndef _POSIX_PTHREAD_SEMANTICS
# undef _POSIX_PTHREAD_SEMANTICS
#endif
/* Enable extensions specified by ISO/IEC TS 18661-5:2014. */
#ifndef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
# undef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-1:2014. */
#ifndef __STDC_WANT_IEC_60559_BFP_EXT__
# undef __STDC_WANT_IEC_60559_BFP_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-2:2015. */
#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
# undef __STDC_WANT_IEC_60559_DFP_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-4:2015. */
#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
# undef __STDC_WANT_IEC_60559_FUNCS_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-3:2015. */
#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
# undef __STDC_WANT_IEC_60559_TYPES_EXT__
#endif
/* Enable extensions specified by ISO/IEC TR 24731-2:2010. */
#ifndef __STDC_WANT_LIB_EXT2__
# undef __STDC_WANT_LIB_EXT2__
#endif
/* Enable extensions specified by ISO/IEC 24747:2009. */
#ifndef __STDC_WANT_MATH_SPEC_FUNCS__
# undef __STDC_WANT_MATH_SPEC_FUNCS__
#endif
/* Enable extensions on HP NonStop. */
#ifndef _TANDEM_SOURCE
# undef _TANDEM_SOURCE
#endif
/* Enable X/Open extensions. Define to 500 only if necessary
to make mbstate_t available. */
#ifndef _XOPEN_SOURCE
# undef _XOPEN_SOURCE
#endif
/* Version number of package */
#undef VERSION
/* Define to empty if `const' does not conform to ANSI C. */
#undef const
/* Define as a signed integer type capable of holding a process identifier. */
#undef pid_t
/* Define to `unsigned int' if <sys/types.h> does not define. */
#undef size_t
/* Define as `fork' if `vfork' does not work. */
#undef vfork
#include "sys.h"
#define SCCSID
#undef LIBC_SCCS
#define lint
lib/libedit/configure.ac
+111
View File
@@ -0,0 +1,111 @@
# -*- Autoconf -*-
# Process this file with autoconf to produce a configure script.
#
# Compile with debug symbols:
# CFLAGS="-ggdb -pedandic -O0" ./configure
# CFLAGS="-ggdb -Wall -Wextra -pedantic -O0" ./configure
#
# Verbose output can be enabled with
# "./configure --disable-silent-rules" or "make V=1"
#
AC_PREREQ(2.61)
AC_INIT(libedit, [EL_RELEASE],, libedit-[EL_TIMESTAMP])
AC_CONFIG_SRCDIR([src/el.c])
AC_CONFIG_HEADER([config.h])
# features of Posix that are extensions to C (define _GNU_SOURCE)
AC_USE_SYSTEM_EXTENSIONS
AM_INIT_AUTOMAKE
AM_MAINTAINER_MODE
AC_PROG_LIBTOOL
# libtool -version-info
AC_SUBST(LT_VERSION, [0:36:0])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
# Checks for programs.
AC_PROG_CC_C99
#AC_PROG_CC
AC_PROG_LN_S
AC_PROG_AWK
EL_MANTYPE
AC_CHECK_LIB(curses, tgetent,,
[AC_CHECK_LIB(ncurses, tgetent,,
[AC_CHECK_LIB(tinfo, tgetent,,
[AC_MSG_ERROR([libcurses, libncurses, or tinfo are required!])] )] )] )
# Checks for header files.
AC_HEADER_DIRENT
AC_HEADER_STDC
AC_HEADER_SYS_WAIT
AC_CHECK_HEADERS([fcntl.h limits.h stdint.h stdlib.h string.h sys/ioctl.h sys/param.h unistd.h curses.h ncurses.h sys/cdefs.h])
AC_CHECK_HEADER([termios.h], [], [AC_MSG_ERROR([termios.h is required!])],[])
## include curses.h to prevent "Present But Cannot Be Compiled"
AC_CHECK_HEADERS([term.h],,,
[[#if HAVE_CURSES_H
# include <curses.h>
#elif HAVE_NCURSES_H
# include <ncurses.h>
#endif
]])
# Checks for typedefs, structures, and compiler characteristics.
AC_C_CONST
AC_TYPE_PID_T
AC_TYPE_SIZE_T
AC_CHECK_TYPES([u_int32_t])
AC_TRY_COMPILE([
#include <limits.h>
#include <stddef.h>
#if HAVE_STDINT_H
# include <stdint.h>
#endif
],
[size_t x = SIZE_MAX;],
[have_size_max=yes],
[have_size_max=no])
if test "$have_size_max" = yes; then
AC_DEFINE([HAVE_SIZE_MAX], [1],
[Define to 1 if if your system has SIZE_MAX])
fi
# Checks for library functions.
AC_FUNC_FORK
AC_PROG_GCC_TRADITIONAL
## _AIX is offended by rpl_malloc and rpl_realloc
#AC_FUNC_MALLOC
#AC_FUNC_REALLOC
AC_TYPE_SIGNAL
AC_FUNC_STAT
AC_CHECK_FUNCS([getline isascii issetugid wcsdup])
EL_GETPW_R_POSIX
EL_GETPW_R_DRAFT
AC_CHECK_MEMBER(struct dirent.d_namlen,
AC_DEFINE([HAVE_STRUCT_DIRENT_D_NAMLEN],[1],
[Define to 1 if struct dirent has member d_namlen]),,
[#if HAVE_DIRENT_H
#include <dirent.h>
#endif
])
AH_BOTTOM([
#include "sys.h"
#define SCCSID
#undef LIBC_SCCS
#define lint
])
AC_CONFIG_FILES([Makefile
src/Makefile
])
AC_OUTPUT
lib/libedit/doc/Makefile.am
+33
View File
@@ -0,0 +1,33 @@
EL_MANS = editline.3 editrc.5
man_MANS = $(EL_MANS)
EL_MAN_LINKS = el_init.3 el_end.3 el_reset.3 el_gets.3 el_getc.3 \
el_push.3 el_parse.3 el_set.3 el_get.3 el_source.3 \
el_resize.3 el_line.3 el_insertstr.3 el_deletestr.3 \
el_history_init.3 el_history_end.3 el_history.3 el_tok_init.3 \
el_tok_end.3 el_tok_reset.3 el_tok_line.3 el_tok_str.3
install-data-hook: $(EL_MAN_LINKS)
$(EL_MAN_LINKS):
(cd $(DESTDIR)$(man3dir) && rm -f $@ && $(LN_S) editline.3 $@)
$(EL_MANS):
@if test "$(MANTYPE)" = "mdoc"; then\
cp $(srcdir)/$@.roff $@;\
else\
$(AWK) -f $(srcdir)/mdoc2man.awk $(srcdir)/$@.roff > $@ || rm -f $@;\
fi;
uninstall-local:
(cd $(DESTDIR)$(man3dir) && rm -f $(EL_MAN_LINKS))
CLEANFILES = $(EL_MANS)
EXTRA_DIST = editline.3.roff editrc.5.roff mdoc2man.awk
changelog.txt: ../ChangeLog
@sed 's/@/ (at)/g; s/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g;' $(srcdir)/$< > $@;

Some files were not shown because too many files have changed in this diff Show More