Commit Graph

169 Commits

Author SHA1 Message Date
Stanislav Sedov
cf771f223b - Update FreeBSD's Heimdal distribution to 1.5.2. This is a bugfix
release, which fixes a DoS issue in libkrb5.
2012-04-08 08:19:17 +00:00
Stanislav Sedov
72c3f707a4 - Add a "real" symbol version map to libasn1. The upstream version
of the version map just exported all the symbols, which caused a
  binutils bug being triggered when ld fails to link two objects, one
  of which exports a versioned version of the symbol, and another --
  unversioned. [1]
- Also add version map for libkafs5.

Submitted by:	jchandra@ (based on)
2012-04-08 04:22:09 +00:00
Juli Mallett
84db023ec1 Assume a big-endian default on MIPS and drop the "eb" suffix from MACHINE_ARCH.
This makes our naming scheme more closely match other systems and the
expectations of much third-party software.  MIPS builds which are little-endian
should require and exhibit no changes.  Big-endian TARGET_ARCHes must be
changed:
	From:		To:
	mipseb		mips
	mipsn32eb	mipsn32
	mips64eb	mips64

An entry has been added to UPDATING and some foot-shooting protection (complete
with warnings which should become errors in the near future) to the top-level
base system Makefile.
2012-03-29 02:54:35 +00:00
Stanislav Sedov
ba5e340b5f - Apply binutils workaround on mips.mips as well. Though this TARGET_ARCH
is deprecated, tinderbox uses it.
2012-03-24 00:42:38 +00:00
Stanislav Sedov
ae77177087 - Update FreeBSD Heimdal distribution to version 1.5.1. This also brings
several new kerberos related libraries and applications to FreeBSD:
  o kgetcred(1) allows one to manually get a ticket for a particular service.
  o kf(1) securily forwards ticket to another host through an authenticated
    and encrypted stream.
  o kcc(1) is an umbrella program around klist(1), kswitch(1), kgetcred(1)
    and other user kerberos operations. klist and kswitch are just symlinks
    to kcc(1) now.
  o kswitch(1) allows you to easily switch between kerberos credentials if
    you're running KCM.
  o hxtool(1) is a certificate management tool to use with PKINIT.
  o string2key(1) maps a password into key.
  o kdigest(8) is a userland tool to access the KDC's digest interface.
  o kimpersonate(8) creates a "fake" ticket for a service.

  We also now install manpages for some lirbaries that were not installed
  before, libheimntlm and libhx509.

- The new HEIMDAL version no longer supports Kerberos 4.  All users are
  recommended to switch to Kerberos 5.

- Weak ciphers are now disabled by default.  To enable DES support (used
  by telnet(8)), use "allow_weak_crypto" option in krb5.conf.

- libtelnet, pam_ksu and pam_krb5 are now compiled with error on warnings
  disabled due to the function they use (krb5_get_err_text(3)) being
  deprecated.  I plan to work on this next.

- Heimdal's KDC now require sqlite to operate.  We use the bundled version
  and install it as libheimsqlite.  If some other FreeBSD components will
  require it in the future we can rename it to libbsdsqlite and use for these
  components as well.

- This is not a latest Heimdal version, the new one was released while I was
  working on the update.  I will update it to 1.5.2 soon, as it fixes some
  important bugs and security issues.
2012-03-22 08:48:42 +00:00
Hajimu UMEMOTO
525f4cadd0 Don't support OpenLDAP during lib32 build. 2011-12-06 12:03:01 +00:00
Hajimu UMEMOTO
782ed6d3d7 - Make heimdal buildable with WITH_OPENLDAP defined, again.
- Our heimdal uses the deprecated OpenLDAP functions.
2011-12-05 16:38:52 +00:00
Max Khon
1b7955541f Link with -ledit instead of -lreadline. 2011-11-29 03:49:03 +00:00
Stanislav Sedov
611ff617cf - Add missing interdependencies to kerberos libraries. Some of the
kerberos libraries were not linked properly (missing dependencies),
  which causes 3rd party applications linking to fail when --as-needed
  ld flag is used.  I also added the --no-undefined ld(1) flag to make
  sure that there're no missing dependencies.

MFC after:	3 days
2011-09-27 07:14:12 +00:00
Marius Strobl
2d2ad9724a The kerberos5 tools are only used as build tools but not otherwise and
didn't get installed either.

MFC after:	1 week
2011-06-25 16:13:56 +00:00
Antoine Brodin
70834576fb Fix a typo.
MFC after:	1 month
2010-01-09 18:53:03 +00:00
Antoine Brodin
003fe9d2ee Fix a typo.
MFC after:	1 month
2010-01-09 18:51:50 +00:00
Alexander Nedotsukov
e62aa473c5 Link GSS mechanics modules against libgssapi so they will not fail due
unresolved symbol errors when in turn libgssapi was loaded with RTLD_LOCAL
flag set (which is the default).

Reviewed by:	dfr, jhb
MFC after:	3 days
2009-10-12 17:10:51 +00:00
Xin LI
ebd972d211 Disconnect closefrom.c as we have it as a system call. 2009-06-16 00:09:06 +00:00
Xin LI
04b7709ccf Now we have closefrom(). 2009-06-15 23:03:38 +00:00
Konstantin Belousov
20e76cb365 Add strndup(3) prototype to string.h.
This change was erronously ommitted from the r185690, and attempt
to simply add the prototype to string.h has revealed that several
contributed programs defined local prototypes for strndup(), controlled
by autoconfed config.h. So, manually change #undef HAVE_STRNDUP to
#define HAVE_STRNDUP 1. Next import of the corresponding program would
regenerate config.h, overriding the changes in this commit.

No objections from: kan
2008-12-08 21:04:24 +00:00
Doug Rabson
8f55a568f6 Add an implementation of the RPCSEC_GSS authentication protocol for RPC. This
is based on an old implementation from the University of Michigan with lots of
changes and fixes by me and the addition of a Solaris-compatible API.

Sponsored by:	Isilon Systems
Reviewed by:	alfred
2008-08-06 14:02:05 +00:00
Marius Strobl
82abac5ecf Add roken.h to SRCS. This fixes the compilation of slc during a
buildworld on a host running a world built with WITHOUT_KERBEROS
defined.
2008-06-18 21:20:50 +00:00
Doug Rabson
ebe306f11c Add the hx509 error table. 2008-05-15 08:53:31 +00:00
Doug Rabson
1f95816c41 Add manpage links to krb5_principal.3. 2008-05-11 10:32:37 +00:00
Doug Rabson
ed62b7f321 Don't try to make links to manpages that no longer exist. Fixes installworld
Submitted by: phk
2008-05-11 08:27:17 +00:00
Doug Rabson
e5dc3b75b8 Update magic sed script for heimdal-1.1 2008-05-09 13:27:20 +00:00
Doug Rabson
d7135570b3 Update heimdal_version.
Pointed out by: antoine@
2008-05-08 13:11:34 +00:00
Doug Rabson
33f1219925 Fix conflicts after heimdal-1.1 import and add build infrastructure. Import
all non-style changes made by heimdal to our own libgssapi.
2008-05-07 13:53:12 +00:00
Ken Smith
c0bb7d9461 While checking over the libraries for 7.0-REL Kris found the following
libraries had not had their versions bumped relative to 6.3-REL but
had indeed been changed.  We need to bump their version so they can be
properly added to the compat6x port:

	libasn1.so.8 libgssapi.so.8 libhdb.so.8 libkadm5clnt.so.8
	libkadm5srv.so.8 libkafs5.so.8 libkrb5.so.8 libobjc.so.2

MFC After:	1 day
2007-11-20 04:20:32 +00:00
Peter Wemm
acba71341c Remove _FREEFALL_CONFIG hacks 2007-10-18 19:42:50 +00:00
Alexander Kabaev
a3c734cc52 Fix generator glue to only expose extern struct units %s_units[] is
struct units defintition it known. The above construct is treated
as an incorrect C by GCC 4.2 otherwise.
2007-05-19 03:29:37 +00:00
Yaroslav Tykhiy
ea8079033e Kerberos/Heimdal doesn't really depend on the INET6 macro.
In the Heimdal distro, only kerberized telnet refers to INET6,
but we don't build it, we use contrib/telnet linked with the
Kerberos libs instead.

Tested with:	cmp(1)
2006-07-28 06:33:27 +00:00
Hajimu UMEMOTO
794063c03f Bump library majro version for gethostbyaddr(3). 2006-05-21 15:15:21 +00:00
Ruslan Ermilov
e1fe3dba5c Reimplementation of world/kernel build options. For details, see:
http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by:	imp, jhb, kris, phk, ru (all bugs are mine)
2006-03-17 18:54:44 +00:00
Ruslan Ermilov
d1e9def254 NO_MAN is not needed here. 2006-03-16 15:18:17 +00:00
Doug Rabson
c0b9f4fe65 Add a new extensible GSS-API layer which can support GSS-API plugins,
similar the the Solaris implementation. Repackage the krb5 GSS mechanism
as a plugin library for the new implementation. This also includes a
comprehensive set of manpages for the GSS-API functions with text mostly
taken from the RFC.

Reviewed by: Love Hörnquist Åstrand <lha@it.su.se>, ru (build system), des (openssh parts)
2005-12-29 14:40:22 +00:00
Ruslan Ermilov
3a30b28fe9 Apply the .PHONY attribute to the ../make*/make* targets. This
causes them to be recreated (if needed) early, when doing "make
depend" here, before generating headers that depend on them.
This should fix breakages often seen while doing incremental
(NO_CLEAN) cross-builds.
2005-11-10 21:03:58 +00:00
Ken Smith
a84020c2b9 Bump the shared library version number of all libraries that have not
been bumped since RELENG_5.

Reviewed by:	ru
Approved by:	re (not needed for commit check but in principle...)
2005-07-22 17:19:05 +00:00
Ken Smith
2672e71736 This is sort of an MFS. Peter made these changes to the RELENG_*
branches but missed HEAD.  This patch extends his a little bit,
setting it up via the Makefiles so that adding _FREEFALL_CONFIG
to /etc/make.conf is the only thing needed to cluster-ize things
(current setup also requires overriding CFLAGS).

From Peter's commit to the RELENG_* branches:
> Add the freebsd.org custer's source modifications under #ifdefs to aid
> keeping things in sync.  For ksu:
> * install suid-root by default
> * don't fall back to asking for a unix password (ie: be pure kerberos)
> * allow custom user instances for things like www and not just root

The Makefile tweaks will be MFC-ed, the rest is already done.

MFC after:      3 days
Approved by:    re (dwhite)
2005-07-07 14:16:38 +00:00
Dag-Erling Smørgrav
ee66677a7a Remove kludges intended to support src trees with partial obj trees.
Discussed with:	ru
2005-06-10 06:12:53 +00:00
Warner Losh
b7ca781307 Cope with the (unwise?) incompatible changes with make by adding
a comment before defined(SRCS).
2005-04-18 22:03:21 +00:00
Jacques Vidrine
7ca39a7ff1 Update Heimdal 0.6.1 -> 0.6.3. 2005-02-24 22:24:24 +00:00
Ruslan Ermilov
ab7a294721 NODOCCOMPRESS -> NO_DOCCOMPRESS
NOINFO -> NO_INFO
NOINFOCOMPRESS -> NO_INFOCOMPRESS
NOLINT -> NO_LINT
NOPIC -> NO_PIC
NOPROFILE -> NO_PROFILE
2004-12-21 09:33:47 +00:00
Ruslan Ermilov
e653b48c80 Start the dreaded NOFOO -> NO_FOO conversion.
OK'ed by:	core
2004-12-21 08:47:35 +00:00
Ruslan Ermilov
dee651eb15 Introduce the PRECIOUSPROG knob in bsd.prog.mk, similar
to PRECIOUSLIB from bsd.lib.mk.  The side effect of this
is making installing the world under jail(8) possible by
using another knob, NOFSCHG.

Reviewed by:	oliver
2004-11-03 18:01:21 +00:00
Colin Percival
d37df47d31 Join the 21st century: Cryptography is no longer an optional component
of releases.  The -DNOCRYPT build option still exists for anyone who
really wants to build non-cryptographic binaries, but the "crypto"
release distribution is now part of "base", and anyone installing from a
release will get cryptographic binaries.

Approved by:	re (scottl), markm
Discussed on:	freebsd-current, in late April 2004
2004-08-06 07:27:08 +00:00
Jacques Vidrine
52d887f87c Update version strings for Heimdal: 0.6 -> 0.6.1 2004-04-13 16:41:00 +00:00
Jacques Vidrine
f5d642e66f Hookup `arcfour.c' to the build (missed during upgrade to heimdal 0.6.1). 2004-04-04 03:31:05 +00:00
Ruslan Ermilov
86751859b5 style.Makefile(5).
OK'ed by:	nectar
2004-02-05 18:51:52 +00:00
Ruslan Ermilov
88a15798d4 Try harder to pick up the correct print_version.c. The old version
works before bsd.dep.mk,v 1.44, whether .depend file exists or not,
but the contents of .depend file is wrong.  With bsd.dep.mk,v 1.44,
the contents of .depend file is always broken, and build without a
.depend file is broken too.  With this change it works reliably in
all cases.  Ugh.
2004-02-05 18:49:35 +00:00
Ruslan Ermilov
fc448d1579 Unbreak build with OpenLDAP.
Forgotten by:	mr
2004-02-04 16:42:36 +00:00
Ruslan Ermilov
751378136d Put libraries in the link order.
Reported by:	lorder(1) (modified to work with libraries)
2004-02-04 10:23:09 +00:00
Ruslan Ermilov
51088c9b7b Take signal.c out of sources.
Reviewed by:	nectar
2004-02-03 09:32:11 +00:00
Ruslan Ermilov
95756ea357 Put generated headers into SRCS so that we pick them up even if
"make depend" was not run.
2004-02-03 09:21:37 +00:00