summaryrefslogtreecommitdiff
path: root/security/heimdal/patches
AgeCommit message (Collapse)AuthorFilesLines
2015-09-17Don't trigger unnecessary rebuilds.joerg2-4/+4
2015-07-11Apply patch from FreeBSD ports to patch-configure. This will allow therodent12-35/+112
package to build and install lib/windc.la, which is the cause of the installation failure. This is evident when PREFER_PKGSRC=yes. Defuzz patches.
2014-09-22Clean up RCS IDs in patches and PLIST to avoid permanent rebuilds.joerg2-4/+4
2014-05-16Fix build under OpenBSD 5.5ryoon6-2/+160
* OpenBSD's vis.h requires stdlib.h * OpenBSD has SO_PEERCRED, but it is different from Linux's one * __weak_alias is not for OpenBSD's gcc 4.2.1 * OpenBSD 5.5 has not VIS_HTTPSTYLE. * Fix PLIST for OpenBSD
2013-12-04Fix heimdal build under MirBSD.bsiegert3-1670/+0
The three tommath patches (which patch the files into existence) have been included in the source code since heimdal 1.5, so remove them. Compile errors due to missing -pthread in MirBSD were fixed by adding PTHREAD_AUTO_VARS.
2013-10-11Heimdal really uses termcaproy2-0/+91
2013-08-16Changes 1.5.3:adam1-10/+1
Bug fixes - Fix leaking file descriptors in KDC - Better socket/timeout handling in libkrb5 - General bug fixes - Build fixes
2013-07-26Fix build under GNU/kFreeBSD/amd64.ryoon4-3/+117
2012-11-15When getting a file basename strip any leading directories.sbd1-0/+15
2012-08-07Improve detection of __sync_add_and_fetch, avoid compiler optimization.obache1-3/+15
Fixes PR 46779.
2012-02-27Update to Heimdal 1.5.2asau3-53/+7
Release Notes - Heimdal - Version Heimdal 1.5.2 Security fixes - CVE-2011-4862 Buffer overflow in libtelnet/encrypt.c in telnetd - escalation of privilege - Check that key types strictly match - denial of service Release Notes - Heimdal - Version Heimdal 1.5.1 Bug fixes - Fix building on Solaris, requires c99 - Fix building on Windows - Build system updates Release Notes - Heimdal - Version Heimdal 1.5 New features - Support GSS name extensions/attributes - SHA512 support - No Kerberos 4 support - Basic support for MIT Admin protocol (SECGSS flavor) in kadmind (extract keytab) - Replace editline with libedit
2011-12-30Fix for CVE-2011-4862 from FreeBSDtez1-0/+19
When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer.
2011-09-15Split and clean up tommath patches. Requested by wiz.hans3-1083/+1082
2011-09-15Remove CVS keywords from patch, so that distinfo has a chance of everwiz1-13/+5
being right. XXX: this patch should be split up, it contains more than one file.
2011-09-14Fix build on SunOS.hans1-0/+1679
2011-07-31Adds the symbols _kdc_db_fetch and _kdc_free_ent to globalgls1-0/+17
visibility, so that they can be referenced from kdc/digest-service. Fixes build on Dragonfly. From Alex Hornung in PR pkg/45195.
2011-07-08Changes 1.4:adam10-245/+34
New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2010-11-30Fixes build with OPENSSL_NO_MD2.obache3-0/+148
2008-11-19The patch from upstream to fix man/man5/qop.5 symlink. This has been sit inhasso1-0/+16
PR 38622 for some time.
2008-02-28Update security/heimdal to version 1.1. Changes from version 0.7.2 include:jlam10-264/+68
* Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2007-02-20Fixed the build on IRIX 6.5.rillig2-4/+28
2006-08-09Security fix for SA21436:salo5-0/+246
"A security issue has been reported in Heimdal, which potentially can be exploited by malicious, local users to perform certain actions with escalated privileges. The security issue is caused due to missing checks for whether the "setuid()" call has succeeded in the bundled rcp application. This may be exploited to perform certain actions with root privileges if the "setuid()" call fails due to e.g. resource limits." http://secunia.com/advisories/21436/ http://www.pdc.kth.se/heimdal/advisory/2006-08-08/ Bump PKGREVISION.
2006-07-05Back out previous and do the same thing more generally for all platforms.jlam1-0/+14
Since the heimdal install process will install additional headers in ${PREFIX}/include/krb5 depending on what the configure process detects, simply query the source Makefile at install-time for the extra headers that it will install and dynamically add them to the PLIST.
2006-02-07http://www.pdc.kth.se/heimdal/releases/0.7.2/lha8-293/+0
http://www.pdc.kth.se/heimdal/advisory/2006-02-06/ Changes in Heimdal 0.7.2 * Fix security problem in rshd that enable an attacker to overwrite and change ownership of any file that root could write. * Fix a DOS in telnetd. The attacker could force the server to crash in a NULL de-reference before the user logged in, resulting in inetd turning telnetd off because it forked too fast. * Make gss_acquire_cred(GSS_C_ACCEPT) check that the requested name exists in the keytab before returning success. This allows servers to check if its even possible to use GSSAPI. * Fix receiving end of token delegation for GSS-API. It still wrongly uses subkey for sending for compatibility reasons, this will change in 0.8. * telnetd, login and rshd are now more verbose in logging failed and successful logins. * Bug fixes
2005-10-29Fix for darwin, reusing Dragonfly fix by joergtonio1-2/+2
2005-10-29Fix Heimdal's LOCAL_PEERCRED on DragonFly by includingjoerg1-0/+14
the necessary headers. XXX Ask upstream, why this isn't a #if / #elif list Reported-by: walt <wa1ter AT myrealbox DOT com> on tech-pkg
2005-10-26Pull in change from Heimdal CVS committed on 20051012 where the fieldjlam4-0/+224
in a publicly-exported structure was renamed from "private" to "opt_private". This allows <krb5.h> to be used by C++ compilers. Bump the PKGREVISION to 1.
2005-10-26Update security/heimdal to 0.7.1 (approved by lha). We drop supportjlam6-98/+52
for the "db4" option and just rely on the appropriate BDB_* settings via bdb.buildlink3.mk. Also, we tweak the builtin.mk file so use krb5-config, if it's available, to check the version of the built-in heimdal. Patches patch-ab, patch-ae and patch-af have been sent back upstream and will be incorporated into future Heimdal releases. Changes between version 0.6.5 and version 0.7.1 include: * Support for KCM, a process based credential cache * Support CCAPI credential cache * SPNEGO support * AES (and the gssapi conterpart, CFX) support * Adding new and improve old documentation * Bug fixes
2005-08-23Include sys/types.h. This fixes configure on DragonFly. Bump PKGREVISION.reed1-2/+34
Okayed by lha@. I tested on Linux and DragonFly. I got this from Joerg Sonnenberger. On DragonFly, the configure errored like: /usr/include/openssl/md5.h:110: error: syntax error before "size_t" In file included from conftest.c:34: /usr/include/openssl/sha.h:109: error: syntax error before "size_t" This caused tests to break and it ended up building and installing libdes and des.h, md4.h, and related headers. So later libgssapi needed this libdes which was not buildlinked which broke kdelibs3 build.
2005-08-04Add patch-aa to make heimdal compile with gcc-4 (default with darwin 8)tonio1-0/+29
This patch is the same as revision 1.3 of /cvsroot/src/crypto/dist/heimdal/lib/asn1/gen_glue.c by matt@ those cvs log: Don't emit struct units [] anymore. emit a struct units * const foo and in the C file initialize that to the static list. Bump pkgrevision: it changes the binary package on gcc<4 platforms approved by wiz@
2005-04-21Update to Heimdal 0.6.4. While I'm here, claim maintainership of thislha1-12/+0
package. Also please pkglint. Changes in heimdal 0.6.4 include: * fix vulnerabilities in telnet * rshd: encryption without a separate error socket should now work * telnet now uses appdefaults for the encrypt and forward/forwardable settings * bug fixes
2004-12-14Change the way that openssl/builtin.mk handles the USE_OLD_DES_API flag.jlam2-50/+1
The idea is to prevent needing to patch source files for packages that use OpenSSL for DES support by ensuring that including <openssl/des.h> will always present the old DES API. (1) If des_old.h exists, then we're using OpenSSL>=0.9.7, and <openssl/des.h> already does the right thing. (2) If des_old.h doesn't exist, then one of two things is happening: (a) If <openssl/des.h> is old and (only) supports the old DES API, then <openssl/des.h> does the right thing. (b) If it's NetBSD's Special(TM) one that stripped out the old DES support into a separate library and header (-ldes, <des.h>), then we create a new header <openssl/des.h> that includes the system one and <des.h>. Also modify existing packages that set USE_OLD_DES_API to simply include <openssl/des.h> instead of either <des.h> or <openssl/des_old.h> (This step is mostly just removing unnecessary patches). This should fix building packages that use OpenSSL's old DES API support on non-NetBSD systems where the built-in OpenSSL is at least 0.9.7.
2004-12-04Set USE_OLD_DES_API and replace custom changes to work with NetBSD-2.0'sjlam2-129/+50
OpenSSL, with patches to use <openssl/des_old.h>.
2004-11-19Correctly detect the old DES API in the OpenSSL in NetBSD's basejlam1-2/+130
install. This prevents Heimdal from building and installing its own DES library and headers. Bump the PKGREVISION.
2004-10-06Undefine open in ndbm_wrap.c. This fixes a build problem on Solaris.gavan1-0/+12
2004-09-14Update security/heimdal to 0.6.3. Changes from version 0.6.1 include:jlam1-3/+3
* fix vulnerabilities in ftpd * support for linux AFS /proc "syscalls" * support for RFC3244 (Windows 2000 Kerberos Change/Set Password) in kpasswdd * fix possible KDC denial of service * Fix possible buffer overrun in v4 kadmin (which now defaults to off)
2004-04-01Update to 0.6.1:joda4-87/+0
* Fixed cross realm vulnerability * Fixed ARCFOUR suppport * kdc: fix denial of service attack * kdc: stop clients from renewing tickets into the future * bug fixes
2004-02-22configure looks for and finds -ltermcap too late in the process for it tomarkd2-0/+53
be linked in when testing -lreadline usability so that test fails on Solaris - so pass that lib into configure at the start via the environment. Also allow optional use of db4 rather that db.
2004-01-13Fix build with gcc3.markd1-0/+15
2004-01-10Initial import of heimdal-0.6 into security/heimdal.jlam4-0/+87
Heimdal is a free implementation of Kerberos 5. Kerberos is a system for authenticating users and services on a network. It is built upon the assumption that the network is "unsafe". Kerberos is a trusted third-party service. That means that there is a third party (the Kerberos server) that is trusted by all the entities on the network (users and services, usually called "principals"). All principals share a secret password (or key) with the Kerberos server and this enables principals to verify that the messages from the Kerberos server are authentic. Thus trusting the Kerberos server, users and services can authenticate each other.
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-09 07:49:55 +0000