summaryrefslogtreecommitdiff
path: root/security/heimdal
AgeCommit message (Collapse)AuthorFilesLines
2008-05-14libhcrypto.la only seems to get installed if we're building on 3.x or older,jwise2-4/+7
so make it only end up in the PLIST if that is the case.
2008-05-05Add missing library (libhcrypto) to PLIST, allowing sudo to build againstjwise2-2/+4
this heimdal on 3.x. Bump PKGREVISION.
2008-04-12Convert to use PLIST_VARS instead of manually passing "@comment "jlam3-12/+10
through PLIST_SUBST to the plist module.
2008-04-04also set KRB5_CONFIG in the case where using builtin butmarkd1-3/+6
/usr/bin/krb5-config exists. Fixes build of imap-uw package with the kerberos option on NetBSD-current and possibly other platforms.
2008-03-04As of revision 1.2 of termcap.buildlink3.mk, "-ltermcap" is automaticallyjlam1-4/+2
transformed into the correct set of libraries, so we no longer need to override the configure script's check for which library has tgetent().
2008-03-02The "missing-from-system" headers that Heimdal installs are now placedjlam1-2/+2
into ${PREFIX}/include/krb5/roken instead of ${PREFIX}/include/krb5. This is good because it reduces the likelihood of a conflict with any other similarly named headers if you simply add -I${PREFIX}/include/krb5 to the compiler command line. Patch from PR pkg/38119 by charlie.
2008-02-29Rename termlib.* to termcap.* to better document exactly what packagesjlam1-2/+2
are trying to use (the termcap t*() API).
2008-02-28Update security/heimdal to version 1.1. Changes from version 0.7.2 include:jlam1-0/+68
* Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28Update security/heimdal to version 1.1. Changes from version 0.7.2 include:jlam14-388/+255
* Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn2-4/+4
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2007-06-15Slightly change script so that ident sees only the NetBSD CVS ID andjoerg1-2/+2
it can therefore be detected properly as up-to-date.
2007-05-30Removed some code duplication from the buildlink3 files by using the newrillig1-8/+3
pkg-build-options.mk procedure.
2007-02-20Fixed the build on IRIX 6.5.rillig5-8/+44
2006-12-12Replace mk/bsd.prefs.mk includes with bsd.fast.prefs.mk includes.joerg1-2/+2
The redundant parsing of bsd.prefs.mk is mostly avoided now and parse time e.g. for x11/kdebase3 gets reduced by up to 10%.
2006-08-29If using the fake krb5-config then set KRB5_CONFIG to point at it. Fixesmarkd1-1/+5
build of imap-uw package with the kerberos option.
2006-08-09Security fix for SA21436:salo7-3/+254
"A security issue has been reported in Heimdal, which potentially can be exploited by malicious, local users to perform certain actions with escalated privileges. The security issue is caused due to missing checks for whether the "setuid()" call has succeeded in the bundled rcp application. This may be exploited to perform certain actions with root privileges if the "setuid()" call fails due to e.g. resource limits." http://secunia.com/advisories/21436/ http://www.pdc.kth.se/heimdal/advisory/2006-08-08/ Bump PKGREVISION.
2006-07-08Change the format of BUILDLINK_ORDER to contain depth information as well,jlam1-2/+2
and add a new helper target and script, "show-buildlink3", that outputs a listing of the buildlink3.mk files included as well as the depth at which they are included. For example, "make show-buildlink3" in fonts/Xft2 displays: zlib fontconfig iconv zlib freetype2 expat freetype2 Xrender renderproto
2006-07-08Track information in a new variable BUILDLINK_ORDER that informs usjlam1-1/+2
of the order in which buildlink3.mk files are (recursively) included by a package Makefile.
2006-07-05Back out previous and do the same thing more generally for all platforms.jlam6-13/+26
Since the heimdal install process will install additional headers in ${PREFIX}/include/krb5 depending on what the configure process detects, simply query the source Makefile at install-time for the extra headers that it will install and dynamically add them to the PLIST.
2006-07-02Solaris does not have err.h, glob.h, ifaddrs.h and vis.h compatible withmarkd2-2/+7
heimdal, so heimdal installs its own. Add them in PLIST.SunOS Fixes PR pkg/33656. Bump PKGREVISION.
2006-05-31The databases/openldap package has been split in -client and -server componentghen2-5/+5
packages. Convert LDAP-based applications to depend on openldap-client, and bump PKGREVISION for those that depend on it by default.
2006-05-15Linux does not have glob.h and vis.h compatible with heimdal, so heimdalminskim2-1/+5
installs its own glob.h and vis.h. Add them to PLIST.Linux. Bump PKGREVISION.
2006-05-06This package requires flex to build.minskim1-2/+2
2006-04-18Update the list that matches up heimdal versions to NetBSD versions.jlam1-4/+4
2006-04-06Over 1200 files touched but no revisions bumped :)reed2-6/+6
RECOMMENDED is removed. It becomes ABI_DEPENDS. BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo. BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo. BUILDLINK_DEPENDS does not change. IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS which defaults to "yes". Added to obsolete.mk checking for IGNORE_RECOMMENDED. I did not manually go through and fix any aesthetic tab/spacing issues. I have tested the above patch on DragonFly building and packaging subversion and pkglint and their many dependencies. I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I have used IGNORE_RECOMMENDED for a long time). I have been an active user of IGNORE_RECOMMENDED since it was available. As suggested, I removed the documentation sentences suggesting bumping for "security" issues. As discussed on tech-pkg. I will commit to revbump, pkglint, pkg_install, createbuildlink separately. Note that if you use wip, it will fail! I will commit to pkgsrc-wip later (within day).
2006-03-31heimdal and gss conflict because they install a common set of manpagesjlam1-1/+2
for the gss_* functions.
2006-03-30Avoid extra stat() calls by not repeatedly checking whether a filejlam1-4/+5
exists on the disk -- we can just check whether a variable defined by find-files.mk is "__nonexistent__" or not.
2006-03-30* Honor PKGINFODIR.jlam2-3/+4
* List the info files directly in the PLIST.
2006-02-07http://www.pdc.kth.se/heimdal/releases/0.7.2/lha10-308/+6
http://www.pdc.kth.se/heimdal/advisory/2006-02-06/ Changes in Heimdal 0.7.2 * Fix security problem in rshd that enable an attacker to overwrite and change ownership of any file that root could write. * Fix a DOS in telnetd. The attacker could force the server to crash in a NULL de-reference before the user logged in, resulting in inetd turning telnetd off because it forked too fast. * Make gss_acquire_cred(GSS_C_ACCEPT) check that the requested name exists in the keytab before returning success. This allows servers to check if its even possible to use GSSAPI. * Fix receiving end of token delegation for GSS-API. It still wrongly uses subkey for sending for compatibility reasons, this will change in 0.8. * telnetd, login and rshd are now more verbose in logging failed and successful logins. * Bug fixes
2006-01-26If using a system builtin heimdal and that heimdal doesn't have amarkd2-1/+120
krb5-config then create one to use in the buildlink tree. Useful for packages that expect krb5-config to exist to determine kerberos existence/locations.
2006-01-25Force Heimdal to compile its own compile_et by telling the configurejlam1-1/+4
script not to find any system-installed compile_et. (This should really be done by using our own PATH that doesn't include any system paths, but we're not quite ready to do that yet.)
2006-01-24security/heimdal and net/openafs conflict because of:wiz1-1/+2
bin/compile_et bin/kpasswd bin/pagsh Addresses PR 32610 and PR 32612 by Ola Eriksson.
2006-01-24security/heimdal and arla conflict with each other because of:wiz1-1/+2
bin/mk_cmds lib/libroken.la lib/libsl.la lib/libss.la man/man3/arg_printusage.3 man/man3/getarg.3 Addresses PR 32610 and PR 32611 by Ola Eriksson.
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-21Add a non-conflicting definition for load_rc_config_var so thatjlam3-4/+30
platforms with older versions of /etc/rc.subr can run smbd.sh and winbindd.sh without updating /etc/rc.subr. Bump PKGREVISION to 2.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig1-5/+5
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-2/+2
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-10-29Fix for darwin, reusing Dragonfly fix by joergtonio2-4/+4
2005-10-29Fix Heimdal's LOCAL_PEERCRED on DragonFly by includingjoerg2-1/+16
the necessary headers. XXX Ask upstream, why this isn't a #if / #elif list Reported-by: walt <wa1ter AT myrealbox DOT com> on tech-pkg
2005-10-26Pull in change from Heimdal CVS committed on 20051012 where the fieldjlam6-2/+231
in a publicly-exported structure was renamed from "private" to "opt_private". This allows <krb5.h> to be used by C++ compilers. Bump the PKGREVISION to 1.
2005-10-26Update security/heimdal to 0.7.1 (approved by lha). We drop supportjlam15-149/+477
for the "db4" option and just rely on the appropriate BDB_* settings via bdb.buildlink3.mk. Also, we tweak the builtin.mk file so use krb5-config, if it's available, to check the version of the built-in heimdal. Patches patch-ab, patch-ae and patch-af have been sent back upstream and will be incorporated into future Heimdal releases. Changes between version 0.6.5 and version 0.7.1 include: * Support for KCM, a process based credential cache * Support CCAPI credential cache * SPNEGO support * AES (and the gssapi conterpart, CFX) support * Adding new and improve old documentation * Bug fixes
2005-10-25Solaris 9 has a <vis.h> header, but it is very different to the BSD <vis.h>rillig1-1/+6
header, which is expected by heimdal. Now the package builds on Solaris 9.
2005-10-05Remove some more *LEGACY* settings that are over a month old andwiz1-3/+1
thus were before 2005Q3.
2005-08-23Include sys/types.h. This fixes configure on DragonFly. Bump PKGREVISION.reed3-6/+38
Okayed by lha@. I tested on Linux and DragonFly. I got this from Joerg Sonnenberger. On DragonFly, the configure errored like: /usr/include/openssl/md5.h:110: error: syntax error before "size_t" In file included from conftest.c:34: /usr/include/openssl/sha.h:109: error: syntax error before "size_t" This caused tests to break and it ended up building and installing libdes and des.h, md4.h, and related headers. So later libgssapi needed this libdes which was not buildlinked which broke kdelibs3 build.
2005-08-04Add patch-aa to make heimdal compile with gcc-4 (default with darwin 8)tonio3-2/+33
This patch is the same as revision 1.3 of /cvsroot/src/crypto/dist/heimdal/lib/asn1/gen_glue.c by matt@ those cvs log: Don't emit struct units [] anymore. emit a struct units * const foo and in the C file initialize that to the static list. Bump pkgrevision: it changes the binary package on gcc<4 platforms approved by wiz@
2005-06-20Update to Heimdal 0.6.5lha2-6/+6
Changes in release 0.6.5 * fix vulnerabilities in telnetd * unbreak Kerberos 4 and kaserver
2005-06-09Fix copy-and-paste error -- in the case where we prefer the pkgsrcjlam1-2/+2
version of the software, USE_BUILTIN.<pkg> should be set to "no", not to ${IS_BUILTIN.<pkg>}.
2005-06-01Massive cleanup of buildlink3.mk and builtin.mk files in pkgsrc.jlam1-55/+72
Several changes are involved since they are all interrelated. These changes affect about 1000 files. The first major change is rewriting bsd.builtin.mk as well as all of the builtin.mk files to follow the new example in bsd.builtin.mk. The loop to include all of the builtin.mk files needed by the package is moved from bsd.builtin.mk and into bsd.buildlink3.mk. bsd.builtin.mk is now included by each of the individual builtin.mk files and provides some common logic for all of the builtin.mk files. Currently, this includes the computation for whether the native or pkgsrc version of the package is preferred. This causes USE_BUILTIN.* to be correctly set when one builtin.mk file includes another. The second major change is teach the builtin.mk files to consider files under ${LOCALBASE} to be from pkgsrc-controlled packages. Most of the builtin.mk files test for the presence of built-in software by checking for the existence of certain files, e.g. <pthread.h>, and we now assume that if that file is under ${LOCALBASE}, then it must be from pkgsrc. This modification is a nod toward LOCALBASE=/usr. The exceptions to this new check are the X11 distribution packages, which are handled specially as noted below. The third major change is providing builtin.mk and version.mk files for each of the X11 distribution packages in pkgsrc. The builtin.mk file can detect whether the native X11 distribution is the same as the one provided by pkgsrc, and the version.mk file computes the version of the X11 distribution package, whether it's built-in or not. The fourth major change is that the buildlink3.mk files for X11 packages that install parts which are part of X11 distribution packages, e.g. Xpm, Xcursor, etc., now use imake to query the X11 distribution for whether the software is already provided by the X11 distribution. This is more accurate than grepping for a symbol name in the imake config files. Using imake required sprinkling various builtin-imake.mk helper files into pkgsrc directories. These files are used as input to imake since imake can't use stdin for that purpose. The fifth major change is in how packages note that they use X11. Instead of setting USE_X11, package Makefiles should now include x11.buildlink3.mk instead. This causes the X11 package buildlink3 and builtin logic to be executed at the correct place for buildlink3.mk and builtin.mk files that previously set USE_X11, and fixes packages that relied on buildlink3.mk files to implicitly note that X11 is needed. Package buildlink3.mk should also include x11.buildlink3.mk when linking against the package libraries requires also linking against the X11 libraries. Where it was obvious, redundant inclusions of x11.buildlink3.mk have been removed.
2005-06-01Make this build on Darwin. This fixes PR pkg/29147.yyamano1-1/+3
2005-05-31Rename option prefix-cmds to kerberos-prefix-cmds. Backwardsdillo1-4/+5
compatibility provided via PKG_OPTIONS_LEGACY_OPTS.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-14 18:18:10 +0000