summaryrefslogtreecommitdiff
path: root/security/heimdal
AgeCommit message (Collapse)AuthorFilesLines
2012-09-09Add CONFLICTS with kth-krb4 (lib/libsl.so)cheusov1-2/+3
2012-08-07Improve detection of __sync_add_and_fetch, avoid compiler optimization.obache2-5/+17
Fixes PR 46779.
2012-07-18Fix install on at least Solaris.jperkin1-1/+5
2012-04-27Recursive bump from icu shlib major bumped to 49.obache2-4/+4
2012-03-13On SunOS, heimdal never builds hcrypto when pkgsrc OpenSSL used.fhajny1-2/+5
2012-03-11PR/39656 -- Use /var/heimdal as hdbdir, not /var.shattered1-2/+3
2012-02-27Update to Heimdal 1.5.2asau6-74/+41
Release Notes - Heimdal - Version Heimdal 1.5.2 Security fixes - CVE-2011-4862 Buffer overflow in libtelnet/encrypt.c in telnetd - escalation of privilege - Check that key types strictly match - denial of service Release Notes - Heimdal - Version Heimdal 1.5.1 Bug fixes - Fix building on Solaris, requires c99 - Fix building on Windows - Build system updates Release Notes - Heimdal - Version Heimdal 1.5 New features - Support GSS name extensions/attributes - SHA512 support - No Kerberos 4 support - Basic support for MIT Admin protocol (SECGSS flavor) in kadmind (extract keytab) - Replace editline with libedit
2012-02-15Provide access to tests (TEST_TARGET=check).asau1-1/+3
2012-01-18Revbump after db5 updateadam1-2/+2
2011-12-30Fix for CVE-2011-4862 from FreeBSDtez3-3/+23
When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer.
2011-12-09In OWN_DIRS_PERMS change ROOT_GROUP to REAL_ROOT_GROUPsbd1-2/+2
2011-09-15Split and clean up tommath patches. Requested by wiz.hans4-1085/+1086
2011-09-15Remove CVS keywords from patch, so that distinfo has a chance of everwiz2-15/+7
being right. XXX: this patch should be split up, it contains more than one file.
2011-09-14Fix build on SunOS.hans4-4/+1708
2011-07-31Adds the symbols _kdc_db_fetch and _kdc_free_ent to globalgls3-2/+21
visibility, so that they can be referenced from kdc/digest-service. Fixes build on Dragonfly. From Alex Hornung in PR pkg/45195.
2011-07-16Regenerate checksum for patches.asau1-2/+2
2011-07-08Changes 1.4:adam15-333/+463
New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-01-23Also allow the builtin heimdal from ArchLinux.markd1-2/+2
2010-11-30Fixes build with OPENSSL_NO_MD2.obache4-1/+152
2010-07-02Use CHECK_BUILTIN.heimdal to prevent the fake-krb5-config target to bejoerg1-1/+3
defined twice.
2010-07-01Don't include mk/bdb.m3.mk for the builtin heimdal.joerg1-1/+5
2010-03-23Reset maintainer, lost his commit bit.wiz1-2/+2
2010-02-19Fix ownership. Bump revision.joerg1-3/+3
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz2-4/+4
2009-06-30Mark packages as MAKE_JOBS_SAFE=no that failed in a bulk build withjoerg1-1/+3
MAKE_JOBS=2 and worked without.
2009-06-14Remove @dirrm related logic.joerg1-3/+2
2009-06-14Remove @dirrm entries from PLISTsjoerg1-7/+1
2009-05-20Recursive ABI depends update and PKGREVISION bump for readline-6.0 shlibwiz1-2/+2
major change. Reported by Robert Elz in PR 41345.
2009-05-19Use standard location for LICENSE line (in MAINTAINER/HOMEPAGE/COMMENTwiz1-3/+2
block). Uncomment some commented out LICENSE lines while here.
2009-03-20Simply and speed up buildlink3.mk files and processing.joerg1-13/+6
This changes the buildlink3.mk files to use an include guard for the recursive include. The use of BUILDLINK_DEPTH, BUILDLINK_DEPENDS, BUILDLINK_PACKAGES and BUILDLINK_ORDER is handled by a single new variable BUILDLINK_TREE. Each buildlink3.mk file adds a pair of enter/exit marker, which can be used to reconstruct the tree and to determine first level includes. Avoiding := for large variables (BUILDLINK_ORDER) speeds up parse time as += has linear complexity. The include guard reduces system time by avoiding reading files over and over again. For complex packages this reduces both %user and %sys time to half of the former time.
2009-02-01heimdal leaves empty directories after deinstallation, fix that.shattered2-5/+8
OK by wiz@.
2008-11-25Correct patch-aa checksum, sorry for a mess.hasso1-2/+2
2008-11-19The patch from upstream to fix man/man5/qop.5 symlink. This has been sit inhasso2-1/+18
PR 38622 for some time.
2008-05-14libhcrypto.la only seems to get installed if we're building on 3.x or older,jwise2-4/+7
so make it only end up in the PLIST if that is the case.
2008-05-05Add missing library (libhcrypto) to PLIST, allowing sudo to build againstjwise2-2/+4
this heimdal on 3.x. Bump PKGREVISION.
2008-04-12Convert to use PLIST_VARS instead of manually passing "@comment "jlam3-12/+10
through PLIST_SUBST to the plist module.
2008-04-04also set KRB5_CONFIG in the case where using builtin butmarkd1-3/+6
/usr/bin/krb5-config exists. Fixes build of imap-uw package with the kerberos option on NetBSD-current and possibly other platforms.
2008-03-04As of revision 1.2 of termcap.buildlink3.mk, "-ltermcap" is automaticallyjlam1-4/+2
transformed into the correct set of libraries, so we no longer need to override the configure script's check for which library has tgetent().
2008-03-02The "missing-from-system" headers that Heimdal installs are now placedjlam1-2/+2
into ${PREFIX}/include/krb5/roken instead of ${PREFIX}/include/krb5. This is good because it reduces the likelihood of a conflict with any other similarly named headers if you simply add -I${PREFIX}/include/krb5 to the compiler command line. Patch from PR pkg/38119 by charlie.
2008-02-29Rename termlib.* to termcap.* to better document exactly what packagesjlam1-2/+2
are trying to use (the termcap t*() API).
2008-02-28Update security/heimdal to version 1.1. Changes from version 0.7.2 include:jlam1-0/+68
* Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28Update security/heimdal to version 1.1. Changes from version 0.7.2 include:jlam14-388/+255
* Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn2-4/+4
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2007-06-15Slightly change script so that ident sees only the NetBSD CVS ID andjoerg1-2/+2
it can therefore be detected properly as up-to-date.
2007-05-30Removed some code duplication from the buildlink3 files by using the newrillig1-8/+3
pkg-build-options.mk procedure.
2007-02-20Fixed the build on IRIX 6.5.rillig5-8/+44
2006-12-12Replace mk/bsd.prefs.mk includes with bsd.fast.prefs.mk includes.joerg1-2/+2
The redundant parsing of bsd.prefs.mk is mostly avoided now and parse time e.g. for x11/kdebase3 gets reduced by up to 10%.
2006-08-29If using the fake krb5-config then set KRB5_CONFIG to point at it. Fixesmarkd1-1/+5
build of imap-uw package with the kerberos option.
2006-08-09Security fix for SA21436:salo7-3/+254
"A security issue has been reported in Heimdal, which potentially can be exploited by malicious, local users to perform certain actions with escalated privileges. The security issue is caused due to missing checks for whether the "setuid()" call has succeeded in the bundled rcp application. This may be exploited to perform certain actions with root privileges if the "setuid()" call fails due to e.g. resource limits." http://secunia.com/advisories/21436/ http://www.pdc.kth.se/heimdal/advisory/2006-08-08/ Bump PKGREVISION.
2006-07-08Change the format of BUILDLINK_ORDER to contain depth information as well,jlam1-2/+2
and add a new helper target and script, "show-buildlink3", that outputs a listing of the buildlink3.mk files included as well as the depth at which they are included. For example, "make show-buildlink3" in fonts/Xft2 displays: zlib fontconfig iconv zlib freetype2 expat freetype2 Xrender renderproto
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-27 02:55:49 +0000