aboutsummaryrefslogtreecommitdiff
path: root/kerberos5/lib/libhdb
Commit message (Collapse)AuthorAgeFilesLines
* heimdal-kadmin: Add support for the -f dump optionRick Macklem2025-10-051-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "-f" dump option allows a dump of the Heimdal KDC in a format that the MIT kdb5_util command can load into a MIT KDC's database. This makes transitioning from the Heimdal KDC to the current MIT one feasible without having to re-create the KDC database from scratch. glebius@ did the initial work, cherry picking these commits from the Heimdal sources on github and then doing extensive merge conflict resolution and other fixes so that it would build. Heimdal commit fca5399 authored by Nico Williams: Initial commit for second approach for multiple kvno. NOT TESTED! Heimdal commit 57f1545 authored by Nico Williams: Add support for writing to KDB and dumping HDB to MIT KDB dump format Before this change Heimdal could read KDBs. Now it can write to them too. Heimdal can now also dump HDBs (including KDBs) in MIT format, which can then be imported with kdb5_util load. This is intended to help in migrations from MIT to Heimdal by allowing migrations from Heimdal to MIT so that it is possible to rollback from Heimdal to MIT should there be any issues. The idea is to allow a) running Heimdal kdc/kadmind with a KDB, or b) running Heimdal with an HDB converted from a KDB and then rollback by dumping the HDB and loading a KDB. Note that not all TL data types are supported, only two: last password change and modify-by. This is the minimum necessary. PKINIT users may need to add support for KRB5_TL_USER_CERTIFICATE, and for databases with K/M history we may need to add KRB5_TL_MKVNO support. This resulted in a Heimdal kadmin that would dump the KDC database in MIT format. However, there were issues when this dump was loaded into the current MIT KDC in FreeBSD current/15.0. The changes I did to make the dump more useful are listed below: When "-f MIT" is used for "kadmin -l dump" it writes the dump out in MIT format. This dump format is understood by the MIT kdb5_util command. The patch modifies the above so that the MIT KDC's master key keytab file can be provided as the argument to "-f" so that the principals are re-encrypted in it. This allows any principal with at least one strong encryption type key to work without needing a change_password. The strong encryption types supported by the Heimdal KDC are: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 The issues my changes address are: - If there are weak encryption keys in a principal's entry, MIT's kadmin.local will report that the principcal's entry is incomplete or corrupted. - The keys are encrypted in Heimdal's master key. The "-d" option can be used on the "kadmin -l dump" to de-encrypt them, but the passwords will not work on the current MIT KDC. To try and deal with the above issues, this patch modied the above to: - Does not dump the weak keys. - Re-encrypts the strong keys in MIT's master key if the argument to "-f" is actually a filename which holds the MIT KDC's master key keytab and not "MIT". - For principals that only have weak keys, it generates a fake strong key. This key will not work on the MIT KDC, but the principal entry will work once a change_password is done to it. - It always generates a "modified_by" entry, faking one if not already present in the Heimdal KDC database. This was necessary, since the MIT kadmin will report that the principal entry is "incomplete or corrupted" without one. It also fixed a problem where "get principal" no longer worked after the initial patch was applied. A man page update will be done as a separate commit. I believe this commit is acceptable since the Heimdal sources are now essentially deprecated in favor of the MIT sources and that this new "-f" patch simplifies the transition to the MIT KDC. Discussed with: glebius, cy MFC after: 3 days
* kerberos5: Fix the Heimdal pkgbase buildLexi Winter2025-09-041-2/+0
| | | | | | | | | | | | | | | | | | When LIB_PACKAGE was added, MIT Kerberos was updated to use it but Heimdal was not, so it still used PACKAGE=kerberos-lib. Since we deleted kerberos-lib-all.ucl, this caused update-packages to fail when WITHOUT_MITKRB5 is set. Change the Heimdal libraries to use LIB_PACKAGE by setting this in kerberos5/lib/Makefile.inc, and remove PACKAGE=kerberos-lib from the individual Makefiles for each library. This means Heimdal gets the same set of packages as MIT Kerberos, except for kerberos-kdc which we don't create for Heimdal. Fixes: 929f5966a9fd ("packages: Improve handling of -lib packages") Reported by: jlduran Reviewed by: jlduran, cy Differential Revision: https://reviews.freebsd.org/D52371
* kerberos5, libcom_err, others: append to LDFLAGS instead of replacingChuck Silvers2025-04-051-1/+1
| | | | | Reviewed by: imp, emaste Differential Revision: https://reviews.freebsd.org/D49548
* Remove residual blank line at start of MakefileWarner Losh2024-07-151-1/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-162-2/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* heimdal: Do not build a redundant source fileCy Schubert2023-04-021-1/+0
| | | | | | | | Heimdal's lib/hdb/db3.c is only built if DB3 is enabled, i.e. #if HAVE_DB3. FreeBSD's bdb is DB1. Therefore the entire db3.c file is #ifdef'd out. Let's avoid building a file that results in a useless object file. MFC after: 1 week
* pkgbase: split kerberos binaries and libsDoug Rabson2022-08-031-1/+1
| | | | | | | | | | | | | | | | | | | | Summary: This allows installing packages that depend on kerberos libraries without pulling in all the binaries. It also moves libgssapi to runtime to allow installing kerbereos libraries without adding a dependancy on the large utilities package. It makes sense to put libgssapi in runtime rather than kerberos-lib since this is a plugin layer which is intended to support any GSS-API mechanisms, not just kerberos. A good example of a package which uses kerberos libraries without needing the kerberos utilities is sshd. This uses the kerberos GSS-API libraries to implement its GSSAPIAuthentication option. MFC after: 2 weeks Subscribers: imp Differential Revision: https://reviews.freebsd.org/D36028
* pkgbase: Create a FreeBSD-kerberos packageEmmanuel Vadot2021-09-071-0/+2
| | | | | | | This allows users to install or not kerberos related utilities and libs. Differential Revision: https://reviews.freebsd.org/D31801
* kerberos5: fix the WITH_OPENLDAP buildKyle Evans2021-01-301-0/+2
| | | | | | | Restore WARNS to its former glory prior to the global WARNS change to fix the build. MFC-after: 3 days
* Update Makefile.depend filesSimon J. Gerraty2019-12-111-1/+0
| | | | | | | | | | | | | Update a bunch of Makefile.depend files as a result of adding Makefile.depend.options files Reviewed by: bdrewery MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22494 Notes: svn path=/head/; revision=355617
* Use ${SRCTOP}/contrib/com_err/com_err.h instead of the installed com_err.h.Yoshihiro Takahashi2019-01-141-0/+1
| | | | | | | | | | This fixes build when com_err.h is not installed. PR: 234691 MFC after: 1 week Notes: svn path=/head/; revision=343011
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-311-1/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* kerberos5: normalize paths using SRCTOP-relative paths or :H when possibleEnji Cooper2017-03-041-1/+1
| | | | | | | | | | This simplifies make logic/output MFC after: 1 month Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314657
* WITH_META_MODE: Don't expect meta files for side-effect generated files.Bryan Drewery2016-06-031-0/+1
| | | | | | | | | | | | The first file in these lists will generate everything else so only it should be getting a .meta file. With bmake's missing=yes meta feature these would otherwise cause a rebuild without the .NOMETA hint. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=301285
* DIRDEPS_BUILD: Regenerate without local dependencies.Bryan Drewery2016-02-241-249/+0
| | | | | | | | | | | These are no longer needed after the recent 'beforebuild: depend' changes and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports skipping 'make depend'. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295989
* FAST_DEPEND: Always run depend via beforebuild which removes many hacks.Bryan Drewery2016-02-241-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will generate dependencies rather than depending on the previous behavior of depending on the guessed OBJS: *.h dependecies or a user running 'make depend'. Experimentation showed that depending only on headers was not enough and prone to .ORDER errors. Downstream users may also have added dependencies into beforedepend or afterdepend targets. The safest way to ensure dependencies are generated before build is to run 'make depend' beforehand rather than just depending on DPSRCS+SRCS. Note that the OBJS_DEPEND_GUESS mechanism (a.k.a .if !exists(.depend) then foo.o: *.h) is still useful as it improves incremental builds with missing .depend.* files and allows 'make foo.o' to usually work, while this 'beforebuild: depend' ensures that the build will always find all dependencies. The 'make foo.o' case has no means of a 'beforebuild' hook. This also removes several hacks in the DIRDEPS_BUILD: - NO_INSTALL_INCLUDES is no longer needed as it mostly was to work around .ORDER problems with building the needed headers early. - DIRDEPS_BUILD: It is no longer necesarry to track "local dependencies" in Makefile.depend. These were only in Makefile.depend for 'clean builds' since nothing would generate the files due to skipping 'make depend' and early dependency bugs that have been fixed, such as adding headers into SRCS for the OBJS_DEPEND_GUESS mechanism. Normally if a .depend file does not exist then a dependency is added by bsd.lib.mk/bsd.prog.mk from OBJS: *.h. However, meta.autodep.mk creates a .depend file from created meta files and inserts that into Makefile.depend. It also only tracks *.[ch] files though which can miss some dependencies that are hooked into 'make depend'. This .depend that is created then breaks incremental builds due to the !exists(.depend) checks for OBJS_DEPEND_GUESS. The goal was to skip 'make depend' yet it only really works the first time. After that files are not generated as expected, which r288966 tried to address but was using buildfiles: rather than beforebuild: and was reverted in r291725. As noted previously, depending only on headers in beforebuild: would create .ORDER errors in some cases. meta.autodep.mk is still used to generate Makefile.depend though via: gendirdeps: Makefile.depend .END: gendirdeps This commit allows removing all of the "local dependencies" in Makefile.depend which cuts down on churn and removes some of the arch-dependent Makefile.depend files. The "local dependencies" were also problematic for bootstrapping. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295988
* DIRDEPS_BUILD: Add some missing build dependencies for kerberos5.Bryan Drewery2016-02-241-0/+2
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295979
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2015-12-071-1/+0
| | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=291972
* META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.Bryan Drewery2015-11-251-1/+0
| | | | | | | | | | | This both avoids some dependencies on xinstall.host and allows bootstrapping on older releases to work due to lack of at least 'install -l' support. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=291307
* Make it buildable with WITH_OPENLDAP, again.Hajimu UMEMOTO2015-08-271-1/+2
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=287208
* Add META_MODE support.Simon J. Gerraty2015-06-132-0/+284
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | Off by default, build behaves normally. WITH_META_MODE we get auto objdir creation, the ability to start build from anywhere in the tree. Still need to add real targets under targets/ to build packages. Differential Revision: D2796 Reviewed by: brooks imp Notes: svn path=/head/; revision=284345
| * Explain why NO_BEFOREBUILD_INCLUDES is neededSimon J. Gerraty2015-06-101-0/+3
| | | | | | | | Notes: svn path=/projects/bmake/; revision=284241
| * dirdeps.mk now sets DEP_RELDIRSimon J. Gerraty2015-06-081-2/+0
| | | | | | | | Notes: svn path=/projects/bmake/; revision=284172
| * Merge sync of headSimon J. Gerraty2015-05-272-6/+7
| |\ | |/ |/| | | Notes: svn path=/projects/bmake/; revision=283595
| * Supress beforebuild dependency on buildincludesSimon J. Gerraty2014-05-161-0/+2
| | | | | | | | Notes: svn path=/projects/bmake/; revision=266222
| * Updated dependenciesSimon J. Gerraty2014-05-161-0/+2
| | | | | | | | Notes: svn path=/projects/bmake/; revision=266219
| * Merge headSimon J. Gerraty2014-04-281-2/+3
| |\ | | | | | | | | | Notes: svn path=/projects/bmake/; revision=265044
| * | Updated dependenciesSimon J. Gerraty2013-03-111-0/+1
| | | | | | | | | | | | Notes: svn path=/projects/bmake/; revision=248169
| * | Updated dependenciesSimon J. Gerraty2013-02-161-2/+0
| | | | | | | | | | | | Notes: svn path=/projects/bmake/; revision=246868
| * | Updated/new Makefile.dependSimon J. Gerraty2012-11-081-0/+10
| | | | | | | | | | | | Notes: svn path=/projects/bmake/; revision=242788
| * | Sync FreeBSD's bmake branch with Juniper's internal bmake branch.Marcel Moolenaar2012-08-221-0/+268
| | | | | | | | | | | | | | | | | | | | | Requested by: Simon Gerraty <sjg@juniper.net> Notes: svn path=/projects/bmake/; revision=239572
* | | Make kerberos use the same sqlite libraries as other sqlite consumer.Baptiste Daroussin2015-05-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reduces the number of copy of sqlite we have to just one and easier tracking version of sqlite Differential Revision: https://reviews.freebsd.org/D2443 Reviewed by: imp, stas, bjk Notes: svn path=/head/; revision=283160
* | | Add a ${CP} alias for copying files in the build.Will Andrews2015-01-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some users build FreeBSD as non-root in Perforce workspaces. By default, Perforce sets files read-only unless they're explicitly being edited. As a result, the -f argument must be used to cp in order to override the read-only flag when copying source files to object directories. Bare use of 'cp' should be avoided in the future. Update all current users of 'cp' in the src tree. Reviewed by: emaste MFC after: 1 week Sponsored by: Spectra Logic Notes: svn path=/head/; revision=277273
* | | Convert kerberos to LIBADD and reduce overlinking of the kerberos binaries andBaptiste Daroussin2014-11-251-2/+2
| |/ |/| | | | | | | | | | | libraries Notes: svn path=/head/; revision=275022
* | Fix installworld failure when kerberos source files have new timestampsEd Maste2014-04-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a kerberos .hx source file is newer than the .h copy, but the content is the same, then during buildworld the "cmp -s || cp" command in the .hx.h rule would do nothing, leaving the .h copy with the older timestamp. During installworld the rule would again be invoked, causing a failure as neither cmp or cp would exist in the temporary path. As the underlying issue should be resolved by r262209, unconditionally copy the file. No objection: peter@ Tested by: gjb@ Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=264774
* | Revert my commit in r261253; the real problem was tackled in r262209.Peter Wemm2014-02-201-2/+2
| | | | | | | | Notes: svn path=/head/; revision=262255
* | Really (I think) fix the sporadic heimdal build failures with high -jPeter Wemm2014-02-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | levels. The root of the problem was that make was attempting to run up to three concurrent asn1_compile commands to produce the three outputs that it was declared to produce. The failure was caused when the asn1_compiles were started out of sync and a later one was truncating the files that another thread was trying to copy. In reality it is supposed to be run exactly once and all three outputs are produced in one pass. Use the same hack as for the parent's Makefile.inc for the compile_et multi-output rule. Notes: svn path=/head/; revision=262209
* | Speculatively replace a cp with a cat for gathering data on aPeter Wemm2014-01-281-2/+2
|/ | | | | | | | sporadic parallel build failure in the FreeBSD cluster on many-core systems with ZFS. cp uses mmap in this scenario, cat does not. Notes: svn path=/head/; revision=261253
* Centralize the specification of the krb5 build tools.David E. O'Brien2012-06-011-2/+0
| | | | Notes: svn path=/head/; revision=236422
* * Remove headers from SRCS that are not generatedDavid E. O'Brien2012-05-301-2/+0
| | | | | | | | | (and are in /usr/src/crypto/heimdal/). * Avoid race conditions with 'make -j<N>'. Notes: svn path=/head/; revision=236337
* - Update FreeBSD Heimdal distribution to version 1.5.1. This also bringsStanislav Sedov2012-03-221-20/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | several new kerberos related libraries and applications to FreeBSD: o kgetcred(1) allows one to manually get a ticket for a particular service. o kf(1) securily forwards ticket to another host through an authenticated and encrypted stream. o kcc(1) is an umbrella program around klist(1), kswitch(1), kgetcred(1) and other user kerberos operations. klist and kswitch are just symlinks to kcc(1) now. o kswitch(1) allows you to easily switch between kerberos credentials if you're running KCM. o hxtool(1) is a certificate management tool to use with PKINIT. o string2key(1) maps a password into key. o kdigest(8) is a userland tool to access the KDC's digest interface. o kimpersonate(8) creates a "fake" ticket for a service. We also now install manpages for some lirbaries that were not installed before, libheimntlm and libhx509. - The new HEIMDAL version no longer supports Kerberos 4. All users are recommended to switch to Kerberos 5. - Weak ciphers are now disabled by default. To enable DES support (used by telnet(8)), use "allow_weak_crypto" option in krb5.conf. - libtelnet, pam_ksu and pam_krb5 are now compiled with error on warnings disabled due to the function they use (krb5_get_err_text(3)) being deprecated. I plan to work on this next. - Heimdal's KDC now require sqlite to operate. We use the bundled version and install it as libheimsqlite. If some other FreeBSD components will require it in the future we can rename it to libbsdsqlite and use for these components as well. - This is not a latest Heimdal version, the new one was released while I was working on the update. I will update it to 1.5.2 soon, as it fixes some important bugs and security issues. Notes: svn path=/head/; revision=233294
* - Make heimdal buildable with WITH_OPENLDAP defined, again.Hajimu UMEMOTO2011-12-051-3/+3
| | | | | | | - Our heimdal uses the deprecated OpenLDAP functions. Notes: svn path=/head/; revision=228284
* - Add missing interdependencies to kerberos libraries. Some of theStanislav Sedov2011-09-271-0/+3
| | | | | | | | | | | | kerberos libraries were not linked properly (missing dependencies), which causes 3rd party applications linking to fail when --as-needed ld flag is used. I also added the --no-undefined ld(1) flag to make sure that there're no missing dependencies. MFC after: 3 days Notes: svn path=/head/; revision=225778
* Fix conflicts after heimdal-1.1 import and add build infrastructure. ImportDoug Rabson2008-05-071-5/+18
| | | | | | | all non-style changes made by heimdal to our own libgssapi. Notes: svn path=/head/; revision=178828
* style.Makefile(5).Ruslan Ermilov2004-02-051-31/+25
| | | | | | | OK'ed by: nectar Notes: svn path=/head/; revision=125491
* Overhaul of kerberos5/ makefiles. Most significant changes are:Ruslan Ermilov2004-01-311-74/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Dropped support for standalone builds, this was only partially supported anyway, and required so much magic in makefiles that made life dangerous (e.g., by using the custom yacc rules). - Got rid of .OBJDIR in makefiles -- makes building of individual files possible again. - Made the .x.c transformations -j safe. - Reprogrammed LDADD to fix static build of some utilities that was broken. - Fixed LDFLAGS and DPADD in the WITH_OPENLDAP case -- positively affects the contents of .depend files. - Removed redundant .h's from SRCS, only kept those that are generated. - libkrb5/ INCS were bogusly installed again with libgssapi/. - Made build-tools real tools with their own makefiles in separate directories. This allows us to properly track their dependencies, etc. - Faster build, 21% less of makefile code! Approved by: nectar Reviewed by: markm Silence on: arch Notes: svn path=/head/; revision=125261
* The header files hdb_asn1.h, hdb_err.h, and kadm5_err.h are generated,Jacques Vidrine2003-10-101-2/+2
| | | | | | | | | and must be installed from ${.OBJDIR}. Pointy hat: nectar Notes: svn path=/head/; revision=120968
* Install additional headers for Kerberos (libkafs, libkadm5*, andJacques Vidrine2003-10-091-0/+7
| | | | | | | libhdb). Notes: svn path=/head/; revision=120950
* Try a lot harder to get dependancies right. This involves some uglyMark Murray2003-07-271-10/+30
| | | | | | | | | | | | looking ${.OBJDIR} work that has the up-side of actually working in upgrade and make -jN cases. This needs to be revisited further, and it is conceivable that the ${.OBJDIR} stuff can be simplified, but the sheer number of edge cases and other causes make this Hard(tm). For now, this works. Notes: svn path=/head/; revision=118092
* Big fixup of the makefiles. Sort out the dependancies so that "make"Mark Murray2003-07-181-31/+32
| | | | | | | | without "make depend" works, "make -j N" works, and lists of source files are made vertical to reduce future diffs. Notes: svn path=/head/; revision=117728
generated by cgit v1.2.3 (git 2.25.1) at 2026-02-04 04:37:53 +0000