summaryrefslogtreecommitdiff
path: root/third_party
Commit message (Collapse)AuthorAgeFilesLines
* third_party/heimdal: Import lorikeet-heimdal-202305160500 (commit ↵Joseph Sutton2023-05-186-18/+29
| | | | | | | | | 8836d64dee78a74aa740e31b7ad406b8a8cfdad0) NOTE: THIS COMMIT WON’T COMPILE/WORK ON ITS OWN! Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal_build: Remove MD2Joseph Sutton2023-03-312-2/+1
| | | | | | | | | | | | | | | This is to adapt to Heimdal: commit 3a5e91eca26284661fd2294dfc485305e5d5cc3d Author: Nicolas Williams <nico@twosigma.com> Date: Tue Oct 25 22:20:45 2022 -0500 hcrypto: Remove MD2 with prejudice NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal: Import lorikeet-heimdal-202303200103 (commit ↵Joseph Sutton2023-03-31235-2188/+5973
| | | | | | | | | 2ee541b5e963f7cffb1ec4acd1a8cc45426a9f28) NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party: Update uid_wrapper to version 1.3.0Stefan Metzmacher2023-01-181-75/+525
| | | | | | | | | | | | This is mainly needed in order to have some interaction with socket_wrapper 1.4.0 regarding the implementation of syscall(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Jan 18 12:47:48 UTC 2023 on sn-devel-184
* third_party: Update socket_wrapper to version 1.4.0Stefan Metzmacher2023-01-182-17/+884
| | | | | | | | | The key feature is support for sendmmsg and recvmmsg, which is required by modern libuv versions, e.g. nsupdate -g makes use of libuv, so we need this for samba. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* third_party: Update waf to version 2.0.25Andreas Schneider2023-01-0612-94/+247
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* third_party: Update resolv_wrapper to version 1.1.8Andreas Schneider2022-12-212-2/+4
| | | | | | | | | | res_randomid() is marked as deprecated in newer glibc. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Dec 21 21:28:42 UTC 2022 on sn-devel-184
* CVE-2022-37966 kdc: Implement new Kerberos session key behaviour since ↵Andrew Bartlett2022-12-134-10/+47
| | | | | | | | | | | | | | | | | ENC_HMAC_SHA1_96_AES256_SK was added ENC_HMAC_SHA1_96_AES256_SK is a flag introduced for by Microsoft in this CVE to indicate that additionally, AES session keys are available. We set the etypes available for session keys depending on the encryption types that are supported by the principal. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15219 Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2022-37966 third_party/heimdal: Fix error message typoJoseph Sutton2022-12-131-1/+1
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-37967 Add new PAC checksumJoseph Sutton2022-12-133-29/+143
| | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15231 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2022-37966 HEIMDAL: Look up the server keys to combine with clients ↵Andrew Bartlett2022-12-131-1/+1
| | | | | | | | | | | | | | etype list to select a session key We need to select server, not client, to compare client etypes against. (It is not useful to compare the client-supplied encryption types with the client's own long-term keys.) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* CVE-2022-44640 HEIMDAL: asn1: invalid free in ASN.1 codecNicolas Williams2022-12-065-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Heimdal's ASN.1 compiler generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free function on the decoded structure upon decode error. This is known to impact the Heimdal KDC, leading to an invalid free() of an address partly or wholly under the control of the attacker, in turn leading to a potential remote code execution (RCE) vulnerability. This error affects the DER codec for all CHOICE types used in Heimdal, though not all cases will be exploitable. We have not completed a thorough analysis of all the Heimdal components affected, thus the Kerberos client, the X.509 library, and other parts, may be affected as well. This bug has been in Heimdal since 2005. It was first reported by Douglas Bagnall, though it had been found independently by the Heimdal maintainers via fuzzing a few weeks earlier. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14929 (cherry-picked from Heimdal commit 9c9dac2b169255bad9071eea99fa90b980dde767) Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Dec 6 13:41:05 UTC 2022 on sn-devel-184
* CVE-2022-42898: HEIMDAL: lib/krb5: fix _krb5_get_int64 on systems where ↵Stefan Metzmacher2022-11-241-1/+1
| | | | | | | | | | | 'unsigned long' is just 32-bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=15203 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party: Update socket_wrapper to version 1.3.5Stefan Metzmacher2022-11-241-6/+33
| | | | | | | This injects O_LARGEFILE as needed. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* CVE-2022-42898 third_party/heimdal: PAC parse integer overflowsJoseph Sutton2022-11-152-218/+444
| | | | | | | | | | | | | | | | | Catch overflows that result from adding PAC_INFO_BUFFER_SIZE. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15203 Heavily edited by committer Nico Williams <nico@twosigma.com>, original by Joseph Sutton <josephsutton@catalyst.net.nz>. Signed-off-by: Nico Williams <nico@twosigma.com> [jsutton@samba.org Zero-initialised header_size in krb5_pac_parse() to avoid a maybe-uninitialized error; added a missing check for ret == 0] Autobuild-User(master): Jule Anger <janger@samba.org> Autobuild-Date(master): Tue Nov 15 17:02:52 UTC 2022 on sn-devel-184
* third_party: Update nss_wrapper to version 1.1.13Andreas Schneider2022-11-092-117/+228
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Nov 9 23:15:07 UTC 2022 on sn-devel-184
* krb5: Detect support for krb5_const_pac typeJoseph Sutton2022-11-081-1/+2
| | | | | | | | | | | We can't unconditionally assume (as we did in third_party/heimdal_build/wscript_configure) that Heimdal has this type, since we may have an older system Heimdal that lacks it. We must also check whether krb5_pac_get_buffer() is usable with krb5_const_pac, and declare krb5_const_pac as a non-const typedef if not. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal_build: Update fallthrough macro for switch statementsJoseph Sutton2022-11-021-1/+1
| | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit 133f5174820b34e2a12c3f3412bf554cae2ee22f Author: Daria Phoebe Brashear <dariaphoebe@auristor.com> Date: Fri Sep 16 09:57:24 2022 -0400 rewrite fallthrough to HEIM_FALLTHROUGH to deal with new Apple SDKs Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Nov 2 05:21:29 UTC 2022 on sn-devel-184
* third_party/heimdal: import lorikeet-heimdal-202210310104 (commit ↵Andrew Bartlett2022-11-02154-1751/+6672
| | | | | | | | | | | | | | 0fc20ff4144973047e6aaaeb2fc8708bd75be222) This commit won't compile on it's own, as we need to fix the build system to cope in the next commit. The purpose of this commit is to update to a new lorikeet-heimdal tree that includes the previous two patches and is rebased on a current Heimdal master snapshot. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* heimdal: Fix the 32-bit build on FreeBSDVolker Lendecke2022-11-025-7/+7
| | | | | | | | REF: https://github.com/heimdal/heimdal/pull/1004 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15220 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal: Introduce macro for common plugin structure elementsJoseph Sutton2022-11-0217-62/+57
| | | | | | | | | | | | | | | | | Heimdal's HDB plugin interface, and hence Samba's KDC that depends upon it, doesn't work on 32-bit builds due to structure fields being arranged in the wrong order. This problem presents itself in the form of segmentation faults on 32-bit systems, but goes unnoticed on 64-bit builds thanks to extra structure padding absorbing the errant fields. This commit reorders the HDB plugin structure fields to prevent crashes and introduces a common macro to ensure every plugin presents a consistent interface. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15110 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* wafsamba: Add -Werror=old-style-definitionAndreas Schneider2022-10-271-1/+2
| | | | | | | See https://fedoraproject.org/wiki/Changes/PortingToModernC Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* CVE-2022-3437 third_party/heimdal: Pass correct length to _gssapi_verify_pad()Joseph Sutton2022-10-251-2/+2
| | | | | | | | | | | | | | We later subtract 8 when calculating the length of the output message buffer. If padlength is excessively high, this calculation can underflow and result in a very large positive value. Now we properly constrain the value of padlength so underflow shouldn't be possible. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Check for overflow in _gsskrb5_get_mech()Joseph Sutton2022-10-251-0/+2
| | | | | | | | | | | | | | If len_len is equal to total_len - 1 (i.e. the input consists only of a 0x60 byte and a length), the expression 'total_len - 1 - len_len - 1', used as the 'len' parameter to der_get_length(), will overflow to SIZE_MAX. Then der_get_length() will proceed to read, unconstrained, whatever data follows in memory. Add a check to ensure that doesn't happen. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Check buffer length against overflow for ↵Joseph Sutton2022-10-251-0/+14
| | | | | | | | | DES{,3} unwrap BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Check the result of _gsskrb5_get_mech()Joseph Sutton2022-10-251-0/+4
| | | | | | | | | | We should make sure that the result of 'total_len - mech_len' won't overflow, and that we don't memcmp() past the end of the buffer. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Avoid undefined behaviour in ↵Joseph Sutton2022-10-251-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | _gssapi_verify_pad() By decrementing 'pad' only when we know it's safe, we ensure we can't stray backwards past the start of a buffer, which would be undefined behaviour. In the previous version of the loop, 'i' is the number of bytes left to check, and 'pad' is the current byte we're checking. 'pad' was decremented at the end of each loop iteration. If 'i' was 1 (so we checked the final byte), 'pad' could potentially be pointing to the first byte of the input buffer, and the decrement would put it one byte behind the buffer. That would be undefined behaviour. The patch changes it so that 'pad' is the byte we previously checked, which allows us to ensure that we only decrement it when we know we have a byte to check. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Don't pass NULL pointers to memcpy() in ↵Joseph Sutton2022-10-251-6/+8
| | | | | | | | | DES unwrap BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Use constant-time memcmp() in unwrap_des3()Joseph Sutton2022-10-251-1/+1
| | | | | | | | | | The surrounding checks all use ct_memcmp(), so this one was presumably meant to as well. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Use constant-time memcmp() for arcfour unwrapJoseph Sutton2022-10-251-7/+7
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal_build: Add gssapi-subsystem subsystemJoseph Sutton2022-10-251-6/+12
| | | | | | | | | | This allows us to access (and so test) functions internal to GSSAPI by depending on this subsystem. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-3437 third_party/heimdal: Remove __func__ compatibility workaroundJoseph Sutton2022-10-251-4/+0
| | | | | | | | | | | | As described by the C standard, __func__ is a variable, not a macro. Hence this #ifndef check does not work as intended, and only serves to unconditionally disable __func__. A nonoperating __func__ prevents cmocka operating correctly, so remove this definition. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* krb5: Add compatability for krb5_const_pac typeJoseph Sutton2022-10-211-0/+1
| | | | | | | | This allows this type to be used in Samba in the future for both Kerberos implementations Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* third_party: Reformat shell scriptsAndreas Schneider2022-08-102-21/+22
| | | | | | | | | | | shfmt -w -p -i 0 -fn third_party/update.sh shfmt -w -p -i 0 -fn third_party/waf/update.sh Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org> Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org> Autobuild-Date(master): Wed Aug 10 14:14:04 UTC 2022 on sn-devel-184
* CVE-2022-2031 third_party/heimdal: Add function to get current KDC timeJoseph Sutton2022-07-273-0/+8
| | | | | | | | | | This allows the plugin to check the endtime of a ticket against the KDC's current time, to see if the ticket will expire in the next two minutes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* CVE-2022-2031 third_party/heimdal: Check generate_pac() return codeJoseph Sutton2022-07-271-1/+3
| | | | | | | | If the function fails, we should not issue a ticket missing the PAC. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* third_party: Update socket_wrapper to version 1.3.4Andreas Schneider2022-07-222-9/+11
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* third_party: Update nss_wraper to version 1.1.12Andreas Schneider2022-06-242-4/+29
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Jun 24 22:29:33 UTC 2022 on sn-devel-184
* third_party/heimdal: Fix build with gcc version 12.1Samuel Cabrero2022-06-141-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Split lib/krb5/crypto to its own subsystem to built with its own CFLAGS and avoid the following error: [1510/4771] Compiling third_party/heimdal/lib/krb5/crypto.c ../../third_party/heimdal/lib/krb5/crypto.c: In function ‘_krb5_internal_hmac’: ../../third_party/heimdal/lib/krb5/crypto.c:302:24: warning: cast discards ‘const’ qualifier from pointer target type [-Wcast-qual] 302 | iov[0].data.data = (void *) data; | ^ ../../third_party/heimdal/lib/krb5/crypto.c: In function ‘derive_key_sp800_hmac’: ../../third_party/heimdal/lib/krb5/crypto.c:2427:18: warning: cast discards ‘const’ qualifier from pointer target type [-Wcast-qual] 2427 | label.data = (void *)constant; | ^ ../../third_party/heimdal/lib/krb5/crypto.c: In function ‘decrypt_internal_derived’: ../../third_party/heimdal/lib/krb5/crypto.c:1280:9: error: pointer ‘p’ may be used after ‘realloc’ [-Werror=use-after-free] 1280 | free(p); | ^~~~~~~ ../../third_party/heimdal/lib/krb5/crypto.c:1278:20: note: call to ‘realloc’ here 1278 | result->data = realloc(p, l); | ^~~~~~~~~~~~~ ../../third_party/heimdal/lib/krb5/crypto.c: In function ‘decrypt_internal_enc_then_cksum’: ../../third_party/heimdal/lib/krb5/crypto.c:1365:9: error: pointer ‘p’ may be used after ‘realloc’ [-Werror=use-after-free] 1365 | free(p); | ^~~~~~~ ../../third_party/heimdal/lib/krb5/crypto.c:1363:20: note: call to ‘realloc’ here 1363 | result->data = realloc(p, l); | ^~~~~~~~~~~~~ ../../third_party/heimdal/lib/krb5/crypto.c: In function ‘decrypt_internal’: ../../third_party/heimdal/lib/krb5/crypto.c:1431:9: error: pointer ‘p’ may be used after ‘realloc’ [-Werror=use-after-free] 1431 | free(p); | ^~~~~~~ ../../third_party/heimdal/lib/krb5/crypto.c:1429:20: note: call to ‘realloc’ here 1429 | result->data = realloc(p, l); | ^~~~~~~~~~~~~ ../../third_party/heimdal/lib/krb5/crypto.c: In function ‘decrypt_internal_special’: ../../third_party/heimdal/lib/krb5/crypto.c:1478:9: error: pointer ‘p’ may be used after ‘realloc’ [-Werror=use-after-free] 1478 | free(p); | ^~~~~~~ ../../third_party/heimdal/lib/krb5/crypto.c:1476:20: note: call to ‘realloc’ here 1476 | result->data = realloc(p, sz); | ^~~~~~~~~~~~~~ cc1: all warnings being treated as errors BUG: https://bugzilla.samba.org/show_bug.cgi?id=15095 Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Samuel Cabrero <scabrero@samba.org> Autobuild-Date(master): Tue Jun 14 10:16:18 UTC 2022 on sn-devel-184
* third_party: Update waf to version 2.0.24Andreas Schneider2022-05-235-7/+24
| | | | | | | | | | | | This fixes building of python libraries with Python 3.11! BUG: https://bugzilla.samba.org/show_bug.cgi?id=15071 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon May 23 09:34:51 UTC 2022 on sn-devel-184
* third_party:waf: Do not recurse in aesni-intel if GnuTLS provides the cipherAndreas Schneider2022-04-041-2/+4
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Apr 4 19:31:28 UTC 2022 on sn-devel-184
* Add missing final newline to end of sh fileAndreas Schneider2022-04-011-1/+1
| | | | | | find $(pwd) -type f -name "*.sh" | xargs sed -i -e '$a\' Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal: import lorikeet-heimdal-202203101710 (commit ↵Stefan Metzmacher2022-03-113-41/+134
| | | | | | | | | | | | | | | df8d801544144949931cd742169be1207b239c3d) This fixes the regressions against KDCs without FAST support. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15002 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15005 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Mar 11 18:06:47 UTC 2022 on sn-devel-184
* third_party/heimdal: import lorikeet-heimdal-202203101709 (commit ↵Stefan Metzmacher2022-03-1113-10/+590
| | | | | | | | | | 47863866da25cc21d292ce335a976b8b33fa1864) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15002 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15005 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* third_party/heimdal: import lorikeet-heimdal-202203031927 (commit ↵Stefan Metzmacher2022-03-0616-45/+189
| | | | | | | | | | | 7abc451ddd74d0c2e57dbb32f3198bde8def73ab) NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14865 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Adapt to hdb_entry_ex removalJoseph Sutton2022-03-011-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than having a 'free_entry' member that can be called to free an hdb_entry, we now implement the free function in HDB. We perform the free only if the context pointer is non-NULL. We also remove the ZERO_STRUCTP() in sdb_entry_to_hdb_entry(), as the context pointer is now part of the 'hdb_entry' structure itself, and this would undesirably zero it out. This is an adaptation to Heimdal commits: commit c5551775e204d00c7ee8055ab6ddbba7e0590584 Author: Luke Howard <lukeh@padl.com> Date: Fri Jan 7 12:15:55 2022 +1100 hdb: decorate HDB_entry with context member Decorate HDB_entry with context and move free_entry callback into HDB structure itself. Requires updating hdb_free_entry() signature to include HDB parameter. A follow-up commit will consolidate hdb_entry_ex (which has a single hdb_entry member) into hdb_entry. commit 0e8c4ccc6ee0123ea39e53e8917fc3f6bb74e8c8 Author: Luke Howard <lukeh@padl.com> Date: Fri Jan 7 12:54:40 2022 +1100 hdb: eliminate hdb_entry_ex Remove hdb_entry_ex and revert to the original design of hdb_entry (except with an additional context member in hdb_entry which is managed by the free_entry method in HDB). NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal_build: Don't generate .x source filesJoseph Sutton2022-03-011-39/+8
| | | | | | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit 9427796f1a65906f12768b28abdb5a928222f3c6 Author: Jeffrey Altman <jaltman@secure-endpoints.com> Date: Wed Jan 5 15:45:23 2022 -0500 Generate .x source files as .c source files The generated .x source and .hx header files are plain C source files. Generate them as .c source files and avoid unnecessary file copying and special makefile rules. Change-Id: Ifc4bbe3c46dd357fdd642040ad964c7cfe1d395c NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal_build: Add SFU source fileJoseph Sutton2022-03-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit 0287558838de79313e38026d2f0905ffc987d0b8 Author: Luke Howard <lukeh@padl.com> Date: Fri Dec 24 13:49:55 2021 +1100 kdc: move Services for User implementation out of krb5tgs.c Move the Services for User (SFU/S4U) implementation -- protocol transition and constrained delegation -- into its own compilation unit, with an interface that only takes an astgs_request_t, so it can be easily factored out into a plugin module in the future. This refactoring is also careful to update all client names in the request structure after the SFU/S4U validation has successfully completed. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Rename windc to kdc pluginJoseph Sutton2022-03-013-2/+2
| | | | | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit fcff5933ade652343d7c169659da92fac0e6e0d4 Author: Luke Howard <lukeh@padl.com> Date: Mon Jan 3 11:10:18 2022 +1100 kdc: rename windc to kdc plugin Rename the "windc" plugin API to the more general "kdc" plugin API, for two reasons: the Heimdal KDC uses the Windows PAC even when not emulating a domain controller, and the plugin API has accreted methods that are not specific to emulating a domain controller (such as referral_policy and finalize_reply). NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* third_party/heimdal_build: Add source files to buildJoseph Sutton2022-03-011-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit be708ca3cf98900c61919f8ff7ced4428b5d1f32 Author: Nicolas Williams <nico@twosigma.com> Date: Wed Dec 22 17:01:12 2021 -0600 gsskrb5: Add simple name attributes support This adds Kerberos mechanism support for: - composite principal name export/import - getting rudimentary name attributes from GSS names using gss_get_name_attribute(): - all (raw) authorization data from the Ticket - all (raw) authorization data from the Authenticator - transit path - realm - component count - each component - gss_inquire_name() - gss_display_name_ext() (just for the hostbased service name type though) The test exercises almost all of the functionality, except for: - getting the PAC - getting authz-data from the Authenticator - getting the transit path TBD (much) later: - amend test_context to do minimal name attribute checks as well - gss_set_name_attribute() (to request authz-data) - gss_delete_name_attribute() - getting specific authorization data elements via URN fragments (as opposed to all of them) - parsing the PAC, extracting SIDs (each one as a separate value) - some configurable local policy (?) - plugin interface for additional local policy NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status