head 1.4; access; symbols pkgsrc-2026Q1:1.3.0.30 pkgsrc-2026Q1-base:1.3 pkgsrc-2025Q4:1.3.0.28 pkgsrc-2025Q4-base:1.3 pkgsrc-2025Q3:1.3.0.26 pkgsrc-2025Q3-base:1.3 pkgsrc-2025Q2:1.3.0.24 pkgsrc-2025Q2-base:1.3 pkgsrc-2025Q1:1.3.0.22 pkgsrc-2025Q1-base:1.3 pkgsrc-2024Q4:1.3.0.20 pkgsrc-2024Q4-base:1.3 pkgsrc-2024Q3:1.3.0.18 pkgsrc-2024Q3-base:1.3 pkgsrc-2024Q2:1.3.0.16 pkgsrc-2024Q2-base:1.3 pkgsrc-2024Q1:1.3.0.14 pkgsrc-2024Q1-base:1.3 pkgsrc-2023Q4:1.3.0.12 pkgsrc-2023Q4-base:1.3 pkgsrc-2023Q3:1.3.0.10 pkgsrc-2023Q3-base:1.3 pkgsrc-2023Q2:1.3.0.8 pkgsrc-2023Q2-base:1.3 pkgsrc-2023Q1:1.3.0.6 pkgsrc-2023Q1-base:1.3 pkgsrc-2022Q4:1.3.0.4 pkgsrc-2022Q4-base:1.3 pkgsrc-2022Q3:1.3.0.2 pkgsrc-2022Q3-base:1.3 pkgsrc-2022Q2:1.2.0.34 pkgsrc-2022Q2-base:1.2 pkgsrc-2022Q1:1.2.0.32 pkgsrc-2022Q1-base:1.2 pkgsrc-2021Q4:1.2.0.30 pkgsrc-2021Q4-base:1.2 pkgsrc-2021Q3:1.2.0.28 pkgsrc-2021Q3-base:1.2 pkgsrc-2021Q2:1.2.0.26 pkgsrc-2021Q2-base:1.2 pkgsrc-2021Q1:1.2.0.24 pkgsrc-2021Q1-base:1.2 pkgsrc-2020Q4:1.2.0.22 pkgsrc-2020Q4-base:1.2 pkgsrc-2020Q3:1.2.0.20 pkgsrc-2020Q3-base:1.2 pkgsrc-2020Q2:1.2.0.18 pkgsrc-2020Q2-base:1.2 pkgsrc-2020Q1:1.2.0.14 pkgsrc-2020Q1-base:1.2 pkgsrc-2019Q4:1.2.0.16 pkgsrc-2019Q4-base:1.2 pkgsrc-2019Q3:1.2.0.12 pkgsrc-2019Q3-base:1.2 pkgsrc-2019Q2:1.2.0.10 pkgsrc-2019Q2-base:1.2 pkgsrc-2019Q1:1.2.0.8 pkgsrc-2019Q1-base:1.2 pkgsrc-2018Q4:1.2.0.6 pkgsrc-2018Q4-base:1.2 pkgsrc-2018Q3:1.2.0.4 pkgsrc-2018Q3-base:1.2 pkgsrc-2018Q2:1.2.0.2 pkgsrc-2018Q2-base:1.2 pkgsrc-2018Q1:1.1.0.20 pkgsrc-2018Q1-base:1.1 pkgsrc-2017Q4:1.1.0.18 pkgsrc-2017Q4-base:1.1 pkgsrc-2017Q3:1.1.0.16 pkgsrc-2017Q3-base:1.1 pkgsrc-2017Q2:1.1.0.12 pkgsrc-2017Q2-base:1.1 pkgsrc-2017Q1:1.1.0.10 pkgsrc-2017Q1-base:1.1 pkgsrc-2016Q4:1.1.0.8 pkgsrc-2016Q4-base:1.1 pkgsrc-2016Q3:1.1.0.6 pkgsrc-2016Q3-base:1.1 pkgsrc-2016Q2:1.1.0.4 pkgsrc-2016Q2-base:1.1 pkgsrc-2016Q1:1.1.0.2 pkgsrc-2016Q1-base:1.1; locks; strict; comment @# @; 1.4 date 2026.04.07.14.12.48; author tnn; state Exp; branches; next 1.3; commitid 98wR1anBQS5qa2BG; 1.3 date 2022.07.29.20.22.44; author jperkin; state Exp; branches; next 1.2; commitid tjOn0SDngl12xPND; 1.2 date 2018.06.15.20.46.01; author tez; state Exp; branches; next 1.1; commitid J8ZFjzKHdbvO2qGA; 1.1 date 2016.03.15.15.16.39; author tez; state Exp; branches; next ; commitid vfGyRvS5ID9EDKYy; desc @@ 1.4 log @mit-krb5: update to 1.22.2 Major changes in 1.22.2 (2026-01-29) ------------------------------------ * Fix a SPNEGO packet parsing bug which could cause GSS mechanism negotiation failure. Major changes in 1.22.1 (2025-08-20) ------------------------------------ * Fix a vulnerability in GSS MIC verification [CVE-2025-57736]. Major changes in 1.22 (2025-08-05) ---------------------------------- User experience: * The libdefaults configuration variable "request_timeout" can be set to limit the total timeout for KDC requests. When making a KDC request, the client will now wait indefinitely (or until the request timeout has elapsed) on a KDC which accepts a TCP connection, without contacting any additional KDCs. Clients will make fewer DNS queries in some configurations. * The realm configuration variable "sitename" can be set to cause the client to query site-specific DNS records when making KDC requests. Administrator experience: * Principal aliases are supported in the DB2 and LMDB KDB modules and in the kadmin protocol. (The LDAP KDB module has supported aliases since release 1.7.) * UNIX domain sockets are supported for the Kerberos and kpasswd protocols. * systemd socket activation is supported for krb5kdc and kadmind. Developer experience: * KDB modules can be be implemented in terms of other modules using the new krb5_db_load_module() function. * The profile library supports the modification of empty profiles and the copying of modified profiles, making it possible to construct an in-memory profile and pass it to krb5_init_context_profile(). * GSS-API applications can pass the GSS_C_CHANNEL_BOUND flag to gss_init_sec_context() to request strict enforcement of channel bindings by the acceptor. Protocol evolution: * The PKINIT preauth module supports elliptic curve client certificates, ECDH key exchange, and the Microsoft paChecksum2 field. * The IAKERB implementation has been changed to comply with the most recent draft standard and to support realm discovery. * Message-Authenticator is supported in the RADIUS implementation used by the OTP kdcpreauth module. @ text @$NetBSD$ Add --enable-pkgsrc-libtool option (was patch-ag) --- config/shlib.conf.orig 2025-08-20 19:44:32.000000000 +0000 +++ config/shlib.conf @@@@ -22,6 +22,7 @@@@ SHLIBVEXT=.so.v-nobuild SHLIBSEXT=.so.s-nobuild # Most systems support profiled libraries. PFLIBEXT=_p.a +LALIBEXT=.la # Install libraries executable. Some systems (e.g., RPM-based ones) require # this for package dependency generation, while others are ambivalent or will # strip it during packaging. @@@@ -45,6 +46,7 @@@@ lib_unload_prevented=no STOBJEXT=.o SHOBJEXT=.so PFOBJEXT=.po +LAOBJEXT=.lo # Default for systems w/o shared libraries CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)' @@@@ -59,6 +61,9 @@@@ INIT_FINI_PREP=: default_static=no default_shared=yes +SHLIB_RPATH_FLAGS='${COMPILER_RPATH_FLAG}$(SHLIB_RDIRS)' +PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' + # Set up architecture-specific variables. case $krb5_cv_host in # Note: "-Wl,+s" when building executables enables the use of the @@@@ -91,17 +96,14 @@@@ case $krb5_cv_host in RPATH_FLAG='-Wl,+b,' if test "$ac_cv_c_compiler_gnu" = yes; then PICFLAGS=-fPIC - SHLIB_RPATH_FLAGS='-Wl,+b,$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='-Wl,+s $(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' LDCOMBINE='gcc -fPIC -shared -Wl,+h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) -Wl,-c,hpux.exports' else PICFLAGS=+z - SHLIB_RPATH_FLAGS='+b $(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' LDCOMBINE='ld -b +h $(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) -c hpux.exports' fi MAKE_SHLIB_COMMAND="${LDCOMBINE} -o \$@@ \$\$objlist \$(LDFLAGS) \$(SHLIB_EXPFLAGS) ${LDCOMBINE_TAIL}" - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -120,35 +122,13 @@@@ case $krb5_cv_host in use_linker_fini_option=yes ;; -mips-*-netbsd*) - PICFLAGS=-fPIC - SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)' - SHLIBSEXT='.so.$(LIBMAJOR)' - SHLIBEXT=.so - LDCOMBINE='ld -shared -soname $(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) -z nodelete' - SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' - SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' - RPATH_FLAG='-Wl,-rpath -Wl,' - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' - CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' - CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' - CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' - CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)' - RUN_ENV='LD_LIBRARY_PATH=`echo $(PROG_LIBPATH) | sed -e "s/-L//g" -e "s/ /:/g"`' - RUN_VARS='LD_LIBRARY_PATH' - PROFFLAGS=-pg - lib_unload_prevented=yes - ;; - -*-*-netbsd*) +*-*-netbsd* | *-*-dragonfly*) PICFLAGS=-fPIC SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)' SHLIBEXT=.so LDCOMBINE='$(CC) -shared -Wl,-z,nodelete' - SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' - RPATH_FLAG=-R - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' + RPATH_FLAG='${COMPILER_RPATH_FLAG}' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -170,12 +150,10 @@@@ mips-*-netbsd*) esac SHLIBVEXT='.so.$(LIBMAJOR)' RPATH_FLAG='-Wl,--enable-new-dtags -Wl,-rpath -Wl,' - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' SHLIBEXT=.so LDCOMBINE='ld -Bshareable -z nodelete' - SHLIB_RPATH_FLAGS='--enable-new-dtags -rpath $(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)' @@@@ -190,10 +168,8 @@@@ mips-*-netbsd*) SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)' SHLIBEXT=.so LDCOMBINE='ld -Bshareable -z nodelete' - SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' RPATH_FLAG=-R - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -220,7 +196,7 @@@@ mips-*-netbsd*) for lib in libkrb5support.1.1.dylib libkadm5srv.5.1.dylib libkdb5.4.0.dylib; do LDCOMBINE_TAIL="$LDCOMBINE_TAIL -dylib_file \"\$(KRB5_LIBDIR)/$lib\":\$(TOPLIBD)/$lib" done - MAKE_DYNOBJ_COMMAND='$(CC) -bundle $(CFLAGS) $(LDFLAGS) -o $@@ $$objlist $(DYNOBJ_EXPFLAGS) $(LDFLAGS) -exported_symbols_list darwin.exports'" ${LDCOMBINE_TAIL}" + MAKE_DYNOBJ_COMMAND='${LIBTOOL} --mode=link $(CC) -bundle $(CFLAGS) $(LDFLAGS) -o $@@ $$objlist $(DYNOBJ_EXPFLAGS) $(LDFLAGS) -exported_symbols_list darwin.exports'" ${LDCOMBINE_TAIL}" CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -dynamic $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) -dynamic $(CXXFLAGS) $(LDFLAGS)' @@@@ -251,11 +227,9 @@@@ mips-*-netbsd*) SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)' SHLIBSEXT='.so.$(LIBMAJOR)' SHLIBEXT=.so - SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' PROFFLAGS=-pg - RPATH_FLAG=-R - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' + RPATH_FLAG=${COMPILER_RPATH_FLAG} CC_LINK_SHARED='$(PURE) $(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(PURE) $(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(PURE) $(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -281,10 +255,8 @@@@ mips-*-netbsd*) RPATH_FLAG='-Wl,--enable-new-dtags -Wl,-rpath -Wl,' # For cases where we do have dependencies on other libraries # built in this tree... - SHLIB_RPATH_FLAGS='$(RPATH_FLAG)$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' PROFFLAGS=-pg - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -324,9 +296,8 @@@@ mips-*-netbsd*) # Assume initialization always delayed. INIT_FINI_PREP="wl=${wl_prefix}; "'i=1; initfini=; for f in . $(LIBFINIFUNC); do if test $$f != .; then initfini="$$initfini $${wl}-binitfini::$$f:$$i"; else :; fi; i=`expr $$i + 1`; done' use_linker_fini_option=yes - MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LDCOMBINE}" + MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LIBTOOL} --mode=link ${LDCOMBINE}" RPATH_TAIL=:/usr/lib:/lib - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH):'"$RPATH_TAIL" CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -339,8 +310,14 @@@@ esac if test "${MAKE_SHLIB_COMMAND}" = "x" ; then if test "${INIT_FINI_PREP}" != ":"; then - MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LDCOMBINE} -o \$@@ \$\$objlist \$(SHLIB_EXPFLAGS) \$(LDFLAGS) ${LDCOMBINE_TAIL}" + MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LIBTOOL} --mode=link ${LDCOMBINE} -o \$@@ \$\$objlist \$(SHLIB_EXPFLAGS) \$(LDFLAGS) ${LDCOMBINE_TAIL}" else - MAKE_SHLIB_COMMAND="${LDCOMBINE} -o \$@@ \$\$objlist \$(SHLIB_EXPFLAGS) \$(LDFLAGS) ${LDCOMBINE_TAIL}" + MAKE_SHLIB_COMMAND="${LIBTOOL} --mode=link ${LDCOMBINE} -o \$@@ \$\$objlist \$(SHLIB_EXPFLAGS) \$(LDFLAGS) ${LDCOMBINE_TAIL}" fi fi + +# Settings for building with pkgsrc libtool. +CC_LINK_LIBTOOL='$(LIBTOOL) --mode=link '"$CC_LINK_SHARED" +LALIB_EXPFLAGS='$(SHLIB_EXPFLAGS)' +LIBTOOL_TAIL='-rpath $(KRB5_LIBDIR) -version-info $(LIBMAJOR):$(LIBMINOR)' +INSTALL_SHLIB='$(INSTALL)' @ 1.3 log @mit-krb5: Update to 1.19.3. Major changes in 1.19.3 (2022-03-11) ------------------------------------ This is a bug fix release. * Fix a denial of service attack against the KDC [CVE-2021-37750]. krb5-1.19.3 changes by ticket ID -------------------------------- 9008 Fix KDC null deref on TGS inner body null server 9023 Fix conformance issue in GSSAPI tests Major changes in 1.19.2 (2021-07-22) ------------------------------------ This is a bug fix release. * Fix a denial of service attack against the KDC encrypted challenge code [CVE-2021-36222]. * Fix a memory leak when gss_inquire_cred() is called without a credential handle. krb5-1.19.2 changes by ticket ID -------------------------------- 8989 Fix typo in enctypes.rst 8992 Avoid rand() in aes-gen test program 9005 Fix argument type errors on Windows 9006 doc build fails with Sphinx 4.0.2 9007 Fix KDC null deref on bad encrypted challenge 9014 Using locking in MEMORY krb5_cc_get_principal() 9015 Fix use-after-free during krad remote_shutdown() 9016 Memory leak in krb5_gss_inquire_cred Major changes in 1.19.1 (2021-02-18) ------------------------------------ This is a bug fix release. * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. krb5-1.19.1 changes by ticket ID -------------------------------- 8984 Load certs when checking pkinit_identities values 8985 Restore krb5_set_default_tgs_ktypes() 8987 Synchronize command-line option documentation Major changes in 1.19 (2021-02-01) ---------------------------------- Administrator experience: * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience: * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution: * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience: * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). krb5-1.19 changes by ticket ID ------------------------------ 7976 Client keytab does not refresh manually obtained ccaches 8332 Referral and cross-realm TGS requests fail with anonymous cache 8871 Zero length fields when freeing object contents 8879 Allow certauth modules to set hw-authent flag 8885 PKINIT calls responder twice 8890 Add finalization safety check to com_err 8893 Do expiration warnings for all init_creds APIs 8897 Pass gss_localname() through SPNEGO 8899 Implement GSS_C_CHANNEL_BOUND_FLAG 8900 Implement KERB_AP_OPTIONS_CBT (server side) 8901 Stop reporting krb5 mech from IAKERB 8902 Omit KDC indicator check for S4U2Self requests 8904 Add KRB5_PRINCIPAL_PARSE_NO_DEF_REALM flag 8907 Pass channel bindings through SPNEGO 8909 Return GSS_S_NO_CRED from krb5 gss_acquire_cred 8910 Building with --enable-static fails when Yasm is available 8911 Default dns_canonicalize_hostname to "fallback" 8912 Omit PA_FOR_USER if we can't compute its checksum 8913 Deleting master key principal entry shouldn't be possible 8914 Invalid negative record length in keytab file 8915 Try to find -ar when cross compiling 8917 Add three kvno options from Heimdal kgetcred 8919 Interop with Heimdal KDC for S4U2Self requests 8920 Fix KDC choice to send encrypted S4U_X509_USER 8921 Use the term "primary KDC" in source and docs 8922 Trace plugin module loading errors 8923 Add GSS_KRB5_NT_X509_CERT name type 8927 getdate.y %type warnings with bison 3.5 8928 Fix three configure tests for Xcode 12 8929 Ignore bad enctypes in krb5_string_to_keysalts() 8930 Expand dns_canonicalize_host=fallback support 8931 Cache S4U2Proxy requests by second ticket 8932 Do proper length decoding in SPNEGO gss_get_oid() 8934 Try kadmin/admin first in libkadm5clnt 8935 Don't create hostbased principals in new KDBs 8937 Fix Leash console option 8940 Remove Leash import functionality 8942 Fix KRB5_GC_CACHED for S4U2Self requests 8943 Allow KDC to canonicalize realm in TGS client 8944 Harmonize macOS pack declarations with Heimdal 8946 Improve KDC alias checking for S4U requests 8947 Warn when des3-cbc-sha1 is used for initial auth 8948 Update SRV record documentation 8950 Document enctype migration 8951 Allow aliases when matching U2U second ticket 8952 Fix doc issues with newer Doxygen and Sphinx 8953 Move more KDC checks to validate_tgs_request() 8954 Update Gladman AES code to a version with a clearer license 8957 Use PKG_CHECK_MODULES for system library com_err 8961 Fix gss_acquire_cred_from() IAKERB handling 8962 Add password option to cred store 8963 Add verify option to cred store 8964 Add GSS credential store documentation 8965 Install shared libraries as executable 8966 Improve duplicate checking in gss_add_cred() 8967 Continue on KRB5_FCC_NOFILE in KCM cache iteration 8969 Update kvno(1) synopsis with missing options 8971 Implement fallback for GSS acceptor names 8973 Revert dns_canonicalize_hostname default to true 8975 Incorrect runstatedir substitution affecting "make install" Major changes in 1.18.5 (2022-03-11) ------------------------------------ This is a bug fix release. * Fix a denial of service attack against the KDC [CVE-2021-37750]. krb5-1.18.5 changes by ticket ID -------------------------------- 9008 Fix KDC null deref on TGS inner body null server @ text @d1 1 a1 1 $NetBSD: patch-config_shlib.conf,v 1.2 2018/06/15 20:46:01 tez Exp $ d6 1 a6 1 --- config/shlib.conf.orig 2022-03-11 06:54:31.000000000 +0000 d16 1 a16 1 @@@@ -39,6 +40,7 @@@@ use_linker_fini_option=no d24 1 a24 1 @@@@ -53,6 +55,9 @@@@ INIT_FINI_PREP=: d33 2 a34 14 alpha*-dec-osf*) @@@@ -67,11 +72,9 @@@@ alpha*-dec-osf*) use_linker_init_option=yes use_linker_fini_option=yes EXTRA_FILES="$EXTRA_FILES export" - SHLIB_RPATH_FLAGS='-rpath $(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' PROFFLAGS=-pg RPATH_FLAG='-Wl,-rpath -Wl,' - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(PTHREAD_CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(PTHREAD_CFLAGS) $(LDFLAGS)' if test "$ac_cv_c_compiler_gnu" = yes \ @@@@ -133,17 +136,14 @@@@ alpha*-dec-osf*) d52 2 a53 53 @@@@ -173,12 +173,10 @@@@ mips-sgi-irix6.3) # This is a Kludge; se else LDCOMBINE='ld -shared -ignore_unresolved -update_registry $(BUILDTOP)/so_locations -soname $(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT)' fi - SHLIB_RPATH_FLAGS='-rpath $(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' # no gprof for Irix... PROFFLAGS=-p RPATH_FLAG='-Wl,-rpath -Wl,' - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -222,12 +220,10 @@@@ mips-sgi-irix*) opts='' fi LDCOMBINE='$(CC) -shared '$opts' -Wl,-soname -Wl,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $$initfini' - SHLIB_RPATH_FLAGS='-rpath $(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' # no gprof for Irix... PROFFLAGS=-p RPATH_FLAG='-Wl,-rpath -Wl,' - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -259,13 +255,11 @@@@ mips-sni-sysv4) PICFLAGS=-Kpic LDCOMBINE='$(CC) -G -h $(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT)' fi - SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' SHLIBEXT=.so SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)' SHLIBSEXT='.so.$(LIBMAJOR)' RPATH_FLAG=-R - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -281,10 +275,8 @@@@ mips-*-netbsd*) SHLIBSEXT='.so.$(LIBMAJOR)' SHLIBEXT=.so LDCOMBINE='ld -shared -soname $(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT)' - SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' RPATH_FLAG='-Wl,-rpath -Wl,' - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -294,15 +286,13 @@@@ mips-*-netbsd*) PROFFLAGS=-pg d56 20 d81 1 a81 1 LDCOMBINE='$(CC) -shared' d86 1 a86 1 + RPATH_FLAG=${COMPILER_RPATH_FLAG} d90 1 a90 1 @@@@ -323,12 +313,10 @@@@ mips-*-netbsd*) d98 1 a98 1 LDCOMBINE='ld -Bshareable' d103 1 a103 1 @@@@ -342,10 +330,8 @@@@ mips-*-netbsd*) d106 1 a106 1 LDCOMBINE='ld -Bshareable' d109 1 a109 1 - RPATH_FLAG=-R a110 1 + RPATH_FLAG=${COMPILER_RPATH_FLAG} d114 1 a114 1 @@@@ -371,7 +357,7 @@@@ mips-*-netbsd*) d123 1 a123 1 @@@@ -403,11 +389,9 @@@@ mips-*-netbsd*) d136 1 a136 1 @@@@ -432,10 +416,8 @@@@ mips-*-netbsd*) d147 1 a147 11 @@@@ -460,9 +442,7 @@@@ mips-*-netbsd*) SHLIBVEXT='.so.$(LIBMAJOR)' SHLIBEXT=.so LDCOMBINE='ld -Bshareable' - SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' - PROG_RPATH_FLAGS='-Wl,-rpath,$(PROG_RPATH)' CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS)' @@@@ -492,9 +472,8 @@@@ mips-*-netbsd*) d158 1 a158 14 @@@@ -529,10 +508,9 @@@@ mips-*-netbsd*) # Assume initialization always delayed. INIT_FINI_PREP="wl=${wl_prefix}; "'i=1; initfini=; for f in . $(LIBFINIFUNC); do if test $$f != .; then initfini="$$initfini $${wl}-binitfini::$$f:$$i"; else :; fi; i=`expr $$i + 1`; done' use_linker_fini_option=yes - MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LDCOMBINE}"' && ar cq $@@ shr.o.$(LIBMAJOR).$(LIBMINOR) && chmod +x $@@ && rm -f shr.o.$(LIBMAJOR).$(LIBMINOR)' - MAKE_DYNOBJ_COMMAND="${INIT_FINI_PREP} && ${LDCOMBINE_DYN}" + MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LIBTOOL} --mode=link ${LDCOMBINE}"' && ar cq $@@ shr.o.$(LIBMAJOR).$(LIBMINOR) && chmod +x $@@ && rm -f shr.o.$(LIBMAJOR).$(LIBMINOR)' + MAKE_DYNOBJ_COMMAND="${INIT_FINI_PREP} && ${LIBTOOL} --mode=link ${LDCOMBINE_DYN}" RPATH_TAIL=:/usr/lib:/lib - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH):'"$RPATH_TAIL" CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' @@@@ -545,8 +523,14 @@@@ esac @ 1.2 log @mit-krb5: update to 1.16.1 Major changes in 1.16.1 (2018-05-03) This is a bug fix release. Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. Fix a KDC PKINIT memory leak. Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. Fix a regression in pkinit_cert_match matching of client certificates containing Microsoft UPN SANs. Fix a null dereference when the KDC sends a large TGS reply. Fix "kdestroy -A" with the KCM credential cache type. Allow validation of Microsoft PACs containing enterprise names. Fix the handling of capaths "." values. Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). Major changes in 1.16 (2017-12-05) Administrator experience: The KDC can match PKINIT client certificates against the "pkinit_cert_match" string attribute on the client principal entry, using the same syntax as the existing "pkinit_cert_match" profile option. The ktutil addent command supports the "-k 0" option to ignore the key version, and the "-s" option to use a non-default salt string. kpropd supports a --pid-file option to write a pid file at startup, when it is run in standalone mode. The "encrypted_challenge_indicator" realm option can be used to attach an authentication indicator to tickets obtained using FAST encrypted challenge pre-authentication. Localization support can be disabled at build time with the --disable-nls configure option. Developer experience: The kdcpolicy pluggable interface allows modules control whether tickets are issued by the KDC. The kadm5_auth pluggable interface allows modules to control whether kadmind grants access to a kadmin request. The certauth pluggable interface allows modules to control which PKINIT client certificates can authenticate to which client principals. KDB modules can use the client and KDC interface IP addresses to determine whether to allow an AS request. GSS applications can query the bit strength of a krb5 GSS context using the GSS_C_SEC_CONTEXT_SASL_SSF OID with gss_inquire_sec_context_by_oid(). GSS applications can query the impersonator name of a krb5 GSS credential using the GSS_KRB5_GET_CRED_IMPERSONATOR OID with gss_inquire_cred_by_oid(). kdcpreauth modules can query the KDC for the canonicalized requested client principal name, or match a principal name against the requested client principal name with canonicalization. Protocol evolution: The client library will continue to try pre-authentication mechanisms after most failure conditions. The KDC will issue trivially renewable tickets (where the renewable lifetime is equal to or less than the ticket lifetime) if requested by the client, to be friendlier to scripts. The client library will use a random nonce for TGS requests instead of the current system time. For the RC4 string-to-key or PAC operations, UTF-16 is supported (previously only UCS-2 was supported). When matching PKINIT client certificates, UPN SANs will be matched correctly as UPNs, with canonicalization. User experience: Dates after the year 2038 are accepted (provided that the platform time facilities support them), through the year 2106. Automatic credential cache selection based on the client realm will take into account the fallback realm and the service hostname. Referral and alternate cross-realm TGTs will not be cached, avoiding some scenarios where they can be added to the credential cache multiple times. A German translation has been added. Code quality: The build is warning-clean under clang with the configured warning options. The automated test suite runs cleanly under AddressSanitizer. Major changes in 1.15.3 (2018-05-03) This is a bug fix release. Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. Fix a KDC PKINIT memory leak. Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. Fix a null dereference when the KDC sends a large TGS reply. Fix "kdestroy -A" with the KCM credential cache type. Fix the handling of capaths "." values. Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). Major changes in 1.15.2 (2017-09-25) This is a bug fix release. Fix a KDC denial of service vulnerability caused by unset status strings [CVE-2017-11368] Preserve GSS contexts on init/accept failure [CVE-2017-11462] Fix kadm5 setkey operation with LDAP KDB module Use a ten-second timeout after successful connection for HTTPS KDC requests, as we do for TCP requests Fix client null dereference when KDC offers encrypted challenge without FAST Ignore dotfiles when processing profile includedir directive Improve documentation Major changes in 1.15.1 (2017-03-01) This is a bug fix release. Allow KDB modules to determine how the e_data field of principal fields is freed Fix udp_preference_limit when the KDC location is configured with SRV records Fix KDC and kadmind startup on some IPv4-only systems Fix the processing of PKINIT certificate matching rules which have two components and no explicit relation Improve documentation Major changes in 1.15 (2016-12-01) Administrator experience: Improve support for multihomed Kerberos servers by adding options for specifying restricted listening addresses for the KDC and kadmind. Add support to kadmin for remote extraction of current keys without changing them (requires a special kadmin permission that is excluded from the wildcard permission), with the exception of highly protected keys. Add a lockdown_keys principal attribute to prevent retrieval of the principal's keys (old or new) via the kadmin protocol. In newly created databases, this attribute is set on the krbtgt and kadmin principals. Restore recursive dump capability for DB2 back end, so sites can more easily recover from database corruption resulting from power failure events. Add DNS auto-discovery of KDC and kpasswd servers from URI records, in addition to SRV records. URI records can convey TCP and UDP servers and master KDC status in a single DNS lookup, and can also point to HTTPS proxy servers. Add support for password history to the LDAP back end. Add support for principal renaming to the LDAP back end. Use the getrandom system call on supported Linux kernels to avoid blocking problems when getting entropy from the operating system. In the PKINIT client, use the correct DigestInfo encoding for PKCS #1 signatures, so that some especially strict smart cards will work. Code quality: Clean up numerous compilation warnings. Remove various infrequently built modules, including some preauth modules that were not built by default. Developer experience: Add support for building with OpenSSL 1.1. Use SHA-256 instead of MD5 for (non-cryptographic) hashing of authenticators in the replay cache. This helps sites that must build with FIPS 140 conformant libraries that lack MD5. Eliminate util/reconf and allow the use of autoreconf alone to regenerate the configure script. Protocol evolution: Add support for the AES-SHA2 enctypes, which allows sites to conform to Suite B crypto requirements. @ text @d1 1 a1 1 $NetBSD$ d6 1 a6 1 --- config/shlib.conf.orig 2016-02-29 19:50:13.000000000 +0000 d13 4 a16 4 # Most systems install shared libs as mode 644, etc. while hpux wants 755 INSTALL_SHLIB='$(INSTALL_DATA)' # Most systems use the same objects for shared libraries and dynamically @@@@ -37,6 +38,7 @@@@ use_linker_fini_option=no d24 1 a24 1 @@@@ -51,6 +53,9 @@@@ INIT_FINI_PREP=: d34 1 a34 1 @@@@ -65,11 +70,9 @@@@ alpha*-dec-osf*) d46 1 a46 1 @@@@ -132,17 +135,14 @@@@ alpha*-dec-osf*) d64 1 a64 1 @@@@ -172,12 +172,10 @@@@ mips-sgi-irix6.3) # This is a Kludge; se d77 1 a77 1 @@@@ -221,12 +219,10 @@@@ mips-sgi-irix*) d90 1 a90 1 @@@@ -258,13 +254,11 @@@@ mips-sni-sysv4) d104 1 a104 1 @@@@ -280,10 +274,8 @@@@ mips-*-netbsd*) d115 1 a115 1 @@@@ -293,15 +285,13 @@@@ mips-*-netbsd*) d133 1 a133 1 @@@@ -322,12 +312,10 @@@@ mips-*-netbsd*) d146 1 a146 1 @@@@ -341,10 +329,8 @@@@ mips-*-netbsd*) d158 1 a158 1 @@@@ -370,7 +356,7 @@@@ mips-*-netbsd*) d167 1 a167 1 @@@@ -402,11 +388,9 @@@@ mips-*-netbsd*) d180 1 a180 1 @@@@ -429,10 +413,8 @@@@ mips-*-netbsd*) d191 1 a191 1 @@@@ -457,9 +439,7 @@@@ mips-*-netbsd*) d201 1 a201 1 @@@@ -489,9 +469,8 @@@@ mips-*-netbsd*) d212 1 a212 1 @@@@ -526,10 +505,9 @@@@ mips-*-netbsd*) d225 1 a225 1 @@@@ -542,8 +520,14 @@@@ esac @ 1.1 log @Update to 1.14.1 resolving all reported vulnerabilities including: CVE-2015-2695 CVE-2015-2696 CVE-2015-2697 CVE-2015-2698 CVE-2015-8629 CVE-2015-8630 CVE-2015-8631 @ text @@