This project is mirrored from Pull mirroring updated .
  1. 27 Sep, 2022 1 commit
  2. 25 Sep, 2022 1 commit
  3. 24 Sep, 2022 2 commits
    • Rod Widdowson's avatar
      Documentation changes for the Windows Build · 348a03e4
      Rod Widdowson authored
      - Fix markup
      - Specific quoted command line for Visual Studio
      - Caveat about line ending for gawk
      - Add comments about python versions
      - makeinfo.exe is no longer available from cygwin
      - Add some words about APPVER setting
    • Sergei Trofimovich's avatar
      hdb: fix ldap module build (missing 'is_file_based' and 'can_taste' initializers) · cd3b6e5a
      Sergei Trofimovich authored
      Without the change the build fails as:
            CC       hdb-ldap.lo
          hdb-ldap.c:2109:5: warning: initialization of 'unsigned char:1' from 'krb5_error_code (*)(struct krb5_context_data *, void **)' {aka 'int (*)(struct krb5_context_data *, void **)'} makes integer from pointer without a cast [-Wint-conversion]
           2109 |     init,
                |     ^~~~
          hdb-ldap.c:2109:5: note: (near initialization for 'hdb_ldapi_interface.is_file_based')
          hdb-ldap.c:2109:5: error: initializer element is not computable at load time
          hdb-ldap.c:2109:5: note: (near initialization for 'hdb_ldapi_interface.is_file_based')
          hdb-ldap.c:2110:5: warning: initialization of 'unsigned char:1' from 'void (*)(void *)' makes integer from pointer without a cast [-Wint-conversion]
           2110 |     fini,
                |     ^~~~
          hdb-ldap.c:2110:5: note: (near initialization for 'hdb_ldapi_interface.can_taste')
          hdb-ldap.c:2110:5: error: initializer element is not computable at load time
          hdb-ldap.c:2110:5: note: (near initialization for 'hdb_ldapi_interface.can_taste')
          hdb-ldap.c:2111:5: warning: initialization of 'krb5_error_code (*)(struct krb5_context_data *, void **)' {aka 'int (*)(struct krb5_context_data *, void **)'} from incompatible pointer type 'char *' [-Wincompatible-pointer-types]
           2111 |     "ldapi",
                |     ^~~~~~~
          hdb-ldap.c:2111:5: note: (near initialization for 'hdb_ldapi_interface.init')
          hdb-ldap.c:2112:5: warning: initialization of 'void (*)(void *)' from incompatible pointer type 'krb5_error_code (*)(struct krb5_context_data *, HDB **, const char *)' {aka 'int (*)(struct krb5_context_data *, HDB **, const char *)'} [-Wincompatible-pointer-types]
           2112 |     hdb_ldapi_create
                |     ^~~~~~~~~~~~~~~~
          hdb-ldap.c:2112:5: note: (near initialization for 'hdb_ldapi_interface.fini')
          hdb-ldap.c:2113:1: warning: missing initializer for field 'prefix' of 'struct hdb_method' [-Wmissing-field-initializers]
           2113 | };
                | ^
      Started failing when commit 93ada1fb ("hdb: Remove default HDB backend
      footgun") added extra fields to 'struct hdb_method'.
  4. 23 Sep, 2022 1 commit
  5. 16 Sep, 2022 12 commits
    • Jeffrey Altman's avatar
      krb5: pkinit select_dh_group clarify 'bits' param is the minimum · 97eaa6cd
      Jeffrey Altman authored
      The 'bits' parameter to select_dh_group() is the minimum acceptable
      bit size.   Rename 'bits' to 'min_bits' and fix the comparision
      with krb5_dh_moduli.bits to ensure that DH groups whose bit size
      is the minimum acceptable are not excluded.
      Fixes #1002
      Reported-By: Julien Rische (GitHub: jrisc)
    • Jeffrey Altman's avatar
      krb5: rfc3526-MODP-group14 incorrect bit size · 1e67fd6c
      Jeffrey Altman authored
      Heimdal supports the 2 mandatory MODP groups (group 2 and group 14)
      according to RFC4556, however group 14 is defined with a size of
      1760 bits instead of 2048.
      Fixes #1001
      Reported-by: Julien Rische (GitHub: jrisc)
    • Sergei Trofimovich's avatar
      gssapi: add dependency on gkrb5_err.h · e7efa778
      Sergei Trofimovich authored
      Noticed missing target directory dependency as a build failure in
      `make --shuffle` mode (added in
            CC       test_common.o
          In file included from test_common.c:34:
          krb5/gsskrb5_locl.h:42:10: fatal error: gkrb5_err.h: No such file or directory
             42 | #include <gkrb5_err.h>
                |          ^~~~~~~~~~~~~
          compilation terminated.
          make[3]: *** [Makefile:2347: test_common.o] Error 1 shuffle=1656680590
      The change moves gkrb5_err.h and friends to BUILT_SOURCES
      to guarantee their presence when main build starts.
    • Sergei Trofimovich's avatar
      doc: add dependency on vars.texi · 254e4029
      Sergei Trofimovich authored
      Noticed missing target directory dependency as a build failure in
      `make --shuffle` mode (added in
          Making all in doc
          make[1]: Entering directory '/build/heimdal/doc'
          hx509.texi:15: @include: could not find vars.texi
          hx509.texi:31: warning: undefined flag: PACKAGE_VERSION
          hx509.texi:186: warning: undefined flag: PACKAGE_VERSION
          make[1]: *** [Makefile:622:] Error 1 shuffle=1656683556
      The change moves vars.texi to BUILT_SOURCES to guarantee it's
      presence when .info files start the build.
    • Sergei Trofimovich's avatar
      hdb: add missing build dependency on "hdb-protos.h" · eb8da07a
      Sergei Trofimovich authored
      Noticed missing target directory dependency as a build failure in
      `make --shuffle` mode (added in
          make[2]: Leaving directory '/build/heimdal/lib/gss_preauth'
          Making all in hdb
          make[2]: Entering directory '/build/heimdal/lib/hdb'
          ../../lib/asn1/asn1_compile --option-file=./hdb.opt ./hdb.asn1 hdb_asn1
          for genfile in 'asn1_Event.c asn1_GENERATION.c asn1_HDB_EncTypeList.c asn1_HDB_Ext_Aliases.c asn1_HDB_Ext_Constrained_delegation_acl.c asn1_HDB_Ext_KeyRotation.c asn1_HDB_Ext_KeySet.c asn1_HDB_Ext_Lan_Manager_OWF.c asn1_HDB_Ext_Password.c asn1_HDB_Ext_PKINIT_acl.c asn1_HDB_Ext_PKINIT_cert.c asn1_HDB_Ext_PKINIT_hash.c asn1_HDB_EntryOrAlias.c asn1_HDB_entry_alias.c asn1_HDB_entry.c asn1_HDB_extension.c asn1_HDB_extensions.c asn1_HDB_keyset.c asn1_HDBFlags.c asn1_Key.c asn1_KeyRotation.c asn1_KeyRotationFlags.c asn1_Keys.c asn1_Salt.c'; do \
                  true -style='{BasedOnStyle: Mozilla, AlwaysBreakAfterReturnType: TopLevelDefinitions, IndentWidth: 4, SortIncludes: false}' -i ${genfile}; \
          make  all-am
          make[3]: Entering directory '/build/heimdal/lib/hdb'
            CC       hdb-ldap.lo
          In file included from hdb_locl.h:67,
                           from hdb-ldap.c:36:
          ./hdb.h:337:10: fatal error: hdb-protos.h: No such file or directory
            337 | #include <hdb-protos.h>
                |          ^~~~~~~~~~~~~~
          compilation terminated.
      The change moves hdb-protos.ha and hdb-private.h to BUILT_SOURCES
      to guarantee their presence when main build starts.
    • Jeffrey Altman's avatar
      ipc: mach_complete_[a]sync avoid 'ret' set but not used warning · 88eb44fd
      Jeffrey Altman authored
      The variable 'ret' is set but not used.   As the value is ignored
      remove it.  Restructure the initialization of 'replyinCnt', 'replyout',
      and 'replyoutCnt' such that a failure of vm_read() results in a
      properly initialized reply structure.
    • Jeffrey Altman's avatar
      kuser: kinit renew_func do not update expire if no new tickets · de7b452d
      Jeffrey Altman authored
      If neither get_new_tickets() nor renew_validate() succeeded, do not
      bother recomputing the 'expire' time as it is unchanged.
    • Jeffrey Altman's avatar
      roken: getaddrinfo get_null return errors · 7b914bfb
      Jeffrey Altman authored
      get_null() can fail for two reasons.  There can be a memory allocation
      issue or the hints->ai_family could be unsupported.  This change
      informs the caller of the error state instead of returning success
      with an invalid struct addrinfo output parameter.
      Fixes #1007
      Reported-by: opless
    • Daria Phoebe Brashear's avatar
      hx509: hx509_verify_path remove spurious fallthrough · 76c110e1
      Daria Phoebe Brashear authored
      fallthrough needs to be directly before the next case, and this duplicate
      inside an else is unneeded
    • Daria Phoebe Brashear's avatar
      rewrite fallthrough to HEIM_FALLTHROUGH to deal with new Apple SDKs · 133f5174
      Daria Phoebe Brashear authored
      Apple clang version 14.0.0 (clang-1400. fails the build
      because stds.h defines `fallthrough` as a macro which is then
      expanded when base.h evaluates
        # if __has_attribute(fallthrough) && __clang_major__ >= 5
      The macOS SDK defines `DISPATCH_FALLTHROUGH` as the macro instead
      of `fallthrough`.
      This change replaces the use of `fallthrough` in the tree with
      `HEIM_FALLTHROUGH` and updates the declaration in configure logic
      to define `HEIM_FALLTHROUGH` based upon existing definitions
      (if any) of `fallthrough` or `DISPATCH_FALLTHROUGH`.
    • Joseph Sutton's avatar
      kadm5: Correctly set userAccountControl bits · f6d26bce
      Joseph Sutton authored
      We meant to clear only the UF_SMARTCARD_REQUIRED bit, but we were
      instead clearing all bits excepting it.
      Signed-off-by: default avatarJoseph Sutton <>
    • Joseph Sutton's avatar
      lib/krb5: Avoid undefined pointer arithmetic · f165d1e9
      Joseph Sutton authored
      If the AP len is large enough, we might end up computing an address
      beyond the end of the 'reply' array, which is undefined behaviour.
      Signed-off-by: default avatarJoseph Sutton <>
  6. 11 Aug, 2022 1 commit
    • Nicolas Williams's avatar
      hxtool: Allow ca command to generate subject key · f40ac787
      Nicolas Williams authored
      This commit makes the hxtool ca sub-command, when invoked with
      --generate-key=TYPE and --certificate-private-key=STORE, write the
      private key only to the given --certificate-private-key store and not
      also the --certificate=STORE.
      Before this commit, invoking the hxtool ca sub-command with both,
      --generate-key=TYPE and --certificate-private-key=STORE, caused the
      --generate-key option to be ignored and the private key to be read from
      the given store and copied to the --certificate=STORE.  That was clearly
      a bug and non-sensical.
  7. 07 Aug, 2022 2 commits
  8. 30 Apr, 2022 3 commits
  9. 26 Apr, 2022 11 commits
  10. 28 Mar, 2022 1 commit
  11. 26 Mar, 2022 1 commit
  12. 24 Mar, 2022 4 commits
    • Nicolas Williams's avatar
      kadmind: Test other operations after LIST · 69328194
      Nicolas Williams authored
      Test that we can still do other things after `kadmin list` to make sure
      we're not leaving -after listing- the connection in a state where other
      operations can't work.
      Also, no more sleeps at all in the test.
    • Nicolas Williams's avatar
      krb5: Fix skew bug, or krb5_copy_context() moar · d1e76509
      Nicolas Williams authored
      Now that we use krb5_copy_context() via kadm5_c_dup_context(), we see
      occasional skew errors in the tests because context->max_skew was not
      being initialized, so it was set to 0s of skew, and krb5_rd_priv() or
      others could fail.
    • Nicolas Williams's avatar
      GitHub: Do not build docs in OS X · d5e21b77
      Nicolas Williams authored
      Texinfo in the GitHub OS X runners must be ancient.  Even Texinfo 5.1
      can handle UTF-8.
            MAKEINFO /Users/runner/work/heimdal/heimdal/doc/
          /Users/runner/work/heimdal/heimdal/doc/hx509.texi:11: warning: unrecognized encoding name `UTF-8'.
          /Users/runner/work/heimdal/heimdal/doc/heimdal.texi:12: warning: unrecognized encoding name `UTF-8'.
          /Users/runner/work/heimdal/heimdal/doc//setup.texi:380: Next field of node `Using soft aliases for configuring referrals' not pointed to (perhaps incorrect sectioning?).
          /Users/runner/work/heimdal/heimdal/doc//setup.texi:404: This node (Checking the setup) has the bad Prev.
          /Users/runner/work/heimdal/heimdal/doc//setup.texi:350: Prev field of node `Using hard aliases for realm migration' not pointed to.
          /Users/runner/work/heimdal/heimdal/doc//setup.texi:310: This node (Using namespaces and synthetic principals to keep the database small) has the bad Next.
          makeinfo: Removing output file `/Users/runner/work/heimdal/heimdal/doc/' due to errors; use --force to preserve.
          make[1]: *** [/Users/runner/work/heimdal/heimdal/doc/] Error 1
    • Nicolas Williams's avatar