1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-07 00:58:40 +03:00

92 Commits

Author SHA1 Message Date
Stefan Metzmacher
8061983d48 wscript: separate embedded_heimdal from system_heimdal
This allows to default (embedded_heimdal) to build even with a
broken krb5-config file from Heimdal.

In the system_heimdal case we parse the content of krb5-config
instead of just executing it. This fails on FreeBSD 12 as
krb5-config contains iso-8859-1 characters, which can't be parsed
as unicode python buffers when using python3.

Fixing the system_heimdal case is a task for another day,
I guess it will only work once we imported a current heimdal version
and actually tested the system_heimdal case.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-01-29 22:09:07 +01:00
Alexander Bokovoy
c797e92127 source4/heimdal_build/wscript_configure: update to handle waf 2.0.4
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-05 06:37:24 +02:00
Thomas Nagy
8077f462c9 build:wafsamba: Build on waf 1.9
Signed-off-by: Thomas Nagy <tnagy@waf.io>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-05 06:37:21 +02:00
Christof Schmitt
b84c0a896f heimdal: Fix build with system provided heimdal library
Trying to compile with a system provided heimdal library
results in this compile error:

[ 876/3043] Compiling source4/auth/kerberos/srv_keytab.c
In file included from /usr/include/heimdal/krb5.h:949:0,
                 from ../lib/replace/system/kerberos.h:33,
                 from ../source4/auth/kerberos/srv_keytab.c:31:
/usr/include/heimdal/krb5-protos.h:3894:1: error: unknown type name ‘HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE’; did you mean ‘_WARN_UNUSED_RESULT_’?
 HEIMDAL_WARN_UNUSED_RESULT_ATTRIBUTE KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 _WARN_UNUSED_RESULT_
/usr/include/heimdal/krb5-protos.h:3895:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘krb5_generate_random’
 krb5_generate_random (

The problem is that Samba provides a minimal krb5-types.h file
for the internal build that gets used during the build with
the system provided heimdal library. As the minimal file
does not provide all definitions, the build fails.

Fix this by having the krb-types.h file simply include the
include file from the system library, if the build is done
using the system provided heimdal library.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Jul 10 07:30:26 CEST 2018 on sn-devel-144
2018-07-10 07:30:26 +02:00
Stefan Metzmacher
2717263c14 s4:heimdal_build: there's no need to define HAVE_KRB5_ADDRESSES twice
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Björn Jacke <bjacke@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Oct 11 12:33:42 CEST 2017 on sn-devel-144
2017-10-11 12:33:42 +02:00
Gary Lockyer
378ae342c4 strerror_r: provide XSI-compliant strerror_r
Provide a XSI-compliant strerror_r on GNU based systems.
The default GNU strerror_r is not XSI-compliant, this patch wraps the
GNU-specific call in an XSI-compliant wrapper.

This reverts 18ed32ce0821d11c0c06d82c07ba1c27b0c2b886 which tried to
make Heimdal use roken, rather than libreplace for strerror_r.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-06-13 18:38:14 +02:00
Stefan Metzmacher
4b295b106c wscript: remove executable bits for all wscript* files
These files should not be executable.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jan 11 20:21:01 CET 2017 on sn-devel-144
2017-01-11 20:21:01 +01:00
Alexander Bokovoy
f5e749414f Wrap krb5_cc_copy_creds and krb5_cc_copy_cache
Heimdal and MIT Kerberos have different API to copy credentials from a
ccache. Wrap it via lib/krb5_wrap/.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Mon Jul 25 21:27:58 CEST 2016 on sn-devel-144
2016-07-25 21:27:57 +02:00
Stefan Metzmacher
2f619066fb s4:heimdal_build: also use check_system_heimdal_lib() for "com_err"
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2015-10-31 22:03:14 +01:00
Stefan Metzmacher
3cb1d6e7c5 s4:heimdal_build: handle CHECK_BUNDLED_SYSTEM returning False in check_system_heimdal_lib()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2015-10-31 22:03:14 +01:00
Günther Deschner
6755376ced kerberos: make sure we only use prompter type when available.
We also verified that we cannot simply remove the prompter as several older
versions of Heimdal would crash.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Oct  2 07:29:43 CEST 2015 on sn-devel-104
2015-10-02 07:29:43 +02:00
Stefan Metzmacher
01499617bd s4:heimdal_build: define HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2015-06-23 14:38:53 +02:00
Günther Deschner
e38acb344a krb5_wrap: add smb_krb5_principal_set_type().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-03-27 01:26:16 +01:00
Stefan Metzmacher
349ba5188a s4:heimdal_build: remove unused openpty check
commit 638a8edd7ce708cf550c054ac16dade795b6448b removed
HEIMDAL_BINARY('rkpty', 'lib/roken/rkpty.c',...)
(the only heimdal user of openpty().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2014-12-18 14:10:06 +01:00
Günther Deschner
9c5470be1e lib/krb5_wrap: provide krb5_warnx() replacement.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug  8 08:30:50 CEST 2014 on sn-devel-104
2014-08-08 08:30:50 +02:00
Günther Deschner
0e255497d2 lib/krb5_wrap: add smb_krb5_principal_get_type().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-08-08 06:02:35 +02:00
Günther Deschner
763cae60c3 lib/krb5_wrap: add smb_krb5_principal_set_realm().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-08-08 06:02:35 +02:00
Günther Deschner
9fed7ed00e lib/krb5_wrap: add krb5_copy_data_contents.
This reuses krb5_data_copy() if available, choosed not to call it
krb5_data_copy as that is easily mixed up with krb5_copy_data (which allocs the
krb5_data pointer). Thanks Simo for proposing the better name.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-08-08 06:02:35 +02:00
Günther Deschner
561c74666a lib/krb5_wrap: add smb_krb5_get_allowed_weak_crypto().
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
2014-08-08 06:02:34 +02:00
Christian Ambach
07b3a04872 waf: consolidate libintl related checks
consolidate the dealing with functions from libintl and the
handling of checking if libiconv is required or not
to a common place in lib/replace

also add a new samba_intl subsystem that has dependencies
on the appropriate set of libraries (libintl, libintl+libiconv or none)
that can be used as a general dependency by code that depends
on the internationalization libraries

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-08-09 22:46:57 +02:00
Andrew Bartlett
dda48146a2 heimdal_build: Try again to sort out the strerror_r mess
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-19 10:32:17 +01:00
Jelmer Vernooij
da284b3765 heimdal_build: Fix finding of system heimdal.
When checking for Heimdal headers, make sure HAVE_CONFIG_H is not
defined, as config.h will not be available.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Jelmer Vernooij <jelmer@samba.org>

Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date(master): Tue Nov  6 16:27:03 CET 2012 on sn-devel-104
2012-11-06 16:27:03 +01:00
Alexander Bokovoy
6e9aca7d41 waf: check for krb5_create_checksum and krb5_creds.flags for some Heimdal versions
Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User: Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date: Fri Jun  1 11:23:21 CEST 2012 on sn-devel-104
2012-06-01 11:23:21 +02:00
Andrew Bartlett
65bd5eb04b lib/krb5_wrap: Move krb5_princ_size helper to source4 as it is only used there
This is also where the related krb5_princ_component is declared.

Also fix the configure check to use the correct name

This helps the autoconf build on Heimdal.

Andrew Bartlett
2012-05-30 12:55:39 +02:00
Alexander Bokovoy
2ddf89a2bc Introduce system MIT krb5 build with --with-system-mitkrb5 option.
System MIT krb5 build also enabled by specifying --without-ad-dc

When --with-system-mitkrb5 (or --withou-ad-dc) option is passed to top level
configure in WAF build we are trying to detect and use system-wide MIT krb5
libraries. As result, Samba 4 DC functionality will be disabled due to the fact
that it is currently impossible to implement embedded KDC server with MIT krb5.

Thus, --with-system-mitkrb5/--without-ad-dc build will only produce
  * Samba 4 client libraries and their Python bindings
  * Samba 3 server (smbd, nmbd, winbindd from source3/)
  * Samba 3 client libraries

In addition, Samba 4 DC server-specific tests will not be compiled into smbtorture.
This in particular affects spoolss_win, spoolss_notify, and remote_pac rpc tests.
2012-05-23 17:51:50 +03:00
Simo Sorce
ad945bc68f gensec_gssapi: Make it possible to build with MIT krb5
We need to ifdef out some minor things here because there is no available API
to set these options in MIT.
The realm and canonicalize options should be not interesting in the client
case. Same for the send_to_kdc hacks.
Also the OLD DES3 enctype is not at all interesting. I am not aware that
Windows will ever use DES3 and no modern implementation relies on that enctype
anymore as it has been fully deprecated long ago, so we can simply ignore it.
2012-05-23 17:51:49 +03:00
Andreas Schneider
e8e5afd4d4 krb5samba: Add smb_krb5_make_pac_checksum.
Signed-off-by: Simo Sorce <idra@samba.org>

Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Tue May  8 08:30:52 CEST 2012 on sn-devel-104
2012-05-08 08:30:51 +02:00
Simo Sorce
3ef95a0b59 krb5samba: Add krb5_free_checksum_contents wrapper 2012-05-08 06:42:56 +02:00
Jelmer Vernooij
890485bd17 heimdal: Cope with newer Heimdal versions accepting a keyset argument to
hdb_enctype2key.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Mon May  7 18:33:10 CEST 2012 on sn-devel-104
2012-05-07 18:33:10 +02:00
Simo Sorce
eb9e3e8a54 auth-session: MIT doesn't have import/export cred yet
For now let's just loose this functionality with the MIT build.
gss_import/export_cred should be availa ble when MIT 1.11 is released and this
code is used only in some proxy scenario. Not normally needed for common
configurations.
2012-05-04 16:51:29 +02:00
Andreas Schneider
4d77466daf krb5samba: Add a smb_krb5_cc_get_lifetime() function.
Signed-off-by: Simo Sorce <idra@samba.org>
2012-05-04 16:51:29 +02:00
Simo Sorce
b776bc5f72 krb5samba: Add compat krb5_make_principal for MIT build 2012-05-04 16:51:29 +02:00
Simo Sorce
93de8e4570 krb5samba: Add compat code to initialize keyblock contents 2012-05-04 16:51:28 +02:00
Simo Sorce
38a5a2c5c5 Move kerberos_kinit_keyblock_cc to krb5samba lib
Make it also work with MIT where krb5_get_in_tkt_with_keyblock is not
available.
2012-05-04 16:51:28 +02:00
Alexander Bokovoy
594e316181 lib/replace: split out GSSAPI from lib/replace/system/kerberos.h into lib/replace/system/gssapi.h
With waf build include directories are defined by dependencies specified to subsystems.
Without proper dependency <gssapi/gssapi.h> cannot be found for embedded Heimdal builds
when there are no system-wide gssapi/gssapi.h available.

Split out GSSAPI header includes in a separate replacement header and use that explicitly
where needed.

Autobuild-User: Alexander Bokovoy <ab@samba.org>
Autobuild-Date: Wed Apr 25 00:18:33 CEST 2012 on sn-devel-104
2012-04-25 00:18:32 +02:00
Alexander Bokovoy
090f9072da Make sure krb5_principal_get_num_comp is identified as present for Heimdal build
Common wrappers for MIT / Heimdal use krb5_principal_get_num_comp() to replace krb5_princ_size
but rely on krb5_principal_get_num_comp() identified by the build. As we know it exists in Heimdal,
define it for waf build.

Signed-off-by: Simo Sorce <idra@samba.org>
2012-04-23 16:39:59 -04:00
Alexander Bokovoy
5cae9293d1 waf: rename SAMBA4_INTERNAL_HEIMDAL to SAMBA4_USES_HEIMDAL
SAMBA4_INTERNAL_HEIMDAL is defined unconditionally regardless
where Heimdal comes from, system-wide or embedded version.

This define is not used anywhere. We'll use it to distinguish
between Heimdal and MIT Krb5 builds.

Signed-off-by: Simo Sorce <idra@samba.org>
2012-04-23 16:38:44 -04:00
Andrew Bartlett
fba028afbd build: Remove checks for krb5_decode_ap_req, free_AP_REQ and KRB5_TICKET_HAS_KEYINFO
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Apr  3 19:19:33 CEST 2012 on sn-devel-104
2012-04-03 19:19:33 +02:00
Andrew Bartlett
3bf922111a s3-build: expliticly require gssapi for HAVE_KRB5 and remove HAVE_GSSAPI
The requirement for gss functions already make this happen, but
this is clearer.  No code depends on HAVE_GSSAPI any more.

Andrew Bartlett
2012-02-13 04:41:05 +01:00
Andrew Bartlett
5c2a2135c9 s3-libsmb: Remove unused kerberos_set_creds_enctype()
Also remove the unused configure tests for krb5_c_enctype_compare.

Found by callcatcher: http://www.skynet.ie/~caolan/Packages/callcatcher.html

Andrew Bartlett
2012-02-10 16:45:15 +11:00
Andrew Bartlett
292974ed0c s3-libsmb: Remove unused kerberos_compatible_enctypes
Also remove the unused configure tests for krb5_c_enctype_compare.

Found by callcatcher: http://www.skynet.ie/~caolan/Packages/callcatcher.html

Andrew Bartlett
2012-02-10 16:45:14 +11:00
Stefan Metzmacher
c74a522db1 s3:build: require gss_krb5_export_lucid_sec_context() for ads support
This is needed to detect krb5 with aes for GENSEC_FEATURE_NEW_SPNEGO
at runtime.

metze
2012-01-25 08:44:33 +01:00
Andrew Bartlett
39d73e2420 krb5: Require krb5_get_renewed_creds be available to build with krb5 2012-01-10 21:50:07 +01:00
Andrew Bartlett
a33d86a745 krb5: Remove now unused checks for krb5_verify_checksum 2012-01-10 21:50:07 +01:00
Andrew Bartlett
17e61e4290 krb5: Require krb5_c_enctype_compare is available to build with krb5 2012-01-10 21:50:07 +01:00
Günther Deschner
0f7918425a samba: check for AES encryption type defines.
Guenther

Autobuild-User: Günther Deschner <gd@samba.org>
Autobuild-Date: Tue Jan 10 15:05:38 CET 2012 on sn-devel-104
2012-01-10 15:05:37 +01:00
Andrew Bartlett
25d7675d69 s3-librpc Use gsskrb5_get_subkey() where available to get the session key
This allows gse_get_session_key() to work against Heimdal.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-01-05 17:17:28 +01:00
Jelmer Vernooij
56e86ed52d heimdal_build: Use krb5-config to find heimdal include directory and library path, rather than hardcoding. 2011-08-01 17:48:30 +02:00
Stefan Metzmacher
dcf197fc8c s4:heimdal_build: define HAVE_KRB5_PDU_NONE_DECL
metze
2011-07-15 11:15:05 +02:00
Andrew Bartlett
e1eae82285 kerberos: Only include gssapi/gssapi_krb5.h when available 2011-04-30 04:58:04 +02:00