From noreply at github.com  Fri May  1 21:09:40 2020
From: noreply at github.com (YASUOKA Masahiko)
Date: Fri, 01 May 2020 12:09:40 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] a028bf: Deadlock in
 lib/krb5/mcache.c #432
Message-ID: <heimdal/heimdal/push/refs/heads/heimdal-7-1-branch/2f611f-a028bf@github.com>

  Branch: refs/heads/heimdal-7-1-branch
  Home:   https://github.com/heimdal/heimdal
  Commit: a028bfbf830c42068f2b440d391a5bab332b236c
      https://github.com/heimdal/heimdal/commit/a028bfbf830c42068f2b440d391a5bab332b236c
  Author: YASUOKA Masahiko <yasuoka at yasuoka.net>
  Date:   2020-05-01 (Fri, 01 May 2020)

  Changed paths:
    M lib/krb5/mcache.c

  Log Message:
  -----------
  Deadlock in lib/krb5/mcache.c #432

(cherry picked from commit becb0b03aed50f71a6a20ac88009b63e92115688)



From noreply at github.com  Thu May 14 04:57:39 2020
From: noreply at github.com (Nico Williams)
Date: Wed, 13 May 2020 19:57:39 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 1243ea: Merge pull
 request #711 from nicowilliams/master
Message-ID: <heimdal/heimdal/push/refs/heads/master/001cf3-1243ea@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: 1243ea6a9a7290747478de7592a5c11ea1f94a0d
      https://github.com/heimdal/heimdal/commit/1243ea6a9a7290747478de7592a5c11ea1f94a0d
  Author: Nico Williams <nico at twosigma.com>
  Date:   2020-05-13 (Wed, 13 May 2020)

  Changed paths:
    M lib/gssapi/krb5/gsskrb5_locl.h
    M lib/gssapi/mech/gss_krb5.c

  Log Message:
  -----------
  Merge pull request #711 from nicowilliams/master

Fix gss_krb5_copy_ccache() (broken by MEM:anon)



From noreply at github.com  Mon May 25 21:08:31 2020
From: noreply at github.com (Nico Williams)
Date: Mon, 25 May 2020 12:08:31 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] d1d900: kinit: Make
 default-for-princ behavior optional
Message-ID: <heimdal/heimdal/push/refs/heads/master/1243ea-d1d900@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: d1d900034f77e62ec19751a0672dc8ec1e6eeef2
      https://github.com/heimdal/heimdal/commit/d1d900034f77e62ec19751a0672dc8ec1e6eeef2
  Author: Nicolas Williams <nico at twosigma.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M kuser/kinit.1
    M kuser/kinit.c
    M tests/kdc/check-cc.in

  Log Message:
  -----------
  kinit: Make default-for-princ behavior optional

We can't just default to useing the krb5_cc_default_for() ccache for a
principal -- that breaks a number of uses of kinit.



From noreply at github.com  Mon May 25 23:56:59 2020
From: noreply at github.com (Nico Williams)
Date: Mon, 25 May 2020 14:56:59 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] e3dbc8: appveyor:
 Install zstd before other pkgs
Message-ID: <heimdal/heimdal/push/refs/heads/master/d1d900-e3dbc8@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: e3dbc89f8fb6dd0a3a07caee7f752dc2bec3b6d9
      https://github.com/heimdal/heimdal/commit/e3dbc89f8fb6dd0a3a07caee7f752dc2bec3b6d9
  Author: Nicolas Williams <nico at twosigma.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M appveyor.yml

  Log Message:
  -----------
  appveyor: Install zstd before other pkgs

Some pacman packages are now being compressed with the ZST algorithm,
but pacman can't handle that unless we first install `zstd`.  This
commit does that.



From noreply at github.com  Tue May 26 04:59:05 2020
From: noreply at github.com (Jeffrey Altman)
Date: Mon, 25 May 2020 19:59:05 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 25b9c8: fix calling
 conventions
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/fix-windows-on-master/000000-4ea964@github.com>

  Branch: refs/heads/jaltman/fix-windows-on-master
  Home:   https://github.com/heimdal/heimdal
  Commit: 25b9c838f051236133177f5593ea913b6240931a
      https://github.com/heimdal/heimdal/commit/25b9c838f051236133177f5593ea913b6240931a
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M kuser/kx509.c
    M lib/base/log.c
    M lib/gssapi/mech/context.c
    M lib/krb5/kx509.c

  Log Message:
  -----------
  fix calling conventions

When a function is assigned to a function pointer that is declared
with a particular calling convention, then the assigned function
must be declared with that calling convention as well.  Otherwise,
kaboom!!!

The following functions are fixed by this change:

kuser/kx509.c
  validate1()
  add1_2chain()

lib/base/log.c
  log_syslog()
  close_syslog()
  log_file()
  close_file()

lib/gssapi/mech/context.c
  gss_set_log_function()

lib/krb5/kx509.c
  certs_export_func()

Change-Id: Ib68abf739e3385e98136fa4e4f5a0240e9fce033


  Commit: c9d8650561c6150cf56a7382408d6ed392f285ae
      https://github.com/heimdal/heimdal/commit/c9d8650561c6150cf56a7382408d6ed392f285ae
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/roken/stdint.hin

  Log Message:
  -----------
  roken: stdint.hin libtommath 1.2.0 needs more

libtommath 1.2.0 c403b660825f0f99451a805408f6a8ef354d1cd7
("hcrypto: import libtommath v1.2.0") needs more from stdint.h
than what Heimdal previously declared.  Add more integer type
declarations and integer MIN/MAX macros.

Also, on Windows declare 64-bit integers using __int64 as
"long long" is not supported as 64-bit type across all visual
studio compiler versions.

Change-Id: I944bedc67bcb26374ffb30eb3dfd7c6108a98fc3


  Commit: bcec0446e4dd32800912a64868b1f25f518806d0
      https://github.com/heimdal/heimdal/commit/bcec0446e4dd32800912a64868b1f25f518806d0
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/base/baselocl.h
    M lib/base/config_file.c
    M lib/base/log.c

  Log Message:
  -----------
  lib/base: introduce HEIM_BASE_USE_PATH_TOKENS

KRB5_USE_PATH_TOKENS cannot be used within lib/base as its value
is declared in lib/krb5/krb5.h.  Declare HEIM_BASE_USE_PATH_TOKENS
in lib/base/baselocl.h and test for it in
heim_config_parse_file_multi().

By conditionalizing heim_config_parse_file_multi() behavior on
KRB5_USE_PATH_TOKENS heim_expand_path_tokens() is not executed
and open() is called on a path without token substitution.  As a
result open() always fails with ENOENT.

Change-Id: I29dc018bc560519b76314232b2d51f53bde6313c


  Commit: 241c9ff907412b97e6195a53db75c3ef0a996366
      https://github.com/heimdal/heimdal/commit/241c9ff907412b97e6195a53db75c3ef0a996366
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M windows/NTMakefile.w32

  Log Message:
  -----------
  windows: revert change to ldebug

ea90ca86664c73fb8d415f3cc7baacdf8a6dd685 ("Move some infra bits of
lib/krb5/ to lib/base/ (2)") inappropriately altered the declaration
of the "ldebug" macro which stores the switches passed to "link.exe".
There is no "/RELEASE" switch and the "/DEBUG" switch instructs the
linker to produce files containing debug symbols (.pdb) which are
required for generating the Windows assemblies.

This change restores the prior behavior.

Change-Id: I61b8fd4759ba84671858f7c8275dbd25af1638e6


  Commit: 92a0e993acd8e53e97f57d844e88b38ba4e5086d
      https://github.com/heimdal/heimdal/commit/92a0e993acd8e53e97f57d844e88b38ba4e5086d
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/base/context.c
    M lib/hx509/cert.c

  Log Message:
  -----------
  Don't override the PATH_SEP definition if present

PATH_SEP is declared on Windows to be ";" and not ":"
by include/config.h.w32.

lib/base/context.c and lib/hx509.c must not override an existing
setting.  Otherwise, file lists cannot be separated and will be
treated as a single file name.

Change-Id: I5521188faca36e41fbae95fbb8942970eab261c8


  Commit: 88501da90e92920c52b2e8e16a9fc412a82991eb
      https://github.com/heimdal/heimdal/commit/88501da90e92920c52b2e8e16a9fc412a82991eb
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  lib/krb5: not_found() do not substitute the error text

not_found() is called internally with error code KRB5_CC_NOTFOUND
from find_cred() and get_cred_kdc_capath_worker() where a hard
coded error string "Matching credential not found" makes sense.
However, it is also called from krb5_get_creds() and
krb5_get_credentials_with_flags() with error codes that are
returned from the KDC where hiding the true error string
confuses the end user and hampers debugging.

This change replaces the hard coded string with the result
of krb5_get_error_message() and appends the service ticket
name.

Change-Id: I275c66c7b5783ae25029dce5b851cb389b118bcc


  Commit: e7bdd585d7a24688790f12398e4896f333104377
      https://github.com/heimdal/heimdal/commit/e7bdd585d7a24688790f12398e4896f333104377
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_debug initialize output parameters

The caller of heim_config_parse_debug() expects the output
parameters to be initialized even when the return code is non-zero.
This change initializes the output parameters in case the caller
did not.  Not all code paths assign values to the output parameters
which can result in unexpected termination of the process when
an uninitialized stack pointer is assumed to be valid.

Change-Id: Ib7530a9f16ba3e1500a7e27ccdd8ad9f0492b464


  Commit: 6179a6a1d9eea5e6d8d03ddb34e31e1073ebd254
      https://github.com/heimdal/heimdal/commit/6179a6a1d9eea5e6d8d03ddb34e31e1073ebd254
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_dir_multi do not overwrite error

In heim_config_parse_dir_multi() do not call heim_enomem(context)
when returning ENOMEM when a better error has already been set in
the context.  Just return ENOMEM.

Change-Id: I9bd9de552b2b04b5a7328ac635e911d6e95422ef


  Commit: 55b4a5efaeff3867fa3d819241c88fe427b54040
      https://github.com/heimdal/heimdal/commit/55b4a5efaeff3867fa3d819241c88fe427b54040
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_debug doesn't return com_err table errors

A non-zero return value from heim_config_parse_debug() means there
was an failure to open or parse the configuration data.  However, it
is not necessarily an error code.  Callers when setting an error
message must use an error code.

This change to heim_config_parse_file_multi() and
heim_config_parse_string_multi() set an error code of
HEIM_ERR_CONFIG_BADFORMAT when setting the error message.

Change-Id: I534b9af1c50e32d79799a936cb6252dab99c2a64


  Commit: 16b3da9c9e4f8936139223142f0e1e027cfaa795
      https://github.com/heimdal/heimdal/commit/16b3da9c9e4f8936139223142f0e1e027cfaa795
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_file do not leak 'newfname'

Refactor heim_config_parse_file() to use a common exit and
ensure that 'newfname' is freed on all exit paths.

Change-Id: Ie805ce2f9d6cbd26a3b98dc944b40864945b6d80


  Commit: 4ea964ff9b69f778646ca45020e1e664e6f4c381
      https://github.com/heimdal/heimdal/commit/4ea964ff9b69f778646ca45020e1e664e6f4c381
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-25 (Mon, 25 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_file_multi warn if ignoring included config

At present Heimdal silently ignores included configuration files that
cannot be successfully opened or parsed.  This is done to ensure that
an administrator or configuration management tool cannot lock users
out of a machine due to an editing mistake.

This change modifies heim_config_parse_file_multi() to warn the user
if a configuration file cannot be parsed or if an included ("include"
or "includedir") configuration file cannot be opened.  Example warnings
for a configuration file starting with:

  includedir c:/temp

where some of the matching file names cannot be parsed:

  Ignoring: c:\temp\20170516:1: binding before section

or opened:

  Ignoring: open or stat c:\temp\AUAA-83: Permission denied

A top level configuration file will also generate a warning if it
can be opened but cannot be parsed successfully produces

  Ignoring: c:\temp\foo.cmd:1: binding before section
  Ignoring: C:\ProgramData\Kerberos\krb5.conf:22: unmatched }

Change-Id: I455854156f4a61e1b7dad7f96601eca23d2368eb


Compare: https://github.com/heimdal/heimdal/compare/25b9c838f051%5E...4ea964ff9b69

From noreply at github.com  Tue May 26 18:51:43 2020
From: noreply at github.com (Jeffrey Altman)
Date: Tue, 26 May 2020 09:51:43 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] afc9eb: fix calling
 conventions
Message-ID: <heimdal/heimdal/push/refs/heads/master/e3dbc8-f0de5f@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: afc9ebe08b84b9b8ea9077b678d3cd5e99c3d1f7
      https://github.com/heimdal/heimdal/commit/afc9ebe08b84b9b8ea9077b678d3cd5e99c3d1f7
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M kuser/kx509.c
    M lib/base/log.c
    M lib/gssapi/mech/context.c
    M lib/krb5/kx509.c

  Log Message:
  -----------
  fix calling conventions

When a function is assigned to a function pointer that is declared
with a particular calling convention, then the assigned function
must be declared with that calling convention as well.  Otherwise,
kaboom!!!

The following functions are fixed by this change:

kuser/kx509.c
  validate1()
  add1_2chain()

lib/base/log.c
  log_syslog()
  close_syslog()
  log_file()
  close_file()

lib/gssapi/mech/context.c
  gss_set_log_function()

lib/krb5/kx509.c
  certs_export_func()

Change-Id: Ib68abf739e3385e98136fa4e4f5a0240e9fce033


  Commit: f77618ef15d37b7abea2d17c00bd4aa8f2406fef
      https://github.com/heimdal/heimdal/commit/f77618ef15d37b7abea2d17c00bd4aa8f2406fef
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/roken/stdint.hin

  Log Message:
  -----------
  roken: stdint.hin libtommath 1.2.0 needs more

libtommath 1.2.0 c403b660825f0f99451a805408f6a8ef354d1cd7
("hcrypto: import libtommath v1.2.0") needs more from stdint.h
than what Heimdal previously declared.  Add more integer type
declarations and integer MIN/MAX macros.

Also, on Windows declare 64-bit integers using __int64 as
"long long" is not supported as 64-bit type across all visual
studio compiler versions.

Change-Id: I944bedc67bcb26374ffb30eb3dfd7c6108a98fc3


  Commit: 30745617960c85586d1b8a067c89d4abecf6f465
      https://github.com/heimdal/heimdal/commit/30745617960c85586d1b8a067c89d4abecf6f465
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/base/baselocl.h
    M lib/base/config_file.c
    M lib/base/log.c

  Log Message:
  -----------
  lib/base: introduce HEIM_BASE_USE_PATH_TOKENS

KRB5_USE_PATH_TOKENS cannot be used within lib/base as its value
is declared in lib/krb5/krb5.h.  Declare HEIM_BASE_USE_PATH_TOKENS
in lib/base/baselocl.h and test for it in
heim_config_parse_file_multi().

By conditionalizing heim_config_parse_file_multi() behavior on
KRB5_USE_PATH_TOKENS heim_expand_path_tokens() is not executed
and open() is called on a path without token substitution.  As a
result open() always fails with ENOENT.

Change-Id: I29dc018bc560519b76314232b2d51f53bde6313c


  Commit: 6bdbf3ca273d6f24e25f1277add70931d0a6a5fd
      https://github.com/heimdal/heimdal/commit/6bdbf3ca273d6f24e25f1277add70931d0a6a5fd
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M windows/NTMakefile.w32

  Log Message:
  -----------
  windows: revert change to ldebug

ea90ca86664c73fb8d415f3cc7baacdf8a6dd685 ("Move some infra bits of
lib/krb5/ to lib/base/ (2)") inappropriately altered the declaration
of the "ldebug" macro which stores the switches passed to "link.exe".
There is no "/RELEASE" switch and the "/DEBUG" switch instructs the
linker to produce files containing debug symbols (.pdb) which are
required for generating the Windows assemblies.

This change restores the prior behavior.

Change-Id: I61b8fd4759ba84671858f7c8275dbd25af1638e6


  Commit: aa47b5f1a37f8284e994f2acd1a769f41938c6c6
      https://github.com/heimdal/heimdal/commit/aa47b5f1a37f8284e994f2acd1a769f41938c6c6
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/base/context.c
    M lib/hx509/cert.c

  Log Message:
  -----------
  Don't override the PATH_SEP definition if present

PATH_SEP is declared on Windows to be ";" and not ":"
by include/config.h.w32.

lib/base/context.c and lib/hx509.c must not override an existing
setting.  Otherwise, file lists cannot be separated and will be
treated as a single file name.

Change-Id: I5521188faca36e41fbae95fbb8942970eab261c8


  Commit: fde95037a8558aeaf47797f39fc9a1645819a040
      https://github.com/heimdal/heimdal/commit/fde95037a8558aeaf47797f39fc9a1645819a040
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  lib/krb5: not_found() do not substitute the error text

not_found() is called internally with error code KRB5_CC_NOTFOUND
from find_cred() and get_cred_kdc_capath_worker() where a hard
coded error string "Matching credential not found" makes sense.
However, it is also called from krb5_get_creds() and
krb5_get_credentials_with_flags() with error codes that are
returned from the KDC where hiding the true error string
confuses the end user and hampers debugging.

This change replaces the hard coded string with the result
of krb5_get_error_message() and appends the service ticket
name.

Change-Id: I275c66c7b5783ae25029dce5b851cb389b118bcc


  Commit: 728639e8170ca72f6c2e2dbe79e7090a6d7b3dc1
      https://github.com/heimdal/heimdal/commit/728639e8170ca72f6c2e2dbe79e7090a6d7b3dc1
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_debug initialize output parameters

The caller of heim_config_parse_debug() expects the output
parameters to be initialized even when the return code is non-zero.
This change initializes the output parameters in case the caller
did not.  Not all code paths assign values to the output parameters
which can result in unexpected termination of the process when
an uninitialized stack pointer is assumed to be valid.

Change-Id: Ib7530a9f16ba3e1500a7e27ccdd8ad9f0492b464


  Commit: 965121630c02240ef417a5237e0529145ed5d230
      https://github.com/heimdal/heimdal/commit/965121630c02240ef417a5237e0529145ed5d230
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_dir_multi do not overwrite error

In heim_config_parse_dir_multi() do not call heim_enomem(context)
when returning ENOMEM when a better error has already been set in
the context.  Just return ENOMEM.

Change-Id: I9bd9de552b2b04b5a7328ac635e911d6e95422ef


  Commit: 58db0edea0d67e1b9a6abcc14eeb474441f50dfa
      https://github.com/heimdal/heimdal/commit/58db0edea0d67e1b9a6abcc14eeb474441f50dfa
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_debug doesn't return com_err table errors

A non-zero return value from heim_config_parse_debug() means there
was an failure to open or parse the configuration data.  However, it
is not necessarily an error code.  Callers when setting an error
message must use an error code.

This change to heim_config_parse_file_multi() and
heim_config_parse_string_multi() set an error code of
HEIM_ERR_CONFIG_BADFORMAT when setting the error message.

Change-Id: I534b9af1c50e32d79799a936cb6252dab99c2a64


  Commit: 5502fa4ecaad44628d91be1edca904d701c880f4
      https://github.com/heimdal/heimdal/commit/5502fa4ecaad44628d91be1edca904d701c880f4
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_file do not leak 'newfname'

Refactor heim_config_parse_file() to use a common exit and
ensure that 'newfname' is freed on all exit paths.

Change-Id: Ie805ce2f9d6cbd26a3b98dc944b40864945b6d80


  Commit: f0de5f5c43f39d45b5d9a656a80864f7a643e283
      https://github.com/heimdal/heimdal/commit/f0de5f5c43f39d45b5d9a656a80864f7a643e283
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  lib/base: heim_config_parse_file_multi warn if ignoring included config

At present Heimdal silently ignores included configuration files that
cannot be successfully opened or parsed.  This is done to ensure that
an administrator or configuration management tool cannot lock users
out of a machine due to an editing mistake.

This change modifies heim_config_parse_file_multi() to warn the user
if a configuration file cannot be parsed or if an included ("include"
or "includedir") configuration file cannot be opened.  Example warnings
for a configuration file starting with:

  includedir c:/temp

where some of the matching file names cannot be parsed:

  Ignoring: c:\temp\20170516:1: binding before section

or opened:

  Ignoring: open or stat c:\temp\AUAA-83: Permission denied

A top level configuration file will also generate a warning if it
can be opened but cannot be parsed successfully produces

  Ignoring: c:\temp\foo.cmd:1: binding before section
  Ignoring: C:\ProgramData\Kerberos\krb5.conf:22: unmatched }

Change-Id: I455854156f4a61e1b7dad7f96601eca23d2368eb


Compare: https://github.com/heimdal/heimdal/compare/e3dbc89f8fb6...f0de5f5c43f3

From noreply at github.com  Tue May 26 19:03:42 2020
From: noreply at github.com (Nico Williams)
Date: Tue, 26 May 2020 10:03:42 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal]
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/fix-windows-on-master/4ea964-f0de5f@github.com>

  Branch: refs/heads/jaltman/fix-windows-on-master
  Home:   https://github.com/heimdal/heimdal

From noreply at github.com  Tue May 26 19:10:33 2020
From: noreply at github.com (Isaac Boukris)
Date: Tue, 26 May 2020 10:10:33 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 6d33cb: Fix core dump
 handling in travis CI
Message-ID: <heimdal/heimdal/push/refs/heads/master/f0de5f-662dfb@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: 6d33cb8290966ef451f4b4389bcb9d07584debef
      https://github.com/heimdal/heimdal/commit/6d33cb8290966ef451f4b4389bcb9d07584debef
  Author: Isaac Boukris <iboukris at gmail.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M .travis.yml

  Log Message:
  -----------
  Fix core dump handling in travis CI


  Commit: 662dfbb38beac948a4b73509cffdffd2bc352cb8
      https://github.com/heimdal/heimdal/commit/662dfbb38beac948a4b73509cffdffd2bc352cb8
  Author: Isaac Boukris <iboukris at gmail.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M tests/gss/krb5.conf.in

  Log Message:
  -----------
  Test including malformed krb5.conf file


Compare: https://github.com/heimdal/heimdal/compare/f0de5f5c43f3...662dfbb38bea

From noreply at github.com  Tue May 26 19:19:45 2020
From: noreply at github.com (Jeffrey Altman)
Date: Tue, 26 May 2020 10:19:45 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 29f504: appveyor:
 Install zstd before other pkgs
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/for-heimdal-7-1-branch/000000-d6327f@github.com>

  Branch: refs/heads/jaltman/for-heimdal-7-1-branch
  Home:   https://github.com/heimdal/heimdal
  Commit: 29f50479e17724c4e037f6ffc83d6abce2994ac9
      https://github.com/heimdal/heimdal/commit/29f50479e17724c4e037f6ffc83d6abce2994ac9
  Author: Nicolas Williams <nico at twosigma.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M appveyor.yml

  Log Message:
  -----------
  appveyor: Install zstd before other pkgs

Some pacman packages are now being compressed with the ZST algorithm,
but pacman can't handle that unless we first install `zstd`.  This
commit does that.

(cherry picked from commit e3dbc89f8fb6dd0a3a07caee7f752dc2bec3b6d9)


  Commit: e2b379c4db64098493458dbec791500b6e6dfccd
      https://github.com/heimdal/heimdal/commit/e2b379c4db64098493458dbec791500b6e6dfccd
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/krb5/config_file.c

  Log Message:
  -----------
  krb5: krb5_config_parse_debug initialize output parameters

The caller of krb5_config_parse_debug() expects the output
parameters to be initialized even when the return code is non-zero.
This change initializes the output parameters in case the caller
did not.  Not all code paths assign values to the output parameters
which can result in unexpected termination of the process when
an uninitialized stack pointer is assumed to be valid.

Change-Id: I91859bb5a79ec08b8168e503e267070e2d9315a0


  Commit: d6327fa12b293c648f57fc034f9bd63700ecaef5
      https://github.com/heimdal/heimdal/commit/d6327fa12b293c648f57fc034f9bd63700ecaef5
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  lib/krb5: not_found() do not substitute the error text

not_found() is called internally with error code KRB5_CC_NOTFOUND
from find_cred() and get_cred_kdc_capath_worker() where a hard
coded error string "Matching credential not found" makes sense.
However, it is also called from krb5_get_creds() and
krb5_get_credentials_with_flags() with error codes that are
returned from the KDC where hiding the true error string
confuses the end user and hampers debugging.

This change replaces the hard coded string with the result
of krb5_get_error_message() and appends the service ticket
name.

Change-Id: I275c66c7b5783ae25029dce5b851cb389b118bcc
(cherry picked from commit fde95037a8558aeaf47797f39fc9a1645819a040)


Compare: https://github.com/heimdal/heimdal/compare/29f50479e177%5E...d6327fa12b29

From noreply at github.com  Tue May 26 22:12:26 2020
From: noreply at github.com (Jeffrey Altman)
Date: Tue, 26 May 2020 13:12:26 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 037b70: appveyor:
 Install zstd before other pkgs
Message-ID: <heimdal/heimdal/push/refs/heads/heimdal-7-1-branch/a028bf-2477c2@github.com>

  Branch: refs/heads/heimdal-7-1-branch
  Home:   https://github.com/heimdal/heimdal
  Commit: 037b70ea0f297e232bc150341b9dcf0347c38096
      https://github.com/heimdal/heimdal/commit/037b70ea0f297e232bc150341b9dcf0347c38096
  Author: Nicolas Williams <nico at twosigma.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M appveyor.yml

  Log Message:
  -----------
  appveyor: Install zstd before other pkgs

Some pacman packages are now being compressed with the ZST algorithm,
but pacman can't handle that unless we first install `zstd`.  This
commit does that.

(cherry picked from commit e3dbc89f8fb6dd0a3a07caee7f752dc2bec3b6d9)


  Commit: 0d51410dba42bacbba25ab11fed0b8aa43dcb589
      https://github.com/heimdal/heimdal/commit/0d51410dba42bacbba25ab11fed0b8aa43dcb589
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/krb5/config_file.c

  Log Message:
  -----------
  krb5: krb5_config_parse_debug initialize output parameters

The caller of krb5_config_parse_debug() expects the output
parameters to be initialized even when the return code is non-zero.
This change initializes the output parameters in case the caller
did not.  Not all code paths assign values to the output parameters
which can result in unexpected termination of the process when
an uninitialized stack pointer is assumed to be valid.

Change-Id: I91859bb5a79ec08b8168e503e267070e2d9315a0


  Commit: 2477c283979d347ed9005a821705cbd788ea9991
      https://github.com/heimdal/heimdal/commit/2477c283979d347ed9005a821705cbd788ea9991
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-26 (Tue, 26 May 2020)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  lib/krb5: not_found() do not substitute the error text

not_found() is called internally with error code KRB5_CC_NOTFOUND
from find_cred() and get_cred_kdc_capath_worker() where a hard
coded error string "Matching credential not found" makes sense.
However, it is also called from krb5_get_creds() and
krb5_get_credentials_with_flags() with error codes that are
returned from the KDC where hiding the true error string
confuses the end user and hampers debugging.

This change replaces the hard coded string with the result
of krb5_get_error_message() and appends the service ticket
name.

Change-Id: I275c66c7b5783ae25029dce5b851cb389b118bcc
(cherry picked from commit fde95037a8558aeaf47797f39fc9a1645819a040)


Compare: https://github.com/heimdal/heimdal/compare/a028bfbf830c...2477c283979d

From noreply at github.com  Tue May 26 22:12:29 2020
From: noreply at github.com (Jeffrey Altman)
Date: Tue, 26 May 2020 13:12:29 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal]
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/for-heimdal-7-1-branch/d6327f-000000@github.com>

  Branch: refs/heads/jaltman/for-heimdal-7-1-branch
  Home:   https://github.com/heimdal/heimdal

From noreply at github.com  Wed May 27 06:17:40 2020
From: noreply at github.com (Jeffrey Altman)
Date: Tue, 26 May 2020 21:17:40 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal]
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/fix-windows-on-master/f0de5f-000000@github.com>

  Branch: refs/heads/jaltman/fix-windows-on-master
  Home:   https://github.com/heimdal/heimdal

From noreply at github.com  Wed May 27 08:41:40 2020
From: noreply at github.com (Jeffrey Altman)
Date: Tue, 26 May 2020 23:41:40 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] e301f0: base:
 heim_conf_parse_file_multi remove extra unus...
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/master-fixes/000000-fd6174@github.com>

  Branch: refs/heads/jaltman/master-fixes
  Home:   https://github.com/heimdal/heimdal
  Commit: e301f08789f636264561247747001cf10610adb8
      https://github.com/heimdal/heimdal/commit/e301f08789f636264561247747001cf10610adb8
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  base: heim_conf_parse_file_multi remove extra unused parameter

This call

  heim_warn(context, ret, "Ignoring", fname);

doesn't require the 'fname' paramter.  Remove it.

Change-Id: Ia339568658306a903a64ff9e098f914e7387bdd7


  Commit: 8194927042677c2a14f0c02e05d6e5c8e90168dc
      https://github.com/heimdal/heimdal/commit/8194927042677c2a14f0c02e05d6e5c8e90168dc
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  krb5: not_found must free krb5_get_error_message string

Even though krb5_get_error_message() returns 'const char *' the
C-string is allocated and must be freed using krb5_free_error_message().

Change-Id: I8d4ef6fce12f113617443d15abadf51f1e04cf1a


  Commit: fd6174ba59e1d50b48aa1093cc88f8712d6168a3
      https://github.com/heimdal/heimdal/commit/fd6174ba59e1d50b48aa1093cc88f8712d6168a3
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/base/common_plugin.h

  Log Message:
  -----------
  base: common_plugin.h add missing typedefs

ea90ca86664c73fb8d415f3cc7baacdf8a6dd685("Move some infra bits of
lib/krb5/ to lib/base/ (2)") forgot to add typedefs

  heim_get_instance_func_t
  krb5_get_instance_t

required for compilation of krb5_get_instance style plugins.

Change-Id: I3130f86034be1f9f79694eca0d1b309e247fd03f


Compare: https://github.com/heimdal/heimdal/compare/e301f08789f6%5E...fd6174ba59e1

From noreply at github.com  Wed May 27 15:01:39 2020
From: noreply at github.com (Jeffrey Altman)
Date: Wed, 27 May 2020 06:01:39 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] c6213f: base:
 heim_conf_parse_file_multi remove extra unus...
Message-ID: <heimdal/heimdal/push/refs/heads/master/662dfb-f91f78@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: c6213fc894e4f3d64a16cfc923ed6eca84d6a11c
      https://github.com/heimdal/heimdal/commit/c6213fc894e4f3d64a16cfc923ed6eca84d6a11c
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/base/config_file.c

  Log Message:
  -----------
  base: heim_conf_parse_file_multi remove extra unused parameter

This call

  heim_warn(context, ret, "Ignoring", fname);

doesn't require the 'fname' paramter.  Remove it.

Change-Id: Ia339568658306a903a64ff9e098f914e7387bdd7


  Commit: 739f7e0484e412de7de6d5ef1100fcc20836d19d
      https://github.com/heimdal/heimdal/commit/739f7e0484e412de7de6d5ef1100fcc20836d19d
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  krb5: not_found must free krb5_get_error_message string

Even though krb5_get_error_message() returns 'const char *' the
C-string is allocated and must be freed using krb5_free_error_message().

Change-Id: I8d4ef6fce12f113617443d15abadf51f1e04cf1a


  Commit: f91f786dd67406650e826ee58c50959ca5000203
      https://github.com/heimdal/heimdal/commit/f91f786dd67406650e826ee58c50959ca5000203
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/base/common_plugin.h

  Log Message:
  -----------
  base: common_plugin.h add missing typedefs

ea90ca86664c73fb8d415f3cc7baacdf8a6dd685("Move some infra bits of
lib/krb5/ to lib/base/ (2)") forgot to add typedefs

  heim_get_instance_func_t
  krb5_get_instance_t

required for compilation of krb5_get_instance style plugins.

Change-Id: I3130f86034be1f9f79694eca0d1b309e247fd03f


Compare: https://github.com/heimdal/heimdal/compare/662dfbb38bea...f91f786dd674

From noreply at github.com  Wed May 27 15:01:53 2020
From: noreply at github.com (Jeffrey Altman)
Date: Wed, 27 May 2020 06:01:53 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal]
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/master-fixes/fd6174-000000@github.com>

  Branch: refs/heads/jaltman/master-fixes
  Home:   https://github.com/heimdal/heimdal

From noreply at github.com  Thu May 28 03:54:54 2020
From: noreply at github.com (Andrew Bartlett)
Date: Wed, 27 May 2020 18:54:54 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 1a6561: Check some error
 returns from *asprintf()
Message-ID: <heimdal/heimdal/push/refs/heads/master/f91f78-1a6561@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: 1a65611f61c240cb58a1620c7ddf9699865ac866
      https://github.com/heimdal/heimdal/commit/1a65611f61c240cb58a1620c7ddf9699865ac866
  Author: Andrew Bartlett <abartlet at samba.org>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M kdc/kerberos5.c
    M lib/base/expand_path.c
    M lib/base/log.c
    M lib/gssapi/mech/context.c

  Log Message:
  -----------
  Check some error returns from *asprintf()

This avoids these compiler warnings on Ubuntu 18.04
gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)

expand_path.c: In function ‘expand_token’:
expand_path.c:493:17: warning: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Wunused-result]
                 asprintf(&arg, "%.*s", (int)(token_end - colon - 1), colon + 1);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
log.c: In function ‘fmtkv’:
log.c:646:5: warning: ignoring return value of ‘vasprintf’, declared with attribute warn_unused_result [-Wunused-result]
     vasprintf(&buf1, fmt, ap);
     ^~~~~~~~~~~~~~~~~~~~~~~~~

mech/context.c: In function ‘gss_mg_set_error_string’:
mech/context.c:212:5: warning: ignoring return value of ‘vasprintf’, declared with attribute warn_unused_result [-Wunused-result]
     (void) vasprintf(&str, fmt, ap);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mech/context.c: In function ‘_gss_mg_log_name’:
mech/context.c:319:6: warning: ignoring return value of ‘vasprintf’, declared with attribute warn_unused_result [-Wunused-result]
      (void) vasprintf(&str, fmt, ap);
      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mech/context.c: In function ‘_gss_mg_log_cred’:
mech/context.c:346:5: warning: ignoring return value of ‘vasprintf’, declared with attribute warn_unused_result [-Wunused-result]
     (void) vasprintf(&str, fmt, ap);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

kerberos5.c: In function ‘_kdc_set_e_text’:
kerberos5.c:338:5: warning: ignoring return value of ‘vasprintf’, declared with attribute warn_unused_result [-Wunused-result]
     vasprintf(&e_text, fmt, ap);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Andrew Bartlett <abartlet at samba.org>



From noreply at github.com  Thu May 28 05:27:05 2020
From: noreply at github.com (Jeffrey Altman)
Date: Wed, 27 May 2020 20:27:05 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 9769a3: lib/krb5:
 krb5_get_instance does not work on Windo...
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/fix-krb5_ccache-plugins/000000-c33324@github.com>

  Branch: refs/heads/jaltman/fix-krb5_ccache-plugins
  Home:   https://github.com/heimdal/heimdal
  Commit: 9769a32b9026cacf062ddb8a767dd4b1667e734e
      https://github.com/heimdal/heimdal/commit/9769a32b9026cacf062ddb8a767dd4b1667e734e
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/heimdal/NTMakefile
    M lib/krb5/plugin.c
    M lib/roken/NTMakefile
    M lib/roken/roken.h.in
    A lib/roken/win32_version.c

  Log Message:
  -----------
  lib/krb5: krb5_get_instance does not work on Windows 7

krb5_get_instance() is meant to ensure that the shared library
instance of heimdal loaded by a plugin matches the instance that
loaded the plugin.  It works by declaring a static C string whose
memory address will be used as an instance identifier.  If the
instance returned from the plugin matches the instance obtain
by the code that loads the plugin, then we can conclude the two
instances are the same.

This doesn't work on Windows 7.  When heimdal.dll loads a plugin
that is linked to heimdal.dll, the plugin's heimdal.dll is always
a new instance.  However, the requirement for plugin safety is
not that the plugin be the same instance in memory but that they
be the same instance on disk.

This change loads the path name and version string for the module
and generates a hash of those strings as an instance identifier.

Change-Id: I1c0651969e9738c5feecb0b323969d13efd4704d


  Commit: b8ca339fc528e31c7e5026f78ba791c049fc74bc
      https://github.com/heimdal/heimdal/commit/b8ca339fc528e31c7e5026f78ba791c049fc74bc
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/base/common_plugin.h

  Log Message:
  -----------
  base: common_plugin.h define KRB5_CALLCONV / KRB5_LIB_CALL

common_plugin.h is expected to be usable on its own.
For backward compatibility, restore the definitions of
KRB5_CALLCONV and KRB5_LIB_CALL.

Change-Id: I6d2239f91ab48b9a6b71816b5221807382dc5914


  Commit: c33324a5cdcd77a31a815598a847ef94901ce418
      https://github.com/heimdal/heimdal/commit/c33324a5cdcd77a31a815598a847ef94901ce418
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/krb5/acache.c
    M lib/krb5/cache.c
    M lib/krb5/dcache.c
    M lib/krb5/fcache.c
    M lib/krb5/kcm.c
    M lib/krb5/krb5.h
    M lib/krb5/krcache.c
    M lib/krb5/mcache.c
    M lib/krb5/pcache.c
    M lib/krb5/scache.c

  Log Message:
  -----------
  krb5: krb5_cc_ops backward compatibility and extensibility

The krb5_cc_ops structure is an extensible structure to which new
functionality has been added over the years.

Version zero was the original.  It included all functions up to
and including get_default_name().

Version one added set_default().

Version two added lastchange().

Version three added set_kdc_offset() and get_kdc_offset().

Version four broke compatibility by modifying the signatures
of get_name() and resolve().   This was in change
7bf4d76e75e904dd65a0fbb90c9cad981245f714 ("krb5: Improve cccol sub
naming; add gss_store_cred_into2()").

Version five restores the original signatures of get_name()
and resolve() and introduces get_name_2() and resolve_2() that
provide the additional cccol functionality.

This change

 * introduces version five
 * documents which functions are part of each version
 * replaces KRB5_CC_OPS_VERSION with KRB5_CC_OPS_VERSION_0,
   KRB5_CC_OPS_VERSION_1, KRB5_CC_OPS_VERSION_2, KRB5_CC_OPS_VERSION_3,
   and KRB5_CC_OPS_VERSION_5.  KRB5_CC_OPS_VERSION_4 is skipped
   because of the aforementioned breakage.
 * compatibility logic is added to permit ccache plugins to implement
   any of version one, two, three, five or a future version.
 * all in-tree krb5_cc_ops implementations are updated to version 5.

Change-Id: Iadfce01d10834bc6151939e4d9d196f03001626e


Compare: https://github.com/heimdal/heimdal/compare/9769a32b9026%5E...c33324a5cdcd

From noreply at github.com  Thu May 28 06:22:54 2020
From: noreply at github.com (Jeffrey Altman)
Date: Wed, 27 May 2020 21:22:54 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] d4c0d3: lib/krb5:
 krb5_get_instance does not work on Windo...
Message-ID: <heimdal/heimdal/push/refs/heads/master/1a6561-d84512@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: d4c0d345488d4d3751aed200e48cc043afe62889
      https://github.com/heimdal/heimdal/commit/d4c0d345488d4d3751aed200e48cc043afe62889
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/heimdal/NTMakefile
    M lib/krb5/plugin.c
    M lib/roken/NTMakefile
    M lib/roken/roken.h.in
    A lib/roken/win32_version.c

  Log Message:
  -----------
  lib/krb5: krb5_get_instance does not work on Windows 7

krb5_get_instance() is meant to ensure that the shared library
instance of heimdal loaded by a plugin matches the instance that
loaded the plugin.  It works by declaring a static C string whose
memory address will be used as an instance identifier.  If the
instance returned from the plugin matches the instance obtain
by the code that loads the plugin, then we can conclude the two
instances are the same.

This doesn't work on Windows 7.  When heimdal.dll loads a plugin
that is linked to heimdal.dll, the plugin's heimdal.dll is always
a new instance.  However, the requirement for plugin safety is
not that the plugin be the same instance in memory but that they
be the same instance on disk.

This change loads the path name and version string for the module
and generates a hash of those strings as an instance identifier.

Change-Id: I1c0651969e9738c5feecb0b323969d13efd4704d


  Commit: 33bb2479b9a7538c1153639dacc02ff46109c215
      https://github.com/heimdal/heimdal/commit/33bb2479b9a7538c1153639dacc02ff46109c215
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/base/common_plugin.h

  Log Message:
  -----------
  base: common_plugin.h define KRB5_CALLCONV / KRB5_LIB_CALL

common_plugin.h is expected to be usable on its own.
For backward compatibility, restore the definitions of
KRB5_CALLCONV and KRB5_LIB_CALL.

Change-Id: I6d2239f91ab48b9a6b71816b5221807382dc5914


  Commit: d84512b8d2b782fdcee2360ea5942969dfc71d96
      https://github.com/heimdal/heimdal/commit/d84512b8d2b782fdcee2360ea5942969dfc71d96
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/krb5/acache.c
    M lib/krb5/cache.c
    M lib/krb5/dcache.c
    M lib/krb5/fcache.c
    M lib/krb5/kcm.c
    M lib/krb5/krb5.h
    M lib/krb5/krcache.c
    M lib/krb5/mcache.c
    M lib/krb5/pcache.c
    M lib/krb5/scache.c

  Log Message:
  -----------
  krb5: krb5_cc_ops backward compatibility and extensibility

The krb5_cc_ops structure is an extensible structure to which new
functionality has been added over the years.

Version zero was the original.  It included all functions up to
and including get_default_name().

Version one added set_default().

Version two added lastchange().

Version three added set_kdc_offset() and get_kdc_offset().

Version four broke compatibility by modifying the signatures
of get_name() and resolve().   This was in change
7bf4d76e75e904dd65a0fbb90c9cad981245f714 ("krb5: Improve cccol sub
naming; add gss_store_cred_into2()").

Version five restores the original signatures of get_name()
and resolve() and introduces get_name_2() and resolve_2() that
provide the additional cccol functionality.

This change

 * introduces version five
 * documents which functions are part of each version
 * replaces KRB5_CC_OPS_VERSION with KRB5_CC_OPS_VERSION_0,
   KRB5_CC_OPS_VERSION_1, KRB5_CC_OPS_VERSION_2, KRB5_CC_OPS_VERSION_3,
   and KRB5_CC_OPS_VERSION_5.  KRB5_CC_OPS_VERSION_4 is skipped
   because of the aforementioned breakage.
 * compatibility logic is added to permit ccache plugins to implement
   any of version one, two, three, five or a future version.
 * all in-tree krb5_cc_ops implementations are updated to version 5.

Change-Id: Iadfce01d10834bc6151939e4d9d196f03001626e


Compare: https://github.com/heimdal/heimdal/compare/1a65611f61c2...d84512b8d2b7

From noreply at github.com  Thu May 28 06:23:58 2020
From: noreply at github.com (Andrew Bartlett)
Date: Wed, 27 May 2020 21:23:58 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] 5e690f: Avoid
 -Werror=address failure due to embedded NULL...
Message-ID: <heimdal/heimdal/push/refs/heads/master/d84512-9142a4@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: 5e690fe70cd763dbc66ad3e313994c9a0271ca95
      https://github.com/heimdal/heimdal/commit/5e690fe70cd763dbc66ad3e313994c9a0271ca95
  Author: Andrew Bartlett <abartlet at samba.org>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/gssapi/mech/gss_krb5.c

  Log Message:
  -----------
  Avoid -Werror=address failure due to embedded NULL check in _mg_buffer_zero

Seen with Ubuntu 18.04
gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)

mech/gss_krb5.c: In function ‘gss_krb5_ccache_name’:
mech/gss_krb5.c:501:18: error: the address of ‘buffer’ will always evaluate as ‘true’ [-Werror=address]
  _mg_buffer_zero(&buffer);
                  ^
mech/mech_locl.h:72:7: note: in definition of macro ‘_mg_buffer_zero’
   if (buffer) {   \
       ^~~~~~

Signed-off-by: Andrew Bartlett <abartlet at samba.org>


  Commit: 9142a46e89b1e2a312e1e2ed4ea8f9a934f318d4
      https://github.com/heimdal/heimdal/commit/9142a46e89b1e2a312e1e2ed4ea8f9a934f318d4
  Author: Andrew Bartlett <abartlet at samba.org>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M .travis.yml

  Log Message:
  -----------
  Do a strict ./configure --enable-developer build to make warnings errors in CI

This will make it harder to commit code that triggers warnings.

This list of allowed warnings is too long, but can be trimmed down
over time.

Signed-off-by: Andrew Bartlett <abartlet at samba.org>


Compare: https://github.com/heimdal/heimdal/compare/d84512b8d2b7...9142a46e89b1

From noreply at github.com  Thu May 28 06:30:05 2020
From: noreply at github.com (Jeffrey Altman)
Date: Wed, 27 May 2020 21:30:05 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal]
Message-ID: <heimdal/heimdal/push/refs/heads/jaltman/fix-krb5_ccache-plugins/c33324-000000@github.com>

  Branch: refs/heads/jaltman/fix-krb5_ccache-plugins
  Home:   https://github.com/heimdal/heimdal

From noreply at github.com  Thu May 28 06:52:02 2020
From: noreply at github.com (Nico Williams)
Date: Wed, 27 May 2020 21:52:02 -0700
Subject: [Heimdal-source-changes] [heimdal/heimdal] c8e046: krb5: Fix
 krb5_cc_get_subsidiary()
Message-ID: <heimdal/heimdal/push/refs/heads/master/9142a4-c8e046@github.com>

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: c8e0461838f1d12913d052093e4936cc0dc87dbf
      https://github.com/heimdal/heimdal/commit/c8e0461838f1d12913d052093e4936cc0dc87dbf
  Author: Nicolas Williams <nico at twosigma.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M lib/krb5/cache.c

  Log Message:
  -----------
  krb5: Fix krb5_cc_get_subsidiary()