]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
kerberos: Fix numerous segfaults when using weak crypto
authorCy Schubert <cy@FreeBSD.org>
Wed, 6 Dec 2023 15:30:05 +0000 (07:30 -0800)
committerCy Schubert <cy@FreeBSD.org>
Thu, 11 Jan 2024 13:26:42 +0000 (05:26 -0800)
commitcb350ba7bf7ca7c4cb97ed2c20ab45af60382cfb
tree6214d52d269daecc743e71fbce54e26dc5d03d03
parented1a88a3116a59b4fd37912099a575b4c8f559dc
kerberos: Fix numerous segfaults when using weak crypto

Weak crypto is provided by the openssl legacy provider which is
not load by default. Load the legacy providers as needed.

When the legacy provider is loaded into the default context the default
provider will no longer be automatically loaded. Without the default
provider the various kerberos applicaions and functions will abort().

PR: 272835
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D43009
Tested by: netchild, Joerg Pulz <Joerg.Pulz@frm2.tum.de>
13 files changed:
Makefile.inc1
crypto/heimdal/lib/kadm5/create_s.c
crypto/heimdal/lib/kadm5/kadm5_locl.h
crypto/heimdal/lib/krb5/context.c
crypto/heimdal/lib/krb5/crypto.c
crypto/heimdal/lib/krb5/salt.c
crypto/heimdal/lib/roken/version-script.map
kerberos5/include/crypto-headers.h
kerberos5/include/fbsd_ossl_provider.h [new file with mode: 0644]
kerberos5/lib/libroken/Makefile
kerberos5/lib/libroken/fbsd_ossl_provider_load.c [new file with mode: 0644]
kerberos5/libexec/kdc/Makefile
share/mk/src.libnames.mk