From nobody Tue Aug 12 13:24:51 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4c1XL04wn1z64mF7; Tue, 12 Aug 2025 13:24:56 +0000 (UTC) (envelope-from fluffy@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4c1XL03xDnz3Q3b; Tue, 12 Aug 2025 13:24:56 +0000 (UTC) (envelope-from fluffy@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1755005096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=4Y9u87pt1iOOItT5b+FO047MnvguQh82Waxdy7/HcBU=; b=k69eJ1f7GlhWdMn3y2bBlZBkvH9u2InYqDRAUaL6HjR2m/YZcKWy1L+mkbTlFnRt4vPWZf 34O1Fyd1ssEpgtNtwVOtwOfCk2qW/Mdza8rERw5sJnpuu0427MOJ+w0JNXTJhiyI4TuhUi 0ZHgQipzRoaf3kbvmcCmr0uiGlQMVQM1ZhsvI0DHIgz+njnnoaThn7v+Y2UMI5e+YG0qer iFRMHVy7H0Fy79NBprVcZD5nJNNbKb3rK5ja+fKJAeebMIxdTNWhqFzTK00BAyrkgvG68P EHySl5ThqbMS+koeo77Iq8RMD+csJjXUDiWKjQURHTs39m793WybXPi72TLciQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1755005096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=4Y9u87pt1iOOItT5b+FO047MnvguQh82Waxdy7/HcBU=; b=bhlw2WCgQzOURJEJv8/kwarB1g52w7q4PrYJqlz1SZfGvNQEsB6Yfu/5R8Jv7hfnFdrKU1 nfywstdkDe6qzTtHXnZUtkNKB+f32UOBI2JcSbTP+7YWkjK+7u8X317m4OvdXYS14MbmR8 2mQ6XnU05aSlatzVHDebE9fw1EwAvD31l7WmpDxRqh0CKLTLQEBzBI3ZP29fXSXiMH9wUX hQiQTiSsVfDjxH4gs+/N1Yqmhoo7/lsM2SgNjTUaB2QUwhd13r0pctIcnfCC0PwO78Rtnx eaeJtrVsmT7mSI8wYzKHCcZsZl1QaUyh8ayZgfHRUfVtia5R5+L9joNVeXMfMg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1755005096; a=rsa-sha256; cv=none; b=eZMvYYdQXZo7BpoxHt59D6tjOJDotT/6Lku4F9Aw9zak6pFVIEq3pk1/Bj0i+ql+4MqutM OvtEODKt9AZqsM/xX4TJ15mmaFP+6k5TtzCNcRABLJSJuQaZjAsVuIsG1LfBIkBFFe0wmy bCHgz6hfYHVextYIoNU329KOs1L/rqIS/FTPsmdSVdS1/G048s50fPU2LMPIEr+KJ6oiVl Q+w0SRxUTakQIZAOrb1O57FLnmNE4KAbjsrYsSAx/H3CAHZZVYeW+XSx1sbAQZ+QW7nnuK yQ2dBpMLfOabCYMUN9vk9RCBjOryzPTtZg/13+7jaPflF58mf3fGr9x7no+7jQ== Received: from [100.109.252.209] (unknown [176.15.166.221]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) (Authenticated sender: fluffy) by smtp.freebsd.org (Postfix) with ESMTPSA id 4c1XKy35zczPWH; Tue, 12 Aug 2025 13:24:54 +0000 (UTC) (envelope-from fluffy@FreeBSD.org) Date: Tue, 12 Aug 2025 16:24:51 +0300 From: Dima Panov To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org, Lexi Winter Message-ID: <8e7a9c07-5efd-4450-a590-a6aeaa59b402@Canary> In-Reply-To: <851c968c-923a-4809-83d4-b0600e70867b@Canary> References: <202508101537.57AFbHrI067216@gitrepo.freebsd.org> <851c968c-923a-4809-83d4-b0600e70867b@Canary> Subject: git: 7ac276298b72 - main - Remove Secure RPC DES authentication X-Canary-Draft: 2 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="689b40a3_2336c6b7_50e" --689b40a3_2336c6b7_50e Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline All xservers are affected. However, upstream already deal with it in commit https://gitlab.freedeskt= op.org/xorg/xserver/-/commit/71b207a2ebc1465c7d9ad9262f60930f6a1d42ee -- Dima. (desktop, kde, x11, office, ports-secteam)=40=46reeBSD team (fluffy=40=46reeBSD.org, https://t.me/=46luffyBSD) > On =D0=B2=D1=82=D0=BE=D1=80=D0=BD=D0=B8=D0=BA, =D0=B0=D0=B2=D0=B3. 12, = 2025 at 1:41 PM, Dima Panov wrote: > Hello=21 > > This commit breaks x11-server/xwayland > > =46AILED: os/liblibxserver=5Fos.a.p/rpcauth.c.o cc -Ios/liblibxserver=5F= os.a.p -Ios -I../os -I. -I.. -IXext -I../Xext -IXi -I../Xi -Icomposite -I= ../composite -Idamageext -I../damageext -Ifb -I../fb -Iglamor -I../glamor= -Imi -I../mi -Imiext/damage -I../miext/damage -Imiext/sync -I../miext/sy= nc -Idbe -I../dbe -Idix -I../dix -Idri3 -I../dri3 -Iinclude -I../include = -Ipresent -I../present -Irandr -I../randr -Irender -I../render -Ixfixes -= I../xfixes -I/usr/local/include -I/usr/local/include/pixman-1 -I/usr/loca= l/include/freetype2 -I/usr/local/include/libpng16 -fdiagnostics-color=3Dn= ever -D=5F=46ILE=5FO=46=46SET=5FBITS=3D64 -Wall -Winvalid-pch -std=3Dgnu9= 9 -DHAVE=5FDIX=5FCON=46IG=5FH -fno-strict-aliasing -fvisibility=3Dhidden = -Wall -Wpointer-arith -Wmissing-declarations -Wformat=3D2 -Wstrict-protot= ypes -Wmissing-prototypes -Wnested-externs -Wbad-function-cast -Wold-styl= e-definition -Wunused -Wuninitialized -Wshadow -Wmissing-noreturn -Wmissi= ng-format-attribute -Wredundant-decls -Werror=3Dimplicit -Werror=3Dnonnul= l -Werror=3Dinit-self -Werror=3Dmain -Werror=3Dmissing-braces -Werror=3Ds= equence-point -Werror=3Dreturn-type -Werror=3Dtrigraphs -Werror=3Darray-b= ounds -Werror=3Dwrite-strings -Werror=3Daddress -Werror=3Dint-to-pointer-= cast -Werror=3Dpointer-to-int-cast -O2 -pipe -fstack-protector-strong -fn= o-strict-aliasing -fPIC -D=5FTHREAD=5FSA=46E -D=5FDE=46AULT=5FSOURCE -D=5F= BSD=5FSOURCE -DHAS=5F=46CHOWN -DHAS=5FSTICKY=5FDIR=5FBIT -DCLIENTIDS -MD = -MQ os/liblibxserver=5Fos.a.p/rpcauth.c.o -M=46 os/liblibxserver=5Fos.a.p= /rpcauth.c.o.d -o os/liblibxserver=5Fos.a.p/rpcauth.c.o -c ../os/rpcauth.= c ../os/rpcauth.c:110:52: error: incomplete definition of type 'struct au= thdes=5Fcred' 110 =7C return (((struct authdes=5Fcred *) r.rq=5Fclntcred)= ->adc=5Ffullname.name); =7C =7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E= =7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=5E= ../os/rpcauth.c:110:22: note: forward declaration of 'struct authdes=5Fc= red' 110 =7C return (((struct authdes=5Fcred *) r.rq=5Fclntcred)->adc=5Ff= ullname.name); =7C =5E 1 error generated. > > > -- > Dima. (desktop, kde, x11, office, ports-secteam)=40=46reeBSD team > (fluffy=40=46reeBSD.org, https://t.me/=46luffyBSD) > > > > > On =D0=B2=D0=BE=D1=81=D0=BA=D1=80=D0=B5=D1=81=D0=B5=D0=BD=D1=8C=D0=B5= , =D0=B0=D0=B2=D0=B3. 10, 2025 at 6:37 PM, Lexi Winter wrote: > > The branch main has been updated by ivy: > > > > URL: https://cgit.=46reeBSD.org/src/commit/=3Fid=3D7ac276298b72982189= ac1a5b17461936dc00163e > > > > commit 7ac276298b72982189ac1a5b17461936dc00163e > > Author: Lexi Winter > > AuthorDate: 2025-08-10 12:57:36 +0000 > > Commit: Lexi Winter > > CommitDate: 2025-08-10 15:36:40 +0000 > > > > Remove Secure RPC DES authentication > > > > =46ollowing the earlier removal of keyserv, none of this functionalit= y > > works since it requires keyserv. > > > > Remove the relevant symbols from libc's Symbol.map. Leave compatibili= ty > > symbols for existing applications, but since the functions don't work= > > without keyserv, stub them out to return an error. > > > > Remove some private symbols that were only used by keyserv; these don= 't > > get compatibility symbols. > > > > Remove the documentation for the old functions. > > > > Remove rpc.ypupdated since it requires DES authentication. > > > > Reviewed by: manu, des, emaste > > Differential Revision: https://reviews.freebsd.org/D50442 > > --- > > Obsolete=46iles.inc =7C 4 + > > include/rpc/auth=5Fdes.h =7C 79 +---- > > lib/libc/rpc/Symbol.map =7C 19 -- > > lib/libc/rpc/auth=5Fdes.c =7C 455 +---------------------------- > > lib/libc/rpc/authdes=5Fprot.c =7C 44 +-- > > lib/libc/rpc/key=5Fcall.c =7C 424 +++------------------------ > > lib/libc/rpc/publickey.5 =7C 40 --- > > lib/libc/rpc/rpc=5Fsecure.3 =7C 177 +----------- > > lib/libc/rpc/rpc=5Fsoc.3 =7C 13 +- > > lib/libc/rpc/rpc=5Fsoc.c =7C 31 +- > > lib/libc/rpc/svc=5Fauth.c =7C 8 - > > lib/libc/rpc/svc=5Fauth=5Fdes.c =7C 460 +----------------------------= - > > lib/librpcsvc/Makefile =7C 2 +- > > lib/librpcsvc/yp=5Fupdate.c =7C 199 ------------- > > libexec/rc/rc.conf =7C 1 - > > libexec/rc/rc.d/Makefile =7C 1 - > > libexec/rc/rc.d/ypupdated =7C 35 --- > > share/man/man5/rc.conf.5 =7C 9 +- > > sys/rpc/auth.h =7C 26 -- > > tools/build/mk/OptionalObsolete=46iles.inc =7C 2 - > > usr.sbin/Makefile =7C 1 - > > usr.sbin/rpc.ypupdated/Makefile =7C 32 --- > > usr.sbin/rpc.ypupdated/Makefile.depend =7C 18 -- > > usr.sbin/rpc.ypupdated/update.c =7C 328 --------------------- > > usr.sbin/rpc.ypupdated/yp=5Fdbdelete.c =7C 68 ----- > > usr.sbin/rpc.ypupdated/yp=5Fdbupdate.c =7C 147 ---------- > > usr.sbin/rpc.ypupdated/ypupdate =7C 32 --- > > usr.sbin/rpc.ypupdated/ypupdated=5Fextern.h =7C 32 --- > > usr.sbin/rpc.ypupdated/ypupdated=5Fmain.c =7C 287 -------------------= > > usr.sbin/rpc.ypupdated/ypupdated=5Fserver.c =7C 227 --------------- > > 30 files changed, 83 insertions(+), 3118 deletions(-) > > > > diff --git a/Obsolete=46iles.inc b/Obsolete=46iles.inc > > index ec324e82f86d..a6662d31829f 100644 > > --- a/Obsolete=46iles.inc > > +++ b/Obsolete=46iles.inc > > =40=40 -51,6 +51,10 =40=40 > > =23 xargs -n1 =7C sort =7C uniq -d; > > =23 done > > > > +=23 20250810: Removal of remaining Secure RPC (DES) bits > > +OLD=5F=46ILES+=3Dusr/sbin/rpc.ypupdated > > +OLD=5F=46ILES+=3Detc/rc.d/ypupdated > > + > > =23 20250808: nvmfd removed from base install > > OLD=5F=46ILES+=3Dusr/sbin/nvmfd > > OLD=5F=46ILES+=3Dusr/share/man/man8/nvmfd.8.gz > > diff --git a/include/rpc/auth=5Fdes.h b/include/rpc/auth=5Fdes.h > > index 0ff43c13139b..1b4943a74b8b 100644 > > --- a/include/rpc/auth=5Fdes.h > > +++ b/include/rpc/auth=5Fdes.h > > =40=40 -33,91 +33,14 =40=40 > > * Copyright (c) 1986 - 1991 by Sun Microsystems, Inc. > > */ > > > > -/* > > - * auth=5Fdes.h, Protocol for DES style authentication for RPC > > - */ > > +/* Note, RPC DES authentication was removed in =46reeBSD 15.0. */ > > > > =23ifndef =5FAUTH=5FDES=5F > > =23define =5FAUTH=5FDES=5F > > > > -/* > > - * There are two kinds of =22names=22: fullnames and nicknames > > - */ > > -enum authdes=5Fnamekind =7B > > - ADN=5F=46ULLNAME, > > - ADN=5FNICKNAME > > -=7D; > > - > > -/* > > - * A fullname contains the network name of the client, > > - * a conversation key and the window > > - */ > > -struct authdes=5Ffullname =7B > > - char *name; /* network name of client, up to MAXNETNAMELEN */ > > - des=5Fblock key; /* conversation key */ > > - u=5Flong window; /* associated window */ > > -=7D; > > - > > - > > -/* > > - * A credential > > - */ > > -struct authdes=5Fcred =7B > > - enum authdes=5Fnamekind adc=5Fnamekind; > > - struct authdes=5Ffullname adc=5Ffullname; > > - u=5Flong adc=5Fnickname; > > -=7D; > > - > > - > > - > > -/* > > - * A des authentication verifier > > - */ > > -struct authdes=5Fverf =7B > > - union =7B > > - struct timeval adv=5Fctime; /* clear time */ > > - des=5Fblock adv=5Fxtime; /* crypt time */ > > - =7D adv=5Ftime=5Fu; > > - u=5Flong adv=5Fint=5Fu; > > -=7D; > > - > > -/* > > - * des authentication verifier: client variety > > - * > > - * adv=5Ftimestamp is the current time. > > - * adv=5Fwinverf is the credential window + 1. > > - * Both are encrypted using the conversation key. > > - */ > > -=23define adv=5Ftimestamp adv=5Ftime=5Fu.adv=5Fctime > > -=23define adv=5Fxtimestamp adv=5Ftime=5Fu.adv=5Fxtime > > -=23define adv=5Fwinverf adv=5Fint=5Fu > > - > > -/* > > - * des authentication verifier: server variety > > - * > > - * adv=5Ftimeverf is the client's timestamp + client's window > > - * adv=5Fnickname is the server's nickname for the client. > > - * adv=5Ftimeverf is encrypted using the conversation key. > > - */ > > -=23define adv=5Ftimeverf adv=5Ftime=5Fu.adv=5Fctime > > -=23define adv=5Fxtimeverf adv=5Ftime=5Fu.adv=5Fxtime > > -=23define adv=5Fnickname adv=5Fint=5Fu > > - > > -/* > > - * Map a des credential into a unix cred. > > - * > > - */ > > -=5F=5FBEGIN=5FDECLS > > -extern int authdes=5Fgetucred( struct authdes=5Fcred *, uid=5Ft *, g= id=5Ft *, int *, gid=5Ft * ); > > -=5F=5FEND=5FDECLS > > - > > =5F=5FBEGIN=5FDECLS > > -extern bool=5Ft xdr=5Fauthdes=5Fcred(XDR *, struct authdes=5Fcred *)= ; > > -extern bool=5Ft xdr=5Fauthdes=5Fverf(XDR *, struct authdes=5Fverf *)= ; > > extern int rtime(dev=5Ft, struct netbuf *, int, struct timeval *, > > struct timeval *); > > -extern void kgetnetname(char *); > > -extern enum auth=5Fstat =5Fsvcauth=5Fdes(struct svc=5Freq *, struct = rpc=5Fmsg *); > > =5F=5FEND=5FDECLS > > > > =23endif /* ndef =5FAUTH=5FDES=5F */ > > diff --git a/lib/libc/rpc/Symbol.map b/lib/libc/rpc/Symbol.map > > index 105d6fb6b54e..61e8e084b1e0 100644 > > --- a/lib/libc/rpc/Symbol.map > > +++ b/lib/libc/rpc/Symbol.map > > =40=40 -8,13 +8,9 =40=40 =46BSD=5F1.0 =7B > > xdr=5Fdesargs; > > xdr=5Fdesresp; > > > > - authdes=5Fseccreate; > > - authdes=5Fpk=5Fseccreate; > > authnone=5Fcreate; > > authunix=5Fcreate; > > authunix=5Fcreate=5Fdefault; > > - xdr=5Fauthdes=5Fcred; > > - xdr=5Fauthdes=5Fverf; > > xdr=5Fauthunix=5Fparms; > > bindresvport; > > bindresvport=5Fsa; > > =40=40 -58,15 +54,6 =40=40 =46BSD=5F1.0 =7B > > endrpcent; > > getrpcent; > > getrpcport; > > - key=5Fsetsecret; > > - key=5Fsecretkey=5Fis=5Fset; > > - key=5Fencryptsession=5Fpk; > > - key=5Fdecryptsession=5Fpk; > > - key=5Fencryptsession; > > - key=5Fdecryptsession; > > - key=5Fgendes; > > - key=5Fsetnet; > > - key=5Fget=5Fconv; > > xdr=5Fkeystatus; > > xdr=5Fkeybuf; > > xdr=5Fnetnamestr; > > =40=40 -130,7 +117,6 =40=40 =46BSD=5F1.0 =7B > > callrpc; > > registerrpc; > > clnt=5Fbroadcast; > > - authdes=5Fcreate; > > clntunix=5Fcreate; > > svcunix=5Fcreate; > > svcunixfd=5Fcreate; > > =40=40 -180,8 +166,6 =40=40 =46BSD=5F1.0 =7B > > =5Fauthenticate; > > =5Fsvcauth=5Fnull; > > svc=5Fauth=5Freg; > > - =5Fsvcauth=5Fdes; > > - authdes=5Fgetucred; > > =5Fsvcauth=5Funix; > > =5Fsvcauth=5Fshort; > > svc=5Fdg=5Fcreate; > > =40=40 -205,9 +189,6 =40=40 =46BSD=5F1.8 =7B > > > > =46BSDprivate=5F1.0 =7B > > =5F=5Fdes=5Fcrypt=5FLOCAL; > > - =5F=5Fkey=5Fencryptsession=5Fpk=5FLOCAL; > > - =5F=5Fkey=5Fdecryptsession=5Fpk=5FLOCAL; > > - =5F=5Fkey=5Fgendes=5FLOCAL; > > =5F=5Fsvc=5Fclean=5Fidle; > > =5F=5Frpc=5Fgss=5Funwrap; > > =5F=5Frpc=5Fgss=5Funwrap=5Fstub; > > diff --git a/lib/libc/rpc/auth=5Fdes.c b/lib/libc/rpc/auth=5Fdes.c > > index c9b20de25cda..754d55cbed3e 100644 > > --- a/lib/libc/rpc/auth=5Fdes.c > > +++ b/lib/libc/rpc/auth=5Fdes.c > > =40=40 -30,463 +30,34 =40=40 > > /* > > * Copyright (c) 1988 by Sun Microsystems, Inc. > > */ > > + > > /* > > - * auth=5Fdes.c, client-side implementation of DES authentication > > + * Secure RPC DES authentication was removed in =46reeBSD 15.0. > > + * These symbols are provided for backward compatibility, but provid= e no > > + * functionality and will always return an error. > > */ > > > > =23include =22namespace.h=22 > > =23include =22reentrant.h=22 > > -=23include > > -=23include > > -=23include > > -=23include > > -=23include > > -=23include > > -=23include > > =23include > > =23include > > =23include > > -=23include > > -=23include > > -=23include > > -=23undef NIS > > =23include > > =23include =22un-namespace.h=22 > > -=23include =22mt=5Fmisc.h=22 > > - > > -=23define USEC=5FPER=5FSEC 1000000 > > -=23define RTIME=5FTIMEOUT 5 /* seconds to wait for sync */ > > - > > -=23define AUTH=5FPRIVATE(auth) (struct ad=5Fprivate *) auth->ah=5Fpr= ivate > > -=23define ALLOC(object=5Ftype) (object=5Ftype *) mem=5Falloc(sizeof(= object=5Ftype)) > > -=23define =46REE(ptr, size) mem=5Ffree((char *)(ptr), (int) size) > > -=23define ATTEMPT(xdr=5Fop) if (=21(xdr=5Fop)) return (=46ALSE) > > - > > -extern bool=5Ft xdr=5Fauthdes=5Fcred( XDR *, struct authdes=5Fcred *= ); > > -extern bool=5Ft xdr=5Fauthdes=5Fverf( XDR *, struct authdes=5Fverf *= ); > > -extern int key=5Fencryptsession=5Fpk(char *, netobj *, des=5Fblock *= ); > > - > > -extern bool=5Ft =5F=5Frpc=5Fget=5Ftime=5Foffset(struct timeval *, ni= s=5Fserver *, char *, > > - char **, char **); > > > > -/* > > - * DES authenticator operations vector > > - */ > > -static void authdes=5Fnextverf(AUTH *); > > -static bool=5Ft authdes=5Fmarshal(AUTH *, XDR *); > > -static bool=5Ft authdes=5Fvalidate(AUTH *, struct opaque=5Fauth *); > > -static bool=5Ft authdes=5Frefresh(AUTH *, void *); > > -static void authdes=5Fdestroy(AUTH *); > > - > > -static struct auth=5Fops *authdes=5Fops(void); > > - > > -/* > > - * This struct is pointed to by the ah=5Fprivate field of an =22AUTH= *=22 > > - */ > > -struct ad=5Fprivate =7B > > - char *ad=5Ffullname; /* client's full name */ > > - u=5Fint ad=5Ffullnamelen; /* length of name, rounded up */ > > - char *ad=5Fservername; /* server's full name */ > > - u=5Fint ad=5Fservernamelen; /* length of name, rounded up */ > > - u=5Fint ad=5Fwindow; /* client specified window */ > > - bool=5Ft ad=5Fdosync; /* synchronize=3F */ > > - struct netbuf ad=5Fsyncaddr; /* remote host to synch with */ > > - char *ad=5Ftimehost; /* remote host to synch with */ > > - struct timeval ad=5Ftimediff; /* server's time - client's time */ > > - u=5Fint ad=5Fnickname; /* server's nickname for client */ > > - struct authdes=5Fcred ad=5Fcred; /* storage for credential */ > > - struct authdes=5Fverf ad=5Fverf; /* storage for verifier */ > > - struct timeval ad=5Ftimestamp; /* timestamp sent */ > > - des=5Fblock ad=5Fxkey; /* encrypted conversation key */ > > - u=5Fchar ad=5Fpkey=5B1024=5D; /* Server's actual public key */ > > - char *ad=5Fnetid; /* Timehost netid */ > > - char *ad=5Fuaddr; /* Timehost uaddr */ > > - nis=5Fserver *ad=5Fnis=5Fsrvr; /* NIS+ server struct */ > > -=7D; > > - > > -AUTH *authdes=5Fpk=5Fseccreate(const char *, netobj *, u=5Fint, cons= t char *, > > - const des=5Fblock *, nis=5Fserver *); > > - > > -/* > > - * documented version of authdes=5Fseccreate > > - */ > > -/* > > - servername: network name of server > > - win: time to live > > - timehost: optional hostname to sync with > > - ckey: optional conversation key to use > > -*/ > > - > > -AUTH * > > -authdes=5Fseccreate(const char *servername, const u=5Fint win, > > +static AUTH * > > +=5F=5Fauthdes=5Fseccreate(const char *servername, const u=5Fint win,= > > const char *timehost, const des=5Fblock *ckey) > > =7B > > - u=5Fchar pkey=5Fdata=5B1024=5D; > > - netobj pkey; > > - AUTH *dummy; > > - > > - if (=21 getpublickey(servername, (char *) pkey=5Fdata)) =7B > > - syslog(LOG=5FERR, > > - =22authdes=5Fseccreate: no public key found for %s=22, > > - servername); > > - return (NULL); > > - =7D > > - > > - pkey.n=5Fbytes =3D (char *) pkey=5Fdata; > > - pkey.n=5Flen =3D (u=5Fint)strlen((char *)pkey=5Fdata) + 1; > > - dummy =3D authdes=5Fpk=5Fseccreate(servername, &pkey, win, timehost= , > > - ckey, NULL); > > - return (dummy); > > -=7D > > - > > -/* > > - * Slightly modified version of authdessec=5Fcreate which takes the = public key > > - * of the server principal as an argument. This spares us a call to > > - * getpublickey() which in the nameserver context can cause a deadlo= ck. > > - */ > > -AUTH * > > -authdes=5Fpk=5Fseccreate(const char *servername, netobj *pkey, u=5Fi= nt window, > > - const char *timehost, const des=5Fblock *ckey, nis=5Fserver *srvr) > > -=7B > > - AUTH *auth; > > - struct ad=5Fprivate *ad; > > - char namebuf=5BMAXNETNAMELEN+1=5D; > > - > > - /* > > - * Allocate everything now > > - */ > > - auth =3D ALLOC(AUTH); > > - if (auth =3D=3D NULL) =7B > > - syslog(LOG=5FERR, =22authdes=5Fpk=5Fseccreate: out of memory=22); > > - return (NULL); > > - =7D > > - ad =3D ALLOC(struct ad=5Fprivate); > > - if (ad =3D=3D NULL) =7B > > - syslog(LOG=5FERR, =22authdes=5Fpk=5Fseccreate: out of memory=22); > > - goto failed; > > - =7D > > - ad->ad=5Ffullname =3D ad->ad=5Fservername =3D NULL; /* Sanity reaso= ns */ > > - ad->ad=5Ftimehost =3D NULL; > > - ad->ad=5Fnetid =3D NULL; > > - ad->ad=5Fuaddr =3D NULL; > > - ad->ad=5Fnis=5Fsrvr =3D NULL; > > - ad->ad=5Ftimediff.tv=5Fsec =3D 0; > > - ad->ad=5Ftimediff.tv=5Fusec =3D 0; > > - memcpy(ad->ad=5Fpkey, pkey->n=5Fbytes, pkey->n=5Flen); > > - if (=21getnetname(namebuf)) > > - goto failed; > > - ad->ad=5Ffullnamelen =3D RNDUP((u=5Fint) strlen(namebuf)); > > - ad->ad=5Ffullname =3D (char *)mem=5Falloc(ad->ad=5Ffullnamelen + 1)= ; > > - ad->ad=5Fservernamelen =3D strlen(servername); > > - ad->ad=5Fservername =3D (char *)mem=5Falloc(ad->ad=5Fservernamelen = + 1); > > - > > - if (ad->ad=5Ffullname =3D=3D NULL =7C=7C ad->ad=5Fservername =3D=3D= NULL) =7B > > - syslog(LOG=5FERR, =22authdes=5Fseccreate: out of memory=22); > > - goto failed; > > - =7D > > - if (timehost =21=3D NULL) =7B > > - ad->ad=5Ftimehost =3D (char *)mem=5Falloc(strlen(timehost) + 1); > > - if (ad->ad=5Ftimehost =3D=3D NULL) =7B > > - syslog(LOG=5FERR, =22authdes=5Fseccreate: out of memory=22); > > - goto failed; > > - =7D > > - memcpy(ad->ad=5Ftimehost, timehost, strlen(timehost) + 1); > > - ad->ad=5Fdosync =3D TRUE; > > - =7D else if (srvr =21=3D NULL) =7B > > - ad->ad=5Fnis=5Fsrvr =3D srvr; /* transient */ > > - ad->ad=5Fdosync =3D TRUE; > > - =7D else =7B > > - ad->ad=5Fdosync =3D =46ALSE; > > - =7D > > - memcpy(ad->ad=5Ffullname, namebuf, ad->ad=5Ffullnamelen + 1); > > - memcpy(ad->ad=5Fservername, servername, ad->ad=5Fservernamelen + 1)= ; > > - ad->ad=5Fwindow =3D window; > > - if (ckey =3D=3D NULL) =7B > > - if (key=5Fgendes(&auth->ah=5Fkey) < 0) =7B > > - syslog(LOG=5FERR, > > - =22authdes=5Fseccreate: keyserv(1m) is unable to generate session k= ey=22); > > - goto failed; > > - =7D > > - =7D else =7B > > - auth->ah=5Fkey =3D *ckey; > > - =7D > > - > > - /* > > - * Set up auth handle > > - */ > > - auth->ah=5Fcred.oa=5Fflavor =3D AUTH=5FDES; > > - auth->ah=5Fverf.oa=5Fflavor =3D AUTH=5FDES; > > - auth->ah=5Fops =3D authdes=5Fops(); > > - auth->ah=5Fprivate =3D (caddr=5Ft)ad; > > - > > - if (=21authdes=5Frefresh(auth, NULL)) =7B > > - goto failed; > > - =7D > > - ad->ad=5Fnis=5Fsrvr =3D NULL; /* not needed any longer */ > > - return (auth); > > - > > -failed: > > - if (auth) > > - =46REE(auth, sizeof (AUTH)); > > - if (ad) =7B > > - if (ad->ad=5Ffullname) > > - =46REE(ad->ad=5Ffullname, ad->ad=5Ffullnamelen + 1); > > - if (ad->ad=5Fservername) > > - =46REE(ad->ad=5Fservername, ad->ad=5Fservernamelen + 1); > > - if (ad->ad=5Ftimehost) > > - =46REE(ad->ad=5Ftimehost, strlen(ad->ad=5Ftimehost) + 1); > > - if (ad->ad=5Fnetid) > > - =46REE(ad->ad=5Fnetid, strlen(ad->ad=5Fnetid) + 1); > > - if (ad->ad=5Fuaddr) > > - =46REE(ad->ad=5Fuaddr, strlen(ad->ad=5Fuaddr) + 1); > > - =46REE(ad, sizeof (struct ad=5Fprivate)); > > - =7D > > return (NULL); > > =7D > > +=5F=5Fsym=5Fcompat(authdes=5Fseccreate, =5F=5Fauthdes=5Fseccreate, =46= BSD=5F1.0); > > > > -/* > > - * Implement the five authentication operations > > - */ > > - > > - > > -/* > > - * 1. Next Verifier > > - */ > > -/*ARGSUSED*/ > > -static void > > -authdes=5Fnextverf(AUTH *auth =5F=5Funused) > > +static AUTH * > > +=5F=5Fauthdes=5Fpk=5Fseccreate(const char *servername =5F=5Funused, = netobj *pkey =5F=5Funused, > > + u=5Fint window =5F=5Funused, const char *timehost =5F=5Funused, > > + const des=5Fblock *ckey =5F=5Funused, nis=5Fserver *srvr =5F=5Funus= ed) > > =7B > > - /* what the heck am I supposed to do=3F=3F=3F */ > > -=7D > > - > > - > > -/* > > - * 2. Marshal > > - */ > > -static bool=5Ft > > -authdes=5Fmarshal(AUTH *auth, XDR *xdrs) > > -=7B > > -/* LINTED pointer alignment */ > > - struct ad=5Fprivate *ad =3D AUTH=5FPRIVATE(auth); > > - struct authdes=5Fcred *cred =3D &ad->ad=5Fcred; > > - struct authdes=5Fverf *verf =3D &ad->ad=5Fverf; > > - des=5Fblock cryptbuf=5B2=5D; > > - des=5Fblock ivec; > > - int status; > > - int len; > > - rpc=5Finline=5Ft *ixdr; > > - > > - /* > > - * =46igure out the =22time=22, accounting for any time difference > > - * with the server if necessary. > > - */ > > - (void)gettimeofday(&ad->ad=5Ftimestamp, NULL); > > - ad->ad=5Ftimestamp.tv=5Fsec +=3D ad->ad=5Ftimediff.tv=5Fsec; > > - ad->ad=5Ftimestamp.tv=5Fusec +=3D ad->ad=5Ftimediff.tv=5Fusec; > > - while (ad->ad=5Ftimestamp.tv=5Fusec >=3D USEC=5FPER=5FSEC) =7B > > - ad->ad=5Ftimestamp.tv=5Fusec -=3D USEC=5FPER=5FSEC; > > - ad->ad=5Ftimestamp.tv=5Fsec++; > > - =7D > > - > > - /* > > - * XDR the timestamp and possibly some other things, then > > - * encrypt them. > > - */ > > - ixdr =3D (rpc=5Finline=5Ft *)cryptbuf; > > - IXDR=5FPUT=5FINT32(ixdr, ad->ad=5Ftimestamp.tv=5Fsec); > > - IXDR=5FPUT=5FINT32(ixdr, ad->ad=5Ftimestamp.tv=5Fusec); > > - if (ad->ad=5Fcred.adc=5Fnamekind =3D=3D ADN=5F=46ULLNAME) =7B > > - IXDR=5FPUT=5FU=5FINT32(ixdr, ad->ad=5Fwindow); > > - IXDR=5FPUT=5FU=5FINT32(ixdr, ad->ad=5Fwindow - 1); > > - ivec.key.high =3D ivec.key.low =3D 0; > > - status =3D cbc=5Fcrypt((char *)&auth->ah=5Fkey, (char *)cryptbuf, > > - (u=5Fint) 2 * sizeof (des=5Fblock), > > - DES=5FENCRYPT =7C DES=5FHW, (char *)&ivec); > > - =7D else =7B > > - status =3D ecb=5Fcrypt((char *)&auth->ah=5Fkey, (char *)cryptbuf, > > - (u=5Fint) sizeof (des=5Fblock), > > - DES=5FENCRYPT =7C DES=5FHW); > > - =7D > > - if (DES=5F=46AILED(status)) =7B > > - syslog(LOG=5FERR, =22authdes=5Fmarshal: DES encryption failure=22);= > > - return (=46ALSE); > > - =7D > > - ad->ad=5Fverf.adv=5Fxtimestamp =3D cryptbuf=5B0=5D; > > - if (ad->ad=5Fcred.adc=5Fnamekind =3D=3D ADN=5F=46ULLNAME) =7B > > - ad->ad=5Fcred.adc=5Ffullname.window =3D cryptbuf=5B1=5D.key.high; > > - ad->ad=5Fverf.adv=5Fwinverf =3D cryptbuf=5B1=5D.key.low; > > - =7D else =7B > > - ad->ad=5Fcred.adc=5Fnickname =3D ad->ad=5Fnickname; > > - ad->ad=5Fverf.adv=5Fwinverf =3D 0; > > - =7D > > - > > - /* > > - * Serialize the credential and verifier into opaque > > - * authentication data. > > - */ > > - if (ad->ad=5Fcred.adc=5Fnamekind =3D=3D ADN=5F=46ULLNAME) =7B > > - len =3D ((1 + 1 + 2 + 1)*BYTES=5FPER=5FXDR=5FUNIT + ad->ad=5Ffullna= melen); > > - =7D else =7B > > - len =3D (1 + 1)*BYTES=5FPER=5FXDR=5FUNIT; > > - =7D > > - > > - if ((ixdr =3D xdr=5Finline(xdrs, 2*BYTES=5FPER=5FXDR=5FUNIT))) =7B > > - IXDR=5FPUT=5FINT32(ixdr, AUTH=5FDES); > > - IXDR=5FPUT=5FINT32(ixdr, len); > > - =7D else =7B > > - ATTEMPT(xdr=5Fputint32(xdrs, (int *)&auth->ah=5Fcred.oa=5Fflavor));= > > - ATTEMPT(xdr=5Fputint32(xdrs, &len)); > > - =7D > > - ATTEMPT(xdr=5Fauthdes=5Fcred(xdrs, cred)); > > - > > - len =3D (2 + 1)*BYTES=5FPER=5FXDR=5FUNIT; > > - if ((ixdr =3D xdr=5Finline(xdrs, 2*BYTES=5FPER=5FXDR=5FUNIT))) =7B > > - IXDR=5FPUT=5FINT32(ixdr, AUTH=5FDES); > > - IXDR=5FPUT=5FINT32(ixdr, len); > > - =7D else =7B > > - ATTEMPT(xdr=5Fputint32(xdrs, (int *)&auth->ah=5Fverf.oa=5Fflavor));= > > - ATTEMPT(xdr=5Fputint32(xdrs, &len)); > > - =7D > > - ATTEMPT(xdr=5Fauthdes=5Fverf(xdrs, verf)); > > - return (TRUE); > > -=7D > > - > > - > > -/* > > - * 3. Validate > > - */ > > -static bool=5Ft > > -authdes=5Fvalidate(AUTH *auth, struct opaque=5Fauth *rverf) > > -=7B > > -/* LINTED pointer alignment */ > > - struct ad=5Fprivate *ad =3D AUTH=5FPRIVATE(auth); > > - struct authdes=5Fverf verf; > > - int status; > > - uint32=5Ft *ixdr; > > - des=5Fblock buf; > > - > > - if (rverf->oa=5Flength =21=3D (2 + 1) * BYTES=5FPER=5FXDR=5FUNIT) =7B= > > - return (=46ALSE); > > - =7D > > -/* LINTED pointer alignment */ > > - ixdr =3D (uint32=5Ft *)rverf->oa=5Fbase; > > - buf.key.high =3D (uint32=5Ft)*ixdr++; > > - buf.key.low =3D (uint32=5Ft)*ixdr++; > > - verf.adv=5Fint=5Fu =3D (uint32=5Ft)*ixdr++; > > - > > - /* > > - * Decrypt the timestamp > > - */ > > - status =3D ecb=5Fcrypt((char *)&auth->ah=5Fkey, (char *)&buf, > > - (u=5Fint)sizeof (des=5Fblock), DES=5FDECRYPT =7C DES=5FHW); > > - > > - if (DES=5F=46AILED(status)) =7B > > - syslog(LOG=5FERR, =22authdes=5Fvalidate: DES decryption failure=22)= ; > > - return (=46ALSE); > > - =7D > > - > > - /* > > - * xdr the decrypted timestamp > > - */ > > -/* LINTED pointer alignment */ > > - ixdr =3D (uint32=5Ft *)buf.c; > > - verf.adv=5Ftimestamp.tv=5Fsec =3D IXDR=5FGET=5FINT32(ixdr) + 1; > > - verf.adv=5Ftimestamp.tv=5Fusec =3D IXDR=5FGET=5FINT32(ixdr); > > - > > - /* > > - * validate > > - */ > > - if (bcmp((char *)&ad->ad=5Ftimestamp, (char *)&verf.adv=5Ftimestamp= , > > - sizeof(struct timeval)) =21=3D 0) =7B > > - syslog(LOG=5FDEBUG, =22authdes=5Fvalidate: verifier mismatch=22); > > - return (=46ALSE); > > - =7D > > - > > - /* > > - * We have a nickname now, let's use it > > - */ > > - ad->ad=5Fnickname =3D verf.adv=5Fnickname; > > - ad->ad=5Fcred.adc=5Fnamekind =3D ADN=5FNICKNAME; > > - return (TRUE); > > -=7D > > - > > -/* > > - * 4. Refresh > > - */ > > -/*ARGSUSED*/ > > -static bool=5Ft > > -authdes=5Frefresh(AUTH *auth, void *dummy =5F=5Funused) > > -=7B > > -/* LINTED pointer alignment */ > > - struct ad=5Fprivate *ad =3D AUTH=5FPRIVATE(auth); > > - struct authdes=5Fcred *cred =3D &ad->ad=5Fcred; > > - int ok; > > - netobj pkey; > > - > > - if (ad->ad=5Fdosync) =7B > > - ok =3D =5F=5Frpc=5Fget=5Ftime=5Foffset(&ad->ad=5Ftimediff, ad->ad=5F= nis=5Fsrvr, > > - ad->ad=5Ftimehost, &(ad->ad=5Fuaddr), > > - &(ad->ad=5Fnetid)); > > - if (=21 ok) =7B > > - /* > > - * Hope the clocks are synced=21 > > - */ > > - ad->ad=5Fdosync =3D 0; > > - syslog(LOG=5FDEBUG, > > - =22authdes=5Frefresh: unable to synchronize clock=22); > > - =7D > > - =7D > > - ad->ad=5Fxkey =3D auth->ah=5Fkey; > > - pkey.n=5Fbytes =3D (char *)(ad->ad=5Fpkey); > > - pkey.n=5Flen =3D (u=5Fint)strlen((char *)ad->ad=5Fpkey) + 1; > > - if (key=5Fencryptsession=5Fpk(ad->ad=5Fservername, &pkey, &ad->ad=5F= xkey) < 0) =7B > > - syslog(LOG=5FIN=46O, > > - =22authdes=5Frefresh: keyserv(1m) is unable to encrypt session key=22= ); > > - return (=46ALSE); > > - =7D > > - cred->adc=5Ffullname.key =3D ad->ad=5Fxkey; > > - cred->adc=5Fnamekind =3D ADN=5F=46ULLNAME; > > - cred->adc=5Ffullname.name =3D ad->ad=5Ffullname; > > - return (TRUE); > > -=7D > > - > > - > > -/* > > - * 5. Destroy > > - */ > > -static void > > -authdes=5Fdestroy(AUTH *auth) > > -=7B > > -/* LINTED pointer alignment */ > > - struct ad=5Fprivate *ad =3D AUTH=5FPRIVATE(auth); > > - > > - =46REE(ad->ad=5Ffullname, ad->ad=5Ffullnamelen + 1); > > - =46REE(ad->ad=5Fservername, ad->ad=5Fservernamelen + 1); > > - if (ad->ad=5Ftimehost) > > - =46REE(ad->ad=5Ftimehost, strlen(ad->ad=5Ftimehost) + 1); > > - if (ad->ad=5Fnetid) > > - =46REE(ad->ad=5Fnetid, strlen(ad->ad=5Fnetid) + 1); > > - if (ad->ad=5Fuaddr) > > - =46REE(ad->ad=5Fuaddr, strlen(ad->ad=5Fuaddr) + 1); > > - =46REE(ad, sizeof (struct ad=5Fprivate)); > > - =46REE(auth, sizeof(AUTH)); > > -=7D > > - > > -static struct auth=5Fops * > > -authdes=5Fops(void) > > -=7B > > - static struct auth=5Fops ops; > > - > > - /* VARIABLES PROTECTED BY ops=5Flock: ops */ > > - > > - mutex=5Flock(&authdes=5Fops=5Flock); > > - if (ops.ah=5Fnextverf =3D=3D NULL) =7B > > - ops.ah=5Fnextverf =3D authdes=5Fnextverf; > > - ops.ah=5Fmarshal =3D authdes=5Fmarshal; > > - ops.ah=5Fvalidate =3D authdes=5Fvalidate; > > - ops.ah=5Frefresh =3D authdes=5Frefresh; > > - ops.ah=5Fdestroy =3D authdes=5Fdestroy; > > - =7D > > - mutex=5Funlock(&authdes=5Fops=5Flock); > > - return (&ops); > > + return (NULL); > > =7D > > +=5F=5Fsym=5Fcompat(authdes=5Fpk=5Fseccreate, =5F=5Fauthdes=5Fpk=5Fse= ccreate, =46BSD=5F1.0); > > diff --git a/lib/libc/rpc/authdes=5Fprot.c b/lib/libc/rpc/authdes=5Fp= rot.c > > index 79a0e5baa084..56b44daafe41 100644 > > --- a/lib/libc/rpc/authdes=5Fprot.c > > +++ b/lib/libc/rpc/authdes=5Fprot.c > > =40=40 -42,44 +42,16 =40=40 > > =23include > > =23include =22un-namespace.h=22 > > > > -=23define ATTEMPT(xdr=5Fop) if (=21(xdr=5Fop)) return (=46ALSE) > > - > > -bool=5Ft > > -xdr=5Fauthdes=5Fcred(XDR *xdrs, struct authdes=5Fcred *cred) > > +static bool=5Ft > > +=5F=5Fxdr=5Fauthdes=5Fcred(XDR *xdrs, void *cred) > > =7B > > - enum authdes=5Fnamekind *padc=5Fnamekind =3D &cred->adc=5Fnamekind;= > > - /* > > - * Unrolled xdr > > - */ > > - ATTEMPT(xdr=5Fenum(xdrs, (enum=5Ft *) padc=5Fnamekind)); > > - switch (cred->adc=5Fnamekind) =7B > > - case ADN=5F=46ULLNAME: > > - ATTEMPT(xdr=5Fstring(xdrs, &cred->adc=5Ffullname.name, > > - MAXNETNAMELEN)); > > - ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&cred->adc=5Ffullname.key, > > - sizeof(des=5Fblock))); > > - ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&cred->adc=5Ffullname.window,= > > - sizeof(cred->adc=5Ffullname.window))); > > - return (TRUE); > > - case ADN=5FNICKNAME: > > - ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&cred->adc=5Fnickname, > > - sizeof(cred->adc=5Fnickname))); > > - return (TRUE); > > - default: > > - return (=46ALSE); > > - =7D > > + return (=46ALSE); > > =7D > > +=5F=5Fsym=5Fcompat(xdr=5Fauthdes=5Fcred, =5F=5Fxdr=5Fauthdes=5Fcred,= =46BSD=5F1.0); > > > > - > > -bool=5Ft > > -xdr=5Fauthdes=5Fverf(XDR *xdrs, struct authdes=5Fverf *verf) > > +static bool=5Ft > > +=5F=5Fxdr=5Fauthdes=5Fverf(XDR *xdrs, void *verf) > > =7B > > - /* > > - * Unrolled xdr > > - */ > > - ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&verf->adv=5Fxtimestamp, > > - sizeof(des=5Fblock))); > > - ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&verf->adv=5Fint=5Fu, > > - sizeof(verf->adv=5Fint=5Fu))); > > - return (TRUE); > > + return (=46ALSE); > > =7D > > +=5F=5Fsym=5Fcompat(xdr=5Fauthdes=5Fverf, =5F=5Fxdr=5Fauthdes=5Fverf,= =46BSD=5F1.0); > > diff --git a/lib/libc/rpc/key=5Fcall.c b/lib/libc/rpc/key=5Fcall.c > > index 5c87881c815c..eb274fcfff36 100644 > > --- a/lib/libc/rpc/key=5Fcall.c > > +++ b/lib/libc/rpc/key=5Fcall.c > > =40=40 -32,426 +32,78 =40=40 > > */ > > > > /* > > - * key=5Fcall.c, Interface to keyserver > > - * > > - * setsecretkey(key) - set your secret key > > - * encryptsessionkey(agent, deskey) - encrypt a session key to talk = to agent > > - * decryptsessionkey(agent, deskey) - decrypt ditto > > - * gendeskey(deskey) - generate a secure des key > > + * Secure RPC keyserver support was removed in =46reeBSD 15.0. > > + * These symbols are provided for backward compatibility, but provid= e no > > + * functionality and will always return an error. > > */ > > > > =23include =22namespace.h=22 > > =23include =22reentrant.h=22 > > -=23include > > -=23include > > -=23include > > -=23include > > =23include > > -=23include > > -=23include > > =23include > > -=23include > > -=23include > > -=23include > > -=23include > > -=23include > > -=23include > > -=23include > > +=23include > > =23include =22un-namespace.h=22 > > =23include =22mt=5Fmisc.h=22 > > > > - > > -=23define KEY=5FTIMEOUT 5 /* per-try timeout in seconds */ > > -=23define KEY=5FNRETRY 12 /* number of retries */ > > - > > -=23ifdef DEBUG > > -=23define debug(msg) (void) fprintf(stderr, =22%s=5Cn=22, msg); > > -=23else > > -=23define debug(msg) > > -=23endif /* DEBUG */ > > - > > -/* > > - * Hack to allow the keyserver to use AUTH=5FDES (for authenticated > > - * NIS+ calls, for example). The only functions that get called > > - * are key=5Fencryptsession=5Fpk, key=5Fdecryptsession=5Fpk, and key= =5Fgendes. > > - * > > - * The approach is to have the keyserver fill in pointers to local > > - * implementations of these functions, and to call those in key=5Fca= ll(). > > - */ > > - > > -cryptkeyres *(*=5F=5Fkey=5Fencryptsession=5Fpk=5FLOCAL)(uid=5Ft, voi= d *arg) =3D 0; > > -cryptkeyres *(*=5F=5Fkey=5Fdecryptsession=5Fpk=5FLOCAL)(uid=5Ft, voi= d *arg) =3D 0; > > -des=5Fblock *(*=5F=5Fkey=5Fgendes=5FLOCAL)(uid=5Ft, void *) =3D 0; > > - > > -static int key=5Fcall( u=5Flong, xdrproc=5Ft, void *, xdrproc=5Ft, v= oid *); > > - > > -int > > -key=5Fsetsecret(const char *secretkey) > > -=7B > > - keystatus status; > > - > > - if (=21key=5Fcall((u=5Flong) KEY=5FSET, (xdrproc=5Ft)xdr=5Fkeybuf, > > - (void *)secretkey, > > - (xdrproc=5Ft)xdr=5Fkeystatus, &status)) =7B > > - return (-1); > > - =7D > > - if (status =21=3D KEY=5FSUCCESS) =7B > > - debug(=22set status is nonzero=22); > > - return (-1); > > - =7D > > - return (0); > > -=7D > > - > > - > > -/* key=5Fsecretkey=5Fis=5Fset() returns 1 if the keyserver has a sec= ret key > > - * stored for the caller's effective uid; it returns 0 otherwise > > - * > > - * N.B.: The KEY=5FNET=5FGET key call is undocumented. Applications = shouldn't > > - * be using it, because it allows them to get the user's secret key.= > > - */ > > - > > -int > > -key=5Fsecretkey=5Fis=5Fset(void) > > -=7B > > - struct key=5Fnetstres kres; > > - > > - memset((void*)&kres, 0, sizeof (kres)); > > - if (key=5Fcall((u=5Flong) KEY=5FNET=5FGET, (xdrproc=5Ft)xdr=5Fvoid,= NULL, > > - (xdrproc=5Ft)xdr=5Fkey=5Fnetstres, &kres) && > > - (kres.status =3D=3D KEY=5FSUCCESS) && > > - (kres.key=5Fnetstres=5Fu.knet.st=5Fpriv=5Fkey=5B0=5D =21=3D 0)) =7B= > > - /* avoid leaving secret key in memory */ > > - memset(kres.key=5Fnetstres=5Fu.knet.st=5Fpriv=5Fkey, 0, HEXKEYBYTES= ); > > - return (1); > > - =7D > > - return (0); > > -=7D > > - > > -int > > -key=5Fencryptsession=5Fpk(char *remotename, netobj *remotekey, des=5F= block *deskey) > > -=7B > > - cryptkeyarg2 arg; > > - cryptkeyres res; > > - > > - arg.remotename =3D remotename; > > - arg.remotekey =3D *remotekey; > > - arg.deskey =3D *deskey; > > - if (=21key=5Fcall((u=5Flong)KEY=5FENCRYPT=5FPK, (xdrproc=5Ft)xdr=5F= cryptkeyarg2, &arg, > > - (xdrproc=5Ft)xdr=5Fcryptkeyres, &res)) =7B > > - return (-1); > > - =7D > > - if (res.status =21=3D KEY=5FSUCCESS) =7B > > - debug(=22encrypt status is nonzero=22); > > - return (-1); > > - =7D > > - *deskey =3D res.cryptkeyres=5Fu.deskey; > > - return (0); > > -=7D > > - > > -int > > -key=5Fdecryptsession=5Fpk(char *remotename, netobj *remotekey, des=5F= block *deskey) > > -=7B > > - cryptkeyarg2 arg; > > - cryptkeyres res; > > - > > - arg.remotename =3D remotename; > > - arg.remotekey =3D *remotekey; > > - arg.deskey =3D *deskey; > > - if (=21key=5Fcall((u=5Flong)KEY=5FDECRYPT=5FPK, (xdrproc=5Ft)xdr=5F= cryptkeyarg2, &arg, > > - (xdrproc=5Ft)xdr=5Fcryptkeyres, &res)) =7B > > - return (-1); > > - =7D > > - if (res.status =21=3D KEY=5FSUCCESS) =7B > > - debug(=22decrypt status is nonzero=22); > > - return (-1); > > - =7D > > - *deskey =3D res.cryptkeyres=5Fu.deskey; > > - return (0); > > -=7D > > - > > -int > > -key=5Fencryptsession(const char *remotename, des=5Fblock *deskey) > > +static int > > +=5F=5Fkey=5Fsetsecret(const char *secretkey) > > =7B > > - cryptkeyarg arg; > > - cryptkeyres res; > > - > > - arg.remotename =3D (char *) remotename; > > - arg.deskey =3D *deskey; > > - if (=21key=5Fcall((u=5Flong)KEY=5FENCRYPT, (xdrproc=5Ft)xdr=5Fcrypt= keyarg, &arg, > > - (xdrproc=5Ft)xdr=5Fcryptkeyres, &res)) =7B > > - return (-1); > > - =7D > > - if (res.status =21=3D KEY=5FSUCCESS) =7B > > - debug(=22encrypt status is nonzero=22); > > - return (-1); > > - =7D > > - *deskey =3D res.cryptkeyres=5Fu.deskey; > > - return (0); > > + return (-1); > > =7D > > +=5F=5Fsym=5Fcompat(key=5Fsetsecret, =5F=5Fkey=5Fsetsecret, =46BSD=5F= 1.0); > > > > -int > > -key=5Fdecryptsession(const char *remotename, des=5Fblock *deskey) > > +static int > > +=5F=5Fkey=5Fsecretkey=5Fis=5Fset(void) > > =7B > > - cryptkeyarg arg; > > - cryptkeyres res; > > - > > - arg.remotename =3D (char *) remotename; > > - arg.deskey =3D *deskey; > > - if (=21key=5Fcall((u=5Flong)KEY=5FDECRYPT, (xdrproc=5Ft)xdr=5Fcrypt= keyarg, &arg, > > - (xdrproc=5Ft)xdr=5Fcryptkeyres, &res)) =7B > > - return (-1); > > - =7D > > - if (res.status =21=3D KEY=5FSUCCESS) =7B > > - debug(=22decrypt status is nonzero=22); > > - return (-1); > > - =7D > > - *deskey =3D res.cryptkeyres=5Fu.deskey; > > return (0); > > =7D > > +=5F=5Fsym=5Fcompat(key=5Fsecretkey=5Fis=5Fset, =5F=5Fkey=5Fsecretkey= =5Fis=5Fset, =46BSD=5F1.0); > > > > -int > > -key=5Fgendes(des=5Fblock *key) > > +static int > > +=5F=5Fkey=5Fencryptsession=5Fpk(char *remotename, netobj *remotekey,= des=5Fblock *deskey) > > =7B > > - if (=21key=5Fcall((u=5Flong)KEY=5FGEN, (xdrproc=5Ft)xdr=5Fvoid, NUL= L, > > - (xdrproc=5Ft)xdr=5Fdes=5Fblock, key)) =7B > > - return (-1); > > - =7D > > - return (0); > > + return (-1); > > =7D > > +=5F=5Fsym=5Fcompat(key=5Fencryptsession=5Fpk, =5F=5Fkey=5Fencryptses= sion=5Fpk, =46BSD=5F1.0); > > > > -int > > -key=5Fsetnet(struct key=5Fnetstarg *arg) > > +static int > > +=5F=5Fkey=5Fdecryptsession=5Fpk(char *remotename, netobj *remotekey,= des=5Fblock *deskey) > > =7B > > *** 2726 LINES SKIPPED *** > > --689b40a3_2336c6b7_50e Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline <= meta name=3D=22viewport=22 content=3D=22width=3Ddevice-width, initial-sca= le=3D1.0, user-scalable=3Dno=22>
All xservers are affected.=C2=A0

However, upstream already deal with it in commit=C2=A0https://gitlab.freedes= ktop.org/xorg/xserver/-/commit/71b207a2ebc1465c7d9ad9262f60930f6a1d42ee

--
Dima. (desktop, kde, x11, office, ports-secteam)=40=46re= eBSD team
(fluffy=40=46reeBSD.org, https://t.me/=46luffyBSD)

On =D0=B2=D1= =82=D0=BE=D1=80=D0=BD=D0=B8=D0=BA, =D0=B0=D0=B2=D0=B3. 12, 2025 at 1:41 P= M, Dima Panov <fluffy=40= =46reeBSD.org> wrote:
Hello=21

This commit breaks x11-serve= r/xwayland

=46AILED: os/liblibxserver=5Fos.a.p/r= pcauth.c.o =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 cc -Ios/liblibxserver=5Fos.a.p -Ios -I../os -I. -I.= . -IXext -I../Xext -IXi -I../Xi -Icomposite -I../composite -Idamageext -I= ../damageext -Ifb -I../fb -Iglamor -I../glamor -Imi -I../mi -Imiext/damag= e -I../miext/damage -Imiext/sync -I../miext/sync -Idbe -I../dbe -Idix -I.= ./dix -Idri3 -I../dri3 -Iinclude -I../include -Ipresent -I../present -Ira= ndr -I../randr -Irender -I../render -Ixfixes -I../xfixes -I/usr/local/inc= lude -I/usr/local/include/pixman-1 -I/usr/local/include/freetype2 -I/usr/= local/include/libpng16 -fdiagnostics-color=3Dnever -D=5F=46ILE=5FO=46=46S= ET=5FBITS=3D64 -Wall -Winvalid-pch -std=3Dgnu99 -DHAVE=5FDIX=5FCON=46IG=5F= H -fno-strict-aliasing -fvisibility=3Dhidden -Wall -Wpointer-arith -Wmiss= ing-declarations -Wformat=3D2 -Wstrict-prototypes -Wmissing-prototypes -W= nested-externs -Wbad-function-cast -Wold-style-definition -Wunused -Wunin= itialized -Wshadow -Wmissing-noreturn -Wmissing-format-attribute -Wredund= ant-decls -Werror=3Dimplicit -Werror=3Dnonnull -Werror=3Dinit-self -Werro= r=3Dmain -Werror=3Dmissing-braces -Werror=3Dsequence-point -Werror=3Dretu= rn-type -Werror=3Dtrigraphs -Werror=3Darray-bounds -Werror=3Dwrite-string= s -Werror=3Daddress -Werror=3Dint-to-pointer-cast -Werror=3Dpointer-to-in= t-cast -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -fPIC -D=5F= THREAD=5FSA=46E -D=5FDE=46AULT=5FSOURCE -D=5FBSD=5FSOURCE -DHAS=5F=46CHOW= N -DHAS=5FSTICKY=5FDIR=5FBIT -DCLIENTIDS -MD -MQ os/liblibxserver=5Fos.a.= p/rpcauth.c.o -M=46 os/liblibxserver=5Fos.a.p/rpcauth.c.o.d -o os/liblibx= server=5Fos.a.p/rpcauth.c.o -c ../os/rpcauth.c =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 ../os/rpcauth.c:110:52: error: incomplete de= finition of type 'struct authdes=5Fcred' =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0110= =7C =C2=A0 =C2=A0 return (((struct authdes=5Fcred *) r.rq=5Fclntcred)-&g= t;adc=5Ffullname.name); =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0=7C =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =7E=7E=7E=7E=7E=7E=7E=7E= =7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E=7E= =7E=7E=7E=7E=7E=7E=5E =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0../os/rpcauth.c:110:22: = note: forward declaration of 'struct authdes=5Fcred' =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0110 =7C =C2=A0 =C2=A0 return (((str= uct authdes=5Fcred *) r.rq=5Fclntcred)->adc=5Ffullname.name); =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=7C =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=5E =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01 error generated.

--
=
Dima. (desktop, kde, x11, office, ports-secteam)=40=46reeBSD team
(fluffy=40=46reeBSD.org, https://t.me/=46luffyBSD)

<= blockquote id=3D=22=22>
On =D0=B2=D0=BE=D1=81=D0=BA=D1=80=D0=B5= =D1=81=D0=B5=D0=BD=D1=8C=D0=B5, =D0=B0=D0=B2=D0=B3. 10, 2025 at 6:37 PM, = Lexi Winter <ivy=40=46reeBS= D.org> wrote:
The branch main has been updated by i= vy:

URL: https://cgit.=46reeBSD.org/src/commit/=3Fid=3D7ac276298= b72982189ac1a5b17461936dc00163e

commit 7ac276298b72982189ac1a5b1= 7461936dc00163e
Author: Lexi Winter <ivy=40=46reeBSD.org>
A= uthorDate: 2025-08-10 12:57:36 +0000
Commit: Lexi Winter <ivy=40=46= reeBSD.org>
CommitDate: 2025-08-10 15:36:40 +0000

Remove= Secure RPC DES authentication

=46ollowing the earlier removal = of keyserv, none of this functionality
works since it requires keyse= rv.

Remove the relevant symbols from libc's Symbol.map. Leave c= ompatibility
symbols for existing applications, but since the functi= ons don't work
without keyserv, stub them out to return an error.
Remove some private symbols that were only used by keyserv; these= don't
get compatibility symbols.

Remove the documentation= for the old functions.

Remove rpc.ypupdated since it requires = DES authentication.

Reviewed by: manu, des, emaste
Differe= ntial Revision: https://reviews.freebsd.org/D50442
---
Obsolete=46= iles.inc =7C 4 +
include/rpc/auth=5Fdes.h =7C 79 +----
lib/libc= /rpc/Symbol.map =7C 19 --
lib/libc/rpc/auth=5Fdes.c =7C 455 +-------= ---------------------
lib/libc/rpc/authdes=5Fprot.c =7C 44 +--
= lib/libc/rpc/key=5Fcall.c =7C 424 +++------------------------
lib/li= bc/rpc/publickey.5 =7C 40 ---
lib/libc/rpc/rpc=5Fsecure.3 =7C 177 +-= ----------
lib/libc/rpc/rpc=5Fsoc.3 =7C 13 +-
lib/libc/rpc/rpc=5F= soc.c =7C 31 +-
lib/libc/rpc/svc=5Fauth.c =7C 8 -
lib/libc/rpc/= svc=5Fauth=5Fdes.c =7C 460 +-----------------------------
lib/librpc= svc/Makefile =7C 2 +-
lib/librpcsvc/yp=5Fupdate.c =7C 199 ----------= ---
libexec/rc/rc.conf =7C 1 -
libexec/rc/rc.d/Makefile =7C 1 -=
libexec/rc/rc.d/ypupdated =7C 35 ---
share/man/man5/rc.conf.5 = =7C 9 +-
sys/rpc/auth.h =7C 26 --
tools/build/mk/OptionalObsole= te=46iles.inc =7C 2 -
usr.sbin/Makefile =7C 1 -
usr.sbin/rpc.yp= updated/Makefile =7C 32 ---
usr.sbin/rpc.ypupdated/Makefile.depend =7C= 18 --
usr.sbin/rpc.ypupdated/update.c =7C 328 ---------------------=
usr.sbin/rpc.ypupdated/yp=5Fdbdelete.c =7C 68 -----
usr.sbin/r= pc.ypupdated/yp=5Fdbupdate.c =7C 147 ----------
usr.sbin/rpc.ypupdat= ed/ypupdate =7C 32 ---
usr.sbin/rpc.ypupdated/ypupdated=5Fextern.h =7C= 32 ---
usr.sbin/rpc.ypupdated/ypupdated=5Fmain.c =7C 287 ----------= ---------
usr.sbin/rpc.ypupdated/ypupdated=5Fserver.c =7C 227 ------= ---------
30 files changed, 83 insertions(+), 3118 deletions(-)
=
diff --git a/Obsolete=46iles.inc b/Obsolete=46iles.inc
index ec3= 24e82f86d..a6662d31829f 100644
--- a/Obsolete=46iles.inc
+++ b/Ob= solete=46iles.inc
=40=40 -51,6 +51,10 =40=40
=23 xargs -n1 =7C s= ort =7C uniq -d;
=23 done

+=23 20250810: Removal of remaini= ng Secure RPC (DES) bits
+OLD=5F=46ILES+=3Dusr/sbin/rpc.ypupdated +OLD=5F=46ILES+=3Detc/rc.d/ypupdated
+
=23 20250808: nvmfd remo= ved from base install
OLD=5F=46ILES+=3Dusr/sbin/nvmfd
OLD=5F=46= ILES+=3Dusr/share/man/man8/nvmfd.8.gz
diff --git a/include/rpc/auth=5F= des.h b/include/rpc/auth=5Fdes.h
index 0ff43c13139b..1b4943a74b8b 100= 644
--- a/include/rpc/auth=5Fdes.h
+++ b/include/rpc/auth=5Fdes.h=
=40=40 -33,91 +33,14 =40=40
* Copyright (c) 1986 - 1991 by Sun = Microsystems, Inc.
*/

-/*
- * auth=5Fdes.h, Protocol fo= r DES style authentication for RPC
- */
+/* Note, RPC DES authent= ication was removed in =46reeBSD 15.0. */

=23ifndef =5FAUTH=5FD= ES=5F
=23define =5FAUTH=5FDES=5F

-/*
- * There are two = kinds of =22names=22: fullnames and nicknames
- */
-enum authdes=5F= namekind =7B
- ADN=5F=46ULLNAME,
- ADN=5FNICKNAME
-=7D;
-=
-/*
- * A fullname contains the network name of the client,
= - * a conversation key and the window
- */
-struct authdes=5Ffull= name =7B
- char *name; /* network name of client, up to MAXNETNAMELEN= */
- des=5Fblock key; /* conversation key */
- u=5Flong window; = /* associated window */
-=7D;
-
-
-/*
- * A credentia= l
- */
-struct authdes=5Fcred =7B
- enum authdes=5Fnamekind a= dc=5Fnamekind;
- struct authdes=5Ffullname adc=5Ffullname;
- u=5F= long adc=5Fnickname;
-=7D;
-
-
-
-/*
- * A des au= thentication verifier
- */
-struct authdes=5Fverf =7B
- union= =7B
- struct timeval adv=5Fctime; /* clear time */
- des=5Fblock= adv=5Fxtime; /* crypt time */
- =7D adv=5Ftime=5Fu;
- u=5Flong a= dv=5Fint=5Fu;
-=7D;
-
-/*
- * des authentication verifier= : client variety
- *
- * adv=5Ftimestamp is the current time. - * adv=5Fwinverf is the credential window + 1.
- * Both are encrypt= ed using the conversation key.
- */
-=23define adv=5Ftimestamp ad= v=5Ftime=5Fu.adv=5Fctime
-=23define adv=5Fxtimestamp adv=5Ftime=5Fu.a= dv=5Fxtime
-=23define adv=5Fwinverf adv=5Fint=5Fu
-
-/*
-= * des authentication verifier: server variety
- *
- * adv=5Ftime= verf is the client's timestamp + client's window
- * adv=5Fnickname i= s the server's nickname for the client.
- * adv=5Ftimeverf is encrypt= ed using the conversation key.
- */
-=23define adv=5Ftimeverf adv= =5Ftime=5Fu.adv=5Fctime
-=23define adv=5Fxtimeverf adv=5Ftime=5Fu.adv= =5Fxtime
-=23define adv=5Fnickname adv=5Fint=5Fu
-
-/*
- = * Map a des credential into a unix cred.
- *
- */
-=5F=5FBEGI= N=5FDECLS
-extern int authdes=5Fgetucred( struct authdes=5Fcred *, ui= d=5Ft *, gid=5Ft *, int *, gid=5Ft * );
-=5F=5FEND=5FDECLS
-
= =5F=5FBEGIN=5FDECLS
-extern bool=5Ft xdr=5Fauthdes=5Fcred(XDR *, str= uct authdes=5Fcred *);
-extern bool=5Ft xdr=5Fauthdes=5Fverf(XDR *, s= truct authdes=5Fverf *);
extern int rtime(dev=5Ft, struct netbuf *, = int, struct timeval *,
struct timeval *);
-extern void kgetnetna= me(char *);
-extern enum auth=5Fstat =5Fsvcauth=5Fdes(struct svc=5Fre= q *, struct rpc=5Fmsg *);
=5F=5FEND=5FDECLS

=23endif /* nd= ef =5FAUTH=5FDES=5F */
diff --git a/lib/libc/rpc/Symbol.map b/lib/lib= c/rpc/Symbol.map
index 105d6fb6b54e..61e8e084b1e0 100644
--- a/li= b/libc/rpc/Symbol.map
+++ b/lib/libc/rpc/Symbol.map
=40=40 -8,13 = +8,9 =40=40 =46BSD=5F1.0 =7B
xdr=5Fdesargs;
xdr=5Fdesresp;
=
- authdes=5Fseccreate;
- authdes=5Fpk=5Fseccreate;
authnone= =5Fcreate;
authunix=5Fcreate;
authunix=5Fcreate=5Fdefault;
= - xdr=5Fauthdes=5Fcred;
- xdr=5Fauthdes=5Fverf;
xdr=5Fauthunix=5F= parms;
bindresvport;
bindresvport=5Fsa;
=40=40 -58,15 +54,6= =40=40 =46BSD=5F1.0 =7B
endrpcent;
getrpcent;
getrpcport;=
- key=5Fsetsecret;
- key=5Fsecretkey=5Fis=5Fset;
- key=5Fenc= ryptsession=5Fpk;
- key=5Fdecryptsession=5Fpk;
- key=5Fencryptses= sion;
- key=5Fdecryptsession;
- key=5Fgendes;
- key=5Fsetnet;=
- key=5Fget=5Fconv;
xdr=5Fkeystatus;
xdr=5Fkeybuf;
xd= r=5Fnetnamestr;
=40=40 -130,7 +117,6 =40=40 =46BSD=5F1.0 =7B
cal= lrpc;
registerrpc;
clnt=5Fbroadcast;
- authdes=5Fcreate; clntunix=5Fcreate;
svcunix=5Fcreate;
svcunixfd=5Fcreate; =40=40 -180,8 +166,6 =40=40 =46BSD=5F1.0 =7B
=5Fauthenticate;
= =5Fsvcauth=5Fnull;
svc=5Fauth=5Freg;
- =5Fsvcauth=5Fdes;
- a= uthdes=5Fgetucred;
=5Fsvcauth=5Funix;
=5Fsvcauth=5Fshort;
= svc=5Fdg=5Fcreate;
=40=40 -205,9 +189,6 =40=40 =46BSD=5F1.8 =7B
=
=46BSDprivate=5F1.0 =7B
=5F=5Fdes=5Fcrypt=5FLOCAL;
- =5F=5F= key=5Fencryptsession=5Fpk=5FLOCAL;
- =5F=5Fkey=5Fdecryptsession=5Fpk=5F= LOCAL;
- =5F=5Fkey=5Fgendes=5FLOCAL;
=5F=5Fsvc=5Fclean=5Fidle; <= br> =5F=5Frpc=5Fgss=5Funwrap;
=5F=5Frpc=5Fgss=5Funwrap=5Fstub;
d= iff --git a/lib/libc/rpc/auth=5Fdes.c b/lib/libc/rpc/auth=5Fdes.c
ind= ex c9b20de25cda..754d55cbed3e 100644
--- a/lib/libc/rpc/auth=5Fdes.c =
+++ b/lib/libc/rpc/auth=5Fdes.c
=40=40 -30,463 +30,34 =40=40
= /*
* Copyright (c) 1988 by Sun Microsystems, Inc.
*/
+ /*
- * auth=5Fdes.c, client-side implementation of DES authenticati= on
+ * Secure RPC DES authentication was removed in =46reeBSD 15.0. <= br>+ * These symbols are provided for backward compatibility, but provide= no
+ * functionality and will always return an error.
*/
<= br> =23include =22namespace.h=22
=23include =22reentrant.h=22
-=23= include <err.h>
-=23include <errno.h>
-=23include <= ;string.h>
-=23include <stdlib.h>
-=23include <unistd= .h>
-=23include <rpc/des=5Fcrypt.h>
-=23include <sysl= og.h>
=23include <rpc/types.h>
=23include <rpc/auth= .h>
=23include <rpc/auth=5Fdes.h>
-=23include <rpc/c= lnt.h>
-=23include <rpc/xdr.h>
-=23include <sys/socke= t.h>
-=23undef NIS
=23include <rpcsvc/nis.h>
=23in= clude =22un-namespace.h=22
-=23include =22mt=5Fmisc.h=22
-
-=23= define USEC=5FPER=5FSEC 1000000
-=23define RTIME=5FTIMEOUT 5 /* secon= ds to wait for sync */
-
-=23define AUTH=5FPRIVATE(auth) (struct = ad=5Fprivate *) auth->ah=5Fprivate
-=23define ALLOC(object=5Ftype)= (object=5Ftype *) mem=5Falloc(sizeof(object=5Ftype))
-=23define =46R= EE(ptr, size) mem=5Ffree((char *)(ptr), (int) size)
-=23define ATTEMP= T(xdr=5Fop) if (=21(xdr=5Fop)) return (=46ALSE)
-
-extern bool=5F= t xdr=5Fauthdes=5Fcred( XDR *, struct authdes=5Fcred *);
-extern bool= =5Ft xdr=5Fauthdes=5Fverf( XDR *, struct authdes=5Fverf *);
-extern i= nt key=5Fencryptsession=5Fpk(char *, netobj *, des=5Fblock *);
-
= -extern bool=5Ft =5F=5Frpc=5Fget=5Ftime=5Foffset(struct timeval *, nis=5F= server *, char *,
- char **, char **);

-/*
- * DES authe= nticator operations vector
- */
-static void authdes=5Fnextverf(A= UTH *);
-static bool=5Ft authdes=5Fmarshal(AUTH *, XDR *);
-stati= c bool=5Ft authdes=5Fvalidate(AUTH *, struct opaque=5Fauth *);
-stati= c bool=5Ft authdes=5Frefresh(AUTH *, void *);
-static void authdes=5F= destroy(AUTH *);
-
-static struct auth=5Fops *authdes=5Fops(void)= ;
-
-/*
- * This struct is pointed to by the ah=5Fprivate fie= ld of an =22AUTH *=22
- */
-struct ad=5Fprivate =7B
- char *a= d=5Ffullname; /* client's full name */
- u=5Fint ad=5Ffullnamelen; /*= length of name, rounded up */
- char *ad=5Fservername; /* server's f= ull name */
- u=5Fint ad=5Fservernamelen; /* length of name, rounded = up */
- u=5Fint ad=5Fwindow; /* client specified window */
- bool= =5Ft ad=5Fdosync; /* synchronize=3F */
- struct netbuf ad=5Fsyncaddr;= /* remote host to synch with */
- char *ad=5Ftimehost; /* remote hos= t to synch with */
- struct timeval ad=5Ftimediff; /* server's time -= client's time */
- u=5Fint ad=5Fnickname; /* server's nickname for c= lient */
- struct authdes=5Fcred ad=5Fcred; /* storage for credential= */
- struct authdes=5Fverf ad=5Fverf; /* storage for verifier */ - struct timeval ad=5Ftimestamp; /* timestamp sent */
- des=5Fblock = ad=5Fxkey; /* encrypted conversation key */
- u=5Fchar ad=5Fpkey=5B10= 24=5D; /* Server's actual public key */
- char *ad=5Fnetid; /* Timeho= st netid */
- char *ad=5Fuaddr; /* Timehost uaddr */
- nis=5Fserv= er *ad=5Fnis=5Fsrvr; /* NIS+ server struct */
-=7D;
-
-AUTH *= authdes=5Fpk=5Fseccreate(const char *, netobj *, u=5Fint, const char *, <= br>- const des=5Fblock *, nis=5Fserver *);
-
-/*
- * document= ed version of authdes=5Fseccreate
- */
-/*
- servername: netw= ork name of server
- win: time to live
- timehost: optional hostn= ame to sync with
- ckey: optional conversation key to use
-*/ -
-AUTH *
-authdes=5Fseccreate(const char *servername, const u=5F= int win,
+static AUTH *
+=5F=5Fauthdes=5Fseccreate(const char *se= rvername, const u=5Fint win,
const char *timehost, const des=5Fblock= *ckey)
=7B
- u=5Fchar pkey=5Fdata=5B1024=5D;
- netobj pkey;=
- AUTH *dummy;
-
- if (=21 getpublickey(servername, (char *)= pkey=5Fdata)) =7B
- syslog(LOG=5FERR,
- =22authdes=5Fseccreate: = no public key found for %s=22,
- servername);
- return (NULL); - =7D
-
- pkey.n=5Fbytes =3D (char *) pkey=5Fdata;
- pkey.n= =5Flen =3D (u=5Fint)strlen((char *)pkey=5Fdata) + 1;
- dummy =3D auth= des=5Fpk=5Fseccreate(servername, &pkey, win, timehost,
- ckey, NU= LL);
- return (dummy);
-=7D
-
-/*
- * Slightly modifi= ed version of authdessec=5Fcreate which takes the public key
- * of t= he server principal as an argument. This spares us a call to
- * getp= ublickey() which in the nameserver context can cause a deadlock.
- */=
-AUTH *
-authdes=5Fpk=5Fseccreate(const char *servername, netobj= *pkey, u=5Fint window,
- const char *timehost, const des=5Fblock *ck= ey, nis=5Fserver *srvr)
-=7B
- AUTH *auth;
- struct ad=5Fpriv= ate *ad;
- char namebuf=5BMAXNETNAMELEN+1=5D;
-
- /*
- * = Allocate everything now
- */
- auth =3D ALLOC(AUTH);
- if (au= th =3D=3D NULL) =7B
- syslog(LOG=5FERR, =22authdes=5Fpk=5Fseccreate: = out of memory=22);
- return (NULL);
- =7D
- ad =3D ALLOC(stru= ct ad=5Fprivate);
- if (ad =3D=3D NULL) =7B
- syslog(LOG=5FERR, =22= authdes=5Fpk=5Fseccreate: out of memory=22);
- goto failed;
- =7D=
- ad->ad=5Ffullname =3D ad->ad=5Fservername =3D NULL; /* Sanit= y reasons */
- ad->ad=5Ftimehost =3D NULL;
- ad->ad=5Fnetid= =3D NULL;
- ad->ad=5Fuaddr =3D NULL;
- ad->ad=5Fnis=5Fsrvr= =3D NULL;
- ad->ad=5Ftimediff.tv=5Fsec =3D 0;
- ad->ad=5Ft= imediff.tv=5Fusec =3D 0;
- memcpy(ad->ad=5Fpkey, pkey->n=5Fbyte= s, pkey->n=5Flen);
- if (=21getnetname(namebuf))
- goto failed= ;
- ad->ad=5Ffullnamelen =3D RNDUP((u=5Fint) strlen(namebuf)); - ad->ad=5Ffullname =3D (char *)mem=5Falloc(ad->ad=5Ffullnamelen += 1);
- ad->ad=5Fservernamelen =3D strlen(servername);
- ad->= ;ad=5Fservername =3D (char *)mem=5Falloc(ad->ad=5Fservernamelen + 1); =
-
- if (ad->ad=5Ffullname =3D=3D NULL =7C=7C ad->ad=5Fserve= rname =3D=3D NULL) =7B
- syslog(LOG=5FERR, =22authdes=5Fseccreate: ou= t of memory=22);
- goto failed;
- =7D
- if (timehost =21=3D N= ULL) =7B
- ad->ad=5Ftimehost =3D (char *)mem=5Falloc(strlen(timeho= st) + 1);
- if (ad->ad=5Ftimehost =3D=3D NULL) =7B
- syslog(LO= G=5FERR, =22authdes=5Fseccreate: out of memory=22);
- goto failed; - =7D
- memcpy(ad->ad=5Ftimehost, timehost, strlen(timehost) + 1= );
- ad->ad=5Fdosync =3D TRUE;
- =7D else if (srvr =21=3D NULL= ) =7B
- ad->ad=5Fnis=5Fsrvr =3D srvr; /* transient */
- ad->= ;ad=5Fdosync =3D TRUE;
- =7D else =7B
- ad->ad=5Fdosync =3D =46= ALSE;
- =7D
- memcpy(ad->ad=5Ffullname, namebuf, ad->ad=5Ff= ullnamelen + 1);
- memcpy(ad->ad=5Fservername, servername, ad->= ad=5Fservernamelen + 1);
- ad->ad=5Fwindow =3D window;
- if (c= key =3D=3D NULL) =7B
- if (key=5Fgendes(&auth->ah=5Fkey) < = 0) =7B
- syslog(LOG=5FERR,
- =22authdes=5Fseccreate: keyserv(1m) = is unable to generate session key=22);
- goto failed;
- =7D
-= =7D else =7B
- auth->ah=5Fkey =3D *ckey;
- =7D
-
- /*=
- * Set up auth handle
- */
- auth->ah=5Fcred.oa=5Fflavor= =3D AUTH=5FDES;
- auth->ah=5Fverf.oa=5Fflavor =3D AUTH=5FDES; - auth->ah=5Fops =3D authdes=5Fops();
- auth->ah=5Fprivate =3D= (caddr=5Ft)ad;
-
- if (=21authdes=5Frefresh(auth, NULL)) =7B - goto failed;
- =7D
- ad->ad=5Fnis=5Fsrvr =3D NULL; /* not n= eeded any longer */
- return (auth);
-
-failed:
- if (aut= h)
- =46REE(auth, sizeof (AUTH));
- if (ad) =7B
- if (ad->= ad=5Ffullname)
- =46REE(ad->ad=5Ffullname, ad->ad=5Ffullnamelen= + 1);
- if (ad->ad=5Fservername)
- =46REE(ad->ad=5Fservern= ame, ad->ad=5Fservernamelen + 1);
- if (ad->ad=5Ftimehost)
= - =46REE(ad->ad=5Ftimehost, strlen(ad->ad=5Ftimehost) + 1);
- i= f (ad->ad=5Fnetid)
- =46REE(ad->ad=5Fnetid, strlen(ad->ad=5F= netid) + 1);
- if (ad->ad=5Fuaddr)
- =46REE(ad->ad=5Fuaddr,= strlen(ad->ad=5Fuaddr) + 1);
- =46REE(ad, sizeof (struct ad=5Fpri= vate));
- =7D
return (NULL);
=7D
+=5F=5Fsym=5Fcompat(au= thdes=5Fseccreate, =5F=5Fauthdes=5Fseccreate, =46BSD=5F1.0);

-/*=
- * Implement the five authentication operations
- */
-
= -
-/*
- * 1. Next Verifier
- */
-/*ARGSUSED*/
-static= void
-authdes=5Fnextverf(AUTH *auth =5F=5Funused)
+static AUTH *=
+=5F=5Fauthdes=5Fpk=5Fseccreate(const char *servername =5F=5Funused,= netobj *pkey =5F=5Funused,
+ u=5Fint window =5F=5Funused, const char= *timehost =5F=5Funused,
+ const des=5Fblock *ckey =5F=5Funused, nis=5F= server *srvr =5F=5Funused)
=7B
- /* what the heck am I supposed = to do=3F=3F=3F */
-=7D
-
-
-/*
- * 2. Marshal
- *= /
-static bool=5Ft
-authdes=5Fmarshal(AUTH *auth, XDR *xdrs)
= -=7B
-/* LINTED pointer alignment */
- struct ad=5Fprivate *ad =3D= AUTH=5FPRIVATE(auth);
- struct authdes=5Fcred *cred =3D &ad->= ad=5Fcred;
- struct authdes=5Fverf *verf =3D &ad->ad=5Fverf; <= br>- des=5Fblock cryptbuf=5B2=5D;
- des=5Fblock ivec;
- int statu= s;
- int len;
- rpc=5Finline=5Ft *ixdr;
-
- /*
- * =46= igure out the =22time=22, accounting for any time difference
- * with= the server if necessary.
- */
- (void)gettimeofday(&ad->a= d=5Ftimestamp, NULL);
- ad->ad=5Ftimestamp.tv=5Fsec +=3D ad->ad= =5Ftimediff.tv=5Fsec;
- ad->ad=5Ftimestamp.tv=5Fusec +=3D ad->a= d=5Ftimediff.tv=5Fusec;
- while (ad->ad=5Ftimestamp.tv=5Fusec >= =3D USEC=5FPER=5FSEC) =7B
- ad->ad=5Ftimestamp.tv=5Fusec -=3D USEC= =5FPER=5FSEC;
- ad->ad=5Ftimestamp.tv=5Fsec++;
- =7D
- - /*
- * XDR the timestamp and possibly some other things, then
= - * encrypt them.
- */
- ixdr =3D (rpc=5Finline=5Ft *)cryptbuf; <= br>- IXDR=5FPUT=5FINT32(ixdr, ad->ad=5Ftimestamp.tv=5Fsec);
- IXDR= =5FPUT=5FINT32(ixdr, ad->ad=5Ftimestamp.tv=5Fusec);
- if (ad->a= d=5Fcred.adc=5Fnamekind =3D=3D ADN=5F=46ULLNAME) =7B
- IXDR=5FPUT=5FU= =5FINT32(ixdr, ad->ad=5Fwindow);
- IXDR=5FPUT=5FU=5FINT32(ixdr, ad= ->ad=5Fwindow - 1);
- ivec.key.high =3D ivec.key.low =3D 0;
- = status =3D cbc=5Fcrypt((char *)&auth->ah=5Fkey, (char *)cryptbuf, =
- (u=5Fint) 2 * sizeof (des=5Fblock),
- DES=5FENCRYPT =7C DES=5FH= W, (char *)&ivec);
- =7D else =7B
- status =3D ecb=5Fcrypt((c= har *)&auth->ah=5Fkey, (char *)cryptbuf,
- (u=5Fint) sizeof (d= es=5Fblock),
- DES=5FENCRYPT =7C DES=5FHW);
- =7D
- if (DES=5F= =46AILED(status)) =7B
- syslog(LOG=5FERR, =22authdes=5Fmarshal: DES e= ncryption failure=22);
- return (=46ALSE);
- =7D
- ad->ad=5F= verf.adv=5Fxtimestamp =3D cryptbuf=5B0=5D;
- if (ad->ad=5Fcred.adc= =5Fnamekind =3D=3D ADN=5F=46ULLNAME) =7B
- ad->ad=5Fcred.adc=5Fful= lname.window =3D cryptbuf=5B1=5D.key.high;
- ad->ad=5Fverf.adv=5Fw= inverf =3D cryptbuf=5B1=5D.key.low;
- =7D else =7B
- ad->ad=5F= cred.adc=5Fnickname =3D ad->ad=5Fnickname;
- ad->ad=5Fverf.adv=5F= winverf =3D 0;
- =7D
-
- /*
- * Serialize the credential = and verifier into opaque
- * authentication data.
- */
- if (= ad->ad=5Fcred.adc=5Fnamekind =3D=3D ADN=5F=46ULLNAME) =7B
- len =3D= ((1 + 1 + 2 + 1)*BYTES=5FPER=5FXDR=5FUNIT + ad->ad=5Ffullnamelen); - =7D else =7B
- len =3D (1 + 1)*BYTES=5FPER=5FXDR=5FUNIT;
- =7D=
-
- if ((ixdr =3D xdr=5Finline(xdrs, 2*BYTES=5FPER=5FXDR=5FUNIT)= )) =7B
- IXDR=5FPUT=5FINT32(ixdr, AUTH=5FDES);
- IXDR=5FPUT=5FINT= 32(ixdr, len);
- =7D else =7B
- ATTEMPT(xdr=5Fputint32(xdrs, (int= *)&auth->ah=5Fcred.oa=5Fflavor));
- ATTEMPT(xdr=5Fputint32(xd= rs, &len));
- =7D
- ATTEMPT(xdr=5Fauthdes=5Fcred(xdrs, cred))= ;
-
- len =3D (2 + 1)*BYTES=5FPER=5FXDR=5FUNIT;
- if ((ixdr =3D= xdr=5Finline(xdrs, 2*BYTES=5FPER=5FXDR=5FUNIT))) =7B
- IXDR=5FPUT=5F= INT32(ixdr, AUTH=5FDES);
- IXDR=5FPUT=5FINT32(ixdr, len);
- =7D e= lse =7B
- ATTEMPT(xdr=5Fputint32(xdrs, (int *)&auth->ah=5Fverf= .oa=5Fflavor));
- ATTEMPT(xdr=5Fputint32(xdrs, &len));
- =7D =
- ATTEMPT(xdr=5Fauthdes=5Fverf(xdrs, verf));
- return (TRUE); -=7D
-
-
-/*
- * 3. Validate
- */
-static bool=5F= t
-authdes=5Fvalidate(AUTH *auth, struct opaque=5Fauth *rverf)
-=7B=
-/* LINTED pointer alignment */
- struct ad=5Fprivate *ad =3D AU= TH=5FPRIVATE(auth);
- struct authdes=5Fverf verf;
- int status; <= br>- uint32=5Ft *ixdr;
- des=5Fblock buf;
-
- if (rverf->o= a=5Flength =21=3D (2 + 1) * BYTES=5FPER=5FXDR=5FUNIT) =7B
- return (=46= ALSE);
- =7D
-/* LINTED pointer alignment */
- ixdr =3D (uint= 32=5Ft *)rverf->oa=5Fbase;
- buf.key.high =3D (uint32=5Ft)*ixdr++;=
- buf.key.low =3D (uint32=5Ft)*ixdr++;
- verf.adv=5Fint=5Fu =3D = (uint32=5Ft)*ixdr++;
-
- /*
- * Decrypt the timestamp
- *= /
- status =3D ecb=5Fcrypt((char *)&auth->ah=5Fkey, (char *)&a= mp;buf,
- (u=5Fint)sizeof (des=5Fblock), DES=5FDECRYPT =7C DES=5FHW);=
-
- if (DES=5F=46AILED(status)) =7B
- syslog(LOG=5FERR, =22a= uthdes=5Fvalidate: DES decryption failure=22);
- return (=46ALSE); - =7D
-
- /*
- * xdr the decrypted timestamp
- */
-= /* LINTED pointer alignment */
- ixdr =3D (uint32=5Ft *)buf.c;
- = verf.adv=5Ftimestamp.tv=5Fsec =3D IXDR=5FGET=5FINT32(ixdr) + 1;
- ver= f.adv=5Ftimestamp.tv=5Fusec =3D IXDR=5FGET=5FINT32(ixdr);
-
- /* =
- * validate
- */
- if (bcmp((char *)&ad->ad=5Ftimesta= mp, (char *)&verf.adv=5Ftimestamp,
- sizeof(struct timeval)) =21=3D= 0) =7B
- syslog(LOG=5FDEBUG, =22authdes=5Fvalidate: verifier mismatc= h=22);
- return (=46ALSE);
- =7D
-
- /*
- * We have a= nickname now, let's use it
- */
- ad->ad=5Fnickname =3D verf.= adv=5Fnickname;
- ad->ad=5Fcred.adc=5Fnamekind =3D ADN=5FNICKNAME;=
- return (TRUE);
-=7D
-
-/*
- * 4. Refresh
- */ =
-/*ARGSUSED*/
-static bool=5Ft
-authdes=5Frefresh(AUTH *auth,= void *dummy =5F=5Funused)
-=7B
-/* LINTED pointer alignment */ <= br>- struct ad=5Fprivate *ad =3D AUTH=5FPRIVATE(auth);
- struct authd= es=5Fcred *cred =3D &ad->ad=5Fcred;
- int ok;
- netobj pke= y;
-
- if (ad->ad=5Fdosync) =7B
- ok =3D =5F=5Frpc=5Fget=5F= time=5Foffset(&ad->ad=5Ftimediff, ad->ad=5Fnis=5Fsrvr,
- ad= ->ad=5Ftimehost, &(ad->ad=5Fuaddr),
- &(ad->ad=5Fnet= id));
- if (=21 ok) =7B
- /*
- * Hope the clocks are synced=21=
- */
- ad->ad=5Fdosync =3D 0;
- syslog(LOG=5FDEBUG,
-= =22authdes=5Frefresh: unable to synchronize clock=22);
- =7D
- =7D=
- ad->ad=5Fxkey =3D auth->ah=5Fkey;
- pkey.n=5Fbytes =3D (= char *)(ad->ad=5Fpkey);
- pkey.n=5Flen =3D (u=5Fint)strlen((char *= )ad->ad=5Fpkey) + 1;
- if (key=5Fencryptsession=5Fpk(ad->ad=5Fs= ervername, &pkey, &ad->ad=5Fxkey) < 0) =7B
- syslog(LOG= =5FIN=46O,
- =22authdes=5Frefresh: keyserv(1m) is unable to encrypt s= ession key=22);
- return (=46ALSE);
- =7D
- cred->adc=5Ffu= llname.key =3D ad->ad=5Fxkey;
- cred->adc=5Fnamekind =3D ADN=5F= =46ULLNAME;
- cred->adc=5Ffullname.name =3D ad->ad=5Ffullname; =
- return (TRUE);
-=7D
-
-
-/*
- * 5. Destroy
= - */
-static void
-authdes=5Fdestroy(AUTH *auth)
-=7B
-/*= LINTED pointer alignment */
- struct ad=5Fprivate *ad =3D AUTH=5FPRI= VATE(auth);
-
- =46REE(ad->ad=5Ffullname, ad->ad=5Ffullname= len + 1);
- =46REE(ad->ad=5Fservername, ad->ad=5Fservernamelen = + 1);
- if (ad->ad=5Ftimehost)
- =46REE(ad->ad=5Ftimehost, = strlen(ad->ad=5Ftimehost) + 1);
- if (ad->ad=5Fnetid)
- =46= REE(ad->ad=5Fnetid, strlen(ad->ad=5Fnetid) + 1);
- if (ad->a= d=5Fuaddr)
- =46REE(ad->ad=5Fuaddr, strlen(ad->ad=5Fuaddr) + 1)= ;
- =46REE(ad, sizeof (struct ad=5Fprivate));
- =46REE(auth, size= of(AUTH));
-=7D
-
-static struct auth=5Fops *
-authdes=5F= ops(void)
-=7B
- static struct auth=5Fops ops;
-
- /* VAR= IABLES PROTECTED BY ops=5Flock: ops */
-
- mutex=5Flock(&auth= des=5Fops=5Flock);
- if (ops.ah=5Fnextverf =3D=3D NULL) =7B
- ops= .ah=5Fnextverf =3D authdes=5Fnextverf;
- ops.ah=5Fmarshal =3D authdes= =5Fmarshal;
- ops.ah=5Fvalidate =3D authdes=5Fvalidate;
- ops.ah=5F= refresh =3D authdes=5Frefresh;
- ops.ah=5Fdestroy =3D authdes=5Fdestr= oy;
- =7D
- mutex=5Funlock(&authdes=5Fops=5Flock);
- retu= rn (&ops);
+ return (NULL);
=7D
+=5F=5Fsym=5Fcompat(auth= des=5Fpk=5Fseccreate, =5F=5Fauthdes=5Fpk=5Fseccreate, =46BSD=5F1.0);
= diff --git a/lib/libc/rpc/authdes=5Fprot.c b/lib/libc/rpc/authdes=5Fprot.= c
index 79a0e5baa084..56b44daafe41 100644
--- a/lib/libc/rpc/auth= des=5Fprot.c
+++ b/lib/libc/rpc/authdes=5Fprot.c
=40=40 -42,44 +4= 2,16 =40=40
=23include <rpc/auth=5Fdes.h>
=23include =22u= n-namespace.h=22

-=23define ATTEMPT(xdr=5Fop) if (=21(xdr=5Fop))= return (=46ALSE)
-
-bool=5Ft
-xdr=5Fauthdes=5Fcred(XDR *xdrs= , struct authdes=5Fcred *cred)
+static bool=5Ft
+=5F=5Fxdr=5Fauth= des=5Fcred(XDR *xdrs, void *cred)
=7B
- enum authdes=5Fnamekind = *padc=5Fnamekind =3D &cred->adc=5Fnamekind;
- /*
- * Unrol= led xdr
- */
- ATTEMPT(xdr=5Fenum(xdrs, (enum=5Ft *) padc=5Fnamek= ind));
- switch (cred->adc=5Fnamekind) =7B
- case ADN=5F=46ULL= NAME:
- ATTEMPT(xdr=5Fstring(xdrs, &cred->adc=5Ffullname.name,=
- MAXNETNAMELEN));
- ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&= cred->adc=5Ffullname.key,
- sizeof(des=5Fblock)));
- ATTEMPT(x= dr=5Fopaque(xdrs, (caddr=5Ft)&cred->adc=5Ffullname.window,
- s= izeof(cred->adc=5Ffullname.window)));
- return (TRUE);
- case = ADN=5FNICKNAME:
- ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&cred->= ;adc=5Fnickname,
- sizeof(cred->adc=5Fnickname)));
- return (T= RUE);
- default:
- return (=46ALSE);
- =7D
+ return (=46A= LSE);
=7D
+=5F=5Fsym=5Fcompat(xdr=5Fauthdes=5Fcred, =5F=5Fxdr=5F= authdes=5Fcred, =46BSD=5F1.0);

-
-bool=5Ft
-xdr=5Fauthde= s=5Fverf(XDR *xdrs, struct authdes=5Fverf *verf)
+static bool=5Ft +=5F=5Fxdr=5Fauthdes=5Fverf(XDR *xdrs, void *verf)
=7B
- /* - * Unrolled xdr
- */
- ATTEMPT(xdr=5Fopaque(xdrs, (caddr=5Ft)&a= mp;verf->adv=5Fxtimestamp,
- sizeof(des=5Fblock)));
- ATTEMPT(= xdr=5Fopaque(xdrs, (caddr=5Ft)&verf->adv=5Fint=5Fu,
- sizeof(v= erf->adv=5Fint=5Fu)));
- return (TRUE);
+ return (=46ALSE); =7D
+=5F=5Fsym=5Fcompat(xdr=5Fauthdes=5Fverf, =5F=5Fxdr=5Fauthdes=5F= verf, =46BSD=5F1.0);
diff --git a/lib/libc/rpc/key=5Fcall.c b/lib/lib= c/rpc/key=5Fcall.c
index 5c87881c815c..eb274fcfff36 100644
--- a/= lib/libc/rpc/key=5Fcall.c
+++ b/lib/libc/rpc/key=5Fcall.c
=40=40 = -32,426 +32,78 =40=40
*/

/*
- * key=5Fcall.c, Interfac= e to keyserver
- *
- * setsecretkey(key) - set your secret key - * encryptsessionkey(agent, deskey) - encrypt a session key to talk to= agent
- * decryptsessionkey(agent, deskey) - decrypt ditto
- * g= endeskey(deskey) - generate a secure des key
+ * Secure RPC keyserver= support was removed in =46reeBSD 15.0.
+ * These symbols are provide= d for backward compatibility, but provide no
+ * functionality and wi= ll always return an error.
*/

=23include =22namespace.h=22=
=23include =22reentrant.h=22
-=23include <stdio.h>
-=23= include <stdlib.h>
-=23include <unistd.h>
-=23include= <errno.h>
=23include <rpc/rpc.h>
-=23include <rp= c/auth.h>
-=23include <rpc/auth=5Funix.h>
=23include &l= t;rpc/key=5Fprot.h>
-=23include <string.h>
-=23include &= lt;netconfig.h>
-=23include <sys/utsname.h>
-=23include = <stdlib.h>
-=23include <signal.h>
-=23include <sys= /wait.h>
-=23include <sys/fcntl.h>
+=23include <rpc/a= uth.h>
=23include =22un-namespace.h=22
=23include =22mt=5Fmi= sc.h=22

-
-=23define KEY=5FTIMEOUT 5 /* per-try timeout in s= econds */
-=23define KEY=5FNRETRY 12 /* number of retries */
- -=23ifdef DEBUG
-=23define debug(msg) (void) fprintf(stderr, =22%s=5C= n=22, msg);
-=23else
-=23define debug(msg)
-=23endif /* DEBUG= */
-
-/*
- * Hack to allow the keyserver to use AUTH=5FDES (= for authenticated
- * NIS+ calls, for example). The only functions th= at get called
- * are key=5Fencryptsession=5Fpk, key=5Fdecryptsession= =5Fpk, and key=5Fgendes.
- *
- * The approach is to have the keys= erver fill in pointers to local
- * implementations of these function= s, and to call those in key=5Fcall().
- */
-
-cryptkeyres *(*= =5F=5Fkey=5Fencryptsession=5Fpk=5FLOCAL)(uid=5Ft, void *arg) =3D 0;
-= cryptkeyres *(*=5F=5Fkey=5Fdecryptsession=5Fpk=5FLOCAL)(uid=5Ft, void *ar= g) =3D 0;
-des=5Fblock *(*=5F=5Fkey=5Fgendes=5FLOCAL)(uid=5Ft, void *= ) =3D 0;
-
-static int key=5Fcall( u=5Flong, xdrproc=5Ft, void *,= xdrproc=5Ft, void *);
-
-int
-key=5Fsetsecret(const char *se= cretkey)
-=7B
- keystatus status;
-
- if (=21key=5Fcall((= u=5Flong) KEY=5FSET, (xdrproc=5Ft)xdr=5Fkeybuf,
- (void *)secretkey, =
- (xdrproc=5Ft)xdr=5Fkeystatus, &status)) =7B
- return (-1); =
- =7D
- if (status =21=3D KEY=5FSUCCESS) =7B
- debug(=22set s= tatus is nonzero=22);
- return (-1);
- =7D
- return (0);
= -=7D
-
-
-/* key=5Fsecretkey=5Fis=5Fset() returns 1 if the ke= yserver has a secret key
- * stored for the caller's effective uid; i= t returns 0 otherwise
- *
- * N.B.: The KEY=5FNET=5FGET key call = is undocumented. Applications shouldn't
- * be using it, because it a= llows them to get the user's secret key.
- */
-
-int
-key= =5Fsecretkey=5Fis=5Fset(void)
-=7B
- struct key=5Fnetstres kres; =
-
- memset((void*)&kres, 0, sizeof (kres));
- if (key=5Fc= all((u=5Flong) KEY=5FNET=5FGET, (xdrproc=5Ft)xdr=5Fvoid, NULL,
- (xdr= proc=5Ft)xdr=5Fkey=5Fnetstres, &kres) &&
- (kres.status =3D= =3D KEY=5FSUCCESS) &&
- (kres.key=5Fnetstres=5Fu.knet.st=5Fpr= iv=5Fkey=5B0=5D =21=3D 0)) =7B
- /* avoid leaving secret key in memor= y */
- memset(kres.key=5Fnetstres=5Fu.knet.st=5Fpriv=5Fkey, 0, HEXKEY= BYTES);
- return (1);
- =7D
- return (0);
-=7D
-
= -int
-key=5Fencryptsession=5Fpk(char *remotename, netobj *remotekey, = des=5Fblock *deskey)
-=7B
- cryptkeyarg2 arg;
- cryptkeyres r= es;
-
- arg.remotename =3D remotename;
- arg.remotekey =3D *r= emotekey;
- arg.deskey =3D *deskey;
- if (=21key=5Fcall((u=5Flong= )KEY=5FENCRYPT=5FPK, (xdrproc=5Ft)xdr=5Fcryptkeyarg2, &arg,
- (xd= rproc=5Ft)xdr=5Fcryptkeyres, &res)) =7B
- return (-1);
- =7D =
- if (res.status =21=3D KEY=5FSUCCESS) =7B
- debug(=22encrypt sta= tus is nonzero=22);
- return (-1);
- =7D
- *deskey =3D res.cr= yptkeyres=5Fu.deskey;
- return (0);
-=7D
-
-int
-key=5F= decryptsession=5Fpk(char *remotename, netobj *remotekey, des=5Fblock *des= key)
-=7B
- cryptkeyarg2 arg;
- cryptkeyres res;
-
- = arg.remotename =3D remotename;
- arg.remotekey =3D *remotekey;
- = arg.deskey =3D *deskey;
- if (=21key=5Fcall((u=5Flong)KEY=5FDECRYPT=5F= PK, (xdrproc=5Ft)xdr=5Fcryptkeyarg2, &arg,
- (xdrproc=5Ft)xdr=5Fc= ryptkeyres, &res)) =7B
- return (-1);
- =7D
- if (res.sta= tus =21=3D KEY=5FSUCCESS) =7B
- debug(=22decrypt status is nonzero=22= );
- return (-1);
- =7D
- *deskey =3D res.cryptkeyres=5Fu.des= key;
- return (0);
-=7D
-
-int
-key=5Fencryptsession(= const char *remotename, des=5Fblock *deskey)
+static int
+=5F=5Fk= ey=5Fsetsecret(const char *secretkey)
=7B
- cryptkeyarg arg; - cryptkeyres res;
-
- arg.remotename =3D (char *) remotename; <= br>- arg.deskey =3D *deskey;
- if (=21key=5Fcall((u=5Flong)KEY=5FENCR= YPT, (xdrproc=5Ft)xdr=5Fcryptkeyarg, &arg,
- (xdrproc=5Ft)xdr=5Fc= ryptkeyres, &res)) =7B
- return (-1);
- =7D
- if (res.sta= tus =21=3D KEY=5FSUCCESS) =7B
- debug(=22encrypt status is nonzero=22= );
- return (-1);
- =7D
- *deskey =3D res.cryptkeyres=5Fu.des= key;
- return (0);
+ return (-1);
=7D
+=5F=5Fsym=5Fcompa= t(key=5Fsetsecret, =5F=5Fkey=5Fsetsecret, =46BSD=5F1.0);

-int -key=5Fdecryptsession(const char *remotename, des=5Fblock *deskey)
= +static int
+=5F=5Fkey=5Fsecretkey=5Fis=5Fset(void)
=7B
- cr= yptkeyarg arg;
- cryptkeyres res;
-
- arg.remotename =3D (cha= r *) remotename;
- arg.deskey =3D *deskey;
- if (=21key=5Fcall((u= =5Flong)KEY=5FDECRYPT, (xdrproc=5Ft)xdr=5Fcryptkeyarg, &arg,
- (x= drproc=5Ft)xdr=5Fcryptkeyres, &res)) =7B
- return (-1);
- =7D=
- if (res.status =21=3D KEY=5FSUCCESS) =7B
- debug(=22decrypt st= atus is nonzero=22);
- return (-1);
- =7D
- *deskey =3D res.c= ryptkeyres=5Fu.deskey;
return (0);
=7D
+=5F=5Fsym=5Fcompat(= key=5Fsecretkey=5Fis=5Fset, =5F=5Fkey=5Fsecretkey=5Fis=5Fset, =46BSD=5F1.= 0);

-int
-key=5Fgendes(des=5Fblock *key)
+static int +=5F=5Fkey=5Fencryptsession=5Fpk(char *remotename, netobj *remotekey, de= s=5Fblock *deskey)
=7B
- if (=21key=5Fcall((u=5Flong)KEY=5FGEN, = (xdrproc=5Ft)xdr=5Fvoid, NULL,
- (xdrproc=5Ft)xdr=5Fdes=5Fblock, key)= ) =7B
- return (-1);
- =7D
- return (0);
+ return (-1); <= br> =7D
+=5F=5Fsym=5Fcompat(key=5Fencryptsession=5Fpk, =5F=5Fkey=5Fen= cryptsession=5Fpk, =46BSD=5F1.0);

-int
-key=5Fsetnet(struct = key=5Fnetstarg *arg)
+static int
+=5F=5Fkey=5Fdecryptsession=5Fpk= (char *remotename, netobj *remotekey, des=5Fblock *deskey)
=7B
*= ** 2726 LINES SKIPPED ***

--689b40a3_2336c6b7_50e--