summaryrefslogtreecommitdiff
path: root/security/krb5-122
diff options
context:
space:
mode:
Diffstat (limited to 'security/krb5-122')
-rw-r--r--security/krb5-122/Makefile154
-rw-r--r--security/krb5-122/distinfo3
-rw-r--r--security/krb5-122/files/kdc.in4
-rw-r--r--security/krb5-122/files/kpropd.in26
-rw-r--r--security/krb5-122/files/patch-clients__ksu__Makefile.in18
-rw-r--r--security/krb5-122/files/patch-config__pre.in23
-rw-r--r--security/krb5-122/files/patch-config__shlib.conf22
-rw-r--r--security/krb5-122/files/patch-configure.ac17
-rw-r--r--security/krb5-122/files/patch-lib-krb5-os-localaddr.c75
-rw-r--r--security/krb5-122/files/patch-lib__gssapi__krb5__import_name.c14
-rw-r--r--security/krb5-122/files/patch-lib_krad_packet.c12
-rw-r--r--security/krb5-122/files/patch-plugins_preauth_pkinit_pkinit__crypto__openssl.c43
-rw-r--r--security/krb5-122/files/patch-util_ss_listen.c14
-rw-r--r--security/krb5-122/pkg-descr22
-rw-r--r--security/krb5-122/pkg-plist177
15 files changed, 624 insertions, 0 deletions
diff --git a/security/krb5-122/Makefile b/security/krb5-122/Makefile
new file mode 100644
index 000000000000..f68506489590
--- /dev/null
+++ b/security/krb5-122/Makefile
@@ -0,0 +1,154 @@
+PORTNAME= krb5
+PORTVERSION= 1.22
+CATEGORIES= security
+MASTER_SITES= http://web.mit.edu/kerberos/dist/${PORTNAME}/${PORTVERSION:C/^[0-9]*\.[0-9]*/&X/:C/X\.[0-9]*$//:C/X//}/
+.if !defined(MASTERDIR)
+PKGNAME_X= -${FLAVOR:S/default//}-122
+.else
+PKGNAME_X= -${FLAVOR:S/default//}
+.endif
+PKGNAMESUFFIX= ${PKGNAME_X:S/--/-/:C/-$//}
+
+PATCH_SITES= http://web.mit.edu/kerberos/advisories/
+PATCH_DIST_STRIP= -p2
+
+MAINTAINER= cy@FreeBSD.org
+COMMENT= MIT implementation of RFC 4120 network authentication service
+WWW= https://web.mit.edu/kerberos/
+
+LICENSE= MIT
+
+CONFLICTS= heimdal krb5 krb5-11* krb5-120
+CONFLICTS_BUILD= boringssl
+
+KERBEROSV_URL= http://web.mit.edu/kerberos/
+USES= autoreconf compiler:c++11-lang cpe gmake gettext-runtime \
+ gssapi:bootstrap,mit libtool:build localbase \
+ perl5 pkgconfig ssl
+USE_CSTD= gnu99
+USE_LDCONFIG= yes
+USE_PERL5= build
+GNU_CONFIGURE= yes
+CONFIGURE_ARGS?= --enable-shared --without-system-verto \
+ --disable-rpath
+GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
+CONFIGURE_ENV= INSTALL="${INSTALL}" INSTALL_LIB="${INSTALL_LIB}" YACC="${YACC}"
+MAKE_ARGS= INSTALL="${INSTALL}" INSTALL_LIB="${INSTALL_LIB}"
+
+CPE_VENDOR= mit
+CPE_VERSION= 5-${PORTVERSION}
+CPE_PRODUCT= kerberos
+
+FLAVORS= default ldap
+
+OPTIONS_DEFINE= EXAMPLES NLS DOCS DNS_FOR_REALM LDAP LMDB
+OPTIONS_DEFAULT= DOCS READLINE
+OPTIONS_RADIO= CMD_LINE_EDITING
+OPTIONS_RADIO_CMD_LINE_EDITING= READLINE LIBEDIT LIBEDIT_BASE
+CMD_LINE_EDITING_DESC= Command line editing for kadmin and ktutil
+DNS_FOR_REALM_DESC= Enable DNS lookups for Kerberos realm names
+DNS_FOR_REALM_CONFIGURE_ENABLE= dns-for-realm
+LDAP= Enable LDAP support
+LDAP_USES= ldap
+LDAP_CONFIGURE_WITH= ldap
+LMDB_DESC= OpenLDAP Lightning Memory-Mapped Database support
+LMDB_CONFIGURE_WITH= lmdb
+LMDB_LIB_DEPENDS= liblmdb.so:databases/lmdb
+LMDB_IMPLIES= LDAP
+NLS_USES= gettext
+NLS_CONFIGURE_OFF= --disable-nls
+READLINE_USES= readline
+READLINE_CONFIGURE_WITH=readline
+LIBEDIT_USES= libedit
+LIBEDIT_CONFIGURE_WITH= libedit
+LIBEDIT_BASE_CONFIGURE_WITH= libedit
+LIBEDIT_BASE_DESC= Use libedit in FreeBSD base
+
+.if ${FLAVOR:U} == ldap
+OPTIONS_DEFAULT+= LDAP LMDB
+.endif
+
+.if defined(KRB5_HOME)
+PREFIX= ${KRB5_HOME}
+.endif
+.if !defined(KRB5_LOCALSTATEDIR)
+KRB5_LOCALSTATEDIR= "${PREFIX}/var"
+.endif
+.if !defined(KRB5_RUNSTATEDIR)
+KRB5_RUNSTATEDIR= "${PREFIX}/var/run"
+.endif
+CONFIGURE_ARGS+= --runstatedir="${KRB5_RUNSTATEDIR}"
+CONFIGURE_ARGS+= --localstatedir="${KRB5_LOCALSTATEDIR}"
+PLIST_SUB+= KRB5_LOCALSTATEDIR=${KRB5_LOCALSTATEDIR}
+PLIST_SUB+= KRB5_RUNSTATEDIR=${KRB5_RUNSTATEDIR}
+CPPFLAGS+= -I${OPENSSLINC}
+LDFLAGS+= -L${OPENSSLLIB}
+
+USE_RC_SUBR= kpropd
+OPTIONS_SUB= yes
+WRKSRC_SUBDIR= src
+PORTEXAMPLES= kdc.conf krb5.conf services.append
+
+.include <bsd.port.options.mk>
+
+# Fix up -Wl,-rpath in LDFLAGS
+.if !empty(KRB5_HOME)
+_RPATH= ${KRB5_HOME}/lib:
+.else
+_RPATH= ${LOCALBASE}/lib:
+.endif
+.if !empty(LDFLAGS:M-Wl,-rpath,*)
+.for F in ${LDFLAGS:M-Wl,-rpath,*}
+LDFLAGS:= -Wl,-rpath,${_RPATH}${F:S/-Wl,-rpath,//} \
+ ${LDFLAGS:N-Wl,-rpath,*}
+.endfor
+.endif
+
+.if defined(KRB5_HOME) && ${KRB5_HOME} != ${LOCALBASE}
+BROKEN= LIB_DEPENDS when using KRB5_HOME is broken
+.endif
+
+.if defined(PROGRAM_TRANSFORM_NAME) && ${PROGRAM_TRANSFORM_NAME} != ""
+CONFIGURE_ARGS+= --program-transform-name="${PROGRAM_TRANSFORM_NAME}"
+.endif
+
+.include <bsd.port.pre.mk>
+
+post-install-DOCS-on:
+ @${MKDIR} ${STAGEDIR}${PREFIX}/share/doc/krb5
+ cd ${WRKDIR}/${PORTNAME}-${PORTVERSION}; \
+ pdf_files=`${FIND} doc/pdf ! -type d`; \
+ pdf_dirs=`${FIND} doc/pdf -type d`; \
+ for i in $${pdf_dirs}; do \
+ ${MKDIR} ${STAGEDIR}${PREFIX}/share/doc/krb5/$${i}; \
+ done; \
+ for i in $${pdf_files}; do \
+ ${INSTALL_DATA} $${i} ${STAGEDIR}${PREFIX}/share/doc/krb5/$${i}; \
+ ${ECHO_CMD} share/doc/krb5/$${i} >> ${TMPPLIST}; \
+ done
+ for i in $${pdf_dirs}; do \
+ ${ECHO_CMD} @dir share/doc/krb5/$${i} >> ${TMPPLIST}; \
+ done | ${TAIL} -r >> ${TMPPLIST}
+ cd ${WRKDIR}/${PORTNAME}-${PORTVERSION}; \
+ html_files=`${FIND} doc/html ! -type d | ${GREP} -v /_sources`; \
+ html_dirs=`${FIND} doc/html -type d | ${GREP} -v /_sources`; \
+ for i in $${html_dirs}; do \
+ ${MKDIR} ${STAGEDIR}${PREFIX}/share/doc/krb5/$${i}; \
+ done; \
+ for i in $${html_files}; do \
+ ${INSTALL_DATA} $${i} ${STAGEDIR}${PREFIX}/share/doc/krb5/$${i}; \
+ ${ECHO_CMD} share/doc/krb5/$${i} >> ${TMPPLIST}; \
+ done
+ for i in $${html_dirs}; do \
+ ${ECHO_CMD} @dir share/doc/krb5/$${i} >> ${TMPPLIST}; \
+ done | ${TAIL} -r >> ${TMPPLIST}
+ ${ECHO_CMD} @dir share/doc/krb5 >> ${TMPPLIST}
+
+post-install-LDAP-on:
+ ${MKDIR} ${STAGEDIR}${DATADIR}
+ ${INSTALL_DATA} ${WRKSRC}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema \
+ ${STAGEDIR}${DATADIR}
+ ${INSTALL_DATA} ${WRKSRC}/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif \
+ ${STAGEDIR}${DATADIR}
+
+.include <bsd.port.post.mk>
diff --git a/security/krb5-122/distinfo b/security/krb5-122/distinfo
new file mode 100644
index 000000000000..fba29315a391
--- /dev/null
+++ b/security/krb5-122/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1754462805
+SHA256 (krb5-1.22.tar.gz) = 652be617b4647f3c5dcac21547d47c7097101aad4e306f1778fb48e17b220ba3
+SIZE (krb5-1.22.tar.gz) = 8749616
diff --git a/security/krb5-122/files/kdc.in b/security/krb5-122/files/kdc.in
new file mode 100644
index 000000000000..d462d45d47f6
--- /dev/null
+++ b/security/krb5-122/files/kdc.in
@@ -0,0 +1,4 @@
+#!/bin/sh -
+
+set -- $(echo "$*" | sed 's/--detach//')
+exec %%PREFIX%%/sbin/krb5kdc "$@"
diff --git a/security/krb5-122/files/kpropd.in b/security/krb5-122/files/kpropd.in
new file mode 100644
index 000000000000..d2147af059d7
--- /dev/null
+++ b/security/krb5-122/files/kpropd.in
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# PROVIDE: kpropd
+# REQUIRE: LOGIN
+# KEYWORD: shutdown
+#
+# Add the following lines to /etc/rc.conf.local or /etc/rc.conf
+# to enable this service:
+#
+# kpropd_enable (bool): Set to NO by default.
+# Set it to YES to enable kpropd.
+# kpropd_flags (str): Set to "" by default.
+
+. /etc/rc.subr
+
+name=kpropd
+rcvar=kpropd_enable
+
+load_rc_config $name
+
+: ${kpropd_enable:="NO"}
+: ${kpropd_flags=""}
+
+command=%%PREFIX%%/sbin/${name}
+
+run_rc_command "$1"
diff --git a/security/krb5-122/files/patch-clients__ksu__Makefile.in b/security/krb5-122/files/patch-clients__ksu__Makefile.in
new file mode 100644
index 000000000000..3544db84fc2c
--- /dev/null
+++ b/security/krb5-122/files/patch-clients__ksu__Makefile.in
@@ -0,0 +1,18 @@
+--- clients/ksu/Makefile.in.orig 2019-05-21 14:09:23.000000000 -0700
++++ clients/ksu/Makefile.in 2019-05-21 20:30:48.612847000 -0700
+@@ -1,6 +1,6 @@
+ mydir=clients$(S)ksu
+ BUILDTOP=$(REL)..$(S)..
+-DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
++DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/sbin /bin /usr/sbin /usr/bin"' -DDEBUG
+
+ KSU_LIBS=@KSU_LIBS@
+
+@@ -30,6 +30,6 @@
+
+ install:
+ -for f in ksu; do \
+- $(INSTALL_SETUID) $$f \
++ $(INSTALL_PROGRAM) $$f \
+ $(DESTDIR)$(CLIENT_BINDIR)/`echo $$f|sed '$(transform)'`; \
+ done
diff --git a/security/krb5-122/files/patch-config__pre.in b/security/krb5-122/files/patch-config__pre.in
new file mode 100644
index 000000000000..8527c550dc25
--- /dev/null
+++ b/security/krb5-122/files/patch-config__pre.in
@@ -0,0 +1,23 @@
+--- config/pre.in.orig 2014-10-15 16:55:10.000000000 -0700
++++ config/pre.in 2015-02-04 12:43:45.693875606 -0800
+@@ -178,9 +178,9 @@
+ INSTALL=@INSTALL@
+ INSTALL_STRIP=
+ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
+-INSTALL_SCRIPT=@INSTALL_PROGRAM@
++INSTALL_SCRIPT=@INSTALL_SCRIPT@
+ INSTALL_DATA=@INSTALL_DATA@
+-INSTALL_SHLIB=@INSTALL_SHLIB@
++INSTALL_SHLIB=$(INSTALL_LIB)
+ INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
+ ## This is needed because autoconf will sometimes define @exec_prefix@ to be
+ ## ${prefix}.
+@@ -197,7 +197,7 @@
+ ADMIN_BINDIR = @sbindir@
+ SERVER_BINDIR = @sbindir@
+ CLIENT_BINDIR =@bindir@
+-PKGCONFIG_DIR = @libdir@/pkgconfig
++PKGCONFIG_DIR = $(prefix)/libdata/pkgconfig
+ ADMIN_MANDIR = $(KRB5MANROOT)/man8
+ SERVER_MANDIR = $(KRB5MANROOT)/man8
+ CLIENT_MANDIR = $(KRB5MANROOT)/man1
diff --git a/security/krb5-122/files/patch-config__shlib.conf b/security/krb5-122/files/patch-config__shlib.conf
new file mode 100644
index 000000000000..6761ad7ef35c
--- /dev/null
+++ b/security/krb5-122/files/patch-config__shlib.conf
@@ -0,0 +1,22 @@
+--- config/shlib.conf.orig 2025-08-05 07:15:15.000000000 -0700
++++ config/shlib.conf 2025-08-06 00:01:20.148882000 -0700
+@@ -168,14 +168,15 @@
+ PICFLAGS=-fpic
+ ;;
+ esac
+- SHLIBVEXT='.so.$(LIBMAJOR)'
+- RPATH_FLAG='-Wl,--enable-new-dtags -Wl,-rpath -Wl,'
++ SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)'
++ SHLIBSEXT='.so.$(LIBMAJOR)'
++ LDCOMBINE='libtool --tag=CC --mode=link cc -Xcompiler -shared -Wl,-soname=$(LIBPREFIX)$(LIBBASE)$(SHLIBVEXT)'
++ RPATH_FLAG='-Wl,-rpath -Wl,'
+ PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)'
+ CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)'
+ CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)'
+ SHLIBEXT=.so
+- LDCOMBINE='ld -Bshareable -z nodelete'
+- SHLIB_RPATH_FLAGS='--enable-new-dtags -rpath $(SHLIB_RDIRS)'
++ SHLIB_RPATH_FLAGS='-rpath $(SHLIB_RDIRS)'
+ SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
+ CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)'
+ CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)'
diff --git a/security/krb5-122/files/patch-configure.ac b/security/krb5-122/files/patch-configure.ac
new file mode 100644
index 000000000000..abbae0e771b3
--- /dev/null
+++ b/security/krb5-122/files/patch-configure.ac
@@ -0,0 +1,17 @@
+--- configure.ac.orig 2023-08-07 11:38:21.000000000 -0700
++++ configure.ac 2023-08-09 14:49:19.833149000 -0700
+@@ -1356,8 +1356,12 @@
+ AC_DEFINE([HAVE_LIBEDIT], 1, [Define if building with libedit.])
+ AC_MSG_NOTICE([Using libedit for readline support])
+ elif test "x$with_libedit" = xyes; then
+- # We were explicitly asked for libedit and couldn't find it.
+- AC_MSG_ERROR([Could not detect libedit with pkg-config])
++ AC_MSG_NOTICE([Using libedit in FreeBSD base])
++ AC_CHECK_LIB([edit], [main], :,
++ AC_MSG_ERROR([Could not detect libedit]))
++ AC_DEFINE([HAVE_LIBEDIT], 1, [Define if building with libedit.])
++ RL_CFLAGS=-DFreeBSD_BASE_EDITLINE
++ RL_LIBS='-ledit'
+ else
+ AC_MSG_NOTICE([Not using any readline support])
+ fi
diff --git a/security/krb5-122/files/patch-lib-krb5-os-localaddr.c b/security/krb5-122/files/patch-lib-krb5-os-localaddr.c
new file mode 100644
index 000000000000..06b6043f22c9
--- /dev/null
+++ b/security/krb5-122/files/patch-lib-krb5-os-localaddr.c
@@ -0,0 +1,75 @@
+--- lib/krb5/os/localaddr.c.orig 2009-10-30 20:17:27.000000000 -0700
++++ lib/krb5/os/localaddr.c 2010-04-19 12:39:56.707090973 -0700
+@@ -175,6 +175,7 @@
+ }
+ #endif
+
++#if 0
+ static int
+ is_loopback_address(struct sockaddr *sa)
+ {
+@@ -191,6 +192,7 @@
+ return 0;
+ }
+ }
++#endif
+
+ #ifdef HAVE_IFADDRS_H
+ #include <ifaddrs.h>
+@@ -467,12 +469,14 @@
+ ifp->ifa_flags &= ~IFF_UP;
+ continue;
+ }
++#if 0
+ if (is_loopback_address(ifp->ifa_addr)) {
+ /* Pretend it's not up, so the second pass will skip
+ it. */
+ ifp->ifa_flags &= ~IFF_UP;
+ continue;
+ }
++#endif
+ /* If this address is a duplicate, punt. */
+ match = 0;
+ for (ifp2 = ifp_head; ifp2 && ifp2 != ifp; ifp2 = ifp2->ifa_next) {
+@@ -601,11 +605,13 @@
+ }
+ /*@=moduncon@*/
+
++#if 0
+ /* None of the current callers want loopback addresses. */
+ if (is_loopback_address((struct sockaddr *)&lifr->lifr_addr)) {
+ Tprintf ((" loopback\n"));
+ goto skip;
+ }
++#endif
+ /* Ignore interfaces that are down. */
+ if ((lifreq.lifr_flags & IFF_UP) == 0) {
+ Tprintf ((" down\n"));
+@@ -772,11 +778,13 @@
+ }
+ /*@=moduncon@*/
+
++#if 0
+ /* None of the current callers want loopback addresses. */
+ if (is_loopback_address(&lifr->iflr_addr)) {
+ Tprintf ((" loopback\n"));
+ goto skip;
+ }
++#endif
+ /* Ignore interfaces that are down. */
+ if ((lifreq.iflr_flags & IFF_UP) == 0) {
+ Tprintf ((" down\n"));
+@@ -987,11 +995,13 @@
+ }
+ /*@=moduncon@*/
+
++#if 0
+ /* None of the current callers want loopback addresses. */
+ if (is_loopback_address(&ifreq.ifr_addr)) {
+ Tprintf ((" loopback\n"));
+ goto skip;
+ }
++#endif
+ /* Ignore interfaces that are down. */
+ if ((ifreq.ifr_flags & IFF_UP) == 0) {
+ Tprintf ((" down\n"));
diff --git a/security/krb5-122/files/patch-lib__gssapi__krb5__import_name.c b/security/krb5-122/files/patch-lib__gssapi__krb5__import_name.c
new file mode 100644
index 000000000000..40f116af2196
--- /dev/null
+++ b/security/krb5-122/files/patch-lib__gssapi__krb5__import_name.c
@@ -0,0 +1,14 @@
+--- lib/gssapi/krb5/import_name.c.orig Mon Jul 18 15:12:42 2005
++++ lib/gssapi/krb5/import_name.c Tue Nov 8 09:53:58 2005
+@@ -33,6 +33,11 @@
+ #endif
+ #endif
+
++#include <sys/param.h>
++#if __FreeBSD_version < 500100
++#include <stdio.h>
++#endif
++
+ #ifdef HAVE_STRING_H
+ #include <string.h>
+ #else
diff --git a/security/krb5-122/files/patch-lib_krad_packet.c b/security/krb5-122/files/patch-lib_krad_packet.c
new file mode 100644
index 000000000000..2668d9121524
--- /dev/null
+++ b/security/krb5-122/files/patch-lib_krad_packet.c
@@ -0,0 +1,12 @@
+--- lib/krad/packet.c.orig 2025-08-05 07:15:15.000000000 -0700
++++ lib/krad/packet.c 2025-08-06 00:16:54.383533000 -0700
+@@ -477,6 +477,9 @@
+ krb5_error_code retval;
+
+ msgauth = krad_packet_get_attr(pkt, KRAD_ATTR_MESSAGE_AUTHENTICATOR, 0);
++/* XXX ENODATA does not exist in FreeBSD. The closest thing we have to */
++/* XXX ENODATA is ENOATTR. We use that instead. */
++#define ENODATA ENOATTR
+ if (msgauth == NULL)
+ return ENODATA;
+
diff --git a/security/krb5-122/files/patch-plugins_preauth_pkinit_pkinit__crypto__openssl.c b/security/krb5-122/files/patch-plugins_preauth_pkinit_pkinit__crypto__openssl.c
new file mode 100644
index 000000000000..71d27a31b406
--- /dev/null
+++ b/security/krb5-122/files/patch-plugins_preauth_pkinit_pkinit__crypto__openssl.c
@@ -0,0 +1,43 @@
+--- plugins/preauth/pkinit/pkinit_crypto_openssl.c.orig 2022-10-17 09:52:43 UTC
++++ plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -184,6 +184,17 @@ pkcs11err(int err);
+ (*_x509_pp) = PKCS7_cert_from_signer_info(_p7,_si)
+ #endif
+
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
++
++/*
++ * 1.1 adds DHX support, which uses the RFC 3279 DomainParameters encoding we
++ * need for PKINIT. For 1.0 we must use the original DH type when creating
++ * EVP_PKEY objects.
++ */
++#define EVP_PKEY_DHX EVP_PKEY_DH
++#define d2i_DHxparams d2i_DHparams
++#endif
++
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L
+
+ /* 1.1 standardizes constructor and destructor names, renaming
+@@ -193,13 +204,6 @@ pkcs11err(int err);
+ #define EVP_MD_CTX_free EVP_MD_CTX_destroy
+ #define ASN1_STRING_get0_data ASN1_STRING_data
+
+-/*
+- * 1.1 adds DHX support, which uses the RFC 3279 DomainParameters encoding we
+- * need for PKINIT. For 1.0 we must use the original DH type when creating
+- * EVP_PKEY objects.
+- */
+-#define EVP_PKEY_DHX EVP_PKEY_DH
+-
+ /* 1.1 makes many handle types opaque and adds accessors. Add compatibility
+ * versions of the new accessors we use for pre-1.1. */
+
+@@ -588,7 +592,7 @@ set_padded_derivation(EVP_PKEY_CTX *ctx)
+ {
+ EVP_PKEY_CTX_set_dh_pad(ctx, 1);
+ }
+-#elif OPENSSL_VERSION_NUMBER >= 0x10100000L
++#elif OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+ static void
+ set_padded_derivation(EVP_PKEY_CTX *ctx)
+ {
diff --git a/security/krb5-122/files/patch-util_ss_listen.c b/security/krb5-122/files/patch-util_ss_listen.c
new file mode 100644
index 000000000000..127784b0e2c0
--- /dev/null
+++ b/security/krb5-122/files/patch-util_ss_listen.c
@@ -0,0 +1,14 @@
+--- util/ss/listen.c.orig 2023-08-07 11:38:21.000000000 -0700
++++ util/ss/listen.c 2023-08-09 13:09:30.816661000 -0700
+@@ -15,7 +15,11 @@
+ #include <sys/param.h>
+
+ #if defined(HAVE_LIBEDIT)
++#if defined(FreeBSD_BASE_EDITLINE)
++#include <edit/readline/readline.h>
++#else
+ #include <editline/readline.h>
++#endif
+ #elif defined(HAVE_READLINE)
+ #include <readline/readline.h>
+ #include <readline/history.h>
diff --git a/security/krb5-122/pkg-descr b/security/krb5-122/pkg-descr
new file mode 100644
index 000000000000..04d20cac8766
--- /dev/null
+++ b/security/krb5-122/pkg-descr
@@ -0,0 +1,22 @@
+Kerberos V5 is an authentication system developed at MIT.
+Abridged from the User Guide:
+ Under Kerberos, a client sends a request for a ticket to the
+ Key Distribution Center (KDC). The KDC creates a ticket-granting
+ ticket (TGT) for the client, encrypts it using the client's
+ password as the key, and sends the encrypted TGT back to the
+ client. The client then attempts to decrypt the TGT, using
+ its password. If the client successfully decrypts the TGT, it
+ keeps the decrypted TGT, which indicates proof of the client's
+ identity. The TGT permits the client to obtain additional tickets,
+ which give permission for specific services.
+ Since Kerberos negotiates authenticated, and optionally encrypted,
+ communications between two points anywhere on the internet, it
+ provides a layer of security that is not dependent on which side of a
+ firewall either client is on.
+ The Kerberos V5 package is designed to be easy to use. Most of the
+ commands are nearly identical to UNIX network programs you are already
+ used to. Kerberos V5 is a single-sign-on system, which means that you
+ have to type your password only once per session, and Kerberos does
+ the authenticating and encrypting transparently.
+
+Jacques Vidrine <n@nectar.com>
diff --git a/security/krb5-122/pkg-plist b/security/krb5-122/pkg-plist
new file mode 100644
index 000000000000..fd0774890425
--- /dev/null
+++ b/security/krb5-122/pkg-plist
@@ -0,0 +1,177 @@
+bin/compile_et
+bin/gss-client
+bin/k5srvutil
+bin/kadmin
+bin/kdestroy
+bin/kinit
+bin/klist
+bin/kpasswd
+bin/krb5-config
+@mode 04755
+@owner root
+@group wheel
+bin/ksu
+@mode
+@owner root
+@group wheel
+bin/kswitch
+bin/ktutil
+bin/kvno
+bin/sclient
+bin/sim_client
+bin/uuclient
+include/com_err.h
+include/gssapi.h
+include/gssapi/gssapi.h
+include/gssapi/gssapi_alloc.h
+include/gssapi/gssapi_ext.h
+include/gssapi/gssapi_generic.h
+include/gssapi/gssapi_krb5.h
+include/gssapi/mechglue.h
+include/gssrpc/auth.h
+include/gssrpc/auth_gss.h
+include/gssrpc/auth_gssapi.h
+include/gssrpc/auth_unix.h
+include/gssrpc/clnt.h
+include/gssrpc/netdb.h
+include/gssrpc/pmap_clnt.h
+include/gssrpc/pmap_prot.h
+include/gssrpc/pmap_rmt.h
+include/gssrpc/rename.h
+include/gssrpc/rpc.h
+include/gssrpc/rpc_msg.h
+include/gssrpc/svc.h
+include/gssrpc/svc_auth.h
+include/gssrpc/types.h
+include/gssrpc/xdr.h
+include/krad.h
+include/krb5.h
+include/krb5/ccselect_plugin.h
+include/krb5/clpreauth_plugin.h
+include/krb5/hostrealm_plugin.h
+include/krb5/kadm5_hook_plugin.h
+include/krb5/kdcpolicy_plugin.h
+include/krb5/kdcpreauth_plugin.h
+include/krb5/localauth_plugin.h
+include/krb5/krb5.h
+include/krb5/locate_plugin.h
+include/krb5/plugin.h
+include/krb5/pwqual_plugin.h
+include/kadm5/admin.h
+include/kadm5/chpass_util_strings.h
+include/krb5/kadm5_auth_plugin.h
+include/kadm5/kadm_err.h
+include/kdb.h
+include/krb5/certauth_plugin.h
+include/krb5/preauth_plugin.h
+include/profile.h
+include/verto-module.h
+include/verto.h
+lib/libcom_err.so
+lib/libcom_err.so.3
+lib/libcom_err.so.3.0
+lib/libgssapi_krb5.so
+lib/libgssapi_krb5.so.2
+lib/libgssapi_krb5.so.2.2
+lib/libgssrpc.so
+lib/libgssrpc.so.4
+lib/libgssrpc.so.4.2
+lib/libk5crypto.so
+lib/libk5crypto.so.3
+lib/libk5crypto.so.3.1
+lib/libkadm5clnt.so
+lib/libkadm5clnt_mit.so
+lib/libkadm5clnt_mit.so.12
+lib/libkadm5clnt_mit.so.12.0
+lib/libkadm5srv.so
+lib/libkadm5srv_mit.so
+lib/libkadm5srv_mit.so.12
+lib/libkadm5srv_mit.so.12.0
+lib/libkdb5.so
+lib/libkdb5.so.10
+lib/libkdb5.so.10.0
+lib/libkrb5.so
+lib/libkrb5.so.3
+lib/libkrb5.so.3.3
+lib/libkrb5support.so
+lib/libkrb5support.so.0
+lib/libkrb5support.so.0.1
+lib/krb5/plugins/kdb/db2.so
+%%LMDB%%lib/krb5/plugins/kdb/klmdb.so
+lib/krb5/plugins/tls/k5tls.so
+%%LDAP%%lib/krb5/plugins/kdb/kldap.so
+lib/krb5/plugins/preauth/otp.so
+lib/krb5/plugins/preauth/pkinit.so
+lib/krb5/plugins/preauth/spake.so
+lib/krb5/plugins/preauth/test.so
+%%LDAP%%lib/libkdb_ldap.so
+%%LDAP%%lib/libkdb_ldap.so.1
+%%LDAP%%lib/libkdb_ldap.so.1.0
+lib/libkrad.so
+lib/libkrad.so.0
+lib/libkrad.so.0.0
+lib/libverto.so
+lib/libverto.so.0
+lib/libverto.so.0.0
+libdata/pkgconfig/gssrpc.pc
+libdata/pkgconfig/kadm-client.pc
+libdata/pkgconfig/kadm-server.pc
+libdata/pkgconfig/kdb.pc
+libdata/pkgconfig/krb5-gssapi.pc
+libdata/pkgconfig/krb5.pc
+libdata/pkgconfig/mit-krb5-gssapi.pc
+libdata/pkgconfig/mit-krb5.pc
+share/man/man1/compile_et.1.gz
+share/man/man1/k5srvutil.1.gz
+share/man/man1/kadmin.1.gz
+share/man/man1/kdestroy.1.gz
+share/man/man1/kinit.1.gz
+share/man/man1/klist.1.gz
+share/man/man1/kpasswd.1.gz
+share/man/man1/krb5-config.1.gz
+share/man/man1/ksu.1.gz
+share/man/man1/kswitch.1.gz
+share/man/man1/ktutil.1.gz
+share/man/man1/kvno.1.gz
+share/man/man1/sclient.1.gz
+share/man/man5/.k5identity.5.gz
+share/man/man5/.k5login.5.gz
+share/man/man5/k5identity.5.gz
+share/man/man5/k5login.5.gz
+share/man/man5/kadm5.acl.5.gz
+share/man/man5/kdc.conf.5.gz
+share/man/man5/krb5.conf.5.gz
+share/man/man7/kerberos.7.gz
+share/man/man8/kadmin.local.8.gz
+share/man/man8/kadmind.8.gz
+share/man/man8/kdb5_ldap_util.8.gz
+share/man/man8/kdb5_util.8.gz
+share/man/man8/kprop.8.gz
+share/man/man8/kpropd.8.gz
+share/man/man8/kproplog.8.gz
+share/man/man8/krb5kdc.8.gz
+share/man/man8/sserver.8.gz
+sbin/gss-server
+sbin/kadmin.local
+sbin/kadmind
+%%LDAP%%sbin/kdb5_ldap_util
+sbin/kdb5_util
+sbin/kprop
+sbin/kpropd
+sbin/kproplog
+sbin/krb5-send-pr
+sbin/krb5kdc
+sbin/sim_server
+sbin/sserver
+sbin/uuserver
+share/et/et_c.awk
+share/et/et_h.awk
+%%NLS%%share/locale/de/LC_MESSAGES/mit-krb5.mo
+%%NLS%%share/locale/en_US/LC_MESSAGES/mit-krb5.mo
+%%NLS%%share/locale/ka/LC_MESSAGES/mit-krb5.mo
+%%LDAP%%share/krb5/kerberos.schema
+%%LDAP%%share/krb5/kerberos.ldif
+@dir lib/krb5/plugins/authdata
+@dir lib/krb5/plugins/libkrb5
+@dir %%KRB5_RUNSTATEDIR%%/krb5kdc
+@dir %%KRB5_LOCALSTATEDIR%%/krb5kdc
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-10 15:26:06 +0000