Re: Building the PKINIT plugin on Windows
Greg Hudson <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Message-ID | <[email protected]> |
On 10/8/20 8:00 PM, Ken Hornstein wrote: > So I think it > makes sense to see if MIT is interested in patches to get PKINIT built > on Windows, and what the best process would be for contributing such > patches. Yes. A pull request on github is the best way to contribute changes. > - "Minor" portability issues, like the use of unistd.h > - Changes need to be made to the build system to build the pkinit plugin > - A dependency on OpenSSL When I last looked into this, the OpenSSL dependency seemed to be the trickiest part. I didn't have any luck finding examples on github that didn't check OpenSSL binaries into the repository. So insight from Windows developers on this point would be the most useful from my perspective. That would also pave the way for k5tls (for MS-KKDCP support) and, less importantly, SPAKE support for the NIST curves. > - The use of dlopen()/dlsym to load a PKCS#11 library krb5int_open_plugin() and krb5int_get_plugin_sym() from libkrb5support should be helpful here. > - The lack of regcomp()/regex() on Windows It doesn't look like we have an existing facility to help here; we use regexps in the aname-to-localname part of libkrb5, but appear to just compile out that code on Windows. gnulib isn't an ideal dependency for us for licensing reasons. While I'm not fond of adding more C++ code to the tree than necessary, wrapping std::regexp might be an option. _______________________________________________ krbdev mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/krbdev