gss-proxy.git/proxy/src, branch master-strerror

use strerror_r instead of strerror.

2013-11-21T15:31:19+00:00

Signed-off-by: Günther Deschner

use gp_strerror where strerror was used.

2013-11-21T15:31:19+00:00

Signed-off-by: Günther Deschner

util: add gp_strerror() function.

2013-11-21T15:31:19+00:00

Currently it only calls back into strerror().

Signed-off-by: Günther Deschner

Use secure_getenv in client and mechglue module

2013-11-21T12:48:25+00:00

proxymehc.so may be used in setuid binaries so follow best security
practices and use secure_getenv() if available.
Fallback to poorman emulation when secure_getenv() is not available.

Resolves: https://fedorahosted.org/gss-proxy/ticket/110

Reviewed-by: Günther Deschner

creds: Allow admins to define only client creds

2013-11-20T14:50:12+00:00

When a service is configured with cred_usage = initiate it is
ok to allow only client credentials to be defined.

Reviewed-by: Günther Deschner

config: Do not modify const strings

2013-11-20T14:48:45+00:00

Take a copy here, the option string is const and strtok_r() is not a safe
function as it may change the string it manipulates.

Reviewed-by: Günther Deschner

server: Implement flag filtering enforcement

2013-11-20T14:26:08+00:00

Resolves: https://fedorahosted.org/gss-proxy/ticket/109

Reviewed-by: Günther Deschner

config: Add code to source flag filters

2013-11-20T14:25:12+00:00

2 New configuration options are made available:
- filter_flags
- enforce_flags

Any GSS Flags listed in the filter_flags option is forcibly filtered
out before a gss_init_sec_context() call is invoked.
Any GSS Flags listed in the enforce_flags option is forcibly added
to the list of flags requested by a gss_init_sec_context() call is
invoked.

Flags can be either literals or numeric and must be preceded by the
sign + (to add to the list) or - (to remove from the list).

Resolves: https://fedorahosted.org/gss-proxy/ticket/109

Reviewed-by: Günther Deschner

Try impersonation even when a name is not provided

2013-11-20T13:37:03+00:00

In some cases a name may not be provided, still try to perform
impersonation if the service is configured that way.

Reviewed-by: Günther Deschner

Autoinitialize creds on init_sec_context

2013-11-20T13:36:57+00:00

If the remote client tries to initialize the context without first
acquiring credentials, try to acquire appropriate credentials if
the service allows it.

Reviewed-by: Günther Deschner