summaryrefslogtreecommitdiffstats
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
* wipHEADmasterGünther Deschner2014-03-051-0/+70
|
* Use preauth options when changing passwordGreg Hudson2014-03-031-12/+51
| | | | | | | | | | | If we try to change the password in rb5_get_init_creds_password, we must use all application-specified gic options which affect preauthentication when getting the kadmin/changepw ticket. Create a helper function make_chpw_options which copies the application's options, unsets the options we don't want, and sets options appropriate for a temporary ticket. ticket: 7868
* Fix install rule for gssapi_krb5.hGreg Hudson2014-02-281-1/+1
| | | | Revert r16428 now that gssapi_krb5.h is in the source tree.
* Fix two omissions in stdint.h changesGreg Hudson2014-02-261-0/+2
| | | | | | | | Since we no longer prefix an "#include <stdint.h>" in the gssapi.h preamble at build time, include it in gssapi.hin. Update util/gss/kernel-lib/Makefile.in to account for gssapi_krb5.h being in the source tree.
* Eliminate internal fixed-width type wrappersGreg Hudson2014-02-2622-96/+87
| | | | | Directly use stdint.h names for integer types in preference to the various internal names we have made up for them.
* Stop generating gssapi_krb5.hGreg Hudson2014-02-264-24/+18
| | | | | | | We started generating gssapi_krb5.h from gssapi_krb5.hin when we needed to use a 64-bit type for lucid contexts. Since we can now assume a standard name for 64-bit types, we can stop generating the header.
* Get rid of builtin AES uitypes.hGreg Hudson2014-02-2611-749/+612
| | | | | Remove uitypes.h and just include stdint.h; all we need from it is uint{8,16,32}_t.
* Assume <stdint.h> and fixed-width typesGreg Hudson2014-02-263-28/+4
| | | | | | | Make unconditional use of <stdint.h> and fixed-width types such as uint32_t. k5-plugin.h doesn't use any special integer types, so remove the conditional include block there. Nothing uses INT64_FMT/UINT64_FMT, so leave those out of k5-platform.h for now.
* Maintain complete ulog on iprop slavesGreg Hudson2014-02-201-75/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | Factor out most of ulog_add_update into a helper function named store_update, and make ulog_add_update just responsible for assigning a serial number and timestamp to the update before storing it. In ulog_replay, use store_update and ulog_finish_update to add each update to the ulog in addition to replaying it to the database. Don't use incr_ret->lastentry to set kdb_last_sno/kdb_last_time, since it will have been set properly by adding the individual updates; instead, just reinitialize the ulog on error. Slave ulogs use serial numbers provided from upstream, and thus do not always begin at serial number 1 after a header reset. As a result, we must: (A) in store_update, detect the first update (for which we must assign kdb_first_sno/kdb_first_time) by comparing kdb_num to 0, instead of by comparing the serial number to 1; (B) in store_update, detect that we are overwriting the first update by comparing kdb_num to ulogentries, instead of comparing the serial number to ulogentries; and (C) in ulog_map, detect that ulogentries changed by verifying the first and last serial number and timestamp against the actual ulog entries, rather than simply comparing kdb_last_sno to kdb_num. Based on code submitted by Richard Basch. ticket: 7855
* Simplify ulog_mapGreg Hudson2014-02-203-85/+19
| | | | | | | | | | | | | | | | | | | | Get rid of the caller parameter. The kproplog semantics (without -R) for mapping the ulog are simple and almost completely different from other users of the ulog, so implement them as a static helper in kproplog. With hierarchical iprop, kpropd will need the same semantics as FKCOMMAND and FKADMIND, which were already identical. Get rid of the db_args parameter, since ulog_map no longer opens the database after #7552. Remove an inoperative lseek() call when creating a new ulog file. Rename ulog_filesize to filesize and compute it from scratch each time we use it, for easier analysis. If kdb_hmagic is zero, init the ulog header but don't skip the rest of the function; it's possible that we need to expand the ulog file. Remove an unneeded conditional before calling extend_file_to for an existing ulog. ticket: 7855
* Lock around more ulog operationsGreg Hudson2014-02-203-44/+101
| | | | | | | | | | | | | | | Always lock the ulog when accessing it. We can currently get away with some laxness on iprop slaves because they are mostly synchronous, but hierarchical iprop will allow master and slave operations to take place concurrently, requiring more strict locking. Add new functions ulog_get_last and ulog_set_last, which access the ulog header with locking, and use them in kdb5_util and kpropd. Add locking to ulog_replay and ulog_init_header. ulog_lock and ulog_sync_header are no longer used outside of kdb_log.c after these changes, so make them static functions and remove the ulog_ prefix. Add an unlock_ulog function for clarity.
* Factor out ulog serial number status checkGreg Hudson2014-02-202-25/+58
| | | | | | | | | | | | | | | Add a new function ulog_get_sno_status, which checks a serial number and timestamp against the ulog for currency. Use it in kdb5_util dump and in ulog_get_entries. Adjust parse_iprop_header's contract in dump.c to better match the ulog_get_sno_status contract. This change causes some minor behavior differences. kadmind will check for an empty ulog unless the last serial number matches exactly, and will never set lastentry when returning UPDATE_FULL_RESYNC_NEEDED (which was pointless). kdb5_util dump will recognize a dump file as current if it exactly matches the last serial number, even if the ulog is empty; it will be more robust in the presence of non-monotonic clocks; and it will properly lock around the ulog access.
* Simplify iprop update locking and avoid deadlockGreg Hudson2014-02-202-138/+37
| | | | | | | | | | | | | Since we are no longer treating the update log like a journal (#7552), we don't need two-stage update logging. In kdb5.c, add an update log entry after each DB change in one step, without getting an explicit lock. In kdb_log.c, combine ulog_add_update with ulog_finish_update, and make ulog_add_update lock the ulog internally. This change avoids deadlock by removing the only cases where the ulog is locked before the DB. ticket: 7861
* Support referrals from Windows Server 2003Nate Rosenblum2014-02-181-3/+32
| | | | | | | | | | | | | | | | | Although RFC 6806 Section 7 requires servers to indicate a client referral in a WRONG_REALM message, Microsoft Windows Server 2003 returns this information in a message with error code PRINCIPAL_UNKNOWN. Failure to follow the referral in these messages prevents referral chasing in Windows Server 2003 forests. Detect referral messages of this type by checking for a non-empty client.realm field in the response, and activate the referral logic in these cases. [tlyu@mit.edu: style, comments, and commit message] ticket: 7856 (new) target_version: 1.12.2 tags: pullup
* Generate dependencies for t_stringattrGreg Hudson2014-02-122-1/+12
| | | | | When t_stringattr.c was introduced, it wasn't added to EXTRADEPSRCS, so no dependencies were created for it. Fix that now.
* Fix SAM-2 preauth when password argument is usedGreg Hudson2014-02-111-2/+3
| | | | | | | | | | | | | | | | sam2_process accesses gak_data to get the password, so that it can do string-to-key with the etype in the SAM-2 challenge. When #7642 changed gic_pwd.c to use struct gak_password instead of krb5_data, sam2_process wasn't altered to match. We don't see a problem when the password is read through the prompter (as with kinit), because the password winds up in the storage field at the beginning of the gak_password structure. But when a password is supplied as a parameter (as with ksu), the storage field is empty and we get the wrong answer from sam2_process. ticket: 7862 target_version: 1.12.2 tags: pullup
* Correctly get default realm in kdb5.cGreg Hudson2014-02-111-10/+13
| | | | | | | Call krb5_get_default_realm instead of directly accessing context->default_realm, to remove the requirement that krb5_get_default_realm or krb5_set_default_realm be used before krb5_db_open.
* Properly reflect MS krb5 mech in SPNEGO acceptorGreg Hudson2014-02-051-4/+4
| | | | | | | | | | | | | | | r25590 changed negotiate_mech() to return an alias into the acceptor's mech set, with the unfortunate side effect of transforming the erroneous Microsoft krb5 mech OID into the correct krb5 mech OID, meaning that we answer with a different OID than the requested one. Return an alias into the initiator's mech set instead, and store that in mech_set field the SPNEGO context. The acceptor code only uses mech_set to hold the allocated storage pointed into by internal_mech, so this change is safe. ticket: 7858 target_version: 1.12.2 tags: pullup
* Don't get KDB lock in ulog_get_entriesGreg Hudson2014-02-051-12/+0
| | | | | | | | ulog_get_entries does not access the KDB, only the ulog, so it does not need a KDB lock; its read lock on the ulog is sufficient to prevent logged updates from happening while it is running. There is no reason to serialize against unlogged KDB updates such as those performed by the KDC, as those do not affect the ulog.
* In kdb5_util load, init ulog closer to promoteGreg Hudson2014-02-051-6/+1
| | | | | | | Always map the ulog with FKCOMMAND, not FKLOAD which reinitializes the ulog. Don't reinitialize the ulog until just before calling krb5_db_promote(). Get rid of FKLOAD since it isn't needed any more; we can just call ulog_init_header() manually.
* Modernize iprop codeGreg Hudson2014-02-052-109/+92
| | | | | | | | | | | | | | | | | | | | * Don't use "extern" for kdb_log.h prototypes. * Avoid passing structures by value. * Avoid the need to cast the result of the INDEX macro, and use char * instead of unsigned long for pointer arithmetic. * Reorganize kdb_log.c so static helpers are at the top and don't use the "ulog_" prefix. * Get rid of ulog_finish_update_slave since it's more concise to open-code it in ulog_replay. * Get rid of ulog_delete_update. In krb5_db_delete_principal, just call ulog_add_update with kdb_deleted set in upd. * Modernize coding style of kproplog.c. Use k5memdup0 instead of snprintf in print_str to convert a byte range to a C string. Remove an unnecesary textdomain call; libkrb5 takes care of calling bindtextdomain in the library initializer. * Modernize coding style of kpropd.c and kprop.c. No functional changes.
* Check for unstable ulog in ulog_get_entriesGreg Hudson2014-01-301-6/+4
| | | | | | | | | | | | | If a process terminates in the middle of a logged database update, it will release its lock and leave the ulog in the KDB_UNSTABLE state. kadmind should notice this when it calls ulog_get_entries, but right now it only checks for the KDB_CORRUPT state (which is never set any more) and does not recover. Check for any state other than KDB_STABLE and recover by resetting the ulog and forcing full resyncs to slaves. ticket: 7853 (new) target_version: 1.12.2 tags: pullup
* Add test case for ulog serial number wrappingGreg Hudson2014-01-304-0/+117
| | | | | | | | | Add a unit test program named t_ulog. Make it map a ulog file, set up header state where kdb_last_sno is the last serial number, and then add an empty update. Check that the result is a ulog header with one update at serial number 1. ticket: 7839
* Reinitialize ulog when wrapping serial numberGreg Hudson2014-01-301-13/+8
| | | | | | | | | | | When we wrap the serial number, reinitialize the ulog so that kdb_num starts counting from 1, instead of leaving the ulog in a weird state where kdb_num == ulogentries but kdb_last_sno == 1 and the serial numbers in the circular array aren't necessarily contiguous. ticket: 7839 (new) target_version: 1.12.2 tags: pullup
* Fix gss_pseudo_random leak on zero length outputGreg Hudson2014-01-181-0/+3
| | | | | | | | | Nobody is likely to ever ask for zero bytes of output from gss_pseudo_random, but if they do, just return an empty buffer without allocating. Otherwise we leak memory because gss_release_buffer doesn't do anything to buffers with length 0. ticket: 7838 (new)
* Allow empty store in gss_acquire_cred_fromGreg Hudson2014-01-171-12/+0
| | | | | | | | | There is no reason to deny a zero-length cred store, so don't check for it in val_acq_cred_args or val_add_cred_args. ticket: 7836 (new) target_version: 1.12.2 tags: pullup
* Add rcache feature to gss_acquire_cred_fromSimo Sorce2014-01-172-13/+36
| | | | | | | | | | The "rcache" cred store entry can specify a replay cache type and name to be used with the credentials being acquired. [ghudson@mit.edu: split up, simplified, and altered to fit preparatory commits] ticket: 7819 (new)
* Clean up rcache if GSS krb5 acquire_cred failsGreg Hudson2014-01-171-0/+2
| | | | | | | | | The error handler in acquire_cred_context didn't release the rcache, which would cause it to leak if we failed after acquire_accept_cred. ticket: 7818 (new) target_version: 1.12.2 tags: pullup
* Clean up GSS krb5 acquire_accept_credGreg Hudson2014-01-171-22/+30
| | | | | | Use a cleanup handler instead of releasing kt in multiple error clauses. Wrap a long line and fix a comment with a missing word. Rewrap the function arguments to use fewer lines.
* Make rcache resolve functions take const char *Greg Hudson2014-01-171-2/+3
|
* Get time offsets for all keyring ccachesGreg Hudson2014-01-171-20/+23
| | | | | | | | | | Move the time offset lookup from krb5_krcc_resolve to make_cache, so that we fetch time offsets for caches created by krb5_krcc_ptcursor_next. ticket: 7820 target_version: 1.12.2 tags: pullup
* Don't produce context deletion token in krb5 mechGreg Hudson2014-01-131-15/+0
| | | | | | | | | RFCs 2743 and 4121 recommend that implementations produce empty tokens from gss_delete_sec_context, and trying to produce one can cause gss_delete_sec_context to fail on a partially established context. Patch from Tomas Kuthan. ticket: 7816 (new)
* Clean up AES-NI codeTom Yu2014-01-102-98/+2
| | | | | Items in .data other than shuffle_mask are unused; delete them. Delete the unused macro load_and_inc4. Move shuffle_mask to .rodata.
* Avoid text relocations in iaesx86.sTom Yu2014-01-101-2/+8
| | | | | | | | | | Use PC-relative addressing to avoid runtime text relocations on i386. Adapted patch from Nalin Dahyabhai. ticket: 7815 target_version: 1.12.1 tags: pullup
* Work around Linux session keyring write behaviorGreg Hudson2014-01-101-4/+24
| | | | | | | | | | | If the session keyring matches the user session keyring, write explicitly to the user session keyring. Otherwise the kernel might create a new session keyring for the process, making the resulting cache collection invisible to other processes. ticket: 7814 target_version: 1.12.1 tags: pullup
* Refactor krb5_string_to_keysalts()Tom Yu2014-01-081-115/+64
| | | | | | | | | Use various standard C library functions rather than rolling our own. Previous code spent many lines reimplementing realloc(), strpbrk(), strtok_r(), etc. Make a separate string_to_keysalt() parser for an individual keysalt pair, which for now is private and destructive.
* Make salt defaulting work for keysaltsTom Yu2014-01-064-6/+6
| | | | | | | | | | Make krb5_string_to_keysalts() default to only ":" as a key:salt separator character. Change most of its callers to pass NULL so they get the default separators. Adapted from a patch proposed by Jon Looney. ticket: 884
* Default to normal salt instead of "ignore"Tom Yu2014-01-061-1/+1
| | | | | | | | krb5_string_to_keysalts() treats an empty salt field as -1 ("ignore"), rather than as the normal salttype. Default to normal instead, so that omitting a salttype works as expected. ticket: 6042
* Mark AESNI files as not needing executable stacksGreg Hudson2014-01-032-0/+22
| | | | | | | | | | | | | | | Some Linux systems now come with facilities to mark the stack as non-executable, making it more difficult to exploit buffer overrun bugs. For this to work, object files built from assembly need a section added to note whether they require an executable stack. Patch from Dhiru Kholia with comments added. More information at: https://bugzilla.redhat.com/show_bug.cgi?id=1045699 https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart ticket: 7813 target_version: 1.12.1 tags: pullup
* Fix uninitialized warning in client_init.cGreg Hudson2013-12-211-0/+3
| | | | ticket: 7800
* Allow realm in kadm5_init service namesGreg Hudson2013-12-211-48/+48
| | | | | | | | | | | | | | | | | | | | Previously, if you passed a service name with a realm part to a kadm5_init function, you would get a KRB5_PARSE_MALFORMED error because the code would internally append its own '@realm' suffix before parsing the name. Fix this as follows: Change gic_iter so instead of producing a full service name, it produces a krb5_principal which is taken from the cred it acquires. Pass the client and full service name around as principals, rather than strings, and use the gss_nt_krb5_principal name type to import them in setup_gss(). Don't append a realm to the input service name; instead, pass the input service name directly to the gic functions (which do not need a realm in the service name and will ignore the realm if one is present). For the INIT_CREDS case, parse the input service name with KRB5_PRINCIPAL_PARSE_IGNORE_REALM and then set the realm. ticket: 7800
* Simplify libkadm5 client realm initializationGreg Hudson2013-12-211-47/+4
| | | | | | | | | | | The "realm" variable in init_any is used only to fill in the realm of the service principal in gic_iter(). The service principal realm should always be the realm we looked up config parameters for, so we can supply that realm to get_init_creds() unconditionally and eliminate the case where we use the client principal realm. Also get rid of an outdated comment and an #if 0 block we will never need again, and use SNPRINTF_OVERFLOW to check the snprintf result.
* make dependGreg Hudson2013-12-201-0/+11
|
* Avoid keyctl purge in keyring ccache testsGreg Hudson2013-12-201-14/+16
| | | | | | | | | keyctl purge was added in keyutils 1.5 (released in March 2011). Use keyctl unlink to clean up keys instead, as it is more universal. ticket: 7810 target_version: 1.12.1 tags: pullup
* Set an error message when keyring get_princ failsNalin Dahyabhai2013-12-201-0/+3
| | | | | | | | | | | | When attempting to use a keyring cache that doesn't exist, set an error message when we fail to read a principal name, as we do when we return the same error code when using a file ccache. [ghudson: removed unnecessary check for d->name nullity.] ticket: 7809 target_version: 1.12.1 tags: pullup
* Fix typo that broke 'make clean'Zhanna Tsitkov2013-12-201-1/+1
| | | | Missing $
* Add a test program for krb5_copy_contextGreg Hudson2013-12-182-1/+174
| | | | | | | | This test program isn't completely proof against the kind of mistakes we've made with krb5_copy_context in the past, but it at least exercises krb5_copy_context and can detect some kinds of bugs. ticket: 7807
* Fix krb5_copy_contextGreg Hudson2013-12-182-1/+16
| | | | | | | | | | | | | krb5_copy_context has been broken since 1.8 (it broke in r22456) because k5_copy_etypes crashes on null enctype lists. Subsequent additions to the context structure were not reflected in krb5_copy_context, creating double-free bugs. Make k5_copy_etypes handle null input and account for all new fields in krb5_copy_context. Reported by Arran Cudbard-Bell. ticket: 7807 (new) target_version: 1.12.1 tags: pullup
* Let SPNEGO display mechanism errorsSimo Sorce2013-12-181-8/+34
| | | | | | | | | | | | | | | To avoid potential recursion we use a thread local variable that tells us whether the ancestor was called via spnego_gss_display_name(). If we detect recursion, we assume that we returned a com_err code like ENOMEM and call error_message(); in the worst case that will result in an "Unknown error" message. [ghudson@mit.edu: Edited comments and commit message; removed an unneeded line of code.] ticket: 7045 target_version: 1.12.1 tags: pullup
* Remove unused krb5_context fieldsGreg Hudson2013-12-182-3/+0
| | | | | The vtbl and locate_fptrs fields were ostensibly related to the locate pluggable interface, but weren't actually used.
generated by cgit (git 2.34.1) at 2025-06-12 23:14:02 +0000