summaryrefslogtreecommitdiffstats
path: root/src/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Use system dictionary for db2 tests againGreg Hudson2014-02-191-4/+13
| | | | | | | | | | The built-in word list is not long enough for all of the libdb2 tests to run properly. Revert d21a86e47a7cda29225013e08d060095b94b2ee7 and go back to using the system dictionary if we find one. However, omit any lines from the chosen word list which contain non-alphabetical characters. ticket: 7860
* Use TAILQ macros instead of CIRCLEQ in libdb2Greg Hudson2014-02-192-27/+24
| | | | | | | | | The optimizer in gcc 4.8.1 (but not the current gcc head revision) breaks the queue.h CIRCLEQ macros, apparently due to an overzealous strict aliasing deduction. Use TAILQ macros in the libdb2 mpool code instead. ticket: 7860
* Don't use system dictionary files for DB2 testsGreg Hudson2014-02-111-8/+0
| | | | | | | | | The system dictionary may contain entries with punctuation, which can confuse the shell. It's more predictable to always use the word list from the source tree. ticket: 7860 status: open
* Move OTP sockets to KDC_RUN_DIRNathaniel McCallum2014-02-061-1/+1
| | | | | | | | | | | | Some system configurations expect Unix-domain sockets to live under /run or /var/run, and not other parts of /var where persistent application state lives. Define a new directory KDC_RUN_DIR using $runstatedir (new in autoconf 2.70, so fall back to $localstatedir/run if it's not set) and use that for the default socket path. [ghudson@mit.edu: commit message, otp.rst formatting fix] ticket: 7859 (new)
* Remove mentions of krb5-send-prTom Yu2014-01-151-2/+1
| | | | | | | | | | | | | | Start the process of deprecating krb5-send-pr. In practice, it causes frustration for some users, and free-form email is good enough for most bug reports. Continue to install krb5-send-pr for now, but plan to remove it from the tree in the future, probably replaced by a script that instructs the user to send email manually. ticket: 5566 target_version: 1.12.1 tags: pullup
* make dependTom Yu2013-12-104-34/+36
|
* Improve LDAP KDB initialization error messagesGreg Hudson2013-10-301-7/+7
| | | | | | | | | | | | | In krb5_ldap_initialize, don't just blat the LDAP error into the extended message; give an indication of which LDAP operation we were trying to do and show what parameters we gave to it. (Also, krb5_set_error_message can handle a null context argument, so don't bother to check before calling.) ticket: 7739 (new) target_version: 1.12 tags: pullup
* Use protocol error for PKINIT cert expiryGreg Hudson2013-10-171-1/+1
| | | | | | | | | | | If we fail to create a cert chain in cms_signeddata_create(), return KRB5KDC_ERR_PREAUTH_FAILED, which corresponds to a protocol code, rather than KRB5_PREAUTH_FAILED, which doesn't. This is also more consistent with other error clauses in the same function. ticket: 7718 (new) target_version: 1.12 tags: pullup
* Fix audit test module initializationGreg Hudson2013-10-051-2/+1
| | | | | | | | Check if the fopen result is NULL, not whether it's less than zero. ticket: 7713 (new) target_version: 1.12 tags: pullups
* KDC Audit infrastructure and plugin implementationZhanna Tsitkov2013-10-0414-0/+1702
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
* Use constant-time comparisons for checksumsGreg Hudson2013-10-032-5/+5
|
* Add hostrealm interface testsGreg Hudson2013-08-154-0/+234
| | | | | | | | | | Create a test module for the hostrealm interface, a harness to call the realm mapping functions and display their results, and a Python script to exercise the functionality of the interface and each module (except the dns module, which we cannot easily test since it relies on TXT records in the public DNS). ticket: 7687
* Don't ask empty responder questions in PKINITNalin Dahyabhai2013-07-221-0/+7
| | | | | | | | | When putting together the set of identity prompts for a responder challenge, if we don't need a PIN or password of some kind, don't ask an empty question. [ghudson@mit.edu: squashed commits, modified commit message, merged PKCS11 test with current Python script]
* Add the error to some PKINIT NSS debug messagesNalin Dahyabhai2013-07-171-10/+14
|
* Support PKINIT OpenSSL deferred identity promptingNalin Dahyabhai2013-07-171-55/+159
| | | | | | | | | | | | | | | | Add a password to the set of things that we can pass to a PEM password callback and the function we use for loading PKCS12 bundles. If we're meant to defer identity prompts, just store the name of the identity which we're loading. Otherwise, if we're passed a password, use it. Otherwise, use the prompter callback. Add a password to the set of things that we can pass to the function that we use for logging in to PKCS11 tokens, too, but if we're deferring identity prompts, just return the identity name without doing anything else. If not, and we're passed a password, use that. Otherwise, try to use the prompter callback to get one. ticket: 7680
* Support PKINIT NSS deferred identity promptingNalin Dahyabhai2013-07-171-60/+252
| | | | | | | | | | | | | | | | | | The password callback which we usually supply to NSS already gets a pointer to the pkinit_identity_crypto_context structure, but it needs to be passed the name of the identity for which it's being called. If it gets a name, and it's deferring prompting, just add the identity to the list of deferred identity prompts (the password callback wouldn't have been called if its result wasn't needed), and either return NULL (as an indication that we couldn't get a password) or an empty string (a value which we know is invalid) if that's handier. Otherwise, check for a password that's been stashed for its use for that identity, and return a copy of it if one's found. If none of that works, try to use the prompter callback to ask for the password. ticket: 7680
* Pass PKINIT identity prompts to the responder cbNalin Dahyabhai2013-07-172-19/+218
| | | | | | | | | | | | | | | | | Use the list of deferred identity prompts and warnings, which we have after calling pkinit_identity_initialize(), to build a list of questions to supply to responder callbacks. Before calling pkinit_identity_prompt() to actually load identities that are protected, save any passwords and PINs which a responder callback may have supplied. Because pkinit_client_prep_questions() can be called multiple times, and we don't want to try to load all of our identities each of those times, take some steps to ensure that we only call pkinit_identity_initialize() and pkinit_identity_prompt() once per request. ticket: 7680
* Make the PKINIT NSS path also check for NULL certsNalin Dahyabhai2013-07-171-1/+6
| | | | | When called to free identity information, do what the OpenSSL-based version does, and error out if the identity information is NULL.
* Use PKCS11_MODNAME for NSS PKINIT by defaultNalin Dahyabhai2013-07-171-0/+7
| | | | | Do what the OpenSSL-using code paths do, and load PKCS11_MODNAME if no module is specified when we're told to use a PKCS11 identity.
* Add support for PKINIT deferring identity promptsNalin Dahyabhai2013-07-176-0/+226
| | | | | | | | | | | Learn to manage a list of deferred identities, for which we want to prompt for passwords or PINs, in pkinit_identity_crypto_context structures, along with their associated token flags. These are opaque outside of pkinit_crypto_openssl and pkinit_crypto_nss, so both implementations need to provide wrapper functions that can be called from elsewhere in the module to populate and query the lists. ticket: 7680
* Split pkinit_identity_initialize into two phasesNalin Dahyabhai2013-07-177-15/+97
| | | | | | | | | | | Split part of pkinit_identity_initialize() into a second piece named pkinit_identity_prompt(). Have each piece pass a new boolean flag to crypto_load_certs() to indicate if it should defer prompting for a password/PIN for client identities that require one. If the flag isn't set, then crypto_load_certs() should attempt to use a responder-supplied value, or call the prompter if there isn't one. ticket: 7680
* Fix OTP KDC module get_string error handlingGreg Hudson2013-07-171-2/+4
| | | | | | If cb->get_string returns 0 with no result in otp_edata, make sure we set retval to avoid sending an empty OTP hint. If cb->get_string returns an error code in otp_verify, avoid masking that code.
* Avoid allocating zero key_data structuresGreg Hudson2013-07-151-1/+2
| | | | | | | | When we allocate space for an array of key_data structures, make sure we allocate at least one, so we don't spuriously fail on platforms where malloc(0) returns NULL. Where we use malloc, use k5calloc instead. Where we use krb5_db_alloc or realloc, just allocate an extra entry.
* Fix a leak when parsing PKINIT cert SANs with NSSNalin Dahyabhai2013-07-151-0/+1
| | | | | When retrieving the list of a certificate's subjectAltName values, we weren't freeing some of the temporary memory we used.
* Don't leak PKINIT CMS signed data certs and CRLsNalin Dahyabhai2013-07-151-2/+4
| | | | | | | | The stacks of certificates and CRLs that we retrieve from CMS objects include newly-owned references to the certificates and CRLs, so when we go to free them, we need to remember to free those. [ghudson@mit.edu: minor formatting change; removed unrelated style fix]
* Don't leak the reply key's memory during PKINITNalin Dahyabhai2013-07-151-1/+3
|
* Use k5calloc instead of k5alloc where appropriateGreg Hudson2013-07-113-12/+14
| | | | | Wherever we use k5alloc with a multiplication in the size parameter,, use the new k5calloc helper function instead.
* Add server-side otp preauth pluginNathaniel McCallum2013-07-116-0/+1145
| | | | | | | | | | This plugin implements the proposal for providing OTP support by proxying requests to RADIUS. Details can be found inside the provided documentation as well as on the project page. http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS ticket: 7678
* Fix uninitialized variable bugsGreg Hudson2013-06-271-0/+1
| | | | | The previous few commits introduced a couple of bugs where variables could be used without being initialized. Fix them.
* Add tests for pwqual modules and plugin orderingGreg Hudson2013-06-274-0/+260
| | | | | | | | | | Create a test module for the pwqual interface, and script to exercise the built-in and test modules through kadmin.local. Also create a test harness to display the order of pwqual modules for the current configuration, and use it to test the plugin module ordering guarantees. ticket: 7665
* Fix various warningsGreg Hudson2013-06-0711-53/+46
|
* Fix warnings in dbtest.cGilles Espinasse2013-05-311-20/+38
| | | | | | | | | Check return values of read() and write(). Avoid some unsigned comparisons. Cast a ptrdiff_t value to int for use with %d in a format string. [ghudson@mit.edu: rewrap long lines; fix one more warning; commit message]
* Link dbtest with libkrb5supportGreg Hudson2013-05-311-2/+2
| | | | | | | | In a static build, linking dbtest could fail on platforms where libdb2 depends on krb5support (platforms without a native mkstemp). Reported by Gilles Espinasse <g.esp@free.fr>. ticket: 7651
* Reduce boilerplate in makefilesGreg Hudson2013-05-1617-182/+4
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Assume mutex locking cannot failGreg Hudson2013-05-144-31/+13
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Fixes for leaking of refcounted resourcesNalin Dahyabhai2013-05-131-11/+22
| | | | | | | | | | | | | | | | Some fixes, some use of different APIs which seem to clean things up better, with the goal of being able to cleanly shut down NSS when we're done using it. * Use PK11_FreeSlot() instead of SECMOD_CloseUserDB() to close a database opened with SECMOD_OpenUserDB(). * Fix a typo and use PK11_DestroyGenericObject() instead of PK11_DestroyGenericObjects() to destroy one object. * Use SECMOD_DestroyModule() instead of SECMOD_UnloadUserModule() to close a module loaded with SECMOD_LoadUserModule(). * crypto_check_for_revocation_information(): don't leak a reference to the CRL, or to intermediate issuers. * Don't leak a reference to a PEM private key.
* In PKINIT NSS crypto, support encrypted PEM keysNalin Dahyabhai2013-05-131-0/+26
| | | | | | | | | | | | | When the PEM module is given an encrypted key, it changes its token flags to indicate that a password is required (by setting needs-login) to signal the application that we need to supply a password to decrypt it. Attempts to load any other items will fail until the flag is cleared. If we detect that the flag is set after we've attempted to load a private key, attempt to "log in" to the "token" using a password. Even if we fail, the token will reset its needs-login flag, which is necessary before we can import anything else.
* Get better at locating the just-loaded certificateNalin Dahyabhai2013-05-131-58/+35
| | | | | | When loading certificates using the PEM module, use a better method for finding the just-loaded certificate that will still work if we've already got a copy of the certificate loaded somewhere else.
* In PKINIT NSS crypto code, load certificates firstNalin Dahyabhai2013-05-131-61/+62
| | | | | | | | | | | | When using NSS's CMS API to generate signed-data messages, we identify the key that we want to use for signing by specifying a certificate. The library then looks up the corresponding private key when it needs to generate the signature. This lookup fails if a certificate and a its corresponding private key were loaded key-first, but succeeds if they were loaded certificate-first (RHBZ#859535). To work around this, switch to loading the certificate first. (We switch to using different _pkinit_identity_crypto_file pointers for each instead of reusing just one, so the diff is messier than it might have been.)
* When DEBUG=1, log why we fail to log in to a tokenNalin Dahyabhai2013-05-101-4/+6
| | | | | | Use PORT_ErrorToName() to let us print an error name instead of an error code in a couple of debug messages, since in practice we just end up looking up the code in <secerr.h> anyway.
* Traverse tokens like we do with OpenSSL for NSSNalin Dahyabhai2013-05-101-15/+14
| | | | | | | | When PKINIT is built with NSS, change how it traverses tokens to match the way it's done when built using OpenSSL: ignore slot names (we used to treat the token label as a possible slot label, too), and either only look at the token with the specified label, or the first token if a no token label was specified.
* Only call SEC_PKCS12DecoderFinish() onceNalin Dahyabhai2013-05-101-1/+0
| | | | | We already call SEC_PKCS12DecoderFinish() before entering the switch() statement, so don't call it again.
* Make the text of NSS's prompts look like OpenSSL'sNalin Dahyabhai2013-05-101-4/+8
| | | | | | | | When PKINIT is built with NSS, make the text of prompts that we issue to the user better match the text we use when we build with OpenSSL: ask for a pass phrase when we're asking about a hardware token, ask for a password the rest of the time, and take advantage of translations for requests for a password.
* Don't fail if a candidate certificate has no SANsNalin Dahyabhai2013-05-101-6/+2
| | | | | | | | When we're doing certificate matching and we're asked for the list of SAN values for a certifiate, and it contains none, don't return an error, as that will eventually cause the module to just return an error. Instead, just return an empty list of SAN values so that processing will continue on to check if other certificates match.
* Fix type mismatch in db2_exp.cGreg Hudson2013-05-101-1/+1
| | | | | | The locking wrapper for audit_as_req used the wrong function signature, which was harmless but produced a couple of warnings. Fix it.
* Improve LDAP password file error messagesGreg Hudson2013-05-081-2/+6
| | | | | | | If we cannot open the LDAP password file or cannot find the bind DN in it, include the filename and DN in the error message. ticket: 7632
* Make reassembled PKCS11 names parseableNalin Dahyabhai2013-05-082-10/+10
| | | | | | The reassembled names used "," as a separator between attributes, when passed-in values use ":". This was due to the original submitter being confused - they weren't intended to be different.
* Fix a typo that caused us to not skip removing "."Nalin Dahyabhai2013-05-081-1/+1
| | | | | | When attempting to clean the files out from our temporary directory, correct the test which was supposed to let us skip over "." and ".." so that we actually don't try to remove them with remove().
* Remove some apparently-accidental debug whitespaceNalin Dahyabhai2013-05-082-4/+4
|
* Use macro for IANA assigned PA-AS-CHECKSUM numberZhanna Tsitkov2013-04-182-4/+5
| | | | | Replace numeric value '132' by the macro KRB5_PADATA_AS_CHECKSUM in preauth plugin.
generated by cgit (git 2.34.1) at 2024-05-23 10:16:00 +0000