sssd.git/src/util/crypto, branch sssctl

Fix minor spelling mistakes

2017-10-25T08:24:49+00:00

Merges: https://pagure.io/SSSD/sssd/pull-request/3556

Reviewed-by: Lukáš Slebodník

CRYPTO: Do not call NSS_Shutdown after every operation

2017-07-24T19:39:38+00:00

Calling setup and teardown on every encryption cases issues like the one
described in https://bugzilla.redhat.com/show_bug.cgi?id=1456151
eventually.

Similarly to other crypto functions, don't tear down NSS by calling
NSS_Shutdown. Let the OS reclaim the resources.

Resolves:
https://pagure.io/SSSD/sssd/issue/3424

Reviewed-by: Lukáš Slebodník

UTIL: Remove fcntl.h from util/util.h

2017-06-08T15:09:36+00:00

fcntl.h is not used directly by util/util.h. The header file fcntl.h
must be included in 49 files and after removing it from util.h it had to be
added only to 7 missing file which were using either directly syscall fcntl
or syscall open.

Reviewed-by: Fabiano Fidêncio

sss_crypto.h: include required headers

2016-12-19T22:22:26+00:00

So we do not depend on #include order.

Reviewed-by: Lukáš Slebodník

libcrypto: Check right value of CRYPTO_memcmp

2016-10-21T16:03:54+00:00

sss_decrypt failed even though should pass because
we were checking wrong value of CRYPTO_memcmp.
Nobody noticed that because there was not a unit test :-)

Reviewed-by: Christian Heimes

crypto: Port libcrypto code to openssl-1.1

2016-10-20T12:51:42+00:00

EVP_MD_CTX and EVP_CIPHER_CTX are opaque in openssl-1.1

Reviewed-by: Tomas Mraz

UTIL: Use sss_atomic_read_s in generate_csprng_buffer

2016-08-17T14:55:15+00:00

There was a bug in generate_csprng_buffer() where if we read the exact
amount of bytes from /dev/urandom, we would always return EIO. Instead,
let's reuse the existing code from sss_atomic_read_s() which fixes this
bug and reduces code duplication.

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Fabiano Fidêncio

Secrets: Add encryption at rest

2016-06-29T19:46:52+00:00

Generates a master key file if it doesn't exist and encrypts secrets
using the master key contained in the file.

Reviewed-by: Jakub Hrozek

CRYPTO: Use unprefixed version of function stpncpy

2014-05-18T03:40:57+00:00

glibc contains two versions of finction stpncpy
sh-4.2$ nm --dynamic --defined-only /lib64/libc.so.6 | grep stpncpy
0000003ce1c89b00 i stpncpy
0000003ce1c89b00 i __stpncpy
0000003ce1d040a0 T __stpncpy_chk

We should use more portable version of stpncpy without prefix with underscores.

The function __stpncpy was used in initial veersion
e65c65fc710fa030bfb8319efc43fcdc9ce5a26f, which was based on
http://people.redhat.com/drepper/SHA-crypt.txt

Reviewed-by: Jakub Hrozek

CRYPTO: Fix access to uninitialized data

2014-04-28T20:14:23+00:00

The size of output buffer(obufsize) was longer than initialised data.
In calculation, uint32_t was used for length of the cryptotext,
but uint16_t was written into buffer. The end of buffer was not initialised
and it caused valgrind warning.

 Use of uninitialised value of size 8
    at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180)
    by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482)
    by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721)
    by 0x40208A: sss_base64_encode (nss_base64.c:47)
    by 0x403305: sss_password_encrypt (nss_obfuscate.c:358)

Reviewed-by: Jakub Hrozek