sssd.git/src/util/crypto, branch sudo

CRYPTO: Do not call NSS_Shutdown after every operation

2017-07-24T19:39:38+00:00

Calling setup and teardown on every encryption cases issues like the one
described in https://bugzilla.redhat.com/show_bug.cgi?id=1456151
eventually.

Similarly to other crypto functions, don't tear down NSS by calling
NSS_Shutdown. Let the OS reclaim the resources.

Resolves:
https://pagure.io/SSSD/sssd/issue/3424

Reviewed-by: Lukáš Slebodník

UTIL: Remove fcntl.h from util/util.h

2017-06-08T15:09:36+00:00

fcntl.h is not used directly by util/util.h. The header file fcntl.h
must be included in 49 files and after removing it from util.h it had to be
added only to 7 missing file which were using either directly syscall fcntl
or syscall open.

Reviewed-by: Fabiano Fidêncio

sss_crypto.h: include required headers

2016-12-19T22:22:26+00:00

So we do not depend on #include order.

Reviewed-by: Lukáš Slebodník

libcrypto: Check right value of CRYPTO_memcmp

2016-10-21T16:03:54+00:00

sss_decrypt failed even though should pass because
we were checking wrong value of CRYPTO_memcmp.
Nobody noticed that because there was not a unit test :-)

Reviewed-by: Christian Heimes

crypto: Port libcrypto code to openssl-1.1

2016-10-20T12:51:42+00:00

EVP_MD_CTX and EVP_CIPHER_CTX are opaque in openssl-1.1

Reviewed-by: Tomas Mraz

UTIL: Use sss_atomic_read_s in generate_csprng_buffer

2016-08-17T14:55:15+00:00

There was a bug in generate_csprng_buffer() where if we read the exact
amount of bytes from /dev/urandom, we would always return EIO. Instead,
let's reuse the existing code from sss_atomic_read_s() which fixes this
bug and reduces code duplication.

Reviewed-by: Lukáš Slebodník 
Reviewed-by: Fabiano Fidêncio

Secrets: Add encryption at rest

2016-06-29T19:46:52+00:00

Generates a master key file if it doesn't exist and encrypts secrets
using the master key contained in the file.

Reviewed-by: Jakub Hrozek

CRYPTO: Use unprefixed version of function stpncpy

2014-05-18T03:40:57+00:00

glibc contains two versions of finction stpncpy
sh-4.2$ nm --dynamic --defined-only /lib64/libc.so.6 | grep stpncpy
0000003ce1c89b00 i stpncpy
0000003ce1c89b00 i __stpncpy
0000003ce1d040a0 T __stpncpy_chk

We should use more portable version of stpncpy without prefix with underscores.

The function __stpncpy was used in initial veersion
e65c65fc710fa030bfb8319efc43fcdc9ce5a26f, which was based on
http://people.redhat.com/drepper/SHA-crypt.txt

Reviewed-by: Jakub Hrozek

CRYPTO: Fix access to uninitialized data

2014-04-28T20:14:23+00:00

The size of output buffer(obufsize) was longer than initialised data.
In calculation, uint32_t was used for length of the cryptotext,
but uint16_t was written into buffer. The end of buffer was not initialised
and it caused valgrind warning.

 Use of uninitialised value of size 8
    at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180)
    by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482)
    by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721)
    by 0x40208A: sss_base64_encode (nss_base64.c:47)
    by 0x403305: sss_password_encrypt (nss_obfuscate.c:358)

Reviewed-by: Jakub Hrozek

Update DEBUG* invocations to use new levels

2014-02-12T21:31:02+00:00

Use a script to update DEBUG* macro invocations, which use literal
numbers for levels, to use bitmask macros instead:

grep -rl --include '*.[hc]' DEBUG . |
    while read f; do
        mv "$f"{,.orig}
        perl -e 'use strict;
                 use File::Slurp;
                 my @map=qw"
                    SSSDBG_FATAL_FAILURE
                    SSSDBG_CRIT_FAILURE
                    SSSDBG_OP_FAILURE
                    SSSDBG_MINOR_FAILURE
                    SSSDBG_CONF_SETTINGS
                    SSSDBG_FUNC_DATA
                    SSSDBG_TRACE_FUNC
                    SSSDBG_TRACE_LIBS
                    SSSDBG_TRACE_INTERNAL
                    SSSDBG_TRACE_ALL
                 ";
                 my $text=read_file(\*STDIN);
                 my $repl;
                 $text=~s/
                            ^
                            (
                                .*
                                \b
                                (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM)
                                \s*
                                \(\s*
                            )(
                                [0-9]
                            )(
                                \s*,
                            )
                            (
                                \s*
                            )
                            (
                                .*
                            )
                            $
                         /
                            $repl = $1.$map[$3].$4.$5.$6,
                            length($repl) <= 80
                                ? $repl
                                : $1.$map[$3].$4."\n".(" " x length($1)).$6
                         /xmge;
                 print $text;
        ' < "$f.orig" > "$f"
        rm "$f.orig"
    done

Reviewed-by: Jakub Hrozek 
Reviewed-by: Stephen Gallagher 
Reviewed-by: Simo Sorce