summaryrefslogtreecommitdiffstats
path: root/util
Commit message (Collapse)AuthorAgeFilesLines
* C compilation fixes and hardeningChristian Heimes2017-03-011-0/+1
| | | | | | | | | | | | | | | | Fix "implicit declaration of function ‘strlen’" in ipa_pwd_ntlm.c, credits to Lukas. Add -Werror=implicit-function-declaration to CFLAGS to point developers to missing includes. It causes compilation to fail when a developer forgets to add a required include. The problem is no longer hidden in a massive wall of text from make. Silence a harmless error from 389-DS slapi.h until the bug is fixed in downstream, https://pagure.io/389-ds-base/issue/48979 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add missing include of stdint.h for uint8_tChristian Heimes2017-02-221-0/+1
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa_pwd: remove unnecessary dependency on dirsrv pluginsLukas Slebodnik2017-02-222-1/+3
| | | | | | | | "dirsrv/slapi-plugin.h" is unnecessary for build of ipa_pwd. This patch allow us to move DIRSRV to daemon only dependencies Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Build: transform util directory to libutil convenience libraryPetr Spacek2016-10-241-0/+14
| | | | | | | | | | | | This is autoconf way of doing things. It should allow us to enable subdir-objects automake option and stay compatible with future versions of automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Migrate from #ifndef guards to #pragma onceNathaniel McCallum2016-05-293-11/+3
| | | | | | | | | | | | Using a pragma instead of guards is easier to write, less error prone and avoids name clashes (a source of very subtle bugs). This pragma is supported on almost all compilers, including all the compilers we care about: https://en.wikipedia.org/wiki/Pragma_once#Portability. This patch does not change the autogenerated files: asn1/asn1c/*.h. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add compatibility function for older libkrb5Simo Sorce2015-05-301-1/+60
| | | | | | | | | | | | | | Before krb5 1.13 the krb5_salttype_to_string() function was returning incorrect names (display names of some kind instead of the names used by the rest of the library to map saltname to the salt type integer number). This patch adds a function that checks at runtime if we have a working function and uses a fallback map updated to the salt types known up to 1.12, this allows us to use the library provided function in following releases where new salt types may emerge. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Milan Kubik <mkubik@redhat.com>
* Detect default encsalts kadmin password changeSimo Sorce2015-05-272-0/+87
| | | | | | | | | | | | | | | | | | | When kadmin tries to change a password it will get the allowed keysalts from the password policy. Failure to provide them will result in kadmin using the defaults specified in the kdc.conf file or hardcoded defaults (the default salt is then of type NORMAL). This patch provides the supported values that have been read out of the appropriate LDAP attribute when we read the server configuration. Then at actual password change, check if kadmin is handing us back the exact list of supported encsalts we sent it, and in that case replace it with the real default encsalts. Fixes https://fedorahosted.org/freeipa/ticket/4914 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Martin Babinsky <mbabinsk@redhat.com>
* Stop including the DES algorythm from openssl.Simo Sorce2015-02-231-1/+0
| | | | | | | | | Since we dropped support for LANMAN hashes we do not need DES from OpenSSL anymore. Stop including an testing for it. Test for the MD4 algorythm instead whichis still used for the NT Hashes. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Add a clear OpenSSL exception.Simo Sorce2015-02-231-0/+4
| | | | | | | | We are linking with OpenSSL in 2 files, so make it clear we intentionally add a GPLv3 exception to allow that linking by third parties. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipa-kdb: unexpected error code in 'ipa_kdb_audit_as_req' triggers a messageMartin Babinsky2015-01-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is related this defect reported by covscan on FreeIPA master: """ Error: DEADCODE (CWE-561): /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328353L", taking false branch. Now the value of "error_code" is equal to -1765328353. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328360L", taking false branch. Now the value of "error_code" is equal to -1765328360. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != 0", taking false branch. Now the value of "error_code" is equal to 0. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: intervals: When switching on "error_code", the value of "error_code" must be in one of the following intervals: {[-1765328360,-1765328360], [-1765328353,-1765328353], [0,0]}. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: dead_error_condition: The switch value "error_code" cannot reach the default case. /daemons/ipa-kdb/ipa_kdb_audit_as.c:123: dead_error_begin: Execution cannot reach this statement: "default:". """ This patch is a part of series related to https://fedorahosted.org/freeipa/ticket/4795. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix unchecked return value in krb5 common utilsJan Cholasta2014-11-251-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4713 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add asn1c generated code for keytab controlsSimo Sorce2014-11-201-0/+1
| | | | | | | | | | | | | | | | Instead of manually encoding controls, use an actual asn1 compiler. The file asn1/asn1c/ipa.asn1 will contain ipa modules. The generated code is committed to the tree and built into a static library that is linked to the code that uses it. The first module implements the GetKeytabControl control. Related: https://fedorahosted.org/freeipa/ticket/4718 https://fedorahosted.org/freeipa/ticket/4728 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipa-getkeytab: Add support for get_keytab extopSimo Sorce2014-06-262-55/+78
| | | | | | | | | | | | This new extended operation is tried by default and then the code falls back to the old method if it fails. The new method allows for server side password generation as well as retrieval of existing credentials w/o causing regeneration of keys on the server. Resolves: https://fedorahosted.org/freeipa/ticket/3859 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* keytab: Add new extended operation to get a keytab.Simo Sorce2014-06-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | This new extended operation allow to create new keys or retrieve existing ones. The new set of keys is returned as a ASN.1 structure similar to the one that is passed in by the 'set keytab' extended operation. Access to the operation is regulated through a new special ACI that allows 'retrieval' only if the user has access to an attribute named ipaProtectedOperation postfixed by the subtypes 'read_keys' and 'write_keys' to distinguish between creation and retrieval operation. For example for allowing retrieval by a specific user the following ACI is set on cn=accounts: (targetattr="ipaProtectedOperation;read_keys") ... ... userattr=ipaAllowedToPerform;read_keys#USERDN) This ACI matches only if the service object hosts a new attribute named ipaAllowedToPerform that holds the DN of the user attempting the operation. Resolves: https://fedorahosted.org/freeipa/ticket/3859 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* keytabs: Expose and modify key encoding functionSimo Sorce2014-06-261-3/+9
| | | | | | | | | | | Make it available outside of the encoding.c file for use in a follow-up patch. Add option to not pass a password and generate a random key instead. Related: https://fedorahosted.org/freeipa/ticket/3859 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Add support to ipa-kdb for keyless principalsNathaniel McCallum2014-02-191-0/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/3779 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* BUILD: Fix portability of NSS in file ipa_pwd.cLukas Slebodnik2014-01-281-4/+4
| | | | Tested-by: Timo Aaltonen <tjaalton@ubuntu.com>
* Remove generation and handling of LM hashesSumit Bose2013-11-012-169/+52
| | | | https://fedorahosted.org/freeipa/ticket/3795
* ipa-kdb: read SID blacklist from LDAPMartin Kosek2013-02-121-0/+32
| | | | | | | | | | | | SIDs in incoming MS-PAC were checked and filtered with a fixed list of well-known SIDs. Allow reading the SID blacklist from LDAP (ipaNTSIDBlacklistIncoming and ipaNTSIDBlacklistOutgoing) and add the list to mspac adtrust structure. Use the hardcoded SID list only if the LDAP SID list is not configured. LIMITATION: SID blacklist list is not used yet. https://fedorahosted.org/freeipa/ticket/3289
* Prevent integer overflow when setting krbPasswordExpirationTomas Babej2013-02-081-0/+3
| | | | | | | | | | | | | | | | Since in Kerberos V5 are used 32-bit unix timestamps, setting maxlife in pwpolicy to values such as 9999 days would cause integer overflow in krbPasswordExpiration attribute. This would result into unpredictable behaviour such as users not being able to log in after password expiration if password policy was changed (#3114) or new users not being able to log in at all (#3312). The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver. https://fedorahosted.org/freeipa/ticket/3312 https://fedorahosted.org/freeipa/ticket/3114
* Make encode_ntlm_keys() publicSumit Bose2012-09-063-0/+226
|
* Move code into common krb5 utilsSimo Sorce2012-07-302-0/+152
| | | | | | | | This moves the decoding function that reads the keys from the ber format into a structure in the common krb5 util code right below the function that encodes the same data structure into a ber format. This way the 2 functions are in the same place and can be both used by all ia components.
* Move some krb5 keys related functions from ipa-client to utilSumit Bose2012-06-112-0/+398
|
* Dereference pointer when comparing password history in qsort compare.Rob Crittenden2012-04-101-1/+1
| | | | | | | | | | | | The man page for qsort(3) says that the comparison function is called with pointers to pointers to char but memcmp(3) wants a pointer to void so we need to cast and dereference. Without this the qsort() call wasn't properly sorting the elements so a random password was being removed rather than the oldest when the list overflowed. https://fedorahosted.org/freeipa/ticket/2613
* ipa-kdb: add AS auditing supportSimo Sorce2012-02-141-0/+3
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/2334
* Improve password change error messageMartin Kosek2012-02-032-0/+26
| | | | | | | | | | | User always receives the same error message if he changes his password via "ipa passwd" command and the new password fails configured password policy. He then has to investigate on his own the actual reason why was the policy violated. This patch improves our SLAPI PWD plugins to provide a better error message explaining the violation reason. https://fedorahosted.org/freeipa/ticket/2067
* Add missing copyright headerSimo Sorce2011-11-171-0/+22
|
* Fix CID 11021: Resource leakSimo Sorce2011-11-071-1/+3
| | | | https://fedorahosted.org/freeipa/ticket/2037
* Amend #2038 fixSimo Sorce2011-11-051-3/+5
| | | | The math was unsafe, thanks to Nalin for spotting it.
* Modify random salt creation for interoperabilitySimo Sorce2011-11-041-8/+29
| | | | | See: https://fedorahosted.org/freeipa/ticket/2038
* util: add password policy manipulation functionsSimo Sorce2011-08-262-0/+699
|
* ipa-kdb: implement change_pwd functionSimo Sorce2011-08-262-0/+37
|
* ipa-pwd-extop: make encsalt parsing function commonSimo Sorce2011-08-262-0/+79
| | | | It is going to be used by the ipa-kdb module too.
* ipa-pwd-extop: Move encoding in common tooSimo Sorce2011-08-262-0/+124
| | | | Also to be used by ipa-kdb
* ipa-pwd-extop: Move encryption of keys in commonSimo Sorce2011-08-262-5/+235
| | | | This way we can reuse the same code from ipa-kdb later
* Use internal implementation of internal Kerberos functionsJakub Hrozek2010-11-222-0/+56
Don't use KRB5_PRIVATE. The patch implements and uses the following krb5 functions that are otherwise private in recent MIT Kerberos releases: * krb5_principal2salt_norealm * krb5_free_ktypes Signed-off-by: Simo Sorce <ssorce@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-27 11:39:05 +0000