gss-proxy.git, branch strerror

Use gp_strerror() everywhere instead of strerror()

2013-11-21T17:14:36+00:00

Add Thread-safe implementation of strerror()

2013-11-21T17:10:00+00:00

Unfortunately strerror() is not thread safe so we have to juggle with
strerror_r() which is a can of worms as 2 incompatible implementations
are available depending on what is defined at compile time.

Try to do something sane.

Use secure_getenv in client and mechglue module

2013-11-21T12:48:25+00:00

proxymehc.so may be used in setuid binaries so follow best security
practices and use secure_getenv() if available.
Fallback to poorman emulation when secure_getenv() is not available.

Resolves: https://fedorahosted.org/gss-proxy/ticket/110

Reviewed-by: Günther Deschner

creds: Allow admins to define only client creds

2013-11-20T14:50:12+00:00

When a service is configured with cred_usage = initiate it is
ok to allow only client credentials to be defined.

Reviewed-by: Günther Deschner

config: Do not modify const strings

2013-11-20T14:48:45+00:00

Take a copy here, the option string is const and strtok_r() is not a safe
function as it may change the string it manipulates.

Reviewed-by: Günther Deschner

man: Describe new flag filtering/enforcing options

2013-11-20T14:26:13+00:00

Resolves: https://fedorahosted.org/gss-proxy/ticket/109

Reviewed-by: Günther Deschner

server: Implement flag filtering enforcement

2013-11-20T14:26:08+00:00

Resolves: https://fedorahosted.org/gss-proxy/ticket/109

Reviewed-by: Günther Deschner

config: Add code to source flag filters

2013-11-20T14:25:12+00:00

2 New configuration options are made available:
- filter_flags
- enforce_flags

Any GSS Flags listed in the filter_flags option is forcibly filtered
out before a gss_init_sec_context() call is invoked.
Any GSS Flags listed in the enforce_flags option is forcibly added
to the list of flags requested by a gss_init_sec_context() call is
invoked.

Flags can be either literals or numeric and must be preceded by the
sign + (to add to the list) or - (to remove from the list).

Resolves: https://fedorahosted.org/gss-proxy/ticket/109

Reviewed-by: Günther Deschner

Try impersonation even when a name is not provided

2013-11-20T13:37:03+00:00

In some cases a name may not be provided, still try to perform
impersonation if the service is configured that way.

Reviewed-by: Günther Deschner

Autoinitialize creds on init_sec_context

2013-11-20T13:36:57+00:00

If the remote client tries to initialize the context without first
acquiring credentials, try to acquire appropriate credentials if
the service allows it.

Reviewed-by: Günther Deschner