summaryrefslogtreecommitdiffstats
path: root/proxy/src
Commit message (Collapse)AuthorAgeFilesLines
* Use secure_getenv in client and mechglue modulegetenvSimo Sorce2013-11-204-3/+24
| | | | | | | | proxymehc.so may be used in setuid binaries so follow best security practices and use secure_getenv() if available. Fallback to poorman emulation when secure_getenv() is not available. Resolves: https://fedorahosted.org/gss-proxy/ticket/110
* creds: Allow admins to define only client credsSimo Sorce2013-11-161-1/+6
| | | | | When a service is configured with cred_usage = initiate it is ok to allow only client credentials to be defined.
* config: Do not modify const stringsSimo Sorce2013-11-161-1/+9
| | | | | Take a copy here, the option string is const and strtok_r() is not a safe function as it may change the string it manipulates.
* Add impersonation supportSimo Sorce2013-10-233-55/+165
| | | | | | | | | | | | | By setting the impersonate flag to true, the acquisition of credentials will be done using constrained delegation (s4uself + s4u2proxy). To work this needs MIT Kereberos 1.11.4 or later. Previous versions have a bug in the import_cred function that prevents the library from properly importing previously exported delegated credentials. Resolves: https://fedorahosted.org/gss-proxy/ticket/95 Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Move uid to name resolution in its own function.Simo Sorce2013-10-231-6/+19
| | | | Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add option to specify allowed usage.Simo Sorce2013-10-183-2/+32
| | | | | | | | | | Credentials can often be used both to accept and to initiate contexts. With this option admins can allow a specific usage only. This is to avoid allowing an unprivileged process to fool a remote client by allowing it to impersonate a server, when we only want to allow this service to use credentials to initiate contexts. Reviewed-by: Günther Deschner <gdeschner@redhat.com
* Allow arbitrary users to connect to a serviceSimo Sorce2013-10-1821-70/+89
| | | | | | | | | | | The rpc.gssd daemon is changing to fork and change uid to the unprivileged user it wants to authenticate, this means gssproxy needs to allow connection from any euid. When this is done though, the trusted flag needs to be dropped, if the connecting euid does not match the default trusted uid to prevent improper impersonation. Resolves: https://fedorahosted.org/gss-proxy/ticket/103 Reviewed-by: Günther Deschner <gdeschner@redhat.com
* Fix LOCAL_FIRST behaviorSimo Sorce2013-10-181-20/+19
| | | | | | | | | We were erroneously returning and never falling back if LOCAL_FIRST was selected. Correct also the remote first fallback flow. Resolves: https://fedorahosted.org/gss-proxy/ticket/105 Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Fix resource leak in gpm_accept_sec_context().Günther Deschner2013-10-151-8/+8
| | | | | | | Resolves Coverity CID #12027. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use right signedness for creds buffer.Günther Deschner2013-08-281-2/+2
| | | | | | | gp_export_creds_*() functions are using a arrays of int32_t values, however this array holds uids and gids which are unsigned integers. Signed-off-by: Günther Deschner <gdeschner@redhat.com>
* Fix selinux option checkSimo Sorce2013-08-261-1/+1
| | | | | | Found by coverity (CID 11894) Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add service match using SeLinux ContextSimo Sorce2013-07-025-13/+144
| | | | | | | | | | | | Using getpeercon we can know the elinux context of the process talking to gssproxy. Use this information as an optional additional filter to match processes to service definitions. If a selinux_context option with a full user;role;type context is specified into a service section, then the connecting process must also be running under the specified selinux context in order to be allowed to connect. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Coverity fixes.Simo Sorce2013-06-272-7/+9
| | | | | | | | | | | Fix a 4 coverity issues, ranging from memory leaks, to uninitialized variables, to potential NULL derefernce. Also a TOCTOU report that is in one of the accessory test scripts. The bug itself is not reallya TOCTOU, but the check done in the script is unecessary, so I just removed it. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Further improve debugging, mention servicename, socket and euid.Günther Deschner2013-06-241-1/+4
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Properly check socket for connection matching.Simo Sorce2013-06-211-3/+8
| | | | | | | | | We always need to chekc if the socket matches otherwise the worng service may be selected if a specific socket is being used but a service allowing the same euid is confgured to use the deault socket as well. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Use verbose ding-libs error reporting when config parsing failed.Günther Deschner2013-06-051-1/+9
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* gssproxy: report an error message on event loop failure.Günther Deschner2013-06-031-0/+2
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix realloc size in gp_get_cred_environment().Günther Deschner2013-05-221-2/+3
| | | | | | | | This fixes a segfault when no client_keytab is passed in via cred_store api. See https://fedorahosted.org/gss-proxy/ticket/85 for details. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Overwrite existing GSS_USE_PROXY variable in the server.Günther Deschner2013-05-161-1/+1
| | | | | | | This is required to make sure we never recurse into ourselves. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix socket error handling.Simo Sorce2013-05-161-44/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Grab the socket lock for the whole conversation. We need to keep the lock until the whole conversation is over. Otherwise we may have concurrency issues where communication gets intermixed and errors in one thread can cause a thread to hang. Here is what we observed: thread 1: grabs lock and send a request. thread 2: grabs lock and sends a request server: thread 2 request causes a fatal error and the server close the connection thread 2: grabs the lock and waits for a reply. thread 2: gets the error and returns to caller with it (connection is closed). thread 1: grabs the lock (which reopens the closed channel) and reads ... ... forever as the server has already killed all the previous state. 2. Fail immediately on short reads for the initial 4 byte length header. If the first 4 bytes do not come at once don't bother retrying. In 99.9% of the cases what we are witnessing here is a fatal error from the proxy that closed the socket. Reopening the scket cannot accomplish anything as the request sent down the channel is tied to the specific socket, so once the socket is closed there is no hope to ever get back a reply. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Fix secondary socket detection at runtime.Simo Sorce2013-05-161-1/+1
| | | | | | | | We were failing to find the right service as the test was reversed. It works with the default socket as it is not stored per service. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Disable gss_export_name_composite() for now.Günther Deschner2013-05-161-1/+3
| | | | | | | | | | We first need to fix our tests and implementation. Temporary workaround for: https://fedorahosted.org/gss-proxy/ticket/81 Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Neutralize gssi_export_name.Simo Sorce2013-05-161-22/+2
| | | | | | | | We do not want to generate an exported name buffer. Let's the mechglue code in MIT generate it for use from the display name. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Fix two memleaks in the configuration code.Günther Deschner2013-05-151-1/+2
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Don't forget to free gp_ini_context struct in load_config().Günther Deschner2013-05-151-0/+1
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use counter when freeing cred_store configuration.Günther Deschner2013-05-151-4/+11
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix typo in gssi_import_name_by_mech().Günther Deschner2013-05-151-2/+2
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix reallocation in gp_dinglibs_get_string_array().Günther Deschner2013-05-151-1/+1
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix unresolved symbol gp_boolean_is_true() in mechglue plugin.Günther Deschner2013-05-151-1/+0
| | | | | | | | At the same time, rename gp_common.c to gp_util.c to make it more visible there is no relation to gp_common.h. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make error message in read_config() more precise, we fail in that case.Günther Deschner2013-05-151-1/+1
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add --with-gpp-default-behavior configure switch.Günther Deschner2013-05-151-4/+5
| | | | | | | | Only LOCAL_ONLY,LOCAL_FIRST and REMOTE_FIRST allowed. REMOTE_ONLY is recognized but configure aborts as long as it is not supported. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use gp_boolean_is_true from interposer plugin's GSS_USE_PROXY check.Günther Deschner2013-04-261-1/+2
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make gp_boolean_is_true non-static.Günther Deschner2013-04-263-12/+13
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Rename option_is_set to gp_boolean_is_true.Günther Deschner2013-04-261-4/+4
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use const string in config functionsSimo Sorce2013-04-235-19/+19
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Make config functions return actual error codes.Simo Sorce2013-04-233-27/+43
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Convert gp_config_get_* to return an error.Günther Deschner2013-04-236-103/+204
| | | | | | | ENOENT is returned if no value is available. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add support for per-service socketsSimo Sorce2013-04-238-18/+124
| | | | | | | | This way different processes running as the same user can be configured as different servervices Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Treat credential store as opaquely as possible.Simo Sorce2013-04-232-69/+95
| | | | | | | | | | | | | The credential store design goal is to allow administrators to set arbitrary strings without additional applications knowledge. This allows extending the number of crdential types GSSAPI can be made to support without having to recompile applications to add explicit support. Only explicitly check for cred store values that ned special treatment and let admins decide what to put in cred_store. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Use mutivalued "cred_store" parameter, deprecate unused parameters.Günther Deschner2013-04-232-27/+36
| | | | | | | | | | | | | | | | The krb5_{ccache,keytab,client_keytab} parameters are replaced with a multivalued "cred_store" parameter instead. krb5_keytab = /etc/krb5.keytab becomes: cred_store = keytab:/etc/krb5.keytab Likewise for the "krb5_ccache" and "krb5_client_keytab" parameters. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Add gp_config_get_string_array() and an implementation in dinglibs backend.Günther Deschner2013-04-234-0/+104
| | | | | | | | | | | | | This call returns an allocated array of strings. It allows to return multiple values for a single parameter like: param = value1 param = value2 This cannot be supported with iniparser, so we have to remove iniparser support. Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix potential double-frees in load_services().Günther Deschner2013-04-231-6/+5
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix memory leak in gp_service_free().Günther Deschner2013-04-111-0/+1
| | | | | Signed-off-by: Günther Deschner <gdeschner@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Special case client_keytab for root userSimo Sorce2013-04-101-2/+7
| | | | | | | | Use /etc/krb5.keytab when nfsd service tries to acquire creds and no id is specified in desired_name. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Use new GSSAPI Credential Store APISimo Sorce2013-04-101-49/+22
| | | | | | | | | | This is the only thread safe way to pass in aribitrary values for all the bits of environment we want to use when doing impersonation within gss-proxy. Requires MIT version 1.12 for the client_keytab part to be operational. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add generic function to get creds defaultsSimo Sorce2013-04-101-21/+58
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Move string formatting in a separate functionSimo Sorce2013-04-101-57/+66
| | | | | | | This way it can be reused for keytab path names too Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Carefully process desired name based on serviceSimo Sorce2013-04-103-39/+36
| | | | | | | | | | | | In case the name type is GSS_C_NT_STRING_UID_NAME or GSS_NT_MACHINE_UID_NAME we want to be able to impersonate the user referenced by the uid. This is allowed exclusively for trusted services otherwise a generic unprivileged application would be allowed to impersonate any user if there are credentials available on the system or client keytabs installed. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Add krb5_client_keytab config optionSimo Sorce2013-04-102-0/+9
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
* Import names as remote name by default.Simo Sorce2013-04-101-14/+21
| | | | | | | | | | | Always use remote name by default, otherwise canonicalization will loose information about the original name, for example it will convert names of the special type GSS_C_NT_STRING_UID_NAME or GSS_NT_MACHINE_UID_NAME in a non reversible way and the proxy will not be a le to use them as intended (for impersonation by trusted services). Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Günther Deschner <gdeschner@redhat.com>
generated by cgit (git 2.34.1) at 2025-07-03 12:21:04 +0000