summaryrefslogtreecommitdiffstats
path: root/proxy
Commit message (Collapse)AuthorAgeFilesLines
* Use t_utils.h in all tests.Simo Sorce2015-12-017-191/+63
| | | | | | | Avoid duplicating the same helper functions everywhere. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwoood <rharwood@redhat.com>
* Add acquire test and generally improve testsSimo Sorce2015-12-016-31/+261
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwoood <rharwood@redhat.com>
* Fix acquiring default credentialsSimo Sorce2015-12-011-1/+3
| | | | | | | | | In this case we want to prefer sourcing the "acceptor" credentials from a keytab if available, as that's what applications expect if they have no credentials. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwoood <rharwood@redhat.com>
* Add helpers to store and retrieve encrypted credsSimo Sorce2015-12-014-9/+246
| | | | | | | | This will allow to (ab)use the krb5 ccache to store encrypted credentials in the user's ccache for later reuse. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwoood <rharwood@redhat.com>
* Add gss_acquire_cred_impersonate_name supportSimo Sorce2015-12-0112-27/+263
| | | | | | | | This is used by a client that wants to peform a s4u2self operation using its server credentials. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwoood <rharwood@redhat.com>
* Add helper to find options in rpc messagesSimo Sorce2015-12-012-30/+44
| | | | | | | Use it in gp_export.c where the code is duplicate already. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwoood <rharwood@redhat.com>
* Add higher level debugging for all rpc callsSimo Sorce2015-12-0115-0/+805
| | | | | | | Print everything, except octet string buffers which are truncated. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Add options to specify a debug levelSimo Sorce2015-12-016-13/+72
| | | | | | | | Print only messages that are at that level or lower. Also add timestamps to debug messages. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Set C standard used to gnu99Robbie Harwood2015-12-011-0/+1
| | | | | | | | | | | | | gcc5 changed the default standard; in order to support older platforms, specify our target explicitly. Setting the C stanndard to c99 doesn't work (it really does need to be a gnu standard), and there is not yet an autoconf macro for C11 support. See also: https://gcc.gnu.org/gcc-5/changes.html See also: https://www.gnu.org/software/autoconf/manual/autoconf-2.64/html_node/C-Compiler.html Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Improve code in gp_export_gssx_cred()Simo Sorce2015-11-301-9/+5
| | | | | | | | Remove dead code, and set length only if allocation was successful. Also resolve valgrind complaints about uninitialized memory. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Fix const warning that can lead to issuesSimo Sorce2015-11-301-1/+1
| | | | | | | This could lead to a free() being called on a constant, and that wuld be bad. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Fix const warning in gp_creds.cSimo Sorce2015-11-302-1/+3
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Fix make cleanSimo Sorce2015-11-301-1/+1
| | | | | | | Clean the generated file not the source file. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Fix several leaksRobbie Harwood2015-11-195-0/+8
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix possible explicit NULL deref in gpm_accept_sec_contextRobbie Harwood2015-10-291-5/+7
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix potential deadlock on socket grabRobbie Harwood2015-10-291-3/+1
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Clear message structure before decoding into itRobbie Harwood2015-10-211-0/+1
| | | | | | | | This resolves a segfault appearing on ARM. Ticket: https://bugzilla.redhat.com/show_bug.cgi?id=1235902 Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Log useful message on kernel interface failureRobbie Harwood2015-10-091-5/+8
| | | | | | | | | Also, cause all failures on accessing this interface to exit GSS-Proxy similar to config file errors. Ticket: https://fedorahosted.org/gss-proxy/ticket/126 Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add tests for reloading on SIGHUPRobbie Harwood2015-09-281-18/+76
| | | | | | | Ticket: https://fedorahosted.org/gss-proxy/ticket/152 Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Port test suite to python3Robbie Harwood2015-09-281-11/+16
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Correct handling of EINTR on read()/write()Robbie Harwood2015-09-281-2/+2
| | | | | | | | The common send/recv functions where zeroing the ret variable only once causing a loop if EINTR as actually ever set. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* Use pkg-config to find libgssapi-krb5.so*Robbie Harwood2015-09-221-2/+11
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Reload config on SIGHUPRobbie Harwood2015-09-155-49/+162
| | | | | | | | For sockets, we will only reinitialize those that have changed. Additionally, the old text about SIGHUP behavior was incorrect. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Ticket: https://fedorahosted.org/gss-proxy/ticket/125
* getpwman(3) can return NULL without setting errnoRobbie Harwood2015-09-141-0/+3
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Allow configdir and configfile to be specified togetherRobbie Harwood2015-09-141-7/+0
| | | | | | | Not being able to do this is a relic of a previous design. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix formatting on noncompliant copyright linesRobbie Harwood2015-09-0466-1574/+66
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Ensure ini_config >= 1.2.0 for `ini_config_augment()`Robbie Harwood2015-09-042-3/+6
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add HTTP service and move NFS into its own conf fileRobbie Harwood (frozencemetery)2015-09-046-21/+41
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Error on `allow_any_uid` issuesRobbie Harwood (frozencemetery)2015-09-041-1/+43
| | | | | | | | As per gssproxy.conf(5), setting allow_any_uid without also setting socket or selinux_context is known to cause problems. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Extract generalized selinux context comparison functionRobbie Harwood2015-09-042-13/+26
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Update man pages for symbolic euids and config snippetsRobbie Harwood (frozencemetery)2015-09-042-7/+40
| | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add support for config directoriesRobbie Harwood (frozencemetery)2015-09-044-30/+142
| | | | | | | | | | Option '-C|--configdir' has been added, and defaults to /etc/gssproxy. File "gssproxy.conf" and all files of the form "##-foo.conf" will be read from that directory. Ticket: https://fedorahosted.org/gss-proxy/ticket/122 Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove one layer of abstraction over dinglibsRobbie Harwood (frozencemetery)2015-08-315-400/+261
| | | | | | | | A handful of parameter name differences (`key` vs. `keyname`) have been tweaked but the function bodies are otherwise unchanged. Signed-off-by: Robbie Harwood (frozencemetery) <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Allow symbolic euids in conf filesRobbie Harwood (frozencemetery)2015-08-261-9/+25
| | | | | | Fixes: https://fedorahosted.org/gss-proxy/ticket/151 Signed-off-by: Robbie Harwood (frozencemetery) <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Specify KRB5RCACHEDIR in systemd unit fileRobbie Harwood (frozencemetery)2015-08-182-0/+3
| | | | | | | | | | | | Moving out of /var/tmp allows for improved separation with selinux and fixes an AVC denial. Signed-off-by: Robbie Harwood (frozencemetery) <rharwood@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/gss-proxy/ticket/145 Ticket: https://fedorahosted.org/gss-proxy/ticket/130 Closes #1
* Update BUILD.txtRoland Mainz2015-04-171-5/+13
| | | | | | | | | Update BUILD.txt, including package requirements for tests Fixes: https://fedorahosted.org/gss-proxy/ticket/148 Signed-off-by: Roland Mainz <rmainz@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove support for iniparse libraryRoland Mainz2015-04-155-272/+1
| | | | | | | | | | This library already does not support some features we need and we want to drop its usage as the code quality is bad. Fixes: https://fedorahosted.org/gss-proxy/ticket/139 Signed-off-by: Roland Mainz <rmainz@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Turn on strict aliasing rulesRoland Mainz2015-04-091-2/+4
| | | | | | | | | | | Remove -fno-strict-aliasing (this is not required because gssproxy is mostly a good ISO C99/C11 citizen) and replace it with -Werror=strict-aliasing to ensure that if *anything* creeps up the build will just fail (this requires in gcc4.x's case the use of -fstrict-aliasing, too). Signed-off-by: Roland Mainz <rmainz@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Release version 0.4.1Simo Sorce2015-03-301-1/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix configuration file substitutionsSimo Sorce2015-03-302-3/+3
| | | | | | | Fixes: https://fedorahosted.org/gss-proxy/ticket/138 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukas Slebodnik <lslebodn@redhat.com>
* Fix handling of context initializationSimo Sorce2015-03-301-5/+7
| | | | | | | | | | | | | | If a previous call has decided to use only local (to the process) credentials, then we need to override all the way to the end. A previous patch also swapped the order in which credential handler and context handler are initialized, make sure also to swap the fallback checks. Set the behavior to the process default only if it wasn't forced to local. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukas Slebodnik <lslebodn@redhat.com>
* Suppress warning: use after freeLukas Slebodnik2015-03-291-0/+1
| | | | | | | | | | | | | | | | | gssx_ctx is released in case of error. After the latest changes, the old ctx is always replaced to new one and output argument is set. Although it would not be used because return code would not be success it's safer to set NULL to the pointer and avoid warnings from static analyzers. src/client/gpm_init_sec_context.c:108: alias: Assigning: "ctx" = "res->context_handle". Now both point to the same storage. src/client/gpm_init_sec_context.c:156: freed_arg: "free" frees "ctx". src/client/gpm_init_sec_context.c:173: use_after_free: Using freed pointer "ctx". Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Include header file with prototypes in implementation moduleLukas Slebodnik2015-03-291-0/+2
| | | | | | | | | Functions implemented in gp_util.c have prototypes in header file gp_common.h, but it was not included. This patch prevent potential conflicts between ptototype and definition of function. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove unused parameter from get_pipe_nameLukas Slebodnik2015-03-291-2/+2
| | | | | Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix warning value stored to 'ret' is never readLukas Slebodnik2015-03-291-1/+2
| | | | | | | | | | | | | | Error: UNUSED_VALUE src/gp_rpc_import_and_canon_name.c:87: value_overwrite: Overwriting previous write to "ret" with value from "gp_conv_status_to_gssx(&icna->call_ctx, ret_maj, ret_min, mech, &icnr->status)". src/gp_rpc_import_and_canon_name.c:52: assigned_value: Assigning value "22" to "ret" here, but that stored value is overwritten before it can be used. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use pkg-config for krb5 libs tooSimo Sorce2015-03-242-55/+5
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Switch to use pkg-config for krb5-gssapiSimo Sorce2015-03-241-4/+5
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Release version 0.4.0Simo Sorce2015-03-241-1/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Suppress exported_composite_name for the kernelSimo Sorce2015-03-241-0/+10
| | | | | | | | | | The kernel makes no use of this data, and ita causes allocation issues in some cases with waste of space on the kernel side. Fixes: https://fedorahosted.org/gss-proxy/ticket/129 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>
* Properly handle security contexts on errorSimo Sorce2015-03-245-39/+62
| | | | | | | | | | | | | | | | On error we need to make sure we do not return a pointer to a security context that may have been already freed. So make sure to always unconditionally return the context that we've been returned by our callees. Also reorganize the code so we do not accidently wipe the context and leak memoy on error. This fixed a double-free bug found by NFS folks @ Red Hat Fixes: https://fedorahosted.org/gss-proxy/ticket/137 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-09 04:00:18 +0000