summaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAgeFilesLines
* Define k5-platform.h wrapper for strerror_rGreg Hudson2014-07-081-0/+6
| | | | | | | | On systems where strerror_r is not the POSIX version, define it to k5_strerror_r. Implement k5_strerror_r in libkrb5support using strerror_s, strerror, or the GNU strerror_r as appropriate. ticket: 7961
* Don't depend on sa_len sockaddr fieldGreg Hudson2014-07-041-8/+12
| | | | | | | In socket-utils.h, replace the socklen macro with an inline function sa_socklen which always uses the address family, even on platforms with the sa_len sockaddr field. This removes the need to set sa_len in socket addresses we construct.
* Add a family-independent bindresvport_sa functionAndreas Schneider2014-06-272-0/+2
| | | | | | | | | | | | This functions allows you to pass IPv4 and IPv6 addresses. If no address is given, t will determine the family by checking the socket with getsockname. [ghudson@mit.edu: clarified commit message, split out setport helper, squashed with next commit, minimized code changes from old bindresvport, used socket-utils.h helpers] ticket: 7935 (new)
* Add socket-utils.h helpers for portsGreg Hudson2014-06-271-0/+30
| | | | | Add sa_setport, sa_getport, and sa_is_inet helpers for conveniently manipulating port numbers on IPv4 and IPv6 socket addresses.
* Tidy up k5-int.h variable name constantsGreg Hudson2014-06-161-98/+99
| | | | | Fix three mismatched constant names, and properly alphabetize and columnize the lists of definitions. No functional changes.
* Define k5_setmsg internal aliasGreg Hudson2014-06-051-0/+3
| | | | | | This is just a shorter internal name for krb5_set_error_message. The full name is so long that we have to wrap error messages more than we'd like.
* Remove DEBUG_ERROR_LOCATIONS supportGreg Hudson2014-06-052-31/+0
| | | | | It wasn't being used and it added too much complexity to the error-handling functions.
* Check names in the server's cert when using KKDCPNalin Dahyabhai2014-06-021-0/+5
| | | | | | | | When we connect to a KDC using an HTTPS proxy, check that the naming information in the certificate matches the name or address which we extracted from the server URL in the configuration. ticket: 7929
* Load custom anchors when using KKDCPNalin Dahyabhai2014-06-022-0/+8
| | | | | | | | Add an http_anchors per-realm setting which we'll apply when using an HTTPS proxy, more or less mimicking the syntax of its similarly-named PKINIT counterpart. We only check the [realms] section, though. ticket: 7929
* HTTPS transport (Microsoft KKDCPP implementation)Nalin Dahyabhai2014-06-021-0/+13
| | | | | | | | | | | | | | | | | | | | Add an 'HTTPS' transport type which connects to an [MS-KKDCP] proxy server using HTTPS to communicate with a KDC. The KDC's name should take the form of an HTTPS URL (e.g. "https://proxybox/KdcProxy"). An HTTPS connection's encryption layer can be reading and writing when the application layer is expecting to write and read, so the HTTPS callbacks have to handle being called multiple times. [nalin@redhat.com: use cleanup labels, make sure we always send the realm name, keep a copy of the URI on-hand, move most of the conditionally-compiled sections into their own conditionally-built functions, break out HTTPS request formatting into a helper function, handle the MS-KKDCP length bytes, update comments to mention specific versions of the MS-KKDCP spec, differentiate TCP and HTTP trace messages, trace unparseable responses] ticket: 7929
* Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGENathaniel McCallum2014-06-021-0/+13
| | | | | | | | | | | | | Handle encoding and decoding [MS-KKDCP] proxy messages, including handling of the additional length bytes. Early versions of [MS-KKDCP] incorrectly omit that the size of the proxied message is prepended to the proxied message, as it is when we're using plain TCP, before encoding the proxy-message structure. This is fixed at least as of version 2.1 of the spec. [nalin@redhat.com: add tests] ticket: 7929
* Add k5-input.hGreg Hudson2014-05-171-0/+143
| | | | | | | | | Add a header containing a declaration for struct k5input and static inline functions to use it. A k5input structure can be used to safely extract bytes and integers from a fixed-sized input buffer without overrunning the buffer. It supports deferred error checking (similar to k5buf) by returning dummy values and storing a status value in the input structure.
* Add k5_buf_get_spaceGreg Hudson2014-05-171-0/+4
| | | | | Add a new k5_buf method to make room in the buffer for the caller to fill in.
* Improve krb5_rd_req decryption failure errorsGreg Hudson2014-05-071-0/+2
| | | | | | | | | | | | | | When krb5_rd_req cannot decrypt a ticket, try to produce the most helpful diagnostic we can, and return an error code which corresponds to the most applicable Kerberos protocol error. Add a trace log containing the error message for ticket decryption failures, in case the application server does not log it. Add new tests to cover krb5_rd_req error messages and adjust existing tests to match the new messages. Also adjust svc_auth_gssapi.c to look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC. ticket: 7232
* Add helper to change extended error message codeGreg Hudson2014-05-071-0/+3
| | | | | k5_change_error_message_code allows an extended error message to be used when an error code is remapped.
* Eliminate internal fixed-width type wrappersGreg Hudson2014-02-262-26/+19
| | | | | Directly use stdint.h names for integer types in preference to the various internal names we have made up for them.
* Assume <stdint.h> and fixed-width typesGreg Hudson2014-02-264-109/+10
| | | | | | | Make unconditional use of <stdint.h> and fixed-width types such as uint32_t. k5-plugin.h doesn't use any special integer types, so remove the conditional include block there. Nothing uses INT64_FMT/UINT64_FMT, so leave those out of k5-platform.h for now.
* Avoid duplicate "/etc/krb5.conf" in profile pathTom Yu2014-02-262-3/+5
| | | | | | | | | | | | | | | | If configure gets run with --sysconfdir=/etc, "/etc/krb5.conf" shows up twice in the profile path, which causes its contents to be read twice. This can cause some confusing and possibly problematic behavior. Add some logic to configure.in to avoid adding the duplicate entry for "/etc/krb5.conf". Reported independently by Denis Vlasenko and Fredrik Tolf. ticket: 3277 tags: pullup target_version: 1.12.2
* Simplify ulog_mapGreg Hudson2014-02-201-9/+1
| | | | | | | | | | | | | | | | | | | | Get rid of the caller parameter. The kproplog semantics (without -R) for mapping the ulog are simple and almost completely different from other users of the ulog, so implement them as a static helper in kproplog. With hierarchical iprop, kpropd will need the same semantics as FKCOMMAND and FKADMIND, which were already identical. Get rid of the db_args parameter, since ulog_map no longer opens the database after #7552. Remove an inoperative lseek() call when creating a new ulog file. Rename ulog_filesize to filesize and compute it from scratch each time we use it, for easier analysis. If kdb_hmagic is zero, init the ulog header but don't skip the rest of the function; it's possible that we need to expand the ulog file. Remove an unneeded conditional before calling extend_file_to for an existing ulog. ticket: 7855
* Lock around more ulog operationsGreg Hudson2014-02-201-4/+3
| | | | | | | | | | | | | | | Always lock the ulog when accessing it. We can currently get away with some laxness on iprop slaves because they are mostly synchronous, but hierarchical iprop will allow master and slave operations to take place concurrently, requiring more strict locking. Add new functions ulog_get_last and ulog_set_last, which access the ulog header with locking, and use them in kdb5_util and kpropd. Add locking to ulog_replay and ulog_init_header. ulog_lock and ulog_sync_header are no longer used outside of kdb_log.c after these changes, so make them static functions and remove the ulog_ prefix. Add an unlock_ulog function for clarity.
* Factor out ulog serial number status checkGreg Hudson2014-02-201-0/+2
| | | | | | | | | | | | | | | Add a new function ulog_get_sno_status, which checks a serial number and timestamp against the ulog for currency. Use it in kdb5_util dump and in ulog_get_entries. Adjust parse_iprop_header's contract in dump.c to better match the ulog_get_sno_status contract. This change causes some minor behavior differences. kadmind will check for an empty ulog unless the last serial number matches exactly, and will never set lastentry when returning UPDATE_FULL_RESYNC_NEEDED (which was pointless). kdb5_util dump will recognize a dump file as current if it exactly matches the last serial number, even if the ulog is empty; it will be more robust in the presence of non-monotonic clocks; and it will properly lock around the ulog access.
* Simplify iprop update locking and avoid deadlockGreg Hudson2014-02-201-2/+0
| | | | | | | | | | | | | Since we are no longer treating the update log like a journal (#7552), we don't need two-stage update logging. In kdb5.c, add an update log entry after each DB change in one step, without getting an explicit lock. In kdb_log.c, combine ulog_add_update with ulog_finish_update, and make ulog_add_update lock the ulog internally. This change avoids deadlock by removing the only cases where the ulog is locked before the DB. ticket: 7861
* Move OTP sockets to KDC_RUN_DIRNathaniel McCallum2014-02-062-0/+3
| | | | | | | | | | | | Some system configurations expect Unix-domain sockets to live under /run or /var/run, and not other parts of /var where persistent application state lives. Define a new directory KDC_RUN_DIR using $runstatedir (new in autoconf 2.70, so fall back to $localstatedir/run if it's not set) and use that for the default socket path. [ghudson@mit.edu: commit message, otp.rst formatting fix] ticket: 7859 (new)
* In kdb5_util load, init ulog closer to promoteGreg Hudson2014-02-051-1/+0
| | | | | | | Always map the ulog with FKCOMMAND, not FKLOAD which reinitializes the ulog. Don't reinitialize the ulog until just before calling krb5_db_promote(). Get rid of FKLOAD since it isn't needed any more; we can just call ulog_init_header() manually.
* Modernize iprop codeGreg Hudson2014-02-051-32/+21
| | | | | | | | | | | | | | | | | | | | * Don't use "extern" for kdb_log.h prototypes. * Avoid passing structures by value. * Avoid the need to cast the result of the INDEX macro, and use char * instead of unsigned long for pointer arithmetic. * Reorganize kdb_log.c so static helpers are at the top and don't use the "ulog_" prefix. * Get rid of ulog_finish_update_slave since it's more concise to open-code it in ulog_replay. * Get rid of ulog_delete_update. In krb5_db_delete_principal, just call ulog_add_update with kdb_deleted set in upd. * Modernize coding style of kproplog.c. Use k5memdup0 instead of snprintf in print_str to convert a byte range to a C string. Remove an unnecesary textdomain call; libkrb5 takes care of calling bindtextdomain in the library initializer. * Modernize coding style of kpropd.c and kprop.c. No functional changes.
* Make rcache resolve functions take const char *Greg Hudson2014-01-171-2/+4
|
* Let SPNEGO display mechanism errorsSimo Sorce2013-12-181-0/+1
| | | | | | | | | | | | | | | To avoid potential recursion we use a thread local variable that tells us whether the ancestor was called via spnego_gss_display_name(). If we detect recursion, we assume that we returned a com_err code like ENOMEM and call error_message(); in the worst case that will result in an "Unknown error" message. [ghudson@mit.edu: Edited comments and commit message; removed an unneeded line of code.] ticket: 7045 target_version: 1.12.1 tags: pullup
* Remove unused krb5_context fieldsGreg Hudson2013-12-181-2/+0
| | | | | The vtbl and locate_fptrs fields were ostensibly related to the locate pluggable interface, but weren't actually used.
* Don't require krb5.conf without KRB5_DNS_LOOKUPGreg Hudson2013-12-161-4/+0
| | | | | | | | | | | | For a long time we have allowed krb5 contexts to be initialized in the absence of krb5.conf--but only if KRB5_DNS_LOOKUP is defined, presumably on the theory that no KDCs could be contacted without either DNS support or profile configuration. But locate plugins could provide the ability to find KDCs, and some libkrb5 operations (such as IAKERB initiation) could succeed without needing to locate KDCs. Also get rid of the profile_in_memory context flag, since we don't use it any more.
* Modernize sn2princ.cGreg Hudson2013-12-111-12/+0
| | | | | Refactor and edit sn2princ.c to match current coding style. No behavior changes, except to be less chatty in trace logs.
* Add new versions of log_badauth gssrpc callbacksGreg Hudson2013-11-252-0/+15
| | | | | | | | | | libgssrpc supports two callbacks for gss_accept_sec_context failures on servers (one for AUTH_GSS and one for AUTH_GSSAPI), which are IPv4-specific. Provide an alternate version which supplies the transport handle instead of the address, so that we can get the address via the file descriptor for TCP connections. ticket: 7770
* Improve default ccache name API documentationGreg Hudson2013-11-221-6/+25
| | | | | | | | | | | | Document the lifetime and caching behavior of the krb5_cc_default_name() return value. Document that krb5_cc_set_default_name() may be called with NULL to purge the cached value. Correct a typo in the krb5_cc_default() summary and explicitly reference krb5_cc_default_name(). ticket: 7775 (new) target_version: 1.12 tags: pullup
* Make set_cloexec_fd return voidBen Kaduk2013-11-041-10/+7
| | | | | | | | | We never check its return value (causing clang to emit warnings), and its use is primarily in cases where we should continue processing in the event of failure. Just ignore errors from the underlying fcntl() call (if present) and treat this operation as best-effort. The #if 0 code should probably be removed.
* KDC Audit infrastructure and plugin implementationZhanna Tsitkov2013-10-042-1/+272
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
* Add an internal constant-time comparison functionGreg Hudson2013-10-031-0/+8
| | | | | | | k5_bcmp acts similarly to the deprecated Unix bcmp() function, returning zero if two memory regions are equal and nonzero if they are not. It is implemented such that it should take the same amount of time regardless of how many bytes are equal within the memory regions.
* Support authoritative KDB check_transited methodsGreg Hudson2013-09-251-2/+3
| | | | | | | | | In kdc_check_transited_list, consult the KDB module first. If it succeeds, treat this as authoritative and do not use the core transited mechanisms. Modules can return KRB5_PLUGIN_NO_HANDLE to fall back to core mechanisms. ticket: 7709
* Factor out krb5int_random_string() routineZhanna Tsitkov2013-09-241-0/+4
| | | | | Make krb5int_random_string() function available outside ccache code. Move it into a separate file under lib/krb5/krb hierarchy.
* Err codes in KRB_ERROR protocol messages are < 128Zhanna Tsitkov2013-09-231-0/+1
| | | | | | If the error code is out of [0,127] range, assign it to KRB_ERR_GENERIC. This fix is to correct the previous behavior with [0,128] range. For more information see krb5_err.et
* Correct comments in ccselect_plugin.hZhanna Tsitkov2013-09-181-3/+3
| | | | Some text mistakenly referred to password quality plugin.
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-061-0/+2
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Fix FAST critical option bit checkingGreg Hudson2013-09-031-2/+2
| | | | | | | | | The FAST option bits 0-15 are intended to be critical--if they are present and a KDC does not support them, the KDC is supposed to fail the request. Because of an incorrect constant, we were erroneously recognizing bits 24-31 as critical. Fix the constant. ticket: 7701 (new)
* Support FAST hide-client-names optionGreg Hudson2013-09-031-1/+1
| | | | | | | | In the KDC, if we see the hide-client-names option, identify the client as the anonymous principal in KDC-REP and KRB-ERROR responses. The actual client name is present in encrypted FAST elements. ticket: 7700 (new)
* Use hostrealm interface for realm mappingGreg Hudson2013-08-152-6/+9
| | | | | | | | | Reimplement krb5_get_host_realm, krb5_get_fallback_host_realm, and krb5_get_default_realm in terms of the hostrealm interface. Three built-in modules (dns, domain, and profile) implement the current behavior. ticket: 7687
* Add hostrealm pluggable interface definitionGreg Hudson2013-08-153-1/+138
| | | | ticket: 7687 (new)
* Add trace logging for TXT lookupsGreg Hudson2013-08-121-0/+5
| | | | | | Rename krb5_try_realm_txt_rr (an internal function despite the name) and add a context parameter. Generate trace logs when we successfully look up a record and when a record is not found.
* Report KDC response sizes in trace logsGreg Hudson2013-08-071-2/+2
|
* Correct an error in kdb.h commentsGreg Hudson2013-08-051-2/+2
| | | | | The check_policy functions return com_err codes, not protocol codes, so use a com_err constant in the example.
* Document krb5_db_iterate restriction on writingGreg Hudson2013-07-311-0/+6
|
* Add non-JSON APIs for PKINIT responder itemsNalin Dahyabhai2013-07-171-0/+59
| | | | | | | | | | | | | | | | | Add wrappers for the JSON-oriented APIs for PKINIT responder items, modeled after the API we provide for OTP items: * krb5_responder_pkinit_get_challenge() returns the list of identities for which we need PINs * krb5_responder_pkinit_challenge_free() frees the structure that was returned by krb5_responder_pkinit_get_challenge() * krb5_responder_pkinit_set_answer() sets the answer to the PIN for one of the identities [ghudson@mit.edu: style cleanup; added comment pointing to main body of PKINIT module] ticket: 7680
* Pass PKINIT identity prompts to the responder cbNalin Dahyabhai2013-07-171-0/+44
| | | | | | | | | | | | | | | | | Use the list of deferred identity prompts and warnings, which we have after calling pkinit_identity_initialize(), to build a list of questions to supply to responder callbacks. Before calling pkinit_identity_prompt() to actually load identities that are protected, save any passwords and PINs which a responder callback may have supplied. Because pkinit_client_prep_questions() can be called multiple times, and we don't want to try to load all of our identities each of those times, take some steps to ensure that we only call pkinit_identity_initialize() and pkinit_identity_prompt() once per request. ticket: 7680
generated by cgit (git 2.34.1) at 2025-09-28 03:33:04 +0000