summaryrefslogtreecommitdiffstats
path: root/src/lib/kdb
Commit message (Collapse)AuthorAgeFilesLines
* make dependGreg Hudson2013-03-241-24/+19
|
* Fix condition with empty bodyDavid Benjamin2013-03-151-2/+2
| | | | | | | | Found by clang's warnings. ticket: 7591 (new) target_version: 1.11.2 tags: pullup
* Modernize k5bufGreg Hudson2013-02-141-10/+10
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-093-13/+7
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Adjust kdb5.c check for ulog being mappedGreg Hudson2013-01-241-1/+1
| | | | | | Check the ulog pointer, which is a little more direct, rather than the ulogfd field. (ulogfd is currently initialized to 0 prior to ulog_map; we could fix that instead, but this feels simpler.)
* Remove ulog_check(); the ulog is not a DB journalNicolas Williams2013-01-231-114/+6
| | | | | | | | | | | | | | | The db2 DB is not power-fail safe. There's no point trying to replay an incompletely committed entry from the ulog at kadmind startup time. For that matter, even if the db2 DB was power-fail safe there'd be no point replaying an uncommitted entry from the ulog as the libkadm5srv app (nor any client of it, as in the case of kadmind) will not have received any notice of success -- it'd be wrong to complete that operation later when the user thought it'd failed. [ghudson@mit.edu: merge with master, adjust comment] ticket: 7552 (new)
* Propagate policy changes over iprop via full dumpGreg Hudson2013-01-221-3/+51
| | | | | | | | Since iprop cannot carry policy changes, force a full resync to happen each time a policy change occurs. Based on a patch from Richard Basch <basch@alum.mit.edu>. ticket: 7522
* Fix iprop log reinitializationGreg Hudson2013-01-222-13/+41
| | | | | | | | | | | | | | | | If the master iprop log is reinitialized to serial number 0, slaves will need to take a full dump--but after that happens, we need to know whether the slave has taken that full dump, we we don't offering full dumps indefinitely. So, record a timestamp in kdb_last_time when we reinitialize the log header, and compare the slave timestamp to kdb_last_time whenever it has the current serial number, even if it's 0. Test this by performing a propagation with sno 0 in t_iprop.py and detecting whether kpropd gets a second UPDATE_FULL_RESYNC_NEEDED response from kadmind. ticket: 7550 (new)
* Modernize style of kdb_log.cGreg Hudson2013-01-221-460/+292
| | | | | ulog_get_entries had an unreachable branch which was removed during de-indentation.
* Clean up iprop flow control in kdb5.cGreg Hudson2013-01-181-53/+42
| | | | | | | | | | | Add a helper predicate to determine whether to log operations. In the predicate, check if the ulog is actually mapped. Use a single cleanup label in krb5_db_put_principal. Use a cleanup label in krb5_db_delete_principal instead of releasing resources individually at each exit point. Avoid locking and unlocking the ulog if we're not logging (although it would be a no-op). Based on a patch from Nico Williams <nico@cryptonector.com>.
* make dependGreg Hudson2013-01-101-1/+1
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Simplify k5test.py environmentsGreg Hudson2012-12-201-1/+1
| | | | | | | | | | | | | | The initial k5test.py design, copied from the dejagnu suite, is to create config files and environments for four expected roles: client, server, master, and slave. This approach exaggerates the complexity of the common case, where the configurations don't need to vary, and limits us to having just one slave for kprop/iprop tests. Instead, create just one configuration by default, and add a special_env() method which sets up a differently configured environment for the few test cases which need one. The run_as_*() methods are collapsed into just run(), which accepts an optional argument for the environment returned by special_env().
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-191-9/+9
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Fix typo disabling static-linked LDAP back endGreg Hudson2012-11-151-1/+1
|
* Bump libkdb5 API and DAL versionsGreg Hudson2012-10-151-1/+1
| | | | | | We made two sets of incompatible changes to the DAL and libkdb5 API during development for 1.11 (master key list simplification and policy extensions), so increment the appropriate version numbers.
* krb5_db_delete_principal() can fail to unlock ulogNicolas Williams2012-10-081-1/+3
| | | | | | Not really: only when the KDB backend lacks a delete method. Still. ticket: 7403
* Fix a minor race in kdb5_util loadNicolas Williams2012-10-051-36/+63
| | | | | | | | | | | | | | | | | | | If a kdb5_util load gets killed between rename()ing the new KDB file into place and resetting the iprop ulog then the ulog can reflect the pre-load state, which will almost certainly be incorrect. This matters because we want to impose a timeout on full resyncs in kpropd when iprop dictates that a full resync is needed, and the simplest timeout scheme involves signaling the kdb5_util load process. But also, we want no such races in general. The fix is simple: re-initialize the ulog before renaming the new KDB file into place, then proceed as usual. If the ulog is not properly updated at the end of the load it will at least always result in subsequent iprop get updates operations always indicating that a full resync is required. ticket: 7399
* Make kadmind iprop never return UPDATE_BUSYNicolas Williams2012-10-051-11/+1
| | | | | | | | | | | | | | | Currently kadmind allows slaves to poll for updates as often as they like, but not within 10s of the last update. This means that iprop will appear to fail to synchronize the KDC at any site whose master KDC processes at least one write transaction every 10 seconds consistently. The original intention must have been to throttle iprop clients (slave KDCs) that poll too often. But UPDATE_BUSY as implemented is not that, and implementing a throttle would be difficult (requires keeping state in a table) and mostly useless (admins can manage their poll timers just fine without a throttle in kadmind). ticket: 7369
* Use a single global dump for iprop full syncsNicolas Williams2012-10-052-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Use a global dump (the default dump file) for full syncs for iprop. When a slave asks for a fullsync we kprop the existing global dump to it if that is good enough, else we dump the DB and send the new global dump. Before this change kadmind would run kdb5_util dump -i... each time a slave asked for a full dump. This was done in a sub-process, thankfully, but it was still a waste of time and storage (e.g., if one has a huge KDB). Also, long dump times might cause a slave to give up (the timeout for this is now configurable). But since iprop dumps bear a serial number and timestamp and since slaves will resync from that point forward, it doesn't matter if the dump we send a slave is fresh as long as it is fresh enough (i.e., that its sno and timestamp are in the ulog). Also: - Rename dumps into place instead of unlink, create, write (but we still keep the dump ok files as lock files and as a method of signaling to kprop that the dump is complete). ticket: 7371
* Fix KDC heap corruption vuln [CVE-2012-1015]Tom Yu2012-08-011-0/+3
| | | | | | | | | | | | | | | | | | | | Fix KDC heap corruption vulnerability [MITKRB5-SA-2012-001 CVE-2012-1015]. The cleanup code in kdc_handle_protected_negotiation() in kdc_util.c could free an uninitialized pointer in some error conditions involving "similar" enctypes and a failure in krb5_c_make_checksum(). Additionally, adjust the handling of "similar" enctypes to avoid advertising enctypes that could lead to inadvertent triggering of this vulnerability (possibly in unpatched KDCs). Note that CVE-2012-1014 (also described in MITKRB5-SA-2012-001) only applies to the krb5-1.10 branch and doesn't affect the master branch or releases prior to krb5-1.10. ticket: 7225 (new) target_version: 1.9.5 tags: pullup
* Policy extensions + new policy: allowed ks typesNicolas Williams2012-07-302-6/+15
| | | | | | | | | | | | | | | | | This simply adds KADM5_API_VERSION_4 and various fields to the policy structures: - attributes (policy-ish principal attributes) - max_life (max ticket life) - max_renewable_life (max ticket renewable life) - allowed_keysalts (allowed key/salt types) - TL data (future policy extensions) Of these only allowed_keysalts is currently implemented. Some refactoring of TL data handling is also done. ticket: 7223 (new)
* Use consistent types for overflow comparisonBen Kaduk2012-07-031-1/+1
| | | | | | Unsigned long might not be 32-bits, in which case the overflow check fails for a 32-bit kdb_sno_t. Cast from -1 explicitly as a more robust check.
* Stop using SALT_TYPE_AFS_LENGTHGreg Hudson2012-04-271-17/+12
| | | | | | | | | | | | In krb5_init_creds_ctx and krb5_clpreauth_rock_st, use a boolean to track whether we're still using the default salt instead of overloading salt.length. In preauth2.c, process afs3 salt values like we would in krb5int_des_string_to_key, and set an s2kparams indicator instead of overloading salt.length. Also use an s2kparams indicator in kdb_cpw.c's add_key_pwd. Remove the s2k code to handle overloaded salt lengths, except for a sanity check. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25837 dc483132-0cff-0310-8789-dd5450dbe970
* Only store master mey list in DAL handleGreg Hudson2012-03-214-65/+67
| | | | | | | | | | | | | | r24314 (#6778) created a hybrid owernship model for the master key list, with one virtual copy stored in the DAL handle and one provided to the caller of krb5_db_fetch_mkey_list. Replace this with a model where only the DAL handle owns the list, and a caller can get access to an alias pointer with a new function krb5_db_mkey_list_alias(). Functions which previously accepted the master key list as an input parameter now expect to find it in the DAL handle. Patch by Will Fiveash <will.fiveash@oracle.com>. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25781 dc483132-0cff-0310-8789-dd5450dbe970
* Get rid of periods in Python test success messagesGreg Hudson2011-11-031-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25432 dc483132-0cff-0310-8789-dd5450dbe970
* Refactor salt computation into libkdb5Greg Hudson2011-10-242-0/+51
| | | | | | | Add a new API krb5_dbe_compute_salt() to determine the salt for a key data entry, and use it in the three places we currently compute salts. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25410 dc483132-0cff-0310-8789-dd5450dbe970
* Make reindentTom Yu2011-10-171-1/+1
| | | | | | | Also fix pkinit_crypto_nss.c struct initializers and add parens to a ternary operator in do_as_req.c for better indentation. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25362 dc483132-0cff-0310-8789-dd5450dbe970
* Create e_data as pa_data in KDC interfacesGreg Hudson2011-10-042-5/+5
| | | | | | | | | | | | All current known uses of e_data are encoded as pa-data or typed-data. FAST requires that e_data be expressed as pa-data. Change the DAL and kdcpreauth interfaces so that e_data is returned as a sequence of pa-data elements. Add a preauth module flag to indicate that the sequence should be encoded as typed-data in non-FAST errors. ticket: 6969 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25298 dc483132-0cff-0310-8789-dd5450dbe970
* Fix krb5_dbe_get_strings error handlingGreg Hudson2011-09-241-8/+12
| | | | | | | The old error handling was incorrect in the case where a strdup() call returns NULL but realloc() returns non-NULL. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25230 dc483132-0cff-0310-8789-dd5450dbe970
* Support special salt type in default krb5_dbe_cpwGreg Hudson2011-09-221-0/+36
| | | | | | | | | | | | | | | This change allows the "special" salt type to be used in supported_enctypes or in the argument to kadmin's cpw -e. If used, kadmind will pick a salt consisting of 64 random bits represented as 16 printable ASCII characters. The use of random explicit salts creates some interoperability issues and is not generally recommended, but can be useful for interop testing, as a workaround for obscure bugs, or to increase the difficulty of brute-force password searches in situations where none of the interoperability issues apply. ticket: 6964 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25226 dc483132-0cff-0310-8789-dd5450dbe970
* Fix string attribute unit testsGreg Hudson2011-09-213-6/+14
| | | | | | | Wrap t_stringattr in a very minimal Python test script so that libkdb5 can find the DB2 module to allocate memory. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25223 dc483132-0cff-0310-8789-dd5450dbe970
* Add KRB5_TL_STRING_ATTRS and libkdb5 accessorsGreg Hudson2011-09-214-1/+286
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25214 dc483132-0cff-0310-8789-dd5450dbe970
* Silence various "may be used uninitialized" warnings from GCC causedKen Raeburn2011-09-051-0/+1
| | | | | | | | | by it not figuring out the control flow (initialization and use both tied to some other variable). DB2 code not included. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25146 dc483132-0cff-0310-8789-dd5450dbe970
* Skip redundant inclusion of iprop.hKen Raeburn2011-09-042-2/+18
| | | | | | | Suppress GCC's unused-variable diagnostic for purely generated code using outside tools, known to have that issue but not ours to fix. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25142 dc483132-0cff-0310-8789-dd5450dbe970
* Define KRB5_TL_DB_ARGS unconditionally in kdb.hGreg Hudson2011-07-261-5/+0
| | | | | | | | | Due to an apparent merge bug, KRB5_TL_DB_ARGS was defined in a SECURID conditional block, and several source files worked around the problem by defining the constant themselves or defining SECURID. Move the definition and remove the workarounds. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25055 dc483132-0cff-0310-8789-dd5450dbe970
* Get static linking working again, mostlyGreg Hudson2011-06-281-1/+1
| | | | | | | | | | | | | | | | | | | Static linking (#6510) broke when lockout support was added because the DB2 plugin became dependent on libkadm5srv_mit for XDR functions. Also, static linking was extensively broken in combination with LDAP support. Fix these problems. Afer these fixes, the test suite fails in the FAST tests because there's no static build support for dynamic preauth plugins, which means there's no encrypted challenge. (And unlike the pkinit tests, the test suite doesn't conditionalize on the presence of the encrypted challenge plugin, because we always build it.) This will fix itself if and when encrypted challenge becomes linked into the consumers, or static build support is added for preauth plugins. ticket: 6914 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24996 dc483132-0cff-0310-8789-dd5450dbe970
* Mark up strings for translationGreg Hudson2011-06-103-31/+37
| | | | | | ticket: 6918 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24961 dc483132-0cff-0310-8789-dd5450dbe970
* Fix multiple tl-data updates over ipropGreg Hudson2011-05-221-35/+8
| | | | | | | | | | | | | krb5_dbe_update_tl_data() accepts a single read-only tl-data entry, but ulog_conv_2dbentry() expects it to process a full list. Fix ulog_conv_2dbentry() to call krb5_db2_update_tl_data() on each entry individually, simplifying its memory management in the process. ticket: 6913 target_version: 1.9.2 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24937 dc483132-0cff-0310-8789-dd5450dbe970
* Resolve a few miscellaneous warningsGreg Hudson2011-03-142-9/+15
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24703 dc483132-0cff-0310-8789-dd5450dbe970
* Adjust most C source files to match the new standards for copyrightGreg Hudson2011-03-097-30/+8
| | | | | | and license comments. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24695 dc483132-0cff-0310-8789-dd5450dbe970
* Make dependGreg Hudson2011-02-251-27/+24
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24662 dc483132-0cff-0310-8789-dd5450dbe970
* Use for loops for recursion in the Windows build, cutting down on theGreg Hudson2010-11-281-1/+1
| | | | | | | | | verbiage in Makefile.in files. For correctness of output, every Makefile.in mydir= definition is changed to use $(S) instead of /. ticket: 6826 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24536 dc483132-0cff-0310-8789-dd5450dbe970
* Propagate modprinc -unlock from master to slave KDCsGreg Hudson2010-10-052-0/+42
| | | | | | | | | | | | Create a new tl-data type to hold the time of the last administrative unlock, and factor it into decisions about account lockout. Since tl-data values are propagated from master to slave, this will cause modprinc -unlock operations to reach slave KDCs on the next propagation. ticket: 6795 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24424 dc483132-0cff-0310-8789-dd5450dbe970
* Protoize old-style function definitions in kdb5.c and normalizeGreg Hudson2010-10-041-131/+75
| | | | | | formatting of definition headers. No functional changes. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24417 dc483132-0cff-0310-8789-dd5450dbe970
* Make krb5_dbe_def_search_enctype skip key data entries with invalidGreg Hudson2010-09-281-6/+4
| | | | | | | | | | | | enctypes instead of erroring out on them. We had this behavior prior to 1.8 (more by accident than by design), but it changed as a side-effect of r23599. ticket: 6790 target_version: 1.8.4 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24370 dc483132-0cff-0310-8789-dd5450dbe970
* WhitespaceGreg Hudson2010-09-151-26/+29
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24318 dc483132-0cff-0310-8789-dd5450dbe970
* kdb: store mkey list in context and permit NULL mkey for ↵Sam Hartman2010-09-154-48/+80
| | | | | | | | | | | | | | | | | | | | | | | | kdb_dbe_decrypt_key_data Previously, code needed to run a loop to find the current master key, possibly fetch a new master key list and try finding the master key again around each key decryption. This was not universally done; there are cases where only the current master key was used. In addition, the correct ideom for decrypting key data is too complicated and is potentially unavailable to plugins that do not have access to the master key. Instead, store the master key list in the dal_handle whenever it is fetched and permit a NULL master key for krb5_dbe_decrypt_key_data. * Remove APIs for krb5_db_{get|set}_mkey_list * krb5_db_fetch_mkey_list: memoize master key list in dal_handle * krb5_db_free_mkey_list: don't free the memoized list; arrange for it to be freed later * krb5_dbe_decrypt_key_data: Search for correct master key on NULL argument * change call sites to take advantage ticket: 6778 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24314 dc483132-0cff-0310-8789-dd5450dbe970
* WhitespaceGreg Hudson2010-09-151-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24311 dc483132-0cff-0310-8789-dd5450dbe970
* Fix warnings in encrypt_key and decrypt_key. Avoid a segfault if NULLSam Hartman2010-09-152-6/+10
| | | | | | | | master key is passed into default decryption function. kdb: fix warnings git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24310 dc483132-0cff-0310-8789-dd5450dbe970
* Make dependGreg Hudson2010-09-081-23/+26
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24298 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2026-01-17 01:30:35 +0000