summaryrefslogtreecommitdiffstats
path: root/src/plugins/kdb
Commit message (Collapse)AuthorAgeFilesLines
* Include autoconf.h before system headersGreg Hudson2014-07-0811-24/+14
| | | | | | | | | Include autoconf.h (either directly or via proxy) before system headers, so that feature test macros defined there can affect the system namespace. Where include order was changed, eliminate some redundant or unnecessary includes. ticket: 7961
* Simplify usage of strerror_rGreg Hudson2014-07-081-5/+0
| | | | | | | | Take advantage of the strerror_r portability wrapper to simplify code using it. Remove unused macros related to strerror_r in ldap_service_stash.c and plugins.c. ticket: 7961
* Tidy up k5-int.h variable name constantsGreg Hudson2014-06-161-1/+1
| | | | | Fix three mismatched constant names, and properly alphabetize and columnize the lists of definitions. No functional changes.
* Treat LDAP KrbKey salt field as optionalGreg Hudson2014-06-051-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Per the ASN.1 definition, the KrbKey salt field is optional. Since 1.7, we have been treating it as mandatory in the encoder; since 1.11, we have been treating it as mandatory in the decoder. Mostly by luck, we have been encoding a salt type of 0 when key_data_ver is 1, but we really should not be looking at key_data_type[1] or key_data_length[1] in this situation. Treat the salt field as optional in the encoder and decoder. Although the previous commit ensures that we continue to always encode a salt (without any dangerous assumptions about krb5_key_data constructors), this change will allow us to decode key data encoded by 1.6 without salt fields. This also fixes issue #7918, by properly setting key_data_ver to 2 if a salt type but no salt value is present. It is difficult to get the decoder to actually assign 2 to key_data_ver just because the salt field is there, so take care of that in asn1_decode_sequence_of_keys. Adjust kdbtest.c to match the new behavior by setting key_data_ver to 2 in both test keys. ticket: 7919 target_version: 1.12.2 tags: pullup
* Always include salt in LDAP KrbKey encodingGreg Hudson2014-06-051-1/+20
| | | | | | | | | | | | | | | | | | | In the LDAP KDB module, ensure that every krb5_key_data we pass to asn1_encode_sequence_of_keys includes a salt type, for compatibility with the decoder in unpatched krb5 1.11 and 1.12. This is not a behavior change by itself; since 1.7 the encoder has always included a KrbKey salt field because it erroneously treats that field as non-optional. (Luckily, the encoded salt always happens to have salt type 0 because krb5_key_data constructors start with zeroed memory.) The next commit will fix the encoder and decoder to properly treat the KrbKey salt field as optional, so we need this change to ensure that our encodings remain compatible. Also fix the ASN.1 tests to set key_data_ver correctly for the sample test key data. ticket: 7919
* Use k5_setmsgGreg Hudson2014-06-0512-126/+98
| | | | | | Replace most calls to krb5_set_error_message with k5_setmsg for brevity. Leave alone plugin sources where we don't include k5-int.h (mostly PKINIT).
* Conditionalize use of LDAP_OPT_DEBUG_LEVELGreg Hudson2014-02-281-0/+2
| | | | | | | | | The LDAP debug level option (#7551) causes a build failure with the Solaris LDAP library, which does not have LDAP_OPT_DEBUG_LEVEL. ticket: 7870 (new) target_version: 1.12.2 tags: pullup
* Assume <stdint.h> and fixed-width typesGreg Hudson2014-02-261-6/+0
| | | | | | | Make unconditional use of <stdint.h> and fixed-width types such as uint32_t. k5-plugin.h doesn't use any special integer types, so remove the conditional include block there. Nothing uses INT64_FMT/UINT64_FMT, so leave those out of k5-platform.h for now.
* Use system dictionary for db2 tests againGreg Hudson2014-02-191-4/+13
| | | | | | | | | | The built-in word list is not long enough for all of the libdb2 tests to run properly. Revert d21a86e47a7cda29225013e08d060095b94b2ee7 and go back to using the system dictionary if we find one. However, omit any lines from the chosen word list which contain non-alphabetical characters. ticket: 7860
* Use TAILQ macros instead of CIRCLEQ in libdb2Greg Hudson2014-02-192-27/+24
| | | | | | | | | The optimizer in gcc 4.8.1 (but not the current gcc head revision) breaks the queue.h CIRCLEQ macros, apparently due to an overzealous strict aliasing deduction. Use TAILQ macros in the libdb2 mpool code instead. ticket: 7860
* Don't use system dictionary files for DB2 testsGreg Hudson2014-02-111-8/+0
| | | | | | | | | The system dictionary may contain entries with punctuation, which can confuse the shell. It's more predictable to always use the word list from the source tree. ticket: 7860 status: open
* Remove mentions of krb5-send-prTom Yu2014-01-151-2/+1
| | | | | | | | | | | | | | Start the process of deprecating krb5-send-pr. In practice, it causes frustration for some users, and free-form email is good enough for most bug reports. Continue to install krb5-send-pr for now, but plan to remove it from the tree in the future, probably replaced by a script that instructs the user to send email manually. ticket: 5566 target_version: 1.12.1 tags: pullup
* Improve LDAP KDB initialization error messagesGreg Hudson2013-10-301-7/+7
| | | | | | | | | | | | | In krb5_ldap_initialize, don't just blat the LDAP error into the extended message; give an indication of which LDAP operation we were trying to do and show what parameters we gave to it. (Also, krb5_set_error_message can handle a null context argument, so don't bother to check before calling.) ticket: 7739 (new) target_version: 1.12 tags: pullup
* Avoid allocating zero key_data structuresGreg Hudson2013-07-151-1/+2
| | | | | | | | When we allocate space for an array of key_data structures, make sure we allocate at least one, so we don't spuriously fail on platforms where malloc(0) returns NULL. Where we use malloc, use k5calloc instead. Where we use krb5_db_alloc or realloc, just allocate an extra entry.
* Use k5calloc instead of k5alloc where appropriateGreg Hudson2013-07-112-10/+12
| | | | | Wherever we use k5alloc with a multiplication in the size parameter,, use the new k5calloc helper function instead.
* Fix various warningsGreg Hudson2013-06-077-43/+36
|
* Fix warnings in dbtest.cGilles Espinasse2013-05-311-20/+38
| | | | | | | | | Check return values of read() and write(). Avoid some unsigned comparisons. Cast a ptrdiff_t value to int for use with %d in a format string. [ghudson@mit.edu: rewrap long lines; fix one more warning; commit message]
* Link dbtest with libkrb5supportGreg Hudson2013-05-311-2/+2
| | | | | | | | In a static build, linking dbtest could fail on platforms where libdb2 depends on krb5support (platforms without a native mkstemp). Reported by Gilles Espinasse <g.esp@free.fr>. ticket: 7651
* Reduce boilerplate in makefilesGreg Hudson2013-05-167-55/+2
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Assume mutex locking cannot failGreg Hudson2013-05-144-31/+13
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Fix type mismatch in db2_exp.cGreg Hudson2013-05-101-1/+1
| | | | | | The locking wrapper for audit_as_req used the wrong function signature, which was harmless but produced a couple of warnings. Fix it.
* Improve LDAP password file error messagesGreg Hudson2013-05-081-2/+6
| | | | | | | If we cannot open the LDAP password file or cannot find the bind DN in it, include the filename and DN in the error message. ticket: 7632
* Simplify krb5_ldap_readpasswordGreg Hudson2013-03-291-19/+2
| | | | | | There's no need to check whether the file exists and is readable before opening it, and setting an extended error message which is just strerror_r() of the errno value isn't useful.
* Fix kdb_ldap_create_principal cleanupGreg Hudson2013-03-281-2/+2
| | | | entry must be initialized before all code which can jump to cleanup.
* Fix more password_policy cleanup codeGreg Hudson2013-03-281-11/+6
| | | | | Initialize policy_dn in krb5_ldap_create_password_policy; free values unconditionally in all ldap_pwd_policy.c cleanup handlers.
* Get rid of krb5_xfreeGreg Hudson2013-03-282-23/+23
|
* Fix krb5_ldap_put_password_policy cleanupGreg Hudson2013-03-281-3/+2
| | | | | Initialize policy_dn since we clean it up. Also free it unconditionally.
* Init output parameter of krb5_decode_princ_entryGreg Hudson2013-03-281-0/+2
| | | | | For easier static analysis, make sure that krb5_decode_princ_entry always sets *entry_ptr to a valid entry or NULL.
* make dependGreg Hudson2013-03-244-124/+112
|
* Eliminate unused variablesGreg Hudson2013-03-151-1/+1
|
* Initialize status in krb5_ldap_parse_db_paramsGreg Hudson2013-03-111-1/+1
| | | | | | | | If db_args is non-null but empty, status could be returned without being initialized; gcc with optimization correctly warns about this, causing a build failure. (This bug was introduced by 0b1dc2f93da4c860dd27f1ac997617b712dff383 which was pushed after the 1.11 release branch, so it isn't in any release.)
* Add missing .gitignore entries and clean rulesGreg Hudson2013-02-271-1/+1
| | | | ticket: 7585
* Modernize k5bufGreg Hudson2013-02-142-9/+9
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-094-36/+19
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Simplify LDAP password decodingGreg Hudson2013-02-012-113/+45
| | | | | | Make dec_password a static function in ldap_service_stash.c and remove some impedance mismatch with krb5_ldap_readpassword() by making it operate on C strings and return a krb5_error_code.
* Remove partial LDAP client cert supportGreg Hudson2013-01-314-138/+40
| | | | | | | | The LDAP KDB module has some code to interpret {FILE} values in stash files, and set the service_cert_path/pass fields in the ldap context. But there was no code to actually use those values to do client cert authentication, so it wasn't useful. Remove the partial implementation.
* Fix prepend_err_str in LDAP KDB moduleGreg Hudson2013-01-291-3/+4
| | | | | | Use the oerr parameter to fetch the existing message. Stop handling oerr == 0, since no call sites were using it. Free the old error message before returning.
* Add LDAP debug DB optionGreg Hudson2013-01-283-0/+4
| | | | | | | Add a DB option in the LDAP KDB module to turn on debugging messages. Adapted from a patch by Zoran Pericic <zpericic@inet.hr>. ticket: 7551 (new)
* Refactor LDAP DB option parsing codeGreg Hudson2013-01-285-378/+167
| | | | | | | | | | krb5_ldap_open and krb5_ldap_create contain two large, almost identical blocks of DB option processing code. Factor it out into a new function krb5_ldap_parse_db_params in ldap_misc.c, and simplify the factored-out code. Create a helper function to add server entries and use it to simplify krb5_ldap_read_server_params as well as DB option parsing. Since the new DB option helper uses isspace instead of isblank, we no longer require portability goop for isblank.
* make dependGreg Hudson2013-01-109-14/+14
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Allow principals to refer to nonexistent policiesGreg Hudson2013-01-091-7/+0
| | | | | | | | | | | | | | Stop using and maintaining the policy_refcnt field, and do not try to prevent deletion of a policy which is still referenced by principals. Instead, allow principals to refer to policy names which do not exist as policy objects; treat those principals as having no associated policy. In the kadmin client, warn if addprinc or modprinc tries to reference a policy which doesn't exist, since the server will no longer error out in this case. ticket: 7385
* Stop loading policy for pw_expiration in LDAPGreg Hudson2013-01-091-24/+0
| | | | | | | | | | | populate_krb5_db_entry() performs a subsidiary LDAP search to load the password policy, which it uses to update the pw_expiration field. This has some minimal value (it causes pw_expiration values in principals to auto-update whenever the pw_max_life field of a policy changes), but it's complicated, expensive, and inconsistent with the DB2 back end. Get rid of it. ticket: 7535 (new)
* Fix various result checksNickolai Zeldovich2013-01-071-1/+1
| | | | | | | | | | | Correct three cases where the wrong expression was checked to see if an allocation function returned null. [ghudson@mit.edu: commit message, patch splitting] ticket: 7534 target_version: 1.11.1 tags: pullup
* Avoid null dereference in BDB dbtree error caseGreg Hudson2012-12-201-3/+3
| | | | | | | | | An error case in __bt_first would deference a null pointer. This is an old upstream BDB bug. Use a separate variable to hold the result of mpool_get() until it has been checked. Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>. ticket: 7511
* Get rid of KRB5_KDB_SRV_TYPE_PASSWDGreg Hudson2012-12-201-2/+0
| | | | | | Nothing was using KRB5_KDB_SRV_TYPE_PASSWD, so get rid of it. (kpasswdd is part of kadmind and interacts with the KDB using KRB5_KDB_SRV_TYPE_ADMIN.)
* Generate dependencies for kdb5_ldap_utilGreg Hudson2012-12-202-1/+105
|
* Remove LDAP realm krbTicketPolicyReference codeGreg Hudson2012-12-202-51/+1
| | | | | | ldap_realm.c had some code intended to handle a krbTicketPolicyReference from a krbRealmContainer object, but there wasn't enough of it to ever do anything. Remove it.
* Simplify LDAP KDB module container DN handlingGreg Hudson2012-12-2011-290/+87
| | | | | | | | | | | | | | | | | Outside of krb5_ldap_read_krbcontainer_params and krb5_ldap_create_krbcontainer, no fields of krb5_ldap_krbcontainer_params were used except for the DN. There was code to create a krbTicketPolicyReference attribute (which would fail because the schema doesn't allow that attribute, and was never exercised because kdb5_ldap_util would never set the parameter) and to read fields like max ticket life from the referenced ticket policy, but those fields were never used. Eliminate the structure and just store the container DN in krb5_ldap_context. Continue creating the container object when creating a realm (by calling krb5_ldap_create_krbcontainer unconditionally; it now exits successfully if the container already exists), but don't ever read it.
* Remove unneeded code in krb5_ldap_put_principalGreg Hudson2012-12-201-17/+7
| | | | | | krb5_ldap_put_principal contained some conditionals for the case where entry->princ is NULL, but only after entry->princ was dereferenced unconditionally. It's not necessary to handle this case, so don't.
* Remove unused functions in the LDAP KDB moduleGreg Hudson2012-12-205-342/+0
|
generated by cgit (git 2.34.1) at 2025-09-26 01:47:16 +0000