summaryrefslogtreecommitdiffstats
path: root/src/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
* Allow principals to refer to nonexistent policiesGreg Hudson2013-01-091-7/+0
| | | | | | | | | | | | | | Stop using and maintaining the policy_refcnt field, and do not try to prevent deletion of a policy which is still referenced by principals. Instead, allow principals to refer to policy names which do not exist as policy objects; treat those principals as having no associated policy. In the kadmin client, warn if addprinc or modprinc tries to reference a policy which doesn't exist, since the server will no longer error out in this case. ticket: 7385
* Stop loading policy for pw_expiration in LDAPGreg Hudson2013-01-091-24/+0
| | | | | | | | | | | populate_krb5_db_entry() performs a subsidiary LDAP search to load the password policy, which it uses to update the pw_expiration field. This has some minimal value (it causes pw_expiration values in principals to auto-update whenever the pw_max_life field of a policy changes), but it's complicated, expensive, and inconsistent with the DB2 back end. Get rid of it. ticket: 7535 (new)
* Fix various result checksNickolai Zeldovich2013-01-072-2/+2
| | | | | | | | | | | Correct three cases where the wrong expression was checked to see if an allocation function returned null. [ghudson@mit.edu: commit message, patch splitting] ticket: 7534 target_version: 1.11.1 tags: pullup
* Avoid null dereference in BDB dbtree error caseGreg Hudson2012-12-201-3/+3
| | | | | | | | | An error case in __bt_first would deference a null pointer. This is an old upstream BDB bug. Use a separate variable to hold the result of mpool_get() until it has been checked. Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>. ticket: 7511
* Get rid of KRB5_KDB_SRV_TYPE_PASSWDGreg Hudson2012-12-201-2/+0
| | | | | | Nothing was using KRB5_KDB_SRV_TYPE_PASSWD, so get rid of it. (kpasswdd is part of kadmind and interacts with the KDB using KRB5_KDB_SRV_TYPE_ADMIN.)
* Generate dependencies for kdb5_ldap_utilGreg Hudson2012-12-202-1/+105
|
* Remove LDAP realm krbTicketPolicyReference codeGreg Hudson2012-12-202-51/+1
| | | | | | ldap_realm.c had some code intended to handle a krbTicketPolicyReference from a krbRealmContainer object, but there wasn't enough of it to ever do anything. Remove it.
* Simplify LDAP KDB module container DN handlingGreg Hudson2012-12-2011-290/+87
| | | | | | | | | | | | | | | | | Outside of krb5_ldap_read_krbcontainer_params and krb5_ldap_create_krbcontainer, no fields of krb5_ldap_krbcontainer_params were used except for the DN. There was code to create a krbTicketPolicyReference attribute (which would fail because the schema doesn't allow that attribute, and was never exercised because kdb5_ldap_util would never set the parameter) and to read fields like max ticket life from the referenced ticket policy, but those fields were never used. Eliminate the structure and just store the container DN in krb5_ldap_context. Continue creating the container object when creating a realm (by calling krb5_ldap_create_krbcontainer unconditionally; it now exits successfully if the container already exists), but don't ever read it.
* Remove unneeded code in krb5_ldap_put_principalGreg Hudson2012-12-201-17/+7
| | | | | | krb5_ldap_put_principal contained some conditionals for the case where entry->princ is NULL, but only after entry->princ was dereferenced unconditionally. It's not necessary to handle this case, so don't.
* Remove unused functions in the LDAP KDB moduleGreg Hudson2012-12-205-342/+0
|
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-195-47/+57
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* PKINIT (draft9) null ptr deref [CVE-2012-1016]Nalin Dahyabhai2012-12-141-2/+3
| | | | | | | | | | | | | | | | | | Don't check for an agility KDF identifier in the non-draft9 reply structure when we're building a draft9 reply, because it'll be NULL. The KDC plugin for PKINIT can dereference a null pointer when handling a draft9 request, leading to a crash of the KDC process. An attacker would need to have a valid PKINIT certificate, or an unauthenticated attacker could execute the attack if anonymous PKINIT is enabled. CVSSv2 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C [tlyu@mit.edu: reformat comment and edit log message] ticket: 7506 (new) target_version: 1.11 tags: pullup
* Fix various integer issuesGreg Hudson2012-12-101-31/+12
| | | | | | | | | | | | | | | In kdc_util.c and spnego_mech.c, error returns from ASN.1 length functions could be ignored because they were assigned to unsigned values. In spnego_mech.c, two buffer size checks could be rewritten to reduce the likelihood of pointer overflow. In dump.c and kdc_preauth.c, calloc() could be used to simplify the code and avoid multiplication overflow. In pkinit_clnt.c, the wrong value was checked for a null result from malloc(), and the code could be simplified. Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>. ticket: 7488
* Fix quoting issues in LDAP KDB moduleGreg Hudson2012-11-173-81/+30
| | | | | | | | | | | | | | | Modify ldap_filter_correct() to quote special characters for DN strings as well as filters, since it is already used to quote a DN string in krb5_ldap_name_to_policydn() and there's no harm in over-quoting. In krb5_ldap_put_principal(), quote the unparsed principal name for use in DNs we choose. In krb5_ldap_create_password_policy(), use the policy name for the CN of the policy entry instead of the (possibly quoted) first element of the DN. Adapted from a patch by Jim Shi <hanmao_shi@apple.com>. ticket: 7296
* Don't use PA_PSEUDO in pkinit client codeGreg Hudson2012-10-221-1/+1
| | | | | PA_PSEUDO only has meaning for kdcpreauth modules. Don't use it in the flags method of the pkinit clpreauth module.
* make dependGreg Hudson2012-10-171-6/+6
|
* Use config storage for client identity selectionNalin Dahyabhai2012-10-178-40/+403
| | | | | | | | * Keep track of the names of client identities when we load them. * Store the client identity we just used when we create or retry a client request. * If we read a client identity from the configuration, treat it like the KDC does: pick the "this is it, there is no other" logic branch.
* Remove install-oldmanBen Kaduk2012-10-171-3/+0
| | | | | | The old man pages are gone, so we can't install them anymore. Also clean up install and install-unix targets that were installing the old man pages by hand.
* Use blocking locks for policy DBGreg Hudson2012-10-161-19/+6
| | | | | | | In the db2 kdb module, use blocking locks for the policy DB as well as the principal DB. ticket: 7359
* Remove nroff man pagesBen Kaduk2012-10-161-938/+0
| | | | | | | We generate man pages from RST sources now; they are checked into the tree in src/man/. The gen-manpages directory is no longer needed.
* Handle anonymous-as-signed-data-with-no-signersNalin Dahyabhai2012-10-151-27/+28
| | | | | Update to generate and consume signed-data with no signer-info, which we need for anonymous PKINIT.
* Make sure that pkinit_octetstring_hkdf() inits NSSNalin Dahyabhai2012-10-151-0/+15
| | | | | Create an NSS context for use when performing KDF, so that the tests, which call into the function directly, will work.
* Don't try to free an uninitialized keyblockNalin Dahyabhai2012-10-151-2/+0
|
* Sanity-check loading keys and certs from PEM filesNalin Dahyabhai2012-10-151-0/+15
| | | | | Print a debug message if we're unable to locate the matching private key for a certificate when we've just loaded both of them from PEM files.
* Reset the prompt_types list after calling prompterNalin Dahyabhai2012-10-151-0/+1
| | | | | Reset the prompt_types list immediately after the prompter callback returns, as is done everywhere else.
* Remove osa_adb_rename_dbGreg Hudson2012-09-132-51/+0
| | | | | This function wasn't used anywhere. Also remove the declaration for osa_adb_close_policy(), which doesn't exist.
* Fix lock inconsistency in ctx_unlock()Nicolas Williams2012-09-121-4/+8
| | | | | | | | | | | | | | | | | | | | | The lock inconsistency fixed here is quite possibly the same as described in https://bugzilla.redhat.com/show_bug.cgi?id=586032 . The problem is that ctx_unlock() fails to unlock the principal DB if it fails to unlock the policy DB, and this happens when ctx_lock() fails to lock the policy DB (likely because the caller is racing against a kdb5_util load, which will be using a "permanent" lock, meaning that the lock file will be unlinked after acquiring the lock). The fix is to perform both unlock operations *then* handle any errors that either or both might have returned. Additionally, we don't really need or want to use non-blocking locks, and we certainly don't want to sleep(1) in krb5kdc (possibly several times, as there was a loop over this) when either of the principal or policy DB is locked. Some callers still request non-blocking locks, and ctx_lock() still honors this. ticket: 7360 (new)
* Use blocking locks in krb5kdc and libkadm5srvNicolas Williams2012-09-122-35/+19
| | | | | | | | | | We don't really need or want to use non-blocking locks, and we certainly don't want to sleep(1) in krb5kdc (possibly several times, as there was a loop over this) when either of the principal or policy DB is locked. Some callers still request non-blocking locks, and ctx_lock() still honors this. ticket: 7359 (new)
* Run "make depend"Tom Yu2012-08-231-8/+12
|
* Add LDAP back end support for policy extensionsGreg Hudson2012-07-303-2/+127
| | | | ticket: 7223
* Policy extensions + new policy: allowed ks typesNicolas Williams2012-07-302-49/+27
| | | | | | | | | | | | | | | | | This simply adds KADM5_API_VERSION_4 and various fields to the policy structures: - attributes (policy-ish principal attributes) - max_life (max ticket life) - max_renewable_life (max ticket renewable life) - allowed_keysalts (allowed key/salt types) - TL data (future policy extensions) Of these only allowed_keysalts is currently implemented. Some refactoring of TL data handling is also done. ticket: 7223 (new)
* Remove eDirectory support code in LDAP KDB moduleGreg Hudson2012-07-2918-5136/+23
|
* Factor out LDAP policy marshallingGreg Hudson2012-07-261-32/+55
| | | | | | Use a helper function add_policy_mods() in krb5_ldap_create_password_policy() and krb5_ldap_put_password_policy() to avoid duplicating code for each field.
* Remove obsolete code in ldap_pwd_policy.cGreg Hudson2012-07-261-36/+0
| | | | | r18750 refactored some policy fetching code into populate_policy(), and left the old code in #if 0 blocks. Get rid of those blocks now.
* Handle huge /bin directories in libdb2 testTom Yu2012-07-121-6/+7
| | | | | | | | | | | | The test suite for libdb2 uses /bin as a source of filenames and contents for insertion into databases. Fedora 17 (and possibly other OSes) have /bin symlinked to /usr/bin, which can vastly increase the number of files found, exceeding some limits of the test databases. Truncate this list of files at 100 to prevent this problem. ticket: 7201 (new) status: pullup target_version: 1.10.3
* Allow using locales when gettext is absentBen Kaduk2012-07-061-0/+1
| | | | | | | | | | | Previously, if configure did not detect dgettext(), we disabled anything that smelled like localization, inadvertently including setlocale(). Now that we use setlocale(LC_ALL, ""), we have localized dates available as well as messages, so we should not disable calls to setlocale() any more. Since the routines from locale.h are only used in a relatively small number of places, just include the header directly in those files and remove it from k5-platform.h.
* Enable all localizations in main functionsBen Kaduk2012-07-061-1/+1
| | | | | | | | | | | | | | | Bite the bullet and pass LC_ALL to setlocale() instead of just LC_MESSAGES. Calls to setlocale() itself were introduced in fabbf9e443459e8c0161c84563690ed70c7f6a61 for ticket 6918, but only for LC_MESSAGES since only localized strings were needed and that was the most conservative option. However, klist, kadmin, and kinit (and perhaps others) would benefit from localized formats for times (i.e., LC_TIME). If potentially localized data is being sent on the wire, that is a bug that should be fixed. No such bugs are found with the current test suite, so we are comfortable enabling LC_ALL at this time. ticket: 7192
* Simplify pkinit_server_verify_padata slightlyGreg Hudson2012-07-051-7/+2
| | | | | Eliminate the effectively unused variable tmp_as_req, and eliminate two unnecessary conditionals for freeing pointers.
* Simplify and fix pkinit_as_req_create cleanupGreg Hudson2012-07-051-11/+5
| | | | | | Avoid dereferencing a null auth_pack pointer if we run out of memory initializing info or auth_pack. Eliminate an unnecessary switch by just cleaning up all of the potentially allocated variables.
* Fix minor memory leaks in PKINIT codeGreg Hudson2012-07-051-0/+2
|
* Fix PKINIT verify_kdc_eku trace loggingGreg Hudson2012-07-051-1/+1
| | | | Test the value of the eku_accepted output parameter, not the pointer.
* Clean up const usage for supported_kdf_alg_idsBen Kaduk2012-07-032-2/+2
| | | | | The previous declaration had redundant consts and missed making the actual pointers stored in the array const.
* Minor cleanups relating to size_t being unsignedBen Kaduk2012-07-031-1/+1
| | | | | | | | | | | In order to use -1 as a sentinel value, we should explicitly cast to make it clear what we are doing. It might be better to use a less convoluted sentinel value such as SIZE_T_MAX, though. Additionally, since size_t is unsigned and at least as wide as an int, a loop with int index variable that compares against a size_t for its termination check could become an infinite loop. Make the loop index size_t for consistency.
* Handle PKINIT DH replies with no certsGreg Hudson2012-06-221-1/+8
| | | | | | | | | | | | | | | If a PKINIT Diffie-Hellman reply contains no certificates in the SignedData object, that may be because the signer certificate was a trust anchor as transmitted to the KDC. Heimdal's KDC, for instance, filters client trust anchors out of the returned set of certificates. Match against idctx->trustedCAs and idctx->intermediateCAs to handle this case. This fix only works with OpenSSL 1.0 or later; when built against OpenSSL 0.9.x, the client will still require a cert in the reply. Code changes suggested by nalin@redhat.com. ticket: 7183
* Fix -DDEBUG compilation errorsHenry B. Hotz2012-06-041-0/+1
| | | | ticket: 7150
* Add missing $(LIBS) to some shared librariesTom Yu2012-05-171-1/+1
| | | | | | | | | | Add $(LIBS) to the $(SHLIB_EXPLIBS) for some shared libraries which did not previously include it, which prevented gcov from working properly in some cases. Patch from W. Trevor King. ticket: 7138
* First pass at PKINIT client trace logsGreg Hudson2012-05-084-25/+156
| | | | | | Trace basic decisions about PKINIT client protocol processing. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25855 dc483132-0cff-0310-8789-dd5450dbe970
* Improve traced error messages from PKINIT clientGreg Hudson2012-05-082-2/+9
| | | | | | | | If we have no configured PKINIT client identity, or if we fail to create a certificate chain, set a reasonable error code (not EINVAL or ENOMEM) and a useful error message to appear in trace log output. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25854 dc483132-0cff-0310-8789-dd5450dbe970
* Make it easier to test SAM-2 client codeGreg Hudson2012-04-266-120/+407
| | | | | | | | | | | | | Add a method to the securid_sam2 plugin, built with alternate compile-time flags, which supplies a plain-text challenge to the client to be used as the OTP value. This lets us manually exercise the SAM-2 client code and a little bit of the KDC code. securid_make_sam_challenge_2_and_cksum is moved into the method- independent code and renamed. get_securid_edata_2 has its sc2b parameter removed as it was not used by the caller. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25832 dc483132-0cff-0310-8789-dd5450dbe970
* Fix KDB iteration when callback does write callsGreg Hudson2012-03-011-4/+2
| | | | | | | | | | | | | | | | | | | kdb_db2's ctx_iterate makes an convenience alias to dbc->db in order to call more invoke call the DB's seq method. This alias may become invalidated if the callback writes to the DB, since ctx_lock() may re-open the DB in order to acquire a write lock. Fix the bug by getting rid of the convenience alias. Most KDB iteration operations in the code base do not write to the DB, but kdb5_util update_princ_encryption does. Bug discovered and diagnosed by will.fiveash@oracle.com. ticket: 7096 target_version: 1.10.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25723 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2025-09-26 14:07:10 +0000