45 Commits

Author SHA1 Message Date
408a62a7b4 cf: Add --with-mitdb=PATH option
OS X builds started thinking they have the mitdb backend and started
failing the tests/kdc/check-mitdb test.  This commit fixes that by
requiring explicit enablement of the mitdb HDB backend.
2024-01-16 16:28:35 -06:00
e3e271ff70 hdb/hdb-mitdb: Nix unused variable key_data in mdb_seq.
key_data is unused.  Presumably this was copypasta from DB_seq in
hdb/db.c, where it is used for the Heimdal database format in which
the value may be missing a principal but it can be recovered from the
key.  In contrast, the mit-krb5 format appears to always store the
principal in the value and _hdb_mdb_value2entry always retrieves it,
with no need for a key2principal fallback.

fix https://github.com/heimdal/heimdal/issues/1102
2023-06-20 23:18:08 -05:00
2e729a9aa2 hdb: Fix coverity warnings 2022-01-17 17:32:24 -06:00
0e8c4ccc6e hdb: eliminate hdb_entry_ex
Remove hdb_entry_ex and revert to the original design of hdb_entry (except with
an additional context member in hdb_entry which is managed by the free_entry
method in HDB).
2022-01-15 18:54:57 +11:00
c5551775e2 hdb: decorate HDB_entry with context member
Decorate HDB_entry with context and move free_entry callback into HDB structure
itself. Requires updating hdb_free_entry() signature to include HDB parameter.
A follow-up commit will consolidate hdb_entry_ex (which has a single hdb_entry
member) into hdb_entry.
2022-01-15 18:54:57 +11:00
4f8399a433 hdb: Fix warnings and leaks 2022-01-14 17:10:16 -06:00
db7763ca7b asn1: X.681/682/683 magic handling of open types
Status:

 - And it works!

 - We have an extensive test based on decoding a rich EK certficate.

   This test exercises all of:

    - decoding
    - encoding with and without decoded open types
    - copying of decoded values with decoded open types
    - freeing of decoded values with decoded open types

   Valgrind finds no memory errors.

 - Added a manual page for the compiler.

 - rfc2459.asn1 now has all three primary PKIX types that we care about
   defined as in RFC5912, with IOS constraints and parameterization:

    - `Extension`       (embeds open type in an `OCTET STRING`)
    - `OtherName`       (embeds open type in an        `ANY`-like type)
    - `SingleAttribute` (embeds open type in an        `ANY`-like type)
    - `AttributeSet`    (embeds open type in a  `SET OF ANY`-like type)

   All of these use OIDs as the open type type ID field, but integer
   open type type ID fields are also supported (and needed, for
   Kerberos).

   That will cover every typed hole pattern in all our ASN.1 modules.

   With this we'll be able to automatically and recursively decode
   through all subject DN attributes even when the subject DN is a
   directoryName SAN, and subjectDirectoryAttributes, and all
   extensions, and all SANs, and all authorization-data elements, and
   PA-data, and...

   We're not really using `SingleAttribute` and `AttributeSet` yet
   because various changes are needed in `lib/hx509` for that.

 - `asn1_compile` builds and recognizes the subset of X.681/682/683 that
   we need for, and now use in, rfc2459.asn1.  It builds the necessary
   AST, generates the correct C types, and generates templating for
   object sets and open types!

 - See READMEs for details.

 - Codegen backend not tested; I won't make it implement automatic open
   type handling, but it should at least not crash by substituting
   `heim_any` for open types not embedded in `OCTET STRING`.

 - We're _really_ starting to have problems with the ITU-T ASN.1
   grammar and our version of it...

   Type names have to start with upper-case, value names with
   lower-case, but it's not enough to disambiguate.

   The fact the we've allowed value and type names to violate their
   respective start-with case rules is causing us trouble now that we're
   adding grammar from X.681/682/683, and we're going to have to undo
   that.

   In preparation for that I'm capitalizing the `heim_any` and
   `heim_any_set` types, and doing some additional cleanup, which
   requires changes to other parts of Heimdal (all in this same commit
   for now).

   Problems we have because of this:

    - We cannot IMPORT values into modules because we have no idea if a
      symbol being imported refers to a value or a type because the only
      clue we would have is the symbol's name, so we assume IMPORTed
      symbols are for types.

      This means we can't import OIDs, for example, which is super
      annoying.

      One thing we might be able to do here is mark imported symbols as
      being of an undetermined-but-not-undefined type, then coerce the
      symbol's type the first time it's used in a context where its type
      is inferred as type, value, object, object set, or class.  (Though
      since we don't generate C symbols for objects or classes, we won't
      be able to import them, especially since we need to know them at
      compile time and cannot defer their handling to link- or
      run-time.)

    - The `NULL` type name, and the `NULL` value name now cause two
      reduce/reduce conflicts via the `FieldSetting` production.

    - Various shift/reduce conflicts involving `NULL` values in
      non-top-level contexts (in constraints, for example).

 - Currently I have a bug where to disambiguate the grammar I have a
   CLASS_IDENTIFIER token that is all caps, while TYPE_IDENTIFIER must
   start with a capital but not be all caps, but this breaks Kerberos
   since all its types are all capitalized -- oof!

   To fix this I made it so class names have to be all caps and
   start with an underscore (ick).

TBD:

 - Check all the XXX comments and address them
 - Apply this treatment to Kerberos!  Automatic handling of authz-data
   sounds useful :)
 - Apply this treatment to PKCS#10 (CSRs) and other ASN.1 modules too.
 - Replace various bits of code in `lib/hx509/` with uses of this
   feature.
 - Add JER.
 - Enhance `hxtool` and `asn1_print`.

Getting there!
2021-02-28 18:13:08 -06:00
5447b81fb1 hdb: Move virtual principals into HDB layer
This is a large commit that adds several features:

 - Revamps and moves virtual host-based service principal functionality
   from kdc/ to lib/hdb/ so that it may be automatically visible to
   lib/kadm5/, as well as kadmin(1)/kadmind(8) and ktutil(1).

   The changes are backwards-incompatible.

 - Completes support for documenting a service principal's supported
   enctypes in its HDB entry independently of its long-term keys.  This
   will reduce HDB bloat by not requiring that service principals have
   more long-term keys than they need just to document the service's
   supported enctypes.

 - Adds support for storing krb5.conf content in principals' HDB
   entries.  This may eventually be used for causing Heimdal KDC
   services to reconfigure primary/secondary roles automatically by
   discovering the configured primary in an HDB entry for the realm.

   For now this will be used to help reduce the amount of configuration
   needed by clients of an upcoming HTTP binding of the kadmin service.
2020-09-08 00:25:36 -05:00
176fe6c06c hdb: fix uninitialized variable use in MIT bridge 2018-12-20 16:25:51 +11:00
b0e4fcd257 hdb-mitdb: Commit 57f1545a broke support of REQUIRES_PWCHANGE during MIT DB imports 2018-10-03 20:03:03 -04:00
3bcc031939 hdb-mitdb: correct missing equals in initialization 2017-10-19 19:49:22 -04:00
5bcbe2125b Add hdb_set_sync() method 2017-10-10 13:07:18 -05:00
122cdc578e Fix some krb5_storage_write() usages 2017-05-26 23:24:30 -04:00
f38089257b Misc fixes (coverity) 2016-11-20 17:43:51 -06:00
82054b4b79 lib/hdb/hdb-mitdb.c: this was failing to build due to undefined variables. 2016-05-12 16:44:51 -04:00
20df2c8706 Two-phase HDB commit via iprop log, + GC for log
We used to update the iprop log and HDB in different orders depending on
the kadm5 operation, which then led to various race conditions.

The iprop log now functions as a two-phase commit (with roll forward)
log for HDB changes.  The log is auto-truncated, keeping the latest
entries that fit in a configurable maximum number of bytes (defaults to
50MB).  See the log-max-size parameter description in krb5.conf(5).

The iprop log format and the protocol remain backwards-compatible with
earlier versions of Heimdal.  This is NOT a flag-day; there is NO need
to update all the slaves at once with the master, though it is advisable
in general.  Rolling upgrades and downgrades should work.

The sequence of updates is now (with HDB and log open and locked):

a) check that the HDB operation will succeed if attempted,
b) append to iprop log and fsync() it,
c) write to HDB (which should fsync()),
d) mark last log record committed (no fsync in this case).

Every kadm5 write operation recover transactions not yet confirmed as
committed, thus there can be at most one unconfirmed commit on a master
KDC.

Reads via kadm5_get_principal() also attempt to lock the log, and if
successful, recover unconfirmed transactions; readers must have write
access and must win any race to lock the iprop log.

The ipropd-master daemon also attempts to recover unconfirmed
transactions when idle.

The log now starts with a nop record whose payload records the offset of
the logical end of the log: the end of the last confirmed committed
transaction.  This is kown as the "uber record".  Its purpose is
two-fold: act as the confirmation of committed transactions, and provide
an O(1) method of finding the end of the log (i.e., without having to
traverse the entire log front to back).

Two-phase commit makes all kadm5 writes single-operation atomic
transactions (though some kadm5 operations, such as renames of
principals, and changes to principals' aliases, use multiple low-level
HDB write operations, but still all in one transaction).  One can still
hold a lock on the HDB across many operations (e.g., by using the lock
command in a kadmin -l or calling kadm5_lock()) in order to push
multiple transactions in sequence, but this sequence will not be atomic
if the process or host crashes in the middle.

As before, HDB writes which do not go through the kadm5 API are excluded
from all of this, but there should be no such writes.

Lastly, the iprop-log(1) command is enhanced as follows:

 - The dump, last-version, truncate, and replay sub-commands now have an
   option to not lock the log.  This is useful for inspecting a running
   system's log file, especially on slave KDCs.

 - The dump, last-version, truncate, and replay sub-commands now take an
   optional iprop log file positional argument, so that they may be used
   to inspect log files other than the running system's
   configured/default log file.

Extensive code review and some re-writing for clarity by Viktor Dukhovni.
2016-02-26 00:55:33 -06:00
528b6d093c coverity 1164092 2015-04-18 23:19:25 -05:00
2c16b0da30 Be verbose about MIT dump entry parsing failures 2013-11-20 01:07:54 -06:00
e9d21aeffc Fix bug in loading MIT dumps 2013-11-20 01:07:54 -06:00
a53f3a49e2 Fix unused variable warnings 2013-06-02 15:52:41 -05:00
216bfa564d rename mdb to mitdb 2012-10-06 15:38:56 -07:00
a3947acb38 Fix segfault in MIT dump entry parsing code 2012-05-19 21:57:53 -05:00
57f1545a46 Add support for writing to KDB and dumping HDB to MIT KDB dump format
Before this change Heimdal could read KDBs.  Now it can write to
    them too.

    Heimdal can now also dump HDBs (including KDBs) in MIT format, which
    can then be imported with kdb5_util load.

    This is intended to help in migrations from MIT to Heimdal by
    allowing migrations from Heimdal to MIT so that it is possible
    to rollback from Heimdal to MIT should there be any issues.  The
    idea is to allow a) running Heimdal kdc/kadmind with a KDB, or
    b) running Heimdal with an HDB converted from a KDB and then
    rollback by dumping the HDB and loading a KDB.

    Note that not all TL data types are supported, only two: last
    password change and modify-by.  This is the minimum necessary.
    PKINIT users may need to add support for KRB5_TL_USER_CERTIFICATE,
    and for databases with K/M history we may need to add KRB5_TL_MKVNO
    support.

    Support for additional TL data types can be added in
    lib/hdb/hdb-mitdb.c:_hdb_mdb_value2entry() and
    lib/hdb/print.c:entry2mit_string_int().
2012-05-03 14:24:18 -05:00
0da84c0c3a Add require-pwchange flag to HDB and honour it if present in mit-db:. 2012-02-27 10:19:54 +00:00
19b6c47f72 Handle 1DES enctype similarity in MIT HDB
We have some cross-realm principals in an MIT KDB with one kind of
    1DES enctype, but the other realm's KDCs issue x-realm TGTs where
    the ticket encpart key enctype is a different 1DES enctype.  We need
    this to work if we use Heimdal with the MIT HDB backend.

    An alternative would be to check for similar (or, rather,
    compatible) enctypes in the KDC (and elsewhere?).  This patch avoids
    the need to make such ugly changes elsewhere.
2011-11-09 00:59:15 -06:00
1b03abb250 This should be the final fix for enctype 0 issues (tested)
But how to build an MIT KDB with enctype 0 keys for testing in
    Heimdal?  Hmmm...
2011-10-06 00:55:54 -05:00
e15cabe10a Fix for enctype 0 / length 0 keys in MIT HDB backend was incomplete 2011-10-05 17:50:26 -05:00
3d6f86af27 Fix segfault in hdb-mitdb when princ have salt 2011-10-02 23:08:37 -05:00
923f3a434f free krb5_storage when dne 2011-09-30 12:44:34 +02:00
0c893d3980 Fixed booboos from kadm5 key history patch set
Also: add support for ignoring null enctype / zero-length keys,
    which *can* be found in MIT DB entries created in pre-historic
    times.

    Also: make the mitdb HDB backend more elegant (e.g., use the ASN.1
    compiler's generated sequence/array utility functions.

    Also: add a utility function needed for kadm5 kvno change
    improvements and make kadmin's mod --kvno work correctly and
    naturally.

Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
2011-09-22 15:13:13 +02:00
95262936c7 s/assert/heim_assert/ and remove dead code 2011-07-24 11:07:27 -05:00
abd94953e2 Fixes to lock nesting code. 2011-07-22 16:04:52 -05:00
58d72035f1 Added kadm5_lock() and unlock. 2011-07-22 16:04:52 -05:00
e7f385ad0d Initial patch to make the MIT KDB backend for HDB handle multiple kvnos. 2011-07-22 16:04:51 -05:00
0879b9831a remove trailing whitespace 2011-05-21 11:57:31 -07:00
f5f9014c90 Warning fixes from Christos Zoulas
- shadowed variables
- signed/unsigned confusion
- const lossage
- incomplete structure initializations
- unused code
2011-04-29 20:25:05 -07:00
b5137810fb Various bug fixes in hdb-mitdb.c.
Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
2011-04-04 22:44:58 -07:00
941eba430b Fixed a bug by s/u16/SEEK_CURR/; the bug prevented this mitdb backend from parsing MIT KDB entries with multiple kvnos in non-increasing order.
Fixed a double-free bug that was triggered by MIT KDB entries with
multiple kvnos in non-increasing order.

Added lots of comments regarding the MIT KDB entry format.

Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
2011-04-04 22:44:57 -07:00
987658325e correctly decode MIT KDB flags
Patch from Nico Williams <nico@cryptonector.com>
2011-03-23 11:26:50 +11:00
0a10f35897 drop unused functions 2010-11-28 11:50:42 -08:00
6c6726d76c drop hdb_fetch 2010-11-28 11:46:46 -08:00
daa3d4753d implement fetch_kvno 2010-11-28 11:31:15 -08:00
1be05e6568 support KRB5_KDB_SALTTYPE_CERTHASH 2010-11-27 13:27:35 -08:00
bf3b753298 less warnings 2009-11-22 14:37:45 -08:00
89b14e91c2 backend to read the MIT Kerberos databse file directly 2009-11-22 12:52:57 -08:00