Commit Graph

740 Commits

Author SHA1 Message Date
Nicolas Williams
475c222472 Fix lib/hdb/test_hdbplugin 2016-11-15 13:54:45 -06:00
Nicolas Williams
09f0a25fda kdc --builtin-hdb should list loadable backends
This fixes the following problems from #210:

 - hdb_ldap doesn't load even when installed correctly
 - loadable hdb backends not listed by kdc --builtin-hdb

Not fixed:

 - hdb_ldap.so not installed in plugin dir
2016-11-15 11:34:54 -06:00
Jeffrey Altman
19e8852697 hdb: hdb_ldap_common NULL dereference
In hdb_ldap_common() the test

  if (search_base == NULL && search_base[0] == '\0')
     error handling ...

must be

  if (search_base == NULL || search_base[0] == '\0')
     error handling ...

Change-Id: I8d876a9c56833431b3c4b582fbb0a8cc7353893d
2016-11-14 16:33:51 -05:00
Jeffrey Altman
95c2940a02 hdb: LDAP_message2entry fix ntPasswordIN leak
free ntPasswordIN from all exit paths.  Do not leak it.

Change-Id: I90c5240439eefabca4458fe4791eb0de693a50f7
2016-11-14 16:25:36 -05:00
Viktor Dukhovni
e1c1cdb1b6 HDB compiler warnings 2016-11-14 02:22:51 -05:00
Viktor Dukhovni
cf69f3321d Fix cut/paste error from f5f76ee7 that breaks LDAP 2016-11-14 16:39:42 +11:00
Nicolas Williams
b83cf2f3bd Support db1 and db3 at the same time 2016-11-08 15:41:38 -06:00
Marcin Cieślak
033001e732 Prefer BDB3/4/5 to BDB1/2 2016-11-08 15:48:40 -05:00
Luke Howard
7b720cf61c krb5: implement draft-ietf-kitten-aes-cts-hmac-sha2-07 2016-10-08 08:17:11 +02:00
Roland C. Dowdeswell
82054b4b79 lib/hdb/hdb-mitdb.c: this was failing to build due to undefined variables. 2016-05-12 16:44:51 -04:00
Nicolas Williams
490337f4f9 Make OpenSSL an hcrypto backend proper
This adds a new backend for libhcrypto: the OpenSSL backend.

Now libhcrypto has these backends:

 - hcrypto itself (i.e., the algorithms coded in lib/hcrypto)
 - Common Crypto (OS X)
 - PKCS#11 (specifically for Solaris, but not Solaris-specific)
 - Windows CNG (Windows)
 - OpenSSL (generic)

The ./configure --with-openssl=... option no longer disables the use of
hcrypto.  Instead it enables the use of OpenSSL as a (and the default)
backend in libhcrypto.  The libhcrypto framework is now always used.

OpenSSL should no longer be used directly within Heimdal, except in the
OpenSSL hcrypto backend itself, and files where elliptic curve (EC)
crypto is needed.

Because libhcrypto's EC support is incomplete, we can only use OpenSSL
for EC.  Currently that means separating all EC-using code so that it
does not use hcrypto, thus the libhx509/hxtool and PKINIT EC code has
been moved out of the files it used to be in.
2016-04-15 00:16:17 -05:00
Jeffrey Altman
278cd63306 lib/hdb: hdb_method functions !KRB5_LIB_CALL
The hdb_method functions cannot be KRB5_LIB_CALL as lib/hdb is not
lib/krb5.  KRB5_LIB_CALL will be inconsistently defined.

This inconsistency resulted in crashes of test_hdbplugin on 32-bit
Windows.

Change-Id: I4cf8d3ef76f31a3cae923df234a19610d956e7ee
2016-04-11 00:33:42 -05:00
Nicolas Williams
a114690bde Fix HDB two-phase commit for LDAP backend
We can't replay log entries when recovering if the backend is shared by
writers with separate logs (or no logs at all), i.e., on other hosts.
2016-02-29 22:12:51 -06:00
Nicolas Williams
2b5ddafab5 HDB sqlite backend: fix error NULL deref 2016-02-29 19:13:10 -06:00
Viktor Dukhovni
579393c8b9 Optionally prune old keys when setting new keys.
When new keys are added (typically via kadm5_setkey_principal_3),
truncate the key history to remove old keys, that is keys older than
the newest key which was in effect prior longer ago than the principal's
maximum ticket lifetime.  This feature is controlled via the "[kadmin]"
section's "prune-key-history" boolean parameter, which defaults to false.

Currently this happens only when kadm5_setkey_principal_3()
is called directly on the server, the client API simulates
kadm5_setkey_principal_3() via a get, update, modify sequence that does
not prune the key history.  The plan is to add a new kadm5 protocol RPC
and convert clients to call that instead.

In setkey_principal_3 seal keys after entry key update

Also, for now, don't check the return value of kadm5_log_modify() in
the new kadm5_s_setkey_principal_3().  This has to be addressed more
globally.

Censor stale keys in kadm5_s_get_principal
2016-02-26 15:43:12 -05:00
Nicolas Williams
047daa077a Windows: build lib/hdb/hdb-mdb.c (LMDB) 2016-02-26 12:08:30 -06:00
Nicolas Williams
50a45a946d Fix more HDB SQLite3 issues
Fix some issues reported by Jeffrey Hutzelman.
2016-02-26 01:04:32 -06:00
Nicolas Williams
5867aa6873 hdb-sqlite: fix error code confusion 2016-02-26 01:04:32 -06:00
Nicolas Williams
20df2c8706 Two-phase HDB commit via iprop log, + GC for log
We used to update the iprop log and HDB in different orders depending on
the kadm5 operation, which then led to various race conditions.

The iprop log now functions as a two-phase commit (with roll forward)
log for HDB changes.  The log is auto-truncated, keeping the latest
entries that fit in a configurable maximum number of bytes (defaults to
50MB).  See the log-max-size parameter description in krb5.conf(5).

The iprop log format and the protocol remain backwards-compatible with
earlier versions of Heimdal.  This is NOT a flag-day; there is NO need
to update all the slaves at once with the master, though it is advisable
in general.  Rolling upgrades and downgrades should work.

The sequence of updates is now (with HDB and log open and locked):

a) check that the HDB operation will succeed if attempted,
b) append to iprop log and fsync() it,
c) write to HDB (which should fsync()),
d) mark last log record committed (no fsync in this case).

Every kadm5 write operation recover transactions not yet confirmed as
committed, thus there can be at most one unconfirmed commit on a master
KDC.

Reads via kadm5_get_principal() also attempt to lock the log, and if
successful, recover unconfirmed transactions; readers must have write
access and must win any race to lock the iprop log.

The ipropd-master daemon also attempts to recover unconfirmed
transactions when idle.

The log now starts with a nop record whose payload records the offset of
the logical end of the log: the end of the last confirmed committed
transaction.  This is kown as the "uber record".  Its purpose is
two-fold: act as the confirmation of committed transactions, and provide
an O(1) method of finding the end of the log (i.e., without having to
traverse the entire log front to back).

Two-phase commit makes all kadm5 writes single-operation atomic
transactions (though some kadm5 operations, such as renames of
principals, and changes to principals' aliases, use multiple low-level
HDB write operations, but still all in one transaction).  One can still
hold a lock on the HDB across many operations (e.g., by using the lock
command in a kadmin -l or calling kadm5_lock()) in order to push
multiple transactions in sequence, but this sequence will not be atomic
if the process or host crashes in the middle.

As before, HDB writes which do not go through the kadm5 API are excluded
from all of this, but there should be no such writes.

Lastly, the iprop-log(1) command is enhanced as follows:

 - The dump, last-version, truncate, and replay sub-commands now have an
   option to not lock the log.  This is useful for inspecting a running
   system's log file, especially on slave KDCs.

 - The dump, last-version, truncate, and replay sub-commands now take an
   optional iprop log file positional argument, so that they may be used
   to inspect log files other than the running system's
   configured/default log file.

Extensive code review and some re-writing for clarity by Viktor Dukhovni.
2016-02-26 00:55:33 -06:00
Nicolas Williams
16275048b8 Prefer LMDB to Berkeley DB 2016-02-26 00:55:32 -06:00
Nicolas Williams
a94dc50114 Add --with-db-type-preference config param 2016-02-26 00:55:32 -06:00
Nicolas Williams
c6f24e99f0 Revamp cf/db.m4; test LMDB 2016-02-26 00:55:32 -06:00
Nicolas Williams
76c26281a7 Fix sqlite HDB backend SQLITE_BUSY bug 2016-02-26 00:55:32 -06:00
Nicolas Williams
fbc87e46fd Fix sqlite HDB backend init bug 2016-02-26 00:55:31 -06:00
Nicolas Williams
76965a2a14 Add missing initialization of mandatory 2016-02-16 20:49:32 -06:00
Timothy Pearson
f5f76ee72c Add ability to store extended principal attributes in LDAP
A careful code review was undertaken, and it was determined
that the best way to store the extended attributes was in a
native ASN1 encoded field.  LDAP does not understand the
SEQUENCE of SEQUENCE structures used extensively throughout
the extended attributes structure, and there was already a
precedent set for storing the krb5Key data in a native ASN1
encoded field.
2015-09-27 16:36:24 -05:00
Stefan Metzmacher
078e6f5dd2 kdc: add support for HDB_ERR_WRONG_REALM
A backend can return this if asked with HDB_F_GET_CLIENT|HDB_F_FOR_AS_REQ
for a KRB5_NT_ENTERPRISE_PRINCIPAL record or for HDB_F_GET_SERVER | HDB_F_FOR_TGS_REQ.

entry_ex->entry.principal->realm needs to return the real realm of the principal
(or at least a the realm of the next cross-realm trust hop).

This is needed to route enterprise principals between AD domain trusts.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2015-07-31 17:30:23 +12:00
Nicolas Williams
528b6d093c coverity 1164092 2015-04-18 23:19:25 -05:00
Jeffrey Altman
902aa4ee02 tests on Windows
Modify the NTMakefile rules for tests so that a failed test does
not prevent subsequent tests from being executed.

Change-Id: I9595ad4a1527feae7c402241bf06ab21a0b76d4a
2015-03-21 15:44:48 -04:00
Nicolas Williams
95e56fa3ae hdb: fix hdb_unseal_keys_kvno return when no history
Prior to this change hdb_unseal_keys_kvno() could return successfully (0)
if the choice_HDB_extension_data_hist_keys extension was found but the
hist_keys list was empty.  As a side effect callers would believe that the
provide hdb_entry keys were unsealed when they weren't.  This could cause
the KDC or kadmin to report invalid key size errors.

If the extension is present and the history list is empty attempt to
unseal the provided hdb_entry using hdb_unseal_keys_mkey().

Change-Id: I9218b02bccdbcf22133a9464a677374db53ade85
2015-03-14 16:08:22 -04:00
Love Hörnquist Åstrand
24c8bac3b8 In all_etypes prefer des3-cbc-sha1 over arcfour-hmac-md5 2014-09-09 18:15:08 +02:00
Love Hörnquist Åstrand
37afa01be3 rename roken base64, fixes #107 2014-08-22 20:57:24 -07:00
Jelmer Vernooij
70e43e9808 Fix some typos. 2014-04-25 02:42:17 +02:00
Ken Dreyer
10519ce50d remove hdb ldap create declarations
The hdb_ldap_create and hdb_ldapi_create prototypes use the "static"
keyword, but the functions themselves are not implemented as static.

Heimdal's buildsystem dynamically adds function declarations to
hdb-protos.h based on the actual function implementations. Those
declarations in hdb-protos.h are not declared as static.

Since the build system generates the declarations dynamically, just
remove them from hdb-ldap.c.
2014-03-27 12:11:29 -06:00
Love Hörnquist Åstrand
4fa77ebb03 clean files 2014-02-16 11:51:56 -08:00
Love Hörnquist Åstrand
4d39bae8bb use noinst_HEADERS for hdb-private.h 2014-02-16 09:15:53 -08:00
Love Hörnquist Åstrand
f2e69c9c62 make hdb plugin test pass 2014-02-14 19:36:36 -08:00
Jeffrey Clark
cc1faff15f Simple hdb plugin test
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2014-01-31 08:49:55 +01:00
Jeffrey Clark
c1c7da7f79 Fix compiling hdb ldap as a module
Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2014-01-31 08:49:51 +01:00
Love Hörnquist Åstrand
d8d0e659ce make sure h is set at when we find a match, from [GITHUB #54] 2014-01-31 08:45:29 +01:00
Nicolas Williams
2c16b0da30 Be verbose about MIT dump entry parsing failures 2013-11-20 01:07:54 -06:00
Nicolas Williams
e9d21aeffc Fix bug in loading MIT dumps 2013-11-20 01:07:54 -06:00
Love Hornquist Astrand
10f3c8b56e add possible to set rules on what enctypes to use based on glob matching on principal 2013-10-18 10:01:55 +02:00
Love Hornquist Astrand
1d84562886 add HDBGET: that only supports get, iteration doesnt really make sense for the HDB keytab except when dumping 2013-10-15 12:40:39 +02:00
Jeffrey Altman
50381859a0 hdb: fix parsing of mkey db string
The use of the wrong value for the length of ":mkey=" was identified
by Brian May and reported via github:

  https://github.com/heimdal/heimdal/issues/40

Change-Id: I0aed86a5bb0359b7a266369076fde5e62f23b5fe
2013-10-13 19:59:48 -04:00
Jeffrey Altman
3c3e2ad5e6 Windows: ktutil.exe requires libkadmsrv and libhdb
Include libkadmsrv.dll and libhdb.dll in the assembly which are
required for ktutil.exe to load.

Change-Id: Ic72d51e72daac71683a7f7000fe084197ee3c94a
2013-09-13 22:17:43 -04:00
Nicolas Williams
ccb148eedb lib/hdb/db3.c:DB_open() needs to DB_close() more
Without this the KDC can trip the assert in DB_open().
2013-09-12 12:14:39 -05:00
Nicolas Williams
075a0d32ee Add UPN support to sqlite HDB backend 2013-08-06 20:54:23 -05:00
Love Hornquist Astrand
82d71b063b support db6 too, based on patch from Lars Wendler <wendler@fasihi.net> 2013-07-18 14:58:54 +02:00
Nicolas Williams
a53f3a49e2 Fix unused variable warnings 2013-06-02 15:52:41 -05:00