Commit Graph

1075 Commits

Author SHA1 Message Date
Viktor Dukhovni
0ae6147483 Fix kadm5 error cleanup 2016-11-11 01:38:41 -05:00
Sergio Gelato
7c8b66d76b Use off_t in for constants used in iprop log seeks
On 32-bit architectures with _FILE_OFFSET_BITS=64,
 sizeof(off_t) > sizeof(size_t) .

LOG_HEADER_SZ was #define'd as an expression of type size_t, so in order
to get the sign extension right we need -(off_t)LOG_HEADER_SZ instead of
(off_t)(-LOG_HEADER_SZ).  However, we can just define the *_SZ macros to
cast to off_t, then we don't need to worry about negation.

Fixes Debian bug #822749, PR 175.

Signed-off-by (and updated by): Nicolas Williams <nico@twosigma.com>
2016-11-09 13:35:08 -06:00
Viktor Dukhovni
b39a4f7c78 Update old_version after timeout
On a low update rate master, if we don't update old_version after
processing a poll timeout, we will generate spurious warnings about
missed (change) signals every time the timer expires, and will
needlessly contact the slaves.
2016-08-09 21:02:44 -04:00
Viktor Dukhovni
2d32982ed4 Fix slave boostrap from incomplete master log
When the master's log does not contain the complete history, slaves
that bootstrap from scratch encountered a loop, because the master
falsely assumed a race with log truncation.
2016-07-07 23:00:29 -04:00
Viktor Dukhovni
74f598e159 Set uber record nominal version when truncating
It needs to match the version of the last record saved and have a
reasonable timestamp.
2016-06-09 08:30:59 -04:00
Viktor Dukhovni
a5237e6940 Fix handling of uber record nominal version
When flushing the uber record, retain the current log version.  When the
uber record is the only (thus last) record in the log, return its nominal
version as the last version, not 0.  Upgrade the log if the current uber
record version number is not 0.
2016-06-09 07:04:01 -04:00
Nicolas Williams
316e0d2184 Store the canonical client princ in ipropd-slave
Otherwise we risk storing a name with the referral (empty) realm name,
which will then cause various knock-on effects, such as thinking that
the start_realm is "", and failing to find matching credentials in the
ccache.
2016-06-09 01:13:15 -04:00
Viktor Dukhovni
ffd0dda237 Fix iprop against legacy master with full log
When the master's log has all entries from version 1 to now, and no
uber entry (legacy master), then new slaves will not pull version 1,
because their uber record has version 1.

The fix is to force the uber version to 0 always, and avoid adding a
truncate nop when doing a full prop.  The uber record now records the
database version even in the absence of any other log entries so that
we know what to pull going forward.
2016-06-09 01:03:10 -04:00
Jeffrey Altman
1007d104fa lib/kadm5: do not prototype imported _krb5_put_int
The function _krb5_put_int() is a private function exported from
lib/krb5.  Its declaration should come from krb5-private.h.  A local
declaration will not result in the proper import qualifiers on
Windows.

See also: e1a244f Make it possible to include krb5_locl.h in kadm5

Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
2016-04-11 16:01:27 -05:00
Nicolas Williams
e1a244f0aa Make it possible to include krb5_locl.h in kadm5
This and ffc525aad1 are the correct fix
rather than f1d73a8e46.  The next commit
reverts f1d73a8 by re-applying ffc525a.
2016-04-11 16:00:12 -05:00
Jeffrey Altman
f1d73a8e46 Revert "lib/kadm5: do not prototype imported _krb5_put_int"
krb5_locl.h cannot be included from within lib/kadm5 in the
current UNIX builds.  Reverting this change which is necessary
to properly build on Windows until an alternate solution is
agreed upon.

This reverts commit ffc525aad1.
2016-04-11 14:40:57 -05:00
Jeffrey Altman
ffc525aad1 lib/kadm5: do not prototype imported _krb5_put_int
The function _krb5_put_int() is a private function exported from
lib/krb5.  Its declaration should come from krb5-private.h.  A local
declaration will not result in the proper import qualifiers on
Windows.

Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
2016-04-10 19:04:30 -05:00
Nicolas Williams
a114690bde Fix HDB two-phase commit for LDAP backend
We can't replay log entries when recovering if the backend is shared by
writers with separate logs (or no logs at all), i.e., on other hosts.
2016-02-29 22:12:51 -06:00
Nicolas Williams
d5bc673e31 Fix HDB two-phase commit for /dev/null log 2016-02-29 19:13:14 -06:00
Nicolas Williams
649c4824b0 kadm5: fix leak in set_keys 2016-02-29 19:13:12 -06:00
Nicolas Williams
1236238cde kadm5/log.c: missing error checking 2016-02-29 19:13:11 -06:00
Nicolas Williams
8394778f92 master: quieten static analyzers 2016-02-29 19:13:11 -06:00
Nicolas Williams
2734102cc7 slave: quieten static analyzer false positives 2016-02-29 19:13:11 -06:00
Nicolas Williams
2415a5ee1d ipropd-slave: missing error check 2016-02-29 19:13:11 -06:00
Nicolas Williams
cfd9d59a15 ipropd-master: missing error check 2016-02-29 19:13:10 -06:00
Nicolas Williams
e625bb6ef6 Remove busted precheck in create_s.c 2016-02-29 19:13:10 -06:00
Nicolas Williams
6cc69e0b1f Shut up VC 2016-02-29 19:13:10 -06:00
Nicolas Williams
c350ca6f6e iprop-log: fix logically dead warnx() 2016-02-29 19:13:09 -06:00
Nicolas Williams
2d9f7257b9 Also build setkey3_s on Windows 2016-02-26 22:23:54 -06:00
Nicolas Williams
1976e012b8 Automatically upgrade iprop logs to add uber rec
We need the uber record all the time now, actually, except when merely
inspecting a log file.  This is important as we depend on replaying
entries written to the log in order to complete the HDB writes, and if
we don't have an uber record we can't do this step.

Also, log_init() should cleanup on error.
2016-02-26 19:10:14 -06:00
Nicolas Williams
eabb2821c6 setkey_principal_3(): use the new HDB/log protocol
The addition of kadm5_setkey_principal_3(), and the associated
kadm5_s_setkey_principal_3() missed the revamp for two-phase commit.
2016-02-26 15:05:34 -06:00
Viktor Dukhovni
8fe294d0d7 Add SO_KEEPALIVE to iprop clients (slaves) 2016-02-26 15:43:13 -05:00
Viktor Dukhovni
579393c8b9 Optionally prune old keys when setting new keys.
When new keys are added (typically via kadm5_setkey_principal_3),
truncate the key history to remove old keys, that is keys older than
the newest key which was in effect prior longer ago than the principal's
maximum ticket lifetime.  This feature is controlled via the "[kadmin]"
section's "prune-key-history" boolean parameter, which defaults to false.

Currently this happens only when kadm5_setkey_principal_3()
is called directly on the server, the client API simulates
kadm5_setkey_principal_3() via a get, update, modify sequence that does
not prune the key history.  The plan is to add a new kadm5 protocol RPC
and convert clients to call that instead.

In setkey_principal_3 seal keys after entry key update

Also, for now, don't check the return value of kadm5_log_modify() in
the new kadm5_s_setkey_principal_3().  This has to be addressed more
globally.

Censor stale keys in kadm5_s_get_principal
2016-02-26 15:43:12 -05:00
Nicolas Williams
f261ed4f58 Fix ipropd_slave: no EDQUOT on WIN32 2016-02-26 11:42:01 -06:00
Nicolas Williams
ebc1ad34ba ipropd-master/slave: enhancements and bug fixes
- fix int/uint confusion and use unsigned integral types for time
 - improve messages
 - add --verbose option
 - attempt transaction recovery in ipropd-master during idle times
 - begin hardening daemons against dying at the slightest provocation
 - better recovery from various errors
 - daemons now restart automatically in most of the many error cases
   where the daemons still die
2016-02-26 00:59:04 -06:00
Nicolas Williams
20df2c8706 Two-phase HDB commit via iprop log, + GC for log
We used to update the iprop log and HDB in different orders depending on
the kadm5 operation, which then led to various race conditions.

The iprop log now functions as a two-phase commit (with roll forward)
log for HDB changes.  The log is auto-truncated, keeping the latest
entries that fit in a configurable maximum number of bytes (defaults to
50MB).  See the log-max-size parameter description in krb5.conf(5).

The iprop log format and the protocol remain backwards-compatible with
earlier versions of Heimdal.  This is NOT a flag-day; there is NO need
to update all the slaves at once with the master, though it is advisable
in general.  Rolling upgrades and downgrades should work.

The sequence of updates is now (with HDB and log open and locked):

a) check that the HDB operation will succeed if attempted,
b) append to iprop log and fsync() it,
c) write to HDB (which should fsync()),
d) mark last log record committed (no fsync in this case).

Every kadm5 write operation recover transactions not yet confirmed as
committed, thus there can be at most one unconfirmed commit on a master
KDC.

Reads via kadm5_get_principal() also attempt to lock the log, and if
successful, recover unconfirmed transactions; readers must have write
access and must win any race to lock the iprop log.

The ipropd-master daemon also attempts to recover unconfirmed
transactions when idle.

The log now starts with a nop record whose payload records the offset of
the logical end of the log: the end of the last confirmed committed
transaction.  This is kown as the "uber record".  Its purpose is
two-fold: act as the confirmation of committed transactions, and provide
an O(1) method of finding the end of the log (i.e., without having to
traverse the entire log front to back).

Two-phase commit makes all kadm5 writes single-operation atomic
transactions (though some kadm5 operations, such as renames of
principals, and changes to principals' aliases, use multiple low-level
HDB write operations, but still all in one transaction).  One can still
hold a lock on the HDB across many operations (e.g., by using the lock
command in a kadmin -l or calling kadm5_lock()) in order to push
multiple transactions in sequence, but this sequence will not be atomic
if the process or host crashes in the middle.

As before, HDB writes which do not go through the kadm5 API are excluded
from all of this, but there should be no such writes.

Lastly, the iprop-log(1) command is enhanced as follows:

 - The dump, last-version, truncate, and replay sub-commands now have an
   option to not lock the log.  This is useful for inspecting a running
   system's log file, especially on slave KDCs.

 - The dump, last-version, truncate, and replay sub-commands now take an
   optional iprop log file positional argument, so that they may be used
   to inspect log files other than the running system's
   configured/default log file.

Extensive code review and some re-writing for clarity by Viktor Dukhovni.
2016-02-26 00:55:33 -06:00
Nicolas Williams
d774aeda38 ipropd-master: add missing ret = 2016-02-26 00:55:33 -06:00
Nicolas Williams
c6f24e99f0 Revamp cf/db.m4; test LMDB 2016-02-26 00:55:32 -06:00
Nicolas Williams
7df165003a Fix iprop-log dump leak 2016-02-26 00:55:31 -06:00
Nicolas Williams
d1fcf3dc67 ipropd_master: fix dump bug 2016-02-26 00:55:31 -06:00
Nicolas Williams
76965a2a14 Add missing initialization of mandatory 2016-02-16 20:49:32 -06:00
Nicolas Williams
b1af99aa81 Fix memleak in lib/kadm5/set_keys.c 2016-02-16 20:49:32 -06:00
Nicolas Williams
05a919b94b iprop slave: try incremental after complete xfer
The following sequence of events results in slave B having a stale HDB:

 - slave A connects to master, master dumps HDB for the slave
 - kadm5 operations
 - slave B connects to master, master sends previously dumped HDB

slave B won't discover any updates until the next transaction.

The fix is simple: the slave should immediately call ihave() after
receiving a complete HDB.
2015-05-20 10:07:52 -05:00
Nicolas Williams
4158ddbc25 Fix HDB rename/close order in iprop slave 2015-05-20 10:07:52 -05:00
Nicolas Williams
409501e5e4 Tolerate some time-travel by slaves 2015-05-20 10:07:51 -05:00
Nicolas Williams
854aaab182 iprop master: Don't ignore flock() result 2015-05-20 10:07:51 -05:00
Nicolas Williams
b6e4d25d0d coverity 1164086 2015-04-18 23:19:24 -05:00
Nicolas Williams
13759fb73f Free kadm5 princ policy 2015-03-24 11:50:02 -05:00
Nicolas Williams
b48bed5f42 Daemons detach atomically to avoid having to wait
Tests that start daemons have to "wait" for them to start.

This commit makes Heimdal daemons prep to detach (when requested) by
forking early, then having the child signal readiness to the parent when
the child really is ready.  The parent exits only which the child is
ready.  This means that tests will no longer need to wait for daemons.

However, tests will still need a pidfile or such so they can stop the
daemons.

Note that the --detach options should not be used on OS X from launchd,
only from tests.
2015-03-24 11:49:59 -05:00
Jeffrey Altman
902aa4ee02 tests on Windows
Modify the NTMakefile rules for tests so that a failed test does
not prevent subsequent tests from being executed.

Change-Id: I9595ad4a1527feae7c402241bf06ab21a0b76d4a
2015-03-21 15:44:48 -04:00
Nicolas Williams
69b0a8f4eb kadm5: kadmin modify must refuse bogus keys
kadmin should not permit a modify that stores invalid keys into the
database.  Accepting bad key data into the database will result in
errors when those keys are eventually used.

This change does not address the general case.  It does address the
specific case of the kadmin client attempting to store the magic
bogus key since that is trivial to check for and can be unintentionally
returned to kadmind by a 1.6rc2 or prior client.  This can happen when
a user has get privilege but lacks the new get-keys privilege.

Change-Id: I44795e6428472b75ab1e4257ce7cb9160f0299f5
2015-03-14 16:08:44 -04:00
Nicolas Williams
db72e66eb9 kadm5: Add functions to check for bogus keys
Introduce kadm5_all_keys_are_bogus() and kadm5_some_keys_are_bogus()
which will be used in later changes.

Change-Id: I3a07ffe07bee7d6eb17c3d2eae91c107e0bac255
2015-03-14 16:08:34 -04:00
Love Hörnquist Åstrand
c10e99bead Merge pull request #109 from cg2v/dist-kadmin-version-script
version-script-client.map needs to be in dist
2014-08-22 21:38:55 -07:00
Love Hörnquist Åstrand
37afa01be3 rename roken base64, fixes #107 2014-08-22 20:57:24 -07:00
Chaskiel Grundman
41da16b48a version-script-client.map needs to be in dist
version-script-client.map needs to be in lib/kadm5's EXTRA_DIST,
otherwise make distcheck fails
2014-07-07 12:39:49 -04:00