Commit Graph

792 Commits

Author SHA1 Message Date
Nicolas Williams
5716b51c18 hdb: Fix HDB corruption with LMDB backend 2020-10-27 13:30:57 -05:00
Nicolas Williams
ea8f3991fb hdb: Fix leak in SQLite3 backend 2020-10-27 13:30:57 -05:00
Nicolas Williams
5d156a5799 hdb: Fix concurrency test 2020-10-08 20:34:38 -05:00
Nicolas Williams
18e8ccf4c2 hdb: WAL mode setting was done incorrectly 2020-10-08 20:34:15 -05:00
Nicolas Williams
da04b45c7f hdb: Fix SQLite3 backend bug 2020-10-08 20:30:21 -05:00
Nicolas Williams
f87ba4f23b hdb: Test LMDB and SQLite3 HDB concurrency
Test that we can dump an HDB w/o blocking write transactions.

This currently works for different processes (both backends), but not
for threads (for either backend), and it's not yet clear why.
2020-10-06 14:16:35 -05:00
Nicolas Williams
8c7900c40b hdb: Use db type preference from ./configure
Use the HDB backend type from the --with-db-type-preference=... option
to ./configure to make the default HDB backend more stable.
2020-10-05 14:51:03 -05:00
Nicolas Williams
93ada1fbf6 hdb: Remove default HDB backend footgun
Do not allow a change in build configuration time default HDB backend
selection cause existing default HDBs to not be possible to open.

Otherwise such a change will cause a KDC configured to use the default
HDB (i.e., without setting it in the "database" stanza in the "[kdc]"
section of krb5.conf) to not start.
2020-10-05 14:51:03 -05:00
Nicolas Williams
753e636274 hdb: Fix new key delay special casing of kvno 1 2020-09-22 18:27:05 -05:00
Nicolas Williams
821dcaec70 hdb: Test hdb_validate_key_rotations() 2020-09-09 22:45:17 -05:00
Nicolas Williams
ff13573ce5 hdb: Do not apply new service key delay to clients
The new [hdb] new_service_key_delay parameter should not apply to
principal entries when used as clients.  Otherwise new passwords would
not take effect immediately, and that would be very confusing.
2020-09-09 21:48:29 -05:00
Nicolas Williams
5447b81fb1 hdb: Move virtual principals into HDB layer
This is a large commit that adds several features:

 - Revamps and moves virtual host-based service principal functionality
   from kdc/ to lib/hdb/ so that it may be automatically visible to
   lib/kadm5/, as well as kadmin(1)/kadmind(8) and ktutil(1).

   The changes are backwards-incompatible.

 - Completes support for documenting a service principal's supported
   enctypes in its HDB entry independently of its long-term keys.  This
   will reduce HDB bloat by not requiring that service principals have
   more long-term keys than they need just to document the service's
   supported enctypes.

 - Adds support for storing krb5.conf content in principals' HDB
   entries.  This may eventually be used for causing Heimdal KDC
   services to reconfigure primary/secondary roles automatically by
   discovering the configured primary in an HDB entry for the realm.

   For now this will be used to help reduce the amount of configuration
   needed by clients of an upcoming HTTP binding of the kadmin service.
2020-09-08 00:25:36 -05:00
Daria Phoebe Brashear
59d132f825 hdb: don't use lock_file name after free in open_lock_file 2020-03-06 11:56:03 -06:00
Nicolas Williams
3c0f59b658 hdb: Fix memory leak in hdb_generate_key_set() 2020-03-02 10:56:13 -06:00
Nicolas Williams
ea90ca8666 Move some infra bits of lib/krb5/ to lib/base/ (2)
This is the second of two commits in a series that must be picked together.

This series of two commits moves parts of lib/krb5/ infrastructure
functionality to lib/base/, leaving behind wrappers.

Some parts of libkrb5 are entirely generic or easily made so, and could
be useful in various parts of Heimdal that are not specific to the krb5
API, such as:

 - lib/gssapi/  (especially since the integration of NegoEx)
 - lib/hx509/
 - bx509d       (which should really move out of kdc/)

For the above we need to move these bits of lib/krb5/:

 - lib/krb5/config_file.c   (all of it, leaving forwardings behind)
 - lib/krb5/config_reg.c    (all of it)
 - lib/krb5/plugin.c        (all of it, leaving forwardings behind)
 - lib/krb5/log.c           (all of it, ditto)
 - lib/krb5/heim_err.et     (all of it)

And because of those two, these too must also move:

 - lib/krb5/expand_path.c   (all of it, leaving forwardings behind)
 - lib/krb5/warn.c          (just the warning functions, ditto)

The changes to the moved files are mostly quite straightforward and are
best reviewed with --word-diff=color.

We're also creating a heim_context and a heim API to go with it.  But
it's as thin as possible, with as little state as necessary to enable
this move.  Functions for dealing with error messages use callbacks.

Moving plugin.c does have one knock-on effect on all users of the old
krb5 plugin API (which remains), which is that a global search and
replace of struct krb5_plugin_data to struct heim_plugin_data was
needed, though the layout and size of that structure doesn't change, so
the ABI doesn't either.

As well, we now build lib/vers/ and lib/com_err/ before lib/base/ so as
to be able to move lib/krb5/heim_err.et to lib/base/ so that we can make
use of HEIM_ERR_* in lib/base/, specifically in the files that moved.

Once this is all done we'll be able to use config files and plugins in
lib/hx509/, we'll be able to move bx509d out of kdc/, and so on.

Most if not all of the new functions in lib/base/ are Heimdal-private,
thus calling conventions for them are not declared.

Status:

 - builds and passes CIs (Travis, Appveyor)
 - ran make check-valgrind and no new leaks or other memory errors
 - ready for review

HOW TO REVIEW:

     $ # Review file moves:
     $ git log --stat -n1 HEAD^
     $
     $ # Review changes to moved files using --word-diff=color
     $ git log -p -b -w --word-diff=color HEAD^..HEAD   \
               lib/base/config_file.c                   \
               lib/base/config_reg.c                    \
               lib/base/expand_path.c                   \
               lib/base/warn.c                          \
               lib/krb5/config_file.c                   \
               lib/krb5/config_reg.c                    \
               lib/krb5/expand_path.c                   \
               lib/krb5/warn.c
     $
     $ # Review the whole thing, possibly adding -b and/or -w, and
     $ # maybe --word-diff=color:
     $ git log -p origin/master..HEAD
     $ git log -p -b -w origin/master..HEAD
     $ git log -p -b -w --word-diff=color origin/master..HEAD

TBD (future commits):

 - make lib/gssapi use the new heimbase functions
 - move kx509/bx509d common code to lib/hx509/ or other approp. location
 - move bx509d out of kdc/
2020-03-02 10:56:13 -06:00
Jeffrey Altman
387684aa93 WIN32: fix calling conventions for 32-bit builds
On 32-bit Windows Intel builds the __cdecl and __stdcall calling
conventions are different so labeling the functions that are
exported or assigned to function pointers matters.

Change-Id: I03b6f34baeb9ffb2e683fd979f12f27a5078a4da
2019-01-14 06:12:36 -05:00
Luke Howard
5abb68c891 hdb: ensure Salt is zero'd in add_default_salts()
Ensure Salt is zero'd in add_default_salts(), as the structure has members
other than the salt type and value.
2019-01-07 18:07:53 +11:00
Luke Howard
a3fd75f368 hdb: generate default salts for entries missing them
Older databases may lack explicitly stored salts where the salt is the default
one. When fetching a client entry for an AS-REQ, add default salts to keys that
lack one.
2019-01-07 16:33:08 +11:00
Luke Howard
9750f2d915 hdb: force canonicalization of enterprise principal names
Whilst Windows does not canonicalize enterprise principal names if the
canonicalize flag is unset, the original specification in
draft-ietf-krb-wg-kerberos-referrals-03.txt says we should. Non-Windows
deployments of Heimdals are unlikely to understand enterprise principal names
in tickets, and are also unlikely to set the canonicalize flag, so this makes
sense. (It was also the behavior prior to moving the name canonicalization
logic into the KDC.)
2019-01-06 18:03:07 +11:00
Luke Howard
0141e7a497 Revert "kdc: move more name canonicalization logic to KDC"
This reverts commit 1b7e196e66.

It turns out that, contrary to the referrals draft, Windows does not
canonicalize enterprise principal names if the canonicalize KDC option is
unset.
2019-01-06 17:45:05 +11:00
Luke Howard
79f84913c9 hdb: krb5_locl.h obviates need for forward declarations 2019-01-05 16:32:00 +11:00
Luke Howard
1b7e196e66 kdc: move more name canonicalization logic to KDC
Enterprise principal client names in AS-REQs should always be canonicalized
irrespective of the setting the canonicalize KDC option. Perform this check in
the KDC rather than HDB.

Do not set the HDB_F_GET_KRBTGT flag unless the client actually requested a TGS
principal.
2019-01-05 15:51:11 +11:00
Luke Howard
c6232299c3 kdc: perform AS-REQ canonicalization in kdc
Mirroring the logic recently introduced in the TGS, this patch modifies the KDC
to perform client and server canonicalization itself rather than relying on the
backend to do so. Per RFC 6806, the behavior is slightly different for the AS
in that the setting of the canonicalize flag in the AS-REQ does impact the
returned names in the ticket. In order to support realm canonicalization or
other custom behavior, we allow the backend to force the KDC to canonicalize by
setting the force-canonicalize flag in the returned client or server entries.
2019-01-05 15:51:11 +11:00
Luke Howard
6bb8eaca20 hdb: dereference principal aliases in all KDC lookups (#452)
e11abf41 added support in libhdb for always dereferencing principal aliases
during an AS-REQ (where dereferencing refers to enabling alias lookups, and
rewriting the returned entry with the alias name unless canonicalization was
enabled).

Due to the KDC setting HDB_F_FOR_AS_REQ for all lookups from the AS, this
allowed aliases on the TGS itself to be dereferenced during an AS-REQ; however,
on presenting the TGT, the TGS would fail to resolve. Creating an explicit TGS
principal for the aliased realm would work (at least prior to c555ed6a), but
this could be confusing to deploy.

This commit changes enables alias dereferencing when HDB_F_GET_ANY is set,
which essentially means dereference whenever the request is coming from the KDC
(as opposed to, say, kadmin).

We also backout c555ed6a, which changed the TGS to always canonicalize the
server realm, as this breaks serving multiple realms from a single KDC, where
server principals in different realms share a single canonical entry.
HDB_F_CANON is now passed to the backend as a hint only, and per RFC 6806 the
principal name is never changed in TGS replies. (However, for Samba interop,
backends can override this by setting the force-canonicalize HDB flag.)
2019-01-05 14:01:26 +11:00
Luke Howard
803efebca5 krb5, kadm5: refactor plugin API
Refactor plugin framework to use a single list of loaded plugins; add a new
plugin API where DSOs export a load function that can declare dependencies and
export multiple plugins; refactor kadm5 hook API to use krb5 plugin framework.

More information in krb5-plugin(7).
2019-01-03 20:06:27 -06:00
Radoslav Bodo
f3f06fcba9 kadmin selective prune of historic key for principal 2018-12-31 14:17:10 -06:00
Luke Howard
e11abf414c hdb: support "hard" alias path in AS-REQ (#452)
Adds support for "hard" aliases when initially authenticating, that is,
allowing a client or server principal to be known by many names without
requiring that the client support name canonicalization.

In order to avoid changing the behavior for other backends such as Samba, this
is implemented in the HDB backend rather than the KDC.

To use, add an alias for both the client and TGS ("krbtgt") principals using
kadmin. This behavior is unchanged if name canonicalization is enabled.
2018-12-20 17:59:18 +11:00
Luke Howard
176fe6c06c hdb: fix uninitialized variable use in MIT bridge 2018-12-20 16:25:51 +11:00
Romain Fihue
b0e4fcd257 hdb-mitdb: Commit 57f1545a broke support of REQUIRES_PWCHANGE during MIT DB imports 2018-10-03 20:03:03 -04:00
Daria Phoebe Brashear
3bcc031939 hdb-mitdb: correct missing equals in initialization 2017-10-19 19:49:22 -04:00
Nicolas Williams
5bcbe2125b Add hdb_set_sync() method 2017-10-10 13:07:18 -05:00
Nicolas Williams
e3cc7dfb94 Set def page size for HDB SQLite3 backend to 8KB 2017-10-10 13:07:06 -05:00
Francisco Blas (klondike) Izquierdo Riera
d6979fcc40 Allow LDAP modifications for entry creation
Heimdal will refuse to create new entries when an entry already exists even
if said entry has no kerberos info and is a new entry.

This patch fixes this issue by allowing object modifications even if the
flags disallow them when we are inserting a new principal on the database.

Signed-off-by: Francisco Blas Izquierdo Riera (klondike) <klondike@gentoo.org>
2017-09-25 18:24:23 -05:00
Nicolas Williams
122cdc578e Fix some krb5_storage_write() usages 2017-05-26 23:24:30 -04:00
Jeffrey Altman
93518bfab4 use memset_s
lib roken includes support for memset_s() but it was not applied
to the Heimdal source tree.

Change-Id: I8362ec97a9be50205bb2d398e65b629b88ce1acd
2017-04-29 01:05:59 -04:00
Nicolas Williams
d8a112ae1a Fix lib/hdb make race 2017-03-17 13:20:06 -05:00
Jeffrey Altman
5360a6dee6 hdb: export hdb_generate_key_set_password_with_ks_tuple
Must export hdb_generate_key_set_password_with_ks_tuple() on Windows
which was introduced in 4303174a49.

Change-Id: Iea2993a17aba44c7cb0360716138c26239254e05
2017-02-16 13:14:50 -05:00
Roland C. Dowdeswell
4303174a49 Fix signature of hdb_generate_key_set_password()
The change to the signature of hdb_generate_key_set_password() in
Heimdal 7.1 broke API/ABI compatibility with previous releases.  We
fix this by renaming it hdb_generate_key_set_password_with_ks_tuple()
and creating a new hdb_generate_key_set_password() which calls our
new function with zeroes for the added arguments.

Issue #246      https://github.com/heimdal/heimdal/issues/246
2017-01-29 19:40:59 -05:00
Viktor Dukhovni
24206682d7 Move external libdeps after our own
If some external library lives in a directory in which Heimdal is
already installed, we may pick up LD_LIBRARY_PATH Heimdal objects
from a different release.  Move the external deps to the end, to
ensure a more appropriate LD_LIBRARY_PATH.
2016-12-19 19:39:22 -05:00
Nicolas Williams
f38089257b Misc fixes (coverity) 2016-11-20 17:43:51 -06:00
Jeffrey Altman
a33b6d6b78 hdb: more read_master_key leaks
Change-Id: Icf0bb8dc3cdcd2babb91b4180cec37737772373d
2016-11-19 08:18:39 -05:00
Jeffrey Altman
6f917463ff hdb: read_master_key use free_master_key on error
If an error occurs during read_masker_key() processing, use
free_master_key() to perform cleanup.

Change-Id: Idc0ad0131ea4855207232e9773772106cb4f5945
2016-11-19 07:25:40 -05:00
Jeffrey Altman
0dc3d21724 hdb: read_master_key add parens around (*mkey)
Add parens around the use of (*mkey)->next.

Change-Id: I3b60c2432d1c5dee8483795bed52ff24c7aa6a70
2016-11-19 01:26:08 -05:00
Jeffrey Altman
9e72c475ae hdb: need prototypes for hdb_ldap[i]_create
Commit 4b6bd40106 made hdb_ldap_create and
hdb_ldapi_create static in the OPENLDAP_MODULE case.  However, by
failing to leave a blank line between the static and the function
declaration the perl program that produces the hdb-protos.h file
skips the functions.

Add appropriate spacing.

Change-Id: I9ad24176fc31a0bce92b51f7adab141e8fa70fa3
2016-11-19 01:23:08 -05:00
Jeffrey Altman
e772511b78 hdb: read_master_keytab free memory on failure
read_master_keytab() should always return with *mkey == NULL on
failure.  Doing otherwise can result in memory leaks or use of
an uninitialized pointer.

Change-Id: Ice1fd504ca573d73bb51dd3b01770c3f8bc59fd4
2016-11-19 00:16:59 -05:00
Nicolas Williams
52a562a3a4 Misc fixes (coverity) 2016-11-18 22:21:45 -06:00
Nicolas Williams
4b6bd40106 Quiet warning in --enable-hdb-openldap-module case
Functions that are not exported in this case should be static in this
case.
2016-11-18 22:21:45 -06:00
Jeffrey Altman
97a40d8838 hdb: hdb_add_aliases frees uninitialized memory
This bug was never shipped in a release.  It was introduced by commit
1c81ddf4e2.

Change-Id: Ia9f6d69b2858a75cc51e50034fe70e29f13b8fc1
2016-11-18 20:58:39 -05:00
Nicolas Williams
7fa85e6d6d Round #3 of scan-build warnings cleanup 2016-11-16 23:27:27 -06:00
Nicolas Williams
1c81ddf4e2 Round #2 of scan-build warnings cleanup 2016-11-16 17:03:14 -06:00