In client_connect() getaddrinfo() stores the head of the allocated
addrinfo structure list in 'res0'. 'res' is used to walk the list
and will be NULL at the end of the for() loop when freeaddrinfo(res)
is executed. Pass 'res0' to freeaddrinfo() instead of 'res'.
Change-Id: Ie1358c0356b6b0f98470e46e25216cfa0ab4adac
In hdb_ldap_common() the test
if (search_base == NULL && search_base[0] == '\0')
error handling ...
must be
if (search_base == NULL || search_base[0] == '\0')
error handling ...
Change-Id: I8d876a9c56833431b3c4b582fbb0a8cc7353893d
The prior patch removed the definition of the XUA check but failed
to remove the execution of the check. Do so now.
Change-Id: I648a374370d3549db0d98b90f810bd018dc28962
gsskrb5_acceptor_start() was making a copy of the global pointer
_gsskrb5_keytab to use later. This invites a race condition where
another thread could call gsskrb5_register_acceptor_identity()
(thus invalidating the target of the copied pointer) before it is
used by gsskrb5_acceptor_start().
So instead, clone the keytab to a new one while protected by the
mutex lock (similar to get_keytab() in acquire_cred.c).
Signed-off-by: Nicolas Williams <nico@twosigma.com>
Instead of imposing a default 10 hour ticket lifetime and 1 month renew
lifetime when requesting tickets, increase the default lifetime and
renew lifetime to 2147483647 seconds. This ensures that in the absence
of any other configuration or command line parameters that the KDC will
determine the ticket lifetime and renew lifetime.
Change-Id: I52b6eeac1ee830a9bf4d0130e8f4ec7b70bc8694
Signed-off-by: Nicolas Williams <nico@twosigma.com>
The original motivation was to avoid extra timeouts when the network is
broken. However this doesn't avoid one of the timeouts and adds
complexity and introduced bugs.
To really suppress search lists use ndots.
In lib/roken/resolve.c, we find rk_dns_srv_order() which re-orders
the results of an SRV RR lookup by the algorithm in RFC2782. We
note that the algorithm doesn't behave according to the RFC w.r.t.
entries of weight zero. We solve this by scaling out the remaining
weights by the number of zeros we find at a particular priority
level and acting like the zero weights have a weight of one.
In lib/roken/resolve.c, we find rk_dns_srv_order() which re-orders
the results of an SRV RR lookup by the algorithm in RFC2782. We
fix a bias in the random weight sorting by changing the order of
operations when selecting rnd. rnd should be a non-zero random
number less than the sum of the weights at a particular priority,
but zero was included as a legitimate output thus biasing the
selection process. rk_random() % sum is still biased as a 32
bit int modulo a number which doesn't divide 2^32 does not have
a uniform distribution, but the bias should be small enough to
live with for our purposes here.
Apending '.' to the hostname passed to `getaddrinfo()` is good for
avoiding extra timeouts when the search list is non-empty and the
network is broken, but searches in /etc/hosts are typically inhibited
then. The fix is to try again without the trailing '.' if the first
lookup failed for any reason other than a timeout.
On 32-bit architectures with _FILE_OFFSET_BITS=64,
sizeof(off_t) > sizeof(size_t) .
LOG_HEADER_SZ was #define'd as an expression of type size_t, so in order
to get the sign extension right we need -(off_t)LOG_HEADER_SZ instead of
(off_t)(-LOG_HEADER_SZ). However, we can just define the *_SZ macros to
cast to off_t, then we don't need to worry about negation.
Fixes Debian bug #822749, PR 175.
Signed-off-by (and updated by): Nicolas Williams <nico@twosigma.com>
The correct test for a windows build is if defined(_WIN32), not just
if _WIN32. Fix a few places in the build which do the wrong thing, as
it gives compiler warnings.
All of the hcrypto source files were updated with commit
0f97855826 to include roken.h. This
means that hash.h no longer needs to include the roken header.
Remove the multiple inclusion.
