Commit Graph

1086 Commits

Author SHA1 Message Date
Viktor Dukhovni
f0a772e3e6 More robust kadm5 server handle init and cleanup 2016-12-03 01:36:53 -05:00
Nicolas Williams
de4bd036e1 lib/kadm5 parallel build fix went too far 2016-11-28 21:56:16 -06:00
Nicolas Williams
923105d130 Fix lib/kadm5 parallel build 2016-11-28 21:48:45 -06:00
Nicolas Williams
3ba12317a0 Misc fixes (coverity) 2016-11-28 15:09:55 -06:00
Nicolas Williams
f38089257b Misc fixes (coverity) 2016-11-20 17:43:51 -06:00
Jeffrey Altman
989a7c3379 kadm5: kadm5_add_passwd_quality_verifier memory leak
if krb5_get_config_strings() returns the empty string do not return
immediately.  Instead the for() loop will be skipped because the empty
string represents the end of the string list permitting
krb5_config_free_strings() to free the allocated memory.

Change-Id: Ia6fdb13f716c07b53c8b3857af4f7ab8be578882
2016-11-19 08:23:06 -05:00
Jeffrey Altman
055edd9669 kadm5: kadm5_add_passwd_quality_verifier leaks 'strs'
Change-Id: Ibcc3f512016a4a095eacbd710c395aaf93c4b7f7
2016-11-19 07:28:42 -05:00
Nicolas Williams
52a562a3a4 Misc fixes (coverity) 2016-11-18 22:21:45 -06:00
Nicolas Williams
7fa85e6d6d Round #3 of scan-build warnings cleanup 2016-11-16 23:27:27 -06:00
Nicolas Williams
1c81ddf4e2 Round #2 of scan-build warnings cleanup 2016-11-16 17:03:14 -06:00
Nicolas Williams
953dc07391 Round #1 of scan-build warnings cleanup 2016-11-15 21:27:20 -06:00
Viktor Dukhovni
0ae6147483 Fix kadm5 error cleanup 2016-11-11 01:38:41 -05:00
Sergio Gelato
7c8b66d76b Use off_t in for constants used in iprop log seeks
On 32-bit architectures with _FILE_OFFSET_BITS=64,
 sizeof(off_t) > sizeof(size_t) .

LOG_HEADER_SZ was #define'd as an expression of type size_t, so in order
to get the sign extension right we need -(off_t)LOG_HEADER_SZ instead of
(off_t)(-LOG_HEADER_SZ).  However, we can just define the *_SZ macros to
cast to off_t, then we don't need to worry about negation.

Fixes Debian bug #822749, PR 175.

Signed-off-by (and updated by): Nicolas Williams <nico@twosigma.com>
2016-11-09 13:35:08 -06:00
Viktor Dukhovni
b39a4f7c78 Update old_version after timeout
On a low update rate master, if we don't update old_version after
processing a poll timeout, we will generate spurious warnings about
missed (change) signals every time the timer expires, and will
needlessly contact the slaves.
2016-08-09 21:02:44 -04:00
Viktor Dukhovni
2d32982ed4 Fix slave boostrap from incomplete master log
When the master's log does not contain the complete history, slaves
that bootstrap from scratch encountered a loop, because the master
falsely assumed a race with log truncation.
2016-07-07 23:00:29 -04:00
Viktor Dukhovni
74f598e159 Set uber record nominal version when truncating
It needs to match the version of the last record saved and have a
reasonable timestamp.
2016-06-09 08:30:59 -04:00
Viktor Dukhovni
a5237e6940 Fix handling of uber record nominal version
When flushing the uber record, retain the current log version.  When the
uber record is the only (thus last) record in the log, return its nominal
version as the last version, not 0.  Upgrade the log if the current uber
record version number is not 0.
2016-06-09 07:04:01 -04:00
Nicolas Williams
316e0d2184 Store the canonical client princ in ipropd-slave
Otherwise we risk storing a name with the referral (empty) realm name,
which will then cause various knock-on effects, such as thinking that
the start_realm is "", and failing to find matching credentials in the
ccache.
2016-06-09 01:13:15 -04:00
Viktor Dukhovni
ffd0dda237 Fix iprop against legacy master with full log
When the master's log has all entries from version 1 to now, and no
uber entry (legacy master), then new slaves will not pull version 1,
because their uber record has version 1.

The fix is to force the uber version to 0 always, and avoid adding a
truncate nop when doing a full prop.  The uber record now records the
database version even in the absence of any other log entries so that
we know what to pull going forward.
2016-06-09 01:03:10 -04:00
Jeffrey Altman
1007d104fa lib/kadm5: do not prototype imported _krb5_put_int
The function _krb5_put_int() is a private function exported from
lib/krb5.  Its declaration should come from krb5-private.h.  A local
declaration will not result in the proper import qualifiers on
Windows.

See also: e1a244f Make it possible to include krb5_locl.h in kadm5

Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
2016-04-11 16:01:27 -05:00
Nicolas Williams
e1a244f0aa Make it possible to include krb5_locl.h in kadm5
This and ffc525aad1 are the correct fix
rather than f1d73a8e46.  The next commit
reverts f1d73a8 by re-applying ffc525a.
2016-04-11 16:00:12 -05:00
Jeffrey Altman
f1d73a8e46 Revert "lib/kadm5: do not prototype imported _krb5_put_int"
krb5_locl.h cannot be included from within lib/kadm5 in the
current UNIX builds.  Reverting this change which is necessary
to properly build on Windows until an alternate solution is
agreed upon.

This reverts commit ffc525aad1.
2016-04-11 14:40:57 -05:00
Jeffrey Altman
ffc525aad1 lib/kadm5: do not prototype imported _krb5_put_int
The function _krb5_put_int() is a private function exported from
lib/krb5.  Its declaration should come from krb5-private.h.  A local
declaration will not result in the proper import qualifiers on
Windows.

Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
2016-04-10 19:04:30 -05:00
Nicolas Williams
a114690bde Fix HDB two-phase commit for LDAP backend
We can't replay log entries when recovering if the backend is shared by
writers with separate logs (or no logs at all), i.e., on other hosts.
2016-02-29 22:12:51 -06:00
Nicolas Williams
d5bc673e31 Fix HDB two-phase commit for /dev/null log 2016-02-29 19:13:14 -06:00
Nicolas Williams
649c4824b0 kadm5: fix leak in set_keys 2016-02-29 19:13:12 -06:00
Nicolas Williams
1236238cde kadm5/log.c: missing error checking 2016-02-29 19:13:11 -06:00
Nicolas Williams
8394778f92 master: quieten static analyzers 2016-02-29 19:13:11 -06:00
Nicolas Williams
2734102cc7 slave: quieten static analyzer false positives 2016-02-29 19:13:11 -06:00
Nicolas Williams
2415a5ee1d ipropd-slave: missing error check 2016-02-29 19:13:11 -06:00
Nicolas Williams
cfd9d59a15 ipropd-master: missing error check 2016-02-29 19:13:10 -06:00
Nicolas Williams
e625bb6ef6 Remove busted precheck in create_s.c 2016-02-29 19:13:10 -06:00
Nicolas Williams
6cc69e0b1f Shut up VC 2016-02-29 19:13:10 -06:00
Nicolas Williams
c350ca6f6e iprop-log: fix logically dead warnx() 2016-02-29 19:13:09 -06:00
Nicolas Williams
2d9f7257b9 Also build setkey3_s on Windows 2016-02-26 22:23:54 -06:00
Nicolas Williams
1976e012b8 Automatically upgrade iprop logs to add uber rec
We need the uber record all the time now, actually, except when merely
inspecting a log file.  This is important as we depend on replaying
entries written to the log in order to complete the HDB writes, and if
we don't have an uber record we can't do this step.

Also, log_init() should cleanup on error.
2016-02-26 19:10:14 -06:00
Nicolas Williams
eabb2821c6 setkey_principal_3(): use the new HDB/log protocol
The addition of kadm5_setkey_principal_3(), and the associated
kadm5_s_setkey_principal_3() missed the revamp for two-phase commit.
2016-02-26 15:05:34 -06:00
Viktor Dukhovni
8fe294d0d7 Add SO_KEEPALIVE to iprop clients (slaves) 2016-02-26 15:43:13 -05:00
Viktor Dukhovni
579393c8b9 Optionally prune old keys when setting new keys.
When new keys are added (typically via kadm5_setkey_principal_3),
truncate the key history to remove old keys, that is keys older than
the newest key which was in effect prior longer ago than the principal's
maximum ticket lifetime.  This feature is controlled via the "[kadmin]"
section's "prune-key-history" boolean parameter, which defaults to false.

Currently this happens only when kadm5_setkey_principal_3()
is called directly on the server, the client API simulates
kadm5_setkey_principal_3() via a get, update, modify sequence that does
not prune the key history.  The plan is to add a new kadm5 protocol RPC
and convert clients to call that instead.

In setkey_principal_3 seal keys after entry key update

Also, for now, don't check the return value of kadm5_log_modify() in
the new kadm5_s_setkey_principal_3().  This has to be addressed more
globally.

Censor stale keys in kadm5_s_get_principal
2016-02-26 15:43:12 -05:00
Nicolas Williams
f261ed4f58 Fix ipropd_slave: no EDQUOT on WIN32 2016-02-26 11:42:01 -06:00
Nicolas Williams
ebc1ad34ba ipropd-master/slave: enhancements and bug fixes
- fix int/uint confusion and use unsigned integral types for time
 - improve messages
 - add --verbose option
 - attempt transaction recovery in ipropd-master during idle times
 - begin hardening daemons against dying at the slightest provocation
 - better recovery from various errors
 - daemons now restart automatically in most of the many error cases
   where the daemons still die
2016-02-26 00:59:04 -06:00
Nicolas Williams
20df2c8706 Two-phase HDB commit via iprop log, + GC for log
We used to update the iprop log and HDB in different orders depending on
the kadm5 operation, which then led to various race conditions.

The iprop log now functions as a two-phase commit (with roll forward)
log for HDB changes.  The log is auto-truncated, keeping the latest
entries that fit in a configurable maximum number of bytes (defaults to
50MB).  See the log-max-size parameter description in krb5.conf(5).

The iprop log format and the protocol remain backwards-compatible with
earlier versions of Heimdal.  This is NOT a flag-day; there is NO need
to update all the slaves at once with the master, though it is advisable
in general.  Rolling upgrades and downgrades should work.

The sequence of updates is now (with HDB and log open and locked):

a) check that the HDB operation will succeed if attempted,
b) append to iprop log and fsync() it,
c) write to HDB (which should fsync()),
d) mark last log record committed (no fsync in this case).

Every kadm5 write operation recover transactions not yet confirmed as
committed, thus there can be at most one unconfirmed commit on a master
KDC.

Reads via kadm5_get_principal() also attempt to lock the log, and if
successful, recover unconfirmed transactions; readers must have write
access and must win any race to lock the iprop log.

The ipropd-master daemon also attempts to recover unconfirmed
transactions when idle.

The log now starts with a nop record whose payload records the offset of
the logical end of the log: the end of the last confirmed committed
transaction.  This is kown as the "uber record".  Its purpose is
two-fold: act as the confirmation of committed transactions, and provide
an O(1) method of finding the end of the log (i.e., without having to
traverse the entire log front to back).

Two-phase commit makes all kadm5 writes single-operation atomic
transactions (though some kadm5 operations, such as renames of
principals, and changes to principals' aliases, use multiple low-level
HDB write operations, but still all in one transaction).  One can still
hold a lock on the HDB across many operations (e.g., by using the lock
command in a kadmin -l or calling kadm5_lock()) in order to push
multiple transactions in sequence, but this sequence will not be atomic
if the process or host crashes in the middle.

As before, HDB writes which do not go through the kadm5 API are excluded
from all of this, but there should be no such writes.

Lastly, the iprop-log(1) command is enhanced as follows:

 - The dump, last-version, truncate, and replay sub-commands now have an
   option to not lock the log.  This is useful for inspecting a running
   system's log file, especially on slave KDCs.

 - The dump, last-version, truncate, and replay sub-commands now take an
   optional iprop log file positional argument, so that they may be used
   to inspect log files other than the running system's
   configured/default log file.

Extensive code review and some re-writing for clarity by Viktor Dukhovni.
2016-02-26 00:55:33 -06:00
Nicolas Williams
d774aeda38 ipropd-master: add missing ret = 2016-02-26 00:55:33 -06:00
Nicolas Williams
c6f24e99f0 Revamp cf/db.m4; test LMDB 2016-02-26 00:55:32 -06:00
Nicolas Williams
7df165003a Fix iprop-log dump leak 2016-02-26 00:55:31 -06:00
Nicolas Williams
d1fcf3dc67 ipropd_master: fix dump bug 2016-02-26 00:55:31 -06:00
Nicolas Williams
76965a2a14 Add missing initialization of mandatory 2016-02-16 20:49:32 -06:00
Nicolas Williams
b1af99aa81 Fix memleak in lib/kadm5/set_keys.c 2016-02-16 20:49:32 -06:00
Nicolas Williams
05a919b94b iprop slave: try incremental after complete xfer
The following sequence of events results in slave B having a stale HDB:

 - slave A connects to master, master dumps HDB for the slave
 - kadm5 operations
 - slave B connects to master, master sends previously dumped HDB

slave B won't discover any updates until the next transaction.

The fix is simple: the slave should immediately call ihave() after
receiving a complete HDB.
2015-05-20 10:07:52 -05:00
Nicolas Williams
4158ddbc25 Fix HDB rename/close order in iprop slave 2015-05-20 10:07:52 -05:00