Commit Graph

1067 Commits

Author SHA1 Message Date
Jeffrey Altman
1007d104fa lib/kadm5: do not prototype imported _krb5_put_int
The function _krb5_put_int() is a private function exported from
lib/krb5.  Its declaration should come from krb5-private.h.  A local
declaration will not result in the proper import qualifiers on
Windows.

See also: e1a244f Make it possible to include krb5_locl.h in kadm5

Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
2016-04-11 16:01:27 -05:00
Nicolas Williams
e1a244f0aa Make it possible to include krb5_locl.h in kadm5
This and ffc525aad1 are the correct fix
rather than f1d73a8e46.  The next commit
reverts f1d73a8 by re-applying ffc525a.
2016-04-11 16:00:12 -05:00
Jeffrey Altman
f1d73a8e46 Revert "lib/kadm5: do not prototype imported _krb5_put_int"
krb5_locl.h cannot be included from within lib/kadm5 in the
current UNIX builds.  Reverting this change which is necessary
to properly build on Windows until an alternate solution is
agreed upon.

This reverts commit ffc525aad1.
2016-04-11 14:40:57 -05:00
Jeffrey Altman
ffc525aad1 lib/kadm5: do not prototype imported _krb5_put_int
The function _krb5_put_int() is a private function exported from
lib/krb5.  Its declaration should come from krb5-private.h.  A local
declaration will not result in the proper import qualifiers on
Windows.

Change-Id: I53e7aeea9f2f34cab105f2e331f3c6522847ccfe
2016-04-10 19:04:30 -05:00
Nicolas Williams
a114690bde Fix HDB two-phase commit for LDAP backend
We can't replay log entries when recovering if the backend is shared by
writers with separate logs (or no logs at all), i.e., on other hosts.
2016-02-29 22:12:51 -06:00
Nicolas Williams
d5bc673e31 Fix HDB two-phase commit for /dev/null log 2016-02-29 19:13:14 -06:00
Nicolas Williams
649c4824b0 kadm5: fix leak in set_keys 2016-02-29 19:13:12 -06:00
Nicolas Williams
1236238cde kadm5/log.c: missing error checking 2016-02-29 19:13:11 -06:00
Nicolas Williams
8394778f92 master: quieten static analyzers 2016-02-29 19:13:11 -06:00
Nicolas Williams
2734102cc7 slave: quieten static analyzer false positives 2016-02-29 19:13:11 -06:00
Nicolas Williams
2415a5ee1d ipropd-slave: missing error check 2016-02-29 19:13:11 -06:00
Nicolas Williams
cfd9d59a15 ipropd-master: missing error check 2016-02-29 19:13:10 -06:00
Nicolas Williams
e625bb6ef6 Remove busted precheck in create_s.c 2016-02-29 19:13:10 -06:00
Nicolas Williams
6cc69e0b1f Shut up VC 2016-02-29 19:13:10 -06:00
Nicolas Williams
c350ca6f6e iprop-log: fix logically dead warnx() 2016-02-29 19:13:09 -06:00
Nicolas Williams
2d9f7257b9 Also build setkey3_s on Windows 2016-02-26 22:23:54 -06:00
Nicolas Williams
1976e012b8 Automatically upgrade iprop logs to add uber rec
We need the uber record all the time now, actually, except when merely
inspecting a log file.  This is important as we depend on replaying
entries written to the log in order to complete the HDB writes, and if
we don't have an uber record we can't do this step.

Also, log_init() should cleanup on error.
2016-02-26 19:10:14 -06:00
Nicolas Williams
eabb2821c6 setkey_principal_3(): use the new HDB/log protocol
The addition of kadm5_setkey_principal_3(), and the associated
kadm5_s_setkey_principal_3() missed the revamp for two-phase commit.
2016-02-26 15:05:34 -06:00
Viktor Dukhovni
8fe294d0d7 Add SO_KEEPALIVE to iprop clients (slaves) 2016-02-26 15:43:13 -05:00
Viktor Dukhovni
579393c8b9 Optionally prune old keys when setting new keys.
When new keys are added (typically via kadm5_setkey_principal_3),
truncate the key history to remove old keys, that is keys older than
the newest key which was in effect prior longer ago than the principal's
maximum ticket lifetime.  This feature is controlled via the "[kadmin]"
section's "prune-key-history" boolean parameter, which defaults to false.

Currently this happens only when kadm5_setkey_principal_3()
is called directly on the server, the client API simulates
kadm5_setkey_principal_3() via a get, update, modify sequence that does
not prune the key history.  The plan is to add a new kadm5 protocol RPC
and convert clients to call that instead.

In setkey_principal_3 seal keys after entry key update

Also, for now, don't check the return value of kadm5_log_modify() in
the new kadm5_s_setkey_principal_3().  This has to be addressed more
globally.

Censor stale keys in kadm5_s_get_principal
2016-02-26 15:43:12 -05:00
Nicolas Williams
f261ed4f58 Fix ipropd_slave: no EDQUOT on WIN32 2016-02-26 11:42:01 -06:00
Nicolas Williams
ebc1ad34ba ipropd-master/slave: enhancements and bug fixes
- fix int/uint confusion and use unsigned integral types for time
 - improve messages
 - add --verbose option
 - attempt transaction recovery in ipropd-master during idle times
 - begin hardening daemons against dying at the slightest provocation
 - better recovery from various errors
 - daemons now restart automatically in most of the many error cases
   where the daemons still die
2016-02-26 00:59:04 -06:00
Nicolas Williams
20df2c8706 Two-phase HDB commit via iprop log, + GC for log
We used to update the iprop log and HDB in different orders depending on
the kadm5 operation, which then led to various race conditions.

The iprop log now functions as a two-phase commit (with roll forward)
log for HDB changes.  The log is auto-truncated, keeping the latest
entries that fit in a configurable maximum number of bytes (defaults to
50MB).  See the log-max-size parameter description in krb5.conf(5).

The iprop log format and the protocol remain backwards-compatible with
earlier versions of Heimdal.  This is NOT a flag-day; there is NO need
to update all the slaves at once with the master, though it is advisable
in general.  Rolling upgrades and downgrades should work.

The sequence of updates is now (with HDB and log open and locked):

a) check that the HDB operation will succeed if attempted,
b) append to iprop log and fsync() it,
c) write to HDB (which should fsync()),
d) mark last log record committed (no fsync in this case).

Every kadm5 write operation recover transactions not yet confirmed as
committed, thus there can be at most one unconfirmed commit on a master
KDC.

Reads via kadm5_get_principal() also attempt to lock the log, and if
successful, recover unconfirmed transactions; readers must have write
access and must win any race to lock the iprop log.

The ipropd-master daemon also attempts to recover unconfirmed
transactions when idle.

The log now starts with a nop record whose payload records the offset of
the logical end of the log: the end of the last confirmed committed
transaction.  This is kown as the "uber record".  Its purpose is
two-fold: act as the confirmation of committed transactions, and provide
an O(1) method of finding the end of the log (i.e., without having to
traverse the entire log front to back).

Two-phase commit makes all kadm5 writes single-operation atomic
transactions (though some kadm5 operations, such as renames of
principals, and changes to principals' aliases, use multiple low-level
HDB write operations, but still all in one transaction).  One can still
hold a lock on the HDB across many operations (e.g., by using the lock
command in a kadmin -l or calling kadm5_lock()) in order to push
multiple transactions in sequence, but this sequence will not be atomic
if the process or host crashes in the middle.

As before, HDB writes which do not go through the kadm5 API are excluded
from all of this, but there should be no such writes.

Lastly, the iprop-log(1) command is enhanced as follows:

 - The dump, last-version, truncate, and replay sub-commands now have an
   option to not lock the log.  This is useful for inspecting a running
   system's log file, especially on slave KDCs.

 - The dump, last-version, truncate, and replay sub-commands now take an
   optional iprop log file positional argument, so that they may be used
   to inspect log files other than the running system's
   configured/default log file.

Extensive code review and some re-writing for clarity by Viktor Dukhovni.
2016-02-26 00:55:33 -06:00
Nicolas Williams
d774aeda38 ipropd-master: add missing ret = 2016-02-26 00:55:33 -06:00
Nicolas Williams
c6f24e99f0 Revamp cf/db.m4; test LMDB 2016-02-26 00:55:32 -06:00
Nicolas Williams
7df165003a Fix iprop-log dump leak 2016-02-26 00:55:31 -06:00
Nicolas Williams
d1fcf3dc67 ipropd_master: fix dump bug 2016-02-26 00:55:31 -06:00
Nicolas Williams
76965a2a14 Add missing initialization of mandatory 2016-02-16 20:49:32 -06:00
Nicolas Williams
b1af99aa81 Fix memleak in lib/kadm5/set_keys.c 2016-02-16 20:49:32 -06:00
Nicolas Williams
05a919b94b iprop slave: try incremental after complete xfer
The following sequence of events results in slave B having a stale HDB:

 - slave A connects to master, master dumps HDB for the slave
 - kadm5 operations
 - slave B connects to master, master sends previously dumped HDB

slave B won't discover any updates until the next transaction.

The fix is simple: the slave should immediately call ihave() after
receiving a complete HDB.
2015-05-20 10:07:52 -05:00
Nicolas Williams
4158ddbc25 Fix HDB rename/close order in iprop slave 2015-05-20 10:07:52 -05:00
Nicolas Williams
409501e5e4 Tolerate some time-travel by slaves 2015-05-20 10:07:51 -05:00
Nicolas Williams
854aaab182 iprop master: Don't ignore flock() result 2015-05-20 10:07:51 -05:00
Nicolas Williams
b6e4d25d0d coverity 1164086 2015-04-18 23:19:24 -05:00
Nicolas Williams
13759fb73f Free kadm5 princ policy 2015-03-24 11:50:02 -05:00
Nicolas Williams
b48bed5f42 Daemons detach atomically to avoid having to wait
Tests that start daemons have to "wait" for them to start.

This commit makes Heimdal daemons prep to detach (when requested) by
forking early, then having the child signal readiness to the parent when
the child really is ready.  The parent exits only which the child is
ready.  This means that tests will no longer need to wait for daemons.

However, tests will still need a pidfile or such so they can stop the
daemons.

Note that the --detach options should not be used on OS X from launchd,
only from tests.
2015-03-24 11:49:59 -05:00
Jeffrey Altman
902aa4ee02 tests on Windows
Modify the NTMakefile rules for tests so that a failed test does
not prevent subsequent tests from being executed.

Change-Id: I9595ad4a1527feae7c402241bf06ab21a0b76d4a
2015-03-21 15:44:48 -04:00
Nicolas Williams
69b0a8f4eb kadm5: kadmin modify must refuse bogus keys
kadmin should not permit a modify that stores invalid keys into the
database.  Accepting bad key data into the database will result in
errors when those keys are eventually used.

This change does not address the general case.  It does address the
specific case of the kadmin client attempting to store the magic
bogus key since that is trivial to check for and can be unintentionally
returned to kadmind by a 1.6rc2 or prior client.  This can happen when
a user has get privilege but lacks the new get-keys privilege.

Change-Id: I44795e6428472b75ab1e4257ce7cb9160f0299f5
2015-03-14 16:08:44 -04:00
Nicolas Williams
db72e66eb9 kadm5: Add functions to check for bogus keys
Introduce kadm5_all_keys_are_bogus() and kadm5_some_keys_are_bogus()
which will be used in later changes.

Change-Id: I3a07ffe07bee7d6eb17c3d2eae91c107e0bac255
2015-03-14 16:08:34 -04:00
Love Hörnquist Åstrand
c10e99bead Merge pull request #109 from cg2v/dist-kadmin-version-script
version-script-client.map needs to be in dist
2014-08-22 21:38:55 -07:00
Love Hörnquist Åstrand
37afa01be3 rename roken base64, fixes #107 2014-08-22 20:57:24 -07:00
Chaskiel Grundman
41da16b48a version-script-client.map needs to be in dist
version-script-client.map needs to be in lib/kadm5's EXTRA_DIST,
otherwise make distcheck fails
2014-07-07 12:39:49 -04:00
Jakub Čajka
6affa4ccec kadm5: fix race in Makefile with kadm5_err.h
When running make with -j4, occasionally kadm5 fails due to a missing
header file kadm5_err.h. Fix the race condition.

Reported at https://bugzilla.redhat.com/1115164

Reviewed-by: Ken Dreyer <ktdreyer@ktdreyer.com>
2014-07-01 13:18:09 -06:00
Nicolas Williams
b80b21c8a8 Make kadmin ext work when lacking get-keys priv
When we added the get-keys privilege we lost the ability to setup
keytabs with the kadmin ext command.  The fix is to note that we got
bogus key data and randkey (as we used to).
2014-03-25 21:45:10 -05:00
Jeffrey Altman
dba026b5ef Introduce and apply krb5_storage_from_socket
On Windows a file descriptor is an int value allocated by the
local module instance of the C Run Time Library.  A socket handle is a
SOCKET value allocated by a Winsock Provider for the requested family and
protocol.   These two values cannot be mixed and there is no mechanism for
converting between the two.   The _get_osfhandle() and _open_osfhandle()
functions can work with a standard HANDLE (file, pipe, etc) but cannot be
used for a SOCKET.

The Heimdal krb5_storage_from_fd() routine counted on the osf conversion
functions working on SOCKET values.  Since they do not any attempt to call
krb5_storage_from_fd() on a socket resulted in an assertion being thrown
by the C RTL.

Another problem is SOCKET value truncation when storing a 64-bit value
into a 32-bit int.

To address these problems a new krb5_storage_from_socket() routine is
introduced.  This routine setups a krb5_storage that stores a socket value
as a rk_socket_t and provides a set of helper routines that always use
network ready functions.

The krb5_storage_from_fd() routines no longer use net_read() and
net_write() but provide helpers that follow their logic so that pipes can
be processed.

All call sites that allocate a socket now store the socket as rk_socket_t
and call krb5_storage_from_socket().

All locations that previously called the bare close() on a socket value
now call rk_closesocket().

Change-Id: I045f775b2a5dbf5cf803751409490bc27fffe597
2014-02-04 23:20:08 -05:00
Jeffrey Altman
6c4423cd46 kadm5: use rk_closesocket to close sockets
kadm5_c_destroy did not use rk_closesocket when cleaning up
the context.  This results in an exception on Windows since a
socket is not a file descriptor.

Change-Id: I9ebddad61f0199acb495a0773925df4f41e4fef2
2014-02-03 15:40:32 -05:00
Russ Allbery
22c7f07ed8 Add symbol versioning for libkadm5clnt
In order to support plugins for kadmin that use libkadm5srv, the
libkadm5clnt library has to be versioned to avoid hijacking all
of the function calls that should go to the server library.  Omit
the _kadm5_ clients from the public interface, and version
everything else.

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
2013-12-23 13:20:26 +01:00
Love Hornquist Astrand
1d84562886 add HDBGET: that only supports get, iteration doesnt really make sense for the HDB keytab except when dumping 2013-10-15 12:40:39 +02:00
Jeffrey Altman
3c3e2ad5e6 Windows: ktutil.exe requires libkadmsrv and libhdb
Include libkadmsrv.dll and libhdb.dll in the assembly which are
required for ktutil.exe to load.

Change-Id: Ic72d51e72daac71683a7f7000fe084197ee3c94a
2013-09-13 22:17:43 -04:00
Nicolas Williams
2d238b9d15 Backwards interop for older iprop peers
Don't abort() when seeing as-yet-unimplemented things we know about.

Patch from Harald Barth <haba@kth.se>.
2013-08-12 11:40:23 -05:00