Adds support for systemd's fd-passing socket activation, letting systemd
listen for connections before starting the service. This might enable
quicker startup on systems with dependent services, since they will now
only need to wait for the socket, which holds connections until kdc is
finished starting up. It also enables use of the `PrivateNetwork`
directive, sandboxing kadmind into it's own network namespace.
Adds support for systemd's fd-passing socket activation, letting systemd
listen for connections before starting the service. This might enable
quicker startup on systems with dependent services, since they will now
only need to wait for the socket, which holds connections until kdc is
finished starting up. It also enables use of the `PrivateNetwork`
directive, sandboxing kpasswd into it's own network namespace.
Adds support for systemd's fd-passing socket activation, letting systemd
listen for connections before starting the service. This might enable
quicker startup on systems with dependent services, since they will now
only need to wait for the socket, which holds connections until kdc is
finished starting up. It also enables use of the `PrivateNetwork`
directive, sandboxing KDC into it's own network namespace.
This commit adds optional integration with systemd's state
notifification system.
When built with libsystemd, kadmind notifies systemd once it is
ready to serve and when it begins a clean shutdown, as well as
publishing a status line reporting the number of accepted connections.
This commit adds optional integration with systemd's state
notifification system.
When built with libsystemd, kpasswdd notifies systemd once it is
ready to serve and when it begins a clean shutdown, as well as
publishing a status line reporting how many password change requests
have been processed.
This commit adds optional integration with systemd's state
notifification system.
When built with libsystemd, the KDC notifies systemd once it is
ready to serve and when it begins a clean shutdown, as well as
publishing a status line reporting how many worker processes are
running.
In case len < (size_t)(*stringp - save) and len > 0
access to buf[l] leads to out-of-bounds write as
l = len and len means the length of buffer.
Change evaluation of l: only len - 1 elements of
buffer can be used for memcpy and terminator
should be written to buf[len - 1] (in case l = len - 1).
Also, this value of l is not used when len == 0,
so we calculate it only when len > 0.
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru>
In cred_delete(), sp is freed after returning from krb5_storage_to_data().
Between this point and the subsequent assignment to sp via krb_storage_emem()
there are two jumps to out, both are executed in an ENOMEM scenario: malloc fail
for cred_data_in_file and krb5_principal_set_realm() fail. In out, sp is freed
again.
This patch fixes the issue by freeing sp right before the krb5_storage_emem()
call.
Signed-off-by: Linar Galimov <galimovlz@sgu.ru>
Signed-off-by: Dmitry Mikhalchenko <tascad@altlinux.org>
This fixes possible double free of ac pointer. In the function
'krb5_auth_con_free' pointer ac (auth_context) is freed. In case
'ac != NULL', 'ac != tgs_ac', 'ac->remote_subkey == NULL' this
function is called twice (when logging "FAST AP-REQ remote subkey
missing" and at label 'out').
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru>
Set *p to NULL on asprintf failure to prevent a dangling pointer
and subsequent USE_AFTER_FREE when the caller ignores ENOMEM.
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Egor Mikhailov <mikhailovev@sgu.ru>
Keep the original DER encoding around when decoding certificates so hx509_cert_binary() does not rewrite certificates unnecessarily.
Add regression coverage for direct certificate binary output and keyless stores.
On our MacOS X CI job, provjobd2 sometimes held local TCP port 49195,
colliding with check-iprop. And so we move all listening ports in the
test setup out of the ephemeral port ranges on Linux and Mac.
Compute DER generalized time conversion in uint64_t and clamp to the
local time_t range before returning. This avoids wrapping far-future
ASN.1 times on 32-bit time_t platforms. We do not address time_t
being a non-integral type.
Do not assume that the open-type payload needs 8-byte alignment.
Align to pointer size instead, which avoids reading the wrong location
on ILP32 layouts.
Select UTCTime versus GeneralizedTime with a helper that only performs
the 2050 comparison when the local time_t range can represent that value.
This avoids ILP32 type-limit problems while preserving GeneralizedTime
output on 64-bit and unsigned 32-bit time_t platforms.
Move the int32 ptr comparison into a helper that first checks
whether the encoded pointer-sized default is representable as int32_t.
This avoids ILP32 type-limit warnings.
Use krb5_time_abs() rather than subtracting time_t values before passing the result to labs(). On signed 32-bit time_t platforms, subtracting far-apart times can overflow before labs() sees the value.
Commit 232c936ea3 added a fallback ENOTSUP
definition. The check itself and the fallback definition rely on
<errno.h> to be included already, so in case it was not (depending on
the platform) then there will be a wrong definition of ENOTSUP.
Instead of rely on <errno.h> to be included before including a
generated header from this tool, include it manually. This way both
the ENOTSUP check and its fallback definition (if ever) will always
work.
Add defensive handling for several NULL allocation and formatting paths reported across issues #820-#829.
Fixes#820, fixes#821, fixes#822, fixes#823, fixes#825, fixes#828
Generate 12 random bytes and encode them with Heimdal base64url, producing
16-character random passwords with 96 bits of entropy.
This avoids punctuation and quoting issues while still raising generated
password entropy substantially from the old roughly 55-bit generator.
Fixes#1145
Do not request an iprop/<master> initial ticket directly. With
name_canon_rules = as-is: this can leave the acquired credential
mismatched with what krb5_sendauth() later asks for. Get a normal TGT
and let sendauth acquire the service ticket.
Fixes#1332.
oysteikt
Roland C. Dowdeswell