Adds support for systemd's fd-passing socket activation, letting systemd
listen for connections before starting the service. This might enable
quicker startup on systems with dependent services, since they will now
only need to wait for the socket, which holds connections until kdc is
finished starting up. It also enables use of the `PrivateNetwork`
directive, sandboxing KDC into it's own network namespace.
This commit adds optional integration with systemd's state
notifification system.
When built with libsystemd, the KDC notifies systemd once it is
ready to serve and when it begins a clean shutdown, as well as
publishing a status line reporting how many worker processes are
running.
This fixes possible double free of ac pointer. In the function
'krb5_auth_con_free' pointer ac (auth_context) is freed. In case
'ac != NULL', 'ac != tgs_ac', 'ac->remote_subkey == NULL' this
function is called twice (when logging "FAST AP-REQ remote subkey
missing" and at label 'out').
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org>
Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru>
Use krb5_time_abs() rather than subtracting time_t values before passing the result to labs(). On signed 32-bit time_t platforms, subtracting far-apart times can overflow before labs() sees the value.
We must switch to OpenSSL 3.x, and getting lib/hcrypto to provide
OpenSSL 3.x APIs is too large an undertaking. Plus the hcrypto backend
is not safe, not secure (probably has timing leaks galore), and no one
has the resources to make it a world-class crypto library, so it just
has to go.
commit 4d48b172ab ("add pkinit
configration for btmm") introduced automatic configuration of
the 'pkinit_kdc_identity' and 'pkinit_kdc_friendly_name' on macOS
but also modified the default for the 'enable_pkinit' setting
such that pkinit is enabled on all __APPLE__ platforms overriding
the [kdc] enable-pkinit setting obtained from the configuration.
This change modifies the enable-pkinit behavior on __APPLE__ platforms
to match those on every other platform. __APPLE__ platforms will
continue to auto-configure the [kdc] pkinit_identity and
[kdc] pkinit_anchors if they are not specified in the configuration.
If block_dns is set, call getaddrinfo with AI_NUMERICHOST set and
AI_CANONNAME clear.
Some paths may not have set AI_CANONNAME, but it's easier to audit
this way when the getaddrinfo prelude is uniform across call sites,
and the compiler can optimize it away.
oysteikt
Nicolas Williams