summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAge
* This is small, but -entirely dead-.Gravatar Karl Ramm2013-10-12
|
* dewarn; unused variableGravatar Karl Ramm2013-09-30
|
* i is unused there, and here without KRB5Gravatar Karl Ramm2013-09-30
|
* rename zephyr python modules to zephyr_ctypesGravatar Karl Ramm2013-09-28
| | | | | Having more plausible claimants to the title of "python zephyr module" installed was interfering with builds.
* make it build without kerberosGravatar Karl Ramm2013-09-28
|
* Implement ZDumpSession and ZLoadSessionGravatar David Benjamin2013-09-28
| | | | This is unlikely to ever get merged, but it'll be handy for roost.
* Use the saved session keys in ZCheckZcodeAuthenticationGravatar David Benjamin2013-09-28
| | | | | | | | | | | | | | | | | This allows for authentication checking to continue working even when tickets expire or are renewed. Also include key expiration logic. This is possibly overly conservative and paranoid by a couple orders of magnitude. Intentionally do not use SERVACK because they're mildly annoying to get at and aren't authenticated. When we receive a notice authenticated with a key, we know the server has received it. From there, we can infer that sufficiently old keys are stale. We can't remove stale keys immediately because some older notices may still be in flight, but after a grace period they can go. The timeout is set to 60 seconds, which is fairly high, but matches Z_ReadWait's timeout.
* Create an alternate Z_AuthProc that saves keysGravatar David Benjamin2013-09-28
| | | | | | | The start of proper session key management in libzephyr. A new Z_AuthProc is added which appends the key into a queue. ZSubscribeTo and ZSubscribeToSansDefaults are modified to use it. For now, it's extremely simple and makes no attempt to expire old keys.
* Add internal Z_MakeZcodeAuthentication functionGravatar David Benjamin2013-09-28
| | | | Explicitly takes a krb5_creds as input.
* Bump find_or_insert_uid's time limitGravatar David Benjamin2013-09-28
| | | | | | | Basing it on krb4's CLOCK_SKEW value doesn't make any sense. We pick 900 because it is just over 128 + 256 + 512, the longest group of three timeouts in the retransmit schedule used by the zephyrd. This allows us to miss two packets in a row and still be fine.
* Turn find_or_insert_uid's buffer into an LRU cacheGravatar David Benjamin2013-09-28
| | | | | | If we see a duplicated packet, that means the server missed (or raced with) our CLIENTACK, which means we should update the timestamp on the entry to reset the aging.
* Drop packets with garbage at the end on the floorGravatar David Benjamin2013-09-28
| | | | | | | | | | | | | This effectively reverts 170736db76139ed9fff9dbf70a55d4ba4f25d9bd. That commit didn't work anyway. It fails to update packet_len, so we computed the Z_InputQ's header_len wrong and fail to truncate the garbage anyway. Plus packets like that likely come from a broken cross-realm zephyrd without f276622ace757977fec43633e43577350e0cf6fe, so we want to drop them. That patch has yet to be in a released libzephyr, so if there are other sources of notices with trailing garbage, no one was relying on them working anyway. On the contrary, we were relying on them NOT working in that it masks broken cross-realm zephyrds.
* Simplify Z_AddNoticeToEntry a bitGravatar David Benjamin2013-08-20
| | | | | The holelist isn't kept sorted; we used to always append to the end. But it's a singly-linked list, so prepending to it is going to be much much simpler.
* Defensively avoid waiting on non-initial SERVACKsGravatar David Benjamin2013-08-08
| | | | | | | | | | | Although the previous commit should make it very unlikely we screw up the subscription sharding, be defensive about waiting for SERVACKs. ZSubscribeTo does mess up, Z_SendFragmentedNotice will shard with a z_multiuid. In that case, although the second packet will get a SERVACK, Z_ReadWait kindly drops it on the floor. The ZIfNotice will then just hang. Tested by bumping zwgc's BATCH_SIZE up to 200, reverting the previous commit, and strace.
* Add fudge factor in subscription shardingGravatar David Benjamin2013-08-08
| | | | | | | | | | | | | | | | | Header lengths are not constant-size because Zcode escapes bytes 0xFF and 0x00 into two bytes. If we end up filling up close to all the space we have and Z_SendFragmentedNotice then computes a header length larger than ours by enough, the message gets fragmented. Getting it fragmented is especially unfortunate because only the first of a fragmented notice ever has a SERVACK survive. (They all get SERVACKs, but libzephyr kindly drops all but the first on the floor.) This isn't a watertight fix; we may get really really unlucky and blow up 13 bytes in the authenticator and checksum. But that's not likely, and a proper fix would involve either computing based on the maximum possible authenticator size (wasteful and hard to bound tightly) or changing to protocol to use a less inappropriate encoding.
* Free the result of krb5_unparse_name in ZGetSenderGravatar David Benjamin2013-08-08
| | | | Minor memory leak, but we may as well fix it.
* Expose Z_Subscriptions as ZSubscriptionsGravatar David Benjamin2013-08-08
| | | | | | With a custom send_routine that mirrors ZSrvSendList. This allows for an asynchronous version that replaces send_routine with non-blocking versions (and waits for ACKs out-of-band).
* Remove unauthenticated support from subs codeGravatar David Benjamin2013-08-08
| | | | | | It's only used by ZCancelSubscription, but the server rejects unauthenticated CLIENT_CANCELSUB requests anyway. The unauthenticated codepath results in a SERVNAK and doesn't drop subs.
* Don't pass HMACKs through reassembly codeGravatar David Benjamin2013-08-08
| | | | | | | | | | | | | | | | | | | ACKs to fragmented notices keep the multiuid field, but multipart becomes "". This is interpreted as 0/z_message_length. This means ACKs to non-initial fragments look like an initial fragment from the multipart field, but not when checking uid == multiuid. The result is that they get smashed when passing through reassembly. 6e8ec12b0ba9d476e065957028e4cf9cf69d6ac2 addressed this. For SERVACKs and SERVNAKs, it drops all but the initial ones (uid == multipart) on the floor. It ignores the problem for HMACKs. Normally ZSendPacket blocks on the HMACK before sending each successive fragment, so there's no opportunity for them to collide. But if calling ZSrvSendNotice with a custom send_function that doesn't block, the HMACKs can smash into each other depending on timing. Instead, fix it by using z_uid instead of z_multiuid as the multiuid key. For compatibility, keep the SERVACK dropping behavior. (I'd like to get all the SERVACKs too, but potentially that'll confuse clients somewhat.)
* Mark cksum_map as constGravatar David Benjamin2013-08-08
| | | | May as well put it in .rodata
* ZSendNotice: Don't leak buffer in error caseGravatar David Benjamin2013-08-08
| | | | | I would hope this codepath can never trigger, but good to clean up properly here.
* Treat obviously non-zephyr packets as badGravatar Jeffrey Hutzelman2013-02-27
| | | | | | | | | | | | | | When Z_ReadWait receives a packet which doesn't start with a zephyr version header, it considers the packet to be "obviously non-zephyr". Such packets are discarded and, previously, caused Z_ReadWait to return ZERR_NONE. Unfortunately, this can cause things to block for up to 60s when a caller was expecting a non-blocking call to pick up a new packet if there is one. This changes Z_ReadWait to return ZERR_BADPKT in this situation, eliminating the potential wait. This fixes #100
* zctl flush_subsGravatar Jeffrey Hutzelman2013-02-26
| | | | | | | | Provide a new zctl subcommand, flush_subs, to flush all subscriptions for a specified recipient. This is implemented using a new library function, ZFlushUserSubscriptions(). This is the client side of #103
* Allow zctl flush_locs to take a user argumentGravatar Jeffrey Hutzelman2013-02-26
| | | | | | | | Provide a new library function, ZFlushUserLocations(), to flush locations for a specified user. This can be called using zctl flush_locs, which now takes an optional username parameter. This is the client side of #102
* Send IPv4 addresses ASCII-encoded in v4 bdumpsGravatar Jeffrey Hutzelman2013-02-17
| | | | This fixes #94
* Don't try to checksum with NULL credsGravatar Jeffrey Hutzelman2013-02-16
| | | | | | | | If we have no Kerberos credentials, we cannot create a checksum. This can happen if, for example, we end up with an expired TGT. In this case, instead of crashing, just leave the zero checksum. This fixes #80
* Revert "Send IPv4 addresses ASCII-encoded, not ZCode"Gravatar Karl Ramm2013-02-16
| | | | | | This can't get subs in the athena realm. This reverts commit b92153fac201a9a22779817be5f2375f7cf754fc.
* Send IPv4 addresses ASCII-encoded, not ZCodeGravatar Jeffrey Hutzelman2013-02-14
| | | | This fixes #94
* Clean up warningsGravatar Jeffrey Hutzelman2013-02-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Eliminate compiler warnings due to various issues (listed below). This allows Zephyr to build cleanly under GCC versions ranging from 4.1.0 to 4.7.2 with all of the options shown below: -g -O2 -Wall -Werror -Wno-deprecated-declarations -Wmissing-declarations -Wpointer-arith -Wstrict-prototypes -Wshadow -Wextra -Wno-missing-field-initializers -Wno-unused-parameter and, on recent versions, -Wunreachable-code Test builds were done - On Ubuntu 12.10 (Quantal Quetzal) using both MIT Kerberos 1.10.1 and Heimdal 1.6, without krb4 and both with and without C-Ares and Hesiod - On Fedora 14 using Heimdal 0.6, without C-Ares or Hesiod and both with and without krb4 (KTH Kerberos 1.3rc2) - On Fedora Core 3, Fedora Core 5, Fedora 7, and Fedora 10, using Heimdal 0.6 and without C-Ares, Hesiod, or krb4 It also allows clean builds on Solaris 10 under the Sun Studio 12 (9/07) C compiler with the following options: -g -fd -v -errfmt -errhdr=%user -errtags=yes -errwarn=%all -erroff=E_OLD_STYLE_FUNC_DECL,E_ENUM_TYPE_MISMATCH_ARG,E_ARG_INCOMPATIBLE_WITH_ARG ... and under Solaris 9 with the Sun Forte 7 (3/02) C compiler with the above options and -erroff=E_FUNC_HAS_NO_RETURN_STMT. Solaris builds were done with Heimdal 0.6 and without C-Ares, Hesiod, or krb4. The following types of issues are addressed in this change: - Parameters and local variables with the same names as library functions - Parameters and local variables with the same names as globals - Declarations for exported global variables missing from headers - Prototypes for exported functions missing from headers - Missing 'static' on functions that shouldn't be exported - Old-style function declarations - Duplicate declarations - Type mismatches - Unused variables and functions - Uninitialized variables - Forward references to enums - Necessary header files not included - Violations of the aliasing rules, where GCC was able to detect them - Missing braces on if blocks that might be empty - Attempts to do pointer arithmetic on pointers of type void *, which is not permitted in standard C. - An attempt to pass a function pointer via a void * parameter, which is not permitted in standard C. Instead, we now pass a pointer to a structure, which then contains the required function pointer. - Unnecessary inclusion of <krb5_err.h>, which is already included by <krb5.h> when the former exists, and might not be protected against double inclusion, depending on which com_err was used. - Missing include of <com_err.h>, which was masked by the fact that it is included by headers generated by e2fsprogs compile_et - Use of com_err() with a non-constant value in place of the format string, which in every case was a fixed-size buffer in which a message was built using sprintf(!). Both the calls to sprintf and the fixed-size buffers have been removed, in favor of just letting com_err() do the formatting. - Various cases where X library functions expecting a parameter of type wchar_t * were instead passed a parameter of type XChar2b *. The two types look similar, but are not the same and are _not_ interchangeable. - An overly-simplistic configure test which failed to detect existence of <term.h> on Solaris, due to not including <curses.h>. - Using the wrong type for the flags output of krb5_auth_con_getflags() when building against Heimdal. A configure test is added to detect the correct type.
* ZGetSubs.c: Make sure MIN is defined before usingGravatar Jeffrey Hutzelman2013-01-31
|
* Add Camellia enctypes to the cksumtype mapGravatar Jeffrey Hutzelman2012-11-24
|
* Reject checksum if krb5_crypto_init failsGravatar Jeffrey Hutzelman2012-11-24
| | | | | | | The result of Z_krb5_verify_cksum is supposed to be nonzero on success and 0 on failure. But if krb5_crypto_init() failed, we were returning the resulting error code, effectively accepting any checksum, when instead we should reject the checksum since we cannot verify it.
* Ignore garbage when packet len > message lenGravatar Jeffrey Hutzelman2012-11-24
| | | | | | | | | | | | | | | | | | | | | | From -c shadow on 15-Nov-2011, discussing a problem where some notices received from other realms were causing clients to crash: So, the packet that crashed my client had extra garbage beyond what should have been the end of the packet. So z_multinotice was 0/61, but the packet was longer than 61. Which means the logic that should have treated this as an unfragmented notice (because partof == z_message_len) did not trigger. So a holelist gets created, with enough storage for partof, and then Z_AddNoticeToEntry is called to copy z_message_len (> partof) bytes into it. So, I don't know why your client, or the server, or something, is sending packets longer than the message length, but I don't think I actually want to just discard those, because then "legitimate" messages would vanish. Instead, if part + notice->z_message_len > partof, I just want to ignore the extra.
* Actually avoid ZReceiveNotice NULL pointer derefGravatar Darrell Kindred2012-11-24
| | | | | | | | | | | | | | | | | Bug report from dkindred in libzephyr affecting amd64_fc5: There's a bug in libzephyr (introduced in version zephyr-064) that is causing tzc to fail on amd64_fc5: In /afs/cs/misc/zephyr/src/zephyr-064/lib/ZRecvNot.c line 33, 'nextq' is tested without being initialized (see code below). I imagine the appropriate fix is to put that "if (!nextq)" test just *after* the "nextq = Z_GetFirstComplete();" line instead of just before. - Darrell
* Avoid null pointer dereference in ZReceiveNoticeGravatar Derrick Brashear2012-11-24
| | | | | | | Z_GetFirstComplete() can return NULL; in that case, we don't want to dereference the pointer it returns. Extracted from Andrew zephyr/064; authorship uncertain.
* Mostly factor out Z_FormatRawHeaderGravatar Chaskiel Grundman2012-07-16
| | | | | | | Have Z_FormatRawHeader call Z_ZcodeFormatRawHeader to reduce duplication and error. Z_FormatRawHeader was previously adding headers 17 and 18 unconditionally, which was not proper for a server forwarding an unauth message.
* Kill off another MAXPATHLENGravatar Karl Ramm2012-02-05
|
* Retool our use of configure such that we track it like everyone else doesGravatar Karl Ramm2011-10-23
| | | | | i.e. don't keep generated or foreign stuff in our source tree. As a side effect, this lets us use a libtool, etc. from this century
* _actually_ make the code work with heimdal.Gravatar Karl Ramm2011-02-21
|
* Use different flags for krb5_cc_retrieve_cred if not using MIT Kerberos.Gravatar Karl Ramm2011-02-21
| | | | | | | The fact that the Heimdal and MIT APIs are subtly different strikes again. I am honestly starting to wonder if they make it look this similar just to frustrate people; I only don't believe it because neither team seems like that sort of person. Fixes #74.
* It is still not the 80s anymore -- remove all caddr_tsGravatar Karl Ramm2011-02-02
|
* make -DZ_DEBUG workGravatar Karl Ramm2011-02-02
|
* Explicitly define ZNotice_Kind constants + actually define the promised stringsGravatar Karl Ramm2011-02-02
| | | | | | | | | Since these are constants used in the protocol be explicit about what values the C compiler is assigning them, and that they can't be arbitrarily rearranged. Also, since we were promising strings for describing them in zephyr.h actually define the array.
* ZOpenPort stashes the port number, no need to getsockname againGravatar Karl Ramm2011-02-02
|
* use system MINGravatar Karl Ramm2011-02-02
|
* In the expired tickets case, authent->length is probably gibberish;Gravatar Karl Ramm2010-12-11
| | | | notice->z_authent_authent_len will be zero.
* Apparently, on Linux at least, if you have an open UDP listening socketGravatar Karl Ramm2010-12-04
| | | | | | with SO_REUSADDR set on a given port, other people can also open listening sockets with SO_REUSEADDR set, so turn SO_REUSADDR back off after we've bound our port.
* No output, ever! We have com_err for a reasonGravatar Karl Ramm2010-12-04
|
* check the return code from krb5_get_default_realm _before_ dereferencingGravatar Karl Ramm2010-11-08
| | | | the pointer
* Restate error table dependencies such that make -j doesn't trip over itselfGravatar Karl Ramm2010-11-06
| | | | (thanks to wthrowe@mit.edu)
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-01 17:57:38 +0000