[Pkg-freeipa-devel] [Git][freeipa-team/gss-ntlmssp][upstream] 53 commits: Add compatibility with OpenSSL 1.1.0

Tue Mar 15 13:39:33 GMT 2022

Timo Aaltonen pushed to branch upstream at FreeIPA packaging / gss-ntlmssp

Commits:
e498737a by Simo Sorce at 2016-07-01T10:18:42-04:00
Add compatibility with OpenSSL 1.1.0

In their continued wisdom OpenSSL developers keep breaking APIs left and right
with very poor documentation and forward/backward source compatibility.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
5bdd7f00 by Simo Sorce at 2017-03-20T09:51:55-04:00
Port some documentation into the tree

It used to be on the old fedorahosted wiki, but let's keep it as
markdown in the tree for now.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
3599d817 by Simo Sorce at 2017-03-31T18:01:50-04:00
Rename and split the README file

Use markdown for neat formatting on pagure.
This file is used as the project description so add information on other
related documentation and split out the old testing information.

Signed-off-by: Simo Sorce <simo at redhat.com>
Merges #9

- - - - -
17ce6893 by Simo Sorce at 2019-04-18T14:09:32-04:00
Add support for RFC5801

These are the only GSS-API functions that can return a mechanism name
given an oid. These are now used by mod_auth_gssapi, so let's support
them in gssntlmssp.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
554dc66b by Simo Sorce at 2019-04-18T15:29:44-04:00
Add support to return SSF value

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
75e3840f by Simo Sorce at 2019-04-18T15:36:40-04:00
Release 0.8.0

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
1092838e by Simo Sorce at 2019-05-15T21:04:42-04:00
Fix strncpy warnings with recent compilers

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
7c06e520 by David Woodhouse at 2019-05-15T21:04:42-04:00
Add gss_inquire_attrs_for_mech()

Since commit 030a4a03a ("Report inquire_attrs_For_mech mech failures") in
MIT krb5, NTLMSSP fallback within SPNEGO is no longer working. It seems
that providing a gss_inquire_attrs_for_mech() function is now mandatory.

Although it does seem that perhaps krb5 should be a little more forgiving
and just assume GSS_C_NO_OID_SET, fix it anyway.

Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>

- - - - -
2251a722 by Simo Sorce at 2019-05-15T21:04:42-04:00
Return actual data for RFC5587 API

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
c0e7dfb2 by Simo Sorce at 2019-12-11T17:16:23-05:00
Add new Windows version flags

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
17da78c7 by Simo Sorce at 2019-12-11T17:16:43-05:00
Add Key exchange also when wanting integrity only

Key Exchange allows for improved security properties so it is always a
good idea to ask it whenever we want to perform any integrity not just
when full confidentiality is requested.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
0edd5954 by Simo Sorce at 2019-12-17T09:05:33-05:00
Add build CI
- - - - -
18e44bbb by Simo Sorce at 2019-12-17T09:14:53-05:00
also on pull requests
- - - - -
b3484a6f by Simo Sorce at 2019-12-17T10:35:41-05:00
Fix CI dependencies

- - - - -
bfc7232d by Amandeep Gautam at 2019-12-17T19:31:08-05:00
add support for getting session key

Return seesion key when gssntlm_inquire_sec_context_by_oid is called
witth GSS_C_INQ_SSPI_SESSION_KEY.

- - - - -
ef893b89 by Simo Sorce at 2020-04-08T11:43:35-04:00
Minor wording change about release pages
- - - - -
e3d6fa39 by Simo Sorce at 2020-04-08T12:14:42-04:00
We moved gss-ntlmssp officially to Github

Update docs to reflect the move
- - - - -
2be70af8 by Simo Sorce at 2020-04-08T12:26:55-04:00
Minor formatting
- - - - -
9d7a275a by Simo Sorce at 2020-04-08T12:32:32-04:00
Add build status
- - - - -
38a28bf7 by Simo Sorce at 2020-04-29T15:27:56-04:00
Drop support for GSS_C_MA_NOT_DFLT_MECH

When this MEchanism Attribute is exposed as supported it causes GSSAPI
implementations to eclude the mechanism completely as vaiable to acquire
creds from pseudo mechanisms like SPNEGO.
This is not what was intended when we added this flag. The intention was
to not make this mechanism the default when mutliple are available, and
specifically to not make it preferred over krb5.
However given this is not how the fal works, we need to drop it now.

It may be re-introduced at a later time as a runtime settings when we
grow a way to set configuration in a file somewhere so that admin can
control this behavior.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
c22160db by Simo Sorce at 2020-04-29T15:44:49-04:00
Release version 0.9.0

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
dbae04dd by Simo Sorce at 2020-05-14T11:12:12+00:00
Fix test_gssapi_rfc5587

Test was broken by commit 38a28bf71277ca49a5f21fdc8b80819f38b5028d
But CI failed to catch it because it was not actually running tests just
building them ...

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
9f35bf83 by Simo Sorce at 2020-05-14T11:12:12+00:00
Actually run tests with make check

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
f89766bd by Simo Sorce at 2020-05-14T11:12:12+00:00
Add two tests around NTLMSSP_NEGOTIATE_LMKEY

One test is a missing example from the MS-NLMP test vectors.

The second one is the puzzle in issue #13

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
556adfa0 by Simo Sorce at 2020-05-14T11:12:12+00:00
Refine LM compatibility level logic

Fix a bug with level 4 not allowing NTLMv2
Rename the V2 flag to give the right meaning.

Fix LM Challenger Response geneation, I realized the artifical
NoLMResponseNTLMv1 boolean in MS-NLMP documents just refers to
compatibility level 2 where NTLMv1 is used but LM is not.

Add one call to check for v2 usage helper instead of doing raw checks
on ctx flags outside of gss_ntlmssp.c Contextually make flags private,
to gss_ntlmssp.c so helpers must be used.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
ab1f3211 by Simo Sorce at 2020-05-14T11:12:12+00:00
Refactor the gssntlm_required_security function

Keeps manipulation of ctx->sec_req inside gss_ntlmssp.c

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
8e99bcbb by Simo Sorce at 2020-05-14T11:12:12+00:00
Implement reading LM/NT hashes

Fixes imports of NT hashes (hex_to_key was broken)
Adds ability to read NTLM_USER_FILE that uses smbpasswd format.
(allows to import NT and LM hashes directly)

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
4c94faab by Simo Sorce at 2020-05-14T11:12:12+00:00
Add test for smpasswd-like user files

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
13818978 by Simo Sorce at 2020-05-14T11:12:12+00:00
Fix CI scripts

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
a14a9967 by Simo Sorce at 2020-05-18T18:57:07+00:00
Return confidentiality status.

And make sure it is tested so it does not regress.
Thanks to Jordan Borean for spotting this.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
26b3b6b9 by Simo Sorce at 2020-05-20T11:59:23+00:00
Fix segfault in sign/seal functions

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
0279a3e8 by Simo Sorce at 2020-05-26T21:58:39+00:00
Fix dummy signature generation

When always sign is set but no sign or seal was negotiated we mistakenly
set the sequence number ionstead of the signature version in the
signature version field.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
36b3a268 by Simo Sorce at 2020-05-27T12:17:15+00:00
Use UCS16LE instead of UCS-2LE

MS-NLMP in 2.2 indicates that UTF-16 little endian w/o BOM is used.

Make sure we do the same as now some chracters maybe used in
usernames and passwords that use code points outside of the range
that can be handled by UCS-2LE.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
9377d908 by Simo Sorce at 2020-05-28T21:34:26+00:00
Provide a zero lm key if the password is too long

In Windows LM and NT keys are not geneated on the fly, but usually
stored in the Windows key store, therefore when LM generation fails or
is disable the LM Key is usually all zeros. Do the same here.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
46c642f0 by Simo Sorce at 2020-06-09T14:15:40+00:00
Completely omit CBs AV pairs when no CB provided

Although the MS-NLMP Spec says zero CBs should be equivalent to no CBs,
Windows apparently fails validation when CBs are optional and an all
zero CB is presented.

So avoid sending any CBs if we have none.
Also make sure to deal with missing CBs on the accpetor by ignoreing
missing CBs and setting the new GSS_C_CHANNEL_BOUND_FLAG in gss flags if
the CBs are present and matching.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
eb4cf16f by Simo Sorce at 2020-06-19T20:48:13+00:00
Remove obsolete TODO comments

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
b31c587a by Simo Sorce at 2020-06-26T13:45:03+00:00
Change license to the more permissive ISC

This change is not sudden, I have been thinking about relicensing this
project for quite a while.
The main trigger is that I received a couple of requests for a more
permissive license, but the real reason is that I always felt it at
odds that a module that is targeted to be loaded by MIT/Krb5's gssapi
library had such a widely different license.
It may give rise to misunderstandings as well as create undue burden
on users to figure out license compatibility with their applications
(proven in fact by the requests to relicense).

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
18aed834 by Simo Sorce at 2020-07-08T14:26:06+00:00
Do not require cached users with winbind

When acquiring credentials we may need to know if a cache is available.
This is necessary in the ISC cacse as we need to use those cached
credentials to perform NTLM authentication. However in the ASC case
we do not need creds of the user to be cached, all we need is a handle
that can be used to later authenticated the user against a DC.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
336473a5 by Volodymyr Khomenko at 2020-07-20T20:50:42+00:00
Fixed memleak of usr_cred

Used in gssntlm_accept_sec_context as temporary credential
holding data needed for the server authentication step

Signed-off-by: Volodymyr Khomenko <volodymyr at vastdata.com>

- - - - -
f93ca02d by Simo Sorce at 2020-07-21T18:39:44+00:00
Add ability to pass keyfile via cred store

This works both for ISC and ASC, so a user can pass their own keyfile
with a single entry or a server can be passed a keyfile with all users'
entries.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
588d6a10 by Volodymyr Khomenko at 2020-08-07T17:39:50+00:00
Support get_sids request via name attributes

To allow server to get details about authenticated user
new get_sid request by "urn:gssntlmssp:sids" name attribute
is implemented (see RFC6680) to report the list of user SIDs.
The list of SIDs is stored in gssntlm source_name
(part of gss context, can be get by gss_inquire_context)
in textual representation - comma-separated list of SIDs.
gss_get_name_attribute() and gssntlm_inquire_name()
should be used to inquire name attributes.

Unit-test for get_sids name attributes:
Test is checking memory management for name attributes
with gss_duplicate_name, gss_release_name and
gss_get_name_attribute / gss_inquire_name API
for accessing name attributes
in both textual and binary representation.

Signed-off-by: Volodymyr Khomenko <volodymyr at vastdata.com>

- - - - -
575e3b93 by Simo Sorce at 2020-08-24T15:20:19-04:00
Remove unused parts of Makefile.am

These are causing issues whenever make clean is called, and we have no
docs we want to generate or install on the user system anyway yet.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
b9e59df8 by Simo Sorce at 2020-08-24T15:20:19-04:00
Move attribute names to allocated strings

Unfortunately as our interfaces allow for importing and exporting the
gssntlmssp context via serialization we need to use allocated strings or
fixed size buffers.

In this case, given the attribute names are arbitrary strings I prefer
to allocate the names for ease of handling.
The bulk of the data for sids is in the values anyway so it is a small
price to pay to have a strdup() for the attribute name.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
01092153 by Simo Sorce at 2020-08-24T15:20:19-04:00
Adjust serialization for name attributes

This allows us to serialize and import back also named attributes.

NOTE: this commit also fixes a few severe export_data_buffer reallocation
bugs that so far flew under the radar because the initial allocation
size (4k) was big enough to contain the context as used in tests.
Larger contexts caused failures in the code that were also hard to
diagnose.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
88e84ace by Simo Sorce at 2020-09-25T17:10:33-04:00
Fix crash in acquiring credentials

When a credential store is provided, but no name is provided, we end up
crashing by dereferencing the name.

Allow the request to proceed without a name, as it may be selected out
of a credential file, but if none was found, return an error.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
52b45b5f by Simo Sorce at 2020-09-25T17:10:33-04:00
Fix fallback to external_creds interface

The code was incorrectly immediately erroring out if no credential file is
provided. Change the code to try to look for external credentials in
case of any error in the previous code block.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
ecda1a5a by Volodymyr Khomenko at 2020-09-30T10:33:40-04:00
Fixed memory leaks found by valgrind

Run 'valgrind --tool=memcheck ntlmssptest'
and fixed all important memory leaks
(one more is left in gssntlm_debug_init() -> debug_fd
as designed behaviour)

Signed-off-by: Volodymyr Khomenko <volodymyr at vastdata.com>

- - - - -
9266d374 by Simo Sorce at 2020-10-21T14:59:20-04:00
Introduce parse_user_name() function

The formet get_enterprise_name() function wa stoo naive and did not
allow to properly recognize enterprise names.

The code is now rearchitected under a new helper function named
parse_user_name() and the function has a proper truth table that
establishes input -> output mappings.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
6f5a1316 by Simo Sorce at 2020-10-21T14:59:20-04:00
Add test for parse_user_name

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
7949fa8e by Simo Sorce at 2020-10-21T14:59:20-04:00
Change how we assemble user names in ASC

Use a DOMAIN\Username format to insure proper detection of enterprise
names versus classic GSS formatted names.

In general using the DOMAIN\username form is always preferred as it
allows to express all valid name formats without escaping.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
d55c0e50 by Simo Sorce at 2021-02-10T13:31:42-05:00
Use thread local storage for winbind context

This allow multiple calls into winbindd from parallel threads without
suffering from a common mutex that serializaes all authentications.

The price to pay is that a new context is allocated for each thread, and
the way windbind works, this probably mean a separate file descriptor is
created for each of this thread on the application side (winbindd will
be ok as it will kick idle connections).

The users of gssntlmssp in a multi-threaded environment will need to be
careful to limit the number of threads they allow to use gssapi in this
case.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
1348c923 by Simo Sorce at 2021-02-10T13:31:42-05:00
Make per thread winbind context optional

By default proceed to acquire a new context for each operation that
needs it. High performance programs that have full control of their
thread usage and can afford one socket per thread can set the
GSSNTLMSSP_WB_TLS_CTX environment variable.

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -
3718f86a by Simo Sorce at 2021-02-10T14:26:52-05:00
Release version 1.0.0

Signed-off-by: Simo Sorce <simo at redhat.com>

- - - - -

30 changed files:

- + .github/workflows/ccpp.yml
- COPYING
- Makefile.am
- + README.md
- README.txt → TESTING.txt
- conf_macros.m4
- configure.ac
- contrib/gssntlmssp.spec.in
- + doc/compatibility.md
- + doc/release-process.md
- + examples/test_user_file2.txt
- + examples/test_user_file3.txt
- src/crypto.c
- src/crypto.h
- src/external.c
- src/gss_auth.c
- src/gss_creds.c
- src/gss_names.c
- src/gss_ntlmssp.c
- src/gss_ntlmssp.h
- src/gss_ntlmssp_winbind.h
- src/gss_sec_ctx.c
- src/gss_serialize.c
- src/gss_signseal.c
- src/gss_spi.c
- src/gssapi_ntlmssp.h
- src/ntlm.c
- src/ntlm.h
- src/ntlm_common.h
- src/ntlm_crypto.c

The diff was not included because it is too large.

View it on GitLab: https://salsa.debian.org/freeipa-team/gss-ntlmssp/-/compare/8e4485ca11aabaedfed4a2a3f3ce9ddabd50fa5b...3718f86a6af815db103785602956a621c91626ca

-- 
View it on GitLab: https://salsa.debian.org/freeipa-team/gss-ntlmssp/-/compare/8e4485ca11aabaedfed4a2a3f3ce9ddabd50fa5b...3718f86a6af815db103785602956a621c91626ca
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-freeipa-devel/attachments/20220315/a481293a/attachment-0001.htm>