Skip Menu |
 

Subject: UNIX domain socket support
From: ghudson@mit.edu
To: rt@kerborg-prod-app-1.mit.edu
Date: Tue, 10 Dec 2024 20:03:02 -0500
Subject: git commit
From: ghudson@mit.edu
Download (untitled) / with headers
text/plain 2.4KiB

Add underpinnings of UNIX domain socket support

Add sa2sun() and ss2sun() helpers to socket-utils.h. Add UNIX domain
socket support to sa_socklen() and print_addr(). Expand buffers for
printing addresses to 128 bytes to accomodate the maximum UNIX domain
socket path length.

Add loop_add_unix_socket() to net-server.c, primarily using the
existing TCP support (renamed to "stream").

As there is no standard Kerberos address type for UNIX domain sockets,
add basic directional address support. Add a definition for
ADDRTYPE_DIRECTIONAL in krb5.h. Add private constant krb5_address
objects to libkrb5 for initiator and acceptor directional addresses.
Use directional addresses for the KRB-SAFE/KRB-PRIV source address in
the kprop and password change protocols when the transport is not IPv4
or IPv6.

krb5_address objects are used for auditing purposes in the KDC audit
and KDB pluggable interfaces. Add a local-use address type
ADDRTYPE_UNIXSOCK for use in these cases. Add a flag to
k5_sockaddr_to_address() to indicate whether this address type can be
used. Add UNIX domains socket conversion support to the test audit
plugin module.

[ghudson@mit.edu: combined several commits; used directional addresses
for KRB-SAFE/KRB-PRIV; reduced duplication in net-server.c support;
wrote commit message. Also based on work by Alexander Bokovoy.]

https://github.com/krb5/krb5/commit/a575589ef525fb139cafa0de1a05382845f0afbd
Author: Andreas Schneider <asn@samba.org>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: a575589ef525fb139cafa0de1a05382845f0afbd
Branch: master
doc/appdev/refs/macros/index.rst | 2 +
src/include/k5-int.h | 12 ++-
src/include/krb5/krb5.hin | 9 +++
src/include/net-server.h | 1 +
src/include/port-sockets.h | 1 +
src/include/socket-utils.h | 14 ++++
src/kadmin/server/schpw.c | 6 +-
src/kdc/dispatch.c | 2 +-
src/kdc/kdc_audit.c | 2 +-
src/kdc/kdc_log.c | 8 +-
src/kdc/kdc_util.c | 2 +-
src/kprop/kprop.c | 4 +-
src/kprop/kpropd.c | 4 +-
src/lib/apputils/net-server.c | 169 +++++++++++++++++++++++++++++----------
src/lib/krb5/libkrb5.exports | 2 +
src/lib/krb5/os/addr.c | 21 ++++-
src/lib/krb5/os/changepw.c | 6 ++
src/plugins/audit/j_dict.h | 1 +
src/plugins/audit/kdc_j_encode.c | 11 +++
19 files changed, 216 insertions(+), 61 deletions(-)
From: ghudson@mit.edu
Subject: git commit
Download (untitled) / with headers
text/plain 1.2KiB

Add support for UNIX domain sockets

Make the KDC and kadmind listen on UNIX domain sockets if any are
listed in kdc_listen, kadmind_listen, or kpasswd_listen. Send KDC and
kpasswd requests on UNIX domain sockets if any are listed in the kdc
and primary_kdc realm variables.

[ghudson@mit.edu: combined several commits; simplified client side by
treating UNIX domain socket entries like module-generated addresses;
edited commit message]

https://github.com/krb5/krb5/commit/f3a59a8bae1c4db4a2b47cc1049236bc339a094f
Author: Andreas Schneider <asn@samba.org>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: f3a59a8bae1c4db4a2b47cc1049236bc339a094f
Branch: master
doc/admin/conf_files/kdc_conf.rst | 62 ++++++++++++++++++++------------------
doc/admin/conf_files/krb5_conf.rst | 17 ++++++-----
src/include/k5-int.h | 1 +
src/kadmin/server/ovsec_kadmd.c | 3 ++
src/kdc/main.c | 3 ++
src/lib/krb5/os/locate_kdc.c | 17 +++++++++++
src/lib/krb5/os/os-proto.h | 1 +
src/lib/krb5/os/sendto_kdc.c | 25 +++++++--------
src/lib/krb5/os/trace.c | 2 ++
src/tests/t_changepw.py | 22 +++++++++++++-
src/tests/t_sendto_kdc.py | 17 +++++++++++
11 files changed, 119 insertions(+), 51 deletions(-)