summaryrefslogtreecommitdiff
path: root/usr.sbin/ldapd
AgeCommit message (Collapse)Author
2021-07-14Remove unneeded calls to tls_init(3)kn
As per the manual and lib/libtls/tls.c revision 1.79 from 2018 "Automatically handle library initialisation for libtls." initialisation is handled automatically by other tls_*(3) functions. Remove explicit tls_init() calls from base to not give the impression of it being needed. Feedback tb OK Tests mestre
2021-07-12Change the error reporting pattern throughout the tree when unveilBob Beck
fails to report the path that the failure occured on. Suggested by deraadt@ after some tech discussion. Work done and verified by Ashton Fagg <ashton@fagg.id.au> ok deraadt@ semarie@ claudio@
2021-05-02Fix having hostnames in the listen on statement. Regression introduced inMartijn van Duren
r1.39. Issue originally reported by Anton Kasimov via rob@. OK claudio@
2021-04-20Move TAILQ initialization to files where they are used.dv
These priv-sep daemons all follow a similar design and use TAILQs for tracking control process connections. In most cases, the TAILQs are initialized separate from where they are used. Since the scope of use is generally confined to a specific control process file, this commit also removes any extern definitions and exposing the TAILQ structures to other compilation units. ok bluhm@, tb@
2021-01-28Add ldap(1) to the SEE ALSO section. OK deraadt@Todd C. Miller
2021-01-27Unveil ldapd. Follow recent precedent and elect to forego the unlinking ofrob
some objects at shutdown thereby allowing for a tighter unveil. Feedbackup from deraadt@ and martijn@. OK deraadt@
2021-01-27these programs (with common ancestry) had a -fno-common problem relatedTheo de Raadt
to privsep_procid. ok mortimer
2021-01-17Comply with man page intent of -dvv enabling BER level logging.rob
Tweak and ok martijn@
2021-01-09Remove locally imposed limit on sockets.rob
Suggested by martijn@, ok claudio@
2020-12-30getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-11-29Silence -Wsign-compare whining in bsnprintf()Theo Buehler
This warning was present since an incorrect cast was removed in r1.11. Add the cast to the correct place, i.e., cast to the wider type. ok florian martijn
2020-11-29Fix cert and key path inference for absolute pathsTheo Buehler
ldapd infers certificate and key paths from the configured certificate string. It appends ".crt" and ".key", respectively, and in the case of a relative path it also prepends "/etc/ldap/certs/". A logic error results in prepending "/etc/ldap/certs/" also for absolute paths. Avoid this by making the whole thing readable at the cost of a bit of verbosity. Problem reported by Maksim Rodin on misc@, thanks! Initial fix from me, committing an improved version on behalf of martijn. ok jmatthew, tb
2020-09-19Add a bsd.schema including a shadowPassword and an sshPublicKeyTheo Buehler
attribute that can be used to extend existing LDAP users with the additional bsdAccount objectclass. The former is useful for ypldap+ldapd setups without login_ldap and the latter makes it easier to use sshd's AuthorizedKeysCommand. Originally from reyk, revived by Aisha Tammy, with input from many, especially Robert Klein.
2020-06-24Using the "ldaps" or "tls" keywords in ldapd.conf currently enables allTheo Buehler
protocols and ciphers. So you get a TLS server speaking TLSv1.0 and supporting cipher suites with RC4 and 3DES encryption, all of which should be considered broken. There is no way of disabling TLSv1.0 and TLSv1.1 in ldapd. All this is also not very clearly called out in the documentation. This commit switches the defaults to using the libtls defaults for both protocols and ciphers. If compatibility with the insecure legacy protocols and ciphers is needed, use the "legacy" keyword before "tls" or "ldaps" in ldapd.conf. tested by abieber. inoguchi agrees with the direction. ok beck
2020-03-05Fix ldapd datadir location.Martijn van Duren
Diff from roklein <at> roklein <dot> de OK claudio@
2020-02-10briefly mention /etc/examples/ in the FILES section of all theIngo Schwarze
manual pages that document the corresponding configuration files; OK jmc@, and general direction discussed with many
2020-01-28usr.sbin/ldapd: replace TAILQ concatenation loop with TAILQ_CONCATbket
OK florian@
2019-10-26The starttls command doesn't have a value with its extended request.Martijn van Duren
The handling of this changed with libutil/ber.c r1.12 resulting in starttls failing. Found by several. Fix suggestion by roklein <at> roklein <dot> de OK claudio@
2019-10-24The ber_* namespace is used by liblber since time immemorial,Theo Buehler
so move our BER API to the unused ober_* prefix to avoid some breakage in ports. Problem diagnosed by jmatthew with ber_free() in samba, but there are many others as pointed out by sthen. tests & ok rob ok sthen (who had an almost identical diff for libutil) "go head hit it" deraadt
2019-07-03snprintf/vsnprintf return < 0 on error, rather than -1.Theo de Raadt
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-06-27Some asprintf() calls were checked < 0, rather than the precise == -1.Theo de Raadt
ok millert nicm tb, etc
2019-05-18Fix LDAP RFC reference in comment. Also noticed by martijn.rob
ok guenther@, claudio@
2019-05-11The BER API is currently used by ldap, ldapd, ldapctl, ypldap, snmpd, androb
snmpctl. Separate copies of ber.[ch] have existed and been maintained in sync in ldap, ldapd, ypldap and snmpd. This commit moves the BER API into /usr/lib/libutil. All current consumers already link libutil. ldapd and snmpd regress passes, and release builds. With help from tb@ and guenther@. ok deraadt@, tb@
2019-04-27Only apply sign extension when less than eight bytes have been consumed. Thisrob
fixes a problem when handling large negative integers. ok claudio@
2019-03-31Avoid calling dup2(oldd, newd) when oldd == newd. In that case theYASUOKA Masahiko
descriptor keeps CLOEXEC flag then it will be closed unexpectedly by exec(). ok tedu florian
2019-02-13(unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherTheo de Raadt
larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
2018-12-05key.data is a void *, on gcc archs doing a %s printf with such a pointerClaudio Jeker
results in a warning. Use either the original string value or use a cast. This makes both clang and gcc happy. OK guenther@
2018-11-27Sync with ldap(1)Martijn van Duren
2018-11-20Fix when ber_free_elements is called with a NULL-value.Martijn van Duren
Found via snmpctl snmp walk 127.0.0.1 oid 1 OK claudio@
2018-11-04some tweaks from raf czlonka, plus one more from me;Jason McIntyre
2018-11-01- odd condition/test in PF lexerAlexandr Nedvedicky
(and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
2018-09-07replace malloc()+strlcpy() with strndup() in cmdline_symset().miko
"looks good" gilles@ halex@
2018-08-27Undefined plans can never match. Check for that before trying to use the plan.Claudio Jeker
OK millert@ gsoares@
2018-08-27Wrap some overly long lines. No functional changeClaudio Jeker
2018-08-12Change ber_write_elements() to return ssize_t instead of int.rob
ok claudio@
2018-08-03Place a limit on the number of elements in a ber sequence/set. This preventsrob
possible stack overflow due to recursion in ber_free_elements(). ok claudio@
2018-07-31Relocate some public functions above the internal functions comment.rob
ok claudio@
2018-07-31Fix some debugging output now that ber type and encoding are unsigned int.rob
ok claudio@
2018-07-31Make ber type and encoding a unsigned int instead of unsigned long.Claudio Jeker
This way the size is the same on all archs and 32bit should be good enough. OK rob@
2018-07-13Fix some comments referencing sockets which are not used by the ber api. Therob
api uses read and write buffers (byte streams) that are utilized by calling applications which may or may not use sockets. ok claudio@ buffer byte streams that applications then use for
2018-07-13Fix loop condition in ber.c. Discussed with claudio.rob
ok claudio@, jca@
2018-07-11Do for most running out of memory err() what was done for most runningKenneth R Westerback
out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
2018-07-09No need to mention which memory allocation entry point failed (malloc,Kenneth R Westerback
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-07-09Simplify ber_read()Jeremie Courreges-Anglas
After the removal of fd-based read/writes I could have trimmed the code further. - no socket-based reads so ber_read() doesn't need to loop until it gets the desired amount of data - return either the requested amount of data or -1/ECANCELED, the caller shouldn't have to handle partial reads itself - inline ber_readbuf() into ber_read() ok rob@ claudio@ tb@
2018-07-08Be consistent in warn() and log_warn() usage whenKenneth R Westerback
running out of memory. Next step, be correct *and* consistent. ok dennis@ tb@ benno@ schwarze@
2018-07-04More whitespace.rob
2018-07-04Cleanup some whitespace.rob
2018-07-04Relocate the update of br_offs from ber_read() to ber_readbuf() so ber_getc()rob
can call ber_readbuf() in all cases. This resolves a problem previously encountered with SNMPv3 authentication, simplifies the code, and completes a full synchronization of all ber instances. Proposed by claudio@. Problematic use case in snmpd tested by sthen@ and me. ldap(s) appear happy as well. looks good to claudio@
2018-07-04Avoid possible vfprintf NULL errors in ldap_unbind().rob
Ok benno@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-12 21:51:25 +0000