summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-07-16Parse the Duo key_file in relaxed JSON modeRuss Allbery
When reading the Duo object configuration to retrieve the Duo admin server, parse the JSON in relaxed mode to match the behavior of Net::Duo itself. Otherwise, we get hung up on trailing commas that Net::Duo doesn't care about. Change-Id: I0a7347b22e379fe5dfe5fdabaec3e23420cf9a63 Reviewed-on: https://gerrit.stanford.edu/1574 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Include the Duo type in the name of Duo integrationsRuss Allbery
Eventually, there will be multiple object types for different Duo integrations, and they will need to have unique names. Add the Duo type in parentheses after the name to help ensure this. Change-Id: I679130f9136077fc6bf5d8c6c9ad98ec83b400d0 Reviewed-on: https://gerrit.stanford.edu/1573 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Move perl/create-ddl into PERL_FILES to copy it during buildRuss Allbery
Otherwise, there are warnings from Build.PL due to the file missing from the manifest. Change-Id: I32db0199bfda25ab8235ab965bfbbca8bee180b8 Reviewed-on: https://gerrit.stanford.edu/1572 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Add more Perl dependencies, bump Perl versionRuss Allbery
Also set module_name (uselessly) to avoid warnings from Module::Build. Change-Id: I53426a096f4133f27aa3315b4be24385a3476793 Reviewed-on: https://gerrit.stanford.edu/1571 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Update MANIFEST for new Perl tests and test reorganizationRuss Allbery
Change-Id: I984f48d667acab4cfcb7e0c115773e34e6335d65 Reviewed-on: https://gerrit.stanford.edu/1570 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Include wallet-rekey-periodic in the distributionRuss Allbery
Change-Id: I3dd9ae38d638cddf2307f5e07cb4a2e01422e172 Reviewed-on: https://gerrit.stanford.edu/1569 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Work around Automake distcheck processRuss Allbery
Automake insists on not using DESTDIR for distcheck and instead relying on prefix, but we don't want Perl module installation to follow prefix since that may result in a module install directory that isn't in Perl's search path. So, if and only if we're running under distcheck, we pass the prefix in as --install_base. When copying the Test::RRA Perl modules into the perl/t/lib tree, use separate mkdir and $(INSTALL_DATA) instead of cp -R. The latter copies the read-only permissions, and then distclean cannot remove the files. Change-Id: Ic1879defad993c76384f7c207cd04cb67889a7ac Reviewed-on: https://gerrit.stanford.edu/1568 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Change the Perl install rule to reflect Module::BuildRuss Allbery
Change-Id: I36565462a248cef0ff1560b5a1d89a20353d566f Reviewed-on: https://gerrit.stanford.edu/1567 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Add perl/t/data/perl.conf to PERL_FILESRuss Allbery
Change-Id: I0d56ea7b64cdcc43bf59f803077d076414b1a1ce Reviewed-on: https://gerrit.stanford.edu/1566 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Fix test skip numbering for keytab testsRuss Allbery
Change-Id: I5143d487d6b3623bc2be1724ed766b8709feb506 Reviewed-on: https://gerrit.stanford.edu/1565 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Add missing directories to PERL_DIRECTORIESRuss Allbery
Change-Id: I5390ec1ea8ba90394454a75acb54f1f4a25f9c83 Reviewed-on: https://gerrit.stanford.edu/1564 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Release 1.1Russ Allbery
Change-Id: I823bb20d129e4c1efdb607821adc3b134c2f6276 Reviewed-on: https://gerrit.stanford.edu/1563 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Move wallet-rekey-periodic license into PODRuss Allbery
To ensure that the generated man page also contains a license, move the license text down into the POD. Change-Id: Iaeedfbffccd1510d50bf1f84f396e1b1f8fda8fc Reviewed-on: https://gerrit.stanford.edu/1562 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-16Add license statements to new SQL filesRuss Allbery
Change-Id: I518a175998aa77920b08c43e3a6b890bbab59280 Reviewed-on: https://gerrit.stanford.edu/1561 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Use xcalloc instead of xmalloc with calculated sizesRuss Allbery
Ensure we don't have integer overflow when allocating the array of struct iovec for store commands. Change-Id: I0777ca8ef050b9773dba0c03b5e8533d3b2d5486 Reviewed-on: https://gerrit.stanford.edu/1560 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Return the name of the ACL instead of the numeric IDRuss Allbery
The owner and getacl commands now return the current name of the ACL instead of its numeric ID, matching the documentation of owner. Change-Id: Ic47aad48bd1454ed4bffff7030b0492d74eee4fa Reviewed-on: https://gerrit.stanford.edu/1559 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Fix ordering of table drops on wallet-admin destroyRuss Allbery
Fix the ordering of table drops during a wallet-admin destroy action to remove tables with foreign key references before the tables they are referencing. Should fix destroy in MySQL and other database engines that enforce referential integrity. Change-Id: I9b37c516f67acdf1d9e25222f067df6749e8c769 Reviewed-on: https://gerrit.stanford.edu/1558 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Update TODO for more Commerzbank contributions, other changesRuss Allbery
Change-Id: I478ed7812a4d25641ee85846e4092e17536e5a1d Reviewed-on: https://gerrit.stanford.edu/1557 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Fix wallet-backend parsing of expiresRuss Allbery
Fix wallet-backend parsing of the expires command to expect only one argument as the expiration. This was correctly documented in the wallet client man page, but not in wallet-backend, and it accepted two arguments (a date and time). However, Wallet::Server did not and would just ignore the time. Now wallet-backend correctly requires the date and time be passed as a single argument. Change-Id: I8e51a576ea8781502f4eb983462ceca867b002be Reviewed-on: https://gerrit.stanford.edu/1556 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Use DateTime objects uniformly, improve expires parsingRuss Allbery
Always use DateTime objects for every date field in the database, and translate them into the local time zone for display when pulling them out of the database. This should provide better portability to different database backends. Change the parsing of expires arguments to use Date::Parse, thus supporting a much broader variety of possible date and time formats and allowing easy conversion to a DateTime object. Document the new dependency. Change-Id: I2ee8eaa6aa6ae9925ac419e49234ec9880d4fe95 Reviewed-on: https://gerrit.stanford.edu/1555 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Record ACL names in the ACL historyRuss Allbery
Change-Id: I0d7a088bb34dda2fc554b9f104c2a33e5faf879e Reviewed-on: https://gerrit.stanford.edu/1554 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Record the ACL name in the acl_history tableRuss Allbery
Store the current name of the ACL with each history row, and index the name. This will eventually allow retrieval of history by name for ACLs that have been deleted, although the rest of the code is not yet in place. The initial creation and membership of the ADMIN ACL during database initialization or reinitialization is no longer recorded in the acl_history table, since otherwise it produces errors due to the missing ah_name field when building the database with schema 0.07. There should be some better solution to this, but this will be okay for the time being. Change-Id: I015a00c972e0c2730c3d449952fcfe9b79c6e54f Reviewed-on: https://gerrit.stanford.edu/1553 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Adjust create-ddl for the move of modules to libRuss Allbery
Now needs a use lib 'lib' in order to run out of the source directory. Change-Id: Ia8645eae6c6699db919968d42f057b06e42150a2 Reviewed-on: https://gerrit.stanford.edu/1552 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Use DateTime objects in the database layer, not stringsRuss Allbery
Pass in DateTime objects for the date fields in the database instead of formatted time strings. This provides better compatibility with different database engines. Document in README the need to install the DateTime::Format::* module corresponding to the DBD::* module used for the server database. Change-Id: Id25796da718d734ac96ca27ccea9045b0c80c03f Reviewed-on: https://gerrit.stanford.edu/1551 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Drop use POSIX from several tests that don't use itRuss Allbery
Change-Id: I61379e8963569d26c9b9c31d1727f3cca4567f8e Reviewed-on: https://gerrit.stanford.edu/1550 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Also drop the new duo table when destroying the databaseRuss Allbery
In Wallet::Admin, add duo to the list of tables to drop when either destroying or reinitializing the database. Change-Id: I78790927f7d53b8d596e6ccb7c2340a341e404ae Reviewed-on: https://gerrit.stanford.edu/1549 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Document enctype reference table population in NEWSRuss Allbery
Change-Id: I3b3a035817e7e8f1c0e9709505490ce0ec299f3d Reviewed-on: https://gerrit.stanford.edu/1548 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Add contrib wallet-rekey-periodic scriptRuss Allbery
Add a new contrib script, wallet-rekey-periodic, which is used at Stanford to periodically rekey hosts from cron. Change-Id: Ic1f515da44e55623f7d6864f9a3cebf24c08e13b Reviewed-on: https://gerrit.stanford.edu/1547 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Test for Perl strict and minimum versionRuss Allbery
Fix strictness issues across the whole code base, and ensure that all Perl scripts enable warnings. (Hopefully enabling warnings won't cause problems for the server.) Change-Id: I4dee49f7a6bcbeeee21d74bf61a1fd26514f832c Reviewed-on: https://gerrit.stanford.edu/1532 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Update Perl POD tests to rra-c-util 5.5Russ Allbery
Now that the Perl directory has been reorganized, it's easier to synchronize with the standard rra-c-util tests. Change-Id: I97a03d06ff964edcc85ab8788af281b7bc321235 Reviewed-on: https://gerrit.stanford.edu/1531 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Switch to Module::Build for the Perl moduleRuss Allbery
The wallet server now requires Perl 5.8 or later (instead of 5.006 in previous versions) and is now built with Module::Build instead of ExtUtils::MakeMaker. This should be transparent to anyone not working with the source code, since Perl 5.8 was released in 2002, but Module::Build is now required to build the wallet server. It is included in some versions of Perl, or can be installed separately from CPAN, distribution packages, or other sources. Also reorganize the test suite to use subdirectories. Change-Id: Id06120ba2bad1ebbfee3d8a48ca2f25869463165 Reviewed-on: https://gerrit.stanford.edu/1530 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Update to rra-c-util 5.5 and C TAP Harness 3.1Russ Allbery
Update to rra-c-util 5.5: * Use Lancaster Consensus environment variables to control tests. * Use calloc or reallocarray for protection against integer overflows. * Suppress warnings from Kerberos headers in non-system paths. * Assume calloc initializes pointers to NULL. * Assume free(NULL) is properly ignored. * Improve error handling in xasprintf and xvasprintf. * Check the return status of snprintf and vsnprintf properly. * Preserve errno if snprintf fails in vasprintf replacement. Update to C TAP Harness 3.1: * Reopen standard input to /dev/null when running a test list. * Don't leak extraneous file descriptors to tests. * Suppress lazy plans and test summaries if the test failed with bail. * runtests now treats the command line as a list of tests by default. * The full test executable path can now be passed to runtests -o. * Improved harness output for tests with lazy plans. * Improved harness output to a terminal for some abort cases. * Flush harness output after each test even when not on a terminal. Change-Id: I05161eb3d3be49a98f7762e876cb114da0c84e9a Reviewed-on: https://gerrit.stanford.edu/1529 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Show the error message if verifier-netdb creation failsRuss Allbery
Change-Id: I1acd7894316fc96943b9eda5e3a9abb9d229646c Reviewed-on: https://gerrit.stanford.edu/1528 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11List all SQL files separately in Makefile.amRuss Allbery
Otherwise, they won't be copied properly to the perl directory when building out of tree. Change-Id: Id178d1b58d14a3595f372e25744dbdc61a81ff34 Reviewed-on: https://gerrit.stanford.edu/1527 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Clean up foreign keys and indices for history tablesRuss Allbery
Previous versions had erroneous foreign key constraints between the object history table and the objects table. Remove those constraints, and an incorrect linkage in the schema for the ACL history, and add indices for the object type, name, and ACL instead. Change-Id: Ie0ff2448caa82c7a533a1b9ff5c13029bb6ae4ef Reviewed-on: https://gerrit.stanford.edu/1526 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Fix test cleanup code to run during global destructionRuss Allbery
If we don't run the code to delete the wallet database very late, destruction of the SQLite objects may recreate the database file. Move the unlink to an END block to avoid this problem. Change-Id: Ib5ec2cbd08ba24c99f3dfa1daa01488931c5958f Reviewed-on: https://gerrit.stanford.edu/1525 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Add some missing stopwords in POD documentationRuss Allbery
Change-Id: Ieb29af8a3bcf61cdebb1d8b7b2a5b8868a3586dc Reviewed-on: https://gerrit.stanford.edu/1524 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Undo email address change for verifier testRuss Allbery
The global replacement of my email address broke this test as well since I was using my address as part of the test. Revert to the previous email address, since it's just example data. Change-Id: Iaebcf4b4556308d5a69fbe2c8b59b05304dfbf66 Reviewed-on: https://gerrit.stanford.edu/1523 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Fix verifier-netdb test for Heimdal, email addressRuss Allbery
Undo the email address renaming for verifier-netdb as well, since this has to use rra@stanford.edu for right now. Adjust so that the test is not skipped with Heimdal Kerberos user space. Change-Id: I0a0e16e1044fe6057a310cc419477a34052ffcda Reviewed-on: https://gerrit.stanford.edu/1522 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Fix verifier-ldap-attr test from email address changeRuss Allbery
This has to use rra@stanford.edu to work at all (and badly needs some sort of mock LDAP environment rather than what it's doing now). Change-Id: I0961c7f97633eb7e29e391804a6803195564d74b Reviewed-on: https://gerrit.stanford.edu/1521 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust Heimdal keytab object tests to not compare keytabsRuss Allbery
For some reason, two keytabs are comparing inequal even after masking the timestamp but both keytabs work for authentication. Stop doing a data comparison and instead attempt authentications with both keytabs as a more reliable test. Change-Id: I4bd0712d492b78f09e95ffbed3461d97613d9d0a Reviewed-on: https://gerrit.stanford.edu/1520 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust Wallet::Admin test for new schema versionRuss Allbery
We now have a 0.09 schema, so test upgrading from 0.07 to 0.09 in two steps. Change-Id: I0e7af4371ba78aa69a9b7be59239f10c86e1fade Reviewed-on: https://gerrit.stanford.edu/1519 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust ACL test for new SQLite autoincrement behaviorRuss Allbery
Similar to server, the ID of the last ACL created may vary depending on whether SQLite reuses the last autoincrement key when the highest-numbered record is deleted. Accept either possibility. Change-Id: I2dd3b3cbbdf32931820ff799ca06f751c37a4cbd Reviewed-on: https://gerrit.stanford.edu/1518 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust server test for new SQLite autoincrement behaviorRuss Allbery
SQLite now, when the highest-numbered record with an autoincrement key is deleted, will reuse that number instead of incrementing further. Adjust the test suite so that this ambiguity is never encountered, since it's not part of what we're testing. Change-Id: I08c0c1c3fae82556d0f016b95db2992bdded1775 Reviewed-on: https://gerrit.stanford.edu/1517 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Add new object type for Duo integrationsRuss Allbery
A new object type, duo (Wallet::Object::Duo), is now supported. This creates an integration with the Duo Security cloud multifactor authentication service and allows retrieval of the integration key, secret key, and admin hostname. Currently, only UNIX integration types are supported. The Net::Duo Perl module is required to use this object type. New configuration settings are required as well; see Wallet::Config for more information. To enable this object type for an existing wallet database, use wallet-admin to register the new object. Change-Id: I2c0dac75e81f526b34d6b509c4bdaecb43dd4a9d Reviewed-on: https://gerrit.stanford.edu/1516 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Ignore new Perl MYMETA.json fileRuss Allbery
Change-Id: I64dcd9fc393edba60f3a8d17ff2b59f8d51e131f Reviewed-on: https://gerrit.stanford.edu/1515 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-05-27Added /cron principals to Stanford policy and summaryJon Robertson
cron principals were being rejected due to not being a part of the Stanford Policy module. Change-Id: Ic67a8e2bce8474431163b74d97c2bf1fb184a4b7 Reviewed-on: https://gerrit.stanford.edu/1488 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-04-13Change my email address to eagle@eyrie.orgRuss Allbery
Change-Id: I4c2b5d7c807d6c27dd18a3b92eef66d21287d21e Reviewed-on: https://gerrit.stanford.edu/1481 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-08Randomize the password on Heimdal principal creationRuss Allbery
When creating new principals in a Heimdal KDC, generate a long, random password as the temporary password of the disabled principal before randomizing keys. This is necessary if password quality is being enforced on create calls. Since the principal is always inactive until the keys have been randomized, the password should not need to be secure (and indeed is not cryptographically random). Change-Id: If519a82475bb0d387a19d16ef1e024b0da64779a Reviewed-on: https://gerrit.stanford.edu/1374 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Fix test skip count in the verifier-ldap-attr testRuss Allbery
When the correct Kerberos tickets aren't available, this test skipped the wrong number of tests. Change-Id: Icf27178fe88027f38764285bb671560e051f9105 Reviewed-on: https://gerrit.stanford.edu/1373 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-06 18:15:23 +0000