eyrie.org Git - kerberos/webauth.git/log

Improvements to the keyutils support

Move the keyutils library out of LIBS into a separate variable so
that we can link only mod_webauth with it. Fix some coding style
issues. Never treat KEYRING caches as relative to the server root,
rather than conditioning that on the existence of libkeyutils.
Remove another stray Kerberos context free.

Change-Id: I5fabf6e3602da17f660086b77fcd26d6bc619ba1
Reviewed-on: https://gerrit.stanford.edu/378
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Support keyring credential caches

MIT Kerberos defines the keyring ccache type which can protect
credentials from sibling processes. On systems with libkeyutils,
override WebAuthCredCacheDir to enable protected session-linked
keyring credential caches.

Change-Id: I54a7aaef110d1b8ef2f4481ef41f56f9b4e7a4c2
Reviewed-on: https://gerrit.stanford.edu/377
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add tests for webauth_keyring_auto_update

Change-Id: Ic75e703146947898920de3790b3976cd26299061
Reviewed-on: https://gerrit.stanford.edu/376
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Only create new ring in keyring_auto_update if missing

Rather than creating a new ring on any keyring read error, only
create a new ring if the error indicated that the file didn't exist.

Change-Id: I9ba8c74caaa1a4478c02ecbcb2601d20a464a4b6
Reviewed-on: https://gerrit.stanford.edu/375
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add tests for remaining keyring functions except auto_update

Change-Id: Ida7b42748df895fe6b50233a2da44176a5c1f726
Reviewed-on: https://gerrit.stanford.edu/374
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Restore previous keyring_remove and keyring_best_key behavior

webauth_keyring_remove takes a zero-based index, not a one-based
index, so fix the check on its upper bound.

Do not return a decryption key from webauth_keyring_best_key whose
creation time predates the hint even if it's the closest key.

These changes restore the pre-APR library behavior.

Change-Id: Iee4a46132db16908dbd25e5d426849201803579a
Reviewed-on: https://gerrit.stanford.edu/373
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Clean up keyring tests

Verify more of the internal structure, test automatic resizing of
the keyring, and separate the keyring comparison into separate
numbered tests.

Change-Id: Iffea483eb94358a1862128396c1eb408a9bb99b3
Reviewed-on: https://gerrit.stanford.edu/372
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Rename tests/lib/key to tests/lib/keyring

This is actually a test for keyring handling at this point, so name
it accordingly.

Change-Id: I2915e48b21d7a66b270ed0bd34322c6533cadf8e
Reviewed-on: https://gerrit.stanford.edu/371
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Flesh out key tests and move keyring_from_key test

Flesh out tests/lib/keys-t.c to include the other key functions
and to test error cases and more of the key contents. Move the
test of keyring_from_key into tests/lib/key-t.c with the other
existing keyring tests.

Change-Id: Id078729e9112f74765cf57f5fc0272f583e95c21
Reviewed-on: https://gerrit.stanford.edu/370
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update TODO and NEWS for Exporter cleanup in WebAuth Perl module

Change-Id: Ia13af1da84547f813ac4d95c6185446243722778
Reviewed-on: https://gerrit.stanford.edu/369
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add URL-safe base64 encoding to TODO

Change-Id: I464f160f519d407ad372a0948beac20c4fb6a69f
Reviewed-on: https://gerrit.stanford.edu/368
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove all WebAuth module exports except :const and :krb5

All the other methods must now be called on a WebAuth object, so
there's no point in exporting them.

Change-Id: I58e37d4993123b0a189f6580da4da57f155be7ae
Reviewed-on: https://gerrit.stanford.edu/367
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove all the token attribute strings from the Perl API

Now that we have WebAuth::Token classes and wrappers around the
high-level token API, the Perl code doesn't need to know the wire
representation of token attributes. Remove the exported constants
used for that purpose.

Change-Id: I7bc130f305cbfbe3c8d86019b395583511c08296
Reviewed-on: https://gerrit.stanford.edu/366
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add missing WA_ERR_* constants to Perl WebAuth module

Change-Id: I8fc3f5ea7dd7774d44ba90de60bbeac74c9c6521
Reviewed-on: https://gerrit.stanford.edu/365
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Move WebAuth::Exception into a separate file, drop match method

Move WebAuth::Exception into its own *.pm file instead of including
it in WebAuth.pm. Drop the match method, which was only used inside
the test suite. Add some tests for the most important accessor
methods in the WebAuth::Exception class.

Add the missing WA_ERR_INVALID error code to the WebAuth Perl module
to allow for testing.

Move the Exporter and $VERSION information for WebAuth into a BEGIN
block so that it's safe for WebAuth and WebAuth::Exception to depend
on each other.

Change-Id: I2c28b81cfeb81df7accc7ea400696955c2ca8377
Reviewed-on: https://gerrit.stanford.edu/364
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Move functions that take keyrings to WEBAUTH_4_2

Since the internal layout of the keyring object has changed, any
interfaces that take keyrings have to move to the WEBAUTH_4_2
version.

Change-Id: I6f8af3bfddc7ce3f6d111d5b40f71616852c8948
Reviewed-on: https://gerrit.stanford.edu/363
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add NEWS entry for WebAuth::Key convenience constructor

Change-Id: I220f417e5037c03d9d284f5c0c1ffc884ef0391b
Reviewed-on: https://gerrit.stanford.edu/362
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add helper constructor for WebAuth::Key

Add a Perl WebAuth::Key module with a helper constructor that calls
WebAuth::key_create.

Change-Id: I67c571761917f1335eced5d4e5b88dec1b038d70
Reviewed-on: https://gerrit.stanford.edu/361
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

NEWS and TODO updates for WebAuth::Key accessor methods

Change-Id: I6f80a2151a30f4330fa55fdda01c7051afc0e949
Reviewed-on: https://gerrit.stanford.edu/360
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add accessor methods to get at WebAuth::Key data

Provide accessor methods to get to the key type, length, and data.
Flesh out the keyring test now that we can actually compare keys.

Change-Id: I693f4855222031b6c4a4919d7970f616249e4e2f
Reviewed-on: https://gerrit.stanford.edu/359
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Update TODO for the Perl module dependency fixes

Change-Id: Ib25dedc6b871bd289c022467787be262b912c262
Reviewed-on: https://gerrit.stanford.edu/358
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

TODO and NEWS updates for WebAuth::Keyring wrappers

Change-Id: I1d3820fbf11315d12709824d9463e96d69da2d81
Reviewed-on: https://gerrit.stanford.edu/357
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add WebAuth::Keyring constructor wrappers

Add a WebAuth::Keyring Perl module with constructor wrappers around
WebAuth::keyring_new and WebAuth::keyring_read.

Change-Id: Id3cea44204751faa7d3887bd05f894360856dc9b
Reviewed-on: https://gerrit.stanford.edu/356
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

TODO update for keyring_from_key and keyring_new merge

Change-Id: Ib624e65ce52c87e211b768aec592f274b0f8342a
Reviewed-on: https://gerrit.stanford.edu/355
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Merge Perl keyring_from_key and keyring_new interfaces

Allow keyring_new to take either a ring capacity or a WebAuth::Key
and call the appropriate underlying C function. Remove the
duplicate keyring_from_key API.

Change-Id: I89c6853e180c48c462bdbb2c85ea3dc5b41ebb28
Reviewed-on: https://gerrit.stanford.edu/354
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add Perl dependencies on perl/Makefile.PL and lib/libwebauth.la

Rebuild the Perl modules when perl/Makefile.PL or lib/libwebauth.la
have changed. This should result in fewer cases where make check
stops and forces rebuilding of the Perl module.

Change-Id: I1e430d74ab681efba5279d82b9b27e8a4b500d75
Reviewed-on: https://gerrit.stanford.edu/353
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

NEWS and TODO for WA_AES_KEY renaming

Change-Id: I960902f435cf1865152e71180fd6c09a51c40095
Reviewed-on: https://gerrit.stanford.edu/352
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Rename WA_AES_KEY to WA_KEY_AES

Change-Id: I8789998c4008da14bda75cbf0f537133445eb457
Reviewed-on: https://gerrit.stanford.edu/351
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove TODO for random number error checking

Change-Id: I088984d7abe940d7adee11847b86f369fd490d01
Reviewed-on: https://gerrit.stanford.edu/350
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Fold webauth_random_key into webauth_key_create

The only caller of webauth_random_key was webauth_key_create, so
incorporate its logic into that function. Pull out the actual
OpenSSL error message and report it.

Change-Id: I2246d01d223058de53929cb19b2efc437e0030d6
Reviewed-on: https://gerrit.stanford.edu/349
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add a test of encoding with an invalid key

This was also going to test retrieving the error from OpenSSL, but
alas OpenSSL doesn't appear to set an error in this case.

Change-Id: I74f69a5caf71d43999719fbc32cfeb53a7dbf67d
Reviewed-on: https://gerrit.stanford.edu/348
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Move webauth_random_bytes into token-crypto.c

The only use of this function was to generate the random nonce for
tokens, so inline the function into its only caller. Update the
OpenSSL code in token-crypto.c to properly obtain and report the
OpenSSL error message, if any.

Change-Id: I8f63ed6134dddbbeb5e7690d5a73fe9c149e714a
Reviewed-on: https://gerrit.stanford.edu/347
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Add NEWS entry for removing the random functions from public API

Change-Id: I68e6daa06c6acf3860d5ac711aaf55b7fecf9a27
Reviewed-on: https://gerrit.stanford.edu/346
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove webauth_random_{bytes,key} from the public API

Now that there's an API to generate a random key, there's no need
for these functions to be part of the public API. Remove them,
the very short test case, and the Perl bindings for them.

Change-Id: I956762ea6c841e949e16d84e4a6231cbd195594a
Reviewed-on: https://gerrit.stanford.edu/345
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Remove unnecessary code from the mod_webauth handler hook

We currently don't need a WebAuth context in the handler, so don't
create one.

Change-Id: I789d91b1ce85ceb6b4e43577335d496bdb2232e1
Reviewed-on: https://gerrit.stanford.edu/344
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Resynchronize TODO with JIRA

Change-Id: I065beea8ba616e4a7979488fefa165bc09c03804
Reviewed-on: https://gerrit.stanford.edu/342
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Rewrite the keyring library functions to use APR

All key and keyring functions in the WebAuth library API have changed
to take the WebAuth context and use APR memory management and
new-style error message handling.  All the *_free functions have
therefore been removed.  Keyrings are now represented by an APR array;
callers that want to walk through the keyring entries will need the
relevant APR headers.  Functions that could only fail if memory
allocation failed now either return new objects directly or are
declared void, since APR code assumes memory allocation does not fail.
The API now uses named structs instead of typedefs.

webauth_key_create will now create a random key if passed NULL for the
key material.  It also now returns a status code so that better error
messages can be reported.

webauth_keyring_read_file has been renamed to webauth_keyring_read.
webauth_keyring_write_file has been renamed to webauth_keyring_write.

The webauth_keyring_encode and webauth_keyring_decode functions have
been removed from the public API.

webauth_keyring_best_key now takes a WA_KEY_DECRYPT or WA_KEY_ENCRYPT
argument instead of a boolean.  This makes the meaning clearer at the
call site.

The Perl API for manipulating keyrings has been modified to include
the WebAuth context.  The read_file method in the WebAuth::Keyring
class has been replaced with a keyring_read method in the WebAuth
class and the WebAuth::Keyring new constructor has been replaced with
a keyring_new method in the WebAuth class so that the WebAuth context
can be tracked.  The capacity method on a WebAuth::Keyring object has
been removed since it's not part of the abstraction.

Change-Id: I31a52f08bfcf02483a3af1196957952a53d183fe
Reviewed-on: https://gerrit.stanford.edu/341
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Clean up layering separation for token decryption

Remove the remaining token attribute decoding and sanity checks from
webauth_token_parse and rename it to webauth_token_decrypt. Add them
to the decoding logic in lib/token-decode.c.

Modify webauth_token_decrypt to take two pairs of buffers and sizes
instead of decoding in place, and clean up all the internal logic
accordingly.

Remove the remaining code to do staleness checks during decoding. All
these checks are now done farther up the application layer and the
functions were never called with the data saying to do those checks.

Change-Id: I754848b8449c265674d5a7812cfd7d6e1f75423c
Reviewed-on: https://gerrit.stanford.edu/340
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

Merge webauth_token_encrypt with an internal helper function

We used to separate these since we might be called with a key rather
than a keyring, but that's no longer the case. Combine the functions.

Change-Id: Ib12cb15b4ddbdc9869d4b69c2550e5c6f178c9d2
Reviewed-on: https://gerrit.stanford.edu/339
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Replace webauth_token_encode with webauth_token_encrypt

Move all the attribute handling up to the caller and just encrypt
a given buffer into the token format in this function. Remove the
ability to provide a hint in favor of always using the current time.

Change-Id: Ie72f53f3ab861d4c978aad3c5a115b7788706513
Reviewed-on: https://gerrit.stanford.edu/338
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Rename lib/token.c to lib/token-crypto.c, hide encoded_length

This source file will eventually contain only the crypto code.
Make webauth_token_encoded_length static and rename it, since it's
no longer called outside of this file.

Change-Id: I3834aeaee5586043add5e4fd189c0d16c112ba89
Reviewed-on: https://gerrit.stanford.edu/337
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Move webauth_token_type_{code,string} to lib/token-decode.c

These functions are used in token decoding, so move them into
lib/token-decode.c from lib/token.c (which is going away).

Change-Id: I003cb9ee42aa4038ed048419dc6c59d0a68643ed
Reviewed-on: https://gerrit.stanford.edu/336
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Remove webauth_token_{create,parse}_with_key

These are no longer used anywhere in the source. We always implement
a workaround of creating a keyring first.

Change-Id: I0ef32cf6fac4febe6f32189a8767ba7364ecc2bb
Reviewed-on: https://gerrit.stanford.edu/335
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add NEWS entry for the removal of WebKDC::Token

Change-Id: Id04c5ce7e5bf9a2d72f9f206032c4a9ce05ea7ab
Reviewed-on: https://gerrit.stanford.edu/334
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Make the old webauth_token_{create,parse} functions private

The old webauth_token_create and webauth_token_parse functions have
been removed from the public API in favor of the new _encode and
_decode functions. The token_create and token_parse methods have also
been removed from the Perl API in favor of the new token_decode method
and WebAuth::Token::* classes.

Change-Id: I2cabf0feec72471835a26127dd78d9ffaf18fbfe
Reviewed-on: https://gerrit.stanford.edu/333
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Remove the generate-tokens test script

The WebKDC::Token module is gone, so remove this script, which relied
on using it. This temporarily leaves us without a way to generate the
various bad tokens. Add a comment about another couple of token types
that we can't currently generate.

Change-Id: I856579bb488fef453dea27084387793d4ad07679
Reviewed-on: https://gerrit.stanford.edu/332
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Update history and copyright date of WebLogin Perl module

Change-Id: Id343c02fff6b9e263a9accdf4902be15756d3fe8
Reviewed-on: https://gerrit.stanford.edu/331
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Perl: Resurrect and fix the webkdc.t test

Bring the webkdc.t test up to date with the changes to the Perl API
and confirm that it works properly if all of its prerequisites are
met.  Fix the syntax of the pwexpiration date passed to remctl.
Improve the diagnostic messages if the test is skipped.  Allow running
the tests that don't require kadmin-remctl and only skipping that one
test if Net::Remctl is not available.  Drop the probing for remctld,
since we don't use it.

Change-Id: Iac202e85d44f682df9e60a40ab910ed310bb9850
Reviewed-on: https://gerrit.stanford.edu/330
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Remove WebKDC::Token, switch all callers to WebAuth::Token::*

Change-Id: I501cbe8459e0c50270f909962a6c5def27e03094
Reviewed-on: https://gerrit.stanford.edu/329
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Perl: Don't pass the token into encode

Now that encode is a method on a WebAuth::Token object, the first
argument is the token and we shouldn't have to pass the token as
a regular argument as well.

Change-Id: I237c0a430a3ad616ec6f228994643f5bfc2b3288
Reviewed-on: https://gerrit.stanford.edu/328
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add prototypes to all WebAuth::Token::* accessor methods

Change-Id: I3e9b6bc82804e94eece7c4e9e824627e381a81d4
Reviewed-on: https://gerrit.stanford.edu/327
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Perl: Allow WebAuth::Token->new to decode tokens

Support passing the token and keyring into WebAuth::Token->new, which
will call WebAuth->token_decode under the hood and then return an
appropriate subclass of WebAuth::Token.

Change-Id: If77c5b81aac3baed76699ac44e642c5f9f9dcb09
Reviewed-on: https://gerrit.stanford.edu/326
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Perl: Load all token classes when loading the WebAuth module

Our C code also creates WebAuth::Token::* objects, and callers expect to
be able to call methods on those objects. Load all of the Perl classes
for the caller so that the caller doesn't have to remember to do so.

Change-Id: I7d0c2ce8ed6ec6616d6f7e894d03c96fe1595ad4
Reviewed-on: https://gerrit.stanford.edu/325
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Formatting and comments in Perl WebAuth XS code

Wrap all PPCODE and CODE segments in braces so that Emacs c-mode
doesn't get quite as confused. Add some additional comments around
tricky parts of the code.

Change-Id: I8509f95c7f9747bfe475976ecab3e65071109b42
Reviewed-on: https://gerrit.stanford.edu/324
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Perl: Make encode a method on a WebAuth::Token

A more natural object-oriented API is to let a token encode itself
rather than using a WebAuth method to do so. Towards that end, store
a copy of the WebAuth context in the token when created via decoding
and require a WebAuth context argument in the constructor.

Change-Id: If1f8da04898fb7faca7d39decad1a17537d5faf8
Reviewed-on: https://gerrit.stanford.edu/323
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Remove TODO about random multifactor that was already finished

Change-Id: I7028e5803e4ebe4cb58094eec8c946ea585b97ea
Reviewed-on: https://gerrit.stanford.edu/322
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add WebAuth::Token::* support for all remaining token types

Change-Id: Iab0b25088330e8de08e9dfbcca0a8e9e3df1ea10
Reviewed-on: https://gerrit.stanford.edu/321
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

More token encode and decode issues for TODO

Change-Id: I5acc0cd7a26928875d18118fc817b4f11034aef2
Reviewed-on: https://gerrit.stanford.edu/320
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Allow krb5 id tokens to omit the subject on encoding

webauth_token_encode now correctly allows id tokens of type krb5 to
omit the subject attribute. The receiver is supposed to determine the
subject via the Kerberos authenticator.

Change-Id: I040bc11edffab0b739929f53a0583c2cc8a9f700
Reviewed-on: https://gerrit.stanford.edu/319
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add protocol documentation of 0 values to TODO

Change-Id: If010eb7ac1cc8d9e92aafa45398b46c66e5eaf18
Reviewed-on: https://gerrit.stanford.edu/318
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add new webauth-make-tokens script based on generate-tokens

Add new tools/webauth-make-tokens script to generate WebAuth tokens
given a configuration file and keyring. This is not installed by
default and is normally only used to generate test data, but it may be
useful in some other cases of manual token generation.

This doesn't replace generate-tokens yet, since not all tokens are
supported by the new library and there isn't yet support for generating
the various invalid tokens.

Change-Id: Ie0a2b505d465b2101ff10b341cf767625beda7fa
Reviewed-on: https://gerrit.stanford.edu/317
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Convert Perl token tests to be data-driven

Load the tokens from the tokens.conf configuration file and use
them for testing both encoding and decoding rather than having to
write Perl code matching the token contents.

Change-Id: I6da35fd2f08cbaf85d7750cc0add268eb565e1c7
Reviewed-on: https://gerrit.stanford.edu/316
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Perl: Do not store 0 numeric values in Perl hash

It's cleaner for testing and seems to be more consistent to not
decode zero numeric values (time_t and unsigned long) and instead
let them be undefined in the Perl hash. 0 is generally used to
mean not set. This needs to be formalized in the protocol.

Change-Id: I6ab8dc73ab218e6d5eccb02105222c807b8a6e2a
Reviewed-on: https://gerrit.stanford.edu/315
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

New test token configuration based on generate-tokens

As the first step of shifting the Perl test suite to be more
data-driven, create a new configuration file that lists all of our
test tokens. This is like the token data in generate-tokens, except
using the new WebAuth::Token::* class names and with attribute names
that match the struct members for the webauth_token_* structs and
therefore our accessor functions.

Divide the test tokens into three groups: ones that are good, ones
that are syntactically valid but will produce errors on decoding,
and ones that are syntactically invalid.

Change-Id: I77030cc52f45cbcf89e0bdaec1ca5dbe8272dc84
Reviewed-on: https://gerrit.stanford.edu/314
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add encoding and decoding of cred tokens

Change-Id: I05f0a3ef4c1fcbb465d1ee13f5fbd9da20f8c74a
Reviewed-on: https://gerrit.stanford.edu/313
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add TODO for fixing string comparison of WebAuth::Exception

Change-Id: If56bacad7c9bd9b34be84cc23e05493ec601f69f
Reviewed-on: https://gerrit.stanford.edu/312
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Move generic WebAuth::Token methods into a base class

We're going to have a lot of WebAuth::Token::* classes, so move the
generic code into an abstract base class that refuses to be
instantiated.

Change-Id: I514095beb2030a917754918403d11f9f3d8351c4
Reviewed-on: https://gerrit.stanford.edu/311
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add encoding for WebAuth::Token::App

Add a generic encoding framework parallel to the decoding framework
and support encoding a WebAuth::Token::App to a base64-encoded token.
Add a constructor to the WebAuth::Token::App class.

Change-Id: I5c8b55dddb64eb5ef2ce072f47bddde047fac270
Reviewed-on: https://gerrit.stanford.edu/310
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add WebAuth::Token::App and decoding app tokens

Add a new framework for token decoding that uses the new libwebauth
API and then maps the resulting token to a Perl hash. Create a
WebAuth::Token::App class to wrap app tokens and add decoding and a
test for app tokens.

This also adds a test framework that starts duplicating some of the
TAP library functions for C and shell in a Perl module framework.

Change-Id: I12df89cc9b5dbcdb69edbfbab9ca90931387f641
Reviewed-on: https://gerrit.stanford.edu/309
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Include new WebAuth dependency libraries in DEPEND_LIBS

The Perl module may need to be linked with all of the dependencies
of the WebAuth library if --enable-reduced-depends was not given,
but the new additions (APR, APR-Util, and remctl) weren't included.
Fix that.

Change-Id: I69192d93c1ee66d524d9a1cfc0106e16ff10120b
Reviewed-on: https://gerrit.stanford.edu/308
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Remove finished header guard fix from TODO

Change-Id: Ie1dabcbe397da628a2b66a34903afcb97d92717a
Reviewed-on: https://gerrit.stanford.edu/307
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Rename user metadata to user information service

For consistency, refer to it as the user information service
everywhere.

Change-Id: Ia10d16d1f2bab7bf052abacd2ba63b8f92ae9761
Reviewed-on: https://gerrit.stanford.edu/306
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Rewrite the Perl API to create a WebAuth object for the context

The WebAuth Perl module API now requires creating a WebAuth object
first and passing that object as the first argument to most other
functions.  This is the first step in making the API more
object-oriented.  All users will need code changes to work with the
new API.  WebAuth::Keyring and WebAuth::Krb5 have not yet been
converted, but will be in a subsequent release.  This means that the
WebKDC and WebLogin Perl modules in this release require the WebAuth
module from this release and vice versa, so be careful of partial
upgrades.

Change-Id: I30ca20da55ed250d18057d65f762071cb7d0b4ae
Reviewed-on: https://gerrit.stanford.edu/305
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Obtain better error messages in Perl API where possible

Modify webauth_croak to take a struct webauth_context as well and
call webauth_error_message immediately to obtain the last error
message, including the context if possible. Modify the
WebAuth::Exception class to pull the message from the rich exception
object instead of calling WebAuth::error_message at the time of
querying the exception.

Currently, we mostly pass NULL into webauth_error_message, but that
will change as the WebAuth Perl module becomes more object-oriented.

Change-Id: I893fffe22953acd79cc53102709e9c2303877679
Reviewed-on: https://gerrit.stanford.edu/304
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Log authorization denied at debug level for Apache 2.4

In Apache 2.4, we might have a bunch of separate directives or
be called in complex ways, so it doesn't make sense to log the
authorization denied state at a high priority level. Previously,
that made sense because mod_webauthldap handled the complete group
list at once, but that's no longer the case. Reduce the level to
debug.

Change-Id: I74fa215d50bd4a0c1a47f6fd90dcaf889bf8e34a
Reviewed-on: https://gerrit.stanford.edu/303
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Only attempt LDAP lookups if the user authenticated with WebAuth

The new fixups hook for Apache 2.4 unconditionally attempted to
look up the user, even if there was no user or they didn't log on
with WebAuth. Restore the previous behavior by checking first.

Change-Id: Ice392abae56f1c5bfe535c44a454929769da5bc5
Reviewed-on: https://gerrit.stanford.edu/302
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add some more missing TODO items

Change-Id: I4c2d6b8ee841e0291a9a23fb96270e83ad64abf3
Reviewed-on: https://gerrit.stanford.edu/301
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add missing TODO entry for user capture

Change-Id: Iccba739eaa71e578c86702a22404e9a27c4d748c
Reviewed-on: https://gerrit.stanford.edu/300
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Sync TODO with JIRA

Change-Id: I94e324004343afb0cf8335491329fd2b7d29859e
Reviewed-on: https://gerrit.stanford.edu/299
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Convert the low-level token functions to use APR

Change-Id: If493cf4fba4ba0395c8fdfa87f093dce26df44f4
Reviewed-on: https://gerrit.stanford.edu/298
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Use webauth_token_encode_raw for the mod_webauth app state

The sole remaining use of the low-level token functions outside of
the WebAuth library and Perl module was in handling the app state
token in mod_webauth. Replace that with webauth_token_encode_raw.

Change-Id: I829c9d97403fcc1dcfd6452b368da5abecb00338
Reviewed-on: https://gerrit.stanford.edu/297
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Refactor the mod_webauth configuration parsing

Rewrite the mod_webauth configuration parsing to move it into a
separate config.c source file and to use the same macros and structure
as the mod_webkdc configuration parsing.

Change-Id: I9b5a818d1175b8287a84013daa683229aa39fdcd
Reviewed-on: https://gerrit.stanford.edu/296
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Fix merging of mod_webkdc Apache directives in multiple merges

Fix merging of mod_webkdc Apache directives in some corner cases where
the directive has a default value or is explicitly set to off.

Previously, the _set flag was not set on the newly generated config
after a merge of a set value, which could cause the winning value to be
discarded in a later merge.

Change-Id: If4244b1340b28760f6fee45e9a9dd13d619328cd
Reviewed-on: https://gerrit.stanford.edu/295
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Rely on portable/apache.h for ap_http_scheme

Call ap_http_scheme instead of ap_http_run_scheme, and rely on
portable/apache.h to ensure that it's available.

Change-Id: I2261b30a250329891a01869d909d11eddb48fb91
Reviewed-on: https://gerrit.stanford.edu/294
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Finish port to Apache 2.4

Add Autoconf probes to restore previous behavior when built with
Apache 2.2 or earlier. Add a portable/apache.h header to encapsulate
the various portability fixes and the inclusion of a basic set of
Apache headers. Adjust all Apache module code to use that header.

Move modules/mod-config.h to config-mod.h at the top level.

Add a NEWS entry for the Apache 2.4 port and warn that the legacy
StanfordAuth support is not available in mod_webauthldap when built
with Apache 2.4.

Change-Id: I8dbc7d70d06759e51da363e7568e9b779d7b6c86
Reviewed-on: https://gerrit.stanford.edu/293
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Initial ugly port to Apache 2.4

The minimum changes required for the modules to compile and work with
Apache 2.4 and pass basic testing. This breaks compilation on Apache
2.2, which will be restored in a subsequent commit with additional
Autoconf probing.

This duplicates a bunch of code in mod_authldap and removes old code
that will no longer compile with #if 0. This too will be cleaned up
in a subsequent release.

Change-Id: Ied003433a40c705d3fc9b78c25859bd9b243fb32
Reviewed-on: https://gerrit.stanford.edu/292
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Change references from Kerberos V5 to just Kerberos

Kerberos v5 has been the default version of Kerberos for well over
ten years.

Change-Id: I31527d40e6705ab3697e323063edc5978962c077
Reviewed-on: https://gerrit.stanford.edu/291
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add tests/tap/macros.h to the libtap sources

Change-Id: I188ccb7c641d784b3729fac05cc086bb11d3f791
Reviewed-on: https://gerrit.stanford.edu/290
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Release 4.1.1

Change-Id: Ic26e702ab76cf56d39ef77eae9f4e0fdb892dcda
Reviewed-on: https://gerrit.stanford.edu/289
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Update to rra-c-util 4.3 and C TAP Harness 1.11

Update to rra-c-util 4.3:

* Update the set of flags enabled by make warnings.

Update to C TAP Harness 1.11:

* Only use feature-test macros when requested or built with gcc -ansi.
* New tests/tap/macros.h header with some common definitions.
* Drop is_double from the C TAP library to avoid requiring -lm.
* Avoid using local in the shell libtap.sh library.

Change-Id: Iaeb3f5abaa17fd65ad6ef7c0ba5d2f382eba7d94
Reviewed-on: https://gerrit.stanford.edu/288
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Fix login template timestamp handling

Fix the sample confirm template to use the correct attribute for login
history timestamps and to suppress the timestamp section if that
history entry had no associated timestamp.

Change-Id: I06d278351d0f9225f03cc677f80033826f8bb299
Reviewed-on: https://gerrit.stanford.edu/287
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Fix webauth_user_info parsing of timestamps in login history

Fix a bug in webauth_user_info that misparsed timestamp attributes
from the user information query results, causing timestamps to be
ignored and always set to 0 in user login history information and
causing the function to fail if any unknown attributes were returned.

Change-Id: Ib8d18c76d6d0ac3c1fd986f16c98fd8fe5595c22
Reviewed-on: https://gerrit.stanford.edu/286
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Remove an old, erroneous comment in WebLogin.pm

Change-Id: Ib0d1081df1d31388b1a898813778e16371e52ec3
Reviewed-on: https://gerrit.stanford.edu/285
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Fix an Initial -> Session mistake in docs/install-stanford

The example of WebAuthRequireSessionFactor should actually use that
directive. Thanks to Andrew Martin for pointing out the issue.

Change-Id: Ibb35d4bbc6bde99c5e312740e37f1f0deab267b8
Reviewed-on: https://gerrit.stanford.edu/284
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add JIRA ticket number for TODO item

Change-Id: Id11642b78ceddbfe9412e1944f224c98b1124cb3
Reviewed-on: https://gerrit.stanford.edu/283
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Update the mod_webkdc HTML manual with the 4.1.0 changes

Update the generated HTML version of the mod_webkdc manual to include
the new directives introduced in WebAuth 4.1.0.

Change-Id: I5a7883548421ac11cbbf35a497ff555565eb2fcc
Reviewed-on: https://gerrit.stanford.edu/276
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>

Add explicit HTML filters to WebLogin variable interpolation

Add explicit HTML filters to all interpolated variables in the
sample WebLogin templates. Previous versions of the sample templates
(since the conversion to Template Toolkit in 4.0) did not uniformly
apply the HTML filter, which could cause rendering problems or even
cross-site scripting vulnerabilities in some corner cases. For most
attributes missing this filter there was no chance of HTML special
characters, but now the filter is applied uniformly for consistency.
Sites with custom templates should check their templates for any
instance of a variable interpolation ([% variable %]) and ensure that
the HTML filter is applied ([% variable FILTER html %] instead).

Change-Id: Ibc0fb7454258b04b65fbfa631bf58d2fb850f3f7
Reviewed-on: https://gerrit.stanford.edu/275
Tested-by: Russ Allbery <rra@stanford.edu>
Reviewed-by: Russ Allbery <rra@stanford.edu>