- C 86%
- Python 6.5%
- RPC 3.5%
- M4 2.4%
- Makefile 1.4%
- Other 0.2%
4d8d5de956
The original do-while pattern calls krb5_free_cred_contents() on the krb5_creds buffer even when krb5_cc_next_cred() reports KRB5_CC_END, i.e. after the iterator already returned without writing the buffer: the terminal iteration frees either freed or stale contents. Reshape as a while loop whose condition performs the iterator call so the body only runs on success, keep error handling after the loop, and terminate the cursor on the mid-iteration error path (the earlier goto-done skipped krb5_cc_end_seq_get, leaking the cursor). Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com> |
||
|---|---|---|
| .github/workflows | ||
| contrib | ||
| docs | ||
| examples | ||
| external | ||
| man | ||
| po | ||
| rpcgen | ||
| src | ||
| systemd | ||
| tests | ||
| x-files | ||
| .gitignore | ||
| BUILD.txt | ||
| build_macros.m4 | ||
| conf_macros.m4 | ||
| configure.ac | ||
| COPYING | ||
| Makefile.am | ||
| NOTES | ||
| README.md | ||
| STYLE.txt | ||
| version.m4 | ||
This is the gss-proxy project.
Documentation lives in the docs folder of this repository.
The goal is to have a GSS-API proxy, with standardizable protocol and a (somewhat portable) reference client and server implementation. There are several motivations for this some of which are:
-
Kernel-mode GSS-API applications (CIFS, NFS, AFS, ...) need to be able to leave all complexity of GSS_Init/Accept_sec_context() out of the kernel by upcalling to a daemon that does all the dirty work.
-
Isolation and privilege separation for user-mode applications. For example: letting HTTP servers use but not see the keytabe entries for HTTP/* principals for accepting security contexts.
-
Possibly an ssh-agent-like SSH agent for GSS credentials -- a gss-agent.
gss-proxy uses libverto for dealing with event loops. Note that you need to have at least one libverto event library installed (e.g. libverto-tevent).
We have a mailing list and an IRC channel (#gssapi on libera.chat).