1. 01 May, 2017 9 commits
  2. 30 Apr, 2017 1 commit
    • Luca Boccassi's avatar
      Problem: no way to deploy releases to OBS · f126da8b
      Luca Boccassi authored
      Solution: add new tokens to .travis.yml and change ci_deploy.sh
      script to use Github APIs to create a temporary branch at the tag,
      and the OBS APIs to trigger a source service run in the stable and
      draft release projects:
      network:messaging:zeromq:release-stable
      network:messaging:zeromq:release-draft
      
      The branch hack is unfortunately necessary as it is not possible to
      modify OBS sources with the token APIs, and it is also not possible
      to automatically fetch the latest tag in the service files.
      The temporary branch is immediately deleted.
      f126da8b
  3. 29 Apr, 2017 3 commits
  4. 28 Apr, 2017 4 commits
  5. 26 Apr, 2017 2 commits
    • Luca Boccassi's avatar
      Merge pull request #2550 from garlick/gssapi_test · 54b89858
      Luca Boccassi authored
      add simple GSSAPI test for make check
      54b89858
    • Jim Garlick's avatar
      gssapi: add a basic test for GSSAPI security · edd6b0ad
      Jim Garlick authored
      Problem: there is no test coverage for GSSAPI.
      
      Solution: add a test structured like the CURVE test.
      
      The test is not built if libzmq is not configured with
      --with-libgssapi_krb5. It will report SKIPPED status
      if the required environment is missing (see below).
      
      Environment:  KRB5_KTNAME and KRB5_CLIENT_KTNAME
      environment variables must point to a keytab file
      containing creds for a host-based test principal
      (see comment at top of source for details).
      Kerberos must be configured and a KDC containing the
      test principal must be running, otherwise the test
      will fail/hang.
      
      N.B. For now, the test must use the same principal for
      both client and server roles because it seems impossible
      to set them to different principals when they are
      threads in the same process.  Once one principal is
      cached in credential cache, attempts to acquire creds
      for a different "desired name" seem to be ignored and
      the cached principal is used instead.
      edd6b0ad
  6. 25 Apr, 2017 4 commits
  7. 24 Apr, 2017 5 commits
  8. 23 Apr, 2017 2 commits
  9. 22 Apr, 2017 1 commit
  10. 21 Apr, 2017 5 commits
    • Jim Garlick's avatar
      gssapi: add zmq_gssapi.7 to MAN7 in Makefile.am · 48f72844
      Jim Garlick authored
      Problem: zmq_gssapi.7 was not mentioned in doc/Makefile.am
      
      Solution: add man page to MAN7 in doc/Makefile.am
      48f72844
    • Jim Garlick's avatar
      gssapi: add NAMETYPE socket opts to zmq_gssapi.7 · 8bd3f03c
      Jim Garlick authored
      Problem: new GSSAPI socket options are not documented.
      
      Solution: add PRINCIPAL NAMES section to zmq_gssapi.7
      8bd3f03c
    • Jim Garlick's avatar
      gssapi: add NAMETYPE socket options · 0b185e82
      Jim Garlick authored
      Problem: principals are looked up unconditionally
      with the GSS_C_NT_HOSTBASED_SERVICE name type.
      
      Solution: Add two new socket options to set the name type
      for ZMQ_GSSAPI_PRINCIPAL and ZMQ_GSSAPI_SERVICE_PRINCIPAL:
      
      ZMQ_GSSAPI_PRINCIPAL_NAMETYPE
      ZMQ_GSSAPI_SERVICE_PRINCIPAL_NAMETYPE
      
      They take an integer argument which must be one of
      ZMQ_GSSAPI_NT_HOSTBASED (0) - default
      ZMQ_GSSAPI_NT_USER_NAME (1)
      ZMQ_GSSAPI_NT_KRB5_PRINCIPAL (2)
      
      These correspond to GSSAPI name types of:
      GSS_C_NT_HOSTBASED_SERVICE
      GSS_C_NT_USER_NAME
      GSS_KRB5_NT_PRINCIPAL_NAME
      
      Fixes #2542
      0b185e82
    • Constantin Rack's avatar
      Merge pull request #2544 from Asmod4n/patch-2 · 4783605b
      Constantin Rack authored
      RELICENSE: Hendrik Beskow grant 
      4783605b
    • Asmod4n's avatar
      Create Asmod4n.md · 798b258f
      Asmod4n authored
      798b258f
  11. 20 Apr, 2017 4 commits
    • Luca Boccassi's avatar
      Merge pull request #2541 from garlick/gssapi_fix · 42729256
      Luca Boccassi authored
      fix misc. bugs in GSSAPI support
      42729256
    • Jim Garlick's avatar
      gssapi: use gss_buffer_desc consistently · 2b9a352a
      Jim Garlick authored
      Problem: one call to gss_import_name() includes the terminating
      NULL in a gss_buffer_desc.length, and one doesn't.
      
      According to the examples at:
      http://docs.oracle.com/cd/E19253-01/816-4863/overview-22/index.html
      the NULL should be included in the length.
      
      Solution:  Fix one case to include the terminating NULL in the length.
      2b9a352a
    • Jim Garlick's avatar
      gssapi: fail if client sets wrong principal · 4e22dd0e
      Jim Garlick authored
      Problem: if client sets ZMQ_GSSAPI_PRINCIPAL to a name
      for which credentials cannot be obtained, authentication
      proceeds with default credentials.
      
      Solution: Before initializing the security context, check
      whether there was a failed attempt to acquire credentials
      for a specific principal and bail out if so.
      
      Fixes #2531
      4e22dd0e
    • Jim Garlick's avatar
      gssapi: use GSS_C_BOTH to acquire credentials · f2b579ce
      Jim Garlick authored
      Problem: if client sets the ZMQ_GSSAPI_PRINCIPAL to a valid
      principal, authentication fails.
      
      When an application sets ZMQ_GSSAPI_PRINCIPAL, whether as a
      client or a server, libzmq internally calls gss_acquire_cred()
      with cred_usage=GSS_C_ACCEPT.  This cred_usage setting is for
      acceptors (servers) only, thus it doesn't work for initiators
      (clients).
      
      Solution: Change the cred_usage parameter to GSS_C_BOTH to allow
      initiators to set ZMQ_GSSAPI_PRINCIPAL.
      f2b579ce