Quanah Gibson-Mount pushed to branch OPENLDAP_REL_ENG_2_4 at openldap / OpenLDAP
Commits:
2210a3bd by Simon Levermann at 2020-04-21T19:40:16+00:00
ITS#8575 Implement argon2 password hashing as a module
This change implements argon2, which won the Password Hashing
Competition (https://password-hashing.net/) as a contrib-module in order
to provide a modern password hashing alternative in openldap. The
currently available password hashing algorithms are relatively old, and
modern hardware, especially GPUs can compute quite a few (ranging from
tens of thousands to millions) of hashes per second. Argon2 was designed
to withstand such attacks.
This implementation uses the default work factors used in the argon2
command line client, but the resulting hashes are stored in a way that
would allow retroactive changes to these values, or even exposing them
as configuration in the module.
- - - - -
793f6ecd by OndÅ™ej KuznÃk at 2020-04-21T19:40:21+00:00
ITS#8575 Add a libsodium based implementation
- - - - -
b643f7fc by OndÅ™ej KuznÃk at 2020-04-21T19:40:24+00:00
ITS#8575 Accept parameters for hashing new passwords
- - - - -
997ff449 by Peter Marschall at 2020-04-21T19:40:30+00:00
ITS#9203 contrib/passwd/argon2: add manual page
Add manual page slapd-pw-argon2.5 and make sure it gets installed.
Signed-off-by: Peter Marschall <peter(a)adpm.de>
- - - - -
0ff54ddf by Ryan Tandy at 2020-04-21T19:40:33+00:00
ITS#9203 slapd-argon2 -> pw-argon2
Based on initial patch by Peter Marschall.
- - - - -
8ff81631 by Peter Marschall at 2020-04-21T19:40:38+00:00
ITS#9206 contrib/passwd/argon2: consolidate libsodium implementation
* use 'crypto_pwhash_str_alg(..., crypto_pwhash_ALG_ARGON2ID13)' to set
the algorithm to Argon2.
According to libsodium's documentation, the original 'crypto_pwhash_str()'
only guarantees a "memory-hard, CPU-intensive hash function", but not
necessarily Argon2. Although in released versions of libsodium Argon2 is
the only implemented backend, this may chane in the future.
* multiply the 'memory' parameter by 1024 to align it with the libargon2
implementation. The objective is to have consistent configuration in
OpenLDAP's pw-argon2 module no matter what backend implementation is used.
Signed-off-by: Peter Marschall <peter(a)adpm.de>
- - - - -
511ad098 by Ryan Tandy at 2020-04-21T19:40:42+00:00
ITS#9206 Initialize libsodium before calling its functions
- - - - -
07405636 by Ryan Tandy at 2020-04-21T19:40:45+00:00
ITS#9206 Convert libsodium default memlimit to KiB
- - - - -
59bed7e6 by Ryan Tandy at 2020-04-21T19:40:49+00:00
ITS#9206 Use argon2id default values explicitly
- - - - -
ba50189b by Ryan Tandy at 2020-04-21T19:40:55+00:00
ITS#9203 Remove default values from slapd-pw-argon2.5
The defaults vary by crypto library and possibly even version, so it's
not worth trying to keep them accurate.
- - - - -
4 changed files:
- + contrib/slapd-modules/passwd/argon2/Makefile
- + contrib/slapd-modules/passwd/argon2/README
- + contrib/slapd-modules/passwd/argon2/pw-argon2.c
- + contrib/slapd-modules/passwd/argon2/slapd-pw-argon2.5
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/0daf80129a7e3fa9ac1073…
--
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/0daf80129a7e3fa9ac1073…
You're receiving this email because of your account on git.openldap.org.
Quanah Gibson-Mount pushed to branch master at openldap / OpenLDAP
Commits:
a019e7fe by Quanah Gibson-Mount at 2020-04-20T21:38:01+00:00
ITS#9207 - Remove MozNSS code and documentation
- - - - -
8505f774 by Quanah Gibson-Mount at 2020-04-20T21:38:01+00:00
Update to drop NON_BLOCKING ifdefs that were only really for moznss
- - - - -
16 changed files:
- configure.in
- doc/guide/admin/appendix-recommended-versions.sdf
- doc/guide/admin/aspell.en.pws
- doc/guide/admin/install.sdf
- doc/guide/admin/intro.sdf
- doc/guide/admin/tls.sdf
- doc/guide/preamble.sdf
- doc/man/man3/ldap_get_option.3
- doc/man/man5/ldap.conf.5
- doc/man/man5/slapd-config.5
- doc/man/man5/slapd.conf.5
- libraries/libldap/Makefile.in
- libraries/libldap/tls2.c
- − libraries/libldap/tls_m.c
- libraries/libldap/tls_o.c
- libraries/libldap_r/Makefile.in
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/3dd0d77d1ac0cd2cd41a44…
--
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/3dd0d77d1ac0cd2cd41a44…
You're receiving this email because of your account on git.openldap.org.
Quanah Gibson-Mount pushed to branch master at openldap / OpenLDAP
Commits:
8e3e85e3 by Isaac Boukris at 2020-04-19T11:10:50+03:00
auth: add SASL/GSSAPI tests
- - - - -
3dd0d77d by Isaac Boukris at 2020-04-19T11:10:50+03:00
gitlab: add krb5 packages for gssapi tests and a second build
- - - - -
7 changed files:
- .gitlab-ci.yml
- + tests/data/krb5.conf
- + tests/data/slapd-sasl-gssapi.conf
- tests/scripts/conf.sh
- tests/scripts/defines.sh
- + tests/scripts/setup_kdc.sh
- + tests/scripts/test077-sasl-gssapi
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/94ef2c9b43db43e2370905…
--
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/94ef2c9b43db43e2370905…
You're receiving this email because of your account on git.openldap.org.
Quanah Gibson-Mount pushed to branch its9087 at openldap / OpenLDAP
Commits:
db404baf by Ryan Tandy at 2020-04-16T19:35:53-07:00
ITS#9226 Fix link order for rewrite program on MinGW
- - - - -
d568e36b by Chris Zagar at 2020-04-17T17:38:42+00:00
ITS#9087 - Change hard-coded windres to $(RC) to support mingw cross-compiling
- - - - -
2 changed files:
- libraries/liblutil/Makefile.in
- libraries/librewrite/Makefile.in
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/657f0988cc93021beb07a9…
--
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/657f0988cc93021beb07a9…
You're receiving this email because of your account on git.openldap.org.
Quanah Gibson-Mount pushed to branch OPENLDAP_REL_ENG_2_5 at openldap / OpenLDAP
Commits:
c6493c45 by Quanah Gibson-Mount at 2020-04-10T18:19:33+00:00
ITS#6567 - Remove non-cyrus-sasl GSSAPI bits
- - - - -
735e1ab1 by Howard Chu at 2020-04-12T23:51:09+01:00
ITS#8650 loop on incomplete TLS handshake
Always retry ldap_int_tls_connect() if it didn't complete,
regardless of blocking or non-blocking socket. Code from
ITS#7428 was wrong to only retry for async.
- - - - -
e50741e4 by Quanah Gibson-Mount at 2020-04-13T17:19:35+00:00
ITS#6567 - More cleanup
- - - - -
e1876446 by Ryan Tandy at 2020-04-13T18:57:50+00:00
ITS#9212 Restore snprintf to caller-provided buffer
76df74dbeab47195e42946a474c3a5f8557c168d removed some snprintfs to
buffers that are actually returned to the client. Restore these.
- - - - -
bbe20cbf by Ryan Tandy at 2020-04-13T18:57:50+00:00
ITS#8731 cleanup unused logbuf
- - - - -
f6d9fdc4 by OndÅ™ej KuznÃk at 2020-04-14T09:58:03+01:00
ITS#9043 Improve replication loggging
- - - - -
5c20342b by Peter Marschall at 2020-04-14T09:26:19-07:00
ITS#9203 contrib/passwd/argon2: add manual page
Add manual page slapd-pw-argon2.5 and make sure it gets installed.
Signed-off-by: Peter Marschall <peter(a)adpm.de>
- - - - -
2be4576a by Ryan Tandy at 2020-04-14T09:26:19-07:00
ITS#9203 slapd-argon2 -> pw-argon2
Based on initial patch by Peter Marschall.
- - - - -
40ce9a46 by Peter Marschall at 2020-04-14T09:26:19-07:00
ITS#9206 contrib/passwd/argon2: consolidate libsodium implementation
* use 'crypto_pwhash_str_alg(..., crypto_pwhash_ALG_ARGON2ID13)' to set
the algorithm to Argon2.
According to libsodium's documentation, the original 'crypto_pwhash_str()'
only guarantees a "memory-hard, CPU-intensive hash function", but not
necessarily Argon2. Although in released versions of libsodium Argon2 is
the only implemented backend, this may chane in the future.
* multiply the 'memory' parameter by 1024 to align it with the libargon2
implementation. The objective is to have consistent configuration in
OpenLDAP's pw-argon2 module no matter what backend implementation is used.
Signed-off-by: Peter Marschall <peter(a)adpm.de>
- - - - -
64856677 by Ryan Tandy at 2020-04-14T09:26:19-07:00
ITS#9206 Initialize libsodium before calling its functions
- - - - -
307b06ff by Ryan Tandy at 2020-04-14T09:26:19-07:00
ITS#9206 Convert libsodium default memlimit to KiB
- - - - -
0ec42b08 by Ryan Tandy at 2020-04-14T09:26:19-07:00
ITS#9206 Use argon2id default values explicitly
- - - - -
feb6f21d by Ryan Tandy at 2020-04-14T09:26:19-07:00
ITS#9203 Remove default values from slapd-pw-argon2.5
The defaults vary by crypto library and possibly even version, so it's
not worth trying to keep them accurate.
- - - - -
38f9dd2f by Ryan Tandy at 2020-04-14T10:04:33-07:00
ITS#7878 Replace uint32_t with unsigned in back-mdb
init.c: align mi_dbenv_flags and flags with mdb_dbi_open, which declares
flags as unsigned int.
search.c: align mi_rtxn_size with ARG_UINT; adjust ww_ctx.nentries to
silence a warning about signed/unsigned comparison.
config.c: parse checkpoint config more carefully. Reject negative or
unreasonably large values for kbytes and minutes. Ensure both values are
parsed successfully before making any changes.
Fixes a compilation failure under MinGW, where stdint.h types are not
implicitly pulled in by other headers.
- - - - -
5368e22b by Ryan Tandy at 2020-04-14T12:10:06-07:00
ITS#9213 Make --enable-modules imply --enable-dynamic
The default for --enable-dynamic is now "auto", meaning "yes" if
--enable-modules and "no" otherwise.
- - - - -
f747d619 by Quanah Gibson-Mount at 2020-04-14T22:20:38+00:00
ITS#9213 -- Regenerate configure
- - - - -
a5e17673 by grapvar at 2020-04-15T00:14:37+01:00
ITS#9214 slapd-mdb: plug cursor leak in dnSuperiorMatch filter
- - - - -
a97eed06 by Quanah Gibson-Mount at 2020-04-15T19:32:28+00:00
ITS#6937 - Remove unused proctitle bits
- - - - -
8a677f65 by Quanah Gibson-Mount at 2020-04-16T15:14:59+00:00
ITS#6937 -- regenerate configure/portable.hin
- - - - -
65d09368 by OndÅ™ej KuznÃk at 2020-04-16T16:41:35+00:00
ITS#8245 Silence warning
- - - - -
8f01fdec by OndÅ™ej KuznÃk at 2020-04-16T16:41:35+00:00
ITS#8731 Remove unused arguments
- - - - -
550476b5 by OndÅ™ej KuznÃk at 2020-04-16T16:41:35+00:00
ITS#9112 Silence warnings
- - - - -
7ce47405 by Ryan Tandy at 2020-04-16T09:51:28-07:00
ITS#6035 Fix test076 to specify SASL mech
- - - - -
d5e133f4 by Ryan Tandy at 2020-04-16T19:15:31+00:00
ITS#9181 fix ldap_pvt_thread_mutex_t used before its definition
- - - - -
3ca7f20b by Quanah Gibson-Mount at 2020-04-16T23:35:43+00:00
Merge remote-tracking branch 'origin/master' into OPENLDAP_REL_ENG_2_5
- - - - -
30 changed files:
- .gitignore
- clients/tools/common.c
- clients/tools/ldapcompare.c
- clients/tools/ldapdelete.c
- clients/tools/ldapmodify.c
- clients/tools/ldapmodrdn.c
- clients/tools/ldappasswd.c
- clients/tools/ldapsearch.c
- clients/tools/ldapvc.c
- clients/tools/ldapwhoami.c
- configure
- configure.in
- contrib/slapd-modules/passwd/argon2/Makefile
- contrib/slapd-modules/passwd/argon2/README
- contrib/slapd-modules/passwd/argon2/pw-argon2.c
- + contrib/slapd-modules/passwd/argon2/slapd-pw-argon2.5
- − include/ac/setproctitle.h
- include/ldap.h
- include/ldap_int_thread.h
- include/portable.hin
- libraries/libldap/Makefile.in
- libraries/libldap/bind.c
- − libraries/libldap/gssapi.c
- libraries/libldap/init.c
- libraries/libldap/ldap-int.h
- libraries/libldap/options.c
- libraries/libldap/request.c
- libraries/libldap/test.c
- libraries/libldap/tls2.c
- libraries/libldap/util-int.c
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/7e5f52aec42d21d21f01fb…
--
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/7e5f52aec42d21d21f01fb…
You're receiving this email because of your account on git.openldap.org.
Quanah Gibson-Mount pushed to branch OPENLDAP_REL_ENG_2_4 at openldap / OpenLDAP
Commits:
6fe9b0c6 by Ryan Tandy at 2020-04-16T16:48:50+00:00
ITS#8383 Look for socklen_t in <ws2tcpip.h> too
MinGW targets do not have the <sys/socket.h> header. The configure check
would conclude that there is no socklen_t type, resulting in portable.h
containing its own definition of socklen_t, which would later conflict
with the actual definition in <ws2tcpip.h>.
Add <ws2tcpip.h> to the configure check for socklen_t, so that the
defined type is correctly detected.
- - - - -
f5143f99 by Ryan Tandy at 2020-04-16T16:52:18+00:00
ITS#7878 Replace uint32_t with unsigned in back-mdb
init.c: align mi_dbenv_flags and flags with mdb_dbi_open, which declares
flags as unsigned int.
search.c: align mi_rtxn_size with ARG_UINT; adjust ww_ctx.nentries to
silence a warning about signed/unsigned comparison.
config.c: parse checkpoint config more carefully. Reject negative or
unreasonably large values for kbytes and minutes. Ensure both values are
parsed successfully before making any changes.
Fixes a compilation failure under MinGW, where stdint.h types are not
implicitly pulled in by other headers.
- - - - -
5 changed files:
- configure.in
- servers/slapd/back-mdb/back-mdb.h
- servers/slapd/back-mdb/config.c
- servers/slapd/back-mdb/init.c
- servers/slapd/back-mdb/search.c
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/3347905d42eb1132cd8425…
--
View it on GitLab: https://git.openldap.org/openldap/openldap/-/compare/3347905d42eb1132cd8425…
You're receiving this email because of your account on git.openldap.org.