| Age | Commit message (Collapse) | Author |
|---|
|
|
|
Retire logwtmp() in favor of POSIX pututxline()
|
|
|
|
|
|
Fix 'unused' warnings when building with clang/llvm
|
|
|
|
Add SElinux tips
|
|
RAND_pseudo_bytes() has been deprecated in OpenSSL 1.1.0
|
|
to use RAND_bytes() instead.
Modified by Philip Prindeville <philipp@redfish-solutions.com>
|
|
Fix compile-time warnings
|
|
|
|
|
|
|
|
A few improvements
|
|
|
|
environment and allow optional attrs (i.e. those specified with a * instead of =) to be added to the environment
|
|
Set Travis to build against Trusty Tahr
|
|
Set Travis to build against Trusty Tahr
|
|
|
|
Fix URL of 'All Contributors' in AUTHORS
|
|
- Fix: Change url of 'All Contributors' to the original repository and not a forked one
|
|
Do not set password for ASCII login
|
|
For ASCII login, data field is not used ([1] Section 9.0.2 Inbound ASCII Login).
So do not add the user password for the login authentication with type ASCII.
[1] https://tools.ietf.org/html/draft-grant-tacacs-02
|
|
Reorg magic
|
|
Add runtime debugging
|
|
Fix damage from PR #71
|
|
Add --enable-runtime-debugging option to ./configure.
Add example logmsg() to tacc.c so it can be built with debugging.
Fix logmsg() prototype (it's supposed to match the prototype of
syslog() which returns void).
Export build-time value of --enable-runtime-debugging into libtac.pc.
|
|
|
|
|
|
The pseudo-random number function magic() needs to be primed via
magic_init() before being invoked. The standard (but klunky) way
of handling this is with a static bool inside the function which
indicates whether initialization has happened, and if not, handles
initialization and then sets the flag.
Sometimes it's more desireable to have initialization happen in
a known order before program execution starts (this helps with
reproducibility). We can do this by indicating to the compiler/
linker that particular functions need to be executed after __start()
but before main().
|
|
|
|
Add option to specify modem port, etc.
|
|
Fix memory leakage related to tac_svr
|
|
Fix ASCII logins where 2 transactions are required
|
|
authenticate() doesn't handle the case of an ASCII login which
results in a continue request being required to complete the
transaction.
|
|
Fix regression introduced when doing incremental encryption
|
|
Wrong subscript (subscript of digest should always be modulo
digest size [16 bytes]).
|
|
Extracting the tty name or port name from the controlling terminal
of a Unix process is a questionable assumption. Further, for
automated testing, you might want the reproducibility of being
able to explicitly set the terminal name. To get the same
functionality as before, one can pass in "tacc ... -y `tty`" as
an extra argument.
|
|
Replacing strncpy() with strncpy()
|
|
Replacing strncpy() with strncpy()
|
|
|
|
|
|
|
|
Various cryptography improvements
|
|
Make TACDEBUG and TACSYSLOG into varargs macros
|
|
Also, correct the -DTACDEBUG_AT_RUNTIME scenario so that TACDEBUG()
binds correct when used in an if-body with an else following it, e.g.:
if (test)
TACDEBUG(LOG_DEBUG, "test is true");
else
return;
would previously have ended up as expanding to:
if (test)
if (tac_debug_enable) logmsg(LOG_DEBUG, "test is true");
else
return;
with the indent redone to reflect the nesting correctly. This now
expands (correctly) to:
if (test)
do { if (tac_debug_enable) logmsg(LOG_DEBUG, "test is true"); } while (0);
else
return;
|
|
It's easier to read, debug, and maintain that way.
Also, avoid unnecessary marshalling while we're at it, since
MD5Update() can be called iteratively, which obviates having to
gather the data to be digested into a contiguous buffer.
|
|
This saves us having to marshall data and allocate a buffer for
the entire pad (bitstream cipher). We only need it in blocks of
16 bytes (the size of the MD5 digest), so let's compute it piecemeal
as we need it.
This has the added benefit of avoiding any calls to malloc() which
might be result in system calls (i.e. sbrk() to extend the heap).
|
|
Why make copies of the payload length to pass as parameters when
it's already present in the header?
|
|
MD5Update supports incremental digesting, so we can invoke it
multiple times to collect data rather than having to marshall it
into a contiguous buffer.
|
