summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* slapi-nis: fix processing of ID viewslazy_clientAlexander Bokovoy2015-11-132-9/+25
| | | | | | | | | | - ID View processing should only happen if ID view is defined - When finding attribute with slapi_entry_attr_find() use correct return code (slapi_entry_attr_exists() returns 1, _find() returns 0) - cn=<view>,cn=views,cn=compat,$SUFFIX lookup is fixed Fixes: bug #1277576 https://bugzilla.redhat.com/show_bug.cgi?id=1277576
* slapi-nis: delay sending responses from compat tree after map searchAlexander Bokovoy2015-11-134-11/+205
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When slapi-nis plugin responds on a search query, it holds read lock for the internal structure called 'map cache'. The map cache lock can also be taken for write when modification would be required like responding to DELETE, ADD, or MODIFY operations. As result of the lock semantics, write lock owner is blocked until all read lock owners release their locks. This is generally not a problem but when readers sent out LDAP query results, they call into SLAPI function that might take long time to send out the data due to external reasons (network latencies, clients being blocked, etc) and all this time map cache is locked for write operations. When Kerberos KDC issues a TGT, it needs to modify few Kerberos-related attributes in the principal's LDAP entry. These updates are generating MOD operations visible by slapi-nis plugin which triggers re-scan of map cache to potentially replace the affected entries. To perform potential replacement, slapi-nis has to take a write lock and be blocked by outstanding readers. Therefore, it is possible to encounter a situation where an LDAP client uses SASL GSSAPI authentication and existing Kerberos ticket did expire in a course of outstanding search request. According to LDAPv3 protocol specification, an LDAP client must perform re-negotiation before reading any outstanding PDUs. It would ask Kerberos KDC for a new (or renewed) TGT, that would cause MOD updates for the primary tree which is tracked for changes by slapi-nis. These changes would be blocked by a slapi-nis reader as the client cannot finish reading outstanding PDUs yet. To solve this problem, we avoid sending LDAP entries while keeping map cache lock. Instead, we generate a linked list of copies of entries which will be sent out. To allow sharing of entries between multiple parallel queries, we hash the entry and reference the cached entry in the linked list with increased reference count. Once entry is actually sent, its reference count decreased and on reaching zero it is removed from the hash. o solve this problem, we avoid sending LDAP entries while keeping map cache lock. Instead, we generate a linked list of copies of entries which will be sent out. To allow sharing of entries between multiple parallel queries, we hash the entry and reference the cached entry in the linked list with increased reference count. Once entry is actually sent, its reference count decreased and on reaching zero it is removed from the hash. The entry in the hash table might become outdated. This is detected by comparing both modifyTimestamp and entryUSN values of the entry to be sent and entry in the hash table. If new version of the entry is different, hash table's entry reference is replaced with a new copy. The old entry is not removed because it is still referenced by some outstanding query processing. Thus, the hash table always references the most recent version of an entry but there might be multiple copies in possesion of the linked lists from the separate parallel queries. An entry sharing via hash table can be disabled by setting slapi-entry-cache: 0 in the definition, cn=Schema Compatibility,cn=plugins,cn=config Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1273587
* slapi-nis: don't search in SSSD when memberUid has no '@' separatorAlexander Bokovoy2015-07-281-2/+5
| | | | | | | | | | | | | In the case there are no groups in cn=groups map that have certain memberUid as a member, we look at possibility that this user might be coming from a trusted AD forest. However, all users from trusted AD forests do have '@' separator in the name between the user name and the domain. In case there is no '@' separator, consider such search as not valid for lookups in SSSD. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1243823
* Make sure default buffer for nsswitch operations is big enoughAlexander Bokovoy2015-03-261-4/+1
| | | | | | By default initial buffer sizes for getgrent/getgrnam/... functions are way small for large groups in Active Directory so make sure we have something reasonable for groups with hundreds or thousands members.
* nss: make sure to remember the length of reallocated bufferAlexander Bokovoy2015-03-261-0/+4
|
* schema-compat: use libnss_sss.so.2 explicitly to resolve trusted domain ↵Alexander Bokovoy2015-03-264-35/+220
| | | | | | | | | | | | users via NSS When Schema Compatibility plugin is configured to enumerate users and groups from Active Directory domains trusted by FreeIPA, use nss_sss module directly instead of following nsswitch.conf configuration. The issue with nsswitch.conf configuration is in the fact that for each request all modules in NSS chain are processed while only one of them is responsible for users from trusted Active Directory domains, namely, nss_sss.
* Use slapi_entry_find_attr instead of slapi_entry_attr_existsAlexander Bokovoy2015-03-262-2/+8
| | | | | | To keep slapi-nis code portable to older versions of 389-ds-base, avoid using slapi_entry_attr_exists() as it was only introduced in 389-ds-base 1.3.3.0.
* schema-compat: support ID overrides in bind callbackAlexander Bokovoy2014-10-303-36/+111
| | | | | | | | If RDN of the bind DN is overridden within the ID view, rewrite the target to use original value of the uid attribute. If original uid attribute is not available, fail the search and thus the whole bind request by claiming that bind DN does not exist.
* ID views: ignore searches for views outside the subtrees of schema-compat setsAlexander Bokovoy2014-10-302-11/+81
| | | | | | | | | | | | | | | | | | | | schema-compat plugin may provide multiple disjoint subtrees which can be used to request overridden entries by prefixing the subtree suffix with a cn=<name of view>,cn=views,<subtree suffix> As subtrees may be disjoint, we cannot rely on the common suffix. Thus, any attempt to replace target DN and update filter terms must only be done once we are sure the search will be done in the subtree. This optimization prevents mistakenly changing the search filter when FreeIPA and SSSD search for the ID overrides themselves, as the same structure of the target DN is used for cn=views,cn=accounts,$SUFFIX subtree in FreeIPA. This subtree is never handled by slapi-nis and should be ignored. https://bugzilla.redhat.com/show_bug.cgi?id=1157989
* slapi-nis: normalize memberUid search filter when searching AD usersAlexander Bokovoy2014-10-101-3/+32
| | | | | | | | | | | | | | | | memberUid attribute uses IA5 String comparison which is case-sensitive. At the same time, uid attribute uses case-insensitive comparison. When memberUid is constructed for groups from AD, SSSD normalizes names to a lower case. slapi-nis records these entries as they produced by SSSD. However, the search filter is not modified, thus case-sensitive comparison of memberUid attribute may fail match of the original term. Workaround the issue by low-casing memberUid term in the search filter if it includes '@' sign, meaning we are searching on fully-qualified user name provided by SSSD. https://bugzilla.redhat.com/show_bug.cgi?id=1130131
* Add support for FreeIPA ID viewsAlexander Bokovoy2014-10-105-31/+585
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FreeIPA ID views allow to override POSIX attributes for certain users and groups. A support is added to allow using specific ID view when serving compatibility tree. Each user or group entry which has an override in the view is amended with the overridden values from the view before served out to the LDAP client. A view to use is specified as a part of base DN: cn=<view>,cn=views,cn=compat,$SUFFIX where cn=compat,$SUFFIX is the original compatibility tree base DN. Each entry, when served through the view, gets new DN rewritten to specify the view. Additionally, if override in the view changes uid (for users) or cn (for groups) attribute, the entry's RDN is changed accordingly. For groups memberUid attribute is modified as well in case there is an override in the view that changes uid value of that member. FreeIPA ID views support overrides for users of trusted Active Directory domains. In case of a trusted AD domain's user or group is returned via compatibility tree, view overrides are applied in two stages: 1. SSSD applies default view for AD users 2. slapi-nis applies explicitly specified (host-specific) view on top of the entry returned by SSSD Thus, slapi-nis does not need to apply default view for AD users and if there are no host-specific views in use, there is no need to specify a view in the base DN, making overhead of a default view for AD users lower.
* Correct the NIS defaults for "hosts" mapsNalin Dahyabhai2014-04-221-4/+4
| | | | | The values for NIS hosts.byname and hosts.byaddr maps should start with addresses, not names. Reported by Rik Megens.
* Better handle out-of-memory reading configurationNalin Dahyabhai2014-03-171-8/+6
| | | | | Avoid calling strdup() in a situation where we don't need to, so that we can better handle cases where it fails (static analysis).
* Accept schema-compat-lookup-nsswitch: passwdNalin Dahyabhai2014-03-171-1/+8
| | | | | | Treat "schema-compat-lookup-nsswitch: passwd" in the configuration the same as "schema-compat-lookup-nsswitch: user", to not fail for people who forget and try to use the nsswitch database name.
* Better handle out-of-memory reading configurationNalin Dahyabhai2014-03-171-4/+20
| | | | | | | If we hit out-of-memory (strdup() failures) while reading the configuration, don't crash (static analysis). In some cases, this means we proceed with garbage data until the copy_config() function sanity-checks its input and output.
* Better handle out-of-memory reading configurationNalin Dahyabhai2014-03-171-2/+15
| | | | | If we hit out-of-memory (strdup() failures) while reading the configuration, don't crash (static analysis).
* Ignore unnamed entries when constructing NIS mapsNalin Dahyabhai2014-03-141-2/+3
|
* Fix a couple of memory leaks (static analysis)Nalin Dahyabhai2014-03-141-1/+3
|
* Check for OOM in format_expand_simple()Nalin Dahyabhai2014-03-131-1/+4
|
* Add free() of a NULL pointer to make tools happyNalin Dahyabhai2014-02-171-0/+4
|
* Cast away type-mismatches calling xdr_free() (static analysis)Nalin Dahyabhai2014-02-171-9/+9
|
* Don't leak ftmp on out-of-memory (static analysis)Nalin Dahyabhai2014-02-171-0/+1
|
* Removing domains and maps correctlyNalin Dahyabhai2013-12-161-6/+6
| | | | | On domain or map removal, fill in gaps in the list of domains or maps correctly.
* Remove an unused local variableNalin Dahyabhai2013-12-121-1/+1
|
* Stop checking if a non-NULL value has a NULL valueNalin Dahyabhai2013-12-121-2/+2
|
* Silence a compiler warningNalin Dahyabhai2013-12-121-1/+2
|
* Accept slightly larger fragments (8K vs 8K - 4)Nalin Dahyabhai2013-12-091-4/+4
|
* Don't leak arguments to yp_all() (more of #967468)Nalin Dahyabhai2013-12-091-0/+1
|
* Remove a possible memmove() of 0 bytesNalin Dahyabhai2013-11-191-4/+6
| | | | | Don't bother memmove()ing a 0-byte chunk of data. Found by static analysis.
* Coverity#11937: use proper structure to pass to map_data_set_entry()Alexander Bokovoy2013-11-151-6/+8
| | | | | map_data_set_entry() passes pointers to the lengths of the key and the value to map_data_save_list() which interpretes them as arrays of integers.
* Try reconnecting if rpcbind EPIPEs usNalin Dahyabhai2013-10-013-60/+94
| | | | | | | If the NIS server encounters an EPIPE while attempting to communicate with the portmapper, try to reconnect before giving up on registering. Depending on which RPC implementation is used, rpcbind may drop idle clients after 30 seconds, and our startup can take longer than that.
* Use MSG_NOSIGNAL when sending a request to portmapNalin Dahyabhai2013-10-011-1/+1
|
* Up the log severity on portmap errorsNalin Dahyabhai2013-10-011-9/+9
| | | | | | Log errors encountered while talking to portmap/rpcbind at level SLAPI_LOG_FATAL rather than at the previous SLAPI_LOG_PLUGIN, so that they show up even when we're not actively debugging.
* Add ignore-subtree and restrict-subtree settingsNalin Dahyabhai2013-09-197-74/+333
| | | | | | | | | | | | | | Add {nis,schema-compat}-ignore-subtree (subtrees under which we ignore contents and updates )and {nis,schema-compat}-restrict-subtree (subtrees out of which we ignore contents and updates, if set) settings, and default the former to "cn=tasks,cn=config". This should avoid cases where we're looking through the ldbm backend for entries which have a dangling reference to a newly-added task (which, because it's in the DSE, means we acquire an ldbm lock after acquiring our internal lock) while also updating a compat entry after its source entry is modified (for example, by the memberOf plugin, which results in us attempting to acquire our lock while the ldbm lock is already held).
* Add a missing word in a commentNalin Dahyabhai2013-09-121-1/+1
|
* Add nis-relevant-subtree and nis-ignore-subtreeNalin Dahyabhai2013-09-121-4/+12
|
* Add schema-compat-relevant-subtreeNalin Dahyabhai2013-09-124-3/+42
| | | | | | | | | | Add a schema-compat-relevant-subtree configuration option, listing the only parts of the DIT that we should ever look at, either as source entries or as other entries which contain data which might be pulled in as part of computing the contents of compat entries. This is more or less the whitelist to schema-compat-ignore-subtree's blacklist.
* Add schema-compat-ignore-subtreeNalin Dahyabhai2013-09-125-1/+115
| | | | | | | Add a schema-compat-ignore-subtree configuration option, listing parts of the DIT that we should never look at, neither as source entries nor as random other entries which contain data which might be pulled in as part of computing the contents of compat entries.
* Remove a pair of unused variablesNalin Dahyabhai2013-08-281-2/+0
|
* Warn if we fail to set SO_LINGER for TCP clientsNalin Dahyabhai2013-08-271-1/+7
|
* Warn if non-blocking-ifying a client socket failsNalin Dahyabhai2013-08-271-1/+7
|
* Error out if the listener can't be non-blockingNalin Dahyabhai2013-08-271-2/+9
|
* Omit an unnecessary switch caseNalin Dahyabhai2013-08-271-2/+0
|
* Don't make an unnecessary checkNalin Dahyabhai2013-08-271-1/+1
|
* Skip values that are going to come up emptyNalin Dahyabhai2013-08-271-0/+3
|
* Sanity check the request size correctlyNalin Dahyabhai2013-08-271-3/+4
| | | | | Use the amount of data that we could have read as the upper bound on reasonable-looking request lengths.
* Make sure that length is always initializedNalin Dahyabhai2013-08-271-0/+1
|
* Fix a missing xdr_free()Nalin Dahyabhai2013-08-271-1/+1
|
* Directly return lists when making single queriesNalin Dahyabhai2013-08-271-35/+42
|
* Don't leak "buf" if its contents are unusedNalin Dahyabhai2013-08-271-0/+2
|
generated by cgit (git 2.34.1) at 2025-08-28 02:06:52 +0000