sssd.git/src/sss_client, branch subdomfo

sssd: incorrect checks on length values during packet decoding

2015-08-31T16:34:26+00:00

https://fedorahosted.org/sssd/ticket/1697

It is safer to isolate the checked (unknown/untrusted)
value on the left hand side in the conditions
to avoid overflows/underflows.

Reviewed-by: Petr Cech

UTIL: Function 2string for enum sss_cli_command

2015-08-31T16:30:19+00:00

Improvement of debug messages.
Instead of:"(0x0400): Running command [17]..."
We could see:"(0x0400): Running command [17][SSS_NSS_GETPWNAM]..."
(It's not used in sss_client. There are only hex numbers of commands.)

Resolves:
https://fedorahosted.org/sssd/ticket/2708

Reviewed-by: Lukáš Slebodník

sss_client: Update integrity check of records in mmap cache

2015-08-05T09:28:27+00:00

The function sss_nss_mc_get_record return copy of record from memory
cache in last argument. Because we should not access data directly
to avoid problems with consistency of record.
The function sss_nss_mc_get_record also check whether length of record
is within data area (with macro MC_CHECK_RECORD_LENGTH)

However we also tried to do the same check in functions sss_nss_mc_get{gr, pw}*
Pointer to end of strings in record was compared to pointer to the end
of data table. But these two pointers are not within the same allocated area
and does not make sense to compare them. Sometimes record can be allocated
before mmaped area and sometime after. Sometimes it will return cached data
and other time will fall back to responder.

Resolves:
https://fedorahosted.org/sssd/ticket/2743

Reviewed-by: Michal Židek

mmap_cache: "Override" functions for initgr mmap cache

2015-08-05T09:28:19+00:00

Functions sss_mc_get_strs_offset and sss_mc_get_strs_len provides
data about strings for individual memory caches (passwd, ...)
Their are used in generic responder mmap cache code to find a record
in mmap cache (sss_mc_find_record). Data provided from functions sss_mc_get_*
are used for checking the validity of record. So in case of corrupted record
the whole mmap cache can be invalidated.

Functions sss_mc_get_strs_offset and sss_mc_get_strs_len did not provide
data for initgroups mmap cache and therefore particular record could not be
invalidated.

Resolves:
https://fedorahosted.org/sssd/ticket/2716

Reviewed-by: Michal Židek

mmap_cache: Rename variables

2015-08-05T09:28:11+00:00

Reviewed-by: Michal Židek

pam_sss: add sc support

2015-07-31T07:52:03+00:00

Reviewed-by: Jakub Hrozek

PAM: add certificate support to PAM (pre-)auth requests

2015-07-31T07:52:01+00:00

Reviewed-by: Jakub Hrozek

authok: add support for Smart Card related authtokens

2015-07-31T07:51:58+00:00

Reviewed-by: Jakub Hrozek

pack_message_v3: allow empty name

2015-07-31T07:51:56+00:00

Reviewed-by: Jakub Hrozek

Fix minor typos

2015-07-23T09:10:16+00:00

Reviewed-by: Lukáš Slebodník