summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* AD Provider: bugfix use-after-freePavel Reichl2014-04-301-2/+7
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2322 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD Provider: bug-fix uninitialized variablePavel Reichl2014-04-301-1/+2
| | | | | | ad_subdomains_refresh() always set value to output parameter 'changes' if EOK is returned. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CRYPTO: Fix access to uninitialized dataLukas Slebodnik2014-04-282-4/+12
| | | | | | | | | | | | | | | | The size of output buffer(obufsize) was longer than initialised data. In calculation, uint32_t was used for length of the cryptotext, but uint16_t was written into buffer. The end of buffer was not initialised and it caused valgrind warning. Use of uninitialised value of size 8 at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180) by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482) by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721) by 0x40208A: sss_base64_encode (nss_base64.c:47) by 0x403305: sss_password_encrypt (nss_obfuscate.c:358) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Fix 'wrong mode' debug messagePavel Reichl2014-04-281-2/+3
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Monitor: fix message wrong perm. mode on config filePavel Reichl2014-04-281-2/+2
| | | | | | | Change description of supported access modes. Add missing new line in message. Reviewed-by: Simo Sorce <simo@redhat.com>
* confdb: Change file checks for config fileSimo Sorce2014-04-281-3/+4
| | | | | | | | | | | | | | We only really care that the file is readable by the owner and not accessible by group or others. We do not really care whether the owner can write/execute the file or not, so we mask out those perms. Resolves: https://bugzilla.redhat.com/1089098 Resolves: https://fedorahosted.org/sssd/ticket/2321 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* util: Change file check fns to use a mode maskSimo Sorce2014-04-288-89/+60
| | | | | | | | | | | | | | | Instead of using a custom way to chck file type, use the system provided macros and a mode mask to decide when we want to check. Additionally a mask also allows us to selectively check permissions. Related: https://bugzilla.redhat.com/1089098 Resolves: https://fedorahosted.org/sssd/ticket/2321 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* mmap: Get errno when unlink failsMichal Zidek2014-04-251-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TEST: Some macros aren't defined in older version of check.Lukas Slebodnik2014-04-251-0/+15
| | | | | | | | | | | | | | | | | | | | | src/tests/sbus_codegen_tests-sbus_codegen_tests.o: In function `eject_handler': tests/sbus_codegen_tests.c:229: undefined reference to `ck_assert_uint_eq' tests/sbus_codegen_tests.c:235: undefined reference to `ck_assert_uint_eq' tests/sbus_codegen_tests.c:239: undefined reference to `ck_assert_uint_eq' src/tests/sbus_codegen_tests-sbus_codegen_tests.o: In function `test_marshal_basic_types': src/tests/sbus_codegen_tests.c:446: undefined reference to `ck_assert_uint_eq' src/tests/sbus_codegen_tests.c:449: undefined reference to `ck_assert_uint_eq' src/tests/sbus_codegen_tests-sbus_codegen_tests.o: src/tests/sbus_codegen_tests.c:451: more undefined references to `ck_assert_uint_eq' follow collect2: ld returned 1 exit status make[3]: *** [sbus_codegen_tests] Error 1 Macro ck_assert_uint_eq was added in check-0.9.10 Resolves: https://fedorahosted.org/sssd/ticket/2319 Reviewed-by: Michal Židek <mzidek@redhat.com>
* KRB5: Print a verbose error message on failure reading the keytabJakub Hrozek2014-04-231-0/+6
| | | | | | | | | | | | krb5_kt_resolve() returns 0 when a non-existent keytab is read, which means there was no FATAL-level DEBUG message printed to the user in case the keytab was missing completely and users had to enable more verbose debugging to diagnose failure to start up. This patch adds both the verbose DEBUG message as well as a syslog message. Reviewed-by: Michal Židek <mzidek@redhat.com>
* RESPONDERS: Add a new request sss_parse_inp_sendJakub Hrozek2014-04-228-1/+483
| | | | | | | | | The responders were copying code to parse input and on encountering an uknown domain, send the discover subdomain request. This patch adds a reusable request that can always be called in responders and in case the name can be parsed, just shortcut. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Split a separate common_mock_resp_dp moduleJakub Hrozek2014-04-223-71/+102
| | | | | | | | Splitting the module would allow responders that test the Data Provider requests to use the mock_rctx/mock_cctx functions without duplicate definitions. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Create a default sss_names_ctx in create_dom_test_ctxJakub Hrozek2014-04-222-0/+13
| | | | | | | | This would allow to call create_dom_test_ctx from tests that expect to be able to parse input with a regular expression just like a responder would do with an input from a client. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Remove unused 'force' parameter from the subdomain handlerJakub Hrozek2014-04-222-20/+6
| | | | | | | | | | | | | The force argument was unused and made the code more complex than required. Moreover, the force argument would have made the subdomain handler behave differently than other identity domains -- when the front end decides it's time to update the domains, the back end should just update them. Handling multiple concurrent requests from multiple responders (typically after startup) is handled at the generic back end level (see be_queue_request). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Fix a wrong DEBUG messageJakub Hrozek2014-04-221-2/+1
| | | | | | | Another function decides whether the responder is updating the subdomains or just returning an error code. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* build: List test extensionsNikolai Kondrashov2014-04-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | List test extensions with TEST_EXTENSIONS [1] in Makefile.am to allow applying separate LOG_COMPILER for binary and Python tests. This is needed to avoid running Python tests under Valgrind as that produces too many interpreter-specific errors which are hard to suppress reliably [2]. Thus a run like this would run only binary tests under Valgrind: make check PY_LOG_COMPILER=env LOG_COMPILER=valgrind Or more briefly: make check LOG_COMPILER=valgrind [1] http://www.gnu.org/software/automake/manual/automake.html#index-TEST_005fEXTENSIONS [2] http://svn.python.org/projects/python/trunk/Misc/README.valgrind Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus request: fix error initializationPavel Březina2014-04-191-2/+4
| | | | | | fixes: sssd_dbus_request.c:28:1: error: missing initializer [-Werror=missing-field-initializers] sssd_dbus_request.c:28:1: error: (near initialization for 'error_internal.dummy1') [-Werror=missing-field-initializers]
* sbus_tests: fix missing invoker in initializerPavel Březina2014-04-191-0/+2
|
* sbus_codegen_tests: Add test case type-safe handler argsStef Walter2014-04-195-5/+568
| | | | | | This adds a big test case for invoking a handler with all supported basic arguments, and constructing a reply with the same. Lots of tedious code, but worth it to make sure things work well.
* sbus: Add type-safe DBus method handlers and finish functionsStef Walter2014-04-1919-71/+544
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Type safe method handlers allow methods not to have to do tedious unwrapping and wrapping of DBus method call messages or replies. Arguments of the following DBus types are supported in type-safe method handlers. In addition arrays of these are supported. y: uint8_t b: bool (but no arrays, yet) n: int16_t q: uint16_t i: int32_t u: uint32_t x: int64_t t: uint64_t d: double s: char * (utf8 string) o: char * (object path) As an exception, arrays of booleans are not supported, but could be added later. Other more complex types could be added later if desired. If a method has other argument types, then it must be marked as having a raw handler (see below). Internally each method can have a type specific invoker function which unpacks the incoming arguments and invokes the method handler with the correct arguments. Each method also has a finish which accepts the type-safe out arguments (ie: return values) and builds the reply message. Like other request 'finish' functions, these free the request talloc context, and are to be used in place of sbus_request_finish() or friends. Raw method handlers parse their own method arguments, and prepare their own reply (ideally using sbus_request_finish() helpers). They can also do strange things like have variable arguments. To mark a DBus method as having a raw method handler use the following annotation: <annotation name="org.freedesktop.sssd.RawHandler" value="true"/> Raw methods do not have invokers or finish functions. I've left all of the internal peer to peer communication using raw method handlers. No code changes here.
* SBUS: Create an sbus_method_meta instance for IntrospectionJakub Hrozek2014-04-193-0/+12
| | | | | Also fixes a warning about uninitialized 'method' as the 'method' variable was unused and not set previously when introspecting.
* KRB5: Go offline in case of generic errorPavel Reichl2014-04-171-0/+1
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2313
* Minor fixes for sss_parse_name_for_domainsJakub Hrozek2014-04-171-6/+11
| | | | | | | | | | | | - use brackets after an if - use the right variable name (candidate_domain instead of candidate_name). - fix a typo in a debug message - only print a debug message about using a default domain when using a default domain - add a comment explaning when is a codepath executed Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add a unit test for sss_parse_name_for_domainsJakub Hrozek2014-04-171-4/+199
| | | | | | | | The code of sss_parse_name_for_domains is really complex and hard to read. This patch adds a unit test to be able to see the function being used. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ad_access_filter man page typoYassir Elley2014-04-171-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* build: Don't assume systemd implies journaldNikolai Kondrashov2014-04-171-1/+3
| | | | | | | | | | | | | Don't add --with-syslog=journald to extra_distcheck_flags if configured with systemd (--with-initscript=systemd). Add it if configured with journald (--with-syslog=journald) instead. This fixes distcheck target when configured with systemd, but without journald. Don't install journal.conf helping with enabling journald logging, unless configured with journald (--with-syslog=journald), as it would be useless and misleading. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB: do not check ccache directory for GIDPavel Reichl2014-04-171-7/+4
|
* ConfigAPI: Add two missing AD optionsJakub Hrozek2014-04-161-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* TEST: Add untested libraries into dlopen testLukas Slebodnik2014-04-161-0/+6
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* BUILD: Move duplicated files from providers to libsss_ldap_common.soLukas Slebodnik2014-04-161-20/+14
| | | | | | | | | | | | | | Files sss_ldap.c, user_info_msg.c were built in libsss_{ad,ipa,ldap}.so. In these two files, there are functions sss_ldap_get_diagnostic_msg, pack_user_info_chpass_error which are needed in libsss_ldap_common.so sss_ldap_get_diagnostic_msg is used in src/providers/ldap/sdap_async.c, src/providers/ldap/sdap_async_connection.c pack_user_info_chpass_error is used in src/providers/ldap/ldap_auth.c Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* BUILD: Move file sss_krb5.c into libsss_krb5_common.soLukas Slebodnik2014-04-161-22/+13
| | | | | | | | | | | | | Functions from module sss_krb5.c were duplicated in many libraries. e.g. symol check_fast was in libsss_ad.so, libsss_ipa.so, libsss_krb5.so, libsss_ldap.so This patch also remove duplicate files between libsss_ldap.so and libsss_krb5_common.so. libsss_ldap.so has already depended on libkrb5. Now, it will depend on libsss_krb5_common.so Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* BUILD: Move file find_uid.c into libsss_util.soLukas Slebodnik2014-04-161-32/+12
| | | | | | | | | Functions from module find_uid.c were duplicated in many libraries. e.g. symol check_if_uid_is_active was in libsss_ad.so, libsss_ipa.so, libsss_krb5.so, libsss_ldap.so Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* BUILD: Link libsss_ldap_common.so to libsss_idmap.soLukas Slebodnik2014-04-161-2/+3
| | | | | | | | | | | | | | | | | | | Library libsss_ldap.so does not directly use functions from library libsss_idmap.so. It only call function sdap_idmap_init (from file sdap_idmap.c) which is in library libsss_ldap_common.so sh-4.2$ nm -D --undefined-only /usr/lib64/sssd/libsss_ldap.so | grep idmap U sdap_idmap_init On the other hand, libsss_ldap_common.so uses functions from libsss_idmap but it was not linked to libsss_idmap.so. sh-4.2$ objdump -p /usr/lib64/sssd/libsss_ldap_common.so | grep idmap sh-4.2$ echo $? 1 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* BUILD: Link libsss_krb5_common.so to libkeyutils.soBenjamin Franzke2014-04-161-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | The symbol add_key (from libkeyutils) is used by function add_user_to_delayed_online_authentication (from file src/providers/krb5/krb5_delayed_online_authentication.c) which is part of libsss_krb5_common.so Fixes following error: [sssd[be[default]]] [load_backend_module] (0x0010): Unable to load ad module with path (/usr/lib64/sssd/libsss_ad.so), error: /usr/lib64/sssd/libsss_krb5_common.so: undefined symbol: add_key -lkeyutils was passed to the libraries libsss_{krb5,ipa,ad}.so, but when compiling with -Wl,--as-needed this flag will be ignored, since it is not used directly. So it was unavailable to libsss_krb5_common.so which actually needs it. This patch removes $(KEYUTILS_LIBS) from those libraries and adds it to libsss_krb5_common.so Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SBUS: Generate introspection from the interface meta structureJakub Hrozek2014-04-156-3/+421
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2234 This patch generates the introspection data from the sbus interface meta structure. The generated XML conforms to http://dbus.freedesktop.org/doc/dbus-specification.html#introspection-format The XML description of the interface also always includes the org.freedesktop.DBus.Introspectable interface, which this patch also allows in the policy settings.
* SDAP: augmented logging for group savingPavel Reichl2014-04-142-1/+24
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2239 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: Shorter retry time for failed SRVPavel Reichl2014-04-143-2/+17
| | | | | | | | | | | Until now there was only one timeout used to re-resolve SRV queries. This patch adds new (shorter) timeout that will be used for queries that previously failed. Resolves: https://fedorahosted.org/sssd/ticket/1885 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AUTOMAKE: Do not include generated files into tarballLukas Slebodnik2014-04-111-12/+12
| | | | | | | | | | | | | | | | | | sssd.service was assigned to the dist_systemdunit_DATA variable. Automake will install this file into the systemd unit directory after building it if necessary. Automake will also include this generated file in the tarball. As a result, when building sssd from the tarball, the paths needn't be recreated. The files in DATA primaries are added as dependencies to the all target via the internal all-am target. If sssd.service doesn’t exist, make will look for a rule to build it. Since there is such a rule, make will simply execute that rule when I build the all target. Resolves: https://fedorahosted.org/sssd/ticket/2314 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD Provider: Fix crash looking up forest on Samba 4Stephen Gallagher2014-04-101-1/+2
| | | | | | | | | | | We were assuming that the forest had been looked up by netlogon, but this is not available on Samba 4 domains. We need to check that the forest is NULL and force the lookup. Resolves: https://fedorahosted.org/sssd/ticket/2311 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAC: fix clang warningPavel Reichl2014-04-101-0/+8
| | | | | | Return value of sss_dp_get_account_recv is checked and logging is done accordingly. Reviewed-by: Sumit Bose <sbose@redhat.com>
* tests: Don't set the check fork mode explicitlyJakub Hrozek2014-04-102-2/+0
| | | | | | | Instead, let the user pick the fork mode with CK_FORK variable (see info check) Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb5_child: Fix use after free in debug messageLukas Slebodnik2014-04-082-11/+16
| | | | | | | | | | debug_prg_name is used in debug_fn and it was allocated under talloc context "kr". The variable "kr" was removed before the last debug messages in function main. It is very little change that it will be overridden. It is possible to see this issue with exported environment variable TALLOC_FREE_FILL=255 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Fix warning zero-length gnu_printf format stringLukas Slebodnik2014-04-071-1/+1
| | | | | | | There is a warning if nsupdate does not support realm. warning: zero-length gnu_printf format string [-Wformat-zero-length] Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove unused argument from resolv_gethostbyname_dns_parseLukas Slebodnik2014-04-071-5/+4
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* krb5_child: Remove unused krb5_context from set_changepw_optionsLukas Slebodnik2014-04-071-4/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove dead code from ipa_get_selinux_recvMichal Zidek2014-04-071-38/+23
| | | | | | | | The 'else' branches in ipa_get_selinux_recv are never executed (and even if they were, the result would be the same as if the true branches were taken). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Possible null dereference in SELinux codeMichal Zidek2014-04-041-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Makefile: Use alternative method to replace *bindirLukas Slebodnik2014-04-042-1/+27
| | | | | | | | | | | | | | | | | | | https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/Installation-Directory-Variables.html Most of these variables have values that rely on prefix or exec_prefix. It is deliberate that the directory output variables keep them unexpanded: typically ‘@sbindir@’ is replaced by ‘${exec_prefix}/sbin’, not ‘/usr/local/sbin’. This behavior is mandated by the GNU Coding Standards. Installation directory variables (sbindir, pkgdatadir ...) should be used only in makefiles. Similarly, we should not rely on AC_CONFIG_FILES to replace sbindir and friends in shell scripts and other files; instead, let make manage their replacement. Resolves: https://fedorahosted.org/sssd/ticket/2293 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: do not create client socketPavel Březina2014-04-042-2/+1
| | | | | | | | | | There is no need for client socket in IFP responder, since it uses D-Bus for communication with clients. Resolves: https://fedorahosted.org/sssd/ticket/2290 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AUTOFS: terminate array after the last entryLukas Slebodnik2014-04-041-1/+2
| | | | | | | | | | | | | | | | If LDAP entries have more then one attribute "automountKey" automount map will be skipped and error message will be printed to log files and sssd_be will crash. DEBUG(SSSDBG_MINOR_FAILURE, "Malformed entry, skipping\n"); The output array with automount maps will contain uninitialized pointers because array was terminated after the expected count of entries and not after the last successfully retrieved entry Resolves: https://fedorahosted.org/sssd/ticket/2288 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-06 05:57:18 +0000