summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* MEMBEROF: Remove temporary workaroundLukas Slebodnik2013-08-281-5/+0
|
* UTIL: Explicitly include header file sys/socket.hLukas Slebodnik2013-08-281-0/+1
| | | | | | | We use constant AF_INET6 in util.c, but we do not explicitly include header file sys/socket.h. This header file was indirectly incuded by another header file netdb.h (netdb.h -> netinet/in.h -> sys/socket.h), but other platform can have other dependencies among header files.
* MONITOR: Move function declaration out of conditional buildLukas Slebodnik2013-08-281-5/+6
| | | | | | | Function monitor_config_file_fallback was defined inside of conditional block "#ifdef HAVE_SYS_INOTIFY_H", but it was also used out of this block. This patch move declaration of function before start of conditional build section.
* CLIENT: Fix non gnu sss_strnlen implementationLukas Slebodnik2013-08-281-1/+1
| | | | | | last argument of function sss_strnlen "size_t *len" is output variable. We need to increment value of size_t being pointed to by pointer instead of incrementing pointer.
* UTIL: Create new wraper header file sss_endian.hLukas Slebodnik2013-08-288-32/+66
| | | | | | Some platform have header file endian.h and anothers have sys/endian.h. We nedd to use conditional build to handle it correctly, therefore new header file sss_endian.h was created.
* DP: Use the correct type for DBus booleanJakub Hrozek2013-08-281-2/+5
| | | | https://fedorahosted.org/sssd/ticket/2057
* mmap_cache: Use stricter check for hash keys.Lukas Slebodnik2013-08-281-4/+6
| | | | ht_size is size of hash_table in bytes, but hash keys have type uint32_t
* mmap_cache: Skip records which doesn't have same hashLukas Slebodnik2013-08-281-2/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The code uses 2 hashes for each record, but only one hash table to index them both, furthermore each record has only one single 'next' pointer. This means that in certain conditions a record main end up being on a hash chain even though its hashes do not match the hash chain. This can happen when another record 'drags' it in from another hash chain where they both belong. If the record without matching hashes happens to be the second of the chain and the first record is removed, then the non matching record is left on the wrong chain. On removal of the non-matching record the hash chain will not be updated and the hash chain will end up pointing to an invalid slot. This slot may be later reused for another record and may not be the first slot of this new record. In this case the hash chain will point to arbitrary data and may cause issues if the slot is interpreted as the head of a record. By skipping any block that has no matching hashes upon removing the first record in a chain we insure that dangling references cannot be left in the hash table Resolves: https://fedorahosted.org/sssd/ticket/2049
* sss_packet_grow: correctly pad packet length to 512BPavel Březina2013-08-281-1/+1
| | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2059 If len % SSSSRV_PACKET_MEM_SIZE == 0 or some low number, we can end up with totlen < len and return EINVAL. It also does not pad the length, but usually allocates much more memory than is desired. len = 1024 n = 1024 % 512 + 1 = 0 + 1 = 1 totlen = 1 * 512 = 512 => totlen < len len = 511 n = 511 % 512 + 1 = 511 + 1 totlen = 512 * 512 = 262144 totlen is way bigger than it was supposed to be
* Removing unused parameter type from sudosrv_get_sudorules_query_cache()Lukas Slebodnik2013-08-281-4/+2
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/1825
* mmap_cache: Store corrupted mmap cache before resetMichal Zidek2013-08-191-0/+66
| | | | | This patch adds function to store corrupted mmap cache file to disk for further analysis.
* mmap_cache: Use better checks for corrupted mc in responderMichal Zidek2013-08-192-5/+53
| | | | | We introduced new way to check integrity of memcache in the client code. We should use similiar checks in the responder.
* mmap_cache: Off by one error.Michal Zidek2013-08-194-14/+17
| | | | | Removes off by one error when using macro MC_SIZE_TO_SLOTS and adds new macro MC_SLOT_WITHIN_BOUNDS.
* mmap_cache: Remove triple checks in client code.Michal Zidek2013-08-192-40/+20
| | | | | We had pattern in client code with 3 conditions that can be replaced with one.
* mmap_cache: Check data->name value in client codeMichal Zidek2013-08-192-0/+37
| | | | | | | | data->name value must be checked to prevent segfaults in case of corrupted memory cache. resolves: https://fedorahosted.org/sssd/ticket/2018
* print hint about password complexity when new password is rejectedPavel Březina2013-08-112-2/+22
| | | | https://fedorahosted.org/sssd/ticket/1827
* ldap, krb5: More descriptive msg on chpass failure.Michal Zidek2013-08-112-0/+31
| | | | | | | | Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
* providers: refresh expired netgroupsPavel Březina2013-08-117-3/+209
| | | | https://fedorahosted.org/sssd/ticket/1713
* back end: add refresh expired records periodic taskPavel Březina2013-08-1111-0/+70
| | | | | | https://fedorahosted.org/sssd/ticket/1713 Add new option refresh_expired_interval.
* back end: periodical refresh of expired records APIPavel Březina2013-08-113-0/+377
| | | | https://fedorahosted.org/sssd/ticket/1713
* back end: periodic task APIPavel Březina2013-08-113-0/+449
| | | | https://fedorahosted.org/sssd/ticket/1891
* mmap_cache: Check if slot and name_ptr are not invalid.Michal Zidek2013-08-115-2/+73
| | | | | | | This patch prevents jumping outside of allocated memory in case of corrupted slot or name_ptr values. It is not proper solution, just hotfix until we find out what is the root cause of ticket https://fedorahosted.org/sssd/ticket/2018
* resolv-tests failing with memory leakMichal Zidek2013-08-091-2/+4
| | | | | | Wait for c-ares to finish before checking for memory leaks. https://fedorahosted.org/sssd/ticket/1899
* Set default DNS resolution timeout to 6 seconds.Jakub Hrozek2013-08-093-3/+3
| | | | | | | Partially solves ticket: https://fedorahosted.org/sssd/ticket/1966 To avoid the problem mentioned in the ticket above, option dns_discovery_domain must be set properly
* Lower timeout to contact DNS serverMichal Zidek2013-08-091-1/+1
| | | | | | | | c-ares timeout to wait for response from DNS server before moving to next DNS server is lowered from 5s to 2s. Partially solves https://fedorahosted.org/sssd/ticket/1966
* Add a commit templateSimo Sorce2013-08-091-0/+9
| | | | | | | | | | | | Explanation: In order to use a common style when creating commits a commit template will be helpful espcially to new developers. The commit template can be activated with the following command: git config commit.template .git-commit-template When this is done any new commit will use the template as the default commit message.
* init script: source /etc/sysconfig/sssdPavel Březina2013-08-084-0/+19
| | | | https://fedorahosted.org/sssd/ticket/1959
* Configure SYSV init scripts properlyStephen Gallagher2013-08-084-10/+10
| | | | | | | Previously, these contained hard-coded paths. Now they are populated correctly by the configure script. https://fedorahosted.org/sssd/ticket/1986
* Handle too many results from getnetgr.Lukas Slebodnik2013-08-081-1/+13
|
* Do not call sss_cmd_done in function check_cache.Lukas Slebodnik2013-08-081-6/+0
| | | | | | | | Function sysdb_getpwnam return more results than 1 and therefore sss_cmd_done was called. Inside of function sss_cmd_done memory was freed, but this freed memory was used in caller functions, therefore sssd crashed. https://fedorahosted.org/sssd/ticket/1980
* MAN: Clarify the min_id/max_id limits furtherJakub Hrozek2013-08-081-0/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2005 Some users were confused by our description of min_id/max_id and thought the limits only applied to returning entries from the NSS responder. However, the limits are actually enforced on the back end side, so the entries are not even saved to cache.
* NSS: Clear cached netgroups if a request comes in from the sss_cacheLukas Slebodnik2013-08-084-0/+55
| | | | | | | In order for sss_cache to work correctly, we must also signal the nss responder to invalidate the hash table requests. https://fedorahosted.org/sssd/ticket/1759
* NSS: allow removing entries from netgroup hash tableLukas Slebodnik2013-08-083-1/+32
| | | | | | | | | There is a timed desctructor in the nss responder that, when the entry timeout passes, removes the netgroup from the hash table while the netgroup is freed. This patch adds a hash delete callback so that if the netgroup is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
* LDAP: Fix crash when processing nested groupsJakub Hrozek2013-08-081-4/+16
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1932 There is a rather strange workaround in the nested groups processing code that calls tevent_req_post outside _send(). However, it broke in certain situations where the tevent_req_call resulted in req being freed, which freed state by extension and then the subsequent _post call was a use-after-free. This patch saves the two variables used outside state so that it's safe to use them even after the callback.
* sudo: print better debug message when a rule has multiple cn valuesPavel Březina2013-08-061-1/+5
|
* sudo: skip rule on error instead of failing completelyPavel Březina2013-08-061-1/+3
| | | | https://fedorahosted.org/sssd/ticket/2031
* Every time use permissive control in function memberof_mod.Lukas Slebodnik2013-07-171-0/+7
| | | | | | | | | | | Storing cyclic groups into sysdb can cause adding ghost members, which has already been stored. Function ldb_modify will fail with error [Attribute or value exists]. With permisive control, duplicated attributes will be skipped as if it was never added. https://fedorahosted.org/sssd/ticket/1846
* Always set port status to neutral when resetting service.Michal Zidek2013-07-151-1/+2
| | | | | | | | We did not set port status for metaservers (srv servers) in fo_reset_services(). Fixes: https://fedorahosted.org/sssd/ticket/1933
* sudo responder: use different callback for oob refreshPavel Březina2013-06-271-6/+8
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1693 Since we don't care about returned values from out of band refresh, we do not need to set callback data. However, this caused talloc to abort as it considers it as type mismatch when called from tevent_req_callback_data().
* IPA: Do not download or store the member attribute of host groupsJakub Hrozek2013-06-242-2/+0
| | | | | | | | https://fedorahosted.org/sssd/ticket/1806 The IPA provider attempted to store the original value of member attribute to the cache. That caused the memberof plugin to process the values which was really CPU intensive.
* failover: if expanded server is marked as neutral, invoke srv collapsePavel Březina2013-06-211-0/+7
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1947 Otherwise we will do the SRV expansion once again: 1. leaving the old servers in server list 2. meta server is not inserted back in the list, the newly found servers are inserted behind meta server, meta server is orphaned and the new servers are forgotten
* collapse_srv_lookup may free the server, make it clear from the APIPavel Březina2013-06-211-5/+8
| | | | https://fedorahosted.org/sssd/ticket/1947
* failover: set state->out when meta server remains in SRV_RESOLVE_ERRORPavel Březina2013-06-171-0/+1
| | | | https://fedorahosted.org/sssd/ticket/1886
* Add ignore_group_members option.Paul B. Henson2013-05-319-18/+64
| | | | https://fedorahosted.org/sssd/ticket/1376
* Adding option to disable retrieving large AD groups.Lukas Slebodnik2013-05-2311-13/+74
| | | | | | | | | This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
* Removing unused functions.Lukas Slebodnik2013-05-232-36/+0
| | | | This patch remove unused functions sdap_parse_user and sdap_parse_group
* sudo responder: use fully qualified name for subdomain usersPavel Březina2013-05-101-1/+1
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1912 Patch that converts subdomain usernames into fully qualified format made it to the 1.9 branch but sudo wasn't aware of it. This patch changes sysdb_getpwnam call to sysdb_subdom_getpwnam which converts username into fqn if the domain is subdomain.
* SUDO: IPA providerLukas Slebodnik2013-05-107-29/+115
| | | | | | This patch added auto configuration SUDO with ipa provider and compat tree. https://fedorahosted.org/sssd/ticket/1733
* Display the last grace warning, tooJakub Hrozek2013-05-022-3/+3
| | | | | | | Due to a comparison error, the last warning when an LDAP password was in its grace period was never displayed. https://fedorahosted.org/sssd/ticket/1890
* Only try to relink ghost users if we're not enumeratingJakub Hrozek2013-04-292-4/+17
| | | | | | | | https://fedorahosted.org/sssd/ticket/1893 When SSSD is not enumerating (which is the default), we are trying to link any "ghost" entries with a newly created user entry. However, when enumeration is on, this means a spurious search on adding any user.
generated by cgit (git 2.34.1) at 2024-05-21 10:53:10 +0000