summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* mmap_cache: Use better checks for corrupted mc in responderMichal Zidek2013-08-302-5/+53
| | | | | We introduced new way to check integrity of memcache in the client code. We should use similiar checks in the responder.
* mmap_cache: Off by one error.Michal Zidek2013-08-304-14/+17
| | | | | Removes off by one error when using macro MC_SIZE_TO_SLOTS and adds new macro MC_SLOT_WITHIN_BOUNDS.
* mmap_cache: Remove triple checks in client code.Michal Zidek2013-08-302-40/+20
| | | | | We had pattern in client code with 3 conditions that can be replaced with one.
* mmap_cache: Check data->name value in client codeMichal Zidek2013-08-302-0/+37
| | | | | | | | data->name value must be checked to prevent segfaults in case of corrupted memory cache. resolves: https://fedorahosted.org/sssd/ticket/2018
* sss_packet_grow: correctly pad packet length to 512Bsssd-1.9.2-124.el6Pavel Březina2013-08-301-1/+1
| | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2059 If len % SSSSRV_PACKET_MEM_SIZE == 0 or some low number, we can end up with totlen < len and return EINVAL. It also does not pad the length, but usually allocates much more memory than is desired. len = 1024 n = 1024 % 512 + 1 = 0 + 1 = 1 totlen = 1 * 512 = 512 => totlen < len len = 511 n = 511 % 512 + 1 = 511 + 1 totlen = 512 * 512 = 262144 totlen is way bigger than it was supposed to be
* Make IPA SELinux provider aware of subdomain userssssd-1.9.2-122.el6Jakub Hrozek2013-08-301-1/+10
| | | | Fixes https://fedorahosted.org/sssd/ticket/1892
* print hint about password complexity when new password is rejectedsssd-1.9.2-121.el6Pavel Březina2013-08-112-2/+22
| | | | https://fedorahosted.org/sssd/ticket/1827
* ldap, krb5: More descriptive msg on chpass failure.sssd-1.9.2-120.el6Michal Zidek2013-08-112-0/+31
| | | | | | | | Print more descriptive message when wrong current password is given during password change operation. resolves: https://fedorahosted.org/sssd/ticket/2029
* providers: refresh expired netgroupssssd-1.9.2-119.el6Pavel Březina2013-08-117-3/+209
| | | | https://fedorahosted.org/sssd/ticket/1713
* back end: add refresh expired records periodic taskPavel Březina2013-08-1111-0/+70
| | | | | | https://fedorahosted.org/sssd/ticket/1713 Add new option refresh_expired_interval.
* back end: periodical refresh of expired records APIPavel Březina2013-08-113-0/+377
| | | | https://fedorahosted.org/sssd/ticket/1713
* back end: periodic task APIPavel Březina2013-08-113-0/+449
| | | | https://fedorahosted.org/sssd/ticket/1891
* mmap_cache: Check if slot and name_ptr are not invalid.sssd-1.9.2-118.el6Michal Zidek2013-08-115-2/+73
| | | | | | | This patch prevents jumping outside of allocated memory in case of corrupted slot or name_ptr values. It is not proper solution, just hotfix until we find out what is the root cause of ticket https://fedorahosted.org/sssd/ticket/2018
* resolv-tests failing with memory leaksssd-1.9.2-117.el6Michal Zidek2013-08-111-2/+4
| | | | | | Wait for c-ares to finish before checking for memory leaks. https://fedorahosted.org/sssd/ticket/1899
* Set default DNS resolution timeout to 6 seconds.Jakub Hrozek2013-08-113-3/+3
| | | | | | | Partially solves ticket: https://fedorahosted.org/sssd/ticket/1966 To avoid the problem mentioned in the ticket above, option dns_discovery_domain must be set properly
* Lower timeout to contact DNS serverMichal Zidek2013-08-111-1/+1
| | | | | | | | c-ares timeout to wait for response from DNS server before moving to next DNS server is lowered from 5s to 2s. Partially solves https://fedorahosted.org/sssd/ticket/1966
* LDAP: Fix crash when processing nested groupssssd-1.9.2-116.el6Jakub Hrozek2013-08-091-4/+16
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1932 There is a rather strange workaround in the nested groups processing code that calls tevent_req_post outside _send(). However, it broke in certain situations where the tevent_req_call resulted in req being freed, which freed state by extension and then the subsequent _post call was a use-after-free. This patch saves the two variables used outside state so that it's safe to use them even after the callback.
* Removing unused functions.sssd-1.9.2-115.el6Lukas Slebodnik2013-08-092-36/+0
| | | | This patch remove unused functions sdap_parse_user and sdap_parse_group
* Always set port status to neutral when resetting service.Michal Zidek2013-08-091-1/+2
| | | | | | | | We did not set port status for metaservers (srv servers) in fo_reset_services(). Fixes: https://fedorahosted.org/sssd/ticket/1933
* failover: if expanded server is marked as neutral, invoke srv collapsePavel Březina2013-08-091-0/+7
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1947 Otherwise we will do the SRV expansion once again: 1. leaving the old servers in server list 2. meta server is not inserted back in the list, the newly found servers are inserted behind meta server, meta server is orphaned and the new servers are forgotten
* collapse_srv_lookup may free the server, make it clear from the APIPavel Březina2013-08-091-5/+8
| | | | https://fedorahosted.org/sssd/ticket/1947
* Remove enumerate=true from man sssd-ldapJakub Hrozek2013-08-091-1/+0
| | | | https://fedorahosted.org/sssd/ticket/1737
* if selinux is disabled, ignore that selogin dir is missingsssd-1.9.2-114.el6Pavel Březina2013-08-091-3/+15
| | | | https://fedorahosted.org/sssd/ticket/1817
* Adding option to disable retrieving large AD groups.sssd-1.9.2-113.el6Lukas Slebodnik2013-08-0911-13/+74
| | | | | | | | | This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
* File descriptor leak in nss responder.sssd-1.9.2-112.el6Michal Zidek2013-08-091-18/+43
| | | | | | | | | File descriptors leaked every time sss_mmap_cache_reinit was called and also the old memory cache was still maped in memory (munmap was not called). This patch adds destructor for memory cache context to call close() and munmap() automaticly. https://fedorahosted.org/sssd/ticket/1826
* Debug message in sss_mc_create_file.Michal Zidek2013-08-091-0/+5
| | | | | | This patch adds debug message for the case if sssd fails to open old mc file for some other reason than the file does not exist.
* MAN: Fix the title of sssd-sudosssd-1.9.2-111.el6Jakub Hrozek2013-08-091-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1710
* Document what does access_provider=ad dosssd-1.9.2-110.el6Jakub Hrozek2013-08-091-0/+14
| | | | https://fedorahosted.org/sssd/ticket/1841
* Every time use permissive control in function memberof_mod.sssd-1.9.2-109.el6Lukas Slebodnik2013-08-091-0/+7
| | | | | | | | | | | Storing cyclic groups into sysdb can cause adding ghost members, which has already been stored. Function ldb_modify will fail with error [Attribute or value exists]. With permisive control, duplicated attributes will be skipped as if it was never added. https://fedorahosted.org/sssd/ticket/1846
* failover: set state->out when meta server remains in SRV_RESOLVE_ERRORsssd-1.9.2-108.el6Pavel Březina2013-08-091-0/+1
| | | | https://fedorahosted.org/sssd/ticket/1886
* Display the last grace warning, toosssd-1.9.2-107.el6Jakub Hrozek2013-08-092-3/+3
| | | | | | | Due to a comparison error, the last warning when an LDAP password was in its grace period was never displayed. https://fedorahosted.org/sssd/ticket/1890
* Do not call sss_cmd_done in function check_cache.sssd-1.9.2-105.el6Lukas Slebodnik2013-08-081-6/+0
| | | | | | | | Function sysdb_getpwnam return more results than 1 and therefore sss_cmd_done was called. Inside of function sss_cmd_done memory was freed, but this freed memory was used in caller functions, therefore sssd crashed. https://fedorahosted.org/sssd/ticket/1980
* init script: source /etc/sysconfig/sssdsssd-1.9.2-104.el6Pavel Březina2013-08-084-0/+19
| | | | https://fedorahosted.org/sssd/ticket/1959
* Configure SYSV init scripts properlyStephen Gallagher2013-08-084-10/+10
| | | | | | | Previously, these contained hard-coded paths. Now they are populated correctly by the configure script. https://fedorahosted.org/sssd/ticket/1986
* Handle too many results from getnetgr.Lukas Slebodnik2013-08-081-1/+13
|
* sudo responder: use fully qualified name for subdomain userssssd-1.9.2-103.el6Pavel Březina2013-08-081-1/+1
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1912 Patch that converts subdomain usernames into fully qualified format made it to the 1.9 branch but sudo wasn't aware of it. This patch changes sysdb_getpwnam call to sysdb_subdom_getpwnam which converts username into fqn if the domain is subdomain.
* Add ignore_group_members option.sssd-1.9.2-102.el6Paul B. Henson2013-08-089-18/+64
| | | | https://fedorahosted.org/sssd/ticket/1376
* NSS: Add original homedir to home directory template optionssssd-1.9.2-101.el6Stephen Gallagher2013-08-086-8/+29
| | | | https://fedorahosted.org/sssd/ticket/1805
* sudo responder: use different callback for oob refreshsssd-1.9.2-100.el6Pavel Březina2013-08-081-6/+8
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1693 Since we don't care about returned values from out of band refresh, we do not need to set callback data. However, this caused talloc to abort as it considers it as type mismatch when called from tevent_req_callback_data().
* MAN: Clarify the min_id/max_id limits furthersssd-1.9.2-99.el6Jakub Hrozek2013-08-081-0/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2005 Some users were confused by our description of min_id/max_id and thought the limits only applied to returning entries from the NSS responder. However, the limits are actually enforced on the back end side, so the entries are not even saved to cache.
* IPA: Do not download or store the member attribute of host groupssssd-1.9.2-98.el6Jakub Hrozek2013-08-082-2/+0
| | | | | | | | https://fedorahosted.org/sssd/ticket/1806 The IPA provider attempted to store the original value of member attribute to the cache. That caused the memberof plugin to process the values which was really CPU intensive.
* NSS: Clear cached netgroups if a request comes in from the sss_cachesssd-1.9.2-97.el6Lukas Slebodnik2013-08-084-0/+55
| | | | | | | In order for sss_cache to work correctly, we must also signal the nss responder to invalidate the hash table requests. https://fedorahosted.org/sssd/ticket/1759
* NSS: allow removing entries from netgroup hash tableLukas Slebodnik2013-08-083-1/+32
| | | | | | | | | There is a timed desctructor in the nss responder that, when the entry timeout passes, removes the netgroup from the hash table while the netgroup is freed. This patch adds a hash delete callback so that if the netgroup is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
* sudo: print better debug message when a rule has multiple cn valuessssd-1.9.2-96.el6Pavel Březina2013-08-081-1/+5
|
* sudo: skip rule on error instead of failing completelyPavel Březina2013-08-081-1/+3
| | | | https://fedorahosted.org/sssd/ticket/2031
* MAN: Clarify that saving users after enumerating large domain might be CPU ↵sssd-1.9.2-95Jakub Hrozek2013-07-251-1/+9
| | | | | | intensive https://fedorahosted.org/sssd/ticket/1732
* Allocate PAM DP request data on responder context1.9.2-92Jakub Hrozek2013-07-253-5/+54
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1869 Currently the private data passed to the PAM request is a structure allocated on the client context. But in the odd case where the back end would be stopped or stuck until the idle timeout hits, the DP callback would access data that were freed when the client timed out. This patch introduces a new structure allocated on responder context, whose only purpose is to live as long as the request is active.
* autofs: fix invalid header 'number of entries' in packet1.9.2-91Pavel Březina2013-05-301-1/+5
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1739 Pointer to packet body may change while filling packet with autofs mount points. As a consequence, we sometimes wrote the number of entries into invalid body and we recieved an arbitrary number on the client side. If the number was 0, there were some skipped entries. If the number was greater than 0, everything worked correctly, because we iterate through the cached entries until we reach packet length - we don't compare to the number.
* Only try to relink ghost users if we're not enumerating1.9.2-90Jakub Hrozek2013-05-302-4/+16
| | | | | | | | https://fedorahosted.org/sssd/ticket/1893 When SSSD is not enumerating (which is the default), we are trying to link any "ghost" entries with a newly created user entry. However, when enumeration is on, this means a spurious search on adding any user.
* LDAP: do not invalidate pointer with realloc while processing ghost users1.9.2-89Jakub Hrozek2013-05-301-3/+13
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1799 One peculiarity of the sysdb_attrs_get_el interface is that if the attribute does not exist, then the attrs array is reallocated and the element is created. But in case other pointers are already pointing into the array, the realloc might invalidate them. Such case was in the sdap_process_ghost_members function where if the group had no members, the "gh" pointer requested earlier might have been invalidated by the realloc in order to create the member element.
generated by cgit (git 2.34.1) at 2024-11-16 05:16:18 +0000