| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
| |
Resolves:
https://fedorahosted.org/sssd/ticket/2133
|
|
|
|
|
| |
Resolves:
https://fedorahosted.org/sssd/ticket/2133
|
|
|
|
|
|
|
|
|
|
|
| |
struct nss_cmd_ctx was not released in function nss_cmd_setnetgrent_done
and it wasn't used in the other function, because getnetgrent creates its own
nss_cmd_ctx context. struct nss_cmd_ctx was released after closing client
because it was allocated under client context. Memory leak is apparent with
long living clients.
Resolves:
https://fedorahosted.org/sssd/ticket/2170
|
|
|
|
|
|
|
|
|
|
| |
Some groups could be skipped, but packet length was not trimmed.
This is a reason why valgrind reported access to uninitialised bytes.
Actually, it isn't a problem, because the first uint32 in body is number of
sended gids.
Resolves:
https://fedorahosted.org/sssd/ticket/2138
|
| |
|
| |
|
|
|
|
|
|
|
| |
The code wrote into the middle of the packet to a space that was already
reserved and allocated but then still advanced the pointer to the buffer.
https://fedorahosted.org/sssd/ticket/2124
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch is a workaround until
https://fedorahosted.org/sssd/ticket/2129 is fixed properly.
Consider a group entry such as:
cn: subgroup@subdom
ghost: someuser
ghost: anotheruser@subdom
Currently in order to print all group members as FQDN (which is the default
for AD provider), the code needs to iterate over the ghost attributes and
parse them into (name,domain) and optionally re-add the domain.
The proper fix would be to store always just the FQDN in the hardcoded
form of user@domain
|
|
|
|
|
|
|
|
|
|
|
|
| |
AD provider downloads domain information and initalizes ID mapping
during subdomains request. This information is necessary to lookup
objects without POSIX attributes.
We need to make sure that we postpone all responder requests until
ID mapping is initialized in the provider.
Resolves:
https://fedorahosted.org/sssd/ticket/2092
|
| |
|
|
|
|
|
| |
The only effect the failure to store a result to negative cache might
have would be a slower lookup next time.
|
|
|
|
|
|
|
| |
https://fedorahosted.org/sssd/ticket/2090
Previously, when searching by UID or GID, the negative cache will only
work in case the UID was searched for using fully qualified names.
|
|
|
|
|
| |
resolves:
https://fedorahosted.org/sssd/ticket/2049
|
|
|
|
| |
Remove code duplication.
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
It is not very likely, that record will have the same hash1 and hash2, but it
is possible. In this situation, it does not make sense to remove record twice.
Function sss_mc_rm_rec_from_chain was not robust and sssd_nss could crash
in this situation. It was only possible if record was alone in chain.
Resolves:
https://fedorahosted.org/sssd/ticket/2049
|
| |
|
|
|
|
| |
https://fedorahosted.org/sssd/ticket/2057
|
|
|
|
|
|
| |
Since we now store the enumerate flag in sysdb for subdomains, we can
always descend to all available subdomains and if they do not allow
enumeration, simply skip them.
|
|
|
|
| |
ht_size is size of hash_table in bytes, but hash keys have type uint32_t
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The code uses 2 hashes for each record, but only one hash table to
index them both, furthermore each record has only one single 'next'
pointer.
This means that in certain conditions a record main end up being on a
hash chain even though its hashes do not match the hash chain. This can
happen when another record 'drags' it in from another hash chain where
they both belong.
If the record without matching hashes happens to be the second of the
chain and the first record is removed, then the non matching record is
left on the wrong chain. On removal of the non-matching record the hash
chain will not be updated and the hash chain will end up pointing to an
invalid slot.
This slot may be later reused for another record and may not be the
first slot of this new record. In this case the hash chain will point to
arbitrary data and may cause issues if the slot is interpreted as the
head of a record.
By skipping any block that has no matching hashes upon removing the
first record in a chain we insure that dangling references cannot be
left in the hash table
Resolves:
https://fedorahosted.org/sssd/ticket/2049
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
https://fedorahosted.org/sssd/ticket/2059
If len % SSSSRV_PACKET_MEM_SIZE == 0 or some low number,
we can end up with totlen < len and return EINVAL.
It also does not pad the length, but usually allocates
much more memory than is desired.
len = 1024
n = 1024 % 512 + 1 = 0 + 1 = 1
totlen = 1 * 512 = 512
=> totlen < len
len = 511
n = 511 % 512 + 1 = 511 + 1
totlen = 512 * 512 = 262144
totlen is way bigger than it was supposed to be
|
| |
|
|
|
|
|
|
|
| |
With the support of POSIX IDs managed on the AD side we may find
non-POSIX groups, i.e. groups which do not have a GID assigned in AD, in
the PAC. Since in this case all cached groups have a SDI attribute it is
more reliable to search the groups by SID instead of GID.
|
|
|
|
|
| |
When processing a list of groups we try to process as much as possible
only not stop on the first error.
|
|
|
|
|
|
| |
To avoid issues with case-sensitivity it is more reliable to search the
user entry in the cache and use the returned DN instead of constructing
it.
|
|
|
|
|
| |
Since the DN of the group is used to remove a membership it is not
necessary to check if the GID is valid.
|
|
|
|
|
| |
If the user entry does not exist in the cache and a primary GID cannot
be found it does not make sense to create a user entry.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Currently the PAC responder deletes a user entry and recreates it if
some attributes seems to be different.
Two of the attributes where the home directory and the shell of the
user. Those two attributes are not available from the PAC but where
generates by the PAC responder. The corresponding ID provider might have
better means to determine those attributes, e.g. read them from LDAP, so
we shouldn't change them here.
The third attribute is the user name. Since the PAC responder does
lookups only based on the UID we can wait until the ID provider updates
the entry.
Fixes https://fedorahosted.org/sssd/ticket/1996
|
| |
|
|
|
|
|
|
|
|
| |
Use sss_atomic_write_s() instead of write() in
sss_mc_save_corrupted(). Also unlink() the file if no data
were written.
It is better to use sss_atomic_write_s instead of write
|
|
|
|
|
| |
This patch adds function to store corrupted mmap cache file to
disk for further analysis.
|
|
|
|
|
| |
We introduced new way to check integrity of memcache in the
client code. We should use similiar checks in the responder.
|
|
|
|
|
| |
Removes off by one error when using macro MC_SIZE_TO_SLOTS
and adds new macro MC_SLOT_WITHIN_BOUNDS.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In some cases when MPG domains are used the information about the
original primary group of a user cannot be determined by looking at
the explicit group memberships. In those cases the GID related to the
original primary group is stored in a special attribute of the user
object.
This patch adds the GID of the original primary group when available and
needed.
Fixes https://fedorahosted.org/sssd/ticket/2027
|
|
|
|
|
|
|
| |
This patch prevents jumping outside of allocated memory in
case of corrupted slot or name_ptr values. It is not proper
solution, just hotfix until we find out what is the root cause
of ticket https://fedorahosted.org/sssd/ticket/2018
|
| |
|
| |
|
|
|
|
|
|
|
| |
In order for sss_cache to work correctly, we must also signal the nss
responder to invalidate the hash table requests.
https://fedorahosted.org/sssd/ticket/1759
|
|
|
|
|
|
|
|
|
| |
There is a timed desctructor in the nss responder that, when the
entry timeout passes, removes the netgroup from the hash table while
the netgroup is freed. This patch adds a hash delete callback so that if the
netgroup is removed from the hash table with hash_delete, its hash table
pointer will be invalidated. Later, when the entry is being freed, the
destructor won't attempt to remove it from the hash table.
|
|
|
|
|
|
|
|
| |
If cmd_ctx->name was not initialized by sss_parse_name
then copy of name will be used.
https://fedorahosted.org/sssd/ticket/1970
Coverity ID: 11647
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Netgroups often have memberNisNetgroup entries included in them
that will never process correctly if we require fully-qualified
names on the nested lookup. This patch alters the behavior of
netgroup lookups to check *all* domains for an unqualified
netgroup name, instead of only the ones not requiring fully-
qualified names.
https://fedorahosted.org/sssd/ticket/2013
|
| |
|
| |
|