summaryrefslogtreecommitdiffstats
path: root/src/sss_client
Commit message (Collapse)AuthorAgeFilesLines
* sss_nss_idmap: add sss_nss_getorigbyname()Sumit Bose2014-10-143-0/+152
| | | | | | | | | | | | | This patch adds an interface to the new SSS_NSS_GETORIGBYNAME request of the nss responder to libsss_nss_idmap. The main use case for this new call is to replace sss_nss_getsidbyname() in the extdom plugin on the FreeIPA server to get more information about the given object than just the SID which is not available with the default POSIX interfaces. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* nss: add SSS_NSS_GETORIGBYNAME requestSumit Bose2014-10-141-0/+7
| | | | | | | | | | | | | | | This patch adds a new request to the nss responder which follows the same flow as a SSS_NSSGETSIDBYNAME request but returns more data than just the SID. The data is returned as pairs of \0-terminated strings where the first string is the sysdb attribute name and the second the corresponding value. The main use case is on the FreeIPA server to make additional user and group data available to the extdom plugin which then send this data to SSSD running on FreeIPA clients. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-292-2/+28
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libwbclient: avoid collision with Samba versionSumit Bose2014-09-083-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Doxygen: replace <pre> with markdown tableSumit Bose2014-09-021-18/+10
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NFSv4 client: (private) headers from libnfsidmapNoam Meltzer2014-09-021-0/+78
| | | | | | | | | | | | The private headers are needed in order to: nfsidmap_internal.h: * definition of struct trans_func * prototype for logger function cfg.h + queue.h: * prototype(s) for accessing rpc.idmpad configuration file Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* NEW CLIENT: plugin for NFSv4 rpc.idmapdNoam Meltzer2014-09-021-0/+571
| | | | | | | | Implementation of design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* sss_client: Fix "struct sss_cli_mc_ctx" reinitialize-on-errorsNalin Dahyabhai2014-08-221-0/+2
| | | | | | | | | | | | | | | | | | | When we have difficulty setting up an sss_cli_mc_ctx structure, we try to clean things up so that we'll be ready to try again the next time we're called. Part of that is closing the descriptor of the file if we've opened it and using memset() to clear the structure. Now that sss_nss_mc_get_ctx() does its work in two phases, and each one may end up doing the cleanup, each needs to be careful to reset the descriptor field so that the new value provided by memset() (0) isn't mistakenly treated as a file which should be closed by the other. Resolves: https://fedorahosted.org/sssd/ticket/2409 Reviewed-by: Simo Sorce <simo@redhat.com>
* libwbclient: SSSD implementationSumit Bose2014-08-2118-0/+3805
| | | | | | | | | | | | | | | | | | | | | | | This patch implements the libwbclient API for Samba daemons and utilities. The main purpose is to map Active Directory users and groups identified by their SID to POSIX users and groups identified by their POSIX UIDs and GIDs respectively. The API is not fully implemented because SSSD does not support some AD features like WINS or NTLM. Additionally this implementation has its focus on the file-server use case and hence does not implement some features which might be needed for a domain controller use case. Some API calls are generic and independent of the backend like e.g. converting binary SIDs and GUIDs into a string representation and back or memory allocation and deallocation. These parts are taken from the original Samba sources together with copyright and authors. Files with'_sssd' as part of the name contain the SSSD related calls. Resolves: https://fedorahosted.org/sssd/ticket/1588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAC: krb5_pac_verify failures should not be fatalJakub Hrozek2014-08-061-1/+10
| | | | | | | | | As noted in the MIT KRB5 documentation, some servers send PAC with no checksum, therefire the PAC validation should not be fatal, instead, we should treat a failure from krb5_pac_verify as if there was no PAC at all. Reported on sssd-devel by Thomas Sondergaard
* sss_client: Fix memory leak in nss_mc_{group,passwd}Lukas Slebodnik2014-07-232-0/+16
| | | | | | | | | | | | | | | | | | | | | | | Memory leak can happen with long living clients where there are records with colliding hashes; usually LDAP servers with many users or groups. Function sss_nss_mc_get_record allocates memory that is stored into "rec", with next iteration variable rec is overriden with new record and old one is lost and cannot be freed. Example code flow: src/sss_client/nss_mc_group.c:133: alloc_arg: "sss_nss_mc_get_record" allocates memory that is stored into "rec". src/sss_client/nss_mc_common.c:216:13: alloc_fn: Storage is returned from allocation function "malloc". src/sss_client/nss_mc_common.c:216:13: var_assign: Assigning: "copy_rec" = "malloc(rec_len)". src/sss_client/nss_mc_common.c:225:9: noescape: Resource "copy_rec" is not freed or pointed-to in function "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.] src/sss_client/nss_mc_common.c:239:5: var_assign: Assigning: "*_rec" = "copy_rec". src/sss_client/nss_mc_group.c:163: noescape: Resource "rec" is not freed or pointed-to in "sss_nss_mc_next_slot_with_hash". src/sss_client/nss_mc_common.c:294:60: noescape: "sss_nss_mc_next_slot_with_hash(struct sss_mc_rec *, uint32_t)" does not free or save its pointer parameter "rec". src/sss_client/nss_mc_group.c:133: overwrite_var: Overwriting "rec" in call to "sss_nss_mc_get_record" leaks the storage that "rec" points to. src/sss_client/nss_mc_common.c:239:5: write_notnull_to_parm: Assigning: "*_rec" = "copy_rec". Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_client: thread safe initialisation of sss_cli_mc_ctxLukas Slebodnik2014-07-231-7/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In multi threaded application, it may happen that more threads will call function getpwuid(or similar) and sss client will not have initialized structure for fast memory cache. This structure is initialized just once. There isn't any problem with multi threaded application after successful initialisation. The race condition will happen if more threads try to initialise structure sss_cli_mc_ctx in function sss_nss_mc_get_ctx (ctx->initialized is false) It takes some time to initialise mmap cache: open file, get file size, mmap file, initialize structure sss_cli_mc_ctx. One of problems is that file with memory cache can be opened more times (file descriptor leak), but the race condition is with initialising structure sss_cli_mc_ctx. One tread will start to initialise this structure; another thread will think that structure is already initialised and will check consistency of this structure. It will fail because 1st thread did not finish initialisation. Therefore 2nd thread will return EINVAL and will do clean up in done section: munmap, close file and reset structure data. The 1st thread will finish an try to use memory cache, but structure was zero initialised by 2nd thread and it will cause dereference of NULL pointer in 1st thread (SIGSEGV) or dividing by zero in murmurhash function(SIGFPE) Function sss_nss_mc_get_ctx was split into two parts for simplification of locking and unlocking. The locking is used only in new static function sss_nss_mc_init_ctx. This function will not be called very often therefore the same mutex is used as in other nss functions. Resolves: https://fedorahosted.org/sssd/ticket/2380 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Test right variable after calling sss_atomic_read_sLukas Slebodnik2014-07-091-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Add version symbol files for public libraries.Lukas Slebodnik2014-07-092-0/+20
| | | | | | | | | | | | | | | | Version symbol files will help package systems to catch backward compatible changes (newly added functions) into library. The difference between libraries libsss_nss_idmap_test.so and libsss_nss_idmap.so is that the 1st library will not be installed and has more exported functions, which are necessary for mocking with cmocka for test sss_nss_idmap-test. Resolves: https://fedorahosted.org/sssd/ticket/2194 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Suppress safealign warnings with DISCARD_ALIGN.Michal Zidek2014-07-012-2/+2
| | | | | | | | These warnings were all false positives. fixes: https://fedorahosted.org/sssd/ticket/1359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add type parameter to DISCARD_ALIGN macroMichal Zidek2014-07-011-1/+1
| | | | | | | | | This macro will be used to suppress alignment warnings when casting pointers. fixes: https://fedorahosted.org/sssd/ticket/1359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: add ignore_authinfo_unavail optionLukas Slebodnik2014-06-031-0/+11
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2232 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Define compatible macros for some functions.Lukas Slebodnik2014-06-032-2/+47
| | | | | | | | Functions pam_vsyslog and pam_modutil_getlogin are not available in openpam. This patch conditionally define macros for these function if they are not available. Compatible macros use standard functions vsyslog, getlogin Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Use fallback version of some pam macrosLukas Slebodnik2014-06-031-1/+18
| | | | | | | The header file security/_pam_macros.h is not available in openapam. This patch copies necessary macros from linux-pam 1.1.8. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Fix compilation of pam_test_client with openpamLukas Slebodnik2014-06-031-1/+15
| | | | | | linuxpam and openpam use different functions for text based conversation. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Include header file security/pam_appl.hLukas Slebodnik2014-06-031-0/+1
| | | | | | | | | | | | | | | | | | | We need this file for declaration of pam functions pam_get_item, pam_putenv, pam_set_data, pam_strerror, pam_set_item There is already test in configure script for this header file, but it was not included in pam_sss.c sh-4.2$ git grep pam_appl.h src/external/pam.m4:AC_CHECK_HEADERS([security/pam_appl.h ... src/providers/data_provider_be.c:#include <security/pam_appl.h> src/providers/proxy/proxy.h:#include <security/pam_appl.h> src/providers/proxy/proxy_child.c:#include <security/pam_appl.h> src/responder/pam/pamsrv.h:#include <security/pam_appl.h> src/sss_client/pam_test_client.c:#include <security/pam_appl.h> src/util/auth_utils.h:#include <security/pam_appl.h> Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_autofs: Do not try to free empty autofs contextLukas Slebodnik2014-05-271-2/+4
| | | | | | | | | | | If initialisation fails in function _sss_setautomntent, context will not be initialized and automount client will crash. The function _sss_endautomntent should not try to dereference NULL pointer. Resolves: https://fedorahosted.org/sssd/ticket/2288 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_autofs: Check return value of autofs make requestLukas Slebodnik2014-05-271-12/+12
| | | | | | | | | | | | The return value of function sss_autofs_make_request was not checked. (returned value was SSS_STATUS_UNAVAIL) Unfotunatelly, errnop was zero; buffer "repbuf" was not initialised and automount crashed in sss_autofs plugin. Resolves: https://fedorahosted.org/sssd/ticket/2288 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: macro PAM_DATA_REPLACE isn't available in openpam.Lukas Slebodnik2014-05-181-0/+2
| | | | | | | This part was introduced in commit dba7903ba7fc04bc331004b0453938c116be3663 "PAM: close socket fd with pam_set_data" Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Fix problem with missing declaration.Lukas Slebodnik2014-05-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The functions strdup and strncmp are used in pam_test_client, but header file string.h was not included directly in this file. The header file string.h was indirectly included by the header file security/pam_client.h. src/sss_client/pam_test_client.c: In function 'main': src/sss_client/pam_test_client.c:45: error: implicit declaration of function 'strdup' src/sss_client/pam_test_client.c:45: warning: incompatible implicit declaration of built-in function 'strdup' src/sss_client/pam_test_client.c:49: warning: incompatible implicit declaration of built-in function 'strdup' src/sss_client/pam_test_client.c:52: warning: incompatible implicit declaration of built-in function 'strdup' src/sss_client/pam_test_client.c:64: error: implicit declaration of function 'strncmp' gmake[2]: *** [src/sss_client/pam_test_client.o] Error 1 sh-4.2$ nm --undefined-only ./pam_test_client | grep -E "strdup|strncmp" U __strdup@@GLIBC_2.2.5 U strncmp@@GLIBC_2.2.5 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Do not attempt to get a TGT after a password change using OTPJakub Hrozek2014-03-262-0/+22
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2271 The current krb5_child code attempts to get a TGT for the convenience of the user using the new password after a password change operation. However, an OTP should never be used twice, which means we can't perform the kinit operation after chpass is finished. Instead, we only print a PAM information instructing the user to log out and back in manually. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* Use pattern #elif defined(identifier)Lukas Slebodnik2014-03-141-2/+2
| | | | | | | | | | | | | | We had in source code following pattern #elif HAVE_<name> It worked because undefined identifier(in some cases) was evaluated to 0. But we do not care about value of HAVE_SOMETHING. We just need to know whether identifier was defined. There is not equivalent to #ifdef (short for of #if definded) We need to use long form: #elif defined HAVE_<name> It causes also compiler warning with enabled compiler flag -Wundef. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: add ignore_unknown_user optionPete Fritchman2014-03-141-0/+11
| | | | | | https://fedorahosted.org/sssd/ticket/2232 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Test return value of strdupLukas Slebodnik2014-03-072-0/+9
| | | | | | | | | Warnings reported by Coverity (12463,12464) Dereferencing a pointer that might be null pi->pam_authtok when calling strlen. Dereferencing a pointer that might be null action when calling strncmp. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* DOC: Fix names of arguments in doxygen commentsLukas Slebodnik2014-02-171-3/+3
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-122-27/+27
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* CLIENT: Remove unused macrosLukas Slebodnik2014-01-241-5/+0
| | | | | PAM_SM_AUTH, PAM_SM_ACCOUNT, PAM_SM_SESSION, PAM_SM_PASSWORD I cannot find in git history where these macro were used.
* Properly align buffer when storing pointers.Michal Zidek2013-12-103-11/+14
| | | | | | | | Properly align buffer address to sizeof(char *) when storing pointers to strings. resolves: https://fedorahosted.org/sssd/ticket/1359
* sss_client: Use SAFEALIGN_COPY_<type> macros where appropriate.Michal Zidek2013-12-038-27/+80
| | | | | resolves: https://fedorahosted.org/sssd/ticket/1359
* sss_client: Use SAFEALIGN_SETMEM_<type> macros where appropriate.Michal Zidek2013-11-151-6/+3
| | | | https://fedorahosted.org/sssd/ticket/1359
* mmap_cache: Use two chains for hash collision.Lukas Slebodnik2013-09-234-8/+23
| | | | | | | | | | | | | | | | | | | | | | | struct sss_mc_rec had two hash members (hash1 and hash2) but only one next member. This was a big problem in case of higher probability of hash collision. structure sss_mc_rec will have two next members (next1, next2) with this patch. next1 is related to hash1 and next2 is related to hash1. Iterating over chains is changed, because we need to choose right next pointer. Right next pointer will be chosen after comparing record hashes. This behaviour is wrapped in function sss_mc_next_slot_with_hash. Adding new record to chain is also changed. The situation is very similar to iterating. We need to choose right next pointer (next1 or next2). Right next pointer will be chosen after comparing record hashes. Adding reference to next slot is wrapped in function sss_mc_chain_slot_to_record_with_hash Size of structure sss_mc_rec was increased from 32 bytes to 40 bytes. Resolves: https://fedorahosted.org/sssd/ticket/2049
* Rename _SSS_MC_SPECIALMichal Zidek2013-09-131-2/+2
| | | | | | If the environment variable _SSS_MC_SPECIAL is set to "NO", the mmap cache is skipped in the client code. The name is not very descriptive. This patch renames the variable to SSS_NSS_USE_MEMCACHE.
* CLIENT: Fix non gnu sss_strnlen implementationLukas Slebodnik2013-08-281-1/+1
| | | | | | last argument of function sss_strnlen "size_t *len" is output variable. We need to increment value of size_t being pointed to by pointer instead of incrementing pointer.
* mmap_cache: Off by one error.Michal Zidek2013-08-192-8/+8
| | | | | Removes off by one error when using macro MC_SIZE_TO_SLOTS and adds new macro MC_SLOT_WITHIN_BOUNDS.
* mmap_cache: Remove triple checks in client code.Michal Zidek2013-08-192-40/+20
| | | | | We had pattern in client code with 3 conditions that can be replaced with one.
* mmap_cache: Check data->name value in client codeMichal Zidek2013-08-192-0/+37
| | | | | | | | data->name value must be checked to prevent segfaults in case of corrupted memory cache. resolves: https://fedorahosted.org/sssd/ticket/2018
* mmap_cache: Check if slot and name_ptr are not invalid.Michal Zidek2013-08-112-0/+16
| | | | | | | This patch prevents jumping outside of allocated memory in case of corrupted slot or name_ptr values. It is not proper solution, just hotfix until we find out what is the root cause of ticket https://fedorahosted.org/sssd/ticket/2018
* Fix warnings: uninitialized variableLukas Slebodnik2013-07-221-1/+1
|
* Enhance PAC responder for AD usersSumit Bose2013-06-061-15/+47
| | | | | | | | | | | This patch modifies the PAC responder so that it can be used with the AD provider as well. The main difference is that the POSIX UIDs and GIDs are now lookup up with the help of the SID instead of being calculated algorithmically. This was necessary because the AD provider allows either algorithmic mapping or reading the value from attributes stored in AD. Fixes https://fedorahosted.org/sssd/ticket/1558
* Rename SAFEALIGN macros.Michal Zidek2013-05-141-34/+2
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1772 SAFEALIGN macros have been renamed in this patch to make it easy to pick the right macro when data is copied from byte buffer to a variable or vice versa. The renamed macros are placed in new header file to avoid code duplication (the old ones were defined in two files, one for the client code and one for the rest of sssd).
* SSH: Use separate field for domain name in client requestsJan Cholasta2013-05-074-37/+29
| | | | | Instead of appending @domain to names when the --domain option of sss_ssh_* is used, put domain name in a separate field in client requests.
* Add client library for SID related lookupsSumit Bose2013-05-035-0/+1925
| | | | | | | | | | | | This patch add a library for client side lookups for a SID or with a SID through the calls: - sss_nss_getsidbyname - sss_nss_getsidbyid - sss_nss_getnamebysid - sss_nss_getidbysid The library is called libsss_nss_idmap and the contributed spec file will create two new packages libsss_nss_idmap and libsss_nss_idmap-devel.
* sudo client: remove dead codePavel Březina2013-04-241-8/+0
| | | | | | https://fedorahosted.org/sssd/ticket/1889 Fixes two minor coverity issues.
* Fix sss_client breakage.Lukas Slebodnik2013-03-181-1/+1
| | | | | | | | | | Adding missing dependencies for linker. Missing dependency was introduced by commit 22d381367c27910fe82f476a76b9f4ede555e35a in changed file src/sss_client/nss_mc_common.c All function declaration for io.c was moved from util.h to separate file io.h, https://fedorahosted.org/sssd/ticket/1838
* Removing unused header file providers.hLukas Slebodnik2013-03-131-151/+0
| | | | | | | | | Header file "providers.h" is not included in any other file and function "dp_process_init" declared in this header file has no implementation. Header file protos.h is not also included in any other file and even hole content is commented out.
generated by cgit (git 2.34.1) at 2024-05-25 15:09:53 +0000