summaryrefslogtreecommitdiffstats
path: root/src/sss_client
Commit message (Collapse)AuthorAgeFilesLines
* nfs idmap: fix infinite loopSumit Bose2016-01-051-2/+2
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2909 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Noam Meltzer <tsnoam@gmail.com>
* sssd_client: Do not use removed memory cacheLukas Slebodnik2015-11-111-0/+12
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_client: Fix underflow of active_threadsLukas Slebodnik2015-11-111-0/+5
| | | | | | | | | | | | | | | | | | | | If the memory cache was not initialized and there was a failure in initialisation of memory cache context (e.g. memory cache file does not exist) then mc_context had to be destroyed to release resources. However the count of active threads in sss_cli_mc_ctx is already higher than zero because current thread is working wih the mc_context. But this counter was zero-ed with memset in sss_nss_mc_destroy_ctx due to issue with initialisation of memory cache. Then we have to decrease counter of active thread in function sss_nss_mc_get_ctx because initialisation of mc failed. And the result of this decrement is underflow of counter. Related to: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Remove sudo doxygen fileLukas Slebodnik2015-11-051-1883/+0
| | | | | | There aren't any documented files in directory src/sss_client/sudo/ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Continue if setlocale failsMichal Židek2015-11-041-1/+3
| | | | | | | | | | | | | setlocale needs some environment variables to be set in order to work. These variables are not present in some special cases. We should not fail completely in these cases but continue with the compatible C locale. Resolves: https://fedorahosted.org/sssd/ticket/2785 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Fix memory leak in sssdpac_verify()Thomas Oulevey2015-09-231-0/+3
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2803 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Remove trailing whitespacePavel Reichl2015-09-031-3/+3
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* sssd: incorrect checks on length values during packet decodingMichal Židek2015-08-311-3/+3
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1697 It is safer to isolate the checked (unknown/untrusted) value on the left hand side in the conditions to avoid overflows/underflows. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: Function 2string for enum sss_cli_commandPetr Cech2015-08-311-3/+3
| | | | | | | | | | | | Improvement of debug messages. Instead of:"(0x0400): Running command [17]..." We could see:"(0x0400): Running command [17][SSS_NSS_GETPWNAM]..." (It's not used in sss_client. There are only hex numbers of commands.) Resolves: https://fedorahosted.org/sssd/ticket/2708 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Update integrity check of records in mmap cacheLukas Slebodnik2015-08-053-32/+33
| | | | | | | | | | | | | | | | | | | | The function sss_nss_mc_get_record return copy of record from memory cache in last argument. Because we should not access data directly to avoid problems with consistency of record. The function sss_nss_mc_get_record also check whether length of record is within data area (with macro MC_CHECK_RECORD_LENGTH) However we also tried to do the same check in functions sss_nss_mc_get{gr, pw}* Pointer to end of strings in record was compared to pointer to the end of data table. But these two pointers are not within the same allocated area and does not make sense to compare them. Sometimes record can be allocated before mmaped area and sometime after. Sometimes it will return cached data and other time will fall back to responder. Resolves: https://fedorahosted.org/sssd/ticket/2743 Reviewed-by: Michal Židek <mzidek@redhat.com>
* mmap_cache: "Override" functions for initgr mmap cacheLukas Slebodnik2015-08-051-5/+11
| | | | | | | | | | | | | | | | | | Functions sss_mc_get_strs_offset and sss_mc_get_strs_len provides data about strings for individual memory caches (passwd, ...) Their are used in generic responder mmap cache code to find a record in mmap cache (sss_mc_find_record). Data provided from functions sss_mc_get_* are used for checking the validity of record. So in case of corrupted record the whole mmap cache can be invalidated. Functions sss_mc_get_strs_offset and sss_mc_get_strs_len did not provide data for initgroups mmap cache and therefore particular record could not be invalidated. Resolves: https://fedorahosted.org/sssd/ticket/2716 Reviewed-by: Michal Židek <mzidek@redhat.com>
* mmap_cache: Rename variablesLukas Slebodnik2015-08-051-5/+5
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* pam_sss: add sc supportSumit Bose2015-07-312-1/+96
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: add certificate support to PAM (pre-)auth requestsSumit Bose2015-07-311-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* authok: add support for Smart Card related authtokensSumit Bose2015-07-311-0/+7
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pack_message_v3: allow empty nameSumit Bose2015-07-311-3/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix minor typosYuri Chornoivan2015-07-232-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Re-check memcache after acquiring the lockLukas Slebodnik2015-07-032-0/+106
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2581 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_client: Use unique lock for memory cacheLukas Slebodnik2015-07-033-4/+26
| | | | | | | | | | | | Previously the sma lock was used as for communication with responder. However it would cause a deadlock in case of re-checking memcache after acquiring the lock and before communication with responder.. Required by: https://fedorahosted.org/sssd/ticket/2581 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_client: Use initgr mmap cache in client codeLukas Slebodnik2015-07-033-1/+192
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2485 Reviewed-by: Michal Židek <mzidek@redhat.com>
* libwbclient-sssd: update interface to version 0.12Sumit Bose2015-05-264-99/+1214
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Fix warning "_" redefinedLukas Slebodnik2015-05-221-1/+1
| | | | | | | | | | | | | | | | | | | | "enum sss_authtok_type" is defined in sss_client/pam_message.h So it's better to include it instead of "util/authtok.h". "util/authtok.h" includes many header files including "util/util.h" CC src/util/crypto/nss/libsss_crypt_la-nss_base64.lo src/sss_client/pam_sss.c:48:0: error: "_" redefined [-Werror] #define _(STRING) dgettext (PACKAGE, STRING) ^ In file included from ../sssd/src/util/authtok.h:23:0, from ../sssd/src/sss_client/pam_message.h:29, from ../sssd/src/sss_client/pam_sss.c:43: src/util/util.h:55:0: note: this is the location of the previous definition #define _(STRING) gettext (STRING) ^ Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sss_client: Fix mixed enumsLukas Slebodnik2015-05-181-2/+4
| | | | | | | | | | | | | | | | | | | | Error: PW.MIXED_ENUM_TYPE: [#def4] sssd-1.12.90/src/sss_client/pam_message.c:159: mixed_enum_type: enumerated type mixed with another type # 157| &buf[rp]); # 158| # 159|-> rp += add_authtok_item(SSS_PAM_ITEM_AUTHTOK, pi->pam_authtok_type, # 160| pi->pam_authtok, pi->pam_authtok_size, &buf[rp]); # 161| Error: PW.MIXED_ENUM_TYPE: [#def5] sssd-1.12.90/src/sss_client/pam_message.c:162: mixed_enum_type: enumerated type mixed with another type # 160| pi->pam_authtok, pi->pam_authtok_size, &buf[rp]); # 161| # 162|-> rp += add_authtok_item(SSS_PAM_ITEM_NEWAUTHTOK, pi->pam_newauthtok_type, # 163| pi->pam_newauthtok, pi->pam_newauthtok_size, # 164| Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: add PAM responder unit testSumit Bose2015-05-081-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam_sss: move message encoding into separate fileSumit Bose2015-05-083-176/+240
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam_sss: add pre-auth and 2fa supportSumit Bose2015-05-081-2/+233
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: create preauth indicator file at startupSumit Bose2015-05-081-0/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5-child: add preauth and split 2fa token supportSumit Bose2015-05-081-0/+6
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add pre-auth requestSumit Bose2015-05-081-0/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* utils: add sss_authtok_[gs]et_2faSumit Bose2015-05-082-0/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CLIENT: Clear errno with enabled sss-default-nss-pluginLukas Slebodnik2015-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although errno was cleared in function sss_nss_make_request some sss glic functions set errno with value of output argument errnop. Reproducer: * sssd compiled with enabled option sss-default-nss-plugin * sss is the last value in group (/etc/nsswitch.conf) * sssd-client is installed but sssd is stopped. C-program: #include <stdio.h> #include <stdlib.h> #include <errno.h> #include <grp.h> int main(int argc, char *argv[]) { struct group *p_group; setgrent(); while (1) { errno = 0; /* initialize for getgrent() */ p_group = getgrent(); if (p_group == NULL) { if (errno == 0) { break; /* end of groups */ } else { perror("getgrent"); printf("getgrent error %d \n", errno); endgrent(); exit(-2); } } printf("getgrent() OK group(%d) = %s \n", p_group->gr_gid, p_group->gr_name); } exit(0); } Resolves: https://fedorahosted.org/sssd/ticket/2619 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* pam_client: fix casting to const pointerLukas Slebodnik2015-03-261-7/+8
| | | | | | | | | | src/sss_client/pam_sss.c:1461:73: error: cast from 'int **' to 'const void **' must have all intermediate pointers const qualified to be safe [-Werror,-Wcast-qual] pam_get_data(pamh, "pam_sss:password_expired_flag", (const void **) &exp_data); ^ Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAC: Fix memory leakLukas Slebodnik2015-03-091-0/+1
| | | | | | Reported by clang static analyser. Reviewed-by: Sumit Bose <sbose@redhat.com>
* Remove useless assignment to function parameterLukas Slebodnik2015-03-021-1/+0
| | | | | | | | | | | | | Reported by: cppcheck void free_fun(struct info *info) free(info->name); free(info); info = NULL; ^^^^^^^^^^^ Assignment to function parameter has no effect outside the function. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: new option pam_account_expired_messagePavel Reichl2015-02-231-1/+1
| | | | | | | | | | This option sets string to be printed when authenticating using SSH keys and account is expired. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: do not reject abruptlyPavel Reichl2015-02-232-5/+77
| | | | | | | | | If account has expired then pass message. Resolves: https://fedorahosted.org/sssd/ticket/2050 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Fix warning: equality comparison with extraneous parenthesesLukas Slebodnik2015-02-111-6/+6
| | | | | | | | | | | | | | | | | | | | | | | Example of warning: src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23: error: equality comparison with extraneous parentheses [-Werror,-Wparentheses-equality] if (((wbc_status) == WBC_ERR_SUCCESS)) { ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~ src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23: note: remove extraneous parentheses around the comparison to silence this warning if (((wbc_status) == WBC_ERR_SUCCESS)) { ~ ^ ~ src/sss_client/libwbclient/wbc_pwd_sssd.c:246:23: note: use '=' to turn this equality comparison into an assignment if (((wbc_status) == WBC_ERR_SUCCESS)) { ^~ = The reason is definition of some macros which were used in if conditions. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Open the PAC socket from krb5_child before dropping rootJakub Hrozek2015-01-212-0/+19
| | | | | | | | | | The PAC responder by default allows only connections from the root user. This patch opens the socket to the PAC responder before the krb5_child drops privileges so the connection seemingly comes from root. https://fedorahosted.org/sssd/ticket/2559 Reviewed-by: Sumit Bose <sbose@redhat.com>
* libwbclient: initialize some return valuesSumit Bose2014-12-191-0/+36
| | | | | | | | | | Some callers of libwbclient functions expects the return values are initialized even it the functions returns an error. This patch adds some initializations to meet this requirement. Resolves https://fedorahosted.org/sssd/ticket/2537 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: Missing argument to domains= should fail authJakub Hrozek2014-12-131-0/+6
| | | | | | | | | | When the administrator sets the domains= list, he usually wants to restrict the set of domains. An empty list is an undefined configuration and it's safer to fail then. https://fedorahosted.org/sssd/ticket/2516 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sss_client: Work around glibc bugLukas Slebodnik2014-12-081-0/+10
| | | | | | | | | | | | | | | | | | glibc is inconsistent with how it treats and returns NSS_STATUS_UNAVAIL. The sss nss plugin is present in nsswitch by default on some platforms due to glibc caching and problem with long living applications (e.g. GNOME). But sssd needn't be configuread and it cause problems in some programs. In this situation, the SSSD nss plugin should behave as if it was functioning but had no data even thought sssd is not running. The errors have to be passed from nss plugin up to the user with minimal moidiffication. Thanks to Stephen Gallagher for initial patch. Resolves: https://fedorahosted.org/sssd/ticket/2439 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_client: Fix race condition in memory cacheLukas Slebodnik2014-11-244-13/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Thread safe initialisation was fixed in ticket #2380, but there is still race condition in reinitialisation. If caches is invalidated with command sss_cache -U (-G or -E) then client code will need to reinitialize fast memory cache. Let say we have two threads. The 1st thread find out that memory cache should be reinitialized; therefore the fast memory cached is unmapped and context destroyed. In the same time, 2nd thread tried to check header of memory cache whether it is initialized and valid. As a result of previously unmapped memory the 2nd thread access out of bound memory (SEGFAULT). The destroying of fast memory cache cannot be done any time. We need to be sure that there isn't any other thread which uses mmaped memory. The new counter of active threads was added for this purpose. The state of fast memory cache was converted from boolean to three value state (UNINITIALIZED, INITIALIZED, RECYCLED) UNINITIALIZED - the fast memory cache need to be initialized. - if there is a problem with initialisation the state will not change - after successful initialisation, the state will change to INITIALIZED INITIALIZED - if the cahe was invalidated or there is any other problem was detected in memory cache header the state will change to RECYCLED and memory cache IS NOT destroyed. RECYCLED - nothing will be done is there are any active threads which may use the data from mmaped memory - if there aren't active threads the fast memory cahe is destroyed and state is changed to UNINITIALIZED. https://fedorahosted.org/sssd/ticket/2445 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_client: Extract destroying of mmap cache to functionLukas Slebodnik2014-11-241-16/+14
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* PAM: Remove authtok from PAM stack with OTPLukas Slebodnik2014-11-071-1/+15
| | | | | | | | | | | We remove the password from the PAM stack when OTP is used to make sure that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore and have to request a password on their own. Resolves: https://fedorahosted.org/sssd/ticket/2287 Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>
* sss_nss_idmap: add sss_nss_getorigbyname()Sumit Bose2014-10-143-0/+152
| | | | | | | | | | | | | This patch adds an interface to the new SSS_NSS_GETORIGBYNAME request of the nss responder to libsss_nss_idmap. The main use case for this new call is to replace sss_nss_getsidbyname() in the extdom plugin on the FreeIPA server to get more information about the given object than just the SID which is not available with the default POSIX interfaces. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* nss: add SSS_NSS_GETORIGBYNAME requestSumit Bose2014-10-141-0/+7
| | | | | | | | | | | | | | | This patch adds a new request to the nss responder which follows the same flow as a SSS_NSSGETSIDBYNAME request but returns more data than just the SID. The data is returned as pairs of \0-terminated strings where the first string is the sysdb attribute name and the second the corresponding value. The main use case is on the FreeIPA server to make additional user and group data available to the extdom plugin which then send this data to SSSD running on FreeIPA clients. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-292-2/+28
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libwbclient: avoid collision with Samba versionSumit Bose2014-09-083-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Doxygen: replace <pre> with markdown tableSumit Bose2014-09-021-18/+10
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NFSv4 client: (private) headers from libnfsidmapNoam Meltzer2014-09-021-0/+78
| | | | | | | | | | | | The private headers are needed in order to: nfsidmap_internal.h: * definition of struct trans_func * prototype for logger function cfg.h + queue.h: * prototype(s) for accessing rpc.idmpad configuration file Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-25 01:33:16 +0000