summaryrefslogtreecommitdiffstats
path: root/src/util
Commit message (Collapse)AuthorAgeFilesLines
* utils: add get_known_services()Pavel Březina2014-05-282-0/+10
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Include netinet/in.h for ip adress macrosLukas Slebodnik2014-05-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The manual page in.h (man in.h) says: The <netinet/in.h> header shall define the in6_addr structure that con‐ tains at least the following member: uint8_t s6_addr[16] The <netinet/in.h> header shall define the following macros that test for special IPv6 addresses. Each macro is of type int and takes a sin‐ gle argument of type const struct in6_addr *: IN6_IS_ADDR_LINKLOCAL: Unicast link-local address. IN6_IS_ADDR_LOOPBACK: Loopback address. IN6_IS_ADDR_MULTICAST: Multicast address. The header file netinet/in.h> was not included directly in src/util/util.c and it caused few problems. ./src/util/util.h:378: warning: 'struct in6_addr' declared inside parameter list ./src/util/util.h:378: warning: its scope is only this definition or declaration, which is probably not what you want src/util/util.c: In function 'check_ipv4_addr': src/util/util.c:765: error: implicit declaration of function 'IN_MULTICAST' src/util/util.c:769: error: 'IN_LOOPBACKNET' undeclared (first use in this function) src/util/util.c:769: error: (Each undeclared identifier is reported only once src/util/util.c:769: error: for each function it appears in.) src/util/util.c:778: error: 'INADDR_BROADCAST' undeclared (first use in this function) src/util/util.c: At top level: src/util/util.c:786: warning: 'struct in6_addr' declared inside parameter list src/util/util.c:787: error: conflicting types for 'check_ipv6_addr' ./src/util/util.h:378: error: previous declaration of 'check_ipv6_addr' was here src/util/util.c: In function 'check_ipv6_addr': src/util/util.c:796: error: implicit declaration of function 'IN6_IS_ADDR_LINKLOCAL' src/util/util.c:799: error: implicit declaration of function 'IN6_IS_ADDR_LOOPBACK' src/util/util.c:802: error: implicit declaration of function 'IN6_IS_ADDR_MULTICAST' Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Fix order of header files.Lukas Slebodnik2014-05-261-1/+3
| | | | | | | | | | | | | | | | | | | | | | The older version of glibc and different implementations of libs requires feature macros for enabling function getline. getline(), getdelim(): Since glibc 2.10: _POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700 Before glibc 2.10: _GNU_SOURCE All feature macros are in header file config.h and are detected by configure script. The header file config.h was included after few other header files. The problem is that header files stdio.h is included just once and is included from many external header files. We need to include config.h before any other header file to prevent problems. src/util/nscd.c: In function ‘sss_nscd_parse_conf’: src/util/nscd.c:150: error: implicit declaration of function ‘getline’ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SBUS: Start implementing property accessStef Walter2014-05-222-0/+2
| | | | | | | | | | | | | | | | This patch adds the basis of SBUS getters and setters. A new module, sssd_dbus_properties.c would contain handlers for the property methods like Get, Set and GetAll. Type-safe property access works in a similar fashion like type-safe method calls - the invoker calls the getter which returns the primitive type, which is in turn marshalled into variant by the invoker. This patch does not contain the complete functionality, see later patches that continue implementing the getters and setters. Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* well known sids: Windows Server 2012 new asserted identity SIDsAlexander Bokovoy2014-05-211-0/+2
| | | | | | | | | | http://support.microsoft.com/kb/2830145 In Windows Server 2012, two new security principal SIDs are introduced to differentiate between proof of possession and Service-for-User-to-Self (S4U2Self) protocol transitions . Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CRYPTO: Use unprefixed version of function stpncpyLukas Slebodnik2014-05-182-4/+4
| | | | | | | | | | | | | | | | glibc contains two versions of finction stpncpy sh-4.2$ nm --dynamic --defined-only /lib64/libc.so.6 | grep stpncpy 0000003ce1c89b00 i stpncpy 0000003ce1c89b00 i __stpncpy 0000003ce1d040a0 T __stpncpy_chk We should use more portable version of stpncpy without prefix with underscores. The function __stpncpy was used in initial veersion e65c65fc710fa030bfb8319efc43fcdc9ce5a26f, which was based on http://people.redhat.com/drepper/SHA-crypt.txt Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_config: the codePavel Březina2014-05-142-0/+580
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Implemented LDAP component of GPO-based access controlYassir Elley2014-05-133-0/+16
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SBUS: Add an async request to retrieve the caller IDJakub Hrozek2014-05-132-0/+4
| | | | | | | | | | | | | | | | | Adds an async request sbus_get_sender_id_{send,recv} that allows retrieval of UID based on "sender" as returned by dbus_message_get_sender(). The UID is an int64_t to be able to use "-1" to as a fallback value for uknown or error cases. The unit test is added as a standalone one, not part of the sbus_tests because the request, and by extension the unit test relies on being connected to the system bus, which is very unlikely to work in a build system. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* UTIL: Use constant instead of value for stdin.Lukas Slebodnik2014-05-121-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-022-0/+4
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CRYPTO: Fix access to uninitialized dataLukas Slebodnik2014-04-282-4/+12
| | | | | | | | | | | | | | | | The size of output buffer(obufsize) was longer than initialised data. In calculation, uint32_t was used for length of the cryptotext, but uint16_t was written into buffer. The end of buffer was not initialised and it caused valgrind warning. Use of uninitialised value of size 8 at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180) by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482) by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721) by 0x40208A: sss_base64_encode (nss_base64.c:47) by 0x403305: sss_password_encrypt (nss_obfuscate.c:358) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Fix 'wrong mode' debug messagePavel Reichl2014-04-281-2/+3
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* confdb: Change file checks for config fileSimo Sorce2014-04-281-3/+4
| | | | | | | | | | | | | | We only really care that the file is readable by the owner and not accessible by group or others. We do not really care whether the owner can write/execute the file or not, so we mask out those perms. Resolves: https://bugzilla.redhat.com/1089098 Resolves: https://fedorahosted.org/sssd/ticket/2321 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* util: Change file check fns to use a mode maskSimo Sorce2014-04-283-73/+40
| | | | | | | | | | | | | | | Instead of using a custom way to chck file type, use the system provided macros and a mode mask to decide when we want to check. Additionally a mask also allows us to selectively check permissions. Related: https://bugzilla.redhat.com/1089098 Resolves: https://fedorahosted.org/sssd/ticket/2321 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* KRB5: Print a verbose error message on failure reading the keytabJakub Hrozek2014-04-231-0/+6
| | | | | | | | | | | | krb5_kt_resolve() returns 0 when a non-existent keytab is read, which means there was no FATAL-level DEBUG message printed to the user in case the keytab was missing completely and users had to enable more verbose debugging to diagnose failure to start up. This patch adds both the verbose DEBUG message as well as a syslog message. Reviewed-by: Michal Židek <mzidek@redhat.com>
* RESPONDERS: Add a new request sss_parse_inp_sendJakub Hrozek2014-04-222-0/+2
| | | | | | | | | The responders were copying code to parse input and on encountering an uknown domain, send the discover subdomain request. This patch adds a reusable request that can always be called in responders and in case the name can be parsed, just shortcut. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Minor fixes for sss_parse_name_for_domainsJakub Hrozek2014-04-171-6/+11
| | | | | | | | | | | | - use brackets after an if - use the right variable name (candidate_domain instead of candidate_name). - fix a typo in a debug message - only print a debug message about using a default domain when using a default domain - add a comment explaning when is a codepath executed Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* refactor calls of sss_parse_namePavel Reichl2014-03-181-2/+1
| | | | | | | sss_parse_name now supports NULL as output parameters so existing calls passing arguments which were never read were substituted by NULL. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Use pattern #elif defined(identifier)Lukas Slebodnik2014-03-144-17/+17
| | | | | | | | | | | | | | We had in source code following pattern #elif HAVE_<name> It worked because undefined identifier(in some cases) was evaluated to 0. But we do not care about value of HAVE_SOMETHING. We just need to know whether identifier was defined. There is not equivalent to #ifdef (short for of #if definded) We need to use long form: #elif defined HAVE_<name> It causes also compiler warning with enabled compiler flag -Wundef. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* UTIL: Hide implementation details about unicode libraries.Lukas Slebodnik2014-03-142-7/+9
| | | | | | | Header files from glib or unistring are only necessary in implementation module sss_utf8.c Reviewed-by: Pavel Reichl <preichl@redhat.com>
* UTIL: Sanitize whitespaces.Lukas Slebodnik2014-02-261-0/+10
| | | | | | | | | | | | Original patches submitted by: mpesari(Thanks!!) It can cause problems if user will hit spaces before entering username. (e.g in gdm). Spaces are ignored by LDAP; it's better to escape them. Resolves: https://fedorahosted.org/sssd/ticket/1955 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix warning unused variable ap_fallbackLukas Slebodnik2014-02-211-1/+1
| | | | | | | The variable ap_fallback is used only if sssd is build with journald, but this variable was declared outside of "#ifdef WITH_JOURNALD" Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DEBUG: Fix crash after fallback from journal logLukas Slebodnik2014-02-201-2/+5
| | | | | | | | | | | if journal_send fail we should not use the same va_list in the fallback functions. va_list can be modiefied and it may cause crashes im some cases e.g. printing string. This patch use copy of initialised va_list for debug_vprintf function. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* DEBUG: Fix build without journaldJakub Hrozek2014-02-191-3/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DEBUG: Enable sending structured debug logs to journaldStephen Gallagher2014-02-191-0/+90
| | | | | | | | | | | | | | | We are now able to send structured debug logs to journald, tagged with the code file, line number and domain that the log pertains to. To enable this functionality, SSSD must be configured at build-time with --with-syslog=journald and must be launched without -f/--debug-to-files This behavior is nearly identical to how SSSD will function today on a systemd-based system if --debug-to-files is disabled, since it will redirect stdout and stderr into journald. This patch merely enhances the situation to send structured logs instead of simple string messages. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DEBUG: Allow debug_fn to process __FILE__ and __LINE__Stephen Gallagher2014-02-192-6/+16
| | | | | | | | | | | | | In preparation for enabling journald support for the DEBUG logs, we will need to be able to pass in certain additional arguments that will be required, specifically the code file and line number. We will be able to optionally enable this in the file-based logs as well if we so choose, but for right now we will avoid breaking the log format on disk. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DOC: Fix names of arguments in doxygen commentsLukas Slebodnik2014-02-171-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Remove DEBUG macro support for old debug levelsNikolai Kondrashov2014-02-122-43/+9
| | | | | | | | | | | | | | Remove support for specifying old debug levels to the DEBUG macro: * remove debug_get_level function which was used for conversion, * remove debug_get_level tests, * remove mentions of old/new levels from DEBUG and DEBUG_IS_SET macro descriptions, * rename "newlevel" argument of debug_fn to just "level". Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-1213-148/+209
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fixup DEBUG macro invocations updateNikolai Kondrashov2014-02-121-2/+2
| | | | | | | | | Fix mistakes made by the update script in f87797f "Make DEBUG macro invocations variadic". Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-1228-453/+453
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro definition variadicNikolai Kondrashov2014-02-121-6/+6
| | | | | | | | | | Update DEBUG macro definition to accept format string and its arguments as direct variadic macro arguments, instead of expecting them as an expression in parens. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Cleanup debug_fnNikolai Kondrashov2014-02-121-4/+6
| | | | | | | | Cleanup debug_fn to better match coding conventions. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove extra flushing from debug message outputNikolai Kondrashov2014-02-121-1/+6
| | | | | | | | Remove extra fflush(3) invocation when outputting debug messages. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Move DEBUG macro body to debug_fnNikolai Kondrashov2014-02-122-75/+53
| | | | | | | | | | | | | | | | | Move DEBUG macro body to the debug_fn function, adding "function" argument to the latter. Rename "debug_fn" in sssd_krb5_locator_plugin.c to "plugin_debug_fn" to remove conflict with the sssd debug_fn. Replace DEBUG_MSG macro usage with debug_fn function usage. Remove DEBUG_MSG macro along with tests. The above makes the total size of binaries drop by 20% for the standard Fedora build and by 44% for a build configured according to Debian packaging script. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Detect the presence of POSIX attributesJakub Hrozek2014-02-122-0/+2
| | | | | | | | | | | | | | | | | | | When the schema is set to AD and ID mapping is not used, there is a one-time check ran when searching for users to detect the presence of POSIX attributes in LDAP. If this check fails, the search fails as if no entry was found and returns a special error code. The sdap_server_opts structure is filled every time a client connects to a server so the posix check boolean is reset to false again on connecting to the server. It might be better to move the check to where the rootDSE is retrieved, but the check depends on several features that are not known to the code that retrieves the rootDSE (or the connection code for example) such as what the attribute mappings are or the authentication method that should be used. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* utils: handling NULL params in sss_parse_namePavel Reichl2014-01-282-26/+30
|
* UTIL: Inherit parent domain's default_shellJakub Hrozek2014-01-151-1/+4
| | | | | Some override parameters were not inherited when creating subdomains. Especially with AD trusts, this gave strange results.
* NSS: Don't use printf(3) on user provided strings.Stef Walter2014-01-122-86/+40
| | | | | | | | | | | | | | | | | | | | This also fixes several corner cases and crashers. It's not prudent to pass user input to (even admin) input as a format string to printf, and various distros now check for this. This can cause accessing memory incorrectly, and various also various libc abort()'s. In addition various assumptions were made about full_name_format that aren't necessarily the case if the user uses a more complex format. Use safe-printf.c implementation for formatting full_name_format. Adapt the NSS resolver so it doesn't barf on formatted strings that are shorter than expected given a full_name_format. Tests added and updated appropriately.
* util: A safe printf for user provided format stringsStef Walter2014-01-122-0/+390
| | | | | | | | | | | | | | | | | | Since the default printf(3) implementation cannot safely be used on user (or admin) provided input, this is a safe implementation. This will be used in later patches by the full_name_format option The implementation came from realmd, but only has libc dependencies. The number of fields is pre-defined, and safe printf fails if an invalid field is accessed. Only string fields are supported, and only flags relevant to string fields are supported. Width and precision work as expected, but precision cannot read from a field. Tests are included, and ported to the check based testing that sssd uses.
* util: Fix const cast failures when building with -WerrorStef Walter2014-01-102-3/+3
| | | | | | | | | | When building with -Werror 'make check' fails with many errors like: ../src/tests/cmocka/test_authtok.c: In function ‘test_sss_authtok_password’: ../src/tests/cmocka/test_authtok.c:98:48: error: cast discards ‘__attribute__((const))’ qualifier from pointer target type [-Werror=cast-qual] Make sss_authtok_set() @data argument const, and fix its documentation
* LDAP: Add a new error code for malformed access control filterJakub Hrozek2014-01-092-0/+2
| | | | | | | https://fedorahosted.org/sssd/ticket/2164 The patch adds a new error code and special cases the new code so that access is denied and a nicer log message is shown.
* Use lower-case name for case-insensitive searchesSumit Bose2013-12-192-0/+36
| | | | | | | | | | | | The patch makes sure that a completely lower-cased version of a fully qualified name is used for case insensitive searches. Currently there are code paths where the domain name was used as configured and was not lower-cased. To make sure this patch does not break with old entries in the cache or case sensitive domains a third template was added to the related filters templates which is either filled with a completely lower-cased version or with the old version. The other two template values are unchanged.
* Properly align buffer when storing pointers.Michal Zidek2013-12-101-0/+10
| | | | | | | | Properly align buffer address to sizeof(char *) when storing pointers to strings. resolves: https://fedorahosted.org/sssd/ticket/1359
* Fix a trivial typoJakub Hrozek2013-12-091-1/+1
|
* added null checks to authtok modulePallavi Jha2013-12-091-1/+19
|
* SSSD: Improved domain detectionPavel Reichl2013-11-292-5/+29
| | | | | | | A bit more elegant way of detection of what domain the group member belongs to Resolves: https://fedorahosted.org/sssd/ticket/2132
* Remove unused parameter from sss_selinux_extract_userLukas Slebodnik2013-11-272-2/+0
|
* monitor: Specific error message for missing sssd.confPavel Reichl2013-11-272-0/+2
| | | | | | | | Specific error message is logged for missing sssd.conf file. New sssd specific error value is introduced for this case. Resolves: https://fedorahosted.org/sssd/ticket/2156
generated by cgit (git 2.34.1) at 2024-04-27 20:26:21 +0000