summaryrefslogtreecommitdiffstats
path: root/src/sss_client
Commit message (Collapse)AuthorAgeFilesLines
* sssd_client: add mutex protected call to the PAC responderSumit Bose2017-09-224-2/+176
| | | | | | | | | | | | | | | | | | | | | | SSSD's plugin for MIT Kerberos to send the PAC to the PAC responder currently uses sss_pac_make_request() which does not protect the communication with the PAC responder with a mutex as e.g. the NSS and PAM clients. If an application using threads loads this plugin via libkrb5 in different threads and is heavily processing Kerberos tickets with PACs chances are that two threads try to communicate with SSSD at once. In this case one of the threads will miss a reply and will wait for it until the default client timeout of 300s is passed. This patch adds a call which uses a mutex to protect the communication which will avoid the 300s delay mentioned above. Resolves: https://pagure.io/SSSD/sssd/issue/3518 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* libwbclient: Fix warning statement with no effectLukas Slebodnik2017-08-221-1/+1
| | | | | | | | | | | | | | | src/sss_client/libwbclient/wbc_pam_sssd.c: In function ‘wbcAuthenticateUserEx’: src/sss_client/libwbclient/wbc_pam_sssd.c:52:5: error: statement with no effect [-Werror=unused-value] WBC_ERR_WINBIND_NOT_AVAILABLE; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/sss_client/libwbclient/wbc_pam_sssd.c:53:1: error: control reaches end of non-void function [-Werror=return-type] } ^ Related to: https://pagure.io/SSSD/sssd/issue/3461 Reviewed-by: Sumit Bose <sbose@redhat.com>
* libwbclient: Change return code for wbcAuthenticateUserExLukas Slebodnik2017-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Samba-4.6 change behaviour of few functions New version of code make sure session info for user is stored in cache. It is a performance optimisation to prevent contacting KDC for each session. More details in samba bug https://bugzilla.samba.org/show_bug.cgi?id=11259 Old return code WBC_SSSD_NOT_IMPLEMENTED was translated to NT_STATUS_LOGON_FAILURE which caused many failures. [2017/08/21 11:34:15.044321, 5, pid=27742, effective(0, 0), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2017/08/21 11:34:15.044330, 5, pid=27742, effective(0, 0), real(0, 0)] ../source3/auth/token_util.c:640(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2017/08/21 11:34:15.044349, 4, pid=27742, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:439(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2017/08/21 11:34:15.044360, 1, pid=27742, effective(0, 0), real(0, 0)] ../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego) Failed to generate session_info (user and group token) for session setup: NT_STATUS_LOGON_FAILURE Resolves: https://pagure.io/SSSD/sssd/issue/3461 Reviewed-by: Sumit Bose <sbose@redhat.com>
* libwbclient-sssd: update interface to version 0.14Sumit Bose2017-08-032-2/+10
| | | | | | The main change is a new member of the wbcAuthErrorInfo struct. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Moving headers used by both server and client to special folderAmitKumar2017-08-034-4/+4
| | | | | | | | | | | | | | | | | | | These are the header files which are used by both client and server: src/util/io.h src/util/murmurhash3.h src/util/util_safealign.h This patch is about moving these header files to special folder (src/shared). It will be easier to identify these headers when looking for them in the src tree. util_safalign.h is renamed as safalign.h because util_ namespace is appropriate when this file belonged to the util's folder which is no longer the case. Resolves: https://pagure.io/SSSD/sssd/issue/1898 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* pam_sss: Fix leaking of memory in case of failuresLukas Slebodnik2017-06-131-0/+3
| | | | | | Found by coverity. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* pam_sss: Fix checking of empty string cert_userLukas Slebodnik2017-06-051-2/+2
| | | | | | | | | | | | | | | | | src/sss_client/pam_sss.c: In function ‘eval_response’: src/sss_client/pam_sss.c:998:64: error: comparison between pointer and zero character constant [-Werror=pointer-compare] if (type == SSS_PAM_CERT_INFO && pi->cert_user == '\0') { ^~ src/sss_client/pam_sss.c:998:50: note: did you mean to dereference the pointer? if (type == SSS_PAM_CERT_INFO && pi->cert_user == '\0') { ^ src/sss_client/pam_sss.c:1010:42: error: comparison between pointer and zero character constant [-Werror=pointer-compare] && pi->cert_user != '\0') { ^~ src/sss_client/pam_sss.c:1010:28: note: did you mean to dereference the pointer? && pi->cert_user != '\0') { Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* pam_sss: add support for SSS_PAM_CERT_INFO_WITH_HINTSumit Bose2017-06-013-14/+127
| | | | | | | | | | | The new response type SSS_PAM_CERT_INFO_WITH_HINT is equivalent to SSS_PAM_CERT_INFO but tells pam_sss to prompt for an option user name as well. Resolves: https://pagure.io/SSSD/sssd/issue/3395 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* ssh tools: Split connect and communication phasesSimo Sorce2017-04-281-8/+22
| | | | | | | | | | | | | | | | | We can fallback after a connect error, but we cannot easily fall back once we start sending data as we may have consumed part of the buffer so reconnecting and sending what's left would not make sense. Therefore we now fallback on connect errors, but we issue a hard fail if error happens after communication has been established. Resolves: https://pagure.io/SSSD/sssd/issue/1498 Merges: https://pagure.io/SSSD/sssd/pull-request/3383 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ssh tools: Fix issues with multiple IP addressesSimo Sorce2017-04-281-1/+7
| | | | | | | | | | | | | | | Cycle through all resolved address until one succeed or all fail. This is needed for dual stack systems where either IPv4 or IPv6 are improperly configured or selectively filtered at some point along the route. Resolves: https://pagure.io/SSSD/sssd/issue/1498 Merges: https://pagure.io/SSSD/sssd/pull-request/3383 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ssh tools: The ai structure is not an array,Simo Sorce2017-04-281-3/+3
| | | | | | | | | | | | | This structure is actually a linked list, so do not mislead readers by treating it as an array. Resolves: https://pagure.io/SSSD/sssd/issue/1498 Merges: https://pagure.io/SSSD/sssd/pull-request/3383 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sssctl: integrate pam_test_client into sssctlSumit Bose2017-04-101-288/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add InfoPipe user lookupSumit Bose2017-04-101-0/+71
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add SSSD getpwnam lookupSumit Bose2017-04-101-0/+76
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_test_client: add service and environment to PAM test clientSumit Bose2017-04-101-12/+38
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3292 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss-idmap: add sss_nss_getlistbycert()Sumit Bose2017-03-234-3/+135
| | | | | | | | | This patch adds a getlistbycert() call to libsss_nss_idmap to make it on par with InfoPipe. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam: use authtok from PAM stack if availableSumit Bose2017-03-021-3/+11
| | | | | | | | | | | | | | | | | With this patch the behavior of pam_sss is slightly changed to be more similar to the behavior of other PAM modules. Currently pam_sss expects that there is a authtok (password) on the PAM stack if the 'use_first_pass' option was used. Without the option pam_sss unconditionally prompts for credentials. With this patch pam_sss will use an authtok from the PAM stack even if 'use_first_pass' is not set but it will assume that it is a password. To return to the previous behavior the new 'prompt_always' can be used. Resolves: https://pagure.io/SSSD/sssd/issue/2984 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Use pagure links as a reference to upstreamLukas Slebodnik2017-02-282-2/+2
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* KRB5: allow pkinit pre-authenticationSumit Bose2017-02-231-0/+6
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam: enhance Smartcard authentication tokenSumit Bose2017-02-231-7/+38
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: return name of PKCS#11 module and key id to pam_sssSumit Bose2017-02-232-2/+49
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: fix memory leak in pam_sssSumit Bose2017-02-231-0/+6
| | | | | | | | | | | Since there can be multiple rounds trips between the PAM client and SSSD it might be possible that the same data is send multiple times by SSSD. So before overriding the old data it should be freed. I've seen this with the domain name which is send both in the pre-auth and the auth responses. To be on the safe side I added free() for some other items as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_sss: check conversation callbackSumit Bose2017-02-221-0/+8
| | | | | | | | | With this patch pam_sss checks if a conversation callback is available before using it. Resolves https://fedorahosted.org/sssd/ticket/3296 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam_sss: Suppress warning format-truncationLukas Slebodnik2017-02-011-2/+2
| | | | | | | | | | | | | src/sss_client/pam_sss.c: In function ‘send_and_receive’: src/sss_client/pam_sss.c:742:39: error: ‘%.*s’ directive output between 0 and 18446744073709551615 bytes may cause result to exceed ‘INT_MAX’ [-Werror=format-truncation=] ret = snprintf(user_msg, bufsize, "%s%s%.*s", ^~~~~~~~~~ sssd/src/sss_client/pam_sss.c:742:39: note: assuming directive output of 4294967295 bytes Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* libwbclient-sssd: wbcLookupSid() allow NULL argumentsSumit Bose2017-01-211-16/+22
| | | | | | | | | | | | Some caller might not be interested in some of the values wbcLookupSid() returns and just pass NULL. Currently 'net ads user info' does this because it is not interested in the domain. wbcLookupSid() should handle this gracefully. Resolves: https://fedorahosted.org/sssd/ticket/3273 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Defer thread cancellation until completion of nss/pam operationsHoward Guo2016-11-241-73/+7
| | | | | | | | | | | | | The client code is not cancellation-safe, an application which has cancelled an NSS operation will experience subtle bugs, hence thread cancellation is deferred until completion of client operations. Resolves: https://fedorahosted.org/sssd/ticket/3156 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Florian Weimer <fweimer@redhat.com>
* libwbclient-sssd: update interface to version 0.13Sumit Bose2016-10-144-1/+69
| | | | | | | | | | This patch adds wbcCtxUnixIdsToSids() and wbcUnixIdsToSids() to SSSD's libwbclient and implements the latter. Resolves: https://fedorahosted.org/sssd/ticket/3181 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Remove double semicolon at the end of lineLukas Slebodnik2016-09-211-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAM: call free only when memory is expected to be allocatedSumit Bose2016-09-191-1/+2
| | | | | | Reborted by Coverity Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* pam_sss: check PKCS11_LOGIN_TOKEN_NAMESumit Bose2016-09-161-0/+65
| | | | | | | | | Check if PKCS11_LOGIN_TOKEN_NAME is set and prompt the user if the matching Smartcard is not inserted. Related to https://fedorahosted.org/sssd/ticket/3165 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM/KRB5: optional otp and password promptingSumit Bose2016-07-073-2/+19
| | | | | | | | | | Depending on the available Kerberos pre-authentication methods pam_sss will prompt the user for a password, 2 authentication factors or both. Resolves https://fedorahosted.org/sssd/ticket/2988 Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a ↵Jakub Hrozek2016-07-011-1/+6
| | | | | | | | | | | | | | | | | | | | local user If an IPA client uses the SSH integration and a local user logs in with SSH, the sss_ssh_authorizedkeys looks up their keys in the SSH responder, which doesn't find the user and returns ENOENT. The sss_ssh_authorizedkeys reports a failure on any error, including ENOENT which produced a confusing error message in the logs. This patch adds a new error code that handles users that are not found by SSSD but exist on the system and also special cases root with the same error code. Therefore, logging in as a local user no longer prints an error message. Resolves: https://fedorahosted.org/sssd/ticket/3003 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss-idmap: add sss_nss_getnamebycert()Sumit Bose2016-06-093-1/+46
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NSS: add SSS_NSS_GETNAMEBYCERT requestSumit Bose2016-06-091-0/+5
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: add pam_sss option allow_missing_nameSumit Bose2016-06-091-4/+37
| | | | | | | | | With this option SSSD can be used with the gdm Smartcard feature. Resolves: https://fedorahosted.org/sssd/ticket/2941 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libwbclient: wbcSidsToUnixIds() don't fail on errorsSumit Bose2016-06-071-8/+7
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3028 Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* pam_sss: reorder pam_message arraySumit Bose2016-03-141-22/+14
| | | | | | | | | | | There are different expectations about how the pam_message array is organized, details can be found in the pam_conv man page. E.g. sudo was not able to handle the Linux-PAM style but expected the Solaris PAM style. With this patch both styles should work as expected. Resolves https://fedorahosted.org/sssd/ticket/2971 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CLIENT: Retry request after EPIPELukas Slebodnik2016-03-111-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a function sss_cli_check_socket which checks socket in client code. The socket is reopened in case of some issues e.g. responder terminated connections ... We use syscall poll for checking status of socket. It's not 100% reliable method because there is still chance that responder will terminate socket after this check. Here is a schema of sss_*_make_request functions: sss_cli_check_socket sss_cli_make_request_nochecks { sss_cli_send_req { poll send } sss_cli_recv_rep { poll read } } The syscall pool does not return EPIPE directly but we convert special revents from poll to EPIPE. As it was mentioned earlier, checking of socket in the sss_cli_check_socket is not 100% reliable. It can happen very rarely due to TOCTOU issue (Time of check to time of use) We can return EPIPE from the sss_cli_make_request_nochecks function in case of failure in poll in sss_cli_send_req. The send function in sss_cli_send_req can also return EPIPE is responder close socket in the same time. The send function can succeed in sss_cli_send_req but it does not mean that responder read the message. It can happen that timer for closing socket can be handled before reading a message. Therefore there is a still a chance that we might return EPIPE in case of failure in poll in sss_cli_recv_rep. Therefore we need to reconnect to responder(sss_cli_check_socket) in case of EPIPE returned from sss_cli_make_request_nochecks and try to do the same request one more time. Resolves: https://fedorahosted.org/sssd/ticket/2626 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CLIENT: Reduce code duplicationLukas Slebodnik2016-03-111-31/+27
| | | | | | Patch for #2626 will be simpler with this small refactoring Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nfs idmap: fix infinite loopSumit Bose2016-01-051-2/+2
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2909 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Noam Meltzer <tsnoam@gmail.com>
* sssd_client: Do not use removed memory cacheLukas Slebodnik2015-11-111-0/+12
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* sss_client: Fix underflow of active_threadsLukas Slebodnik2015-11-111-0/+5
| | | | | | | | | | | | | | | | | | | | If the memory cache was not initialized and there was a failure in initialisation of memory cache context (e.g. memory cache file does not exist) then mc_context had to be destroyed to release resources. However the count of active threads in sss_cli_mc_ctx is already higher than zero because current thread is working wih the mc_context. But this counter was zero-ed with memset in sss_nss_mc_destroy_ctx due to issue with initialisation of memory cache. Then we have to decrease counter of active thread in function sss_nss_mc_get_ctx because initialisation of mc failed. And the result of this decrement is underflow of counter. Related to: https://fedorahosted.org/sssd/ticket/2726 Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Remove sudo doxygen fileLukas Slebodnik2015-11-051-1883/+0
| | | | | | There aren't any documented files in directory src/sss_client/sudo/ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Continue if setlocale failsMichal Židek2015-11-041-1/+3
| | | | | | | | | | | | | setlocale needs some environment variables to be set in order to work. These variables are not present in some special cases. We should not fail completely in these cases but continue with the compatible C locale. Resolves: https://fedorahosted.org/sssd/ticket/2785 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Fix memory leak in sssdpac_verify()Thomas Oulevey2015-09-231-0/+3
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2803 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Remove trailing whitespacePavel Reichl2015-09-031-3/+3
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* sssd: incorrect checks on length values during packet decodingMichal Židek2015-08-311-3/+3
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1697 It is safer to isolate the checked (unknown/untrusted) value on the left hand side in the conditions to avoid overflows/underflows. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: Function 2string for enum sss_cli_commandPetr Cech2015-08-311-3/+3
| | | | | | | | | | | | Improvement of debug messages. Instead of:"(0x0400): Running command [17]..." We could see:"(0x0400): Running command [17][SSS_NSS_GETPWNAM]..." (It's not used in sss_client. There are only hex numbers of commands.) Resolves: https://fedorahosted.org/sssd/ticket/2708 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Update integrity check of records in mmap cacheLukas Slebodnik2015-08-053-32/+33
| | | | | | | | | | | | | | | | | | | | The function sss_nss_mc_get_record return copy of record from memory cache in last argument. Because we should not access data directly to avoid problems with consistency of record. The function sss_nss_mc_get_record also check whether length of record is within data area (with macro MC_CHECK_RECORD_LENGTH) However we also tried to do the same check in functions sss_nss_mc_get{gr, pw}* Pointer to end of strings in record was compared to pointer to the end of data table. But these two pointers are not within the same allocated area and does not make sense to compare them. Sometimes record can be allocated before mmaped area and sometime after. Sometimes it will return cached data and other time will fall back to responder. Resolves: https://fedorahosted.org/sssd/ticket/2743 Reviewed-by: Michal Židek <mzidek@redhat.com>
* mmap_cache: "Override" functions for initgr mmap cacheLukas Slebodnik2015-08-051-5/+11
| | | | | | | | | | | | | | | | | | Functions sss_mc_get_strs_offset and sss_mc_get_strs_len provides data about strings for individual memory caches (passwd, ...) Their are used in generic responder mmap cache code to find a record in mmap cache (sss_mc_find_record). Data provided from functions sss_mc_get_* are used for checking the validity of record. So in case of corrupted record the whole mmap cache can be invalidated. Functions sss_mc_get_strs_offset and sss_mc_get_strs_len did not provide data for initgroups mmap cache and therefore particular record could not be invalidated. Resolves: https://fedorahosted.org/sssd/ticket/2716 Reviewed-by: Michal Židek <mzidek@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-11 00:13:41 +0000