summaryrefslogtreecommitdiffstats
path: root/src/util
Commit message (Collapse)AuthorAgeFilesLines
* SELINUX: Use getseuserbyname to get IPA seuserJustin Stephenson2017-09-062-75/+0
| | | | | | | | | | | | | | The libselinux function getseuserbyname is more reliable method to retrieve SELinux usernames then functions from libsemanage `semanage_user_query` and is recommended by libsemanage developers. Replace get_seuser function with getseuserbyname. Resolves: https://pagure.io/SSSD/sssd/issue/3308 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Petr Lautrbach <plautrba@redhat.com>
* UTIL: Add sss_create_dir()Fabiano Fidêncio2017-08-282-0/+82
| | | | | | | | | | | | | | | | | The newly added function helps us to create a new dir avoiding a possible TUCTOU issue. It's going to be used by the new session provider code. A simple test for this new function has also been provided. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: move {files,selinux}.c under util directoryFabiano Fidêncio2017-08-283-0/+911
| | | | | | | | | | | | | | | | | | | | | | | | | files.c has at least one function that will be re-used for the new session provider that's about to be added. Also, a few other functions may be added and files.c seems the right place for those. selinux.c has been moved together with files.c as the latter takes advantage of some functions from the former and we do not want to always link agains the tools code. The public functions from files.c got a "sss_" prefix and it has been changed whenever they're used. Last but not least, all the places that included "tools/tools_util.h" due to the functions on files.c had this include removed (as they were already including "util/util.h". Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Set udp_preference_limit=0 in krb5 snippetPetr Čech2017-08-142-14/+43
| | | | | | | | | | | | | We add udp_preference_limit = 0 to krb5 snippet if ad provider is used. This option enable TCP connection before UDP, when sending a message to the KDC. Resolves: https://pagure.io/SSSD/sssd/issue/3254 Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* Moving headers used by both server and client to special folderAmitKumar2017-08-037-205/+5
| | | | | | | | | | | | | | | | | | | These are the header files which are used by both client and server: src/util/io.h src/util/murmurhash3.h src/util/util_safealign.h This patch is about moving these header files to special folder (src/shared). It will be easier to identify these headers when looking for them in the src tree. util_safalign.h is renamed as safalign.h because util_ namespace is appropriate when this file belonged to the util's folder which is no longer the case. Resolves: https://pagure.io/SSSD/sssd/issue/1898 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Add session recording conf management moduleNikolai Kondrashov2017-07-272-0/+189
| | | | | | | Add an util module for loading session recording configuration. To be used by responders and data provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CRYPTO: Do not call NSS_Shutdown after every operationJakub Hrozek2017-07-242-4/+0
| | | | | | | | | | | | | | Calling setup and teardown on every encryption cases issues like the one described in https://bugzilla.redhat.com/show_bug.cgi?id=1456151 eventually. Similarly to other crypto functions, don't tear down NSS by calling NSS_Shutdown. Let the OS reclaim the resources. Resolves: https://pagure.io/SSSD/sssd/issue/3424 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: temporary increase hardcoded buffersLukas Slebodnik2017-07-241-1/+1
| | | | | | | Temporary workaround: https://pagure.io/SSSD/sssd/issue/3386 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DOMAIN: Add sss_domain_info_{get,set}_output_fqnames()Fabiano Fidêncio2017-06-213-1/+17
| | | | | | | | | | | | | | | | | Let's avoid setting a domain's property directly from cr_domain code. In order to do so, let's introduce a setter, which may help us in the future whenever we decide to make sss_domain_info an opaque structure. For completeness, a getter has also been introduced and used in the usertools code. Related: https://pagure.io/SSSD/sssd/issue/3403 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDER: Use fqnames as output when neededFabiano Fidêncio2017-06-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | As some regressions have been caused by not handling properly naming conflicts when using shortnames, last explicitly use fully qualified names as output in the following situations: - domain resolution order is set; - a trusted domain has been using `use_fully_qualified_name = false` In both cases we want to ensure that even handling shortnames as input, the output will always be fully qualified. As part of this patch, our tests ended up being modified to reflect the changes done. In other words, the tests related to shortnames now return expect as return a fully qualified name for trusted domains. Resolves: https://pagure.io/SSSD/sssd/issue/3403 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Remove limits.h from util/util.hLukas Slebodnik2017-06-082-1/+1
| | | | | | | | limits.h is not used directly by util/util.h. The header file limits.h must be included in 17 files and after removing it from util.h it had to be added only to 4 missing files Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Remove ctype.h from util/util.hLukas Slebodnik2017-06-084-1/+3
| | | | | | | | ctype.h is not used directly by util/util.h. The header file ctype.h must be included in 32 files and after removing it from util.h it had to be added only to 8 missing files Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Remove string{,s}.hLukas Slebodnik2017-06-081-2/+0
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Remove fcntl.h from util/util.hLukas Slebodnik2017-06-084-1/+8
| | | | | | | | | fcntl.h is not used directly by util/util.h. The header file fcntl.h must be included in 49 files and after removing it from util.h it had to be added only to 7 missing file which were using either directly syscall fcntl or syscall open. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Remove signal.h from util/util.hLukas Slebodnik2017-06-084-2/+3
| | | | | | | | signal.h is not used directly by util/util.h. The header file signal.h must be included in 19 files and after removing it from util.h it had to be added only to 12 missing files. And util.util.h is included in 381 files Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Remove signal.h from util/util.hLukas Slebodnik2017-06-082-1/+2
| | | | | | | | signal.h is not used directly by util/util.h. The header file signal.h must be included in 8 files and removing it from util.h it had to be added only to 5 missing file. But util/util.h is include in 377 files Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Remove few unused headed filesLukas Slebodnik2017-06-081-2/+0
| | | | | | They are not required for any prototype in util/util.h Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* VALIDATORS: Detect inherit_from in normal domainMichal Židek2017-05-311-1/+52
| | | | | | | | | | | | This patch adds new sssd specific validator. In the future we can add more checks in it, but currently it only checks if the option inherit_from is used on normal domain and reports error if it is. Resolves: https://pagure.io/SSSD/sssd/issue/3356 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Drop unused error code ERR_MISSING_CONFLukas Slebodnik2017-05-232-2/+0
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Move output name formatting to utilsNikolai Kondrashov2017-05-102-0/+76
| | | | | | | Move NSS nss_get_name_from_msg and the core of sized_output_name to the utils to make them available to provider and other responders. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* utils: add sss_domain_is_forest_root()Sumit Bose2017-04-282-0/+6
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3361 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Use max 15 characters for AD host UPNLukas Slebodnik2017-04-121-1/+7
| | | | | | | | | | | | | | | | | We do not want to use host principal with AD "host/name.domain.tld@DOMAIN.TLD" because it does not work. We need to use correct user principal for AD hosts. And we cannot rely all fallback "*$" because of other principals in keytab. The NetBIOS naming convention allows for 16 characters in a NetBIOS name. Microsoft, however, limits NetBIOS names to 15 characters and uses the 16th character as a NetBIOS suffix. https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-character-of-the-netbios-name Resolves: https://pagure.io/SSSD/sssd/issue/3329 Reviewed-by: Michal Židek <mzidek@redhat.com>
* selinux: Do not fail if SELinux is not managedMichal Židek2017-04-063-22/+41
| | | | | | | | | | | Previously we failed if semanage_is_managed returned 0 or -1 (not managed or error). With this patch we only fail in case of error and continue normally if selinux is not managed by libsemanage at all. Resolves: https://fedorahosted.org/sssd/ticket/3297 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libsss_certmap: Accept certificate with data before headerDavid Kupka2017-04-031-4/+5
| | | | | | | | | | | | | According to RFC 7468 parser must not fail when some data are present before the encapsulation boundary. sss_cert_pem_to_der didn't respect this and refused valid input. Changing it's code to first locate the certificate header fixes the issue. Resolves: https://pagure.io/SSSD/sssd/issue/3354 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sss_iobuf: fix 'read' shadows a global declarationPavel Březina2017-03-301-3/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tcurl: add support for http basic authPavel Březina2017-03-302-0/+39
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl: add support for ssl and raw outputPavel Březina2017-03-304-355/+651
| | | | | | | | | | | | | | At first, this patch separates curl_easy handle from the multi-handle processing and makes it encapsulated in custom tcurl_request structure. This allows us to separate protocol initialization from its asynchonous logic which gives us the ability to set different options for each request without over-extending the parameter list. In this patch we implement options for peer verification for TLS-enabled protocols and to return response with body and headers together. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONFDB: Introduce SSSD domain type to distinguish POSIX and application domainsJakub Hrozek2017-03-302-0/+15
| | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new option that allows to distinguish domains that do contain POSIX users and groups and those that don't. The POSIX domains are the default. The non-POSIX domains are selected by selecting an "application" type domain. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Expose replace_char() as sss_replace_char()Fabiano Fidêncio2017-03-292-6/+11
| | | | | | | | | | | | | | | This method is going to be used in the follow-up patch for replacing ',' by ':' so we can keep the domain resolution order option consitent with the way it's set on IPA side and still keep consistent with the way lists are represented on sssd.conf file. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DLINKLIST: Add DLIST_FOR_EACH_SAFE macroFabiano Fidêncio2017-03-291-0/+5
| | | | | | | | | | | This macro, as DLIST_FOR_EACH, iterates over the whole list. The main difference between both is that in the _SAFE version the pointer to the next list node is stored, allowing us to delete the current node safely. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Introduce subdomain_create_conf_path()Michal Židek2017-03-292-0/+18
| | | | | | | | | | This is a utility function that replaces the create_subdom_conf_path(). Differently than the latter, it only takes one parameter and is going to be used in a few different places (thus adding it to util.h). Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukas Slebodnik <lslebodn@redhat.com>
* KCM: Store ccaches in secretsJakub Hrozek2017-03-272-0/+4
| | | | | | | | Adds a new KCM responder ccache back end that forwards all requests to sssd-secrets. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* TCURL: Support HTTP POST for creating containersJakub Hrozek2017-03-272-0/+8
| | | | | | | | The curl integration must allow us to create containers, therefore we also add support of the POST HTTP request type. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* KCM: Initial responder build and packagingJakub Hrozek2017-03-272-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds the initial build of the Kerberos Cache Manager responder (KCM). This is a deamon that is capable of holding and storing Kerberos ccaches. When KCM is used, the kerberos libraries (invoked through e.g. kinit) are referred to as a 'client' and the KCM deamon is referred to as 'server'. At the moment, only the Heimdal implementation of Kerberos implements the KCM server: https://www.h5l.org/manual/HEAD/info/heimdal/Credential-cache-server-_002d-KCM.html This patch adds a KCM server to SSSD. In MIT, only the 'client-side' support was added: http://k5wiki.kerberos.org/wiki/Projects/KCM_client This page also describes the protocol between the client and the server. The client is capable of talking to the server over either UNIX sockets (Linux, most Unixes) or Mach RPC (macOS). Our server only implements the UNIX sockets way and should be socket-activated by systemd, although can in theory be also ran explicitly. The KCM server only builds if the configuration option "--with-kcm" is enabled. It is packaged in a new subpackage sssd-kcm in order to allow distributions to enable the KCM credential caches by installing this subpackage only, without the rest of the SSSD. The sssd-kcm subpackage also includes a krb5.conf.d snippet that allows the admin to just uncomment the KCM defaults and instructs them to start the socket. The server can be configured in sssd.conf in the "[kcm]" section. By default, the server only listens on the same socket path the Heimdal server uses, which is "/var/run/.heim_org.h5l.kcm-socket". This is, however, configurable. The file src/responder/kcm/kcm.h is more or less directly imported from the MIT Kerberos tree, with an additional sentinel code and some comments. Not all KCM operations are implemented, only those that also the MIT client implements. That said, this KCM server should also be usable with a Heimdal client, although no special testing was with this hybrid. The patch also adds several error codes that will be used in later patches. Related to: https://pagure.io/SSSD/sssd/issue/2887 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: krb5 principal (un)marshallingJakub Hrozek2017-03-272-0/+204
| | | | | | | | | | | | | | The KCM responder needs to read the contents of the principal blob that the Kerberos library sends. Since libkrb5 doesn't export any API to do so, we need to implement marshalling and unmarshalling of the principal ourselves. In future, when the KCM server also supports renewals, we will also need to unmarshall the credentials, but until that is not really needed, the credentials will be stored as a blob. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Add type-specific getsetters to sss_iobufJakub Hrozek2017-03-272-0/+141
| | | | | | | | | The KCM responder receives its input as unstructured data. To make the parsing easier, this commit adds several type-specific getsetters to the iobuf module. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Add utility macro cli_creds_get_gid()Jakub Hrozek2017-03-271-0/+1
| | | | | | | | | | The KCM responder checks the owneship of the ccache based on both UID and GID of the peer. In order to reuse the already existing creds structure, let's just add a new macro that returns the GID from the creds structure. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Add SAFEALIGN_COPY_UINT8_CHECKJakub Hrozek2017-03-271-0/+6
| | | | | | | This macro will be used later in the KCM code Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: iobuf: Make input parameter for the readonly operation constJakub Hrozek2017-03-272-2/+2
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* sss_cert_derb64_to_ldap_filter: add sss_certmap supportSumit Bose2017-03-232-11/+68
| | | | | | | | | | Use certificate mapping library if available to lookup a user by certificate in LDAP. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* util: move string_in_list to util_extSumit Bose2017-03-232-20/+22
| | | | | | | | | | To be able to include string_in_list() without additional dependencies it is moved into a separate file. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* split_on_separator: move to a separate fileSumit Bose2017-03-232-93/+121
| | | | | | | | | | To be able to include split_on_separator() without additional dependencies (only talloc), it is moved into a separate file. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Typo in commentMichal Židek2017-03-171-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a libtevent libcurl wrapperJakub Hrozek2017-03-142-0/+1044
| | | | | | | | | Adds a request that enables the caller to issue an asynchronous request with libcurl. Currently only requests towards UNIX sockets are supported. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a generic iobuf moduleJakub Hrozek2017-03-142-0/+323
| | | | | | | | | | | | | | | | | The KCM responder reads bytes and writes bytes from a buffer of bytes. Instead of letting the caller deal with low-level handling using the SAFEALIGN macros, this patch adds a new iobuf.c module with more high-level functions. The core is a iobuf struct that keeps track of the buffer, its total capacity and a current read or write position. There are helper function to read or write a generic buffer with a set length. Later, we will also add convenience functions to read C data types using the SAFEALIGN macros. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a new macro SAFEALIGN_MEMCPY_CHECKJakub Hrozek2017-03-141-0/+6
| | | | | | | We will use it later in the KCM server Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: first letter of user name template for override_homedirIgnacio Reguero2017-03-071-0/+17
| | | | | | | Resolves: https://pagure.io/SSSD/sssd/issue/2668 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Sanitize newline and carriage return characters.Victor Tapia2017-03-071-0/+10
| | | | | | | | | | Introducing valid usernames with a trailing newline character triggers the removal of valid LDB cache entries. Resolves: https://pagure.io/SSSD/sssd/issue/3317 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* authtok: enhance support for Smartcard auth blobsSumit Bose2017-02-234-11/+540
| | | | | | | | | The blobs contains beside the PIN the name of the PKCS#11 module and the token name where the certificate of the user was found and the key id. Those data will be used e.g. by the pkinit module to make sure them right certificate is used. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: new error codesSumit Bose2017-02-232-0/+4
| | | | | | | | ERR_SC_AUTH_NOT_SUPPORTED can be used by backends to indicate that Smartcard authentication is not supported. ERR_NO_AUTH_METHOD_AVAILABLE can be used by backends that no authentication method was found. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2026-04-20 23:33:56 +0000