summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* cache_req tests: improve user and group creationPavel Březina2016-03-141-142/+118
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: use leak check in test fixturesPavel Březina2016-03-141-17/+47
| | | | | | | | | To ensure no memory is leak on long living context such as rctx. Resolves: https://fedorahosted.org/sssd/ticket/2869 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* mock domain: reset ldb errorsPavel Březina2016-03-142-1/+7
| | | | | | | | | | | | | | | | | | After ldb connect ldb context contains the following error: "NULL Base DN invalid for a base search" This comes from internal ldb function ldb_set_default_dns() which runs base search on NULL dn to discover records similar to what rootDSE provides. However, tdb backend considers this an error and sets the message above. This may break memory leak checks in tests when we do push/pop on test_ctx which is a indirect parent of ldb_context. The error message is allocated when push is called but it is freed by other ldb queries and therefore not preset during the push phase and thus the leak check fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: remove unused users and groupsPavel Březina2016-03-141-11/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: improve debuggingPavel Březina2016-03-144-50/+149
| | | | | | | | | Each debug message is matched to a specific request, this way it will be easier to follow the request flow especially when paralel request are running. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: rename debug_fqn to debugobjPavel Březina2016-03-141-20/+22
| | | | | | It is not always a name. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: break cache_req_input_create into more functionsPavel Březina2016-03-141-23/+46
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: fix typo in debug messagePavel Březina2016-03-141-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: bring together search parametersPavel Březina2016-03-141-59/+59
| | | | | | | This way it is more clear that the string parameters should not be misued when adding a new one. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_sss: reorder pam_message arraySumit Bose2016-03-141-22/+14
| | | | | | | | | | | There are different expectations about how the pam_message array is organized, details can be found in the pam_conv man page. E.g. sudo was not able to handle the Linux-PAM style but expected the Solaris PAM style. With this patch both styles should work as expected. Resolves https://fedorahosted.org/sssd/ticket/2971 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Do not call stderr with negative numberLukas Slebodnik2016-03-141-3/+5
| | | | | | | | The function connect return -1 in case of error and we could call strerror with -1 instead of errno. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Ensure we always build with C90Lukas Slebodnik2016-03-124-2/+14
| | | | | | | | | | | libipa_hbac is also used by external projects such as pam_hbac: https://github.com/jhrozek/pam_hbac In order to make sure we don't use C99 features in the libipa_hbac code in the future, this patch adds an explicit -std=c89 flag to CFLAGS. Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Move the library to src/lib/ipa_hbacJakub Hrozek2016-03-1212-18/+19
| | | | | | | | | | | Moving the library to the lib directory will force maintainers to think twice about changes, because it would be obvious this is a library. Also don't use includes from sssd source tree paths, but add the util path to Makefile's CFLAGS so that other projects can copy the hbac_evaluator.c file verbatim. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Fix typo in constant nameJakub Hrozek2016-03-121-1/+1
| | | | | | | On platforms without the format attribute, libhbac could not be compiled. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Add more debug messagesJakub Hrozek2016-03-121-3/+19
| | | | | | | Adding more debug messages proved to be useful during pam_hbac development. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Do not use C99Jakub Hrozek2016-03-121-4/+10
| | | | | | | | libipa_hbac can be used by external consumers like pam_hbac who run on old platforms that do not support C99. Refrain from using C99 features in that codebase. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CLIENT: Retry request after EPIPELukas Slebodnik2016-03-111-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a function sss_cli_check_socket which checks socket in client code. The socket is reopened in case of some issues e.g. responder terminated connections ... We use syscall poll for checking status of socket. It's not 100% reliable method because there is still chance that responder will terminate socket after this check. Here is a schema of sss_*_make_request functions: sss_cli_check_socket sss_cli_make_request_nochecks { sss_cli_send_req { poll send } sss_cli_recv_rep { poll read } } The syscall pool does not return EPIPE directly but we convert special revents from poll to EPIPE. As it was mentioned earlier, checking of socket in the sss_cli_check_socket is not 100% reliable. It can happen very rarely due to TOCTOU issue (Time of check to time of use) We can return EPIPE from the sss_cli_make_request_nochecks function in case of failure in poll in sss_cli_send_req. The send function in sss_cli_send_req can also return EPIPE is responder close socket in the same time. The send function can succeed in sss_cli_send_req but it does not mean that responder read the message. It can happen that timer for closing socket can be handled before reading a message. Therefore there is a still a chance that we might return EPIPE in case of failure in poll in sss_cli_recv_rep. Therefore we need to reconnect to responder(sss_cli_check_socket) in case of EPIPE returned from sss_cli_make_request_nochecks and try to do the same request one more time. Resolves: https://fedorahosted.org/sssd/ticket/2626 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CLIENT: Reduce code duplicationLukas Slebodnik2016-03-111-31/+27
| | | | | | Patch for #2626 will be simpler with this small refactoring Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Add a unit test for the external groups resolutionJakub Hrozek2016-03-113-4/+533
| | | | | | | | | Adds a test that tests a complex nested group hierarchy. Also defines the talloc chunk for group members to 1 to make sure the realloc branch is always tested. Unit test for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Fix warning misleading-indentationLukas Slebodnik2016-03-103-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Warnings are emited from macro generated code in dlinklist.h e.g. src/ldb_modules/memberof.c:4209:13: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_DEMOTE(ctx->group_list, grp, struct mbof_member *); ^~~~~~~~~~~~ src/ldb_modules/memberof.c:4209:13: note: ...this ‘if’ clause, but it is not src/ldb_modules/memberof.c: In function ‘mbof_member_update’: src/ldb_modules/memberof.c:4305:9: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_PROMOTE(ctx->group_list, mem); ^~~~~~~~~~~~~ src/ldb_modules/memberof.c:4305:9: note: ...this ‘if’ clause, but it is not src/ldb_modules/memberof.c: In function ‘mbof_rcmp_update’: src/ldb_modules/memberof.c:4408:9: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_REMOVE(ctx->user_list, x); ^~~~~~~~~~~~ src/util/crypto/nss/nss_obfuscate.c: In function ‘sss_password_decrypt’: src/util/crypto/nss/nss_obfuscate.c:419:5: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] SAFEALIGN_COPY_UINT16_CHECK(&meth, obfbuf+p, obflen, &p); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ src/python/pyhbac.c: In function ‘PyInit_pyhbac’: src/python/pyhbac.c:1987:5: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] TYPE_READY(m, pyhbac_hbacrule_type, "HbacRule"); ^~~~~~~~~~ src/python/pyhbac.c:1987:5: note: ...this ‘if’ clause, but it is not Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Fix indentation in dlinklist.hLukas Slebodnik2016-03-101-65/+65
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Simplify build of cwrap testsLukas Slebodnik2016-03-101-48/+7
| | | | | | It will compilation of 40 files. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Remove unused include directoriesLukas Slebodnik2016-03-101-3/+1
| | | | | | | | We do not have the "include" directory in git and such directory is not generated by autotools in build directory either. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Util Sockets: Tidy up connect() handlingSimo Sorce2016-03-091-12/+6
| | | | | | | | | | | The connect() man page says waiting on a non-blocking connect should be done by checking for writability, so drop checking for readability. Also check for EALREADY as an acceptable error to retry on. Related: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Set socket options and flags separatelySimo Sorce2016-03-091-37/+41
| | | | | | | | | | | Reorganize functions to set options and flags, all flags can be set at once, and there is no need to keep old falgs around as nothing ever used that for anything useful. Related: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Move socket setup in a common utility fileSimo Sorce2016-03-094-244/+412
| | | | | | | | | | | | | Other components may need to connect sockets, the code here is generic enough that with minimal modifications can be used for non-ldap connections too. So create a sss_sockets.c/h utility file with all the non-ldap specific socket setup functions and make them available for other uses. Resolves: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-095-0/+5
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* memberof: Don't allocate on a NULL contextJakub Hrozek2016-03-091-1/+2
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2959 In case no previous delete operation occured, the del_ctx->muops pointer we allocate the diff structure was would be NULL, effectivelly leaking the diff array during the memberof processing. Allocating on del_ctx is safer as that pointer is always allocated and prevents the leak. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: Move proxy_fast_alias to the correct man sectionJakub Hrozek2016-03-091-17/+18
| | | | | | The option was in the general section, belongs to the proxy section. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: Move subdomain_inherit to the correct man sectionJakub Hrozek2016-03-091-40/+41
| | | | | | The option was in the general section, belongs to the domain section. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Move a DEBUG message so that it's less confusingJakub Hrozek2016-03-081-2/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IDMAP: Make parameter names more descriptivePavel Reichl2016-03-021-6/+6
| | | | | | | | | | | Domain SID (not name) is part of identification string for helper range in generate_sec_slice_name(). Use more generic name for range identifier when calculating range for new slice in sss_idmap_calculate_range(). Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sdap: improve filtering of multiple results in GC lookupsSumit Bose2016-03-014-42/+238
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Global Catalog of AD contains some information about all users and groups in an AD forest. Users from different domain in the forest can have the same name. The most obvious example is the Administrator user which is present in all domains. Although SSSD uses a domain specific search base for looking up users in the GC the search might still return multiple results if there is a user with the same name in one of the child (or grand-child ...) domains because of the hierarchic nature of the LDAP tree. Limiting the search depth would not help because users can be created in deeply nested OUs. Currently SSSD expects in this case that the user object is store in CN=Users or below. This works for all default users like Administrator but in general users can be created anywhere in the directory tree. If a user is created outside of CN=Users and there is a user with the same name in a child domain the initgroups command to look up the group-memberships of the user fails because it is not clear which of the two results should be used (initgroups for the child domain user works fine). This patch adds an additional scheme to select the right result based on the domain component attribute name 'dc'. This attribute indicates an additional component in the domain name and hence a child domain. So as long as the result contains a dc component following out search base it cannot be the object we are looking for. This scheme includes the old CN=Users based one but since it is more expensive I kept the old scheme which so far worked all the time and only use the new one if the old one fails. Resolves https://fedorahosted.org/sssd/ticket/2961 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* remove user certificate if not found on the serverPavel Březina2016-03-013-1/+57
| | | | | | | | | | | | | | | | If the user is not found by cert lookup when the user is already cached, two things may happen: 1) cert was removed from the user object 2) user was removed Instead of issuing another cert lookup we will just remove cert attribute from the cache not touching the expiration timestamp so the user may be updated later when needed. Resolves: https://fedorahosted.org/sssd/ticket/2934 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IDMAP: Add minor performance improvementsPavel Reichl2016-03-011-11/+84
| | | | | | | | Some ID ranges are precalculated when ID mapping is being initialized. This patch utilizes these (helper) ranges when new domains are generated if appropriate. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CI: Use yum-deprecated instead of dnfLukas Slebodnik2016-03-012-4/+17
| | | | | | | | | /usr/bin/yum is provided by the dnf-yum package and call /usr/bin/dnf on new fedora distributions. We should directly use old style yum which was renamed to /usr/bin/yum-deprecated and is still part of the yum package. Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* GPO: Add other display managers to interactive logonStephen Gallagher2016-02-292-1/+26
| | | | | | | | Gone are the days when all systems used GDM or KDM. We need to support other display managers in the default configuration to avoid issues when enrolled in AD domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: Add Cockpit to the Remote Interactive defaultsStephen Gallagher2016-02-292-1/+8
| | | | | | | | | The Cockpit Project is an administrative console that is gaining in popularity and is a default component on some operating systems (such as Fedora Server). Since it is becoming more common, we should ensure that it is part of the standard mapping. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: invalidate override data if original view is missingSumit Bose2016-02-261-3/+13
| | | | | | | | | | | | | | If the idview name cannot be read from cache this either means that the cache was empty or the name wasn't written because of an error. In the case of an error SSSD would assume that the default view was used. If the new view is different from the default view the override data must be invalidated. Since the sysdb call to invalidate the override data would work with an empty cache as well and do nothing it is safe to call it on both cases. Related to https://fedorahosted.org/sssd/ticket/2960 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: lookup idview name even if there is no master domain recordSumit Bose2016-02-261-35/+43
| | | | | | | | | | | | | | | Currently the IPA subdomain provider returns with a error if there is no master domain record found. Since this record contains data which is only needed to create a trust with AD, like e.g. the IPA domain SID, this record is only created by ipa-adtrust-install. But the idview name is read after the master domain record. To make the idview feature work with a plain FreeIPA setup without running ipa-adtrust-install the missing master domain record should be handled gracefully and the following lookup should run as well. Resolves https://fedorahosted.org/sssd/ticket/2960 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Extend test_child_common.c to include tests for the only_extra_args ↵Jakub Hrozek2016-02-262-7/+91
| | | | | | | functionality Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use the common if-else coding styleJakub Hrozek2016-02-251-4/+2
| | | | | Reviewed-by: Petr Cech <pcech@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* build: detect endianness at configure timeDavid Disseldorp2016-02-241-0/+3
| | | | | | | | | WORDS_BIGENDIAN, HAVE_BIG_ENDIAN and HAVE_LITTLE_ENDIAN are needed by Samba. See Samba's byteorder.h header for an example. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Use the IPA provider interface to resolve external group membersJakub Hrozek2016-02-244-29/+657
| | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2522 Currently the approach is not optimized for performance, because each external member is resolved in a full transaction to make sure even ID views and similar information is processed. In future, we should implement https://fedorahosted.org/sssd/ticket/2943 we will again be able to process all the data in a single transaction. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add interface to call into IPA provider from LDAP providerJakub Hrozek2016-02-246-1/+342
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2522 Adds a pluggable interface that is able to resolve the IPA group's external members. At the moment, the request calls the full be_ interface to make sure all corner cases like id-views are handled internally. Reviewed-by: Sumit Bose <sbose@redhat.com>
* Add a new option ldap_group_external_memberJakub Hrozek2016-02-2410-0/+27
| | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Sumit Bose <sbose@redhat.com>
* TEST_TOOLS_COLONDB: Add tests for sss_colondb_*Petr Cech2016-02-242-0/+436
| | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three functions at API of colondb wrapper: * sss_colondb_open() * sss_colondb_readline() * sss_colondb_writeline() This patch adds tests for all of them. We test those cases: * open nonexisting file for read * open nonexisting file for write * open existing empty file for read * open existing file with records for read * open existing empty file for write * open existing file with records for write * write to empty file * write to file with existing records * sss_colondb_open() * sss_colondb_readline() * sss_colondb_write_line() * write to empty file and read it Resolves: https://fedorahosted.org/sssd/ticket/2764 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: Add comments on functions in colondbPetr Cech2016-02-241-0/+23
| | | | | | | | | | | | | | | | | | The colondb API provides three function: * sss_colondb_open() * sss_colondb_write_field() * sss_colondb_read_field() It is not obvious that sss_colondb_open() add destructor on talloc context which close the colondb during free context. And there is expectation that SSS_COLONDB_SENTINEL is type of last item in line. So this patch adds simple lightening comments in doxygen style. Resolves: https://fedorahosted.org/sssd/ticket/2764 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: Fix memory leak after getline() failedPetr Cech2016-02-241-0/+4
| | | | | | | | | | | | | | | | | | This patch fixes buffer freeing in case if getline() failed in function sss_colondb_readline(). ssize_t getline(char **lineptr, size_t *n, FILE *stream); If *lineptr is set to NULL and *n is set 0 before the call, then getline() will allocate a buffer for storing the line. This buffer should be freed by the user program even if getline() failed. man 3 getline This patch fix buffer freeing in case if getline() failed. Resolves: https://fedorahosted.org/sssd/ticket/2764 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TOOLS: Fix minor memory leak in sss_colondb_writelineLukas Slebodnik2016-02-241-0/+7
| | | | | | | | | | The variable line was initialized to NULL. The we created temporary context tmp_ctx. We use talloc_asprintf_append to append string to line which is initially NULL and therefore new context which was not connected to tmp_ctx. man 3 talloc_string -> talloc_asprintf_append Reviewed-by: Petr Cech <pcech@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-02 15:43:17 +0000