summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* IPA: Remove unused parameter from ipa_ext_group_member_checkLukas Slebodnik2016-04-051-2/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* CI: Use make check instead of make-check-wrapLukas Slebodnik2016-04-013-65/+13
| | | | | | | make-check-wrap had to be used due to missing LOG_COMPILER on rhel6 which is enabled with parallel test harness Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* AUTOMAKE: Force usage of parallel test harnessLukas Slebodnik2016-04-011-1/+2
| | | | | | | | | | | | | | | | | | | | Parallel test harness[1] is enabled by default with new versions of automake. However, automake on rhel6 (1.11.1-4) still uses serial test harness by default even though it also contains parallel test harness. Downside of serial test is that output of all test are mixed together and is not in separate log files as with parallel test harness. Another problem is slow execution test with valgrind due to missing parallelisation. It's approximately 4-5 minutes slower on machine with 4 CPUs. The automake option parallel-tests is kept for backward-compatibility in new versions of automake, since the parallel test harness is the default there. [1] http://www.gnu.org/software/automake/manual/html_node/Parallel-Test-Harness.html#Parallel-Test-Harness [2] http://www.gnu.org/software/automake/manual/html_node/Serial-Test-Harness.html#Serial-Test-Harness Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* GPO: log specific ini parse error messagesMichal Židek2016-03-232-2/+40
| | | | | | | | We should log error messages generated by libini if there are problems with parsing gpo files. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Allow to append new line in sss_vdebug_fnLukas Slebodnik2016-03-234-4/+12
| | | | | | | | libldb is not consistent with appending line feed in debug messages. AS a result of this two messages can be on the same line in sssd log files. Which makes analyzing log files more difficult. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Move debug part from util.h -> new debug.hLukas Slebodnik2016-03-233-118/+142
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUDO: be able to parse modifyTimestamp correctlyPavel Březina2016-03-174-29/+62
| | | | | | | | | | | | | We were unable to parse modifyTimestamp where a non-numeric part (timezone) was involved. The format is YYYYMMDDHHmmssZ. It may also contain fraction or different timezone, everytime separated from the datetime by character. This patch gets the numberic part and then appends the string part again to get value usable in filter. Resolves: https://fedorahosted.org/sssd/ticket/2970 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Responders: Fix client destructorSimo Sorce2016-03-171-4/+7
| | | | | | | | | | | | | | | | To close a socket associated to an fd event we must set the close function of the event and not associate a destructor to a parent context. Otherwise the destructor will close() the socket before the fd event is freed, and this may cause invalid calls on a closed file descriptor to poll/epoll/etc. Discovered by looking at strace output. Resolves: https://fedorahosted.org/sssd/ticket/2973 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA SUDO: support old ipasudocmd rdnPavel Březina2016-03-141-22/+103
| | | | | | | | | FreeIPA versions older than 3.1 have rdn sudoCmd instead of ipaUniqueID. Resolves: https://fedorahosted.org/sssd/ticket/2969 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: fix typoPavel Březina2016-03-141-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: remove old commentPavel Březina2016-03-141-5/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: rename cache_req_input to cache_reqPavel Březina2016-03-141-209/+203
| | | | | | The input part has no longer meaning. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: hide input and pass parameters in structPavel Březina2016-03-143-244/+308
| | | | | | This way it makes it a lot easier to add new parameters. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req test: add lookup by sidPavel Březina2016-03-141-5/+404
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add SID lookupsPavel Březina2016-03-143-15/+111
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2848 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: return const char ** from dup_string_listPavel Březina2016-03-142-4/+4
| | | | | | | This function is not used anywhere and const char ** suits better in my use case (next patch) so I just changed the function. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: improve user and group creationPavel Březina2016-03-141-142/+118
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: use leak check in test fixturesPavel Březina2016-03-141-17/+47
| | | | | | | | | To ensure no memory is leak on long living context such as rctx. Resolves: https://fedorahosted.org/sssd/ticket/2869 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* mock domain: reset ldb errorsPavel Březina2016-03-142-1/+7
| | | | | | | | | | | | | | | | | | After ldb connect ldb context contains the following error: "NULL Base DN invalid for a base search" This comes from internal ldb function ldb_set_default_dns() which runs base search on NULL dn to discover records similar to what rootDSE provides. However, tdb backend considers this an error and sets the message above. This may break memory leak checks in tests when we do push/pop on test_ctx which is a indirect parent of ldb_context. The error message is allocated when push is called but it is freed by other ldb queries and therefore not preset during the push phase and thus the leak check fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: remove unused users and groupsPavel Březina2016-03-141-11/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: improve debuggingPavel Březina2016-03-144-50/+149
| | | | | | | | | Each debug message is matched to a specific request, this way it will be easier to follow the request flow especially when paralel request are running. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: rename debug_fqn to debugobjPavel Březina2016-03-141-20/+22
| | | | | | It is not always a name. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: break cache_req_input_create into more functionsPavel Březina2016-03-141-23/+46
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: fix typo in debug messagePavel Březina2016-03-141-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: bring together search parametersPavel Březina2016-03-141-59/+59
| | | | | | | This way it is more clear that the string parameters should not be misued when adding a new one. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_sss: reorder pam_message arraySumit Bose2016-03-141-22/+14
| | | | | | | | | | | There are different expectations about how the pam_message array is organized, details can be found in the pam_conv man page. E.g. sudo was not able to handle the Linux-PAM style but expected the Solaris PAM style. With this patch both styles should work as expected. Resolves https://fedorahosted.org/sssd/ticket/2971 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Do not call stderr with negative numberLukas Slebodnik2016-03-141-3/+5
| | | | | | | | The function connect return -1 in case of error and we could call strerror with -1 instead of errno. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Ensure we always build with C90Lukas Slebodnik2016-03-124-2/+14
| | | | | | | | | | | libipa_hbac is also used by external projects such as pam_hbac: https://github.com/jhrozek/pam_hbac In order to make sure we don't use C99 features in the libipa_hbac code in the future, this patch adds an explicit -std=c89 flag to CFLAGS. Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Move the library to src/lib/ipa_hbacJakub Hrozek2016-03-1212-18/+19
| | | | | | | | | | | Moving the library to the lib directory will force maintainers to think twice about changes, because it would be obvious this is a library. Also don't use includes from sssd source tree paths, but add the util path to Makefile's CFLAGS so that other projects can copy the hbac_evaluator.c file verbatim. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Fix typo in constant nameJakub Hrozek2016-03-121-1/+1
| | | | | | | On platforms without the format attribute, libhbac could not be compiled. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Add more debug messagesJakub Hrozek2016-03-121-3/+19
| | | | | | | Adding more debug messages proved to be useful during pam_hbac development. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Do not use C99Jakub Hrozek2016-03-121-4/+10
| | | | | | | | libipa_hbac can be used by external consumers like pam_hbac who run on old platforms that do not support C99. Refrain from using C99 features in that codebase. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CLIENT: Retry request after EPIPELukas Slebodnik2016-03-111-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a function sss_cli_check_socket which checks socket in client code. The socket is reopened in case of some issues e.g. responder terminated connections ... We use syscall poll for checking status of socket. It's not 100% reliable method because there is still chance that responder will terminate socket after this check. Here is a schema of sss_*_make_request functions: sss_cli_check_socket sss_cli_make_request_nochecks { sss_cli_send_req { poll send } sss_cli_recv_rep { poll read } } The syscall pool does not return EPIPE directly but we convert special revents from poll to EPIPE. As it was mentioned earlier, checking of socket in the sss_cli_check_socket is not 100% reliable. It can happen very rarely due to TOCTOU issue (Time of check to time of use) We can return EPIPE from the sss_cli_make_request_nochecks function in case of failure in poll in sss_cli_send_req. The send function in sss_cli_send_req can also return EPIPE is responder close socket in the same time. The send function can succeed in sss_cli_send_req but it does not mean that responder read the message. It can happen that timer for closing socket can be handled before reading a message. Therefore there is a still a chance that we might return EPIPE in case of failure in poll in sss_cli_recv_rep. Therefore we need to reconnect to responder(sss_cli_check_socket) in case of EPIPE returned from sss_cli_make_request_nochecks and try to do the same request one more time. Resolves: https://fedorahosted.org/sssd/ticket/2626 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CLIENT: Reduce code duplicationLukas Slebodnik2016-03-111-31/+27
| | | | | | Patch for #2626 will be simpler with this small refactoring Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Add a unit test for the external groups resolutionJakub Hrozek2016-03-113-4/+533
| | | | | | | | | Adds a test that tests a complex nested group hierarchy. Also defines the talloc chunk for group members to 1 to make sure the realloc branch is always tested. Unit test for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Fix warning misleading-indentationLukas Slebodnik2016-03-103-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Warnings are emited from macro generated code in dlinklist.h e.g. src/ldb_modules/memberof.c:4209:13: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_DEMOTE(ctx->group_list, grp, struct mbof_member *); ^~~~~~~~~~~~ src/ldb_modules/memberof.c:4209:13: note: ...this ‘if’ clause, but it is not src/ldb_modules/memberof.c: In function ‘mbof_member_update’: src/ldb_modules/memberof.c:4305:9: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_PROMOTE(ctx->group_list, mem); ^~~~~~~~~~~~~ src/ldb_modules/memberof.c:4305:9: note: ...this ‘if’ clause, but it is not src/ldb_modules/memberof.c: In function ‘mbof_rcmp_update’: src/ldb_modules/memberof.c:4408:9: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_REMOVE(ctx->user_list, x); ^~~~~~~~~~~~ src/util/crypto/nss/nss_obfuscate.c: In function ‘sss_password_decrypt’: src/util/crypto/nss/nss_obfuscate.c:419:5: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] SAFEALIGN_COPY_UINT16_CHECK(&meth, obfbuf+p, obflen, &p); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ src/python/pyhbac.c: In function ‘PyInit_pyhbac’: src/python/pyhbac.c:1987:5: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] TYPE_READY(m, pyhbac_hbacrule_type, "HbacRule"); ^~~~~~~~~~ src/python/pyhbac.c:1987:5: note: ...this ‘if’ clause, but it is not Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Fix indentation in dlinklist.hLukas Slebodnik2016-03-101-65/+65
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Simplify build of cwrap testsLukas Slebodnik2016-03-101-48/+7
| | | | | | It will compilation of 40 files. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Remove unused include directoriesLukas Slebodnik2016-03-101-3/+1
| | | | | | | | We do not have the "include" directory in git and such directory is not generated by autotools in build directory either. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Util Sockets: Tidy up connect() handlingSimo Sorce2016-03-091-12/+6
| | | | | | | | | | | The connect() man page says waiting on a non-blocking connect should be done by checking for writability, so drop checking for readability. Also check for EALREADY as an acceptable error to retry on. Related: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Set socket options and flags separatelySimo Sorce2016-03-091-37/+41
| | | | | | | | | | | Reorganize functions to set options and flags, all flags can be set at once, and there is no need to keep old falgs around as nothing ever used that for anything useful. Related: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Move socket setup in a common utility fileSimo Sorce2016-03-094-244/+412
| | | | | | | | | | | | | Other components may need to connect sockets, the code here is generic enough that with minimal modifications can be used for non-ldap connections too. So create a sss_sockets.c/h utility file with all the non-ldap specific socket setup functions and make them available for other uses. Resolves: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-095-0/+5
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* memberof: Don't allocate on a NULL contextJakub Hrozek2016-03-091-1/+2
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2959 In case no previous delete operation occured, the del_ctx->muops pointer we allocate the diff structure was would be NULL, effectivelly leaking the diff array during the memberof processing. Allocating on del_ctx is safer as that pointer is always allocated and prevents the leak. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: Move proxy_fast_alias to the correct man sectionJakub Hrozek2016-03-091-17/+18
| | | | | | The option was in the general section, belongs to the proxy section. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MAN: Move subdomain_inherit to the correct man sectionJakub Hrozek2016-03-091-40/+41
| | | | | | The option was in the general section, belongs to the domain section. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Move a DEBUG message so that it's less confusingJakub Hrozek2016-03-081-2/+4
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IDMAP: Make parameter names more descriptivePavel Reichl2016-03-021-6/+6
| | | | | | | | | | | Domain SID (not name) is part of identification string for helper range in generate_sec_slice_name(). Use more generic name for range identifier when calculating range for new slice in sss_idmap_calculate_range(). Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sdap: improve filtering of multiple results in GC lookupsSumit Bose2016-03-014-42/+238
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Global Catalog of AD contains some information about all users and groups in an AD forest. Users from different domain in the forest can have the same name. The most obvious example is the Administrator user which is present in all domains. Although SSSD uses a domain specific search base for looking up users in the GC the search might still return multiple results if there is a user with the same name in one of the child (or grand-child ...) domains because of the hierarchic nature of the LDAP tree. Limiting the search depth would not help because users can be created in deeply nested OUs. Currently SSSD expects in this case that the user object is store in CN=Users or below. This works for all default users like Administrator but in general users can be created anywhere in the directory tree. If a user is created outside of CN=Users and there is a user with the same name in a child domain the initgroups command to look up the group-memberships of the user fails because it is not clear which of the two results should be used (initgroups for the child domain user works fine). This patch adds an additional scheme to select the right result based on the domain component attribute name 'dc'. This attribute indicates an additional component in the domain name and hence a child domain. So as long as the result contains a dc component following out search base it cannot be the object we are looking for. This scheme includes the old CN=Users based one but since it is more expensive I kept the old scheme which so far worked all the time and only use the new one if the old one fails. Resolves https://fedorahosted.org/sssd/ticket/2961 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* remove user certificate if not found on the serverPavel Březina2016-03-013-1/+57
| | | | | | | | | | | | | | | | If the user is not found by cert lookup when the user is already cached, two things may happen: 1) cert was removed from the user object 2) user was removed Instead of issuing another cert lookup we will just remove cert attribute from the cache not touching the expiration timestamp so the user may be updated later when needed. Resolves: https://fedorahosted.org/sssd/ticket/2934 Reviewed-by: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-26 23:40:01 +0000