summaryrefslogtreecommitdiffstats
path: root/src/sss_client/common.c
Commit message (Collapse)AuthorAgeFilesLines
* CLIENT: Retry request after EPIPELukas Slebodnik2016-03-111-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a function sss_cli_check_socket which checks socket in client code. The socket is reopened in case of some issues e.g. responder terminated connections ... We use syscall poll for checking status of socket. It's not 100% reliable method because there is still chance that responder will terminate socket after this check. Here is a schema of sss_*_make_request functions: sss_cli_check_socket sss_cli_make_request_nochecks { sss_cli_send_req { poll send } sss_cli_recv_rep { poll read } } The syscall pool does not return EPIPE directly but we convert special revents from poll to EPIPE. As it was mentioned earlier, checking of socket in the sss_cli_check_socket is not 100% reliable. It can happen very rarely due to TOCTOU issue (Time of check to time of use) We can return EPIPE from the sss_cli_make_request_nochecks function in case of failure in poll in sss_cli_send_req. The send function in sss_cli_send_req can also return EPIPE is responder close socket in the same time. The send function can succeed in sss_cli_send_req but it does not mean that responder read the message. It can happen that timer for closing socket can be handled before reading a message. Therefore there is a still a chance that we might return EPIPE in case of failure in poll in sss_cli_recv_rep. Therefore we need to reconnect to responder(sss_cli_check_socket) in case of EPIPE returned from sss_cli_make_request_nochecks and try to do the same request one more time. Resolves: https://fedorahosted.org/sssd/ticket/2626 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CLIENT: Reduce code duplicationLukas Slebodnik2016-03-111-31/+27
| | | | | | Patch for #2626 will be simpler with this small refactoring Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix minor typosYuri Chornoivan2015-07-231-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Use unique lock for memory cacheLukas Slebodnik2015-07-031-0/+20
| | | | | | | | | | | | Previously the sma lock was used as for communication with responder. However it would cause a deadlock in case of re-checking memcache after acquiring the lock and before communication with responder.. Required by: https://fedorahosted.org/sssd/ticket/2581 Reviewed-by: Michal Židek <mzidek@redhat.com>
* CLIENT: Clear errno with enabled sss-default-nss-pluginLukas Slebodnik2015-04-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although errno was cleared in function sss_nss_make_request some sss glic functions set errno with value of output argument errnop. Reproducer: * sssd compiled with enabled option sss-default-nss-plugin * sss is the last value in group (/etc/nsswitch.conf) * sssd-client is installed but sssd is stopped. C-program: #include <stdio.h> #include <stdlib.h> #include <errno.h> #include <grp.h> int main(int argc, char *argv[]) { struct group *p_group; setgrent(); while (1) { errno = 0; /* initialize for getgrent() */ p_group = getgrent(); if (p_group == NULL) { if (errno == 0) { break; /* end of groups */ } else { perror("getgrent"); printf("getgrent error %d \n", errno); endgrent(); exit(-2); } } printf("getgrent() OK group(%d) = %s \n", p_group->gr_gid, p_group->gr_name); } exit(0); } Resolves: https://fedorahosted.org/sssd/ticket/2619 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Open the PAC socket from krb5_child before dropping rootJakub Hrozek2015-01-211-0/+13
| | | | | | | | | | The PAC responder by default allows only connections from the root user. This patch opens the socket to the PAC responder before the krb5_child drops privileges so the connection seemingly comes from root. https://fedorahosted.org/sssd/ticket/2559 Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_client: Work around glibc bugLukas Slebodnik2014-12-081-0/+10
| | | | | | | | | | | | | | | | | | glibc is inconsistent with how it treats and returns NSS_STATUS_UNAVAIL. The sss nss plugin is present in nsswitch by default on some platforms due to glibc caching and problem with long living applications (e.g. GNOME). But sssd needn't be configuread and it cause problems in some programs. In this situation, the SSSD nss plugin should behave as if it was functioning but had no data even thought sssd is not running. The errors have to be passed from nss plugin up to the user with minimal moidiffication. Thanks to Stephen Gallagher for initial patch. Resolves: https://fedorahosted.org/sssd/ticket/2439 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Use pattern #elif defined(identifier)Lukas Slebodnik2014-03-141-2/+2
| | | | | | | | | | | | | | We had in source code following pattern #elif HAVE_<name> It worked because undefined identifier(in some cases) was evaluated to 0. But we do not care about value of HAVE_SOMETHING. We just need to know whether identifier was defined. There is not equivalent to #ifdef (short for of #if definded) We need to use long form: #elif defined HAVE_<name> It causes also compiler warning with enabled compiler flag -Wundef. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sss_client: Use SAFEALIGN_COPY_<type> macros where appropriate.Michal Zidek2013-12-031-1/+1
| | | | | resolves: https://fedorahosted.org/sssd/ticket/1359
* CLIENT: Fix non gnu sss_strnlen implementationLukas Slebodnik2013-08-281-1/+1
| | | | | | last argument of function sss_strnlen "size_t *len" is output variable. We need to increment value of size_t being pointed to by pointer instead of incrementing pointer.
* Fix errors reported by rpmlintJan Cholasta2012-11-221-3/+2
|
* PAM: fix handling the client fd in pam destructorJakub Hrozek2012-10-121-5/+12
| | | | | * Protect the fd with a mutex when closing * Set it to a safe value after closing
* PAM: close socket fd with pam_set_dataJakub Hrozek2012-10-111-0/+6
| | | | https://fedorahosted.org/sssd/ticket/1569
* do not fail if POLLHUP occurs while reading dataPavel Březina2012-10-101-1/+9
| | | | | | | | | | | This cause troubles when we send data to a pipe and close the file descriptor before data is read. The pipe is still readable, but POLLHUP is detected and we fail to read them. For example, this may cause a user beeing unable to log in. Now if POLLHUP appears, we read the pipe and then close it on the client side too.
* Use PTHREAD_MUTEX_ROBUST to avoid deadlock in the clientJakub Hrozek2012-08-271-6/+90
| | | | https://fedorahosted.org/sssd/ticket/1460
* Fix uninitialized valuesNick Guay2012-07-181-1/+1
| | | | https://fedorahosted.org/sssd/ticket/1379
* PAC client: add basic support in common client codeSumit Bose2012-06-211-0/+33
|
* Do not send SIGPIPE on disconnectionShantanu Goel2012-06-181-6/+21
| | | | | | | | Note we set MSG_NOSIGNAL to avoid having to fiddle with signal masks but also do not want to die in case SIGPIPE gets raised and the application does not handle it.
* Set return errno to the value prior to calling close().Shantanu Goel2012-06-181-2/+2
|
* SSH: Common client codeJan Cholasta2012-02-071-0/+19
|
* AUTOFS: a client libraryJakub Hrozek2012-02-051-0/+20
| | | | | | | | | | | | | | | This is the library the autofs client is using. automounter dlopen()s the library so there is no header file, no pkgconfig file and the library is in the libsss_autofs package, not in -devel. The library provides the following interface: * _sss_setautomntent() - select the map for processing * _sss_getautomntent_r() - iterates through key/value pairs in the selected map. The key is usually the mount point, the value is mount information (server:/export) * _sss_getautomntbyname_r() - returns value for a specific key. * _sss_endautomntent() deselect a map, clean up
* NSS: Add sss_readrep_copy_stringStephen Gallagher2012-01-181-0/+30
| | | | | | | There were many places in the client code where we were duplicating a loop to copy data in from the response buffer. This patch turns those loops into a function for easier maintenance and easier-to-read *readrep() routines.
* SUDO integration - client common interfacePavel Březina2011-12-161-0/+18
|
* Fixed implicit declaration of function 'time' in src/sss_client/common.c.Pavel Březina2011-08-081-0/+1
|
* sss_client: avoid leaking file descriptorsSimo Sorce2011-07-291-0/+3
| | | | | | | | | | If a pam or nss module is dlcolse()d and unloaded we were leaking the file descriptor used to communicate to sssd in the process. Make sure the fucntion used to close the socket file descriptor is called on dlclose() Silence autoconf 2.28 warnings (Patch by Jakub Hrozek)
* Set _GNU_SOURCE globallySumit Bose2011-05-231-3/+1
|
* clients: use poll instead of selectSimo Sorce2011-05-031-9/+6
| | | | | | | select is limited to fd numbers up to 1024, we need to use poll() here to avoid causing memory corruption in the calling process. Fixes: https://fedorahosted.org/sssd/ticket/861
* Use neutral name for functions used by both pam and nssSimo Sorce2011-02-111-48/+62
|
* Check that the socket is really ours before attempting to close it.Simo Sorce2011-02-081-13/+42
| | | | Fixes: https://fedorahosted.org/sssd/ticket/790
* Fix another possible memory leak in sss_nss_recv_rep()Sumit Bose2010-12-151-8/+19
| | | | https://fedorahosted.org/sssd/ticket/723
* Fix possible memory leak in sss_nss_recv_rep()Sumit Bose2010-12-141-8/+13
| | | | https://fedorahosted.org/sssd/ticket/723
* sss_client: make code thread-safeSimo Sorce2010-11-221-8/+60
| | | | | | | | | | Add mutexes around nss operations and serialize them. This is necessary because nss operations may have global state. For pam it is sufficient to protect socket operations instead. As pam functions use only the provided pam handler. Fixes: https://fedorahosted.org/sssd/ticket/640
* Fix incorrect type comparisonStephen Gallagher2010-11-151-1/+1
| | | | https://fedorahosted.org/sssd/ticket/657
* Add utility function sss_strnlen()Stephen Gallagher2010-10-131-0/+29
| | | | This is useful for guaranteeing the size of an input buffer.
* Allow sssd clients to reconnectSumit Bose2010-07-231-4/+3
| | | | | | | Currently the PAM and NSS client just return an error if there are problems on an open socket. This will lead to problems in long running programs like gdm if sssd is restarted, e.g. during an update. With this patch the socket is closed and reopened.
* Properly handle read() and write() throughout the SSSDStephen Gallagher2010-06-101-0/+16
| | | | | | | We need to guarantee at all times that reads and writes complete successfully. This means that they must be checked for returning EINTR and EAGAIN, and all writes must be wrapped in a loop to ensure that they do not truncate their output.
* Use SO_PEERCRED on the PAM socketSumit Bose2010-04-161-1/+80
| | | | | | | | | | | | | | | | | This is the second attempt to let the PAM client and the PAM responder exchange their credentials, i.e. uid, gid and pid. Because this approach does not require any message interchange between the client and the server the protocol version number is not changed. On the client side the connection is terminated it the responder is not run by root. On the server side the effective uid and gid and the pid of the client are available for future use. The following additional changes are made by this patch: - the checks of the ownership and the permissions on the PAM sockets are enhanced - internal error codes are introduced on the client side to generate more specific log messages if an error occurs
* Revert "Add better checks on PAM socket"Sumit Bose2010-04-161-122/+4
| | | | This reverts commit 5a88e963744e5da453e88b5c36499f04712df097.
* Fixed buffer alignment in exchange_credentials().George McCollister2010-03-151-5/+9
| | | | | | buf needs to be 32 bit aligned on ARM. Also made the fix on the server side. Signed-off-by: George McCollister <George.McCollister@gmail.com>
* Add better checks on PAM socketSumit Bose2010-03-111-4/+118
| | | | | - check if the public socket belongs to root and has 0666 permissions - use a SCM_CREDENTIALS message if available
* Rename server/ directory to src/Stephen Gallagher2010-02-181-0/+669
Also update BUILD.txt
generated by cgit (git 2.34.1) at 2024-06-03 17:11:57 +0000