summaryrefslogtreecommitdiffstats
path: root/src/util
Commit message (Collapse)AuthorAgeFilesLines
* cert_to_ssh_key: properly add leading 0 to bignumsSumit Bose2016-07-071-8/+24
| | | | | | | | In the ssh keys a leading 0 is added to the bignums of the RSA modulus and exponent if the leading bit is set to avoid the interpretation as a negative number. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssctl: Add config-check commandMichal Židek2016-07-071-2/+0
| | | | | | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2269 sssctl sconfig-check command allows to call SSSD config file validators on demand. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_ini: Small refacoring of sss_ini_call_validatorsMichal Židek2016-07-072-11/+146
| | | | | | | Separate logic to fill errobj so that the errors can be printed by the caller. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Remove unused functionsJakub Hrozek2016-07-073-144/+0
| | | | | | The conversion to sysdb made several functions obsolete. Remove them. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Parse internal fqnames in find_domain_by_object_nameJakub Hrozek2016-07-071-2/+2
| | | | | | | Previously, the sss_parse_name function was used. That function is meant to parse SSSD input, mainly in responders, not internal object names. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Qualify user and group names when saving the sudo usersJakub Hrozek2016-07-072-0/+34
| | | | | | | | | | | | | | | If the sudoUser values we fetch from LDAP correspond to a user or a group name per: http://www.sudo.ws/man/1.8.14/sudoers.ldap.man.html then we parse the usernames into (name,domain) tuples and store them qualified. This patch not only makes the sudo provider work with qualified names, but also makes it possible to use qualified names on the LDAP side, allowing for example AD users from different domains to access sudo rules. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: expand_homedir_template manages usernames internallyJakub Hrozek2016-07-072-5/+22
| | | | | | | | | expand_homedir_template() can be considered an outward-facing interface, therefore the function and its input structure will accept the internal name format and parse it internally into a username and domain component. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add a utility function sss_output_nameJakub Hrozek2016-07-072-0/+46
| | | | | | | | | | Adds a convenience function that will help reduce the amount of code duplication in the responders. All responders need to parse the username from the internal format, lower-case the name, if the domain is case-insensitive and then replace spaces if the responder is configured to do so. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add a utility function to create a list of qualified namesJakub Hrozek2016-07-072-0/+40
| | | | | | | Adds a convenience wrapper around sss_create_fqname that qualifies a list of names into the format used internally in sssd. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add function to create internal fqnameMichal Zidek2016-07-072-0/+31
| | | | | | | Add function to create internal fqname in format shortname@domname where domain portion is lowercased. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add function to parse internal fqname formatMichal Zidek2016-07-074-0/+64
| | | | | | | | Add lightweight function to parse internal fqname format (shortname@domain). This function does not require the sss_names to be initialized. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA/AD: globally set krb5 canonicalization flagSumit Bose2016-07-062-2/+48
| | | | | | | | | | | If Kerberos principal canonicalization is configured in SSSD, currently it is the default for the IPA provider, a configuration snippet is generated for the system-wide libkrb5 configuration so that all kerberized applications will use canonicalization by default. Resolves https://fedorahosted.org/sssd/ticket/3041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: add sss_write_krb5_snippet_common()Sumit Bose2016-07-061-23/+47
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* localauth: remove enable_only sssd from config snippetSumit Bose2016-07-061-2/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2788 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a ↵Jakub Hrozek2016-07-012-0/+2
| | | | | | | | | | | | | | | | | | | | local user If an IPA client uses the SSH integration and a local user logs in with SSH, the sss_ssh_authorizedkeys looks up their keys in the SSH responder, which doesn't find the user and returns ENOENT. The sss_ssh_authorizedkeys reports a failure on any error, including ENOENT which produced a confusing error message in the logs. This patch adds a new error code that handles users that are not found by SSSD but exist on the system and also special cases root with the same error code. Therefore, logging in as a local user no longer prints an error message. Resolves: https://fedorahosted.org/sssd/ticket/3003 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* config: Fix filename matching regexMichal Židek2016-07-011-1/+1
| | | | | | | | Configuration file snippets must end with suffix .conf. We wrongly allowed any suffixes that begin with .conf (for example .conf.back). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Fix warning Wmissing-bracesLukas Slebodnik2016-07-011-1/+2
| | | | | | | | | | | | | | | | | | | Older versions of gcc does not like initialisation of struct sigevent because the first member of structure is union (sigval_t) src/util/util_watchdog.c: In function 'setup_watchdog': src/util/util_watchdog.c:77:12: warning: missing braces around initializer [-Wmissing-braces] struct sigevent sev = { 0 }; ^ src/util/util_watchdog.c:77:12: warning: (near initialization for 'sev.sigev_value') [-Wmissing-braces] src/util/util_watchdog.c:77:12: warning: initialization makes integer from pointer without a cast src/util/util_watchdog.c:77:12: warning: (near initialization for 'sev.sigev_value.sival_int') Reviewed-by: Sumit Bose <sbose@redhat.com>
* Monitor: Add mode to generate confdb onlySimo Sorce2016-06-291-0/+1
| | | | | | | | | | With this mode we can add socket activated services and have systemd pre exec sssd to genrate the configuration file w/o starting the whole sssd if not necessary. https://fedorahosted.org/sssd/ticket/2243 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Secrets: Add encryption at restSimo Sorce2016-06-298-202/+966
| | | | | | | Generates a master key file if it doesn't exist and encrypts secrets using the master key contained in the file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Server: Enable Watchdog in all daemonsSimo Sorce2016-06-291-0/+16
| | | | | | | | | | This allows the services to self monitor. Related: https://fedorahosted.org/sssd/ticket/2921 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Util: Add watchdog helperSimo Sorce2016-06-292-0/+145
| | | | | | | | | | | | | | | | | | The watchdog uses a kernel timer to issue a signal to the process. It checks if the ticker is not being reset by the main event loop, which would indicate that the process got stuck. At the same time it sets a tevent timer to clear the watchdog ticker, so that the watchdog handler is kept happy. If the watchdog detects that the timer event failed to reset the watchdog for three times in a row then the process is killed. Normally the monitor will detect the child terminated and will rescheduled it. Related: https://fedorahosted.org/sssd/ticket/2921 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Downcast to errno_t after tevent_req_is_errorLukas Slebodnik2016-06-291-2/+7
| | | | | | | | | | | | | Functions tevent_req_is_error and _tevent_req_error use type uint64_t for error code. SSSD uses errno_t which is an alias for int. Therefore complier assumes that macro TEVENT_REQ_RETURN_ON_ERROR can return 0 due to implicit down casting from uint64_t -> int. This patch makes down casting explicit and returns EINVAL if result of downcasting is 0. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Revent connection handling in sssd_async_connect_sendLukas Slebodnik2016-06-281-1/+9
| | | | | | | | | | | | | | | | | | | | | Even though the connect() man page says waiting on a non-blocking connect should be done by checking for writability, we need to check also for readability. Otherwise it slightly break offline mode. Changing password in offline mode is not supported by sssd and error message "System is offline, password change not possible" is printed. However without TEVENT_FD_READ for connect it takes much longer when sssd finds out that it cannot connect to a server. It fails after expiration of timeout (6 seconds). But meanwhile "passwd user" finished without logging the offline message. With TEVENT_FD_READ, connect fails much faster with errno 113/No route to host. The change was introduced in the commit e05d3f5872263aadfbc2f6a2a8c9735219922387 Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Fix debug message in sssd_async_connect_doneLukas Slebodnik2016-06-281-0/+1
| | | | | | | | | | Function strerror does not expect negative values. There should be errno. [sssd_async_connect_done] (0x0020): connect failed [-1][Unknown error 18446744073709551615]. Reviewed-by: Simo Sorce <simo@redhat.com>
* confdb: Check for config file errors on sssd startupMichal Židek2016-06-272-2/+51
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2028 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* confdb: Make it possible to use config snippetsMichal Židek2016-06-272-2/+63
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2247 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ERRORS: Add errors to indicated whether SSSD is running or notPavel Březina2016-06-272-0/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Shortcut looking up for group members soonerJakub Hrozek2016-06-232-0/+2
| | | | | | | | | | | | | | | | This patch is a performance enhancement. When looking for entries to refresh, we always looked up all members in the cache, even if we ended up dereferencing the whole group. If we are about to try dereference, it makes sense to shortcut the lookups after the dereference threshold is reached. In that case, the split_members function returns a special error code and the caller just dereferences the whole group. Only if dereference fails, we fall back to looking up all members so that we can look them up one-by-one. Also adds an integration test to make sure the dereference code works. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Search the timestamp caches in addition to the sysdb cacheJakub Hrozek2016-06-232-0/+4
| | | | | | | | | | | | | | | When a sysdb entry is searched, the sysdb cache is consulted first for users or groups. If an entry is found in the sysdb cache, the attributes from the timestamp cache are merged to return the full and up-to-date set of attributes. The merging is done with a single BASE search which is a direct lookup into the underlying key-value database, so it should be relatively fast. More complex merging is done only for enumeration by filter which is currently done only via the IFP back end and should be quite infrequent, so I hope we can justify a more complex merging there. Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Add error codes for sysdb too old or too newJakub Hrozek2016-06-232-0/+4
| | | | | | | We used really strange errno codes for detecting whether the database is too old or too new. We should use our sssd-specific error coded instead. Reviewed-by: Sumit Bose <sbose@redhat.com>
* ERRORS: Add ERR_MISSING_DP_TARGETPavel Březina2016-06-202-0/+2
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ERRORS: Add ERR_INVALID_DATA_TYPEPavel Březina2016-06-202-0/+2
| | | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ERRORS: Add ERR_TERMINATEDPavel Březina2016-06-202-0/+2
| | | | | | | | To indicate that data provider request was unexpectedly terminated. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ERRORS: Add ERR_OFFLINEPavel Březina2016-06-202-0/+2
| | | | | | | | To indicate that backend is offline. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Remove braces from DEBUG statementsPavel Březina2016-06-181-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DEBUG: Add `debug` alias for debug_levelStephen Gallagher2016-06-161-1/+14
| | | | | | | | | | | | | Our users constantly make the mistake of typing `debug = 9` in the sssd.conf instead of `debug_level = 9` as would be correct. This happens frequently-enough that we should just alias it rather than continue to have people make mistakes. Resolves: https://fedorahosted.org/sssd/ticket/2999 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Petr Cech <pcech@redhat.com>
* Add underlying diagnostic message for SSL errors.Graham Leggett2016-06-161-1/+18
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3005 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Add build infrastructure for systemtap scriptsJakub Hrozek2016-06-101-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds infrastructure that generatest the probes.h and probes.o from the dtrace probes.d file. The probes.d file is empty except for the provider name in this commit, its content will be added with later commits that actually add some content. The probes.d file is always distributed in the tarball so that distributions can optionally enable systemtap support. The generation is done using the "dtrace" command because the probes.d file is compatible with the Solaris dtrace format. Please see "man 1 dtrace" for more information on the dtrace format and the command line tool. In order to make libtool happy, a fake libtool object is generated. This hunk was taken from the libvirt code. The AM_V_GEN macro is used to make the build compatible with the silent build configuration. To enable systemtap probing, configure sssd with: --enable-systemtap In order to do so, the 'dtrace' command-line utility must be installed. On Fedora and RHEL, this package is installed as part of the "systemtap-sdt-devel" package. You'll also want the 'systemtap' package installed as well as the matching versions of kernel-devel and kernel-debuginfo on your machine. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add a PROBE macro into probes.hJakub Hrozek2016-06-101-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The macros are inspired by very similar macros in libvirt code. Adds a macro PROBE that can be used by SSSD developers to add systemtap marks to code. These marks, when coupled with a location in a binary can be in turn used to call probes. The mark can be called like this: PROBE(PROBE_NAME, arguments) This is cleaner than using the SSSD_$(PROBE_NAME) directly as it directly shows that a probe is being called at that place. If the systemtap tracing is disabled, they would expand to an empty macro. If the systemtap tracing is enabled, the systemtap probe will be called. The overhead of calling the probes is close to zero. As one of the systemtap developers explained to me: """ STAP_PROBE() macros cost apprx. one nop in the executable, so apprx. no cost at all. The more the merrier. Only when activated by a stap script do we generally think of it like a microsecond of time. """ The probe arguments can be used in the probes to be printed or passed on to functions. There was an issue in case a string argument was NULL. This commit adds a helper macro to deal with NULL-strings as if they were empty (""). This file would be included by any source file that wants to call the PROBE() macro. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* p11: add OCSP default responder optionsSumit Bose2016-06-093-4/+101
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* p11: add no_verification optionSumit Bose2016-06-095-20/+61
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Do not leak fds in case of failures setting up a child processJakub Hrozek2016-05-311-0/+14
| | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3006 The handling of open pipes in failure cases was suboptimal. Moreover, the faulty logic was copied all over the place. This patch introduces helper macros to: - initialize the pipe endpoints to -1 - close an open pipe fd and set it to -1 afterwards - close both ends unless already closed These macros are used in the child handling code. The patch also uses child_io_destructor in the p11_child code for safer fd handling. Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: exit() the forked process if exec()-ing a child process failsJakub Hrozek2016-05-192-23/+23
| | | | | | | | | | | When exec() fails, we should not attempt to continue, but just kill the forked process. The patch adds this logic to the exec_child() and exec_child_ex() functions to avoid code duplication Resolves: https://fedorahosted.org/sssd/ticket/3016 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Add ERR_SBUS_REQUEST_HANDLEDJakub Hrozek2016-05-102-0/+2
| | | | | | | | | | | In most cases when sbus request parsing finishes, the request is handled internally and a reply is sent to the caller. However, in handlers that are parsed and handled completely manually, we might want to be notified about this case so that the called of sbus_request_parse_or_finish() aborts the request and doesn't proceed with using the sbus request which is already freed internally in sbus_request_parse_or_finish(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* util: make concatenate_string_array() reusableSumit Bose2016-04-132-0/+25
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Allow to append new line in sss_vdebug_fnLukas Slebodnik2016-03-233-3/+11
| | | | | | | | libldb is not consistent with appending line feed in debug messages. AS a result of this two messages can be on the same line in sssd log files. Which makes analyzing log files more difficult. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Move debug part from util.h -> new debug.hLukas Slebodnik2016-03-232-118/+141
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: return const char ** from dup_string_listPavel Březina2016-03-142-4/+4
| | | | | | | This function is not used anywhere and const char ** suits better in my use case (next patch) so I just changed the function. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Do not call stderr with negative numberLukas Slebodnik2016-03-141-3/+5
| | | | | | | | The function connect return -1 in case of error and we could call strerror with -1 instead of errno. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Ensure we always build with C90Lukas Slebodnik2016-03-123-2/+9
| | | | | | | | | | | libipa_hbac is also used by external projects such as pam_hbac: https://github.com/jhrozek/pam_hbac In order to make sure we don't use C99 features in the libipa_hbac code in the future, this patch adds an explicit -std=c89 flag to CFLAGS. Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-21 12:43:38 +0000