summaryrefslogtreecommitdiffstats
path: root/daemons/ipa-kdb
Commit message (Collapse)AuthorAgeFilesLines
* Add support for searching policies in cn=accountsSimo Sorce2017-03-103-6/+17
| | | | | | | | | | | Use the new multibase search to collect policies from multiple subtrees. The 'any' parameter is set to 'true' so the search stop when the first result is found in any of the bases. https://fedorahosted.org/freeipa/ticket/6568 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add code to retrieve results from multiple basesSimo Sorce2017-03-102-0/+113
| | | | | | | | | Internally performs multiple seraches as needed based on the basedn strings passed in and whether the caller indicated that any result is ok or all results are needed. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kdb: support KDB DAL version 6.1Alexander Bokovoy2017-02-153-20/+66
| | | | | | | | | | | | | | | | | | | | | | | | | DAL version 6.0 removed support for a callback to free principal. This broke KDB drivers which had complex e_data structure within the principal structure. As result, FreeIPA KDB driver was leaking memory with DAL version 6.0 (krb5 1.15). DAL version 6.1 added a special callback for freeing e_data structure. See details at krb5/krb5#596 Restructure KDB driver code to provide this callback in case we are built against DAL version that supports it. For DAL version prior to 6.0 use this callback in the free_principal callback to tidy the code. Use explicit KDB version dependency in Fedora 26+ via BuildRequires. With new DAL version, freeipa package will fail to build and we'll have to add a support for new DAL version explicitly. https://fedorahosted.org/freeipa/ticket/6619 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Clean / ignore make check artefactChristian Heimes2017-01-181-0/+3
| | | | | | | | | In tree runs of make check leave some artifacts around. The patch adds them to make clean and .gitignore. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-kdb: search for password policies globallyAlexander Bokovoy2016-12-151-1/+1
| | | | | | | | | | | | | | | | With the CoS templates now used to create additional password policies per object type that are placed under the object subtrees, DAL driver needs to search for the policies in the whole tree. Individual policies referenced by the krbPwdPolicyReference attribute are always searched by their full DN and with the base scope. However, when KDC asks a DAL driver to return a password policy by name, we don't have any specific base to search. The original code did search by the realm subtree. Fixes https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-161-4/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Support DAL version 5 and version 6Simo Sorce2016-11-101-39/+63
| | | | | | | | https://fedorahosted.org/freeipa/ticket/6466 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Build: fix distribution of daemon/ipa-kdb filesPetr Spacek2016-11-091-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix Makefile.am files to separate source and build directoriesPetr Spacek2016-11-091-7/+3
| | | | | | | | | | | | | This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: transform util directory to libutil convenience libraryPetr Spacek2016-10-241-4/+4
| | | | | | | | | | | | This is autoconf way of doing things. It should allow us to enable subdir-objects automake option and stay compatible with future versions of automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: adjust include paths in daemons/ipa-kdb/tests/ipa_kdb_tests.cPetr Spacek2016-10-241-2/+2
| | | | | | | | | | | Fix include paths to prevent breakage when we move configure.ac from daemons to the top-level. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa-kdb: simplify trusted domain parent searchAlexander Bokovoy2016-08-221-13/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | In terms of cross-forest trust parent domain is the root domain of the forest because we only have trust established with the forest root. In FreeIPA LDAP store all sub-domains stored in cn=<forest root>, cn=ad,cn=trusts,... subtree. Thus, a first RDN after cn=ad is the forest root domain. This allows us to simplify logic of finding the parent domain. For complex hierachical forests with more than two levels of sub-domains, this will still be true because of the forest trust: as forest trust is established to the forest root domain, any communication to any sub-domain must traverse forest root domain's domain controller. Note that SSSD also generated incorrectly CA paths information for forests with non-hierarchical tree-roots. In such cases IPA KDC got confused and mistakenly assumed direct trust to the non-hierarchical tree-root instead of going through the forest root domain. See https://fedorahosted.org/sssd/ticket/3103 for details. Resolves: https://fedorahosted.org/freeipa/ticket/5738 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kdb: Allow to build with samba 4.5Lukas Slebodnik2016-08-091-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | daemons/ipa-kdb/ipa_kdb_mspac.c: In function 'filter_logon_info': daemons/ipa-kdb/ipa_kdb_mspac.c:1536:19: error: 'struct PAC_LOGON_INFO' has no member named 'res_group_dom_sid' if (info->info->res_group_dom_sid != NULL && ^~ daemons/ipa-kdb/ipa_kdb_mspac.c:1537:19: error: 'struct PAC_LOGON_INFO' has no member named 'res_groups'; did you mean 'resource_groups'? info->info->res_groups.count != 0) { ^~ mv -f .deps/ipa_kdb_delegation.Tpo .deps/ipa_kdb_delegation.Plo Makefile:806: recipe for target 'ipa_kdb_mspac.lo' failed make[3]: *** [ipa_kdb_mspac.lo] Error 1 make[3]: *** Waiting for unfinished jobs.... Related change in samba https://github.com/samba-team/samba/commit/4406cf792a599724f55777a45efb6367a9bd92b2 Resolves: https://fedorahosted.org/freeipa/ticket/6173 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* kdb: check for local realm in enterprise principalsSumit Bose2016-07-121-12/+40
| | | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* Allow unexpiring passwordsDavid Kupka2016-07-012-1/+16
| | | | | | | | | | Treat maxlife=0 in password policy as "never expire". Delete krbPasswordExpiration in user entry when password should never expire. https://fedorahosted.org/freeipa/ticket/2795 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* ipa-kdb: set krbCanonicalName when creating new principalsMartin Babinsky2016-06-231-3/+1
| | | | | | | | | | Additionally, stop setting ipakrbprincipalalias attribute during principal creation. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* perform case-insensitive principal search when canonicalization is requestedMartin Babinsky2016-06-231-1/+12
| | | | | | | | | | | | | When canonicalization is requested, the krbprincipalname attribute is searched for case-insensitively. In the case that krbcanonicalname is not set, the matched alias is returned with the casing stored in backend, not the one input by client. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-112-11/+50
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Migrate from #ifndef guards to #pragma onceNathaniel McCallum2016-05-291-5/+1
| | | | | | | | | | | | Using a pragma instead of guards is easier to write, less error prone and avoids name clashes (a source of very subtle bugs). This pragma is supported on almost all compilers, including all the compilers we care about: https://en.wikipedia.org/wiki/Pragma_once#Portability. This patch does not change the autogenerated files: asn1/asn1c/*.h. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Enable authentication indicators for OTP and RADIUSNathaniel McCallum2016-05-261-2/+8
| | | | | | | | | If the user is configured for OTP or RADIUS authentication, insert the relevant authentication indicator. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Return password-only preauth if passwords are allowedNathaniel McCallum2016-05-261-4/+2
| | | | | | | | | | Before this patch, if either password or password+otp were permitted, only the otp preauth mech would be returned to the client. Now, the client will receive either enc_ts or enc_chl in addition to otp. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa_kdb: add krbPrincipalAuthInd handlingMatt Rogers2016-05-021-0/+170
| | | | | | | | | | Store and retrieve the authentication indicator "require_auth" string in the krbPrincipalAuthInd attribute. Skip storing auth indicators to krbExtraData. https://fedorahosted.org/freeipa/ticket/5782 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Allow to specify Kerberos authz data type per userSimo Sorce2016-03-091-7/+9
| | | | | | | | | | | | Like for services setting the ipaKrbAuthzData attribute on a user object will allow us to control exactly what authz data is allowed for that user. Setting NONE would allow no authz data, while setting MS-PAC would allow only Active Directory compatible data. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2579 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Allow admins to disable preauth for SPNs.Simo Sorce2016-03-083-6/+27
| | | | | | | | | | | | | | | | Some legacy softare is not able to properly cope with preauthentication, allow the admins to disable the requirement to use preauthentication for all Service Principal Names if they so desire. IPA Users are excluded, for users, which use password of lessere entrpy, preauthentication is always required by default. This setting does NOT override explicit policies set on service principals or in the global policy, it only affects the default. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/3860 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kdb: map_groups() consider all resultsSumit Bose2016-02-021-52/+56
| | | | | | | Resolves https://fedorahosted.org/freeipa/ticket/5573 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: get_authz_data_types() make sure entry can be NULLSumit Bose2016-01-272-1/+9
| | | | | | | | | | | | This function determines which type of authorization data should be added to the Kerberos ticket. There are global default and it is possible to configure this per service as well. The second argument is the data base entry of a service. If no service is given it makes sense to return the global defaults and most parts of get_authz_data_types() handle this case well and this patch fixes the remain issue and adds a test for this as well. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Always verify we have a valid ldap context.Simo Sorce2016-01-131-0/+29
| | | | | | | | | | | LDAP calls just assert if an invalid (NULL) context is passed in, so we need to be sure we have a valid connection context before calling into LDAP APIs and fail outright if a context can't be obtained. https://fedorahosted.org/freeipa/ticket/5577 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* FIX: ipa_kdb_principals: add missing break statementMartin Basti2015-11-301-0/+1
| | | | | | | Needs a 'break' otherwise prevents correct reporting of data and it always overrides it with the placeholder data. Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Return default TL_DATA is krbExtraData is missingSimo Sorce2015-11-251-1/+10
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/937 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa_kdb_tests: Fix test with default krb5.confLukas Slebodnik2015-11-181-0/+4
| | | | | | | Default krb5.conf needn't have defined default_realm. Unit tests should not rely on existing default value. Reviewed-By: Martin Basti <mbasti@redhat.com>
* cmocka_tests: Do not use deprecated cmocka interfaceLukas Slebodnik2015-11-181-8/+15
| | | | | | | | The cmocka-1.0 introduced new interface for tests which is not compatible with the old one. And the old interface is deprecated which caused compiled warnings. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Fix warning Wmissing-bracesLukas Slebodnik2015-11-131-2/+2
| | | | | | | | | | | | | | | | tests/ipa_kdb_tests.c:254:9: warning: missing braces around initializer [-Wmissing-braces] {3, {BLACKLIST_SID"-1000", BLACKLIST_SID"-1001", BLACKLIST_SID"-1002"}, ^ tests/ipa_kdb_tests.c:254:9: note: (near initialization for ‘test_data[6]’) tests/ipa_kdb_tests.c:256:9: warning: missing braces around initializer [-Wmissing-braces] {0, NULL, 0 , NULL} ^ tests/ipa_kdb_tests.c:256:9: note: (near initialization for ‘test_data[7]’) tests/ipa_kdb_tests.c:234:21: warning: missing braces around initializer [-Wmissing-braces] } test_data[] = { ^ Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Remove unused variablesLukas Slebodnik2015-11-131-4/+0
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* client referral support for trusted domain principalsAlexander Bokovoy2015-10-083-0/+123
| | | | | | https://fedorahosted.org/freeipa/ticket/3559 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipa-kdb: add unit_tests for string_to_sid() and dom_sid_string()Sumit Bose2015-07-081-0/+60
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: make string_to_sid() and dom_sid_string() more robustSumit Bose2015-07-081-1/+10
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: add unit-test for filter_logon_info()Sumit Bose2015-07-083-50/+323
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: convert test to cmockaSumit Bose2015-07-082-88/+49
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: filter out group membership from MS-PAC for exact SID matches tooAlexander Bokovoy2015-07-081-1/+99
| | | | | | | | | | | | | | | | | | When incoming SID blacklist contains exact SIDs of users and groups, attempt to filter them out as well, according to [MS-PAC] 4.1.1.2. Note that we treat user's SID and primary group RID filtering as violation of the KDC policy because the resulting MS-PAC will have no user SID or primary group and thus will be invalid. For group RIDs we filter them out. According to [MS-KILE] 3.3.5.6.3.1 it is OK to have empty group RIDs array as GroupCount SHOULD be equal to Groups.MembershipCount returned by SamrGetGroupsForUser [MS-SAMR] 3.1.5.9.1, not MUST, thus it may be empty. Part of fix for https://bugzilla.redhat.com/show_bug.cgi?id=1222475 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: use proper memory chunk size when moving sidsAlexander Bokovoy2015-07-081-3/+17
| | | | | Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1222475 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: common function to get key encodings/salt typesMartin Babinsky2015-06-292-70/+62
| | | | | | | | | | | This patch moves duplicate code in `ipadb_get_connection` to get default and supported key encodings/salt types from Kerberos container to a common function handling this task. It is actually a small cosmetic enhancement of the fix of https://fedorahosted.org/freeipa/ticket/4914 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix s4u2proxy README and add warningSimo Sorce2015-06-081-2/+14
| | | | | | | | The attribute mentioned was using an older name that was later changed in the implementation. Also add a prominent warning about the use of the kadmin flags. Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Detect default encsalts kadmin password changeSimo Sorce2015-05-275-0/+144
| | | | | | | | | | | | | | | | | | | When kadmin tries to change a password it will get the allowed keysalts from the password policy. Failure to provide them will result in kadmin using the defaults specified in the kdc.conf file or hardcoded defaults (the default salt is then of type NORMAL). This patch provides the supported values that have been read out of the appropriate LDAP attribute when we read the server configuration. Then at actual password change, check if kadmin is handing us back the exact list of supported encsalts we sent it, and in that case replace it with the real default encsalts. Fixes https://fedorahosted.org/freeipa/ticket/4914 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kdb: reject principals from disabled domains as a KDC policyAlexander Bokovoy2015-02-161-1/+1
| | | | | | | Fixes https://fedorahosted.org/freeipa/ticket/4788 Reviewed-By: Sumit Bose <sbose@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-kdb: when processing transitions, hand over unknown ones to KDCAlexander Bokovoy2015-02-161-1/+2
| | | | | | | | | | | When processing cross-realm trust transitions, let the KDC to handle those we don't know about. Admins might define the transitions as explicit [capaths] in krb5.conf. https://fedorahosted.org/freeipa/ticket/4791 Reviewed-By: Sumit Bose <sbose@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Handle DAL ABI change in MIT 1.13Simo Sorce2015-02-132-0/+14
| | | | | | | | | | | | | In this new MIT version the DAL interface changes slightly but KRB5_KDB_DAL_MAJOR_VERSION was not changed. Luckily KRB5_KDB_API_VERSION did change and that's enough to know what to compile in. Resolves: https://fedorahosted.org/freeipa/ticket/4861 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Expose the disabled User Auth TypeNathaniel McCallum2015-02-121-6/+7
| | | | | | | | | Additionally, fix a small bug in ipa-kdb so that the disabled User Auth Type is properly handled. https://fedorahosted.org/freeipa/ticket/4720 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-kdb: more robust handling of principal addition/editingMartin Babinsky2015-01-301-23/+47
| | | | | | | | | | | | | | | | | | | | | | | | The patch addresses the following defect reported by covscan in FreeIPA master: """ Error: FORWARD_NULL (CWE-476): /daemons/ipa-kdb/ipa_kdb_principals.c:1886: assign_zero: Assigning: "principal" = "NULL". /daemons/ipa-kdb/ipa_kdb_principals.c:1929: var_deref_model: Passing null pointer "principal" to "ipadb_entry_to_mods", which dereferences it. /daemons/ipa-kdb/ipa_kdb_principals.c:1491:9: deref_parm_in_call: Function "ipadb_get_ldap_mod_str" dereferences "principal". /daemons/ipa-kdb/ipa_kdb_principals.c:1174:5: deref_parm_in_call: Function "strdup" dereferences "value" """ This is a part of series of patches related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* always get PAC for client principal if AS_REQ is trueMartin Babinsky2015-01-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch proposes a fix for the following defect reported by covscan in FreeIPA master code: """ Error: DEADCODE (CWE-561): /daemons/ipa-kdb/ipa_kdb_mspac.c:2013: assignment: Assigning: "client_entry" = "NULL". /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: null: At condition "client_entry", the value of "client_entry" must be "NULL". /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: dead_error_condition: The condition "client_entry" cannot be true. /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: dead_error_line: Execution cannot reach the expression "client_entry" inside this statement: "kerr = ipadb_get_pac(contex...". """ This is a part of a series of patches related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: unexpected error code in 'ipa_kdb_audit_as_req' triggers a messageMartin Babinsky2015-01-302-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is related this defect reported by covscan on FreeIPA master: """ Error: DEADCODE (CWE-561): /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328353L", taking false branch. Now the value of "error_code" is equal to -1765328353. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328360L", taking false branch. Now the value of "error_code" is equal to -1765328360. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != 0", taking false branch. Now the value of "error_code" is equal to 0. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: intervals: When switching on "error_code", the value of "error_code" must be in one of the following intervals: {[-1765328360,-1765328360], [-1765328353,-1765328353], [0,0]}. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: dead_error_condition: The switch value "error_code" cannot reach the default case. /daemons/ipa-kdb/ipa_kdb_audit_as.c:123: dead_error_begin: Execution cannot reach this statement: "default:". """ This patch is a part of series related to https://fedorahosted.org/freeipa/ticket/4795. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2026-03-20 18:12:24 +0000