summaryrefslogtreecommitdiffstats
path: root/src/responder/common
Commit message (Collapse)AuthorAgeFilesLines
* Secrets: Add initial responder code for secrets serviceSimo Sorce2016-04-052-12/+11
| | | | | | | | | | | Start implementing the Secrets Service Reponder core. This commit implements stratup and basic conenction handling and HTTP parsing (using the http-parser library). Signed-off-by: Simo Sorce <simo@redhat.com> Related: https://fedorahosted.org/sssd/ticket/2913
* Responders: Add support for socket activationSimo Sorce2016-04-052-2/+58
| | | | | | | | Add helper that uses systemd socket activation if available to accept a pre-listining socket at startup. Related: https://fedorahosted.org/sssd/ticket/2913
* Responders: Make the client context more genericSimo Sorce2016-04-053-50/+99
| | | | | | | | | | | | | This is useufl to allow reusing the responder code with other protocols. Store protocol data and responder state data behind opaque pointers and use tallog_get_type to check they are of the right type. This also allows to store per responder state_ctx so that, for example, the autofs responder does not have to carry useless variables used only by the nss responder. Resolves: https://fedorahosted.org/sssd/ticket/2918
* Responders: Fix client destructorSimo Sorce2016-03-171-4/+7
| | | | | | | | | | | | | | | | To close a socket associated to an fd event we must set the close function of the event and not associate a destructor to a parent context. Otherwise the destructor will close() the socket before the fd event is freed, and this may cause invalid calls on a closed file descriptor to poll/epoll/etc. Discovered by looking at strace output. Resolves: https://fedorahosted.org/sssd/ticket/2973 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* cache_req: remove old commentPavel Březina2016-03-141-5/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: rename cache_req_input to cache_reqPavel Březina2016-03-141-209/+203
| | | | | | The input part has no longer meaning. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: hide input and pass parameters in structPavel Březina2016-03-142-235/+303
| | | | | | This way it makes it a lot easier to add new parameters. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add SID lookupsPavel Březina2016-03-142-13/+109
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2848 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: improve debuggingPavel Březina2016-03-143-48/+145
| | | | | | | | | Each debug message is matched to a specific request, this way it will be easier to follow the request flow especially when paralel request are running. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: rename debug_fqn to debugobjPavel Březina2016-03-141-20/+22
| | | | | | It is not always a name. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: break cache_req_input_create into more functionsPavel Březina2016-03-141-23/+46
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: fix typo in debug messagePavel Březina2016-03-141-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: bring together search parametersPavel Březina2016-03-141-59/+59
| | | | | | | This way it is more clear that the string parameters should not be misued when adding a new one. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix typos reported by lintianLukas Slebodnik2016-02-231-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* cache_req: do not lookup views if possiblePavel Březina2016-01-281-6/+84
| | | | | | | | | | This is needed for LOCAL view but also creates a shortcut for server side overrides. Resolves: https://fedorahosted.org/sssd/ticket/2849 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: simplify cache_req_cache_check()Pavel Březina2016-01-281-31/+48
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Improve code to get connection credentialsSimo Sorce2016-01-282-21/+44
| | | | | | | | | | Adds support to get SELINUX context and make code more abstract so that struct ucred (if availale) can be used w/o redefining uid,gid,pid to int32. Also gives a layer of indirection that may come handy if we want to improve the code further in the future. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* cache_req: check all domains for lookups by certificateSumit Bose2015-11-111-3/+4
| | | | | | | Like lookup by ID or by UPN the match for lookups by certificate can be found in any domain and all sub-domains must be included in the search. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* cache_req: Fix warning -WshadowLukas Slebodnik2015-11-101-4/+4
| | | | | | | | src/responder/common/responder_cache_req.c: In function 'cache_req_input_set_name': src/responder/common/responder_cache_req.c:199: warning: declaration of 'dup' shadows a global declaration /usr/include/unistd.h:528: warning: shadowed declaration is here Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Update get_next_domain's interfaceMichal Židek2015-10-234-14/+18
| | | | | | | | | | | | Update get next domain to be able to include disbled domains and change the interface to accept flags instead of multiple booleans. Ticket: https://fedorahosted.org/sssd/ticket/2673 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* REFACTOR: SCKT_RSP_UMASK constant in responder codePetr Cech2015-10-142-1/+5
| | | | | | | | | | This patch adds new SCKT_RSP_UMASK constant which stands for 0111. And it replaces all occurances in responder code. Resolves: https://fedorahosted.org/sssd/ticket/2424 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* REFACTOR: DFL_RSP_UMASK constant in responder codePetr Cech2015-10-142-2/+3
| | | | | | | | | | There is DFL_RSP_UMASK constant for very secure umask in responder code. This patch replaces occurances of value 0177 with this constant. Resolves: https://fedorahosted.org/sssd/ticket/2424 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* fix upn cache_req for sub-domain usersSumit Bose2015-10-081-2/+7
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: remove raw_name and do not touch orig_namePavel Březina2015-10-081-23/+29
| | | | | | | Parsed name or UPN is now stored in input->name instead of touching orig_name and storing the original name in raw_name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: add support for UPNPavel Březina2015-10-083-14/+127
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: provide extra flag for oob requestPavel Březina2015-10-081-5/+6
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* UTIL: Convert domain->disabled into tri-state with domain statesJakub Hrozek2015-09-211-2/+3
| | | | | | | | | | | | | Required for: https://fedorahosted.org/sssd/ticket/2637 This is a first step towards making it possible for domain to be around, but not contacted by Data Provider. Also explicitly create domains as active, previously we only relied on talloc_zero marking dom->disabled as false. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DATA_PROVIDER: BE_REQ as string in log messagePetr Cech2015-09-141-2/+2
| | | | | | | | | | | | | | | | | Add be_req2str() for translation BE_REQ to string. So we will have || Got request for [0x1001][FAST BE_REQ_USER][1][name=celestian] instead of || Got request for [0x1001][1][name=celestian] Function be_req2str() is used in data provider and in responder too. So this patch create new header file data_provider_req.h which delivers function be_req2str() and definitions of BE_REQ_*. Resolves: https://fedorahosted.org/sssd/ticket/2708 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* negcache: allow domain name for UID and GIDSumit Bose2015-07-273-16/+44
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2731 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: Extend cache_req with wildcard lookupsJakub Hrozek2015-07-152-14/+166
| | | | | | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds two new functions to the cache_req API: - cache_req_user_by_filter_send - cache_req_group_by_filter_send These functions can be used to retrieve users or groups that match a specified filter. Also renames a variable to avoid constant confusion -- the variable is only used for debug output. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add DP_WILDCARD and SSS_DP_WILDCARD_USER/SSS_DP_WILDCARD_GROUPJakub Hrozek2015-07-152-1/+14
| | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Extends the Data Provider interface and the responder<->Data provider interface with wildcard lookups. The patch uses a new "wildcard" prefix rather than reusing the existing user/group prefixes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: add FindByCertificate method for User objectsSumit Bose2015-06-194-11/+110
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ncache: add calls for certificate based searchesSumit Bose2015-06-192-0/+34
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* negcache: Soften condition for expired entriesLukas Slebodnik2015-05-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Type of timestamp for entries in negative cache is time_t which is number of *seconds* that have elapsed since 1 January 1970. The condition for ttl was to strict so entry could be valid from "ttl-1" to ttl e.g. * ttl is 1 second * entry was stored to negative cache at 1432120871.999639 stored_timestamp = 1432120871 * entry was tested few miliseconds later 1432120872.001293 current_time = 1432120872 Entry was marked as expired becuase result of condition was false stored_timestamp + ttl < current_time 1432120871 + 1 < 1432120872 This is a reason why ./test-negcache sometime fails. It's quite easily reproducible on slow machine or when valgrind was used. sh$ while libtool --mode=execute valgrind ./test-negcache ; do echo OK: done Reviewed-by: Pavel Reichl <preichl@redhat.com>
* responders: reset ncache after domains are discovered during startupJakub Hrozek2015-04-092-8/+38
| | | | | | | | | After responders start, they add a lookup operation that discovers the subdomains so that qualifying users works. After this operation is finishes, we need to reset negcache to allow users to be added into the newly discovered domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Add sss_ncache_reset_repopulate_permanentJakub Hrozek2015-04-092-0/+20
| | | | | | | This new function resets the negative cache and then re-adds the permanent entries. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Silence critical error from filter_users when default_domain_suffix ↵Jakub Hrozek2015-04-091-3/+15
| | | | | | | | | | | | | | | is set When default_domain_suffix is used and filter_users is set (at least root is always, by default), SSSD tried to add the negcache entry to the default domain. But since the default domain is not known after start up, adding the entries fail with a verbose error message. This patch handles EAGAIN returned from the parsing function while setting negcache entries gracefully and also makes the debug message in parsing function more precise. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ncache: Fix sss_ncache_reset_permanentJakub Hrozek2015-04-091-1/+1
| | | | | | | There was an off-by-one error in sss_ncache_reset_permanent that prevented the reset from working. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add missing new lines to debug messagesLukas Slebodnik2015-03-171-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* responder_cache: Fix warning may be used uninitializedLukas Slebodnik2015-03-171-1/+1
| | | | | | | | | | | | | | | There is a warning with gcc-5.0 and enabled optimization. Warning is not visible with "-O0". CC src/responder/common/responder_cache_req.o src/responder/common/responder_cache_req.c: In function ‘cache_req_next_domain’: src/responder/common/responder_cache_req.c:296:160: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] src/responder/common/responder_cache_req.c:277:13: note: ‘ret’ was declared here errno_t ret; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: return ERR_INTERNAL if more than one entry is foundPavel Březina2015-03-131-1/+1
| | | | | | | This means that the db is not in the expected format thus we should make the error more visible. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: parse input name if neededPavel Březina2015-03-132-24/+118
| | | | | | | | The input name is now parse automatically by cache_req if none particullar domain is specified. The parsed named is returned from _recv as an output parameter. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by idPavel Březina2015-03-132-0/+58
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: remove default branch from switchesPavel Březina2015-03-131-20/+4
| | | | | | | | | | | | Originaly, the cache_req used enum sss_dp_acct_type to indicate request type but not all types were implemented. Thus we used default branch to indicate unimplemented request type. Now when we switched to a custom enum type we can get rid of the default branch so the compiler can check if all switches contains all values. This proved to be useful during development of new request types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for group by namePavel Březina2015-03-132-0/+56
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add support for user by uidPavel Březina2015-03-132-7/+115
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: preparations for different input typePavel Březina2015-03-132-99/+287
| | | | | | | | | Currently cache_req takes only user name as an input parameter. However, this is not enough since we will need also UID and GID in the future. This patch creates a structure to hold input parameters so it can be simply extended to support other input types. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: add new iface via sbus_conn_register_iface()Pavel Březina2015-01-231-7/+1
| | | | | | | | | | | | | | | | | | | Rename sbus_conn_add_interface() to sbus_conn_register_iface() and remove sbus_new_interface() calls since it is just one more unnecessary call outside the sbus code. The function sbus_new_interface() is made static and used directly in sbus_conn_register_iface(). The name was chosen to better describe what the function is doing. That it registers an interface on a given object path. The same interface can be used with different paths so it is not really about adding an interface. Preparation for: https://fedorahosted.org/sssd/ticket/2339 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Unify the fd_nonblocking implementationJakub Hrozek2015-01-151-24/+1
| | | | | | | The responder and child_common modules each had their own implementation. Unify it instead and add a unit test. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* responders: enable views in cache requestPavel Březina2015-01-091-3/+9
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
generated by cgit (git 2.34.1) at 2026-04-01 14:30:44 +0000