sssd-devel September 2010

sssd-devel@lists.fedorahosted.org

13 participants
48 discussions

[PATCH] Handle multiple simultaneous enumeration requests
by Stephen Gallagher 15 Sep '10

15 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Simo, ideally I'd like you to do this review, since you're the most familiar with this area of the code. However, other eyes are always encouraged. Previously, if a second enumeration request arrived while one was already being processed, each process would receive only a subset of the total number of available users or groups. This is because we were maintaining the response object as a global value in the NSS responder. The second request would come in, see that the data set was already populated, and start reading from wherever the cursor was currently pointed. With this patch, we now add a reference count to the data set object and move the cursor to the client context instead of the global NSS context. Additionally, this patch completely rewrites the approach to enumerations in the tevent_req style. This makes it much easier to follow in the code. There is a known issue with this patch that I am working to address in a follow-up patch. With this change, it's possible to trick the sssd_nss process into holding onto the enumeration cache forever. Since the global result object is retained as long as there are references to it, it would be possible for a malicious program to call setpwent/getpwent and never call getpwent - thereby preventing the result object from ever being reaped. I will be sending a follow-up patch that adds a timeout value on the lifetime of the result object. The plan will be that once this timeout runs out, the object will be reaped and if there are active enumerations running (meaning that they have started calling getpwent but not retrieved all the entries yet), they will be directed to call another setpwent, but will retain their current pointers to the result data. Since in the 99% case, the data will remain the same (and in the same order), this will have minimal impact on the clients. I am sending the current patch out first so I can get some opinions on the approach while I work on fixing the vulnerability it introduces. This patch addresses https://fedorahosted.org/sssd/ticket/608 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkx+5p0ACgkQeiVVYja6o6MxfACcCftq5H0FCZSHWLwBN11r5l8l +30AnibV+UtlZ+7L9xllSBLRpZCY6kdO =+kyZ -----END PGP SIGNATURE-----

3 8

Netgroups in SSSD
by Stephen Gallagher 13 Sep '10

13 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have written up a problem statement and a brief overview of my plans regarding netgroup support in the SSSD. Please read through and comment as needed: https://fedorahosted.org/sssd/wiki/DesignDocs/Netgroups My goal is to have this work completed before the end of September. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyG1OEACgkQeiVVYja6o6PIwQCgh62juMYdDpeGcXaYoGCf5/WG mC4An0jwqIf+C22owuI4gE8M6CiPLHnZ =iN+7 -----END PGP SIGNATURE-----

3 14

[PATCH] Support password obfuscation in sssd.conf
by Jakub Hrozek 08 Sep '10

08 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/7] Move crypto functions into its own subdir A refactoring patch that creates a common util/crypto subdir with per-implementation subdirectories for each underlying crypto library supported by SSSD. [PATCH 2/7] Add safe copy/move macros for uint16_t These will be used later on in the code [PATCH 3/7] Password obfuscation utility functions This is where the actual obfuscation happens. Adds two utility functions - one to obfuscate a password and inverse to extract the cleartext password back. So far, only NSS-based implementation is provided. [PATCH 4/7] Fix pysss linking I noticed that the python bindings were not properly linked so a simple import pysss failed [PATCH 5/7] Python bindings for obfuscation Provides python bindings for utility functions from patch 3/7. These will be used later on in the obfuscation tool itself. [PATCH 6/7] sss_obfuscate tool A tool to add obfuscated passwords into the SSSD config file [PATCH 7/7] Deobfuscate password in back ends When obfuscated password is used in config file, the LDAP backend converts it back to clear text and uses it to authenticate to the server. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkx7+oUACgkQHsardTLnvCV+2QCg0TXyStJUpcOA3BaDFeZBwCst CVYAoKpvZPmEviGTNQeIcUYuTOw4mdFr =TFuL -----END PGP SIGNATURE-----

3 13

[PATCH] Fix assorted minor bugs in sss_ tools
by Jakub Hrozek 08 Sep '10

08 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fixes: #585 by introducing a macro that encapsulates handling a common error during password parsing. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyFMFcACgkQHsardTLnvCWfQwCggczrLdP1QH0SMbF2cXkttnPq 87kAn1v2F2/Db2U34Ii1jVlwq1bLsC32 =5ro5 -----END PGP SIGNATURE-----

2 2

Dead assignment cleanup
by Jan Zelený 08 Sep '10

08 Sep '10

I'm sending the last wave of patches cleaning dead assignments or fixing code around them. 0001-Dead-assignments-cleanup-in-providers-code.patch: Here the biggest change is in prototype of sdap_access_decide_offline, which IMO doesn't need to return any value, since it returns alway EOK now and there is no code which could be failing. 0002-Dead-assignments-cleanup-in-NSS-responder.patch 0003-Dead-assignments-cleanup-in-memberof-module.patch: Here I'm not entirely sure about return code LDB_ERR_OPERATIONS_ERROR. The variable ret can contain either 0 or -1 (in case of insufficient memory, I checked the ldb code). I think returning -1 further isn't the right choice, thus either ENOMEM or LDB_ERR_OPERATIONS_ERR seem to be acceptable. I chose the latter one, because it indicates generic ldb error. ENOMEM could be convenient now, but in the future the behavior of ldb_schema_attribute_add might change and ENOMEM would become misleading. 0004-Dead-assignments-cleanup-in-various-places-in-SSSD.patch The last hunk should be fixing this: http://jhrozek.fedorapeople.org/sssd- clang-llvm/report-G4QCn7.html#EndPath . IMO the original code had a flaw there, which would make the inner while cycle useless in case write() actually wrote less bytes than it could. This way it should be fixed. -- Jan

2 6

[PATCHES] Add a setent result object timeout
by Stephen Gallagher 07 Sep '10

07 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is a follow-up to the patch in the thread "[PATCH] Handle multiple simultaneous enumeration requests". It addresses the vulnerability that would be introduced by that earlier patch. Patches 0001 and 0002 are nearly identical, they are just divided into one patch for setpwent and another for setgrent to make reviewing easier. In order to ensure that a slow or malicious client cannot hold onto a reference for the setpwent result object indefinitely, we set an expiration on the object. We use the enum_cache_timeout here, since that is an appropriate value. If the timeout fires during the normal operation of the getpwent() loop of a client program, we will save the current values of the read index so that we can resume as soon as the object has been refreshed by an implicit setpwent call. Also attached is a simple test program that I wrote to verify the fix. It will start an enumeration read, then pause partway through (I picked 70 because that was firmly within the sss results and after the files results) for 35 seconds. I set enum_cache_timeout = 30 in the [nss] section of my sssd.conf for testing this. The final count should be the same as received from getent group |wc -l The output can be verified by inspection to see that all of the groups are as expected. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkx/6P0ACgkQeiVVYja6o6NSlgCfbypL4Wy4NweoC7yaIIFYYjOy umkAniVMpnyphBIFMujKR0/8III+mGmS =ikGR -----END PGP SIGNATURE-----

1 1

[PATCH] Minor fixes in various places
by Jan Zelený 07 Sep '10

07 Sep '10

I'm attaching some patches fixing various minor issues found by clang: 0001-Initialized-return-value-in-dp_copy_options.patch Ticket: #577 0002-Fixed-potential-comparison-of-undefined-variable.patch Ticket: #578 0003-Fixed-printing-of-undefined-value-in-sdap_async_acco.patch Ticket: #579 0004-Fixed-uninialized-value-in-proxy_id-provider.patch Ticket: #580 0005-Deleted-some-needless-assignments.patch Ticket: #582 -- Jan

3 15

[PATCH] Reviewed sssd-ldap man page
by Jan Zelený 07 Sep '10

07 Sep '10

So I've finished sssd-ldap man page review. The attached patch reflects all changes previously discussed here. -- Jan

3 8

[PATCH] Memory context hierarchy fix
by Jan Zelený 07 Sep '10

07 Sep '10

When I studied the code, I noticed one small inconsistency in fail_over.c, which turned out to be in fact a minor bug. Attached patch fixes it. -- Jan

3 2

[PATCH] Fix chpass operations with LDAP provider
by Stephen Gallagher 02 Sep '10

02 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The initial verification of the old password was returning an error because we were not explicitly setting dp_err to DP_ERR_SUCCESS and it was initialized earlier in the function to DP_ERR_FATAL. Pushing this to master and sssd-1-2 under the one-liner rule. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxZs3IACgkQeiVVYja6o6NkbwCgqU/UMujaWD5jtXVelvgKeB5w 5IcAnjnB7wMJFwe7mZyeKrgRRjAYhtkl =KZf0 -----END PGP SIGNATURE-----

3 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2010