March 2012 - sssd-devel - Fedora mailing-lists

[PATCH] PROXY: Create fake user entries for group lookups
by Stephen Gallagher 09 Mar '12

09 Mar '12

Fixes https://fedorahosted.org/sssd/ticket/1241 Now we will check that each member referenced by the group exists in the cache, and we will create a fake user if it is not. I did not do any special handling for aliases because there's no way to identify them in the proxy provider.

2 2

[PATCH] Potential NULL-dereference in sudosrv_cmd_get_sudorules
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1236

3 4

[PATCHES] Fixes for issues in SSH-related code found by coverity
by Jan Zelený 09 Mar '12

09 Mar '12

Please check the umask mode, that's the only thing I'm not sure about. Thanks Jan

3 7

Use of unininitialized value in sss_sudo_parse_response
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1231

2 2

Use of unininitialized value in sudosrv_cache_set_entry
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1232

2 3

Missing debug message if sdap_sudo_refresh_set_timer fails
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1238

2 2

[PATCH] Two memory leaks in sss_sudo_get_values
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1235

3 2

[PATCHES] Check nsAccountLock during IPA pam_acct_mgmt
by Stephen Gallagher 09 Mar '12

09 Mar '12

Patch 0001: Make sdap_access_send() public so the IPA provider can consume it. Patch 0002: Check that the user is not disabled before performing the HBAC check. I chose to do the nsAccountLock check first because it's a very fast operation against the cache, so if it returns PAM_PERM_DENIED we will skip the slower HBAC checks and jump straight to denial.

2 2

[PATCH] Fix two netgroup issues
by Jakub Hrozek 08 Mar '12

08 Mar '12

Hi, Amith reported these two issues. [PATCH 1/2] Save original name into the in-memory cache We were saving the original name into the netgroup hash when the object was first constructed but when no domain matched, we would save the cased name. The first request that was constructed with the original name was never marked as "ready", so another request with the same name was stuck waiting. [PATCH 2/2] setnetgrent return codes are handled in the _done callback, some of them gracefully, such as ENOENT that sends an empty reply. This patch uses tevent_req_post() to always call the callback and handle error conditions there. In particular, Amith was able to trigger this error by requesting a netgroup by raw name when all domains were marked as FQDN only

2 3

[PATCH] Fix nested groups processing
by Jakub Hrozek 08 Mar '12

08 Mar '12

The attached patch fixes the crash described in https://bugzilla.redhat.com/show_bug.cgi?id=743133#c28 The cause is actually embarassingly simple, the bug just did occur only with specific configurations our tests didn't exercise and moreover the default debugging didn't include enough information to triage the issue just from the debug logs. The root cause was that we would process all nested groups in a nesting level in a single tevent request and we kept the number of parent groups stored in the "state" structure. However, when moving to next group in the nesting leve, we didn't reset the number of parents.. Instead of keeping the number of parent groups in "state" and having to reset the count when moving to another group on the same level, the patch keeps track of the all groups on a particular level along with their parents and parent count in a more structured manner. This makes the code less fragile. The patch also adds more debugging.

2 2

[PATCHES] Contrib RPM specfile improvements
by Stephen Gallagher 08 Mar '12

08 Mar '12

Jan Cholasta noticed that our upstream builder wasn't producing experimental packages into the ipa-devel repository. This was due to the builders not setting the enable_experimental variable. Patch 0003 in this set now makes that the default in the spec file. I left it conditionalized so that it's easy for other packagers to take the spec and turn the experimental features back off. Patch 0001 makes a change that we made in Fedora some time ago to properly handle filtering Provides: for our python library. The other approach was long outdated and broke multilib on Fedora 17. Patch 0002 is a cleanup patch to make the set of files we're installing explicit, so we can easily catch mistakes. Previously we were installing files by glob, which meant we could have missed some if we didn't notice that they hadn't built. Patch 0003 makes building the experimental features the default for 'make rpms'.

2 4

[PATCH] path_utils: path_concat should return empty string on ENOBUFS
by Stephen Gallagher 08 Mar '12

08 Mar '12

This patch makes several changes. 1) Change the behavior of path_concat so that it will always return an empty string if it hits ENOBUFS. 2) Clean up the code, adding more comments. 3) Modify the unit tests to check for empty string and to make sure we don't write past the allowed buffer if the input strings are too long. 4) Update the doxygen for path_concat so that it's clear that path will be empty on failure.

2 4

[PATCH] Autofs Coverity issues
by Jakub Hrozek 08 Mar '12

08 Mar '12

[PATCH 1/2] Autofs: operate on contents of double-pointer, not address This is a bad one, luckily the code is defensive later on and detects that we have processed all the records and quits correctly. [PATCH 2/2] Only free returned values on success The pointers are set to NULL when the map is not found or the code iterates over all the maps, but it is good manners to only free the data when the caller is sure he received any.

3 2

[PATCH] Fix reconnection logic leaking unhandled requests
by Simo Sorce 08 Mar '12

08 Mar '12

This took a while to find out, a nasty, nasty bug! See details in git comment. Fixes 1229 Simo. -- Simo Sorce * Red Hat, Inc * New York

4 4

[PATCH] Only detect cycle in the fail over on subsequent resolve requests
by Jakub Hrozek 08 Mar '12

08 Mar '12

The yesterday's fail over patch broke the IPA provider.. The IPA provider is a special case because it uses fail over port 0 for both LDAP and Kerberos. That is done to make sure that we never connect to LDAP port on one host and Kerberos port on a different host. However, the cycle detection in fail over tripped over this because when performing a GSSAPI bind, we first request a server with port 0 to get the LDAP server and before we can mark the server status (or go offline), we also need to resolve the KDC, which, from fail over point of view is also running on port 0... The attached patch adds a boolean parameter to be_resolve_server_send() and only performs the cycle check if the parameter is false, that is, when requesting another server during the same operation.

2 2

[PATCH] Fix reconnection logic leaking unhandled requests
by Simo Sorce 07 Mar '12

07 Mar '12

This took a while to find out, a nasty, nasty bug! See details in git comment. Fixes 1229 Simo. -- Simo Sorce * Red Hat, Inc * New York

1 0

Fate of ding-libs branches
by Stephen Gallagher 06 Mar '12

06 Mar '12

The ding-libs development on master has been virtually stagnant for many months now. Much of what is included on the master branch is partially-completed concept work that was originally going to be done as part of a nebulous 1.0 future. Given that the ding-libs 1.0 has been effectively abandoned (and that the ding_libs-0-1 branch has been remarkably stable for a long time), I'd like to recommend that we branch the current master off (perhaps name it 'experimental') and then reset the master branch to be identical to the current contents of ding_libs-0-1.

2 3

[PATCH] INI: Silence compilation warnings
by Jakub Hrozek 06 Mar '12

06 Mar '12

I saw two compilation warnings when reviewing the recent path_utils patches. The first hunk is a parameter that is unused, but set, the second was an implicit function declaration due to forgotten private header include.

3 2

[PATCHES] Bugs in path_utils path_concat()
by Stephen Gallagher 06 Mar '12

06 Mar '12

Patch 0001: Handle off-by-one error in path_concat() Fixes https://fedorahosted.org/sssd/ticket/1230 Patch 0002: While fixing the above error, I noticed that path_concat() would also get it wrong if we passed "/" for head.

2 2

[PATCH] Only do one cycle when resolving a server
by Jakub Hrozek 06 Mar '12

06 Mar '12

https://fedorahosted.org/sssd/ticket/1214 I was actually going back and forth on the implementation -- my first approach was to separate requests for "beginning to resolve a service" and "give me another server for this service". I think that is more natural way to perform the resolution, but it turned out that this approach would require bigger changes to the back ends and I'm not sure if I can justify that just for the sake of nicer code at this point of 1.8 development. I still have a WIP patch that builds, should we decide that it's actually better to separate requests for first and any next server..

2 2

[PATCH] Search netgroups by alias, too
by Jakub Hrozek 06 Mar '12

06 Mar '12

https://fedorahosted.org/sssd/ticket/1228

2 2

[PATCH] krb5_child: set debugging sooner
by Jakub Hrozek 06 Mar '12

06 Mar '12

Both krb5_child and ldap_child would emit a "child started" message and only after that set up debugging to file. This might confuse users, because unless there is an error, the krb5_child.log might actually be empty. I'm thinking we might also add a couple of "tracing" DEBUG messages so that we can follow the flow in the subprocess more easily.

2 8

[PATCH] IPA: Fix segfault with srchost functionality enabled
by Stephen Gallagher 05 Mar '12

05 Mar '12

Fixes https://fedorahosted.org/sssd/ticket/1215

2 3

[PATCH] DP: Reorganize memory hierarchy of requests
by Stephen Gallagher 05 Mar '12

05 Mar '12

This function alters the memory hierarchy of the be_req to ensure memory safety during shutdown. It creates a spy on the be_cli object so that it will free the be_req if the client is freed. It is generally allocated atop the private data context for the appropriate back-end against which it is being filed. This should resolve https://fedorahosted.org/sssd/ticket/1226

2 5

[PATCH] Use proper errno code
by Jakub Hrozek 05 Mar '12

05 Mar '12

Found this when looking for an unrelated nested groups issue.

2 2

Hide --debug option in sss_debuglevel
by Pavel Březina 02 Mar '12

02 Mar '12

https://fedorahosted.org/sssd/ticket/1224

3 2

pam_krb5 & wrong principal in request
by Ondrej Valousek 01 Mar '12

01 Mar '12

Hello, I am running sssd on RHEL-6 with AD and recently found out, that I can no longer authenticate via ssh. The message is: pam_krb5[27045]: TGT failed verification using keytab and key for 'nfs/draco.prague.s3group.com(a)DUBLIN.AD.S3GROUP.COM': Wrong principal in request My krb5.keytab file has been created using Samba with "net ads join". I can still run 'kinit <username>' to obtain a TGT. Does anyone know what is going on here? Why is sshd verifying the TGT via just the nfs/ service principal? Sorry for a bit off-topic question, but I hoped someone in this list might point me in the right direction. Ondrej

5 12

Any plans for something like 'wbinfo' for sssd?
by Ondrej Valousek 01 Mar '12

01 Mar '12

Hi List, Are there any plans for a command line tool like 'wbinfo' which for winbind for sssd? Thanks, Ondrej

5 12

[PATCH] IPA: Set the DNS discovery domain to match ipa_domain
by Stephen Gallagher 01 Mar '12

01 Mar '12

The IPA provider should default to looking at the ipa_domain for the dns discovery domain if it is not explicitly set. The current behavior is to look at the domain part of the hostname, which may not match. Fixes https://fedorahosted.org/sssd/ticket/1217

2 2

GDB pretty printers
by Jakub Hrozek 01 Mar '12

01 Mar '12

Hi, I've been using the attached GDB helper script when debugging and I figured it might be useful for the others, too. I sometimes need to print and examine the contents of struct sysdb_attrs, ldb_message or similar. Using just the print command is quite tedious. The pretty printers can recursively print the contents of several commonly used structures. For example this is how the first several attributes of the IPA admin user look like: (gdb) p *attrs $1 = { <struct sysdb_attrs> num = 14 { <struct ldb_message_element> flags = 0, name = 0x85ba30 "originalDN", num_values = 1 { <struct ldb_val> data = 0x85dca0 "uid=admin,cn=users,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com", length = 68 } } { <struct ldb_message_element> flags = 0, name = 0x85b060 "name", num_values = 1 { <struct ldb_val> data = 0x85b130 "admin", length = 5 } } { <struct ldb_message_element> flags = 0, name = 0x85afc0 "uidNumber", num_values = 1 The other part is a new gdb command "tbr" which sets a breakpoint to the callback of a tevent_req without having to examine the contents of the tevent_req structure. For example: Breakpoint 1, sdap_get_users_process (subreq=0x85bf50) at src/providers/ldap/sdap_async_users.c:483 483 { (gdb) n 484 struct tevent_req *req = tevent_req_callback_data(subreq, (gdb) 486 struct sdap_get_users_state *state = tevent_req_data(req, (gdb) tbr req Breakpoint 2 at 0x7fe6c211b9c1: file src/providers/ldap/ldap_id.c, line 185. (gdb) c Continuing. Breakpoint 2, users_get_done (subreq=0x900004000) at src/providers/ldap/ldap_id.c:185 185 { (gdb) The script can be loaded into gdb with the "source" command: (gdb) source /path/to/the/script.py

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2012