October 2013 - sssd-devel - Fedora mailing-lists

[PATCH] krb5: Check return value of sss_krb5_princ_realm
by Lukas Slebodnik 28 Nov '14

28 Nov '14

ehlo, yet another warning from clang static analyser. sss_krb5_princ_realm set output parameter realm to NULL and len to 0 in case of failure. Clang static analysers repoted warning "Null pointer passed as an argument to a 'nonnull' parameter" in function match_principal. It was possible, that realm_name with value NULL could be used in strncmp. Function sss_krb5_princ_realm is used on other places for printing(formatting) realm_name and NULL can be safely used as a argument for printf-like functions. Patch is attached. LS

5 13

[PATCH] LDAP: Try all attributes when saving an entry
by Jakub Hrozek 08 Jul '14

08 Jul '14

Hi, this bug was reported on #sssd by a user. He was running some flavor of IBM Tivoli where the entries only had an "ID", not separate "UID" and "GID". But due to a bug in sssd he couldn't use the same value for both, this configuration: ldap_user_uid_number = idAttribute ldap_user_gid_number = idAttribute only saved the ID into UID and left GID empty. It appears we have a long standing bug in sdap_parse where we only consider first match. If this patch is accepted, I would also like to refactor sdap_parse in master because currently it is a 250-lines long function with multiple branches..

2 6

Build Fixes
by Benjamin Franzke 17 May '14

17 May '14

Hi, These two patches add missing CFLAGS/LIBS to Makefile.am: [PATCH 1/2] BUILD: Link libsss_ad.so to sasl libs [PATCH 2/2] BUILD: Use OPENLDAP_CFLAGS instead of LDAP_CFLAGS This underlinking was noticed in make check (dlopen-test). Note: It failed for me since my openldap build had no sasl support, which would otherwise have pulled in libsasl2.so. Of course, that support should be in place, but the linking should still be fixed. BTW: It would propably be nice to have a configure check whether openldap has sasl support, but it seems that would need a check if ldap_sasl_interactive_bind returns LDAP_NOT_SUPPORTED. Regards, Ben

6 13

[PATCH] BUILD: Link libsss_krb5_common.so to libkeyutils.so
by Benjamin Franzke 28 Apr '14

28 Apr '14

Hi List, The symbol add_key is used by src/providers/krb5/krb5_delayed_online_authentication.c which is part of libsss_krb5_common.so Fixes following error: [sssd[be[default]]] [load_backend_module] (0x0010): Unable to load ad module with path (/usr/lib64/sssd/libsss_ad.so), error: /usr/lib64/sssd/libsss_krb5_common.so: undefined symbol: add_key -lkeyutils was passed to the libraries libsss_{krb5,ipa,ad}.so, but when compiling with -Wl,--as-needed this flag will be ignored, since it is not used directly. So it was unavailable to libsss_krb5_common.so which actually needs it. This patch removes $(KEYUTILS_LIBS) from those libraries and adds it to libsss_krb5_common.so Maybe libsss_krb5_common.so should be added to dlopen-tests? But then other libraries and functions are needed as well, which it currently inherits from libsss_{krb5,ipa,ad}.so. BTW: are these common libraries (i mean ldap too) convenience build libraries, or to save disk space? If they're just for convencience maybe they should not be installed? Regards, Ben

4 16

[PATCH] nested groups unit test
by Pavel Březina 18 Feb '14

18 Feb '14

Hi, this is the first unit test for nested groups. It covers only the most basic situation when we are trying to resolve one group with no members. Even though it is only one test, the patch set is quite big. This is because it creates the possibility to mock providers related modules. Most of the patches are just a preparation for unit testing providers. Patches 1-5 Moves the code around to reduce number of dependencies. (E.g. you do not want to load fail over when you are testing nested groups.) Patch 6 Mocks basic SDAP interface. Patch 7 Mocks sysdb objects - currently user and rfc2307bis group. You can decide what set of attributes the object should posses. For example, creating a user requires only basedn and name parameter, to construct originalDN and name attributes. The rest is provided by (attrname, value) pairs via variadic function. E.g.: mock_sysdb_user(mem_ctx, basedn, name, SYSDB_UIDNUM, uid, ...) get_attr_type() translates the sysdb attribute name to proper data type. This should be extended as needed. Patch 8 Adds provider tests related common object files and cflags in makefile Patch 9 New macro sss_will_return_always(fn, value). This can be used to mock function data in such way that any call of mock() will return the value. It was just pushed also to cmocka upstream as will_return_always(). Patch 10-11 Unit test. Patch 12 Removes a noisy debug message. I would like to get this reviewed before I continue with more test cases, so the framework is tuned enough. Off topic: I also created new macro called fail_msg, which will make the test fail printing a message. I didn't use this macro in the end, but it made its way to cmocka upstream.

3 10

[INI][PATCHES] All of them (C-Style Comments, Unicode conversion, Space processing, UNIT tests)
by Dmitri Pal 10 Jan '14

10 Jan '14

Hello, This mail contains all the patches that I have so far in my git. -------------------------- The following set of patches is related to comments and unchanged from the previous submission. I replied to the comments about them in another mail. I do not think there is anything to address. If there is please let me know. 0001-INI-Do-not-check-validity-of-comments.patch 0002-INI-Extend-error-set-and-add-parsing-error.patch 0003-INI-Process-c-style-comments.patch 0004-INI-Test-files-for-unit-test.patch 0005-INI-Unit-test-for-c-style-comments.patch -------------------------- The following set of patches addresses comments and fixes bugs in Unicode/UTF8 conversion 0006-INI-Expose-buffer-context-as-void.patch 0007-INI-Extend-internal-file-handle.patch 0008-INI-Convert-files-to-UTF.patch 0009-INI-Updated-unit-test-for-UTF8-conversion.patch Thanks for review Lukas. I reworked the code significantly. I think I addressed everything except the initialization comment. I agree with you that it would have been better to initialize things outside the loop but I need to read the first buffer to be able to determine the encoding. This is what causes this logic. I do not see a way to avoid it so left that part as is. ---------------------------- The following one liner fixes a trace text 0010-INI-Fix-typo-in-comment.patch ---------------------------- The following patches are related to the problem I noticed earlier and recorded in the ticket https://fedorahosted.org/sssd/ticket/2119 But in reality the cause was bug in the Unicode conversion and a bug with space processing. 0011-INI-Fix-processing-of-the-white-space-at-the-end-of-.patch 0012-INI-Unit-test-for-space-trimming-in-multiline-values.patch ---------------------------- The following patch adds more unit test for both Unicode conversion and folding by combining the tests together. The unit tests written for each of them individually are not sufficient to catch corner cases. This test does. And I played with different constants before checking in to make sure that all sorts of combinations are caught. I decided to settle on these numbers because they provide sufficient amount of testing but do not extend the time too much. Right now all make check tests take about 7-8 seconds on my laptop. 0013-INI-Adding-more-unit-tests.patch -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 9

[PATCHES] Heimdal Support
by Benjamin Franzke 23 Dec '13

23 Dec '13

Hi list, I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them? They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log). This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there. I've tested this in a samba 4 environment (with the sssd-ad module). Regards, Ben

5 8

DEBUG macro refactoring
by Nikolai Kondrashov 18 Dec '13

18 Dec '13

Hi everyone, I've been looking at the sssd sources for some test failure investigation and noticed that the DEBUG macro expands to quite a lot of code. I decided to see if it can be reduced and what the impact will be. The result is the patches that follow. I've noticed that the total size of installed binaries produced by the standard Fedora build with "reconfig && chmake" drops by 20% after applying these patches. A build on Debian, configured similarly to the one used in the Debian package dropped by 44%. I've verified that all the patches build and pass the tests run by "chmake", but otherwise haven't tested them. Sincerely, Nick

7 37

[PATCH] AUTOMAKE: Don't build libsss_test_common every time
by Lukas Slebodnik 29 Nov '13

29 Nov '13

ehlo, Although static library libsss_test_common was used only in tests, It was also built with command "make all". Simple patch is attached. LS

2 9

[PATCH] Look up originalDN if not available during LDAP auth
by Jakub Hrozek 20 Nov '13

20 Nov '13

Hi, the attached two patches fix #2077. I wrote the patches even though there are unresolved 1.11 issues because there was a customer looking for a test package.

2 6

[PATCH] PROXY: Handle empty GECOS
by Jakub Hrozek 20 Nov '13

20 Nov '13

I found this bug while triaging a customer case with Chris Hudson who ran into the same issue Simo fixed recently in the proxy provider.

2 3

Fix proxy backend initgroups_dyn code
by Simo Sorce 20 Nov '13

20 Nov '13

Tested fix for #2051 and seem to work. However it just occurred to me we may always want to check if pwd.pw_gid is listed in the gids returned and add it if not ? Simo. -- Simo Sorce * Red Hat, Inc * New York

3 5

[PATCHES] Alignment issues reported by Clang
by Michal Židek 15 Nov '13

15 Nov '13

Patches 1-4 and 9: These patches use the SAFEALIGN macros where it is appropriate. I split them into several patches for easier review, so that client code changes are not mixed with the rest of the code and changes that are a little different than the rest have their own patch. Patches 5-6: Here I think it is not needed to use uint8_t* or char*. We cast the pointer anyway and there are no real alignment issues (the memory is aligned properly). I was thinking about suppressing the warnings with #pragma here, but in this particular situation it is IMO better to have just void*. Patches 7-8: These were all false positive warnings. It is possible to suppress them with additional casting but I found it less readable so I used #pragma. Patch 10: We had improperly aligned part of a buffer used in client code. Also some code blocks here must rely on fact that the buffer they get is aligned properly (they can do nothing about it if it isn't). In these cases it is better to silence the warnings, so that it does not make permanent noise during compilation. Thanks Michal

5 13

[PATCH] Inherit ID limits of parent domains if set
by Jakub Hrozek 14 Nov '13

14 Nov '13

Hi, the attached patch was tested by a customer running RHEL6. I'm not sure if we should do any more checking when running on a modern system where ranges can be better defined on the IPA side for example?

2 3

[PATCH] Add ldap_autofs_map_master_name option
by C. S. 12 Nov '13

12 Nov '13

Add ldap_autofs_map_master_name option so that the auto master map name change be changed from the default auto.master.

3 17

[PATCH] UTIL: Free log message when using journald
by Jakub Hrozek 07 Nov '13

07 Nov '13

I was exercising sssd with valgrind when looking for #1020945 and found this leak.

3 6

[PATCH] confdb: Make offline timeout configurable
by Michal Židek 07 Nov '13

07 Nov '13

I decided not to only document the behaviour, but also add option to configure it (so I could remove one FIXME from the code). https://fedorahosted.org/sssd/ticket/1718 Michal

5 11

[PATCH] responder: Access packet header using SAFEALIGN macros
by Michal Židek 07 Nov '13

07 Nov '13

Hello, the attached patch should uses the SAFEALIGN macros to access data in the packet header (in sss_packet structure) so that it does not depend on proper memory alignment (currently the alignment is OK, but if we add something to the packet header later, it is probably safer not to depend on proper alignment). It also silences a lot of alignment warnings. Thanks Michal

4 10

[PATCH] Include external headers with #include <foo.h>
by Jakub Hrozek 04 Nov '13

04 Nov '13

Attached is a style patch. Feel free to ack or nack, it's just a readability improvement.

5 16

[PATCH] NSS: Check allocation result
by Jakub Hrozek 01 Nov '13

01 Nov '13

Another small bug I found when looking for #1020945

5 9

Announcing SSSD 1.11.2
by Jakub Hrozek 31 Oct '13

31 Oct '13

=== SSSD 1.11.2 === The SSSD team is proud to announce the release of version 1.11.2 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 19, 20 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * A new option ad_access_filter was added. This option allows the administrator to easily configure LDAP search filter that the users logging in must match in order to be granted access * Group resolution now supports resolving group members from different trusted AD domains in a single forest * A bug that prevented a configuration file with trailing spaces to be loaded was fixed * SSSD no longer crashes if the LDAP connection is terminated while LDAP requests are still in progress * Several important bugs related to the Global Catalog support were fixed: * SSSD now correctly falls back to LDAP lookups in case Global Catalog is not reachable * If the AD servers were specified using the ad_server option and not autodiscovered, server fail over did not work correctly with 1.11.1 == Feature removal == * The Kerberos provider is no longer able to create public directories when evaluating the krb5_ccachedir option. This is a backwards-incompatible change. Creating public directories is something the system administrator should perform in order for the directories to have the correct permissions and allow the authentication daemon to create user directories as private only. == Documentation Changes == * The decimal debug levels are now recommended instead of the advanced hexadecimal levels which are more suitable for developers == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1968 Memory grows if subdomain goes away in the AD provider https://fedorahosted.org/sssd/ticket/2030 getent response requires sssd restart after trust add https://fedorahosted.org/sssd/ticket/2064 ad: unable to resolve membership when user is from different domain than group https://fedorahosted.org/sssd/ticket/2071 Ccache directory creation leads to unexpected results https://fedorahosted.org/sssd/ticket/2082 [RFE] Add a new option ad_access_filter https://fedorahosted.org/sssd/ticket/2092 Group lookup is not returned immediately after service startup https://fedorahosted.org/sssd/ticket/2100 sudo responder does not support specifying just one of sudoNotBefore/sudoNotAfter https://fedorahosted.org/sssd/ticket/2101 Use idrange of forest root if there is none for a member domain and type is ipa-ad-trust-posix https://fedorahosted.org/sssd/ticket/2104 AD provider should fall back the LDAP if Global Catalog is not reachable https://fedorahosted.org/sssd/ticket/2105 Do not show 'Could not add new domain' error messages if ldap_id_mapping=false https://fedorahosted.org/sssd/ticket/2112 Coverity reported potential NULL dereference https://fedorahosted.org/sssd/ticket/2116 SID looksups are not handled if noexist_delete flag is set https://fedorahosted.org/sssd/ticket/2121 ipa ad trusted user lookups failed with sssd_be crash https://fedorahosted.org/sssd/ticket/2123 Creating system accounts on a IdM client takes up to 10 minutes when AD trust is configured in the IdM. https://fedorahosted.org/sssd/ticket/2124 sssd_nss exited abnormally and generated core files. https://fedorahosted.org/sssd/ticket/2126 sssd_be segfault when authenticating against active directory https://fedorahosted.org/sssd/ticket/2131 NSS responder doesn't qualify memberuid and ghost users of groups that contain members from different domains == Detailed Changelog == Jakub Hrozek (23): * Updating the version for the 1.11.2 release * krb5: Fix unit tests * INI: Disable line-wrapping functionality * KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD user * PROXY: Fix memory hierarchy when enumerating services * Inherit ID limits of parent domains if set * SYSDB: Add sysdb_delete_by_sid * LDAP: Delete entry by SID if not found * LDAP: Amend sdap_access_check to allow any connection * LDAP: Parse FQDN into name/domain for subdomain users * AD: Add a new option ad_access_filter * AD: Use the ad_access_filter if it's set * AD: Search GC by default during access control, fall back to LDAP * AD: Add extended access filter * TEST: Test getgrnam with emphasis on members * NSS: Print FQDN for groups with mixed domain membership * KRB5: Handle ERR_CHPASS_FAILED * NSS: Fix service enumeration * MAN: Document that krb5 directories can only be created as private * LDAP: Check all search bases during nested group processing * NSS: Fix parenthesis * AD: Fix ad_access_filter parsing with empty filter * Updating translation for the 1.11.2 release Lukas Slebodnik (9): * LDAP: Set default value for dyndns update to false * krb5: Remove warning dereference of a null pointer * krb5: Use right function to free data. * AD: Prefer GC port from SRV record * AD: fall back to LDAP if GC is not available. * tests: Use right format string for type size_t * Makefile: Add missing libraries * Makefile: Remove unused variable TEST_MOCK_OBJ * LDAP: Return correct error code Pavel Březina (23): * sudo: allow specifying only one time restriction * sudo: improve time restrictions debug messages * nss: wait for initial subdomains request to finish * subdomains: first destroy ptask then remove sdom * dp: make subdomains refresh interval configurable * dp: store list of ongoing requests * utils: add ERR_DOMAIN_NOT_FOUND error code * dp: set request domain * dp: add function to terminate request of specific domain * dp: free sdap domain if subdomain is removed * be_ptask: add be_ptask_create_sync() * dp: convert cleanup task to be_ptask * ipa: destroy cleanup task when subdomain is removed * ad: destroy ptasks when subdomain is removed * sdap_save_user: try to determine domain by SID * sdap_save_group: try to determine domain by SID * free sid obtained from sss_idmap_unix_to_sid() * ad: shortcut if possible during get object by ID or SID * sdap: store base dn in sdap_domain * sdap: add sdap_domain_get_by_dn() * ghosts: pick correct domain for every member * sdap_fill_memberships: pick correct domain for every member * nested groups: pick correct domain for cache lookups Simo Sorce (1): * krb5: Remove ability to create public directories Stephen Gallagher (4): * SYSDB: Fix incorrect DEBUG message * MAN: Clarify debug level documentation * MAN: Reflow debug_levels.xml * BUILD: Update bashrc macros Sumit Bose (17): * AD: properly intitialize GC from ad_server option * LDAP: handle SID requests if noexist_delete is set * IPA server mode: properly initialize ext_groups * idmap: add internal function to free a domain struct * idmap: fix a memory leak if a collision is detected * idmap: allow ranges with external mapping to overlap * sdap_idmap: add sdap_idmap_get_configured_external_range() * sdap_idmap: properly handle ranges for external mappings * Add unconditional online callbacks * IPA: add callback to reset subdomain timeouts * sdap_get_generic_ext_send: check if we a re still connected * find_subdomain_by_sid: skip domains with missing domain_id * idmap: add sss_idmap_domain_by_name_has_algorithmic_mapping() * sdap_idmap_domain_has_algorithmic_mapping: add domain name argument * IPA: add trusted domains with missing idrange * ad_subdom_store: check ID mapping of the domain not of the parent * be_spy_create: free be_req and not the long living data

2 1

[PATCH] ad: support cross domain membership
by Pavel Březina 30 Oct '13

30 Oct '13

https://fedorahosted.org/sssd/ticket/2064 These patch set depends on: [PATCH] ad: store group in correct tree on initgroups via tokenGroups You can also pull it with all dependencies from my repository: fedorapeople.org:public_git/sssd.git #ad-groups The fundamental changes in this patch set are: - lookup groups in global catalog - pick up member domain from its originalDN

3 24

[PATCH] AD: Fix ad_access_filter parsing with empty filter
by Jakub Hrozek 30 Oct '13

30 Oct '13

I'm sorry about the breakage, but if the ad_access_filter was unset yet access_provider was set to AD, access was denied. Even though the access order was set correctly to "expire, filter", the filter being NULL caused problems. A patch including unit test is attached.

2 2

[PATCH] be_spy_create: free be_req and not the long living data
by Sumit Bose 30 Oct '13

30 Oct '13

Hi, Steeve found some unusual behaviour during his test which led to the shutdown of the whole SSSD. The attached patch should fix it. bye, Sumit

2 3

[PATCH] free sid obtained from sss_idmap_unix_to_sid()
by Pavel Březina 30 Oct '13

30 Oct '13

4 5

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2013