sssd-devel November 2013

sssd-devel@lists.fedorahosted.org

18 participants
68 discussions

[PATCH 5/7] responder: Use SAFEALIGN macro when checking pam data, validity.
by Michal Židek 03 Dec '13

03 Dec '13

On 11/14/2013 01:14 PM, Lukas Slebodnik wrote:>>From fbc7adbf1331fdb931b43f2b6ffda43565ce442e Mon Sep 17 00:00:00 2001 >> >From: Michal Zidek<mzidek(a)redhat.com> >> >Date: Wed, 4 Sep 2013 16:17:57 +0200 >> >Subject: [PATCH 5/7] responder: Use SAFEALIGN macro when checking pam data >> >validity. >> > >> >resolves: >> >https://fedorahosted.org/sssd/ticket/1359 >> >--- >> >src/responder/pam/pamsrv_cmd.c | 18 +++++++++++++----- >> >1 file changed, 13 insertions(+), 5 deletions(-) >> > >> >diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c >> >index 32efc4b..6418047 100644 >> >--- a/src/responder/pam/pamsrv_cmd.c >> >+++ b/src/responder/pam/pamsrv_cmd.c >> >@@ -144,12 +144,20 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains, >> > uint32_t size; >> > char *pam_user; >> > int ret; >> >- uint32_t terminator = SSS_END_OF_PAM_REQUEST; >> >+ uint32_t start; >> >+ uint32_t terminator; >> > >> >- if (blen < 4*sizeof(uint32_t)+2 || >> >- ((uint32_t *)body)[0] != SSS_START_OF_PAM_REQUEST || >> >- memcmp(&body[blen - sizeof(uint32_t)], &terminator, sizeof(uint32_t)) != 0) { > Function memcmp is also used in the function pam_forwarder_parse_data, > although there is no alignment warning we should be consistent at least in the > same file. Yes. I modified it to use safealign copy as well in the new patch. Michal PS: Btw. why is the condition to detect unterminated data like this if (blen >= sizeof(uint32_t) && lastfourbytes != END_OF_PAM_REQUEST) { return error; } Shouldn't it be like this? if (blen < sizeof(uint32_t) || lastfourbytes != END_OF_PAM_REQUEST) { return error; } Is it possible that pam request shorter than terminator is valid?

3 2

[PATCH 1/7] sss_client: Use SAFEALIGN_COPY_<type> macros where appropriate
by Michal Židek 03 Dec '13

03 Dec '13

On 11/14/2013 01:14 PM, Lukas Slebodnik wrote:> On (05/11/13 15:18), Michal Židek wrote: >>>>> Thanks for the responses. >>>>> >>>>> I decided to reduce the patches for this thread to only >>>>> similar or simple changes. I think it is still quite enough >>>>> for a review. I will post patches for the rest of the issues >>>>> (like the one with sockaddr) in >>>>> separate threads. I hope this will make review easier. So >>>>> after applying >>>>> these patches there will still be a lot of warnings. >>>>> >>>>> New patches attached. >>>>> >>>>> PS: Sorry for delayed answer. >>>>> >>>>> >>> >>> Sending patches rebased on top of current master. >>> >>> Michal >>> >> From 93a3b127e24ed26068ca7cfea41992a86440d8c2 Mon Sep 17 00:00:00 >> 2001 >>> From: Michal Zidek<mzidek(a)redhat.com> Date: Wed, 21 Aug 2013 >>> 17:17:06 +0200 Subject: [PATCH 1/7] sss_client: Use >>> SAFEALIGN_COPY_<type> macros where diff --git >>> a/src/sss_client/idmap/sss_nss_idmap.c b/src/sss_client/idmap/sss_nss_idmap.c >>> index e0faf6e..69f825f 100644 --- >>> a/src/sss_client/idmap/sss_nss_idmap.c +++ >>> b/src/sss_client/idmap/sss_nss_idmap.c @@ -108,7 +108,7 @@ static >>> int sss_nss_getyyybyxxx(union input inp, enum sss_cli_command cmd , >>> goto done; } >>> >>> - num_results = ((uint32_t *)repbuf)[0]; + >>> SAFEALIGN_COPY_UINT32(&num_results, repbuf, NULL); if >>> (num_results == 0) { ret = ENOENT; goto done; @@ -117,7 +117,7 @@ >>> static int sss_nss_getyyybyxxx(union input inp, enum sss_cli_command cmd , >>> goto done; } >>> > Please add comment why comment why you skipped one unit32_t There is > already similar comment on the other place in this patch. /* Skip > first two 32 bit values (number of results and * reserved padding) > */ Added. > >>> - out->type = ((uint32_t *)repbuf)[2]; + >>> SAFEALIGN_COPY_UINT32(&out->type, repbuf + 2 * sizeof(uint32_t), NULL); >>> >>> data_len = replen - DATA_START; >>> >>> diff --git a/src/sss_client/nss_group.c >>> b/src/sss_client/nss_group.c index e6ea54b..a7fb093 100644 --- >>> a/src/sss_client/nss_group.c +++ b/src/sss_client/nss_group.c @@ >>> -298,7 +298,7 @@ enum nss_status _nss_sss_initgroups_dyn(const char *user, gid_t group, >>> } >>> >>> /* no results if not found */ - num_ret = ((uint32_t >>> *)repbuf)[0]; + SAFEALIGN_COPY_UINT32(&num_ret, repbuf, >>> NULL); if (num_ret == 0) { free(repbuf); nret = >>> NSS_STATUS_NOTFOUND; @@ -328,9 +328,13 @@ enum nss_status >>> _nss_sss_initgroups_dyn(const char *user, gid_t group, >>> *size = newsize; } >>> > The same issue is here. >>> - rbuf = &((uint32_t *)repbuf)[2]; + /* Skip first two 32 >>> bit values (number of results and + * reserved padding) */ ^^^^^^^^^^^^^^^^^^^^^ The comment was there. Maybe I missed something? >>> + buf_index = 2 * sizeof(uint32_t); + for (l = 0; l < max_ret; >>> l++) { - (*groups)[*start] = rbuf[l]; + >>> SAFEALIGN_COPY_UINT32(&(*groups)[*start], repbuf + buf_index, + >>> &buf_index); *start += 1; } >>> > Otherwise, conditions look much nicer with variables like a > "num_results" instead of "buffer magic" (((uint32_t *)repbuf)[0] == > 0) New patch attached. Michal

3 2

[PATCH] - Improved detection of user domain
by Pavel Reichl 03 Dec '13

03 Dec '13

Hello, First patch improves domain detection taking matched length into account as proposed and elaborated by Jakub. Second patch is a simple unit test testing sss_ldap_dn_in_search_bases and sdap_domain_get_by_dn. Pavel Reichl

4 18

kerberos problems with 2008R2 AD
by Greg Lehmann 01 Dec '13

01 Dec '13

Hi All, I'm after some help tracking this problem down. I am seeing this from a few different OSes all with the same AD realm: CentOS 6.4, SLES 11SP3 and opensuse 13.1 all of which run sssd 1.9.x and SLES 11 SP2 running sssd 1.5.11. The ldap side of things seems to be working OK as getent passwd is returning what I expect. The kerberos side of things is not, although kinit as a user works: client:/var/log/sssd # kinit user Password for user(a)DOM.COMPANY.COM: client:/var/log/sssd # It looks like the realm is being truncated somehow so DOM.COMPANY.COM is getting truncated to COMPANY.COM for the kerberos lookups. I see this in the krb5_child.log file: (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [main] (0x0400): krb5_child started. (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [unpack_buffer] (0x1000): total buffer size: [104] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [unpack_buffer] (0x0100): cmd [241] uid [67657] gid [67657] validate [false] offline [false] UPN [user(a)COMPANY.COM] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_67657_XXXXXX] keytab: [/etc/krb5.keytab] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0400): Will perform online auth (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sss_child_set_krb5_tracing] (0x0100): krb5 tracing is not available (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_set_canonicalize] (0x0100): SSSD_KRB5_CANONICALIZE is set to [false] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sss_krb5_get_init_creds_opt_set_canonicalize] (0x0040): Kerberos principal canonicalization is not available! (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0100): Not using FAST. (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sss_krb5_get_init_creds_opt_set_expire_callback] (0x0200): krb5_get_init_creds_opt_set_expi re_callback not available. (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [COMPANY.COM] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [get_and_save_tgt] (0x0020): 977: [-1765328230][Cannot find KDC for requested realm] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [kerr_handle_error] (0x0020): 1030: [-1765328230][Cannot find KDC for requested realm] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [prepare_response_message] (0x0400): Building response for result [-1765328230] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [pack_response_packet] (0x2000): response packet size: [48] (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sendresponse] (0x4000): Response sent. (Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [main] (0x0400): krb5_child completed successfully sssd.conf: [sssd] config_file_version = 2 debug_level = 10 reconnection_retries = 3 sbus_timeout = 30 services = nss,pam domains = DOM.COMPANY.COM [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 debug_level = 10 offline_credentials_expiration = 3 [domain/DOM.COMPANY.COM] debug_level = 10 filter_groups = root filter_users = root description = LDAP domain with AD server cache_credentials = false enumerate = false min_id = 65537 ldap_uri = ldap://dc1.dom.comany.com ldap_sasl_mech = GSSAPI ldap_krb5_keytab = /etc/krb5.keytab ldap_sasl_authid = CLIENT$(a)DOM.COMPANY.COM ldap_search_base = dc=dom,dc=company,dc=com ldap_schema = rfc2307bis id_provider = ldap ldap_user_search_base = ou=People,dc=dom,dc=company,dc=com ldap_group_search_base = ou=Groups,dc=dom,dc=company,dc=com ldap_group_name = msSFU30Name ldap_group_nesting_level = 5 ldap_user_object_class = user ldap_user_home_directory = unixHomeDirectory ldap_user_principal = userPrincipalName ldap_group_object_class = group ldap_force_upper_case_realm = true auth_provider = krb5 krb5_realm = DOM.COMPANY.COM krb5_server = dc.dom.company.com krb5.conf: [libdefaults] clockskew = 300 default_realm = DOM.COMPANY.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true default_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5 default_tkt_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5 preferred_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC [realms] DOM.COMPANY.COM = { default_domain = dom.company.com admin_server = dc1.dom.company.com kpasswd_server = dc1.dom.company.com kdc = dc1.dom.company.com } [domain_realm] .dom.company.com = DOM.COMPANY.COM dom.company.com = DOM.COMPANY.COM [logging] default = SYSLOG:NOTICE:DAEMON [appdefaults] pam = { ticket_lifetime = 1d renew_lifetime = 1d forwardable = true debug = true krb4_convert = false }

4 5

[PATCH] KRB5: Go offline in case of clock skew
by Jakub Hrozek 29 Nov '13

29 Nov '13

Hi, while testing the offline subdomain logins, I found out that clock skew (which is still an issue in trusted environments even after the recent MIT Kerberos changes) results in System Error. The attached patch simply treats the skew as networking error, which results in failover and if no good serve is found, then in offline operation. It didn't seem necessary to me to add new error code, but if other developers would like ie better error reporting, I can add it easily.

2 2

[PATCHES] SYSDB: Sanitize filter before removing ghost attrs
by Lukas Slebodnik 29 Nov '13

29 Nov '13

ehlo, attached patches should fix https://fedorahosted.org/sssd/ticket/2163 LS

2 9

[PATCH] AUTOMAKE: Don't build libsss_test_common every time
by Lukas Slebodnik 29 Nov '13

29 Nov '13

ehlo, Although static library libsss_test_common was used only in tests, It was also built with command "make all". Simple patch is attached. LS

2 9

[PATCH] LDAP: Initialize user count for AD matching rule
by Jakub Hrozek 28 Nov '13

28 Nov '13

A RHEL customer was hitting this issue. To reproduce, just enable the matching rule and request an empty group.

2 3

sssd_be not telling user account is locked?
by Viviano, Brad 27 Nov '13

27 Nov '13

Hello, I have a RHEL6 server running sssd 1.9.2-129 (Redhat RPM). I've configured it to talk to my LDAP server, which is OpenLDAP. OpenLDAP doesn't nativly support account locking via ldap_ns_account_lock so I added a schema extension so I could set a an account locked when needed. Everything is working fine having ldap_account_expire_policy set to rhds, but I was wondering if there was an option in sssd to provide a message to the user directly that the account is locked when they try and login. All the user sees is (as an example): $ ssh -o bviviano@myhost bviviano@myhost's password: Your password will expire in 6 day(s). Connection closed If I look in /var/log/secure I see this message: Nov 27 10:03:44 smtools sshd[17267]: pam_sss(sshd:account): system info: [The user account is locked on the server] I can see the account is locked and my sssd log for that domain shows the account is locked: (Wed Nov 27 10:03:44 2013) [sssd[be[default]]] [sdap_account_expired_rhds] (0x0400): Performing RHDS access check for user [bviviano] (Wed Nov 27 10:03:44 2013) [sssd[be[default]]] [sdap_account_expired_rhds] (0x4000): Account for user [bviviano] is locked. (Wed Nov 27 10:03:44 2013) [sssd[be[default]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 6, <NULL>) [Success] I'd just like to provide that information back to the user directly in this case, if its an option. Thanks, -Brad Viviano =================================================== Brad Viviano High Performance Computing & Scientific Visualization Lockheed Martin, Supporting the EPA Research Triangle Park, NC 919-541-2696 HSCSS Task Order Lead - Ravi Nair 919-541-5467 - Nair.Ravi(a)epa.gov High Performance Computing Subtask Lead - Durward Jones 919-541-5043 - Jones.Durward(a)epa.gov Environmental Modeling and Visualization Lead - Heidi Paulsen 919-541-1834 - Paulsen.Heidi(a)epa.gov

2 3

[PATCHES] Remove unused parameter after sysdb refactoring
by Lukas Slebodnik 27 Nov '13

27 Nov '13

ehlo, there are lof of unused parametres in functions after sysdb refactoring. Patches are splitted per function for easier review. I can reduce count of patches after review. LS

3 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2013