sssd-devel April 2021

sssd-devel@lists.fedorahosted.org

1 participants
57 discussions

[sssd PR#5558][opened] p11_child: Add partial verification support
by 3v1n0 12 Apr '21

12 Apr '21

URL: https://github.com/SSSD/sssd/pull/5558 Author: 3v1n0 Title: #5558: p11_child: Add partial verification support Action: opened PR body: """ From the main commit: <blockquote> As per the switch to libcrypto by default, the CA certificates DB needs to contain the whole certificates key-chain in order to verify a leaf certificate. This means that if an intermediate CA authority signed a leaf certificate the CA DB we provide to SSSD needs to contain the whole key-chain, up to the root CA cert in order to verify the leaf one. Now, while this is indeed more secure, it may break previous configurations that were based on an NSS database that contained only trusted intermediate CA certificates. To allow such setups to continue working (once the NSS db is migrated) we need to permit a "weaker" setup where an x509 certificate is verified when the CA database we test against contains only the intermediate CA certificate that was used to sign it. As per this, support `partial_chain` value to be used as `certification_verification` parameter that will add the `X509_V_FLAG_PARTIAL_CHAIN` verify param flag to the store, as the openssl's verify `-partial-chain` parameter works. This setup can still be considered secure as it's still needed to have configured the SSSD ca db to contain the trusted certs. Add tests to check that we can verify a leaf certificate against its parent (only) when using such option. </blockquote> In particular in Ubuntu we [switched to use libcrypto by default in our current LTS](https://bugs.launchpad.net/ubuntu/focal/+source/sssd/+bug/1905790), even if we never supported properly the usage of NSS system DB, it was possible to setup one and so we did a [simple migration tool](https://github.com/3v1n0/nss-database-pem-exporter) to export all the trusted NSS certificates to the SSSD's `ca_db`. However, there are still some custom setups in which [may break when using openssl based implementation](https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1919563), because their NSS db was only containing the issuing CA certificates (and no their parent certs) and so it's not possible to verify their certificate. So using `pam_cert_verification = partial_chain` on upgrades (only and only if migrated) we can ensure that no such system will be broken. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5558/head:pr5558 git checkout pr5558

3 31

[sssd PR#5572][opened] Handle large service tickets in SSS_GSSAPI_SEC_CTX packets
by yrro 12 Apr '21

12 Apr '21

URL: https://github.com/SSSD/sssd/pull/5572 Author: yrro Title: #5572: Handle large service tickets in SSS_GSSAPI_SEC_CTX packets Action: opened PR body: """ Fixes #5568 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5572/head:pr5572 git checkout pr5572

3 22

[sssd PR#5495][opened] Fix python headers detection with recent autoconf (Fixes #5336)
by mtorromeo 08 Apr '21

08 Apr '21

URL: https://github.com/SSSD/sssd/pull/5495 Author: mtorromeo Title: #5495: Fix python headers detection with recent autoconf (Fixes #5336) Action: opened PR body: """ See details in issue report #5336. This is causing issues on Arch Linux which is using autoconf-2.71 at the moment. This only addresses the specific issue with python headers detection and not the whole use of if statements in autoconf files. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5495/head:pr5495 git checkout pr5495

4 17

[sssd PR#5573][opened] configure: set CPP macro with AC_PROG_CPP
by ikerexxe 08 Apr '21

08 Apr '21

URL: https://github.com/SSSD/sssd/pull/5573 Author: ikerexxe Title: #5573: configure: set CPP macro with AC_PROG_CPP Action: opened PR body: """ sssd build with an autoconf version greater than 2.70 fails because CPP macro is empty. This change fixes this problem by setting the macro with AC_PROG_CPP at the beginning of the configuration. Resolves: https://github.com/SSSD/sssd/issues/5563 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5573/head:pr5573 git checkout pr5573

4 9

[sssd PR#5535][opened] A set of patches to sanitize logger code a little bit.
by alexey-tikhonov 06 Apr '21

06 Apr '21

URL: https://github.com/SSSD/sssd/pull/5535 Author: alexey-tikhonov Title: #5535: A set of patches to sanitize logger code a little bit. Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5535/head:pr5535 git checkout pr5535

5 25

[sssd PR#5546][opened] kcm: add GET_CRED_LIST for faster iteration
by pbrezina 06 Apr '21

06 Apr '21

URL: https://github.com/SSSD/sssd/pull/5546 Author: pbrezina Title: #5546: kcm: add GET_CRED_LIST for faster iteration Action: opened PR body: """ For large caches, one IPC operation per credential dominates the cost of iteration. Instead transfer the whole list of credentials to the client in one IPC operation. Resolves: https://github.com/SSSD/sssd/issues/5545 This is a continuation of https://github.com/SSSD/sssd/pull/5375. The first pull requests addressed bottlenecks in sssd-kcm and reduced the test case run time from 30 minutes to 2 minutes, this new operation takes it down to 9 seconds. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5546/head:pr5546 git checkout pr5546

2 14

[sssd PR#5564][opened] DEBUG: Error is printed when everything is ok
by thalman 01 Apr '21

01 Apr '21

URL: https://github.com/SSSD/sssd/pull/5564 Author: thalman Title: #5564: DEBUG: Error is printed when everything is ok Action: opened PR body: """ Due to invalid condition error message that config file does not exist is printed when there is actually no problem. This update fixes the condition. Thanks @alexey-tikhonov for pointing this out. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5564/head:pr5564 git checkout pr5564

3 8

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2021