Age | Commit message (Collapse) | Author | Files | Lines |
|
Similar to George McCollister's patch to the pam code, this patch fixes
other places in the code where we forced data into 32-bit alignment.
Fixes: #390
|
|
* sssd.conf
* sbus_timeout was used in an example but explained nowhere
* enum_cache_timeout unit was not defined
* same for entry_cache_timeout
* store_legacy_passwords option does not exist anymore
* better example than domain/LOCAL - domain/LDAP which uses krb5/ldap
* sssd.conf(5) listed sssd.conf(5) in SEE ALSO section
* sssd-krb5, sssd-ldap
* these include each other in SEE ALSO section
Fixes: #393
|
|
- return PAM_AUTHTOK_ERR instead of PAM_SYSTEM_ERR if the password
change operation fails
- send a message to the user if the system is offline and the password
cannot be changed
|
|
|
|
|
|
|
|
|
|
|
|
Older versions of openLDAP do not provide a connection callback. This
patch adds a configure check to see if the callback is available and
activates the old way of handling the file description of the LDAP
connection. This also means that it is not possible to follow referrals.
|
|
Also add list_mandatory_options() to both SSSDService and
SSSDDomain objects.
There is a new list_options_with_mandatory() function that will
return a longer tuple than list_options(), including the mandatory
flag directly.
|
|
|
|
crypto_sha512crypt.c is a clone of nss_sha512crypt.c with the exception that
all usage of NSS and related libraries has been switched to libcrypto.
I renamed nss_sha512crypt.h to sha512crypt.h since it is common to both
crypto_sha512crypt.c and nss_sha512crypt.c. Note that the random number
generator is not seeded manually and thus relies on seeding done
automatically by libcrypto. On some systems without /dev/urandom
seeding may not be performed.
See http://www.openssl.org/docs/crypto/RAND_add.html.
Signed-off-by: George McCollister <georgem@novatech-llc.com>
|
|
|
|
It can be overridden in the sssd.conf or on the commandline with
--debug-timestamps=0
|
|
When CK_FORK is set to 'no' the fixtures are executed for every new test
inside of the same process. Global variables must be set to the expected
values by the fixtures.
check_and_open-tests.c: the filename template for mkstemp() was a
globally defined character string. After the first call to mkstemp() the
trailing XXXXXX are substituted by random values, a second call to
mkstemp() with this character string fails. This patch initialize the
filename template before mkstemp() is called with the help of strdup()
and the memory is freed in the teardown fixture.
krb5_utils-tests.c: this patch sets the just freed global talloc context
to NULL to make a consistency check in the setup fixture pass.
|
|
The leak checking code which is used by the resolve and failover tests
frees talloc's autofree context which is not recommended. As a
consequence the initialization of tevent failed when it was called by
the second test and CF_FORK=no, because it holds some data in the
autofree context.
This patch introduces a global talloc context which should be uses by
the test as the root of their memory hierarchy instead of NULL. This
global context is used in the leak checking routines.
Not all types of memory leaks can be detected by the new version , it is
recommended to use valgrind or similar tools additionally.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If the monitor receives SIGUSR1, it will instruct all providers to
enter offline operation. If any individual provider receives
SIGUSR1, it alone will enter offline operation.
|
|
|
|
|
|
|
|
|
|
uint32_t pointers must point to 32 bit aligned data on ARM. Instead of padding the data to force it into alignment I altered the code to memcpy the data to an aligned location. I'd appreciate any and all feedback especially on whether I took the best approach.
pam_test_client auth and pam_test_client acct now work on my armeb-xscale-linux-gnueabi target.
Signed-off-by: George McCollister <georgem@opteron.novatech-llc.com>
|
|
We weren't properly setting read/write flags on the tevent fd
events, so c-ares was unable to perform bidirectional
communication for TCP DNS (in situations where the response is too
large to send by UDP)
|
|
|
|
This is the preferred way of setting the version in a file, as
autotools will properly monitor this file for changes and rerun
autoconf/configure when necessary to update the version. This
means that we don't need to manually perform an autoreconf in
order to build a new RPM
|
|
Right now, the pkg-config checks for the system version of
libdhash are forcibly disabled, requiring the SSSD to build it
from its own tree. In the future, when we split the libraries off
from the SSSD, it will be easy to switch this check to the
external library.
|
|
|
|
This fixes two issues:
1) Eliminates a double-free when a timeout occurs (we were freeing
the running event context)
2) Ensures that we don't continue to schedule unnecessary timeout
checks
|
|
The manual pages for userdel and groupdel utilities incorrectly
stated that deleting a nonexistent user or group is a noop. We
changed that behavior, but forgot to sync the documentation.
|
|
|
|
The code for authentication against a cached password is moved from the
pam responder to a generic sysdb tevent request. The new code can be
used by other components of sssd to verify passwords on their own.
Tests for the sysdb_cache_password and sysdb_cache_auth request are
added and some unneeded or unused code and variables are removed.
|
|
This patch adds a utility called sss_groupshow that allows user to
print properties of a group in the local domain.
Fixes: #306
|
|
Some reformatting to stay within 79 char line length.
Better definition of server vs. machine usage in failover section.
|
|
When the resolv context destructor is invoked, the callbacks for pending
queries could have been called with ARES_EDESTRUCTION and try to re-send
the query.
|
|
Since ares_process_fd() might also cause fd_event() to be called again,
calling ares_process_fd() is unwise. The bug will cause a crash if
c-ares is using tcp connections.
Fixes: #384
|
|
Since we only call c-ares to process input on FD when there is an
activity on them, c-ares never gets a chance to react to a timed-out
request. This caused SSSD to hang.
Fixes: #381
|
|
We will allow 5s per DNS server, no retries.
|
|
|
|
Fixes: #378
|
|
Update tests to reflect these removals.
|
|
|
|
Fixes CVE-2010-0014
|
|
|