summaryrefslogtreecommitdiff
path: root/src/responder/common/responder.h
AgeCommit message (Collapse)AuthorFilesLines
2013-01-15Refactor sysdb initializationSimo Sorce1-1/+0
Change the way sysdbs are initialized. Make callers responsible for providing the list of domains. Remove the returned array of sysdb contexts, it was used only by sss_cache and not really necessary there either as that tool can easily iterate the domains. Make sysdb ctx children of their respective domains. Neither sysdb context nor domains are ever freed until a program is done so there shouldn't be any memory hierarchy issue. As plus we simplify the code by removing a destructor and a setter function.
2012-10-11do not call dp callbacks when responder is shutting downPavel Březina1-0/+2
https://fedorahosted.org/sssd/ticket/1514 We were experiencing crash duting responder shut down. This happened when there were some unresolved dp request during the shut down. The memory hierarchy is main_ctx->specific_ctx->rctx, where specific_ctx may be one of the pam, nss, sudo, etc. contexts. If we try to call dp request callback as a result of responder termination, the specific context is already semi freed, which may cause crash.
2012-10-01Add new option default_domain_suffixSumit Bose1-0/+3
2012-07-10pac responder: limit access by checking UIDsSumit Bose1-0/+10
A check for allowed UIDs is added in the common responder code directly after accept(). If the platform does not support reading the UID of the peer but allowed UIDs are configured, access is denied. Currently only the PAC responder sets the allowed UIDs for a socket. The default is that only root is allowed to access the socket of the PAC responder. Fixes: https://fedorahosted.org/sssd/ticket/1382
2012-06-18Make the client idle timeout configurableStephen Gallagher1-0/+1
2012-06-18Add support for terminating idle connectionsShantanu Goel1-0/+2
2012-06-12Make re_expression and full_name_format per domain optionsStef Walter1-2/+4
* Allows different user/domain qualified names for different domains. For example Domain\User or user@domain. * The global re_expression and full_name_format options remain as defaults for the domains. * Subdomains get the re_expression and full_name_format of their parent domain. https://bugzilla.redhat.com/show_bug.cgi?id=811663
2012-05-03SSH: Add dp_get_host_send to common responder codeJakub Hrozek1-2/+1
Instead of using account_info request, creates a new ssh specific request. This improves code readability and will make the code more flexible in the future. https://fedorahosted.org/sssd/ticket/1176
2012-04-24Modified responder_get_domain()Jan Zeleny1-1/+2
Now it checks for subdomains as well as for the domain itself
2012-04-24Responder part of the subdomain retrieval workJan Zeleny1-0/+11
2012-03-08Use the correct hash table for pending requestsSimo Sorce1-1/+5
The function that handled pending requests on reconnect was checking an orphaned global variable that was never used, redenring the whole function uselsess. This fixes a very nasty bug that was causing requests for which we never received an answer for (for example because the backend failed and was restarted) to be never removed and therefore causing a black hole effect for any other request of the same type. Fixes: https://fedorahosted.org/sssd/ticket/1229
2012-02-17RESPONDERS: Allow increasing the file-descriptor limitStephen Gallagher1-0/+3
This patch will increase the file descriptor limit to 8k or the limits.conf maximum, whichever is lesser. https://fedorahosted.org/sssd/ticket/1197
2012-02-13Remove setent structure when callback is calledJakub Hrozek1-2/+2
2012-02-07DP: Add support for hosts in sss_dp_get_accountJan Cholasta1-1/+2
Host requests are directed to the host info handler.
2012-02-05AUTOFS: responderJakub Hrozek1-0/+2
2012-02-05Split the logic to check cache expiration into separate functionJakub Hrozek1-0/+5
2012-02-05RESPONDERS: Refactor setent_req_listJakub Hrozek1-5/+11
Makes the setent_add_ref() and setent_notify_*() functions more generic to be reusable by the autofs responder.
2012-02-02RESPONDERS: Provide a common sss_cmd_send_error functionJakub Hrozek1-0/+1
The common function could be reused in new responders
2012-01-31Refactor nss_cmd_send_emptyJakub Hrozek1-0/+2
2012-01-27NSS: Add service enumeration support to NSS providerStephen Gallagher1-0/+3
2012-01-27DP: Refactor responder_dp_req so it's reusable by other respondersJakub Hrozek1-7/+49
* the internal request is now more generic and is decoupled from account-specific data. There is a new sss_dp_issue_request() wrapper that issues a BE request or registers a callback * the public requests all use struct sss_dp_req_state as the tevent_req state data. This allows to report back data from the internal request even if the caller is just a callback notifier * each specific request now uses an _info structure that contains all the data necessary to construct a DBusMessage passed to provider * each specific request now defines a sss_dp_get_$data_msg callback that is called from the sss_dp_issue_request() common wraper. The purpose of the wrapper is to construct a DBusMessage and bind it to a DBus method so the message can be just sent over to back end The miscellanous changes include: * change SSS_DP_ constants to an enum. This way, a switch() would error if a value is not handled. * rename sss_dp_get_account_int_send() to sss_dp_internal_get_send() request because the internal request is going to handle more than just account data * the DBus return values were renamed from err_maj, err_min to dp_err and dp_ret respectively
2012-01-27DP: Add support for services in dp requestsStephen Gallagher1-0/+1
2012-01-21RESPONDER: Extend sss_dp_account_send() to include extra dataStephen Gallagher1-1/+2
Some NSS maps such as 'services' require more values to be passed to the data provider than just the name or ID. In these cases, we will amend an optional component to filter value to pass to the data provider backend.
2011-12-20PAM: make initgroups timeout work across multiple clientsStephen Gallagher1-2/+0
Instead of timing out the initgroups lookup on a per-cctx basis, we will maintain a hash table of recently-seen users and use this instead. This will allow SSSD to handle user's logging into multiple services simultaneously more graciously, as well as playing nicer with SSH (which makes calls to PAM both before and after a fork). https://fedorahosted.org/sssd/ticket/1063
2011-12-16Responders: Split getting domain by name into separate functionJakub Hrozek1-0/+2
2011-11-29RESPONDER: Refactor DP requests into tevent_req styleStephen Gallagher1-6/+32
2011-11-18RESPONDER: Ensure that all input strings are valid UTF-8Stephen Gallagher1-0/+2
2011-05-06Allow changing the log level without restartStephen Gallagher1-0/+3
We will now re-read the confdb debug_level value when processing the monitor_common_logrotate() function, which occurs when the monitor receives a SIGHUP.
2010-12-22Update the ID cache for any PAM requestStephen Gallagher1-0/+2
Also adds an option to limit how often we check the ID provider, so that conversations with multiple PAM requests won't update the cache multiple times. https://fedorahosted.org/sssd/ticket/749
2010-10-26Remove all nss requests after a reconnectSumit Bose1-0/+2
Currently we do not handle the open nss request after a reconnect and wait until they timeout (which is a couple of minutes!). This patch adds a handler that terminates all requests after a reconnect. Then responder will return matching cache entries or nothing.
2010-10-13Add netgroup support to the NSS responderStephen Gallagher1-0/+4
2010-09-08Handle multiple simultaneous enumeration requestsStephen Gallagher1-0/+11
Previously, if a second enumeration request arrived while one was already being processed, each process would receive only a subset of the total number of available users or groups. This is because we were maintaining the response object as a global value in the NSS responder. The second request would come in, see that the data set was already populated, and start reading from wherever the cursor was currently pointed. With this patch, we now move the cursor to the client context instead of the global NSS context. Additionally, this patch completely rewrites the approach to enumerations in the tevent_req style. This makes it much easier to follow in the code. In order to ensure that a slow or malicious client cannot hold onto a reference for the setent result object indefinitely, we set an expiration on the object. We use the enum_cache_timeout here, since that is an appropriate value. If the timeout fires during the normal operation of the get*ent() loop of a client program, we will save the current values of the read index so that we can resume as soon as the object has been refreshed by an implicit setent call. Instead of deleting the enumeration result object immediately after the last in-progress client has read it, we'll keep the object around for the lifetime of enum_cache_timeout. This way, additional clients making enumeration requests can still access the results in-memory.
2010-04-16Use SO_PEERCRED on the PAM socketSumit Bose1-0/+3
This is the second attempt to let the PAM client and the PAM responder exchange their credentials, i.e. uid, gid and pid. Because this approach does not require any message interchange between the client and the server the protocol version number is not changed. On the client side the connection is terminated it the responder is not run by root. On the server side the effective uid and gid and the pid of the client are available for future use. The following additional changes are made by this patch: - the checks of the ownership and the permissions on the PAM sockets are enhanced - internal error codes are introduced on the client side to generate more specific log messages if an error occurs
2010-04-16Revert "Add better checks on PAM socket"Sumit Bose1-4/+0
This reverts commit 5a88e963744e5da453e88b5c36499f04712df097.
2010-03-11Add better checks on PAM socketSumit Bose1-0/+4
- check if the public socket belongs to root and has 0666 permissions - use a SCM_CREDENTIALS message if available
2010-02-18Rename server/ directory to src/Stephen Gallagher1-0/+152
Also update BUILD.txt