summaryrefslogtreecommitdiff
path: root/src/responder/nss
AgeCommit message (Collapse)AuthorFilesLines
2013-09-25NSS: Failure to store entry negative cache should not be fatalJakub Hrozek1-18/+31
The only effect the failure to store a result to negative cache might have would be a slower lookup next time.
2013-09-25NSS: Set UID and GID to negative cache after searching all domainsJakub Hrozek1-66/+105
https://fedorahosted.org/sssd/ticket/2090 Previously, when searching by UID or GID, the negative cache will only work in case the UID was searched for using fully qualified names.
2013-09-23mmap_cache: Use two chains for hash collision.Lukas Slebodnik1-18/+48
struct sss_mc_rec had two hash members (hash1 and hash2) but only one next member. This was a big problem in case of higher probability of hash collision. structure sss_mc_rec will have two next members (next1, next2) with this patch. next1 is related to hash1 and next2 is related to hash1. Iterating over chains is changed, because we need to choose right next pointer. Right next pointer will be chosen after comparing record hashes. This behaviour is wrapped in function sss_mc_next_slot_with_hash. Adding new record to chain is also changed. The situation is very similar to iterating. We need to choose right next pointer (next1 or next2). Right next pointer will be chosen after comparing record hashes. Adding reference to next slot is wrapped in function sss_mc_chain_slot_to_record_with_hash Size of structure sss_mc_rec was increased from 32 bytes to 40 bytes. Resolves: https://fedorahosted.org/sssd/ticket/2049
2013-09-23Revert "mmap_cache: Skip records which doesn't have same hash"Lukas Slebodnik1-34/+2
This reverts commit 4662725ffef62b3b2502481438effa7c8fef9f80.
2013-09-17nss: Wrong debug message.Michal Zidek1-1/+2
2013-09-17util: add sss_idmap_talloc[_free]Pavel Březina1-11/+2
Remove code duplication.
2013-09-16Add missing new line in DEBUG messageLukas Slebodnik1-2/+3
2013-09-11Fix formating of variables with type defined in stdint.hLukas Slebodnik1-6/+7
2013-09-11Fix formating of variables with type: size_tLukas Slebodnik1-1/+1
2013-09-09mmap_cache: Do not remove record from chain twiceLukas Slebodnik1-0/+6
It is not very likely, that record will have the same hash1 and hash2, but it is possible. In this situation, it does not make sense to remove record twice. Function sss_mc_rm_rec_from_chain was not robust and sssd_nss could crash in this situation. It was only possible if record was alone in chain. Resolves: https://fedorahosted.org/sssd/ticket/2049
2013-08-28NSS: Descend into subdomains if enumerate=trueJakub Hrozek1-12/+12
Since we now store the enumerate flag in sysdb for subdomains, we can always descend to all available subdomains and if they do not allow enumeration, simply skip them.
2013-08-28mmap_cache: Use stricter check for hash keys.Lukas Slebodnik1-4/+6
ht_size is size of hash_table in bytes, but hash keys have type uint32_t
2013-08-28mmap_cache: Skip records which doesn't have same hashLukas Slebodnik1-2/+34
The code uses 2 hashes for each record, but only one hash table to index them both, furthermore each record has only one single 'next' pointer. This means that in certain conditions a record main end up being on a hash chain even though its hashes do not match the hash chain. This can happen when another record 'drags' it in from another hash chain where they both belong. If the record without matching hashes happens to be the second of the chain and the first record is removed, then the non matching record is left on the wrong chain. On removal of the non-matching record the hash chain will not be updated and the hash chain will end up pointing to an invalid slot. This slot may be later reused for another record and may not be the first slot of this new record. In this case the hash chain will point to arbitrary data and may cause issues if the slot is interpreted as the head of a record. By skipping any block that has no matching hashes upon removing the first record in a chain we insure that dangling references cannot be left in the hash table Resolves: https://fedorahosted.org/sssd/ticket/2049
2013-08-22mmap_cache: Use sss_atomic_write_s instead of write.Michal Zidek1-2/+11
Use sss_atomic_write_s() instead of write() in sss_mc_save_corrupted(). Also unlink() the file if no data were written. It is better to use sss_atomic_write_s instead of write
2013-08-19mmap_cache: Store corrupted mmap cache before resetMichal Zidek1-0/+66
This patch adds function to store corrupted mmap cache file to disk for further analysis.
2013-08-19mmap_cache: Use better checks for corrupted mc in responderMichal Zidek1-3/+53
We introduced new way to check integrity of memcache in the client code. We should use similiar checks in the responder.
2013-08-19mmap_cache: Off by one error.Michal Zidek1-6/+6
Removes off by one error when using macro MC_SIZE_TO_SLOTS and adds new macro MC_SLOT_WITHIN_BOUNDS.
2013-08-19fill_initgr: add original primary GID if availableSumit Bose1-0/+27
In some cases when MPG domains are used the information about the original primary group of a user cannot be determined by looking at the explicit group memberships. In those cases the GID related to the original primary group is stored in a special attribute of the user object. This patch adds the GID of the original primary group when available and needed. Fixes https://fedorahosted.org/sssd/ticket/2027
2013-08-11mmap_cache: Check if slot and name_ptr are not invalid.Michal Zidek2-2/+54
This patch prevents jumping outside of allocated memory in case of corrupted slot or name_ptr values. It is not proper solution, just hotfix until we find out what is the root cause of ticket https://fedorahosted.org/sssd/ticket/2018
2013-08-08NSS: Clear cached netgroups if a request comes in from the sss_cacheLukas Slebodnik3-0/+54
In order for sss_cache to work correctly, we must also signal the nss responder to invalidate the hash table requests. https://fedorahosted.org/sssd/ticket/1759
2013-08-08NSS: allow removing entries from netgroup hash tableLukas Slebodnik3-1/+32
There is a timed desctructor in the nss responder that, when the entry timeout passes, removes the netgroup from the hash table while the netgroup is freed. This patch adds a hash delete callback so that if the netgroup is removed from the hash table with hash_delete, its hash table pointer will be invalidated. Later, when the entry is being freed, the destructor won't attempt to remove it from the hash table.
2013-07-31Fix netgroup lookup when using fully qualified namePavel Březina1-2/+2
2013-07-29Netgroups should ignore the 'use_fully_qualified_names' settingStephen Gallagher1-8/+6
Netgroups often have memberNisNetgroup entries included in them that will never process correctly if we require fully-qualified names on the nested lookup. This patch alters the behavior of netgroup lookups to check *all* domains for an unqualified netgroup name, instead of only the ones not requiring fully- qualified names. https://fedorahosted.org/sssd/ticket/2013
2013-07-16remove unused variablePavel Březina1-4/+0
2013-07-16Remove unused function parameterLukas Slebodnik1-3/+1
2013-06-27Do not call sss_cmd_done in function check_cache.Lukas Slebodnik1-6/+0
Function sysdb_getpwnam return more results than 1 and therefore sss_cmd_done was called. Inside of function sss_cmd_done memory was freed, but this freed memory was used in caller functions, therefore sssd crashed. https://fedorahosted.org/sssd/ticket/1980
2013-06-27Handle too many results from getnetgr.Lukas Slebodnik1-1/+13
2013-06-04Lookup domains at startupSumit Bose1-0/+6
To make sure that e.g. the short/NetBIOS domain name is available this patch make sure that the responders send a get_domains request to their backends at startup the collect the domain information or read it from the cache if the backend is offline. For completeness I added this to all responders even if they do not need the information at the moment. Fixes https://fedorahosted.org/sssd/ticket/1951
2013-05-30Remove branching to improve readabilityJakub Hrozek1-23/+11
2013-05-30Allow flat name in the FQname formatJakub Hrozek1-3/+3
https://fedorahosted.org/sssd/ticket/1648 Adds another expansion in the printf format that allows the user to use the domain flat name in the format.
2013-05-30Add utility functions for formatting fully-qualified namesJakub Hrozek1-30/+19
Instead of using printf-like functions directly, provide two wrappers that would encapsulate formatting the fully-qualified names. No functional change is present in this patch.
2013-05-20Fixing critical format string issues.Lukas Slebodnik2-6/+11
--missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
2013-05-03Add SID related calls to the NSS responderSumit Bose2-3/+795
The patch adds 4 new calls to the NSS responder: - SSS_NSS_GETSIDBYNAME - SSS_NSS_GETSIDBYID - SSS_NSS_GETNAMEBYSID - SSS_NSS_GETIDBYSID to either return the SIDs of the requested object or map the SID to the name or the POSIX ID of the related object.
2013-05-02Add idmap context to nss contextSumit Bose2-0/+22
This allows the nss responder to use libsss_idmap to convert between different SID representations.
2013-05-02Remove unused TALLOC_CTX from responder_get_domain()Sumit Bose3-4/+4
Recent refactoring removed the need to copy the domain info data of sub-domains because the related objects will not be removed from memory anymore.
2013-04-26DB: Switch to new libini_config APIOndrej Kos2-2/+1
https://fedorahosted.org/sssd/ticket/1786 Since we need to support the old interface as well, the configure scritp is modified and correct ini interface is chosen.
2013-04-21Refactoring: remove duplicated code in nss responderSumit Bose2-622/+240
Different user and group lookup requests used nearly identical code, this patch unifies some of the related code paths.
2013-04-17Inform about function duplication.Michal Zidek1-0/+3
sss_mc_set_recycled is a static function, that should not be used outside nsssrv_mmap_cache.c. The sss_cache tool is an exception, because in the case when sssd is not running, sss_cache must invalidate the memory cache file. That is why sss_mc_set_recycled was copied to the tools_mc_util.c (as helper function for sss_memcache_invalidate function). It was duplicated to allow this function to remain static (and invisible to any .h files), so that it is not used anywhere else. Wrong usage of this function might cause race conditions and corrupt the cache. I'll add comments about the duplication to the code.
2013-04-10Allow using flatname for subdomain home dir templateJakub Hrozek1-4/+6
https://fedorahosted.org/sssd/ticket/1609
2013-03-20change responder contexts hierarchyPavel Březina1-15/+20
https://fedorahosted.org/sssd/ticket/1575 The hierarchy is now: main_ctx -> responder_ctx -> specific_ctx where specific_ctx is one of sudo, pam, etc.
2013-03-20do not leak memory on failure in *_process_init()Pavel Březina1-7/+12
2013-03-19Removing unused declaration of functions and variable.Lukas Slebodnik1-1/+0
Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
2013-03-07Debug message in sss_mc_create_file.Michal Zidek1-0/+5
This patch adds debug message for the case if sssd fails to open old mc file for some other reason than the file does not exist.
2013-03-07File descriptor leak in nss responder.Michal Zidek1-18/+43
File descriptors leaked every time sss_mmap_cache_reinit was called and also the old memory cache was still maped in memory (munmap was not called). This patch adds destructor for memory cache context to call close() and munmap() automaticly. https://fedorahosted.org/sssd/ticket/1826
2013-03-04Use the same dbg level for all ncache hits.Michal Zidek1-18/+25
We used different debug levels for messages informing about negative cache hits (old levels 2,3,4). Now it is only SSSDBG_TRACE_FUNC (same level is used in nsssrv_services.c and proposed in the ticket bellow). https://fedorahosted.org/sssd/ticket/1771
2013-03-04Remove unused functionsJakub Hrozek2-18/+0
2013-02-14Lower the DEBUG level if an entry cannot be deleted from memcacheJakub Hrozek1-3/+3
2013-02-10Introduce IS_SUBDOMAIN() macroSimo Sorce1-3/+3
Fixes https://fedorahosted.org/sssd/ticket/1766
2013-02-10Add function get_next_domain()Simo Sorce3-75/+55
Use this function instead of explicitly calling domain->next This function allows to get the next primary domain or to descend into the subdomains and replaces also get_next_dom_or_subdom()
2013-02-10NSS: Add original homedir to home directory template optionsStephen Gallagher1-5/+6
https://fedorahosted.org/sssd/ticket/1805
generated by cgit (git 2.34.1) at 2024-05-28 23:42:51 +0000