[PATCH] ticket#101
by Simo Sorce
Apparently parent and member got reversed when I rewrote some of the
functions.
Simo.
14 years, 8 months
sssd [PATCH] Make socket paths a compile-time option
by Stephen Gallagher
Previously, we had hardcoded the paths for the NSS, PAM and
private PAM sockets to /var/lib/sss/pipes. With this patch, we
will specify the sockets as $(localstatedir)/lib/sss/pipes.
This fixes a problem builing RPMs on Red Hat Enterprise Linux.
--
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
14 years, 8 months
[PATCH] Fix monitor ping timeout
by Stephen Gallagher
Our configuration specifies the monitor config timeout as seconds,
but we were passing it directly to dbus commands that require
milliseconds. Fixing this in get_monitor_config(). Also, the
default value of -1 for the timeout resulted in a timeout much too
short to be useful, so I'm making it 10s instead.
This fix solves the problem where a busy backend (for example, one
that is enumerating a large number of LDAP entries) would fail to
respond to the ping in time.
--
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
14 years, 8 months
[PATCHES] services startup and identification
by Simo Sorce
The following 3 patches changes the way services are started up and
identify themselves to the monitor.
The first patch is just minor or cosmetic fixes.
The second patch changes the identification from monitor initiated to
service initiated and acked by the monitor. This allows the service to
perform the identification after it has completely set up all the dbus
channel and is ready to receive a reply avoiding nasty race conditions.
The third patch changes the way services are started at startup. The
Data Provider service is given a 1 second advantage so that it should
normally be all set up by the time other service start and try to
connect to it. This way services normally avoid racing against dp and
can fully initialize on the first attempt and not rely on reconnection.
Initial testing seem to work pretty well and startup does not show ugly
errors anymore.
I may send an additional separate patch to make services identify
against dp the same way they do against the monitor (ie service
initiated instead of server initiated). A patch will follow if I can
pull it off in a short time frame.
Simo.
14 years, 8 months
Proposed version and branch policy in the SSSD
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
As the subject implies, I think we need a branch policy in the SSSD to
address things like the recent security update that we released for
0.4.1. Currently there is no obvious way in the upstream tree to
retrieve a safe copy of the 0.4.1 source to compile. You would have to
be aware that the code tagged as 0.4.1 also requires cherry-picking a
specific commit from the master branch to address a security bug.
Furthermore, we don't have a consistent definition about the components
of our version string. I'd like to recommend the following policy for
these two things.
Version components:
Major version: Should reflect our current major goal. It will become 1
once we support all features necessary to replace nss_ldap, pam_ldap and
pam_kerberos entirely.
Minor version: These should represent feature-enhancement releases to
the SSSD. For example, the major features intended in SSSD 0.5.0 will be
support for the LDAP id backend and the Kerberos auth backend.
Point version: These should represent bugfixes and security patches ONLY
for the minor revision.
Branch policy:
When the master branch has reached a point where we believe it to be
ready as a new minor version (e.g. 0.5.0), we should tag that point
(sssd-0_5_0) and create a new branch from that tag (sssd-0_5).
Development should continue on the master branch. If there are fixes
needed to continue supporting 0.5.x, they should be cherry-picked into
the sssd-0_5 branch and tagged as 0.5.x+1.
In the case of bugfixes, they can be queued up and released as a single
point release when it is convenient. In the case of security issues, on
the date of the embargo lift, these should be immediately merged in and
a new point release generated.
Comments and criticisms welcome.
- --
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkp64oQACgkQeiVVYja6o6OYAQCfStMlqwb1toFD/k+lT0TSkTuF
+44AoKIxPs+jV9XNgBWOBiufAXi8OKJ8
=mhG3
-----END PGP SIGNATURE-----
14 years, 8 months
[PATCH] Fix startup race condition causing backend restarts
by Stephen Gallagher
When the backends start up, the monitor was immediately sending a
getIdentity request. However, as we've added more processing to
the initialization routines over time, we started introducing
latency between when we open the connection and when we're able to
process requests on that connection.
I've updated the monitor to check for NoReply as an error message
and queue the getIdentity check for retries until the service
answers or one wallclock second (literally, ten tries at 10ms
each) has passed.
--
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
14 years, 8 months
[PATCH] Revert build-breaking libsss_util_la change.
by Stephen Gallagher
Moving the common utility sources into a libtool convenience library
caused problems with symbols when loading the plugin libraries.
This is a straight revert of 00aa07816bfd4305ac94780a8c2b9e6609be39ea
except leaving the "make check" logic in place.
--
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
14 years, 8 months