[PATCH] Handle multiple simultaneous enumeration requests
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Simo, ideally I'd like you to do this review, since you're the most
familiar with this area of the code. However, other eyes are always
encouraged.
Previously, if a second enumeration request arrived while one was
already being processed, each process would receive only a subset
of the total number of available users or groups. This is because
we were maintaining the response object as a global value in the
NSS responder. The second request would come in, see that the data
set was already populated, and start reading from wherever the
cursor was currently pointed.
With this patch, we now add a reference count to the data set
object and move the cursor to the client context instead of the
global NSS context.
Additionally, this patch completely rewrites the approach to
enumerations in the tevent_req style. This makes it much easier to
follow in the code.
There is a known issue with this patch that I am working to address in a
follow-up patch. With this change, it's possible to trick the sssd_nss
process into holding onto the enumeration cache forever. Since the
global result object is retained as long as there are references to it,
it would be possible for a malicious program to call setpwent/getpwent
and never call getpwent - thereby preventing the result object from ever
being reaped.
I will be sending a follow-up patch that adds a timeout value on the
lifetime of the result object. The plan will be that once this timeout
runs out, the object will be reaped and if there are active enumerations
running (meaning that they have started calling getpwent but not
retrieved all the entries yet), they will be directed to call another
setpwent, but will retain their current pointers to the result data.
Since in the 99% case, the data will remain the same (and in the same
order), this will have minimal impact on the clients.
I am sending the current patch out first so I can get some opinions on
the approach while I work on fixing the vulnerability it introduces.
This patch addresses https://fedorahosted.org/sssd/ticket/608
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkx+5p0ACgkQeiVVYja6o6MxfACcCftq5H0FCZSHWLwBN11r5l8l
+30AnibV+UtlZ+7L9xllSBLRpZCY6kdO
=+kyZ
-----END PGP SIGNATURE-----
13 years, 7 months
Netgroups in SSSD
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I have written up a problem statement and a brief overview of my plans
regarding netgroup support in the SSSD.
Please read through and comment as needed:
https://fedorahosted.org/sssd/wiki/DesignDocs/Netgroups
My goal is to have this work completed before the end of September.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyG1OEACgkQeiVVYja6o6PIwQCgh62juMYdDpeGcXaYoGCf5/WG
mC4An0jwqIf+C22owuI4gE8M6CiPLHnZ
=iN+7
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH] Support password obfuscation in sssd.conf
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[PATCH 1/7] Move crypto functions into its own subdir
A refactoring patch that creates a common util/crypto subdir with
per-implementation subdirectories for each underlying crypto library
supported by SSSD.
[PATCH 2/7] Add safe copy/move macros for uint16_t
These will be used later on in the code
[PATCH 3/7] Password obfuscation utility functions
This is where the actual obfuscation happens.
Adds two utility functions - one to obfuscate a password and inverse to
extract the cleartext password back. So far, only NSS-based
implementation is provided.
[PATCH 4/7] Fix pysss linking
I noticed that the python bindings were not properly linked so a simple
import pysss failed
[PATCH 5/7] Python bindings for obfuscation
Provides python bindings for utility functions from patch 3/7. These
will be used later on in the obfuscation tool itself.
[PATCH 6/7] sss_obfuscate tool
A tool to add obfuscated passwords into the SSSD config file
[PATCH 7/7] Deobfuscate password in back ends
When obfuscated password is used in config file, the LDAP backend
converts it back to clear text and uses it to authenticate to the
server.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkx7+oUACgkQHsardTLnvCV+2QCg0TXyStJUpcOA3BaDFeZBwCst
CVYAoKpvZPmEviGTNQeIcUYuTOw4mdFr
=TFuL
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH] Fix assorted minor bugs in sss_ tools
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Fixes: #585 by introducing a macro that encapsulates handling a common
error during password parsing.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyFMFcACgkQHsardTLnvCWfQwCggczrLdP1QH0SMbF2cXkttnPq
87kAn1v2F2/Db2U34Ii1jVlwq1bLsC32
=5ro5
-----END PGP SIGNATURE-----
13 years, 7 months
Dead assignment cleanup
by Jan Zelený
I'm sending the last wave of patches cleaning dead assignments or fixing code
around them.
0001-Dead-assignments-cleanup-in-providers-code.patch:
Here the biggest change is in prototype of sdap_access_decide_offline, which IMO
doesn't need to return any value, since it returns alway EOK now and there is
no code which could be failing.
0002-Dead-assignments-cleanup-in-NSS-responder.patch
0003-Dead-assignments-cleanup-in-memberof-module.patch:
Here I'm not entirely sure about return code LDB_ERR_OPERATIONS_ERROR. The
variable ret can contain either 0 or -1 (in case of insufficient memory, I
checked the ldb code). I think returning -1 further isn't the right choice,
thus either ENOMEM or LDB_ERR_OPERATIONS_ERR seem to be acceptable. I chose
the latter one, because it indicates generic ldb error. ENOMEM could be
convenient now, but in the future the behavior of ldb_schema_attribute_add
might change and ENOMEM would become misleading.
0004-Dead-assignments-cleanup-in-various-places-in-SSSD.patch
The last hunk should be fixing this: http://jhrozek.fedorapeople.org/sssd-
clang-llvm/report-G4QCn7.html#EndPath . IMO the original code had a flaw there,
which would make the inner while cycle useless in case write() actually wrote
less bytes than it could. This way it should be fixed.
--
Jan
13 years, 7 months
[PATCHES] Add a setent result object timeout
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a follow-up to the patch in the thread "[PATCH] Handle multiple
simultaneous enumeration requests". It addresses the vulnerability that
would be introduced by that earlier patch.
Patches 0001 and 0002 are nearly identical, they are just divided into
one patch for setpwent and another for setgrent to make reviewing easier.
In order to ensure that a slow or malicious client cannot hold
onto a reference for the setpwent result object indefinitely, we
set an expiration on the object. We use the enum_cache_timeout
here, since that is an appropriate value.
If the timeout fires during the normal operation of the getpwent()
loop of a client program, we will save the current values of the
read index so that we can resume as soon as the object has been
refreshed by an implicit setpwent call.
Also attached is a simple test program that I wrote to verify the fix.
It will start an enumeration read, then pause partway through (I picked
70 because that was firmly within the sss results and after the files
results) for 35 seconds. I set enum_cache_timeout = 30 in the [nss]
section of my sssd.conf for testing this.
The final count should be the same as received from
getent group |wc -l
The output can be verified by inspection to see that all of the groups
are as expected.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkx/6P0ACgkQeiVVYja6o6NSlgCfbypL4Wy4NweoC7yaIIFYYjOy
umkAniVMpnyphBIFMujKR0/8III+mGmS
=ikGR
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH] Minor fixes in various places
by Jan Zelený
I'm attaching some patches fixing various minor issues found by clang:
0001-Initialized-return-value-in-dp_copy_options.patch
Ticket: #577
0002-Fixed-potential-comparison-of-undefined-variable.patch
Ticket: #578
0003-Fixed-printing-of-undefined-value-in-sdap_async_acco.patch
Ticket: #579
0004-Fixed-uninialized-value-in-proxy_id-provider.patch
Ticket: #580
0005-Deleted-some-needless-assignments.patch
Ticket: #582
--
Jan
13 years, 7 months
[PATCH] Memory context hierarchy fix
by Jan Zelený
When I studied the code, I noticed one small inconsistency in fail_over.c,
which turned out to be in fact a minor bug. Attached patch fixes it.
--
Jan
13 years, 7 months
[PATCH] Fix chpass operations with LDAP provider
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The initial verification of the old password was returning an
error because we were not explicitly setting dp_err to
DP_ERR_SUCCESS and it was initialized earlier in the function to
DP_ERR_FATAL.
Pushing this to master and sssd-1-2 under the one-liner rule.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxZs3IACgkQeiVVYja6o6NkbwCgqU/UMujaWD5jtXVelvgKeB5w
5IcAnjnB7wMJFwe7mZyeKrgRRjAYhtkl
=KZf0
-----END PGP SIGNATURE-----
13 years, 7 months