When I wrote the TTL patches, I did a mistake of using ares_query
instead of ares_search. The two are identical, except that ares_query
does not use "search" or "domain" directives into account.
during the sdap_cli_connect request we loop over all configured LDAP
servers until we find a working one. For this we talloc_free() the old
sdap handle before requesting a new one. But for the first attempt the
handle is not initialized and we may free random memory.
by chance I realized that an OpenLDAP server does not list all controls
it can handle in the rootDSE attribute supportedControl.
Especially LDAP_CONTROL_PASSWORDPOLICY is not listed. According to the
OpenLDAP developers this is because the related spec
still a draft and not finalized
Since sssd only uses controls which are in the supportedControl list we
will not be able to give the user expiration warnings or information
about grace logins for OpenLDAP servers with the password policy overlay
I'm not sure if we need to do anything about it but at least I think it
is good to be aware of.
Several parts of the HBAC python bindings did not work on old Python
versions, such as the one shipped in RHEL5.
The changes include:
* a compatibility wrapper around python set object
* PyModule_AddIntMacro compat macro
* HbacRule.enabled is now a getsetter to avoid using T_BOOL which is
not present in old Python versions
* Py_ssize_t compat definition
* Do not use PyUnicode_FromFormat
* several function prototypes and structures used to have "char *"
arguments where they have "const char *" in recent versions. This
caused compilation warnings this patch mitigates by using the
It also plugs one memory leak - HbacRequest.rule_name wasn't freed in
When used with the ipa_dyndns_iface option, the dynamic DNS code would
blindly put in any addresses the interface has. I think we should filter
addresses such as multicast, loopback and IPv6 link-local -- they don't
belong to DNS.
Adding Honza to CC list as he's probably got the most experience with
address formats and was solving a similar issue on the server side. Are
there any other I should filter out?
[PATCH 1/2] Move IP adress escaping from the LDAP namespace
The function called sss_ldap_escape_ip_address() was actually no longer
used for constructing LDAP URIs and was just polluting the namespace.
[PATCH 2/2] Escape IP address in kdcinfo
[PATCH 1/4] Do not hardcode default resolver timeout
This will allow us to reuse the timeout during the dyndns check
[PATCH 2/4] Split reading resolver family order into a separate function
The new function will be reused as well
[PATCH 3/4] Allow returning arbitrary address from resolv_hostent as string
While we always connect to the first address in the list returned from
DNS, the dyndns check code needs the complete list
[PATCH 4/4] Check DNS records before updating
The check itself.
The patch also includes one change that I was wondering about splitting
out as a separate patch. The previous code would always delete both
address families even in case the updated address was detected from the
LDAP socket, so the other address family would disappear if set. This
patch changes the behaviour such that only the address family of the
ldap socket is deleted and readded (and also checked for in DNS).
this patch adds support for the NDS/eDirectory access control attributes
loginDisabled, loginExpirationTime and loginAllowedTimeMap. It is not
fully tested because currently I do not have access to an eDirectory
server. Since the impact on other parts of the code is minimal I didn't
add a seperate configure option for it but only mark it in the man page
I you have a chance to test this feature please let me know the result.