[PATCH] Two sssd_nss patches
by Jakub Hrozek
I found two sssd_nss bugs pretty much by accident.
[PATCH 1/2] NSS: keep a pointer to body after body is reallocated
When a memory is reallocated with talloc_realloc, the original pointer
might be relocated elsewhere. The "fullname" pointer used to point to
the original location before realloc which led to use-after-free issues.
[PATCH 2/2] Use sized_string correctly in FQDN domains
We were using the structure itself instead of the string pointer, which
led to crashes when the domain was fully qualified.
11 years, 10 months
Announcing ding-libs 0.3 beta1
by Jan Zelený
The SSSD team is proud to announce the 0.3 beta1 (0.2.91) release of ding-libs
utility library.
It can be downloaded from
https://fedorahosted.org/sssd/wiki/Releases#DING-LIBSReleases
== Highlights ==
* extensive changes in libini_config (merging config section, better handling of
metadata)
* coverity and other bugfixes
== Detailed Changelog ==
Dmitri Pal (71):
* New wrapper macros for function entry and exit
* Introducing basic objects
* Fixing the cleaup code
* Refining comment object
* Introducing Value object
* Allow destroying collection with a callback
* Added a convenience function
* More config files for testing
* Extend the comment interface
* Add error codes for the new parser
* Fixes to the value object
* The beginning of the new INI interface
* New INI parser
* Starting to consolidate the new interface in one place
* Introducing configuration file object
* Adding ref_array copy method
* Refactoring comment object
* Fixing trace macros
* Enhancements to value object
* Refactoring error reporting
* Minor tracing cleanup
* Fix copy collection
* Improvements to the value object
* New copy and folding functionality
* Allow merging values
* Collision flag validation
* Preparing to merge sections
* Adding missing file to the package
* Fix crashes with file object
* Correcting paths to test files
* Additional tests
* Coverity issues 10071 & 10072
* Coverity issue 10034
* File descritpor leak
* Leaking memory on failure
* Initializing variables in test
* Initialize simple buffer
* Free newly created value in case of error
* Freeing memory used for source dir
* Adding missing const
* Coverity issue 10042
* Coverity issue 10075
* Fixing dereferencing NULL
* Fixing coverity issues 10078 & 10079
* New error codes and messages
* New merge flags
* Add new vars to parse structure
* Add save_error function
* Change parse_error to use save_error
* Preparing for merging sections
* Enhance value processing
* Use section line number
* Refactor section processing
* Return error in DETECT mode
* New test files for section merge
* Test DETECT mode and use new file
* Test for all section merge modes
* Fix indentention in the switch statement
* Separate close and destroy
* Function to reopen file
* Metadata collection is gone
* Check access function
* Function to check for changes
* Tests for access and changes
* Rename error print function
* Initialize variables in loops
* Exposing functions
* Do not debug padding
* Add missing assertion macro
* Add missing cleanup in unit test
* Use right macro
Jakub Hrozek (1):
* INI: Silence compilation warnings
Jan Zeleny (1):
* Update version numbers for ding-libs-0.2.91 release
John Dennis (1):
* Resolves: bug #735464 Fix the loop limit used to initialize the table
directory, was based on count, now limited to segment_count.
Stephen Gallagher (10):
* Bumping development version number
* Updating dhash version to 0.4.2
* Fix license text for several files that should be LGPLv3+
* path_utils: handle off-by-one error in path_concat()
* path_utils: Handle "/" in path_concat
* path_utils: path_concat should return empty string on ENOBUFS
* Bump version for 0.1.3 release
* Update version numbers for ding-libs 0.1.3 release
* Fix issue when running make distcheck
* Properly handle file permissions for ini_parse_ut startup_test()
Sumit Bose (10):
* Fix typo in spec file
* Fix overflow in ini_parse unit test
* Remove unneeded --disable-rpath configure option
* Fix version handling of the libraries
* dhash: add stddef.h to dhash.h
* dhash: Fix memory leak in example
* dhash: Allow hash_enter() to update entries
* Fix a typo in dhash.h
* Fix typo which makes make prerelease-srpm fail
* Ensure error_string() never returns NULL
11 years, 10 months
Fix libsss_hbac library version
by Sumit Bose
Hi,
while checking the version of libsss_idmap I found that there is a typo
for libsss_hbac as well. This patch should fix it.
bye,
Sumit
11 years, 10 months
Rename struct dom_sid to struct sss_dom_sid
by Sumit Bose
Hi,
although we currently use the same internal representation for struct
dom_sid as samba does this might not be the case in future. To avoid
irritations this patch changes the name to struct sss_dom_sid.
bye,
Sumit
11 years, 10 months
[PATCHES] Better handling of large Active Directory groups
by Stephen Gallagher
Fixes https://fedorahosted.org/sssd/ticket/783
Patch 0001: Adds some better debug messages to sysdb_set_entry_attr()
that I found useful while debugging my AD patch
Patch 0002: Modifies build_attrs_from_map() to return a count of the
attributes as well. This is necessary because there are a couple places
in the code (notably the nested group deref code) where we are appending
to the resulting attrs. However, if any attribute in the map was unset
(as is the case by default in the ad2008r2_group_map), the resulting
additions would be made AFTER a NULL-terminator and would be ignored.
(It took me about two hours of debugging to figure out why the users in
my deref lookups didn't have names...)
Patch 0003: Here's the meat of the changes. I did not actually implement
the standards-decimating range extension from Microsoft for a couple
reasons: 1) It was really difficult to shoehorn into our LDAP
implementation. 2) I found a better, faster way that does not require
the use of special LDAP requests.
It turns out that the ASQ requests against AD will always return all of
the members of the groups. We were actually saving all of the fake users
into the cache already, but what was missing were just the
member/memberOf linkages, because our processing was entirely dependent
upon the original lookup. So with this patch, we will add any members
discovered by deref/ASQ that were not already in the member element of
the initial lookup into the queue to be processed.
We don't need to worry about the non-ASQ case because we have a
guarantee from AD that ASQ is always available.
11 years, 10 months