[PATCH 4/7] responder: Use SAFEALIGN macros where appropriate.
by Michal Židek
On 11/14/2013 01:14 PM, Lukas Slebodnik wrote:>>From
>> >- ((uint32_t *)body)[0] = num-skipped; /* num results */
>> >- ((uint32_t *)body)[1] = 0; /* reserved */
>> >+ SAFEALIGN_SETMEM_UINT32(body, num - skipped, NULL); /* num
results */
>> >+ SAFEALIGN_SETMEM_UINT32(body + sizeof(uint32_t), 0, NULL); /*
reserved */
> Here is an conflict due to patch "NSS: Set packet length for initgroups"
Resolved.
>
>> >
>> > return EOK;
>> >}
New patch is attached.
Michal
10 years, 2 months
[PATCH] AD: Retry and terminate sdap_id_op if possible
by Jakub Hrozek
Hi,
another smaller issue I found when working on other patches. I quickly
scanned the rest of the code and I think we have a similar issue
elsewhere, so we can either accept this patch or file a ticket and fix
it everywhere.
10 years, 2 months
[PATCH] Connect to GC during enumeration
by Jakub Hrozek
Hi,
the attached patches address ticket
https://fedorahosted.org/sssd/ticket/2142
There are some things I'm still not satisfied with and one of them is
refreshing subdomains. Currently the subdomain refresh happens after
startup and then only if a direct lookup for a user or group happens and
the timeout for subdomain refresh is over. So in theory it's possible
that the user and group objects will be refreshed by the enumeration
task only and there would be no lookup to trigger the subdomain refresh.
With master domain enumeration we've solved this problem by
re-downloading master domain info before the enumeration request. We
could do something similar with subdomains (although a little more
involved becase there is always precisely one subdomain), but I didn't
like doing all the changes in 1.11.3. I can code up additional patch
only for master, though.
Something similar is with fallback from GC to LDAP. Although here I'm
not convinced we need to perform the fallback at all, since there are
already patches on the list that implement the option to disable GC
lookups and there will also be a patch to autodetect POSIX attributes in
GC.
These patches must be applied on top of my previous patches.
10 years, 2 months
[INI][PATCHES] All of them (C-Style Comments, Unicode conversion, Space processing, UNIT tests)
by Dmitri Pal
Hello,
This mail contains all the patches that I have so far in my git.
--------------------------
The following set of patches is related to comments and unchanged
from the previous submission.
I replied to the comments about them in another mail.
I do not think there is anything to address.
If there is please let me know.
0001-INI-Do-not-check-validity-of-comments.patch
0002-INI-Extend-error-set-and-add-parsing-error.patch
0003-INI-Process-c-style-comments.patch
0004-INI-Test-files-for-unit-test.patch
0005-INI-Unit-test-for-c-style-comments.patch
--------------------------
The following set of patches addresses comments and fixes
bugs in Unicode/UTF8 conversion
0006-INI-Expose-buffer-context-as-void.patch
0007-INI-Extend-internal-file-handle.patch
0008-INI-Convert-files-to-UTF.patch
0009-INI-Updated-unit-test-for-UTF8-conversion.patch
Thanks for review Lukas. I reworked the code significantly.
I think I addressed everything except the initialization comment.
I agree with you that it would have been better to
initialize things outside the loop but I need to read the first buffer
to be able to determine the encoding. This is what causes this logic.
I do not see a way to avoid it so left that part as is.
----------------------------
The following one liner fixes a trace text
0010-INI-Fix-typo-in-comment.patch
----------------------------
The following patches are related to the problem I noticed earlier
and recorded in the ticket https://fedorahosted.org/sssd/ticket/2119
But in reality the cause was bug in the Unicode conversion
and a bug with space processing.
0011-INI-Fix-processing-of-the-white-space-at-the-end-of-.patch
0012-INI-Unit-test-for-space-trimming-in-multiline-values.patch
----------------------------
The following patch adds more unit test for both Unicode conversion
and folding by combining the tests together. The unit tests written
for each of them individually are not sufficient to catch corner cases.
This test does. And I played with different constants before checking
in to make sure that all sorts of combinations are caught.
I decided to settle on these numbers because they provide
sufficient amount of testing but do not extend the time too much.
Right now all make check tests take about 7-8 seconds on my laptop.
0013-INI-Adding-more-unit-tests.patch
--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
10 years, 3 months
[Patch] Cmocka unit test patch for authtok module
by Pallavi Jha
Hi
I have created the patch and attached it with this mail. Kindly review it.
I have commented some of the test as it fails(gives segmentation fault)
when authtoken is NULL. I think we should test tok for NULL before
accessing its elements. Please correct me if am wrong.
for example :
uint8_t *sss_authtok_get_data(struct sss_auth_token *tok)
{
return tok->data;
}
This should be written as:
uint8_t *sss_authtok_get_data(struct sss_auth_token *tok)
{
if(!tok) {
return EINVAL;
}
return tok->data;
}
Thanking You,
Pallavi
10 years, 3 months
[PATCH] Fix FAST authentication for FreeIPA two-factor authentication case
by Alexander Bokovoy
Hi!
FAST auth is broken for OTP case at least for FreeIPA because krb5_child
returns an empty SSS_OTP message as the last one in the buffer. This message
never got processed by the krb5_child_handler due to the fact that message
size (8 bytes) was triggering the check for buffer length and prematurely
claiming that the whole buffer is malformed.
Fixes https://fedorahosted.org/sssd/ticket/2186 and now I have working ssh logons
with two-factor authentication using native FreeIPA OTP implementation and FreeOTP Android app.
Additionally this patch makes clear how ccache name is passed. It avoids looking into anything
but SSS_PAM_ENV_ITEM message.
--
/ Alexander Bokovoy
10 years, 3 months
DEBUG macro refactoring v3
by Nikolai Kondrashov
Hi everyone,
Please find attached the third version of the DEBUG macro refactoring
patchset. The second version was lost to the maillist message size limit, so
I'll list the changes from the first one:
* level limiting condition moved to the macro as requested by Simo,
* macro definition update is separated from the invocation update,
* automatic macro invocation update is separated from the following manual
fixups,
* invocations using the old debug level (number literals) are updated to
use the new bitmask macros,
* the level conversion function "debug_get_level" is removed.
Please feel free to pick and squash commits as necessary.
Sincerely,
Nick
10 years, 3 months
rpc.idmapd plugin
by Noam Meltzer
Hello sssd-developers,
Allow me to introduce myself and the suggested contribution to the SSSD
project. PrimaryData Inc. is a startup company in the field of distributed
NAS. As such, we would like to contribute to the SSSD project by developing
support for rpc.idmapd.
Below is our proposed design for this new feature.
Best regards,
Noam Meltzer
---
*SSS NFS Client (rpc.idmapd plugin) - Design*
We named the client "sss_nfs" (althogh "sss_idmap" or "idmap" might have
been better names, the term "idmap" is already occupied in the SSSD world).
*rpc.idmapd - background*
rpc.idmapd runs on NFSv4 servers as a userspace daemon (part of nfs-utils).
It's role is to assist knfsd by providing the following 6 mapping functions:
1. (user) name to uid
2. (group) name to gid
3. uid to (user) name
4. gid to (group) name
5. principal (user) name to ids (uid + gid)
6. principal (user) name to grouplist (groups which user are member of)
rpc.idmapd provides API for developing plugins (loaded by dlopen(3)) which
implements the actual mapping process.
* note: 5 + 6 are relevant only for kerberised NFSv4 servers. At the first
stage we only purpose a design without kerberos support.
* note2: On the kernel level, there's a caching mechanism for the responses
from the userspace daemon.
*SSSD - Responder*
The functionality required from the Responder side is a subset of the
functionality provided by existing NSS Responder's commands.
As you can see below (on the client part of the design) - no changes are
needed in the NSS Responder.
*SSSD - NFS Client*
*Responder-Facing Interactions (existing NSS Responder commands)*
SSS_NSS_GETPWNAM - map (user) name to uid requests
SSS_NSS_GETGRNAM - map (group) name to gid requests
SSS_NSS_GETPWUID - map uid to (user) name requests
SSS_NSS_GETGRGID - map gid to (group) name requests
The request & reply sent to & from the responder is "standard" in terms of
the NSS Responder.
The client only needs a portion of the reply. Only this portion will be
extracted from the packet (i.e. uid/gid/user name/group name).
*Optimisation Techniques*
The optimisation techniques used for the NSS client will be used here as
well. i.e. Fast Cache (memcache) & negative-cache.
It will be possible for the user to disable Fast Cache from the
configuration file. (see below)
*Configuration File*
The configuration of the client will be part of rpc.idmap config file
(/etc/idmapd.conf).
--
*Noam Meltzer*
*Linux Software Engineer*
*PRIMARY DATA*
P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya
Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843
E-mail: noam(a)primarydata.com
* <Slankry(a)PrimaryData.com>*
10 years, 3 months