URL: https://github.com/SSSD/sssd/pull/561
Author: jhrozek
Title: #561: DYNDNS: Retry also on timeouts
Action: opened
PR body:
"""
There is the dyndns_server option that is supposed to make it possible for
the admin to select a server to update DNS with if the server detected by
nsupdate does not work. The fallback works OK for the case where nsupdate
fails with a non-zero return code, but doesn't work for the case where
nsupdate times out.
This patch extends the retry condition to also fallback to the
dyndns_server directive if nsupdate return ERR_DYNDNS_TIMEOUT.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/561/head:pr561
git checkout pr561
URL: https://github.com/SSSD/sssd/pull/554
Author: jhrozek
Title: #554: Several fixes for the files provider
Action: opened
PR body:
"""
This PR contains several fixes for the files provider, mainly a performance
bug which is really embarassing - I have no idea why was the code #if-ed
out. I think I must have been experimenting with the provider update
and then forgot to remove the preprocessor macros. The rest is mostly code
cleanup and minor fixes.
btw initially I wanted to also include a fix to avoid removing cachedPassword
on updates, but I realized the current way where the files provider throws
away everything and then updates everything would force us to maintain
all the sssd-added attributes on our own. And because especially with 2FA
it might not be just cachedPassword, but also the factor length or offline
lockout counter etc, we might as well devise a better way to update the
cache than just throw away everything and recreate the entries, so I'll work
on that separately.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/554/head:pr554
git checkout pr554
URL: https://github.com/SSSD/sssd/pull/511
Author: fidencio
Title: #511: Do not shutdown KCM/Secrets responders when activities are happening ...
Action: opened
PR body:
"""
Firstly, I'd like to make it **explicit** that this PR is **missing tests**, but I won't write them down till we have an agreement whether the proposed patches do look right/good.
Basically, while trying to reproduce https://pagure.io/SSSD/sssd/issue/3470 I've noticed that both secrets and kcm responders were going down due to the responder_idle_timeout expiring ... even with a lot of activities happening on them.
Does this approach look right? If yes, then, what would be the easiest way to test:
- A responder actually goes down after x seconds;
- Any activity on that responder will make the responder alive for more x seconds;
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/511/head:pr511
git checkout pr511
URL: https://github.com/SSSD/sssd/pull/551
Author: mzidek-rh
Title: #551: GPO: Fix bug with empty GPO rules
Action: opened
PR body:
"""
Resolves:
https://pagure.io/SSSD/sssd/issue/3680
To reproduce:
On AD server create 2 GPO rules:
- Allow log on locally - allow group Administrators and user Administrator(a)ad.test
- Deny log on locally - define the rule, but enter no users or groups
On client:
- Try to: su Administrator(a)ad.test
Result without patch: Login fails with "System error"
Result with patch: Login succeeds
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/551/head:pr551
git checkout pr551
URL: https://github.com/SSSD/sssd/pull/547
Author: fidencio
Title: #547: Tests for #511
Action: opened
PR body:
"""
We've decided to split the fix/tests in two different PRs.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/547/head:pr547
git checkout pr547
URL: https://github.com/SSSD/sssd/pull/555
Author: jhrozek
Title: #555: MAN: Document which principal does the AD provider use
Action: opened
PR body:
"""
Administrators are often confused by the difference between what principal
is used to authenticate to AD. Let's document that.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/555/head:pr555
git checkout pr555
URL: https://github.com/SSSD/sssd/pull/557
Author: sumit-bose
Title: #557: nss-idmap: use right group list pointer after sss_get_ex()
Action: opened
PR body:
"""
This pull-request fixes an memory management issue which might cause crashes in
long running processes and makes sure getgrouplist() returns the expected
results if the data is read from the memory mapped cache.
Related to https://pagure.io/SSSD/sssd/issue/3715
To verify the memory management issue you can run the following short test
program with valgrind:
int main(int argc, char *argv[])
{
int ret;
const char *name;
uint32_t flags = 0;
unsigned int timeout = 10000;
gid_t groups[10];
int ngroups = 10;
int c;
if (argc == 2) {
name = (const char *) argv[1];
} else {
name = "testuser";
}
ret = sss_nss_getgrouplist_timeout(name, 112233, groups, &ngroups, flags,
timeout);
if (ret == 0) {
printf("%s: %d\n", name, ngroups);
for (c = 0; c < ngroups; c++) {
printf(" %d\n", groups[c]);
}
} else {
printf("%s: sss_nss_getgrouplist_ex %d: %s\n", name, ret,
strerror(ret));
}
return ret;
}
If the user is a member of more then 10 groups there will be a reallocation of
memory which will cause the issue and valgrind will report this. The first
tests should be run with 'SSS_NSS_USE_MEMCACHE=NO' to make sure the code path
which talks directly to SSSD's nss responder is used.
The second patch fixes an issue in the code path which read the data from the
memory mapped cached. Since an internal limit was set to the initial array size
there was no reallocation in this code path but the number of groups the user
is a member of couldn't be returned properly as well. If only the limit patch
is applied valgrind should report the memory management issue for this code
path as well.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/557/head:pr557
git checkout pr557