[SSSD] [PATCH] NSS: Use right domain for group members with fq names

Lukas Slebodnik lslebodn at redhat.com
Tue Sep 2 17:46:33 UTC 2014


ehlo,

attached patch fixes regression introduced by commit:
  commit c86904baad32fbf9e66bf1cdc667aa5e683b48ba
  NSS: Don't use printf(3) on user provided strings.

Fortunatelly, it was not backported into 1-11 branch.
sh$ git tag --contains c86904baad32fbf9e66bf1cdc667aa5e683b48ba
sssd-1_11_90
sssd-1_11_91
sssd-1_12_0
sssd-1_12_0_beta1
sssd-1_12_0_beta2

How to reproduce:
    a) you need to have 2 AD domains with trust.
    b) group from subdomain should contain mixed members (from all 2 domains)
    c) have emty sssd cache.
    d) getent group subdomain_group_fqname


In my case:
 * without this patch:
sh# getent group group2_dom2 at sssdad_tree.com
group2_dom2 at sssdad_tree.com:*:525402171:user2_dom3 at child1.sssdad.com,user1_dom2 at sssdad_tree.com

 * with this patch:
sh# getent group group2_dom2 at sssdad_tree.com
group2_dom2 at sssdad_tree.com:*:525402171:user2_dom1 at sssdad.com,user2_dom3 at child1.sssdad.com,user1_dom2 at sssdad_tree.com


You can also test with unit test.
a) apply attached patch
b) revert changes in file src/responder/nss/nsssrv_cmd.c
    sh$ git checkout HEAD~ src/responder/nss/nsssrv_cmd.c
c) run test
   -- nss-srv-tests will fail and will contain error
[ RUN      ] test_nss_getgrnam_mix_subdom
0x2 != 0x3
../sssd/src/tests/cmocka/test_nss_srv.c:1429: error: Failure!
[  FAILED  ] test_nss_getgrnam_mix_subdom

LS
-------------- next part --------------
>From 1fd3cade59e2f8a92ed87071fa8267cc5d3c0e24 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Sat, 30 Aug 2014 17:31:50 +0200
Subject: [PATCH] NSS: Use right domain for group members with fq names

If we query group from subdmain it can contains users from different domains.
All members from subdomain have fully qualified names, but member from main
domain aren't. In function fill_members, we extracted name and domain with
function fill_members. Later, we called function sss_fqname the first time
with queried group domain and the second time with parsed domain.
It caused following error in nss responder:

[fill_members] (0x0040): Failed to generate a fully qualified name for member
  [user2_dom1 at sssdad_tree.com] of group [group2_dom2 at sssdad_tree.com]! Skipping

The test test_nss_getgrnam_mix_dom_fqdn passed, because name of main domain
and mame of sub-domain have the same length, Therefore there was not problem
in function fill_members with calling sss_fqname with different domains.
This patch also changes name of subdomain to prevent such problems in future.
---
 src/responder/nss/nsssrv_cmd.c  | 2 +-
 src/tests/cmocka/test_nss_srv.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 91139980ab2f46cff1c71928f9106e2bfbfa6878..620cfe53cc85073c16f799beacbf33ec8ea808cc 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -2391,7 +2391,7 @@ static int fill_members(struct sss_packet *packet,
         }
 
         if (add_domain) {
-            nlen = sss_fqname(NULL, 0, dom->names, dom, name.str);
+            nlen = sss_fqname(NULL, 0, dom->names, member_dom, name.str);
             if (nlen >= 0) {
                 nlen += 1;
             } else {
diff --git a/src/tests/cmocka/test_nss_srv.c b/src/tests/cmocka/test_nss_srv.c
index e7d6540ccdba1cdc6c3d87661df86e1b60900c6f..644468dbbbbef99f293e3556df6304327be57edd 100644
--- a/src/tests/cmocka/test_nss_srv.c
+++ b/src/tests/cmocka/test_nss_srv.c
@@ -37,7 +37,7 @@
 #define TEST_CONF_DB "test_nss_conf.ldb"
 #define TEST_DOM_NAME "nss_test"
 #define TEST_SYSDB_FILE "cache_"TEST_DOM_NAME".ldb"
-#define TEST_SUBDOM_NAME "test.sub"
+#define TEST_SUBDOM_NAME "test.subdomain"
 #define TEST_ID_PROVIDER "ldap"
 
 struct nss_test_ctx {
-- 
2.1.0



More information about the sssd-devel mailing list