[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Lukas Slebodnik lslebodn at redhat.com
Wed Apr 29 16:50:09 UTC 2015


On (29/04/15 08:00), Stephen Gallagher wrote:
>I'm not aware of any situation where this would be a sensible reply,
>so this should be fine (and at worst, safe).
>
>I suspect (but since Yassir isn't here any more cannot confirm) that
>the original intent here was to skip this GPO, but that wasn't
>correctly implemented. Good thing too, as it would have been a
>security bug as previously noted.
>
>Given that this is fairly likely to be hit, I suggest that we need to
>open an RFE bug upstream and then change the message to refer to it. I
>suggest the following:
>
>"BUG: No attrs found for GPO [%s]. This was likely caused by the GPO
>entry being a referred to another domain controller. SSSD does not yet
>support this configuration. See [insert SSSD bug number] for more
>information."

Updated patch attached.

LS
-------------- next part --------------
>From a1a9b7492224cba34068aa55cc088db4b2c4db1c Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Wed, 29 Apr 2015 09:17:18 +0200
Subject: [PATCH] GPO: Do not ignore missing attrs for GPOs

We don't want to skip over a GPO that might properly be denying
users.

[sssd[be[a.foo.com]]] [sdap_sd_search_send] (0x0400):
    Searching entry [cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=foo,DC=com] using SD
[sssd[be[a.foo.com]]] [sdap_get_generic_ext_step] (0x0400):
    calling ldap_search_ext with [(objectclass=*)][cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=lzb,DC=hq].
[sssd[be[a.foo.com]]] [sdap_process_message] (0x4000):
    Message type: [LDAP_RES_SEARCH_RESULT]
[sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x0400):
    Search result: Referral(10), 0000202B: RefErr: DSID-0310063C, data 0, 1 access points
        ref 1: 'lzb.hq'
[sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x1000):
    Ref: ldap://foo.com/cn=%7B2BA15B73-9524-419F-B4B7-185E1F0D3DCF%7D,cn=policies,cn=system,DC=foo,DC=com
[sssd[be[a.foo.com]]] [ad_gpo_get_gpo_attrs_done] (0x0040):
    no attrs found for GPO; try next GPO.

Resolves:
https://fedorahosted.org/sssd/ticket/2629
---
 src/providers/ad/ad_gpo.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
index 23d67bc35ded5d93ee4cb63bf5ea6f5e938257cd..4cfd26800da6c8d77fa4b5ee133a7adab346906c 100644
--- a/src/providers/ad/ad_gpo.c
+++ b/src/providers/ad/ad_gpo.c
@@ -3497,9 +3497,15 @@ ad_gpo_get_gpo_attrs_done(struct tevent_req *subreq)
     }
 
     if ((num_results < 1) || (results == NULL)) {
-        DEBUG(SSSDBG_OP_FAILURE, "no attrs found for GPO; try next GPO.\n");
-        state->gpo_index++;
-        ret = ad_gpo_get_gpo_attrs_step(req);
+        const char *gpo_dn = state->candidate_gpos[state->gpo_index]->gpo_dn;
+
+        DEBUG(SSSDBG_OP_FAILURE,
+              "BUG: No attrs found for GPO [%s]. This was likely caused by "
+              "the GPO entry being a referred to another domain controller."
+              " SSSD does not yet support this configuration. See upstream "
+              "ticket #2645 for more information.\n",
+              gpo_dn);
+        ret = ERR_INTERNAL;
         goto done;
     }
     else if (num_results > 1) {
-- 
2.3.6



More information about the sssd-devel mailing list