[SSSD] [PATCHES] KDC proxy related fixes

Sumit Bose sbose at redhat.com
Fri Jul 31 09:46:37 UTC 2015


On Fri, Jul 31, 2015 at 11:34:23AM +0200, Sumit Bose wrote:
> Hi,
> 
> it turned out that some of the current SSSD behaviour does not fit well
> if a KDC proxy is configured, see
> https://fedorahosted.org/sssd/ticket/2652 and
> https://fedorahosted.org/sssd/ticket/2700 for details.
> 
> The first patch in this series introduces a new call which checks if a
> KDC proxy is configured as suggested in the tickets. The other two
> patches aim to fix the respective ticket.
> 
> bye,
> Sumit
> 

Hi,

this is not a self-review, I just want the other developers to check
something which I think looks odd.


> diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
> index 4e453b02d5f4e57b8f5a8f48d7be2434654c0f7e..da5d2707894511a97b7f13eef888f359907b41e0 100644
> --- a/src/providers/krb5/krb5_child_handler.c
> +++ b/src/providers/krb5/krb5_child_handler.c
> @@ -177,7 +177,12 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
>      SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->uid, &rp);
>      SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->gid, &rp);
>      SAFEALIGN_COPY_UINT32(&buf->data[rp], &validate, &rp);
> -    SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->is_offline, &rp);
> +    if (sss_krb5_realm_has_proxy(dp_opt_get_cstring(kr->krb5_ctx->opts,
> +                                                    KRB5_REALM))) {
> +        SAFEALIGN_SET_UINT32(&buf->data[rp], 0, &rp);
> +    } else {
> +        SAFEALIGN_COPY_UINT32(&buf->data[rp], &kr->is_offline, &rp);

I didn't change the line above, just moved it. is_offline is defined as
bool in struct krb5child_req. I think we were just lucky the we didn't
run into issues here so far. I think it would be more clean to use
something like:

    SAFEALIGN_SET_UINT32(&buf->data[rp], (kr->is_offline ? 1 : 0), &rp);

to make sure we do not depend on memory layout. I haven't modified it in
the patch because I didn't want to change the existing behaviour.

bye,
Sumit

> +    }
>      SAFEALIGN_COPY_UINT32(&buf->data[rp], &send_pac, &rp);
>      SAFEALIGN_COPY_UINT32(&buf->data[rp], &use_enterprise_principal, &rp);
>  



More information about the sssd-devel mailing list