Jakub Hrozek | 25 May 12:46
Picon
Favicon

[PATCH] Use uint32_t to copy the service port

The sss_client was copying 32bit port value, but the NSS responder was
reading 16bit port value. This was breaking on Big-Endian machines where
we read "the other 16bits".

By the way, is there a reason to use 32bits in the client in the first
place? IIRC a port number is a 16 bit value..
From eb8a81adfa05cfa8b62291bac0052c4e15124a8e Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@...>
Date: Fri, 25 May 2012 11:51:11 +0200
Subject: [PATCH] Use uint32_t to copy the service port

---
 src/responder/nss/nsssrv_services.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/responder/nss/nsssrv_services.c b/src/responder/nss/nsssrv_services.c
index 2e539f13576d18c97d8c3bff2ced2fd5ed01290f..3a6e1b07866a539b36284446e60b2d507d312275 100644
--- a/src/responder/nss/nsssrv_services.c
+++ b/src/responder/nss/nsssrv_services.c
@@ -1041,13 +1041,13 @@ errno_t parse_getservbyport(TALLOC_CTX *mem_ctx,
     errno_t ret;
     size_t i, j;
     size_t port_and_padding_len;
-    uint16_t c, port;
+    uint32_t c, port;
     char *protocol;
     TALLOC_CTX *tmp_ctx = talloc_new(NULL);
     if (!tmp_ctx) return ENOMEM;
(Continue reading)

Ariel Barria | 25 May 07:22
Picon
Favicon

Use variable to control verbosity for things in common directory

https://fedorahosted.org/sssd/ticket/394

I was reviewing this ticket and talks about a default value to verbosity.

althought i'm not sure if is about the sssd debug level or other case.

If the case of debug level:

Reading theory in
   http://sgallagh.fedorapeople.org/sssd/1.8.91/man/sssd.conf.5.html
in section debug_level (integer) mentions that:

  "0x0010 is the default value as well as the lowest allowed value"
  "0x0010: Fatal failures. Anything that would prevent SSSD from starting up or causes it to cease running."

If you want to use a higher debug level is changed in sssd.conf-> debug_level = (desired level is placed).

By not specifying on command line flag, is used the indicated in sssd.conf ->debug_level.

If specified in command line debug_level first uses the command line, this was corrected in the ticket https://fedorahosted.org/sssd/ticket/764

In the case concerned from that, the flag already exists.

util.h
[code]
      /** \def DEBUG_IS_SET(level)
         \brief checks whether level (must be in new format) is set in debug_level
          \param level the debug level, please use one of the SSSDBG*_ macros
      */
       #define DEBUG_IS_SET(level) (debug_level & (level))
      
       #define CONVERT_AND_SET_DEBUG_LEVEL(new_value) debug_level = ( \
            ((new_value) != SSSDBG_INVALID) \
            ? debug_convert_old_level(new_value) \
            : SSSDBG_UNRESOLVED /* Debug level should be loaded from config file. */ \
       );
[/code]
_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Sumit Bose | 24 May 15:04
Picon
Favicon

[PATCH] sss_idmap: add support for samba struct dom_sid

Hi,

this patch allows us besides other conversions to convert the dom_sid
structure used by samba to strings and back. This structure is used by
various samba libraries, but there are no public inferfaces for the
conversion. I've seen Simo adding code to the IPA kdb plugin doing these
conversions and I need them for the PAC responder as well. So I thought
it might be useful to put it in a library.

bye,
Sumit
From b33d2e0e6cb18a3c90a9b4fda0d4ae7e60136f97 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose <at> redhat.com>
Date: Thu, 24 May 2012 12:39:56 +0200
Subject: [PATCH] sss_idmap: add support for samba struct dom_sid

The samba ndr libraries use struct dom_sid to handle SIDs. Since there
is no public samba library which offers conversion from other
representations, e.g. as string, this is addded to libsss_idmap. There
is only a compile-time dependency to the samba header files to check if
struct dom_sid has the expected format. There is no run-time dependency
to any samba library.
---
 Makefile.am                    |    3 +
 configure.ac                   |    1 +
 src/external/dom_sid.m4        |   65 ++++++++++++++
 src/lib/idmap/sss_idmap.h      |  107 +++++++++++++++++++++++
 src/lib/idmap/sss_idmap_conv.c |  183 ++++++++++++++++++++++++++++++++++++++++
 src/tests/sss_idmap-tests.c    |  104 ++++++++++++++++++++++-
 6 files changed, 461 insertions(+), 2 deletions(-)
 create mode 100644 src/external/dom_sid.m4

diff --git a/Makefile.am b/Makefile.am
index 7663053..f0aab71 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -513,6 +513,8 @@ dist_pkgconfig_DATA += src/lib/idmap/sss_idmap.pc
 libsss_idmap_la_SOURCES = \
     src/lib/idmap/sss_idmap.c \
     src/lib/idmap/sss_idmap_conv.c
+libsss_idmap_la_CFLAGS = \
+    $(NDR_CFLAGS)
 libsss_idmap_la_LDFLAGS = \
     -version-info 0:1:0
 
@@ -985,6 +987,7 @@ sss_idmap_tests_SOURCES = \
     src/tests/sss_idmap-tests.c
 sss_idmap_tests_CFLAGS = \
     $(AM_CFLAGS) \
+    $(NDR_CFLAGS) \
     $(CHECK_CFLAGS)
 sss_idmap_tests_LDADD = \
     $(CHECK_LIBS) \
diff --git a/configure.ac b/configure.ac
index 16e10d6..0b0e7b8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -126,6 +126,7 @@ m4_include([src/external/libkeyutils.m4])
 m4_include([src/external/libnl.m4])
 m4_include([src/external/systemd.m4])
 m4_include([src/external/pac_responder.m4])
+m4_include([src/external/dom_sid.m4])
 m4_include([src/util/signal.m4])
 
 WITH_UNICODE_LIB
diff --git a/src/external/dom_sid.m4 b/src/external/dom_sid.m4
new file mode 100644
index 0000000..0088008
--- /dev/null
+++ b/src/external/dom_sid.m4
@@ -0,0 +1,65 @@
+AC_SUBST(NDR_CFLAGS)
+AC_SUBST(NDR_LIBS)
+PKG_CHECK_MODULES(NDR, ndr,,
+                  AC_MSG_ERROR([Cannot check struct dom_sid without ndr header installed]))
+SAVE_CFLAGS=$CFLAGS
+CFLAGS="$CFLAGS $NDR_CFLAGS"
+dnl Since the names of the checked components are used as parts of variable
+dnl names by autoconf it is not possible to use the [] index notation directly.
+dnl As a workaround I used the define apporach below
+AC_CHECK_MEMBERS([struct dom_sid.sid_rev_num,
+                  struct dom_sid.num_auths,
+                  struct dom_sid.id_auth0,
+                  struct dom_sid.id_auth1,
+                  struct dom_sid.id_auth2,
+                  struct dom_sid.id_auth3,
+                  struct dom_sid.id_auth4,
+                  struct dom_sid.id_auth5,
+                  struct dom_sid.sub_auths0,
+                  struct dom_sid.sub_auths1,
+                  struct dom_sid.sub_auths2,
+                  struct dom_sid.sub_auths3,
+                  struct dom_sid.sub_auths4,
+                  struct dom_sid.sub_auths5,
+                  struct dom_sid.sub_auths6,
+                  struct dom_sid.sub_auths7,
+                  struct dom_sid.sub_auths8,
+                  struct dom_sid.sub_auths9,
+                  struct dom_sid.sub_auths10,
+                  struct dom_sid.sub_auths11,
+                  struct dom_sid.sub_auths12,
+                  struct dom_sid.sub_auths13,
+                  struct dom_sid.sub_auths14],
+                 [AC_DEFINE([HAVE_VALID_DOM_SID],
+                            [1],
+                            [Define if struct dom_sid has all expected members.])],
+                 [AC_MSG_ERROR([struct dom_sid does not has all expected members.])],
+                 [[#include <pwd.h>
+                   #include <stdbool.h>
+                   #include <util/data_blob.h>
+                   #include <gen_ndr/security.h>
+                   #define id_auth0 id_auth[0]
+                   #define id_auth1 id_auth[1]
+                   #define id_auth2 id_auth[2]
+                   #define id_auth3 id_auth[3]
+                   #define id_auth4 id_auth[4]
+                   #define id_auth5 id_auth[5]
+                   #define sub_auths0 sub_auths[0]
+                   #define sub_auths1 sub_auths[1]
+                   #define sub_auths2 sub_auths[2]
+                   #define sub_auths3 sub_auths[3]
+                   #define sub_auths4 sub_auths[4]
+                   #define sub_auths5 sub_auths[5]
+                   #define sub_auths6 sub_auths[6]
+                   #define sub_auths7 sub_auths[7]
+                   #define sub_auths8 sub_auths[8]
+                   #define sub_auths9 sub_auths[9]
+                   #define sub_auths10 sub_auths[10]
+                   #define sub_auths11 sub_auths[11]
+                   #define sub_auths12 sub_auths[12]
+                   #define sub_auths13 sub_auths[13]
+                   #define sub_auths14 sub_auths[14]
+                   #define sub_auths15 sub_auths[15]
+                  ]])
+
+CFLAGS=$SAVE_CFLAGS
diff --git a/src/lib/idmap/sss_idmap.h b/src/lib/idmap/sss_idmap.h
index a3ec919..6b7cbe5 100644
--- a/src/lib/idmap/sss_idmap.h
+++ b/src/lib/idmap/sss_idmap.h
@@ -98,6 +98,13 @@ struct sss_dom_sid;
 struct sss_idmap_ctx;
 
 /**
+ * Placeholder for Samba's struct dom_sid. Consumers of libsss_idmap should
+ * include an appropriate Samba header file to define struct dom_sid. We use
+ * it here to avoid a hard dependency on Samba devel packages.
+ */
+struct dom_sid;
+
+/**
  * @brief Initialize idmap context
  *
  * @param[in] alloc_func Function to allocate memory for the context, if
@@ -375,6 +382,106 @@ enum idmap_error_code sss_idmap_dom_sid_to_sid(struct sss_idmap_ctx *ctx,
 enum idmap_error_code sss_idmap_sid_to_dom_sid(struct sss_idmap_ctx *ctx,
                                                const char *sid,
                                                struct sss_dom_sid **dom_sid);
+
+/**
+ * @brief Convert SID string to Samba dom_sid structure
+ *
+ * @param[in] ctx       Idmap context
+ * @param[in] sid       Zero-terminated string representation of the SID
+ * @param[out] smb_sid  Samba dom_sid structure,
+ *                      must be freed if not needed anymore
+ *
+ * @return
+ *  - #IDMAP_SID_INVALID: Given SID is invalid
+ *  - #IDMAP_OUT_OF_MEMORY: Failed to allocate memory for the result
+ */
+enum idmap_error_code sss_idmap_sid_to_smb_sid(struct sss_idmap_ctx *ctx,
+                                               const char *sid,
+                                               struct dom_sid **smb_sid);
+
+/**
+ * @brief Convert Samba dom_sid structure to SID string
+ *
+ * @param[in] ctx       Idmap context
+ * @param[in] smb_sid   Samba dom_sid structure
+ * @param[out] sid      Zero-terminated string representation of the SID,
+ *                      must be freed if not needed anymore
+ *
+ * @return
+ *  - #IDMAP_SID_INVALID: Given SID is invalid
+ *  - #IDMAP_OUT_OF_MEMORY: Failed to allocate memory for the result
+ */
+enum idmap_error_code sss_idmap_smb_sid_to_sid(struct sss_idmap_ctx *ctx,
+                                               struct dom_sid *smb_sid,
+                                               char **sid);
+
+/**
+ * @brief Convert SID stucture to Samba dom_sid structure
+ *
+ * @param[in] ctx       Idmap context
+ * @param[in] dom_sid   SID structure
+ * @param[out] smb_sid  Samba dom_sid structure,
+ *                      must be freed if not needed anymore
+ *
+ * @return
+ *  - #IDMAP_SID_INVALID: Given SID is invalid
+ *  - #IDMAP_OUT_OF_MEMORY: Failed to allocate memory for the result
+ */
+enum idmap_error_code sss_idmap_dom_sid_to_smb_sid(struct sss_idmap_ctx *ctx,
+                                                   struct sss_dom_sid *dom_sid,
+                                                   struct dom_sid **smb_sid);
+
+/**
+ * @brief Convert Samba dom_sid structure to SID structure
+ *
+ * @param[in] ctx       Idmap context
+ * @param[in] smb_sid   Samba dom_sid structure
+ * @param[out] dom_sid  SID structure,
+ *                      must be freed if not needed anymore
+ *
+ * @return
+ *  - #IDMAP_SID_INVALID: Given SID is invalid
+ *  - #IDMAP_OUT_OF_MEMORY: Failed to allocate memory for the result
+ */
+enum idmap_error_code sss_idmap_smb_sid_to_dom_sid(struct sss_idmap_ctx *ctx,
+                                                   struct dom_sid *smb_sid,
+                                                   struct sss_dom_sid **dom_sid);
+
+/**
+ * @brief Convert binary SID to Samba dom_sid structure
+ *
+ * @param[in] ctx       Idmap context
+ * @param[in] bin_sid   Array with the binary SID
+ * @param[in] length    Size of the array containing the binary SID
+ * @param[out] smb_sid  Samba dom_sid structure,
+ *                      must be freed if not needed anymore
+ *
+ * @return
+ *  - #IDMAP_SID_INVALID: Given SID is invalid
+ *  - #IDMAP_OUT_OF_MEMORY: Failed to allocate memory for the result
+ */
+enum idmap_error_code sss_idmap_bin_sid_to_smb_sid(struct sss_idmap_ctx *ctx,
+                                                   const uint8_t *bin_sid,
+                                                   size_t length,
+                                                   struct dom_sid **smb_sid);
+
+/**
+ * @brief Convert Samba dom_sid structure to binary SID
+ *
+ * @param[in] ctx       Idmap context
+ * @param[in] smb_sid   Samba dom_sid structure
+ * @param[out] bin_sid  Array with the binary SID,
+ *                      must be freed if not needed anymore
+ * @param[out] length   Size of the array containing the binary SID
+ *
+ * @return
+ *  - #IDMAP_SID_INVALID: Given SID is invalid
+ *  - #IDMAP_OUT_OF_MEMORY: Failed to allocate memory for the result
+ */
+enum idmap_error_code sss_idmap_smb_sid_to_bin_sid(struct sss_idmap_ctx *ctx,
+                                                   struct dom_sid *smb_sid,
+                                                   uint8_t **bin_sid,
+                                                   size_t *length);
 /**
  * @}
  */
diff --git a/src/lib/idmap/sss_idmap_conv.c b/src/lib/idmap/sss_idmap_conv.c
index df96fcc..d74df8c 100644
--- a/src/lib/idmap/sss_idmap_conv.c
+++ b/src/lib/idmap/sss_idmap_conv.c
@@ -31,6 +31,10 @@
 #include "lib/idmap/sss_idmap_private.h"
 #include "util/util.h"
 
+#include <stdbool.h>
+#include <util/data_blob.h>
+#include <gen_ndr/security.h>
+
 #define SID_ID_AUTHS 6
 #define SID_SUB_AUTHS 15
 struct sss_dom_sid {
@@ -59,6 +63,7 @@ enum idmap_error_code sss_idmap_bin_sid_to_dom_sid(struct sss_idmap_ctx *ctx,
     if (dom_sid == NULL) {
         return IDMAP_OUT_OF_MEMORY;
     }
+    memset(dom_sid, 0, sizeof(struct sss_dom_sid));
 
     /* Safely copy in the SID revision number */
     dom_sid->sid_rev_num = (uint8_t) *(bin_sid + p);
@@ -387,3 +392,181 @@ done:
 
     return err;
 }
+
+enum idmap_error_code sss_idmap_sid_to_smb_sid(struct sss_idmap_ctx *ctx,
+                                               const char *sid,
+                                               struct dom_sid **_smb_sid)
+{
+    enum idmap_error_code err;
+    struct sss_dom_sid *dom_sid = NULL;
+    struct dom_sid *smb_sid = NULL;
+
+    err = sss_idmap_sid_to_dom_sid(ctx, sid, &dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    err = sss_idmap_dom_sid_to_smb_sid(ctx, dom_sid, &smb_sid);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    *_smb_sid = smb_sid;
+    err = IDMAP_SUCCESS;
+
+done:
+    talloc_free(dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        talloc_free(smb_sid);
+    }
+
+    return err;
+}
+
+enum idmap_error_code sss_idmap_smb_sid_to_sid(struct sss_idmap_ctx *ctx,
+                                               struct dom_sid *smb_sid,
+                                               char **_sid)
+{
+    enum idmap_error_code err;
+    struct sss_dom_sid *dom_sid = NULL;
+    char *sid = NULL;
+
+    err = sss_idmap_smb_sid_to_dom_sid(ctx, smb_sid, &dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    err = sss_idmap_dom_sid_to_sid(ctx, dom_sid, &sid);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    *_sid = sid;
+    err = IDMAP_SUCCESS;
+
+done:
+    talloc_free(dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        talloc_free(sid);
+    }
+
+    return err;
+}
+
+enum idmap_error_code sss_idmap_dom_sid_to_smb_sid(struct sss_idmap_ctx *ctx,
+                                                   struct sss_dom_sid *dom_sid,
+                                                   struct dom_sid **_smb_sid)
+{
+    struct dom_sid *smb_sid;
+    size_t c;
+
+    smb_sid = ctx->alloc_func(sizeof(struct dom_sid), ctx->alloc_pvt);
+    if (smb_sid == NULL) {
+        return IDMAP_OUT_OF_MEMORY;
+    }
+    memset(smb_sid, 0, sizeof(struct dom_sid));
+
+    smb_sid->sid_rev_num = dom_sid->sid_rev_num;
+    smb_sid->num_auths = dom_sid->num_auths;
+    for (c = 0; c < SID_ID_AUTHS; c++) {
+        smb_sid->id_auth[c] = dom_sid->id_auth[c];
+    }
+    for (c = 0; c < SID_SUB_AUTHS; c++) {
+        smb_sid->sub_auths[c] = dom_sid->sub_auths[c];
+    }
+
+    *_smb_sid = smb_sid;
+
+    return IDMAP_SUCCESS;
+}
+
+enum idmap_error_code sss_idmap_smb_sid_to_dom_sid(struct sss_idmap_ctx *ctx,
+                                                   struct dom_sid *smb_sid,
+                                                   struct sss_dom_sid **_dom_sid)
+{
+    struct sss_dom_sid *dom_sid;
+    size_t c;
+
+    dom_sid = ctx->alloc_func(sizeof(struct sss_dom_sid), ctx->alloc_pvt);
+    if (dom_sid == NULL) {
+        return IDMAP_OUT_OF_MEMORY;
+    }
+    memset(dom_sid, 0, sizeof(struct sss_dom_sid));
+
+    dom_sid->sid_rev_num = smb_sid->sid_rev_num;
+    dom_sid->num_auths = smb_sid->num_auths;
+    for (c = 0; c < SID_ID_AUTHS; c++) {
+        dom_sid->id_auth[c] = smb_sid->id_auth[c];
+    }
+    for (c = 0; c < SID_SUB_AUTHS; c++) {
+        dom_sid->sub_auths[c] = smb_sid->sub_auths[c];
+    }
+
+    *_dom_sid = dom_sid;
+
+    return IDMAP_SUCCESS;
+}
+
+enum idmap_error_code sss_idmap_bin_sid_to_smb_sid(struct sss_idmap_ctx *ctx,
+                                                   const uint8_t *bin_sid,
+                                                   size_t length,
+                                                   struct dom_sid **_smb_sid)
+{
+    enum idmap_error_code err;
+    struct sss_dom_sid *dom_sid = NULL;
+    struct dom_sid *smb_sid = NULL;
+
+    err = sss_idmap_bin_sid_to_dom_sid(ctx, bin_sid, length, &dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    err = sss_idmap_dom_sid_to_smb_sid(ctx, dom_sid, &smb_sid);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    *_smb_sid = smb_sid;
+    err = IDMAP_SUCCESS;
+
+done:
+    talloc_free(dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        talloc_free(smb_sid);
+    }
+
+    return err;
+}
+
+enum idmap_error_code sss_idmap_smb_sid_to_bin_sid(struct sss_idmap_ctx *ctx,
+                                                   struct dom_sid *smb_sid,
+                                                   uint8_t **_bin_sid,
+                                                   size_t *_length)
+{
+    enum idmap_error_code err;
+    struct sss_dom_sid *dom_sid = NULL;
+    uint8_t *bin_sid = NULL;
+    size_t length;
+
+    err = sss_idmap_smb_sid_to_dom_sid(ctx, smb_sid, &dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    err = sss_idmap_dom_sid_to_bin_sid(ctx, dom_sid, &bin_sid, &length);
+    if (err != IDMAP_SUCCESS) {
+        goto done;
+    }
+
+    *_bin_sid = bin_sid;
+    *_length = length;
+    err = IDMAP_SUCCESS;
+
+done:
+    talloc_free(dom_sid);
+    if (err != IDMAP_SUCCESS) {
+        talloc_free(bin_sid);
+    }
+
+    return err;
+}
diff --git a/src/tests/sss_idmap-tests.c b/src/tests/sss_idmap-tests.c
index b821dfc..a7d5f57 100644
--- a/src/tests/sss_idmap-tests.c
+++ b/src/tests/sss_idmap-tests.c
@@ -21,6 +21,9 @@
 */
 
 #include <check.h>
+#include <stdbool.h>
+#include <util/data_blob.h>
+#include <gen_ndr/security.h>
 
 #include "lib/idmap/sss_idmap.h"
 #include "tests/common.h"
@@ -35,6 +38,8 @@ uint8_t test_bin_sid[] = {0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x15,
                           0x00};
 size_t test_bin_sid_length = sizeof(test_bin_sid);
 
+struct dom_sid test_smb_sid = {1, 5, {0, 0, 0, 0, 0, 5}, {21, 2127521184, 1604012920, 1887927527, 72713,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0}};
+
 struct sss_idmap_ctx *idmap_ctx;
 
 static void *idmap_talloc(size_t size, void *pvt)
@@ -267,7 +272,7 @@ START_TEST(idmap_test_uid2bin_sid)
 }
 END_TEST
 
-START_TEST(idmap_test_sid_bin2dom_sid)
+START_TEST(idmap_test_bin_sid2dom_sid)
 {
     struct sss_dom_sid *dom_sid = NULL;
     enum idmap_error_code err;
@@ -357,6 +362,96 @@ START_TEST(idmap_test_bin_sid2sid)
 }
 END_TEST
 
+START_TEST(idmap_test_smb_sid2dom_sid)
+{
+    struct sss_dom_sid *dom_sid = NULL;
+    enum idmap_error_code err;
+    struct dom_sid *new_smb_sid = NULL;
+
+    err = sss_idmap_smb_sid_to_dom_sid(idmap_ctx, &test_smb_sid, &dom_sid);
+    fail_unless(err == IDMAP_SUCCESS,
+                "Failed to convert samba dom_sid to struct sss_dom_sid.");
+
+    err = sss_idmap_dom_sid_to_smb_sid(idmap_ctx, dom_sid, &new_smb_sid);
+    fail_unless(err == IDMAP_SUCCESS,
+                "Failed to convert struct sss_dom_sid to samba dom_sid.");
+
+    fail_unless(memcmp(&test_smb_sid, new_smb_sid, sizeof(struct dom_sid)) == 0,
+                "Samba dom_sid-s do not match.");
+
+    talloc_free(dom_sid);
+    talloc_free(new_smb_sid);
+}
+END_TEST
+
+START_TEST(idmap_test_smb_sid2bin_sid)
+{
+    enum idmap_error_code err;
+    size_t length;
+    uint8_t *bin_sid = NULL;
+
+    err = sss_idmap_smb_sid_to_bin_sid(idmap_ctx, &test_smb_sid,
+                                       &bin_sid, &length);
+    fail_unless(err == IDMAP_SUCCESS,
+                "Failed to convert samba dom_sid to binary sid.");
+    fail_unless(length == test_bin_sid_length,
+                "Size of binary SIDs do not match, got [%d], expected [%d]",
+                length, test_bin_sid_length);
+    fail_unless(memcmp(bin_sid, test_bin_sid, test_bin_sid_length) == 0,
+                "Binary SIDs do not match.");
+
+    talloc_free(bin_sid);
+}
+END_TEST
+
+START_TEST(idmap_test_bin_sid2smb_sid)
+{
+    enum idmap_error_code err;
+    struct dom_sid *smb_sid = NULL;
+
+    err = sss_idmap_bin_sid_to_smb_sid(idmap_ctx, test_bin_sid,
+                                       test_bin_sid_length, &smb_sid);
+    fail_unless(err == IDMAP_SUCCESS,
+                "Failed to convert binary sid to samba dom_sid.");
+    fail_unless(memcmp(&test_smb_sid, smb_sid, sizeof(struct dom_sid)) == 0,
+                 "Samba dom_sid structs do not match.");
+
+    talloc_free(smb_sid);
+}
+END_TEST
+
+START_TEST(idmap_test_smb_sid2sid)
+{
+    enum idmap_error_code err;
+    char *sid = NULL;
+
+    err = sss_idmap_smb_sid_to_sid(idmap_ctx, &test_smb_sid, &sid);
+    fail_unless(err == IDMAP_SUCCESS,
+                "Failed to convert samba dom_sid to sid string.");
+    fail_unless(strcmp(sid, test_sid) == 0, "SID strings do not match, "
+                                            "expected [%s], get [%s]",
+                                            test_sid, sid);
+
+    talloc_free(sid);
+}
+END_TEST
+
+START_TEST(idmap_test_sid2smb_sid)
+{
+    enum idmap_error_code err;
+    struct dom_sid *smb_sid = NULL;
+
+    err = sss_idmap_sid_to_smb_sid(idmap_ctx, test_sid, &smb_sid);
+    fail_unless(err == IDMAP_SUCCESS,
+                "Failed to convert binary sid to samba dom_sid.");
+    fail_unless(memcmp(&test_smb_sid, smb_sid, sizeof(struct dom_sid)) == 0,
+                 "Samba dom_sid structs do not match.");
+
+    talloc_free(smb_sid);
+}
+END_TEST
+
+
 Suite *idmap_test_suite (void)
 {
     Suite *s = suite_create ("IDMAP");
@@ -392,10 +487,15 @@ Suite *idmap_test_suite (void)
                               idmap_ctx_setup,
                               idmap_ctx_teardown);
 
-    tcase_add_test(tc_conv, idmap_test_sid_bin2dom_sid);
+    tcase_add_test(tc_conv, idmap_test_bin_sid2dom_sid);
     tcase_add_test(tc_conv, idmap_test_sid2dom_sid);
     tcase_add_test(tc_conv, idmap_test_sid2bin_sid);
     tcase_add_test(tc_conv, idmap_test_bin_sid2sid);
+    tcase_add_test(tc_conv, idmap_test_smb_sid2dom_sid);
+    tcase_add_test(tc_conv, idmap_test_smb_sid2bin_sid);
+    tcase_add_test(tc_conv, idmap_test_bin_sid2smb_sid);
+    tcase_add_test(tc_conv, idmap_test_smb_sid2sid);
+    tcase_add_test(tc_conv, idmap_test_sid2smb_sid);
 
     suite_add_tcase(s, tc_conv);
 
-- 
1.7.7.6

_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Ariel Barria | 24 May 00:30
Picon
Favicon

[RFE] Add 'auth_provider = none' as an option to SSSD

Hi, i would comment for to see if i'm wrong.

Ticket https://fedorahosted.org/sssd/ticket/1339

"auth_provider = none" already exists (it seems)

Reading theory in http://sgallagh.fedorapeople.org/sssd/1.8.91/man/sssd.conf.5.html  mentions that:

auth_provider (string)
"none" disallows password changes explicitly.
Default: "id_provider" is used if it is set and can handle authentication requests.

in data_provider_be.c
 [code]
    if (strcasecmp(mod_name, NO_PROVIDER) == 0) {
            ret = ENOENT;
            goto done;
    }
 [/code]
 
and by placing "id_provider = proxy" the default auth_provider= id_provider (proxy) , this ago that request proxy_pam_target.

this is correct?

Thanks.
_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Stephen Gallagher | 23 May 15:03
Picon
Favicon
Gravatar

[PATCH] NSS: Fix segfault when mmap cache cannot be initialized

If the mmap cache cannot be initialized (such as insufficient
permissions or SELinux/AppArmor denial), we are supposed to fall back to
our 1.8 behavior of LDB cache only. However, we weren't properly
checking that the cache had been set up and we were always attempting to
dereference the mmap context in fill_pwent() and fill_grent().

Fixes https://fedorahosted.org/sssd/ticket/1346
From 944ac21c0b4a12e43bfde95d7b3ce519fd9deb62 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh <at> redhat.com>
Date: Wed, 23 May 2012 08:35:26 -0400
Subject: [PATCH] NSS: Fix segfault when mmap cache cannot be initialized

---
 src/responder/nss/nsssrv_cmd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index aa3ef3cbc0b98d3fe44e14dce212ecf1279f14f3..1b444e68a2f09749a3f230905febc5efa15c8a82 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -365,7 +365,7 @@ static int fill_pwent(struct sss_packet *packet,
 
         num++;
 
-        if (pw_mmap_cache) {
+        if (pw_mmap_cache && nctx->pwd_mc_ctx) {
             ret = sss_mmap_cache_pw_store(nctx->pwd_mc_ctx,
                                           &fullname, &pwfield,
                                           uid, gid,
@@ -1918,7 +1918,7 @@ static int fill_grent(struct sss_packet *packet,
 
         num++;
 
-        if (gr_mmap_cache) {
+        if (gr_mmap_cache && nctx->grp_mc_ctx) {
             /* body was reallocated, so fullname might be pointing to
              * where body used to be, not where it is */
             to_sized_string(&fullname, (const char *)&body[rzero+STRS_ROFFSET]);
-- 
1.7.10.1

_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Edward Z. Yang | 23 May 04:06
Picon
Favicon

Securing remote domains

Hello all,

We're interested in using SSSD to replace our current use of
NSS/PAM/NSCD/NSLCD.  However, we were curious whether or not
SSSD had implemented some critical security checks to protect
against malicious remote domains.

    - What are the semantics of the local domain: that is,
      do I have a guarantee that entries in local will never
      be affected by the network?

    - If the answer to the above is true, how does SSSD resolve
      conflicts between two domains which have entries that claim
      the same UID?  I understand that the max_id/min_id functionality
      is intended to address this partially, but does SSSD do any
      further sanity checks, such as refusing information from
      remote domains that exist in local domains?

    - Additionally, users may come with groups, and it is bad if
      remote domains can spoof ownership in local groups.  Is there
      anyway to lock this down?

    - It is frequently useful for applications running on the system
      to be able to identify nonlocal users as opposed to local users;
      we had a nsswitch module which identified nonlocal users and
      added them to their own group.  Does this functionality exist
      in SSSD?  (It's also convenient to have another group which contains
      local users.)

    - A nice to have feature (though not strictly necessary), is the
      ability to pretend that nonlocal users are in some local group.
      This may be necessary if remote domains cannot dictate ownership
      in local groups.

In general, we would like to avoid trusting the source of the remote
authentication data: local accounts are first class, whereas remote accounts
are merely "nice to have". The remote LDAP server may not be held to as high
security standards as the machine itself, and if we can achieve isolation at
very little cost, we should do so.

The MIT Debathena and Scripts projects would be very interested
in seeing this functionality exist, and if it doesn't, we'd be
interested in contributing this functionality.  We consider this
a blocker for moving to SSSD.

Thanks,
Edward
_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Stephen Gallagher | 22 May 19:41
Picon
Favicon
Gravatar

New mailing list: sssd-users

For quite some time, we have used the sssd-devel mailing list for
development and user configuration issue discussions. As the project has
grown, it becomes more and more clear that we need to separate these
topics into their own lists.

So as of today, we now have a new mailing list for user questions. You
can subscribe at https://fedorahosted.org/mailman/listinfo/sssd-users

This list will be considerably less noisy for our users as they will not
be bombarded with patch review emails and other development-centric
issues.
_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Jakub Hrozek | 22 May 17:43
Picon
Favicon

[PATCH] LDAP nested groups: Do not process callback with _post deep in the nested structure

https://fedorahosted.org/sssd/ticket/1343

I still haven't been able to fully test the patch, but sending out for
review anyway.
From d111b80ff5f49f5efcf3bf7d30abf76533e4d440 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@...>
Date: Tue, 22 May 2012 17:41:52 +0200
Subject: [PATCH] LDAP nested groups: Do not process callback with _post deep
 in the nested structure

https://fedorahosted.org/sssd/ticket/1343
---
 src/providers/ldap/sdap_async_groups.c |   22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/src/providers/ldap/sdap_async_groups.c b/src/providers/ldap/sdap_async_groups.c
index 84eb7cbfd6536f286c5bf4b1f41e150d003130aa..b587f668e678fd0b68eb401174fc2b097b3f4b87 100644
--- a/src/providers/ldap/sdap_async_groups.c
+++ b/src/providers/ldap/sdap_async_groups.c
@@ -2498,14 +2498,13 @@ static errno_t sdap_nested_group_lookup_user(struct tevent_req *req,
                 ret = sdap_nested_group_process_step(req);
             }

-            if (ret == EOK) {
-                /* EOK means it's complete */
+            if (ret != EOK && ret != EAGAIN) {
+                DEBUG(SSSDBG_OP_FAILURE, ("Nested group processing failed\n"));
+                return ret;
+            } else if (ret == EOK) {
+                DEBUG(SSSDBG_TRACE_FUNC, ("All done.\n"));
                 tevent_req_done(req);
-                tevent_req_post(req, state->ev);
-            } else if (ret != EAGAIN) {
-                return ret;
             }
-
             return EOK;
         }
         /*
@@ -2583,14 +2582,13 @@ static errno_t sdap_nested_group_lookup_group(struct tevent_req *req)
             ret = sdap_nested_group_process_step(req);
         }

-        if (ret == EOK) {
-            /* EOK means it's complete */
-            tevent_req_done(req);
-            tevent_req_post(req, state->ev);
-        } else if (ret != EAGAIN) {
+        if (ret != EOK && ret != EAGAIN) {
+            DEBUG(SSSDBG_OP_FAILURE, ("Nested group processing failed\n"));
             return ret;
+        } else if (ret == EOK) {
+            DEBUG(SSSDBG_TRACE_FUNC, ("All done.\n"));
+            tevent_req_done(req);
         }
-
         return EOK;
     }

--

-- 
1.7.10.1

_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Jan Zelený | 22 May 16:44
Picon
Favicon

[PATCH] Fixed issue in SELinux user maps

There was an issue when IPA provider didn't set PAM_SUCCESS when
successfully finished loading SELinux user maps. This lead to the map
not being read in the responder.

Thanks
Jan
From c0e205dbdc154ff36297857182b1da161476bb4c Mon Sep 17 00:00:00 2001
From: Jan Zeleny <jzeleny@...>
Date: Tue, 15 May 2012 10:49:14 -0400
Subject: [PATCH] Fixed issue in SELinux user maps

There was an issue when IPA provider didn't set PAM_SUCCESS when
successfully finished loading SELinux user maps. This lead to the map
not being read in the responder.
---
 src/providers/ipa/ipa_session.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/src/providers/ipa/ipa_session.c b/src/providers/ipa/ipa_session.c
index e23b0120e6c2ce1303f4e70190721721a99b124a..238acdde776520dbb69046b8d45ecac4569e5cbc 100644
--- a/src/providers/ipa/ipa_session.c
+++ b/src/providers/ipa/ipa_session.c
@@ -104,6 +104,7 @@ static void ipa_session_handler_done(struct tevent_req *req)
     struct sysdb_attrs **maps;
     bool in_transaction = false;
     char *default_user;
+    struct pam_data *pd = talloc_get_type(breq->req_data, struct pam_data);
     char *map_order;

     ret = ipa_get_selinux_recv(req, breq, &map_count, &maps,
@@ -140,6 +141,7 @@ static void ipa_session_handler_done(struct tevent_req *req)
     in_transaction = false;

 
+    pd->pam_status = PAM_SUCCESS;
     breq->fn(breq, DP_ERR_OK, EOK, "Success");
     return;

--

-- 
1.7.7.6

_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Ondrej Valousek | 21 May 14:08
Favicon

sssd & AD frequently disconnecting

Hi List,

I am using sssd (F17) with AD and what I observed is that sssd frequently marks my AD server working and then "not working". Symptoms:

(Mon May 21 13:58:43 2012) [sssd[be[default]]] [sdap_id_op_connect_step] (0x4000): beginning to connect
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP'
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [get_server_status] (0x1000): Status of server 'dcpra1.XXX' is 'working'
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [get_port_status] (0x1000): Port status of port 389 for server 'dcpra1.XXX' is 'not working'
(Mon May 21 13:58:43 2012) [sssd[be[default]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP'

Sometimes sssd does manage to connect, sometimes not.
I know there is a problem with the AD controller cutting the connection after some timeout that we can not (yet) handle correctly, but this also happens shortly after sssd restart.

Is there any explanation to this?
Thanks,
Ondrej

The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications-K2D8ygZuxnnowKkBSvOlow@public.gmane.org Thank You. Silicon and Software Systems Limited. Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18

_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Dmitri Pal | 22 May 12:05
Picon
Favicon

Request for community input: Support of RADIUS authentication via SSSD

Hello,

As SSSD (the System Security Services Daemon) is gaining ground as a
bridge between applications running on a machine and central
authentication sources such as Active Directory and FreeIPA, questions
about support for other authentication protocols start to come up. One
such protocol is RADIUS (Remote Authentication Dial In User Service).
RADIUS is a popular authentication protocol for enterprise deployments,
notably for VPN (virtual private network) and WPA (WiFI Protected
Access) access.

Some enterprise deployments today also rely on RADIUS for the
authentication of system users. This is most often accomplished through
the use of the pam_radius_auth[1] module for PAM (Pluggable
Authentication Modules).

From a design standpoint, a RADIUS authentication module would be a
simple fit. SSSD would acquire user identities from an LDAP directory
server, but would perform authentication against a RADIUS server, rather
than via LDAP simple-bind or Kerberos TGT acquisition. From a
completeness perspective, it seems sensible for SSSD to implement a
RADIUS authentication provider.

The question we need to ask is whether support of RADIUS in SSSD adds any
additional benefits. For this, we need to reach out to our community for
their experience and advice. Do you have (or know of) any specific
use-cases where the availability of a RADIUS authentication provider
would be beneficial? Similarly, do you feel that implementation of such
a provider would be best served by SSSD (and by extension, with offline
cached-credentials capability), or should we recommend continued use of
pam_radius_auth and simply ensure that SSSD gets out of its way?

Please provide as much justification and reasoning to back your
recommendations, so we can use this information to best identify our
path forward on this.

[1] http://freeradius.org/pam_radius_auth/

--

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IPA project,
Red Hat Inc.

-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/

_______________________________________________
sssd-devel mailing list
sssd-devel <at> lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel

Gmane