Resolves: upstream#3679 - Make nss netgroup requests more robust
Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
This commit is contained in:
Fabiano Fidêncio
parent
8565df471c
commit
8d67726a47
36
0028-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
Normal file
36
0028-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
Normal file
@ -0,0 +1,36 @@
|
||||
From 29f9df0162096d0e3ec4e85c1f1b5ce87062aa64 Mon Sep 17 00:00:00 2001
|
||||
From: Sumit Bose <sbose@redhat.com>
|
||||
Date: Thu, 15 Mar 2018 12:43:34 +0100
|
||||
Subject: [PATCH] nss: initialize nss_enum_index in nss_setnetgrent()
|
||||
|
||||
setnetgrent() is the first call when looking up a netgroup and sets the
|
||||
netgroup name for upcoming getnetgrent() and endnetgrent() calls.
|
||||
Currently the state is reset by calling endnetgrent() but it would be
|
||||
more robust to unconditionally reset the state in setnetgrent() as well
|
||||
in case calling endnetgrent() was forgotten.
|
||||
|
||||
Related to https://pagure.io/SSSD/sssd/issue/3679
|
||||
|
||||
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
||||
(cherry picked from commit 37a84285aeb497ed4909d16916bbf934af3f68b3)
|
||||
---
|
||||
src/responder/nss/nss_cmd.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/responder/nss/nss_cmd.c b/src/responder/nss/nss_cmd.c
|
||||
index 956ee53cb..9f8479b7b 100644
|
||||
--- a/src/responder/nss/nss_cmd.c
|
||||
+++ b/src/responder/nss/nss_cmd.c
|
||||
@@ -756,6 +756,9 @@ static errno_t nss_setnetgrent(struct cli_ctx *cli_ctx,
|
||||
goto done;
|
||||
}
|
||||
|
||||
+ state_ctx->netgrent.domain = 0;
|
||||
+ state_ctx->netgrent.result = 0;
|
||||
+
|
||||
talloc_zfree(state_ctx->netgroup);
|
||||
state_ctx->netgroup = talloc_strdup(state_ctx, netgroup);
|
||||
if (state_ctx->netgroup == NULL) {
|
||||
--
|
||||
2.14.3
|
||||
|
||||
116
0029-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
Normal file
116
0029-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
Normal file
@ -0,0 +1,116 @@
|
||||
From 9f85ab4d8eba042b43a9346ed6dfbf3fc60ea488 Mon Sep 17 00:00:00 2001
|
||||
From: Sumit Bose <sbose@redhat.com>
|
||||
Date: Thu, 15 Mar 2018 12:50:20 +0100
|
||||
Subject: [PATCH] nss: add a netgroup counter to struct nss_enum_index
|
||||
|
||||
Netgroups are not looked up with the help of a single request but by
|
||||
calling setnetgrent(), getnetgrent() and endnetgrent() where
|
||||
getnetgrent() might be called multiple times depending on the number of
|
||||
netgroup elements. Since the caller does not provide a state the state
|
||||
has to be maintained by the SSSD nss responder. Besides the netgroup
|
||||
name this is mainly the number of elements already returned.
|
||||
|
||||
This number is used to select the next element to return and currently
|
||||
it is assumed that there are not changes to the netgroup while the
|
||||
client is requesting the individual elements. But if e.g. the 3 nss
|
||||
calls are not used correctly or the netgroup is modified while the
|
||||
client is sending getnetgrent() calls the stored number might be out of
|
||||
range. To be on the safe side the stored number should be always
|
||||
compared with the current number of netgroup elements.
|
||||
|
||||
Related to https://pagure.io/SSSD/sssd/issue/3679
|
||||
|
||||
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
||||
(cherry picked from commit 08db22b1b1a2e742edbca92e35087294d963adda)
|
||||
---
|
||||
src/db/sysdb.h | 3 ++-
|
||||
src/db/sysdb_search.c | 5 ++++-
|
||||
src/responder/nss/nss_enum.c | 3 ++-
|
||||
src/responder/nss/nss_private.h | 1 +
|
||||
src/responder/nss/nss_protocol_netgr.c | 7 +++++++
|
||||
5 files changed, 16 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
|
||||
index fd18ecefe..2660314a7 100644
|
||||
--- a/src/db/sysdb.h
|
||||
+++ b/src/db/sysdb.h
|
||||
@@ -1219,7 +1219,8 @@ errno_t sysdb_attrs_to_list(TALLOC_CTX *mem_ctx,
|
||||
|
||||
errno_t sysdb_netgr_to_entries(TALLOC_CTX *mem_ctx,
|
||||
struct ldb_result *res,
|
||||
- struct sysdb_netgroup_ctx ***entries);
|
||||
+ struct sysdb_netgroup_ctx ***entries,
|
||||
+ size_t *netgroup_count);
|
||||
|
||||
errno_t sysdb_dn_sanitize(TALLOC_CTX *mem_ctx, const char *input,
|
||||
char **sanitized);
|
||||
diff --git a/src/db/sysdb_search.c b/src/db/sysdb_search.c
|
||||
index dc0bd4f2c..b7ceb6e59 100644
|
||||
--- a/src/db/sysdb_search.c
|
||||
+++ b/src/db/sysdb_search.c
|
||||
@@ -1831,7 +1831,8 @@ done:
|
||||
|
||||
errno_t sysdb_netgr_to_entries(TALLOC_CTX *mem_ctx,
|
||||
struct ldb_result *res,
|
||||
- struct sysdb_netgroup_ctx ***entries)
|
||||
+ struct sysdb_netgroup_ctx ***entries,
|
||||
+ size_t *netgroup_count)
|
||||
{
|
||||
errno_t ret;
|
||||
size_t size = 0;
|
||||
@@ -1935,6 +1936,8 @@ errno_t sysdb_netgr_to_entries(TALLOC_CTX *mem_ctx,
|
||||
tmp_entry[c] = NULL;
|
||||
|
||||
*entries = talloc_steal(mem_ctx, tmp_entry);
|
||||
+ *netgroup_count = c;
|
||||
+
|
||||
ret = EOK;
|
||||
|
||||
done:
|
||||
diff --git a/src/responder/nss/nss_enum.c b/src/responder/nss/nss_enum.c
|
||||
index 031db9f2e..a45b65233 100644
|
||||
--- a/src/responder/nss/nss_enum.c
|
||||
+++ b/src/responder/nss/nss_enum.c
|
||||
@@ -144,7 +144,8 @@ static void nss_setent_internal_done(struct tevent_req *subreq)
|
||||
/* We need to expand the netgroup into triples and members. */
|
||||
ret = sysdb_netgr_to_entries(state->enum_ctx,
|
||||
result[0]->ldb_result,
|
||||
- &state->enum_ctx->netgroup);
|
||||
+ &state->enum_ctx->netgroup,
|
||||
+ &state->enum_ctx->netgroup_count);
|
||||
if (ret != EOK) {
|
||||
goto done;
|
||||
}
|
||||
diff --git a/src/responder/nss/nss_private.h b/src/responder/nss/nss_private.h
|
||||
index 5fc19d26b..aa8d8e9cd 100644
|
||||
--- a/src/responder/nss/nss_private.h
|
||||
+++ b/src/responder/nss/nss_private.h
|
||||
@@ -41,6 +41,7 @@ struct nss_enum_index {
|
||||
struct nss_enum_ctx {
|
||||
struct cache_req_result **result;
|
||||
struct sysdb_netgroup_ctx **netgroup;
|
||||
+ size_t netgroup_count;
|
||||
|
||||
/* Ongoing cache request that is constructing enumeration result. */
|
||||
struct tevent_req *ongoing;
|
||||
diff --git a/src/responder/nss/nss_protocol_netgr.c b/src/responder/nss/nss_protocol_netgr.c
|
||||
index ed04fd258..9f27c6b78 100644
|
||||
--- a/src/responder/nss/nss_protocol_netgr.c
|
||||
+++ b/src/responder/nss/nss_protocol_netgr.c
|
||||
@@ -126,6 +126,13 @@ nss_protocol_fill_netgrent(struct nss_ctx *nss_ctx,
|
||||
idx = cmd_ctx->enum_index;
|
||||
entries = cmd_ctx->enum_ctx->netgroup;
|
||||
|
||||
+ if (idx->result > cmd_ctx->enum_ctx->netgroup_count) {
|
||||
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
||||
+ "Unconsistent state while processing netgroups.\n");
|
||||
+ ret = EINVAL;
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
/* First two fields (length and reserved), filled up later. */
|
||||
ret = sss_packet_grow(packet, 2 * sizeof(uint32_t));
|
||||
if (ret != EOK) {
|
||||
--
|
||||
2.14.3
|
||||
|
||||
@ -69,6 +69,8 @@ Patch0024: 0024-TESTS-Add-a-test-for-the-multiple-files-feature.patch
|
||||
Patch0025: 0025-AD-Missing-header-in-ad_access.h.patch
|
||||
Patch0026: 0026-GPO-Add-ad_options-to-ad_gpo_process_som_state.patch
|
||||
Patch0027: 0027-GPO-Use-AD-site-override-if-set.patch
|
||||
Patch0028: 0028-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
|
||||
Patch0029: 0029-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
|
||||
|
||||
Patch0502: 0502-SYSTEMD-Use-capabilities.patch
|
||||
Patch0503: 0503-Disable-stopping-idle-socket-activated-responders.patch
|
||||
@ -1280,6 +1282,7 @@ fi
|
||||
netgrous in 1.15
|
||||
- Resolves: upstream#3402 - Support alternative sources for the files provider
|
||||
- Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
|
||||
- Resolves: upstream#3679 - Make nss netgroup requests more robust
|
||||
|
||||
* Fri Mar 30 2018 Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
|
||||
- Resolves: upstream#3573 - sssd won't show netgroups with blank domain
|
||||
|
||||
Loading…
Reference in New Issue
Block a user