From 8a0dc53ab77d5ccca8a3a5952e4ccb941e1fb2ed Mon Sep 17 00:00:00 2001 From: pedrosam Date: Nov 01 2019 09:25:03 +0000 Subject: [PATCH 1/2] COMPONENT: src/util/ Explanation: Propagate error when multiple entries with same certificate have been found Resolves: https://pagure.io/SSSD/sssd/issue/2710 --- diff --git a/src/responder/common/cache_req/cache_req.c b/src/responder/common/cache_req/cache_req.c index 303cee3..b7b8bc5 100644 --- a/src/responder/common/cache_req/cache_req.c +++ b/src/responder/common/cache_req/cache_req.c @@ -1547,6 +1547,10 @@ errno_t cache_req_single_domain_recv(TALLOC_CTX *mem_ctx, *_result = talloc_steal(mem_ctx, state->results[0]); } + if(state->num_results > 1) { + return ERR_MULTIPLE_ENTRIES; + } + return EOK; } diff --git a/src/util/util_errors.c b/src/util/util_errors.c index 9f36967..0fa41f1 100644 --- a/src/util/util_errors.c +++ b/src/util/util_errors.c @@ -123,6 +123,7 @@ struct err_string error_to_str[] = { { "The last GetAccountDomain() result is still valid" }, /* ERR_GET_ACCT_DOM_CACHED */ { "ID is outside the allowed range" }, /* ERR_ID_OUTSIDE_RANGE */ { "Group ID is duplicated" }, /* ERR_GID_DUPLICATED */ + { "Certificate matches multiple user entries" }, /* ERR_MULTIPLE_ENTRIES */ /* DBUS Errors */ { "Connection was killed on demand" }, /* ERR_SBUS_KILL_CONNECTION */ diff --git a/src/util/util_errors.h b/src/util/util_errors.h index ae21991..a6411c6 100644 --- a/src/util/util_errors.h +++ b/src/util/util_errors.h @@ -144,6 +144,7 @@ enum sssd_errors { ERR_GET_ACCT_DOM_CACHED, ERR_ID_OUTSIDE_RANGE, ERR_GID_DUPLICATED, + ERR_MULTIPLE_ENTRIES, /* DBUS Errors */ ERR_SBUS_KILL_CONNECTION, From 4ed122589eaff99643558ed8711a2e97028aded4 Mon Sep 17 00:00:00 2001 From: pedrosam Date: Nov 01 2019 09:46:11 +0000 Subject: [PATCH 2/2] Merge branch 'master' of ssh://pagure.io/forks/pedrosam/SSSD/sssd --- diff --git a/contrib/ci/deps.sh b/contrib/ci/deps.sh index 746a02a..1585dca 100644 --- a/contrib/ci/deps.sh +++ b/contrib/ci/deps.sh @@ -116,8 +116,6 @@ if [[ "$DISTRO_BRANCH" == -debian-* ]]; then libnfsidmap-dev libnl-3-dev libnl-route-3-dev - libnspr4-dev - libnss3-dev libpam0g-dev libpcre3-dev libpopt-dev diff --git a/src/sss_client/idmap/common_ex.c b/src/sss_client/idmap/common_ex.c index e655bb8..1aa6c6f 100644 --- a/src/sss_client/idmap/common_ex.c +++ b/src/sss_client/idmap/common_ex.c @@ -73,7 +73,7 @@ int sss_nss_timedlock(unsigned int timeout_ms, int *time_left_ms) ret = clock_gettime(CLOCK_REALTIME, &starttime); if (ret != 0) { - return ret; + return errno; } endtime.tv_sec = starttime.tv_sec + SEC_FROM_MSEC(timeout_ms); endtime.tv_nsec = starttime.tv_nsec + NSEC_FROM_MSEC(timeout_ms); @@ -83,6 +83,7 @@ int sss_nss_timedlock(unsigned int timeout_ms, int *time_left_ms) if (ret == 0) { ret = clock_gettime(CLOCK_REALTIME, &endtime); if (ret != 0) { + ret = errno; sss_nss_unlock(); return ret; } diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am index 51c90fa..02c182d 100644 --- a/src/tests/intg/Makefile.am +++ b/src/tests/intg/Makefile.am @@ -150,9 +150,11 @@ clean-local: if HAVE_NSS PAM_CERT_DB_PATH="sql:$(DESTDIR)$(sysconfdir)/pki/nssdb" SOFTHSM2_CONF="" +USE_NSS=1 else PAM_CERT_DB_PATH="$(abs_builddir)/../test_CA/SSSD_test_CA.pem" SOFTHSM2_CONF="$(abs_builddir)/../test_CA/softhsm2_one.conf" +USE_NSS=0 endif intgcheck-installed: config.py passwd group pam_sss_service pam_sss_alt_service pam_sss_sc_required pam_sss_try_sc pam_sss_allow_missing_name @@ -187,6 +189,7 @@ intgcheck-installed: config.py passwd group pam_sss_service pam_sss_alt_service PAM_WRAPPER_PATH=$$(pkg-config --libs pam_wrapper) \ PAM_CERT_DB_PATH=$(PAM_CERT_DB_PATH) \ SOFTHSM2_CONF=$(SOFTHSM2_CONF) \ + USE_NSS=$(USE_NSS) \ DBUS_SOCK_DIR="$(DESTDIR)$(runstatedir)/dbus/" \ DBUS_SESSION_BUS_ADDRESS="unix:path=$$DBUS_SOCK_DIR/fake_socket" \ DBUS_SYSTEM_BUS_ADDRESS="unix:path=$$DBUS_SOCK_DIR/system_bus_socket" \ diff --git a/src/tests/intg/test_pam_responder.py b/src/tests/intg/test_pam_responder.py index 5809b83..ad6bec7 100644 --- a/src/tests/intg/test_pam_responder.py +++ b/src/tests/intg/test_pam_responder.py @@ -272,13 +272,15 @@ def cleanup_nssdb(): def create_nssdb_fixture(request): - create_nssdb() - request.addfinalizer(cleanup_nssdb) + if 'USE_NSS' in os.environ and os.environ['USE_NSS'] == '1': + create_nssdb() + request.addfinalizer(cleanup_nssdb) def create_nssdb_no_cert_fixture(request): - create_nssdb_no_cert() - request.addfinalizer(cleanup_nssdb) + if 'USE_NSS' in os.environ and os.environ['USE_NSS'] == '1': + create_nssdb_no_cert() + request.addfinalizer(cleanup_nssdb) @pytest.fixture diff --git a/src/tools/sssctl/sssctl_domains.c b/src/tools/sssctl/sssctl_domains.c index 8b8df56..026ac07 100644 --- a/src/tools/sssctl/sssctl_domains.c +++ b/src/tools/sssctl/sssctl_domains.c @@ -209,6 +209,12 @@ sssctl_domain_status_active_server(struct sbus_sync_connection *conn, goto done; } + if (services == NULL) { + PRINT("This domain has no active servers.\n"); + ret = EOK; + goto done; + } + PRINT("Active servers:\n"); for (i = 0; services[i] != NULL; i++) { ret = sbus_call_ifp_domain_ActiveServer(tmp_ctx, conn, IFP_BUS, @@ -220,6 +226,7 @@ sssctl_domain_status_active_server(struct sbus_sync_connection *conn, goto done; } + /* SBUS_REQ_STRING_DEFAULT handles (server == NULL) case gracefully */ server = SBUS_REQ_STRING_DEFAULT(server, _("not connected")); printf("%s: %s\n", proper_service_name(services[i]), server); } @@ -256,6 +263,12 @@ sssctl_domain_status_server_list(struct sbus_sync_connection *conn, goto done; } + if (services == NULL) { + PRINT("No servers discovered.\n"); + ret = EOK; + goto done; + } + for (i = 0; services[i] != NULL; i++) { PRINT("Discovered %s servers:\n", proper_service_name(services[i]));