Add underlying diagnostic message for SSL errors. Resolves: https://fedorahosted.org/sssd/ticket/3005 Reviewed-by: Pavel Březina <pbrezina@redhat.com>

Util: Move socket setup in a common utility file Other components may need to connect sockets, the code here is generic enough that with minimal modifications can be used for non-ldap connections too. So create a sss_sockets.c/h utility file with all the non-ldap specific socket setup functions and make them available for other uses. Resolves: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

LDAP: Fix leak of file descriptors The state "struct sss_ldap_init_state" contains socket created in function sss_ldap_init_send. We register callback sdap_async_sys_connect_timeout for handling issue with connection The tevent request "sss_ldap_init_send" is usually (nested) subrequest of "struct resolve_service_state" related request created in fucntion fo_resolve_service_send. Function fo_resolve_service_send also register timeout callback fo_resolve_service_timeout to state "struct resolve_service_state". It might happen that fo_resolve_service_timeout will be called before sss_ldap_init_send timeout and we could not handle tiemout error for state "struct sss_ldap_init_state" and therefore created socket was not closed. We tried to release resources in function sdap_handle_release. But the structure "struct sdap_handle" had not been initialized yet with LDAP handle and therefore associated file descriptor could not be closed. [fo_resolve_service_timeout] (0x0080): Service resolving timeout reached [fo_resolve_service_recv] (0x0020): TEVENT_REQ_RETURN_ON_ERROR ret[110] [sdap_handle_release] (0x2000): Trace: sh[0x7f6713410270], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory [be_resolve_server_done] (0x1000): Server resolution failed: 14 [be_resolve_server_recv] (0x0020): TEVENT_REQ_RETURN_ON_ERROR ret[14] [check_online_callback] (0x0100): Backend returned: (1, 0, <NULL>) [Provider is Offline (Success)] Resolves: https://fedorahosted.org/sssd/ticket/2792 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

IPA: Improve messages about failures Reviewed-by: Pavel Březina <pbrezina@redhat.com>

SDAP: Use portable constant as level in setsockopt The macros SOL_TCP and IPPROTO_TCP have the same value on linux, but the first one is not portable. man in.h says: The <netinet/in.h> header shall define the following macros for use as values of the level argument of getsockopt() and setsockopt(): IPPROTO_IP Internet protocol. IPPROTO_IPV6 Internet Protocol Version 6. IPPROTO_ICMP Control message protocol. IPPROTO_RAW Raw IP Packets Protocol. IPPROTO_TCP Transmission control protocol. IPPROTO_UDP User datagram protocol. Reviewed-by: Pavel Reichl <preichl@redhat.com>

Update DEBUG* invocations to use new levels Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

Make DEBUG macro invocations variadic Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>

SSSD: Improved domain detection A bit more elegant way of detection of what domain the group member belongs to Resolves: https://fedorahosted.org/sssd/ticket/2132

Fix formating of variables with type: int

add sss_ldap_encode_ndr_uint32 Converts uint32 to a string value that is suitable for octed string attributes.

Use common error facility instead of sdap_result Simplifies and consolidates error reporting for ldap authentication paths. Adds 3 new error codes: ERR_CHPASS_DENIED - Used when password constraints deny password changes ERR_ACCOUNT_EXPIRED - Account is expired ERR_PASSWORD_EXPIRED - Password is expired

Unbreak build on RHEL5: replace ldap_destroy() with ldap_unbind_ext() ldap_destroy() is not present in RHEL5

Close LDAP connection when unable to install TLS We were not closing LDAP connection when using SSL with invalid certificate. https://fedorahosted.org/sssd/ticket/1490

Log fixes for sdap_call_conn_cb

Use of uninitialized value in sss_ldap_dn_in_search_bases https://fedorahosted.org/sssd/ticket/1112

Added sss_ldap_dn_in_search_bases()

Always attempt to connect in sdap_async_sys_connect_done This syncs up with Samba commit 50e30afa608dfdeae8a260730ead9761ed424dad

sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() https://fedorahosted.org/sssd/ticket/986

sss_ldap_err2string() - function created https://fedorahosted.org/sssd/ticket/986

Handle timeout during sss_ldap_init_send In some cases, where there would be no response from the LDAP server, there would be no R/W events on the LDAP fd, so sdap_async_sys_connect_done would never be called. This patch adds a tevent timer that cancels the connection after SDAP_NETWORK_TIMEOUT seconds.

Allow the O_NONBLOCK flag to be reset correctly sssd set the O_NONBLOCK flag on the LDAP socket twice. First in set_fd_flags_and_opts(). And the second time in sdap_async_sys_connect_send() after storing a backup in the local state structure. The backup is later used to restore the original flags (after connect() succeeded). As NONBLOCK was already set before it didn't correctly reset that flag. https://fedorahosted.org/sssd/ticket/952

Move IP adress escaping from the LDAP namespace

Call ldap_install_tls() on ldaps connections

Do not access state after tevent_req_done() is called.

Do not attempt to close() a file descriptor < 0 Coverity 10886

Use ldap_init_fd() instead of ldap_initialize() if available

Add a utility function to escape IPv6 address for use in URIs

Don't pass NULL to printf for TLS errors https://fedorahosted.org/sssd/ticket/643

Rename server/ directory to src/ Also update BUILD.txt