Julien Rische
6ae52a2fb4
The final call to ipadb_reinit_mspac() in ipadb_get_connection() is not considered essential for the function to succeed, as there might be cases where the required pieces of information to generate PACs are not yet configured in the database. However, in environments where 389ds is overwhelmed, the LDAP connection established at the beginning of ipadb_get_connection() might already be lost while executing ipadb_reinit_mspac(). Connection errors were not distinguished from configuration errors, which could result in ipadb_get_connection() succeeding while the LDAP context is set to null, leading to a KDC crash on the next LDAP request. ipadb_get_connection() now explicitly checks the value of the LDAP context before returning. Fixes: https://pagure.io/freeipa/issue/9777 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
This is the ipa krb5kdc database backend. As the KDB interfaces heavily with krb5, we inherit its code style as well. However, note the following changes: - no modelines (and different file preamble) - return types don't require their own line - single-statement blocks may optionally be braced - /* and */ do not ever get their own line - C99 for-loops are permitted (and encouraged) - a restricted set of other C99 features are permitted In particular, variable-length arrays, flexible array members, compound literals, universal character names, and //-style comments are not permitted. Use of regular malloc/free is preferred over talloc for new code. By and large, existing code mostly conforms to these requirements. New code must conform to them.