NAS-135784 / 25.04.2 / Avoid TOCTOU issues in account and iscsi.target (by anodos325) (#16468)
This commit changes the behavior of get_next_uid and get_next_gid such
that we keep track of uids/gids handed out by this endpoint and prevent
them from being reused in concurrent calls. These reservations of uid /
gids time out after one hour.
During investigation it was discovered that additional simpler toctou
issues existed related to iscsi.target and nvmet namespaces. These ones
were remedied by adding locking.
Original PR: https://github.com/truenas/middleware/pull/16460
Jira URL: https://ixsystems.atlassian.net/browse/NAS-135784
Co-authored-by: Andrew Walker <awalker at ixsystems.com>
NAS-135784 / 25.10 / Avoid TOCTOU issues in account and iscsi.target (#16460)
This commit changes the behavior of get_next_uid and get_next_gid such
that we keep track of uids/gids handed out by this endpoint and prevent
them from being reused in concurrent calls. These reservations of uid /
gids time out after one hour.
During investigation it was discovered that additional simpler toctou
issues existed related to iscsi.target and nvmet namespaces. These ones
were remedied by adding locking.
NAS-135792 / 25.04.2 / Fix mutual TLS authentication for LDAP (#16466)
This commit fixes a longstanding validation bug in mutual tls
authentication for the LDAP plugin. Tests will be added once CI pipeline
added with this authentication type and an LDAP identity provider. This
commit is not targeted for master since the underlying fix will be
rolled into the overall larger rewrite project.
Fix mutual TLS authentication for LDAP
This commit fixes a longstanding validation bug in mutual tls
authentication for the LDAP plugin. Tests will be added once
CI pipeline added with this authentication type and an LDAP
identity provider. This commit is not targeted for master since
the underlying fix will be rolled into the overall larger rewrite
project.
