[PATCH] Include string.h in sss_cli.h
by Sumit Bose
Hi,
by chance so far string.h was always included before sss_cli.h. But to be
on the safe side we should include string.h in sss_cli.h because
safealign_memcpy() is define here which calls memcpy().
bye,
Sumit
12 years, 11 months
RFC: a substitute for the hostent structure
by Jakub Hrozek
I've been working on extending our resolver code to honour TTL lately.
One of the problems I'm solving is the data structure we pass from our
resolver abstraction over c-ares to the failover code.
Currently, the code uses "struct hostent". This is not practical as
hostent does not store TTL.
My current version of the patch uses a "struct resolv_hostent" quite
similar to hostent, but the address itself is stored in:
--------
struct resolv_in_addr {
struct in_addr ipaddr;
int ttl;
};
struct resolv_in6_addr {
struct in6_addr ipaddr;
int ttl;
};
union resolv_addr {
struct resolv_in_addr v4_addr;
struct resolv_in6_addr v6_addr;
};
--------
I was also considering using "struct sockaddr_storage" because that is
defined in system headers and some sources[1] recommend it, but I also
think that semantics of sockaddr structures is more tied to connecting
to a socket than just pure resolving. So right now I prefer the
resolv_addr union, but I would like to hear other opinions before moving
on with the patch.
Jakub
[1] http://www.akkadia.org/drepper/userapi-ipv6.html
12 years, 11 months
[PATCH] Use dereference to speed up RFC2307bis group processing
by Jakub Hrozek
The attached patch set uses special dereference LDAP controls to speed
up RFC2307bis group processing. In my setup, with the LDAP server being
in Boston and client in Brno, the time for "getent group ipausers"
consisting of 2000 entries went down from 1.5 minute to 4 seconds.
One part of the patchset I'd like to draw attention to is the heuristics
in patch #9. Dereference can potentially provide huge savings, but it's
an all-or-nothing operation. As far as I know, you can't only say "only
dereference entries matching this filter", at least not using the
OpenLDAP dereference.
This could actually slow down the processing - consider if a single IPA
user being created triggered a full dereference of "ipausers" group. In
order to overcome this, the code includes a simple heuristics that
either issues a full dereference or a series of single lookups.
The heuristics itself was pulled out of thin air, really. If there are
any suggestions on a better one, I'll be glad to hear them.
And now the patches:
[PATCH 1/9] sdap_get_generic_ext
Add a private sdap_get_generic_ext_send()/_recv() request that
exposes more of ldap_search_ext options, in particular the server
contols. The existing sdap_generic_search_send()/_recv() request
is now a thin wrapper around the new _ext request.
The other important change is that an entry parsing is a callback now.
That was done in order to allow custom parsing for results such as
OpenLDAP deref or Attribute Scoped Queries.
[PATCH 2/9] Add support for Attribute Scoped Queries
For more details on ASQ, see:
http://msdn.microsoft.com/en-us/library/aa366976%28VS.85%29.aspx
http://msdn.microsoft.com/en-us/library/aa746418%28v=VS.85%29.aspx
[PATCH 3/9] OpenLDAP dereference searches
For more details, see:
http://tools.ietf.org/html/draft-masarati-ldap-deref-00
[PATCH 4/9] Generic dereference search
A generic wrapper around ASQ and OpenLDAP dereference searches.
https://fedorahosted.org/sssd/ticket/635
[PATCH 5/9] append_attrs_to_array allocs on a memory context
A convenience function
[PATCH 6/9] Change sysdb_add_fake_user to add OriginalDN
RFC2307bis code relies heavily on originalDN, so the fake users need to
have an option to store it, too.
[PATCH 7/9] Use fake users during RFC2307bis nested group processing
Instead of downloading complete user data which is potentionally very
slow, only download the necessary minimum information and store the
users as dummy entries.
[PATCH 8/9] Refactor RFC2307bis nested group processing
This patch splits checking cache and hash tables into standalone
functions. This will make it easy to reuse the code in a new branch that
uses dereferencing.
[PATCH 9/9] Use dereference in processing RFC2307bis nested groups
Instead of issuing N LDAP requests when processing a group with N users,
utilize the dereference functionality to pull down all the members in a
single LDAP request.
https://fedorahosted.org/sssd/ticket/799
12 years, 11 months
[PATCH] two cleanup patches
by Jakub Hrozek
[PATCH 1/2] Remove append_attrs_to_array
This used to be part of the deref patchset. Since the function is not
used, I think it should be removed.
[PATCH 2/2] Rename label in expand_ccname_template
Simo had a comment about one of my previous patches, but came too late
:-) This patch fixes the label name so it is clear that it is hit even
on success.
12 years, 11 months
[PATCH] AD group nesting
by Jan Zelený
Hi,
I'm sending the first version of the patch solving issues with nested groups
without GID. The patch is definitely not final, let's say it's the first draft
of final patch. It depends on Jakub's recent series of rfc2307bis patches and
it won't be final until they are pushed.
At this moment I'd like to hear your opinion on the concept of the patch.
Thanks in advance
Jan
12 years, 11 months