In our responders we have a feature that allows to avoid dispatching
multiple identical requests at the same time.
This is done by queing additional identical requests in a special hash
table and then replying to all clients at the same time when a response
When the connection to a provider breaks all these waiting requests need
to be cleaned out and the has table emptied.
This was not happening in sssd_pam, so if a connection to the provider
was lost client request would pile up and never be replied again.
The attached patch fixes this issue. Tested using kill -STOP of the
sssd_be process and trying to authenticate via the gnome screensaver.
Simo Sorce * Red Hat, Inc * New York
The result of the percent calculation was always 0 as it used plain
ints. The patch switches to using explicit floats to avoid reintroducing
the bug again even with brackets.
the attached patch might seem simple, but it touches a delicate and
low-level part of the SSSD, so I'd like to request a detailed review.
I was notified by Bruce Aiesi of the Red Hat QE team that the sssd_nss
process grew its memory footprint when stress-tested by logging in many
users in parallel. I ran a couple of tests and then found out that the
responder context grew because we never freed the internal Data Provider
request. Attached is a patch that simple frees the "side request" after
all the callbacks have been invoked.
I didn't see the memory growth anymore during my testing and I didn't
see any other issues, either during my tests or with valgrind.
I hope I didn't miss any detail and the patch is OK.
I noticed that if offline auth failed for any reason including mistyped
password, we would always print System Error. This makes auditing the
logs hard as it sounds like an internal error occured.
I don't like the header with a single inline function myself, but I
didn't want to clutter util.h with that function either. And we don't
have any shared header for that purpose at the moment..suggestions are
Normally I just push version bumps when releasing a new version without
sending the patch, but this time I also need to fix packaging bug.
Intended for the sssd-1-9 branch only, the master branch had been fixed
when we branched off sssd-1-9.