On (14/07/15 15:02), Sumit Bose wrote:
Hi,
this patch should fix
https://fedorahosted.org/sssd/ticket/2717 .
As you can see I added a new entry ipa_ad_default_names to the global
nss context so that the regular expression string is only evaluated
once. Since it is currently only used in
nss_check_name_of_well_known_sid() I do the initialization here to avoid
initialization when it is not needed. If you think this is too risky in
future I'm fine with moving the initialization to the general
initialization of the nss context.
bye,
Sumit
From 1ff1e1f5fb57dd7e1fa85eb758b8769dfb1260d0 Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Tue, 14 Jul 2015 14:41:34 +0200
Subject: [PATCH] nss_check_name_of_well_known_sid() improve name splitting
Currently in the default configuration
nss_check_name_of_well_known_sid() can only split fully-qualified names
in the user(a)domain.name style. DOM\user style names will cause an error
and terminate the whole request.
With this patch both styles can be handled by default, additionally if
the name could not be split nss_check_name_of_well_known_sid() returns
ENOENT which can be handled more gracefully by the caller.
Resolves
https://fedorahosted.org/sssd/ticket/2717
---
src/responder/nss/nsssrv.h | 1 +
src/responder/nss/nsssrv_cmd.c | 32 ++++++++++++++-
src/tests/cmocka/test_nss_srv.c | 90 ++++++++++++++++++++++++-----------------
src/util/usertools.c | 7 ++++
src/util/util.h | 3 ++
5 files changed, 94 insertions(+), 39 deletions(-)
diff --git a/src/responder/nss/nsssrv.h b/src/responder/nss/nsssrv.h
index e293e3b4d03582abf6abf07cce61d3b6fdebfcae..6a77f9f1179e0bb2353a01edf14a27e576eba481
100644
--- a/src/responder/nss/nsssrv.h
+++ b/src/responder/nss/nsssrv.h
@@ -76,6 +76,7 @@ struct nss_ctx {
struct sss_idmap_ctx *idmap_ctx;
struct sss_names_ctx *global_names;
+ struct sss_names_ctx *ipa_ad_default_names;
const char **extra_attributes;
};
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 0129467302f16af318bbbb0a5be47ff2e235da65..eb550cd007cfb6fac0271b7de211285b6cebfdef
100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -1248,13 +1248,43 @@ static int nss_check_name_of_well_known_sid(struct nss_cmd_ctx
*cmdctx,
size_t pctr = 0;
nss_ctx = talloc_get_type(cmdctx->cctx->rctx->pvt_ctx, struct nss_ctx);
- ret = sss_parse_name(cmdctx, nss_ctx->global_names, full_name,
nss_ctx->global_names is used just in two functions
nss_check_name_of_well_known_sid
nss_check_well_known_sid
All SID related functions should be used with AD.
I would prefer to directly change default to IPA/AD regex for global_names.
Or alternatively iterate over all domains and use their regexes.
In teory, someone can use alternative regex
"(?P<name>[^(a)]+)&(?P<domain>.+$)"
and you will not be able to parse it with default ipa ad regex.
LS
+
+ if (nss_ctx->ipa_ad_default_names == NULL) {
+ ret = get_default_ipa_ad_names(nss_ctx,
+ &nss_ctx->ipa_ad_default_names);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "get_default_ipa_ad_names failed, using global_names.\n");
+
+ /* Instead of failing try the next best. */
+ nss_ctx->ipa_ad_default_names = nss_ctx->global_names;
+ }
+ }
+
+ ret = sss_parse_name(cmdctx, nss_ctx->ipa_ad_default_names, full_name,