From 32105397d4466266ee70809cb22889f18fbc87ab Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Mon, 18 Jun 2012 11:23:04 -0400
Subject: [PATCH 5/5] Make the client idle timeout configurable

---
 src/confdb/confdb.h                     |    2 ++
 src/config/SSSDConfig/__init__.py.in    |    1 +
 src/config/SSSDConfigTest.py            |    3 ++-
 src/config/etc/sssd.api.conf            |    1 +
 src/man/sssd.conf.5.xml                 |   15 +++++++++++++++
 src/responder/common/responder.h        |    1 +
 src/responder/common/responder_common.c |   22 ++++++++++++++++++----
 7 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index db247b184d2dbecdd281d16d7b5bc9659bb1cfc3..3fa8b0377d701548e737ae413925358fda6b6884 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -72,6 +72,8 @@
 
 /* Responders */
 #define CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT "get_domains_timeout"
+#define CONFDB_RESPONDER_CLI_IDLE_TIMEOUT "client_idle_timeout"
+#define CONFDB_RESPONDER_CLI_IDLE_DEFAULT_TIMEOUT 60
 
 /* NSS */
 #define CONFDB_NSS_CONF_ENTRY "config/nss"
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index d7895b49af9e6c9a3b48bb282679c61d6ebbfa6a..b90f505d110bf293e8b65964a38c7d620e779a11 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -45,6 +45,7 @@ option_strings = {
     'command' : _('Command to start service'),
     'reconnection_retries' : _('Number of times to attempt connection to Data Providers'),
     'fd_limit' : _('The number of file descriptors that may be opened by this responder'),
+    'client_idle_timeout' : _('Idle time before automatic disconnection of a client'),
 
     # [sssd]
     'services' : _('SSSD Services to start'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 1e1fe98e6850f7539579db00fc0bd96d2a865c9b..ef696e98c0b1ccce3dccda8ead7a3bda10049cf8 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -274,7 +274,8 @@ class SSSDConfigTestSSSDService(unittest.TestCase):
             'debug_to_files',
             'command',
             'reconnection_retries',
-            'fd_limit']
+            'fd_limit',
+            'client_idle_timeout']
 
         self.assertTrue(type(options) == dict,
                         "Options should be a dictionary")
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index e09a8bf033f38144cd9824e2592728c2898e3db2..c3d6fa8119213c874c5f9f1d5f77746a0e1fc88f 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -10,6 +10,7 @@ debug_to_files = bool, None, false
 command = str, None, false
 reconnection_retries = int, None, false
 fd_limit = int, None, false
+client_idle_timeout = int, None, false
 
 [sssd]
 # Monitor service
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 1dae3ccbcbef6ac73c2bfae82a1ab04251e84259..bdf2543b7900aed7b4e75999a4088f91985fe69b 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -303,6 +303,21 @@
                         </para>
                     </listitem>
                 </varlistentry>
+                <varlistentry>
+                    <term>client_idle_timeout</term>
+                    <listitem>
+                        <para>
+                            This option specifies the number of seconds that
+                            a client of an SSSD process can hold onto a file
+                            descriptor without communicating on it. This value
+                            is limited in order to avoid resource exhasution
+                            on the system.
+                        </para>
+                        <para>
+                            Default: 60
+                        </para>
+                    </listitem>
+                </varlistentry>
             </variablelist>
         </refsect2>
 
diff --git a/src/responder/common/responder.h b/src/responder/common/responder.h
index 67884ed7659d3d99ac8d693ad083b4f7e293bf71..43a4fa0236c313c3cdeb2a0b181ffd4c96167bb7 100644
--- a/src/responder/common/responder.h
+++ b/src/responder/common/responder.h
@@ -87,6 +87,7 @@ struct resp_ctx {
 
     struct sss_domain_info *domains;
     int domains_timeout;
+    int client_idle_timeout;
     struct sysdb_ctx_list *db_list;
 
     struct sss_cmd_table *sss_cmds;
diff --git a/src/responder/common/responder_common.c b/src/responder/common/responder_common.c
index 3c269725256c88cfad65a0fc9f1b0d4ac4009797..242fae996634469cb6a4e29c137613fb4bf19a03 100644
--- a/src/responder/common/responder_common.c
+++ b/src/responder/common/responder_common.c
@@ -352,10 +352,8 @@ static void accept_fd_handler(struct tevent_context *ev,
 
 static errno_t reset_idle_timer(struct cli_ctx *cctx)
 {
-    struct timeval tv;
-
-    /* TODO: make this configurable */
-    tv = tevent_timeval_current_ofs(60, 0);
+    struct timeval tv =
+            tevent_timeval_current_ofs(cctx->rctx->client_idle_timeout, 0);
 
     talloc_zfree(cctx->idle);
 
@@ -620,6 +618,22 @@ int sss_process_init(TALLOC_CTX *mem_ctx,
     rctx->confdb_service_path = confdb_service_path;
 
     ret = confdb_get_int(rctx->cdb, rctx->confdb_service_path,
+                         CONFDB_RESPONDER_CLI_IDLE_TIMEOUT,
+                         CONFDB_RESPONDER_CLI_IDLE_DEFAULT_TIMEOUT,
+                         &rctx->client_idle_timeout);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              ("Cannot get the client idle timeout [%d]: %s\n",
+               ret, strerror(ret)));
+        return ret;
+    }
+
+    /* Ensure that the client timeout is at least ten seconds */
+    if (rctx->client_idle_timeout < 10) {
+        rctx->client_idle_timeout = 10;
+    }
+
+    ret = confdb_get_int(rctx->cdb, rctx->confdb_service_path,
                          CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT,
                          GET_DOMAINS_DEFAULT_TIMEOUT, &rctx->domains_timeout);
     if (ret != EOK) {
-- 
1.7.10.2

