From d2fbe17663f7cfc79e11e2fec7371f102bbe9aed Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Thu, 4 Sep 2014 15:42:26 +0200 Subject: [PATCH] name2sid: Check negative cache for users and groups Since we cannot know if a SID belongs to a user or a group a lookup should only fail if the given name is in both the negative cache for the users and the groups. Currently if the SID for a group called 'abc' should be looked up and the negative cache for the users contain an entry for 'abc' the request fails. --- src/responder/nss/nsssrv_cmd.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index bf578f3..c51ad13 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -4075,26 +4075,30 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx) } - /* verify this user has not yet been negatively cached, - * or has been permanently filtered */ + /* verify this name has not yet been negatively cached, as user + * and groupm, or has been permanently filtered */ ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dom, name); - /* if neg cached, return we didn't find it */ if (ret == EEXIST) { - DEBUG(SSSDBG_TRACE_FUNC, - "User [%s] does not exist in [%s]! (negative cache)\n", - name, dom->name); - /* if a multidomain search, try with next */ - if (cmdctx->check_next) { - dom = get_next_domain(dom, false); - continue; + ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout, + dom, name); + if (ret == EEXIST) { + /* if neg cached, return we didn't find it */ + DEBUG(SSSDBG_TRACE_FUNC, + "User [%s] does not exist in [%s]! (negative cache)\n", + name, dom->name); + /* if a multidomain search, try with next */ + if (cmdctx->check_next) { + dom = get_next_domain(dom, false); + continue; + } + /* There are no further domains or this was a + * fully-qualified user request. + */ + ret = ENOENT; + goto done; } - /* There are no further domains or this was a - * fully-qualified user request. - */ - ret = ENOENT; - goto done; } DEBUG(SSSDBG_TRACE_FUNC, "Requesting info for [%s@%s]\n", -- 1.8.3.1