From 9624ecdcae0451a910428f04e64a366e6746f9a0 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Wed, 29 Apr 2015 15:21:17 +0200 Subject: [PATCH 1/2] NSS: check for overrides before calling backend Currently the flag that the input data in a user or group lookup request might be an override value is only set if no cached entry was found. If the cached entry of an object with overrides is expired and a request with the override value as input is processed the flag is not set and the backend might not be able to find the right entry on the server. Typically this should not happen because of mid-point refreshes. To reproduce this create a FreeIPA user and override the login name for a specific view. On a client which has this view applied call getent passwd overridename sss_cache -E getent passwd overridename The second getent command will still show the right output but in the logs a [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 0 error message: Account info lookup failed message can be found for the second request. Related to https://fedorahosted.org/sssd/ticket/2642 --- src/responder/nss/nsssrv_cmd.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index 45d65717312f90cadb88f3a7334aca0629e33d58..41586e9fc0fd05b4a485f6c7541f0fef6bfc2d50 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -960,7 +960,10 @@ static int nss_cmd_getpwnam_search(struct nss_dom_ctx *dctx) if (cmdctx->name_is_upn) { extra_flag = EXTRA_NAME_IS_UPN; - } else if (DOM_HAS_VIEWS(dom) && dctx->res->count == 0) { + } else if (DOM_HAS_VIEWS(dom) && (dctx->res->count == 0 + || ldb_msg_find_attr_as_string(dctx->res->msgs[0], + OVERRIDE_PREFIX SYSDB_NAME, + NULL) != NULL)) { extra_flag = EXTRA_INPUT_MAYBE_WITH_VIEW; } else { extra_flag = NULL; @@ -1626,7 +1629,10 @@ static int nss_cmd_getpwuid_search(struct nss_dom_ctx *dctx) * yet) then verify that the cache is uptodate */ if (dctx->check_provider) { - if (DOM_HAS_VIEWS(dom) && dctx->res->count == 0) { + if (DOM_HAS_VIEWS(dom) && (dctx->res->count == 0 + || ldb_msg_find_attr_as_uint64(dctx->res->msgs[0], + OVERRIDE_PREFIX SYSDB_UIDNUM, + 0) != 0)) { extra_flag = EXTRA_INPUT_MAYBE_WITH_VIEW; } else { extra_flag = NULL; @@ -3073,7 +3079,10 @@ static int nss_cmd_getgrnam_search(struct nss_dom_ctx *dctx) * yet) then verify that the cache is uptodate */ if (dctx->check_provider) { - if (DOM_HAS_VIEWS(dom) && dctx->res->count == 0) { + if (DOM_HAS_VIEWS(dom) && (dctx->res->count == 0 + || ldb_msg_find_attr_as_string(dctx->res->msgs[0], + OVERRIDE_PREFIX SYSDB_NAME, + NULL) != NULL)) { extra_flag = EXTRA_INPUT_MAYBE_WITH_VIEW; } else { extra_flag = NULL; @@ -3197,7 +3206,10 @@ static int nss_cmd_getgrgid_search(struct nss_dom_ctx *dctx) * yet) then verify that the cache is uptodate */ if (dctx->check_provider) { - if (DOM_HAS_VIEWS(dom) && dctx->res->count == 0) { + if (DOM_HAS_VIEWS(dom) && (dctx->res->count == 0 + || ldb_msg_find_attr_as_uint64(dctx->res->msgs[0], + OVERRIDE_PREFIX SYSDB_GIDNUM, + 0) != 0)) { extra_flag = EXTRA_INPUT_MAYBE_WITH_VIEW; } else { extra_flag = NULL; @@ -4155,7 +4167,10 @@ static int nss_cmd_initgroups_search(struct nss_dom_ctx *dctx) if (cmdctx->name_is_upn) { extra_flag = EXTRA_NAME_IS_UPN; - } else if (DOM_HAS_VIEWS(dom) && dctx->res->count == 0) { + } else if (DOM_HAS_VIEWS(dom) && (dctx->res->count == 0 + || ldb_msg_find_attr_as_string(dctx->res->msgs[0], + OVERRIDE_PREFIX SYSDB_NAME, + NULL) != NULL)) { extra_flag = EXTRA_INPUT_MAYBE_WITH_VIEW; } else { extra_flag = NULL; -- 2.1.0