On 11/11/2015 01:28 PM, Sumit Bose wrote:
On Wed, Nov 11, 2015 at 12:57:23PM +0100, Pavel Březina wrote:
> On 11/10/2015 10:48 AM, Sumit Bose wrote:
>> Hi,
>>
>> this patch is the equivalent of 374268c5eda35e8bbc2fef30752299199439cffe
>> "fix upn cache_req for sub-domain users" for lookups by certificates.
>>
>> bye,
>> Sumit
>>
>>
>> 0001-cache_req-check-all-domains-for-lookups-by-certifica.patch
>>
>>
>> From 78ac47bfdbb9c91dddefb4de06dcdf41e7035c6a Mon Sep 17 00:00:00 2001
>> From: Sumit Bose<sbose(a)redhat.com>
>> Date: Mon, 12 Oct 2015 13:00:28 +0200
>> Subject: [PATCH] cache_req: check all domains for lookups by certificate
>>
>> Like lookup by ID or by UPN the match for lookups by certificate can be
>> found in any domain and all sub-domains must be included in the search.
>> ---
>> src/responder/common/responder_cache_req.c | 7 ++++---
>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/src/responder/common/responder_cache_req.c
b/src/responder/common/responder_cache_req.c
>> index
fc63f84f1725b98398d383983c385c01508c73b6..a6fff2253c4057eb7239373be18ab15ba161b3dc 100644
>> --- a/src/responder/common/responder_cache_req.c
>> +++ b/src/responder/common/responder_cache_req.c
>> @@ -982,6 +982,7 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
>> * qualified names instead. */
>> while (state->domain != NULL && state->check_next
>> && state->domain->fqnames
>> + && state->input->type != CACHE_REQ_USER_BY_CERT
>> && !cache_req_input_is_upn(state->input)) {
>> state->domain = get_next_domain(state->domain, 0);
>> }
>> @@ -1010,9 +1011,9 @@ static errno_t cache_req_next_domain(struct tevent_req
*req)
>>
>> /* we will continue with the following domain the next time */
>> if (state->check_next) {
>> - if (cache_req_input_is_upn(state->input)) {
>> - state->domain = get_next_domain(state->domain,
>> - SSS_GND_DESCEND);
>> + if (cache_req_input_is_upn(state->input)
>> + || state->input->type != CACHE_REQ_USER_BY_CERT ) {
>> + state->domain = get_next_domain(state->domain,
SSS_GND_DESCEND);
>
> Shouldn't this say if state->input->type IS EQUAL TO cert?
of course you are right. Sorry for the copy-n-paste error. For my
testing (use_fully_qualified_names=True) the first hunk was sufficent.
New version attached.
bye,
Sumit
Ack.