-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
These patches were tested on the local domain (by manually editing the sssd.ldb). I also ran them through valgrind.
Patch 0001: Add utility function sss_strnlen() This is useful for guaranteeing the size of an input buffer. I'm using this in the nss client portion of the netgroups support.
Patch 0002: Store entry_cache_timeout in sss_domain_info object This is useful so that the NSS responder can identify an domain's entry timeout for expiring the memory cache for a lookup such as with netgroups.
Patch 0003: Require explicit setting of callback context for check_cache Previously, it was implicitly using the nss_dom_ctx, but there are situations where we would want to send a different private context. Specifically, we need to be able to send a step_ctx for the netgroups support in patch 0010.
Patch 0004-0005: Sysdb interfaces for netgroups (and associated tests) These are identical to the last set I sent in the "Sysdb interface for netgroups" thread. I am retiring that thread to use this one for the review.
Patch 0006: Rename group.c and passwd.c for clarity Prefixing group.c and passwd.c with "nss_" similar to the way the PAM client sources are prefixed with "pam_". This patch isn't strictly necessary, but I wanted it to be more clear which files were associated with NSS vs. PAM vs. common in the sss_client directory. Patch 0007 will create nss_netgroup.c as well.
Patch 0007: Add support for netgroups to NSS sss_client There's one peculiarity about this patch that I have to note. I need to send back a true/false value to the setnetgrent call in order to properly report that there were no entries. This differs from the other set*ent functions because we are processing a specific requested entry rather than enumerating all entries. Without doing this, we actually return a netgroup containing no member triples, which is certainly not what the client app expects.
Patch 0008: Add negative cache features for netgroups This patch just updates the negative cache interface to allow including netgroups in the negative cache like other entries.
Patch 0009: Split out some helper functions for the NSS responder Create a new private header and make some functions available for other object files. The nsssrv_cmd.c file is getting far too large to be manageable. Patch 0010 will create a separate file (nsssrv_netgroup.c) to hold all of the netgroup-related code, but we need access to this set of functions in both places.
Patch 0010: Add netgroup support to the NSS responder This is the big one. It borrows a lot of its design from the recently rewritten enumeration code, but it has a few gotchas (notably that we need to maintain state between setnetgrent and getnetgrent calls to ensure that we are still answering requests for the same requested entry.
Remaining work on netgroups will be to add support for the LDAP backend to store the netgroups in the cache appropriately. In the future (https://fedorahosted.org/sssd/ticket/630) we will also add netgroups support to the proxy provider. This proxy support is not planned for 1.4.0.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/22/2010 07:28 PM, Stephen Gallagher wrote:
Patch 0006: Rename group.c and passwd.c for clarity Prefixing group.c and passwd.c with "nss_" similar to the way the PAM client sources are prefixed with "pam_". This patch isn't strictly necessary, but I wanted it to be more clear which files were associated with NSS vs. PAM vs. common in the sss_client directory. Patch 0007 will create nss_netgroup.c as well.
Forgot to update POTFILES.in with the new names.
Patch 0007: Add support for netgroups to NSS sss_client There's one peculiarity about this patch that I have to note. I need to send back a true/false value to the setnetgrent call in order to properly report that there were no entries. This differs from the other set*ent functions because we are processing a specific requested entry rather than enumerating all entries. Without doing this, we actually return a netgroup containing no member triples, which is certainly not what the client app expects.
Drop a #include on a header that isn't packaged (and should probably be removed in a separate patch). It caused builds from a tarball to fail.
Patch 0010: Add netgroup support to the NSS responder This is the big one. It borrows a lot of its design from the recently rewritten enumeration code, but it has a few gotchas (notably that we need to maintain state between setnetgrent and getnetgrent calls to ensure that we are still answering requests for the same requested entry.
Missed including nsssrv_private.h and nsssrv_netgroup.h from the dist_noinst_HEADERS in Makefile.am. Builds from a tarball were failing.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Thu, Sep 23, 2010 at 11:04:00AM -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/22/2010 07:28 PM, Stephen Gallagher wrote:
Patch 0006: Rename group.c and passwd.c for clarity Prefixing group.c and passwd.c with "nss_" similar to the way the PAM client sources are prefixed with "pam_". This patch isn't strictly necessary, but I wanted it to be more clear which files were associated with NSS vs. PAM vs. common in the sss_client directory. Patch 0007 will create nss_netgroup.c as well.
Forgot to update POTFILES.in with the new names.
Patch 0007: Add support for netgroups to NSS sss_client There's one peculiarity about this patch that I have to note. I need to send back a true/false value to the setnetgrent call in order to properly report that there were no entries. This differs from the other set*ent functions because we are processing a specific requested entry rather than enumerating all entries. Without doing this, we actually return a netgroup containing no member triples, which is certainly not what the client app expects.
Drop a #include on a header that isn't packaged (and should probably be removed in a separate patch). It caused builds from a tarball to fail.
Patch 0010: Add netgroup support to the NSS responder This is the big one. It borrows a lot of its design from the recently rewritten enumeration code, but it has a few gotchas (notably that we need to maintain state between setnetgrent and getnetgrent calls to ensure that we are still answering requests for the same requested entry.
Missed including nsssrv_private.h and nsssrv_netgroup.h from the dist_noinst_HEADERS in Makefile.am. Builds from a tarball were failing.
ACK
I found two issues which are fixed by patches in "[PATCHES] Netgroup support for LDAP provider".
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkybbGAACgkQeiVVYja6o6NK8gCfcPg2YSio/kVHv5otv44SoiQa CsgAn38LKEywSlBFC06uiR71RwJrhs2p =ZJha -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/05/2010 10:29 AM, Sumit Bose wrote:
On Thu, Sep 23, 2010 at 11:04:00AM -0400, Stephen Gallagher wrote: On 09/22/2010 07:28 PM, Stephen Gallagher wrote:
Patch 0006: Rename group.c and passwd.c for clarity Prefixing group.c and passwd.c with "nss_" similar to the way the PAM client sources are prefixed with "pam_". This patch isn't strictly necessary, but I wanted it to be more clear which files were associated with NSS vs. PAM vs. common in the sss_client directory. Patch 0007 will create nss_netgroup.c as well.
Forgot to update POTFILES.in with the new names.
Patch 0007: Add support for netgroups to NSS sss_client There's one peculiarity about this patch that I have to note. I need to send back a true/false value to the setnetgrent call in order to properly report that there were no entries. This differs from the other set*ent functions because we are processing a specific requested entry rather than enumerating all entries. Without doing this, we actually return a netgroup containing no member triples, which is certainly not what the client app expects.
Drop a #include on a header that isn't packaged (and should probably be removed in a separate patch). It caused builds from a tarball to fail.
Patch 0010: Add netgroup support to the NSS responder This is the big one. It borrows a lot of its design from the recently rewritten enumeration code, but it has a few gotchas (notably that we need to maintain state between setnetgrent and getnetgrent calls to ensure that we are still answering requests for the same requested entry.
Missed including nsssrv_private.h and nsssrv_netgroup.h from the dist_noinst_HEADERS in Makefile.am. Builds from a tarball were failing.
ACK
I found two issues which are fixed by patches in "[PATCHES] Netgroup support for LDAP provider".
bye, Sumit
Pushed to master.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
sssd-devel@lists.fedorahosted.org