On Fri, Sep 05, 2014 at 05:54:59PM +0200, Sumit Bose wrote:
Hi,
I found this while testing other stuff.
bye,
Sumit
The patch works as expected, so ACK. I will just fix one DEBUG message
before pushing if you don't mind, see inline.
Also, while testing I realized that when looking up entries with the
extop, even nonexistant entry turns up as a DP lookup error, so the
negcache is not set..is that expected/known?
From d2fbe17663f7cfc79e11e2fec7371f102bbe9aed Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Thu, 4 Sep 2014 15:42:26 +0200
Subject: [PATCH] name2sid: Check negative cache for users and groups
Since we cannot know if a SID belongs to a user or a group a lookup
should only fail if the given name is in both the negative cache for the
users and the groups.
Currently if the SID for a group called 'abc' should be looked up and
the negative cache for the users contain an entry for 'abc' the request
fails.
---
src/responder/nss/nsssrv_cmd.c | 34 +++++++++++++++++++---------------
1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index bf578f3..c51ad13 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -4075,26 +4075,30 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
}
- /* verify this user has not yet been negatively cached,
- * or has been permanently filtered */
+ /* verify this name has not yet been negatively cached, as user
+ * and groupm, or has been permanently filtered */
ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout,
dom, name);
- /* if neg cached, return we didn't find it */
if (ret == EEXIST) {
- DEBUG(SSSDBG_TRACE_FUNC,
- "User [%s] does not exist in [%s]! (negative cache)\n",
- name, dom->name);
- /* if a multidomain search, try with next */
- if (cmdctx->check_next) {
- dom = get_next_domain(dom, false);
- continue;
+ ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout,
+ dom, name);
+ if (ret == EEXIST) {
+ /* if neg cached, return we didn't find it */
+ DEBUG(SSSDBG_TRACE_FUNC,
+ "User [%s] does not exist in [%s]! (negative
cache)\n",
I'll change "User [%s]" into "SID [%s]" here.
+ name, dom->name);
+ /* if a multidomain search, try with next */
+ if (cmdctx->check_next) {
+ dom = get_next_domain(dom, false);
+ continue;
+ }
+ /* There are no further domains or this was a
+ * fully-qualified user request.
+ */
+ ret = ENOENT;
+ goto done;
}
- /* There are no further domains or this was a
- * fully-qualified user request.
- */
- ret = ENOENT;
- goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Requesting info for [%s@%s]\n",
--
1.8.3.1