To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
On Fri, May 06, 2016 at 03:04:42PM +0200, Jakub Hrozek wrote:
To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
From 18cbf559addfeb77ad83b81e23431295a3e5c6ae Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Fri, 6 May 2016 15:02:19 +0200 Subject: [PATCH] IPA: Handle requests for netgroups from trusted domains gracefully
In ipa_account_info_handler we first check if the request is for a user from a trusted domain and go that way for all request types. In contrast, in the ipa_account_info_done we first check if the requested object is a netgroup. If both are true, we first start a subdomain lookup send but then call netgroup lookup recv, which results in talloc type mismatch and crashes sssd_be.
FWIW, the reporter also confirmed this patch works for them.
On 05/06/2016 03:04 PM, Jakub Hrozek wrote:
To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
Ack for non-master branches. But could you please rebase the patch atop my backend branch and push it to master together later please?
On Wed, May 11, 2016 at 01:57:53PM +0200, Pavel Březina wrote:
On 05/06/2016 03:04 PM, Jakub Hrozek wrote:
To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
Ack for non-master branches. But could you please rebase the patch atop my backend branch and push it to master together later please?
Then I would prefer to wait and use your ack to deliver the patch to downstream only in the meantime. Upstream patches must be pushed to master first.
On Wed, May 11, 2016 at 01:59:42PM +0200, Jakub Hrozek wrote:
On Wed, May 11, 2016 at 01:57:53PM +0200, Pavel Březina wrote:
On 05/06/2016 03:04 PM, Jakub Hrozek wrote:
To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
Ack for non-master branches. But could you please rebase the patch atop my backend branch and push it to master together later please?
Then I would prefer to wait and use your ack to deliver the patch to downstream only in the meantime. Upstream patches must be pushed to master first.
Bump, the bug is no longer present in master after the DP refactoring, but I would still like to push this patch to sssd-1-13.
On 06/28/2016 06:41 PM, Jakub Hrozek wrote:
On Wed, May 11, 2016 at 01:59:42PM +0200, Jakub Hrozek wrote:
On Wed, May 11, 2016 at 01:57:53PM +0200, Pavel Březina wrote:
On 05/06/2016 03:04 PM, Jakub Hrozek wrote:
To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
Ack for non-master branches. But could you please rebase the patch atop my backend branch and push it to master together later please?
Then I would prefer to wait and use your ack to deliver the patch to downstream only in the meantime. Upstream patches must be pushed to master first.
Bump, the bug is no longer present in master after the DP refactoring, but I would still like to push this patch to sssd-1-13.
Ack for 1.13.
On (29/06/16 14:13), Pavel Březina wrote:
On 06/28/2016 06:41 PM, Jakub Hrozek wrote:
On Wed, May 11, 2016 at 01:59:42PM +0200, Jakub Hrozek wrote:
On Wed, May 11, 2016 at 01:57:53PM +0200, Pavel Březina wrote:
On 05/06/2016 03:04 PM, Jakub Hrozek wrote:
To reproduce, just run: getent netgroup some_name@trusted.domain
Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.
Ack for non-master branches. But could you please rebase the patch atop my backend branch and push it to master together later please?
Then I would prefer to wait and use your ack to deliver the patch to downstream only in the meantime. Upstream patches must be pushed to master first.
Bump, the bug is no longer present in master after the DP refactoring, but I would still like to push this patch to sssd-1-13.
Ack for 1.13.
sssd-1-13: * d68d2b8ca6ded8662408817dffc3aa2a58dd844c
LS
sssd-devel@lists.fedorahosted.org
-
Jakub Hrozek -
Lukas Slebodnik -
Pavel Březina