[SSSD] [PATCH] Reactivate old fd handling conditionally

Sumit Bose sbose at redhat.com
Thu Feb 4 19:13:15 UTC 2010


On Thu, Feb 04, 2010 at 09:02:51AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 02/04/2010 08:15 AM, Sumit Bose wrote:
> > Hi,
> > 
> > this path reintroduces the old way of handling the file description of a
> > LDAP connection if the connection callback is not available.
> > 
> > Using the old way we cannot handle LDAP referrals and I think we should
> > generate a DEBUG message if ldap_referrals is set to 'true' and add a
> > hint to the man page. Do you agree?  I didn't put these changes in the
> > patch to make the review easier because if can be compared line by line
> > with commit 7c8f422495347e6ff829246ebf5d7faad9f6d160 'Use ldap
> > connection callbacks to get file descriptors'.
> > 
> > bye,
> > Sumit
> > 
> 
> The patch looks fine. I'd like to see the man page specify that
> ldap_referrals do not work for openldap libraries older than 2.4.12.
> 
> The debug message should reflect the same.
> 
> Please resubmit with these two changes.
> 
> 

man page change and debug message are in the second patch.

bye,
Sumit

> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAktq04sACgkQeiVVYja6o6OOuwCdGDpYQNYgRCrKlD8fq6WPFiGi
> FEYAn1HWCbdPyiWJ+6Dm6qGbWBvZa5Gf
> =f6sA
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From e162de2fbf6e03bc5426537b46692db38315f5dd Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 4 Feb 2010 11:53:36 +0100
Subject: [PATCH 1/2] Reactivate old fd handling conditionally

Older versions of openLDAP do not provide a connection callback. This
patch adds a configure check to see if the callback is available and
activates the old way of handling the file description of the LDAP
connection. This also means that it is not possible to follow referrals.
---
 server/external/ldap.m4                       |    4 ++
 server/providers/ldap/sdap.h                  |    4 ++
 server/providers/ldap/sdap_async.c            |   44 +++++++++++++++++++++++++
 server/providers/ldap/sdap_async_connection.c |   25 +++++++++++++-
 server/providers/ldap/sdap_async_private.h    |    6 +++
 5 files changed, 82 insertions(+), 1 deletions(-)

diff --git a/server/external/ldap.m4 b/server/external/ldap.m4
index a17ed7e..ee425d8 100644
--- a/server/external/ldap.m4
+++ b/server/external/ldap.m4
@@ -44,6 +44,10 @@ SAVE_LIBS=$LIBS
 CFLAGS="$CFLAGS $OPENLDAP_CFLAGS"
 LIBS="$LIBS $OPENLDAP_LIBS"
 AC_CHECK_FUNCS([ldap_control_create])
+AC_CHECK_MEMBERS([struct ldap_conncb.lc_arg],
+                 [AC_DEFINE([HAVE_LDAP_CONNCB], [1],
+                     [Define if LDAP connection callbacks are available])],
+                 [], [[#include <ldap.h>]])
 CFLAGS=$SAVE_CFLAGS
 LIBS=$SAVE_LIBS
 
diff --git a/server/providers/ldap/sdap.h b/server/providers/ldap/sdap.h
index f32ce05..16dbb78 100644
--- a/server/providers/ldap/sdap.h
+++ b/server/providers/ldap/sdap.h
@@ -71,7 +71,11 @@ struct sdap_handle {
     LDAP *ldap;
     bool connected;
 
+#ifdef HAVE_LDAP_CONNCB
     struct ldap_conncb *conncb;
+#else
+    struct tevent_fd *fde;
+#endif
 
     struct sdap_op *ops;
 };
diff --git a/server/providers/ldap/sdap_async.c b/server/providers/ldap/sdap_async.c
index fd8c11e..88f1c4b 100644
--- a/server/providers/ldap/sdap_async.c
+++ b/server/providers/ldap/sdap_async.c
@@ -97,8 +97,12 @@ static void sdap_handle_release(struct sdap_handle *sh)
     if (sh->connected) {
         struct sdap_op *op;
 
+#ifdef HAVE_LDAP_CONNCB
         /* remove all related fd events from the event loop */
         talloc_zfree(sh->conncb->lc_arg);
+#else
+        talloc_zfree(sh->fde);
+#endif
 
         while (sh->ops) {
             op = sh->ops;
@@ -111,7 +115,9 @@ static void sdap_handle_release(struct sdap_handle *sh)
         if (sh->ldap) {
             ldap_unbind_ext(sh->ldap, NULL, NULL);
         }
+#ifdef HAVE_LDAP_CONNCB
         talloc_zfree(sh->conncb);
+#endif
         sh->connected = false;
         sh->ldap = NULL;
         sh->ops = NULL;
@@ -330,6 +336,7 @@ static void sdap_process_next_reply(struct tevent_context *ev,
     op->callback(op, op->list, EOK, op->data);
 }
 
+#ifdef HAVE_LDAP_CONNCB
 int sdap_ldap_connect_callback_add(LDAP *ld, Sockbuf *sb, LDAPURLDesc *srv,
                            struct sockaddr *addr, struct ldap_conncb *ctx)
 {
@@ -404,6 +411,43 @@ void sdap_ldap_connect_callback_del(LDAP *ld, Sockbuf *sb,
     return;
 }
 
+#else
+
+static int get_fd_from_ldap(LDAP *ldap, int *fd)
+{
+    int ret;
+
+    ret = ldap_get_option(ldap, LDAP_OPT_DESC, fd);
+    if (ret != LDAP_OPT_SUCCESS) {
+        DEBUG(1, ("Failed to get fd from ldap!!\n"));
+        *fd = -1;
+        return EIO;
+    }
+
+    return EOK;
+}
+
+int sdap_install_ldap_callbacks(struct sdap_handle *sh,
+                                struct tevent_context *ev)
+{
+    int fd;
+    int ret;
+
+    ret = get_fd_from_ldap(sh->ldap, &fd);
+    if (ret) return ret;
+
+    sh->fde = tevent_add_fd(ev, sh, fd, TEVENT_FD_READ, sdap_ldap_result, sh);
+    if (!sh->fde) return ENOMEM;
+
+    DEBUG(8, ("Trace: sh[%p], connected[%d], ops[%p], fde[%p], ldap[%p]\n",
+              sh, (int)sh->connected, sh->ops, sh->fde, sh->ldap));
+
+    return EOK;
+}
+
+#endif
+
+
 /* ==LDAP-Operations-Helpers============================================== */
 
 static int sdap_op_destructor(void *mem)
diff --git a/server/providers/ldap/sdap_async_connection.c b/server/providers/ldap/sdap_async_connection.c
index 1ed6b3f..18e47d3 100644
--- a/server/providers/ldap/sdap_async_connection.c
+++ b/server/providers/ldap/sdap_async_connection.c
@@ -56,7 +56,6 @@ struct tevent_req *sdap_connect_send(TALLOC_CTX *memctx,
     int lret;
     int ret = EOK;
     int msgid;
-    struct ldap_cb_data *cb_data;
     bool ldap_referrals;
 
     req = tevent_req_create(memctx, &state, struct sdap_connect_state);
@@ -120,6 +119,9 @@ struct tevent_req *sdap_connect_send(TALLOC_CTX *memctx,
         goto fail;
     }
 
+#ifdef HAVE_LDAP_CONNCB
+    struct ldap_cb_data *cb_data;
+
     /* add connection callback */
     state->sh->conncb = talloc_zero(state->sh, struct ldap_conncb);
     if (state->sh->conncb == NULL) {
@@ -147,6 +149,7 @@ struct tevent_req *sdap_connect_send(TALLOC_CTX *memctx,
         DEBUG(1, ("Failed to set connection callback\n"));
         goto fail;
     }
+#endif
 
     /* if we do not use start_tls the connection is not really connected yet
      * just fake an async procedure and leave connection to the bind call */
@@ -164,6 +167,10 @@ struct tevent_req *sdap_connect_send(TALLOC_CTX *memctx,
     }
 
     state->sh->connected = true;
+#ifndef HAVE_LDAP_CONNCB
+    ret = sdap_install_ldap_callbacks(state->sh, state->ev);
+    if (ret) goto fail;
+#endif
 
     /* FIXME: get timeouts from configuration, for now 5 secs. */
     ret = sdap_op_add(state, ev, state->sh, msgid,
@@ -335,6 +342,10 @@ static struct tevent_req *simple_bind_send(TALLOC_CTX *memctx,
 
     if (!sh->connected) {
         sh->connected = true;
+#ifndef HAVE_LDAP_CONNCB
+        ret = sdap_install_ldap_callbacks(sh, ev);
+        if (ret) goto fail;
+#endif
     }
 
     /* FIXME: get timeouts from configuration, for now 5 secs. */
@@ -500,6 +511,10 @@ static struct tevent_req *sasl_bind_send(TALLOC_CTX *memctx,
 
     if (!sh->connected) {
         sh->connected = true;
+#ifndef HAVE_LDAP_CONNCB
+        ret = sdap_install_ldap_callbacks(sh, ev);
+        if (ret) goto fail;
+#endif
     }
 
     tevent_req_post(req, ev);
@@ -936,6 +951,14 @@ static void sdap_cli_rootdse_step(struct tevent_req *req)
      * so we need to set up the callbacks or we will never get notified
      * of a reply */
         state->sh->connected = true;
+#ifndef HAVE_LDAP_CONNCB
+        int ret;
+
+        ret = sdap_install_ldap_callbacks(state->sh, state->ev);
+        if (ret) {
+            tevent_req_error(req, ret);
+        }
+#endif
     }
 }
 
diff --git a/server/providers/ldap/sdap_async_private.h b/server/providers/ldap/sdap_async_private.h
index 5549626..55f76ed 100644
--- a/server/providers/ldap/sdap_async_private.h
+++ b/server/providers/ldap/sdap_async_private.h
@@ -22,15 +22,21 @@
 #ifndef _SDAP_ASYNC_PRIVATE_H_
 #define _SDAP_ASYNC_PRIVATE_H_
 
+#include "config.h"
 #include "providers/ldap/sdap_async.h"
 
 void make_realm_upper_case(const char *upn);
 struct sdap_handle *sdap_handle_create(TALLOC_CTX *memctx);
 
+#ifdef HAVE_LDAP_CONNCB
 int sdap_ldap_connect_callback_add(LDAP *ld, Sockbuf *sb, LDAPURLDesc *srv,
                            struct sockaddr *addr, struct ldap_conncb *ctx);
 void sdap_ldap_connect_callback_del(LDAP *ld, Sockbuf *sb,
                                     struct ldap_conncb *ctx);
+#else
+int sdap_install_ldap_callbacks(struct sdap_handle *sh,
+                                struct tevent_context *ev);
+#endif
 
 int sdap_op_add(TALLOC_CTX *memctx, struct tevent_context *ev,
                 struct sdap_handle *sh, int msgid,
-- 
1.6.6

-------------- next part --------------
From 893375f01381b1cd00cd8550291b8ed6b2a8edb9 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 4 Feb 2010 20:07:09 +0100
Subject: [PATCH 2/2] Document when LDAP referral chasing is available

---
 server/man/sssd-ldap.5.xml          |    5 +++++
 server/providers/ldap/ldap_common.c |   11 +++++++++++
 2 files changed, 16 insertions(+), 0 deletions(-)

diff --git a/server/man/sssd-ldap.5.xml b/server/man/sssd-ldap.5.xml
index 2737c24..18af37b 100644
--- a/server/man/sssd-ldap.5.xml
+++ b/server/man/sssd-ldap.5.xml
@@ -622,6 +622,11 @@
                             be enabled.
                         </para>
                         <para>
+                            Please note that sssd only supports referral chasing
+                            when it is compiled with OpenLDAP version 2.4.12 or
+                            higher.
+                        </para>
+                        <para>
                             Default: true
                         </para>
                     </listitem>
diff --git a/server/providers/ldap/ldap_common.c b/server/providers/ldap/ldap_common.c
index 15d44dc..a0cb223 100644
--- a/server/providers/ldap/ldap_common.c
+++ b/server/providers/ldap/ldap_common.c
@@ -165,6 +165,7 @@ int ldap_get_options(TALLOC_CTX *memctx,
     struct sdap_options *opts;
     char *schema;
     const char *pwd_policy;
+    bool ldap_referrals;
     int ret;
 
     opts = talloc_zero(memctx, struct sdap_options);
@@ -217,6 +218,16 @@ int ldap_get_options(TALLOC_CTX *memctx,
         goto done;
     }
 
+
+#ifndef HAVE_LDAP_CONNCB
+    ldap_referrals = dp_opt_get_bool(opts->basic, SDAP_REFERRALS);
+    if (ldap_referrals) {
+        DEBUG(1, ("LDAP referrals are not supported, because the LDAP library "
+                  "is too old, see sssd-ldap(5) for details.\n"));
+        ret = dp_opt_set_bool(opts->basic, SDAP_REFERRALS, false);
+    }
+#endif
+
     /* schema type */
     schema = dp_opt_get_string(opts->basic, SDAP_SCHEMA);
     if (strcasecmp(schema, "rfc2307") == 0) {
-- 
1.6.6



More information about the sssd-devel mailing list