[SSSD] [PATCHES] ldap_*_search_base doesn't fully limit the group / netgroup

Pavel Březina pbrezina at redhat.com
Wed Dec 14 14:34:24 UTC 2011


Dne 29.11.2011 14:40, Jan Zelený napsal(a):
>> https://fedorahosted.org/sssd/ticket/960
>
> patch #0001:
> Nack,
> first of all, I still don't like setting *_filter to NULL on the beginning of
> the helper function. In case the function fails, the content of this variable
> should not be tampered with.
>
> In your comment in the helper function, you assume that comma can be in the
> attribute name. I'm don't think this is allowed by RFC. Is there any other
> scenario this "if" is valid for? If not I suggest removing it entirely. If
> there is, please modify it to something like this:
>
> if (len_diff>= 2&&  dn[len_diff-1] == ','&&  dn[len_diff-2] == '\\')
>
>
> patch #0002:
> Nack,
> regarding our previous conversation in the original thread, I'm pretty sure,
> returning ret is better than returning EOK every time. Also I'm pretty sure
> that if you return other return code than EAGAIN, the tevent_req_error() will
> be called later.
>
>
> patch #0003:
> Ack,
> for any other who would like to review this patch, please note that the change
> only limits number of queries going to LDAP server. It will not eliminate all
> queries due to the filtering being done by an (|....) filter.
>
>
> Thanks
> Jan

New patches attached.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0001-Added-sss_ldap_dn_in_search_bases.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111214/c52ef3f2/attachment.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0002-Support-search-bases-in-RFC2307bis-enumeration.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111214/c52ef3f2/attachment-0001.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0003-Support-search-bases-in-netgroup-members-translation.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111214/c52ef3f2/attachment-0002.ksh>


More information about the sssd-devel mailing list