[SSSD] [PATCHES] ldap_*_search_base doesn't fully limit the group / netgroup
Jan Zelený
jzeleny at redhat.com
Tue Nov 29 13:40:10 UTC 2011
> https://fedorahosted.org/sssd/ticket/960
patch #0001:
Nack,
first of all, I still don't like setting *_filter to NULL on the beginning of
the helper function. In case the function fails, the content of this variable
should not be tampered with.
In your comment in the helper function, you assume that comma can be in the
attribute name. I'm don't think this is allowed by RFC. Is there any other
scenario this "if" is valid for? If not I suggest removing it entirely. If
there is, please modify it to something like this:
if (len_diff >= 2 && dn[len_diff-1] == ',' && dn[len_diff-2] == '\\')
patch #0002:
Nack,
regarding our previous conversation in the original thread, I'm pretty sure,
returning ret is better than returning EOK every time. Also I'm pretty sure
that if you return other return code than EAGAIN, the tevent_req_error() will
be called later.
patch #0003:
Ack,
for any other who would like to review this patch, please note that the change
only limits number of queries going to LDAP server. It will not eliminate all
queries due to the filtering being done by an (|....) filter.
Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111129/0f6b01a1/attachment.sig>
More information about the sssd-devel
mailing list