[SSSD] [PATCH] Fix pam responder handling of coalesced requests

Simo Sorce simo at redhat.com
Fri Dec 14 13:44:32 UTC 2012


On Fri, 2012-12-14 at 10:43 +0100, Jakub Hrozek wrote:
> On Thu, Dec 13, 2012 at 11:25:25PM -0500, Simo Sorce wrote:
> > In our responders we have a feature that allows to avoid dispatching
> > multiple identical requests at the same time.
> > This is done by queing additional identical requests in a special hash
> > table and then replying to all clients at the same time when a response
> > is received.
> > 
> > When the connection to a provider breaks all these waiting requests need
> > to be cleaned out and the has table emptied.
> > 
> > This was not happening in sssd_pam, so if a connection to the provider
> > was lost client request would pile up and never be replied again.
> > 
> > The attached patch fixes this issue. Tested using kill -STOP of the
> > sssd_be process and trying to authenticate via the gnome screensaver.
> > 
> > Fixes: https://fedorahosted.org/sssd/ticket/1655
> > 
> > -- 
> > Simo Sorce * Red Hat, Inc * New York
> 
> Ack. Nice catch, thank you. The other *_dp_reconnect_init functions are
> fine.

Yes, I checked, but this is the third time we regress wrt this
functionality, I am thinking I may add a new patch that marks requests
with a timestamp and automatically expire those older than X.

It doesn't make sense to pile requests when they are very far one from
the other, there is clearly an error if sssd_be hasn't answered in say 5
minutes, and it is better to cancel the old one at that point and
repeat.

Do you agree ?

Stephen you coded this feature originally IIRC, any objection ?

Anyway this would be a new ticket, I think we need to push this patch as
is w/o waiting as it is a very bad bug.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list