[SSSD] [PATCHES][PRELIMINARY] Support the 'services' NSS map in SSSD

Simo Sorce simo at redhat.com
Sun Jan 22 07:20:17 UTC 2012


On Sat, 2012-01-21 at 16:54 -0500, Stephen Gallagher wrote:
> These patches add support for getservbyname() and getservbyport() to
> the NSS responder. They do not yet support enumeration of services 
> through setservent(), getservent() and endservent(). These patches also
> include a reference implementation using the proxy ID provider (which I
> used to test and validate the functionality).
> 
> Work still to come: enumeration support and LDAP provider
> implementation.
> 
> Patch 0001: Make the sized_string structure available elsewhere in the
> source.

ACK.

> Patch 0002: Add support for strtouint16 (needed for managing the port
> number)

ACK;

> Patch 0003: Make add_string() and add_ulong() available to all sysdb
> files.

ACK

> Patch 0004: Add routines to save, delete and modify service entries in
> the sysdb. (Also includes some very rudimentary unit tests)

Nitpick of partial review:

do not use proto?sanitized_proto:"*"
instead assign sanitized_proto and use that always

if (proto) {
   [...]
} else {
   sanitized_proto = "*";
}


> Patch 0005: Add LDB indexes for the port and protocol arguments, since
> we'll be searching on them.

TBR

> Patch 0006: Add support to the NSS sss_client to look up getservbyname()
> and getservbyport().

TBR

> Patch 0007: Add support for services in dp requests

ACK

> Patch 0008: Add routines to the negative cache to handle services

ACK

> Patch 0009: The big one. This patch adds a new feature to the NSS
> responder to handle looking up services by name and by port (optionally
> filtering by protocol).

TBR when fully awake :)

> Important note: I did not use the existing check_cache() functionality
> here. I changed the cache check and lookup logic to match that which was
> proposed in https://fedorahosted.org/sssd/ticket/1126 (to deal with
> multiple domains more efficiently). I would like this very carefully
> reviewed (by two engineers) because I think our long-term plan is going
> to be to migrate the existing NSS responders over to this style.
> 
> /* Provider Lookup Logic:
>  * Iterate through the available caches. If the cached entry is
>  * present and not expired, return it immediately(*). If it is
>  * present and expired, add it to a list of domains eligible to
>  * be checked. If it is in the negative cache, skip over it and
>  * do not add it to the eligible domain list.
>  *
>  * Once we have searched all of the caches, if the entry has not
>  * been determined to be available, search all domains in order
>  * to see if any of them contain the requested entry.
>  *
>  * (*) Optionally perform a midpoint cache refresh if appropriate.
>  */
> 
> See the functions getserv_send() and lookup_service_*() for more
> details.
> 
> 
> Patch 0010: This is the reference implementation I used for testing
> purposes. I tested against proxy_lib_name = files (and changed the
> 'services' line in my /etc/nsswitch.conf to contain only 'sss')

TBR


Nice work so far.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list