[SSSD] [PATCHES][PRELIMINARY] Support the 'services' NSS map in SSSD
Simo Sorce
simo at redhat.com
Sun Jan 22 07:20:17 UTC 2012
On Sat, 2012-01-21 at 16:54 -0500, Stephen Gallagher wrote:
> These patches add support for getservbyname() and getservbyport() to
> the NSS responder. They do not yet support enumeration of services
> through setservent(), getservent() and endservent(). These patches also
> include a reference implementation using the proxy ID provider (which I
> used to test and validate the functionality).
>
> Work still to come: enumeration support and LDAP provider
> implementation.
>
> Patch 0001: Make the sized_string structure available elsewhere in the
> source.
ACK.
> Patch 0002: Add support for strtouint16 (needed for managing the port
> number)
ACK;
> Patch 0003: Make add_string() and add_ulong() available to all sysdb
> files.
ACK
> Patch 0004: Add routines to save, delete and modify service entries in
> the sysdb. (Also includes some very rudimentary unit tests)
Nitpick of partial review:
do not use proto?sanitized_proto:"*"
instead assign sanitized_proto and use that always
if (proto) {
[...]
} else {
sanitized_proto = "*";
}
> Patch 0005: Add LDB indexes for the port and protocol arguments, since
> we'll be searching on them.
TBR
> Patch 0006: Add support to the NSS sss_client to look up getservbyname()
> and getservbyport().
TBR
> Patch 0007: Add support for services in dp requests
ACK
> Patch 0008: Add routines to the negative cache to handle services
ACK
> Patch 0009: The big one. This patch adds a new feature to the NSS
> responder to handle looking up services by name and by port (optionally
> filtering by protocol).
TBR when fully awake :)
> Important note: I did not use the existing check_cache() functionality
> here. I changed the cache check and lookup logic to match that which was
> proposed in https://fedorahosted.org/sssd/ticket/1126 (to deal with
> multiple domains more efficiently). I would like this very carefully
> reviewed (by two engineers) because I think our long-term plan is going
> to be to migrate the existing NSS responders over to this style.
>
> /* Provider Lookup Logic:
> * Iterate through the available caches. If the cached entry is
> * present and not expired, return it immediately(*). If it is
> * present and expired, add it to a list of domains eligible to
> * be checked. If it is in the negative cache, skip over it and
> * do not add it to the eligible domain list.
> *
> * Once we have searched all of the caches, if the entry has not
> * been determined to be available, search all domains in order
> * to see if any of them contain the requested entry.
> *
> * (*) Optionally perform a midpoint cache refresh if appropriate.
> */
>
> See the functions getserv_send() and lookup_service_*() for more
> details.
>
>
> Patch 0010: This is the reference implementation I used for testing
> purposes. I tested against proxy_lib_name = files (and changed the
> 'services' line in my /etc/nsswitch.conf to contain only 'sss')
TBR
Nice work so far.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list