[SSSD] [PATCHES][PRELIMINARY] Support the 'services' NSS map in SSSD

Stephen Gallagher sgallagh at redhat.com
Tue Jan 24 03:12:15 UTC 2012


On Sat, 2012-01-21 at 16:54 -0500, Stephen Gallagher wrote:
> These patches add support for getservbyname() and getservbyport() to
> the NSS responder. They do not yet support enumeration of services 
> through setservent(), getservent() and endservent(). These patches also
> include a reference implementation using the proxy ID provider (which I
> used to test and validate the functionality).
> 
> Work still to come: enumeration support and LDAP provider
> implementation.
> 
> Patch 0001: Make the sized_string structure available elsewhere in the
> source.
> 
> Patch 0002: Add support for strtouint16 (needed for managing the port
> number)
> 
> Patch 0003: Make add_string() and add_ulong() available to all sysdb
> files.
> 
> Patch 0004: Add routines to save, delete and modify service entries in
> the sysdb. (Also includes some very rudimentary unit tests)
> 
> Patch 0005: Add LDB indexes for the port and protocol arguments, since
> we'll be searching on them.
> 
> Patch 0006: Add support to the NSS sss_client to look up getservbyname()
> and getservbyport().
> 
> Patch 0007: Add support for services in dp requests
> 
> Patch 0008: Add routines to the negative cache to handle services
> 
> Patch 0009: The big one. This patch adds a new feature to the NSS
> responder to handle looking up services by name and by port (optionally
> filtering by protocol).
> 
> Important note: I did not use the existing check_cache() functionality
> here. I changed the cache check and lookup logic to match that which was
> proposed in https://fedorahosted.org/sssd/ticket/1126 (to deal with
> multiple domains more efficiently). I would like this very carefully
> reviewed (by two engineers) because I think our long-term plan is going
> to be to migrate the existing NSS responders over to this style.
> 
> /* Provider Lookup Logic:
>  * Iterate through the available caches. If the cached entry is
>  * present and not expired, return it immediately(*). If it is
>  * present and expired, add it to a list of domains eligible to
>  * be checked. If it is in the negative cache, skip over it and
>  * do not add it to the eligible domain list.
>  *
>  * Once we have searched all of the caches, if the entry has not
>  * been determined to be available, search all domains in order
>  * to see if any of them contain the requested entry.
>  *
>  * (*) Optionally perform a midpoint cache refresh if appropriate.
>  */
> 
> See the functions getserv_send() and lookup_service_*() for more
> details.
> 
> 
> Patch 0010: This is the reference implementation I used for testing
> purposes. I tested against proxy_lib_name = files (and changed the
> 'services' line in my /etc/nsswitch.conf to contain only 'sss')



New round of patches. The first seven patches are unchanged from the
first pass (though offset by three, since the first three patches have
been pushed). The eighth patch is just Jakub's acked patch for
refactoring the dp_req routines from "[PATCH] DP: Refactor
responder_dp_req so it's reusable by other responders" in the proper
order to ensure it doesn't get lost/put in the wrong place. (Though I'm
pretty sure it will apply cleanly anywhere after 0006).

Patch 0009: Add support to sss_client to make enumeration requests for
services

Patch 0010: Add sysdb routines for requesting the complete list of
cached services.

Patch 0011: Another big one. Adds support for enumerating services to
the NSS provider.

Patch 0012: The proxy provider implementation of the enumeration logic.
Useful for testing purposes (I tested against the 'files' NSS library).

There is a known issue with the proxy provider support that I'm going to
work on in a later patch. Specifically, when we get back the list of
available services from the proxy provider, we get services that have
multiple available protocols back as separate entries. This causes the
second value to overwrite the primary value in sysdb_store_service().
I'm going to add the ability to merge them, but since the LDAP provider
(when finished) won't suffer this problem (since LDAP lookups will
return all protocols in the same request), I'm not stressing over it
right now. Once the code is in, I'll file a bug so we don't forget about
it.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-SYSDB-Add-sysdb-routines-for-manipulating-service-en.patch
Type: text/x-patch
Size: 37070 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-SYSDB-Add-indexes-for-servicePort-and-serviceProtoco.patch
Type: text/x-patch
Size: 5167 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-NSS-Add-client-support-for-services-non-enumeration.patch
Type: text/x-patch
Size: 13020 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-DP-Add-support-for-services-in-dp-requests.patch
Type: text/x-patch
Size: 2080 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-NSS-Add-negative-cache-routines-for-services.patch
Type: text/x-patch
Size: 7892 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-NSS-Add-getservbyname-and-getservbyport-support-to-t.patch
Type: text/x-patch
Size: 43157 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-PROXY-add-support-for-service-lookups-non-enumeratio.patch
Type: text/x-patch
Size: 13412 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-DP-Refactor-responder_dp_req-so-it-s-reusable-by-oth.patch
Type: text/x-patch
Size: 31320 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0007.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0009-NSS-Add-client-support-for-set-get-end-servent.patch
Type: text/x-patch
Size: 5033 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0008.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0010-SYSDB-add-support-for-enumerating-services.patch
Type: text/x-patch
Size: 2484 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0009.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0011-NSS-Add-service-enumeration-support-to-NSS-provider.patch
Type: text/x-patch
Size: 21866 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0010.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0012-PROXY-add-support-for-enumerating-services.patch
Type: text/x-patch
Size: 9334 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment-0011.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/898744af/attachment.sig>


More information about the sssd-devel mailing list