[SSSD] sss_cache flush ssh hosts list.
Pavel Reichl
preichl at redhat.com
Thu Aug 28 16:11:34 UTC 2014
On 08/25/2014 02:05 PM, Jan Cholasta wrote:
> Dne 4.8.2014 v 19:34 Pavel Reichl napsal(a):
>>
>> On 07/21/2014 02:08 PM, Jakub Hrozek wrote:
>>> On Mon, Jul 21, 2014 at 01:55:20PM +0200, Jan Cholasta wrote:
>>>> On 18.7.2014 06:41, William wrote:
>>>>>>> Ignore that last patch, I messed up and didn't include a .h file.
>>>>>>> Here
>>>>>>> is the fixed patch.
>>>>>> This new patch seems to be based on some older version of the
>>>>>> patch, it
>>>>>> uses wrong option name, sysdb_update_ssh_host still has the confdb
>>>>>> argument, etc.
>>>>>>
>>>>> Fixed, and fixed the documentation into the xml file, removed the
>>>>> references to the .pot file.
>>>> I don't see any of the requested fixes in the patch.
>>>>
>>>> See attachment for fixed patch. I also did a few additional tweaks to
>>>> make
>>>> the patch work when SSSD is updated from a previous version and when
>>>> building without SSH bits.
>>> Awesome thank you, I guess some of us need to review the patch now
>>> you're also an author.
>> While Jan was so kind to give me some hints on how to test patch
>> properly, we found out a little bug. So Jan is going to prepare an
>> updated patch.
>>
>> I'll do the review then.
>
> I can't reproduce the issue, maybe something else was wrong in your
> setup?
>
> For the record, I installed IPA in a VM and then ran these commands on
> it:
>
> $ sss_ssh_knownhostsproxy --debug 10 $HOSTNAME
> [no errors]
> $ cat /var/lib/sss/pubconf/known_hosts
> [not empty]
> # systemctl stop ipa
> $ sss_ssh_knownhostsproxy --debug 10 $HOSTNAME
> [no errors]
> $ cat /var/lib/sss/pubconf/known_hosts
> [not empty]
> # sss_cache -H
> $ sss_ssh_knownhostsproxy --debug 10 $HOSTNAME
> [no errors]
> $ cat /var/lib/sss/pubconf/known_hosts
> [empty]
> # systemctl start ipa
> $ sss_ssh_knownhostsproxy --debug 10 $HOSTNAME
> [no errors]
> $ cat /var/lib/sss/pubconf/known_hosts
> [not empty]
>
> Pavel had an empty /var/lib/sss/pubconf/known_hosts in the last step,
> I have it non-empty as expected.
>
> (sorry for the delay, I was on leave)
>
This test ran OK this time, so I think you are right.
I have some comments to the patch itself.
I'm not personally fan of big patches like this one. Could you at least
separate the man page changes to separate patch - so we can ask some
native speaker to review it.
Also new options in sss_cache -h and -H are not documented in man pages,
could you document them?
Please see some minor comments inline:
> From 31312ab877da0b7fe8da9ddd808345e3096dbcd0 Mon Sep 17 00:00:00 2001
> From: William B <william at adelaide.edu.au>
> Date: Mon, 21 Jul 2014 11:13:25 +0200
> Subject: [PATCH] Allow sss_cache tool to flush SSH hosts cache
>
> ---
> src/confdb/confdb.c | 11 ++++++
> src/confdb/confdb.h | 2 +
> src/config/SSSDConfigTest.py | 2 +
> src/config/etc/sssd.api.conf | 1 +
> src/db/sysdb_ssh.c | 65 +++++++++++++++++++++++++++----
> src/db/sysdb_ssh.h | 15 ++++++++
> src/man/sssd.conf.5.xml | 14 +++++++
> src/providers/ipa/ipa_hostid.c | 4 +-
> src/tests/sysdb_ssh-tests.c | 1 +
> src/tools/sss_cache.c | 86
> +++++++++++++++++++++++++++++++++++++-----
> 10 files changed, 183 insertions(+), 18 deletions(-)
>
> diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
> index 15de961..e2d7e8d 100644
> --- a/src/confdb/confdb.c
> +++ b/src/confdb/confdb.c
> @@ -1040,6 +1040,17 @@ static int confdb_get_domain_internal(struct
> confdb_ctx *cdb,
> goto done;
> }
>
> + /* Override the ssh known hosts timeout, if specified */
> + ret = get_entry_as_uint32(res->msgs[0], &domain->ssh_host_timeout,
> + CONFDB_DOMAIN_SSH_HOST_CACHE_TIMEOUT,
> + entry_cache_timeout);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_FATAL_FAILURE,
> + "Invalid value for [%s]\n",
> + CONFDB_DOMAIN_SSH_HOST_CACHE_TIMEOUT);
> + goto done;
> + }
> +
> /* Set refresh_expired_interval, if specified */
> ret = get_entry_as_uint32(res->msgs[0],
> &domain->refresh_expired_interval,
> CONFDB_DOMAIN_REFRESH_EXPIRED_INTERVAL,
> diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
> index ba33ea5..e6c5c2d 100644
> --- a/src/confdb/confdb.h
> +++ b/src/confdb/confdb.h
> @@ -175,6 +175,7 @@
> #define CONFDB_DOMAIN_SERVICE_CACHE_TIMEOUT "entry_cache_service_timeout"
> #define CONFDB_DOMAIN_AUTOFS_CACHE_TIMEOUT "entry_cache_autofs_timeout"
> #define CONFDB_DOMAIN_SUDO_CACHE_TIMEOUT "entry_cache_sudo_timeout"
> +#define CONFDB_DOMAIN_SSH_HOST_CACHE_TIMEOUT
> "entry_cache_ssh_host_timeout"
> #define CONFDB_DOMAIN_PWD_EXPIRATION_WARNING "pwd_expiration_warning"
> #define CONFDB_DOMAIN_REFRESH_EXPIRED_INTERVAL "refresh_expired_interval"
> #define CONFDB_DOMAIN_OFFLINE_TIMEOUT "offline_timeout"
> @@ -232,6 +233,7 @@ struct sss_domain_info {
> uint32_t service_timeout;
> uint32_t autofsmap_timeout;
> uint32_t sudo_timeout;
> + uint32_t ssh_host_timeout;
>
> uint32_t refresh_expired_interval;
> uint32_t subdomain_refresh_interval;
> diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
> index 1450003..2d12bc0 100755
> --- a/src/config/SSSDConfigTest.py
> +++ b/src/config/SSSDConfigTest.py
> @@ -505,6 +505,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
> 'entry_cache_service_timeout',
> 'entry_cache_autofs_timeout',
> 'entry_cache_sudo_timeout',
> + 'entry_cache_ssh_host_timeout',
> 'refresh_expired_interval',
> 'lookup_family_order',
> 'account_cache_expiration',
> @@ -863,6 +864,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
> 'entry_cache_service_timeout',
> 'entry_cache_autofs_timeout',
> 'entry_cache_sudo_timeout',
> + 'entry_cache_ssh_host_timeout',
> 'refresh_expired_interval',
> 'account_cache_expiration',
> 'lookup_family_order',
> diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
> index 5e5a928..5f995af 100644
> --- a/src/config/etc/sssd.api.conf
> +++ b/src/config/etc/sssd.api.conf
> @@ -133,6 +133,7 @@ entry_cache_netgroup_timeout = int, None, false
> entry_cache_service_timeout = int, None, false
> entry_cache_autofs_timeout = int, None, false
> entry_cache_sudo_timeout = int, None, false
> +entry_cache_ssh_host_timeout = int, None, false
> refresh_expired_interval = int, None, false
>
> # Dynamic DNS updates
> diff --git a/src/db/sysdb_ssh.c b/src/db/sysdb_ssh.c
> index 7dd98cf..bc8b1f6 100644
> --- a/src/db/sysdb_ssh.c
> +++ b/src/db/sysdb_ssh.c
> @@ -23,6 +23,14 @@
> #include "db/sysdb_ssh.h"
> #include "db/sysdb_private.h"
>
> +static struct ldb_dn *
> +sysdb_ssh_host_dn(TALLOC_CTX *mem_ctx,
> + struct sss_domain_info *domain,
> + const char *name)
> +{
> + return sysdb_custom_dn(mem_ctx, domain, name, SSH_HOSTS_SUBDIR);
> +}
> +
> static errno_t
> sysdb_update_ssh_host(struct sss_domain_info *domain,
> const char *name,
> @@ -45,6 +53,7 @@ errno_t
> sysdb_store_ssh_host(struct sss_domain_info *domain,
> const char *name,
> const char *alias,
> + int cache_timeout,
> time_t now,
> struct sysdb_attrs *attrs)
> {
> @@ -147,6 +156,14 @@ sysdb_store_ssh_host(struct sss_domain_info *domain,
> goto done;
> }
>
> + ret = sysdb_attrs_add_time_t(attrs, SYSDB_CACHE_EXPIRE,
> + cache_timeout ? (now +
> cache_timeout) : 0);
> + if (ret) {
Please use form:
ret != EOK
as it is used in the rest of the module
> + DEBUG(SSSDBG_OP_FAILURE, "Could not set sysdb cache expire
> [%d]: %s\n",
> + ret, strerror(ret));
> + goto done;
> + }
> +
> ret = sysdb_update_ssh_host(domain, name, attrs);
> if (ret != EOK) {
> goto done;
> @@ -175,6 +192,36 @@ done:
> return ret;
> }
>
> +
One too many empty lines.
> +errno_t
> +sysdb_set_ssh_host_attr(struct sss_domain_info *domain,
> + const char *name,
> + struct sysdb_attrs *attrs,
> + int mod_op)
> +{
> +
Is the empty line here intentional?
> + errno_t ret;
> + struct ldb_dn *dn;
> + TALLOC_CTX *tmp_ctx;
> +
> + tmp_ctx = talloc_new(NULL);
> + if (!tmp_ctx) {
> + return ENOMEM;
> + }
> +
> + dn = sysdb_ssh_host_dn(tmp_ctx, domain, name);
> + if (!dn) {
> + ret = ENOMEM;
> + goto done;
> + }
> +
> + ret = sysdb_set_entry_attr(domain->sysdb, dn, attrs, mod_op);
We should check return value here, right?
> +
> +done:
> + talloc_free(tmp_ctx);
> + return ret;
> +}
> +
> errno_t
> sysdb_update_ssh_known_host_expire(struct sss_domain_info *domain,
> const char *name,
> @@ -229,13 +276,13 @@ sysdb_delete_ssh_host(struct sss_domain_info
> *domain,
> return sysdb_delete_custom(domain, name, SSH_HOSTS_SUBDIR);
> }
>
> -static errno_t
> +errno_t
> sysdb_search_ssh_hosts(TALLOC_CTX *mem_ctx,
> struct sss_domain_info *domain,
> const char *filter,
> const char **attrs,
> - struct ldb_message ***hosts,
> - size_t *num_hosts)
> + size_t *num_hosts,
> + struct ldb_message ***hosts)
> {
> errno_t ret;
> TALLOC_CTX *tmp_ctx;
> @@ -297,7 +344,7 @@ sysdb_get_ssh_host(TALLOC_CTX *mem_ctx,
> }
>
> ret = sysdb_search_ssh_hosts(tmp_ctx, domain, filter, attrs,
> - &hosts, &num_hosts);
> + &num_hosts, &hosts);
> if (ret != EOK) {
> goto done;
> }
> @@ -335,15 +382,19 @@ sysdb_get_ssh_known_hosts(TALLOC_CTX *mem_ctx,
> return ENOMEM;
> }
>
> - filter = talloc_asprintf(tmp_ctx, "(%s>=%ld)",
> - SYSDB_SSH_KNOWN_HOSTS_EXPIRE, (long)now);
> + filter = talloc_asprintf(tmp_ctx,
> + "(&(|(!(%s=*))(%s=0)(%s>=%lld))(%s>=%lld))",
> + SYSDB_CACHE_EXPIRE,
> + SYSDB_CACHE_EXPIRE,
> + SYSDB_CACHE_EXPIRE, (long long)now + 1,
> + SYSDB_SSH_KNOWN_HOSTS_EXPIRE, (long
> long)now + 1);
> if (!filter) {
> ret = ENOMEM;
> goto done;
> }
>
> ret = sysdb_search_ssh_hosts(mem_ctx, domain, filter, attrs,
> - hosts, num_hosts);
> + num_hosts, hosts);
>
> done:
> talloc_free(tmp_ctx);
> diff --git a/src/db/sysdb_ssh.h b/src/db/sysdb_ssh.h
> index e8aca77..960a13f 100644
> --- a/src/db/sysdb_ssh.h
> +++ b/src/db/sysdb_ssh.h
> @@ -33,6 +33,7 @@ errno_t
> sysdb_store_ssh_host(struct sss_domain_info *domain,
> const char *name,
> const char *alias,
> + int cache_timeout,
> time_t now,
> struct sysdb_attrs *attrs);
>
> @@ -42,11 +43,25 @@ sysdb_update_ssh_known_host_expire(struct
> sss_domain_info *domain,
> time_t now,
> int known_hosts_timeout);
>
> +int
> +sysdb_set_ssh_host_attr(struct sss_domain_info *domain,
> + const char *name,
> + struct sysdb_attrs *attrs,
> + int mod_op);
> +
> errno_t
> sysdb_delete_ssh_host(struct sss_domain_info *domain,
> const char *name);
>
> errno_t
> +sysdb_search_ssh_hosts(TALLOC_CTX *mem_ctx,
> + struct sss_domain_info *domain,
> + const char *filter,
> + const char **attrs,
> + size_t *num_hosts,
> + struct ldb_message ***hosts);
> +
> +errno_t
> sysdb_get_ssh_host(TALLOC_CTX *mem_ctx,
> struct sss_domain_info *domain,
> const char *name,
> diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
> index 27d22f4..bb631c3 100644
> --- a/src/man/sssd.conf.5.xml
> +++ b/src/man/sssd.conf.5.xml
> @@ -1175,6 +1175,20 @@ fallback_homedir = /home/%u
> </listitem>
> </varlistentry>
>
> + <varlistentry condition="with_ssh">
> + <term>entry_cache_ssh_host_timeout (integer)</term>
> + <listitem>
> + <para>
> + How many seconds to keep a host ssh key after
> + refresh. IE how long to cache the host key
> + for.
> + </para>
> + <para>
> + Default: entry_cache_timeout
> + </para>
> + </listitem>
> + </varlistentry>
> +
> <varlistentry>
> <term>refresh_expired_interval (integer)</term>
> <listitem>
> diff --git a/src/providers/ipa/ipa_hostid.c
> b/src/providers/ipa/ipa_hostid.c
> index 905454d..6b82335 100644
> --- a/src/providers/ipa/ipa_hostid.c
> +++ b/src/providers/ipa/ipa_hostid.c
> @@ -300,8 +300,8 @@ hosts_get_done(struct tevent_req *subreq)
> goto done;
> }
>
> - ret = sysdb_store_ssh_host(state->domain, state->name,
> state->alias, now,
> - attrs);
> + ret = sysdb_store_ssh_host(state->domain, state->name, state->alias,
> + state->domain->ssh_host_timeout, now, attrs);
> if (ret != EOK) {
> goto done;
> }
> diff --git a/src/tests/sysdb_ssh-tests.c b/src/tests/sysdb_ssh-tests.c
> index 6a4c219..46f5c47 100644
> --- a/src/tests/sysdb_ssh-tests.c
> +++ b/src/tests/sysdb_ssh-tests.c
> @@ -175,6 +175,7 @@ static int test_sysdb_store_ssh_host(struct
> test_data *data)
> ret = sysdb_store_ssh_host(data->ctx->domain,
> data->hostname,
> data->alias,
> + data->ctx->domain->ssh_host_timeout,
> now,
> data->attrs);
> return ret;
> diff --git a/src/tools/sss_cache.c b/src/tools/sss_cache.c
> index 7cd5852..c72af4b 100644
> --- a/src/tools/sss_cache.c
> +++ b/src/tools/sss_cache.c
> @@ -30,6 +30,7 @@
> #include "db/sysdb.h"
> #include "db/sysdb_services.h"
> #include "db/sysdb_autofs.h"
> +#include "db/sysdb_ssh.h"
>
> #define INVALIDATE_NONE 0
> #define INVALIDATE_USERS 1
> @@ -37,22 +38,36 @@
> #define INVALIDATE_NETGROUPS 4
> #define INVALIDATE_SERVICES 8
> #define INVALIDATE_AUTOFSMAPS 16
> +#define INVALIDATE_SSH_HOSTS 32
>
> #ifdef BUILD_AUTOFS
> +#ifdef BUILD_SSH
> #define INVALIDATE_EVERYTHING (INVALIDATE_USERS | INVALIDATE_GROUPS | \
> INVALIDATE_NETGROUPS |
> INVALIDATE_SERVICES | \
> - INVALIDATE_AUTOFSMAPS)
> -#else
> + INVALIDATE_AUTOFSMAPS |
> INVALIDATE_SSH_HOSTS )
> +#else /* BUILD_SSH */
> +#define INVALIDATE_EVERYTHING (INVALIDATE_USERS | INVALIDATE_GROUPS | \
> + INVALIDATE_NETGROUPS |
> INVALIDATE_SERVICES | \
> + INVALIDATE_AUTOFSMAPS )
> +#endif /* BUILD_SSH */
> +#else /* BUILD_AUTOFS */
> +#ifdef BUILD_SSH
> +#define INVALIDATE_EVERYTHING (INVALIDATE_USERS | INVALIDATE_GROUPS | \
> + INVALIDATE_NETGROUPS |
> INVALIDATE_SERVICES | \
> + INVALIDATE_SSH_HOSTS )
> +#else /* BUILD_SSH */
> #define INVALIDATE_EVERYTHING (INVALIDATE_USERS | INVALIDATE_GROUPS | \
> - INVALIDATE_NETGROUPS |
> INVALIDATE_SERVICES)
> -#endif
> + INVALIDATE_NETGROUPS |
> INVALIDATE_SERVICES )
> +#endif /* BUILD_SSH */
> +#endif /* BUILD_AUTOFS */
>
> enum sss_cache_entry {
> TYPE_USER=0,
> TYPE_GROUP,
> TYPE_NETGROUP,
> TYPE_SERVICE,
> - TYPE_AUTOFSMAP
> + TYPE_AUTOFSMAP,
> + TYPE_SSH_HOST
> };
>
> static errno_t search_autofsmaps(TALLOC_CTX *mem_ctx,
> @@ -69,18 +84,21 @@ struct cache_tool_ctx {
> char *netgroup_filter;
> char *service_filter;
> char *autofs_filter;
> + char *ssh_host_filter;
>
> char *user_name;
> char *group_name;
> char *netgroup_name;
> char *service_name;
> char *autofs_name;
> + char *ssh_host_name;
>
> bool update_user_filter;
> bool update_group_filter;
> bool update_netgroup_filter;
> bool update_service_filter;
> bool update_autofs_filter;
> + bool update_ssh_host_filter;
> };
>
> errno_t init_domains(struct cache_tool_ctx *ctx, const char *domain);
> @@ -152,6 +170,9 @@ int main(int argc, const char *argv[])
> skipped &= !invalidate_entries(tctx, dinfo, TYPE_AUTOFSMAP,
> tctx->autofs_filter,
> tctx->autofs_name);
> + skipped &= !invalidate_entries(tctx, dinfo, TYPE_SSH_HOST,
> + tctx->ssh_host_filter,
> + tctx->ssh_host_name);
>
> ret = sysdb_transaction_commit(sysdb);
> if (ret != EOK) {
> @@ -328,6 +349,14 @@ static errno_t update_all_filters(struct
> cache_tool_ctx *tctx,
> return ret;
> }
>
> + /* Update ssh host filter */
> + ret = update_filter(tctx, dinfo, tctx->ssh_host_name,
> + tctx->update_ssh_host_filter, "(%s=%s)", false,
> + &tctx->ssh_host_filter);
> + if (ret != EOK) {
> + return ret;
> + }
> +
> return EOK;
> }
>
> @@ -371,6 +400,15 @@ static bool invalidate_entries(TALLOC_CTX *ctx,
> type_string = "autofs map";
> ret = search_autofsmaps(ctx, dinfo, filter, attrs,
> &msg_count, &msgs);
> break;
> + case TYPE_SSH_HOST:
> + type_string = "ssh_host";
> +#ifdef BUILD_SSH
> + ret = sysdb_search_ssh_hosts(ctx, dinfo,
> + filter, attrs, &msg_count, &msgs);
> +#else /* BUILD_SSH */
> + ret = ENOSYS;
> +#endif /* BUILD_SSH */
> + break;
> }
>
> if (ret != EOK) {
> @@ -446,6 +484,14 @@ static errno_t invalidate_entry(TALLOC_CTX *ctx,
> ret = sysdb_set_autofsmap_attr(domain, name,
> sys_attrs,
> SYSDB_MOD_REP);
> break;
> + case TYPE_SSH_HOST:
> +#ifdef BUILD_SSH
> + ret = sysdb_set_ssh_host_attr(domain, name,
> + sys_attrs,
> SYSDB_MOD_REP);
> +#else /* BUILD_SSH */
> + ret = ENOSYS;
> +#endif /* BUILD_SSH */
> + break;
> default:
> return EINVAL;
> }
> @@ -530,6 +576,7 @@ errno_t init_context(int argc, const char *argv[],
> struct cache_tool_ctx **tctx)
> char *netgroup = NULL;
> char *service = NULL;
> char *map = NULL;
> + char *ssh_host = NULL;
> char *domain = NULL;
> int debug = SSSDBG_DEFAULT;
> errno_t ret = EOK;
> @@ -563,6 +610,12 @@ errno_t init_context(int argc, const char
> *argv[], struct cache_tool_ctx **tctx)
> { "autofs-maps", 'A', POPT_ARG_NONE, NULL, 'a',
> _("Invalidate all autofs maps"), NULL },
> #endif /* BUILD_AUTOFS */
> +#ifdef BUILD_SSH
> + { "ssh_host", 'h', POPT_ARG_STRING, &ssh_host, 0,
> + _("Invalidate particular SSH host"), NULL },
> + { "ssh_hosts", 'H', POPT_ARG_NONE, NULL, 'h',
> + _("Invalidate all SSH hosts"), NULL },
> +#endif /* BUILD_SSH */
> { "domain", 'd', POPT_ARG_STRING, &domain, 0,
> _("Only invalidate entries from a particular domain"),
> NULL },
> POPT_TABLEEND
> @@ -594,6 +647,9 @@ errno_t init_context(int argc, const char *argv[],
> struct cache_tool_ctx **tctx)
> case 'a':
> idb |= INVALIDATE_AUTOFSMAPS;
> break;
> + case 'h':
> + idb |= INVALIDATE_SSH_HOSTS;
> + break;
> case 'e':
> idb = INVALIDATE_EVERYTHING;
> break;
> @@ -608,7 +664,7 @@ errno_t init_context(int argc, const char *argv[],
> struct cache_tool_ctx **tctx)
> }
>
> if (idb == INVALIDATE_NONE && !user && !group &&
> - !netgroup && !service && !map) {
> + !netgroup && !service && !map && !ssh_host) {
> BAD_POPT_PARAMS(pc,
> _("Please select at least one object to invalidate\n"),
> ret, fini);
> @@ -665,14 +721,26 @@ errno_t init_context(int argc, const char
> *argv[], struct cache_tool_ctx **tctx)
> ctx->update_autofs_filter = true;
> }
>
> + if (idb & INVALIDATE_SSH_HOSTS) {
> + ctx->ssh_host_filter = talloc_asprintf(ctx, "(%s=*)",
> SYSDB_NAME);
> + ctx->update_ssh_host_filter = false;
> + } else if (ssh_host) {
> + ctx->ssh_host_name = talloc_strdup(ctx, ssh_host);
> + ctx->update_ssh_host_filter = true;
> + }
> +
> if (((idb & INVALIDATE_USERS) && !ctx->user_filter) ||
> ((idb & INVALIDATE_GROUPS) && !ctx->group_filter) ||
> ((idb & INVALIDATE_NETGROUPS) && !ctx->netgroup_filter) ||
> ((idb & INVALIDATE_SERVICES) && !ctx->service_filter) ||
> ((idb & INVALIDATE_AUTOFSMAPS) && !ctx->autofs_filter) ||
> - (user && !ctx->user_name) || (group && !ctx->group_name) ||
> - (netgroup && !ctx->netgroup_name) || (map &&
> !ctx->autofs_name) ||
> - (service && !ctx->service_name)) {
> + ((idb & INVALIDATE_SSH_HOSTS) && !ctx->ssh_host_filter) ||
> + (user && !ctx->user_name) ||
> + (group && !ctx->group_name) ||
> + (netgroup && !ctx->netgroup_name) ||
> + (service && !ctx->service_name) ||
> + (map && !ctx->autofs_name) ||
> + (ssh_host && !ctx->ssh_host_name)) {
> DEBUG(SSSDBG_CRIT_FAILURE, "Construction of filters failed\n");
> ret = ENOMEM;
> goto fini;
> --
More information about the sssd-devel
mailing list