[SSSD] [PATCH] name2sid: Check negative cache for users and groups
Jakub Hrozek
jhrozek at redhat.com
Tue Sep 16 10:03:33 UTC 2014
On Fri, Sep 05, 2014 at 05:54:59PM +0200, Sumit Bose wrote:
> Hi,
>
> I found this while testing other stuff.
>
> bye,
> Sumit
The patch works as expected, so ACK. I will just fix one DEBUG message
before pushing if you don't mind, see inline.
Also, while testing I realized that when looking up entries with the
extop, even nonexistant entry turns up as a DP lookup error, so the
negcache is not set..is that expected/known?
> From d2fbe17663f7cfc79e11e2fec7371f102bbe9aed Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Thu, 4 Sep 2014 15:42:26 +0200
> Subject: [PATCH] name2sid: Check negative cache for users and groups
>
> Since we cannot know if a SID belongs to a user or a group a lookup
> should only fail if the given name is in both the negative cache for the
> users and the groups.
>
> Currently if the SID for a group called 'abc' should be looked up and
> the negative cache for the users contain an entry for 'abc' the request
> fails.
> ---
> src/responder/nss/nsssrv_cmd.c | 34 +++++++++++++++++++---------------
> 1 file changed, 19 insertions(+), 15 deletions(-)
>
> diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
> index bf578f3..c51ad13 100644
> --- a/src/responder/nss/nsssrv_cmd.c
> +++ b/src/responder/nss/nsssrv_cmd.c
> @@ -4075,26 +4075,30 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
> }
>
>
> - /* verify this user has not yet been negatively cached,
> - * or has been permanently filtered */
> + /* verify this name has not yet been negatively cached, as user
> + * and groupm, or has been permanently filtered */
> ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout,
> dom, name);
>
> - /* if neg cached, return we didn't find it */
> if (ret == EEXIST) {
> - DEBUG(SSSDBG_TRACE_FUNC,
> - "User [%s] does not exist in [%s]! (negative cache)\n",
> - name, dom->name);
> - /* if a multidomain search, try with next */
> - if (cmdctx->check_next) {
> - dom = get_next_domain(dom, false);
> - continue;
> + ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout,
> + dom, name);
> + if (ret == EEXIST) {
> + /* if neg cached, return we didn't find it */
> + DEBUG(SSSDBG_TRACE_FUNC,
> + "User [%s] does not exist in [%s]! (negative cache)\n",
I'll change "User [%s]" into "SID [%s]" here.
> + name, dom->name);
> + /* if a multidomain search, try with next */
> + if (cmdctx->check_next) {
> + dom = get_next_domain(dom, false);
> + continue;
> + }
> + /* There are no further domains or this was a
> + * fully-qualified user request.
> + */
> + ret = ENOENT;
> + goto done;
> }
> - /* There are no further domains or this was a
> - * fully-qualified user request.
> - */
> - ret = ENOENT;
> - goto done;
> }
>
> DEBUG(SSSDBG_TRACE_FUNC, "Requesting info for [%s@%s]\n",
> --
> 1.8.3.1
>
More information about the sssd-devel
mailing list