[SSSD] [PATCH] name2sid: Check negative cache for users and groups

Jakub Hrozek jhrozek at redhat.com
Tue Sep 16 10:03:33 UTC 2014


On Fri, Sep 05, 2014 at 05:54:59PM +0200, Sumit Bose wrote:
> Hi,
> 
> I found this while testing other stuff.
> 
> bye,
> Sumit

The patch works as expected, so ACK. I will just fix one DEBUG message
before pushing if you don't mind, see inline.

Also, while testing I realized that when looking up entries with the
extop, even nonexistant entry turns up as a DP lookup error, so the
negcache is not set..is that expected/known?

> From d2fbe17663f7cfc79e11e2fec7371f102bbe9aed Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Thu, 4 Sep 2014 15:42:26 +0200
> Subject: [PATCH] name2sid: Check negative cache for users and groups
> 
> Since we cannot know if a SID belongs to a user or a group a lookup
> should only fail if the given name is in both the negative cache for the
> users and the groups.
> 
> Currently if the SID for a group called 'abc' should be looked up and
> the negative cache for the users contain an entry for 'abc' the request
> fails.
> ---
>  src/responder/nss/nsssrv_cmd.c | 34 +++++++++++++++++++---------------
>  1 file changed, 19 insertions(+), 15 deletions(-)
> 
> diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
> index bf578f3..c51ad13 100644
> --- a/src/responder/nss/nsssrv_cmd.c
> +++ b/src/responder/nss/nsssrv_cmd.c
> @@ -4075,26 +4075,30 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
>              }
>  
>  
> -            /* verify this user has not yet been negatively cached,
> -            * or has been permanently filtered */
> +            /* verify this name has not yet been negatively cached, as user
> +             * and groupm, or has been permanently filtered */
>              ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout,
>                                          dom, name);
>  
> -            /* if neg cached, return we didn't find it */
>              if (ret == EEXIST) {
> -                DEBUG(SSSDBG_TRACE_FUNC,
> -                      "User [%s] does not exist in [%s]! (negative cache)\n",
> -                       name, dom->name);
> -                /* if a multidomain search, try with next */
> -                if (cmdctx->check_next) {
> -                    dom = get_next_domain(dom, false);
> -                    continue;
> +                ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout,
> +                                             dom, name);
> +                if (ret == EEXIST) {
> +                    /* if neg cached, return we didn't find it */
> +                    DEBUG(SSSDBG_TRACE_FUNC,
> +                          "User [%s] does not exist in [%s]! (negative cache)\n",

I'll change "User [%s]" into "SID [%s]" here.

> +                           name, dom->name);
> +                    /* if a multidomain search, try with next */
> +                    if (cmdctx->check_next) {
> +                        dom = get_next_domain(dom, false);
> +                        continue;
> +                    }
> +                    /* There are no further domains or this was a
> +                     * fully-qualified user request.
> +                     */
> +                    ret = ENOENT;
> +                    goto done;
>                  }
> -                /* There are no further domains or this was a
> -                 * fully-qualified user request.
> -                 */
> -                ret = ENOENT;
> -                goto done;
>              }
>  
>              DEBUG(SSSDBG_TRACE_FUNC, "Requesting info for [%s@%s]\n",
> -- 
> 1.8.3.1
> 



More information about the sssd-devel mailing list