[SSSD] [PATCH] nss_check_name_of_well_known_sid() improve name splitting
Lukas Slebodnik
lslebodn at redhat.com
Tue Jul 14 14:33:58 UTC 2015
On (14/07/15 15:02), Sumit Bose wrote:
>Hi,
>
>this patch should fix https://fedorahosted.org/sssd/ticket/2717 .
>
>As you can see I added a new entry ipa_ad_default_names to the global
>nss context so that the regular expression string is only evaluated
>once. Since it is currently only used in
>nss_check_name_of_well_known_sid() I do the initialization here to avoid
>initialization when it is not needed. If you think this is too risky in
>future I'm fine with moving the initialization to the general
>initialization of the nss context.
>
>bye,
>Sumit
>From 1ff1e1f5fb57dd7e1fa85eb758b8769dfb1260d0 Mon Sep 17 00:00:00 2001
>From: Sumit Bose <sbose at redhat.com>
>Date: Tue, 14 Jul 2015 14:41:34 +0200
>Subject: [PATCH] nss_check_name_of_well_known_sid() improve name splitting
>
>Currently in the default configuration
>nss_check_name_of_well_known_sid() can only split fully-qualified names
>in the user at domain.name style. DOM\user style names will cause an error
>and terminate the whole request.
>
>With this patch both styles can be handled by default, additionally if
>the name could not be split nss_check_name_of_well_known_sid() returns
>ENOENT which can be handled more gracefully by the caller.
>
>Resolves https://fedorahosted.org/sssd/ticket/2717
>---
> src/responder/nss/nsssrv.h | 1 +
> src/responder/nss/nsssrv_cmd.c | 32 ++++++++++++++-
> src/tests/cmocka/test_nss_srv.c | 90 ++++++++++++++++++++++++-----------------
> src/util/usertools.c | 7 ++++
> src/util/util.h | 3 ++
> 5 files changed, 94 insertions(+), 39 deletions(-)
>
>diff --git a/src/responder/nss/nsssrv.h b/src/responder/nss/nsssrv.h
>index e293e3b4d03582abf6abf07cce61d3b6fdebfcae..6a77f9f1179e0bb2353a01edf14a27e576eba481 100644
>--- a/src/responder/nss/nsssrv.h
>+++ b/src/responder/nss/nsssrv.h
>@@ -76,6 +76,7 @@ struct nss_ctx {
>
> struct sss_idmap_ctx *idmap_ctx;
> struct sss_names_ctx *global_names;
>+ struct sss_names_ctx *ipa_ad_default_names;
>
> const char **extra_attributes;
> };
>diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
>index 0129467302f16af318bbbb0a5be47ff2e235da65..eb550cd007cfb6fac0271b7de211285b6cebfdef 100644
>--- a/src/responder/nss/nsssrv_cmd.c
>+++ b/src/responder/nss/nsssrv_cmd.c
>@@ -1248,13 +1248,43 @@ static int nss_check_name_of_well_known_sid(struct nss_cmd_ctx *cmdctx,
> size_t pctr = 0;
>
> nss_ctx = talloc_get_type(cmdctx->cctx->rctx->pvt_ctx, struct nss_ctx);
>- ret = sss_parse_name(cmdctx, nss_ctx->global_names, full_name,
nss_ctx->global_names is used just in two functions
nss_check_name_of_well_known_sid
nss_check_well_known_sid
All SID related functions should be used with AD.
I would prefer to directly change default to IPA/AD regex for global_names.
Or alternatively iterate over all domains and use their regexes.
In teory, someone can use alternative regex "(?P<name>[^@]+)&(?P<domain>.+$)"
and you will not be able to parse it with default ipa ad regex.
LS
>+
>+ if (nss_ctx->ipa_ad_default_names == NULL) {
>+ ret = get_default_ipa_ad_names(nss_ctx,
>+ &nss_ctx->ipa_ad_default_names);
>+ if (ret != EOK) {
>+ DEBUG(SSSDBG_OP_FAILURE,
>+ "get_default_ipa_ad_names failed, using global_names.\n");
>+
>+ /* Instead of failing try the next best. */
>+ nss_ctx->ipa_ad_default_names = nss_ctx->global_names;
>+ }
>+ }
>+
>+ ret = sss_parse_name(cmdctx, nss_ctx->ipa_ad_default_names, full_name,
More information about the sssd-devel
mailing list