[SSSD] [PATCH] nss_check_name_of_well_known_sid() improve name splitting

Lukas Slebodnik lslebodn at redhat.com
Tue Jul 14 14:33:58 UTC 2015


On (14/07/15 15:02), Sumit Bose wrote:
>Hi,
>
>this patch should fix https://fedorahosted.org/sssd/ticket/2717 .
>
>As you can see I added a new entry ipa_ad_default_names to the global
>nss context so that the regular expression string is only evaluated
>once. Since it is currently only used in
>nss_check_name_of_well_known_sid() I do the initialization here to avoid
>initialization when it is not needed. If you think this is too risky in
>future I'm fine with moving the initialization to the general
>initialization of the nss context.
>
>bye,
>Sumit

>From 1ff1e1f5fb57dd7e1fa85eb758b8769dfb1260d0 Mon Sep 17 00:00:00 2001
>From: Sumit Bose <sbose at redhat.com>
>Date: Tue, 14 Jul 2015 14:41:34 +0200
>Subject: [PATCH] nss_check_name_of_well_known_sid() improve name splitting
>
>Currently in the default configuration
>nss_check_name_of_well_known_sid() can only split fully-qualified names
>in the user at domain.name style. DOM\user style names will cause an error
>and terminate the whole request.
>
>With this patch both styles can be handled by default, additionally if
>the name could not be split nss_check_name_of_well_known_sid() returns
>ENOENT which can be handled more gracefully by the caller.
>
>Resolves https://fedorahosted.org/sssd/ticket/2717
>---
> src/responder/nss/nsssrv.h      |  1 +
> src/responder/nss/nsssrv_cmd.c  | 32 ++++++++++++++-
> src/tests/cmocka/test_nss_srv.c | 90 ++++++++++++++++++++++++-----------------
> src/util/usertools.c            |  7 ++++
> src/util/util.h                 |  3 ++
> 5 files changed, 94 insertions(+), 39 deletions(-)
>
>diff --git a/src/responder/nss/nsssrv.h b/src/responder/nss/nsssrv.h
>index e293e3b4d03582abf6abf07cce61d3b6fdebfcae..6a77f9f1179e0bb2353a01edf14a27e576eba481 100644
>--- a/src/responder/nss/nsssrv.h
>+++ b/src/responder/nss/nsssrv.h
>@@ -76,6 +76,7 @@ struct nss_ctx {
> 
>     struct sss_idmap_ctx *idmap_ctx;
>     struct sss_names_ctx *global_names;
>+    struct sss_names_ctx *ipa_ad_default_names;
> 
>     const char **extra_attributes;
> };
>diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
>index 0129467302f16af318bbbb0a5be47ff2e235da65..eb550cd007cfb6fac0271b7de211285b6cebfdef 100644
>--- a/src/responder/nss/nsssrv_cmd.c
>+++ b/src/responder/nss/nsssrv_cmd.c
>@@ -1248,13 +1248,43 @@ static int nss_check_name_of_well_known_sid(struct nss_cmd_ctx *cmdctx,
>     size_t pctr = 0;
> 
>     nss_ctx = talloc_get_type(cmdctx->cctx->rctx->pvt_ctx, struct nss_ctx);
>-    ret = sss_parse_name(cmdctx, nss_ctx->global_names, full_name,
nss_ctx->global_names is used just in two functions
  nss_check_name_of_well_known_sid
  nss_check_well_known_sid

All SID related functions should be used with AD.
I would prefer to directly change default to IPA/AD regex for global_names.

Or alternatively iterate over all domains and use their regexes.
In teory, someone can use alternative regex "(?P<name>[^@]+)&(?P<domain>.+$)"
and you will not be able to parse it with default ipa ad regex.

LS


>+
>+    if (nss_ctx->ipa_ad_default_names == NULL) {
>+        ret = get_default_ipa_ad_names(nss_ctx,
>+                                       &nss_ctx->ipa_ad_default_names);
>+        if (ret != EOK) {
>+            DEBUG(SSSDBG_OP_FAILURE,
>+                  "get_default_ipa_ad_names failed, using global_names.\n");
>+
>+            /* Instead of failing try the next best. */
>+            nss_ctx->ipa_ad_default_names = nss_ctx->global_names;
>+        }
>+    }
>+
>+    ret = sss_parse_name(cmdctx, nss_ctx->ipa_ad_default_names, full_name,



More information about the sssd-devel mailing list