[SSSD] [PATCH] cache_req: check all domains for lookups by certificate

Sumit Bose sbose at redhat.com
Wed Nov 11 12:28:45 UTC 2015


On Wed, Nov 11, 2015 at 12:57:23PM +0100, Pavel Březina wrote:
> On 11/10/2015 10:48 AM, Sumit Bose wrote:
> >Hi,
> >
> >this patch is the equivalent of 374268c5eda35e8bbc2fef30752299199439cffe
> >"fix upn cache_req for sub-domain users" for lookups by certificates.
> >
> >bye,
> >Sumit
> >
> >
> >0001-cache_req-check-all-domains-for-lookups-by-certifica.patch
> >
> >
> > From 78ac47bfdbb9c91dddefb4de06dcdf41e7035c6a Mon Sep 17 00:00:00 2001
> >From: Sumit Bose<sbose at redhat.com>
> >Date: Mon, 12 Oct 2015 13:00:28 +0200
> >Subject: [PATCH] cache_req: check all domains for lookups by certificate
> >
> >Like lookup by ID or by UPN the match for lookups by certificate can be
> >found in any domain and all sub-domains must be included in the search.
> >---
> >  src/responder/common/responder_cache_req.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> >
> >diff --git a/src/responder/common/responder_cache_req.c b/src/responder/common/responder_cache_req.c
> >index fc63f84f1725b98398d383983c385c01508c73b6..a6fff2253c4057eb7239373be18ab15ba161b3dc 100644
> >--- a/src/responder/common/responder_cache_req.c
> >+++ b/src/responder/common/responder_cache_req.c
> >@@ -982,6 +982,7 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
> >          * qualified names instead. */
> >          while (state->domain != NULL && state->check_next
> >                  && state->domain->fqnames
> >+                && state->input->type != CACHE_REQ_USER_BY_CERT
> >                  && !cache_req_input_is_upn(state->input)) {
> >              state->domain = get_next_domain(state->domain, 0);
> >          }
> >@@ -1010,9 +1011,9 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
> >
> >          /* we will continue with the following domain the next time */
> >          if (state->check_next) {
> >-            if (cache_req_input_is_upn(state->input)) {
> >-                state->domain = get_next_domain(state->domain,
> >-                                                SSS_GND_DESCEND);
> >+            if (cache_req_input_is_upn(state->input)
> >+                    || state->input->type != CACHE_REQ_USER_BY_CERT ) {
> >+                state->domain = get_next_domain(state->domain, SSS_GND_DESCEND);
> 
> Shouldn't this say if state->input->type IS EQUAL TO cert?

of course you are right. Sorry for the copy-n-paste error. For my
testing (use_fully_qualified_names=True) the first hunk was sufficent.

New version attached.

bye,
Sumit
-------------- next part --------------
From 63f1e25208e3381e1e5e564c6bc48c3b53fcef3c Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 12 Oct 2015 13:00:28 +0200
Subject: [PATCH] cache_req: check all domains for lookups by certificate

Like lookup by ID or by UPN the match for lookups by certificate can be
found in any domain and all sub-domains must be included in the search.
---
 src/responder/common/responder_cache_req.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/responder/common/responder_cache_req.c b/src/responder/common/responder_cache_req.c
index 68206e42af6fdab29567588db307dca3f9f2f877..4ab52b8188859f1143ba1ffa3de03d14ecc028c2 100644
--- a/src/responder/common/responder_cache_req.c
+++ b/src/responder/common/responder_cache_req.c
@@ -982,6 +982,7 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
         * qualified names instead. */
         while (state->domain != NULL && state->check_next
                 && state->domain->fqnames
+                && state->input->type != CACHE_REQ_USER_BY_CERT
                 && !cache_req_input_is_upn(state->input)) {
             state->domain = get_next_domain(state->domain, 0);
         }
@@ -1010,9 +1011,9 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
 
         /* we will continue with the following domain the next time */
         if (state->check_next) {
-            if (cache_req_input_is_upn(state->input)) {
-                state->domain = get_next_domain(state->domain,
-                                                SSS_GND_DESCEND);
+            if (cache_req_input_is_upn(state->input)
+                    || state->input->type == CACHE_REQ_USER_BY_CERT ) {
+                state->domain = get_next_domain(state->domain, SSS_GND_DESCEND);
             } else {
                 state->domain = get_next_domain(state->domain, 0);
             }
-- 
2.1.0



More information about the sssd-devel mailing list