[SSSD] [PATCH] cache_req: check all domains for lookups by certificate

Pavel Březina pbrezina at redhat.com
Wed Nov 11 12:50:12 UTC 2015


On 11/11/2015 01:28 PM, Sumit Bose wrote:
> On Wed, Nov 11, 2015 at 12:57:23PM +0100, Pavel Březina wrote:
>> On 11/10/2015 10:48 AM, Sumit Bose wrote:
>>> Hi,
>>>
>>> this patch is the equivalent of 374268c5eda35e8bbc2fef30752299199439cffe
>>> "fix upn cache_req for sub-domain users" for lookups by certificates.
>>>
>>> bye,
>>> Sumit
>>>
>>>
>>> 0001-cache_req-check-all-domains-for-lookups-by-certifica.patch
>>>
>>>
>>>  From 78ac47bfdbb9c91dddefb4de06dcdf41e7035c6a Mon Sep 17 00:00:00 2001
>>> From: Sumit Bose<sbose at redhat.com>
>>> Date: Mon, 12 Oct 2015 13:00:28 +0200
>>> Subject: [PATCH] cache_req: check all domains for lookups by certificate
>>>
>>> Like lookup by ID or by UPN the match for lookups by certificate can be
>>> found in any domain and all sub-domains must be included in the search.
>>> ---
>>>   src/responder/common/responder_cache_req.c | 7 ++++---
>>>   1 file changed, 4 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/src/responder/common/responder_cache_req.c b/src/responder/common/responder_cache_req.c
>>> index fc63f84f1725b98398d383983c385c01508c73b6..a6fff2253c4057eb7239373be18ab15ba161b3dc 100644
>>> --- a/src/responder/common/responder_cache_req.c
>>> +++ b/src/responder/common/responder_cache_req.c
>>> @@ -982,6 +982,7 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
>>>           * qualified names instead. */
>>>           while (state->domain != NULL && state->check_next
>>>                   && state->domain->fqnames
>>> +                && state->input->type != CACHE_REQ_USER_BY_CERT
>>>                   && !cache_req_input_is_upn(state->input)) {
>>>               state->domain = get_next_domain(state->domain, 0);
>>>           }
>>> @@ -1010,9 +1011,9 @@ static errno_t cache_req_next_domain(struct tevent_req *req)
>>>
>>>           /* we will continue with the following domain the next time */
>>>           if (state->check_next) {
>>> -            if (cache_req_input_is_upn(state->input)) {
>>> -                state->domain = get_next_domain(state->domain,
>>> -                                                SSS_GND_DESCEND);
>>> +            if (cache_req_input_is_upn(state->input)
>>> +                    || state->input->type != CACHE_REQ_USER_BY_CERT ) {
>>> +                state->domain = get_next_domain(state->domain, SSS_GND_DESCEND);
>>
>> Shouldn't this say if state->input->type IS EQUAL TO cert?
>
> of course you are right. Sorry for the copy-n-paste error. For my
> testing (use_fully_qualified_names=True) the first hunk was sufficent.
>
> New version attached.
>
> bye,
> Sumit

Ack.



More information about the sssd-devel mailing list