From acb2de04987b163d602aa02155b34c50bce93584 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn@redhat.com>
Date: Mon, 8 Aug 2016 13:55:52 +0200
Subject: [PATCH 79/82] NSS: Do not check local users with disabled
 local_negative_timeout

sssd_nss can set different negative timeout for local users
and groups. However, checking whether user/group is local
is quite expensive operation. We can avoid such operations
if local_negative_timeout is not set.

This fix improve performance(40%) of lookup non-existing
entries in offline mode and with disabled local_negative_timeout.

  sh$ cat pok.sh
  for i in {1..10000}; do
    getent passwd -s sss temp$i
    getent group -s sss temp$i
  done

  #without patch
  sh $time /bin/bash pok.sh
  real    0m41.534s
  user    0m3.580s
  sys     0m14.202s

  #with patch
  sh $time /bin/bash pok.sh
  real    0m26.686s
  user    0m3.292s
  sys     0m13.165s

Resolves:
https://fedorahosted.org/sssd/ticket/3122

Reviewed-by: Petr Cech <pcech@redhat.com>
---
 src/responder/common/negcache.c | 45 ++++++++++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/src/responder/common/negcache.c b/src/responder/common/negcache.c
index dfeb0d483e4db34cb2f25e1f82884611a707aabe..5b7ad69f432518be94b88e92e24265add722c852 100644
--- a/src/responder/common/negcache.c
+++ b/src/responder/common/negcache.c
@@ -143,7 +143,7 @@ done:
 }
 
 static int sss_ncache_set_str(struct sss_nc_ctx *ctx, char *str,
-                              bool permanent, bool is_local)
+                              bool permanent, bool use_local_negative)
 {
     TDB_DATA key;
     TDB_DATA data;
@@ -157,15 +157,16 @@ static int sss_ncache_set_str(struct sss_nc_ctx *ctx, char *str,
     if (permanent) {
         timest = talloc_strdup(ctx, "0");
     } else {
-        if (is_local == true && ctx->local_timeout > 0) {
-            timell = (unsigned long long int)time(NULL) + ctx->local_timeout;
+        if (use_local_negative == true && ctx->local_timeout > ctx->timeout) {
+            timell = ctx->local_timeout;
         } else {
-            if (ctx->timeout > 0) {
-                timell = (unsigned long long int)time(NULL) + ctx->timeout;
-            } else {
+            /* EOK is tested in cwrap based unit test */
+            if (ctx->timeout == 0) {
                 return EOK;
             }
+            timell = ctx->timeout;
         }
+        timell += (unsigned long long int)time(NULL);
         timest = talloc_asprintf(ctx, "%llu", timell);
     }
     if (!timest) return ENOMEM;
@@ -457,7 +458,7 @@ int sss_ncache_check_cert(struct sss_nc_ctx *ctx, const char *cert)
 static int sss_ncache_set_user_int(struct sss_nc_ctx *ctx, bool permanent,
                                    const char *domain, const char *name)
 {
-    bool is_local;
+    bool use_local_negative = false;
     char *str;
     int ret;
 
@@ -466,8 +467,10 @@ static int sss_ncache_set_user_int(struct sss_nc_ctx *ctx, bool permanent,
     str = talloc_asprintf(ctx, "%s/%s/%s", NC_USER_PREFIX, domain, name);
     if (!str) return ENOMEM;
 
-    is_local = is_user_local_by_name(name);
-    ret = sss_ncache_set_str(ctx, str, permanent, is_local);
+    if (ctx->local_timeout > 0) {
+        use_local_negative = is_user_local_by_name(name);
+    }
+    ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);
 
     talloc_free(str);
     return ret;
@@ -476,7 +479,7 @@ static int sss_ncache_set_user_int(struct sss_nc_ctx *ctx, bool permanent,
 static int sss_ncache_set_group_int(struct sss_nc_ctx *ctx, bool permanent,
                                     const char *domain, const char *name)
 {
-    bool is_local;
+    bool use_local_negative = false;
     char *str;
     int ret;
 
@@ -485,8 +488,10 @@ static int sss_ncache_set_group_int(struct sss_nc_ctx *ctx, bool permanent,
     str = talloc_asprintf(ctx, "%s/%s/%s", NC_GROUP_PREFIX, domain, name);
     if (!str) return ENOMEM;
 
-    is_local = is_group_local_by_name(name);
-    ret = sss_ncache_set_str(ctx, str, permanent, is_local);
+    if (ctx->local_timeout > 0) {
+        use_local_negative = is_group_local_by_name(name);
+    }
+    ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);
 
     talloc_free(str);
     return ret;
@@ -550,7 +555,7 @@ int sss_ncache_set_netgr(struct sss_nc_ctx *ctx, bool permanent,
 int sss_ncache_set_uid(struct sss_nc_ctx *ctx, bool permanent,
                        struct sss_domain_info *dom, uid_t uid)
 {
-    bool is_local;
+    bool use_local_negative = false;
     char *str;
     int ret;
 
@@ -562,8 +567,10 @@ int sss_ncache_set_uid(struct sss_nc_ctx *ctx, bool permanent,
     }
     if (!str) return ENOMEM;
 
-    is_local = is_user_local_by_uid(uid);
-    ret = sss_ncache_set_str(ctx, str, permanent, is_local);
+    if (ctx->local_timeout > 0) {
+        use_local_negative = is_user_local_by_uid(uid);
+    }
+    ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);
 
     talloc_free(str);
     return ret;
@@ -572,7 +579,7 @@ int sss_ncache_set_uid(struct sss_nc_ctx *ctx, bool permanent,
 int sss_ncache_set_gid(struct sss_nc_ctx *ctx, bool permanent,
                        struct sss_domain_info *dom, gid_t gid)
 {
-    bool is_local;
+    bool use_local_negative = false;
     char *str;
     int ret;
 
@@ -584,8 +591,10 @@ int sss_ncache_set_gid(struct sss_nc_ctx *ctx, bool permanent,
     }
     if (!str) return ENOMEM;
 
-    is_local = is_group_local_by_gid(gid);
-    ret = sss_ncache_set_str(ctx, str, permanent, is_local);
+    if (ctx->local_timeout > 0) {
+        use_local_negative = is_group_local_by_gid(gid);
+    }
+    ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);
 
     talloc_free(str);
     return ret;
-- 
2.4.11