From ff71a9ad628ec66e36ccc7c9c49c1306fbe0d25c Mon Sep 17 00:00:00 2001 From: Pavel Reichl Date: Thu, 30 Oct 2014 17:02:45 +0000 Subject: [PATCH 53/64] NSS: disable midpoint refresh for netgroups MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Disable midpoint refresh for netgroups if periodical refresh of expired netgroups is enabled (refresh_expired_interval) Resolves: https://fedorahosted.org/sssd/ticket/2102 Reviewed-by: Pavel Březina --- src/responder/nss/nsssrv_cmd.c | 57 +++++++++++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 14 deletions(-) diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index 9fca644be164e682f787bda61ea39afa8b703874..4ac5eb91eab80291e60afad2bf9c65edfbc21e7d 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -559,6 +559,25 @@ static int nss_cmd_getpw_send_reply(struct nss_dom_ctx *dctx, bool filter) return EOK; } +/* Currently only refreshing expired netgroups is supported. */ +static bool +is_refreshed_on_bg(int req_type, + enum sss_dp_acct_type refresh_expired_interval) +{ + if (refresh_expired_interval == 0) { + return false; + } + + switch (req_type) { + case SSS_DP_NETGR: + return true; + default: + return false; + } + + return false; +} + static void nsssrv_dp_send_acct_req_done(struct tevent_req *req); /* FIXME: do not check res->count, but get in a msgs and check in parent */ @@ -585,25 +604,35 @@ errno_t check_cache(struct nss_dom_ctx *dctx, if ((req_type == SSS_DP_USER || req_type == SSS_DP_NETGR) && (res->count > 1)) { DEBUG(SSSDBG_CRIT_FAILURE, - "getpwXXX call returned more than one result!" - " DB Corrupted?\n"); + "getpwXXX call returned more than one result! DB Corrupted?\n"); return ENOENT; } - /* if we have any reply let's check cache validity */ + /* if we have any reply let's check cache validity, but ignore netgroups + * if refresh_expired_interval is set (which implies that another method + * is used to refresh netgroups) + */ if (res->count > 0) { - if (req_type == SSS_DP_INITGROUPS) { - cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0], - SYSDB_INITGR_EXPIRE, 1); - } - if (cacheExpire == 0) { - cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0], - SYSDB_CACHE_EXPIRE, 0); - } + if (is_refreshed_on_bg(req_type, + dctx->domain->refresh_expired_interval)) { + ret = EOK; + } else { + if (req_type == SSS_DP_INITGROUPS) { + cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0], + SYSDB_INITGR_EXPIRE, + 1); + } + if (cacheExpire == 0) { + cacheExpire = ldb_msg_find_attr_as_uint64(res->msgs[0], + SYSDB_CACHE_EXPIRE, + 0); + } - /* if we have any reply let's check cache validity */ - ret = sss_cmd_check_cache(res->msgs[0], nctx->cache_refresh_percent, - cacheExpire); + /* if we have any reply let's check cache validity */ + ret = sss_cmd_check_cache(res->msgs[0], + nctx->cache_refresh_percent, + cacheExpire); + } if (ret == EOK) { DEBUG(SSSDBG_TRACE_FUNC, "Cached entry is valid, returning..\n"); return EOK; -- 1.9.3