From a8e75bbb77e15e3a42adb2d30933cf9e1edd2f0b Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Tue, 11 Jun 2024 10:50:51 +0200 Subject: [PATCH] ipa_sidgen: Allow sidgen_task to continue after finding issues find_sid_for_ldap_entry could fail in several ways if a Posix ID can not be converted to an unused SID. This could happen for example for ducplicate IDs or user/group out of range. This change enables ipa_sidgen_task to continue in the error case to try to convert the entries without errors. The error messages have been extended to additionally show the DN string for the bad entries. Fixes: https://pagure.io/freeipa/issue/9618 Signed-off-by: Thomas Woerner Reviewed-By: Alexander Bokovoy --- .../ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c | 11 ++++++----- .../ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c | 11 ++++++++--- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c index cb763ebf8..13f4de541 100644 --- a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c +++ b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c @@ -491,7 +491,7 @@ int find_sid_for_ldap_entry(struct slapi_entry *entry, } if (uid_number >= UINT32_MAX || gid_number >= UINT32_MAX) { - LOG_FATAL("ID value too large.\n"); + LOG_FATAL("ID value too large on entry [%s].\n", dn_str); ret = LDAP_CONSTRAINT_VIOLATION; goto done; } @@ -508,7 +508,7 @@ int find_sid_for_ldap_entry(struct slapi_entry *entry, &has_posix_group, &has_ipa_id_object); if (ret != 0) { - LOG_FATAL("Cannot determine objectclasses.\n"); + LOG_FATAL("Cannot determine objectclasses on entry [%s].\n", dn_str); goto done; } @@ -522,15 +522,16 @@ int find_sid_for_ldap_entry(struct slapi_entry *entry, id = (uid_number != 0) ? uid_number : gid_number; objectclass_to_add = NULL; } else { - LOG_FATAL("Inconsistent objectclasses and attributes, nothing to do.\n"); + LOG_FATAL("Inconsistent objectclasses and attributes on entry " + "[%s], nothing to do.\n", dn_str); ret = 0; goto done; } ret = find_sid_for_id(id, plugin_id, base_dn, dom_sid, ranges, &sid); if (ret != 0) { - LOG_FATAL("Cannot convert Posix ID [%lu] into an unused SID.\n", - (unsigned long) id); + LOG_FATAL("Cannot convert Posix ID [%lu] into an unused SID on " + "entry [%s].\n", (unsigned long) id, dn_str); goto done; } diff --git a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c index 007b1c945..67979cb9f 100644 --- a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c +++ b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c @@ -89,7 +89,7 @@ static void free_pblock(void *arg) static int do_work(struct worker_ctx *worker_ctx) { Slapi_PBlock *pb; - int ret; + int ret, failures = 0; size_t c; char *filter = NULL; char *attrs[] = { OBJECTCLASS, UID_NUMBER, GID_NUMBER, NULL }; @@ -151,8 +151,7 @@ static int do_work(struct worker_ctx *worker_ctx) worker_ctx->base_dn, worker_ctx->dom_sid, worker_ctx->ranges); if (ret != 0) { - LOG_FATAL("Cannot add SID to existing entry.\n"); - goto done; + failures++; } if (worker_ctx->delay != 0) { @@ -162,6 +161,12 @@ static int do_work(struct worker_ctx *worker_ctx) } }; + ret = failures; + if (ret > 0) { + LOG_FATAL("Finished with %d failures, please check the log.\n", + failures); + } + done: slapi_ch_free_string(&filter); pthread_cleanup_pop(1);