mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 01:41:14 -06:00
78ad1cfe4f
Refactor nsswitch operations in ipa-extdom-extop plugin to allow use of timeout-enabled nsswitch calls provided by libsss_nss_idmap. Standard POSIX nsswitch API has no way to cancel requests which may cause ipa-extdom-extop requests to hang far too long and potentially exhaust LDAP server workers. In addition, glibc nsswitch API iterates through all nsswitch modules one by one and with multiple parallel requests a lock up may happen in an unrelated nsswitch module like nss_files.so.2. A solution to the latter issue is to directly load nss_sss.so.2 plugin and utilize it. This, however, does not solve a problem with lack of cancellable API. With SSSD 1.16.1, libsss_nss_idmap provides a timeout-enabled variant of nsswitch API that is directly integrated with SSSD client side machinery used by nss_sss.so.2. As result, this API can be used instead of loading nss_sss.so.2 directly. To support older SSSD version, both direct loading of nss_sss.so.2 and new timeout-enabled API are supported by this changeset. An API to abstract both is designed to be a mix between internal glibc nsswitch API and external nsswitch API that libsss_nss_idmap mimics. API does not expose per-call timeout. Instead, it allows to set a timeout per nsswitch operation context to reduce requirements on information a caller has to maintain. A choice which API to use is made at configure time. In order to test the API, a cmocka test is updated to explicitly load nss_files.so.2 as a backend. Since use of nss_sss.so.2 would always depend on availablility of SSSD, predictable testing would not be possible without it otherwise. Also, cmocka test does not use nss_wrapper anymore because nss_wrapper overrides higher level glibc nsswitch API while we are loading an individual nsswitch module directly. As result, cmocka test overrides fopen() call used by nss_files.so.2 to load /etc/passwd and /etc/group. An overridden version changes paths to /etc/passwd and /etc/group to a local test_data/passwd and test_data/group. This way we can continue testing a backend API for ipa-extdom-extop with the same data as with nss_wrapper. Fixes https://pagure.io/freeipa/issue/5464 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
80 lines
3.2 KiB
C
80 lines
3.2 KiB
C
/*
|
|
* Copyright 2017 Red Hat, Inc.
|
|
*
|
|
* This Program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; version 2 of the License.
|
|
*
|
|
* This Program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this Program; if not, write to the
|
|
*
|
|
* Free Software Foundation, Inc.
|
|
* 59 Temple Place, Suite 330
|
|
* Boston, MA 02111-1307 USA
|
|
*
|
|
*/
|
|
|
|
#ifndef BACK_EXTDOM_H
|
|
#define BACK_EXTDOM_H
|
|
#include <unistd.h>
|
|
#include <pwd.h>
|
|
#include <grp.h>
|
|
|
|
/* Possible results of lookup using a nss_* function.
|
|
* Note: don't include nss.h as its path gets overriden by NSS library */
|
|
enum nss_status {
|
|
NSS_STATUS_TRYAGAIN = -2,
|
|
NSS_STATUS_UNAVAIL,
|
|
NSS_STATUS_NOTFOUND,
|
|
NSS_STATUS_SUCCESS,
|
|
NSS_STATUS_RETURN
|
|
};
|
|
|
|
/* NSS backend operations implemented using either nss_sss.so.2 or libsss_nss_idmap API */
|
|
struct nss_ops_ctx;
|
|
|
|
int back_extdom_init_context(struct nss_ops_ctx **nss_context);
|
|
void back_extdom_free_context(struct nss_ops_ctx **nss_context);
|
|
void back_extdom_set_timeout(struct nss_ops_ctx *nss_context,
|
|
unsigned int timeout);
|
|
void back_extdom_evict_user(struct nss_ops_ctx *nss_context,
|
|
const char *name);
|
|
void back_extdom_evict_group(struct nss_ops_ctx *nss_context,
|
|
const char *name);
|
|
|
|
enum nss_status back_extdom_getpwnam(struct nss_ops_ctx *nss_context,
|
|
const char *name, struct passwd *pwd,
|
|
char *buffer, size_t buflen,
|
|
struct passwd **result,
|
|
int *lerrno);
|
|
|
|
enum nss_status back_extdom_getpwuid(struct nss_ops_ctx *nss_context,
|
|
uid_t uid, struct passwd *pwd,
|
|
char *buffer, size_t buflen,
|
|
struct passwd **result,
|
|
int *lerrno);
|
|
|
|
enum nss_status back_extdom_getgrnam(struct nss_ops_ctx *nss_context,
|
|
const char *name, struct group *grp,
|
|
char *buffer, size_t buflen,
|
|
struct group **result,
|
|
int *lerrno);
|
|
|
|
enum nss_status back_extdom_getgrgid(struct nss_ops_ctx *nss_context,
|
|
gid_t gid, struct group *grp,
|
|
char *buffer, size_t buflen,
|
|
struct group **result,
|
|
int *lerrno);
|
|
|
|
enum nss_status back_extdom_getgrouplist(struct nss_ops_ctx *nss_context,
|
|
const char *name, gid_t group,
|
|
gid_t *groups, int *ngroups,
|
|
int *lerrno);
|
|
|
|
#endif /* BACK_EXTDOM_H */
|