summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--src/responder/common/responder.h11
-rw-r--r--src/responder/nss/nsssrv_cmd.c995
2 files changed, 717 insertions, 289 deletions
diff --git a/src/responder/common/responder.h b/src/responder/common/responder.h
index deb1e5a3c..0f59ffd43 100644
--- a/src/responder/common/responder.h
+++ b/src/responder/common/responder.h
@@ -92,6 +92,11 @@ struct resp_ctx {
void *pvt_ctx;
};
+/* Needed for the NSS responder */
+struct getent_ref_tracker {
+ void *pvt;
+};
+
struct cli_ctx {
struct tevent_context *ev;
struct resp_ctx *rctx;
@@ -104,6 +109,12 @@ struct cli_ctx {
int32_t client_euid;
int32_t client_egid;
int32_t client_pid;
+
+ int pwent_dom_idx;
+ int pwent_cur;
+
+ int grent_dom_idx;
+ int grent_cur;
};
struct sss_cmd_table {
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 719608c0c..6df705fb6 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -35,18 +35,20 @@ struct nss_cmd_ctx {
bool check_next;
bool enum_cached;
+ int saved_dom_idx;
+ int saved_cur;
};
struct dom_ctx {
struct sss_domain_info *domain;
struct ldb_result *res;
- int cur;
};
struct getent_ctx {
struct dom_ctx *doms;
int num;
- int cur;
+ bool ready;
+ struct setent_req_list *reqs;
};
struct nss_dom_ctx {
@@ -172,6 +174,63 @@ static int nss_cmd_done(struct nss_cmd_ctx *cmdctx, int ret)
return EOK;
}
+/***************************
+ * Enumeration procedures *
+ ***************************/
+
+struct setent_req_list {
+ struct setent_req_list *prev;
+ struct setent_req_list *next;
+ struct getent_ctx *getent_ctx;
+
+ struct tevent_req *req;
+};
+
+static int
+setent_remove_ref(TALLOC_CTX *ctx);
+static errno_t
+setent_add_ref(TALLOC_CTX *memctx,
+ struct getent_ctx *getent_ctx,
+ struct tevent_req *req)
+{
+ struct setent_req_list *entry =
+ talloc_zero(memctx, struct setent_req_list);
+ if (!entry) {
+ return ENOMEM;
+ }
+
+ entry->req = req;
+ entry->getent_ctx = getent_ctx;
+ DLIST_ADD_END(getent_ctx->reqs, entry, struct setent_req_list *);
+
+ talloc_set_destructor((TALLOC_CTX *)entry, setent_remove_ref);
+ return EOK;
+}
+
+static int
+setent_remove_ref(TALLOC_CTX *ctx)
+{
+ struct setent_req_list *entry =
+ talloc_get_type(ctx, struct setent_req_list);
+ DLIST_REMOVE(entry->getent_ctx->reqs, entry);
+ return 0;
+}
+
+struct setent_ctx {
+ struct cli_ctx *client;
+ struct nss_ctx *nctx;
+ struct nss_dom_ctx *dctx;
+ struct getent_ctx *getent_ctx;
+};
+
+struct setent_step_ctx {
+ struct nss_ctx *nctx;
+ struct nss_dom_ctx *dctx;
+ struct getent_ctx *getent_ctx;
+ struct resp_ctx *rctx;
+ bool enum_cached;
+};
+
/****************************************************************************
* PASSWD db related functions
***************************************************************************/
@@ -944,32 +1003,176 @@ done:
* the last returned user.
*/
static int nss_cmd_getpwent_immediate(struct nss_cmd_ctx *cmdctx);
+struct tevent_req * nss_cmd_setpwent_send(TALLOC_CTX *mem_ctx,
+ struct cli_ctx *client);
+static void nss_cmd_setpwent_done(struct tevent_req *req);
+static int nss_cmd_setpwent(struct cli_ctx *cctx)
+{
+ struct nss_cmd_ctx *cmdctx;
+ struct tevent_req *req;
+ errno_t ret = EOK;
-static void nss_cmd_getpwent_dp_callback(uint16_t err_maj, uint32_t err_min,
- const char *err_msg, void *ptr);
+ cmdctx = talloc_zero(cctx, struct nss_cmd_ctx);
+ if (!cmdctx) {
+ return ENOMEM;
+ }
+ cmdctx->cctx = cctx;
+
+ req = nss_cmd_setpwent_send(cmdctx, cctx);
+ if (!req) {
+ DEBUG(0, ("Fatal error calling nss_cmd_setpwent_send\n"));
+ ret = EIO;
+ goto done;
+ }
+ tevent_req_set_callback(req, nss_cmd_setpwent_done, cmdctx);
+
+done:
+ return nss_cmd_done(cmdctx, ret);
+}
-static int nss_cmd_getpwent_search(struct nss_dom_ctx *dctx)
+static errno_t nss_cmd_setpwent_step(struct setent_step_ctx *step_ctx);
+struct tevent_req *nss_cmd_setpwent_send(TALLOC_CTX *mem_ctx,
+ struct cli_ctx *client)
{
- struct nss_cmd_ctx *cmdctx = dctx->cmdctx;
- struct sss_domain_info *dom = dctx->domain;
- struct cli_ctx *cctx = cmdctx->cctx;
- struct sysdb_ctx *sysdb;
- struct ldb_result *res;
- struct getent_ctx *pctx;
+ errno_t ret;
struct nss_ctx *nctx;
- int timeout;
- int ret;
+ struct tevent_req *req;
+ struct setent_ctx *state;
+ struct sss_domain_info *dom;
+ struct setent_step_ctx *step_ctx;
+ bool enum_cached = false;
+ time_t now = time(NULL);
- nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
- pctx = nctx->pctx;
- if (pctx == NULL) {
- pctx = talloc_zero(nctx, struct getent_ctx);
- if (!pctx) {
- return ENOMEM;
+ DEBUG(4, ("Received setpwent request\n"));
+ nctx = talloc_get_type(client->rctx->pvt_ctx, struct nss_ctx);
+
+ /* Reset the read pointers */
+ client->pwent_dom_idx = 0;
+ client->pwent_cur = 0;
+
+ req = tevent_req_create(mem_ctx, &state, struct setent_ctx);
+ if (!req) {
+ DEBUG(0, ("Could not create tevent request for setpwent\n"));
+ return NULL;
+ }
+
+ state->nctx = nctx;
+ state->client = client;
+
+ /* do not query backends if we have a recent enumeration */
+ if (nctx->enum_cache_timeout) {
+ if (nctx->last_user_enum + nctx->enum_cache_timeout > now) {
+ enum_cached = true;
+ }
+ }
+
+ state->dctx = talloc_zero(state, struct nss_dom_ctx);
+ if (!state->dctx) {
+ ret = ENOMEM;
+ goto error;
+ }
+
+ /* check if enumeration is enabled in any domain */
+ for (dom = client->rctx->domains; dom; dom = dom->next) {
+ if (dom->enumerate != 0) break;
+ }
+ state->dctx->domain = dom;
+
+ if (state->dctx->domain == NULL) {
+ DEBUG(2, ("Enumeration disabled on all domains!\n"));
+ ret = ENOENT;
+ goto error;
+ }
+
+ state->dctx->check_provider =
+ NEED_CHECK_PROVIDER(state->dctx->domain->provider);
+
+ /* Is the result context already available */
+ if (state->nctx->pctx) {
+ if (state->nctx->pctx->ready) {
+ /* All of the necessary data is in place
+ * We can return now, getpwent requests will work at this point
+ */
+ tevent_req_done(req);
+ tevent_req_post(req, state->nctx->rctx->ev);
+ }
+ else {
+ /* Object is still being constructed
+ * Register for notification when it's
+ * ready.
+ */
+ ret = setent_add_ref(state->client, state->nctx->pctx, req);
+ if (ret != EOK) {
+ talloc_free(req);
+ return NULL;
+ }
}
- nctx->pctx = pctx;
+ return req;
}
+ /* Create a new result context
+ * We are creating it on the nss_ctx so that it doesn't
+ * go away if the original request does. We will delete
+ * it when the refcount goes to zero;
+ */
+ state->nctx->pctx = talloc_zero(nctx, struct getent_ctx);
+ if (!state->nctx->pctx) {
+ ret = ENOMEM;
+ goto error;
+ }
+ state->getent_ctx = nctx->pctx;
+
+ /* Add a callback reference for ourselves */
+ setent_add_ref(state->client, state->nctx->pctx, req);
+
+ /* ok, start the searches */
+ step_ctx = talloc_zero(state->getent_ctx, struct setent_step_ctx);
+ if (!step_ctx) {
+ ret = ENOMEM;
+ goto error;
+ }
+
+ /* Steal the dom_ctx onto the step_ctx so it doesn't go out of scope if
+ * this request is canceled while other requests are in-progress.
+ */
+ step_ctx->dctx = talloc_steal(step_ctx, state->dctx);
+ step_ctx->nctx = state->nctx;
+ step_ctx->getent_ctx = state->getent_ctx;
+ step_ctx->rctx = client->rctx;
+ step_ctx->enum_cached = enum_cached;
+
+ ret = nss_cmd_setpwent_step(step_ctx);
+ if (ret != EOK) goto error;
+
+ return req;
+
+ error:
+ tevent_req_error(req, ret);
+ tevent_req_post(req, client->rctx->ev);
+ return req;
+}
+
+static void nss_cmd_setpwent_dp_callback(uint16_t err_maj, uint32_t err_min,
+ const char *err_msg, void *ptr);
+static void setpwent_result_timeout(struct tevent_context *ev,
+ struct tevent_timer *te,
+ struct timeval current_time,
+ void *pvt);
+static errno_t nss_cmd_setpwent_step(struct setent_step_ctx *step_ctx)
+{
+ errno_t ret;
+ struct sss_domain_info *dom = step_ctx->dctx->domain;
+ struct resp_ctx *rctx = step_ctx->rctx;
+ struct nss_dom_ctx *dctx = step_ctx->dctx;
+ struct getent_ctx *pctx = step_ctx->getent_ctx;
+ struct nss_ctx *nctx = step_ctx->nctx;
+ struct sysdb_ctx *sysdb;
+ struct ldb_result *res;
+ struct setent_req_list *req;
+ struct timeval tv;
+ struct tevent_timer *te;
+ int timeout;
+
while (dom) {
while (dom && dom->enumerate == 0) {
dom = dom->next;
@@ -980,7 +1183,7 @@ static int nss_cmd_getpwent_search(struct nss_dom_ctx *dctx)
if (dom != dctx->domain) {
/* make sure we reset the check_provider flag when we check
* a new domain */
- if (cmdctx->enum_cached) {
+ if (step_ctx->enum_cached) {
dctx->check_provider = false;
} else {
dctx->check_provider = NEED_CHECK_PROVIDER(dom->provider);
@@ -990,9 +1193,9 @@ static int nss_cmd_getpwent_search(struct nss_dom_ctx *dctx)
/* make sure to update the dctx if we changed domain */
dctx->domain = dom;
- DEBUG(4, ("Requesting info for domain [%s]\n", dom->name));
+ DEBUG(6, ("Requesting info for domain [%s]\n", dom->name));
- ret = sysdb_get_ctx_from_list(cctx->rctx->db_list, dom, &sysdb);
+ ret = sysdb_get_ctx_from_list(rctx->db_list, dom, &sysdb);
if (ret != EOK) {
DEBUG(0, ("Fatal: Sysdb CTX not found for this domain!\n"));
return EIO;
@@ -1001,10 +1204,12 @@ static int nss_cmd_getpwent_search(struct nss_dom_ctx *dctx)
/* if this is a caching provider (or if we haven't checked the cache
* yet) then verify that the cache is uptodate */
if (dctx->check_provider) {
+ /* Only do this once per provider */
dctx->check_provider = false;
timeout = SSS_CLI_SOCKET_TIMEOUT;
- ret = sss_dp_send_acct_req(cctx->rctx, cmdctx,
- nss_cmd_getpwent_dp_callback, dctx,
+
+ ret = sss_dp_send_acct_req(rctx, step_ctx,
+ nss_cmd_setpwent_dp_callback, step_ctx,
timeout, dom->name, true,
SSS_DP_USER, NULL, 0);
if (ret == EOK) {
@@ -1030,7 +1235,7 @@ static int nss_cmd_getpwent_search(struct nss_dom_ctx *dctx)
continue;
}
- pctx->doms = talloc_realloc(pctx, pctx->doms,
+ nctx->pctx->doms = talloc_realloc(pctx, pctx->doms,
struct dom_ctx, pctx->num +1);
if (!pctx->doms) {
talloc_free(pctx);
@@ -1038,41 +1243,65 @@ static int nss_cmd_getpwent_search(struct nss_dom_ctx *dctx)
return ENOMEM;
}
- pctx->doms[pctx->num].domain = dctx->domain;
- pctx->doms[pctx->num].res = talloc_steal(pctx->doms, res);
- pctx->doms[pctx->num].cur = 0;
+ nctx->pctx->doms[pctx->num].domain = dctx->domain;
+ nctx->pctx->doms[pctx->num].res = talloc_steal(pctx->doms, res);
- pctx->num++;
+ nctx->pctx->num++;
/* do not reply until all domain searches are done */
dom = dom->next;
}
- /* set cache mark */
- nctx->last_user_enum = time(NULL);
+ /* We've finished all our lookups
+ * The result object is now safe to read.
+ */
+ nctx->pctx->ready = true;
- if (cmdctx->immediate) {
- /* this was a getpwent call w/o setpwent,
- * return immediately one result */
- return nss_cmd_getpwent_immediate(cmdctx);
+ /* Set up a lifetime timer for this result object
+ * We don't want this result object to outlive the
+ * enum cache refresh timeout
+ */
+ tv = tevent_timeval_current_ofs(nctx->enum_cache_timeout, 0);
+ te = tevent_add_timer(rctx->ev, nctx->pctx, tv,
+ setpwent_result_timeout, nctx);
+ if (!te) {
+ DEBUG(0, ("Could not set up life timer for setpwent result object. "
+ "Entries may become stale.\n"));
}
- /* create response packet */
- ret = sss_packet_new(cctx->creq, 0,
- sss_packet_get_cmd(cctx->creq->in),
- &cctx->creq->out);
- if (ret == EOK) {
- sss_cmd_done(cctx, cmdctx);
+ /* Notify the waiting clients */
+ while (nctx->pctx->reqs) {
+ tevent_req_done(nctx->pctx->reqs->req);
+ /* Freeing each entry in the list removes it from the dlist */
+ req = nctx->pctx->reqs;
+ nctx->pctx->reqs = nctx->pctx->reqs->next;
+ talloc_free(req);
}
- return ret;
+ return EOK;
}
-static void nss_cmd_getpwent_dp_callback(uint16_t err_maj, uint32_t err_min,
+static void setpwent_result_timeout(struct tevent_context *ev,
+ struct tevent_timer *te,
+ struct timeval current_time,
+ void *pvt)
+{
+ struct nss_ctx *nctx = talloc_get_type(pvt, struct nss_ctx);
+
+ DEBUG(1, ("setpwent result object has expired. Cleaning up.\n"));
+
+ /* Free the passwd enumeration context.
+ * If additional getpwent requests come in, they will invoke
+ * an implicit setpwent and refresh the result object.
+ */
+ talloc_zfree(nctx->pctx);
+}
+
+static void nss_cmd_setpwent_dp_callback(uint16_t err_maj, uint32_t err_min,
const char *err_msg, void *ptr)
{
- struct nss_dom_ctx *dctx = talloc_get_type(ptr, struct nss_dom_ctx);
- struct nss_cmd_ctx *cmdctx = dctx->cmdctx;
- struct cli_ctx *cctx = cmdctx->cctx;
+ struct setent_step_ctx *step_ctx =
+ talloc_get_type(ptr, struct setent_step_ctx);
+ struct getent_ctx *pctx = step_ctx->nctx->pctx;
int ret;
if (err_maj) {
@@ -1082,84 +1311,117 @@ static void nss_cmd_getpwent_dp_callback(uint16_t err_maj, uint32_t err_min,
(unsigned int)err_maj, (unsigned int)err_min, err_msg));
}
- ret = nss_cmd_getpwent_search(dctx);
-
+ ret = nss_cmd_setpwent_step(step_ctx);
if (ret) {
- NSS_CMD_FATAL_ERROR(cctx);
+ /* Notify any waiting processes of failure */
+ while(step_ctx->nctx->pctx->reqs) {
+ tevent_req_error(pctx->reqs->req, ret);
+ /* Freeing each entry in the list removes it from the dlist */
+ talloc_free(pctx->reqs);
+ }
}
}
-static int nss_cmd_setpwent_ext(struct cli_ctx *cctx, bool immediate)
+static errno_t nss_cmd_setpwent_recv(struct tevent_req *req)
{
- struct sss_domain_info *dom;
- struct nss_cmd_ctx *cmdctx;
- struct nss_dom_ctx *dctx;
- struct nss_ctx *nctx;
- time_t now = time(NULL);
- int ret;
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+ return EOK;
+}
- DEBUG(4, ("Requesting info for all users\n"));
+static void nss_cmd_setpwent_done(struct tevent_req *req)
+{
+ errno_t ret;
+ struct nss_cmd_ctx *cmdctx =
+ tevent_req_callback_data(req, struct nss_cmd_ctx);
- nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
- talloc_free(nctx->pctx);
- nctx->pctx = NULL;
+ ret = nss_cmd_setpwent_recv(req);
+ talloc_zfree(req);
+ if (ret == EOK || ret == ENOENT) {
+ /* Either we succeeded or no domains were eligible */
+ ret = sss_packet_new(cmdctx->cctx->creq, 0,
+ sss_packet_get_cmd(cmdctx->cctx->creq->in),
+ &cmdctx->cctx->creq->out);
+ if (ret == EOK) {
+ sss_cmd_done(cmdctx->cctx, cmdctx);
+ return;
+ }
+ }
- cmdctx = talloc_zero(cctx, struct nss_cmd_ctx);
+ /* Something bad happened */
+ nss_cmd_done(cmdctx, ret);
+}
+
+static void nss_cmd_implicit_setpwent_done(struct tevent_req *req);
+static int nss_cmd_getpwent(struct cli_ctx *cctx)
+{
+ struct nss_ctx *nctx;
+ struct nss_cmd_ctx *cmdctx;
+ struct tevent_req *req;
+
+ DEBUG(4, ("Requesting info for all accounts\n"));
+
+ cmdctx = talloc(cctx, struct nss_cmd_ctx);
if (!cmdctx) {
return ENOMEM;
}
cmdctx->cctx = cctx;
- cmdctx->immediate = immediate;
- dctx = talloc_zero(cmdctx, struct nss_dom_ctx);
- if (!dctx) {
- ret = ENOMEM;
- goto done;
- }
- dctx->cmdctx = cmdctx;
+ /* Save the current index and cursor locations
+ * If we end up calling setpwent implicitly, because the response object
+ * expired and has to be recreated, we want to resume from the same
+ * location.
+ */
+ cmdctx->saved_dom_idx = cctx->pwent_dom_idx;
+ cmdctx->saved_cur = cctx->pwent_cur;
- /* do not query backends if we have a recent enumeration */
- if (nctx->enum_cache_timeout) {
- if (nctx->last_user_enum + nctx->enum_cache_timeout > now) {
- cmdctx->enum_cached = true;
+ nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
+ if(!nctx->pctx || !nctx->pctx->ready) {
+ /* Make sure we invoke setpwent if it hasn't been run or is still
+ * processing from another client
+ */
+ req = nss_cmd_setpwent_send(cctx, cctx);
+ if (!req) {
+ return EIO;
}
+ tevent_req_set_callback(req, nss_cmd_implicit_setpwent_done, cmdctx);
+ return EOK;
}
- /* check if enumeration is enabled in any domain */
- for (dom = cctx->rctx->domains; dom; dom = dom->next) {
- if (dom->enumerate != 0) break;
+ return nss_cmd_getpwent_immediate(cmdctx);
+}
+
+static int nss_cmd_retpwent(struct cli_ctx *cctx, int num);
+static int nss_cmd_getpwent_immediate(struct nss_cmd_ctx *cmdctx)
+{
+ struct cli_ctx *cctx = cmdctx->cctx;
+ uint8_t *body;
+ size_t blen;
+ uint32_t num;
+ int ret;
+
+ /* get max num of entries to return in one call */
+ sss_packet_get_body(cctx->creq->in, &body, &blen);
+ if (blen != sizeof(uint32_t)) {
+ return EINVAL;
}
- dctx->domain = dom;
+ num = *((uint32_t *)body);
- if (dctx->domain == NULL) {
- DEBUG(2, ("Enumeration disabled on all domains!\n"));
- if (cmdctx->immediate) {
- ret = ENOENT;
- } else {
- ret = sss_packet_new(cctx->creq, 0,
- sss_packet_get_cmd(cctx->creq->in),
- &cctx->creq->out);
- if (ret == EOK) {
- sss_cmd_done(cctx, cmdctx);
- }
- }
- goto done;
+ /* create response packet */
+ ret = sss_packet_new(cctx->creq, 0,
+ sss_packet_get_cmd(cctx->creq->in),
+ &cctx->creq->out);
+ if (ret != EOK) {
+ return ret;
}
- dctx->check_provider = NEED_CHECK_PROVIDER(dctx->domain->provider);
+ ret = nss_cmd_retpwent(cctx, num);
- /* ok, start the searches */
- ret = nss_cmd_getpwent_search(dctx);
-done:
- return nss_cmd_done(cmdctx, ret);
-}
+ sss_packet_set_error(cctx->creq->out, ret);
+ sss_cmd_done(cctx, cmdctx);
-static int nss_cmd_setpwent(struct cli_ctx *cctx)
-{
- return nss_cmd_setpwent_ext(cctx, false);
+ return EOK;
}
-
static int nss_cmd_retpwent(struct cli_ctx *cctx, int num)
{
struct nss_ctx *nctx;
@@ -1175,26 +1437,26 @@ static int nss_cmd_retpwent(struct cli_ctx *cctx, int num)
pctx = nctx->pctx;
while (ret == ENOENT) {
- if (pctx->cur >= pctx->num) break;
+ if (cctx->pwent_dom_idx >= pctx->num) break;
- pdom = &pctx->doms[pctx->cur];
+ pdom = &pctx->doms[cctx->pwent_dom_idx];
- n = pdom->res->count - pdom->cur;
- if (n == 0 && (pctx->cur+1 < pctx->num)) {
- pctx->cur++;
- pdom = &pctx->doms[pctx->cur];
- n = pdom->res->count - pdom->cur;
+ n = pdom->res->count - cctx->pwent_cur;
+ if (n <= 0 && (cctx->pwent_dom_idx+1 < pctx->num)) {
+ cctx->pwent_dom_idx++;
+ pdom = &pctx->doms[cctx->pwent_dom_idx];
+ n = pdom->res->count - cctx->pwent_cur;
}
if (!n) break;
if (n > num) n = num;
- msgs = &(pdom->res->msgs[pdom->cur]);
+ msgs = &(pdom->res->msgs[cctx->pwent_cur]);
ret = fill_pwent(cctx->creq->out, pdom->domain, nctx, true, msgs, &n);
- pdom->cur += n;
+ cctx->pwent_cur += n;
}
none:
@@ -1204,58 +1466,35 @@ none:
return ret;
}
-static int nss_cmd_getpwent_immediate(struct nss_cmd_ctx *cmdctx)
+static void nss_cmd_implicit_setpwent_done(struct tevent_req *req)
{
- struct cli_ctx *cctx = cmdctx->cctx;
- uint8_t *body;
- size_t blen;
- uint32_t num;
- int ret;
+ errno_t ret;
+ struct nss_cmd_ctx *cmdctx =
+ tevent_req_callback_data(req, struct nss_cmd_ctx);
- /* get max num of entries to return in one call */
- sss_packet_get_body(cctx->creq->in, &body, &blen);
- if (blen != sizeof(uint32_t)) {
- return EINVAL;
- }
- num = *((uint32_t *)body);
+ ret = nss_cmd_setpwent_recv(req);
+ talloc_zfree(req);
- /* create response packet */
- ret = sss_packet_new(cctx->creq, 0,
- sss_packet_get_cmd(cctx->creq->in),
- &cctx->creq->out);
- if (ret != EOK) {
- return ret;
+ /* ENOENT is acceptable, as it just means that there were no entries
+ * to be returned. This will be handled gracefully in nss_cmd_retpwent
+ * later.
+ */
+ if (ret != EOK && ret != ENOENT) {
+ DEBUG(0, ("Implicit setpwent failed with unexpected error [%d][%s]\n",
+ ret, strerror(ret)));
+ NSS_CMD_FATAL_ERROR(cmdctx);
}
- ret = nss_cmd_retpwent(cctx, num);
-
- sss_packet_set_error(cctx->creq->out, ret);
- sss_cmd_done(cctx, cmdctx);
+ /* Restore the saved index and cursor locations */
+ cmdctx->cctx->pwent_dom_idx = cmdctx->saved_dom_idx;
+ cmdctx->cctx->pwent_cur = cmdctx->saved_cur;
- return EOK;
-}
-
-static int nss_cmd_getpwent(struct cli_ctx *cctx)
-{
- struct nss_ctx *nctx;
- struct nss_cmd_ctx *cmdctx;
-
- DEBUG(4, ("Requesting info for all accounts\n"));
-
- nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
-
- /* see if we need to trigger an implicit setpwent() */
- if (nctx->pctx == NULL) {
- return nss_cmd_setpwent_ext(cctx, true);
- }
-
- cmdctx = talloc(cctx, struct nss_cmd_ctx);
- if (!cmdctx) {
- return ENOMEM;
+ ret = nss_cmd_getpwent_immediate(cmdctx);
+ if (ret != EOK) {
+ DEBUG(0, ("Immediate retrieval failed with unexpected error "
+ "[%d][%s]\n", ret, strerror(ret)));
+ NSS_CMD_FATAL_ERROR(cmdctx);
}
- cmdctx->cctx = cctx;
-
- return nss_cmd_getpwent_immediate(cmdctx);
}
static int nss_cmd_endpwent(struct cli_ctx *cctx)
@@ -1277,9 +1516,9 @@ static int nss_cmd_endpwent(struct cli_ctx *cctx)
}
if (nctx->pctx == NULL) goto done;
- /* free results and reset */
- talloc_free(nctx->pctx);
- nctx->pctx = NULL;
+ /* Reset the indices so that subsequent requests start at zero */
+ cctx->pwent_dom_idx = 0;
+ cctx->pwent_cur = 0;
done:
sss_cmd_done(cctx, NULL);
@@ -2014,33 +2253,176 @@ done:
* even if the data is still being fetched
* - make getgrent() wait on the mutex
*/
-static int nss_cmd_getgrent_immediate(struct nss_cmd_ctx *cmdctx);
+struct tevent_req *nss_cmd_setgrent_send(TALLOC_CTX *mem_ctx,
+ struct cli_ctx *client);
+static void nss_cmd_setgrent_done(struct tevent_req *req);
+static int nss_cmd_setgrent(struct cli_ctx *cctx)
+{
+ struct nss_cmd_ctx *cmdctx;
+ struct tevent_req *req;
+ errno_t ret = EOK;
-static void nss_cmd_getgrent_dp_callback(uint16_t err_maj, uint32_t err_min,
- const char *err_msg, void *ptr);
+ cmdctx = talloc_zero(cctx, struct nss_cmd_ctx);
+ if (!cmdctx) {
+ return ENOMEM;
+ }
+ cmdctx->cctx = cctx;
+
+ req = nss_cmd_setgrent_send(cmdctx, cctx);
+ if (!req) {
+ DEBUG(0, ("Fatal error calling nss_cmd_setgrent_send\n"));
+ ret = EIO;
+ goto done;
+ }
+ tevent_req_set_callback(req, nss_cmd_setgrent_done, cmdctx);
+
+done:
+ return nss_cmd_done(cmdctx, ret);
+}
-static int nss_cmd_getgrent_search(struct nss_dom_ctx *dctx)
+static errno_t nss_cmd_setgrent_step(struct setent_step_ctx *step_ctx);
+struct tevent_req *nss_cmd_setgrent_send(TALLOC_CTX *mem_ctx,
+ struct cli_ctx *client)
{
- struct nss_cmd_ctx *cmdctx = dctx->cmdctx;
- struct sss_domain_info *dom = dctx->domain;
- struct cli_ctx *cctx = cmdctx->cctx;
- struct sysdb_ctx *sysdb;
- struct ldb_result *res;
- struct getent_ctx *gctx;
+ errno_t ret;
struct nss_ctx *nctx;
- int timeout;
- int ret;
+ struct tevent_req *req;
+ struct setent_ctx *state;
+ struct sss_domain_info *dom;
+ struct setent_step_ctx *step_ctx;
+ bool enum_cached = false;
+ time_t now = time(NULL);
- nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
- gctx = nctx->gctx;
- if (gctx == NULL) {
- gctx = talloc_zero(nctx, struct getent_ctx);
- if (!gctx) {
- return ENOMEM;
+ DEBUG(4, ("Received setgrent request\n"));
+ nctx = talloc_get_type(client->rctx->pvt_ctx, struct nss_ctx);
+
+ /* Reset the read pointers */
+ client->grent_dom_idx = 0;
+ client->grent_cur = 0;
+
+ req = tevent_req_create(mem_ctx, &state, struct setent_ctx);
+ if (!req) {
+ DEBUG(0, ("Could not create tevent request for setgrent\n"));
+ return NULL;
+ }
+
+ state->nctx = nctx;
+ state->client = client;
+
+ /* do not query backends if we have a recent enumeration */
+ if (nctx->enum_cache_timeout) {
+ if (nctx->last_user_enum + nctx->enum_cache_timeout > now) {
+ enum_cached = true;
}
- nctx->gctx = gctx;
}
+ state->dctx = talloc_zero(state, struct nss_dom_ctx);
+ if (!state->dctx) {
+ ret = ENOMEM;
+ goto error;
+ }
+
+ /* check if enumeration is enabled in any domain */
+ for (dom = client->rctx->domains; dom; dom = dom->next) {
+ if (dom->enumerate != 0) break;
+ }
+ state->dctx->domain = dom;
+
+ if (state->dctx->domain == NULL) {
+ DEBUG(2, ("Enumeration disabled on all domains!\n"));
+ ret = ENOENT;
+ goto error;
+ }
+
+ state->dctx->check_provider =
+ NEED_CHECK_PROVIDER(state->dctx->domain->provider);
+
+ /* Is the result context already available */
+ if (state->nctx->gctx) {
+ if (state->nctx->gctx->ready) {
+ /* All of the necessary data is in place
+ * We can return now, getgrent requests will work at this point
+ */
+ tevent_req_done(req);
+ tevent_req_post(req, state->nctx->rctx->ev);
+ }
+ else {
+ /* Object is still being constructed
+ * Register for notification when it's
+ * ready.
+ */
+ ret = setent_add_ref(state->client, state->nctx->gctx, req);
+ if (ret != EOK) {
+ talloc_free(req);
+ return NULL;
+ }
+ }
+ return req;
+ }
+
+ /* Create a new result context
+ * We are creating it on the nss_ctx so that it doesn't
+ * go away if the original request does. We will delete
+ * it when the refcount goes to zero;
+ */
+ state->nctx->gctx = talloc_zero(nctx, struct getent_ctx);
+ if (!state->nctx->gctx) {
+ ret = ENOMEM;
+ goto error;
+ }
+ state->getent_ctx = nctx->gctx;
+
+ /* Add a callback reference for ourselves */
+ setent_add_ref(state->client, state->nctx->gctx, req);
+
+ /* ok, start the searches */
+ step_ctx = talloc_zero(state->getent_ctx, struct setent_step_ctx);
+ if (!step_ctx) {
+ ret = ENOMEM;
+ goto error;
+ }
+
+ /* Steal the dom_ctx onto the step_ctx so it doesn't go out of scope if
+ * this request is canceled while other requests are in-progress.
+ */
+ step_ctx->dctx = talloc_steal(step_ctx, state->dctx);
+ step_ctx->nctx = state->nctx;
+ step_ctx->getent_ctx = state->getent_ctx;
+ step_ctx->rctx = client->rctx;
+ step_ctx->enum_cached = enum_cached;
+
+ ret = nss_cmd_setgrent_step(step_ctx);
+ if (ret != EOK) goto error;
+
+ return req;
+
+ error:
+ tevent_req_error(req, ret);
+ tevent_req_post(req, client->rctx->ev);
+ return req;
+}
+
+static void nss_cmd_setgrent_dp_callback(uint16_t err_maj, uint32_t err_min,
+ const char *err_msg, void *ptr);
+static void setgrent_result_timeout(struct tevent_context *ev,
+ struct tevent_timer *te,
+ struct timeval current_time,
+ void *pvt);
+static errno_t nss_cmd_setgrent_step(struct setent_step_ctx *step_ctx)
+{
+ errno_t ret;
+ struct sss_domain_info *dom = step_ctx->dctx->domain;
+ struct resp_ctx *rctx = step_ctx->rctx;
+ struct nss_dom_ctx *dctx = step_ctx->dctx;
+ struct getent_ctx *gctx = step_ctx->getent_ctx;
+ struct nss_ctx *nctx = step_ctx->nctx;
+ struct sysdb_ctx *sysdb;
+ struct ldb_result *res;
+ struct setent_req_list *req;
+ struct timeval tv;
+ struct tevent_timer *te;
+ int timeout;
+
while (dom) {
while (dom && dom->enumerate == 0) {
dom = dom->next;
@@ -2051,7 +2433,7 @@ static int nss_cmd_getgrent_search(struct nss_dom_ctx *dctx)
if (dom != dctx->domain) {
/* make sure we reset the check_provider flag when we check
* a new domain */
- if (cmdctx->enum_cached) {
+ if (step_ctx->enum_cached) {
dctx->check_provider = false;
} else {
dctx->check_provider = NEED_CHECK_PROVIDER(dom->provider);
@@ -2061,9 +2443,9 @@ static int nss_cmd_getgrent_search(struct nss_dom_ctx *dctx)
/* make sure to update the dctx if we changed domain */
dctx->domain = dom;
- DEBUG(4, ("Requesting info for domain [%s]\n", dom->name));
+ DEBUG(6, ("Requesting info for domain [%s]\n", dom->name));
- ret = sysdb_get_ctx_from_list(cctx->rctx->db_list, dom, &sysdb);
+ ret = sysdb_get_ctx_from_list(rctx->db_list, dom, &sysdb);
if (ret != EOK) {
DEBUG(0, ("Fatal: Sysdb CTX not found for this domain!\n"));
return EIO;
@@ -2072,10 +2454,12 @@ static int nss_cmd_getgrent_search(struct nss_dom_ctx *dctx)
/* if this is a caching provider (or if we haven't checked the cache
* yet) then verify that the cache is uptodate */
if (dctx->check_provider) {
+ /* Only do this once per provider */
dctx->check_provider = false;
timeout = SSS_CLI_SOCKET_TIMEOUT;
- ret = sss_dp_send_acct_req(cctx->rctx, cmdctx,
- nss_cmd_getgrent_dp_callback, dctx,
+
+ ret = sss_dp_send_acct_req(rctx, step_ctx,
+ nss_cmd_setgrent_dp_callback, step_ctx,
timeout, dom->name, true,
SSS_DP_GROUP, NULL, 0);
if (ret == EOK) {
@@ -2101,8 +2485,7 @@ static int nss_cmd_getgrent_search(struct nss_dom_ctx *dctx)
continue;
}
-
- gctx->doms = talloc_realloc(gctx, gctx->doms,
+ nctx->gctx->doms = talloc_realloc(gctx, gctx->doms,
struct dom_ctx, gctx->num +1);
if (!gctx->doms) {
talloc_free(gctx);
@@ -2110,41 +2493,65 @@ static int nss_cmd_getgrent_search(struct nss_dom_ctx *dctx)
return ENOMEM;
}
- gctx->doms[gctx->num].domain = dctx->domain;
- gctx->doms[gctx->num].res = talloc_steal(gctx->doms, res);
- gctx->doms[gctx->num].cur = 0;
+ nctx->gctx->doms[gctx->num].domain = dctx->domain;
+ nctx->gctx->doms[gctx->num].res = talloc_steal(gctx->doms, res);
- gctx->num++;
+ nctx->gctx->num++;
/* do not reply until all domain searches are done */
dom = dom->next;
}
- /* set cache mark */
- nctx->last_group_enum = time(NULL);
+ /* We've finished all our lookups
+ * The result object is now safe to read.
+ */
+ nctx->gctx->ready = true;
- if (cmdctx->immediate) {
- /* this was a getgrent call w/o setgrent,
- * return immediately one result */
- return nss_cmd_getgrent_immediate(cmdctx);
+ /* Set up a lifetime timer for this result object
+ * We don't want this result object to outlive the
+ * enum cache refresh timeout
+ */
+ tv = tevent_timeval_current_ofs(nctx->enum_cache_timeout, 0);
+ te = tevent_add_timer(rctx->ev, nctx->gctx, tv,
+ setgrent_result_timeout, nctx);
+ if (!te) {
+ DEBUG(0, ("Could not set up life timer for setgrent result object. "
+ "Entries may become stale.\n"));
}
- /* create response packet */
- ret = sss_packet_new(cctx->creq, 0,
- sss_packet_get_cmd(cctx->creq->in),
- &cctx->creq->out);
- if (ret == EOK) {
- sss_cmd_done(cctx, cmdctx);
+ /* Notify the waiting clients */
+ while (nctx->gctx->reqs) {
+ tevent_req_done(nctx->gctx->reqs->req);
+ /* Freeing each entry in the list removes it from the dlist */
+ req = nctx->gctx->reqs;
+ nctx->gctx->reqs = nctx->gctx->reqs->next;
+ talloc_free(req);
}
- return ret;
+ return EOK;
}
-static void nss_cmd_getgrent_dp_callback(uint16_t err_maj, uint32_t err_min,
+static void setgrent_result_timeout(struct tevent_context *ev,
+ struct tevent_timer *te,
+ struct timeval current_time,
+ void *pvt)
+{
+ struct nss_ctx *nctx = talloc_get_type(pvt, struct nss_ctx);
+
+ DEBUG(1, ("setgrent result object has expired. Cleaning up.\n"));
+
+ /* Free the group enumeration context.
+ * If additional getgrent requests come in, they will invoke
+ * an implicit setgrent and refresh the result object.
+ */
+ talloc_zfree(nctx->gctx);
+}
+
+static void nss_cmd_setgrent_dp_callback(uint16_t err_maj, uint32_t err_min,
const char *err_msg, void *ptr)
{
- struct nss_dom_ctx *dctx = talloc_get_type(ptr, struct nss_dom_ctx);
- struct nss_cmd_ctx *cmdctx = dctx->cmdctx;
- struct cli_ctx *cctx = cmdctx->cctx;
+ struct setent_step_ctx *step_ctx =
+ talloc_get_type(ptr, struct setent_step_ctx);
+ struct getent_ctx *gctx = step_ctx->nctx->gctx;
int ret;
if (err_maj) {
@@ -2154,81 +2561,44 @@ static void nss_cmd_getgrent_dp_callback(uint16_t err_maj, uint32_t err_min,
(unsigned int)err_maj, (unsigned int)err_min, err_msg));
}
- ret = nss_cmd_getgrent_search(dctx);
-
+ ret = nss_cmd_setgrent_step(step_ctx);
if (ret) {
- NSS_CMD_FATAL_ERROR(cctx);
+ /* Notify any waiting processes of failure */
+ while(step_ctx->nctx->gctx->reqs) {
+ tevent_req_error(gctx->reqs->req, ret);
+ /* Freeing each entry in the list removes it from the dlist */
+ talloc_free(gctx->reqs);
+ }
}
}
-static int nss_cmd_setgrent_ext(struct cli_ctx *cctx, bool immediate)
+static errno_t nss_cmd_setgrent_recv(struct tevent_req *req)
{
- struct sss_domain_info *dom;
- struct nss_cmd_ctx *cmdctx;
- struct nss_dom_ctx *dctx;
- struct nss_ctx *nctx;
- time_t now = time(NULL);
- int ret;
-
- DEBUG(4, ("Requesting info for all groups\n"));
-
- nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
- talloc_free(nctx->gctx);
- nctx->gctx = NULL;
-
- cmdctx = talloc_zero(cctx, struct nss_cmd_ctx);
- if (!cmdctx) {
- return ENOMEM;
- }
- cmdctx->cctx = cctx;
- cmdctx->immediate = immediate;
-
- dctx = talloc_zero(cmdctx, struct nss_dom_ctx);
- if (!dctx) {
- ret = ENOMEM;
- goto done;
- }
- dctx->cmdctx = cmdctx;
-
- /* do not query backends if we have a recent enumeration */
- if (nctx->enum_cache_timeout) {
- if (nctx->last_group_enum + nctx->enum_cache_timeout > now) {
- cmdctx->enum_cached = true;
- }
- }
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+ return EOK;
+}
- /* check if enumeration is enabled in any domain */
- for (dom = cctx->rctx->domains; dom; dom = dom->next) {
- if (dom->enumerate != 0) break;
- }
- dctx->domain = dom;
+static void nss_cmd_setgrent_done(struct tevent_req *req)
+{
+ errno_t ret;
+ struct nss_cmd_ctx *cmdctx =
+ tevent_req_callback_data(req, struct nss_cmd_ctx);
- if (dctx->domain == NULL) {
- DEBUG(2, ("Enumeration disabled on all domains!\n"));
- if (cmdctx->immediate) {
- ret = ENOENT;
- } else {
- ret = sss_packet_new(cctx->creq, 0,
- sss_packet_get_cmd(cctx->creq->in),
- &cctx->creq->out);
- if (ret == EOK) {
- sss_cmd_done(cctx, cmdctx);
- }
+ ret = nss_cmd_setgrent_recv(req);
+ talloc_zfree(req);
+ if (ret == EOK || ret == ENOENT) {
+ /* Either we succeeded or no domains were eligible */
+ ret = sss_packet_new(cmdctx->cctx->creq, 0,
+ sss_packet_get_cmd(cmdctx->cctx->creq->in),
+ &cmdctx->cctx->creq->out);
+ if (ret == EOK) {
+ sss_cmd_done(cmdctx->cctx, cmdctx);
+ return;
}
- goto done;
}
- dctx->check_provider = NEED_CHECK_PROVIDER(dctx->domain->provider);
-
- /* ok, start the searches */
- ret = nss_cmd_getgrent_search(dctx);
-done:
- return nss_cmd_done(cmdctx, ret);
-}
-
-static int nss_cmd_setgrent(struct cli_ctx *cctx)
-{
- return nss_cmd_setgrent_ext(cctx, false);
+ /* Something bad happened */
+ nss_cmd_done(cmdctx, ret);
}
static int nss_cmd_retgrent(struct cli_ctx *cctx, int num)
@@ -2246,28 +2616,28 @@ static int nss_cmd_retgrent(struct cli_ctx *cctx, int num)
gctx = nctx->gctx;
while (ret == ENOENT) {
- if (gctx->cur >= gctx->num) break;
+ if (cctx->grent_dom_idx >= gctx->num) break;
- gdom = &gctx->doms[gctx->cur];
+ gdom = &gctx->doms[cctx->grent_dom_idx];
- n = gdom->res->count - gdom->cur;
- if (n == 0 && (gctx->cur+1 < gctx->num)) {
- gctx->cur++;
- gdom = &gctx->doms[gctx->cur];
- n = gdom->res->count - gdom->cur;
+ n = gdom->res->count - cctx->grent_cur;
+ if (n <= 0 && (cctx->grent_cur+1 < gctx->num)) {
+ cctx->grent_dom_idx++;
+ gdom = &gctx->doms[cctx->grent_dom_idx];
+ n = gdom->res->count - cctx->grent_cur;
}
if (!n) break;
if (n > num) n = num;
- msgs = &(gdom->res->msgs[gdom->cur]);
+ msgs = &(gdom->res->msgs[cctx->grent_cur]);
ret = fill_grent(cctx->creq->out,
gdom->domain,
nctx, true, msgs, &n);
- gdom->cur += n;
+ cctx->grent_cur += n;
}
none:
@@ -2308,29 +2678,77 @@ static int nss_cmd_getgrent_immediate(struct nss_cmd_ctx *cmdctx)
return EOK;
}
+static void nss_cmd_implicit_setgrent_done(struct tevent_req *req);
static int nss_cmd_getgrent(struct cli_ctx *cctx)
{
struct nss_ctx *nctx;
struct nss_cmd_ctx *cmdctx;
+ struct tevent_req *req;
DEBUG(4, ("Requesting info for all groups\n"));
- nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
-
- /* see if we need to trigger an implicit setpwent() */
- if (nctx->gctx == NULL) {
- return nss_cmd_setgrent_ext(cctx, true);
- }
-
cmdctx = talloc(cctx, struct nss_cmd_ctx);
if (!cmdctx) {
return ENOMEM;
}
cmdctx->cctx = cctx;
+ /* Save the current index and cursor locations
+ * If we end up calling setgrent implicitly, because the response object
+ * expired and has to be recreated, we want to resume from the same
+ * location.
+ */
+ cmdctx->saved_dom_idx = cctx->grent_dom_idx;
+ cmdctx->saved_cur = cctx->grent_cur;
+
+ nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx);
+ if(!nctx->gctx || !nctx->gctx->ready) {
+ /* Make sure we invoke setgrent if it hasn't been run or is still
+ * processing from another client
+ */
+ req = nss_cmd_setgrent_send(cctx, cctx);
+ if (!req) {
+ return EIO;
+ }
+ tevent_req_set_callback(req, nss_cmd_implicit_setgrent_done, cmdctx);
+ return EOK;
+ }
+
return nss_cmd_getgrent_immediate(cmdctx);
}
+static errno_t nss_cmd_setgrent_recv(struct tevent_req *req);
+static void nss_cmd_implicit_setgrent_done(struct tevent_req *req)
+{
+ errno_t ret;
+ struct nss_cmd_ctx *cmdctx =
+ tevent_req_callback_data(req, struct nss_cmd_ctx);
+
+ ret = nss_cmd_setgrent_recv(req);
+ talloc_zfree(req);
+
+ /* ENOENT is acceptable, as it just means that there were no entries
+ * to be returned. This will be handled gracefully in nss_cmd_retpwent
+ * later.
+ */
+ if (ret != EOK && ret != ENOENT) {
+ DEBUG(0, ("Implicit setgrent failed with unexpected error [%d][%s]\n",
+ ret, strerror(ret)));
+ NSS_CMD_FATAL_ERROR(cmdctx);
+ }
+
+ /* Restore the saved index and cursor locations */
+ cmdctx->cctx->grent_dom_idx = cmdctx->saved_dom_idx;
+ cmdctx->cctx->grent_cur = cmdctx->saved_cur;
+
+ ret = nss_cmd_getgrent_immediate(cmdctx);
+ if (ret != EOK) {
+ DEBUG(0, ("Immediate retrieval failed with unexpected error "
+ "[%d][%s]\n", ret, strerror(ret)));
+ NSS_CMD_FATAL_ERROR(cmdctx);
+ }
+}
+
static int nss_cmd_endgrent(struct cli_ctx *cctx)
{
struct nss_ctx *nctx;
@@ -2350,9 +2768,9 @@ static int nss_cmd_endgrent(struct cli_ctx *cctx)
}
if (nctx->gctx == NULL) goto done;
- /* free results and reset */
- talloc_free(nctx->gctx);
- nctx->gctx = NULL;
+ /* Reset the indices so that subsequent requests start at zero */
+ cctx->grent_dom_idx = 0;
+ cctx->grent_cur = 0;
done:
sss_cmd_done(cctx, NULL);
@@ -2674,4 +3092,3 @@ int nss_cmd_execute(struct cli_ctx *cctx)
return EINVAL;
}
-