From ae5716d87c7b126ab01b0d4fcacd4f519585e5fb Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Wed, 16 Jun 2010 14:59:49 -0400 Subject: Refactor the negative cache Rename functions from nss_ncache_* to sss_ncache_* Move negative cache to responder/common and rename as negcache.c/h --- src/responder/common/negcache.c | 321 ++++++++++++++++++++++++++++++++++++++++ src/responder/common/negcache.h | 51 +++++++ src/responder/nss/nsssrv.c | 16 +- src/responder/nss/nsssrv.h | 3 +- src/responder/nss/nsssrv_cmd.c | 27 ++-- src/responder/nss/nsssrv_nc.c | 321 ---------------------------------------- src/responder/nss/nsssrv_nc.h | 51 ------- 7 files changed, 395 insertions(+), 395 deletions(-) create mode 100644 src/responder/common/negcache.c create mode 100644 src/responder/common/negcache.h delete mode 100644 src/responder/nss/nsssrv_nc.c delete mode 100644 src/responder/nss/nsssrv_nc.h (limited to 'src/responder') diff --git a/src/responder/common/negcache.c b/src/responder/common/negcache.c new file mode 100644 index 000000000..aef9080a8 --- /dev/null +++ b/src/responder/common/negcache.c @@ -0,0 +1,321 @@ +/* + SSSD + + NSS Responder + + Copyright (C) Simo Sorce 2008 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "util/util.h" +#include +#include +#include "tdb.h" + +#define NC_ENTRY_PREFIX "NCE/" +#define NC_USER_PREFIX NC_ENTRY_PREFIX"USER" +#define NC_GROUP_PREFIX NC_ENTRY_PREFIX"GROUP" +#define NC_UID_PREFIX NC_ENTRY_PREFIX"UID" +#define NC_GID_PREFIX NC_ENTRY_PREFIX"GID" + +struct sss_nc_ctx { + struct tdb_context *tdb; +}; + +static int string_to_tdb_data(char *str, TDB_DATA *ret) +{ + if (!str || !ret) return EINVAL; + + ret->dptr = (uint8_t *)str; + ret->dsize = strlen(str)+1; + + return EOK; +} + +int sss_ncache_init(TALLOC_CTX *memctx, struct sss_nc_ctx **_ctx) +{ + struct sss_nc_ctx *ctx; + + ctx = talloc_zero(memctx, struct sss_nc_ctx); + if (!ctx) return ENOMEM; + + errno = 0; + /* open a memory only tdb with default hash size */ + ctx->tdb = tdb_open("memcache", 0, TDB_INTERNAL, O_RDWR|O_CREAT, 0); + if (!ctx->tdb) return errno; + + *_ctx = ctx; + return EOK; +}; + +static int sss_ncache_check_str(struct sss_nc_ctx *ctx, char *str, int ttl) +{ + TDB_DATA key; + TDB_DATA data; + unsigned long long int timestamp; + bool expired = false; + char *ep; + int ret; + + ret = string_to_tdb_data(str, &key); + if (ret != EOK) goto done; + + data = tdb_fetch(ctx->tdb, key); + + if (!data.dptr) { + ret = ENOENT; + goto done; + } + + if (ttl == -1) { + /* a negative ttl means: never expires */ + ret = EEXIST; + goto done; + } + + errno = 0; + timestamp = strtoull((const char *)data.dptr, &ep, 0); + if (errno != 0 || *ep != '\0') { + /* Malformed entry, remove it and return no entry */ + expired = true; + goto done; + } + + if (timestamp == 0) { + /* a 0 timestamp means this is a permanent entry */ + ret = EEXIST; + goto done; + } + + if (timestamp + ttl > time(NULL)) { + /* still valid */ + ret = EEXIST; + goto done; + } + + expired = true; + +done: + if (expired) { + /* expired, remove and return no entry */ + tdb_delete(ctx->tdb, key); + ret = ENOENT; + } + + return ret; +} + +static int sss_ncache_set_str(struct sss_nc_ctx *ctx, + char *str, bool permanent) +{ + TDB_DATA key; + TDB_DATA data; + char *timest; + int ret; + + ret = string_to_tdb_data(str, &key); + if (ret != EOK) return ret; + + if (permanent) { + timest = talloc_strdup(ctx, "0"); + } else { + timest = talloc_asprintf(ctx, "%llu", + (unsigned long long int)time(NULL)); + } + if (!timest) return ENOMEM; + + ret = string_to_tdb_data(timest, &data); + if (ret != EOK) goto done; + + ret = tdb_store(ctx->tdb, key, data, TDB_REPLACE); + if (ret != 0) { + DEBUG(1, ("Negative cache failed to set entry: [%s]\n", + tdb_errorstr(ctx->tdb))); + ret = EFAULT; + } + +done: + talloc_free(timest); + return ret; +} + +int sss_ncache_check_user(struct sss_nc_ctx *ctx, int ttl, + const char *domain, const char *name) +{ + char *str; + int ret; + + if (!name || !*name) return EINVAL; + + str = talloc_asprintf(ctx, "%s/%s/%s", NC_USER_PREFIX, domain, name); + if (!str) return ENOMEM; + + ret = sss_ncache_check_str(ctx, str, ttl); + + talloc_free(str); + return ret; +} + +int sss_ncache_check_group(struct sss_nc_ctx *ctx, int ttl, + const char *domain, const char *name) +{ + char *str; + int ret; + + if (!name || !*name) return EINVAL; + + str = talloc_asprintf(ctx, "%s/%s/%s", NC_GROUP_PREFIX, domain, name); + if (!str) return ENOMEM; + + ret = sss_ncache_check_str(ctx, str, ttl); + + talloc_free(str); + return ret; +} + +int sss_ncache_check_uid(struct sss_nc_ctx *ctx, int ttl, uid_t uid) +{ + char *str; + int ret; + + str = talloc_asprintf(ctx, "%s/%u", NC_UID_PREFIX, uid); + if (!str) return ENOMEM; + + ret = sss_ncache_check_str(ctx, str, ttl); + + talloc_free(str); + return ret; +} + +int sss_ncache_check_gid(struct sss_nc_ctx *ctx, int ttl, gid_t gid) +{ + char *str; + int ret; + + str = talloc_asprintf(ctx, "%s/%u", NC_GID_PREFIX, gid); + if (!str) return ENOMEM; + + ret = sss_ncache_check_str(ctx, str, ttl); + + talloc_free(str); + return ret; +} + +int sss_ncache_set_user(struct sss_nc_ctx *ctx, bool permanent, + const char *domain, const char *name) +{ + char *str; + int ret; + + if (!name || !*name) return EINVAL; + + str = talloc_asprintf(ctx, "%s/%s/%s", NC_USER_PREFIX, domain, name); + if (!str) return ENOMEM; + + ret = sss_ncache_set_str(ctx, str, permanent); + + talloc_free(str); + return ret; +} + +int sss_ncache_set_group(struct sss_nc_ctx *ctx, bool permanent, + const char *domain, const char *name) +{ + char *str; + int ret; + + if (!name || !*name) return EINVAL; + + str = talloc_asprintf(ctx, "%s/%s/%s", NC_GROUP_PREFIX, domain, name); + if (!str) return ENOMEM; + + ret = sss_ncache_set_str(ctx, str, permanent); + + talloc_free(str); + return ret; +} + +int sss_ncache_set_uid(struct sss_nc_ctx *ctx, bool permanent, uid_t uid) +{ + char *str; + int ret; + + str = talloc_asprintf(ctx, "%s/%u", NC_UID_PREFIX, uid); + if (!str) return ENOMEM; + + ret = sss_ncache_set_str(ctx, str, permanent); + + talloc_free(str); + return ret; +} + +int sss_ncache_set_gid(struct sss_nc_ctx *ctx, bool permanent, gid_t gid) +{ + char *str; + int ret; + + str = talloc_asprintf(ctx, "%s/%u", NC_GID_PREFIX, gid); + if (!str) return ENOMEM; + + ret = sss_ncache_set_str(ctx, str, permanent); + + talloc_free(str); + return ret; +} + +static int delete_permanent(struct tdb_context *tdb, + TDB_DATA key, TDB_DATA data, void *state) +{ + unsigned long long int timestamp; + bool remove_key = false; + char *ep; + + if (strncmp((char *)key.dptr, + NC_ENTRY_PREFIX, sizeof(NC_ENTRY_PREFIX)) != 0) { + /* not interested in this key */ + return 0; + } + + errno = 0; + timestamp = strtoull((const char *)data.dptr, &ep, 0); + if (errno != 0 || *ep != '\0') { + /* Malformed entry, remove it */ + remove_key = true; + goto done; + } + + if (timestamp == 0) { + /* a 0 timestamp means this is a permanent entry */ + remove_key = true; + } + +done: + if (remove_key) { + return tdb_delete(tdb, key); + } + + return 0; +} + +int sss_ncache_reset_permament(struct sss_nc_ctx *ctx) +{ + int ret; + + ret = tdb_traverse(ctx->tdb, delete_permanent, NULL); + if (ret < 0) + return EIO; + + return EOK; +} diff --git a/src/responder/common/negcache.h b/src/responder/common/negcache.h new file mode 100644 index 000000000..d310c9e3d --- /dev/null +++ b/src/responder/common/negcache.h @@ -0,0 +1,51 @@ +/* + SSSD + + NSS Responder + + Copyright (C) Simo Sorce 2008 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#ifndef _NSS_NEG_CACHE_H_ +#define _NSS_NEG_CACHE_H_ + +struct sss_nc_ctx; + +/* init the in memory negative cache */ +int sss_ncache_init(TALLOC_CTX *memctx, struct sss_nc_ctx **_ctx); + +/* check if the user is expired according to the passed in time to live */ +int sss_ncache_check_user(struct sss_nc_ctx *ctx, int ttl, + const char *domain, const char *name); +int sss_ncache_check_group(struct sss_nc_ctx *ctx, int ttl, + const char *domain, const char *name); +int sss_ncache_check_uid(struct sss_nc_ctx *ctx, int ttl, uid_t uid); +int sss_ncache_check_gid(struct sss_nc_ctx *ctx, int ttl, gid_t gid); + +/* add a new neg-cache entry setting the timestamp to "now" unless + * "permanent" is set to true, in which case the timestamps is set to 0 + * and the negative cache never expires (used to permanently filter out + * users and groups) */ +int sss_ncache_set_user(struct sss_nc_ctx *ctx, bool permanent, + const char *domain, const char *name); +int sss_ncache_set_group(struct sss_nc_ctx *ctx, bool permanent, + const char *domain, const char *name); +int sss_ncache_set_uid(struct sss_nc_ctx *ctx, bool permanent, uid_t uid); +int sss_ncache_set_gid(struct sss_nc_ctx *ctx, bool permanent, gid_t gid); + +int sss_ncache_reset_permament(struct sss_nc_ctx *ctx); + +#endif /* _NSS_NEG_CACHE_H_ */ diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c index ea2dc5186..24753674a 100644 --- a/src/responder/nss/nsssrv.c +++ b/src/responder/nss/nsssrv.c @@ -33,7 +33,7 @@ #include "popt.h" #include "util/util.h" #include "responder/nss/nsssrv.h" -#include "responder/nss/nsssrv_nc.h" +#include "responder/common/negcache.h" #include "db/sysdb.h" #include "confdb/confdb.h" #include "dbus/dbus.h" @@ -135,7 +135,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } - ret = nss_ncache_set_user(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_user(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent user filter for [%s]" " (%d [%s])\n", filter_list[i], @@ -174,7 +174,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } if (domain) { - ret = nss_ncache_set_user(nctx->ncache, true, domain, name); + ret = sss_ncache_set_user(nctx->ncache, true, domain, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent user filter for [%s]" " (%d [%s])\n", filter_list[i], @@ -183,7 +183,7 @@ static int nss_get_config(struct nss_ctx *nctx, } } else { for (dom = rctx->domains; dom; dom = dom->next) { - ret = nss_ncache_set_user(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_user(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent user filter for" " [%s:%s] (%d [%s])\n", @@ -226,7 +226,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } - ret = nss_ncache_set_group(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_group(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent group filter for [%s]" " (%d [%s])\n", filter_list[i], @@ -265,7 +265,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } if (domain) { - ret = nss_ncache_set_group(nctx->ncache, true, domain, name); + ret = sss_ncache_set_group(nctx->ncache, true, domain, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent group filter for" " [%s] (%d [%s])\n", filter_list[i], @@ -274,7 +274,7 @@ static int nss_get_config(struct nss_ctx *nctx, } } else { for (dom = rctx->domains; dom; dom = dom->next) { - ret = nss_ncache_set_group(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_group(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent group filter for" " [%s:%s] (%d [%s])\n", @@ -351,7 +351,7 @@ int nss_process_init(TALLOC_CTX *mem_ctx, return ENOMEM; } - ret = nss_ncache_init(nctx, &nctx->ncache); + ret = sss_ncache_init(nctx, &nctx->ncache); if (ret != EOK) { DEBUG(0, ("fatal error initializing negative cache\n")); return ret; diff --git a/src/responder/nss/nsssrv.h b/src/responder/nss/nsssrv.h index a6c661835..d53143dc0 100644 --- a/src/responder/nss/nsssrv.h +++ b/src/responder/nss/nsssrv.h @@ -32,7 +32,6 @@ #include "sbus/sssd_dbus.h" #include "responder/common/responder_packet.h" #include "responder/common/responder.h" -#include "responder/nss/nsssrv_nc.h" #define NSS_SBUS_SERVICE_VERSION 0x0001 #define NSS_SBUS_SERVICE_NAME "nss" @@ -45,7 +44,7 @@ struct nss_ctx { struct resp_ctx *rctx; int neg_timeout; - struct nss_nc_ctx *ncache; + struct sss_nc_ctx *ncache; int cache_refresh_percent; diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index 25e914bb2..9b7551384 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -21,6 +21,7 @@ #include "util/util.h" #include "responder/nss/nsssrv.h" +#include "responder/common/negcache.h" #include "confdb/confdb.h" #include "db/sysdb.h" #include @@ -220,7 +221,7 @@ static int fill_pwent(struct sss_packet *packet, } if (filter_users) { - ncret = nss_ncache_check_user(nctx->ncache, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, domain, name); if (ncret == EEXIST) { @@ -528,7 +529,7 @@ static int nss_cmd_getpwnam_search(struct nss_dom_ctx *dctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ret = nss_ncache_check_user(nctx->ncache, nctx->neg_timeout, + ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dom->name, name); /* if neg cached, return we didn't find it */ @@ -570,7 +571,7 @@ static int nss_cmd_getpwnam_search(struct nss_dom_ctx *dctx) DEBUG(2, ("No results for getpwnam call\n")); /* set negative cache only if not result of cache check */ - ret = nss_ncache_set_user(nctx->ncache, false, dom->name, name); + ret = sss_ncache_set_user(nctx->ncache, false, dom->name, name); if (ret != EOK) { return ret; } @@ -791,7 +792,7 @@ static int nss_cmd_getpwuid_search(struct nss_dom_ctx *dctx) DEBUG(2, ("No results for getpwuid call\n")); /* set negative cache only if not result of cache check */ - ret = nss_ncache_set_uid(nctx->ncache, false, cmdctx->id); + ret = sss_ncache_set_uid(nctx->ncache, false, cmdctx->id); if (ret != EOK) { return ret; } @@ -900,7 +901,7 @@ static int nss_cmd_getpwuid(struct cli_ctx *cctx) } cmdctx->id = *((uint32_t *)body); - ret = nss_ncache_check_uid(nctx->ncache, nctx->neg_timeout, cmdctx->id); + ret = sss_ncache_check_uid(nctx->ncache, nctx->neg_timeout, cmdctx->id); if (ret == EEXIST) { DEBUG(3, ("Uid [%lu] does not exist! (negative cache)\n", (unsigned long)cmdctx->id)); @@ -1360,7 +1361,7 @@ static int fill_grent(struct sss_packet *packet, } if (filter_groups) { - ret = nss_ncache_check_group(nctx->ncache, + ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout, domain, name); if (ret == EEXIST) { DEBUG(4, ("Group [%s@%s] filtered out! (negative cache)\n", @@ -1437,7 +1438,7 @@ static int fill_grent(struct sss_packet *packet, name = (const char *)el->values[j].data; if (nctx->filter_users_in_groups) { - ret = nss_ncache_check_user(nctx->ncache, + ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, domain, name); if (ret == EEXIST) { @@ -1602,7 +1603,7 @@ static int nss_cmd_getgrnam_search(struct nss_dom_ctx *dctx) /* verify this group has not yet been negatively cached, * or has been permanently filtered */ - ret = nss_ncache_check_group(nctx->ncache, nctx->neg_timeout, + ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout, dom->name, name); /* if neg cached, return we didn't find it */ @@ -1644,7 +1645,7 @@ static int nss_cmd_getgrnam_search(struct nss_dom_ctx *dctx) DEBUG(2, ("No results for getgrnam call\n")); /* set negative cache only if not result of cache check */ - ret = nss_ncache_set_group(nctx->ncache, false, dom->name, name); + ret = sss_ncache_set_group(nctx->ncache, false, dom->name, name); if (ret != EOK) { return ret; } @@ -1865,7 +1866,7 @@ static int nss_cmd_getgrgid_search(struct nss_dom_ctx *dctx) DEBUG(2, ("No results for getgrgid call\n")); /* set negative cache only if not result of cache check */ - ret = nss_ncache_set_gid(nctx->ncache, false, cmdctx->id); + ret = sss_ncache_set_gid(nctx->ncache, false, cmdctx->id); if (ret != EOK) { return ret; } @@ -1974,7 +1975,7 @@ static int nss_cmd_getgrgid(struct cli_ctx *cctx) } cmdctx->id = *((uint32_t *)body); - ret = nss_ncache_check_gid(nctx->ncache, nctx->neg_timeout, cmdctx->id); + ret = sss_ncache_check_gid(nctx->ncache, nctx->neg_timeout, cmdctx->id); if (ret == EEXIST) { DEBUG(3, ("Gid [%lu] does not exist! (negative cache)\n", (unsigned long)cmdctx->id)); @@ -2451,7 +2452,7 @@ static int nss_cmd_initgroups_search(struct nss_dom_ctx *dctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ret = nss_ncache_check_user(nctx->ncache, nctx->neg_timeout, + ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dom->name, name); /* if neg cached, return we didn't find it */ @@ -2488,7 +2489,7 @@ static int nss_cmd_initgroups_search(struct nss_dom_ctx *dctx) DEBUG(2, ("No results for initgroups call\n")); /* set negative cache only if not result of cache check */ - ret = nss_ncache_set_user(nctx->ncache, false, dom->name, name); + ret = sss_ncache_set_user(nctx->ncache, false, dom->name, name); if (ret != EOK) { return ret; } diff --git a/src/responder/nss/nsssrv_nc.c b/src/responder/nss/nsssrv_nc.c deleted file mode 100644 index 8d8ef01c1..000000000 --- a/src/responder/nss/nsssrv_nc.c +++ /dev/null @@ -1,321 +0,0 @@ -/* - SSSD - - NSS Responder - - Copyright (C) Simo Sorce 2008 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "util/util.h" -#include -#include -#include "tdb.h" - -#define NC_ENTRY_PREFIX "NCE/" -#define NC_USER_PREFIX NC_ENTRY_PREFIX"USER" -#define NC_GROUP_PREFIX NC_ENTRY_PREFIX"GROUP" -#define NC_UID_PREFIX NC_ENTRY_PREFIX"UID" -#define NC_GID_PREFIX NC_ENTRY_PREFIX"GID" - -struct nss_nc_ctx { - struct tdb_context *tdb; -}; - -static int string_to_tdb_data(char *str, TDB_DATA *ret) -{ - if (!str || !ret) return EINVAL; - - ret->dptr = (uint8_t *)str; - ret->dsize = strlen(str)+1; - - return EOK; -} - -int nss_ncache_init(TALLOC_CTX *memctx, struct nss_nc_ctx **_ctx) -{ - struct nss_nc_ctx *ctx; - - ctx = talloc_zero(memctx, struct nss_nc_ctx); - if (!ctx) return ENOMEM; - - errno = 0; - /* open a memory only tdb with default hash size */ - ctx->tdb = tdb_open("memcache", 0, TDB_INTERNAL, O_RDWR|O_CREAT, 0); - if (!ctx->tdb) return errno; - - *_ctx = ctx; - return EOK; -}; - -static int nss_ncache_check_str(struct nss_nc_ctx *ctx, char *str, int ttl) -{ - TDB_DATA key; - TDB_DATA data; - unsigned long long int timestamp; - bool expired = false; - char *ep; - int ret; - - ret = string_to_tdb_data(str, &key); - if (ret != EOK) goto done; - - data = tdb_fetch(ctx->tdb, key); - - if (!data.dptr) { - ret = ENOENT; - goto done; - } - - if (ttl == -1) { - /* a negative ttl means: never expires */ - ret = EEXIST; - goto done; - } - - errno = 0; - timestamp = strtoull((const char *)data.dptr, &ep, 0); - if (errno != 0 || *ep != '\0') { - /* Malformed entry, remove it and return no entry */ - expired = true; - goto done; - } - - if (timestamp == 0) { - /* a 0 timestamp means this is a permanent entry */ - ret = EEXIST; - goto done; - } - - if (timestamp + ttl > time(NULL)) { - /* still valid */ - ret = EEXIST; - goto done; - } - - expired = true; - -done: - if (expired) { - /* expired, remove and return no entry */ - tdb_delete(ctx->tdb, key); - ret = ENOENT; - } - - return ret; -} - -static int nss_ncache_set_str(struct nss_nc_ctx *ctx, - char *str, bool permanent) -{ - TDB_DATA key; - TDB_DATA data; - char *timest; - int ret; - - ret = string_to_tdb_data(str, &key); - if (ret != EOK) return ret; - - if (permanent) { - timest = talloc_strdup(ctx, "0"); - } else { - timest = talloc_asprintf(ctx, "%llu", - (unsigned long long int)time(NULL)); - } - if (!timest) return ENOMEM; - - ret = string_to_tdb_data(timest, &data); - if (ret != EOK) goto done; - - ret = tdb_store(ctx->tdb, key, data, TDB_REPLACE); - if (ret != 0) { - DEBUG(1, ("Negative cache failed to set entry: [%s]\n", - tdb_errorstr(ctx->tdb))); - ret = EFAULT; - } - -done: - talloc_free(timest); - return ret; -} - -int nss_ncache_check_user(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_USER_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_check_group(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_GROUP_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_check_uid(struct nss_nc_ctx *ctx, int ttl, uid_t uid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_UID_PREFIX, uid); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_check_gid(struct nss_nc_ctx *ctx, int ttl, gid_t gid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_GID_PREFIX, gid); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_user(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_USER_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_group(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_GROUP_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_uid(struct nss_nc_ctx *ctx, bool permanent, uid_t uid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_UID_PREFIX, uid); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_gid(struct nss_nc_ctx *ctx, bool permanent, gid_t gid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_GID_PREFIX, gid); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -static int delete_permanent(struct tdb_context *tdb, - TDB_DATA key, TDB_DATA data, void *state) -{ - unsigned long long int timestamp; - bool remove_key = false; - char *ep; - - if (strncmp((char *)key.dptr, - NC_ENTRY_PREFIX, sizeof(NC_ENTRY_PREFIX)) != 0) { - /* not interested in this key */ - return 0; - } - - errno = 0; - timestamp = strtoull((const char *)data.dptr, &ep, 0); - if (errno != 0 || *ep != '\0') { - /* Malformed entry, remove it */ - remove_key = true; - goto done; - } - - if (timestamp == 0) { - /* a 0 timestamp means this is a permanent entry */ - remove_key = true; - } - -done: - if (remove_key) { - return tdb_delete(tdb, key); - } - - return 0; -} - -int nss_ncache_reset_permament(struct nss_nc_ctx *ctx) -{ - int ret; - - ret = tdb_traverse(ctx->tdb, delete_permanent, NULL); - if (ret < 0) - return EIO; - - return EOK; -} diff --git a/src/responder/nss/nsssrv_nc.h b/src/responder/nss/nsssrv_nc.h deleted file mode 100644 index c0fa197c2..000000000 --- a/src/responder/nss/nsssrv_nc.h +++ /dev/null @@ -1,51 +0,0 @@ -/* - SSSD - - NSS Responder - - Copyright (C) Simo Sorce 2008 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#ifndef _NSS_NEG_CACHE_H_ -#define _NSS_NEG_CACHE_H_ - -struct nss_nc_ctx; - -/* init the in memory negative cache */ -int nss_ncache_init(TALLOC_CTX *memctx, struct nss_nc_ctx **_ctx); - -/* check if the user is expired according to the passed in time to live */ -int nss_ncache_check_user(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name); -int nss_ncache_check_group(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name); -int nss_ncache_check_uid(struct nss_nc_ctx *ctx, int ttl, uid_t uid); -int nss_ncache_check_gid(struct nss_nc_ctx *ctx, int ttl, gid_t gid); - -/* add a new neg-cache entry setting the timestamp to "now" unless - * "permanent" is set to true, in which case the timestamps is set to 0 - * and the negative cache never expires (used to permanently filter out - * users and groups) */ -int nss_ncache_set_user(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name); -int nss_ncache_set_group(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name); -int nss_ncache_set_uid(struct nss_nc_ctx *ctx, bool permanent, uid_t uid); -int nss_ncache_set_gid(struct nss_nc_ctx *ctx, bool permanent, gid_t gid); - -int nss_ncache_reset_permament(struct nss_nc_ctx *ctx); - -#endif /* _NSS_NEG_CACHE_H_ */ -- cgit