NSS: Reset negcache after checking domains

The NSS responder periodically re-checks subdomains. We need to reset
the negative cache each time the check finishes to allow the negative
cache to contain entries from different domains.

Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

1 files changed, 24 insertions, 0 deletions

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 576532226..72da865d0 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -105,6 +105,18 @@ struct setent_ctx {
     struct getent_ctx *getent_ctx;
 };
 
+static int nss_reset_negcache(struct resp_ctx *rctx)
+{
+    struct nss_ctx *nss_ctx;
+
+    nss_ctx = talloc_get_type(rctx->pvt_ctx, struct nss_ctx);
+    if (nss_ctx == NULL) {
+        return EIO;
+    }
+
+    return sss_ncache_reset_repopulate_permanent(rctx, nss_ctx->ncache);
+}
+
 /****************************************************************************
  * PASSWD db related functions
  ***************************************************************************/
@@ -1450,6 +1462,12 @@ static void nss_cmd_getbynam_done(struct tevent_req *req)
         goto done;
     }
 
+    ret = nss_reset_negcache(cctx->rctx);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_MINOR_FAILURE, "Cannot reset negcache records\n");
+        /* Not fatal */
+    }
+
     DEBUG(SSSDBG_TRACE_FUNC, "Requesting info for [%s] from [%s]\n",
               cmdctx->name, domname?domname:"<ALL>");
 
@@ -1808,6 +1826,12 @@ static void nss_cmd_getbyid_done(struct tevent_req *req)
         goto done;
     }
 
+    ret = nss_reset_negcache(cmdctx->cctx->rctx);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_MINOR_FAILURE, "Cannot reset negcache records\n");
+        /* Not fatal */
+    }
+
     /* ok, find it ! */
     switch(dctx->cmdctx->cmd) {
     case SSS_NSS_GETPWUID: