On 10/17/2013 10:59 AM, Pavel Březina wrote:
I suggest to revert c2aeea38addda1a07e60adbc3451f11b640f7bf1 to test this patch, since this commit makes the race condition much less likely to happen.
On Thu, Oct 17, 2013 at 10:59:47AM +0200, Pavel Březina wrote:
From d363ac390df58435a8cf83098a1407689f1f5db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= pbrezina@redhat.com Date: Thu, 17 Oct 2013 10:20:56 +0200 Subject: [PATCH] nss: wait for initial subdomains request to finish
AD provider downloads domain information and initalizes ID mapping during subdomains request. This information is necessary to lookup objects without POSIX attributes.
We need to make sure that we postpone all responder requests until ID mapping is initialized in the provider.
I haven't tested the patch yet, but I think it is a good solution for the present issue although it might lead to some additional cycles for environments without subdomains.
I wonder if a more general solution to the issue would be to let the backend only send a response to a DP_METHOD_REGISTER request if the backend is fully initialized? Currently the response is send immediately. I think this change is out of scope for 1.11 but if you agree I can open a ticket with this suggestion and a hint to remove this patch if it is implemented?
bye, Sumit
src/responder/nss/nsssrv_cmd.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index 7220e3a35a4b97b3425ff88dbd8e08b7afdaa9c8..d37b4707cb734375011650632bca6d429042038c 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -1039,6 +1039,20 @@ static int nss_cmd_getbynam(enum sss_cli_command cmd, struct cli_ctx *cctx) DEBUG(SSSDBG_TRACE_FUNC, ("Running command [%d] with input [%s].\n", dctx->cmdctx->cmd, rawname));
- /* We need to attach to subdomain request, if the first one is not
* finished yet. We may not be able to lookup object in AD otherwise. */- if (cctx->rctx->get_domains_last_call.tv_sec == 0) {
req = sss_dp_get_domains_send(cctx->rctx, cctx->rctx, true, NULL);if (req == NULL) {ret = ENOMEM;} else {dctx->rawname = rawname;tevent_req_set_callback(req, nss_cmd_getbynam_done, dctx);ret = EAGAIN;}goto done;- }
- domname = NULL; ret = sss_parse_name_for_domains(cmdctx, cctx->rctx->domains, cctx->rctx->default_domain, rawname,
-- 1.7.11.7
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Thu, Oct 17, 2013 at 01:23:02PM +0200, Sumit Bose wrote:
On Thu, Oct 17, 2013 at 10:59:47AM +0200, Pavel Březina wrote:
From d363ac390df58435a8cf83098a1407689f1f5db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= pbrezina@redhat.com Date: Thu, 17 Oct 2013 10:20:56 +0200 Subject: [PATCH] nss: wait for initial subdomains request to finish
AD provider downloads domain information and initalizes ID mapping during subdomains request. This information is necessary to lookup objects without POSIX attributes.
We need to make sure that we postpone all responder requests until ID mapping is initialized in the provider.
I haven't tested the patch yet, but I think it is a good solution for the present issue although it might lead to some additional cycles for environments without subdomains.
I wonder if a more general solution to the issue would be to let the backend only send a response to a DP_METHOD_REGISTER request if the backend is fully initialized? Currently the response is send immediately. I think this change is out of scope for 1.11 but if you agree I can open a ticket with this suggestion and a hint to remove this patch if it is implemented?
bye, Sumit
Please do.
On Thu, Oct 17, 2013 at 01:33:41PM +0200, Jakub Hrozek wrote:
On Thu, Oct 17, 2013 at 01:23:02PM +0200, Sumit Bose wrote:
On Thu, Oct 17, 2013 at 10:59:47AM +0200, Pavel Březina wrote:
From d363ac390df58435a8cf83098a1407689f1f5db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= pbrezina@redhat.com Date: Thu, 17 Oct 2013 10:20:56 +0200 Subject: [PATCH] nss: wait for initial subdomains request to finish
AD provider downloads domain information and initalizes ID mapping during subdomains request. This information is necessary to lookup objects without POSIX attributes.
We need to make sure that we postpone all responder requests until ID mapping is initialized in the provider.
I haven't tested the patch yet, but I think it is a good solution for the present issue although it might lead to some additional cycles for environments without subdomains.
I wonder if a more general solution to the issue would be to let the backend only send a response to a DP_METHOD_REGISTER request if the backend is fully initialized? Currently the response is send immediately. I think this change is out of scope for 1.11 but if you agree I can open a ticket with this suggestion and a hint to remove this patch if it is implemented?
bye, Sumit
Please do.
https://fedorahosted.org/sssd/ticket/2122
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Thu, Oct 17, 2013 at 02:15:57PM +0200, Sumit Bose wrote:
On Thu, Oct 17, 2013 at 01:33:41PM +0200, Jakub Hrozek wrote:
On Thu, Oct 17, 2013 at 01:23:02PM +0200, Sumit Bose wrote:
On Thu, Oct 17, 2013 at 10:59:47AM +0200, Pavel Březina wrote:
From d363ac390df58435a8cf83098a1407689f1f5db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= pbrezina@redhat.com Date: Thu, 17 Oct 2013 10:20:56 +0200 Subject: [PATCH] nss: wait for initial subdomains request to finish
AD provider downloads domain information and initalizes ID mapping during subdomains request. This information is necessary to lookup objects without POSIX attributes.
We need to make sure that we postpone all responder requests until ID mapping is initialized in the provider.
I haven't tested the patch yet, but I think it is a good solution for the present issue although it might lead to some additional cycles for environments without subdomains.
I wonder if a more general solution to the issue would be to let the backend only send a response to a DP_METHOD_REGISTER request if the backend is fully initialized? Currently the response is send immediately. I think this change is out of scope for 1.11 but if you agree I can open a ticket with this suggestion and a hint to remove this patch if it is implemented?
bye, Sumit
Please do.
Thanks!
I tested Pavel's patch together with c2aeea38addda1a07e60adbc3451f11b640f7bf1 reverted as Pavel suggested.
* with clean master the resolution worked for me, so I didn't have much luck reproducing the error * with clean master and c2aeea reverted, the lookups failed in more than half of the attempts * with clean master, c2aeea reverted and Pavel's patch, the lookups were working fine all the time
The code looks good, ACK
On Thu, Oct 17, 2013 at 05:42:28PM +0200, Jakub Hrozek wrote:
On Thu, Oct 17, 2013 at 02:15:57PM +0200, Sumit Bose wrote:
On Thu, Oct 17, 2013 at 01:33:41PM +0200, Jakub Hrozek wrote:
On Thu, Oct 17, 2013 at 01:23:02PM +0200, Sumit Bose wrote:
On Thu, Oct 17, 2013 at 10:59:47AM +0200, Pavel Březina wrote:
From d363ac390df58435a8cf83098a1407689f1f5db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= pbrezina@redhat.com Date: Thu, 17 Oct 2013 10:20:56 +0200 Subject: [PATCH] nss: wait for initial subdomains request to finish
AD provider downloads domain information and initalizes ID mapping during subdomains request. This information is necessary to lookup objects without POSIX attributes.
We need to make sure that we postpone all responder requests until ID mapping is initialized in the provider.
I haven't tested the patch yet, but I think it is a good solution for the present issue although it might lead to some additional cycles for environments without subdomains.
I wonder if a more general solution to the issue would be to let the backend only send a response to a DP_METHOD_REGISTER request if the backend is fully initialized? Currently the response is send immediately. I think this change is out of scope for 1.11 but if you agree I can open a ticket with this suggestion and a hint to remove this patch if it is implemented?
bye, Sumit
Please do.
Thanks!
I tested Pavel's patch together with c2aeea38addda1a07e60adbc3451f11b640f7bf1 reverted as Pavel suggested.
- with clean master the resolution worked for me, so I didn't have much luck reproducing the error
- with clean master and c2aeea reverted, the lookups failed in more than half of the attempts
- with clean master, c2aeea reverted and Pavel's patch, the lookups were working fine all the time
The code looks good, ACK
Sorry, I forgot to send push mail. This patch was already pushed to master and sssd-1-11
sssd-devel@lists.fedorahosted.org
-
Jakub Hrozek -
Pavel Březina -
Sumit Bose