On 08/30/2016 01:06 PM, Lukas Slebodnik wrote:
On (30/08/16 13:03), Petr Cech wrote:
On 08/30/2016 12:42 PM, Pavel Březina wrote:
On 08/25/2016 01:43 PM, Petr Cech wrote:
- /* FIXME: get max_children from configuration file */
- auth_ctx->max_children = 10;
+ ret = confdb_get_int(be_ctx->cdb, be_ctx->conf_path,
+ CONFDB_PROXY_MAX_CHILDREN, 10,
+ &max_children);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to read confdb [%d]: %s\n",
+ ret, sss_strerror(ret));
+ goto done;
+ }
+ if (max_children < 1) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Option %s must be bigger then 1\n",
+ CONFDB_PROXY_MAX_CHILDREN);
+ goto done;
+ }
You need to either set ret here, or set max_children to some reasonable
value (10?).
Hello Pavel,
max_children is set on the next line as:
auth_ctx->max_children = max_children;
I use temporary variable max_children,
because there is issue with signed/unsigned
integer value.
10 was original value. I increase it to 50.
And I use constant OPT_MAX_CHILDREN_DEFAULT now.
10 is a reasonable default and works for most of users.
I do not think we need to increase default value.
This is a purpose of the new option
I agree. I am sorry, I misunderstood to Pavel.
10 is back!
Regards
--
Petr^4 Čech
>From b24f2d546dd7045843de380aee22c654d23ad95b Mon Sep 17 00:00:00 2001
From: Petr Cech <pc...@redhat.com>
Date: Wed, 24 Aug 2016 14:41:09 +0200
Subject: [PATCH] PROXY: Adding proxy_max_children option
The new option 'proxy_max_children' is applicable
in domain section. Default value is 10.
Resolves:
https://fedorahosted.org/sssd/ticket/3153
---
src/confdb/confdb.h | 1 +
src/config/SSSDConfig/__init__.py.in | 3 +++
src/config/cfg_rules.ini | 1 +
src/config/etc/sssd.api.d/sssd-proxy.conf | 1 +
src/man/sssd.conf.5.xml | 12 ++++++++++++
src/providers/proxy/proxy_init.c | 20 ++++++++++++++++++--
6 files changed, 36 insertions(+), 2 deletions(-)
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 401e5fbf7ed6bb9e8d7158dfab378c8159aa03db..9b5c7bc04bb8297842aa9a0ef50f239c50302757 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -218,6 +218,7 @@
#define CONFDB_PROXY_LIBNAME "proxy_lib_name"
#define CONFDB_PROXY_PAM_TARGET "proxy_pam_target"
#define CONFDB_PROXY_FAST_ALIAS "proxy_fast_alias"
+#define CONFDB_PROXY_MAX_CHILDREN "proxy_max_children"
/* Secrets Service */
#define CONFDB_SEC_CONF_ENTRY "config/secrets"
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index b3f04ac26309bb5b518fb87cd0dae2962e853179..9076dd2c4bf630626d6d8eaef0e7ab67c0ac93f5 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -430,6 +430,9 @@ option_strings = {
'default_shell' : _('Default shell, /bin/bash'),
'base_directory' : _('Base for home directories'),
+ # [provider/proxy]
+ 'proxy_max_children' : _('The number of preforked proxy children.'),
+
# [provider/proxy/id]
'proxy_lib_name' : _('The name of the NSS library to use'),
'proxy_fast_alias' : _('Whether to look up canonical group name from cache if possible'),
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index df10538dee4a547a1b1af62a4cfe37b89e236b18..1b3c840199d64fe1a9088147c9c5c836216b25eb 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -323,6 +323,7 @@ option = base_directory
option = proxy_lib_name
option = proxy_fast_alias
option = proxy_pam_target
+option = proxy_max_children
# simple access provider specific options
option = simple_allow_users
diff --git a/src/config/etc/sssd.api.d/sssd-proxy.conf b/src/config/etc/sssd.api.d/sssd-proxy.conf
index 89a6503f9b84b7eab5fb3b0dd591dea905b43adb..09bf82affcb4263de3abbb67d1d484f6b01a1824 100644
--- a/src/config/etc/sssd.api.d/sssd-proxy.conf
+++ b/src/config/etc/sssd.api.d/sssd-proxy.conf
@@ -1,4 +1,5 @@
[provider/proxy]
+proxy_max_children = int, None, false
[provider/proxy/id]
proxy_lib_name = str, None, true
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index ae291e0fc8f2f9afabcdf32f18a5ec12252bbbbf..1bf3e799047d9c722487be8657bbee5cfd479cdd 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -2464,6 +2464,18 @@ subdomain_inherit = ldap_purge_cache_timeout
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>proxy_max_children (integer)</term>
+ <listitem>
+ <para>
+ The number of preforked proxy children.
+ </para>
+ <para>
+ Default: 50
+ </para>
+ </listitem>
+ </varlistentry>
+
</variablelist>
</para>
diff --git a/src/providers/proxy/proxy_init.c b/src/providers/proxy/proxy_init.c
index 1edf4fd64e54f4f0df7a78a9e56eb232a1d3e948..29410451ec103ac0ca73ae490197241b3aca3dec 100644
--- a/src/providers/proxy/proxy_init.c
+++ b/src/providers/proxy/proxy_init.c
@@ -29,6 +29,8 @@
#define NSS_FN_NAME "_nss_%s_%s"
+#define OPT_MAX_CHILDREN_DEFAULT 10
+
#define ERROR_INITGR "The '%s' library does not provides the " \
"_nss_XXX_initgroups_dyn function!\n" \
"initgroups will be slow as it will require " \
@@ -220,6 +222,7 @@ static errno_t proxy_init_auth_ctx(TALLOC_CTX *mem_ctx,
struct proxy_auth_ctx *auth_ctx;
errno_t ret;
int hret;
+ int max_children;
auth_ctx = talloc_zero(mem_ctx, struct proxy_auth_ctx);
if (auth_ctx == NULL) {
@@ -241,8 +244,21 @@ static errno_t proxy_init_auth_ctx(TALLOC_CTX *mem_ctx,
}
/* Set up request hash table */
- /* FIXME: get max_children from configuration file */
- auth_ctx->max_children = 10;
+ ret = confdb_get_int(be_ctx->cdb, be_ctx->conf_path,
+ CONFDB_PROXY_MAX_CHILDREN,
+ OPT_MAX_CHILDREN_DEFAULT,
+ &max_children);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to read confdb [%d]: %s\n",
+ ret, sss_strerror(ret));
+ goto done;
+ }
+ if (max_children < 1) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Option %s must be bigger then 1\n",
+ CONFDB_PROXY_MAX_CHILDREN);
+ goto done;
+ }
+ auth_ctx->max_children = max_children;
hret = hash_create(auth_ctx->max_children * 2, &auth_ctx->request_table,
NULL, NULL);
--
2.7.4
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
