dovecot - Feb 2021 - doveadm user '*' vs sssd: enumeration works only once

> On 25/02/2021 11:41 Heiko Schlittermann <hs at schlittermann.de>
wrote:
> 
>  
> Heiko Schlittermann <hs at schlittermann.de> (Do 25 Feb 2021 10:36:21
CET):
> > > within a small timeframe returns a subset of the local users only
(the
> >     say count();
> I suppose the following would fix the issue:
> (not tested yet)
> 
> diff --git a/src/auth/userdb-passwd.c b/src/auth/userdb-passwd.c
> index 70b9969f6..4682dc873 100644
> --- a/src/auth/userdb-passwd.c
> +++ b/src/auth/userdb-passwd.c
> @@ -208,6 +208,7 @@ static int passwd_iterate_deinit(struct
userdb_iterate_context *_ctx)
>                 cur_userdb_iter_to = timeout_add(0,
passwd_iterate_next_timeout,
>                                                  NULL);
>         }
> +       endpwent();
>         return ret;
>  }
> 
> 
> -- 
> Heiko
Hi!

We'll look into it, might be that we are missing endpwent() there indeed.

Aki

> On 25/02/2021 13:06 Aki Tuomi <aki.tuomi at open-xchange.com> wrote:
> 
>  
> > On 25/02/2021 11:41 Heiko Schlittermann <hs at schlittermann.de>
wrote:
> > 
> >  
> > Heiko Schlittermann <hs at schlittermann.de> (Do 25 Feb 2021
10:36:21 CET):
> > > > within a small timeframe returns a subset of the local users
only (the
> > >     say count();
> > I suppose the following would fix the issue:
> > (not tested yet)
> > 
> > diff --git a/src/auth/userdb-passwd.c b/src/auth/userdb-passwd.c
> > index 70b9969f6..4682dc873 100644
> > --- a/src/auth/userdb-passwd.c
> > +++ b/src/auth/userdb-passwd.c
> > @@ -208,6 +208,7 @@ static int passwd_iterate_deinit(struct
userdb_iterate_context *_ctx)
> >                 cur_userdb_iter_to = timeout_add(0,
passwd_iterate_next_timeout,
> >                                                  NULL);
> >         }
> > +       endpwent();
> >         return ret;
> >  }
> > 
> > 
> > -- 
> > Heiko
> 
> Hi!
> 
> We'll look into it, might be that we are missing endpwent() there
indeed.
> 
> Aki
Tracking as DOP-2284.

Aki

Aki Tuomi <aki.tuomi at open-xchange.com> (Do 25 Feb 2021 12:06:43
CET):
> > 
> > diff --git a/src/auth/userdb-passwd.c b/src/auth/userdb-passwd.c
> > index 70b9969f6..4682dc873 100644
> > --- a/src/auth/userdb-passwd.c
> > +++ b/src/auth/userdb-passwd.c
> > @@ -208,6 +208,7 @@ static int passwd_iterate_deinit(struct
userdb_iterate_context *_ctx)
> >                 cur_userdb_iter_to = timeout_add(0,
passwd_iterate_next_timeout,
> >                                                  NULL);
> >         }
> > +       endpwent();
> >         return ret;
> >  }
> > 
> > 
> > -- 
> > Heiko
> 
> Hi!
> We'll look into it, might be that we are missing endpwent() there
indeed.
I'm not sure about the semantics of setpwent()/endpwent(), mayb the nss
plugin (here sssd) should gracefully handle a missing endwent() if it
sees a new setpwent(). But I think, it can't harm to call endpwent() on
the dovecot side.

I deployed a debian package with the above patch added onto my system,
and it seems to work.

So, should I file a bug report against dovecot?

    Best regards from Dresden/Germany
    Viele Gr??e aus Dresden
    Heiko Schlittermann
--
 SCHLITTERMANN.de ---------------------------- internet & unix support -
 Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
 gnupg encrypted messages are welcome --------------- key ID: F69376CE -
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20210225/63939d9d/attachment.sig>