1:59 a.m.
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Action: opened
PR body:
"""
In case of unreachable DNS server or invalid hostname sssd/c-ares tries
to search in multiple domains based on the search directive
in resolv.conf
But the hostnames in config file are fully qualified and this just
extends the time spent with DNS resolution.
This patch set the c-ares library flags to avoid DNS search
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=1608496
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5245/head:pr5245
git checkout pr5245
2:06 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
thalman commented:
"""
Despite the change is small, it changes the default behaviour and we should discuss it
across the team.
Once we agree the change I will also add commit with man page update to explicitly state
that servers must be IP address or FQDN.
From discussion with @sumit-bose I got that it should be safe to do it because of relation
to kerberos (kerberos would not work with short hostnames) but are there any other use
ceases?
CI runs fine in my environment.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-658587362
2:23 a.m.
New subject: [sssd PR#5245][+Bugzilla] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Label: +Bugzilla
4:14 a.m.
New subject: [sssd PR#5245][synchronized] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Action: synchronized
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5245/head:pr5245
git checkout pr5245
7:02 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
pbrezina commented:
"""
Does SSSD even work if the hostname or domain name is not qualified? If not then what
change of behavior do you refer to?
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-678255476
4:42 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
thalman commented:
"""
Does SSSD even work if the hostname or domain name is not qualified?
If not then what change of behavior do you refer to?
I discussed that with @sumit-bose and as he explained to me we have FQDN in configuration
anyway. Kerberos requires FQDN to work and we can assume that SSSD has it in
configuration. Then this patch is safe to include.
But is anyone aware of a case that I missed and short names may be there? Perhaps with
LDAP provider?
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-679024710
4:53 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
pbrezina commented:
"""
In theory I think it is possible to set `dns_discovery_domain` without the whole domain
part and since it is used only in DNS it should work with the domain search. But the man
page say `specifies the domain part of the service discovery DNS query` so I think we are
safe here.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-679029923
5:10 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
pbrezina commented:
"""
Please try to set ldap_uri to non-qualified name and see if the domain search works. If
there is not Kerberos authentication there maybe no requirement for this.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-684718189
1:57 p.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
thalman commented:
"""
my test shows that user can have NOT qualified names in ldap_uri now
ldap_uri = ldap://ldap/
and it works thanks to the domain search. With this patch users are no longer resolved.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-687324416
1:43 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
sumit-bose commented:
"""
Hi @thalman,
what about using your suggestion from
https://bugzilla.redhat.com/show_bug.cgi?id=1608496#c26?
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-688072841
3:31 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
pbrezina commented:
"""
'hostname.subdomain' will still work through domain search if subdomain is not a
top level domain, wouldn't it?
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-688161437
3:46 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
sumit-bose commented:
"""
'hostname.subdomain' will still work through domain search if
subdomain is not a top level domain, wouldn't it?
Hi,
no, as @thalman suggested in https://bugzilla.redhat.com/show_bug.cgi?id=1608496#c26 we
would check if there is a '.' in the name and since `hostname.subdomain` has a dot
we would add a dot to the end which would skip the domain searches.
Since we cannot reliable determine if what follows the '.' is a fully-qualified
domain or just the first part which has to be extended with what's available in
/etc/resolv.conf I guess we cannot avoid a config option which can switch `options.flags =
ARES_FLAG_NOSEARCH;` on and off.
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-688171034
8:06 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
thalman commented:
"""
Suggested solution with "." lookup is still possible but this one is more
simple, elegant and consistent.
I would rather see a new option "perform_dns_search" which will give as the
possibility to keep old behaviour rather than to do the trailing dot.
I also think there will be very few installation where admins depends on domain search.
Maybe some testing installation.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-688313575
9:39 a.m.
New subject: [sssd PR#5245][comment] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
sumit-bose commented:
"""
Suggested solution with "." lookup is still possible but
this one is more simple, elegant and consistent.
I would rather see a new option "perform_dns_search" which will give as the
possibility to keep old behaviour rather than to do the trailing dot.
I also think there will be very few installation where admins depends on domain search.
Maybe some testing installation.
Hi,
I agree, but `perform_dns_search` sounds misleading, I would suggestion something like
`dns_resolver_use_default_search_domains'.
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-688367440
3:41 a.m.
New subject: [sssd PR#5245][edited] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Action: edited
Changed field: title
Original value:
"""
RESOLV: Avoid DNS search to improve fail-over reaction
"""
7:17 a.m.
New subject: [sssd PR#5245][+Blocked] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Label: +Blocked
7:18 a.m.
New subject: [sssd PR#5245][+Deferred] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Label: +Deferred
7:18 a.m.
New subject: [sssd PR#5245][-Blocked] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Label: -Blocked
6:15 a.m.
New subject: [sssd PR#5245][-Deferred] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Label: -Deferred
8:29 a.m.
New subject: [sssd PR#5245][synchronized] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Action: synchronized
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5245/head:pr5245
git checkout pr5245
7:38 a.m.
New subject: [sssd PR#5245][synchronized] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Action: synchronized
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5245/head:pr5245
git checkout pr5245
7:40 a.m.
New subject: [sssd PR#5245][edited] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Action: edited
Changed field: title
Original value:
"""
WIP: RESOLV: Avoid DNS search to improve fail-over reaction
"""
7:57 a.m.
New subject: [sssd PR#5245][synchronized] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Action: synchronized
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5245/head:pr5245
git checkout pr5245
7:57 a.m.
New subject: [sssd PR#5245][edited] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Action: edited
Changed field: body
Original value:
"""
In case of unreachable DNS server or invalid hostname sssd/c-ares tries
to search in multiple domains based on the search directive
in resolv.conf
But the hostnames in config file are fully qualified and this just
extends the time spent with DNS resolution.
This patch set the c-ares library flags to avoid DNS search
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=1608496
"""
7:58 a.m.
New subject: [sssd PR#5245][+Waiting for review] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Label: +Waiting for review
4:06 a.m.
New subject: [sssd PR#5245][-Waiting for review] RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction
Label: -Waiting for review
4:06 a.m.
New subject: [sssd PR#5245][edited] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Action: edited
Changed field: title
Original value:
"""
RESOLV: Avoid DNS search to improve fail-over reaction
"""
4:08 a.m.
New subject: [sssd PR#5245][comment] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
thalman commented:
"""
Patch works for ldap provider but it looks like DNS search is still performed in case of
AD provider. I need to investigate it more
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-729574707
8:23 a.m.
New subject: [sssd PR#5245][comment] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
elkoniu commented:
"""
@thalman If this PR is still alive and ongoing? If not maybe close it and reopen when
there will be new changes? @alexey-tikhonov If I remember correct last time you run some
upstream PR list cleaning to close long standing WIP PRs?
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-799415378
8:30 a.m.
New subject: [sssd PR#5245][comment] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
alexey-tikhonov commented:
"""
This PR was discussed on a team meeting and Tomas said he plans to finish it.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-799420619
5:50 a.m.
New subject: [sssd PR#5245][comment] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
thalman commented:
"""
I decided to close the PR due to my capacity. I will reopen it once there is a progress.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5245#issuecomment-800154853
5:50 a.m.
New subject: [sssd PR#5245][closed] WIP: RESOLV: Avoid DNS search to improve fail-over reaction
URL: https://github.com/SSSD/sssd/pull/5245
Author: thalman
Title: #5245: WIP: RESOLV: Avoid DNS search to improve fail-over reaction
Action: closed
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5245/head:pr5245
git checkout pr5245
1152
days inactive
1396
days old
sssd-devel@lists.fedorahosted.org
31 comments
5 participants
participants (5)
-
alexey-tikhonov -
elkoniu
-
pbrezina
-
sumit-bose
-
thalman