[TACACS] Improve per-command authorization performance by read passwd entry with getpwent #16460
Conversation
liuh-80
changed the title
|
In "Tested branch (Please provide the tested image version)", please provide a version to indicate you have tested on earliest backport branch. #Closed |
Fixed, add UT to cover new codes. |
liuh-80
changed the title
|
Fixed, PR description updated. Change can't be clean cherry-pick to 202205, create a manually cherry-pick PR: #16659 |
|
Close and open to trigger re-build. |
|
TACACS UT keeps failed on T0 device, every time failed on different place. test on local test bed all UT passed. After check test failed log, seems UT check TACPLUS server log before server updates it. create a new UT to fix this issue.: |
|
UT fix merged, close and re-open to trigger validation. |
|
Master branch build image failed, waiting fix merge first: #16859 |
|
Cherry-pick to 202205 will have conflict, here is manually cherry-pick PR for 202205: #16659 |
|
UT still failed, seems found a corner case, will fix and update later. |
|
Close and reopen to trigger rebuild and validation. |
…ad passwd entry with getpwent (#16659) Improve per-command authorization performance by read passwd entry with getpwent. This is manually cherry-pick PR for #16460 Why I did it Currently per-command authorization will check if user is remote user with getpwnam API, which will trigger tacplus-nss for authentication with TACACS server. But this is not necessary because when user login the user information already add to local passwd file. Use getpwent API can directly read from passwd file, this will improve per-command authorization performance.
| return ERROR_CHECK_LOCAL_USER; | ||
| } | ||
| if (strcmp(ppwd->pw_name, user) != 0) { | ||
| continue; |
There was a problem hiding this comment.
This will not be an infinity loop, the getpwent_r API designed to return next entry in passwd, the loop will end when there is no next entry:
Improve per-command authorization performance by read passwd entry with getpwent.
Why I did it
Currently per-command authorization will check if user is remote user with getpwnam API, which will trigger tacplus-nss for authentication with TACACS server.
But this is not necessary because when user login the user information already add to local passwd file.
Use getpwent API can directly read from passwd file, this will improve per-command authorization performance.
Work item tracking
How I did it
Improve per-command authorization performance by read passwd entry with getpwent.
How to verify it
Pass all UT.
Which release branch to backport (provide reason below if selected)
Tested branch (Please provide the tested image version)
Description for the changelog
Improve per-command authorization performance by read passwd entry with getpwent.
Link to config_db schema for YANG module changes
A picture of a cute animal (not mandatory but encouraged)