From 363e1143de03e8321894a05983640799e9bb8e16 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 17 Jun 2005 10:57:55 +0000 Subject: r7680: Move to using our own private enum for the principal type inside the hdb-ldb module. This removes the need for the KRBTGT case to exist in the broader heimdal code. Andrew Bartlett (This used to be commit fb83465dbccae8af5eb26f735e60f3f40e944446) --- source4/kdc/hdb-ldb.c | 70 +++++++++++++++++++++++++++++---------------------- 1 file changed, 40 insertions(+), 30 deletions(-) (limited to 'source4/kdc/hdb-ldb.c') diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c index b751ff33c0..ee5bed2682 100644 --- a/source4/kdc/hdb-ldb.c +++ b/source4/kdc/hdb-ldb.c @@ -39,6 +39,8 @@ #include "lib/ldb/include/ldb.h" #include "system/iconv.h" +enum hdb_ldb_ent_type +{ HDB_LDB_ENT_TYPE_CLIENT, HDB_LDB_ENT_TYPE_SERVER, HDB_LDB_ENT_TYPE_KRBTGT, HDB_LDB_ENT_TYPE_ANY }; static const char * const krb5_attrs[] = { "objectClass", @@ -95,7 +97,7 @@ static KerberosTime ldb_msg_find_krb5time_ldap_time(struct ldb_message *msg, con return timegm(&tm); } -static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum hdb_ent_type ent_type) +static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum hdb_ldb_ent_type ent_type) { HDBFlags flags = int2HDBFlags(0); @@ -109,32 +111,32 @@ static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum h /* Account types - clear the invalid bit if it turns out to be valid */ if (userAccountControl & UF_NORMAL_ACCOUNT) { - if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) { + if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) { flags.client = 1; } flags.invalid = 0; } if (userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT) { - if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) { + if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) { flags.client = 1; } flags.invalid = 0; } if (userAccountControl & UF_WORKSTATION_TRUST_ACCOUNT) { - if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) { + if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) { flags.client = 1; } - if (ent_type == HDB_ENT_TYPE_SERVER || ent_type == HDB_ENT_TYPE_ENUM) { + if (ent_type == HDB_LDB_ENT_TYPE_SERVER || ent_type == HDB_LDB_ENT_TYPE_ANY) { flags.server = 1; } flags.invalid = 0; } if (userAccountControl & UF_SERVER_TRUST_ACCOUNT) { - if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) { + if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) { flags.client = 1; } - if (ent_type == HDB_ENT_TYPE_SERVER || ent_type == HDB_ENT_TYPE_ENUM) { + if (ent_type == HDB_LDB_ENT_TYPE_SERVER || ent_type == HDB_LDB_ENT_TYPE_ANY) { flags.server = 1; } flags.invalid = 0; @@ -208,7 +210,7 @@ static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum h */ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, TALLOC_CTX *mem_ctx, krb5_const_principal principal, - enum hdb_ent_type ent_type, struct ldb_message *realm_msg, + enum hdb_ldb_ent_type ent_type, struct ldb_message *realm_msg, struct ldb_message *msg, hdb_entry *ent) { @@ -217,18 +219,13 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, int i; krb5_error_code ret = 0; const char *dnsdomain = ldb_msg_find_string(realm_msg, "dnsDomain", NULL); - char *realm = talloc_strdup(mem_ctx, dnsdomain); + char *realm = strupper_talloc(mem_ctx, dnsdomain); if (!realm) { krb5_set_error_string(context, "talloc_strdup: out of memory"); ret = ENOMEM; goto out; } - - /* TODO: Use Samba charset functions */ - for (i=0; i< strlen(realm); i++) { - realm[i] = toupper(realm[i]); - } krb5_warnx(context, "LDB_message2entry:\n"); @@ -237,7 +234,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, userAccountControl = ldb_msg_find_int(msg, "userAccountControl", 0); ent->principal = malloc(sizeof(*(ent->principal))); - if (ent_type == HDB_ENT_TYPE_ENUM && principal == NULL) { + if (ent_type == HDB_LDB_ENT_TYPE_ANY && principal == NULL) { const char *samAccountName = ldb_msg_find_string(msg, "samAccountName", NULL); if (!samAccountName) { krb5_set_error_string(context, "LDB_message2entry: no samAccountName present"); @@ -277,7 +274,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, ent->flags = uf2HDBFlags(context, userAccountControl, ent_type); - if (ent_type == HDB_ENT_TYPE_KRBTGT) { + if (ent_type == HDB_LDB_ENT_TYPE_KRBTGT) { ent->flags.invalid = 0; ent->flags.server = 1; } @@ -444,7 +441,7 @@ out: static krb5_error_code LDB_lookup_principal(krb5_context context, struct ldb_context *ldb_ctx, TALLOC_CTX *mem_ctx, krb5_const_principal principal, - enum hdb_ent_type ent_type, + enum hdb_ldb_ent_type ent_type, const char *realm_dn, struct ldb_message ***pmsg) { @@ -483,19 +480,19 @@ static krb5_error_code LDB_lookup_principal(krb5_context context, struct ldb_con switch (ent_type) { - case HDB_ENT_TYPE_KRBTGT: + case HDB_LDB_ENT_TYPE_KRBTGT: filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(samAccountName=%s))", KRB5_TGS_NAME); break; - case HDB_ENT_TYPE_CLIENT: + case HDB_LDB_ENT_TYPE_CLIENT: filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(|(samAccountName=%s)(userPrincipalName=%s)))", short_princ, princ_str_talloc); break; - case HDB_ENT_TYPE_SERVER: + case HDB_LDB_ENT_TYPE_SERVER: filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(|(samAccountName=%s)(servicePrincipalName=%s)))", short_princ, short_princ); break; - case HDB_ENT_TYPE_ENUM: + case HDB_LDB_ENT_TYPE_ANY: filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(|(|(samAccountName=%s)(servicePrincipalName=%s))(userPrincipalName=%s)))", short_princ, short_princ, princ_str_talloc); break; @@ -710,6 +707,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, { struct ldb_message **msg = NULL; struct ldb_message **realm_msg = NULL; + enum hdb_ldb_ent_type ldb_ent_type; krb5_error_code ret; const char *realm; @@ -736,17 +734,29 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, /* Cludge, cludge cludge. If the realm part of krbtgt/realm, * is in our db, then direct the caller at our primary * krgtgt */ - if (ent_type == HDB_ENT_TYPE_SERVER - && principal->name.name_string.len == 2 - && (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) == 0) - && (LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db, - mem_ctx, principal->name.name_string.val[1], NULL) == 0)) { - ent_type = HDB_ENT_TYPE_KRBTGT; + + switch (ent_type) { + case HDB_ENT_TYPE_SERVER: + if (principal->name.name_string.len == 2 + && (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) == 0) + && (LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db, + mem_ctx, principal->name.name_string.val[1], NULL) == 0)) { + ldb_ent_type = HDB_LDB_ENT_TYPE_KRBTGT; + } else { + ldb_ent_type = HDB_LDB_ENT_TYPE_SERVER; + } + break; + case HDB_ENT_TYPE_CLIENT: + ldb_ent_type = HDB_LDB_ENT_TYPE_CLIENT; + break; + case HDB_ENT_TYPE_ANY: + ldb_ent_type = HDB_LDB_ENT_TYPE_ANY; + break; } ret = LDB_lookup_principal(context, (struct ldb_context *)db->hdb_db, mem_ctx, - principal, ent_type, realm_dn, &msg); + principal, ldb_ent_type, realm_dn, &msg); if (ret != 0) { char *alias_from = principal->name.name_string.val[0]; @@ -754,7 +764,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, Principal alias_principal; /* Try again with a servicePrincipal alias */ - if (ent_type != HDB_ENT_TYPE_SERVER && ent_type != HDB_ENT_TYPE_ENUM) { + if (ent_type != HDB_LDB_ENT_TYPE_SERVER && ent_type != HDB_LDB_ENT_TYPE_ANY) { talloc_free(mem_ctx); return ret; } @@ -857,7 +867,7 @@ static krb5_error_code LDB_seq(krb5_context context, HDB *db, unsigned flags, hd if (priv->index < priv->count) { ret = LDB_message2entry(context, db, mem_ctx, - NULL, HDB_ENT_TYPE_ENUM, + NULL, HDB_LDB_ENT_TYPE_ANY, priv->realm_msgs[0], priv->msgs[priv->index++], entry); } else { ret = HDB_ERR_NOENTRY; -- cgit