summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--Makefile.am1
-rw-r--r--src/providers/ipa/ipa_id.h10
-rw-r--r--src/providers/ipa/ipa_s2n_exop.c657
3 files changed, 668 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am
index 00f466c6..fc54e716 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1196,6 +1196,7 @@ libsss_ipa_la_SOURCES = \
src/providers/ipa/ipa_dyndns.c \
src/providers/ipa/ipa_hosts.c \
src/providers/ipa/ipa_subdomains.c \
+ src/providers/ipa/ipa_s2n_exop.c \
src/providers/ipa/ipa_hbac_hosts.c \
src/providers/ipa/ipa_hbac_private.h \
src/providers/ipa/ipa_hbac_rules.c \
diff --git a/src/providers/ipa/ipa_id.h b/src/providers/ipa/ipa_id.h
index 3a8fdb44..b7923449 100644
--- a/src/providers/ipa/ipa_id.h
+++ b/src/providers/ipa/ipa_id.h
@@ -49,4 +49,14 @@ int ipa_get_netgroups_recv(struct tevent_req *req,
void ipa_check_online(struct be_req *be_req);
+struct tevent_req *ipa_s2n_get_acct_info_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct sdap_options *opts,
+ struct sss_domain_info *dom,
+ struct sdap_handle *sh,
+ const char **attrs,
+ int entry_type,
+ const char *user_name,
+ uid_t uid);
+int ipa_s2n_get_acct_info_recv(struct tevent_req *req);
#endif
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
new file mode 100644
index 00000000..26cb0aad
--- /dev/null
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -0,0 +1,657 @@
+/*
+ SSSD
+
+ IPA Helper routines - external users and groups with s2n plugin
+
+ Copyright (C) Sumit Bose <sbose@redhat.com> - 2011
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "util/util.h"
+#include "util/sss_nss.h"
+#include "db/sysdb.h"
+#include "providers/ldap/sdap_async_private.h"
+#include "providers/ldap/ldap_common.h"
+
+enum input_types {
+ INP_SID = 1,
+ INP_NAME,
+ INP_POSIX_UID,
+ INP_POSIX_GID
+};
+
+enum request_types {
+ REQ_SIMPLE = 1,
+ REQ_FULL
+};
+
+enum response_types {
+ RESP_SID = 1,
+ RESP_NAME,
+ RESP_USER,
+ RESP_GROUP
+};
+
+/* ==Sid2Name Extended Operation============================================= */
+#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
+
+struct ipa_s2n_exop_state {
+ struct sdap_handle *sh;
+
+ struct sdap_op *op;
+
+ int result;
+ char *retoid;
+ struct berval *retdata;
+};
+
+static void ipa_s2n_exop_done(struct sdap_op *op,
+ struct sdap_msg *reply,
+ int error, void *pvt);
+
+static struct tevent_req *ipa_s2n_exop_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct sdap_handle *sh,
+ struct berval *bv)
+{
+ struct tevent_req *req = NULL;
+ struct ipa_s2n_exop_state *state;
+ int ret;
+ int msgid;
+
+ req = tevent_req_create(mem_ctx, &state, struct ipa_s2n_exop_state);
+ if (!req) return NULL;
+
+ state->sh = sh;
+ state->result = LDAP_OPERATIONS_ERROR;
+ state->retoid = NULL;
+ state->retdata = NULL;
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("Executing extended operation\n"));
+
+ ret = ldap_extended_operation(state->sh->ldap, EXOP_SID2NAME_OID,
+ bv, NULL, NULL, &msgid);
+ if (ret == -1 || msgid == -1) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("ldap_extended_operation failed\n"));
+ goto fail;
+ }
+ DEBUG(SSSDBG_TRACE_INTERNAL, ("ldap_extended_operation sent, msgid = %d\n", msgid));
+
+ /* FIXME: get timeouts from configuration, for now 10 secs. */
+ ret = sdap_op_add(state, ev, state->sh, msgid, ipa_s2n_exop_done, req, 10,
+ &state->op);
+ if (ret) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to set up operation!\n"));
+ goto fail;
+ }
+
+ return req;
+
+fail:
+ tevent_req_error(req, EIO);
+ tevent_req_post(req, ev);
+ return req;
+}
+
+static void ipa_s2n_exop_done(struct sdap_op *op,
+ struct sdap_msg *reply,
+ int error, void *pvt)
+{
+ struct tevent_req *req = talloc_get_type(pvt, struct tevent_req);
+ struct ipa_s2n_exop_state *state = tevent_req_data(req,
+ struct ipa_s2n_exop_state);
+ int ret;
+ char *errmsg = NULL;
+ char *retoid = NULL;
+ struct berval *retdata = NULL;
+
+ if (error) {
+ tevent_req_error(req, error);
+ return;
+ }
+
+ ret = ldap_parse_result(state->sh->ldap, reply->msg,
+ &state->result, &errmsg, NULL, NULL,
+ NULL, 0);
+ if (ret != LDAP_SUCCESS) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ldap_parse_result failed (%d)\n", state->op->msgid));
+ ret = EIO;
+ goto done;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("ldap_extended_operation result: %s(%d), %s\n",
+ sss_ldap_err2string(state->result), state->result, errmsg));
+
+ if (state->result != LDAP_SUCCESS) {
+ ret = EIO;
+ goto done;
+ }
+
+ ret = ldap_parse_extended_result(state->sh->ldap, reply->msg,
+ &retoid, &retdata, 0);
+ if (ret != LDAP_SUCCESS) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ldap_parse_extendend_result failed (%d)\n", ret));
+ ret = EIO;
+ goto done;
+ }
+
+ state->retoid = talloc_strdup(state, retoid);
+ if (state->retoid == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ state->retdata = talloc(state, struct berval);
+ if (state->retdata == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+ state->retdata->bv_len = retdata->bv_len;
+ state->retdata->bv_val = talloc_memdup(state->retdata, retdata->bv_val,
+ retdata->bv_len);
+ if (state->retdata->bv_val == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_memdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = EOK;
+
+done:
+ ldap_memfree(errmsg);
+ ldap_memfree(retoid);
+ ber_bvfree(retdata);
+ if (ret == EOK) {
+ tevent_req_done(req);
+ } else {
+ tevent_req_error(req, ret);
+ }
+}
+
+static int ipa_s2n_exop_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
+ enum sdap_result *result, char **retoid,
+ struct berval **retdata)
+{
+ struct ipa_s2n_exop_state *state = tevent_req_data(req,
+ struct ipa_s2n_exop_state);
+
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+
+ if (state->result == LDAP_SUCCESS) {
+ *result = SDAP_SUCCESS;
+ *retoid = talloc_steal(mem_ctx, state->retoid);
+ *retdata = talloc_steal(mem_ctx, state->retdata);
+ } else {
+ *result = SDAP_ERROR;
+ }
+
+ return EOK;
+}
+
+static errno_t talloc_ber_flatten(TALLOC_CTX *mem_ctx, BerElement *ber,
+ struct berval **_bv)
+{
+ int ret;
+ struct berval *bv = NULL;
+ struct berval *tbv = NULL;
+
+ ret = ber_flatten(ber, &bv);
+ if (ret == -1) {
+ ret = EFAULT;
+ goto done;
+ }
+
+ tbv = talloc_zero(mem_ctx, struct berval);
+ if (tbv == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ tbv->bv_len = bv->bv_len;
+ tbv->bv_val = talloc_memdup(tbv, bv->bv_val, bv->bv_len);
+ if (tbv->bv_val == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = EOK;
+
+done:
+ ber_bvfree(bv);
+ if (ret == EOK) {
+ *_bv = tbv;
+ } else {
+ talloc_free(tbv);
+ }
+
+ return ret;
+}
+
+/* The extended operation expect the following ASN.1 encoded request data:
+ *
+ * ExtdomRequestValue ::= SEQUENCE {
+ * inputType ENUMERATED {
+ * sid (1),
+ * name (2),
+ * posix uid (3),
+ * posix gid (3)
+ * },
+ * requestType ENUMERATED {
+ * simple (1),
+ * full (2)
+ * },
+ * data InputData
+ * }
+ *
+ * InputData ::= CHOICE {
+ * sid OCTET STRING,
+ * name NameDomainData
+ * uid PosixUid,
+ * gid PosixGid
+ * }
+ *
+ * NameDomainData ::= SEQUENCE {
+ * domain_name OCTET STRING,
+ * object_name OCTET STRING
+ * }
+ *
+ * PosixUid ::= SEQUENCE {
+ * domain_name OCTET STRING,
+ * uid INTEGER
+ * }
+ *
+ * PosixGid ::= SEQUENCE {
+ * domain_name OCTET STRING,
+ * gid INTEGER
+ * }
+ *
+ */
+
+static errno_t s2n_encode_request(TALLOC_CTX *mem_ctx,
+ const char *domain_name,
+ int entry_type,
+ const char *name,
+ uint32_t id,
+ struct berval **_bv)
+{
+ BerElement *ber = NULL;
+ int ret;
+
+ ber = ber_alloc_t( LBER_USE_DER );
+ if (ber == NULL) {
+ return ENOMEM;
+ }
+
+ switch (entry_type) {
+ case BE_REQ_USER:
+ if (name != NULL) {
+ ret = ber_printf(ber, "{ee{ss}}", INP_NAME, REQ_FULL,
+ domain_name, name);
+ } else {
+ ret = ber_printf(ber, "{ee{si}}", INP_POSIX_UID, REQ_FULL,
+ domain_name, id);
+ }
+ break;
+ case BE_REQ_GROUP:
+ if (name != NULL) {
+ ret = ber_printf(ber, "{ee{ss}}", INP_NAME, REQ_FULL,
+ domain_name, name);
+ } else {
+ ret = ber_printf(ber, "{ee{si}}", INP_POSIX_GID, REQ_FULL,
+ domain_name, id);
+ }
+ break;
+ default:
+ ret = EINVAL;
+ goto done;
+ }
+ if (ret == -1) {
+ ret = EFAULT;
+ goto done;
+ }
+
+ ret = talloc_ber_flatten(mem_ctx, ber, _bv);
+ if (ret == -1) {
+ ret = EFAULT;
+ goto done;
+ }
+
+ ret = EOK;
+
+done:
+ ber_free(ber, 1);
+
+ return ret;
+}
+
+/* If the extendend operation is successful it returns the following ASN.1
+ * encoded response:
+ *
+ * ExtdomResponseValue ::= SEQUENCE {
+ * responseType ENUMERATED {
+ * sid (1),
+ * name (2),
+ * posix_user (3),
+ * posix_group (4)
+ * },
+ * data OutputData
+ * }
+ *
+ * OutputData ::= CHOICE {
+ * sid OCTET STRING,
+ * name NameDomainData,
+ * user PosixUser,
+ * group PosixGroup
+ * }
+ *
+ * NameDomainData ::= SEQUENCE {
+ * domain_name OCTET STRING,
+ * object_name OCTET STRING
+ * }
+ *
+ * PosixUser ::= SEQUENCE {
+ * domain_name OCTET STRING,
+ * user_name OCTET STRING,
+ * uid INTEGER
+ * gid INTEGER
+ * }
+ *
+ * PosixGroup ::= SEQUENCE {
+ * domain_name OCTET STRING,
+ * group_name OCTET STRING,
+ * gid INTEGER
+ * }
+ *
+ * Since we always request the full data set (REQ_FULL), i.e user/group name,
+ * domain name and corresponding unix id, only PosixUser (RESP_USER) and
+ * PosixGroup (RESP_GROUP) are handled by s2n_response_to_attrs().
+ */
+
+struct resp_attrs {
+ enum response_types response_type;
+ char *domain_name;
+ union {
+ struct passwd user;
+ struct group group;
+ } a;
+};
+
+static errno_t s2n_response_to_attrs(TALLOC_CTX *mem_ctx,
+ char *retoid,
+ struct berval *retdata,
+ struct resp_attrs **resp_attrs)
+{
+ BerElement *ber = NULL;
+ ber_tag_t tag;
+ int ret;
+ enum response_types type;
+ char *domain_name = NULL;
+ char *name = NULL;
+ uid_t uid;
+ gid_t gid;
+ struct resp_attrs *attrs = NULL;
+
+ if (retoid == NULL || retdata == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Missing OID or data.\n"));
+ return EINVAL;
+ }
+
+ if (strcmp(retoid, EXOP_SID2NAME_OID) != 0) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("Result has wrong OID, expected [%s], got [%s].\n",
+ EXOP_SID2NAME_OID, retoid));
+ return EINVAL;
+ }
+
+ ber = ber_init(retdata);
+ if (ber == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ber_init failed.\n"));
+ return EINVAL;
+ }
+
+ tag = ber_scanf(ber, "{e", &type);
+ if (tag == LBER_ERROR) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ber_scanf failed.\n"));
+ ret = EINVAL;
+ goto done;
+ }
+
+ attrs = talloc_zero(mem_ctx, struct resp_attrs);
+ if (attrs == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_zero failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ switch (type) {
+ case RESP_USER:
+ tag = ber_scanf(ber, "{aaii}}", &domain_name, &name, &uid, &gid);
+ if (tag == LBER_ERROR) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ber_scanf failed.\n"));
+ ret = EINVAL;
+ goto done;
+ }
+
+ attrs->a.user.pw_name = talloc_strdup(attrs, name);
+ if (attrs->a.user.pw_name == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ attrs->a.user.pw_uid = uid;
+ attrs->a.user.pw_gid = gid;
+
+ break;
+ case RESP_GROUP:
+ tag = ber_scanf(ber, "{aai}}", &domain_name, &name, &gid);
+ if (tag == LBER_ERROR) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ber_scanf failed.\n"));
+ ret = EINVAL;
+ goto done;
+ }
+
+ attrs->a.group.gr_name = talloc_strdup(attrs, name);
+ if (attrs->a.group.gr_name == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ attrs->a.group.gr_gid = gid;
+
+ break;
+ default:
+ DEBUG(SSSDBG_OP_FAILURE, ("Unexpected response type [%d].\n",
+ type));
+ ret = EINVAL;
+ goto done;
+ }
+
+ attrs->response_type = type;
+ attrs->domain_name = talloc_strdup(attrs, domain_name);
+ if (attrs->domain_name == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = EOK;
+
+done:
+ ber_memfree(domain_name);
+ ber_memfree(name);
+ ber_free(ber, 1);
+
+ if (ret == EOK) {
+ *resp_attrs = attrs;
+ } else {
+ talloc_free(attrs);
+ }
+
+ return ret;
+}
+
+struct ipa_s2n_get_user_state {
+ struct tevent_context *ev;
+ struct sdap_options *opts;
+ struct sss_domain_info *dom;
+ struct sdap_handle *sh;
+ const char **expected_attrs;
+};
+
+static void ipa_s2n_get_user_done(struct tevent_req *subreq);
+
+struct tevent_req *ipa_s2n_get_acct_info_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct sdap_options *opts,
+ struct sss_domain_info *dom,
+ struct sdap_handle *sh,
+ const char **attrs,
+ int entry_type,
+ const char *name,
+ uint32_t id)
+{
+ struct ipa_s2n_get_user_state *state;
+ struct tevent_req *req;
+ struct tevent_req *subreq;
+ struct berval *bv_req = NULL;
+ int ret = EFAULT;
+
+ if ((name == NULL && id == 0) || (name != NULL && id != 0)) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Either a user name or a uid expected, "
+ "not both or nothing.\n"));
+ return NULL;
+ }
+
+ req = tevent_req_create(mem_ctx, &state, struct ipa_s2n_get_user_state);
+ if (req == NULL) {
+ return NULL;
+ }
+
+ state->ev = ev;
+ state->opts = opts;
+ state->dom = dom;
+ state->sh = sh;
+ state->expected_attrs = attrs;
+
+ ret = s2n_encode_request(state, dom->name, entry_type, name, id, &bv_req);
+ if (ret != EOK) {
+ goto fail;
+ }
+
+ subreq = ipa_s2n_exop_send(state, state->ev, state->sh, bv_req);
+ if (subreq == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ipa_s2n_exop_send failed.\n"));
+ ret = ENOMEM;
+ goto fail;
+ }
+ tevent_req_set_callback(subreq, ipa_s2n_get_user_done, req);
+
+ return req;
+
+fail:
+ tevent_req_error(req, ret);
+ tevent_req_post(req, ev);
+
+ return req;
+}
+
+static void ipa_s2n_get_user_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(subreq,
+ struct tevent_req);
+ struct ipa_s2n_get_user_state *state = tevent_req_data(req,
+ struct ipa_s2n_get_user_state);
+ int ret;
+ enum sdap_result result;
+ char *retoid = NULL;
+ struct berval *retdata = NULL;
+ struct resp_attrs *attrs;
+ time_t now;
+ uint64_t timeout = 10*60*60; /* FIXME: find a better timeout ! */
+ const char *homedir = NULL;
+
+ ret = ipa_s2n_exop_recv(subreq, state, &result, &retoid, &retdata);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("s2n exop request failed.\n"));
+ goto done;
+ }
+
+ ret = s2n_response_to_attrs(state, retoid, retdata, &attrs);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("s2n_response_to_attrs failed.\n"));
+ goto done;
+ }
+
+ if (strcasecmp(state->dom->name, attrs->domain_name) != 0) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Unexpected domain name returned, "
+ "expected [%s], got [%s].\n",
+ state->dom->name, attrs->domain_name));
+ ret = EINVAL;
+ goto done;
+ }
+
+ now = time(NULL);
+ if (state->dom->subdomain_homedir) {
+ homedir = expand_homedir_template(state, state->dom->subdomain_homedir,
+ attrs->a.user.pw_name,
+ attrs->a.user.pw_uid,
+ state->dom->name);
+ if (homedir == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+ }
+
+ switch (attrs->response_type) {
+ case RESP_USER:
+ ret = sysdb_store_domuser(state->dom, attrs->a.user.pw_name, NULL,
+ attrs->a.user.pw_uid,
+ 0, NULL, /* gecos */
+ homedir, NULL,
+ NULL, NULL, timeout, now);
+ break;
+ case RESP_GROUP:
+ ret = sysdb_store_domgroup(state->dom, attrs->a.group.gr_name,
+ attrs->a.group.gr_gid, NULL, timeout,
+ now);
+ break;
+ default:
+ DEBUG(SSSDBG_OP_FAILURE, ("Unexpected response type [%d].\n",
+ attrs->response_type));
+ ret = EINVAL;
+ goto done;
+ }
+
+
+done:
+ if (ret == EOK) {
+ tevent_req_done(req);
+ } else {
+ tevent_req_error(req, ret);
+ }
+ return;
+}
+
+int ipa_s2n_get_acct_info_recv(struct tevent_req *req)
+{
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+
+ return EOK;
+}
generated by cgit (git 2.34.1) at 2024-12-16 12:54:05 +0000