ipa_hbac_hosts.c revision c1fcc832ccfc237caac8b99be238cf2d598f908c
/*
SSSD
Authors:
Stephen Gallagher <sgallagh@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ldap/sdap_async.h"
struct ipa_hbac_host_state {
struct tevent_context *ev;
struct sss_domain_info *dom;
struct sdap_handle *sh;
struct sdap_options *opts;
const char *search_base;
const char **attrs;
/* Return values */
struct sysdb_attrs **hosts;
struct sysdb_attrs **hostgroups;
};
static void
static void
struct tevent_req *
struct tevent_context *ev,
struct sss_domain_info *dom,
struct sdap_handle *sh,
struct sdap_options *opts,
const char *search_base)
{
struct ipa_hbac_host_state *state;
struct tevent_req *req;
struct tevent_req *subreq;
char *host_filter;
return NULL;
}
if (host_filter == NULL) {
goto immediate;
}
goto immediate;
}
goto immediate;
}
return req;
} else {
}
return req;
}
static void
{
struct tevent_req *req =
struct ipa_hbac_host_state *state =
char *hostgroup_filter;
&state->host_count,
return;
}
if (state->host_count == 0) {
return;
}
return;
}
if (hostgroup_filter == NULL) {
return;
}
/* Look up host groups */
return;
}
}
static void
{
struct tevent_req *req =
struct ipa_hbac_host_state *state =
&state->hostgroups);
state->hostgroups);
goto done;
}
state->hostgroups);
goto done;
}
done:
} else {
}
}
struct sysdb_attrs ***hosts,
struct sysdb_attrs ***hostgroups)
{
size_t c;
struct ipa_hbac_host_state *state =
for (c = 0; c < state->host_count; c++) {
/* Guarantee the memory heirarchy of the list */
}
return EOK;
}
/*
* Functions to convert sysdb_attrs to the hbac_rule format
*/
struct sss_domain_info *domain,
const char *rule_name,
struct sysdb_attrs *rule_attrs,
const char *category_attr,
const char *member_attr,
struct hbac_rule_element **hosts)
{
struct hbac_rule_element *new_hosts;
struct ldb_message_element *el;
size_t num_hostgroups = 0;
size_t i;
char *member_dn;
char *filter;
struct ldb_message **msgs;
const char *name;
goto done;
}
/* First check for host category */
goto done;
}
/* Short-cut to the exit */
goto done;
}
/* Get the list of DNs from the member_attr */
goto done;
}
el->num_values = 0;
}
/* Assume maximum size; We'll trim it later */
const char *,
goto done;
}
const char *,
goto done;
}
for (i = 0; i < el->num_values; i++) {
&member_dn);
goto done;
}
/* First check if this is a specific host */
}
if (count > 1) {
continue;
}
/* Original DN matched a single host. Get the hostname */
NULL);
goto done;
}
name);
goto done;
}
num_hosts++;
} else { /* ret == ENOENT */
/* Check if this is a hostgroup */
}
if (count > 1) {
"Skipping\n"));
continue;
}
/* Original DN matched a single group. Get the groupname */
goto done;
}
goto done;
}
} else { /* ret == ENOENT */
/* Neither a host nor a hostgroup? Skip it */
"Skipping\n", member_dn));
}
}
}
/* Shrink the arrays down to their real sizes */
const char *, num_hosts + 1);
goto done;
}
const char *, num_hostgroups + 1);
goto done;
}
done:
}
return ret;
}
struct sss_domain_info *domain,
const char *rule_name,
struct sysdb_attrs *rule_attrs,
struct hbac_rule_element **thosts)
{
}
struct sss_domain_info *domain,
const char *rule_name,
struct sysdb_attrs *rule_attrs,
struct hbac_rule_element **source_hosts)
{
struct ldb_message_element *el;
struct hbac_rule_element *shosts;
&host_count, &shosts);
goto done;
}
/* All hosts (including external) are
* allowed.
*/
goto done;
}
/* Include external (non-IPA-managed) source hosts */
goto done;
}
goto done;
}
}
}
done:
}
return ret;
}
const char *host_dn,
char **hostgroupname)
{
const char *rdn_name;
const char *hostgroup_comp_name;
const char *account_comp_name;
const struct ldb_val *hostgroup_comp_val;
const struct ldb_val *account_comp_val;
/* This is an IPA-specific hack. It may not
* work for non-IPA servers and will need to
* be changed if SSSD ever supports HBAC on
* a non-IPA server.
*/
*hostgroupname = NULL;
goto done;
}
if (!ldb_dn_validate(dn)) {
goto done;
}
/* RDN, hostgroups, accounts, and at least one DC= */
/* If it's fewer, it's not a group DN */
goto done;
}
/* If the RDN name is 'cn' */
/* Shouldn't happen if ldb_dn_validate()
* passed, but we'll be careful.
*/
goto done;
}
/* RDN has the wrong attribute name.
* It's not a host.
*/
goto done;
}
/* and the second component is "cn=hostgroups" */
/* The second component name is not "cn" */
goto done;
}
if (strncasecmp("hostgroups",
(const char *) hostgroup_comp_val->data,
hostgroup_comp_val->length) != 0) {
/* The second component value is not "hostgroups" */
goto done;
}
/* and the third component is "accounts" */
/* The third component name is not "cn" */
goto done;
}
if (strncasecmp("accounts",
(const char *) account_comp_val->data,
account_comp_val->length) != 0) {
/* The third component value is not "accounts" */
goto done;
}
/* Then the value of the RDN is the group name */
if (*hostgroupname == NULL) {
goto done;
}
done:
return ret;
}