ipa_hbac_services.c revision 770896b194b7b66b09c2a30545b4d091fd86b1f4
/*
SSSD
Authors:
Stephen Gallagher <sgallagh@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ipa/ipa_hbac_private.h"
#include "providers/ldap/sdap_async.h"
struct ipa_hbac_service_state {
struct tevent_context *ev;
struct sdap_handle *sh;
struct sdap_options *opts;
const char **attrs;
char *service_filter;
char *cur_filter;
struct sdap_search_base **search_bases;
int search_base_iter;
/* Return values */
struct sysdb_attrs **services;
struct sysdb_attrs **servicegroups;
};
static errno_t
struct ipa_hbac_service_state *state);
static void
static errno_t
struct ipa_hbac_service_state *state);
static void
struct tevent_req *
struct tevent_context *ev,
struct sdap_handle *sh,
struct sdap_options *opts,
struct sdap_search_base **search_bases)
{
struct ipa_hbac_service_state *state;
struct tevent_req *req;
char *service_filter;
return NULL;
}
state->search_base_iter = 0;
if (service_filter == NULL) {
goto immediate;
}
goto immediate;
}
}
goto immediate;
}
return req;
} else {
}
return req;
}
struct ipa_hbac_service_state *state)
{
struct tevent_req *subreq;
struct sdap_search_base *base;
return EOK;
}
return ENOMEM;
}
state->cur_filter));
true);
return EIO;
}
return EAGAIN;
}
static void
{
struct tevent_req *req =
struct ipa_hbac_service_state *state =
char *servicegroup_filter;
goto done;
}
/* If there are no services, we'll shortcut out
* This is still valid, as rules can apply to
* all services
*
* There's no reason to try to process groups
*/
return;
}
state->service_count = 0;
goto done;
}
goto done;
}
if (servicegroup_filter == NULL) {
goto done;
}
state->search_base_iter = 0;
}
goto done;
}
return;
done:
} else {
}
}
static errno_t
struct ipa_hbac_service_state *state)
{
struct tevent_req *subreq;
struct sdap_search_base *base;
return EOK;
}
return ENOMEM;
}
/* Look up service groups */
state->cur_filter));
true);
return EIO;
}
return EAGAIN;
}
static void
{
struct tevent_req *req =
struct ipa_hbac_service_state *state =
struct sysdb_attrs **groups;
struct sysdb_attrs **target;
int i;
&groups);
goto done;
}
if (group_count > 0) {
groups);
goto done;
}
goto done;
}
struct sysdb_attrs *,
goto done;
}
i = 0;
i++;
}
}
return;
goto done;
}
done:
} else {
}
}
struct sysdb_attrs ***services,
struct sysdb_attrs ***servicegroups)
{
size_t c;
struct ipa_hbac_service_state *state =
for (c = 0; c < state->service_count; c++) {
/* Guarantee the memory heirarchy of the list */
}
return EOK;
}
struct sss_domain_info *domain,
const char *rule_name,
struct sysdb_attrs *rule_attrs,
struct hbac_rule_element **services)
{
struct hbac_rule_element *new_services;
struct ldb_message_element *el;
size_t num_services = 0;
size_t num_servicegroups = 0;
size_t i;
char *member_dn;
char *filter;
struct ldb_message **msgs;
const char *name;
if (new_services == NULL) {
goto done;
}
/* First check for service category */
&new_services->category);
goto done;
}
/* Short-cut to the exit */
goto done;
}
/* Get the list of DNs from the member attr */
goto done;
}
el->num_values = 0;
}
/* Assume maximum size; We'll trim it later */
const char *,
goto done;
}
const char *,
goto done;
}
for (i = 0; i < el->num_values; i++) {
&member_dn);
goto done;
}
/* First check if this is a specific service */
}
if (count > 1) {
"Skipping \n"));
continue;
}
/* Original DN matched a single service. Get the service name */
goto done;
}
goto done;
}
num_services++;
} else { /* ret == ENOENT */
/* Check if this is a service group */
}
if (count > 1) {
"Skipping\n"));
continue;
}
/* Original DN matched a single group. Get the groupname */
goto done;
}
goto done;
}
} else { /* ret == ENOENT */
/* Neither a service nor a service group? Skip it */
"service group. Skipping\n", member_dn));
}
}
}
/* Shrink the arrays down to their real sizes */
const char *, num_services + 1);
goto done;
}
const char *, num_servicegroups + 1);
goto done;
}
done:
}
return ret;
}
const char *service_dn,
char **servicegroupname)
{
const char *rdn_name;
const char *svc_comp_name;
const char *hbac_comp_name;
const struct ldb_val *svc_comp_val;
const struct ldb_val *hbac_comp_val;
/* This is an IPA-specific hack. It may not
* work for non-IPA servers and will need to
* be changed if SSSD ever supports HBAC on
* a non-IPA server.
*/
*servicegroupname = NULL;
goto done;
}
if (!ldb_dn_validate(dn)) {
goto done;
}
/* RDN, services, hbac, and at least one DC= */
/* If it's fewer, it's not a group DN */
goto done;
}
/* If the RDN name is 'cn' */
/* Shouldn't happen if ldb_dn_validate()
* passed, but we'll be careful.
*/
goto done;
}
/* RDN has the wrong attribute name.
* It's not a service.
*/
goto done;
}
/* and the second component is "cn=hbacservicegroups" */
/* The second component name is not "cn" */
goto done;
}
if (strncasecmp("hbacservicegroups",
(const char *) svc_comp_val->data,
svc_comp_val->length) != 0) {
/* The second component value is not "hbacservicegroups" */
goto done;
}
/* and the third component is "hbac" */
/* The third component name is not "cn" */
goto done;
}
if (strncasecmp("hbac",
(const char *) hbac_comp_val->data,
hbac_comp_val->length) != 0) {
/* The third component value is not "hbac" */
goto done;
}
/* Then the value of the RDN is the group name */
if (*servicegroupname == NULL) {
goto done;
}
done:
return ret;
}