ipa_subdomains.c revision 05d935cc9d04f03522d0bb44598d22d99b085926
/*
SSSD
IPA Subdomains Module
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ldap/sdap_async.h"
#include "providers/ldap/sdap_idmap.h"
#include "providers/ipa/ipa_subdomains.h"
#include "providers/ipa/ipa_common.h"
#include <ctype.h>
#define SUBDOMAINS_FILTER "objectclass=ipaNTTrustedDomain"
#define MASTER_DOMAIN_FILTER "objectclass=ipaNTDomainAttrs"
#define RANGE_FILTER "objectclass=ipaIDRange"
#define IPA_CN "cn"
#define IPA_FLATNAME "ipaNTFlatName"
#define IPA_SID "ipaNTSecurityIdentifier"
#define IPA_TRUSTED_DOMAIN_SID "ipaNTTrustedDomainSID"
#define IPA_RANGE_TYPE "ipaRangeType"
#define IPA_BASE_ID "ipaBaseID"
#define IPA_ID_RANGE_SIZE "ipaIDRangeSize"
#define IPA_BASE_RID "ipaBaseRID"
#define IPA_SECONDARY_BASE_RID "ipaSecondaryBaseRID"
#define OBJECTCLASS "objectClass"
#define IPA_ASSIGNED_ID_VIEW "ipaAssignedIDView"
/* do not refresh more often than every 5 seconds for now */
#define IPA_SUBDOMAIN_REFRESH_LIMIT 5
#define IPA_SUBDOMAIN_DISABLED_PERIOD 3600
enum ipa_subdomains_req_type {
IPA_SUBDOMAINS_MAX /* Counter */
};
struct ipa_subdomains_req_params {
const char *filter;
const char *attrs[9];
};
struct ipa_subdomains_ctx {
struct ipa_id_ctx *id_ctx;
struct sdap_id_ctx *sdap_id_ctx;
struct sdap_search_base **search_bases;
struct sdap_search_base **master_search_bases;
struct sdap_search_base **ranges_search_bases;
struct sdap_search_base **host_search_bases;
struct tevent_timer *timer_event;
bool configured_explicit;
bool view_read_at_init;
};
{
sd_ctx->view_read_at_init = true;
}
{
struct ipa_subdomains_ctx *subdom_ctx;
struct ipa_subdomains_ctx);
if (subdom_ctx == NULL) {
return NULL;
}
return subdom_ctx->be_ctx;
}
static errno_t
{
/* Just continue */
}
return ret;
}
return ret;
}
"sss_krb5_write_mappings failed.\n");
/* Just continue */
}
return EOK;
}
char *domain_name,
struct sysdb_attrs **reply,
struct range_info ***_range_list)
{
struct range_info *r;
const char *value;
size_t c;
size_t d;
int ret;
enum idmap_error_code err;
char *name1;
char *name2;
char *sid1;
char *sid2;
struct sss_idmap_range range1;
struct sss_idmap_range range2;
bool mapping1;
bool mapping2;
if (range_list == NULL) {
return ENOMEM;
}
for (c = 0; c < count; c++) {
if (r == NULL) {
goto done;
}
goto done;
}
goto done;
}
if (r->trusted_dom_sid == NULL) {
goto done;
}
goto done;
}
&r->base_id);
goto done;
}
&r->id_range_size);
goto done;
}
&r->base_rid);
goto done;
}
&r->secondary_base_rid);
goto done;
}
if (r->range_type == NULL) {
goto done;
}
/* Older IPA servers might not have the range_type attribute, but
* only support local ranges and trusts with algorithmic mapping. */
if (r->trusted_dom_sid == NULL) {
} else {
}
} else {
goto done;
}
if (r->range_type == NULL) {
goto done;
}
goto done;
}
for (d = 0; d < c; d++) {
("get_idmap_data_from_range failed.\n"));
goto done;
}
if (err != IDMAP_SUCCESS) {
"Collision of ranges [%s] and [%s] detected.\n",
goto done;
}
}
range_list[c] = r;
}
range_list[c] = NULL;
done:
}
return ret;
}
struct sysdb_attrs *attrs,
bool *_enumerates)
{
const char *name;
return ret;
}
return EOK;
}
struct ldb_context *ldb_ctx,
struct sysdb_attrs *attrs,
char **_forest)
{
int ret;
goto done;
}
if (ipa_subdom_is_member_dom(dn) == false) {
goto done;
}
goto done;
}
done:
}
return ret;
}
struct ipa_id_ctx *id_ctx,
struct ldb_context *ldb_ctx,
{
} else {
/* Clients do not have access to the trust objects's trust direction
* and don't generally care
*/
*_direction = 0;
return EOK;
}
}
struct ipa_id_ctx *id_ctx,
struct sdap_idmap_ctx *sdap_idmap_ctx,
struct sysdb_attrs *attrs)
{
const char *name;
char *realm;
const char *flat;
const char *id;
int ret;
bool mpg;
bool enumerate;
return ENOMEM;
}
goto done;
}
if (!realm) {
goto done;
}
if (ret) {
goto done;
}
if (ret) {
goto done;
}
goto done;
}
goto done;
}
&direction);
"ipa_get_sd_trust_direction failed: %d\n", ret);
goto done;
}
if (ret) {
goto done;
}
done:
return ret;
}
struct ipa_id_ctx *id_ctx,
struct sdap_idmap_ctx *sdap_idmap_ctx,
struct sysdb_attrs *attrs)
{
int ret;
if (ret == ERR_TRUST_NOT_SUPPORTED) {
} else if (ret) {
/* Nothing we can do about the error. */
"will try to use cached subdomain\n");
}
}
bool *changes)
{
const char *value;
int c, h;
int ret;
h = 0;
/* check existing subdomains */
for (c = 0; c < count; c++) {
if (handled[c]) {
continue;
}
goto done;
}
break;
}
}
if (c >= count) {
/* ok this subdomain does not exist anymore, let's clean up */
goto done;
}
/* Remove the AD ID ctx from the list of LDAP domains */
} else {
/* ok let's try to update it */
reply[c]);
handled[c] = true;
h++;
}
}
if (count == h) {
/* all domains were already accounted for and have been updated */
goto done;
}
/* if we get here it means we have changes to the subdomains list */
*changes = true;
for (c = 0; c < count; c++) {
if (handled[c]) {
continue;
}
reply[c]);
}
done:
ctx->last_refreshed = 0;
} else {
}
return ret;
}
struct ipa_subdomains_req_ctx {
struct ipa_subdomains_ctx *sd_ctx;
struct sdap_id_op *sdap_op;
char *current_filter;
struct sdap_search_base **search_bases;
int search_base_iter;
struct sysdb_attrs **reply;
};
static errno_t
struct sdap_search_base **search_bases,
enum ipa_subdomains_req_type type);
static errno_t
enum ipa_subdomains_req_type type);
static struct ipa_subdomains_req_params subdomain_requests[] = {
},
},
{ RANGE_FILTER,
{ OBJECTCLASS, IPA_CN,
}
}
};
{
struct tevent_req *req;
int dp_error = DP_ERR_FATAL;
int ret;
goto done;
}
req_ctx->search_base_iter = 0;
req_ctx->reply_count = 0;
goto done;
}
goto done;
}
return;
done:
}
}
{
int ret;
int dp_error = DP_ERR_FATAL;
struct ipa_subdomains_req_ctx *ctx;
if (ret) {
if (dp_error == DP_ERR_OFFLINE) {
"No IPA server is available, cannot get the "
"subdomain list while offline\n");
} else {
"Failed to connect to IPA server: [%d](%s)\n",
}
goto fail;
}
goto fail;
}
return;
fail:
}
static errno_t
enum ipa_subdomains_req_type type)
{
struct tevent_req *req;
struct sdap_search_base *base;
struct ipa_subdomains_req_params *params;
if (type >= IPA_SUBDOMAINS_MAX) {
return EINVAL;
}
return EOK;
}
return ENOMEM;
}
SDAP_SEARCH_TIMEOUT), false);
return ENOMEM;
}
return EAGAIN;
}
static errno_t
struct sdap_search_base **search_bases,
enum ipa_subdomains_req_type type)
{
ctx->search_base_iter = 0;
}
static errno_t
enum ipa_subdomains_req_type type)
{
ctx->search_base_iter++;
}
{
struct tevent_req *req;
struct sdap_search_base *base;
struct sdap_attr_map_info *maps;
return ENOMEM;
}
return EOK;
}
1, maps,
return ENOMEM;
}
return EAGAIN;
}
{
int ret;
int sret;
struct ipa_subdomains_req_ctx *ctx;
const char *view_name;
int dp_error = DP_ERR_FATAL;
/* Depending on the version 389ds return a different error code if the
* search for the view name failed because our dereference attribute
* ipaAssignedIDView is not known. Newer version return
* LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to
* EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which
* is returned as EIO. In both cases we have to assume that the server
* is not view aware and keep the view name unset. */
"like server does not support views.\n");
return;
goto done;
}
} else {
}
goto done;
}
if (reply_count == 0) {
ctx->search_base_iter++;
return;
} else {
goto done;
}
} else if (reply_count > 1) {
"get_view_name request returned more than one object.\n");
goto done;
} else {
&view_name);
goto done;
}
}
"Found IPA default view name, replacing with sysdb default.\n");
}
"View name changed, this is not supported at runtime. " \
"Please restart SSSD to get the new view applied.\n");
} else {
/* View name changed */
"sysdb_transaction_start failed.\n");
goto done;
}
SYSDB_DEFAULT_VIEW_NAME) != 0) {
/* Old view was not the default view, delete view tree */
"sysdb_delete_view_tree failed.\n");
"sysdb_transaction_cancel failed.\n");
goto done;
}
goto done;
}
}
"sysdb_invalidate_overrides failed.\n");
"sysdb_transaction_cancel failed.\n");
goto done;
}
goto done;
}
"sysdb_transaction_commit failed.\n");
goto done;
}
/* TODO: start referesh task */
}
} else {
}
}
}
/* refresh view data of all domains at startup */
"sysdb_master_domain_update failed.\n");
goto done;
}
goto done;
}
}
}
done:
}
}
{
int ret;
struct ipa_subdomains_req_ctx *ctx;
struct sss_domain_info *domain;
bool refresh_has_changes = false;
int dp_error = DP_ERR_FATAL;
goto done;
}
if (reply_count) {
goto done;
}
reply_count * sizeof(struct sysdb_attrs *));
}
return;
goto done;
}
goto done;
}
if (refresh_has_changes) {
goto done;
}
domain);
goto done;
}
}
ctx->search_base_iter = 0;
IPA_HOSTNAME));
goto done;
}
/* Only get view on clients, on servers it is always 'default' */
return;
goto done;
}
}
done:
}
}
{
int ret;
struct sss_domain_info *domain;
return ret;
}
return EAGAIN;
return ret;
}
}
return EOK;
}
{
int dp_error = DP_ERR_FATAL;
struct ipa_subdomains_req_ctx *ctx;
struct sss_domain_info *domain;
goto done;
}
"ipa_ranges_parse_results request failed.\n");
goto done;
}
goto done;
}
return;
goto done;
}
/* Master domain is up-to-date. Continue checking subdomains */
return;
goto done;
}
done:
}
}
{
int dp_error = DP_ERR_FATAL;
size_t reply_count = 0;
struct ipa_subdomains_req_ctx *ctx;
goto done;
}
if (reply_count) {
const char *realm;
goto done;
}
goto done;
}
goto done;
}
goto done;
}
/* There is only one master record. Don't bother checking other IPA
* search bases; move to checking subdomains instead
*/
return;
}
/* Either no search bases or an error. End the request in both cases */
} else {
return;
goto done;
}
/* Right now we know there has been an error
* and we don't have the master domain record
*/
}
}
done:
}
}
static void ipa_subdom_online_cb(void *pvt);
struct tevent_timer *te,
struct timeval current_time,
void *pvt)
{
}
const char *errstr)
{
}
static void ipa_subdom_reset_timeouts_cb(void *pvt)
{
struct ipa_subdomains_ctx *ctx;
return;
}
ctx->last_refreshed = 0;
ctx->disabled_until = 0;
}
static void ipa_subdom_online_cb(void *pvt)
{
struct ipa_subdomains_ctx *ctx;
if (!ctx) {
return;
}
ctx->disabled_until = 0;
return;
}
if (!ctx->timer_event) {
}
}
static void ipa_subdom_offline_cb(void *pvt)
{
struct ipa_subdomains_ctx *ctx;
if (ctx) {
}
}
bool *configured_explicit)
{
int ret;
char *tmp_str;
return ENOMEM;
}
&tmp_str);
goto done;
}
*configured_explicit = false;
} else {
*configured_explicit = true;
}
done:
return ret;
}
{
struct ipa_subdomains_ctx *ctx;
struct ipa_subdomains_ctx);
if (!ctx) {
return;
}
return;
}
return;
}
}
struct bet_ops ipa_subdomains_ops = {
};
struct ipa_id_ctx *id_ctx,
void **pvt_data)
{
struct ipa_subdomains_ctx *ctx;
int ret;
bool configured_explicit = false;
return ret;
}
return ENOMEM;
}
ctx->disabled_until = 0;
*ops = &ipa_subdomains_ops;
NULL);
"Failed to add subdom reset timeouts callback\n");
}
}
}
"Users from trusted domains might not be resolved correctly\n");
}
return ret;
}
return EOK;
}