sdap_async_sudo.c revision cb235ec146f1ba81c211f8506736edea436be28a
/*
SSSD
Async LDAP Helper routines for sudo
Authors:
Pavel Březina <pbrezina@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <talloc.h>
#include <tevent.h>
#include "providers/dp_backend.h"
#include "providers/ldap/ldap_common.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ldap/sdap_sudo.h"
#include "providers/ldap/sdap_sudo_cache.h"
#include "db/sysdb_sudo.h"
struct sdap_sudo_load_sudoers_state {
struct tevent_context *ev;
struct sdap_options *opts;
struct sdap_handle *sh;
int timeout;
const char **attrs;
const char *filter;
struct sdap_search_base **search_bases;
struct sysdb_attrs **rules;
};
static struct tevent_req *
struct tevent_context *ev,
struct sdap_options *opts,
struct sdap_handle *sh,
const char *ldap_filter)
{
struct tevent_req *req;
struct sdap_sudo_load_sudoers_state *state;
int ret;
struct sdap_sudo_load_sudoers_state);
if (!req) {
return NULL;
}
"SUDOERS lookup request without a search base\n");
goto immediately;
}
/* create attrs from map */
goto immediately;
}
/* begin search */
/* asynchronous processing */
return req;
}
} else {
}
return req;
}
{
struct sdap_sudo_load_sudoers_state *state;
struct sdap_search_base *base;
struct tevent_req *subreq;
char *filter;
return EOK;
}
/* Combine lookup and search base filters. */
return ENOMEM;
}
return ENOMEM;
}
return EAGAIN;
}
{
struct tevent_req *req;
struct sdap_sudo_load_sudoers_state *state;
struct sdap_search_base *search_base;
int ret;
int i;
return;
}
/* Add rules to result. */
if (count > 0) {
struct sysdb_attrs *,
return;
}
for (i = 0; i < count; i++) {
attrs[i]);
}
}
/* Try next search base. */
}
return;
}
struct sysdb_attrs ***rules)
{
struct sdap_sudo_load_sudoers_state *state;
return EOK;
}
const char *filter,
struct sdap_attr_map *map,
struct sysdb_attrs **rules)
{
const char *name;
int i;
/* removes downloaded rules from the cache */
return EOK;
}
for (i = 0; i < rules_count; i++) {
&name);
continue;
}
"Failed to delete rule %s: [%s]\n",
continue;
}
}
} else {
/* purge cache by provided filter */
goto done;
}
}
done:
}
return ret;
}
struct sss_domain_info *domain,
struct sdap_options *opts,
struct sysdb_attrs **rules,
int cache_timeout,
char **_usn)
{
/* Empty sudoers? Done. */
return EOK;
}
_usn);
return ret;
}
return EOK;
}
{
unsigned int usn_number;
return;
}
/* If the USN value is unknown and we don't have max_sudo_value set
* (possibly first full refresh which did not find any rule) we will
* set zero so smart refresh can pick up. */
}
return;
}
return;
}
}
}
struct sdap_attr_map *map,
char **hostnames,
char **ip_addr,
bool netgroups,
bool regexp)
{
int i;
return NULL;
}
goto done;
}
/* sudoHost is not specified */
goto done;
}
/* ALL */
goto done;
}
/* hostnames */
hostnames[i]);
goto done;
}
}
}
/* ip addresses and networks */
ip_addr[i]);
goto done;
}
}
}
/* sudoHost contains netgroup - will be filtered more by sudo */
if (netgroups) {
"*");
goto done;
}
}
/* sudoHost contains regexp - will be filtered more by sudo */
/* from sudo match.c :
* #define has_meta(s) (strpbrk(s, "\\?*[]") != NULL)
*/
if (regexp) {
"(|(%s=*\\\\*)(%s=*?*)(%s=*\\2A*)"
"(%s=*[*]*))",
goto done;
}
}
goto done;
}
done:
return filter;
}
struct sdap_attr_map *map,
struct sdap_sudo_ctx *sudo_ctx,
const char *rule_filter)
{
char *host_filter = NULL;
if (!sudo_ctx->use_host_filter) {
}
return NULL;
}
if (host_filter == NULL) {
goto done;
}
goto done;
}
done:
return filter;
}
struct sdap_sudo_refresh_state {
struct sdap_sudo_ctx *sudo_ctx;
struct tevent_context *ev;
struct sdap_server_opts *srv_opts;
struct sdap_options *opts;
struct sdap_id_op *sdap_op;
struct sss_domain_info *domain;
const char *search_filter;
const char *delete_filter;
int dp_error;
};
struct sdap_sudo_ctx *sudo_ctx,
const char *search_filter,
const char *delete_filter)
{
struct tevent_req *req;
struct sdap_sudo_refresh_state *state;
int ret;
if (!req) {
return NULL;
}
/* if we don't have a search filter, this request is meaningless */
if (search_filter == NULL) {
goto immediately;
}
goto immediately;
}
goto immediately;
}
goto immediately;
}
/* asynchronous processing */
return req;
}
} else {
}
return req;
}
{
struct sdap_sudo_refresh_state *state;
struct tevent_req *subreq;
int ret;
return ret;
}
return EAGAIN;
}
{
struct tevent_req *req;
struct sdap_sudo_refresh_state *state;
int dp_error;
int ret;
return;
}
/* Renew host information if needed. */
return;
}
return;
}
}
}
{
struct sdap_sudo_ctx *sudo_ctx;
struct sdap_sudo_refresh_state *state;
struct tevent_req *req;
"host filter will be disabled [%d]: %s\n",
sudo_ctx->use_host_filter = false;
} else {
sudo_ctx->use_host_filter = true;
}
}
}
{
struct sdap_sudo_refresh_state *state;
struct tevent_req *subreq;
char *filter;
/* We are connected. Host information may have changed during transition
* from offline to online state. At this point we can combine search
* and host filter. */
return ENOMEM;
}
filter);
return ENOMEM;
}
return EAGAIN;
}
{
struct tevent_req *req;
struct sdap_sudo_refresh_state *state;
size_t rules_count = 0;
int dp_error;
int ret;
bool in_transaction = false;
/* retry */
}
return;
}
/* start transaction */
goto done;
}
in_transaction = true;
/* purge cache */
goto done;
}
/* store rules */
goto done;
}
/* commit transaction */
goto done;
}
in_transaction = false;
/* remember new usn */
done:
if (in_transaction) {
}
}
} else {
}
}
struct tevent_req *req,
int *dp_error,
{
struct sdap_sudo_refresh_state *state;
}
return EOK;
}