sdap_sudo.c revision 208bf72198fb3580bc67993b6de373bea0f06836
/*
Authors:
Pavel Březina <pbrezina@redhat.com>
Copyright (C) 2011 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <string.h>
#include <tevent.h>
#include "providers/dp_backend.h"
#include "providers/ldap/ldap_common.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ldap/sdap_sudo.h"
#include "providers/ldap/sdap_sudo_cache.h"
#include "db/sysdb_sudo.h"
struct sdap_sudo_full_refresh_state {
struct sdap_sudo_ctx *sudo_ctx;
struct sdap_id_ctx *id_ctx;
int dp_error;
int error;
};
struct sdap_sudo_ctx *sudo_ctx);
int *dp_error,
int *error);
struct sdap_sudo_rules_refresh_state {
struct sdap_id_ctx *id_ctx;
int dp_error;
int error;
};
struct sdap_sudo_ctx *sudo_ctx,
struct sdap_options *opts,
struct sdap_id_conn_cache *conn_cache,
char **rules);
int *dp_error,
int *error);
struct sdap_sudo_smart_refresh_state {
struct tevent_req *subreq;
struct sdap_id_ctx *id_ctx;
};
struct sdap_sudo_ctx *sudo_ctx);
int *dp_error,
int *error);
static void
{
}
struct bet_ops sdap_sudo_ops = {
};
struct sdap_id_ctx *id_ctx,
void **pvt_data)
{
int ret;
return ENOMEM;
}
*ops = &sdap_sudo_ops;
/* we didn't do any full refresh now,
* so we don't have current usn values available */
sudo_ctx->full_refresh_done = false;
return ret;
}
"(host filter will be disabled)\n"));
sudo_ctx->use_host_filter = false;
("Unable to setup periodical refresh"
/* periodical updates will not work, but specific-rule update
* is no affected by this, therefore we don't have to fail here */
}
} else {
}
return EOK;
}
{
int ret;
sudo_ctx->use_host_filter = false;
return;
}
}
}
{
struct tevent_req *req;
int ret;
if (smart_interval == 0 && full_interval == 0) {
"enabled. Setting smart refresh interval to default value (%d).\n",
return ret;
}
}
if (full_interval <= smart_interval) {
"than smart refresh interval. Periodical full refresh will be "
"disabled.\n"));
0);
return ret;
}
}
return ret;
}
if (last_full == 0) {
/* If this is the first startup, we need to kick off
* an refresh immediately, to close a window where
* clients requesting sudo information won't get an
* immediate reply with no entries
*/
tv = tevent_timeval_current();
} else {
/* At least one update has previously run,
* so clients will get cached data.
* We will delay the refresh so we don't slow
* down the startup process if this is happening
* during system boot.
*/
/* delay at least by 10s */
}
"rules! Periodical updates will not work!\n"));
return ENOMEM;
}
sudo_ctx);
return EOK;
}
{
unsigned int usn_number;
}
} else {
}
}
struct sdap_attr_map *map,
char **hostnames,
char **ip_addr,
bool netgroups,
bool regexp)
{
int i;
return NULL;
}
goto done;
}
/* ALL */
goto done;
}
/* hostnames */
hostnames[i]);
goto done;
}
}
}
/* ip addresses and networks */
ip_addr[i]);
goto done;
}
}
}
/* sudoHost contains netgroup - will be filtered more by sudo */
if (netgroups) {
"*");
goto done;
}
}
/* sudoHost contains regexp - will be filtered more by sudo */
/* from sudo match.c :
* #define has_meta(s) (strpbrk(s, "\\?*[]") != NULL)
*/
if (regexp) {
"(|(%s=*\\\\*)(%s=*?*)(%s=*\\**)"
"(%s=*[*]*))",
goto done;
}
}
goto done;
}
done:
return filter;
}
struct sdap_attr_map *map,
struct sdap_sudo_ctx *sudo_ctx,
const char *rule_filter)
{
char *host_filter = NULL;
if (!sudo_ctx->use_host_filter) {
}
return NULL;
}
if (host_filter == NULL) {
goto done;
}
goto done;
}
done:
return filter;
}
{
int ret;
case BE_REQ_SUDO_FULL:
break;
case BE_REQ_SUDO_RULES:
break;
default:
}
return;
}
}
{
struct sdap_sudo_ctx);
case BE_REQ_SUDO_FULL:
break;
case BE_REQ_SUDO_RULES:
break;
default:
goto fail;
}
goto fail;
}
return;
fail:
}
/* issue full refresh of sudo rules */
struct sdap_sudo_ctx *sudo_ctx)
{
char *ldap_filter = NULL;
char *ldap_full_filter = NULL;
char *sysdb_filter = NULL;
int ret;
return NULL;
}
/* Download all rules from LDAP */
if (ldap_filter == NULL) {
goto immediately;
}
if (ldap_full_filter == NULL) {
goto immediately;
}
/* Remove all rules from cache */
if (sysdb_filter == NULL) {
goto immediately;
}
goto immediately;
}
/* free filters */
return req;
} else {
}
return req;
}
{
char *highest_usn = NULL;
int ret;
return;
}
/* save the time in the sysdb */
"a successful full refresh\n"));
/* this is only a minor error that does not affect the functionality,
* therefore there is no need to report it with tevent_req_error()
* which would cause problems in the consumers */
}
/* set highest usn */
if (highest_usn != NULL) {
}
}
int *dp_error,
int *error)
{
return EOK;
}
/* issue refresh of specific sudo rules */
struct sdap_sudo_ctx *sudo_ctx,
struct sdap_options *opts,
struct sdap_id_conn_cache *conn_cache,
char **rules)
{
char *ldap_filter = NULL;
char *ldap_full_filter = NULL;
char *sysdb_filter = NULL;
int ret;
int i;
return NULL;
}
return NULL;
}
return NULL;
}
/* Download only selected rules from LDAP */
/* Remove all selected rules from cache */
goto immediately;
}
if (ldap_filter == NULL) {
goto immediately;
}
if (sysdb_filter == NULL) {
goto immediately;
}
}
if (ldap_filter == NULL) {
goto immediately;
}
if (ldap_full_filter == NULL) {
goto immediately;
}
if (sysdb_filter == NULL) {
goto immediately;
}
goto immediately;
}
}
return req;
}
{
char *highest_usn = NULL;
int ret;
return;
}
/* set highest usn */
if (highest_usn != NULL) {
}
}
}
int *dp_error,
int *error)
{
return EOK;
}
/* issue smart refresh of sudo rules */
struct sdap_sudo_ctx *sudo_ctx)
{
char *ldap_filter = NULL;
char *ldap_full_filter = NULL;
const char *usn;
int ret;
return NULL;
}
if (!sudo_ctx->full_refresh_done
/* Perform full refresh first */
"waiting for full refresh!\n"));
goto immediately;
}
/* Download all rules from LDAP that are newer than usn */
if (ldap_filter == NULL) {
goto immediately;
}
if (ldap_full_filter == NULL) {
goto immediately;
}
/* Do not remove any rules that are already in the sysdb
* sysdb_filter = NULL; */
goto immediately;
}
/* free filters */
return req;
} else {
}
return req;
}
{
char *highest_usn = NULL;
int dp_error;
int error;
int ret;
&highest_usn, NULL);
return;
}
/* set highest usn */
if (highest_usn != NULL) {
}
}
int *dp_error,
int *error)
{
}
{
int ret;
goto schedule;
}
goto schedule;
}
"failed [dp_error: %d] ([%d]: %s)\n",
goto schedule;
}
/* full refresh */
if (delay == 0) {
/* runtime configuration change? */
"is disabled\n"));
return;
}
}
/* smart refresh */
if (delay == 0) {
/* runtime configuration change? */
"is disabled\n"));
return;
}
}
}
{
int dp_error;
int error;
int ret;
goto schedule;
}
goto schedule;
}
"failed [dp_error: %d] ([%d]: %s)\n",
goto schedule;
}
if (delay == 0) {
/* runtime configuration change? */
"is disabled\n"));
return;
}
}
}
{
int dp_error;
int error;
int ret;
goto schedule;
}
}
"failed [dp_error: %d] ([%d]: %s)\n",
goto schedule;
}
if (delay == 0) {
/* runtime configuration change? */
"is disabled\n"));
return;
}
}
}
{
/* schedule new refresh */
"rules!\n"));
return ENOMEM;
}
sudo_ctx);
return EOK;
}
{
/* schedule new refresh */
"rules!\n"));
return ENOMEM;
}
sudo_ctx);
return EOK;
}