sdap_sudo_refresh.c revision 00fea5c2aaa0277bea522d2f61de75699ee2ed49
/*
Authors:
Pavel Březina <pbrezina@redhat.com>
Copyright (C) 2015 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <talloc.h>
#include <tevent.h>
#include "providers/dp_ptask.h"
#include "providers/ldap/sdap_sudo.h"
#include "db/sysdb_sudo.h"
{
unsigned int usn_number;
}
} else {
}
}
struct sdap_attr_map *map,
char **hostnames,
char **ip_addr,
bool netgroups,
bool regexp)
{
int i;
return NULL;
}
goto done;
}
/* sudoHost is not specified */
goto done;
}
/* ALL */
goto done;
}
/* hostnames */
hostnames[i]);
goto done;
}
}
}
/* ip addresses and networks */
ip_addr[i]);
goto done;
}
}
}
/* sudoHost contains netgroup - will be filtered more by sudo */
if (netgroups) {
"*");
goto done;
}
}
/* sudoHost contains regexp - will be filtered more by sudo */
/* from sudo match.c :
* #define has_meta(s) (strpbrk(s, "\\?*[]") != NULL)
*/
if (regexp) {
"(|(%s=*\\\\*)(%s=*?*)(%s=*\\2A*)"
"(%s=*[*]*))",
goto done;
}
}
goto done;
}
done:
return filter;
}
struct sdap_attr_map *map,
struct sdap_sudo_ctx *sudo_ctx,
const char *rule_filter)
{
char *host_filter = NULL;
if (!sudo_ctx->use_host_filter) {
}
return NULL;
}
if (host_filter == NULL) {
goto done;
}
goto done;
}
done:
return filter;
}
struct sdap_sudo_full_refresh_state {
struct sdap_sudo_ctx *sudo_ctx;
struct sdap_id_ctx *id_ctx;
struct sss_domain_info *domain;
int dp_error;
int error;
};
struct sdap_sudo_ctx *sudo_ctx)
{
char *ldap_filter = NULL;
char *ldap_full_filter = NULL;
char *sysdb_filter = NULL;
int ret;
return NULL;
}
sudo_ctx->full_refresh_in_progress = true;
/* Download all rules from LDAP */
if (ldap_filter == NULL) {
goto immediately;
}
if (ldap_full_filter == NULL) {
goto immediately;
}
/* Remove all rules from cache */
if (sysdb_filter == NULL) {
goto immediately;
}
goto immediately;
}
/* free filters */
return req;
} else {
}
return req;
}
{
char *highest_usn = NULL;
int ret;
goto done;
}
/* save the time in the sysdb */
"a successful full refresh\n");
/* this is only a minor error that does not affect the functionality,
* therefore there is no need to report it with tevent_req_error()
* which would cause problems in the consumers */
}
/* set highest usn */
if (highest_usn != NULL) {
}
done:
return;
}
}
int *dp_error,
int *error)
{
return EOK;
}
struct sdap_sudo_smart_refresh_state {
struct tevent_req *subreq;
struct sdap_id_ctx *id_ctx;
};
struct sdap_sudo_ctx *sudo_ctx)
{
char *ldap_filter = NULL;
char *ldap_full_filter = NULL;
const char *usn;
int ret;
return NULL;
}
if (!sudo_ctx->full_refresh_done
/* Perform full refresh first */
"waiting for full refresh!\n");
goto immediately;
}
/* Download all rules from LDAP that are newer than usn */
"(&(objectclass=%s)(%s>=%s)(!(%s=%s)))",
} else {
/* no valid USN value known */
}
if (ldap_filter == NULL) {
goto immediately;
}
if (ldap_full_filter == NULL) {
goto immediately;
}
/* Do not remove any rules that are already in the sysdb
* sysdb_filter = NULL; */
goto immediately;
}
/* free filters */
return req;
} else {
}
return req;
}
{
char *highest_usn = NULL;
int dp_error;
int error;
int ret;
&highest_usn, NULL);
goto done;
}
/* set highest usn */
if (highest_usn != NULL) {
}
done:
return;
}
}
int *dp_error,
int *error)
{
}
struct sdap_sudo_rules_refresh_state {
struct sdap_id_ctx *id_ctx;
int dp_error;
int error;
};
struct sdap_sudo_ctx *sudo_ctx,
struct sdap_options *opts,
struct sdap_id_conn_cache *conn_cache,
char **rules)
{
char *ldap_filter = NULL;
char *ldap_full_filter = NULL;
char *sysdb_filter = NULL;
int ret;
int i;
return NULL;
}
return NULL;
}
return NULL;
}
/* Download only selected rules from LDAP */
/* Remove all selected rules from cache */
goto immediately;
}
if (ldap_filter == NULL) {
goto immediately;
}
if (sysdb_filter == NULL) {
goto immediately;
}
}
if (ldap_filter == NULL) {
goto immediately;
}
if (ldap_full_filter == NULL) {
goto immediately;
}
if (sysdb_filter == NULL) {
goto immediately;
}
goto immediately;
}
}
return req;
}
{
char *highest_usn = NULL;
int ret;
goto done;
}
/* set highest usn */
if (highest_usn != NULL) {
}
}
done:
return;
}
}
int *dp_error,
int *error)
{
return EOK;
}
static struct tevent_req *
struct tevent_context *ev,
void *pvt)
{
struct sdap_sudo_ctx *sudo_ctx;
}
static errno_t
{
int dp_error;
int error;
}
static struct tevent_req *
struct tevent_context *ev,
void *pvt)
{
struct sdap_sudo_ctx *sudo_ctx;
}
static errno_t
{
int dp_error;
int error;
}
{
/* We don't allow both types to be disabled. At least smart refresh
* needs to be enabled. In this case smart refresh will catch up new
* and modified rules and deleted rules are caught when expired. */
"enabled. Setting smart refresh interval to default value "
"(%ld) seconds.\n", smart);
/* In this case it does not make any sense to run smart refresh. */
smart = 0;
"than full refresh interval. Periodical smart refresh will be "
"disabled.\n");
}
"refresh. Assuming none was performed so far.\n");
last_refresh = 0;
}
if (last_refresh == 0) {
/* If this is the first startup, we need to kick off an refresh
* immediately, to close a window where clients requesting sudo
* information won't get an immediate reply with no entries */
delay = 0;
} else {
/* At least one update has previously run, so clients will get cached
* data. We will delay the refresh so we don't slow down the startup
* process if this is happening during system boot. */
delay = 10;
}
/* Full refresh.
*
* Disable when offline and run immediately when SSSD goes back online.
* Since we have periodical online check we don't have to run this task
* when offline. */
return ret;
}
/* Smart refresh.
*
* Disable when offline and reschedule normally when SSSD goes back online.
* Since we have periodical online check we don't have to run this task
* when offline. */
return ret;
}
return EOK;
}