From 739e116f5809b9be26ca204e062aedddecd0b784 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 29 Sep 2014 14:52:03 +0200 Subject: [PATCH 11/15] nss: add view support for getgr* requests Make group lookups view and override aware. Relates to https://fedorahosted.org/sssd/ticket/2375 --- src/responder/nss/nsssrv_cmd.c | 63 +++++++++++++++++++++++++++++++++--------- 1 file changed, 50 insertions(+), 13 deletions(-) diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index 04a90d6..bf0f252 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -2617,7 +2617,7 @@ static int fill_grent(struct sss_packet *packet, size_t blen; uint32_t gid; const char *tmpstr; - const char *orig_name; + const char *orig_name = NULL; struct sized_string name; struct sized_string pwfield; struct sized_string fullname; @@ -2660,8 +2660,25 @@ static int fill_grent(struct sss_packet *packet, rsize = 0; /* find group name/gid */ - orig_name = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL); - gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_GIDNUM, 0); + if (DOM_HAS_VIEWS(dom)) { + orig_name = ldb_msg_find_attr_as_string(msg, + OVERRIDE_PREFIX SYSDB_NAME, + NULL); + if (orig_name != NULL && IS_SUBDOMAIN(dom)) { + /* Override names are not fully qualified */ + add_domain = true; + } + } + if (orig_name == NULL) { + orig_name = ldb_msg_find_attr_as_string(msg, + SYSDB_DEFAULT_OVERRIDE_NAME, + NULL); + if (orig_name == NULL) { + orig_name = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL); + } + } + + gid = sss_view_ldb_msg_find_attr_as_uint64(dom, msg, SYSDB_GIDNUM, 0); if (!orig_name || !gid) { DEBUG(SSSDBG_OP_FAILURE, "Incomplete group object for %s[%llu]! Skipping\n", @@ -2753,7 +2770,7 @@ static int fill_grent(struct sss_packet *packet, memnum = 0; if (!dom->ignore_group_members) { - el = ldb_msg_find_element(msg, SYSDB_MEMBERUID); + el = sss_view_ldb_msg_find_element(dom, msg, SYSDB_MEMBERUID); if (el) { ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum); @@ -2765,6 +2782,13 @@ static int fill_grent(struct sss_packet *packet, } el = ldb_msg_find_element(msg, SYSDB_GHOST); if (el) { + if (DOM_HAS_VIEWS(dom) && el->num_values != 0) { + DEBUG(SSSDBG_CRIT_FAILURE, + "Domain has a view [%s] but group [%s] still has " \ + "ghost members.\n", dom->view_name, orig_name); + num = 0; + goto done; + } ret = fill_members(packet, dom, nctx, el, &rzero, &rsize, &memnum); if (ret != EOK) { @@ -2864,6 +2888,7 @@ static int nss_cmd_getgrnam_search(struct nss_dom_ctx *dctx) char *name = NULL; struct nss_ctx *nctx; int ret; + const char *extra_flag = NULL; nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx); @@ -2927,7 +2952,7 @@ static int nss_cmd_getgrnam_search(struct nss_dom_ctx *dctx) return EIO; } - ret = sysdb_getgrnam(cmdctx, dom, name, &dctx->res); + ret = sysdb_getgrnam_with_views(cmdctx, dom, name, &dctx->res); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "Failed to make request to our cache!\n"); @@ -2971,10 +2996,15 @@ static int nss_cmd_getgrnam_search(struct nss_dom_ctx *dctx) /* if this is a caching provider (or if we haven't checked the cache * yet) then verify that the cache is uptodate */ if (dctx->check_provider) { - ret = check_cache(dctx, nctx, dctx->res, - SSS_DP_GROUP, name, 0, NULL, - nss_cmd_getby_dp_callback, - dctx); + + if (DOM_HAS_VIEWS(dom) && dctx->res->count == 0) { + extra_flag = EXTRA_INPUT_MAYBE_WITH_VIEW; + } else { + extra_flag = NULL; + } + + ret = check_cache(dctx, nctx, dctx->res, SSS_DP_GROUP, name, 0, + extra_flag, nss_cmd_getby_dp_callback, dctx); if (ret != EOK) { /* Anything but EOK means we should reenter the mainloop * because we may be refreshing the cache @@ -3016,6 +3046,7 @@ static int nss_cmd_getgrgid_search(struct nss_dom_ctx *dctx) struct nss_ctx *nctx; int ret; int err; + const char *extra_flag = NULL; nctx = talloc_get_type(cctx->rctx->pvt_ctx, struct nss_ctx); @@ -3055,7 +3086,7 @@ static int nss_cmd_getgrgid_search(struct nss_dom_ctx *dctx) goto done; } - ret = sysdb_getgrgid(cmdctx, dom, cmdctx->id, &dctx->res); + ret = sysdb_getgrgid_with_views(cmdctx, dom, cmdctx->id, &dctx->res); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "Failed to make request to our cache!\n"); @@ -3086,9 +3117,15 @@ static int nss_cmd_getgrgid_search(struct nss_dom_ctx *dctx) /* if this is a caching provider (or if we haven't checked the cache * yet) then verify that the cache is uptodate */ if (dctx->check_provider) { - ret = check_cache(dctx, nctx, dctx->res, - SSS_DP_GROUP, NULL, cmdctx->id, NULL, - nss_cmd_getby_dp_callback, + + if (DOM_HAS_VIEWS(dom) && dctx->res->count == 0) { + extra_flag = EXTRA_INPUT_MAYBE_WITH_VIEW; + } else { + extra_flag = NULL; + } + + ret = check_cache(dctx, nctx, dctx->res, SSS_DP_GROUP, NULL, + cmdctx->id, extra_flag, nss_cmd_getby_dp_callback, dctx); if (ret != EOK) { /* Anything but EOK means we should reenter the mainloop -- 1.8.3.1