>From a40924f1d3e5a641b44939bbe994ad28ec7aefaf Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Fri, 25 Oct 2013 20:47:08 +0200 Subject: [PATCH] Choose best match from overlapping domains --- src/providers/ldap/ldap_common.c | 32 +++++++++++++++++++++++--------- src/util/sss_ldap.c | 21 +++++++++++++++++---- src/util/sss_ldap.h | 6 ++++++ 3 files changed, 46 insertions(+), 13 deletions(-) diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 3a7751f0321df6c10bcb3ff6effa0a519eaa29ce..d93becb8a21ae79d6aeb5b1e730da67d84ba0566 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -68,7 +68,10 @@ sdap_domain_get_by_dn(struct sdap_options *opts, const char *dn) { struct sdap_domain *sditer = NULL; + struct sdap_domain *sdmatch = NULL; TALLOC_CTX *tmp_ctx = NULL; + int match_len; + int best_match_len = 0; tmp_ctx = talloc_new(NULL); if (tmp_ctx == NULL) { @@ -76,19 +79,30 @@ sdap_domain_get_by_dn(struct sdap_options *opts, } DLIST_FOR_EACH(sditer, opts->sdom) { - if (sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->search_bases, NULL) || - sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->user_search_bases, NULL) || - sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->group_search_bases, NULL) || - sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->netgroup_search_bases, NULL) || - sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->sudo_search_bases, NULL) || - sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->service_search_bases, NULL) || - sss_ldap_dn_in_search_bases(tmp_ctx, dn, sditer->autofs_search_bases, NULL)) { - break; + if (sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->search_bases, + NULL, &match_len) + || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->user_search_bases, + NULL, &match_len) + || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->group_search_bases, + NULL, &match_len) + || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->netgroup_search_bases, + NULL, &match_len) + || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->sudo_search_bases, + NULL, &match_len) + || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->service_search_bases, + NULL, &match_len) + || sss_ldap_dn_in_search_bases_len(tmp_ctx, dn, sditer->autofs_search_bases, + NULL, &match_len)) { + if (best_match_len < match_len) { + /* This is a longer match */ + best_match_len = match_len; + sdmatch = sditer; + } } } talloc_free(tmp_ctx); - return sditer; + return sdmatch; } diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c index 6d7b0907ca2fa48d9cff5257ab6bbba0ae7dd5c6..ac05284fc8e018c1907f68285b00a6a46874badf 100644 --- a/src/util/sss_ldap.c +++ b/src/util/sss_ldap.c @@ -470,10 +470,11 @@ int sss_ldap_init_recv(struct tevent_req *req, LDAP **ldap, int *sd) * _filter will contain combined filters from all possible search bases * or NULL if it should be empty */ -bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx, - const char *dn, - struct sdap_search_base **search_bases, - char **_filter) +bool sss_ldap_dn_in_search_bases_len(TALLOC_CTX *mem_ctx, + const char *dn, + struct sdap_search_base **search_bases, + char **_filter, + int *_match_len) { struct sdap_search_base *base; int basedn_len, dn_len; @@ -484,6 +485,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx, bool backslash_found = false; char *filter = NULL; bool ret = false; + int match_len; if (dn == NULL) { DEBUG(SSSDBG_FUNC_DATA, ("dn is NULL\n")); @@ -511,6 +513,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx, if (!base_confirmed) { continue; } + match_len = basedn_len; switch (base->scope) { case LDAP_SCOPE_BASE: @@ -558,6 +561,7 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx, * Append filter otherwise. */ ret = true; + *_match_len = match_len; if (base->filter == NULL || _filter == NULL) { goto done; @@ -589,6 +593,15 @@ done: return ret; } +bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx, + const char *dn, + struct sdap_search_base **search_bases, + char **_filter) +{ + return sss_ldap_dn_in_search_bases_len(mem_ctx, dn, search_bases, + _filter, NULL); +} + char *sss_ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t flags) { char hex[9]; /* 4 bytes in hex + terminating zero */ diff --git a/src/util/sss_ldap.h b/src/util/sss_ldap.h index e5c30eb2115d422ef5a52cc5cd75c85be8fbe2d7..f298b2fbb30cf1532f8e94504ffb83ef73880b81 100644 --- a/src/util/sss_ldap.h +++ b/src/util/sss_ldap.h @@ -74,6 +74,12 @@ bool sss_ldap_dn_in_search_bases(TALLOC_CTX *mem_ctx, struct sdap_search_base **search_bases, char **_filter); +bool sss_ldap_dn_in_search_bases_len(TALLOC_CTX *mem_ctx, + const char *dn, + struct sdap_search_base **search_bases, + char **_filter, + int *_match_len); + char *sss_ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t flags); #endif /* __SSS_LDAP_H__ */ -- 1.8.3.1