From ef679a185865ae584eaf3631696eb0309d5b7b6e Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Fri, 24 Jun 2011 14:07:17 -0400
Subject: [PATCH 10/12] Move hbac_user_attrs_to_rule to ipa_hbac_user.c

No functional changes other than adding making it more public.
---
 src/providers/ipa/ipa_hbac_common.c  |  194 ----------------------------------
 src/providers/ipa/ipa_hbac_private.h |    8 ++
 src/providers/ipa/ipa_hbac_users.c   |  187 ++++++++++++++++++++++++++++++++
 3 files changed, 195 insertions(+), 194 deletions(-)

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index 67a11fb91d947400f4b9eee637f542bf544e0caa..97e7698da8483cccf6cae8fb70ee0dfdb36fb7bc 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -299,14 +299,6 @@ hbac_attrs_to_rule(TALLOC_CTX *mem_ctx,
                    struct hbac_rule **rule);
 
 static errno_t
-hbac_user_attrs_to_rule(TALLOC_CTX *mem_ctx,
-                        struct sysdb_ctx *sysdb,
-                        struct sss_domain_info *domain,
-                        const char *rule_name,
-                        struct sysdb_attrs *rule_attrs,
-                        struct hbac_rule_element **users);
-
-static errno_t
 hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
                          struct hbac_ctx *hbac_ctx,
                          struct hbac_eval_req **request);
@@ -489,192 +481,6 @@ done:
     return ret;
 }
 
-static errno_t hbac_user_attrs_to_rule(TALLOC_CTX *mem_ctx,
-                                       struct sysdb_ctx *sysdb,
-                                       struct sss_domain_info *domain,
-                                       const char *rule_name,
-                                       struct sysdb_attrs *rule_attrs,
-                                       struct hbac_rule_element **users)
-{
-    errno_t ret;
-    TALLOC_CTX *tmp_ctx = NULL;
-    struct hbac_rule_element *new_users = NULL;
-    struct ldb_message_element *el = NULL;
-    struct ldb_message **msgs = NULL;
-    char *filter;
-    char *member_dn;
-    const char *attrs[] = { SYSDB_NAME, NULL };
-    size_t num_users = 0;
-    size_t num_groups = 0;
-    const char *name;
-
-    size_t count;
-    size_t i;
-
-    tmp_ctx = talloc_new(mem_ctx);
-    if (tmp_ctx == NULL) return ENOMEM;
-
-    new_users = talloc_zero(tmp_ctx, struct hbac_rule_element);
-    if (new_users == NULL) {
-        ret = ENOMEM;
-        goto done;
-    }
-
-    DEBUG(7, ("Processing users for rule [%s]\n", rule_name));
-
-    ret = hbac_get_category(rule_attrs, IPA_USER_CATEGORY,
-                            &new_users->category);
-    if (ret != EOK) {
-        DEBUG(1, ("Could not identify user categories\n"));
-        goto done;
-    }
-    if (new_users->category & HBAC_CATEGORY_ALL) {
-        /* Short-cut to the exit */
-        ret = EOK;
-        goto done;
-    }
-
-    ret = sysdb_attrs_get_el(rule_attrs, IPA_MEMBER_USER, &el);
-    if (ret != EOK && ret != ENOENT) {
-        DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
-        goto done;
-    }
-    if (ret == ENOENT || el->num_values == 0) {
-        el->num_values = 0;
-        DEBUG(4, ("No user specified, rule will never apply.\n"));
-    }
-
-    new_users->names = talloc_array(new_users,
-                                    const char *,
-                                    el->num_values + 1);
-    if (new_users->names == NULL) {
-        ret = ENOMEM;
-        goto done;
-    }
-
-    new_users->groups = talloc_array(new_users,
-                                     const char *,
-                                     el->num_values + 1);
-    if (new_users->groups == NULL) {
-        ret = ENOMEM;
-        goto done;
-    }
-
-    for (i = 0; i < el->num_values; i++) {
-        ret = sss_filter_sanitize(tmp_ctx,
-                                  (const char *)el->values[i].data,
-                                  &member_dn);
-        if (ret != EOK) goto done;
-
-        filter = talloc_asprintf(member_dn, "(%s=%s)",
-                                 SYSDB_ORIG_DN, member_dn);
-        if (filter == NULL) {
-            ret = ENOMEM;
-            goto done;
-        }
-
-        /* First check if this is a user */
-        ret = sysdb_search_users(tmp_ctx, sysdb, domain,
-                                 filter, attrs, &count, &msgs);
-        if (ret != EOK && ret != ENOENT) goto done;
-        if (ret == EOK && count == 0) {
-            ret = ENOENT;
-        }
-
-        if (ret == EOK) {
-            if (count > 1) {
-                DEBUG(1, ("Original DN matched multiple users. Skipping \n"));
-                talloc_zfree(member_dn);
-                continue;
-            }
-
-            /* Original DN matched a single user. Get the username */
-            name = ldb_msg_find_attr_as_string(msgs[0], SYSDB_NAME, NULL);
-            if (name == NULL) {
-                DEBUG(1, ("Attribute is missing!\n"));
-                ret = EFAULT;
-                goto done;
-            }
-
-            new_users->names[num_users] = talloc_strdup(new_users->names,
-                                                        name);
-            if (new_users->names[num_users] == NULL) {
-                ret = ENOMEM;
-                goto done;
-            }
-            DEBUG(8, ("Added user [%s] to rule [%s]\n",
-                      name, rule_name));
-            num_users++;
-        } else {
-            /* Check if it is a group instead */
-            ret = sysdb_search_groups(tmp_ctx, sysdb, domain,
-                                      filter, attrs, &count, &msgs);
-            if (ret != EOK && ret != ENOENT) goto done;
-            if (ret == EOK && count == 0) {
-                ret = ENOENT;
-            }
-
-            if (ret == EOK) {
-                if (count > 1) {
-                    DEBUG(1, ("Original DN matched multiple groups. "
-                              "Skipping\n"));
-                    talloc_zfree(member_dn);
-                    continue;
-                }
-
-                /* Original DN matched a single group. Get the groupname */
-                name = ldb_msg_find_attr_as_string(msgs[0], SYSDB_NAME, NULL);
-                if (name == NULL) {
-                    DEBUG(1, ("Attribute is missing!\n"));
-                    ret = EFAULT;
-                    goto done;
-                }
-
-                new_users->groups[num_groups] =
-                        talloc_strdup(new_users->groups, name);
-                if (new_users->groups[num_groups] == NULL) {
-                    ret = ENOMEM;
-                    goto done;
-                }
-                DEBUG(8, ("Added group [%s] to rule [%s]\n",
-                          name, rule_name));
-                num_groups++;
-            } else {
-                /* Neither a user nor a group? */
-                DEBUG(1, ("[%s] does not map to either a user or group. "
-                          "Skipping\n", member_dn));
-            }
-        }
-        talloc_zfree(member_dn);
-    }
-    new_users->names[num_users] = NULL;
-    new_users->groups[num_groups] = NULL;
-
-    /* Shrink the arrays down to their real sizes */
-    new_users->names = talloc_realloc(new_users, new_users->names,
-                                      const char *, num_users + 1);
-    if (new_users->names == NULL) {
-        ret = ENOMEM;
-        goto done;
-    }
-
-    new_users->groups = talloc_realloc(new_users, new_users->groups,
-                                      const char *, num_groups + 1);
-    if (new_users->groups == NULL) {
-        ret = ENOMEM;
-        goto done;
-    }
-
-    ret = EOK;
-done:
-    if (ret == EOK) {
-        *users = talloc_steal(mem_ctx, new_users);
-    }
-    talloc_free(tmp_ctx);
-
-    return ret;
-}
-
 static errno_t
 hbac_eval_user_element(TALLOC_CTX *mem_ctx,
                        struct sysdb_ctx *sysdb,
diff --git a/src/providers/ipa/ipa_hbac_private.h b/src/providers/ipa/ipa_hbac_private.h
index 8fc47c0fe89728071fc2f25ff33503b3362894a1..e717a09df61ef7f30ec96322497c6a6c7ad3f0e9 100644
--- a/src/providers/ipa/ipa_hbac_private.h
+++ b/src/providers/ipa/ipa_hbac_private.h
@@ -182,4 +182,12 @@ ipa_hbac_update_groups_send(TALLOC_CTX *mem_ctx,
 errno_t
 ipa_hbac_update_groups_recv(struct tevent_req *req);
 
+errno_t
+hbac_user_attrs_to_rule(TALLOC_CTX *mem_ctx,
+                        struct sysdb_ctx *sysdb,
+                        struct sss_domain_info *domain,
+                        const char *rule_name,
+                        struct sysdb_attrs *rule_attrs,
+                        struct hbac_rule_element **users);
+
 #endif /* IPA_HBAC_PRIVATE_H_ */
diff --git a/src/providers/ipa/ipa_hbac_users.c b/src/providers/ipa/ipa_hbac_users.c
index 9ac489ce866af6171df5da47f153286a4dec227f..4c35b969d6a91de555855d83c19abf28da903ce3 100644
--- a/src/providers/ipa/ipa_hbac_users.c
+++ b/src/providers/ipa/ipa_hbac_users.c
@@ -386,3 +386,190 @@ ipa_hbac_update_groups_recv(struct tevent_req *req)
     TEVENT_REQ_RETURN_ON_ERROR(req);
     return EOK;
 }
+
+errno_t
+hbac_user_attrs_to_rule(TALLOC_CTX *mem_ctx,
+                        struct sysdb_ctx *sysdb,
+                        struct sss_domain_info *domain,
+                        const char *rule_name,
+                        struct sysdb_attrs *rule_attrs,
+                        struct hbac_rule_element **users)
+{
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx = NULL;
+    struct hbac_rule_element *new_users = NULL;
+    struct ldb_message_element *el = NULL;
+    struct ldb_message **msgs = NULL;
+    char *filter;
+    char *member_dn;
+    const char *attrs[] = { SYSDB_NAME, NULL };
+    size_t num_users = 0;
+    size_t num_groups = 0;
+    const char *name;
+
+    size_t count;
+    size_t i;
+
+    tmp_ctx = talloc_new(mem_ctx);
+    if (tmp_ctx == NULL) return ENOMEM;
+
+    new_users = talloc_zero(tmp_ctx, struct hbac_rule_element);
+    if (new_users == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    DEBUG(7, ("Processing users for rule [%s]\n", rule_name));
+
+    ret = hbac_get_category(rule_attrs, IPA_USER_CATEGORY,
+                            &new_users->category);
+    if (ret != EOK) {
+        DEBUG(1, ("Could not identify user categories\n"));
+        goto done;
+    }
+    if (new_users->category & HBAC_CATEGORY_ALL) {
+        /* Short-cut to the exit */
+        ret = EOK;
+        goto done;
+    }
+
+    ret = sysdb_attrs_get_el(rule_attrs, IPA_MEMBER_USER, &el);
+    if (ret != EOK && ret != ENOENT) {
+        DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
+        goto done;
+    }
+    if (ret == ENOENT || el->num_values == 0) {
+        el->num_values = 0;
+        DEBUG(4, ("No user specified, rule will never apply.\n"));
+    }
+
+    new_users->names = talloc_array(new_users,
+                                    const char *,
+                                    el->num_values + 1);
+    if (new_users->names == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    new_users->groups = talloc_array(new_users,
+                                     const char *,
+                                     el->num_values + 1);
+    if (new_users->groups == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    for (i = 0; i < el->num_values; i++) {
+        ret = sss_filter_sanitize(tmp_ctx,
+                                  (const char *)el->values[i].data,
+                                  &member_dn);
+        if (ret != EOK) goto done;
+
+        filter = talloc_asprintf(member_dn, "(%s=%s)",
+                                 SYSDB_ORIG_DN, member_dn);
+        if (filter == NULL) {
+            ret = ENOMEM;
+            goto done;
+        }
+
+        /* First check if this is a user */
+        ret = sysdb_search_users(tmp_ctx, sysdb, domain,
+                                 filter, attrs, &count, &msgs);
+        if (ret != EOK && ret != ENOENT) goto done;
+        if (ret == EOK && count == 0) {
+            ret = ENOENT;
+        }
+
+        if (ret == EOK) {
+            if (count > 1) {
+                DEBUG(1, ("Original DN matched multiple users. Skipping \n"));
+                talloc_zfree(member_dn);
+                continue;
+            }
+
+            /* Original DN matched a single user. Get the username */
+            name = ldb_msg_find_attr_as_string(msgs[0], SYSDB_NAME, NULL);
+            if (name == NULL) {
+                DEBUG(1, ("Attribute is missing!\n"));
+                ret = EFAULT;
+                goto done;
+            }
+
+            new_users->names[num_users] = talloc_strdup(new_users->names,
+                                                        name);
+            if (new_users->names[num_users] == NULL) {
+                ret = ENOMEM;
+                goto done;
+            }
+            DEBUG(8, ("Added user [%s] to rule [%s]\n",
+                      name, rule_name));
+            num_users++;
+        } else {
+            /* Check if it is a group instead */
+            ret = sysdb_search_groups(tmp_ctx, sysdb, domain,
+                                      filter, attrs, &count, &msgs);
+            if (ret != EOK && ret != ENOENT) goto done;
+            if (ret == EOK && count == 0) {
+                ret = ENOENT;
+            }
+
+            if (ret == EOK) {
+                if (count > 1) {
+                    DEBUG(1, ("Original DN matched multiple groups. "
+                              "Skipping\n"));
+                    talloc_zfree(member_dn);
+                    continue;
+                }
+
+                /* Original DN matched a single group. Get the groupname */
+                name = ldb_msg_find_attr_as_string(msgs[0], SYSDB_NAME, NULL);
+                if (name == NULL) {
+                    DEBUG(1, ("Attribute is missing!\n"));
+                    ret = EFAULT;
+                    goto done;
+                }
+
+                new_users->groups[num_groups] =
+                        talloc_strdup(new_users->groups, name);
+                if (new_users->groups[num_groups] == NULL) {
+                    ret = ENOMEM;
+                    goto done;
+                }
+                DEBUG(8, ("Added group [%s] to rule [%s]\n",
+                          name, rule_name));
+                num_groups++;
+            } else {
+                /* Neither a user nor a group? */
+                DEBUG(1, ("[%s] does not map to either a user or group. "
+                          "Skipping\n", member_dn));
+            }
+        }
+        talloc_zfree(member_dn);
+    }
+    new_users->names[num_users] = NULL;
+    new_users->groups[num_groups] = NULL;
+
+    /* Shrink the arrays down to their real sizes */
+    new_users->names = talloc_realloc(new_users, new_users->names,
+                                      const char *, num_users + 1);
+    if (new_users->names == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    new_users->groups = talloc_realloc(new_users, new_users->groups,
+                                      const char *, num_groups + 1);
+    if (new_users->groups == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = EOK;
+done:
+    if (ret == EOK) {
+        *users = talloc_steal(mem_ctx, new_users);
+    }
+    talloc_free(tmp_ctx);
+
+    return ret;
+}
-- 
1.7.5.4

