From c2af969630611dc1fc91d86e1d6141746c2cc82b Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Wed, 9 Oct 2013 15:22:53 +0200 Subject: [PATCH 3/5] idmap: allow ranges with external mapping to overlap If POSIX IDs are managed externally e.g. by AD it might be possible that the IDs are centrally manages for the whole forest. Hence there might not be a single ID range for each member domain in the forest but only a single ID range for the whole forest. This means that we have to allow collisions if ID ranges in this case. Unit tests are added to make sure that the collisions are only allowed for external mappings. --- src/lib/idmap/sss_idmap.c | 12 +++++--- src/tests/sss_idmap-tests.c | 64 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+), 5 deletions(-) diff --git a/src/lib/idmap/sss_idmap.c b/src/lib/idmap/sss_idmap.c index 89c55fc..17bd577 100644 --- a/src/lib/idmap/sss_idmap.c +++ b/src/lib/idmap/sss_idmap.c @@ -357,11 +357,13 @@ static enum idmap_error_code dom_check_collision( /* TODO: if both ranges have the same ID check if an update is * needed. */ - /* check if ID ranges overlap */ - if ((new_dom->range->min >= dom->range->min - && new_dom->range->min <= dom->range->max) - || (new_dom->range->max >= dom->range->min - && new_dom->range->max <= dom->range->max)) { + /* Check if ID ranges overlap. + * ID ranges with external mapping may overlap. */ + if ((!new_dom->external_mapping && !dom->external_mapping) + && ((new_dom->range->min >= dom->range->min + && new_dom->range->min <= dom->range->max) + || (new_dom->range->max >= dom->range->min + && new_dom->range->max <= dom->range->max))) { return IDMAP_COLLISION; } diff --git a/src/tests/sss_idmap-tests.c b/src/tests/sss_idmap-tests.c index eb20413..65e6135 100644 --- a/src/tests/sss_idmap-tests.c +++ b/src/tests/sss_idmap-tests.c @@ -29,6 +29,9 @@ #define IDMAP_RANGE_MIN 1234 #define IDMAP_RANGE_MAX 9876 +#define IDMAP_RANGE_MIN2 11234 +#define IDMAP_RANGE_MAX2 19876 + const char test_sid[] = "S-1-5-21-2127521184-1604012920-1887927527-72713"; uint8_t test_bin_sid[] = {0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x15, 0x00, 0x00, 0x00, 0xA0, 0x65, 0xCF, 0x7E, 0x78, 0x4B, @@ -142,6 +145,65 @@ START_TEST(idmap_test_add_domain) } END_TEST +START_TEST(idmap_test_add_domain_collisions) +{ + enum idmap_error_code err; + struct sss_idmap_range range = {IDMAP_RANGE_MIN, IDMAP_RANGE_MAX}; + struct sss_idmap_range range2 = {IDMAP_RANGE_MIN2, IDMAP_RANGE_MAX2}; + + err = sss_idmap_add_domain(idmap_ctx, "test.dom", "S-1-5-21-1-2-3", &range); + fail_unless(err == IDMAP_SUCCESS, "sss_idmap_add_domain failed."); + + err = sss_idmap_add_domain(idmap_ctx, "test.dom", "S-1-5-21-1-2-4", + &range2); + fail_unless(err == IDMAP_COLLISION, + "sss_idmap_add_domain added domain with the same name."); + + err = sss_idmap_add_domain(idmap_ctx, "test.dom2", "S-1-5-21-1-2-3", + &range2); + fail_unless(err == IDMAP_COLLISION, + "sss_idmap_add_domain added domain with the same SID."); + + err = sss_idmap_add_domain(idmap_ctx, "test.dom2", "S-1-5-21-1-2-4", + &range); + fail_unless(err == IDMAP_COLLISION, + "sss_idmap_add_domain added domain with the same range."); + + err = sss_idmap_add_domain(idmap_ctx, "test.dom2", "S-1-5-21-1-2-4", + &range2); + fail_unless(err == IDMAP_SUCCESS, + "sss_idmap_add_domain failed to add second domain."); +} +END_TEST + +START_TEST(idmap_test_add_domain_collisions_ext_mapping) +{ + enum idmap_error_code err; + struct sss_idmap_range range = {IDMAP_RANGE_MIN, IDMAP_RANGE_MAX}; + struct sss_idmap_range range2 = {IDMAP_RANGE_MIN2, IDMAP_RANGE_MAX2}; + + err = sss_idmap_add_domain_ex(idmap_ctx, "test.dom", "S-1-5-21-1-2-3", + &range, NULL, 0, true); + fail_unless(err == IDMAP_SUCCESS, "sss_idmap_add_domain failed."); + + err = sss_idmap_add_domain_ex(idmap_ctx, "test.dom", "S-1-5-21-1-2-4", + &range2, NULL, 0, true); + fail_unless(err == IDMAP_COLLISION, + "sss_idmap_add_domain added domain with the same name."); + + err = sss_idmap_add_domain_ex(idmap_ctx, "test.dom2", "S-1-5-21-1-2-3", + &range2, NULL, 0, true); + fail_unless(err == IDMAP_COLLISION, + "sss_idmap_add_domain added domain with the same SID."); + + err = sss_idmap_add_domain_ex(idmap_ctx, "test.dom2", "S-1-5-21-1-2-4", + &range, NULL, 0, true); + fail_unless(err == IDMAP_SUCCESS, + "sss_idmap_add_domain failed to add second domain with " \ + "external mapping and the same range."); +} +END_TEST + START_TEST(idmap_test_sid2uid) { enum idmap_error_code err; @@ -510,6 +572,8 @@ Suite *idmap_test_suite (void) idmap_ctx_teardown); tcase_add_test(tc_dom, idmap_test_add_domain); + tcase_add_test(tc_dom, idmap_test_add_domain_collisions); + tcase_add_test(tc_dom, idmap_test_add_domain_collisions_ext_mapping); suite_add_tcase(s, tc_dom); -- 1.7.7.6