>From 961a4949a72b53a958d479b18168ca4c63c7eae6 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 10 Nov 2009 16:45:07 +0100 Subject: [PATCH] Add support for host, source host and user category This patch add support for the host, source host and user category 'all'. All other category values are ignored so far. With the patch the interpretation of an empty memberUser and empty sourceHost and externalHost is changed to 'not applicable'. --- server/providers/ipa/ipa_access.c | 62 ++++++++++++++++++++++++++++++++----- 1 files changed, 54 insertions(+), 8 deletions(-) diff --git a/server/providers/ipa/ipa_access.c b/server/providers/ipa/ipa_access.c index 19b707c..64f1ceb 100644 --- a/server/providers/ipa/ipa_access.c +++ b/server/providers/ipa/ipa_access.c @@ -44,6 +44,7 @@ #define IPA_UNIQUE_ID "ipauniqueid" #define IPA_ENABLED_FLAG "ipaenabledflag" #define IPA_MEMBER_HOST "memberHost" +#define IPA_HOST_CATEGORY "hostCategory" #define IPA_CN "cn" #define IPA_HOST_BASE_TMPL "cn=computers,cn=accounts,dc=%s" @@ -789,7 +790,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, goto fail; } - state->hbac_attrs = talloc_array(state, const char *, 13); + state->hbac_attrs = talloc_array(state, const char *, 15); if (state->hbac_attrs == NULL) { DEBUG(1, ("Failed to allocate HBAC attribute list.\n")); ret = ENOMEM; @@ -807,10 +808,14 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx, state->hbac_attrs[9] = IPA_ENABLED_FLAG; state->hbac_attrs[10] = IPA_CN; state->hbac_attrs[11] = "objectclass"; - state->hbac_attrs[12] = NULL; + state->hbac_attrs[12] = IPA_MEMBER_HOST; + state->hbac_attrs[13] = IPA_HOST_CATEGORY; + state->hbac_attrs[14] = NULL; state->hbac_filter = talloc_asprintf(state, - "(&(objectclass=ipaHBACRule)(|(%s=%s)", + "(&(objectclass=ipaHBACRule)" + "(|(%s=%s)(%s=%s)", + IPA_HOST_CATEGORY, "all", IPA_MEMBER_HOST, host_dn); if (state->hbac_filter == NULL) { ret = ENOMEM; @@ -1181,14 +1186,33 @@ enum check_result check_user(struct hbac_ctx *hbac_ctx, return RULE_ERROR; } -/* TODO: add group and category checks */ + ret = sysdb_attrs_get_el(rule_attrs, IPA_USER_CATEGORY, &el); + if (ret != EOK) { + DEBUG(1, ("sysdb_attrs_get_el failed.\n")); + return RULE_ERROR; + } + if (el->num_values == 0) { + DEBUG(9, ("USer category is not set.\n")); + } else { + for (i = 0; i < el->num_values; i++) { + if (strncasecmp("all", (const char *) el->values[i].data, + el->values[i].length) == 0) { + DEBUG(9, ("User category is set to 'all', rule applies.\n")); + return RULE_APPLICABLE; + } + DEBUG(9, ("Unsupported user category [%.*s].\n", + el->values[i].length, + (char *) el->values[i].data)); + } + } + ret = sysdb_attrs_get_el(rule_attrs, IPA_MEMBER_USER, &el); if (ret != EOK) { DEBUG(1, ("sysdb_attrs_get_el failed.\n")); return RULE_ERROR; } if (el->num_values == 0) { - DEBUG(9, ("No user specified, assuming rule applies.\n")); + DEBUG(9, ("No user specified, rule does not apply.\n")); return RULE_APPLICABLE; } else { for (i = 0; i < el->num_values; i++) { @@ -1225,6 +1249,7 @@ enum check_result check_remote_hosts(struct pam_data *pd, { int ret; int i; + struct ldb_message_element *cat_el; struct ldb_message_element *src_el; struct ldb_message_element *ext_el; const char *remote_hostname; @@ -1243,7 +1268,28 @@ enum check_result check_remote_hosts(struct pam_data *pd, remote_hostname = pd->rhost; } -/* TODO: add group and category checks */ + ret = sysdb_attrs_get_el(rule_attrs, IPA_SOURCE_HOST_CATEGORY, &cat_el); + if (ret != EOK) { + DEBUG(1, ("sysdb_attrs_get_el failed.\n")); + return RULE_ERROR; + } + if (cat_el->num_values == 0) { + DEBUG(9, ("Source host category not set.\n")); + } else { + for(i = 0; i < cat_el->num_values; i++) { + if (strncasecmp("all", (const char *) cat_el->values[i].data, + cat_el->values[i].length) == 0) { + DEBUG(9, ("Source host category is set to 'all', " + "rule applies.\n")); + return RULE_APPLICABLE; + } + DEBUG(9, ("Unsupported source hosts category [%.*s].\n", + cat_el->values[i].length, + (char *) cat_el->values[i].data)); + } + } + + ret = sysdb_attrs_get_el(rule_attrs, IPA_SOURCE_HOST, &src_el); if (ret != EOK) { DEBUG(1, ("sysdb_attrs_get_el failed.\n")); @@ -1256,8 +1302,8 @@ enum check_result check_remote_hosts(struct pam_data *pd, } if (src_el->num_values == 0 && ext_el->num_values == 0) { - DEBUG(9, ("No remote host specified, assuming rule applies.\n")); - return RULE_APPLICABLE; + DEBUG(9, ("No remote host specified, rule does not apply.\n")); + return RULE_NOT_APPLICABLE; } else { for (i = 0; i < src_el->num_values; i++) { if (strncasecmp(remote_hostname, -- 1.6.2.5