On 07/21/2016 10:21 AM, Jakub Hrozek wrote:
On Wed, Jul 20, 2016 at 12:24:11PM +0200, Jakub Hrozek wrote:
> On Fri, Jul 15, 2016 at 03:24:15PM +0200, Petr Cech wrote:
>>
>> On 07/12/2016 10:31 AM, Pavel Březina wrote:
>>> On 07/11/2016 05:12 PM, Petr Cech wrote:
>>>>
>>>> On 07/05/2016 08:44 AM, Jakub Hrozek wrote:
>>>>> On Mon, Jun 27, 2016 at 03:37:25PM +0200, Petr Cech wrote:
>>>>
>>>> ...
>>>>
>>>>>> +static errno_t ad_get_enabled_domains(TALLOC_CTX *mem_ctx,
>>>>>> + struct ad_id_ctx
*ad_id_ctx,
>>>>>> + const char *ad_domain,
>>>>>> + const char
>>>>>> ***_ad_enabled_domains)
>>>>>> +{
>>>>>> + int ret;
>>>>>> + const char *str;
>>>>>> + const char *option_name;
>>>>>> + char **domains = NULL;
>>>>>> + const char **list = NULL;
>>>>>> + int count;
>>>>>> + bool is_ad_in_domains;
>>>>>> + TALLOC_CTX *tmp_ctx = NULL;
>>>>>> +
>>>>>> + tmp_ctx = talloc_new(NULL);
>>>>>> + if (tmp_ctx == NULL) {
>>>>>> + return ENOMEM;
>>>>>> + }
>>>>>> +
>>>>>> + str =
dp_opt_get_cstring(ad_id_ctx->ad_options->basic,
>>>>>> AD_ENABLED_DOMAINS);
>>>>>> + if (str == NULL) {
>>>>>> + _ad_enabled_domains = NULL;
>>>>>> + ret = EOK;
>>>>>> + goto done;
>>>>>> + }
>>>>>> +
>>>>>> + count = 0;
>>>>>> + ret = split_on_separator(tmp_ctx, str, ',', true,
true,
>>>>>> &domains, &count);
>>>>>> + if (ret != EOK) {
>>>>>> + option_name =
>>>>>> ad_id_ctx->ad_options->basic[AD_ENABLED_DOMAINS].opt_name;
>>>>>> + DEBUG(SSSDBG_CRIT_FAILURE, "Failed to parse option
[%s],
>>>>>> [%i] [%s]!\n",
>>>>>> + option_name, ret,
>>>>>> sss_strerror(ret));
>>>>>> + ret = EINVAL;
>>>>>> + goto done;
>>>>>> + }
>>>>>> +
>>>>>> + list = talloc_array_size(tmp_ctx, sizeof(char*), count);
>>>>>> + if (list == NULL) {
>>>>>> + ret = ENOMEM;
>>>>>> + goto done;
>>>>>> + }
>>>>>> +
>>>>>> + is_ad_in_domains = false;
>>>>>> + for (int i = 0; i < count; i++) {
>>>>>> + list[i] = talloc_strdup(list, domains[i]);
>>>>>
>>>>> Do we need to duplicate the string here, wouldn't it be enough to
steal
>>>>> it?
>>>>
>>>> This is my attempt to satisfy the needs. I am trying to make:
>>>> # const char** from char**
>>>> I would like to return const char** because it is option. But the
>>>> function split_on_separator() expects char**.
>>>>
>>>> Does anybody know better solution?
>>>
>>> You can use discard_const for this case.
>>>
>>
>> Hi list,
>>
>> I pulled master again and it started to work :-)
>>
>> Regards...
>
> I finally tested the patches and they work fine in my setup of two
> domains (root and child domain).
>
> I'll also install and configure a third AD domain to do some more
> testing, but in the meantime, I tested that a user from disabled
> subdomain can't be lookup up and a user who is a member of a group from
> another domain reports correct group membership (the tokengroups code
> stores a range that corresponds to the trusted domain, but not the
> domain, subsequent lookup of that ID "fails" with idmap domain not
> found).
>
> So functional ACK for now, I just need to do more testing with a third
> domain.
OK, the patchset doesn't work with a third domain:
Program received signal SIGSEGV, Segmentation fault.
0x00007f9aac975716 in __strcmp_sse2_unaligned () from /lib64/libc.so.6
Missing separate debuginfos, use: dnf debuginfo-install gssproxy-0.4.1-4.fc23.x86_64
(gdb) bt
#0 0x00007f9aac975716 in __strcmp_sse2_unaligned () from /lib64/libc.so.6
#1 0x00007f9ab0c5c24f in string_in_list (string=0xf22e50
"subdom.win.trust.test",
list=0x7fff84129408, case_sensitive=true) at /sssd/src/util/util.c:712
#2 0x00007f9aa844e5a2 in ad_subdomains_process (mem_ctx=0xf26150, domain=0xe9c7f0,
enabled_domains_list=0xef76a0, nsd=2, sd=0xf14960, root=0x0, _nsd_out=0x7fff841294e8,
problem is here ----- ^
Thanks for testing.
It is in a call of the function string_in_list() as I assumed. I will
fix it late today.
Regards
--
Petr^4 Čech