From c37ec6fb92d23f9c94123c1a0de404af8b8616bc Mon Sep 17 00:00:00 2001
From: Jan Zeleny <jzeleny@redhat.com>
Date: Wed, 13 Apr 2011 08:16:37 -0400
Subject: [PATCH 3/3] Cache cleaning tool

https://fedorahosted.org/sssd/ticket/787
---
 Makefile.am           |   10 ++-
 contrib/sssd.spec.in  |    1 +
 src/tools/sss_cache.c |  346 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 356 insertions(+), 1 deletions(-)
 create mode 100644 src/tools/sss_cache.c

diff --git a/Makefile.am b/Makefile.am
index d8eb28d3ef507bc72439ae95dfc335d60139fc5d..014293dfd4d07ca1f1cf383307b1350a29bbbffb 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -54,7 +54,8 @@ sbin_PROGRAMS = \
     sss_groupdel \
     sss_usermod \
     sss_groupmod \
-    sss_groupshow
+    sss_groupshow \
+    sss_cache
 
 sssdlibexec_PROGRAMS = \
     sssd_nss \
@@ -476,6 +477,13 @@ sss_groupshow_SOURCES = \
 sss_groupshow_LDADD = \
     $(TOOLS_LIBS)
 
+sss_cache_SOURCES = \
+    src/tools/sss_cache.c \
+    $(SSSD_UTIL_OBJ) \
+    $(SSSD_TOOLS_OBJ)
+sss_cache_LDADD = \
+    $(TOOLS_LIBS)
+
 #################
 # Feature Tests #
 #################
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 338151ddb20a5258aa5a851cec7bf6b1546d6f69..56e36f4d5948043c70b144c38bd28010f4a5f7b7 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -249,6 +249,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_sbindir}/sss_groupmod
 %{_sbindir}/sss_groupshow
 %{_sbindir}/sss_obfuscate
+%{_sbindir}/sss_cache
 %{_mandir}/man8/sss_groupadd.8*
 %{_mandir}/man8/sss_groupdel.8*
 %{_mandir}/man8/sss_groupmod.8*
diff --git a/src/tools/sss_cache.c b/src/tools/sss_cache.c
new file mode 100644
index 0000000000000000000000000000000000000000..df04a805961fbae85ff9ec9b32dc395e5e04f62e
--- /dev/null
+++ b/src/tools/sss_cache.c
@@ -0,0 +1,346 @@
+/*
+   SSSD
+
+   sss_cache
+
+   Copyright (C) Jan Zeleny <jzeleny@redhat.com>        2011
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <talloc.h>
+#include <popt.h>
+#include <sys/types.h>
+
+#include "util/util.h"
+#include "tools/sss_sync_ops.h"
+#include "db/sysdb.h"
+
+#define INVALIDATE_NONE 0
+#define INVALIDATE_USERS 1
+#define INVALIDATE_GROUPS 2
+#define INVALIDATE_NETGROUPS 4
+
+struct cache_tool_ctx {
+    struct confdb_ctx *confdb;
+    struct sss_domain_info *domains;
+    struct sysdb_ctx_list *sysdb_list;
+
+    char *user_filter;
+    char *group_filter;
+    char *netgroup_filter;
+};
+
+errno_t init_domains(struct cache_tool_ctx *ctx, const char *domain);
+errno_t init_context(struct cache_tool_ctx **tctx, int argc, const char *argv[]);
+
+int main(int argc, const char *argv[])
+{
+    errno_t ret;
+    struct cache_tool_ctx *tctx = NULL;
+    struct sysdb_ctx *sysdb;
+    int i, j;
+    const char *attrs[] = {SYSDB_NAME, NULL};
+    struct sysdb_attrs *sys_attrs = NULL;
+    size_t msg_count;
+    struct ldb_message **msgs;
+    const char *c_name;
+
+    ret = init_context(&tctx, argc, argv);
+    if (ret != EOK) {
+        DEBUG(2, ("Error initializing context for the application\n"));
+        goto done;
+    }
+
+    for (i = 0; i<tctx->sysdb_list->num_dbs; i++) {
+        sysdb = tctx->sysdb_list->dbs[i];
+        ret = sysdb_transaction_start(sysdb);
+        if (ret != EOK) {
+            DEBUG(1, ("Could not start the transaction!\n"));
+            goto done;
+        }
+
+        if (tctx->user_filter) {
+            ret = sysdb_search_users(tctx, sysdb, NULL, tctx->user_filter, attrs,
+                                     &msg_count, &msgs);
+            if (ret != EOK) {
+                DEBUG(3, ("Finding users with filter %s failed\n", tctx->user_filter));
+            }
+
+            for (j=0 ; j<msg_count ; j++) {
+                c_name = ldb_msg_find_attr_as_string(msgs[j], SYSDB_NAME, NULL);
+                if (c_name == NULL) {
+                    DEBUG(1, ("Something bad happenned, can't find attribute %s",
+                              SYSDB_NAME));
+                } else {
+                    ret = sysdb_store_user(tctx, sysdb, NULL, c_name, NULL, 0, 0,
+                                           NULL, NULL, NULL, NULL, NULL, 0);
+                    if (ret != EOK) {
+                        DEBUG(5, ("Couldn't invalidate user %s", c_name));
+                    }
+                }
+            }
+            talloc_free(msgs);
+        }
+
+        if (tctx->group_filter) {
+            ret = sysdb_search_groups(tctx, sysdb, NULL, tctx->group_filter,
+                                      attrs, &msg_count, &msgs);
+            if (ret != EOK) {
+                DEBUG(3, ("Finding groups with filter %s failed\n",
+                          tctx->group_filter));
+            }
+
+            for (j=0 ; j<msg_count ; j++) {
+                c_name = ldb_msg_find_attr_as_string(msgs[j], SYSDB_NAME, NULL);
+                if (c_name == NULL) {
+                    DEBUG(1, ("Something bad happenned, can't find attribute %s",
+                              SYSDB_NAME));
+                } else {
+                    ret = sysdb_store_group(tctx, sysdb, NULL, c_name, 0, NULL, 0);
+                    if (ret != EOK) {
+                        DEBUG(5, ("Couldn't invalidate group %s", c_name));
+                    }
+                }
+            }
+            talloc_free(msgs);
+        }
+
+        if (tctx->netgroup_filter) {
+            ret = sysdb_search_netgroups(tctx, sysdb, NULL, tctx->netgroup_filter,
+                                         attrs, &msg_count, &msgs);
+            if (ret != EOK) {
+                DEBUG(3, ("Finding netgroups with filter %s failed\n",
+                          tctx->netgroup_filter));
+            }
+
+            for (j=0 ; j<msg_count ; j++) {
+                c_name = ldb_msg_find_attr_as_string(msgs[j], SYSDB_NAME, NULL);
+                if (c_name == NULL) {
+                    DEBUG(1, ("Something bad happenned, can't find attribute %s",
+                              SYSDB_NAME));
+                } else {
+
+                    sys_attrs = sysdb_new_attrs(tctx);
+                    if (sys_attrs) {
+                        ret = sysdb_attrs_add_time_t(sys_attrs,
+                                                     SYSDB_CACHE_EXPIRE, 0);
+                        if (ret == EOK) {
+                            ret = sysdb_set_netgroup_attr(sysdb, NULL, c_name,
+                                                          sys_attrs,
+                                                          SYSDB_MOD_REP);
+                            if (ret != EOK) {
+                                DEBUG(3, ("Could not invalidate netgroup %s\n",
+                                          c_name));
+                            }
+                        } else {
+                            DEBUG(3, ("Could not add expiration time to "
+                                      "netgroup attributes\n"));
+                        }
+                        talloc_zfree(sys_attrs);
+                    } else {
+                        DEBUG(1, ("Could not create sysdb attributes\n"));
+                    }
+                }
+            }
+            talloc_free(msgs);
+        }
+
+        ret = sysdb_transaction_commit(sysdb);
+        if (ret != EOK) {
+            DEBUG(1, ("Could not commit the transaction!\n"));
+        }
+    }
+
+done:
+    if (tctx) talloc_free(tctx);
+    return ret;
+}
+
+
+errno_t init_domains(struct cache_tool_ctx *ctx, const char *domain) {
+    char *confdb_path;
+    int ret;
+    struct sysdb_ctx *db_ctx = NULL;
+
+    confdb_path = talloc_asprintf(ctx, "%s/%s", DB_PATH, CONFDB_FILE);
+    if (confdb_path == NULL) {
+        return ENOMEM;
+    }
+
+    /* Connect to the conf db */
+    ret = confdb_init(ctx, &ctx->confdb, confdb_path);
+    talloc_free(confdb_path);
+    if (ret != EOK) {
+        DEBUG(1, ("Could not initialize connection to the confdb\n"));
+        return ret;
+    }
+
+    if (domain) {
+        ret = confdb_get_domain(ctx->confdb, domain, &ctx->domains);
+        if (ret != EOK) {
+            DEBUG(1, ("Could not get '%s' domain: [%d] [%s]\n",
+                      domain, ret, strerror(ret)));
+            goto fail;
+        }
+
+        ret = sysdb_domain_init(ctx, ctx->domains, DB_PATH, &db_ctx);
+        if (ret != EOK) {
+            DEBUG(1, ("Could not initialize connection to the sysdb\n"));
+            goto fail;
+        }
+
+        ret = sysdb_list_init(ctx, DB_PATH, db_ctx, &ctx->sysdb_list);
+        if (ret != EOK) {
+            DEBUG(1, ("Could not initialize the list of connections\n"));
+            goto fail;
+        }
+    } else {
+        ret = sysdb_init(ctx, ctx->confdb, NULL, false, &ctx->sysdb_list);
+        if (ret != EOK) {
+            DEBUG(1, ("Could not initialize connection to the sysdb\n"));
+            goto fail;
+        }
+    }
+
+    return EOK;
+fail:
+    if (ctx->confdb) talloc_zfree(ctx->confdb);
+    if (ctx->domains) talloc_zfree(ctx->domains);
+    if (ctx->sysdb_list) {
+        talloc_zfree(ctx->sysdb_list);
+    } else {
+        if (db_ctx) talloc_free(db_ctx);
+    }
+    return ret;
+}
+
+errno_t init_context(struct cache_tool_ctx **tctx, int argc, const char *argv[])
+{
+    struct cache_tool_ctx *ctx = NULL;
+    int idb = INVALIDATE_NONE;
+    char *user = NULL;
+    char *group = NULL;
+    char *netgroup = NULL;
+    char *domain = NULL;
+    int debug = 0;
+    errno_t ret = EOK;
+
+    poptContext pc = NULL;
+    struct poptOption long_options[] = {
+        POPT_AUTOHELP
+        { "debug", '\0', POPT_ARG_INT | POPT_ARGFLAG_DOC_HIDDEN, &debug,
+            0, _("The debug level to run with"), NULL },
+        { "user", 'u', POPT_ARG_STRING, &user, 0,
+            _("Invalidate particular user"), NULL },
+        { "users", 'U', POPT_ARG_NONE, NULL, 'u',
+            _("Invalidate all users"), NULL },
+        { "group", 'g', POPT_ARG_STRING, &group, 0,
+            _("Invalidate particular group"), NULL },
+        { "groups", 'G', POPT_ARG_NONE, NULL, 'g',
+            _("Invalidate all groups"), NULL },
+        { "netgroup", 'n', POPT_ARG_STRING, &netgroup, 0,
+            _("Invalidate particular netgroup"), NULL },
+        { "netgroups", 'N', POPT_ARG_NONE, NULL, 'n',
+            _("Invalidate all netgroups"), NULL },
+        { "domain", 'd', POPT_ARG_STRING, &domain, 0,
+            _("Only invalidate entries from a particular domain"), NULL },
+        POPT_TABLEEND
+    };
+
+    ret = set_locale();
+    if (ret != EOK) {
+        DEBUG(1, ("set_locale failed (%d): %s\n", ret, strerror(ret)));
+        ERROR("Error setting the locale\n");
+        ret = EXIT_FAILURE;
+        goto fini;
+    }
+
+    pc = poptGetContext(NULL, argc, argv, long_options, 0);
+    while ((ret = poptGetNextOpt(pc)) > 0) {
+        switch (ret) {
+            case 'u':
+                idb |= INVALIDATE_USERS;
+                break;
+            case 'g':
+                idb |= INVALIDATE_GROUPS;
+                break;
+            case 'n':
+                idb |= INVALIDATE_NETGROUPS;
+                break;
+        }
+    }
+    if (ret != -1) {
+        BAD_POPT_PARAMS(pc, poptStrerror(ret), ret, fini);
+    }
+
+    debug_level = debug;
+    debug_prg_name = argv[0];
+    CHECK_ROOT(ret, debug_prg_name);
+
+    ctx = talloc_zero(NULL, struct cache_tool_ctx);
+    if (ctx == NULL) {
+        DEBUG(1, ("Could not allocate memory for tools context\n"));
+        ret = ENOMEM;
+        goto fini;
+    }
+
+    if (idb & INVALIDATE_USERS) {
+        ctx->user_filter = talloc_strdup(ctx, "");
+    } else if (user) {
+        ctx->user_filter = talloc_asprintf(ctx, "(%s=%s)", SYSDB_NAME, user);
+    }
+
+    if (idb & INVALIDATE_GROUPS) {
+        ctx->group_filter = talloc_strdup(ctx, "");
+    } else if (group) {
+        ctx->group_filter = talloc_asprintf(ctx, "(%s=%s)", SYSDB_NAME, group);
+    }
+
+    if (idb & INVALIDATE_NETGROUPS) {
+        ctx->netgroup_filter = talloc_strdup(ctx, "");
+    } else if (netgroup) {
+        ctx->netgroup_filter = talloc_asprintf(ctx, "(%s=%s)", SYSDB_NAME,
+                                               netgroup);
+    }
+    if (((idb & INVALIDATE_USERS || user) && !ctx->user_filter) ||
+        ((idb & INVALIDATE_GROUPS || group) && !ctx->group_filter) ||
+        ((idb & INVALIDATE_NETGROUPS || netgroup) && !ctx->netgroup_filter)) {
+        DEBUG(1, ("Construction of filters failed\n"));
+        ret = ENOMEM;
+        goto fini;
+    }
+
+    ret = init_domains(ctx, domain);
+    if (ret != EOK) {
+        DEBUG(3, ("Initialization of sysdb connections failed\n"));
+        goto fini;
+    }
+
+    ret = EOK;
+
+fini:
+    poptFreeContext(pc);
+    if (user) free(user);
+    if (group) free(group);
+    if (netgroup) free(netgroup);
+    if (domain) free(domain);
+    if (ret != EOK && ctx) {
+        talloc_zfree(ctx);
+    }
+    *tctx = ctx;
+    return ret;
+}
-- 
1.7.4.1

