From 40cd9afd5d423539a54f70a0875d5d42175aaa64 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 6 Dec 2011 17:08:27 +0100 Subject: [PATCH 8/9] Use the case sensitivity flag in the simple access provider --- src/providers/simple/simple_access.c | 19 +++++++++++++++---- src/tests/simple_access-tests.c | 30 ++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+), 4 deletions(-) diff --git a/src/providers/simple/simple_access.c b/src/providers/simple/simple_access.c index 4b9c3139853adc2c65eb65af69199f820a75ca89..06662e9dfe3ffd13d8dd785545a836b7e519c8c3 100644 --- a/src/providers/simple/simple_access.c +++ b/src/providers/simple/simple_access.c @@ -24,6 +24,7 @@ #include #include "util/util.h" +#include "util/sss_utf8.h" #include "providers/dp_backend.h" #include "db/sysdb.h" #include "providers/simple/simple_access.h" @@ -34,6 +35,15 @@ #define CONFDB_SIMPLE_ALLOW_GROUPS "simple_allow_groups" #define CONFDB_SIMPLE_DENY_GROUPS "simple_deny_groups" +static bool string_equal(bool cs, const char *s1, const char *s2) +{ + if (cs) { + return strcmp(s1, s2) == 0; + } + + return sss_utf8_case_eq((const uint8_t *)s1, (const uint8_t *)s2) == EOK; +} + errno_t simple_access_check(struct simple_ctx *ctx, const char *username, bool *access_granted) { @@ -51,13 +61,14 @@ errno_t simple_access_check(struct simple_ctx *ctx, const char *username, const char *primary_group; gid_t gid; bool matched; + bool cs = ctx->domain->case_sensitive; *access_granted = false; /* First, check whether the user is in the allowed users list */ if (ctx->allow_users != NULL) { for(i = 0; ctx->allow_users[i] != NULL; i++) { - if (strcmp(username, ctx->allow_users[i]) == 0) { + if (string_equal(cs, username, ctx->allow_users[i])) { DEBUG(9, ("User [%s] found in allow list, access granted.\n", username)); @@ -78,7 +89,7 @@ errno_t simple_access_check(struct simple_ctx *ctx, const char *username, /* Next check whether this user has been specifically denied */ if (ctx->deny_users != NULL) { for(i = 0; ctx->deny_users[i] != NULL; i++) { - if (strcmp(username, ctx->deny_users[i]) == 0) { + if (string_equal(cs, username, ctx->deny_users[i])) { DEBUG(9, ("User [%s] found in deny list, access denied.\n", username)); @@ -189,7 +200,7 @@ errno_t simple_access_check(struct simple_ctx *ctx, const char *username, matched = false; for (i = 0; ctx->allow_groups[i]; i++) { for(j = 0; groups[j]; j++) { - if (strcmp(groups[j], ctx->allow_groups[i])== 0) { + if (string_equal(cs, groups[j], ctx->allow_groups[i])) { matched = true; break; } @@ -210,7 +221,7 @@ errno_t simple_access_check(struct simple_ctx *ctx, const char *username, matched = false; for (i = 0; ctx->deny_groups[i]; i++) { for(j = 0; groups[j]; j++) { - if (strcmp(groups[j], ctx->deny_groups[i])== 0) { + if (string_equal(cs, groups[j], ctx->deny_groups[i])) { matched = true; break; } diff --git a/src/tests/simple_access-tests.c b/src/tests/simple_access-tests.c index 9cd73d84c91b29fcc5a43bf12e22696d74aae545..4f041d400c948eff6077a0698ad1b4a54cb28fcf 100644 --- a/src/tests/simple_access-tests.c +++ b/src/tests/simple_access-tests.c @@ -26,6 +26,7 @@ #include #include +#include "confdb/confdb.h" #include "providers/simple/simple_access.h" const char *ulist_1[] = {"u1", "u2", NULL}; @@ -37,6 +38,10 @@ void setup_simple(void) fail_unless(ctx == NULL, "Simple context already initialized."); ctx = talloc_zero(NULL, struct simple_ctx); fail_unless(ctx != NULL, "Cannot create simple context."); + + ctx->domain = talloc_zero(ctx, struct sss_domain_info); + fail_unless(ctx != NULL, "Cannot create domain in simple context."); + ctx->domain->case_sensitive = true; } void teardown_simple(void) @@ -123,6 +128,30 @@ START_TEST(test_both_set) } END_TEST +START_TEST(test_case) +{ + int ret; + bool access_granted = false; + + ctx->allow_users = discard_const(ulist_1); + ctx->deny_users = NULL; + + ret = simple_access_check(ctx, "U1", &access_granted); + fail_unless(ret == EOK, "access_simple_check failed."); + fail_unless(access_granted == false, "Access granted " + "for user with different case " + "in case-sensitive domain"); + + ctx->domain->case_sensitive = false; + + ret = simple_access_check(ctx, "U1", &access_granted); + fail_unless(ret == EOK, "access_simple_check failed."); + fail_unless(access_granted == true, "Access denied " + "for user with different case " + "in case-insensitive domain"); +} +END_TEST + Suite *access_simple_suite (void) { Suite *s = suite_create("access_simple"); @@ -133,6 +162,7 @@ Suite *access_simple_suite (void) tcase_add_test(tc_allow_deny, test_allow_empty); tcase_add_test(tc_allow_deny, test_deny_empty); tcase_add_test(tc_allow_deny, test_both_set); + tcase_add_test(tc_allow_deny, test_case); suite_add_tcase(s, tc_allow_deny); return s; -- 1.7.7.4