[SSSD] [PATCH] ipa_access offline support

Sumit Bose sbose at redhat.com
Mon Nov 30 09:58:36 UTC 2009


Hi,

I realized that although all attributes are saved the offline support
the for ipa_access module was not present. These two patches should fix it.

0001 adds a general search request for custom attributes
0002 adds sysdb calls to ipa_access if the provider is offline

bye,
Sumit
-------------- next part --------------
From c28fed110190b87e1dde56e42f74dfabc7925bc1 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 30 Nov 2009 10:48:02 +0100
Subject: [PATCH 1/2] Add sysdb_search_custom request

---
 server/db/sysdb.h          |   11 +++-
 server/db/sysdb_ops.c      |   97 ++++++++++++++++++++++---
 server/tests/sysdb-tests.c |  172 ++++++++++++++++++++++++++++----------------
 3 files changed, 206 insertions(+), 74 deletions(-)

diff --git a/server/db/sysdb.h b/server/db/sysdb.h
index d9f224c..086c837 100644
--- a/server/db/sysdb.h
+++ b/server/db/sysdb.h
@@ -538,6 +538,14 @@ struct tevent_req *sysdb_store_custom_send(TALLOC_CTX *mem_ctx,
                                          struct sysdb_attrs *attrs);
 int sysdb_store_custom_recv(struct tevent_req *req);
 
+struct tevent_req *sysdb_search_custom_send(TALLOC_CTX *mem_ctx,
+                                            struct tevent_context *ev,
+                                            struct sysdb_ctx *sysdb,
+                                            struct sysdb_handle *handle,
+                                            struct sss_domain_info *domain,
+                                            const char *filter,
+                                            const char *subtree_name,
+                                            const char **attrs);
 struct tevent_req *sysdb_search_custom_by_name_send(TALLOC_CTX *mem_ctx,
                                                     struct tevent_context *ev,
                                                     struct sysdb_ctx *sysdb,
@@ -548,7 +556,8 @@ struct tevent_req *sysdb_search_custom_by_name_send(TALLOC_CTX *mem_ctx,
                                                     const char **attrs);
 int sysdb_search_custom_recv(struct tevent_req *req,
                               TALLOC_CTX *mem_ctx,
-                              struct ldb_message **msg);
+                              size_t *msgs_count,
+                              struct ldb_message ***msg);
 
 struct tevent_req *sysdb_delete_custom_send(TALLOC_CTX *mem_ctx,
                                              struct tevent_context *ev,
diff --git a/server/db/sysdb_ops.c b/server/db/sysdb_ops.c
index da53fd3..c237473 100644
--- a/server/db/sysdb_ops.c
+++ b/server/db/sysdb_ops.c
@@ -3395,7 +3395,12 @@ struct tevent_req *sysdb_check_handle_send(TALLOC_CTX *mem_ctx,
 
     if (handle != NULL) {
         state->handle = talloc_memdup(state, handle, sizeof(struct sysdb_handle));
-        tevent_req_done(req);
+        if (state->handle == NULL) {
+            DEBUG(1, ("talloc_memdup failed.\n"));
+            tevent_req_error(req, ENOMEM);
+        } else {
+            tevent_req_done(req);
+        }
         tevent_req_post(req, ev);
         return req;
     }
@@ -3457,6 +3462,7 @@ struct sysdb_search_custom_state {
     const char **attrs;
     const char *filter;
     int scope;
+    bool expect_not_more_than_one;
 
     size_t msgs_count;
     struct ldb_message **msgs;
@@ -3465,6 +3471,70 @@ struct sysdb_search_custom_state {
 static void sysdb_search_custom_check_handle_done(struct tevent_req *subreq);
 static void sysdb_search_custom_done(struct tevent_req *subreq);
 
+struct tevent_req *sysdb_search_custom_send(TALLOC_CTX *mem_ctx,
+                                            struct tevent_context *ev,
+                                            struct sysdb_ctx *sysdb,
+                                            struct sysdb_handle *handle,
+                                            struct sss_domain_info *domain,
+                                            const char *filter,
+                                            const char *subtree_name,
+                                            const char **attrs)
+{
+    struct tevent_req *req, *subreq;
+    struct sysdb_search_custom_state *state;
+    int ret;
+
+    if (sysdb == NULL && handle == NULL) return NULL;
+
+    if (filter == NULL || subtree_name == NULL) return NULL;
+
+    req = tevent_req_create(mem_ctx, &state, struct sysdb_search_custom_state);
+    if (req == NULL) {
+        DEBUG(1, ("tevent_req_create failed.\n"));
+        return NULL;
+    }
+
+    state->ev = ev;
+    state->handle = handle;
+    state->attrs = attrs;
+    state->filter = filter;
+    state->scope = LDB_SCOPE_SUBTREE;
+    state->expect_not_more_than_one = false;
+    state->msgs_count = 0;
+    state->msgs = NULL;
+
+    if (sysdb == NULL) {
+        sysdb = handle->ctx;
+    }
+    state->basedn = sysdb_custom_subtree_dn(sysdb, state, domain->name,
+                                            subtree_name);
+    if (state->basedn == NULL) {
+        DEBUG(1, ("sysdb_custom_subtree_dn failed.\n"));
+        ret = ENOMEM;
+        goto fail;
+    }
+    if (!ldb_dn_validate(state->basedn)) {
+        DEBUG(1, ("Failed to create DN.\n"));
+        ret = EINVAL;
+        goto fail;
+    }
+
+    subreq = sysdb_check_handle_send(state, state->ev, sysdb, state->handle);
+    if (!subreq) {
+        DEBUG(1, ("sysdb_check_handle_send failed.\n"));
+        ret = ENOMEM;
+        goto fail;
+    }
+    tevent_req_set_callback(subreq, sysdb_search_custom_check_handle_done, req);
+
+    return req;
+
+fail:
+    tevent_req_error(req, ret);
+    tevent_req_post(req, ev);
+    return req;
+}
+
 struct tevent_req *sysdb_search_custom_by_name_send(TALLOC_CTX *mem_ctx,
                                                     struct tevent_context *ev,
                                                     struct sysdb_ctx *sysdb,
@@ -3493,6 +3563,7 @@ struct tevent_req *sysdb_search_custom_by_name_send(TALLOC_CTX *mem_ctx,
     state->attrs = attrs;
     state->filter = NULL;
     state->scope = LDB_SCOPE_BASE;
+    state->expect_not_more_than_one = true;
     state->msgs_count = 0;
     state->msgs = NULL;
 
@@ -3571,24 +3642,27 @@ static void sysdb_search_custom_done(struct tevent_req *subreq)
         return;
     }
 
+    if (state->expect_not_more_than_one && state->msgs_count > 1) {
+        DEBUG(1, ("More than one result found.\n"));
+        tevent_req_error(req, EFAULT);
+        return;
+    }
+
     tevent_req_done(req);
 }
 
 int sysdb_search_custom_recv(struct tevent_req *req,
                               TALLOC_CTX *mem_ctx,
-                              struct ldb_message **msg)
+                              size_t *msgs_count,
+                              struct ldb_message ***msgs)
 {
     struct sysdb_search_custom_state *state = tevent_req_data(req,
                                               struct sysdb_search_custom_state);
 
     TEVENT_REQ_RETURN_ON_ERROR(req);
 
-    if (state->msgs_count > 1) {
-        DEBUG(1, ("More than one result found.\n"));
-        return EFAULT;
-    }
-
-    *msg = talloc_move(mem_ctx, &state->msgs[0]);
+    *msgs_count = state->msgs_count;
+    *msgs = talloc_move(mem_ctx, &state->msgs);
 
     return EOK;
 }
@@ -3690,13 +3764,14 @@ static void sysdb_store_custom_check_done(struct tevent_req *subreq)
                                             struct sysdb_store_custom_state);
     int ret;
     int i;
-    struct ldb_message *resp;
+    size_t resp_count = 0;
+    struct ldb_message **resp;
     struct ldb_message *msg;
     struct ldb_request *ldbreq;
     struct ldb_message_element *el;
     bool add_object = false;
 
-    ret = sysdb_search_custom_recv(subreq, state, &resp);
+    ret = sysdb_search_custom_recv(subreq, state, &resp_count, &resp);
     talloc_zfree(subreq);
     if (ret != EOK && ret != ENOENT) {
         tevent_req_error(req, ret);
@@ -3727,7 +3802,7 @@ static void sysdb_store_custom_check_done(struct tevent_req *subreq)
         if (add_object) {
             msg->elements[i].flags = LDB_FLAG_MOD_ADD;
         } else {
-            el = ldb_msg_find_element(resp, state->attrs->a[i].name);
+            el = ldb_msg_find_element(resp[0], state->attrs->a[i].name);
             if (el == NULL) {
                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
             } else {
diff --git a/server/tests/sysdb-tests.c b/server/tests/sysdb-tests.c
index d4f0e2f..3bf6ddc 100644
--- a/server/tests/sysdb-tests.c
+++ b/server/tests/sysdb-tests.c
@@ -879,68 +879,10 @@ static void test_store_custom_done(struct tevent_req *subreq)
     return test_return(data, ret);
 }
 
-static void test_search_custom_by_name_done(struct tevent_req *subreq)
+static void test_search_custom_done(struct tevent_req *req)
 {
-    struct test_data *data = tevent_req_callback_data(subreq, struct test_data);
-    int ret;
-
-    ret = sysdb_search_custom_recv(subreq, data, &data->msg);
-    talloc_zfree(subreq);
-    if (ret != EOK) {
-        data->error = ret;
-        goto done;
-    }
-
-    fail_unless(data->msg->num_elements == 1,
-                "Wrong number of results, expected [1] got [%d]",
-                data->msg->num_elements);
-    fail_unless(strcmp(data->msg->elements[0].name, TEST_ATTR_NAME) == 0,
-                "Wrong attribute name");
-    fail_unless(data->msg->elements[0].num_values == 1,
-                "Wrong number of attribute values");
-    fail_unless(strncmp((const char *)data->msg->elements[0].values[0].data,
-                TEST_ATTR_VALUE, data->msg->elements[0].values[0].length) == 0,
-                "Wrong attribute value");
-
-done:
-    data->finished = true;
-    return;
-}
-
-static void test_search_custom_update_done(struct tevent_req *subreq)
-{
-    struct test_data *data = tevent_req_callback_data(subreq, struct test_data);
-    int ret;
-    struct ldb_message_element *el;
-
-    ret = sysdb_search_custom_recv(subreq, data, &data->msg);
-    talloc_zfree(subreq);
-    if (ret != EOK) {
-        data->error = ret;
-        goto done;
-    }
-
-    fail_unless(data->msg->num_elements == 2,
-                "Wrong number of results, expected [1] got [%d]",
-                data->msg->num_elements);
-
-    el = ldb_msg_find_element(data->msg, TEST_ATTR_NAME);
-    fail_unless(el != NULL, "Attribute [%s] not found", TEST_ATTR_NAME);
-    fail_unless(el->num_values == 1, "Wrong number ([%d] instead of 1) "
-                "of attribute values for [%s]", el->num_values, TEST_ATTR_NAME);
-    fail_unless(strncmp((const char *) el->values[0].data, TEST_ATTR_UPDATE_VALUE,
-                el->values[0].length) == 0,
-                "Wrong attribute value");
-
-    el = ldb_msg_find_element(data->msg, TEST_ATTR_ADD_NAME);
-    fail_unless(el != NULL, "Attribute [%s] not found", TEST_ATTR_ADD_NAME);
-    fail_unless(el->num_values == 1, "Wrong number ([%d] instead of 1) "
-                "of attribute values for [%s]", el->num_values, TEST_ATTR_ADD_NAME);
-    fail_unless(strncmp((const char *) el->values[0].data, TEST_ATTR_ADD_VALUE,
-                el->values[0].length) == 0,
-                "Wrong attribute value");
+    struct test_data *data = tevent_req_callback_data(req, struct test_data);
 
-done:
     data->finished = true;
     return;
 }
@@ -1993,9 +1935,29 @@ START_TEST (test_sysdb_search_custom_by_name)
     }
 
     if (ret == EOK) {
-        tevent_req_set_callback(subreq, test_search_custom_by_name_done, data);
+        tevent_req_set_callback(subreq, test_search_custom_done, data);
 
         ret = test_loop(data);
+
+        ret = sysdb_search_custom_recv(subreq, data, &data->msgs_count,
+                                       &data->msgs);
+        talloc_zfree(subreq);
+        fail_unless(ret == EOK, "sysdb_search_custom_by_name_send failed");
+
+        fail_unless(data->msgs_count == 1,
+                    "Wrong number of objects, exptected [1] got [%d]",
+                    data->msgs_count);
+        fail_unless(data->msgs[0]->num_elements == 1,
+                    "Wrong number of results, expected [1] got [%d]",
+                    data->msgs[0]->num_elements);
+        fail_unless(strcmp(data->msgs[0]->elements[0].name, TEST_ATTR_NAME) == 0,
+                    "Wrong attribute name");
+        fail_unless(data->msgs[0]->elements[0].num_values == 1,
+                    "Wrong number of attribute values");
+        fail_unless(strncmp((const char *)data->msgs[0]->elements[0].values[0].data,
+                            TEST_ATTR_VALUE,
+                            data->msgs[0]->elements[0].values[0].length) == 0,
+                    "Wrong attribute value");
     }
 
     fail_if(ret != EOK, "Could not search custom object");
@@ -2066,6 +2028,7 @@ START_TEST (test_sysdb_search_custom_update)
     struct tevent_req *subreq;
     int ret;
     char *object_name;
+    struct ldb_message_element *el;
 
     /* Setup */
     ret = setup_sysdb_tests(&test_ctx);
@@ -2098,9 +2061,93 @@ START_TEST (test_sysdb_search_custom_update)
     }
 
     if (ret == EOK) {
-        tevent_req_set_callback(subreq, test_search_custom_update_done, data);
+        tevent_req_set_callback(subreq, test_search_custom_done, data);
+
+        ret = test_loop(data);
+
+        ret = sysdb_search_custom_recv(subreq, data, &data->msgs_count,
+                                       &data->msgs);
+        talloc_zfree(subreq);
+        fail_unless(ret == EOK, "sysdb_search_custom_by_name_send failed");
+
+        fail_unless(data->msgs_count == 1,
+                    "Wrong number of objects, exptected [1] got [%d]",
+                    data->msgs_count);
+        fail_unless(data->msgs[0]->num_elements == 2,
+                    "Wrong number of results, expected [2] got [%d]",
+                    data->msgs[0]->num_elements);
+
+        el = ldb_msg_find_element(data->msgs[0], TEST_ATTR_NAME);
+        fail_unless(el != NULL, "Attribute [%s] not found", TEST_ATTR_NAME);
+        fail_unless(el->num_values == 1, "Wrong number ([%d] instead of 1) "
+                    "of attribute values for [%s]", el->num_values, TEST_ATTR_NAME);
+        fail_unless(strncmp((const char *) el->values[0].data, TEST_ATTR_UPDATE_VALUE,
+                    el->values[0].length) == 0,
+                    "Wrong attribute value");
+
+        el = ldb_msg_find_element(data->msgs[0], TEST_ATTR_ADD_NAME);
+        fail_unless(el != NULL, "Attribute [%s] not found", TEST_ATTR_ADD_NAME);
+        fail_unless(el->num_values == 1, "Wrong number ([%d] instead of 1) "
+                    "of attribute values for [%s]", el->num_values, TEST_ATTR_ADD_NAME);
+        fail_unless(strncmp((const char *) el->values[0].data, TEST_ATTR_ADD_VALUE,
+                    el->values[0].length) == 0,
+                    "Wrong attribute value");
+
+    }
+
+    fail_if(ret != EOK, "Could not search custom object");
+    talloc_free(test_ctx);
+}
+END_TEST
+
+START_TEST (test_sysdb_search_custom)
+{
+    struct sysdb_test_ctx *test_ctx;
+    struct test_data *data;
+    struct tevent_req *subreq;
+    int ret;
+    const char *filter = "(distinguishedName=*)";
+
+    /* Setup */
+    ret = setup_sysdb_tests(&test_ctx);
+    if (ret != EOK) {
+        fail("Could not set up the test");
+        return;
+    }
+
+    data = talloc_zero(test_ctx, struct test_data);
+    fail_unless(data != NULL, "talloc_zero failed");
+    data->ctx = test_ctx;
+    data->ev = test_ctx->ev;
+    data->attrlist = talloc_array(test_ctx, const char *, 3);
+    fail_unless(data->attrlist != NULL, "talloc_array failed");
+    data->attrlist[0] = TEST_ATTR_NAME;
+    data->attrlist[1] = TEST_ATTR_ADD_NAME;
+    data->attrlist[2] = NULL;
+
+    subreq = sysdb_search_custom_send(data, data->ev,
+                                               data->ctx->sysdb, NULL,
+                                               data->ctx->domain,
+                                               filter,
+                                               CUSTOM_TEST_CONTAINER,
+                                               data->attrlist);
+    if (!subreq) {
+        ret = ENOMEM;
+    }
+
+    if (ret == EOK) {
+        tevent_req_set_callback(subreq, test_search_custom_done, data);
 
         ret = test_loop(data);
+
+        ret = sysdb_search_custom_recv(subreq, data, &data->msgs_count,
+                                       &data->msgs);
+        talloc_zfree(subreq);
+        fail_unless(ret == EOK, "sysdb_search_custom_send failed");
+
+        fail_unless(data->msgs_count == 10,
+                    "Wrong number of objects, exptected [10] got [%d]",
+                    data->msgs_count);
     }
 
     fail_if(ret != EOK, "Could not search custom object");
@@ -2484,6 +2531,7 @@ Suite *create_sysdb_suite(void)
     tcase_add_test(tc_sysdb, test_sysdb_search_custom_by_name);
     tcase_add_test(tc_sysdb, test_sysdb_update_custom);
     tcase_add_test(tc_sysdb, test_sysdb_search_custom_update);
+    tcase_add_test(tc_sysdb, test_sysdb_search_custom);
     tcase_add_test(tc_sysdb, test_sysdb_delete_custom);
 
     /* test recursive delete */
-- 
1.6.5.2

-------------- next part --------------
From dc64e56d46808db6b828868c0d8ec39ef598af08 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 30 Nov 2009 10:50:01 +0100
Subject: [PATCH 2/2] Add offline support for ipa_access

---
 server/providers/ipa/ipa_access.c |  157 +++++++++++++++++++++++++++++++++----
 server/providers/ipa/ipa_access.h |    1 +
 2 files changed, 141 insertions(+), 17 deletions(-)

diff --git a/server/providers/ipa/ipa_access.c b/server/providers/ipa/ipa_access.c
index 675e7c2..292dd3a 100644
--- a/server/providers/ipa/ipa_access.c
+++ b/server/providers/ipa/ipa_access.c
@@ -56,6 +56,42 @@
 #define HBAC_RULES_SUBDIR "hbac_rules"
 #define HBAC_HOSTS_SUBDIR "hbac_hosts"
 
+static errno_t msgs2attrs_array(TALLOC_CTX *mem_ctx, size_t count,
+                                struct ldb_message **msgs,
+                                struct sysdb_attrs ***attrs)
+{
+    int i;
+    struct sysdb_attrs **a;
+
+    a = talloc_array(mem_ctx, struct sysdb_attrs *, count);
+    if (a == NULL) {
+        DEBUG(1, ("talloc_array failed.\n"));
+        return ENOMEM;
+    }
+
+    *a = talloc_array(mem_ctx, struct sysdb_attrs, count);
+    if (*a == NULL) {
+        DEBUG(1, ("talloc_array failed.\n"));
+        talloc_free(a);
+        return ENOMEM;
+    }
+
+    for (i = 0; i < count; i++) {
+        a[i] = talloc(a, struct sysdb_attrs);
+        if (a[i] == NULL) {
+            DEBUG(1, ("talloc_array failed.\n"));
+            talloc_free(a);
+            return ENOMEM;
+        }
+        a[i]->num = msgs[i]->num_elements;
+        a[i]->a = talloc_steal(a[i], msgs[i]->elements);
+    }
+
+    *attrs = a;
+
+    return EOK;
+}
+
 static void ipa_access_reply(struct be_req *be_req, int pam_status)
 {
     struct pam_data *pd;
@@ -288,6 +324,7 @@ struct hbac_get_host_info_state {
     struct sdap_id_ctx *sdap_ctx;
     struct sysdb_ctx *sysdb;
     struct sysdb_handle *handle;
+    bool offline;
 
     char *host_filter;
     char *host_search_base;
@@ -300,13 +337,14 @@ struct hbac_get_host_info_state {
 };
 
 static void hbac_get_host_info_connect_done(struct tevent_req *subreq);
-static void host_get_host_memberof_done(struct tevent_req *subreq);
+static void hbac_get_host_memberof_done(struct tevent_req *subreq);
 static void hbac_get_host_info_sysdb_transaction_started(struct tevent_req *subreq);
 static void hbac_get_host_info_store_prepare(struct tevent_req *req);
 static void hbac_get_host_info_store_done(struct tevent_req *subreq);
 
 static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
                                                   struct tevent_context *ev,
+                                                  bool offline,
                                                   struct sdap_id_ctx *sdap_ctx,
                                                   struct sysdb_ctx *sysdb,
                                                   const char *ipa_domain,
@@ -333,6 +371,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
     state->sdap_ctx = sdap_ctx;
     state->sysdb = sysdb;
     state->handle = NULL;
+    state->offline = offline;
 
     state->host_reply_list = NULL;
     state->host_reply_count = 0;
@@ -369,7 +408,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
         goto fail;
     }
 
-    state->host_attrs = talloc_array(state, const char *, 5);
+    state->host_attrs = talloc_array(state, const char *, 7);
     if (state->host_attrs == NULL) {
         DEBUG(1, ("Failed to allocate host attribute list.\n"));
         ret = ENOMEM;
@@ -379,7 +418,25 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
     state->host_attrs[1] = IPA_HOST_SERVERHOSTNAME;
     state->host_attrs[2] = IPA_HOST_FQDN;
     state->host_attrs[3] = "objectClass";
-    state->host_attrs[4] = NULL;
+    state->host_attrs[4] = SYSDB_ORIG_DN;
+    state->host_attrs[5] = SYSDB_ORIG_MEMBEROF;
+    state->host_attrs[6] = NULL;
+
+    if (offline) {
+        subreq = sysdb_search_custom_send(state, state->ev, state->sysdb, NULL,
+                                          state->sdap_ctx->be->domain,
+                                          state->host_filter, HBAC_HOSTS_SUBDIR,
+                                          state->host_attrs);
+        if (subreq == NULL) {
+            DEBUG(1, ("sysdb_search_custom_send.\n"));
+            ret = ENOMEM;
+            goto fail;
+        }
+
+        tevent_req_set_callback(subreq, hbac_get_host_memberof_done, req);
+
+        return req;
+    }
 
     if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) {
         if (sdap_ctx->gsh != NULL) {
@@ -414,7 +471,7 @@ static struct tevent_req *hbac_get_host_info_send(TALLOC_CTX *memctx,
         goto fail;
     }
 
-    tevent_req_set_callback(subreq, host_get_host_memberof_done, req);
+    tevent_req_set_callback(subreq, hbac_get_host_memberof_done, req);
 
     return req;
 
@@ -455,7 +512,8 @@ static void hbac_get_host_info_connect_done(struct tevent_req *subreq)
         goto fail;
     }
 
-    tevent_req_set_callback(subreq, host_get_host_memberof_done, req);
+    tevent_req_set_callback(subreq, hbac_get_host_memberof_done, req);
+
     return;
 
 fail:
@@ -463,7 +521,7 @@ fail:
     return;
 }
 
-static void host_get_host_memberof_done(struct tevent_req *subreq)
+static void hbac_get_host_memberof_done(struct tevent_req *subreq)
 {
     struct tevent_req *req = tevent_req_callback_data(subreq,
                                                       struct tevent_req);
@@ -474,9 +532,15 @@ static void host_get_host_memberof_done(struct tevent_req *subreq)
     int v;
     struct ldb_message_element *el;
     struct hbac_host_info **hhi;
+    struct ldb_message **msgs;
 
-    ret = sdap_get_generic_recv(subreq, state, &state->host_reply_count,
-                                &state->host_reply_list);
+    if (state->offline) {
+        ret = sysdb_search_custom_recv(subreq, state, &state->host_reply_count,
+                                       &msgs);
+    } else {
+        ret = sdap_get_generic_recv(subreq, state, &state->host_reply_count,
+                                    &state->host_reply_list);
+    }
     talloc_zfree(subreq);
     if (ret != EOK) {
         tevent_req_error(req, ret);
@@ -489,9 +553,19 @@ static void host_get_host_memberof_done(struct tevent_req *subreq)
         goto fail;
     }
 
+    if (state->offline) {
+        ret = msgs2attrs_array(state, state->host_reply_count, msgs,
+                               &state->host_reply_list);
+        talloc_zfree(msgs);
+        if (ret != EOK) {
+            DEBUG(1, ("msgs2attrs_array failed.\n"));
+            goto fail;
+        }
+    }
+
     hhi = talloc_array(state, struct hbac_host_info *, state->host_reply_count + 1);
     if (hhi == NULL) {
-        DEBUG(1, ("talloc failed.\n"));
+        DEBUG(1, ("talloc_array failed.\n"));
         ret = ENOMEM;
         goto fail;
     }
@@ -562,7 +636,9 @@ static void host_get_host_memberof_done(struct tevent_req *subreq)
         }
 
         ret = sysdb_attrs_get_el(state->host_reply_list[i],
-                                 IPA_HOST_MEMBEROF, &el);
+                                 state->offline ? SYSDB_ORIG_MEMBEROF :
+                                                  IPA_HOST_MEMBEROF,
+                                 &el);
         if (ret != EOK) {
             DEBUG(1, ("sysdb_attrs_get_el failed.\n"));
             goto fail;
@@ -591,6 +667,11 @@ static void host_get_host_memberof_done(struct tevent_req *subreq)
 
     state->hbac_host_info = hhi;
 
+    if (state->offline) {
+        tevent_req_done(req);
+        return;
+    }
+
     subreq = sysdb_transaction_send(state, state->ev, state->sysdb);
     if (subreq == NULL) {
         DEBUG(1, ("sysdb_transaction_send failed.\n"));
@@ -732,6 +813,7 @@ struct hbac_get_rules_state {
     struct sdap_id_ctx *sdap_ctx;
     struct sysdb_ctx *sysdb;
     struct sysdb_handle *handle;
+    bool offline;
 
     const char *host_dn;
     const char **memberof;
@@ -754,6 +836,7 @@ static void hbac_rule_store_done(struct tevent_req *subreq);
 
 static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
                                              struct tevent_context *ev,
+                                             bool offline,
                                              struct sdap_id_ctx *sdap_ctx,
                                              struct sysdb_ctx *sysdb,
                                              const char *ipa_domain,
@@ -778,6 +861,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
     }
 
     state->ev = ev;
+    state->offline = offline;
     state->sdap_ctx = sdap_ctx;
     state->sysdb = sysdb;
     state->handle = NULL;
@@ -797,7 +881,7 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
         goto fail;
     }
 
-    state->hbac_attrs = talloc_array(state, const char *, 15);
+    state->hbac_attrs = talloc_array(state, const char *, 16);
     if (state->hbac_attrs == NULL) {
         DEBUG(1, ("Failed to allocate HBAC attribute list.\n"));
         ret = ENOMEM;
@@ -817,7 +901,8 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
     state->hbac_attrs[11] = "objectclass";
     state->hbac_attrs[12] = IPA_MEMBER_HOST;
     state->hbac_attrs[13] = IPA_HOST_CATEGORY;
-    state->hbac_attrs[14] = NULL;
+    state->hbac_attrs[14] = SYSDB_ORIG_DN;
+    state->hbac_attrs[15] = NULL;
 
     state->hbac_filter = talloc_asprintf(state,
                                          "(&(objectclass=ipaHBACRule)"
@@ -846,6 +931,22 @@ static struct tevent_req *hbac_get_rules_send(TALLOC_CTX *memctx,
 
     DEBUG(9, ("HBAC rule filter: [%s].\n", state->hbac_filter));
 
+    if (offline) {
+        subreq = sysdb_search_custom_send(state, state->ev, state->sysdb, NULL,
+                                          state->sdap_ctx->be->domain,
+                                          state->hbac_filter, HBAC_RULES_SUBDIR,
+                                          state->hbac_attrs);
+        if (subreq == NULL) {
+            DEBUG(1, ("sysdb_search_custom_send failed.\n"));
+            ret = ENOMEM;
+            goto fail;
+        }
+
+        tevent_req_set_callback(subreq, hbac_rule_get_done, req);
+
+        return req;
+    }
+
     if (sdap_ctx->gsh == NULL || ! sdap_ctx->gsh->connected) {
         if (sdap_ctx->gsh != NULL) {
             talloc_zfree(sdap_ctx->gsh);
@@ -937,15 +1038,31 @@ static void hbac_rule_get_done(struct tevent_req *subreq)
     int ret;
     int i;
     struct ldb_message_element *el;
+    struct ldb_message **msgs;
 
-    ret = sdap_get_generic_recv(subreq, state, &state->hbac_reply_count,
-                                &state->hbac_reply_list);
+    if (state->offline) {
+        ret = sysdb_search_custom_recv(subreq, state, &state->hbac_reply_count,
+                                       &msgs);
+    } else {
+        ret = sdap_get_generic_recv(subreq, state, &state->hbac_reply_count,
+                                    &state->hbac_reply_list);
+    }
     talloc_zfree(subreq);
     if (ret != EOK) {
         tevent_req_error(req, ret);
         return;
     }
 
+    if (state->offline) {
+        ret = msgs2attrs_array(state, state->hbac_reply_count, msgs,
+                               &state->hbac_reply_list);
+        talloc_zfree(msgs);
+        if (ret != EOK) {
+            DEBUG(1, ("msgs2attrs_array failed.\n"));
+            goto fail;
+        }
+    }
+
     for (i = 0; i < state->hbac_reply_count; i++) {
         ret = sysdb_attrs_get_el(state->hbac_reply_list[i], SYSDB_ORIG_DN, &el);
         if (ret != EOK) {
@@ -953,13 +1070,14 @@ static void hbac_rule_get_done(struct tevent_req *subreq)
             goto fail;
         }
         if (el->num_values == 0) {
+            DEBUG(1, ("Missing original DN.\n"));
             ret = EINVAL;
             goto fail;
         }
         DEBUG(9, ("OriginalDN: [%s].\n", (const char *)el->values[0].data));
     }
 
-    if (state->hbac_reply_count == 0) {
+    if (state->hbac_reply_count == 0 || state->offline) {
         tevent_req_done(req);
         return;
     }
@@ -1547,6 +1665,10 @@ void ipa_access_handler(struct be_req *be_req)
     hbac_ctx->sdap_ctx = ipa_access_ctx->sdap_ctx;
     hbac_ctx->ipa_options = ipa_access_ctx->ipa_options;
     hbac_ctx->tr_ctx = ipa_access_ctx->tr_ctx;
+    hbac_ctx->offline = be_is_offline(be_req->be_ctx);
+
+    DEBUG(9, ("Connection status is [%s].\n", hbac_ctx->offline ? "offline" :
+                                                                  "online"));
 
 
     hostlist[0] = dp_opt_get_cstring(hbac_ctx->ipa_options, IPA_HOSTNAME);
@@ -1567,6 +1689,7 @@ void ipa_access_handler(struct be_req *be_req)
     hostlist[2] = NULL;
 
     req = hbac_get_host_info_send(hbac_ctx, be_req->be_ctx->ev,
+                                  hbac_ctx->offline,
                                   hbac_ctx->sdap_ctx, be_req->be_ctx->sysdb,
                                   dp_opt_get_string(hbac_ctx->ipa_options,
                                                     IPA_DOMAIN),
@@ -1626,8 +1749,8 @@ static void hbac_get_host_info_done(struct tevent_req *req)
         ret = EINVAL;
         goto fail;
     }
-    req = hbac_get_rules_send(hbac_ctx, be_req->be_ctx->ev, hbac_ctx->sdap_ctx,
-                              be_req->be_ctx->sysdb,
+    req = hbac_get_rules_send(hbac_ctx, be_req->be_ctx->ev, hbac_ctx->offline,
+                              hbac_ctx->sdap_ctx, be_req->be_ctx->sysdb,
                               dp_opt_get_string(hbac_ctx->ipa_options,
                                                 IPA_DOMAIN),
                               local_hhi->dn, local_hhi->memberof);
diff --git a/server/providers/ipa/ipa_access.h b/server/providers/ipa/ipa_access.h
index 486dac6..bd221c5 100644
--- a/server/providers/ipa/ipa_access.h
+++ b/server/providers/ipa/ipa_access.h
@@ -58,6 +58,7 @@ struct hbac_ctx {
     const char *user_dn;
     size_t groups_count;
     const char **groups;
+    bool offline;
 };
 
 void ipa_access_handler(struct be_req *be_req);
-- 
1.6.5.2



More information about the sssd-devel mailing list