[SSSD] [PATCHES] Netgroups for proxy provider
Sumit Bose
sbose at redhat.com
Wed Oct 20 09:34:06 UTC 2010
Hi,
there two patches add netgroups support for the proxy provider as
requested in ticket #630.
bye,
Sumit
-------------- next part --------------
From 31ac67dc8cb4eb127e05f6ad4c2df8fd2258c1bd Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 13 Oct 2010 10:51:50 +0200
Subject: [PATCH 1/2] Add netgroups infrastructure to proxy provider
---
src/providers/proxy/proxy.h | 6 ++++++
src/providers/proxy/proxy_id.c | 14 ++++++++++++++
src/providers/proxy/proxy_init.c | 22 ++++++++++++++++++++++
3 files changed, 42 insertions(+), 0 deletions(-)
diff --git a/src/providers/proxy/proxy.h b/src/providers/proxy/proxy.h
index eefcce5..e35e91c 100644
--- a/src/providers/proxy/proxy.h
+++ b/src/providers/proxy/proxy.h
@@ -40,6 +40,7 @@
#include "providers/dp_backend.h"
#include "db/sysdb.h"
#include "proxy.h"
+#include "sss_client/nss_compat.h"
#include <dhash.h>
struct proxy_nss_ops {
@@ -64,6 +65,11 @@ struct proxy_nss_ops {
long int *start, long int *size,
gid_t **groups, long int limit,
int *errnop);
+ enum nss_status (*setnetgrent)(const char *netgroup,
+ struct __netgrent *result);
+ enum nss_status (*getnetgrent_r)(struct __netgrent *result, char *buffer,
+ size_t buflen, int *errnop);
+ enum nss_status (*endnetgrent)(struct __netgrent *result);
};
struct authtok_conv {
diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c
index 3fe58f3..ead6ce0 100644
--- a/src/providers/proxy/proxy_id.c
+++ b/src/providers/proxy/proxy_id.c
@@ -1138,6 +1138,20 @@ void proxy_get_account_info(struct be_req *breq)
ret = get_initgr(breq, ctx, sysdb, domain, ar->filter_value);
break;
+ case BE_REQ_NETGROUP:
+ if (ar->filter_type != BE_FILTER_NAME) {
+ return proxy_reply(breq, DP_ERR_FATAL,
+ EINVAL, "Invalid filter type");
+ }
+ if (ctx->ops.setnetgrent == NULL || ctx->ops.getnetgrent_r == NULL ||
+ ctx->ops.endnetgrent == NULL) {
+ return proxy_reply(breq, DP_ERR_FATAL,
+ ENODEV, "Netgroups are not supported");
+ }
+
+ return proxy_reply(breq, DP_ERR_FATAL,
+ ENOSYS, "Netgroups not implemented");
+
default: /*fail*/
return proxy_reply(breq, DP_ERR_FATAL,
EINVAL, "Invalid request type");
diff --git a/src/providers/proxy/proxy_init.c b/src/providers/proxy/proxy_init.c
index 47c9e81..de1904c 100644
--- a/src/providers/proxy/proxy_init.c
+++ b/src/providers/proxy/proxy_init.c
@@ -207,6 +207,28 @@ int sssm_proxy_id_init(struct be_ctx *bectx,
"full groups enumeration!\n", libname));
}
+ ctx->ops.setnetgrent = proxy_dlsym(handle, "_nss_%s_setnetgrent", libname);
+ if (!ctx->ops.setnetgrent) {
+ DEBUG(0, ("Failed to load _nss_%s_setnetgrent, error: %s. "
+ "The library does not support netgroups.\n", libname,
+ dlerror()));
+ }
+
+ ctx->ops.getnetgrent_r = proxy_dlsym(handle, "_nss_%s_getnetgrent_r",
+ libname);
+ if (!ctx->ops.getgrent_r) {
+ DEBUG(0, ("Failed to load _nss_%s_getnetgrent_r, error: %s. "
+ "The library does not support netgroups.\n", libname,
+ dlerror()));
+ }
+
+ ctx->ops.endnetgrent = proxy_dlsym(handle, "_nss_%s_endnetgrent", libname);
+ if (!ctx->ops.endnetgrent) {
+ DEBUG(0, ("Failed to load _nss_%s_endnetgrent, error: %s. "
+ "The library does not support netgroups.\n", libname,
+ dlerror()));
+ }
+
*ops = &proxy_id_ops;
*pvt_data = ctx;
ret = EOK;
--
1.7.2.3
-------------- next part --------------
From ddf59d4c55a14a5236fde502faa7f1854ca4db82 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 13 Oct 2010 21:52:26 +0200
Subject: [PATCH 2/2] Implement netgroups for proxy provider
---
Makefile.am | 1 +
src/providers/proxy/proxy.h | 7 ++
src/providers/proxy/proxy_id.c | 4 +-
src/providers/proxy/proxy_netgroup.c | 134 ++++++++++++++++++++++++++++++++++
4 files changed, 144 insertions(+), 2 deletions(-)
create mode 100644 src/providers/proxy/proxy_netgroup.c
diff --git a/Makefile.am b/Makefile.am
index 65860b6..294b174 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -795,6 +795,7 @@ libsss_proxy_la_SOURCES = \
src/providers/proxy/proxy_common.c \
src/providers/proxy/proxy_init.c \
src/providers/proxy/proxy_id.c \
+ src/providers/proxy/proxy_netgroup.c \
src/providers/proxy/proxy_auth.c
libsss_proxy_la_CFLAGS = \
$(AM_CFLAGS)
diff --git a/src/providers/proxy/proxy.h b/src/providers/proxy/proxy.h
index e35e91c..9faa967 100644
--- a/src/providers/proxy/proxy.h
+++ b/src/providers/proxy/proxy.h
@@ -138,4 +138,11 @@ void proxy_get_account_info(struct be_req *breq);
/* From proxy_auth.c */
void proxy_pam_handler(struct be_req *req);
+/* From proxy_netgroup.c */
+errno_t get_netgroup(struct proxy_id_ctx *ctx,
+ struct sysdb_ctx *sysdb,
+ struct sss_domain_info *dom,
+ const char *name);
+
+
#endif /* __PROXY_H__ */
diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c
index ead6ce0..ff3ddf8 100644
--- a/src/providers/proxy/proxy_id.c
+++ b/src/providers/proxy/proxy_id.c
@@ -1149,8 +1149,8 @@ void proxy_get_account_info(struct be_req *breq)
ENODEV, "Netgroups are not supported");
}
- return proxy_reply(breq, DP_ERR_FATAL,
- ENOSYS, "Netgroups not implemented");
+ ret = get_netgroup(ctx, sysdb, domain, ar->filter_value);
+ break;
default: /*fail*/
return proxy_reply(breq, DP_ERR_FATAL,
diff --git a/src/providers/proxy/proxy_netgroup.c b/src/providers/proxy/proxy_netgroup.c
new file mode 100644
index 0000000..d31df0c
--- /dev/null
+++ b/src/providers/proxy/proxy_netgroup.c
@@ -0,0 +1,134 @@
+/*
+ SSSD
+
+ Proxy netgroup handler
+
+ Authors:
+
+ Sumit Bose <sbose at redhat.com>
+
+ Copyright (C) 2010 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "providers/proxy/proxy.h"
+#include "util/util.h"
+
+#define BUFLEN 1024
+
+static errno_t make_netgroup_attr(struct __netgrent netgrent,
+ struct sysdb_attrs *attrs)
+{
+ int ret;
+ char *dummy;
+
+ if (netgrent.type == group_val) {
+ ret =sysdb_attrs_add_string(attrs, SYSDB_NETGROUP_MEMBER,
+ netgrent.val.group);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_add_string failed.\n"));
+ return ret;
+ }
+ } else if (netgrent.type == triple_val) {
+ dummy = talloc_asprintf(attrs, "(%s,%s,%s)", netgrent.val.triple.host,
+ netgrent.val.triple.user,
+ netgrent.val.triple.domain);
+ if (dummy == NULL) {
+ DEBUG(1, ("talloc_asprintf failed.\n"));
+ return ENOMEM;
+ }
+
+ ret = sysdb_attrs_add_string(attrs, SYSDB_NETGROUP_TRIPLE, dummy);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_attrs_add_string failed.\n"));
+ return ret;
+ }
+ } else {
+ DEBUG(1, ("Unknown netgrentoupt entry type [%d].\n", netgrent.type));
+ return EINVAL;
+ }
+
+ return EOK;
+}
+
+errno_t get_netgroup(struct proxy_id_ctx *ctx,
+ struct sysdb_ctx *sysdb,
+ struct sss_domain_info *dom,
+ const char *name)
+{
+ struct __netgrent result;
+ enum nss_status status;
+ char buffer[BUFLEN];
+ int ret;
+ TALLOC_CTX *tmp_ctx;
+ struct sysdb_attrs *attrs;
+
+ memset(&result, 0 ,sizeof(result));
+ status = ctx->ops.setnetgrent(name, &result);
+ if (status != NSS_STATUS_SUCCESS) {
+ DEBUG(5, ("setnetgrent failed for netgroup [%s].\n", name));
+ return EIO;
+ }
+
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ DEBUG(1, ("talloc_new failed.\n"));
+ return ENOMEM;
+ }
+
+ attrs = sysdb_new_attrs(tmp_ctx);
+ if (attrs == NULL) {
+ DEBUG(1, ("sysdb_new_attrs failed.\n"));
+ return ENOMEM;
+ }
+
+ do {
+ status = ctx->ops.getnetgrent_r(&result, buffer, BUFLEN, &ret);
+ if (status != NSS_STATUS_SUCCESS && status != NSS_STATUS_RETURN) {
+ DEBUG(1, ("getnetgrent_r failed for netgroup [%s]: [%d][%s].\n",
+ name, ret, strerror(ret)));
+ return ret;
+ }
+
+ if (status == NSS_STATUS_SUCCESS) {
+ ret = make_netgroup_attr(result, attrs);
+ if (ret != EOK) {
+ DEBUG(1, ("make_netgroup_attr failed.\n"));
+ goto done;
+ }
+ }
+ } while (status != NSS_STATUS_RETURN);
+
+ status = ctx->ops.endnetgrent(&result);
+ if (status != NSS_STATUS_SUCCESS) {
+ DEBUG(1, ("endnetgrent failed.\n"));
+ ret = EIO;
+ goto done;
+ }
+
+ ret = sysdb_add_netgroup(sysdb, dom, name, NULL, attrs,
+ ctx->entry_cache_timeout);
+ if (ret != EOK) {
+ DEBUG(1, ("sysdb_add_netgroup failed.\n"));
+ goto done;
+ }
+
+ ret = EOK;
+
+done:
+ talloc_free(tmp_ctx);
+
+ return ret;
+}
--
1.7.2.3
More information about the sssd-devel
mailing list