[SSSD] [PATCHES] Netgroups for proxy provider

Sumit Bose sbose at redhat.com
Fri Oct 22 12:41:54 UTC 2010


On Fri, Oct 22, 2010 at 08:10:10AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 10/20/2010 05:34 AM, Sumit Bose wrote:
> > Hi,
> > 
> > there two patches add netgroups support for the proxy provider as
> > requested in ticket #630.
> > 
> 
> Nack.
> 
> If ctx->ops.getnetgrent_r() returns an error in get_netgroup(), you're
> leaking memory.

fixed

> 
> Typo in make_netgroup_attr(): "netgrentoupt"

fixed
> 
> 
> Otherwise, it looks good.

Thanks for the review, new version attached.

bye,
Sumit

> 
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAkzBfyEACgkQeiVVYja6o6PlzwCfdqu4VFjMlRI3foXnfiTpxK5d
> M1YAnAydAvINQ8ft1VaWGw7NvgJUfJkP
> =aMTo
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 31ac67dc8cb4eb127e05f6ad4c2df8fd2258c1bd Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 13 Oct 2010 10:51:50 +0200
Subject: [PATCH 1/2] Add netgroups infrastructure to proxy provider

---
 src/providers/proxy/proxy.h      |    6 ++++++
 src/providers/proxy/proxy_id.c   |   14 ++++++++++++++
 src/providers/proxy/proxy_init.c |   22 ++++++++++++++++++++++
 3 files changed, 42 insertions(+), 0 deletions(-)

diff --git a/src/providers/proxy/proxy.h b/src/providers/proxy/proxy.h
index eefcce5..e35e91c 100644
--- a/src/providers/proxy/proxy.h
+++ b/src/providers/proxy/proxy.h
@@ -40,6 +40,7 @@
 #include "providers/dp_backend.h"
 #include "db/sysdb.h"
 #include "proxy.h"
+#include "sss_client/nss_compat.h"
 #include <dhash.h>
 
 struct proxy_nss_ops {
@@ -64,6 +65,11 @@ struct proxy_nss_ops {
                                       long int *start, long int *size,
                                       gid_t **groups, long int limit,
                                       int *errnop);
+    enum nss_status (*setnetgrent)(const char *netgroup,
+                                   struct __netgrent *result);
+    enum nss_status (*getnetgrent_r)(struct __netgrent *result, char *buffer,
+                                     size_t buflen, int *errnop);
+    enum nss_status (*endnetgrent)(struct __netgrent *result);
 };
 
 struct authtok_conv {
diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c
index 3fe58f3..ead6ce0 100644
--- a/src/providers/proxy/proxy_id.c
+++ b/src/providers/proxy/proxy_id.c
@@ -1138,6 +1138,20 @@ void proxy_get_account_info(struct be_req *breq)
         ret = get_initgr(breq, ctx, sysdb, domain, ar->filter_value);
         break;
 
+    case BE_REQ_NETGROUP:
+        if (ar->filter_type != BE_FILTER_NAME) {
+            return proxy_reply(breq, DP_ERR_FATAL,
+                               EINVAL, "Invalid filter type");
+        }
+        if (ctx->ops.setnetgrent == NULL || ctx->ops.getnetgrent_r == NULL ||
+            ctx->ops.endnetgrent == NULL) {
+            return proxy_reply(breq, DP_ERR_FATAL,
+                               ENODEV, "Netgroups are not supported");
+        }
+
+        return proxy_reply(breq, DP_ERR_FATAL,
+                           ENOSYS, "Netgroups not implemented");
+
     default: /*fail*/
         return proxy_reply(breq, DP_ERR_FATAL,
                            EINVAL, "Invalid request type");
diff --git a/src/providers/proxy/proxy_init.c b/src/providers/proxy/proxy_init.c
index 47c9e81..de1904c 100644
--- a/src/providers/proxy/proxy_init.c
+++ b/src/providers/proxy/proxy_init.c
@@ -207,6 +207,28 @@ int sssm_proxy_id_init(struct be_ctx *bectx,
                   "full groups enumeration!\n", libname));
     }
 
+    ctx->ops.setnetgrent = proxy_dlsym(handle, "_nss_%s_setnetgrent", libname);
+    if (!ctx->ops.setnetgrent) {
+        DEBUG(0, ("Failed to load _nss_%s_setnetgrent, error: %s. "
+                  "The library does not support netgroups.\n", libname,
+                                                               dlerror()));
+    }
+
+    ctx->ops.getnetgrent_r = proxy_dlsym(handle, "_nss_%s_getnetgrent_r",
+                                         libname);
+    if (!ctx->ops.getgrent_r) {
+        DEBUG(0, ("Failed to load _nss_%s_getnetgrent_r, error: %s. "
+                  "The library does not support netgroups.\n", libname,
+                                                               dlerror()));
+    }
+
+    ctx->ops.endnetgrent = proxy_dlsym(handle, "_nss_%s_endnetgrent", libname);
+    if (!ctx->ops.endnetgrent) {
+        DEBUG(0, ("Failed to load _nss_%s_endnetgrent, error: %s. "
+                  "The library does not support netgroups.\n", libname,
+                                                               dlerror()));
+    }
+
     *ops = &proxy_id_ops;
     *pvt_data = ctx;
     ret = EOK;
-- 
1.7.2.3

-------------- next part --------------
From d17fc280867f656da09f71dafae4b2491432ff8e Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 13 Oct 2010 21:52:26 +0200
Subject: [PATCH 2/2] Implement netgroups for proxy provider

---
 Makefile.am                          |    1 +
 src/providers/proxy/proxy.h          |    7 ++
 src/providers/proxy/proxy_id.c       |    4 +-
 src/providers/proxy/proxy_netgroup.c |  134 ++++++++++++++++++++++++++++++++++
 4 files changed, 144 insertions(+), 2 deletions(-)
 create mode 100644 src/providers/proxy/proxy_netgroup.c

diff --git a/Makefile.am b/Makefile.am
index 65860b6..294b174 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -795,6 +795,7 @@ libsss_proxy_la_SOURCES = \
     src/providers/proxy/proxy_common.c \
     src/providers/proxy/proxy_init.c \
     src/providers/proxy/proxy_id.c \
+    src/providers/proxy/proxy_netgroup.c \
     src/providers/proxy/proxy_auth.c
 libsss_proxy_la_CFLAGS = \
     $(AM_CFLAGS)
diff --git a/src/providers/proxy/proxy.h b/src/providers/proxy/proxy.h
index e35e91c..9faa967 100644
--- a/src/providers/proxy/proxy.h
+++ b/src/providers/proxy/proxy.h
@@ -138,4 +138,11 @@ void proxy_get_account_info(struct be_req *breq);
 /* From proxy_auth.c */
 void proxy_pam_handler(struct be_req *req);
 
+/* From proxy_netgroup.c */
+errno_t get_netgroup(struct proxy_id_ctx *ctx,
+                     struct sysdb_ctx *sysdb,
+                     struct sss_domain_info *dom,
+                     const char *name);
+
+
 #endif /* __PROXY_H__ */
diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c
index ead6ce0..ff3ddf8 100644
--- a/src/providers/proxy/proxy_id.c
+++ b/src/providers/proxy/proxy_id.c
@@ -1149,8 +1149,8 @@ void proxy_get_account_info(struct be_req *breq)
                                ENODEV, "Netgroups are not supported");
         }
 
-        return proxy_reply(breq, DP_ERR_FATAL,
-                           ENOSYS, "Netgroups not implemented");
+        ret = get_netgroup(ctx, sysdb, domain, ar->filter_value);
+        break;
 
     default: /*fail*/
         return proxy_reply(breq, DP_ERR_FATAL,
diff --git a/src/providers/proxy/proxy_netgroup.c b/src/providers/proxy/proxy_netgroup.c
new file mode 100644
index 0000000..cdcb2a8
--- /dev/null
+++ b/src/providers/proxy/proxy_netgroup.c
@@ -0,0 +1,134 @@
+/*
+    SSSD
+
+    Proxy netgroup handler
+
+    Authors:
+
+        Sumit Bose <sbose at redhat.com>
+
+    Copyright (C) 2010 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "providers/proxy/proxy.h"
+#include "util/util.h"
+
+#define BUFLEN  1024
+
+static errno_t make_netgroup_attr(struct __netgrent netgrent,
+                                  struct sysdb_attrs *attrs)
+{
+    int ret;
+    char *dummy;
+
+    if (netgrent.type == group_val) {
+        ret =sysdb_attrs_add_string(attrs, SYSDB_NETGROUP_MEMBER,
+                                    netgrent.val.group);
+        if (ret != EOK) {
+            DEBUG(1, ("sysdb_attrs_add_string failed.\n"));
+            return ret;
+        }
+    } else if (netgrent.type == triple_val) {
+        dummy = talloc_asprintf(attrs, "(%s,%s,%s)", netgrent.val.triple.host,
+                                netgrent.val.triple.user,
+                                netgrent.val.triple.domain);
+        if (dummy == NULL) {
+            DEBUG(1, ("talloc_asprintf failed.\n"));
+            return ENOMEM;
+        }
+
+        ret = sysdb_attrs_add_string(attrs, SYSDB_NETGROUP_TRIPLE, dummy);
+        if (ret != EOK) {
+            DEBUG(1, ("sysdb_attrs_add_string failed.\n"));
+            return ret;
+        }
+    } else {
+        DEBUG(1, ("Unknown netgrent entry type [%d].\n", netgrent.type));
+        return EINVAL;
+    }
+
+    return EOK;
+}
+
+errno_t get_netgroup(struct proxy_id_ctx *ctx,
+                     struct sysdb_ctx *sysdb,
+                     struct sss_domain_info *dom,
+                     const char *name)
+{
+    struct __netgrent result;
+    enum nss_status status;
+    char buffer[BUFLEN];
+    int ret;
+    TALLOC_CTX *tmp_ctx;
+    struct sysdb_attrs *attrs;
+
+    memset(&result, 0 ,sizeof(result));
+    status = ctx->ops.setnetgrent(name, &result);
+    if (status != NSS_STATUS_SUCCESS) {
+        DEBUG(5, ("setnetgrent failed for netgroup [%s].\n", name));
+        return EIO;
+    }
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(1, ("talloc_new failed.\n"));
+        return ENOMEM;
+    }
+
+    attrs = sysdb_new_attrs(tmp_ctx);
+    if (attrs == NULL) {
+        DEBUG(1, ("sysdb_new_attrs failed.\n"));
+        return ENOMEM;
+    }
+
+    do {
+        status = ctx->ops.getnetgrent_r(&result, buffer, BUFLEN, &ret);
+        if (status != NSS_STATUS_SUCCESS && status != NSS_STATUS_RETURN) {
+            DEBUG(1, ("getnetgrent_r failed for netgroup [%s]: [%d][%s].\n",
+                      name, ret, strerror(ret)));
+            goto done;
+        }
+
+        if (status == NSS_STATUS_SUCCESS) {
+            ret = make_netgroup_attr(result, attrs);
+            if (ret != EOK) {
+                DEBUG(1, ("make_netgroup_attr failed.\n"));
+                goto done;
+            }
+        }
+    } while (status != NSS_STATUS_RETURN);
+
+    status = ctx->ops.endnetgrent(&result);
+    if (status != NSS_STATUS_SUCCESS) {
+        DEBUG(1, ("endnetgrent failed.\n"));
+        ret = EIO;
+        goto done;
+    }
+
+    ret = sysdb_add_netgroup(sysdb, dom, name, NULL, attrs,
+                             ctx->entry_cache_timeout);
+    if (ret != EOK) {
+        DEBUG(1, ("sysdb_add_netgroup failed.\n"));
+        goto done;
+    }
+
+    ret = EOK;
+
+done:
+    talloc_free(tmp_ctx);
+
+    return ret;
+}
-- 
1.7.2.3



More information about the sssd-devel mailing list