[SSSD] [PATCH] Escape IP address in kdcinfo

Jakub Hrozek jhrozek at redhat.com
Fri Jul 1 23:58:55 UTC 2011


[PATCH 1/2] Move IP adress escaping from the LDAP namespace
The function called sss_ldap_escape_ip_address() was actually no longer
used for constructing LDAP URIs and was just polluting the namespace.

[PATCH 2/2] Escape IP address in kdcinfo

https://fedorahosted.org/sssd/ticket/909
-------------- next part --------------
>From f1b5df047c0c3427d7f5524a972d48da2a14137f Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 1 Jul 2011 16:57:28 +0200
Subject: [PATCH 1/2] Move IP adress escaping from the LDAP namespace

---
 src/providers/ipa/ipa_common.c |    6 +++---
 src/util/sss_ldap.c            |    8 --------
 src/util/sss_ldap.h            |    3 ---
 src/util/util.c                |    8 ++++++++
 src/util/util.h                |    3 +++
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 9972c34..cb0b7ea 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -634,9 +634,9 @@ static void ipa_resolve_callback(void *private_data, struct fo_server *server)
         return;
     }
 
-    safe_address = sss_ldap_escape_ip_address(tmp_ctx,
-                                              srvaddr->family,
-                                              address);
+    safe_address = sss_escape_ip_address(tmp_ctx,
+                                         srvaddr->family,
+                                         address);
     if (safe_address == NULL) {
         DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
         talloc_free(tmp_ctx);
diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c
index e24ae82..2436fd4 100644
--- a/src/util/sss_ldap.c
+++ b/src/util/sss_ldap.c
@@ -18,7 +18,6 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #include <stdlib.h>
-#include <netdb.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <sys/socket.h>
@@ -93,13 +92,6 @@ int sss_ldap_control_create(const char *oid, int iscritical,
 #endif
 }
 
-inline const char *
-sss_ldap_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr)
-{
-    return family == AF_INET6 ? talloc_asprintf(mem_ctx, "[%s]", addr) :
-                                talloc_strdup(mem_ctx, addr);
-}
-
 #ifdef HAVE_LDAP_INIT_FD
 struct sdap_async_sys_connect_state {
     long old_flags;
diff --git a/src/util/sss_ldap.h b/src/util/sss_ldap.h
index 14fff29..ab89029 100644
--- a/src/util/sss_ldap.h
+++ b/src/util/sss_ldap.h
@@ -49,9 +49,6 @@ int sss_ldap_control_create(const char *oid, int iscritical,
                             struct berval *value, int dupval,
                             LDAPControl **ctrlp);
 
-inline const char *
-sss_ldap_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr);
-
 struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,
                                       struct tevent_context *ev,
                                       const char *uri,
diff --git a/src/util/util.c b/src/util/util.c
index 6c4a603..1a0f4eb 100644
--- a/src/util/util.c
+++ b/src/util/util.c
@@ -19,6 +19,7 @@
 */
 
 #include <ctype.h>
+#include <netdb.h>
 
 #include "talloc.h"
 #include "util/util.h"
@@ -589,3 +590,10 @@ errno_t sss_filter_sanitize(TALLOC_CTX *mem_ctx,
 
     return EOK;
 }
+
+inline char *
+sss_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr)
+{
+    return family == AF_INET6 ? talloc_asprintf(mem_ctx, "[%s]", addr) :
+                                talloc_strdup(mem_ctx, addr);
+}
diff --git a/src/util/util.h b/src/util/util.h
index 4b6f3b7..57ec370 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -405,4 +405,7 @@ errno_t sss_filter_sanitize(TALLOC_CTX *mem_ctx,
                             const char *input,
                             char **sanitized);
 
+inline char *
+sss_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr);
+
 #endif /* __SSSD_UTIL_H__ */
-- 
1.7.5.4

-------------- next part --------------
>From 9ead27fa92006f41b570463b1652ddab7b77c590 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 1 Jul 2011 17:45:05 +0200
Subject: [PATCH 2/2] Escape IP address in kdcinfo

https://fedorahosted.org/sssd/ticket/909
---
 src/providers/ipa/ipa_common.c   |   20 ++++++++++----------
 src/providers/krb5/krb5_common.c |   27 +++++++++++++++++++++++----
 2 files changed, 33 insertions(+), 14 deletions(-)

diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index cb0b7ea..c969e15 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -634,15 +634,6 @@ static void ipa_resolve_callback(void *private_data, struct fo_server *server)
         return;
     }
 
-    safe_address = sss_escape_ip_address(tmp_ctx,
-                                         srvaddr->family,
-                                         address);
-    if (safe_address == NULL) {
-        DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
-        talloc_free(tmp_ctx);
-        return;
-    }
-
     new_uri = talloc_asprintf(service, "ldap://%s", fo_get_server_name(server));
     if (!new_uri) {
         DEBUG(2, ("Failed to copy URI ...\n"));
@@ -659,7 +650,16 @@ static void ipa_resolve_callback(void *private_data, struct fo_server *server)
     talloc_zfree(service->krb5_service->address);
     service->krb5_service->address = talloc_steal(service, address);
 
-    ret = write_krb5info_file(service->krb5_service->realm, address,
+    safe_address = sss_escape_ip_address(tmp_ctx,
+                                         srvaddr->family,
+                                         address);
+    if (safe_address == NULL) {
+        DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
+        talloc_free(tmp_ctx);
+        return;
+    }
+
+    ret = write_krb5info_file(service->krb5_service->realm, safe_address,
                               SSS_KRB5KDC_FO_SRV);
     if (ret != EOK) {
         DEBUG(2, ("write_krb5info_file failed, authentication might fail.\n"));
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index b3d8d22..2411ed5 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -379,7 +379,9 @@ static void krb5_resolve_callback(void *private_data, struct fo_server *server)
     struct krb5_service *krb5_service;
     struct resolv_hostent *srvaddr;
     char *address;
+    char *safe_address;
     int ret;
+    TALLOC_CTX *tmp_ctx = NULL;
 
     krb5_service = talloc_get_type(private_data, struct krb5_service);
     if (!krb5_service) {
@@ -394,28 +396,45 @@ static void krb5_resolve_callback(void *private_data, struct fo_server *server)
         return;
     }
 
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(1, ("talloc_new failed\n"));
+        return;
+    }
+
     address = resolv_get_string_address(krb5_service, srvaddr);
     if (address == NULL) {
         DEBUG(1, ("resolv_get_string_address failed.\n"));
         return;
     }
 
-    address = talloc_asprintf_append(address, ":%d",
-                                     fo_get_server_port(server));
-    if (address == NULL) {
+    safe_address = sss_escape_ip_address(tmp_ctx,
+                                         srvaddr->family,
+                                         address);
+    if (safe_address == NULL) {
+        DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
+        talloc_free(tmp_ctx);
+        return;
+    }
+
+    safe_address = talloc_asprintf_append(safe_address, ":%d",
+                                          fo_get_server_port(server));
+    if (safe_address == NULL) {
         DEBUG(1, ("talloc_asprintf_append failed.\n"));
+        talloc_free(tmp_ctx);
         return;
     }
 
     talloc_zfree(krb5_service->address);
     krb5_service->address = address;
 
-    ret = write_krb5info_file(krb5_service->realm, address,
+    ret = write_krb5info_file(krb5_service->realm, safe_address,
                               krb5_service->name);
     if (ret != EOK) {
         DEBUG(2, ("write_krb5info_file failed, authentication might fail.\n"));
     }
 
+    talloc_free(tmp_ctx);
     return;
 }
 
-- 
1.7.5.4



More information about the sssd-devel mailing list