[SSSD] [PATCH] Escape IP address in kdcinfo
Jakub Hrozek
jhrozek at redhat.com
Fri Jul 1 23:58:55 UTC 2011
[PATCH 1/2] Move IP adress escaping from the LDAP namespace
The function called sss_ldap_escape_ip_address() was actually no longer
used for constructing LDAP URIs and was just polluting the namespace.
[PATCH 2/2] Escape IP address in kdcinfo
https://fedorahosted.org/sssd/ticket/909
-------------- next part --------------
>From f1b5df047c0c3427d7f5524a972d48da2a14137f Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 1 Jul 2011 16:57:28 +0200
Subject: [PATCH 1/2] Move IP adress escaping from the LDAP namespace
---
src/providers/ipa/ipa_common.c | 6 +++---
src/util/sss_ldap.c | 8 --------
src/util/sss_ldap.h | 3 ---
src/util/util.c | 8 ++++++++
src/util/util.h | 3 +++
5 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 9972c34..cb0b7ea 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -634,9 +634,9 @@ static void ipa_resolve_callback(void *private_data, struct fo_server *server)
return;
}
- safe_address = sss_ldap_escape_ip_address(tmp_ctx,
- srvaddr->family,
- address);
+ safe_address = sss_escape_ip_address(tmp_ctx,
+ srvaddr->family,
+ address);
if (safe_address == NULL) {
DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
talloc_free(tmp_ctx);
diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c
index e24ae82..2436fd4 100644
--- a/src/util/sss_ldap.c
+++ b/src/util/sss_ldap.c
@@ -18,7 +18,6 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <stdlib.h>
-#include <netdb.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/socket.h>
@@ -93,13 +92,6 @@ int sss_ldap_control_create(const char *oid, int iscritical,
#endif
}
-inline const char *
-sss_ldap_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr)
-{
- return family == AF_INET6 ? talloc_asprintf(mem_ctx, "[%s]", addr) :
- talloc_strdup(mem_ctx, addr);
-}
-
#ifdef HAVE_LDAP_INIT_FD
struct sdap_async_sys_connect_state {
long old_flags;
diff --git a/src/util/sss_ldap.h b/src/util/sss_ldap.h
index 14fff29..ab89029 100644
--- a/src/util/sss_ldap.h
+++ b/src/util/sss_ldap.h
@@ -49,9 +49,6 @@ int sss_ldap_control_create(const char *oid, int iscritical,
struct berval *value, int dupval,
LDAPControl **ctrlp);
-inline const char *
-sss_ldap_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr);
-
struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
const char *uri,
diff --git a/src/util/util.c b/src/util/util.c
index 6c4a603..1a0f4eb 100644
--- a/src/util/util.c
+++ b/src/util/util.c
@@ -19,6 +19,7 @@
*/
#include <ctype.h>
+#include <netdb.h>
#include "talloc.h"
#include "util/util.h"
@@ -589,3 +590,10 @@ errno_t sss_filter_sanitize(TALLOC_CTX *mem_ctx,
return EOK;
}
+
+inline char *
+sss_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr)
+{
+ return family == AF_INET6 ? talloc_asprintf(mem_ctx, "[%s]", addr) :
+ talloc_strdup(mem_ctx, addr);
+}
diff --git a/src/util/util.h b/src/util/util.h
index 4b6f3b7..57ec370 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -405,4 +405,7 @@ errno_t sss_filter_sanitize(TALLOC_CTX *mem_ctx,
const char *input,
char **sanitized);
+inline char *
+sss_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr);
+
#endif /* __SSSD_UTIL_H__ */
--
1.7.5.4
-------------- next part --------------
>From 9ead27fa92006f41b570463b1652ddab7b77c590 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 1 Jul 2011 17:45:05 +0200
Subject: [PATCH 2/2] Escape IP address in kdcinfo
https://fedorahosted.org/sssd/ticket/909
---
src/providers/ipa/ipa_common.c | 20 ++++++++++----------
src/providers/krb5/krb5_common.c | 27 +++++++++++++++++++++++----
2 files changed, 33 insertions(+), 14 deletions(-)
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index cb0b7ea..c969e15 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -634,15 +634,6 @@ static void ipa_resolve_callback(void *private_data, struct fo_server *server)
return;
}
- safe_address = sss_escape_ip_address(tmp_ctx,
- srvaddr->family,
- address);
- if (safe_address == NULL) {
- DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
- talloc_free(tmp_ctx);
- return;
- }
-
new_uri = talloc_asprintf(service, "ldap://%s", fo_get_server_name(server));
if (!new_uri) {
DEBUG(2, ("Failed to copy URI ...\n"));
@@ -659,7 +650,16 @@ static void ipa_resolve_callback(void *private_data, struct fo_server *server)
talloc_zfree(service->krb5_service->address);
service->krb5_service->address = talloc_steal(service, address);
- ret = write_krb5info_file(service->krb5_service->realm, address,
+ safe_address = sss_escape_ip_address(tmp_ctx,
+ srvaddr->family,
+ address);
+ if (safe_address == NULL) {
+ DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
+ talloc_free(tmp_ctx);
+ return;
+ }
+
+ ret = write_krb5info_file(service->krb5_service->realm, safe_address,
SSS_KRB5KDC_FO_SRV);
if (ret != EOK) {
DEBUG(2, ("write_krb5info_file failed, authentication might fail.\n"));
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index b3d8d22..2411ed5 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -379,7 +379,9 @@ static void krb5_resolve_callback(void *private_data, struct fo_server *server)
struct krb5_service *krb5_service;
struct resolv_hostent *srvaddr;
char *address;
+ char *safe_address;
int ret;
+ TALLOC_CTX *tmp_ctx = NULL;
krb5_service = talloc_get_type(private_data, struct krb5_service);
if (!krb5_service) {
@@ -394,28 +396,45 @@ static void krb5_resolve_callback(void *private_data, struct fo_server *server)
return;
}
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ DEBUG(1, ("talloc_new failed\n"));
+ return;
+ }
+
address = resolv_get_string_address(krb5_service, srvaddr);
if (address == NULL) {
DEBUG(1, ("resolv_get_string_address failed.\n"));
return;
}
- address = talloc_asprintf_append(address, ":%d",
- fo_get_server_port(server));
- if (address == NULL) {
+ safe_address = sss_escape_ip_address(tmp_ctx,
+ srvaddr->family,
+ address);
+ if (safe_address == NULL) {
+ DEBUG(1, ("sss_ldap_escape_ip_address failed.\n"));
+ talloc_free(tmp_ctx);
+ return;
+ }
+
+ safe_address = talloc_asprintf_append(safe_address, ":%d",
+ fo_get_server_port(server));
+ if (safe_address == NULL) {
DEBUG(1, ("talloc_asprintf_append failed.\n"));
+ talloc_free(tmp_ctx);
return;
}
talloc_zfree(krb5_service->address);
krb5_service->address = address;
- ret = write_krb5info_file(krb5_service->realm, address,
+ ret = write_krb5info_file(krb5_service->realm, safe_address,
krb5_service->name);
if (ret != EOK) {
DEBUG(2, ("write_krb5info_file failed, authentication might fail.\n"));
}
+ talloc_free(tmp_ctx);
return;
}
--
1.7.5.4
More information about the sssd-devel
mailing list