[SSSD] [PATCHES] Fixes for sss_cache
Sumit Bose
sbose at redhat.com
Thu Dec 19 10:03:41 UTC 2013
On Thu, Dec 19, 2013 at 10:28:30AM +0100, Jakub Hrozek wrote:
> On Thu, Dec 19, 2013 at 12:25:02AM +0100, Jakub Hrozek wrote:
> > > The attached patch set should handle this as well. I modified
> > > update_filter() for this and tried to remove some redundancy there. I
> > > also added sss_filter_sanitize_for_dom() to clean the input.
> > >
> > > bye,
> > > Sumit
> >
> > Thanks for the patience.
> >
> > I tested the usual NSS and PAM operations as well as retrieving aliases
> > stored with the old format using the patched code and everythign went
> > well.
> >
> > ACK to all patches.
>
> Pushed to master.
>
> The patch that touches the unit tests doesn't apply cleanly on
> sssd-1-11, can you send a rebased version?
The attached version of the patch set should apply cleanly to sssd-1-11.
bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 9ec215c6a84e7fdc2e3df4c92e7b6ed7db118742 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 25 Nov 2013 17:54:06 +0100
Subject: [PATCH 1/5] sss_cache: initialize names member of sss_domain_info
sss_tc_fqname() called by sss_get_domain_name() requires that the names
member of the sss_domain_info struct is set to work properly. If the
names struct is properly initialized in sss_domain_info the separate one
in the tool context is not needed anymore.
Related to https://fedorahosted.org/sssd/ticket/1741
---
src/tools/sss_cache.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
diff --git a/src/tools/sss_cache.c b/src/tools/sss_cache.c
index fa2e29d..3b6e623 100644
--- a/src/tools/sss_cache.c
+++ b/src/tools/sss_cache.c
@@ -63,7 +63,6 @@ static errno_t search_autofsmaps(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
struct cache_tool_ctx {
struct confdb_ctx *confdb;
struct sss_domain_info *domains;
- struct sss_names_ctx *nctx;
char *user_filter;
char *group_filter;
@@ -209,7 +208,7 @@ static errno_t update_filter(struct cache_tool_ctx *tctx,
return ENOMEM;
}
- ret = sss_parse_name(tmp_ctx, tctx->nctx, name,
+ ret = sss_parse_name(tmp_ctx, dinfo->names, name,
&parsed_domain, &parsed_name);
if (ret != EOK) {
DEBUG(SSSDBG_CRIT_FAILURE, ("sss_parse_name failed\n"));
@@ -280,17 +279,6 @@ static errno_t update_all_filters(struct cache_tool_ctx *tctx,
{
errno_t ret;
- if (IS_SUBDOMAIN(dinfo)) {
- ret = sss_names_init(tctx, tctx->confdb, dinfo->parent->name,
- &tctx->nctx);
- } else {
- ret = sss_names_init(tctx, tctx->confdb, dinfo->name, &tctx->nctx);
- }
- if (ret != EOK) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("sss_names_init() failed\n"));
- return ret;
- }
-
/* Update user filter */
ret = update_filter(tctx, dinfo, tctx->user_name,
tctx->update_user_filter, "(%s=%s)", false,
@@ -467,6 +455,7 @@ errno_t init_domains(struct cache_tool_ctx *ctx, const char *domain)
{
char *confdb_path;
int ret;
+ struct sss_domain_info *dinfo;
confdb_path = talloc_asprintf(ctx, "%s/%s", DB_PATH, CONFDB_FILE);
if (confdb_path == NULL) {
@@ -505,6 +494,14 @@ errno_t init_domains(struct cache_tool_ctx *ctx, const char *domain)
}
}
+ for (dinfo = ctx->domains; dinfo; dinfo = get_next_domain(dinfo, false)) {
+ ret = sss_names_init(ctx, ctx->confdb, dinfo->name, &dinfo->names);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("sss_names_init() failed\n"));
+ return ret;
+ }
+ }
+
return EOK;
}
--
1.8.3.1
-------------- next part --------------
From e744f699c1c293d4f8ec812a70a44dc4bc98f40d Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 26 Nov 2013 10:27:50 +0100
Subject: [PATCH 2/5] sss_cache: fix case-sensitivity issue
For case-insensitive domains the lower-case name for case-insensitive
searches is stored in SYSDB_NAME_ALIAS.
Related to https://fedorahosted.org/sssd/ticket/1741
---
src/tools/sss_cache.c | 63 +++++++++++++++++++++++++++++----------------------
1 file changed, 36 insertions(+), 27 deletions(-)
diff --git a/src/tools/sss_cache.c b/src/tools/sss_cache.c
index 3b6e623..56dc47a 100644
--- a/src/tools/sss_cache.c
+++ b/src/tools/sss_cache.c
@@ -196,6 +196,8 @@ static errno_t update_filter(struct cache_tool_ctx *tctx,
TALLOC_CTX *tmp_ctx = NULL;
char *use_name = NULL;
char *filter;
+ char *sanitized;
+ char *lc_sanitized;
if (!name || !update) {
/* Nothing to do */
@@ -215,6 +217,14 @@ static errno_t update_filter(struct cache_tool_ctx *tctx,
goto done;
}
+ if (parsed_domain != NULL && strcasecmp(dinfo->name, parsed_domain) != 0) {
+ /* We were able to parse the domain from given fqdn, but it
+ * does not match with currently processed domain. */
+ filter = NULL;
+ ret = EOK;
+ goto done;
+ }
+
if (!dinfo->case_sensitive && !force_case_sensitivity) {
use_name = sss_tc_utf8_str_tolower(tmp_ctx, parsed_name);
if (!use_name) {
@@ -232,41 +242,40 @@ static errno_t update_filter(struct cache_tool_ctx *tctx,
ret = ENOMEM;
goto done;
}
+ }
- if (!strcasecmp(dinfo->name, parsed_domain)) {
- if (fmt) {
- filter = talloc_asprintf(tmp_ctx, fmt,
- SYSDB_NAME, use_name);
- } else {
- filter = talloc_strdup(tmp_ctx, use_name);
- }
- if (filter == NULL) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
- ret = ENOMEM;
- goto done;
- }
+ ret = sss_filter_sanitize_for_dom(tmp_ctx, use_name, dinfo,
+ &sanitized, &lc_sanitized);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to sanitize the given name.\n"));
+ goto done;
+ }
+
+ if (fmt) {
+ if (!dinfo->case_sensitive && !force_case_sensitivity) {
+ filter = talloc_asprintf(tmp_ctx, "(|(%s=%s)(%s=%s))",
+ SYSDB_NAME_ALIAS, lc_sanitized,
+ SYSDB_NAME_ALIAS, sanitized);
} else {
- /* We were able to parse the domain from given fqdn, but it
- * does not match with currently processed domain. */
- filter = NULL;
+ filter = talloc_asprintf(tmp_ctx, fmt, SYSDB_NAME, sanitized);
}
} else {
- if (fmt) {
- filter = talloc_asprintf(tmp_ctx, fmt, SYSDB_NAME, name);
- } else {
- filter = talloc_strdup(tmp_ctx, name);
- }
- if (filter == NULL) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
- ret = ENOMEM;
- goto done;
- }
+ filter = talloc_strdup(tmp_ctx, sanitized);
+ }
+ if (filter == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
+ ret = ENOMEM;
+ goto done;
}
- talloc_free(*_filter);
- *_filter = talloc_steal(tctx, filter);
ret = EOK;
+
done:
+ if (ret == EOK) {
+ talloc_free(*_filter);
+ *_filter = talloc_steal(tctx, filter);
+ }
+
talloc_free(tmp_ctx);
return ret;
--
1.8.3.1
-------------- next part --------------
From 9b83234d18cf7df42fb26544cb73b558eeffff55 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 28 Nov 2013 11:28:39 +0100
Subject: [PATCH 3/5] Add sysdb_attrs_add_lc_name_alias
---
src/db/sysdb.c | 22 ++++++++++++++++++++++
src/db/sysdb.h | 2 ++
src/tests/sysdb-tests.c | 29 +++++++++++++++++++++++++++++
3 files changed, 53 insertions(+)
diff --git a/src/db/sysdb.c b/src/db/sysdb.c
index da5dbe8..2a4be58 100644
--- a/src/db/sysdb.c
+++ b/src/db/sysdb.c
@@ -618,6 +618,28 @@ int sysdb_attrs_add_time_t(struct sysdb_attrs *attrs,
return ret;
}
+int sysdb_attrs_add_lc_name_alias(struct sysdb_attrs *attrs,
+ const char *value)
+{
+ char *lc_str;
+ int ret;
+
+ if (attrs == NULL || value == NULL) {
+ return EINVAL;
+ }
+
+ lc_str = sss_tc_utf8_str_tolower(attrs, value);
+ if (lc_str == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Cannot convert name to lowercase\n"));
+ return ENOMEM;
+ }
+
+ ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, lc_str);
+ talloc_free(lc_str);
+
+ return ret;
+}
+
int sysdb_attrs_copy_values(struct sysdb_attrs *src,
struct sysdb_attrs *dst,
const char *name)
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index 4d5ef0b..f3358d6 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -274,6 +274,8 @@ int sysdb_attrs_add_uint32(struct sysdb_attrs *attrs,
const char *name, uint32_t value);
int sysdb_attrs_add_time_t(struct sysdb_attrs *attrs,
const char *name, time_t value);
+int sysdb_attrs_add_lc_name_alias(struct sysdb_attrs *attrs,
+ const char *value);
int sysdb_attrs_copy_values(struct sysdb_attrs *src,
struct sysdb_attrs *dst,
const char *name);
diff --git a/src/tests/sysdb-tests.c b/src/tests/sysdb-tests.c
index ddbf6f2..63ffac8 100644
--- a/src/tests/sysdb-tests.c
+++ b/src/tests/sysdb-tests.c
@@ -4422,6 +4422,33 @@ START_TEST(test_sysdb_svc_remove_alias)
}
END_TEST
+#define LC_NAME_ALIAS_TEST_VAL "TeSt VaLuE"
+#define LC_NAME_ALIAS_CHECK_VAL "test value"
+START_TEST(test_sysdb_attrs_add_lc_name_alias)
+{
+ int ret;
+ struct sysdb_attrs *attrs;
+ const char *str;
+
+ ret = sysdb_attrs_add_lc_name_alias(NULL, NULL);
+ fail_unless(ret == EINVAL, "EINVAL not returned for NULL input");
+
+ attrs = sysdb_new_attrs(NULL);
+ fail_unless(attrs != NULL, "sysdb_new_attrs failed");
+
+ ret = sysdb_attrs_add_lc_name_alias(attrs, LC_NAME_ALIAS_TEST_VAL);
+ fail_unless(ret == EOK, "sysdb_attrs_add_lc_name_alias failed");
+
+ ret = sysdb_attrs_get_string(attrs, SYSDB_NAME_ALIAS, &str);
+ fail_unless(ret == EOK, "sysdb_attrs_get_string failed");
+ fail_unless(strcmp(str, LC_NAME_ALIAS_CHECK_VAL) == 0,
+ "Unexpected value, expected [%s], got [%s]",
+ LC_NAME_ALIAS_CHECK_VAL, str);
+
+ talloc_free(attrs);
+}
+END_TEST
+
START_TEST(test_sysdb_has_enumerated)
{
errno_t ret;
@@ -5188,6 +5215,8 @@ Suite *create_sysdb_suite(void)
tcase_add_test(tc_sysdb, test_sysdb_store_services);
tcase_add_test(tc_sysdb, test_sysdb_svc_remove_alias);
+ tcase_add_test(tc_sysdb, test_sysdb_attrs_add_lc_name_alias);
+
/* Add all test cases to the test suite */
suite_add_tcase(s, tc_sysdb);
--
1.8.3.1
-------------- next part --------------
From 976e8d55ba66f51b0d507124eec72325af570604 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 28 Nov 2013 12:31:24 +0100
Subject: [PATCH 4/5] Use sysdb_attrs_add_lc_name_alias to add case-insensitive
alias
---
src/providers/ipa/ipa_s2n_exop.c | 27 ++++++---------------------
src/providers/ldap/sdap_async.c | 21 ++++++++++++++++-----
src/providers/proxy/proxy_id.c | 20 ++------------------
src/providers/proxy/proxy_netgroup.c | 10 +---------
src/responder/pac/pacsrv_utils.c | 4 ++--
5 files changed, 27 insertions(+), 55 deletions(-)
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
index d8506aa..8bad16d 100644
--- a/src/providers/ipa/ipa_s2n_exop.c
+++ b/src/providers/ipa/ipa_s2n_exop.c
@@ -651,7 +651,6 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
struct sysdb_attrs *user_attrs = NULL;
struct sysdb_attrs *group_attrs = NULL;
char *name;
- char *lc_name;
char *realm;
char *upn;
struct berval *bv_req = NULL;
@@ -767,16 +766,10 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
goto done;
}
- lc_name = sss_tc_utf8_str_tolower(user_attrs, name);
- if (lc_name == NULL) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("Cannot convert name to lowercase\n"));
- ret = ENOMEM;
- goto done;
- }
-
- ret = sysdb_attrs_add_string(user_attrs, SYSDB_NAME_ALIAS, lc_name);
+ ret = sysdb_attrs_add_lc_name_alias(user_attrs, name);
if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n"));
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("sysdb_attrs_add_lc_name_alias failed.\n"));
goto done;
}
@@ -852,18 +845,10 @@ static void ipa_s2n_get_user_done(struct tevent_req *subreq)
goto done;
}
- lc_name = sss_tc_utf8_str_tolower(group_attrs, name);
- if (lc_name == NULL) {
- DEBUG(SSSDBG_CRIT_FAILURE,
- ("Cannot convert name to lowercase\n"));
- ret = ENOMEM;
- goto done;
- }
-
- ret = sysdb_attrs_add_string(group_attrs, SYSDB_NAME_ALIAS,
- lc_name);
+ ret = sysdb_attrs_add_lc_name_alias(group_attrs, name);
if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n"));
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("sysdb_attrs_add_lc_name_alias failed.\n"));
goto done;
}
diff --git a/src/providers/ldap/sdap_async.c b/src/providers/ldap/sdap_async.c
index f5cc962..e905d2d 100644
--- a/src/providers/ldap/sdap_async.c
+++ b/src/providers/ldap/sdap_async.c
@@ -2318,12 +2318,23 @@ sdap_save_all_names(const char *name,
goto done;
}
- ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, domname);
- if (ret) {
- DEBUG(SSSDBG_OP_FAILURE, ("Failed to add alias [%s] into the "
- "attribute list\n", aliases[i]));
- goto done;
+ if (lowercase) {
+ ret = sysdb_attrs_add_lc_name_alias(attrs, domname);
+ if (ret) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Failed to add lower-cased version "
+ "of alias [%s] into the "
+ "attribute list\n", aliases[i]));
+ goto done;
+ }
+ } else {
+ ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, domname);
+ if (ret) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Failed to add alias [%s] into the "
+ "attribute list\n", aliases[i]));
+ goto done;
+ }
}
+
}
ret = EOK;
diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c
index 963aad2..2c01aad 100644
--- a/src/providers/proxy/proxy_id.c
+++ b/src/providers/proxy/proxy_id.c
@@ -223,7 +223,6 @@ static int save_user(struct sysdb_ctx *sysdb, struct sss_domain_info *domain,
{
const char *shell;
const char *gecos;
- char *lower;
struct sysdb_attrs *attrs = NULL;
errno_t ret;
const char *cased_alias;
@@ -249,14 +248,7 @@ static int save_user(struct sysdb_ctx *sysdb, struct sss_domain_info *domain,
}
if (lowercase) {
- lower = sss_tc_utf8_str_tolower(attrs, pwd->pw_name);
- if (!lower) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("Cannot convert name to lowercase\n"));
- talloc_zfree(attrs);
- return ENOMEM;
- }
-
- ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, lower);
+ ret = sysdb_attrs_add_lc_name_alias(attrs, pwd->pw_name);
if (ret) {
DEBUG(SSSDBG_OP_FAILURE, ("Could not add name alias\n"));
talloc_zfree(attrs);
@@ -540,7 +532,6 @@ static int save_group(struct sysdb_ctx *sysdb, struct sss_domain_info *dom,
{
errno_t ret, sret;
struct sysdb_attrs *attrs = NULL;
- char *lower;
const char *cased_alias;
TALLOC_CTX *tmp_ctx;
time_t now = time(NULL);
@@ -595,14 +586,7 @@ static int save_group(struct sysdb_ctx *sysdb, struct sss_domain_info *dom,
}
if (dom->case_sensitive == false) {
- lower = sss_tc_utf8_str_tolower(attrs, grp->gr_name);
- if (!lower) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("Cannot convert name to lowercase\n"));
- ret = ENOMEM;
- goto done;
- }
-
- ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, lower);
+ ret = sysdb_attrs_add_lc_name_alias(attrs, grp->gr_name);
if (ret) {
DEBUG(SSSDBG_OP_FAILURE, ("Could not add name alias\n"));
ret = ENOMEM;
diff --git a/src/providers/proxy/proxy_netgroup.c b/src/providers/proxy/proxy_netgroup.c
index 04a0b18..bb0bc17 100644
--- a/src/providers/proxy/proxy_netgroup.c
+++ b/src/providers/proxy/proxy_netgroup.c
@@ -74,17 +74,9 @@ static errno_t save_netgroup(struct sysdb_ctx *sysdb,
uint64_t cache_timeout)
{
errno_t ret;
- char *lower;
if (lowercase) {
- lower = sss_tc_utf8_str_tolower(NULL, name);
- if (!lower) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("Cannot convert name to lowercase\n"));
- return ENOMEM;
- }
-
- ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, lower);
- talloc_free(lower);
+ ret = sysdb_attrs_add_lc_name_alias(attrs, name);
if (ret) {
DEBUG(SSSDBG_OP_FAILURE, ("Could not add name alias\n"));
return ret;
diff --git a/src/responder/pac/pacsrv_utils.c b/src/responder/pac/pacsrv_utils.c
index 573b0f7..53edcc2 100644
--- a/src/responder/pac/pacsrv_utils.c
+++ b/src/responder/pac/pacsrv_utils.c
@@ -481,9 +481,9 @@ errno_t get_pwd_from_pac(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = sysdb_attrs_add_string(attrs, SYSDB_NAME_ALIAS, pwd->pw_name);
+ ret = sysdb_attrs_add_lc_name_alias(attrs, pwd->pw_name);
if (ret != EOK) {
- DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_string failed.\n"));
+ DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_add_lc_name_alias failed.\n"));
goto done;
}
--
1.8.3.1
-------------- next part --------------
From 3e57163a7bfae0e5e90ca8c412c1f10f01dbbeda Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 13 Dec 2013 11:44:59 +0100
Subject: [PATCH 5/5] Use lower-case name for case-insensitive searches
The patch makes sure that a completely lower-cased version of a fully
qualified name is used for case insensitive searches. Currently there
are code paths where the domain name was used as configured and was not
lower-cased.
To make sure this patch does not break with old entries in the cache or
case sensitive domains a third template was added to the related filters
templates which is either filled with a completely lower-cased version or
with the old version. The other two template values are unchanged.
---
src/db/sysdb.h | 10 +++++-----
src/db/sysdb_ops.c | 8 +++++---
src/db/sysdb_search.c | 30 ++++++++++++++++++++--------
src/responder/pam/pam_LOCAL_domain.c | 4 ++--
src/tests/cmocka/test_utils.c | 38 ++++++++++++++++++++++++++++++++++++
src/util/sss_tc_utf8.c | 30 ++++++++++++++++++++++++++++
src/util/util.h | 6 ++++++
7 files changed, 108 insertions(+), 18 deletions(-)
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index f3358d6..f1ed815 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -144,23 +144,23 @@
#define SYSDB_NC "objectclass="SYSDB_NETGROUP_CLASS
#define SYSDB_MPGC "|("SYSDB_UC")("SYSDB_GC")"
-#define SYSDB_PWNAM_FILTER "(&("SYSDB_UC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
+#define SYSDB_PWNAM_FILTER "(&("SYSDB_UC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
#define SYSDB_PWUID_FILTER "(&("SYSDB_UC")("SYSDB_UIDNUM"=%lu))"
#define SYSDB_PWSID_FILTER "(&("SYSDB_UC")("SYSDB_SID_STR"=%s))"
#define SYSDB_PWENT_FILTER "("SYSDB_UC")"
-#define SYSDB_GRNAM_FILTER "(&("SYSDB_GC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
+#define SYSDB_GRNAM_FILTER "(&("SYSDB_GC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
#define SYSDB_GRGID_FILTER "(&("SYSDB_GC")("SYSDB_GIDNUM"=%lu))"
#define SYSDB_GRSID_FILTER "(&("SYSDB_GC")("SYSDB_SID_STR"=%s))"
#define SYSDB_GRENT_FILTER "("SYSDB_GC")"
-#define SYSDB_GRNAM_MPG_FILTER "(&("SYSDB_MPGC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
+#define SYSDB_GRNAM_MPG_FILTER "(&("SYSDB_MPGC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
#define SYSDB_GRGID_MPG_FILTER "(&("SYSDB_MPGC")("SYSDB_GIDNUM"=%lu))"
#define SYSDB_GRENT_MPG_FILTER "("SYSDB_MPGC")"
#define SYSDB_INITGR_FILTER "(&("SYSDB_GC")("SYSDB_GIDNUM"=*))"
-#define SYSDB_NETGR_FILTER "(&("SYSDB_NC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
-#define SYSDB_NETGR_TRIPLES_FILTER "(|("SYSDB_NAME"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_MEMBEROF"=%s))"
+#define SYSDB_NETGR_FILTER "(&("SYSDB_NC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
+#define SYSDB_NETGR_TRIPLES_FILTER "(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_MEMBEROF"=%s))"
#define SYSDB_SID_FILTER "(&(|("SYSDB_UC")("SYSDB_GC"))("SYSDB_SID_STR"=%s))"
diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index 890bf1e..a5dfd44 100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -305,6 +305,7 @@ int sysdb_search_user_by_name(TALLOC_CTX *mem_ctx,
struct ldb_dn *basedn;
size_t msgs_count = 0;
char *sanitized_name;
+ char *lc_sanitized_name;
char *filter;
int ret;
@@ -320,13 +321,14 @@ int sysdb_search_user_by_name(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = sss_filter_sanitize(tmp_ctx, name, &sanitized_name);
+ ret = sss_filter_sanitize_for_dom(tmp_ctx, name, domain, &sanitized_name,
+ &lc_sanitized_name);
if (ret != EOK) {
goto done;
}
- filter = talloc_asprintf(tmp_ctx, SYSDB_PWNAM_FILTER, sanitized_name,
- sanitized_name);
+ filter = talloc_asprintf(tmp_ctx, SYSDB_PWNAM_FILTER, lc_sanitized_name,
+ sanitized_name, sanitized_name);
if (!filter) {
ret = ENOMEM;
goto done;
diff --git a/src/db/sysdb_search.c b/src/db/sysdb_search.c
index d15fc73..308710a 100644
--- a/src/db/sysdb_search.c
+++ b/src/db/sysdb_search.c
@@ -38,6 +38,7 @@ int sysdb_getpwnam(TALLOC_CTX *mem_ctx,
struct ldb_dn *base_dn;
struct ldb_result *res;
char *sanitized_name;
+ char *lc_sanitized_name;
const char *src_name;
int ret;
@@ -61,13 +62,15 @@ int sysdb_getpwnam(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = sss_filter_sanitize(tmp_ctx, src_name, &sanitized_name);
+ ret = sss_filter_sanitize_for_dom(tmp_ctx, src_name, domain,
+ &sanitized_name, &lc_sanitized_name);
if (ret != EOK) {
goto done;
}
ret = ldb_search(sysdb->ldb, tmp_ctx, &res, base_dn,
LDB_SCOPE_SUBTREE, attrs, SYSDB_PWNAM_FILTER,
+ lc_sanitized_name,
sanitized_name, sanitized_name);
if (ret) {
ret = sysdb_error_to_errno(ret);
@@ -214,6 +217,7 @@ int sysdb_getgrnam(TALLOC_CTX *mem_ctx,
struct ldb_dn *base_dn;
struct ldb_result *res;
const char *src_name;
+ char *lc_sanitized_name;
int ret;
tmp_ctx = talloc_new(NULL);
@@ -243,14 +247,15 @@ int sysdb_getgrnam(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = sss_filter_sanitize(tmp_ctx, src_name, &sanitized_name);
+ ret = sss_filter_sanitize_for_dom(tmp_ctx, src_name, domain,
+ &sanitized_name, &lc_sanitized_name);
if (ret != EOK) {
goto done;
}
ret = ldb_search(sysdb->ldb, tmp_ctx, &res, base_dn,
LDB_SCOPE_SUBTREE, attrs, fmt_filter,
- sanitized_name, sanitized_name);
+ lc_sanitized_name, sanitized_name, sanitized_name);
if (ret) {
ret = sysdb_error_to_errno(ret);
goto done;
@@ -481,6 +486,7 @@ int sysdb_get_user_attr(TALLOC_CTX *mem_ctx,
struct ldb_dn *base_dn;
struct ldb_result *res;
char *sanitized_name;
+ char *lc_sanitized_name;
int ret;
tmp_ctx = talloc_new(NULL);
@@ -495,14 +501,15 @@ int sysdb_get_user_attr(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = sss_filter_sanitize(tmp_ctx, name, &sanitized_name);
+ ret = sss_filter_sanitize_for_dom(tmp_ctx, name, domain, &sanitized_name,
+ &lc_sanitized_name);
if (ret != EOK) {
goto done;
}
ret = ldb_search(sysdb->ldb, tmp_ctx, &res, base_dn,
LDB_SCOPE_SUBTREE, attributes,
- SYSDB_PWNAM_FILTER, sanitized_name,
+ SYSDB_PWNAM_FILTER, lc_sanitized_name, sanitized_name,
sanitized_name);
if (ret) {
ret = sysdb_error_to_errno(ret);
@@ -785,6 +792,7 @@ errno_t sysdb_getnetgr(TALLOC_CTX *mem_ctx,
struct ldb_dn *base_dn;
struct ldb_result *result;
char *sanitized_netgroup;
+ char *lc_sanitized_netgroup;
char *netgroup_dn;
int lret;
errno_t ret;
@@ -802,7 +810,9 @@ errno_t sysdb_getnetgr(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = sss_filter_sanitize(tmp_ctx, netgroup, &sanitized_netgroup);
+ ret = sss_filter_sanitize_for_dom(tmp_ctx, netgroup, domain,
+ &sanitized_netgroup,
+ &lc_sanitized_netgroup);
if (ret != EOK) {
goto done;
}
@@ -816,7 +826,7 @@ errno_t sysdb_getnetgr(TALLOC_CTX *mem_ctx,
lret = ldb_search(sysdb->ldb, tmp_ctx, &result, base_dn,
LDB_SCOPE_SUBTREE, attrs,
- SYSDB_NETGR_TRIPLES_FILTER,
+ SYSDB_NETGR_TRIPLES_FILTER, lc_sanitized_netgroup,
sanitized_netgroup, sanitized_netgroup,
netgroup_dn);
ret = sysdb_error_to_errno(lret);
@@ -843,6 +853,7 @@ int sysdb_get_netgroup_attr(TALLOC_CTX *mem_ctx,
struct ldb_dn *base_dn;
struct ldb_result *result;
char *sanitized_netgroup;
+ char *lc_sanitized_netgroup;
int ret;
tmp_ctx = talloc_new(NULL);
@@ -857,7 +868,9 @@ int sysdb_get_netgroup_attr(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = sss_filter_sanitize(tmp_ctx, netgrname, &sanitized_netgroup);
+ ret = sss_filter_sanitize_for_dom(tmp_ctx, netgrname, domain,
+ &sanitized_netgroup,
+ &lc_sanitized_netgroup);
if (ret != EOK) {
goto done;
}
@@ -865,6 +878,7 @@ int sysdb_get_netgroup_attr(TALLOC_CTX *mem_ctx,
ret = ldb_search(sysdb->ldb, tmp_ctx, &result, base_dn,
LDB_SCOPE_SUBTREE, attributes,
SYSDB_NETGR_FILTER,
+ lc_sanitized_netgroup,
sanitized_netgroup,
sanitized_netgroup);
if (ret) {
diff --git a/src/responder/pam/pam_LOCAL_domain.c b/src/responder/pam/pam_LOCAL_domain.c
index e7776cb..49ddbcd 100644
--- a/src/responder/pam/pam_LOCAL_domain.c
+++ b/src/responder/pam/pam_LOCAL_domain.c
@@ -258,12 +258,12 @@ int LOCAL_pam_handler(struct pam_auth_req *preq)
if (res->count < 1) {
DEBUG(4, ("No user found with filter ["SYSDB_PWNAM_FILTER"]\n",
- pd->user, pd->user));
+ pd->user, pd->user, pd->user));
pd->pam_status = PAM_USER_UNKNOWN;
goto done;
} else if (res->count > 1) {
DEBUG(4, ("More than one object found with filter ["SYSDB_PWNAM_FILTER"]\n",
- pd->user, pd->user));
+ pd->user, pd->user, pd->user));
lreq->error = EFAULT;
goto done;
}
diff --git a/src/tests/cmocka/test_utils.c b/src/tests/cmocka/test_utils.c
index 1be59ab..61e8e9f 100644
--- a/src/tests/cmocka/test_utils.c
+++ b/src/tests/cmocka/test_utils.c
@@ -177,6 +177,41 @@ void test_find_subdomain_by_sid_missing_sid(void **state)
}
}
+#define TEST_SANITIZE_INPUT "TestUser at Test.Domain"
+#define TEST_SANITIZE_LC_INPUT "testuser at test.domain"
+
+void test_sss_filter_sanitize_for_dom(void **state)
+{
+ struct dom_list_test_ctx *test_ctx;
+ int ret;
+ char *sanitized;
+ char *lc_sanitized;
+ struct sss_domain_info *dom;
+
+ test_ctx = talloc_get_type(*state, struct dom_list_test_ctx);
+ dom = test_ctx->dom_list;
+
+ dom->case_sensitive = true;
+
+ ret = sss_filter_sanitize_for_dom(test_ctx, TEST_SANITIZE_INPUT, dom,
+ &sanitized, &lc_sanitized);
+ assert_int_equal(ret, EOK);
+ assert_string_equal(sanitized, TEST_SANITIZE_INPUT);
+ assert_string_equal(lc_sanitized, TEST_SANITIZE_INPUT);
+ talloc_free(sanitized);
+ talloc_free(lc_sanitized);
+
+ dom->case_sensitive = false;
+
+ ret = sss_filter_sanitize_for_dom(test_ctx, TEST_SANITIZE_INPUT, dom,
+ &sanitized, &lc_sanitized);
+ assert_int_equal(ret, EOK);
+ assert_string_equal(sanitized, TEST_SANITIZE_INPUT);
+ assert_string_equal(lc_sanitized, TEST_SANITIZE_LC_INPUT);
+ talloc_free(sanitized);
+ talloc_free(lc_sanitized);
+}
+
int main(int argc, const char *argv[])
{
poptContext pc;
@@ -194,6 +229,9 @@ int main(int argc, const char *argv[])
setup_dom_list, teardown_dom_list),
unit_test_setup_teardown(test_find_subdomain_by_sid_missing_sid,
setup_dom_list, teardown_dom_list),
+
+ unit_test_setup_teardown(test_sss_filter_sanitize_for_dom,
+ setup_dom_list, teardown_dom_list),
};
/* Set debug level to invalid value so we can deside if -d 0 was used. */
diff --git a/src/util/sss_tc_utf8.c b/src/util/sss_tc_utf8.c
index 6a97621..e1426a4 100644
--- a/src/util/sss_tc_utf8.c
+++ b/src/util/sss_tc_utf8.c
@@ -55,3 +55,33 @@ sss_tc_utf8_tolower(TALLOC_CTX *mem_ctx, const uint8_t *s, size_t len, size_t *_
return ret;
}
+errno_t sss_filter_sanitize_for_dom(TALLOC_CTX *mem_ctx,
+ const char *input,
+ struct sss_domain_info *dom,
+ char **sanitized,
+ char **lc_sanitized)
+{
+ int ret;
+
+ ret = sss_filter_sanitize(mem_ctx, input, sanitized);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sss_filter_sanitize failed.\n"));
+ return ret;
+ }
+
+ if (dom->case_sensitive) {
+ *lc_sanitized = talloc_strdup(mem_ctx, *sanitized);
+ } else {
+ *lc_sanitized = sss_tc_utf8_str_tolower(mem_ctx, *sanitized);
+ }
+
+ if (*lc_sanitized == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("%s failed.\n",
+ dom->case_sensitive ?
+ "talloc_strdup" :
+ "sss_tc_utf8_str_tolower"));
+ return ENOMEM;
+ }
+
+ return EOK;
+}
diff --git a/src/util/util.h b/src/util/util.h
index 058c1c2..3334476 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -484,6 +484,12 @@ errno_t sss_filter_sanitize(TALLOC_CTX *mem_ctx,
const char *input,
char **sanitized);
+errno_t sss_filter_sanitize_for_dom(TALLOC_CTX *mem_ctx,
+ const char *input,
+ struct sss_domain_info *dom,
+ char **sanitized,
+ char **lc_sanitized);
+
char *
sss_escape_ip_address(TALLOC_CTX *mem_ctx, int family, const char *addr);
--
1.8.3.1
More information about the sssd-devel
mailing list