File: | /dev/shm/clang/../sssd/src/providers/ad/ad_gpo.c |
Location: | line 849, column 9 |
Description: | Access to field 'gpo_guid' results in a dereference of a null pointer |
1 | /* | |||||
2 | SSSD | |||||
3 | ||||||
4 | Authors: | |||||
5 | Yassir Elley <yelley@redhat.com> | |||||
6 | ||||||
7 | Copyright (C) 2013 Red Hat | |||||
8 | ||||||
9 | This program is free software; you can redistribute it and/or modify | |||||
10 | it under the terms of the GNU General Public License as published by | |||||
11 | the Free Software Foundation; either version 3 of the License, or | |||||
12 | (at your option) any later version. | |||||
13 | ||||||
14 | This program is distributed in the hope that it will be useful, | |||||
15 | but WITHOUT ANY WARRANTY; without even the implied warranty of | |||||
16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |||||
17 | GNU General Public License for more details. | |||||
18 | ||||||
19 | You should have received a copy of the GNU General Public License | |||||
20 | along with this program. If not, see <http://www.gnu.org/licenses/>. | |||||
21 | */ | |||||
22 | ||||||
23 | /* | |||||
24 | * This file implements the following pair of *public* functions (see header): | |||||
25 | * ad_gpo_access_send/recv: provides client-side GPO processing | |||||
26 | * | |||||
27 | * This file also implements the following pairs of *private* functions (which | |||||
28 | * are used by the public functions): | |||||
29 | * ad_gpo_process_som_send/recv: populate list of gp_som objects | |||||
30 | * ad_gpo_process_gpo_send/recv: populate list of gp_gpo objects | |||||
31 | */ | |||||
32 | ||||||
33 | #include <security/pam_modules.h> | |||||
34 | #include "util/util.h" | |||||
35 | #include "util/strtonum.h" | |||||
36 | #include "providers/data_provider.h" | |||||
37 | #include "providers/dp_backend.h" | |||||
38 | #include "providers/ad/ad_access.h" | |||||
39 | #include "providers/ad/ad_common.h" | |||||
40 | #include "providers/ad/ad_domain_info.h" | |||||
41 | #include "providers/ad/ad_gpo.h" | |||||
42 | #include "providers/ldap/sdap_access.h" | |||||
43 | #include "providers/ldap/sdap_async.h" | |||||
44 | #include "providers/ldap/sdap.h" | |||||
45 | #include <ndr.h> | |||||
46 | #include <gen_ndr/security.h> | |||||
47 | ||||||
48 | #define AD_AT_DN"distinguishedName" "distinguishedName" | |||||
49 | #define AD_AT_UAC"userAccountControl" "userAccountControl" | |||||
50 | #define AD_AT_CONFIG_NC"configurationNamingContext" "configurationNamingContext" | |||||
51 | #define AD_AT_GPLINK"gPLink" "gPLink" | |||||
52 | #define AD_AT_GPOPTIONS"gpOptions" "gpOptions" | |||||
53 | #define AD_AT_NT_SEC_DESC"nTSecurityDescriptor" "nTSecurityDescriptor" | |||||
54 | #define AD_AT_CN"cn" "cn" | |||||
55 | #define AD_AT_DISPLAY_NAME"displayName" "displayName" | |||||
56 | #define AD_AT_FILE_SYS_PATH"gPCFileSysPath" "gPCFileSysPath" | |||||
57 | #define AD_AT_VERSION_NUMBER"versionNumber" "versionNumber" | |||||
58 | #define AD_AT_MACHINE_EXT_NAMES"gPCMachineExtensionNames" "gPCMachineExtensionNames" | |||||
59 | #define AD_AT_USER_EXT_NAMES"gPCUserExtensionNames" "gPCUserExtensionNames" | |||||
60 | #define AD_AT_FUNC_VERSION"gPCFunctionalityVersion" "gPCFunctionalityVersion" | |||||
61 | #define AD_AT_FLAGS"flags" "flags" | |||||
62 | ||||||
63 | #define UAC_WORKSTATION_TRUST_ACCOUNT0x00001000 0x00001000 | |||||
64 | #define AD_AGP_GUID"edacfd8f-ffb3-11d1-b41d-00a0c968f939" "edacfd8f-ffb3-11d1-b41d-00a0c968f939" | |||||
65 | #define AD_AUTHENTICATED_USERS_SID"S-1-5-11" "S-1-5-11" | |||||
66 | #define SID_MAX_LEN1024 1024 | |||||
67 | ||||||
68 | /* == common data structures and declarations ============================= */ | |||||
69 | ||||||
70 | struct gp_som { | |||||
71 | const char *som_dn; | |||||
72 | struct gp_gplink **gplink_list; | |||||
73 | int num_gplinks; | |||||
74 | }; | |||||
75 | ||||||
76 | struct gp_gplink { | |||||
77 | const char *gpo_dn; | |||||
78 | bool_Bool enforced; | |||||
79 | }; | |||||
80 | ||||||
81 | struct gp_gpo { | |||||
82 | struct security_descriptor *gpo_sd; | |||||
83 | const char *gpo_dn; | |||||
84 | const char *gpo_guid; | |||||
85 | const char *gpo_display_name; | |||||
86 | const char *gpo_file_sys_path; | |||||
87 | uint32_t gpo_container_version; | |||||
88 | const char **gpo_cse_guids; | |||||
89 | int num_gpo_cse_guids; | |||||
90 | int gpo_func_version; | |||||
91 | int gpo_flags; | |||||
92 | }; | |||||
93 | ||||||
94 | enum ace_eval_status { | |||||
95 | AD_GPO_ACE_DENIED, | |||||
96 | AD_GPO_ACE_ALLOWED, | |||||
97 | AD_GPO_ACE_NEUTRAL | |||||
98 | }; | |||||
99 | ||||||
100 | struct tevent_req *ad_gpo_process_som_send(TALLOC_CTX *mem_ctx, | |||||
101 | struct tevent_context *ev, | |||||
102 | struct sdap_id_conn_ctx *conn, | |||||
103 | struct ldb_context *ldb_ctx, | |||||
104 | struct sdap_id_op *sdap_op, | |||||
105 | struct sdap_options *opts, | |||||
106 | int timeout, | |||||
107 | const char *target_dn, | |||||
108 | const char *domain_name); | |||||
109 | int ad_gpo_process_som_recv(struct tevent_req *req, | |||||
110 | TALLOC_CTX *mem_ctx, | |||||
111 | struct gp_som ***som_list); | |||||
112 | ||||||
113 | struct tevent_req *ad_gpo_process_gpo_send(TALLOC_CTX *mem_ctx, | |||||
114 | struct tevent_context *ev, | |||||
115 | struct sdap_id_op *sdap_op, | |||||
116 | struct sdap_options *opts, | |||||
117 | int timeout, | |||||
118 | struct gp_som **som_list); | |||||
119 | int ad_gpo_process_gpo_recv(struct tevent_req *req, | |||||
120 | TALLOC_CTX *mem_ctx, | |||||
121 | struct gp_gpo ***candidate_gpos, | |||||
122 | int *num_candidate_gpos); | |||||
123 | ||||||
124 | /* == ad_gpo_access_send/recv helpers =======================================*/ | |||||
125 | ||||||
126 | /* | |||||
127 | * This function retrieves the SIDs corresponding to the input user and returns | |||||
128 | * the user_sid, group_sids, and group_size in their respective output params. | |||||
129 | * | |||||
130 | * Note: since authentication must complete successfully before the | |||||
131 | * gpo access checks are called, we can safely assume that the user/computer | |||||
132 | * has been authenticated. As such, this function always adds the | |||||
133 | * AD_AUTHENTICATED_USERS_SID to the group_sids. | |||||
134 | */ | |||||
135 | static errno_t | |||||
136 | ad_gpo_get_sids(TALLOC_CTX *mem_ctx, | |||||
137 | const char *user, | |||||
138 | struct sss_domain_info *domain, | |||||
139 | const char **_user_sid, | |||||
140 | const char ***_group_sids, | |||||
141 | int *_group_size) | |||||
142 | { | |||||
143 | TALLOC_CTX *tmp_ctx = NULL((void*)0); | |||||
144 | struct ldb_result *res; | |||||
145 | int ret = 0; | |||||
146 | int i = 0; | |||||
147 | int num_group_sids = 0; | |||||
148 | const char *user_sid = NULL((void*)0); | |||||
149 | const char *group_sid = NULL((void*)0); | |||||
150 | const char **group_sids = NULL((void*)0); | |||||
151 | ||||||
152 | tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c" ":" "152"); | |||||
153 | if (tmp_ctx == NULL((void*)0)) { | |||||
154 | ret = ENOMEM12; | |||||
155 | goto done; | |||||
156 | } | |||||
157 | ||||||
158 | /* first result from sysdb_initgroups is user_sid; rest are group_sids */ | |||||
159 | ret = sysdb_initgroups(tmp_ctx, domain, user, &res); | |||||
160 | if (ret != EOK0) { | |||||
161 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 163, __FUNCTION__, __debug_macro_level, "sysdb_initgroups failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
162 | "sysdb_initgroups failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 163, __FUNCTION__, __debug_macro_level, "sysdb_initgroups failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
163 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 163, __FUNCTION__, __debug_macro_level, "sysdb_initgroups failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
164 | return ret; | |||||
165 | } | |||||
166 | ||||||
167 | if (res->count == 0) { | |||||
168 | ret = ENOENT2; | |||||
169 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 170, __FUNCTION__, __debug_macro_level, "sysdb_initgroups returned empty result\n" ); } } while (0) | |||||
170 | "sysdb_initgroups returned empty result\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 170, __FUNCTION__, __debug_macro_level, "sysdb_initgroups returned empty result\n" ); } } while (0); | |||||
171 | return ret; | |||||
172 | } | |||||
173 | ||||||
174 | user_sid = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_SID_STR"objectSIDString", NULL((void*)0)); | |||||
175 | num_group_sids = (res->count) - 1; | |||||
176 | ||||||
177 | /* include space for AD_AUTHENTICATED_USERS_SID and NULL */ | |||||
178 | group_sids = talloc_array(tmp_ctx, const char *, num_group_sids + 1 + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_group_sids + 1 + 1, "const char *"); | |||||
179 | if (group_sids == NULL((void*)0)) { | |||||
180 | ret = ENOMEM12; | |||||
181 | goto done; | |||||
182 | } | |||||
183 | ||||||
184 | for (i = 0; i < num_group_sids; i++) { | |||||
185 | group_sid = ldb_msg_find_attr_as_string(res->msgs[i+1], | |||||
186 | SYSDB_SID_STR"objectSIDString", NULL((void*)0)); | |||||
187 | if (group_sid == NULL((void*)0)) { | |||||
188 | continue; | |||||
189 | } | |||||
190 | ||||||
191 | group_sids[i] = talloc_steal(group_sids, group_sid)({ __typeof__(group_sid) __talloc_steal_ret = (__typeof__(group_sid ))_talloc_steal_loc((group_sids),(group_sid), "../sssd/src/providers/ad/ad_gpo.c" ":" "191"); __talloc_steal_ret; }); | |||||
192 | if (group_sids[i] == NULL((void*)0)) { | |||||
193 | ret = ENOMEM12; | |||||
194 | goto done; | |||||
195 | } | |||||
196 | } | |||||
197 | group_sids[i++] = talloc_strdup(group_sids, AD_AUTHENTICATED_USERS_SID"S-1-5-11"); | |||||
198 | group_sids[i] = NULL((void*)0); | |||||
199 | ||||||
200 | *_group_size = num_group_sids + 1; | |||||
201 | *_group_sids = talloc_steal(mem_ctx, group_sids)({ __typeof__(group_sids) __talloc_steal_ret = (__typeof__(group_sids ))_talloc_steal_loc((mem_ctx),(group_sids), "../sssd/src/providers/ad/ad_gpo.c" ":" "201"); __talloc_steal_ret; }); | |||||
202 | *_user_sid = talloc_steal(mem_ctx, user_sid)({ __typeof__(user_sid) __talloc_steal_ret = (__typeof__(user_sid ))_talloc_steal_loc((mem_ctx),(user_sid), "../sssd/src/providers/ad/ad_gpo.c" ":" "202"); __talloc_steal_ret; }); | |||||
203 | return EOK0; | |||||
204 | ||||||
205 | done: | |||||
206 | talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":" "206"); | |||||
207 | return ret; | |||||
208 | } | |||||
209 | ||||||
210 | bool_Bool string_to_sid(struct dom_sid *sidout, const char *sidstr); | |||||
211 | int dom_sid_string_buf(const struct dom_sid *sid, char *buf, int buflen); | |||||
212 | bool_Bool dom_sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2); | |||||
213 | ||||||
214 | /* | |||||
215 | * This function determines whether the input ACE includes any of the | |||||
216 | * client's SIDs. The boolean result is assigned to the _included output param. | |||||
217 | */ | |||||
218 | static errno_t | |||||
219 | ad_gpo_ace_includes_client_sid(const char *user_sid, | |||||
220 | const char **group_sids, | |||||
221 | int group_size, | |||||
222 | struct security_ace *ace, | |||||
223 | bool_Bool *_included) | |||||
224 | { | |||||
225 | int i = 0; | |||||
226 | struct dom_sid ace_dom_sid; | |||||
227 | struct dom_sid user_dom_sid; | |||||
228 | struct dom_sid group_dom_sid; | |||||
229 | char buf[SID_MAX_LEN1024 + 1]; | |||||
230 | ||||||
231 | ace_dom_sid = ace->trustee; | |||||
232 | ||||||
233 | dom_sid_string_buf(&ace_dom_sid, buf, SID_MAX_LEN1024); | |||||
234 | ||||||
235 | if (!string_to_sid(&user_dom_sid, user_sid)) { | |||||
236 | DEBUG(SSSDBG_OP_FAILURE, "string_to_sid failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 236, __FUNCTION__, __debug_macro_level, "string_to_sid failed\n" ); } } while (0); | |||||
237 | return EINVAL22; | |||||
238 | } | |||||
239 | ||||||
240 | if (dom_sid_equal(&ace_dom_sid, &user_dom_sid)) { | |||||
241 | *_included = true1; | |||||
242 | return EOK0; | |||||
243 | } | |||||
244 | ||||||
245 | for (i = 0; i < group_size; i++) { | |||||
246 | if (!string_to_sid(&group_dom_sid, group_sids[i])) { | |||||
247 | DEBUG(SSSDBG_OP_FAILURE, "string_to_sid failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 247, __FUNCTION__, __debug_macro_level, "string_to_sid failed\n" ); } } while (0); | |||||
248 | return EINVAL22; | |||||
249 | } | |||||
250 | if (dom_sid_equal(&ace_dom_sid, &group_dom_sid)) { | |||||
251 | *_included = true1; | |||||
252 | return EOK0; | |||||
253 | } | |||||
254 | } | |||||
255 | ||||||
256 | *_included = false0; | |||||
257 | return EOK0; | |||||
258 | } | |||||
259 | ||||||
260 | /* | |||||
261 | * This function determines whether use of the extended right | |||||
262 | * named "ApplyGroupPolicy" (AGP) is allowed, by comparing the specified | |||||
263 | * user_sid and group_sids against the specified access control entry (ACE). | |||||
264 | * This function returns ALLOWED, DENIED, or NEUTRAL depending on whether | |||||
265 | * the ACE explictly allows, explicitly denies, or does neither. | |||||
266 | * | |||||
267 | * Note that the 'M' abbreviation used in the evaluation algorithm stands for | |||||
268 | * "access_mask", which represents the set of access rights associated with an | |||||
269 | * individual ACE. The access right of interest to the GPO code is | |||||
270 | * RIGHT_DS_CONTROL_ACCESS, which serves as a container for all control access | |||||
271 | * rights. The specific control access right is identified by a GUID in the | |||||
272 | * ACE's ObjectType. In our case, this is the GUID corresponding to AGP. | |||||
273 | * | |||||
274 | * The ACE evaluation algorithm is specified in [MS-ADTS] 5.1.3.3.4: | |||||
275 | * - Deny access by default | |||||
276 | * - If the "Inherit Only" (IO) flag is set in the ACE, skip the ACE. | |||||
277 | * - If the SID in the ACE does not match any SID in the requester's | |||||
278 | * security context, skip the ACE | |||||
279 | * - If the ACE type is "Object Access Allowed", the access right | |||||
280 | * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType | |||||
281 | * field in the ACE is either not present OR contains a GUID value equal | |||||
282 | * to AGP, then grant requested control access right. Stop access checking. | |||||
283 | * - If the ACE type is "Object Access Denied", the access right | |||||
284 | * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType | |||||
285 | * field in the ACE is either not present OR contains a GUID value equal to | |||||
286 | * AGP, then deny the requested control access right. Stop access checking. | |||||
287 | */ | |||||
288 | static enum ace_eval_status ad_gpo_evaluate_ace(struct security_ace *ace, | |||||
289 | const char *user_sid, | |||||
290 | const char **group_sids, | |||||
291 | int group_size) | |||||
292 | { | |||||
293 | bool_Bool agp_included = false0; | |||||
294 | bool_Bool included = false0; | |||||
295 | int ret = 0; | |||||
296 | struct security_ace_object object; | |||||
297 | struct GUID ext_right_agp_guid; | |||||
298 | ||||||
299 | if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY( 0x08 )) { | |||||
300 | return AD_GPO_ACE_NEUTRAL; | |||||
301 | } | |||||
302 | ||||||
303 | ret = ad_gpo_ace_includes_client_sid(user_sid, group_sids, group_size, ace, | |||||
304 | &included); | |||||
305 | if (ret != EOK0) { | |||||
306 | return AD_GPO_ACE_DENIED; | |||||
307 | } | |||||
308 | ||||||
309 | if (!included) { | |||||
310 | return AD_GPO_ACE_NEUTRAL; | |||||
311 | } | |||||
312 | ||||||
313 | object = ace->object.object; | |||||
314 | GUID_from_string(AD_AGP_GUID"edacfd8f-ffb3-11d1-b41d-00a0c968f939", &ext_right_agp_guid); | |||||
315 | ||||||
316 | if (object.flags & SEC_ACE_OBJECT_TYPE_PRESENT( 0x00000001 )) { | |||||
317 | if (GUID_equal(&object.type.type, &ext_right_agp_guid)) { | |||||
318 | agp_included = true1; | |||||
319 | } | |||||
320 | } else { | |||||
321 | agp_included = false0; | |||||
322 | } | |||||
323 | ||||||
324 | if (ace->access_mask & SEC_ADS_CONTROL_ACCESS( 0x00000100 )) { | |||||
325 | if (agp_included) { | |||||
326 | if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) { | |||||
327 | return AD_GPO_ACE_ALLOWED; | |||||
328 | } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) { | |||||
329 | return AD_GPO_ACE_DENIED; | |||||
330 | } | |||||
331 | } | |||||
332 | } | |||||
333 | ||||||
334 | return AD_GPO_ACE_DENIED; | |||||
335 | } | |||||
336 | ||||||
337 | /* | |||||
338 | * This function extracts the GPO's DACL (discretionary access control list) | |||||
339 | * from the GPO's specified security descriptor, and determines whether | |||||
340 | * the GPO is applicable to the policy target, by comparing the specified | |||||
341 | * user_sid and group_sids against each access control entry (ACE) in the DACL. | |||||
342 | * The boolean result is assigned to the _access_allowed output parameter. | |||||
343 | */ | |||||
344 | static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, | |||||
345 | const char *user_sid, | |||||
346 | const char **group_sids, | |||||
347 | int group_size, | |||||
348 | bool_Bool *_dacl_access_allowed) | |||||
349 | { | |||||
350 | uint32_t num_aces = 0; | |||||
351 | enum ace_eval_status ace_status; | |||||
352 | int i = 0; | |||||
353 | struct security_ace *ace = NULL((void*)0); | |||||
354 | ||||||
355 | num_aces = dacl->num_aces; | |||||
356 | ||||||
357 | /* | |||||
358 | * [MS-ADTS] 5.1.3.3.4: | |||||
359 | * If the DACL does not have any ACE, then deny the requester the | |||||
360 | * requested control access right. | |||||
361 | */ | |||||
362 | if (num_aces == 0) { | |||||
363 | *_dacl_access_allowed = false0; | |||||
364 | return EOK0; | |||||
365 | } | |||||
366 | ||||||
367 | for (i = 0; i < dacl->num_aces; i ++) { | |||||
368 | ace = &dacl->aces[i]; | |||||
369 | ||||||
370 | ace_status = ad_gpo_evaluate_ace(ace, user_sid, group_sids, group_size); | |||||
371 | ||||||
372 | switch (ace_status) { | |||||
373 | case AD_GPO_ACE_NEUTRAL: | |||||
374 | continue; | |||||
375 | case AD_GPO_ACE_ALLOWED: | |||||
376 | *_dacl_access_allowed = true1; | |||||
377 | return EOK0; | |||||
378 | case AD_GPO_ACE_DENIED: | |||||
379 | *_dacl_access_allowed = false0; | |||||
380 | return EOK0; | |||||
381 | } | |||||
382 | } | |||||
383 | ||||||
384 | *_dacl_access_allowed = false0; | |||||
385 | return EOK0; | |||||
386 | } | |||||
387 | ||||||
388 | /* | |||||
389 | * This function takes candidate_gpos as input, filters out any gpo that is | |||||
390 | * not applicable to the policy target and assigns the result to the | |||||
391 | * _dacl_filtered_gpos output parameter. The filtering algorithm is | |||||
392 | * defined in [MS-GPOL] 3.2.5.1.6 | |||||
393 | */ | |||||
394 | ||||||
395 | static errno_t | |||||
396 | ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx, | |||||
397 | const char *user, | |||||
398 | struct sss_domain_info *domain, | |||||
399 | struct gp_gpo **candidate_gpos, | |||||
400 | int num_candidate_gpos, | |||||
401 | struct gp_gpo ***_dacl_filtered_gpos, | |||||
402 | int *_num_dacl_filtered_gpos) | |||||
403 | { | |||||
404 | TALLOC_CTX *tmp_ctx = NULL((void*)0); | |||||
405 | int i = 0; | |||||
406 | int ret = 0; | |||||
407 | struct gp_gpo *candidate_gpo = NULL((void*)0); | |||||
408 | struct security_descriptor *sd = NULL((void*)0); | |||||
409 | struct security_acl *dacl = NULL((void*)0); | |||||
410 | const char *user_sid = NULL((void*)0); | |||||
411 | const char **group_sids = NULL((void*)0); | |||||
412 | int group_size = 0; | |||||
413 | int gpo_dn_idx = 0; | |||||
414 | bool_Bool access_allowed = false0; | |||||
415 | struct gp_gpo **dacl_filtered_gpos = NULL((void*)0); | |||||
416 | ||||||
417 | tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c" ":" "417"); | |||||
418 | if (tmp_ctx == NULL((void*)0)) { | |||||
419 | ret = ENOMEM12; | |||||
420 | goto done; | |||||
421 | } | |||||
422 | ||||||
423 | ret = ad_gpo_get_sids(tmp_ctx, user, domain, &user_sid, | |||||
424 | &group_sids, &group_size); | |||||
425 | if (ret != EOK0) { | |||||
426 | ret = ERR_NO_SIDS; | |||||
427 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 428, __FUNCTION__, __debug_macro_level, "Unable to retrieve SIDs: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
428 | "Unable to retrieve SIDs: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 428, __FUNCTION__, __debug_macro_level, "Unable to retrieve SIDs: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
429 | goto done; | |||||
430 | } | |||||
431 | ||||||
432 | dacl_filtered_gpos = talloc_array(tmp_ctx,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo *), num_candidate_gpos + 1, "struct gp_gpo *") | |||||
433 | struct gp_gpo *,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo *), num_candidate_gpos + 1, "struct gp_gpo *") | |||||
434 | num_candidate_gpos + 1)(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo *), num_candidate_gpos + 1, "struct gp_gpo *"); | |||||
435 | ||||||
436 | if (dacl_filtered_gpos == NULL((void*)0)) { | |||||
437 | ret = ENOMEM12; | |||||
438 | goto done; | |||||
439 | } | |||||
440 | ||||||
441 | for (i = 0; i < num_candidate_gpos; i++) { | |||||
442 | ||||||
443 | access_allowed = false0; | |||||
444 | candidate_gpo = candidate_gpos[i]; | |||||
445 | sd = candidate_gpo->gpo_sd; | |||||
446 | dacl = candidate_gpo->gpo_sd->dacl; | |||||
447 | ||||||
448 | DEBUG(SSSDBG_TRACE_ALL, "examining dacl candidate_gpo_guid:%s\n",do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 449, __FUNCTION__, __debug_macro_level, "examining dacl candidate_gpo_guid:%s\n" , candidate_gpo->gpo_guid); } } while (0) | |||||
449 | candidate_gpo->gpo_guid)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 449, __FUNCTION__, __debug_macro_level, "examining dacl candidate_gpo_guid:%s\n" , candidate_gpo->gpo_guid); } } while (0); | |||||
450 | ||||||
451 | /* gpo_func_version must be set to version 2 */ | |||||
452 | if (candidate_gpo->gpo_func_version != 2) { | |||||
453 | DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 454, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n" ); } } while (0) | |||||
454 | "GPO not applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 454, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n" ); } } while (0); | |||||
455 | continue; | |||||
456 | } | |||||
457 | ||||||
458 | /* gpo_flags value of 2 means that GPO's computer portion is disabled */ | |||||
459 | if (candidate_gpo->gpo_flags == 2) { | |||||
460 | DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 461, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n" ); } } while (0) | |||||
461 | "GPO not applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 461, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n" ); } } while (0); | |||||
462 | continue; | |||||
463 | } | |||||
464 | ||||||
465 | /* | |||||
466 | * [MS-ADTS] 5.1.3.3.4: | |||||
467 | * If the security descriptor has no DACL or its "DACL Present" bit | |||||
468 | * is not set, then grant requester the requested control access right. | |||||
469 | */ | |||||
470 | ||||||
471 | if ((!(sd->type & SEC_DESC_DACL_PRESENT( 0x0004 ))) || (dacl == NULL((void*)0))) { | |||||
472 | DEBUG(SSSDBG_TRACE_ALL, "DACL is not present\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 472, __FUNCTION__, __debug_macro_level, "DACL is not present\n" ); } } while (0); | |||||
473 | access_allowed = true1; | |||||
474 | break; | |||||
475 | } | |||||
476 | ||||||
477 | ad_gpo_evaluate_dacl(dacl, user_sid, group_sids, | |||||
478 | group_size, &access_allowed); | |||||
479 | if (access_allowed) { | |||||
480 | DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 481, __FUNCTION__, __debug_macro_level, "GPO applicable to target per security filtering\n" ); } } while (0) | |||||
481 | "GPO applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 481, __FUNCTION__, __debug_macro_level, "GPO applicable to target per security filtering\n" ); } } while (0); | |||||
482 | dacl_filtered_gpos[gpo_dn_idx] = talloc_steal(dacl_filtered_gpos,({ __typeof__(candidate_gpo) __talloc_steal_ret = (__typeof__ (candidate_gpo))_talloc_steal_loc((dacl_filtered_gpos),(candidate_gpo ), "../sssd/src/providers/ad/ad_gpo.c" ":" "483"); __talloc_steal_ret ; }) | |||||
483 | candidate_gpo)({ __typeof__(candidate_gpo) __talloc_steal_ret = (__typeof__ (candidate_gpo))_talloc_steal_loc((dacl_filtered_gpos),(candidate_gpo ), "../sssd/src/providers/ad/ad_gpo.c" ":" "483"); __talloc_steal_ret ; }); | |||||
484 | gpo_dn_idx++; | |||||
485 | } else { | |||||
486 | DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 487, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n" ); } } while (0) | |||||
487 | "GPO not applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 487, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n" ); } } while (0); | |||||
488 | continue; | |||||
489 | } | |||||
490 | } | |||||
491 | ||||||
492 | dacl_filtered_gpos[gpo_dn_idx] = NULL((void*)0); | |||||
493 | ||||||
494 | *_dacl_filtered_gpos = talloc_steal(mem_ctx, dacl_filtered_gpos)({ __typeof__(dacl_filtered_gpos) __talloc_steal_ret = (__typeof__ (dacl_filtered_gpos))_talloc_steal_loc((mem_ctx),(dacl_filtered_gpos ), "../sssd/src/providers/ad/ad_gpo.c" ":" "494"); __talloc_steal_ret ; }); | |||||
495 | *_num_dacl_filtered_gpos = gpo_dn_idx; | |||||
496 | ||||||
497 | ret = EOK0; | |||||
498 | ||||||
499 | done: | |||||
500 | talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":" "500"); | |||||
501 | return ret; | |||||
502 | } | |||||
503 | ||||||
504 | /* == ad_gpo_access_send/recv implementation ================================*/ | |||||
505 | ||||||
506 | struct ad_gpo_access_state { | |||||
507 | struct tevent_context *ev; | |||||
508 | struct ldb_context *ldb_ctx; | |||||
509 | struct sdap_id_conn_ctx *conn; | |||||
510 | struct sdap_id_op *sdap_op; | |||||
511 | struct sdap_options *opts; | |||||
512 | int timeout; | |||||
513 | struct sss_domain_info *domain; | |||||
514 | const char *user; | |||||
515 | const char *ad_hostname; | |||||
516 | const char *target_dn; | |||||
517 | struct gp_gpo **dacl_filtered_gpos; | |||||
518 | int num_dacl_filtered_gpos; | |||||
519 | }; | |||||
520 | ||||||
521 | static void ad_gpo_connect_done(struct tevent_req *subreq); | |||||
522 | static void ad_gpo_target_dn_retrieval_done(struct tevent_req *subreq); | |||||
523 | static void ad_gpo_process_som_done(struct tevent_req *subreq); | |||||
524 | static void ad_gpo_process_gpo_done(struct tevent_req *subreq); | |||||
525 | ||||||
526 | struct tevent_req * | |||||
527 | ad_gpo_access_send(TALLOC_CTX *mem_ctx, | |||||
528 | struct tevent_context *ev, | |||||
529 | struct sss_domain_info *domain, | |||||
530 | struct ad_access_ctx *ctx, | |||||
531 | const char *user) | |||||
532 | { | |||||
533 | struct tevent_req *req; | |||||
534 | struct tevent_req *subreq; | |||||
535 | struct ad_gpo_access_state *state; | |||||
536 | errno_t ret; | |||||
537 | ||||||
538 | req = tevent_req_create(mem_ctx, &state, struct ad_gpo_access_state)_tevent_req_create((mem_ctx), (&state), sizeof(struct ad_gpo_access_state ), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "538"); | |||||
539 | if (req == NULL((void*)0)) { | |||||
540 | DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n")do { int __debug_macro_level = 0x0020; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 540, __FUNCTION__, __debug_macro_level, "tevent_req_create() failed\n" ); } } while (0); | |||||
541 | return NULL((void*)0); | |||||
542 | } | |||||
543 | ||||||
544 | state->domain = domain; | |||||
545 | state->dacl_filtered_gpos = NULL((void*)0); | |||||
546 | state->num_dacl_filtered_gpos = 0; | |||||
547 | state->ev = ev; | |||||
548 | state->user = user; | |||||
549 | state->ldb_ctx = sysdb_ctx_get_ldb(domain->sysdb); | |||||
550 | state->ad_hostname = dp_opt_get_string(ctx->ad_options, AD_HOSTNAME)_dp_opt_get_string(ctx->ad_options, AD_HOSTNAME, __FUNCTION__ ); | |||||
551 | state->opts = ctx->sdap_access_ctx->id_ctx->opts; | |||||
552 | state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT)_dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT , __FUNCTION__); | |||||
553 | state->conn = ad_get_dom_ldap_conn(ctx->ad_id_ctx, domain); | |||||
554 | state->sdap_op = sdap_id_op_create(state, state->conn->conn_cache); | |||||
555 | if (state->sdap_op == NULL((void*)0)) { | |||||
556 | DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 556, __FUNCTION__, __debug_macro_level, "sdap_id_op_create failed.\n" ); } } while (0); | |||||
557 | ret = ENOMEM12; | |||||
558 | goto immediately; | |||||
559 | } | |||||
560 | ||||||
561 | subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret); | |||||
562 | if (subreq == NULL((void*)0)) { | |||||
563 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 565, __FUNCTION__, __debug_macro_level, "sdap_id_op_connect_send failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
564 | "sdap_id_op_connect_send failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 565, __FUNCTION__, __debug_macro_level, "sdap_id_op_connect_send failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
565 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 565, __FUNCTION__, __debug_macro_level, "sdap_id_op_connect_send failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
566 | goto immediately; | |||||
567 | } | |||||
568 | tevent_req_set_callback(subreq, ad_gpo_connect_done, req); | |||||
569 | ||||||
570 | ret = EOK0; | |||||
571 | ||||||
572 | immediately: | |||||
573 | ||||||
574 | if (ret != EOK0) { | |||||
575 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "575"); | |||||
576 | tevent_req_post(req, ev); | |||||
577 | } | |||||
578 | ||||||
579 | return req; | |||||
580 | } | |||||
581 | ||||||
582 | static void | |||||
583 | ad_gpo_connect_done(struct tevent_req *subreq) | |||||
584 | { | |||||
585 | struct tevent_req *req; | |||||
586 | struct ad_gpo_access_state *state; | |||||
587 | char* filter; | |||||
588 | char *sam_account_name; | |||||
589 | char *domain_dn; | |||||
590 | int dp_error; | |||||
591 | errno_t ret; | |||||
592 | ||||||
593 | const char *attrs[] = {AD_AT_DN"distinguishedName", AD_AT_UAC"userAccountControl", NULL((void*)0)}; | |||||
594 | ||||||
595 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "595"); | |||||
596 | state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "596"); | |||||
597 | ||||||
598 | ret = sdap_id_op_connect_recv(subreq, &dp_error); | |||||
599 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "599"); subreq = ((void*)0); } while(0); | |||||
600 | ||||||
601 | if (ret != EOK0) { | |||||
602 | /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */ | |||||
603 | ||||||
604 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 606, __FUNCTION__, __debug_macro_level, "Failed to connect to AD server: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
605 | "Failed to connect to AD server: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 606, __FUNCTION__, __debug_macro_level, "Failed to connect to AD server: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
606 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 606, __FUNCTION__, __debug_macro_level, "Failed to connect to AD server: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
607 | ||||||
608 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "608"); | |||||
609 | return; | |||||
610 | } | |||||
611 | ||||||
612 | sam_account_name = talloc_asprintf(state, "%s$", state->ad_hostname); | |||||
613 | if (sam_account_name == NULL((void*)0)) { | |||||
614 | tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c" ":" "614"); | |||||
615 | return; | |||||
616 | } | |||||
617 | ||||||
618 | DEBUG(SSSDBG_TRACE_FUNC, "sam_account_name is %s\n", sam_account_name)do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 618, __FUNCTION__, __debug_macro_level, "sam_account_name is %s\n" , sam_account_name); } } while (0); | |||||
619 | ||||||
620 | /* Convert the domain name into domain DN */ | |||||
621 | ret = domain_to_basedn(state, state->domain->name, &domain_dn); | |||||
622 | if (ret != EOK0) { | |||||
623 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 625, __FUNCTION__, __debug_macro_level, "Cannot convert domain name [%s] to base DN [%d]: %s\n" , state->domain->name, ret, sss_strerror(ret)); } } while (0) | |||||
624 | "Cannot convert domain name [%s] to base DN [%d]: %s\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 625, __FUNCTION__, __debug_macro_level, "Cannot convert domain name [%s] to base DN [%d]: %s\n" , state->domain->name, ret, sss_strerror(ret)); } } while (0) | |||||
625 | state->domain->name, ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 625, __FUNCTION__, __debug_macro_level, "Cannot convert domain name [%s] to base DN [%d]: %s\n" , state->domain->name, ret, sss_strerror(ret)); } } while (0); | |||||
626 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "626"); | |||||
627 | return; | |||||
628 | } | |||||
629 | ||||||
630 | /* SDAP_OC_USER objectclass covers both users and computers */ | |||||
631 | filter = talloc_asprintf(state, | |||||
632 | "(&(objectclass=%s)(%s=%s))", | |||||
633 | state->opts->user_map[SDAP_OC_USER].name, | |||||
634 | state->opts->user_map[SDAP_AT_USER_NAME].name, | |||||
635 | sam_account_name); | |||||
636 | ||||||
637 | if (filter == NULL((void*)0)) { | |||||
638 | tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c" ":" "638"); | |||||
639 | return; | |||||
640 | } | |||||
641 | ||||||
642 | subreq = sdap_get_generic_send(state, state->ev, state->opts, | |||||
643 | sdap_id_op_handle(state->sdap_op), | |||||
644 | domain_dn, LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002), | |||||
645 | filter, attrs, NULL((void*)0), 0, | |||||
646 | state->timeout, | |||||
647 | false0); | |||||
648 | ||||||
649 | if (subreq == NULL((void*)0)) { | |||||
650 | DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 650, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n" ); } } while (0); | |||||
651 | tevent_req_error(req, EIO)_tevent_req_error(req, 5, "../sssd/src/providers/ad/ad_gpo.c" ":" "651"); | |||||
652 | return; | |||||
653 | } | |||||
654 | ||||||
655 | tevent_req_set_callback(subreq, ad_gpo_target_dn_retrieval_done, req); | |||||
656 | } | |||||
657 | ||||||
658 | static void | |||||
659 | ad_gpo_target_dn_retrieval_done(struct tevent_req *subreq) | |||||
660 | { | |||||
661 | struct tevent_req *req; | |||||
662 | struct ad_gpo_access_state *state; | |||||
663 | int ret; | |||||
664 | int dp_error; | |||||
665 | size_t reply_count; | |||||
666 | struct sysdb_attrs **reply; | |||||
667 | const char *target_dn = NULL((void*)0); | |||||
668 | uint32_t uac; | |||||
669 | ||||||
670 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "670"); | |||||
671 | state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "671"); | |||||
672 | ret = sdap_get_generic_recv(subreq, state, | |||||
673 | &reply_count, &reply); | |||||
674 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "674"); subreq = ((void*)0); } while(0); | |||||
675 | if (ret != EOK0) { | |||||
676 | ret = sdap_id_op_done(state->sdap_op, ret, &dp_error); | |||||
677 | /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */ | |||||
678 | ||||||
679 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 681, __FUNCTION__, __debug_macro_level, "Unable to get policy target's DN: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
680 | "Unable to get policy target's DN: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 681, __FUNCTION__, __debug_macro_level, "Unable to get policy target's DN: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
681 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 681, __FUNCTION__, __debug_macro_level, "Unable to get policy target's DN: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
682 | ret = ENOENT2; | |||||
683 | goto done; | |||||
684 | } | |||||
685 | ||||||
686 | /* make sure there is only one non-NULL reply returned */ | |||||
687 | ||||||
688 | if (reply_count < 1) { | |||||
689 | DEBUG(SSSDBG_OP_FAILURE, "No DN retrieved for policy target.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 689, __FUNCTION__, __debug_macro_level, "No DN retrieved for policy target.\n" ); } } while (0); | |||||
690 | ret = ENOENT2; | |||||
691 | goto done; | |||||
692 | } else if (reply_count > 1) { | |||||
693 | DEBUG(SSSDBG_OP_FAILURE, "Multiple replies for policy target\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 693, __FUNCTION__, __debug_macro_level, "Multiple replies for policy target\n" ); } } while (0); | |||||
694 | ret = ERR_INTERNAL; | |||||
695 | goto done; | |||||
696 | } else if (reply == NULL((void*)0)) { | |||||
697 | DEBUG(SSSDBG_OP_FAILURE, "reply_count is 1, but reply is NULL\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 697, __FUNCTION__, __debug_macro_level, "reply_count is 1, but reply is NULL\n" ); } } while (0); | |||||
698 | ret = ERR_INTERNAL; | |||||
699 | goto done; | |||||
700 | } | |||||
701 | ||||||
702 | /* reply[0] holds requested attributes of single reply */ | |||||
703 | ret = sysdb_attrs_get_string(reply[0], AD_AT_DN"distinguishedName", &target_dn); | |||||
704 | if (ret != EOK0) { | |||||
705 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 707, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
706 | "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 707, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
707 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 707, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
708 | goto done; | |||||
709 | } | |||||
710 | ||||||
711 | state->target_dn = talloc_steal(state, target_dn)({ __typeof__(target_dn) __talloc_steal_ret = (__typeof__(target_dn ))_talloc_steal_loc((state),(target_dn), "../sssd/src/providers/ad/ad_gpo.c" ":" "711"); __talloc_steal_ret; }); | |||||
712 | if (state->target_dn == NULL((void*)0)) { | |||||
713 | ret = ENOMEM12; | |||||
714 | goto done; | |||||
715 | } | |||||
716 | ||||||
717 | ret = sysdb_attrs_get_uint32_t(reply[0], AD_AT_UAC"userAccountControl", &uac); | |||||
718 | if (ret != EOK0) { | |||||
719 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 721, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
720 | "sysdb_attrs_get_uint32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 721, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
721 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 721, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
722 | goto done; | |||||
723 | } | |||||
724 | ||||||
725 | /* we only support computer policy targets, not users */ | |||||
726 | if (!(uac & UAC_WORKSTATION_TRUST_ACCOUNT0x00001000)) { | |||||
727 | ret = EINVAL22; | |||||
728 | goto done; | |||||
729 | } | |||||
730 | ||||||
731 | subreq = ad_gpo_process_som_send(state, | |||||
732 | state->ev, | |||||
733 | state->conn, | |||||
734 | state->ldb_ctx, | |||||
735 | state->sdap_op, | |||||
736 | state->opts, | |||||
737 | state->timeout, | |||||
738 | state->target_dn, | |||||
739 | state->domain->name); | |||||
740 | if (subreq == NULL((void*)0)) { | |||||
741 | ret = ENOMEM12; | |||||
742 | goto done; | |||||
743 | } | |||||
744 | ||||||
745 | tevent_req_set_callback(subreq, ad_gpo_process_som_done, req); | |||||
746 | ||||||
747 | ret = EOK0; | |||||
748 | ||||||
749 | done: | |||||
750 | ||||||
751 | if (ret != EOK0) { | |||||
752 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "752"); | |||||
753 | } | |||||
754 | } | |||||
755 | ||||||
756 | static void | |||||
757 | ad_gpo_process_som_done(struct tevent_req *subreq) | |||||
758 | { | |||||
759 | struct tevent_req *req; | |||||
760 | struct ad_gpo_access_state *state; | |||||
761 | int ret; | |||||
762 | struct gp_som **som_list; | |||||
763 | ||||||
764 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "764"); | |||||
765 | state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "765"); | |||||
766 | ret = ad_gpo_process_som_recv(subreq, state, &som_list); | |||||
767 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "767"); subreq = ((void*)0); } while(0); | |||||
768 | ||||||
769 | if (ret != EOK0) { | |||||
770 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 772, __FUNCTION__, __debug_macro_level, "Unable to get som list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
771 | "Unable to get som list: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 772, __FUNCTION__, __debug_macro_level, "Unable to get som list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
772 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 772, __FUNCTION__, __debug_macro_level, "Unable to get som list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
773 | ret = ENOENT2; | |||||
774 | goto done; | |||||
775 | } | |||||
776 | ||||||
777 | subreq = ad_gpo_process_gpo_send(state, | |||||
778 | state->ev, | |||||
779 | state->sdap_op, | |||||
780 | state->opts, | |||||
781 | state->timeout, | |||||
782 | som_list); | |||||
783 | if (subreq == NULL((void*)0)) { | |||||
784 | ret = ENOMEM12; | |||||
785 | goto done; | |||||
786 | } | |||||
787 | ||||||
788 | tevent_req_set_callback(subreq, ad_gpo_process_gpo_done, req); | |||||
789 | ||||||
790 | ret = EOK0; | |||||
791 | ||||||
792 | done: | |||||
793 | ||||||
794 | if (ret != EOK0) { | |||||
795 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "795"); | |||||
796 | } | |||||
797 | } | |||||
798 | ||||||
799 | /* | |||||
800 | * This function retrieves a list of candidate_gpos and potentially reduces it | |||||
801 | * to a list of dacl_filtered_gpos, based on each GPO's DACL. | |||||
802 | */ | |||||
803 | static void | |||||
804 | ad_gpo_process_gpo_done(struct tevent_req *subreq) | |||||
805 | { | |||||
806 | struct tevent_req *req; | |||||
807 | struct ad_gpo_access_state *state; | |||||
808 | int ret; | |||||
809 | int dp_error; | |||||
810 | struct gp_gpo **candidate_gpos = NULL((void*)0); | |||||
811 | int num_candidate_gpos = 0; | |||||
812 | int i = 0; | |||||
813 | ||||||
814 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "814"); | |||||
815 | state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "815"); | |||||
816 | ret = ad_gpo_process_gpo_recv(subreq, state, &candidate_gpos, | |||||
817 | &num_candidate_gpos); | |||||
818 | ||||||
819 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "819"); subreq = ((void*)0); } while(0); | |||||
820 | ||||||
821 | ret = sdap_id_op_done(state->sdap_op, ret, &dp_error); | |||||
822 | ||||||
823 | if (ret != EOK0) { | |||||
| ||||||
824 | /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */ | |||||
825 | ||||||
826 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 828, __FUNCTION__, __debug_macro_level, "Unable to get GPO list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
827 | "Unable to get GPO list: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 828, __FUNCTION__, __debug_macro_level, "Unable to get GPO list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
828 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 828, __FUNCTION__, __debug_macro_level, "Unable to get GPO list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
829 | ret = ENOENT2; | |||||
830 | goto done; | |||||
831 | } | |||||
832 | ||||||
833 | ret = ad_gpo_filter_gpos_by_dacl(state, state->user, state->domain, | |||||
834 | candidate_gpos, num_candidate_gpos, | |||||
835 | &state->dacl_filtered_gpos, | |||||
836 | &state->num_dacl_filtered_gpos); | |||||
837 | if (ret != EOK0) { | |||||
838 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 840, __FUNCTION__, __debug_macro_level, "Unable to filter GPO list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
839 | "Unable to filter GPO list: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 840, __FUNCTION__, __debug_macro_level, "Unable to filter GPO list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
840 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 840, __FUNCTION__, __debug_macro_level, "Unable to filter GPO list: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
841 | goto done; | |||||
842 | } | |||||
843 | ||||||
844 | if (state->dacl_filtered_gpos[0] == NULL((void*)0)) { | |||||
845 | DEBUG(SSSDBG_TRACE_FUNC, "dacl_filtered_gpos is empty\n")do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 845, __FUNCTION__, __debug_macro_level, "dacl_filtered_gpos is empty\n" ); } } while (0); | |||||
846 | } | |||||
847 | ||||||
848 | for (i = 0; i < state->num_dacl_filtered_gpos; i++) { | |||||
849 | DEBUG(SSSDBG_TRACE_FUNC, "dacl_filtered_gpos[%d]->gpo_guid is %s\n", i,do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 850, __FUNCTION__, __debug_macro_level, "dacl_filtered_gpos[%d]->gpo_guid is %s\n" , i, state->dacl_filtered_gpos[i]->gpo_guid); } } while (0) | |||||
| ||||||
850 | state->dacl_filtered_gpos[i]->gpo_guid)do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 850, __FUNCTION__, __debug_macro_level, "dacl_filtered_gpos[%d]->gpo_guid is %s\n" , i, state->dacl_filtered_gpos[i]->gpo_guid); } } while (0); | |||||
851 | } | |||||
852 | ||||||
853 | /* TBD: initiate SMB retrieval */ | |||||
854 | DEBUG(SSSDBG_TRACE_FUNC, "time for SMB retrieval\n")do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 854, __FUNCTION__, __debug_macro_level, "time for SMB retrieval\n" ); } } while (0); | |||||
855 | ||||||
856 | ret = EOK0; | |||||
857 | ||||||
858 | done: | |||||
859 | ||||||
860 | if (ret == EOK0) { | |||||
861 | tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":" "861"); | |||||
862 | } else if (ret != EAGAIN11) { | |||||
863 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "863"); | |||||
864 | } | |||||
865 | } | |||||
866 | ||||||
867 | errno_t | |||||
868 | ad_gpo_access_recv(struct tevent_req *req) | |||||
869 | { | |||||
870 | TEVENT_REQ_RETURN_ON_ERROR(req)do { enum tevent_req_state TRROEstate; uint64_t TRROEerr; if ( tevent_req_is_error(req, &TRROEstate, &TRROEerr)) { if (TRROEstate == TEVENT_REQ_USER_ERROR) { return TRROEerr; } return ERR_INTERNAL; } } while (0); | |||||
871 | ||||||
872 | return EOK0; | |||||
873 | } | |||||
874 | ||||||
875 | /* == ad_gpo_process_som_send/recv helpers ================================= */ | |||||
876 | ||||||
877 | /* | |||||
878 | * This function returns the parent of an LDAP DN | |||||
879 | */ | |||||
880 | static errno_t | |||||
881 | ad_gpo_parent_dn(TALLOC_CTX *mem_ctx, | |||||
882 | struct ldb_context *ldb_ctx, | |||||
883 | const char *dn, | |||||
884 | const char **_parent_dn) | |||||
885 | { | |||||
886 | struct ldb_dn *ldb_dn; | |||||
887 | struct ldb_dn *parent_ldb_dn; | |||||
888 | const char *p; | |||||
889 | int ret; | |||||
890 | TALLOC_CTX *tmp_ctx = NULL((void*)0); | |||||
891 | ||||||
892 | tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c" ":" "892"); | |||||
893 | if (tmp_ctx == NULL((void*)0)) { | |||||
894 | ret = ENOMEM12; | |||||
895 | goto done; | |||||
896 | } | |||||
897 | ||||||
898 | ldb_dn = ldb_dn_new(tmp_ctx, ldb_ctx, dn); | |||||
899 | parent_ldb_dn = ldb_dn_get_parent(tmp_ctx, ldb_dn); | |||||
900 | p = ldb_dn_get_linearized(parent_ldb_dn); | |||||
901 | ||||||
902 | *_parent_dn = talloc_steal(mem_ctx, p)({ __typeof__(p) __talloc_steal_ret = (__typeof__(p))_talloc_steal_loc ((mem_ctx),(p), "../sssd/src/providers/ad/ad_gpo.c" ":" "902" ); __talloc_steal_ret; }); | |||||
903 | ret = EOK0; | |||||
904 | ||||||
905 | done: | |||||
906 | talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":" "906"); | |||||
907 | return ret; | |||||
908 | } | |||||
909 | ||||||
910 | /* | |||||
911 | * This function populates the _som_list output parameter by parsing the input | |||||
912 | * DN into a list of gp_som objects. This function essentially repeatedly | |||||
913 | * appends the input DN's parent to the SOM List (if the parent starts with | |||||
914 | * "OU=" or "DC="), until the first "DC=" component is reached. | |||||
915 | * Example: if input DN is "CN=MyComputer,CN=Computers,OU=Sales,DC=FOO,DC=COM", | |||||
916 | * then SOM List has 2 SOM entries: {[OU=Sales,DC=FOO,DC=COM], [DC=FOO, DC=COM]} | |||||
917 | */ | |||||
918 | ||||||
919 | static errno_t | |||||
920 | ad_gpo_populate_som_list(TALLOC_CTX *mem_ctx, | |||||
921 | struct ldb_context *ldb_ctx, | |||||
922 | const char *target_dn, | |||||
923 | int *_num_soms, | |||||
924 | struct gp_som ***_som_list) | |||||
925 | { | |||||
926 | TALLOC_CTX *tmp_ctx = NULL((void*)0); | |||||
927 | int ret; | |||||
928 | int rdn_count = 0; | |||||
929 | int som_idx = 0; | |||||
930 | struct gp_som **som_list; | |||||
931 | const char *parent_dn = NULL((void*)0); | |||||
932 | const char *tmp_dn = NULL((void*)0); | |||||
933 | struct ldb_dn *ldb_target_dn; | |||||
934 | ||||||
935 | tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c" ":" "935"); | |||||
936 | if (tmp_ctx == NULL((void*)0)) { | |||||
937 | ret = ENOMEM12; | |||||
938 | goto done; | |||||
939 | } | |||||
940 | ||||||
941 | ldb_target_dn = ldb_dn_new(tmp_ctx, ldb_ctx, target_dn); | |||||
942 | rdn_count = ldb_dn_get_comp_num(ldb_target_dn); | |||||
943 | ||||||
944 | if (rdn_count == 0) { | |||||
945 | *_som_list = NULL((void*)0); | |||||
946 | ret = EOK0; | |||||
947 | goto done; | |||||
948 | } | |||||
949 | ||||||
950 | /* assume the worst-case, in which every parent is a SOM */ | |||||
951 | /* include space for Site SOM and NULL: rdn_count + 1 + 1 */ | |||||
952 | som_list = talloc_array(tmp_ctx, struct gp_som *, rdn_count + 1 + 1)(struct gp_som * *)_talloc_array(tmp_ctx, sizeof(struct gp_som *), rdn_count + 1 + 1, "struct gp_som *"); | |||||
953 | if (som_list == NULL((void*)0)) { | |||||
954 | ret = ENOMEM12; | |||||
955 | goto done; | |||||
956 | } | |||||
957 | ||||||
958 | /* first, populate the OU and Domain SOMs */ | |||||
959 | tmp_dn = target_dn;; | |||||
960 | while ((ad_gpo_parent_dn(tmp_ctx, ldb_ctx, tmp_dn, &parent_dn)) == EOK0) { | |||||
961 | ||||||
962 | if ((strncasecmp(parent_dn, "OU=", strlen("OU=")) == 0) || | |||||
963 | (strncasecmp(parent_dn, "DC=", strlen("DC=")) == 0)) { | |||||
964 | ||||||
965 | som_list[som_idx] = talloc_zero(som_list, struct gp_som)(struct gp_som *)_talloc_zero(som_list, sizeof(struct gp_som) , "struct gp_som"); | |||||
966 | if (som_list[som_idx] == NULL((void*)0)) { | |||||
967 | ret = ENOMEM12; | |||||
968 | goto done; | |||||
969 | } | |||||
970 | som_list[som_idx]->som_dn = talloc_steal(som_list[som_idx],({ __typeof__(parent_dn) __talloc_steal_ret = (__typeof__(parent_dn ))_talloc_steal_loc((som_list[som_idx]),(parent_dn), "../sssd/src/providers/ad/ad_gpo.c" ":" "971"); __talloc_steal_ret; }) | |||||
971 | parent_dn)({ __typeof__(parent_dn) __talloc_steal_ret = (__typeof__(parent_dn ))_talloc_steal_loc((som_list[som_idx]),(parent_dn), "../sssd/src/providers/ad/ad_gpo.c" ":" "971"); __talloc_steal_ret; }); | |||||
972 | if (som_list[som_idx]->som_dn == NULL((void*)0)) { | |||||
973 | ret = ENOMEM12; | |||||
974 | goto done; | |||||
975 | } | |||||
976 | som_idx++; | |||||
977 | } | |||||
978 | ||||||
979 | if (strncasecmp(parent_dn, "DC=", strlen("DC=")) == 0) { | |||||
980 | break; | |||||
981 | } | |||||
982 | tmp_dn = parent_dn; | |||||
983 | } | |||||
984 | ||||||
985 | som_list[som_idx] = NULL((void*)0); | |||||
986 | ||||||
987 | *_num_soms = som_idx; | |||||
988 | *_som_list = talloc_steal(mem_ctx, som_list)({ __typeof__(som_list) __talloc_steal_ret = (__typeof__(som_list ))_talloc_steal_loc((mem_ctx),(som_list), "../sssd/src/providers/ad/ad_gpo.c" ":" "988"); __talloc_steal_ret; }); | |||||
989 | ||||||
990 | ret = EOK0; | |||||
991 | ||||||
992 | done: | |||||
993 | talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":" "993"); | |||||
994 | return ret; | |||||
995 | } | |||||
996 | ||||||
997 | /* | |||||
998 | * This function populates the _gplink_list output parameter by parsing the | |||||
999 | * input raw_gplink_value into an array of gp_gplink objects, each consisting of | |||||
1000 | * a GPO DN and bool enforced field. | |||||
1001 | * | |||||
1002 | * The raw_gplink_value is single string consisting of multiple gplink strings. | |||||
1003 | * The raw_gplink_value is in the following format: | |||||
1004 | * "[GPO_DN_1;GPLinkOptions_1]...[GPO_DN_n;GPLinkOptions_n]" | |||||
1005 | * | |||||
1006 | * Each gplink string consists of a GPO DN and a GPLinkOptions field (which | |||||
1007 | * indicates whether its associated GPO DN is ignored, unenforced, or enforced). | |||||
1008 | * If a GPO DN is flagged as ignored, it is discarded and will not be added to | |||||
1009 | * the _gplink_list. If the allow_enforced_only input is true, AND a GPO DN is | |||||
1010 | * flagged as unenforced, it will also be discarded. | |||||
1011 | * | |||||
1012 | * Example: if raw_gplink_value="[OU=Sales,DC=FOO,DC=COM;0][DC=FOO,DC=COM;2]" | |||||
1013 | * and allow_enforced_only=FALSE, then the output would consist of following: | |||||
1014 | * _gplink_list[0]: {GPO DN: "OU=Sales,DC=FOO,DC=COM", enforced: FALSE} | |||||
1015 | * _gplink_list[1]: {GPO DN: "DC=FOO,DC=COM", enforced: TRUE} | |||||
1016 | */ | |||||
1017 | static errno_t | |||||
1018 | ad_gpo_populate_gplink_list(TALLOC_CTX *mem_ctx, | |||||
1019 | const char *som_dn, | |||||
1020 | char *raw_gplink_value, | |||||
1021 | struct gp_gplink ***_gplink_list, | |||||
1022 | bool_Bool allow_enforced_only) | |||||
1023 | { | |||||
1024 | TALLOC_CTX *tmp_ctx = NULL((void*)0); | |||||
1025 | char *ptr; | |||||
1026 | char *first; | |||||
1027 | char *last; | |||||
1028 | char *dn; | |||||
1029 | char *gplink_options; | |||||
1030 | const char delim = ']'; | |||||
1031 | struct gp_gplink **gplink_list; | |||||
1032 | int i; | |||||
1033 | int ret; | |||||
1034 | uint32_t gplink_number; | |||||
1035 | int gplink_count = 0; | |||||
1036 | int num_enabled = 0; | |||||
1037 | ||||||
1038 | if (raw_gplink_value == NULL((void*)0) || | |||||
1039 | *raw_gplink_value == '\0' || | |||||
1040 | _gplink_list == NULL((void*)0)) { | |||||
1041 | return EINVAL22; | |||||
1042 | } | |||||
1043 | ||||||
1044 | DEBUG(SSSDBG_TRACE_ALL, "som_dn: %s\n", som_dn)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1044, __FUNCTION__, __debug_macro_level, "som_dn: %s\n", som_dn ); } } while (0); | |||||
1045 | tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c" ":" "1045"); | |||||
1046 | if (tmp_ctx == NULL((void*)0)) { | |||||
1047 | ret = ENOMEM12; | |||||
1048 | goto done; | |||||
1049 | } | |||||
1050 | ||||||
1051 | ptr = raw_gplink_value; | |||||
1052 | ||||||
1053 | while ((ptr = strchr(ptr, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p (ptr) && (delim) == '\0' ? (char *) __rawmemchr (ptr , delim) : __builtin_strchr (ptr, delim))))) { | |||||
1054 | ptr++; | |||||
1055 | gplink_count++; | |||||
1056 | } | |||||
1057 | ||||||
1058 | if (gplink_count == 0) { | |||||
1059 | ret = EINVAL22; | |||||
1060 | goto done; | |||||
1061 | } | |||||
1062 | ||||||
1063 | gplink_list = talloc_array(tmp_ctx, struct gp_gplink *, gplink_count + 1)(struct gp_gplink * *)_talloc_array(tmp_ctx, sizeof(struct gp_gplink *), gplink_count + 1, "struct gp_gplink *"); | |||||
1064 | if (gplink_list == NULL((void*)0)) { | |||||
1065 | ret = ENOMEM12; | |||||
1066 | goto done; | |||||
1067 | } | |||||
1068 | ||||||
1069 | num_enabled = 0; | |||||
1070 | ptr = raw_gplink_value; | |||||
1071 | for (i = 0; i < gplink_count; i++) { | |||||
1072 | first = ptr + 1; | |||||
1073 | last = strchr(first, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p (first) && (delim) == '\0' ? (char *) __rawmemchr (first , delim) : __builtin_strchr (first, delim))); | |||||
1074 | if (last == NULL((void*)0)) { | |||||
1075 | break; | |||||
1076 | } | |||||
1077 | *last = '\0'; | |||||
1078 | last++; | |||||
1079 | dn = first; | |||||
1080 | if ( strncasecmp(dn, "LDAP://", 7)== 0 ) { | |||||
1081 | dn = dn + 7; | |||||
1082 | } | |||||
1083 | gplink_options = strchr(first, ';')(__extension__ (__builtin_constant_p (';') && !__builtin_constant_p (first) && (';') == '\0' ? (char *) __rawmemchr (first , ';') : __builtin_strchr (first, ';'))); | |||||
1084 | if (gplink_options == NULL((void*)0)) { | |||||
1085 | continue; | |||||
1086 | } | |||||
1087 | *gplink_options = '\0'; | |||||
1088 | gplink_options++; | |||||
1089 | ||||||
1090 | gplink_number = strtouint32(gplink_options, NULL((void*)0), 10); | |||||
1091 | if (errno(*__errno_location ()) != 0) { | |||||
1092 | ret = errno(*__errno_location ()); | |||||
1093 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1094, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1094 | "strtouint32 failed: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1094, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1095 | goto done; | |||||
1096 | } | |||||
1097 | ||||||
1098 | DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1099, __FUNCTION__, __debug_macro_level, "gplink_list[%d]: [%s; %d]\n" , num_enabled, dn, gplink_number); } } while (0) | |||||
1099 | "gplink_list[%d]: [%s; %d]\n", num_enabled, dn, gplink_number)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1099, __FUNCTION__, __debug_macro_level, "gplink_list[%d]: [%s; %d]\n" , num_enabled, dn, gplink_number); } } while (0); | |||||
1100 | ||||||
1101 | if ((gplink_number == 1) || (gplink_number ==3)) { | |||||
1102 | /* ignore flag is set */ | |||||
1103 | DEBUG(SSSDBG_TRACE_ALL, "ignored gpo skipped\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1103, __FUNCTION__, __debug_macro_level, "ignored gpo skipped\n" ); } } while (0); | |||||
1104 | ptr = last; | |||||
1105 | continue; | |||||
1106 | } | |||||
1107 | ||||||
1108 | if (allow_enforced_only && (gplink_number == 0)) { | |||||
1109 | /* unenforced flag is set; only enforced gpos allowed */ | |||||
1110 | DEBUG(SSSDBG_TRACE_ALL, "unenforced gpo skipped\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1110, __FUNCTION__, __debug_macro_level, "unenforced gpo skipped\n" ); } } while (0); | |||||
1111 | ptr = last; | |||||
1112 | continue; | |||||
1113 | } | |||||
1114 | ||||||
1115 | gplink_list[num_enabled] = talloc_zero(gplink_list, struct gp_gplink)(struct gp_gplink *)_talloc_zero(gplink_list, sizeof(struct gp_gplink ), "struct gp_gplink"); | |||||
1116 | if (gplink_list[num_enabled] == NULL((void*)0)) { | |||||
1117 | ret = ENOMEM12; | |||||
1118 | goto done; | |||||
1119 | } | |||||
1120 | gplink_list[num_enabled]->gpo_dn = | |||||
1121 | talloc_strdup(gplink_list[num_enabled], dn); | |||||
1122 | ||||||
1123 | if (gplink_list[num_enabled]->gpo_dn == NULL((void*)0)) { | |||||
1124 | ret = ENOMEM12; | |||||
1125 | goto done; | |||||
1126 | } | |||||
1127 | ||||||
1128 | if (gplink_number == 0) { | |||||
1129 | gplink_list[num_enabled]->enforced = 0; | |||||
1130 | num_enabled++; | |||||
1131 | } else if (gplink_number == 2) { | |||||
1132 | gplink_list[num_enabled]->enforced = 1; | |||||
1133 | num_enabled++; | |||||
1134 | } else { | |||||
1135 | ret = EINVAL22; | |||||
1136 | goto done; | |||||
1137 | } | |||||
1138 | ||||||
1139 | ptr = last; | |||||
1140 | } | |||||
1141 | gplink_list[num_enabled] = NULL((void*)0); | |||||
1142 | ||||||
1143 | *_gplink_list = talloc_steal(mem_ctx, gplink_list)({ __typeof__(gplink_list) __talloc_steal_ret = (__typeof__(gplink_list ))_talloc_steal_loc((mem_ctx),(gplink_list), "../sssd/src/providers/ad/ad_gpo.c" ":" "1143"); __talloc_steal_ret; }); | |||||
1144 | ret = EOK0; | |||||
1145 | ||||||
1146 | done: | |||||
1147 | talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":" "1147"); | |||||
1148 | return ret; | |||||
1149 | } | |||||
1150 | ||||||
1151 | /* == ad_gpo_process_som_send/recv implementation ========================== */ | |||||
1152 | ||||||
1153 | struct ad_gpo_process_som_state { | |||||
1154 | struct tevent_context *ev; | |||||
1155 | struct sdap_id_op *sdap_op; | |||||
1156 | struct sdap_options *opts; | |||||
1157 | int timeout; | |||||
1158 | bool_Bool allow_enforced_only; | |||||
1159 | char *site_name; | |||||
1160 | char *site_dn; | |||||
1161 | struct gp_som **som_list; | |||||
1162 | int som_index; | |||||
1163 | int num_soms; | |||||
1164 | }; | |||||
1165 | ||||||
1166 | static void ad_gpo_site_name_retrieval_done(struct tevent_req *subreq); | |||||
1167 | static void ad_gpo_site_dn_retrieval_done(struct tevent_req *subreq); | |||||
1168 | static errno_t ad_gpo_get_som_attrs_step(struct tevent_req *req); | |||||
1169 | static void ad_gpo_get_som_attrs_done(struct tevent_req *subreq); | |||||
1170 | ||||||
1171 | ||||||
1172 | /* | |||||
1173 | * This function uses the input target_dn and input domain_name to populate | |||||
1174 | * a list of gp_som objects. Each object in this list represents a SOM | |||||
1175 | * associated with the target (such as OU, Domain, and Site). | |||||
1176 | * | |||||
1177 | * The inputs are used to determine the DNs of each SOM associated with the | |||||
1178 | * target. In turn, the SOM object DNs are used to retrieve certain LDAP | |||||
1179 | * attributes of each SOM object, that are parsed into an array of gp_gplink | |||||
1180 | * objects, essentially representing the GPOs that have been linked to each | |||||
1181 | * SOM object. Note that it is perfectly valid for there to be *no* GPOs | |||||
1182 | * linked to a SOM object. | |||||
1183 | */ | |||||
1184 | struct tevent_req * | |||||
1185 | ad_gpo_process_som_send(TALLOC_CTX *mem_ctx, | |||||
1186 | struct tevent_context *ev, | |||||
1187 | struct sdap_id_conn_ctx *conn, | |||||
1188 | struct ldb_context *ldb_ctx, | |||||
1189 | struct sdap_id_op *sdap_op, | |||||
1190 | struct sdap_options *opts, | |||||
1191 | int timeout, | |||||
1192 | const char *target_dn, | |||||
1193 | const char *domain_name) | |||||
1194 | { | |||||
1195 | struct tevent_req *req; | |||||
1196 | struct tevent_req *subreq; | |||||
1197 | struct ad_gpo_process_som_state *state; | |||||
1198 | errno_t ret; | |||||
1199 | ||||||
1200 | req = tevent_req_create(mem_ctx, &state, struct ad_gpo_process_som_state)_tevent_req_create((mem_ctx), (&state), sizeof(struct ad_gpo_process_som_state ), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "1200"); | |||||
1201 | if (req == NULL((void*)0)) { | |||||
1202 | DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n")do { int __debug_macro_level = 0x0020; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1202, __FUNCTION__, __debug_macro_level, "tevent_req_create() failed\n" ); } } while (0); | |||||
1203 | return NULL((void*)0); | |||||
1204 | } | |||||
1205 | ||||||
1206 | state->ev = ev; | |||||
1207 | state->sdap_op = sdap_op; | |||||
1208 | state->opts = opts; | |||||
1209 | state->timeout = timeout; | |||||
1210 | state->som_index = -1; | |||||
1211 | state->allow_enforced_only = 0; | |||||
1212 | ||||||
1213 | ret = ad_gpo_populate_som_list(state, ldb_ctx, target_dn, | |||||
1214 | &state->num_soms, &state->som_list); | |||||
1215 | if (ret != EOK0) { | |||||
1216 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1218, __FUNCTION__, __debug_macro_level, "Unable to retrieve SOM List : [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1217 | "Unable to retrieve SOM List : [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1218, __FUNCTION__, __debug_macro_level, "Unable to retrieve SOM List : [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1218 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1218, __FUNCTION__, __debug_macro_level, "Unable to retrieve SOM List : [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1219 | ret = ENOENT2; | |||||
1220 | goto immediately; | |||||
1221 | } | |||||
1222 | ||||||
1223 | if (state->som_list == NULL((void*)0)) { | |||||
1224 | DEBUG(SSSDBG_OP_FAILURE, "target dn must have at least one parent\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1224, __FUNCTION__, __debug_macro_level, "target dn must have at least one parent\n" ); } } while (0); | |||||
1225 | ret = EINVAL22; | |||||
1226 | goto immediately; | |||||
1227 | } | |||||
1228 | ||||||
1229 | subreq = ad_master_domain_send(state, state->ev, conn, | |||||
1230 | state->sdap_op, domain_name); | |||||
1231 | ||||||
1232 | if (subreq == NULL((void*)0)) { | |||||
1233 | DEBUG(SSSDBG_OP_FAILURE, "ad_master_domain_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1233, __FUNCTION__, __debug_macro_level, "ad_master_domain_send failed.\n" ); } } while (0); | |||||
1234 | ret = ENOMEM12; | |||||
1235 | goto immediately; | |||||
1236 | } | |||||
1237 | ||||||
1238 | tevent_req_set_callback(subreq, ad_gpo_site_name_retrieval_done, req); | |||||
1239 | ||||||
1240 | ret = EOK0; | |||||
1241 | ||||||
1242 | immediately: | |||||
1243 | ||||||
1244 | if (ret != EOK0) { | |||||
1245 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "1245"); | |||||
1246 | tevent_req_post(req, ev); | |||||
1247 | } | |||||
1248 | ||||||
1249 | return req; | |||||
1250 | } | |||||
1251 | ||||||
1252 | static void | |||||
1253 | ad_gpo_site_name_retrieval_done(struct tevent_req *subreq) | |||||
1254 | { | |||||
1255 | struct tevent_req *req; | |||||
1256 | struct ad_gpo_process_som_state *state; | |||||
1257 | int ret; | |||||
1258 | char *site; | |||||
1259 | const char *attrs[] = {AD_AT_CONFIG_NC"configurationNamingContext", NULL((void*)0)}; | |||||
1260 | ||||||
1261 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "1261"); | |||||
1262 | state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "1262"); | |||||
1263 | ||||||
1264 | /* gpo code only cares about the site name */ | |||||
1265 | ret = ad_master_domain_recv(subreq, state, NULL((void*)0), NULL((void*)0), &site, NULL((void*)0)); | |||||
1266 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "1266"); subreq = ((void*)0); } while(0); | |||||
1267 | ||||||
1268 | if (ret != EOK0) { | |||||
1269 | DEBUG(SSSDBG_OP_FAILURE, "Cannot retrieve master domain info\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1269, __FUNCTION__, __debug_macro_level, "Cannot retrieve master domain info\n" ); } } while (0); | |||||
1270 | tevent_req_error(req, ENOENT)_tevent_req_error(req, 2, "../sssd/src/providers/ad/ad_gpo.c" ":" "1270"); | |||||
1271 | return; | |||||
1272 | } | |||||
1273 | ||||||
1274 | state->site_name = talloc_asprintf(state, "cn=%s", site); | |||||
1275 | if (state->site_name == NULL((void*)0)) { | |||||
1276 | tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c" ":" "1276"); | |||||
1277 | return; | |||||
1278 | } | |||||
1279 | ||||||
1280 | /* | |||||
1281 | * note: the configNC attribute is being retrieved here from the rootDSE | |||||
1282 | * entry. In future, since we already make an LDAP query for the rootDSE | |||||
1283 | * entry when LDAP connection is made, this attribute should really be | |||||
1284 | * retrieved at that point (see https://fedorahosted.org/sssd/ticket/2276) | |||||
1285 | */ | |||||
1286 | subreq = sdap_get_generic_send(state, state->ev, state->opts, | |||||
1287 | sdap_id_op_handle(state->sdap_op), | |||||
1288 | "", LDAP_SCOPE_BASE((ber_int_t) 0x0000), | |||||
1289 | "(objectclass=*)", attrs, NULL((void*)0), 0, | |||||
1290 | state->timeout, | |||||
1291 | false0); | |||||
1292 | ||||||
1293 | if (subreq == NULL((void*)0)) { | |||||
1294 | DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1294, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n" ); } } while (0); | |||||
1295 | tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c" ":" "1295"); | |||||
1296 | return; | |||||
1297 | } | |||||
1298 | ||||||
1299 | tevent_req_set_callback(subreq, ad_gpo_site_dn_retrieval_done, req); | |||||
1300 | } | |||||
1301 | ||||||
1302 | static void | |||||
1303 | ad_gpo_site_dn_retrieval_done(struct tevent_req *subreq) | |||||
1304 | { | |||||
1305 | struct tevent_req *req; | |||||
1306 | struct ad_gpo_process_som_state *state; | |||||
1307 | int ret; | |||||
1308 | int dp_error; | |||||
1309 | int i = 0; | |||||
1310 | size_t reply_count; | |||||
1311 | struct sysdb_attrs **reply; | |||||
1312 | const char *configNC; | |||||
1313 | ||||||
1314 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "1314"); | |||||
1315 | state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "1315"); | |||||
1316 | ||||||
1317 | ret = sdap_get_generic_recv(subreq, state, | |||||
1318 | &reply_count, &reply); | |||||
1319 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "1319"); subreq = ((void*)0); } while(0); | |||||
1320 | if (ret != EOK0) { | |||||
1321 | ret = sdap_id_op_done(state->sdap_op, ret, &dp_error); | |||||
1322 | /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */ | |||||
1323 | ||||||
1324 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1325, __FUNCTION__, __debug_macro_level, "Unable to get configNC: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1325 | "Unable to get configNC: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1325, __FUNCTION__, __debug_macro_level, "Unable to get configNC: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1326 | ret = ENOENT2; | |||||
1327 | goto done; | |||||
1328 | } | |||||
1329 | ||||||
1330 | /* make sure there is only one non-NULL reply returned */ | |||||
1331 | ||||||
1332 | if (reply_count < 1) { | |||||
1333 | DEBUG(SSSDBG_OP_FAILURE, "No configNC retrieved\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1333, __FUNCTION__, __debug_macro_level, "No configNC retrieved\n" ); } } while (0); | |||||
1334 | ret = ENOENT2; | |||||
1335 | goto done; | |||||
1336 | } else if (reply_count > 1) { | |||||
1337 | DEBUG(SSSDBG_OP_FAILURE, "Multiple replies for configNC\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1337, __FUNCTION__, __debug_macro_level, "Multiple replies for configNC\n" ); } } while (0); | |||||
1338 | ret = ERR_INTERNAL; | |||||
1339 | goto done; | |||||
1340 | } else if (reply == NULL((void*)0)) { | |||||
1341 | DEBUG(SSSDBG_OP_FAILURE, "reply_count is 1, but reply is NULL\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1341, __FUNCTION__, __debug_macro_level, "reply_count is 1, but reply is NULL\n" ); } } while (0); | |||||
1342 | ret = ERR_INTERNAL; | |||||
1343 | goto done; | |||||
1344 | } | |||||
1345 | ||||||
1346 | /* reply[0] holds requested attributes of single reply */ | |||||
1347 | ret = sysdb_attrs_get_string(reply[0], AD_AT_CONFIG_NC"configurationNamingContext", &configNC); | |||||
1348 | if (ret != EOK0) { | |||||
1349 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1351, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1350 | "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1351, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1351 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1351, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1352 | goto done; | |||||
1353 | } | |||||
1354 | state->site_dn = | |||||
1355 | talloc_asprintf(state, "%s,cn=Sites,%s", state->site_name, configNC); | |||||
1356 | if (state->site_dn == NULL((void*)0)) { | |||||
1357 | ret = ENOMEM12; | |||||
1358 | goto done; | |||||
1359 | } | |||||
1360 | ||||||
1361 | /* note that space was allocated for site_dn when allocating som_list */ | |||||
1362 | state->som_list[state->num_soms] = | |||||
1363 | talloc_zero(state->som_list, struct gp_som)(struct gp_som *)_talloc_zero(state->som_list, sizeof(struct gp_som), "struct gp_som"); | |||||
1364 | if (state->som_list[state->num_soms] == NULL((void*)0)) { | |||||
1365 | ret = ENOMEM12; | |||||
1366 | goto done; | |||||
1367 | } | |||||
1368 | ||||||
1369 | state->som_list[state->num_soms]->som_dn = | |||||
1370 | talloc_steal(state->som_list[state->num_soms], state->site_dn)({ __typeof__(state->site_dn) __talloc_steal_ret = (__typeof__ (state->site_dn))_talloc_steal_loc((state->som_list[state ->num_soms]),(state->site_dn), "../sssd/src/providers/ad/ad_gpo.c" ":" "1370"); __talloc_steal_ret; }); | |||||
1371 | ||||||
1372 | if (state->som_list[state->num_soms]->som_dn == NULL((void*)0)) { | |||||
1373 | ret = ENOMEM12; | |||||
1374 | goto done; | |||||
1375 | } | |||||
1376 | ||||||
1377 | state->num_soms++; | |||||
1378 | state->som_list[state->num_soms] = NULL((void*)0); | |||||
1379 | ||||||
1380 | i = 0; | |||||
1381 | while (state->som_list[i]) { | |||||
1382 | DEBUG(SSSDBG_TRACE_FUNC, "som_list[%d]->som_dn is %s\n", i,do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1383, __FUNCTION__, __debug_macro_level, "som_list[%d]->som_dn is %s\n" , i, state->som_list[i]->som_dn); } } while (0) | |||||
1383 | state->som_list[i]->som_dn)do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1383, __FUNCTION__, __debug_macro_level, "som_list[%d]->som_dn is %s\n" , i, state->som_list[i]->som_dn); } } while (0); | |||||
1384 | i++; | |||||
1385 | } | |||||
1386 | ||||||
1387 | ret = ad_gpo_get_som_attrs_step(req); | |||||
1388 | ||||||
1389 | done: | |||||
1390 | ||||||
1391 | if (ret == EOK0) { | |||||
1392 | tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":" "1392"); | |||||
1393 | } else if (ret != EAGAIN11) { | |||||
1394 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "1394"); | |||||
1395 | } | |||||
1396 | ||||||
1397 | } | |||||
1398 | static errno_t | |||||
1399 | ad_gpo_get_som_attrs_step(struct tevent_req *req) | |||||
1400 | { | |||||
1401 | const char *attrs[] = {AD_AT_GPLINK"gPLink", AD_AT_GPOPTIONS"gpOptions", NULL((void*)0)}; | |||||
1402 | struct tevent_req *subreq; | |||||
1403 | struct ad_gpo_process_som_state *state; | |||||
1404 | ||||||
1405 | state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "1405"); | |||||
1406 | ||||||
1407 | state->som_index++; | |||||
1408 | struct gp_som *gp_som = state->som_list[state->som_index]; | |||||
1409 | ||||||
1410 | /* gp_som is NULL only after all SOMs have been processed */ | |||||
1411 | if (gp_som == NULL((void*)0)) return EOK0; | |||||
1412 | ||||||
1413 | const char *som_dn = gp_som->som_dn; | |||||
1414 | subreq = sdap_get_generic_send(state, state->ev, state->opts, | |||||
1415 | sdap_id_op_handle(state->sdap_op), | |||||
1416 | som_dn, LDAP_SCOPE_BASE((ber_int_t) 0x0000), | |||||
1417 | "(objectclass=*)", attrs, NULL((void*)0), 0, | |||||
1418 | state->timeout, | |||||
1419 | false0); | |||||
1420 | ||||||
1421 | if (subreq == NULL((void*)0)) { | |||||
1422 | DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1422, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n" ); } } while (0); | |||||
1423 | return ENOMEM12; | |||||
1424 | } | |||||
1425 | ||||||
1426 | tevent_req_set_callback(subreq, ad_gpo_get_som_attrs_done, req); | |||||
1427 | return EAGAIN11; | |||||
1428 | } | |||||
1429 | ||||||
1430 | static void | |||||
1431 | ad_gpo_get_som_attrs_done(struct tevent_req *subreq) | |||||
1432 | { | |||||
1433 | struct tevent_req *req; | |||||
1434 | struct ad_gpo_process_som_state *state; | |||||
1435 | int ret; | |||||
1436 | int dp_error; | |||||
1437 | size_t num_results; | |||||
1438 | struct sysdb_attrs **results; | |||||
1439 | struct ldb_message_element *el = NULL((void*)0); | |||||
1440 | uint8_t *raw_gplink_value; | |||||
1441 | uint8_t *raw_gpoptions_value; | |||||
1442 | uint32_t allow_enforced_only = 0; | |||||
1443 | struct gp_som *gp_som; | |||||
1444 | ||||||
1445 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "1445"); | |||||
1446 | state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "1446"); | |||||
1447 | ret = sdap_get_generic_recv(subreq, state, | |||||
1448 | &num_results, &results); | |||||
1449 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "1449"); subreq = ((void*)0); } while(0); | |||||
1450 | ||||||
1451 | if (ret != EOK0) { | |||||
1452 | ret = sdap_id_op_done(state->sdap_op, ret, &dp_error); | |||||
1453 | /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */ | |||||
1454 | ||||||
1455 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1457, __FUNCTION__, __debug_macro_level, "Unable to get SOM attributes: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1456 | "Unable to get SOM attributes: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1457, __FUNCTION__, __debug_macro_level, "Unable to get SOM attributes: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1457 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1457, __FUNCTION__, __debug_macro_level, "Unable to get SOM attributes: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1458 | ret = ENOENT2; | |||||
1459 | goto done; | |||||
1460 | } | |||||
1461 | if ((num_results < 1) || (results == NULL((void*)0))) { | |||||
1462 | DEBUG(SSSDBG_OP_FAILURE, "no attrs found for SOM; try next SOM.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1462, __FUNCTION__, __debug_macro_level, "no attrs found for SOM; try next SOM.\n" ); } } while (0); | |||||
1463 | ret = ad_gpo_get_som_attrs_step(req); | |||||
1464 | goto done; | |||||
1465 | } else if (num_results > 1) { | |||||
1466 | DEBUG(SSSDBG_OP_FAILURE, "Received multiple replies\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1466, __FUNCTION__, __debug_macro_level, "Received multiple replies\n" ); } } while (0); | |||||
1467 | ret = ERR_INTERNAL; | |||||
1468 | goto done; | |||||
1469 | } | |||||
1470 | ||||||
1471 | /* Get the gplink value, if available */ | |||||
1472 | ret = sysdb_attrs_get_el(results[0], AD_AT_GPLINK"gPLink", &el); | |||||
1473 | ||||||
1474 | if (ret != EOK0 && ret != ENOENT2) { | |||||
1475 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1477, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1476 | "sysdb_attrs_get_el() failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1477, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1477 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1477, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1478 | goto done; | |||||
1479 | } | |||||
1480 | ||||||
1481 | if ((ret == ENOENT2) || (el->num_values == 0)) { | |||||
1482 | DEBUG(SSSDBG_OP_FAILURE, "no attrs found for SOM; try next SOM\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1482, __FUNCTION__, __debug_macro_level, "no attrs found for SOM; try next SOM\n" ); } } while (0); | |||||
1483 | ret = ad_gpo_get_som_attrs_step(req); | |||||
1484 | goto done; | |||||
1485 | } | |||||
1486 | ||||||
1487 | raw_gplink_value = el[0].values[0].data; | |||||
1488 | ||||||
1489 | ret = sysdb_attrs_get_el(results[0], AD_AT_GPOPTIONS"gpOptions", &el); | |||||
1490 | ||||||
1491 | if (ret != EOK0 && ret != ENOENT2) { | |||||
1492 | DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_el() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1492, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed\n" ); } } while (0); | |||||
1493 | goto done; | |||||
1494 | } | |||||
1495 | ||||||
1496 | if ((ret == ENOENT2) || (el->num_values == 0)) { | |||||
1497 | DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1498, __FUNCTION__, __debug_macro_level, "gpoptions attr not found or has no value; defaults to 0\n" ); } } while (0) | |||||
1498 | "gpoptions attr not found or has no value; defaults to 0\n")do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1498, __FUNCTION__, __debug_macro_level, "gpoptions attr not found or has no value; defaults to 0\n" ); } } while (0); | |||||
1499 | allow_enforced_only = 0; | |||||
1500 | } else { | |||||
1501 | raw_gpoptions_value = el[0].values[0].data; | |||||
1502 | allow_enforced_only = strtouint32((char *)raw_gpoptions_value, NULL((void*)0), 10); | |||||
1503 | if (errno(*__errno_location ()) != 0) { | |||||
1504 | ret = errno(*__errno_location ()); | |||||
1505 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1506, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1506 | "strtouint32 failed: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1506, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1507 | goto done; | |||||
1508 | } | |||||
1509 | } | |||||
1510 | ||||||
1511 | gp_som = state->som_list[state->som_index]; | |||||
1512 | ret = ad_gpo_populate_gplink_list(gp_som, | |||||
1513 | gp_som->som_dn, | |||||
1514 | (char *)raw_gplink_value, | |||||
1515 | &gp_som->gplink_list, | |||||
1516 | state->allow_enforced_only); | |||||
1517 | ||||||
1518 | if (ret != EOK0) { | |||||
1519 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1520, __FUNCTION__, __debug_macro_level, "ad_gpo_populate_gplink_list() failed\n" ); } } while (0) | |||||
1520 | "ad_gpo_populate_gplink_list() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1520, __FUNCTION__, __debug_macro_level, "ad_gpo_populate_gplink_list() failed\n" ); } } while (0); | |||||
1521 | goto done; | |||||
1522 | } | |||||
1523 | ||||||
1524 | if (allow_enforced_only) { | |||||
1525 | state->allow_enforced_only = 1; | |||||
1526 | } | |||||
1527 | ||||||
1528 | ret = ad_gpo_get_som_attrs_step(req); | |||||
1529 | ||||||
1530 | done: | |||||
1531 | ||||||
1532 | if (ret == EOK0) { | |||||
1533 | tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":" "1533"); | |||||
1534 | } else if (ret != EAGAIN11) { | |||||
1535 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "1535"); | |||||
1536 | } | |||||
1537 | } | |||||
1538 | ||||||
1539 | int | |||||
1540 | ad_gpo_process_som_recv(struct tevent_req *req, | |||||
1541 | TALLOC_CTX *mem_ctx, | |||||
1542 | struct gp_som ***som_list) | |||||
1543 | { | |||||
1544 | ||||||
1545 | struct ad_gpo_process_som_state *state = | |||||
1546 | tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "1546"); | |||||
1547 | ||||||
1548 | TEVENT_REQ_RETURN_ON_ERROR(req)do { enum tevent_req_state TRROEstate; uint64_t TRROEerr; if ( tevent_req_is_error(req, &TRROEstate, &TRROEerr)) { if (TRROEstate == TEVENT_REQ_USER_ERROR) { return TRROEerr; } return ERR_INTERNAL; } } while (0); | |||||
1549 | *som_list = talloc_steal(mem_ctx, state->som_list)({ __typeof__(state->som_list) __talloc_steal_ret = (__typeof__ (state->som_list))_talloc_steal_loc((mem_ctx),(state->som_list ), "../sssd/src/providers/ad/ad_gpo.c" ":" "1549"); __talloc_steal_ret ; }); | |||||
1550 | return EOK0; | |||||
1551 | } | |||||
1552 | ||||||
1553 | /* == ad_gpo_process_gpo_send/recv helpers ================================= */ | |||||
1554 | ||||||
1555 | /* | |||||
1556 | * This function examines the gp_gplink objects in each gp_som object specified | |||||
1557 | * in the input som_list, and populates the _candidate_gpos output parameter's | |||||
1558 | * gpo_dn fields with prioritized list of GPO DNs. Prioritization ensures that: | |||||
1559 | * - GPOs linked to an OU will be applied after GPOs linked to a Domain, | |||||
1560 | * which will be applied after GPOs linked to a Site. | |||||
1561 | * - multiple GPOs linked to a single SOM are applied in their link order | |||||
1562 | * (i.e. 1st GPO linked to SOM is applied after 2nd GPO linked to SOM, etc). | |||||
1563 | * - enforced GPOs are applied after unenforced GPOs. | |||||
1564 | * | |||||
1565 | * As such, the _candidate_gpos output's dn fields looks like (in link order): | |||||
1566 | * [unenforced {Site, Domain, OU}; enforced {Site, Domain, OU}] | |||||
1567 | * | |||||
1568 | * Note that in the case of conflicting policy settings, GPOs appearing later | |||||
1569 | * in the list will trump GPOs appearing earlier in the list. | |||||
1570 | */ | |||||
1571 | static errno_t | |||||
1572 | ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx, | |||||
1573 | struct gp_som **som_list, | |||||
1574 | struct gp_gpo ***_candidate_gpos, | |||||
1575 | int *_num_candidate_gpos) | |||||
1576 | { | |||||
1577 | ||||||
1578 | TALLOC_CTX *tmp_ctx = NULL((void*)0); | |||||
1579 | struct gp_som *gp_som = NULL((void*)0); | |||||
1580 | struct gp_gplink *gp_gplink = NULL((void*)0); | |||||
1581 | struct gp_gpo **candidate_gpos = NULL((void*)0); | |||||
1582 | int num_candidate_gpos = 0; | |||||
1583 | const char **enforced_gpo_dns = NULL((void*)0); | |||||
1584 | const char **unenforced_gpo_dns = NULL((void*)0); | |||||
1585 | int gpo_dn_idx = 0; | |||||
1586 | int num_enforced = 0; | |||||
1587 | int enforced_idx = 0; | |||||
1588 | int num_unenforced = 0; | |||||
1589 | int unenforced_idx = 0; | |||||
1590 | int i = 0; | |||||
1591 | int j = 0; | |||||
1592 | int ret; | |||||
1593 | ||||||
1594 | tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c" ":" "1594"); | |||||
1595 | if (tmp_ctx == NULL((void*)0)) { | |||||
1596 | ret = ENOMEM12; | |||||
1597 | goto done; | |||||
1598 | } | |||||
1599 | ||||||
1600 | while (som_list[i]) { | |||||
1601 | gp_som = som_list[i]; | |||||
1602 | j = 0; | |||||
1603 | while (gp_som && gp_som->gplink_list && gp_som->gplink_list[j]) { | |||||
1604 | gp_gplink = gp_som->gplink_list[j]; | |||||
1605 | if (gp_gplink == NULL((void*)0)) { | |||||
1606 | DEBUG(SSSDBG_OP_FAILURE, "unexpected null gp_gplink\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1606, __FUNCTION__, __debug_macro_level, "unexpected null gp_gplink\n" ); } } while (0); | |||||
1607 | ret = EINVAL22; | |||||
1608 | goto done; | |||||
1609 | } | |||||
1610 | if (gp_gplink->enforced) { | |||||
1611 | num_enforced++; | |||||
1612 | } else { | |||||
1613 | num_unenforced++; | |||||
1614 | } | |||||
1615 | j++; | |||||
1616 | } | |||||
1617 | i++; | |||||
1618 | } | |||||
1619 | ||||||
1620 | num_candidate_gpos = num_enforced + num_unenforced; | |||||
1621 | ||||||
1622 | if (num_candidate_gpos == 0) { | |||||
1623 | *_candidate_gpos = NULL((void*)0); | |||||
1624 | *_num_candidate_gpos = 0; | |||||
1625 | ret = EOK0; | |||||
1626 | goto done; | |||||
1627 | } | |||||
1628 | ||||||
1629 | enforced_gpo_dns = talloc_array(tmp_ctx, const char *, num_enforced + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_enforced + 1, "const char *"); | |||||
1630 | if (enforced_gpo_dns == NULL((void*)0)) { | |||||
1631 | ret = ENOMEM12; | |||||
1632 | goto done; | |||||
1633 | } | |||||
1634 | ||||||
1635 | unenforced_gpo_dns = talloc_array(tmp_ctx, const char *, num_unenforced + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_unenforced + 1, "const char *"); | |||||
1636 | if (unenforced_gpo_dns == NULL((void*)0)) { | |||||
1637 | ret = ENOMEM12; | |||||
1638 | goto done; | |||||
1639 | } | |||||
1640 | ||||||
1641 | i = 0; | |||||
1642 | while (som_list[i]) { | |||||
1643 | gp_som = som_list[i]; | |||||
1644 | j = 0; | |||||
1645 | while (gp_som && gp_som->gplink_list && gp_som->gplink_list[j]) { | |||||
1646 | gp_gplink = gp_som->gplink_list[j]; | |||||
1647 | if (gp_gplink == NULL((void*)0)) { | |||||
1648 | DEBUG(SSSDBG_OP_FAILURE, "unexpected null gp_gplink\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1648, __FUNCTION__, __debug_macro_level, "unexpected null gp_gplink\n" ); } } while (0); | |||||
1649 | ret = EINVAL22; | |||||
1650 | goto done; | |||||
1651 | } | |||||
1652 | ||||||
1653 | if (gp_gplink->enforced) { | |||||
1654 | enforced_gpo_dns[enforced_idx] = | |||||
1655 | talloc_steal(enforced_gpo_dns, gp_gplink->gpo_dn)({ __typeof__(gp_gplink->gpo_dn) __talloc_steal_ret = (__typeof__ (gp_gplink->gpo_dn))_talloc_steal_loc((enforced_gpo_dns),( gp_gplink->gpo_dn), "../sssd/src/providers/ad/ad_gpo.c" ":" "1655"); __talloc_steal_ret; }); | |||||
1656 | if (enforced_gpo_dns[enforced_idx] == NULL((void*)0)) { | |||||
1657 | ret = ENOMEM12; | |||||
1658 | goto done; | |||||
1659 | } | |||||
1660 | enforced_idx++; | |||||
1661 | } else { | |||||
1662 | ||||||
1663 | unenforced_gpo_dns[unenforced_idx] = | |||||
1664 | talloc_steal(unenforced_gpo_dns, gp_gplink->gpo_dn)({ __typeof__(gp_gplink->gpo_dn) __talloc_steal_ret = (__typeof__ (gp_gplink->gpo_dn))_talloc_steal_loc((unenforced_gpo_dns) ,(gp_gplink->gpo_dn), "../sssd/src/providers/ad/ad_gpo.c" ":" "1664"); __talloc_steal_ret; }); | |||||
1665 | ||||||
1666 | if (unenforced_gpo_dns[unenforced_idx] == NULL((void*)0)) { | |||||
1667 | ret = ENOMEM12; | |||||
1668 | goto done; | |||||
1669 | } | |||||
1670 | unenforced_idx++; | |||||
1671 | } | |||||
1672 | j++; | |||||
1673 | } | |||||
1674 | i++; | |||||
1675 | } | |||||
1676 | enforced_gpo_dns[num_enforced] = NULL((void*)0); | |||||
1677 | unenforced_gpo_dns[num_unenforced] = NULL((void*)0); | |||||
1678 | ||||||
1679 | candidate_gpos = talloc_array(tmp_ctx,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo *), num_candidate_gpos + 1, "struct gp_gpo *") | |||||
1680 | struct gp_gpo *,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo *), num_candidate_gpos + 1, "struct gp_gpo *") | |||||
1681 | num_candidate_gpos + 1)(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo *), num_candidate_gpos + 1, "struct gp_gpo *"); | |||||
1682 | ||||||
1683 | if (candidate_gpos == NULL((void*)0)) { | |||||
1684 | ret = ENOMEM12; | |||||
1685 | goto done; | |||||
1686 | } | |||||
1687 | ||||||
1688 | gpo_dn_idx = 0; | |||||
1689 | for (i = num_unenforced - 1; i >= 0; i--) { | |||||
1690 | candidate_gpos[gpo_dn_idx] = talloc_zero(candidate_gpos, struct gp_gpo)(struct gp_gpo *)_talloc_zero(candidate_gpos, sizeof(struct gp_gpo ), "struct gp_gpo"); | |||||
1691 | if (candidate_gpos[gpo_dn_idx] == NULL((void*)0)) { | |||||
1692 | ret = ENOMEM12; | |||||
1693 | goto done; | |||||
1694 | } | |||||
1695 | candidate_gpos[gpo_dn_idx]->gpo_dn = | |||||
1696 | talloc_steal(candidate_gpos[gpo_dn_idx], unenforced_gpo_dns[i])({ __typeof__(unenforced_gpo_dns[i]) __talloc_steal_ret = (__typeof__ (unenforced_gpo_dns[i]))_talloc_steal_loc((candidate_gpos[gpo_dn_idx ]),(unenforced_gpo_dns[i]), "../sssd/src/providers/ad/ad_gpo.c" ":" "1696"); __talloc_steal_ret; }); | |||||
1697 | ||||||
1698 | if (candidate_gpos[gpo_dn_idx]->gpo_dn == NULL((void*)0)) { | |||||
1699 | ret = ENOMEM12; | |||||
1700 | goto done; | |||||
1701 | } | |||||
1702 | DEBUG(SSSDBG_TRACE_FUNC,do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1704, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n" , gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while (0) | |||||
1703 | "candidate_gpos[%d]->gpo_dn: %s\n",do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1704, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n" , gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while (0) | |||||
1704 | gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn)do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1704, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n" , gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while (0); | |||||
1705 | gpo_dn_idx++; | |||||
1706 | } | |||||
1707 | ||||||
1708 | for (i = 0; i < num_enforced; i++) { | |||||
1709 | ||||||
1710 | candidate_gpos[gpo_dn_idx] = talloc_zero(candidate_gpos, struct gp_gpo)(struct gp_gpo *)_talloc_zero(candidate_gpos, sizeof(struct gp_gpo ), "struct gp_gpo"); | |||||
1711 | if (candidate_gpos[gpo_dn_idx] == NULL((void*)0)) { | |||||
1712 | ret = ENOMEM12; | |||||
1713 | goto done; | |||||
1714 | } | |||||
1715 | ||||||
1716 | candidate_gpos[gpo_dn_idx]->gpo_dn = | |||||
1717 | talloc_steal(candidate_gpos[gpo_dn_idx], enforced_gpo_dns[i])({ __typeof__(enforced_gpo_dns[i]) __talloc_steal_ret = (__typeof__ (enforced_gpo_dns[i]))_talloc_steal_loc((candidate_gpos[gpo_dn_idx ]),(enforced_gpo_dns[i]), "../sssd/src/providers/ad/ad_gpo.c" ":" "1717"); __talloc_steal_ret; }); | |||||
1718 | if (candidate_gpos[gpo_dn_idx]->gpo_dn == NULL((void*)0)) { | |||||
1719 | ret = ENOMEM12; | |||||
1720 | goto done; | |||||
1721 | } | |||||
1722 | ||||||
1723 | DEBUG(SSSDBG_TRACE_FUNC,do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1725, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n" , gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while (0) | |||||
1724 | "candidate_gpos[%d]->gpo_dn: %s\n",do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1725, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n" , gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while (0) | |||||
1725 | gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn)do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1725, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n" , gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while (0); | |||||
1726 | gpo_dn_idx++; | |||||
1727 | } | |||||
1728 | ||||||
1729 | candidate_gpos[gpo_dn_idx] = NULL((void*)0); | |||||
1730 | ||||||
1731 | *_candidate_gpos = talloc_steal(mem_ctx, candidate_gpos)({ __typeof__(candidate_gpos) __talloc_steal_ret = (__typeof__ (candidate_gpos))_talloc_steal_loc((mem_ctx),(candidate_gpos) , "../sssd/src/providers/ad/ad_gpo.c" ":" "1731"); __talloc_steal_ret ; }); | |||||
1732 | *_num_candidate_gpos = num_candidate_gpos; | |||||
1733 | ||||||
1734 | ret = EOK0; | |||||
1735 | ||||||
1736 | done: | |||||
1737 | talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":" "1737"); | |||||
1738 | return ret; | |||||
1739 | } | |||||
1740 | ||||||
1741 | /* | |||||
1742 | * This function converts the input_path to an smb uri, which is used to | |||||
1743 | * populate the _converted_path output parameter. The conversion consists of: | |||||
1744 | * - prepending "smb:" | |||||
1745 | * - replacing each forward slash ('\') with a back slash character ('/') | |||||
1746 | */ | |||||
1747 | static errno_t | |||||
1748 | ad_gpo_convert_to_smb_uri(TALLOC_CTX *mem_ctx, | |||||
1749 | char *input_path, | |||||
1750 | const char **_converted_path) | |||||
1751 | { | |||||
1752 | char *ptr; | |||||
1753 | const char delim = '\\'; | |||||
1754 | int ret; | |||||
1755 | int num_seps = 0; | |||||
1756 | ||||||
1757 | DEBUG(SSSDBG_TRACE_ALL, "input_path: %s\n", input_path)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1757, __FUNCTION__, __debug_macro_level, "input_path: %s\n" , input_path); } } while (0); | |||||
1758 | ||||||
1759 | if (input_path == NULL((void*)0) || | |||||
1760 | *input_path == '\0' || | |||||
1761 | _converted_path == NULL((void*)0)) { | |||||
1762 | ret = EINVAL22; | |||||
1763 | goto done; | |||||
1764 | } | |||||
1765 | ||||||
1766 | ptr = input_path; | |||||
1767 | while ((ptr = strchr(ptr, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p (ptr) && (delim) == '\0' ? (char *) __rawmemchr (ptr , delim) : __builtin_strchr (ptr, delim))))) { | |||||
1768 | *ptr = '/'; | |||||
1769 | ptr++; | |||||
1770 | num_seps++; | |||||
1771 | } | |||||
1772 | ||||||
1773 | if (num_seps == 0) { | |||||
1774 | ret = EINVAL22; | |||||
1775 | goto done; | |||||
1776 | } | |||||
1777 | ||||||
1778 | *_converted_path = talloc_asprintf(mem_ctx, "smb:%s", input_path); | |||||
1779 | ret = EOK0; | |||||
1780 | ||||||
1781 | done: | |||||
1782 | return ret; | |||||
1783 | } | |||||
1784 | ||||||
1785 | /* | |||||
1786 | * This function populates the _cse_guid_list output parameter by parsing the | |||||
1787 | * input raw_machine_ext_names_value into an array of cse_guid strings. | |||||
1788 | * | |||||
1789 | * The raw_machine_ext_names_value is a single string in the following format: | |||||
1790 | * "[{cse_guid_1}{tool_guid1}]...[{cse_guid_n}{tool_guid_n}]" | |||||
1791 | */ | |||||
1792 | static errno_t | |||||
1793 | ad_gpo_parse_machine_ext_names(TALLOC_CTX *mem_ctx, | |||||
1794 | char *raw_machine_ext_names_value, | |||||
1795 | const char ***_gpo_cse_guids, | |||||
1796 | int *_num_gpo_cse_guids) | |||||
1797 | { | |||||
1798 | TALLOC_CTX *tmp_ctx = NULL((void*)0); | |||||
1799 | char *ptr; | |||||
1800 | char *first; | |||||
1801 | char *last; | |||||
1802 | char *cse_guid; | |||||
1803 | char *tool_guid; | |||||
1804 | const char delim = ']'; | |||||
1805 | const char **gpo_cse_guids; | |||||
1806 | int i; | |||||
1807 | int ret; | |||||
1808 | int num_gpo_cse_guids = 0; | |||||
1809 | ||||||
1810 | if (raw_machine_ext_names_value == NULL((void*)0) || | |||||
1811 | *raw_machine_ext_names_value == '\0' || | |||||
1812 | _gpo_cse_guids == NULL((void*)0)) { | |||||
1813 | return EINVAL22; | |||||
1814 | } | |||||
1815 | ||||||
1816 | tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c" ":" "1816"); | |||||
1817 | if (tmp_ctx == NULL((void*)0)) { | |||||
1818 | ret = ENOMEM12; | |||||
1819 | goto done; | |||||
1820 | } | |||||
1821 | ||||||
1822 | ptr = raw_machine_ext_names_value; | |||||
1823 | while ((ptr = strchr(ptr, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p (ptr) && (delim) == '\0' ? (char *) __rawmemchr (ptr , delim) : __builtin_strchr (ptr, delim))))) { | |||||
1824 | ptr++; | |||||
1825 | num_gpo_cse_guids++; | |||||
1826 | } | |||||
1827 | ||||||
1828 | if (num_gpo_cse_guids == 0) { | |||||
1829 | ret = EINVAL22; | |||||
1830 | goto done; | |||||
1831 | } | |||||
1832 | ||||||
1833 | gpo_cse_guids = talloc_array(tmp_ctx, const char *, num_gpo_cse_guids + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_gpo_cse_guids + 1, "const char *"); | |||||
1834 | if (gpo_cse_guids == NULL((void*)0)) { | |||||
1835 | ret = ENOMEM12; | |||||
1836 | goto done; | |||||
1837 | } | |||||
1838 | ||||||
1839 | ptr = raw_machine_ext_names_value; | |||||
1840 | for (i = 0; i < num_gpo_cse_guids; i++) { | |||||
1841 | first = ptr + 1; | |||||
1842 | last = strchr(first, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p (first) && (delim) == '\0' ? (char *) __rawmemchr (first , delim) : __builtin_strchr (first, delim))); | |||||
1843 | if (last == NULL((void*)0)) { | |||||
1844 | break; | |||||
1845 | } | |||||
1846 | *last = '\0'; | |||||
1847 | last++; | |||||
1848 | cse_guid = first; | |||||
1849 | first ++; | |||||
1850 | tool_guid = strchr(first, '{')(__extension__ (__builtin_constant_p ('{') && !__builtin_constant_p (first) && ('{') == '\0' ? (char *) __rawmemchr (first , '{') : __builtin_strchr (first, '{'))); | |||||
1851 | if (tool_guid == NULL((void*)0)) { | |||||
1852 | break; | |||||
1853 | } | |||||
1854 | *tool_guid = '\0'; | |||||
1855 | gpo_cse_guids[i] = talloc_strdup(gpo_cse_guids, cse_guid); | |||||
1856 | ptr = last; | |||||
1857 | } | |||||
1858 | gpo_cse_guids[i] = NULL((void*)0); | |||||
1859 | ||||||
1860 | DEBUG(SSSDBG_TRACE_ALL, "num_gpo_cse_guids: %d\n", num_gpo_cse_guids)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1860, __FUNCTION__, __debug_macro_level, "num_gpo_cse_guids: %d\n" , num_gpo_cse_guids); } } while (0); | |||||
1861 | ||||||
1862 | for (i = 0; i < num_gpo_cse_guids; i++) { | |||||
1863 | DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1864, __FUNCTION__, __debug_macro_level, "gpo_cse_guids[%d] is %s\n" , i, gpo_cse_guids[i]); } } while (0) | |||||
1864 | "gpo_cse_guids[%d] is %s\n", i, gpo_cse_guids[i])do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1864, __FUNCTION__, __debug_macro_level, "gpo_cse_guids[%d] is %s\n" , i, gpo_cse_guids[i]); } } while (0); | |||||
1865 | } | |||||
1866 | ||||||
1867 | *_gpo_cse_guids = talloc_steal(mem_ctx, gpo_cse_guids)({ __typeof__(gpo_cse_guids) __talloc_steal_ret = (__typeof__ (gpo_cse_guids))_talloc_steal_loc((mem_ctx),(gpo_cse_guids), "../sssd/src/providers/ad/ad_gpo.c" ":" "1867"); __talloc_steal_ret; }); | |||||
1868 | *_num_gpo_cse_guids = num_gpo_cse_guids; | |||||
1869 | ret = EOK0; | |||||
1870 | ||||||
1871 | done: | |||||
1872 | talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":" "1872"); | |||||
1873 | return ret; | |||||
1874 | } | |||||
1875 | ||||||
1876 | enum ndr_err_code | |||||
1877 | ndr_pull_security_descriptor(struct ndr_pull *ndr, int ndr_flags, | |||||
1878 | struct security_descriptor *r); | |||||
1879 | ||||||
1880 | /* | |||||
1881 | * This function parses the input data blob and assigns the resulting | |||||
1882 | * security_descriptor object to the _gpo_sd output parameter. | |||||
1883 | */ | |||||
1884 | static errno_t ad_gpo_parse_sd(TALLOC_CTX *mem_ctx, | |||||
1885 | uint8_t *data, | |||||
1886 | size_t length, | |||||
1887 | struct security_descriptor **_gpo_sd) | |||||
1888 | { | |||||
1889 | ||||||
1890 | struct ndr_pull *ndr_pull = NULL((void*)0); | |||||
1891 | struct security_descriptor sd; | |||||
1892 | DATA_BLOB blob; | |||||
1893 | ||||||
1894 | blob.data = data; | |||||
1895 | blob.length = length; | |||||
1896 | ||||||
1897 | ndr_pull = ndr_pull_init_blob(&blob, mem_ctx); | |||||
1898 | if (ndr_pull == NULL((void*)0)) { | |||||
1899 | DEBUG(SSSDBG_OP_FAILURE, "ndr_pull_init_blob() failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1899, __FUNCTION__, __debug_macro_level, "ndr_pull_init_blob() failed.\n" ); } } while (0); | |||||
1900 | return EINVAL22; | |||||
1901 | } | |||||
1902 | ||||||
1903 | ndr_pull_security_descriptor(ndr_pull, NDR_SCALARS0x100|NDR_BUFFERS0x200, &sd); | |||||
1904 | ||||||
1905 | *_gpo_sd = talloc_memdup(mem_ctx, &sd, sizeof(struct security_descriptor))_talloc_memdup(mem_ctx, &sd, sizeof(struct security_descriptor ), "../sssd/src/providers/ad/ad_gpo.c" ":" "1905"); | |||||
1906 | ||||||
1907 | return EOK0; | |||||
1908 | } | |||||
1909 | ||||||
1910 | /* == ad_gpo_process_gpo_send/recv implementation ========================== */ | |||||
1911 | ||||||
1912 | struct ad_gpo_process_gpo_state { | |||||
1913 | struct tevent_context *ev; | |||||
1914 | struct sdap_id_op *sdap_op; | |||||
1915 | struct sdap_options *opts; | |||||
1916 | int timeout; | |||||
1917 | struct gp_gpo **candidate_gpos; | |||||
1918 | int num_candidate_gpos; | |||||
1919 | int gpo_index; | |||||
1920 | }; | |||||
1921 | ||||||
1922 | static errno_t ad_gpo_get_gpo_attrs_step(struct tevent_req *req); | |||||
1923 | static void ad_gpo_get_gpo_attrs_done(struct tevent_req *subreq); | |||||
1924 | ||||||
1925 | /* | |||||
1926 | * This function uses the input som_list to populate a prioritized list of | |||||
1927 | * gp_gpo objects, prioritized based on SOM type, link order, and whether the | |||||
1928 | * GPO is "enforced". This list represents the initial set of candidate GPOs | |||||
1929 | * that might be applicable to the target. This list can not be expanded, but | |||||
1930 | * it might be reduced based on subsequent filtering steps. The GPO object DNs | |||||
1931 | * are used to retrieve certain LDAP attributes of each GPO object, that are | |||||
1932 | * parsed into the various fields of the gp_gpo object. | |||||
1933 | */ | |||||
1934 | struct tevent_req * | |||||
1935 | ad_gpo_process_gpo_send(TALLOC_CTX *mem_ctx, | |||||
1936 | struct tevent_context *ev, | |||||
1937 | struct sdap_id_op *sdap_op, | |||||
1938 | struct sdap_options *opts, | |||||
1939 | int timeout, | |||||
1940 | struct gp_som **som_list) | |||||
1941 | { | |||||
1942 | struct tevent_req *req; | |||||
1943 | struct ad_gpo_process_gpo_state *state; | |||||
1944 | errno_t ret; | |||||
1945 | ||||||
1946 | req = tevent_req_create(mem_ctx, &state, struct ad_gpo_process_gpo_state)_tevent_req_create((mem_ctx), (&state), sizeof(struct ad_gpo_process_gpo_state ), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "1946"); | |||||
1947 | if (req == NULL((void*)0)) { | |||||
1948 | DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n")do { int __debug_macro_level = 0x0020; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1948, __FUNCTION__, __debug_macro_level, "tevent_req_create() failed\n" ); } } while (0); | |||||
1949 | return NULL((void*)0); | |||||
1950 | } | |||||
1951 | ||||||
1952 | state->ev = ev; | |||||
1953 | state->sdap_op = sdap_op; | |||||
1954 | state->opts = opts; | |||||
1955 | state->timeout = timeout; | |||||
1956 | state->gpo_index = -1; | |||||
1957 | state->candidate_gpos = NULL((void*)0); | |||||
1958 | state->num_candidate_gpos = 0; | |||||
1959 | ||||||
1960 | ret = ad_gpo_populate_candidate_gpos(state, | |||||
1961 | som_list, | |||||
1962 | &state->candidate_gpos, | |||||
1963 | &state->num_candidate_gpos); | |||||
1964 | ||||||
1965 | if (ret != EOK0) { | |||||
1966 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1968, __FUNCTION__, __debug_macro_level, "Unable to retrieve GPO List: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1967 | "Unable to retrieve GPO List: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1968, __FUNCTION__, __debug_macro_level, "Unable to retrieve GPO List: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
1968 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1968, __FUNCTION__, __debug_macro_level, "Unable to retrieve GPO List: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
1969 | ret = ENOENT2; | |||||
1970 | goto immediately; | |||||
1971 | } | |||||
1972 | ||||||
1973 | if (state->candidate_gpos == NULL((void*)0)) { | |||||
1974 | DEBUG(SSSDBG_OP_FAILURE, "no gpos found\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 1974, __FUNCTION__, __debug_macro_level, "no gpos found\n") ; } } while (0); | |||||
1975 | ret = ENOENT2; | |||||
1976 | goto immediately; | |||||
1977 | } | |||||
1978 | ||||||
1979 | ret = ad_gpo_get_gpo_attrs_step(req); | |||||
1980 | ||||||
1981 | immediately: | |||||
1982 | ||||||
1983 | if (ret == EOK0) { | |||||
1984 | tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":" "1984"); | |||||
1985 | tevent_req_post(req, ev); | |||||
1986 | } else if (ret != EAGAIN11) { | |||||
1987 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "1987"); | |||||
1988 | tevent_req_post(req, ev); | |||||
1989 | } | |||||
1990 | ||||||
1991 | return req; | |||||
1992 | } | |||||
1993 | ||||||
1994 | static errno_t | |||||
1995 | ad_gpo_get_gpo_attrs_step(struct tevent_req *req) | |||||
1996 | { | |||||
1997 | const char *attrs[] = {AD_AT_NT_SEC_DESC"nTSecurityDescriptor", AD_AT_CN"cn", AD_AT_DISPLAY_NAME"displayName", | |||||
1998 | AD_AT_FILE_SYS_PATH"gPCFileSysPath", AD_AT_VERSION_NUMBER"versionNumber", | |||||
1999 | AD_AT_MACHINE_EXT_NAMES"gPCMachineExtensionNames", AD_AT_FUNC_VERSION"gPCFunctionalityVersion", | |||||
2000 | AD_AT_FLAGS"flags", NULL((void*)0)}; | |||||
2001 | struct tevent_req *subreq; | |||||
2002 | struct ad_gpo_process_gpo_state *state; | |||||
2003 | ||||||
2004 | state = tevent_req_data(req, struct ad_gpo_process_gpo_state)(struct ad_gpo_process_gpo_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "2004"); | |||||
2005 | ||||||
2006 | state->gpo_index++; | |||||
2007 | struct gp_gpo *gp_gpo = state->candidate_gpos[state->gpo_index]; | |||||
2008 | ||||||
2009 | /* gp_gpo is NULL only after all GPOs have been processed */ | |||||
2010 | if (gp_gpo == NULL((void*)0)) return EOK0; | |||||
2011 | ||||||
2012 | const char *gpo_dn = gp_gpo->gpo_dn; | |||||
2013 | ||||||
2014 | subreq = sdap_sd_search_send(state, state->ev, | |||||
2015 | state->opts, sdap_id_op_handle(state->sdap_op), | |||||
2016 | gpo_dn, SECINFO_DACL( 0x00000004 ), attrs, state->timeout); | |||||
2017 | ||||||
2018 | if (subreq == NULL((void*)0)) { | |||||
2019 | DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2019, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n" ); } } while (0); | |||||
2020 | return ENOMEM12; | |||||
2021 | } | |||||
2022 | ||||||
2023 | tevent_req_set_callback(subreq, ad_gpo_get_gpo_attrs_done, req); | |||||
2024 | return EAGAIN11; | |||||
2025 | } | |||||
2026 | ||||||
2027 | static void | |||||
2028 | ad_gpo_get_gpo_attrs_done(struct tevent_req *subreq) | |||||
2029 | { | |||||
2030 | struct tevent_req *req; | |||||
2031 | struct ad_gpo_process_gpo_state *state; | |||||
2032 | int ret; | |||||
2033 | int dp_error; | |||||
2034 | size_t num_results; | |||||
2035 | struct sysdb_attrs **results; | |||||
2036 | struct ldb_message_element *el = NULL((void*)0); | |||||
2037 | const char *gpo_guid = NULL((void*)0); | |||||
2038 | const char *smb_uri = NULL((void*)0); | |||||
2039 | const char *gpo_display_name = NULL((void*)0); | |||||
2040 | const char *raw_file_sys_path = NULL((void*)0); | |||||
2041 | char *file_sys_path = NULL((void*)0); | |||||
2042 | uint8_t *raw_machine_ext_names = NULL((void*)0); | |||||
2043 | ||||||
2044 | req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data (subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c" ":" "2044"); | |||||
2045 | state = tevent_req_data(req, struct ad_gpo_process_gpo_state)(struct ad_gpo_process_gpo_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "2045"); | |||||
2046 | ||||||
2047 | ret = sdap_sd_search_recv(subreq, state, &num_results, &results); | |||||
2048 | talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c" ":" "2048"); subreq = ((void*)0); } while(0); | |||||
2049 | ||||||
2050 | if (ret != EOK0) { | |||||
2051 | ret = sdap_id_op_done(state->sdap_op, ret, &dp_error); | |||||
2052 | /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */ | |||||
2053 | ||||||
2054 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2056, __FUNCTION__, __debug_macro_level, "Unable to get GPO attributes: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2055 | "Unable to get GPO attributes: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2056, __FUNCTION__, __debug_macro_level, "Unable to get GPO attributes: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2056 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2056, __FUNCTION__, __debug_macro_level, "Unable to get GPO attributes: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
2057 | ret = ENOENT2; | |||||
2058 | goto done; | |||||
2059 | } | |||||
2060 | ||||||
2061 | if ((num_results < 1) || (results == NULL((void*)0))) { | |||||
2062 | DEBUG(SSSDBG_OP_FAILURE, "no attrs found for GPO; try next GPO.\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2062, __FUNCTION__, __debug_macro_level, "no attrs found for GPO; try next GPO.\n" ); } } while (0); | |||||
2063 | ret = ad_gpo_get_gpo_attrs_step(req); | |||||
2064 | goto done; | |||||
2065 | } | |||||
2066 | else if (num_results > 1) { | |||||
2067 | DEBUG(SSSDBG_OP_FAILURE, "Received multiple replies\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2067, __FUNCTION__, __debug_macro_level, "Received multiple replies\n" ); } } while (0); | |||||
2068 | ret = ERR_INTERNAL; | |||||
2069 | goto done; | |||||
2070 | } | |||||
2071 | ||||||
2072 | struct gp_gpo *gp_gpo = state->candidate_gpos[state->gpo_index]; | |||||
2073 | ||||||
2074 | /* retrieve AD_AT_CN */ | |||||
2075 | ret = sysdb_attrs_get_string(results[0], AD_AT_CN"cn", &gpo_guid); | |||||
2076 | if (ret != EOK0) { | |||||
2077 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2079, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2078 | "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2079, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2079 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2079, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
2080 | goto done; | |||||
2081 | } | |||||
2082 | ||||||
2083 | gp_gpo->gpo_guid = talloc_steal(gp_gpo, gpo_guid)({ __typeof__(gpo_guid) __talloc_steal_ret = (__typeof__(gpo_guid ))_talloc_steal_loc((gp_gpo),(gpo_guid), "../sssd/src/providers/ad/ad_gpo.c" ":" "2083"); __talloc_steal_ret; }); | |||||
2084 | if (gp_gpo->gpo_guid == NULL((void*)0)) { | |||||
2085 | ret = ENOMEM12; | |||||
2086 | goto done; | |||||
2087 | } | |||||
2088 | ||||||
2089 | DEBUG(SSSDBG_TRACE_ALL, "populating attrs for gpo_guid: %s\n",do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2090, __FUNCTION__, __debug_macro_level, "populating attrs for gpo_guid: %s\n" , gp_gpo->gpo_guid); } } while (0) | |||||
2090 | gp_gpo->gpo_guid)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2090, __FUNCTION__, __debug_macro_level, "populating attrs for gpo_guid: %s\n" , gp_gpo->gpo_guid); } } while (0); | |||||
2091 | ||||||
2092 | /* retrieve AD_AT_DISPLAY_NAME */ | |||||
2093 | ret = sysdb_attrs_get_string(results[0], AD_AT_DISPLAY_NAME"displayName", | |||||
2094 | &gpo_display_name); | |||||
2095 | if (ret != EOK0) { | |||||
2096 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2098, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2097 | "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2098, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2098 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2098, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
2099 | goto done; | |||||
2100 | } | |||||
2101 | ||||||
2102 | gp_gpo->gpo_display_name = talloc_steal(gp_gpo, gpo_display_name)({ __typeof__(gpo_display_name) __talloc_steal_ret = (__typeof__ (gpo_display_name))_talloc_steal_loc((gp_gpo),(gpo_display_name ), "../sssd/src/providers/ad/ad_gpo.c" ":" "2102"); __talloc_steal_ret ; }); | |||||
2103 | if (gp_gpo->gpo_display_name == NULL((void*)0)) { | |||||
2104 | ret = ENOMEM12; | |||||
2105 | goto done; | |||||
2106 | } | |||||
2107 | ||||||
2108 | DEBUG(SSSDBG_TRACE_ALL, "gpo_display_name: %s\n",do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2109, __FUNCTION__, __debug_macro_level, "gpo_display_name: %s\n" , gp_gpo->gpo_display_name); } } while (0) | |||||
2109 | gp_gpo->gpo_display_name)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2109, __FUNCTION__, __debug_macro_level, "gpo_display_name: %s\n" , gp_gpo->gpo_display_name); } } while (0); | |||||
2110 | ||||||
2111 | /* retrieve AD_AT_FILE_SYS_PATH */ | |||||
2112 | ret = sysdb_attrs_get_string(results[0], | |||||
2113 | AD_AT_FILE_SYS_PATH"gPCFileSysPath", | |||||
2114 | &raw_file_sys_path); | |||||
2115 | ||||||
2116 | if (ret != EOK0) { | |||||
2117 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2119, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2118 | "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2119, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2119 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2119, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
2120 | goto done; | |||||
2121 | } | |||||
2122 | ||||||
2123 | file_sys_path = talloc_strdup(gp_gpo, raw_file_sys_path); | |||||
2124 | ad_gpo_convert_to_smb_uri(state, file_sys_path, &smb_uri); | |||||
2125 | ||||||
2126 | gp_gpo->gpo_file_sys_path = talloc_asprintf(gp_gpo, "%s/Machine", | |||||
2127 | smb_uri); | |||||
2128 | if (gp_gpo->gpo_file_sys_path == NULL((void*)0)) { | |||||
2129 | ret = ENOMEM12; | |||||
2130 | goto done; | |||||
2131 | } | |||||
2132 | ||||||
2133 | DEBUG(SSSDBG_TRACE_FUNC, "gpo_file_sys_path: %s\n",do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2134, __FUNCTION__, __debug_macro_level, "gpo_file_sys_path: %s\n" , gp_gpo->gpo_file_sys_path); } } while (0) | |||||
2134 | gp_gpo->gpo_file_sys_path)do { int __debug_macro_level = 0x0400; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2134, __FUNCTION__, __debug_macro_level, "gpo_file_sys_path: %s\n" , gp_gpo->gpo_file_sys_path); } } while (0); | |||||
2135 | ||||||
2136 | /* retrieve AD_AT_VERSION_NUMBER */ | |||||
2137 | ret = sysdb_attrs_get_uint32_t(results[0], AD_AT_VERSION_NUMBER"versionNumber", | |||||
2138 | &gp_gpo->gpo_container_version); | |||||
2139 | if (ret != EOK0) { | |||||
2140 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2142, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2141 | "sysdb_attrs_get_uint32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2142, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2142 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2142, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
2143 | goto done; | |||||
2144 | } | |||||
2145 | ||||||
2146 | DEBUG(SSSDBG_TRACE_ALL, "gpo_container_version: %d\n",do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2147, __FUNCTION__, __debug_macro_level, "gpo_container_version: %d\n" , gp_gpo->gpo_container_version); } } while (0) | |||||
2147 | gp_gpo->gpo_container_version)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2147, __FUNCTION__, __debug_macro_level, "gpo_container_version: %d\n" , gp_gpo->gpo_container_version); } } while (0); | |||||
2148 | ||||||
2149 | /* retrieve AD_AT_MACHINE_EXT_NAMES */ | |||||
2150 | ret = sysdb_attrs_get_el(results[0], AD_AT_MACHINE_EXT_NAMES"gPCMachineExtensionNames", &el); | |||||
2151 | if (ret != EOK0 && ret != ENOENT2) { | |||||
2152 | DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_el() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2152, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed\n" ); } } while (0); | |||||
2153 | goto done; | |||||
2154 | } | |||||
2155 | if ((ret == ENOENT2) || (el->num_values == 0)) { | |||||
2156 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2157, __FUNCTION__, __debug_macro_level, "machine_ext_names not found or has no value\n" ); } } while (0) | |||||
2157 | "machine_ext_names not found or has no value\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2157, __FUNCTION__, __debug_macro_level, "machine_ext_names not found or has no value\n" ); } } while (0); | |||||
2158 | ret = ENOENT2; | |||||
2159 | goto done; | |||||
2160 | } | |||||
2161 | ||||||
2162 | raw_machine_ext_names = el[0].values[0].data; | |||||
2163 | ||||||
2164 | ret = ad_gpo_parse_machine_ext_names(gp_gpo, | |||||
2165 | (char *)raw_machine_ext_names, | |||||
2166 | &gp_gpo->gpo_cse_guids, | |||||
2167 | &gp_gpo->num_gpo_cse_guids); | |||||
2168 | if (ret != EOK0) { | |||||
2169 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2170, __FUNCTION__, __debug_macro_level, "ad_gpo_parse_machine_ext_names() failed\n" ); } } while (0) | |||||
2170 | "ad_gpo_parse_machine_ext_names() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2170, __FUNCTION__, __debug_macro_level, "ad_gpo_parse_machine_ext_names() failed\n" ); } } while (0); | |||||
2171 | goto done; | |||||
2172 | } | |||||
2173 | ||||||
2174 | /* retrieve AD_AT_FUNC_VERSION */ | |||||
2175 | ret = sysdb_attrs_get_int32_t(results[0], AD_AT_FUNC_VERSION"gPCFunctionalityVersion", | |||||
2176 | &gp_gpo->gpo_func_version); | |||||
2177 | if (ret != EOK0) { | |||||
2178 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2180, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2179 | "sysdb_attrs_get_int32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2180, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2180 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2180, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
2181 | goto done; | |||||
2182 | } | |||||
2183 | ||||||
2184 | DEBUG(SSSDBG_TRACE_ALL, "gpo_func_version: %d\n",do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2185, __FUNCTION__, __debug_macro_level, "gpo_func_version: %d\n" , gp_gpo->gpo_func_version); } } while (0) | |||||
2185 | gp_gpo->gpo_func_version)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2185, __FUNCTION__, __debug_macro_level, "gpo_func_version: %d\n" , gp_gpo->gpo_func_version); } } while (0); | |||||
2186 | ||||||
2187 | /* retrieve AD_AT_FLAGS */ | |||||
2188 | ret = sysdb_attrs_get_int32_t(results[0], AD_AT_FLAGS"flags", | |||||
2189 | &gp_gpo->gpo_flags); | |||||
2190 | if (ret != EOK0) { | |||||
2191 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2193, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2192 | "sysdb_attrs_get_int32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2193, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0) | |||||
2193 | ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2193, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n" , ret, sss_strerror(ret)); } } while (0); | |||||
2194 | goto done; | |||||
2195 | } | |||||
2196 | ||||||
2197 | DEBUG(SSSDBG_TRACE_ALL, "gpo_flags: %d\n", gp_gpo->gpo_flags)do { int __debug_macro_level = 0x4000; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2197, __FUNCTION__, __debug_macro_level, "gpo_flags: %d\n", gp_gpo->gpo_flags); } } while (0); | |||||
2198 | ||||||
2199 | /* retrieve AD_AT_NT_SEC_DESC */ | |||||
2200 | ret = sysdb_attrs_get_el(results[0], AD_AT_NT_SEC_DESC"nTSecurityDescriptor", &el); | |||||
2201 | if (ret != EOK0 && ret != ENOENT2) { | |||||
2202 | DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_el() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2202, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed\n" ); } } while (0); | |||||
2203 | goto done; | |||||
2204 | } | |||||
2205 | if ((ret == ENOENT2) || (el->num_values == 0)) { | |||||
2206 | DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2207, __FUNCTION__, __debug_macro_level, "nt_sec_desc attribute not found or has no value\n" ); } } while (0) | |||||
2207 | "nt_sec_desc attribute not found or has no value\n")do { int __debug_macro_level = 0x0040; if ((debug_level & (__debug_macro_level) || (debug_level == 0 && (__debug_macro_level & (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c" , 2207, __FUNCTION__, __debug_macro_level, "nt_sec_desc attribute not found or has no value\n" ); } } while (0); | |||||
2208 | ret = ENOENT2; | |||||
2209 | goto done; | |||||
2210 | } | |||||
2211 | ||||||
2212 | ret = ad_gpo_parse_sd(gp_gpo, el[0].values[0].data, el[0].values[0].length, | |||||
2213 | &gp_gpo->gpo_sd); | |||||
2214 | ||||||
2215 | ret = ad_gpo_get_gpo_attrs_step(req); | |||||
2216 | ||||||
2217 | done: | |||||
2218 | ||||||
2219 | if (ret == EOK0) { | |||||
2220 | tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":" "2220"); | |||||
2221 | } else if (ret != EAGAIN11) { | |||||
2222 | tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c" ":" "2222"); | |||||
2223 | } | |||||
2224 | } | |||||
2225 | ||||||
2226 | int | |||||
2227 | ad_gpo_process_gpo_recv(struct tevent_req *req, | |||||
2228 | TALLOC_CTX *mem_ctx, | |||||
2229 | struct gp_gpo ***candidate_gpos, | |||||
2230 | int *num_candidate_gpos) | |||||
2231 | { | |||||
2232 | struct ad_gpo_process_gpo_state *state = | |||||
2233 | tevent_req_data(req, struct ad_gpo_process_gpo_state)(struct ad_gpo_process_gpo_state *)_talloc_get_type_abort(_tevent_req_data (req), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c" ":" "2233"); | |||||
2234 | ||||||
2235 | TEVENT_REQ_RETURN_ON_ERROR(req)do { enum tevent_req_state TRROEstate; uint64_t TRROEerr; if ( tevent_req_is_error(req, &TRROEstate, &TRROEerr)) { if (TRROEstate == TEVENT_REQ_USER_ERROR) { return TRROEerr; } return ERR_INTERNAL; } } while (0); | |||||
2236 | ||||||
2237 | *candidate_gpos = talloc_steal(mem_ctx, state->candidate_gpos)({ __typeof__(state->candidate_gpos) __talloc_steal_ret = ( __typeof__(state->candidate_gpos))_talloc_steal_loc((mem_ctx ),(state->candidate_gpos), "../sssd/src/providers/ad/ad_gpo.c" ":" "2237"); __talloc_steal_ret; }); | |||||
2238 | *num_candidate_gpos = state->num_candidate_gpos; | |||||
2239 | return EOK0; | |||||
2240 | } |