Bug Summary

File:/dev/shm/clang/../sssd/src/providers/ad/ad_gpo.c
Location:line 849, column 9
Description:Access to field 'gpo_guid' results in a dereference of a null pointer

Annotated Source Code

1/*
2 SSSD
3
4 Authors:
5 Yassir Elley <yelley@redhat.com>
6
7 Copyright (C) 2013 Red Hat
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23/*
24 * This file implements the following pair of *public* functions (see header):
25 * ad_gpo_access_send/recv: provides client-side GPO processing
26 *
27 * This file also implements the following pairs of *private* functions (which
28 * are used by the public functions):
29 * ad_gpo_process_som_send/recv: populate list of gp_som objects
30 * ad_gpo_process_gpo_send/recv: populate list of gp_gpo objects
31 */
32
33#include <security/pam_modules.h>
34#include "util/util.h"
35#include "util/strtonum.h"
36#include "providers/data_provider.h"
37#include "providers/dp_backend.h"
38#include "providers/ad/ad_access.h"
39#include "providers/ad/ad_common.h"
40#include "providers/ad/ad_domain_info.h"
41#include "providers/ad/ad_gpo.h"
42#include "providers/ldap/sdap_access.h"
43#include "providers/ldap/sdap_async.h"
44#include "providers/ldap/sdap.h"
45#include <ndr.h>
46#include <gen_ndr/security.h>
47
48#define AD_AT_DN"distinguishedName" "distinguishedName"
49#define AD_AT_UAC"userAccountControl" "userAccountControl"
50#define AD_AT_CONFIG_NC"configurationNamingContext" "configurationNamingContext"
51#define AD_AT_GPLINK"gPLink" "gPLink"
52#define AD_AT_GPOPTIONS"gpOptions" "gpOptions"
53#define AD_AT_NT_SEC_DESC"nTSecurityDescriptor" "nTSecurityDescriptor"
54#define AD_AT_CN"cn" "cn"
55#define AD_AT_DISPLAY_NAME"displayName" "displayName"
56#define AD_AT_FILE_SYS_PATH"gPCFileSysPath" "gPCFileSysPath"
57#define AD_AT_VERSION_NUMBER"versionNumber" "versionNumber"
58#define AD_AT_MACHINE_EXT_NAMES"gPCMachineExtensionNames" "gPCMachineExtensionNames"
59#define AD_AT_USER_EXT_NAMES"gPCUserExtensionNames" "gPCUserExtensionNames"
60#define AD_AT_FUNC_VERSION"gPCFunctionalityVersion" "gPCFunctionalityVersion"
61#define AD_AT_FLAGS"flags" "flags"
62
63#define UAC_WORKSTATION_TRUST_ACCOUNT0x00001000 0x00001000
64#define AD_AGP_GUID"edacfd8f-ffb3-11d1-b41d-00a0c968f939" "edacfd8f-ffb3-11d1-b41d-00a0c968f939"
65#define AD_AUTHENTICATED_USERS_SID"S-1-5-11" "S-1-5-11"
66#define SID_MAX_LEN1024 1024
67
68/* == common data structures and declarations ============================= */
69
70struct gp_som {
71 const char *som_dn;
72 struct gp_gplink **gplink_list;
73 int num_gplinks;
74};
75
76struct gp_gplink {
77 const char *gpo_dn;
78 bool_Bool enforced;
79};
80
81struct gp_gpo {
82 struct security_descriptor *gpo_sd;
83 const char *gpo_dn;
84 const char *gpo_guid;
85 const char *gpo_display_name;
86 const char *gpo_file_sys_path;
87 uint32_t gpo_container_version;
88 const char **gpo_cse_guids;
89 int num_gpo_cse_guids;
90 int gpo_func_version;
91 int gpo_flags;
92};
93
94enum ace_eval_status {
95 AD_GPO_ACE_DENIED,
96 AD_GPO_ACE_ALLOWED,
97 AD_GPO_ACE_NEUTRAL
98};
99
100struct tevent_req *ad_gpo_process_som_send(TALLOC_CTX *mem_ctx,
101 struct tevent_context *ev,
102 struct sdap_id_conn_ctx *conn,
103 struct ldb_context *ldb_ctx,
104 struct sdap_id_op *sdap_op,
105 struct sdap_options *opts,
106 int timeout,
107 const char *target_dn,
108 const char *domain_name);
109int ad_gpo_process_som_recv(struct tevent_req *req,
110 TALLOC_CTX *mem_ctx,
111 struct gp_som ***som_list);
112
113struct tevent_req *ad_gpo_process_gpo_send(TALLOC_CTX *mem_ctx,
114 struct tevent_context *ev,
115 struct sdap_id_op *sdap_op,
116 struct sdap_options *opts,
117 int timeout,
118 struct gp_som **som_list);
119int ad_gpo_process_gpo_recv(struct tevent_req *req,
120 TALLOC_CTX *mem_ctx,
121 struct gp_gpo ***candidate_gpos,
122 int *num_candidate_gpos);
123
124/* == ad_gpo_access_send/recv helpers =======================================*/
125
126/*
127 * This function retrieves the SIDs corresponding to the input user and returns
128 * the user_sid, group_sids, and group_size in their respective output params.
129 *
130 * Note: since authentication must complete successfully before the
131 * gpo access checks are called, we can safely assume that the user/computer
132 * has been authenticated. As such, this function always adds the
133 * AD_AUTHENTICATED_USERS_SID to the group_sids.
134 */
135static errno_t
136ad_gpo_get_sids(TALLOC_CTX *mem_ctx,
137 const char *user,
138 struct sss_domain_info *domain,
139 const char **_user_sid,
140 const char ***_group_sids,
141 int *_group_size)
142{
143 TALLOC_CTX *tmp_ctx = NULL((void*)0);
144 struct ldb_result *res;
145 int ret = 0;
146 int i = 0;
147 int num_group_sids = 0;
148 const char *user_sid = NULL((void*)0);
149 const char *group_sid = NULL((void*)0);
150 const char **group_sids = NULL((void*)0);
151
152 tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c"
":" "152")
;
153 if (tmp_ctx == NULL((void*)0)) {
154 ret = ENOMEM12;
155 goto done;
156 }
157
158 /* first result from sysdb_initgroups is user_sid; rest are group_sids */
159 ret = sysdb_initgroups(tmp_ctx, domain, user, &res);
160 if (ret != EOK0) {
161 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 163, __FUNCTION__, __debug_macro_level, "sysdb_initgroups failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
162 "sysdb_initgroups failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 163, __FUNCTION__, __debug_macro_level, "sysdb_initgroups failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
163 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 163, __FUNCTION__, __debug_macro_level, "sysdb_initgroups failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
164 return ret;
165 }
166
167 if (res->count == 0) {
168 ret = ENOENT2;
169 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 170, __FUNCTION__, __debug_macro_level, "sysdb_initgroups returned empty result\n"
); } } while (0)
170 "sysdb_initgroups returned empty result\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 170, __FUNCTION__, __debug_macro_level, "sysdb_initgroups returned empty result\n"
); } } while (0)
;
171 return ret;
172 }
173
174 user_sid = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_SID_STR"objectSIDString", NULL((void*)0));
175 num_group_sids = (res->count) - 1;
176
177 /* include space for AD_AUTHENTICATED_USERS_SID and NULL */
178 group_sids = talloc_array(tmp_ctx, const char *, num_group_sids + 1 + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_group_sids
+ 1 + 1, "const char *")
;
179 if (group_sids == NULL((void*)0)) {
180 ret = ENOMEM12;
181 goto done;
182 }
183
184 for (i = 0; i < num_group_sids; i++) {
185 group_sid = ldb_msg_find_attr_as_string(res->msgs[i+1],
186 SYSDB_SID_STR"objectSIDString", NULL((void*)0));
187 if (group_sid == NULL((void*)0)) {
188 continue;
189 }
190
191 group_sids[i] = talloc_steal(group_sids, group_sid)({ __typeof__(group_sid) __talloc_steal_ret = (__typeof__(group_sid
))_talloc_steal_loc((group_sids),(group_sid), "../sssd/src/providers/ad/ad_gpo.c"
":" "191"); __talloc_steal_ret; })
;
192 if (group_sids[i] == NULL((void*)0)) {
193 ret = ENOMEM12;
194 goto done;
195 }
196 }
197 group_sids[i++] = talloc_strdup(group_sids, AD_AUTHENTICATED_USERS_SID"S-1-5-11");
198 group_sids[i] = NULL((void*)0);
199
200 *_group_size = num_group_sids + 1;
201 *_group_sids = talloc_steal(mem_ctx, group_sids)({ __typeof__(group_sids) __talloc_steal_ret = (__typeof__(group_sids
))_talloc_steal_loc((mem_ctx),(group_sids), "../sssd/src/providers/ad/ad_gpo.c"
":" "201"); __talloc_steal_ret; })
;
202 *_user_sid = talloc_steal(mem_ctx, user_sid)({ __typeof__(user_sid) __talloc_steal_ret = (__typeof__(user_sid
))_talloc_steal_loc((mem_ctx),(user_sid), "../sssd/src/providers/ad/ad_gpo.c"
":" "202"); __talloc_steal_ret; })
;
203 return EOK0;
204
205 done:
206 talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":"
"206")
;
207 return ret;
208}
209
210bool_Bool string_to_sid(struct dom_sid *sidout, const char *sidstr);
211int dom_sid_string_buf(const struct dom_sid *sid, char *buf, int buflen);
212bool_Bool dom_sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2);
213
214/*
215 * This function determines whether the input ACE includes any of the
216 * client's SIDs. The boolean result is assigned to the _included output param.
217 */
218static errno_t
219ad_gpo_ace_includes_client_sid(const char *user_sid,
220 const char **group_sids,
221 int group_size,
222 struct security_ace *ace,
223 bool_Bool *_included)
224{
225 int i = 0;
226 struct dom_sid ace_dom_sid;
227 struct dom_sid user_dom_sid;
228 struct dom_sid group_dom_sid;
229 char buf[SID_MAX_LEN1024 + 1];
230
231 ace_dom_sid = ace->trustee;
232
233 dom_sid_string_buf(&ace_dom_sid, buf, SID_MAX_LEN1024);
234
235 if (!string_to_sid(&user_dom_sid, user_sid)) {
236 DEBUG(SSSDBG_OP_FAILURE, "string_to_sid failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 236, __FUNCTION__, __debug_macro_level, "string_to_sid failed\n"
); } } while (0)
;
237 return EINVAL22;
238 }
239
240 if (dom_sid_equal(&ace_dom_sid, &user_dom_sid)) {
241 *_included = true1;
242 return EOK0;
243 }
244
245 for (i = 0; i < group_size; i++) {
246 if (!string_to_sid(&group_dom_sid, group_sids[i])) {
247 DEBUG(SSSDBG_OP_FAILURE, "string_to_sid failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 247, __FUNCTION__, __debug_macro_level, "string_to_sid failed\n"
); } } while (0)
;
248 return EINVAL22;
249 }
250 if (dom_sid_equal(&ace_dom_sid, &group_dom_sid)) {
251 *_included = true1;
252 return EOK0;
253 }
254 }
255
256 *_included = false0;
257 return EOK0;
258}
259
260/*
261 * This function determines whether use of the extended right
262 * named "ApplyGroupPolicy" (AGP) is allowed, by comparing the specified
263 * user_sid and group_sids against the specified access control entry (ACE).
264 * This function returns ALLOWED, DENIED, or NEUTRAL depending on whether
265 * the ACE explictly allows, explicitly denies, or does neither.
266 *
267 * Note that the 'M' abbreviation used in the evaluation algorithm stands for
268 * "access_mask", which represents the set of access rights associated with an
269 * individual ACE. The access right of interest to the GPO code is
270 * RIGHT_DS_CONTROL_ACCESS, which serves as a container for all control access
271 * rights. The specific control access right is identified by a GUID in the
272 * ACE's ObjectType. In our case, this is the GUID corresponding to AGP.
273 *
274 * The ACE evaluation algorithm is specified in [MS-ADTS] 5.1.3.3.4:
275 * - Deny access by default
276 * - If the "Inherit Only" (IO) flag is set in the ACE, skip the ACE.
277 * - If the SID in the ACE does not match any SID in the requester's
278 * security context, skip the ACE
279 * - If the ACE type is "Object Access Allowed", the access right
280 * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType
281 * field in the ACE is either not present OR contains a GUID value equal
282 * to AGP, then grant requested control access right. Stop access checking.
283 * - If the ACE type is "Object Access Denied", the access right
284 * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType
285 * field in the ACE is either not present OR contains a GUID value equal to
286 * AGP, then deny the requested control access right. Stop access checking.
287 */
288static enum ace_eval_status ad_gpo_evaluate_ace(struct security_ace *ace,
289 const char *user_sid,
290 const char **group_sids,
291 int group_size)
292{
293 bool_Bool agp_included = false0;
294 bool_Bool included = false0;
295 int ret = 0;
296 struct security_ace_object object;
297 struct GUID ext_right_agp_guid;
298
299 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY( 0x08 )) {
300 return AD_GPO_ACE_NEUTRAL;
301 }
302
303 ret = ad_gpo_ace_includes_client_sid(user_sid, group_sids, group_size, ace,
304 &included);
305 if (ret != EOK0) {
306 return AD_GPO_ACE_DENIED;
307 }
308
309 if (!included) {
310 return AD_GPO_ACE_NEUTRAL;
311 }
312
313 object = ace->object.object;
314 GUID_from_string(AD_AGP_GUID"edacfd8f-ffb3-11d1-b41d-00a0c968f939", &ext_right_agp_guid);
315
316 if (object.flags & SEC_ACE_OBJECT_TYPE_PRESENT( 0x00000001 )) {
317 if (GUID_equal(&object.type.type, &ext_right_agp_guid)) {
318 agp_included = true1;
319 }
320 } else {
321 agp_included = false0;
322 }
323
324 if (ace->access_mask & SEC_ADS_CONTROL_ACCESS( 0x00000100 )) {
325 if (agp_included) {
326 if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
327 return AD_GPO_ACE_ALLOWED;
328 } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) {
329 return AD_GPO_ACE_DENIED;
330 }
331 }
332 }
333
334 return AD_GPO_ACE_DENIED;
335}
336
337/*
338 * This function extracts the GPO's DACL (discretionary access control list)
339 * from the GPO's specified security descriptor, and determines whether
340 * the GPO is applicable to the policy target, by comparing the specified
341 * user_sid and group_sids against each access control entry (ACE) in the DACL.
342 * The boolean result is assigned to the _access_allowed output parameter.
343 */
344static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl,
345 const char *user_sid,
346 const char **group_sids,
347 int group_size,
348 bool_Bool *_dacl_access_allowed)
349{
350 uint32_t num_aces = 0;
351 enum ace_eval_status ace_status;
352 int i = 0;
353 struct security_ace *ace = NULL((void*)0);
354
355 num_aces = dacl->num_aces;
356
357 /*
358 * [MS-ADTS] 5.1.3.3.4:
359 * If the DACL does not have any ACE, then deny the requester the
360 * requested control access right.
361 */
362 if (num_aces == 0) {
363 *_dacl_access_allowed = false0;
364 return EOK0;
365 }
366
367 for (i = 0; i < dacl->num_aces; i ++) {
368 ace = &dacl->aces[i];
369
370 ace_status = ad_gpo_evaluate_ace(ace, user_sid, group_sids, group_size);
371
372 switch (ace_status) {
373 case AD_GPO_ACE_NEUTRAL:
374 continue;
375 case AD_GPO_ACE_ALLOWED:
376 *_dacl_access_allowed = true1;
377 return EOK0;
378 case AD_GPO_ACE_DENIED:
379 *_dacl_access_allowed = false0;
380 return EOK0;
381 }
382 }
383
384 *_dacl_access_allowed = false0;
385 return EOK0;
386}
387
388/*
389 * This function takes candidate_gpos as input, filters out any gpo that is
390 * not applicable to the policy target and assigns the result to the
391 * _dacl_filtered_gpos output parameter. The filtering algorithm is
392 * defined in [MS-GPOL] 3.2.5.1.6
393 */
394
395static errno_t
396ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx,
397 const char *user,
398 struct sss_domain_info *domain,
399 struct gp_gpo **candidate_gpos,
400 int num_candidate_gpos,
401 struct gp_gpo ***_dacl_filtered_gpos,
402 int *_num_dacl_filtered_gpos)
403{
404 TALLOC_CTX *tmp_ctx = NULL((void*)0);
405 int i = 0;
406 int ret = 0;
407 struct gp_gpo *candidate_gpo = NULL((void*)0);
408 struct security_descriptor *sd = NULL((void*)0);
409 struct security_acl *dacl = NULL((void*)0);
410 const char *user_sid = NULL((void*)0);
411 const char **group_sids = NULL((void*)0);
412 int group_size = 0;
413 int gpo_dn_idx = 0;
414 bool_Bool access_allowed = false0;
415 struct gp_gpo **dacl_filtered_gpos = NULL((void*)0);
416
417 tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c"
":" "417")
;
418 if (tmp_ctx == NULL((void*)0)) {
419 ret = ENOMEM12;
420 goto done;
421 }
422
423 ret = ad_gpo_get_sids(tmp_ctx, user, domain, &user_sid,
424 &group_sids, &group_size);
425 if (ret != EOK0) {
426 ret = ERR_NO_SIDS;
427 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 428, __FUNCTION__, __debug_macro_level, "Unable to retrieve SIDs: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
428 "Unable to retrieve SIDs: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 428, __FUNCTION__, __debug_macro_level, "Unable to retrieve SIDs: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
429 goto done;
430 }
431
432 dacl_filtered_gpos = talloc_array(tmp_ctx,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo
*), num_candidate_gpos + 1, "struct gp_gpo *")
433 struct gp_gpo *,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo
*), num_candidate_gpos + 1, "struct gp_gpo *")
434 num_candidate_gpos + 1)(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo
*), num_candidate_gpos + 1, "struct gp_gpo *")
;
435
436 if (dacl_filtered_gpos == NULL((void*)0)) {
437 ret = ENOMEM12;
438 goto done;
439 }
440
441 for (i = 0; i < num_candidate_gpos; i++) {
442
443 access_allowed = false0;
444 candidate_gpo = candidate_gpos[i];
445 sd = candidate_gpo->gpo_sd;
446 dacl = candidate_gpo->gpo_sd->dacl;
447
448 DEBUG(SSSDBG_TRACE_ALL, "examining dacl candidate_gpo_guid:%s\n",do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 449, __FUNCTION__, __debug_macro_level, "examining dacl candidate_gpo_guid:%s\n"
, candidate_gpo->gpo_guid); } } while (0)
449 candidate_gpo->gpo_guid)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 449, __FUNCTION__, __debug_macro_level, "examining dacl candidate_gpo_guid:%s\n"
, candidate_gpo->gpo_guid); } } while (0)
;
450
451 /* gpo_func_version must be set to version 2 */
452 if (candidate_gpo->gpo_func_version != 2) {
453 DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 454, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n"
); } } while (0)
454 "GPO not applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 454, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n"
); } } while (0)
;
455 continue;
456 }
457
458 /* gpo_flags value of 2 means that GPO's computer portion is disabled */
459 if (candidate_gpo->gpo_flags == 2) {
460 DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 461, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n"
); } } while (0)
461 "GPO not applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 461, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n"
); } } while (0)
;
462 continue;
463 }
464
465 /*
466 * [MS-ADTS] 5.1.3.3.4:
467 * If the security descriptor has no DACL or its "DACL Present" bit
468 * is not set, then grant requester the requested control access right.
469 */
470
471 if ((!(sd->type & SEC_DESC_DACL_PRESENT( 0x0004 ))) || (dacl == NULL((void*)0))) {
472 DEBUG(SSSDBG_TRACE_ALL, "DACL is not present\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 472, __FUNCTION__, __debug_macro_level, "DACL is not present\n"
); } } while (0)
;
473 access_allowed = true1;
474 break;
475 }
476
477 ad_gpo_evaluate_dacl(dacl, user_sid, group_sids,
478 group_size, &access_allowed);
479 if (access_allowed) {
480 DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 481, __FUNCTION__, __debug_macro_level, "GPO applicable to target per security filtering\n"
); } } while (0)
481 "GPO applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 481, __FUNCTION__, __debug_macro_level, "GPO applicable to target per security filtering\n"
); } } while (0)
;
482 dacl_filtered_gpos[gpo_dn_idx] = talloc_steal(dacl_filtered_gpos,({ __typeof__(candidate_gpo) __talloc_steal_ret = (__typeof__
(candidate_gpo))_talloc_steal_loc((dacl_filtered_gpos),(candidate_gpo
), "../sssd/src/providers/ad/ad_gpo.c" ":" "483"); __talloc_steal_ret
; })
483 candidate_gpo)({ __typeof__(candidate_gpo) __talloc_steal_ret = (__typeof__
(candidate_gpo))_talloc_steal_loc((dacl_filtered_gpos),(candidate_gpo
), "../sssd/src/providers/ad/ad_gpo.c" ":" "483"); __talloc_steal_ret
; })
;
484 gpo_dn_idx++;
485 } else {
486 DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 487, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n"
); } } while (0)
487 "GPO not applicable to target per security filtering\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 487, __FUNCTION__, __debug_macro_level, "GPO not applicable to target per security filtering\n"
); } } while (0)
;
488 continue;
489 }
490 }
491
492 dacl_filtered_gpos[gpo_dn_idx] = NULL((void*)0);
493
494 *_dacl_filtered_gpos = talloc_steal(mem_ctx, dacl_filtered_gpos)({ __typeof__(dacl_filtered_gpos) __talloc_steal_ret = (__typeof__
(dacl_filtered_gpos))_talloc_steal_loc((mem_ctx),(dacl_filtered_gpos
), "../sssd/src/providers/ad/ad_gpo.c" ":" "494"); __talloc_steal_ret
; })
;
495 *_num_dacl_filtered_gpos = gpo_dn_idx;
496
497 ret = EOK0;
498
499 done:
500 talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":"
"500")
;
501 return ret;
502}
503
504/* == ad_gpo_access_send/recv implementation ================================*/
505
506struct ad_gpo_access_state {
507 struct tevent_context *ev;
508 struct ldb_context *ldb_ctx;
509 struct sdap_id_conn_ctx *conn;
510 struct sdap_id_op *sdap_op;
511 struct sdap_options *opts;
512 int timeout;
513 struct sss_domain_info *domain;
514 const char *user;
515 const char *ad_hostname;
516 const char *target_dn;
517 struct gp_gpo **dacl_filtered_gpos;
518 int num_dacl_filtered_gpos;
519};
520
521static void ad_gpo_connect_done(struct tevent_req *subreq);
522static void ad_gpo_target_dn_retrieval_done(struct tevent_req *subreq);
523static void ad_gpo_process_som_done(struct tevent_req *subreq);
524static void ad_gpo_process_gpo_done(struct tevent_req *subreq);
525
526struct tevent_req *
527ad_gpo_access_send(TALLOC_CTX *mem_ctx,
528 struct tevent_context *ev,
529 struct sss_domain_info *domain,
530 struct ad_access_ctx *ctx,
531 const char *user)
532{
533 struct tevent_req *req;
534 struct tevent_req *subreq;
535 struct ad_gpo_access_state *state;
536 errno_t ret;
537
538 req = tevent_req_create(mem_ctx, &state, struct ad_gpo_access_state)_tevent_req_create((mem_ctx), (&state), sizeof(struct ad_gpo_access_state
), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "538")
;
539 if (req == NULL((void*)0)) {
540 DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n")do { int __debug_macro_level = 0x0020; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 540, __FUNCTION__, __debug_macro_level, "tevent_req_create() failed\n"
); } } while (0)
;
541 return NULL((void*)0);
542 }
543
544 state->domain = domain;
545 state->dacl_filtered_gpos = NULL((void*)0);
546 state->num_dacl_filtered_gpos = 0;
547 state->ev = ev;
548 state->user = user;
549 state->ldb_ctx = sysdb_ctx_get_ldb(domain->sysdb);
550 state->ad_hostname = dp_opt_get_string(ctx->ad_options, AD_HOSTNAME)_dp_opt_get_string(ctx->ad_options, AD_HOSTNAME, __FUNCTION__
)
;
551 state->opts = ctx->sdap_access_ctx->id_ctx->opts;
552 state->timeout = dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT)_dp_opt_get_int(state->opts->basic, SDAP_SEARCH_TIMEOUT
, __FUNCTION__)
;
553 state->conn = ad_get_dom_ldap_conn(ctx->ad_id_ctx, domain);
554 state->sdap_op = sdap_id_op_create(state, state->conn->conn_cache);
555 if (state->sdap_op == NULL((void*)0)) {
556 DEBUG(SSSDBG_OP_FAILURE, "sdap_id_op_create failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 556, __FUNCTION__, __debug_macro_level, "sdap_id_op_create failed.\n"
); } } while (0)
;
557 ret = ENOMEM12;
558 goto immediately;
559 }
560
561 subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);
562 if (subreq == NULL((void*)0)) {
563 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 565, __FUNCTION__, __debug_macro_level, "sdap_id_op_connect_send failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
564 "sdap_id_op_connect_send failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 565, __FUNCTION__, __debug_macro_level, "sdap_id_op_connect_send failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
565 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 565, __FUNCTION__, __debug_macro_level, "sdap_id_op_connect_send failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
566 goto immediately;
567 }
568 tevent_req_set_callback(subreq, ad_gpo_connect_done, req);
569
570 ret = EOK0;
571
572immediately:
573
574 if (ret != EOK0) {
575 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "575")
;
576 tevent_req_post(req, ev);
577 }
578
579 return req;
580}
581
582static void
583ad_gpo_connect_done(struct tevent_req *subreq)
584{
585 struct tevent_req *req;
586 struct ad_gpo_access_state *state;
587 char* filter;
588 char *sam_account_name;
589 char *domain_dn;
590 int dp_error;
591 errno_t ret;
592
593 const char *attrs[] = {AD_AT_DN"distinguishedName", AD_AT_UAC"userAccountControl", NULL((void*)0)};
594
595 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "595")
;
596 state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "596")
;
597
598 ret = sdap_id_op_connect_recv(subreq, &dp_error);
599 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "599"); subreq = ((void*)0); } while(0)
;
600
601 if (ret != EOK0) {
602 /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */
603
604 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 606, __FUNCTION__, __debug_macro_level, "Failed to connect to AD server: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
605 "Failed to connect to AD server: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 606, __FUNCTION__, __debug_macro_level, "Failed to connect to AD server: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
606 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 606, __FUNCTION__, __debug_macro_level, "Failed to connect to AD server: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
607
608 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "608")
;
609 return;
610 }
611
612 sam_account_name = talloc_asprintf(state, "%s$", state->ad_hostname);
613 if (sam_account_name == NULL((void*)0)) {
614 tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c"
":" "614")
;
615 return;
616 }
617
618 DEBUG(SSSDBG_TRACE_FUNC, "sam_account_name is %s\n", sam_account_name)do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 618, __FUNCTION__, __debug_macro_level, "sam_account_name is %s\n"
, sam_account_name); } } while (0)
;
619
620 /* Convert the domain name into domain DN */
621 ret = domain_to_basedn(state, state->domain->name, &domain_dn);
622 if (ret != EOK0) {
623 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 625, __FUNCTION__, __debug_macro_level, "Cannot convert domain name [%s] to base DN [%d]: %s\n"
, state->domain->name, ret, sss_strerror(ret)); } } while
(0)
624 "Cannot convert domain name [%s] to base DN [%d]: %s\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 625, __FUNCTION__, __debug_macro_level, "Cannot convert domain name [%s] to base DN [%d]: %s\n"
, state->domain->name, ret, sss_strerror(ret)); } } while
(0)
625 state->domain->name, ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 625, __FUNCTION__, __debug_macro_level, "Cannot convert domain name [%s] to base DN [%d]: %s\n"
, state->domain->name, ret, sss_strerror(ret)); } } while
(0)
;
626 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "626")
;
627 return;
628 }
629
630 /* SDAP_OC_USER objectclass covers both users and computers */
631 filter = talloc_asprintf(state,
632 "(&(objectclass=%s)(%s=%s))",
633 state->opts->user_map[SDAP_OC_USER].name,
634 state->opts->user_map[SDAP_AT_USER_NAME].name,
635 sam_account_name);
636
637 if (filter == NULL((void*)0)) {
638 tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c"
":" "638")
;
639 return;
640 }
641
642 subreq = sdap_get_generic_send(state, state->ev, state->opts,
643 sdap_id_op_handle(state->sdap_op),
644 domain_dn, LDAP_SCOPE_SUBTREE((ber_int_t) 0x0002),
645 filter, attrs, NULL((void*)0), 0,
646 state->timeout,
647 false0);
648
649 if (subreq == NULL((void*)0)) {
650 DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 650, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n"
); } } while (0)
;
651 tevent_req_error(req, EIO)_tevent_req_error(req, 5, "../sssd/src/providers/ad/ad_gpo.c"
":" "651")
;
652 return;
653 }
654
655 tevent_req_set_callback(subreq, ad_gpo_target_dn_retrieval_done, req);
656}
657
658static void
659ad_gpo_target_dn_retrieval_done(struct tevent_req *subreq)
660{
661 struct tevent_req *req;
662 struct ad_gpo_access_state *state;
663 int ret;
664 int dp_error;
665 size_t reply_count;
666 struct sysdb_attrs **reply;
667 const char *target_dn = NULL((void*)0);
668 uint32_t uac;
669
670 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "670")
;
671 state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "671")
;
672 ret = sdap_get_generic_recv(subreq, state,
673 &reply_count, &reply);
674 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "674"); subreq = ((void*)0); } while(0)
;
675 if (ret != EOK0) {
676 ret = sdap_id_op_done(state->sdap_op, ret, &dp_error);
677 /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */
678
679 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 681, __FUNCTION__, __debug_macro_level, "Unable to get policy target's DN: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
680 "Unable to get policy target's DN: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 681, __FUNCTION__, __debug_macro_level, "Unable to get policy target's DN: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
681 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 681, __FUNCTION__, __debug_macro_level, "Unable to get policy target's DN: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
682 ret = ENOENT2;
683 goto done;
684 }
685
686 /* make sure there is only one non-NULL reply returned */
687
688 if (reply_count < 1) {
689 DEBUG(SSSDBG_OP_FAILURE, "No DN retrieved for policy target.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 689, __FUNCTION__, __debug_macro_level, "No DN retrieved for policy target.\n"
); } } while (0)
;
690 ret = ENOENT2;
691 goto done;
692 } else if (reply_count > 1) {
693 DEBUG(SSSDBG_OP_FAILURE, "Multiple replies for policy target\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 693, __FUNCTION__, __debug_macro_level, "Multiple replies for policy target\n"
); } } while (0)
;
694 ret = ERR_INTERNAL;
695 goto done;
696 } else if (reply == NULL((void*)0)) {
697 DEBUG(SSSDBG_OP_FAILURE, "reply_count is 1, but reply is NULL\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 697, __FUNCTION__, __debug_macro_level, "reply_count is 1, but reply is NULL\n"
); } } while (0)
;
698 ret = ERR_INTERNAL;
699 goto done;
700 }
701
702 /* reply[0] holds requested attributes of single reply */
703 ret = sysdb_attrs_get_string(reply[0], AD_AT_DN"distinguishedName", &target_dn);
704 if (ret != EOK0) {
705 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 707, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
706 "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 707, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
707 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 707, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
708 goto done;
709 }
710
711 state->target_dn = talloc_steal(state, target_dn)({ __typeof__(target_dn) __talloc_steal_ret = (__typeof__(target_dn
))_talloc_steal_loc((state),(target_dn), "../sssd/src/providers/ad/ad_gpo.c"
":" "711"); __talloc_steal_ret; })
;
712 if (state->target_dn == NULL((void*)0)) {
713 ret = ENOMEM12;
714 goto done;
715 }
716
717 ret = sysdb_attrs_get_uint32_t(reply[0], AD_AT_UAC"userAccountControl", &uac);
718 if (ret != EOK0) {
719 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 721, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
720 "sysdb_attrs_get_uint32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 721, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
721 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 721, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
722 goto done;
723 }
724
725 /* we only support computer policy targets, not users */
726 if (!(uac & UAC_WORKSTATION_TRUST_ACCOUNT0x00001000)) {
727 ret = EINVAL22;
728 goto done;
729 }
730
731 subreq = ad_gpo_process_som_send(state,
732 state->ev,
733 state->conn,
734 state->ldb_ctx,
735 state->sdap_op,
736 state->opts,
737 state->timeout,
738 state->target_dn,
739 state->domain->name);
740 if (subreq == NULL((void*)0)) {
741 ret = ENOMEM12;
742 goto done;
743 }
744
745 tevent_req_set_callback(subreq, ad_gpo_process_som_done, req);
746
747 ret = EOK0;
748
749 done:
750
751 if (ret != EOK0) {
752 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "752")
;
753 }
754}
755
756static void
757ad_gpo_process_som_done(struct tevent_req *subreq)
758{
759 struct tevent_req *req;
760 struct ad_gpo_access_state *state;
761 int ret;
762 struct gp_som **som_list;
763
764 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "764")
;
765 state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "765")
;
766 ret = ad_gpo_process_som_recv(subreq, state, &som_list);
767 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "767"); subreq = ((void*)0); } while(0)
;
768
769 if (ret != EOK0) {
770 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 772, __FUNCTION__, __debug_macro_level, "Unable to get som list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
771 "Unable to get som list: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 772, __FUNCTION__, __debug_macro_level, "Unable to get som list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
772 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 772, __FUNCTION__, __debug_macro_level, "Unable to get som list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
773 ret = ENOENT2;
774 goto done;
775 }
776
777 subreq = ad_gpo_process_gpo_send(state,
778 state->ev,
779 state->sdap_op,
780 state->opts,
781 state->timeout,
782 som_list);
783 if (subreq == NULL((void*)0)) {
784 ret = ENOMEM12;
785 goto done;
786 }
787
788 tevent_req_set_callback(subreq, ad_gpo_process_gpo_done, req);
789
790 ret = EOK0;
791
792 done:
793
794 if (ret != EOK0) {
795 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "795")
;
796 }
797}
798
799/*
800 * This function retrieves a list of candidate_gpos and potentially reduces it
801 * to a list of dacl_filtered_gpos, based on each GPO's DACL.
802 */
803static void
804ad_gpo_process_gpo_done(struct tevent_req *subreq)
805{
806 struct tevent_req *req;
807 struct ad_gpo_access_state *state;
808 int ret;
809 int dp_error;
810 struct gp_gpo **candidate_gpos = NULL((void*)0);
811 int num_candidate_gpos = 0;
812 int i = 0;
813
814 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "814")
;
815 state = tevent_req_data(req, struct ad_gpo_access_state)(struct ad_gpo_access_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_access_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "815")
;
816 ret = ad_gpo_process_gpo_recv(subreq, state, &candidate_gpos,
817 &num_candidate_gpos);
818
819 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "819"); subreq = ((void*)0); } while(0)
;
820
821 ret = sdap_id_op_done(state->sdap_op, ret, &dp_error);
822
823 if (ret != EOK0) {
1
Assuming 'ret' is equal to 0
2
Taking false branch
824 /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */
825
826 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 828, __FUNCTION__, __debug_macro_level, "Unable to get GPO list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
827 "Unable to get GPO list: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 828, __FUNCTION__, __debug_macro_level, "Unable to get GPO list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
828 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 828, __FUNCTION__, __debug_macro_level, "Unable to get GPO list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
829 ret = ENOENT2;
830 goto done;
831 }
832
833 ret = ad_gpo_filter_gpos_by_dacl(state, state->user, state->domain,
834 candidate_gpos, num_candidate_gpos,
835 &state->dacl_filtered_gpos,
836 &state->num_dacl_filtered_gpos);
837 if (ret != EOK0) {
3
Assuming 'ret' is equal to 0
4
Taking false branch
838 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 840, __FUNCTION__, __debug_macro_level, "Unable to filter GPO list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
839 "Unable to filter GPO list: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 840, __FUNCTION__, __debug_macro_level, "Unable to filter GPO list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
840 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 840, __FUNCTION__, __debug_macro_level, "Unable to filter GPO list: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
841 goto done;
842 }
843
844 if (state->dacl_filtered_gpos[0] == NULL((void*)0)) {
5
Assuming pointer value is null
6
Taking true branch
845 DEBUG(SSSDBG_TRACE_FUNC, "dacl_filtered_gpos is empty\n")do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 845, __FUNCTION__, __debug_macro_level, "dacl_filtered_gpos is empty\n"
); } } while (0)
;
846 }
847
848 for (i = 0; i < state->num_dacl_filtered_gpos; i++) {
7
Loop condition is true. Entering loop body
849 DEBUG(SSSDBG_TRACE_FUNC, "dacl_filtered_gpos[%d]->gpo_guid is %s\n", i,do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 850, __FUNCTION__, __debug_macro_level, "dacl_filtered_gpos[%d]->gpo_guid is %s\n"
, i, state->dacl_filtered_gpos[i]->gpo_guid); } } while
(0)
8
Within the expansion of the macro 'DEBUG':
a
Access to field 'gpo_guid' results in a dereference of a null pointer
850 state->dacl_filtered_gpos[i]->gpo_guid)do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 850, __FUNCTION__, __debug_macro_level, "dacl_filtered_gpos[%d]->gpo_guid is %s\n"
, i, state->dacl_filtered_gpos[i]->gpo_guid); } } while
(0)
;
851 }
852
853 /* TBD: initiate SMB retrieval */
854 DEBUG(SSSDBG_TRACE_FUNC, "time for SMB retrieval\n")do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 854, __FUNCTION__, __debug_macro_level, "time for SMB retrieval\n"
); } } while (0)
;
855
856 ret = EOK0;
857
858 done:
859
860 if (ret == EOK0) {
861 tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":"
"861")
;
862 } else if (ret != EAGAIN11) {
863 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "863")
;
864 }
865}
866
867errno_t
868ad_gpo_access_recv(struct tevent_req *req)
869{
870 TEVENT_REQ_RETURN_ON_ERROR(req)do { enum tevent_req_state TRROEstate; uint64_t TRROEerr; if (
tevent_req_is_error(req, &TRROEstate, &TRROEerr)) { if
(TRROEstate == TEVENT_REQ_USER_ERROR) { return TRROEerr; } return
ERR_INTERNAL; } } while (0)
;
871
872 return EOK0;
873}
874
875/* == ad_gpo_process_som_send/recv helpers ================================= */
876
877/*
878 * This function returns the parent of an LDAP DN
879 */
880static errno_t
881ad_gpo_parent_dn(TALLOC_CTX *mem_ctx,
882 struct ldb_context *ldb_ctx,
883 const char *dn,
884 const char **_parent_dn)
885{
886 struct ldb_dn *ldb_dn;
887 struct ldb_dn *parent_ldb_dn;
888 const char *p;
889 int ret;
890 TALLOC_CTX *tmp_ctx = NULL((void*)0);
891
892 tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c"
":" "892")
;
893 if (tmp_ctx == NULL((void*)0)) {
894 ret = ENOMEM12;
895 goto done;
896 }
897
898 ldb_dn = ldb_dn_new(tmp_ctx, ldb_ctx, dn);
899 parent_ldb_dn = ldb_dn_get_parent(tmp_ctx, ldb_dn);
900 p = ldb_dn_get_linearized(parent_ldb_dn);
901
902 *_parent_dn = talloc_steal(mem_ctx, p)({ __typeof__(p) __talloc_steal_ret = (__typeof__(p))_talloc_steal_loc
((mem_ctx),(p), "../sssd/src/providers/ad/ad_gpo.c" ":" "902"
); __talloc_steal_ret; })
;
903 ret = EOK0;
904
905 done:
906 talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":"
"906")
;
907 return ret;
908}
909
910/*
911 * This function populates the _som_list output parameter by parsing the input
912 * DN into a list of gp_som objects. This function essentially repeatedly
913 * appends the input DN's parent to the SOM List (if the parent starts with
914 * "OU=" or "DC="), until the first "DC=" component is reached.
915 * Example: if input DN is "CN=MyComputer,CN=Computers,OU=Sales,DC=FOO,DC=COM",
916 * then SOM List has 2 SOM entries: {[OU=Sales,DC=FOO,DC=COM], [DC=FOO, DC=COM]}
917 */
918
919static errno_t
920ad_gpo_populate_som_list(TALLOC_CTX *mem_ctx,
921 struct ldb_context *ldb_ctx,
922 const char *target_dn,
923 int *_num_soms,
924 struct gp_som ***_som_list)
925{
926 TALLOC_CTX *tmp_ctx = NULL((void*)0);
927 int ret;
928 int rdn_count = 0;
929 int som_idx = 0;
930 struct gp_som **som_list;
931 const char *parent_dn = NULL((void*)0);
932 const char *tmp_dn = NULL((void*)0);
933 struct ldb_dn *ldb_target_dn;
934
935 tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c"
":" "935")
;
936 if (tmp_ctx == NULL((void*)0)) {
937 ret = ENOMEM12;
938 goto done;
939 }
940
941 ldb_target_dn = ldb_dn_new(tmp_ctx, ldb_ctx, target_dn);
942 rdn_count = ldb_dn_get_comp_num(ldb_target_dn);
943
944 if (rdn_count == 0) {
945 *_som_list = NULL((void*)0);
946 ret = EOK0;
947 goto done;
948 }
949
950 /* assume the worst-case, in which every parent is a SOM */
951 /* include space for Site SOM and NULL: rdn_count + 1 + 1 */
952 som_list = talloc_array(tmp_ctx, struct gp_som *, rdn_count + 1 + 1)(struct gp_som * *)_talloc_array(tmp_ctx, sizeof(struct gp_som
*), rdn_count + 1 + 1, "struct gp_som *")
;
953 if (som_list == NULL((void*)0)) {
954 ret = ENOMEM12;
955 goto done;
956 }
957
958 /* first, populate the OU and Domain SOMs */
959 tmp_dn = target_dn;;
960 while ((ad_gpo_parent_dn(tmp_ctx, ldb_ctx, tmp_dn, &parent_dn)) == EOK0) {
961
962 if ((strncasecmp(parent_dn, "OU=", strlen("OU=")) == 0) ||
963 (strncasecmp(parent_dn, "DC=", strlen("DC=")) == 0)) {
964
965 som_list[som_idx] = talloc_zero(som_list, struct gp_som)(struct gp_som *)_talloc_zero(som_list, sizeof(struct gp_som)
, "struct gp_som")
;
966 if (som_list[som_idx] == NULL((void*)0)) {
967 ret = ENOMEM12;
968 goto done;
969 }
970 som_list[som_idx]->som_dn = talloc_steal(som_list[som_idx],({ __typeof__(parent_dn) __talloc_steal_ret = (__typeof__(parent_dn
))_talloc_steal_loc((som_list[som_idx]),(parent_dn), "../sssd/src/providers/ad/ad_gpo.c"
":" "971"); __talloc_steal_ret; })
971 parent_dn)({ __typeof__(parent_dn) __talloc_steal_ret = (__typeof__(parent_dn
))_talloc_steal_loc((som_list[som_idx]),(parent_dn), "../sssd/src/providers/ad/ad_gpo.c"
":" "971"); __talloc_steal_ret; })
;
972 if (som_list[som_idx]->som_dn == NULL((void*)0)) {
973 ret = ENOMEM12;
974 goto done;
975 }
976 som_idx++;
977 }
978
979 if (strncasecmp(parent_dn, "DC=", strlen("DC=")) == 0) {
980 break;
981 }
982 tmp_dn = parent_dn;
983 }
984
985 som_list[som_idx] = NULL((void*)0);
986
987 *_num_soms = som_idx;
988 *_som_list = talloc_steal(mem_ctx, som_list)({ __typeof__(som_list) __talloc_steal_ret = (__typeof__(som_list
))_talloc_steal_loc((mem_ctx),(som_list), "../sssd/src/providers/ad/ad_gpo.c"
":" "988"); __talloc_steal_ret; })
;
989
990 ret = EOK0;
991
992 done:
993 talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":"
"993")
;
994 return ret;
995}
996
997/*
998 * This function populates the _gplink_list output parameter by parsing the
999 * input raw_gplink_value into an array of gp_gplink objects, each consisting of
1000 * a GPO DN and bool enforced field.
1001 *
1002 * The raw_gplink_value is single string consisting of multiple gplink strings.
1003 * The raw_gplink_value is in the following format:
1004 * "[GPO_DN_1;GPLinkOptions_1]...[GPO_DN_n;GPLinkOptions_n]"
1005 *
1006 * Each gplink string consists of a GPO DN and a GPLinkOptions field (which
1007 * indicates whether its associated GPO DN is ignored, unenforced, or enforced).
1008 * If a GPO DN is flagged as ignored, it is discarded and will not be added to
1009 * the _gplink_list. If the allow_enforced_only input is true, AND a GPO DN is
1010 * flagged as unenforced, it will also be discarded.
1011 *
1012 * Example: if raw_gplink_value="[OU=Sales,DC=FOO,DC=COM;0][DC=FOO,DC=COM;2]"
1013 * and allow_enforced_only=FALSE, then the output would consist of following:
1014 * _gplink_list[0]: {GPO DN: "OU=Sales,DC=FOO,DC=COM", enforced: FALSE}
1015 * _gplink_list[1]: {GPO DN: "DC=FOO,DC=COM", enforced: TRUE}
1016 */
1017static errno_t
1018ad_gpo_populate_gplink_list(TALLOC_CTX *mem_ctx,
1019 const char *som_dn,
1020 char *raw_gplink_value,
1021 struct gp_gplink ***_gplink_list,
1022 bool_Bool allow_enforced_only)
1023{
1024 TALLOC_CTX *tmp_ctx = NULL((void*)0);
1025 char *ptr;
1026 char *first;
1027 char *last;
1028 char *dn;
1029 char *gplink_options;
1030 const char delim = ']';
1031 struct gp_gplink **gplink_list;
1032 int i;
1033 int ret;
1034 uint32_t gplink_number;
1035 int gplink_count = 0;
1036 int num_enabled = 0;
1037
1038 if (raw_gplink_value == NULL((void*)0) ||
1039 *raw_gplink_value == '\0' ||
1040 _gplink_list == NULL((void*)0)) {
1041 return EINVAL22;
1042 }
1043
1044 DEBUG(SSSDBG_TRACE_ALL, "som_dn: %s\n", som_dn)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1044, __FUNCTION__, __debug_macro_level, "som_dn: %s\n", som_dn
); } } while (0)
;
1045 tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c"
":" "1045")
;
1046 if (tmp_ctx == NULL((void*)0)) {
1047 ret = ENOMEM12;
1048 goto done;
1049 }
1050
1051 ptr = raw_gplink_value;
1052
1053 while ((ptr = strchr(ptr, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p
(ptr) && (delim) == '\0' ? (char *) __rawmemchr (ptr
, delim) : __builtin_strchr (ptr, delim)))
)) {
1054 ptr++;
1055 gplink_count++;
1056 }
1057
1058 if (gplink_count == 0) {
1059 ret = EINVAL22;
1060 goto done;
1061 }
1062
1063 gplink_list = talloc_array(tmp_ctx, struct gp_gplink *, gplink_count + 1)(struct gp_gplink * *)_talloc_array(tmp_ctx, sizeof(struct gp_gplink
*), gplink_count + 1, "struct gp_gplink *")
;
1064 if (gplink_list == NULL((void*)0)) {
1065 ret = ENOMEM12;
1066 goto done;
1067 }
1068
1069 num_enabled = 0;
1070 ptr = raw_gplink_value;
1071 for (i = 0; i < gplink_count; i++) {
1072 first = ptr + 1;
1073 last = strchr(first, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p
(first) && (delim) == '\0' ? (char *) __rawmemchr (first
, delim) : __builtin_strchr (first, delim)))
;
1074 if (last == NULL((void*)0)) {
1075 break;
1076 }
1077 *last = '\0';
1078 last++;
1079 dn = first;
1080 if ( strncasecmp(dn, "LDAP://", 7)== 0 ) {
1081 dn = dn + 7;
1082 }
1083 gplink_options = strchr(first, ';')(__extension__ (__builtin_constant_p (';') && !__builtin_constant_p
(first) && (';') == '\0' ? (char *) __rawmemchr (first
, ';') : __builtin_strchr (first, ';')))
;
1084 if (gplink_options == NULL((void*)0)) {
1085 continue;
1086 }
1087 *gplink_options = '\0';
1088 gplink_options++;
1089
1090 gplink_number = strtouint32(gplink_options, NULL((void*)0), 10);
1091 if (errno(*__errno_location ()) != 0) {
1092 ret = errno(*__errno_location ());
1093 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1094, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1094 "strtouint32 failed: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1094, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1095 goto done;
1096 }
1097
1098 DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1099, __FUNCTION__, __debug_macro_level, "gplink_list[%d]: [%s; %d]\n"
, num_enabled, dn, gplink_number); } } while (0)
1099 "gplink_list[%d]: [%s; %d]\n", num_enabled, dn, gplink_number)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1099, __FUNCTION__, __debug_macro_level, "gplink_list[%d]: [%s; %d]\n"
, num_enabled, dn, gplink_number); } } while (0)
;
1100
1101 if ((gplink_number == 1) || (gplink_number ==3)) {
1102 /* ignore flag is set */
1103 DEBUG(SSSDBG_TRACE_ALL, "ignored gpo skipped\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1103, __FUNCTION__, __debug_macro_level, "ignored gpo skipped\n"
); } } while (0)
;
1104 ptr = last;
1105 continue;
1106 }
1107
1108 if (allow_enforced_only && (gplink_number == 0)) {
1109 /* unenforced flag is set; only enforced gpos allowed */
1110 DEBUG(SSSDBG_TRACE_ALL, "unenforced gpo skipped\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1110, __FUNCTION__, __debug_macro_level, "unenforced gpo skipped\n"
); } } while (0)
;
1111 ptr = last;
1112 continue;
1113 }
1114
1115 gplink_list[num_enabled] = talloc_zero(gplink_list, struct gp_gplink)(struct gp_gplink *)_talloc_zero(gplink_list, sizeof(struct gp_gplink
), "struct gp_gplink")
;
1116 if (gplink_list[num_enabled] == NULL((void*)0)) {
1117 ret = ENOMEM12;
1118 goto done;
1119 }
1120 gplink_list[num_enabled]->gpo_dn =
1121 talloc_strdup(gplink_list[num_enabled], dn);
1122
1123 if (gplink_list[num_enabled]->gpo_dn == NULL((void*)0)) {
1124 ret = ENOMEM12;
1125 goto done;
1126 }
1127
1128 if (gplink_number == 0) {
1129 gplink_list[num_enabled]->enforced = 0;
1130 num_enabled++;
1131 } else if (gplink_number == 2) {
1132 gplink_list[num_enabled]->enforced = 1;
1133 num_enabled++;
1134 } else {
1135 ret = EINVAL22;
1136 goto done;
1137 }
1138
1139 ptr = last;
1140 }
1141 gplink_list[num_enabled] = NULL((void*)0);
1142
1143 *_gplink_list = talloc_steal(mem_ctx, gplink_list)({ __typeof__(gplink_list) __talloc_steal_ret = (__typeof__(gplink_list
))_talloc_steal_loc((mem_ctx),(gplink_list), "../sssd/src/providers/ad/ad_gpo.c"
":" "1143"); __talloc_steal_ret; })
;
1144 ret = EOK0;
1145
1146 done:
1147 talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":"
"1147")
;
1148 return ret;
1149}
1150
1151/* == ad_gpo_process_som_send/recv implementation ========================== */
1152
1153struct ad_gpo_process_som_state {
1154 struct tevent_context *ev;
1155 struct sdap_id_op *sdap_op;
1156 struct sdap_options *opts;
1157 int timeout;
1158 bool_Bool allow_enforced_only;
1159 char *site_name;
1160 char *site_dn;
1161 struct gp_som **som_list;
1162 int som_index;
1163 int num_soms;
1164};
1165
1166static void ad_gpo_site_name_retrieval_done(struct tevent_req *subreq);
1167static void ad_gpo_site_dn_retrieval_done(struct tevent_req *subreq);
1168static errno_t ad_gpo_get_som_attrs_step(struct tevent_req *req);
1169static void ad_gpo_get_som_attrs_done(struct tevent_req *subreq);
1170
1171
1172/*
1173 * This function uses the input target_dn and input domain_name to populate
1174 * a list of gp_som objects. Each object in this list represents a SOM
1175 * associated with the target (such as OU, Domain, and Site).
1176 *
1177 * The inputs are used to determine the DNs of each SOM associated with the
1178 * target. In turn, the SOM object DNs are used to retrieve certain LDAP
1179 * attributes of each SOM object, that are parsed into an array of gp_gplink
1180 * objects, essentially representing the GPOs that have been linked to each
1181 * SOM object. Note that it is perfectly valid for there to be *no* GPOs
1182 * linked to a SOM object.
1183 */
1184struct tevent_req *
1185ad_gpo_process_som_send(TALLOC_CTX *mem_ctx,
1186 struct tevent_context *ev,
1187 struct sdap_id_conn_ctx *conn,
1188 struct ldb_context *ldb_ctx,
1189 struct sdap_id_op *sdap_op,
1190 struct sdap_options *opts,
1191 int timeout,
1192 const char *target_dn,
1193 const char *domain_name)
1194{
1195 struct tevent_req *req;
1196 struct tevent_req *subreq;
1197 struct ad_gpo_process_som_state *state;
1198 errno_t ret;
1199
1200 req = tevent_req_create(mem_ctx, &state, struct ad_gpo_process_som_state)_tevent_req_create((mem_ctx), (&state), sizeof(struct ad_gpo_process_som_state
), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "1200")
;
1201 if (req == NULL((void*)0)) {
1202 DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n")do { int __debug_macro_level = 0x0020; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1202, __FUNCTION__, __debug_macro_level, "tevent_req_create() failed\n"
); } } while (0)
;
1203 return NULL((void*)0);
1204 }
1205
1206 state->ev = ev;
1207 state->sdap_op = sdap_op;
1208 state->opts = opts;
1209 state->timeout = timeout;
1210 state->som_index = -1;
1211 state->allow_enforced_only = 0;
1212
1213 ret = ad_gpo_populate_som_list(state, ldb_ctx, target_dn,
1214 &state->num_soms, &state->som_list);
1215 if (ret != EOK0) {
1216 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1218, __FUNCTION__, __debug_macro_level, "Unable to retrieve SOM List : [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1217 "Unable to retrieve SOM List : [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1218, __FUNCTION__, __debug_macro_level, "Unable to retrieve SOM List : [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1218 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1218, __FUNCTION__, __debug_macro_level, "Unable to retrieve SOM List : [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1219 ret = ENOENT2;
1220 goto immediately;
1221 }
1222
1223 if (state->som_list == NULL((void*)0)) {
1224 DEBUG(SSSDBG_OP_FAILURE, "target dn must have at least one parent\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1224, __FUNCTION__, __debug_macro_level, "target dn must have at least one parent\n"
); } } while (0)
;
1225 ret = EINVAL22;
1226 goto immediately;
1227 }
1228
1229 subreq = ad_master_domain_send(state, state->ev, conn,
1230 state->sdap_op, domain_name);
1231
1232 if (subreq == NULL((void*)0)) {
1233 DEBUG(SSSDBG_OP_FAILURE, "ad_master_domain_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1233, __FUNCTION__, __debug_macro_level, "ad_master_domain_send failed.\n"
); } } while (0)
;
1234 ret = ENOMEM12;
1235 goto immediately;
1236 }
1237
1238 tevent_req_set_callback(subreq, ad_gpo_site_name_retrieval_done, req);
1239
1240 ret = EOK0;
1241
1242 immediately:
1243
1244 if (ret != EOK0) {
1245 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "1245")
;
1246 tevent_req_post(req, ev);
1247 }
1248
1249 return req;
1250}
1251
1252static void
1253ad_gpo_site_name_retrieval_done(struct tevent_req *subreq)
1254{
1255 struct tevent_req *req;
1256 struct ad_gpo_process_som_state *state;
1257 int ret;
1258 char *site;
1259 const char *attrs[] = {AD_AT_CONFIG_NC"configurationNamingContext", NULL((void*)0)};
1260
1261 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "1261")
;
1262 state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "1262")
;
1263
1264 /* gpo code only cares about the site name */
1265 ret = ad_master_domain_recv(subreq, state, NULL((void*)0), NULL((void*)0), &site, NULL((void*)0));
1266 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "1266"); subreq = ((void*)0); } while(0)
;
1267
1268 if (ret != EOK0) {
1269 DEBUG(SSSDBG_OP_FAILURE, "Cannot retrieve master domain info\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1269, __FUNCTION__, __debug_macro_level, "Cannot retrieve master domain info\n"
); } } while (0)
;
1270 tevent_req_error(req, ENOENT)_tevent_req_error(req, 2, "../sssd/src/providers/ad/ad_gpo.c"
":" "1270")
;
1271 return;
1272 }
1273
1274 state->site_name = talloc_asprintf(state, "cn=%s", site);
1275 if (state->site_name == NULL((void*)0)) {
1276 tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c"
":" "1276")
;
1277 return;
1278 }
1279
1280 /*
1281 * note: the configNC attribute is being retrieved here from the rootDSE
1282 * entry. In future, since we already make an LDAP query for the rootDSE
1283 * entry when LDAP connection is made, this attribute should really be
1284 * retrieved at that point (see https://fedorahosted.org/sssd/ticket/2276)
1285 */
1286 subreq = sdap_get_generic_send(state, state->ev, state->opts,
1287 sdap_id_op_handle(state->sdap_op),
1288 "", LDAP_SCOPE_BASE((ber_int_t) 0x0000),
1289 "(objectclass=*)", attrs, NULL((void*)0), 0,
1290 state->timeout,
1291 false0);
1292
1293 if (subreq == NULL((void*)0)) {
1294 DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1294, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n"
); } } while (0)
;
1295 tevent_req_error(req, ENOMEM)_tevent_req_error(req, 12, "../sssd/src/providers/ad/ad_gpo.c"
":" "1295")
;
1296 return;
1297 }
1298
1299 tevent_req_set_callback(subreq, ad_gpo_site_dn_retrieval_done, req);
1300}
1301
1302static void
1303ad_gpo_site_dn_retrieval_done(struct tevent_req *subreq)
1304{
1305 struct tevent_req *req;
1306 struct ad_gpo_process_som_state *state;
1307 int ret;
1308 int dp_error;
1309 int i = 0;
1310 size_t reply_count;
1311 struct sysdb_attrs **reply;
1312 const char *configNC;
1313
1314 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "1314")
;
1315 state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "1315")
;
1316
1317 ret = sdap_get_generic_recv(subreq, state,
1318 &reply_count, &reply);
1319 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "1319"); subreq = ((void*)0); } while(0)
;
1320 if (ret != EOK0) {
1321 ret = sdap_id_op_done(state->sdap_op, ret, &dp_error);
1322 /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */
1323
1324 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1325, __FUNCTION__, __debug_macro_level, "Unable to get configNC: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1325 "Unable to get configNC: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1325, __FUNCTION__, __debug_macro_level, "Unable to get configNC: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1326 ret = ENOENT2;
1327 goto done;
1328 }
1329
1330 /* make sure there is only one non-NULL reply returned */
1331
1332 if (reply_count < 1) {
1333 DEBUG(SSSDBG_OP_FAILURE, "No configNC retrieved\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1333, __FUNCTION__, __debug_macro_level, "No configNC retrieved\n"
); } } while (0)
;
1334 ret = ENOENT2;
1335 goto done;
1336 } else if (reply_count > 1) {
1337 DEBUG(SSSDBG_OP_FAILURE, "Multiple replies for configNC\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1337, __FUNCTION__, __debug_macro_level, "Multiple replies for configNC\n"
); } } while (0)
;
1338 ret = ERR_INTERNAL;
1339 goto done;
1340 } else if (reply == NULL((void*)0)) {
1341 DEBUG(SSSDBG_OP_FAILURE, "reply_count is 1, but reply is NULL\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1341, __FUNCTION__, __debug_macro_level, "reply_count is 1, but reply is NULL\n"
); } } while (0)
;
1342 ret = ERR_INTERNAL;
1343 goto done;
1344 }
1345
1346 /* reply[0] holds requested attributes of single reply */
1347 ret = sysdb_attrs_get_string(reply[0], AD_AT_CONFIG_NC"configurationNamingContext", &configNC);
1348 if (ret != EOK0) {
1349 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1351, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1350 "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1351, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1351 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1351, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1352 goto done;
1353 }
1354 state->site_dn =
1355 talloc_asprintf(state, "%s,cn=Sites,%s", state->site_name, configNC);
1356 if (state->site_dn == NULL((void*)0)) {
1357 ret = ENOMEM12;
1358 goto done;
1359 }
1360
1361 /* note that space was allocated for site_dn when allocating som_list */
1362 state->som_list[state->num_soms] =
1363 talloc_zero(state->som_list, struct gp_som)(struct gp_som *)_talloc_zero(state->som_list, sizeof(struct
gp_som), "struct gp_som")
;
1364 if (state->som_list[state->num_soms] == NULL((void*)0)) {
1365 ret = ENOMEM12;
1366 goto done;
1367 }
1368
1369 state->som_list[state->num_soms]->som_dn =
1370 talloc_steal(state->som_list[state->num_soms], state->site_dn)({ __typeof__(state->site_dn) __talloc_steal_ret = (__typeof__
(state->site_dn))_talloc_steal_loc((state->som_list[state
->num_soms]),(state->site_dn), "../sssd/src/providers/ad/ad_gpo.c"
":" "1370"); __talloc_steal_ret; })
;
1371
1372 if (state->som_list[state->num_soms]->som_dn == NULL((void*)0)) {
1373 ret = ENOMEM12;
1374 goto done;
1375 }
1376
1377 state->num_soms++;
1378 state->som_list[state->num_soms] = NULL((void*)0);
1379
1380 i = 0;
1381 while (state->som_list[i]) {
1382 DEBUG(SSSDBG_TRACE_FUNC, "som_list[%d]->som_dn is %s\n", i,do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1383, __FUNCTION__, __debug_macro_level, "som_list[%d]->som_dn is %s\n"
, i, state->som_list[i]->som_dn); } } while (0)
1383 state->som_list[i]->som_dn)do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1383, __FUNCTION__, __debug_macro_level, "som_list[%d]->som_dn is %s\n"
, i, state->som_list[i]->som_dn); } } while (0)
;
1384 i++;
1385 }
1386
1387 ret = ad_gpo_get_som_attrs_step(req);
1388
1389 done:
1390
1391 if (ret == EOK0) {
1392 tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":"
"1392")
;
1393 } else if (ret != EAGAIN11) {
1394 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "1394")
;
1395 }
1396
1397}
1398static errno_t
1399ad_gpo_get_som_attrs_step(struct tevent_req *req)
1400{
1401 const char *attrs[] = {AD_AT_GPLINK"gPLink", AD_AT_GPOPTIONS"gpOptions", NULL((void*)0)};
1402 struct tevent_req *subreq;
1403 struct ad_gpo_process_som_state *state;
1404
1405 state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "1405")
;
1406
1407 state->som_index++;
1408 struct gp_som *gp_som = state->som_list[state->som_index];
1409
1410 /* gp_som is NULL only after all SOMs have been processed */
1411 if (gp_som == NULL((void*)0)) return EOK0;
1412
1413 const char *som_dn = gp_som->som_dn;
1414 subreq = sdap_get_generic_send(state, state->ev, state->opts,
1415 sdap_id_op_handle(state->sdap_op),
1416 som_dn, LDAP_SCOPE_BASE((ber_int_t) 0x0000),
1417 "(objectclass=*)", attrs, NULL((void*)0), 0,
1418 state->timeout,
1419 false0);
1420
1421 if (subreq == NULL((void*)0)) {
1422 DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1422, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n"
); } } while (0)
;
1423 return ENOMEM12;
1424 }
1425
1426 tevent_req_set_callback(subreq, ad_gpo_get_som_attrs_done, req);
1427 return EAGAIN11;
1428}
1429
1430static void
1431ad_gpo_get_som_attrs_done(struct tevent_req *subreq)
1432{
1433 struct tevent_req *req;
1434 struct ad_gpo_process_som_state *state;
1435 int ret;
1436 int dp_error;
1437 size_t num_results;
1438 struct sysdb_attrs **results;
1439 struct ldb_message_element *el = NULL((void*)0);
1440 uint8_t *raw_gplink_value;
1441 uint8_t *raw_gpoptions_value;
1442 uint32_t allow_enforced_only = 0;
1443 struct gp_som *gp_som;
1444
1445 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "1445")
;
1446 state = tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "1446")
;
1447 ret = sdap_get_generic_recv(subreq, state,
1448 &num_results, &results);
1449 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "1449"); subreq = ((void*)0); } while(0)
;
1450
1451 if (ret != EOK0) {
1452 ret = sdap_id_op_done(state->sdap_op, ret, &dp_error);
1453 /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */
1454
1455 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1457, __FUNCTION__, __debug_macro_level, "Unable to get SOM attributes: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1456 "Unable to get SOM attributes: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1457, __FUNCTION__, __debug_macro_level, "Unable to get SOM attributes: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1457 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1457, __FUNCTION__, __debug_macro_level, "Unable to get SOM attributes: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1458 ret = ENOENT2;
1459 goto done;
1460 }
1461 if ((num_results < 1) || (results == NULL((void*)0))) {
1462 DEBUG(SSSDBG_OP_FAILURE, "no attrs found for SOM; try next SOM.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1462, __FUNCTION__, __debug_macro_level, "no attrs found for SOM; try next SOM.\n"
); } } while (0)
;
1463 ret = ad_gpo_get_som_attrs_step(req);
1464 goto done;
1465 } else if (num_results > 1) {
1466 DEBUG(SSSDBG_OP_FAILURE, "Received multiple replies\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1466, __FUNCTION__, __debug_macro_level, "Received multiple replies\n"
); } } while (0)
;
1467 ret = ERR_INTERNAL;
1468 goto done;
1469 }
1470
1471 /* Get the gplink value, if available */
1472 ret = sysdb_attrs_get_el(results[0], AD_AT_GPLINK"gPLink", &el);
1473
1474 if (ret != EOK0 && ret != ENOENT2) {
1475 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1477, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1476 "sysdb_attrs_get_el() failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1477, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1477 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1477, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1478 goto done;
1479 }
1480
1481 if ((ret == ENOENT2) || (el->num_values == 0)) {
1482 DEBUG(SSSDBG_OP_FAILURE, "no attrs found for SOM; try next SOM\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1482, __FUNCTION__, __debug_macro_level, "no attrs found for SOM; try next SOM\n"
); } } while (0)
;
1483 ret = ad_gpo_get_som_attrs_step(req);
1484 goto done;
1485 }
1486
1487 raw_gplink_value = el[0].values[0].data;
1488
1489 ret = sysdb_attrs_get_el(results[0], AD_AT_GPOPTIONS"gpOptions", &el);
1490
1491 if (ret != EOK0 && ret != ENOENT2) {
1492 DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_el() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1492, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed\n"
); } } while (0)
;
1493 goto done;
1494 }
1495
1496 if ((ret == ENOENT2) || (el->num_values == 0)) {
1497 DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1498, __FUNCTION__, __debug_macro_level, "gpoptions attr not found or has no value; defaults to 0\n"
); } } while (0)
1498 "gpoptions attr not found or has no value; defaults to 0\n")do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1498, __FUNCTION__, __debug_macro_level, "gpoptions attr not found or has no value; defaults to 0\n"
); } } while (0)
;
1499 allow_enforced_only = 0;
1500 } else {
1501 raw_gpoptions_value = el[0].values[0].data;
1502 allow_enforced_only = strtouint32((char *)raw_gpoptions_value, NULL((void*)0), 10);
1503 if (errno(*__errno_location ()) != 0) {
1504 ret = errno(*__errno_location ());
1505 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1506, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1506 "strtouint32 failed: [%d](%s)\n", ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1506, __FUNCTION__, __debug_macro_level, "strtouint32 failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1507 goto done;
1508 }
1509 }
1510
1511 gp_som = state->som_list[state->som_index];
1512 ret = ad_gpo_populate_gplink_list(gp_som,
1513 gp_som->som_dn,
1514 (char *)raw_gplink_value,
1515 &gp_som->gplink_list,
1516 state->allow_enforced_only);
1517
1518 if (ret != EOK0) {
1519 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1520, __FUNCTION__, __debug_macro_level, "ad_gpo_populate_gplink_list() failed\n"
); } } while (0)
1520 "ad_gpo_populate_gplink_list() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1520, __FUNCTION__, __debug_macro_level, "ad_gpo_populate_gplink_list() failed\n"
); } } while (0)
;
1521 goto done;
1522 }
1523
1524 if (allow_enforced_only) {
1525 state->allow_enforced_only = 1;
1526 }
1527
1528 ret = ad_gpo_get_som_attrs_step(req);
1529
1530 done:
1531
1532 if (ret == EOK0) {
1533 tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":"
"1533")
;
1534 } else if (ret != EAGAIN11) {
1535 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "1535")
;
1536 }
1537}
1538
1539int
1540ad_gpo_process_som_recv(struct tevent_req *req,
1541 TALLOC_CTX *mem_ctx,
1542 struct gp_som ***som_list)
1543{
1544
1545 struct ad_gpo_process_som_state *state =
1546 tevent_req_data(req, struct ad_gpo_process_som_state)(struct ad_gpo_process_som_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_som_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "1546")
;
1547
1548 TEVENT_REQ_RETURN_ON_ERROR(req)do { enum tevent_req_state TRROEstate; uint64_t TRROEerr; if (
tevent_req_is_error(req, &TRROEstate, &TRROEerr)) { if
(TRROEstate == TEVENT_REQ_USER_ERROR) { return TRROEerr; } return
ERR_INTERNAL; } } while (0)
;
1549 *som_list = talloc_steal(mem_ctx, state->som_list)({ __typeof__(state->som_list) __talloc_steal_ret = (__typeof__
(state->som_list))_talloc_steal_loc((mem_ctx),(state->som_list
), "../sssd/src/providers/ad/ad_gpo.c" ":" "1549"); __talloc_steal_ret
; })
;
1550 return EOK0;
1551}
1552
1553/* == ad_gpo_process_gpo_send/recv helpers ================================= */
1554
1555/*
1556 * This function examines the gp_gplink objects in each gp_som object specified
1557 * in the input som_list, and populates the _candidate_gpos output parameter's
1558 * gpo_dn fields with prioritized list of GPO DNs. Prioritization ensures that:
1559 * - GPOs linked to an OU will be applied after GPOs linked to a Domain,
1560 * which will be applied after GPOs linked to a Site.
1561 * - multiple GPOs linked to a single SOM are applied in their link order
1562 * (i.e. 1st GPO linked to SOM is applied after 2nd GPO linked to SOM, etc).
1563 * - enforced GPOs are applied after unenforced GPOs.
1564 *
1565 * As such, the _candidate_gpos output's dn fields looks like (in link order):
1566 * [unenforced {Site, Domain, OU}; enforced {Site, Domain, OU}]
1567 *
1568 * Note that in the case of conflicting policy settings, GPOs appearing later
1569 * in the list will trump GPOs appearing earlier in the list.
1570 */
1571static errno_t
1572ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
1573 struct gp_som **som_list,
1574 struct gp_gpo ***_candidate_gpos,
1575 int *_num_candidate_gpos)
1576{
1577
1578 TALLOC_CTX *tmp_ctx = NULL((void*)0);
1579 struct gp_som *gp_som = NULL((void*)0);
1580 struct gp_gplink *gp_gplink = NULL((void*)0);
1581 struct gp_gpo **candidate_gpos = NULL((void*)0);
1582 int num_candidate_gpos = 0;
1583 const char **enforced_gpo_dns = NULL((void*)0);
1584 const char **unenforced_gpo_dns = NULL((void*)0);
1585 int gpo_dn_idx = 0;
1586 int num_enforced = 0;
1587 int enforced_idx = 0;
1588 int num_unenforced = 0;
1589 int unenforced_idx = 0;
1590 int i = 0;
1591 int j = 0;
1592 int ret;
1593
1594 tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c"
":" "1594")
;
1595 if (tmp_ctx == NULL((void*)0)) {
1596 ret = ENOMEM12;
1597 goto done;
1598 }
1599
1600 while (som_list[i]) {
1601 gp_som = som_list[i];
1602 j = 0;
1603 while (gp_som && gp_som->gplink_list && gp_som->gplink_list[j]) {
1604 gp_gplink = gp_som->gplink_list[j];
1605 if (gp_gplink == NULL((void*)0)) {
1606 DEBUG(SSSDBG_OP_FAILURE, "unexpected null gp_gplink\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1606, __FUNCTION__, __debug_macro_level, "unexpected null gp_gplink\n"
); } } while (0)
;
1607 ret = EINVAL22;
1608 goto done;
1609 }
1610 if (gp_gplink->enforced) {
1611 num_enforced++;
1612 } else {
1613 num_unenforced++;
1614 }
1615 j++;
1616 }
1617 i++;
1618 }
1619
1620 num_candidate_gpos = num_enforced + num_unenforced;
1621
1622 if (num_candidate_gpos == 0) {
1623 *_candidate_gpos = NULL((void*)0);
1624 *_num_candidate_gpos = 0;
1625 ret = EOK0;
1626 goto done;
1627 }
1628
1629 enforced_gpo_dns = talloc_array(tmp_ctx, const char *, num_enforced + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_enforced
+ 1, "const char *")
;
1630 if (enforced_gpo_dns == NULL((void*)0)) {
1631 ret = ENOMEM12;
1632 goto done;
1633 }
1634
1635 unenforced_gpo_dns = talloc_array(tmp_ctx, const char *, num_unenforced + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_unenforced
+ 1, "const char *")
;
1636 if (unenforced_gpo_dns == NULL((void*)0)) {
1637 ret = ENOMEM12;
1638 goto done;
1639 }
1640
1641 i = 0;
1642 while (som_list[i]) {
1643 gp_som = som_list[i];
1644 j = 0;
1645 while (gp_som && gp_som->gplink_list && gp_som->gplink_list[j]) {
1646 gp_gplink = gp_som->gplink_list[j];
1647 if (gp_gplink == NULL((void*)0)) {
1648 DEBUG(SSSDBG_OP_FAILURE, "unexpected null gp_gplink\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1648, __FUNCTION__, __debug_macro_level, "unexpected null gp_gplink\n"
); } } while (0)
;
1649 ret = EINVAL22;
1650 goto done;
1651 }
1652
1653 if (gp_gplink->enforced) {
1654 enforced_gpo_dns[enforced_idx] =
1655 talloc_steal(enforced_gpo_dns, gp_gplink->gpo_dn)({ __typeof__(gp_gplink->gpo_dn) __talloc_steal_ret = (__typeof__
(gp_gplink->gpo_dn))_talloc_steal_loc((enforced_gpo_dns),(
gp_gplink->gpo_dn), "../sssd/src/providers/ad/ad_gpo.c" ":"
"1655"); __talloc_steal_ret; })
;
1656 if (enforced_gpo_dns[enforced_idx] == NULL((void*)0)) {
1657 ret = ENOMEM12;
1658 goto done;
1659 }
1660 enforced_idx++;
1661 } else {
1662
1663 unenforced_gpo_dns[unenforced_idx] =
1664 talloc_steal(unenforced_gpo_dns, gp_gplink->gpo_dn)({ __typeof__(gp_gplink->gpo_dn) __talloc_steal_ret = (__typeof__
(gp_gplink->gpo_dn))_talloc_steal_loc((unenforced_gpo_dns)
,(gp_gplink->gpo_dn), "../sssd/src/providers/ad/ad_gpo.c" ":"
"1664"); __talloc_steal_ret; })
;
1665
1666 if (unenforced_gpo_dns[unenforced_idx] == NULL((void*)0)) {
1667 ret = ENOMEM12;
1668 goto done;
1669 }
1670 unenforced_idx++;
1671 }
1672 j++;
1673 }
1674 i++;
1675 }
1676 enforced_gpo_dns[num_enforced] = NULL((void*)0);
1677 unenforced_gpo_dns[num_unenforced] = NULL((void*)0);
1678
1679 candidate_gpos = talloc_array(tmp_ctx,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo
*), num_candidate_gpos + 1, "struct gp_gpo *")
1680 struct gp_gpo *,(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo
*), num_candidate_gpos + 1, "struct gp_gpo *")
1681 num_candidate_gpos + 1)(struct gp_gpo * *)_talloc_array(tmp_ctx, sizeof(struct gp_gpo
*), num_candidate_gpos + 1, "struct gp_gpo *")
;
1682
1683 if (candidate_gpos == NULL((void*)0)) {
1684 ret = ENOMEM12;
1685 goto done;
1686 }
1687
1688 gpo_dn_idx = 0;
1689 for (i = num_unenforced - 1; i >= 0; i--) {
1690 candidate_gpos[gpo_dn_idx] = talloc_zero(candidate_gpos, struct gp_gpo)(struct gp_gpo *)_talloc_zero(candidate_gpos, sizeof(struct gp_gpo
), "struct gp_gpo")
;
1691 if (candidate_gpos[gpo_dn_idx] == NULL((void*)0)) {
1692 ret = ENOMEM12;
1693 goto done;
1694 }
1695 candidate_gpos[gpo_dn_idx]->gpo_dn =
1696 talloc_steal(candidate_gpos[gpo_dn_idx], unenforced_gpo_dns[i])({ __typeof__(unenforced_gpo_dns[i]) __talloc_steal_ret = (__typeof__
(unenforced_gpo_dns[i]))_talloc_steal_loc((candidate_gpos[gpo_dn_idx
]),(unenforced_gpo_dns[i]), "../sssd/src/providers/ad/ad_gpo.c"
":" "1696"); __talloc_steal_ret; })
;
1697
1698 if (candidate_gpos[gpo_dn_idx]->gpo_dn == NULL((void*)0)) {
1699 ret = ENOMEM12;
1700 goto done;
1701 }
1702 DEBUG(SSSDBG_TRACE_FUNC,do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1704, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n"
, gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while
(0)
1703 "candidate_gpos[%d]->gpo_dn: %s\n",do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1704, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n"
, gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while
(0)
1704 gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn)do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1704, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n"
, gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while
(0)
;
1705 gpo_dn_idx++;
1706 }
1707
1708 for (i = 0; i < num_enforced; i++) {
1709
1710 candidate_gpos[gpo_dn_idx] = talloc_zero(candidate_gpos, struct gp_gpo)(struct gp_gpo *)_talloc_zero(candidate_gpos, sizeof(struct gp_gpo
), "struct gp_gpo")
;
1711 if (candidate_gpos[gpo_dn_idx] == NULL((void*)0)) {
1712 ret = ENOMEM12;
1713 goto done;
1714 }
1715
1716 candidate_gpos[gpo_dn_idx]->gpo_dn =
1717 talloc_steal(candidate_gpos[gpo_dn_idx], enforced_gpo_dns[i])({ __typeof__(enforced_gpo_dns[i]) __talloc_steal_ret = (__typeof__
(enforced_gpo_dns[i]))_talloc_steal_loc((candidate_gpos[gpo_dn_idx
]),(enforced_gpo_dns[i]), "../sssd/src/providers/ad/ad_gpo.c"
":" "1717"); __talloc_steal_ret; })
;
1718 if (candidate_gpos[gpo_dn_idx]->gpo_dn == NULL((void*)0)) {
1719 ret = ENOMEM12;
1720 goto done;
1721 }
1722
1723 DEBUG(SSSDBG_TRACE_FUNC,do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1725, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n"
, gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while
(0)
1724 "candidate_gpos[%d]->gpo_dn: %s\n",do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1725, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n"
, gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while
(0)
1725 gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn)do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1725, __FUNCTION__, __debug_macro_level, "candidate_gpos[%d]->gpo_dn: %s\n"
, gpo_dn_idx, candidate_gpos[gpo_dn_idx]->gpo_dn); } } while
(0)
;
1726 gpo_dn_idx++;
1727 }
1728
1729 candidate_gpos[gpo_dn_idx] = NULL((void*)0);
1730
1731 *_candidate_gpos = talloc_steal(mem_ctx, candidate_gpos)({ __typeof__(candidate_gpos) __talloc_steal_ret = (__typeof__
(candidate_gpos))_talloc_steal_loc((mem_ctx),(candidate_gpos)
, "../sssd/src/providers/ad/ad_gpo.c" ":" "1731"); __talloc_steal_ret
; })
;
1732 *_num_candidate_gpos = num_candidate_gpos;
1733
1734 ret = EOK0;
1735
1736 done:
1737 talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":"
"1737")
;
1738 return ret;
1739}
1740
1741/*
1742 * This function converts the input_path to an smb uri, which is used to
1743 * populate the _converted_path output parameter. The conversion consists of:
1744 * - prepending "smb:"
1745 * - replacing each forward slash ('\') with a back slash character ('/')
1746 */
1747static errno_t
1748ad_gpo_convert_to_smb_uri(TALLOC_CTX *mem_ctx,
1749 char *input_path,
1750 const char **_converted_path)
1751{
1752 char *ptr;
1753 const char delim = '\\';
1754 int ret;
1755 int num_seps = 0;
1756
1757 DEBUG(SSSDBG_TRACE_ALL, "input_path: %s\n", input_path)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1757, __FUNCTION__, __debug_macro_level, "input_path: %s\n"
, input_path); } } while (0)
;
1758
1759 if (input_path == NULL((void*)0) ||
1760 *input_path == '\0' ||
1761 _converted_path == NULL((void*)0)) {
1762 ret = EINVAL22;
1763 goto done;
1764 }
1765
1766 ptr = input_path;
1767 while ((ptr = strchr(ptr, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p
(ptr) && (delim) == '\0' ? (char *) __rawmemchr (ptr
, delim) : __builtin_strchr (ptr, delim)))
)) {
1768 *ptr = '/';
1769 ptr++;
1770 num_seps++;
1771 }
1772
1773 if (num_seps == 0) {
1774 ret = EINVAL22;
1775 goto done;
1776 }
1777
1778 *_converted_path = talloc_asprintf(mem_ctx, "smb:%s", input_path);
1779 ret = EOK0;
1780
1781 done:
1782 return ret;
1783}
1784
1785/*
1786 * This function populates the _cse_guid_list output parameter by parsing the
1787 * input raw_machine_ext_names_value into an array of cse_guid strings.
1788 *
1789 * The raw_machine_ext_names_value is a single string in the following format:
1790 * "[{cse_guid_1}{tool_guid1}]...[{cse_guid_n}{tool_guid_n}]"
1791 */
1792static errno_t
1793ad_gpo_parse_machine_ext_names(TALLOC_CTX *mem_ctx,
1794 char *raw_machine_ext_names_value,
1795 const char ***_gpo_cse_guids,
1796 int *_num_gpo_cse_guids)
1797{
1798 TALLOC_CTX *tmp_ctx = NULL((void*)0);
1799 char *ptr;
1800 char *first;
1801 char *last;
1802 char *cse_guid;
1803 char *tool_guid;
1804 const char delim = ']';
1805 const char **gpo_cse_guids;
1806 int i;
1807 int ret;
1808 int num_gpo_cse_guids = 0;
1809
1810 if (raw_machine_ext_names_value == NULL((void*)0) ||
1811 *raw_machine_ext_names_value == '\0' ||
1812 _gpo_cse_guids == NULL((void*)0)) {
1813 return EINVAL22;
1814 }
1815
1816 tmp_ctx = talloc_new(NULL)talloc_named_const(((void*)0), 0, "talloc_new: " "../sssd/src/providers/ad/ad_gpo.c"
":" "1816")
;
1817 if (tmp_ctx == NULL((void*)0)) {
1818 ret = ENOMEM12;
1819 goto done;
1820 }
1821
1822 ptr = raw_machine_ext_names_value;
1823 while ((ptr = strchr(ptr, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p
(ptr) && (delim) == '\0' ? (char *) __rawmemchr (ptr
, delim) : __builtin_strchr (ptr, delim)))
)) {
1824 ptr++;
1825 num_gpo_cse_guids++;
1826 }
1827
1828 if (num_gpo_cse_guids == 0) {
1829 ret = EINVAL22;
1830 goto done;
1831 }
1832
1833 gpo_cse_guids = talloc_array(tmp_ctx, const char *, num_gpo_cse_guids + 1)(const char * *)_talloc_array(tmp_ctx, sizeof(const char *), num_gpo_cse_guids
+ 1, "const char *")
;
1834 if (gpo_cse_guids == NULL((void*)0)) {
1835 ret = ENOMEM12;
1836 goto done;
1837 }
1838
1839 ptr = raw_machine_ext_names_value;
1840 for (i = 0; i < num_gpo_cse_guids; i++) {
1841 first = ptr + 1;
1842 last = strchr(first, delim)(__extension__ (__builtin_constant_p (delim) && !__builtin_constant_p
(first) && (delim) == '\0' ? (char *) __rawmemchr (first
, delim) : __builtin_strchr (first, delim)))
;
1843 if (last == NULL((void*)0)) {
1844 break;
1845 }
1846 *last = '\0';
1847 last++;
1848 cse_guid = first;
1849 first ++;
1850 tool_guid = strchr(first, '{')(__extension__ (__builtin_constant_p ('{') && !__builtin_constant_p
(first) && ('{') == '\0' ? (char *) __rawmemchr (first
, '{') : __builtin_strchr (first, '{')))
;
1851 if (tool_guid == NULL((void*)0)) {
1852 break;
1853 }
1854 *tool_guid = '\0';
1855 gpo_cse_guids[i] = talloc_strdup(gpo_cse_guids, cse_guid);
1856 ptr = last;
1857 }
1858 gpo_cse_guids[i] = NULL((void*)0);
1859
1860 DEBUG(SSSDBG_TRACE_ALL, "num_gpo_cse_guids: %d\n", num_gpo_cse_guids)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1860, __FUNCTION__, __debug_macro_level, "num_gpo_cse_guids: %d\n"
, num_gpo_cse_guids); } } while (0)
;
1861
1862 for (i = 0; i < num_gpo_cse_guids; i++) {
1863 DEBUG(SSSDBG_TRACE_ALL,do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1864, __FUNCTION__, __debug_macro_level, "gpo_cse_guids[%d] is %s\n"
, i, gpo_cse_guids[i]); } } while (0)
1864 "gpo_cse_guids[%d] is %s\n", i, gpo_cse_guids[i])do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1864, __FUNCTION__, __debug_macro_level, "gpo_cse_guids[%d] is %s\n"
, i, gpo_cse_guids[i]); } } while (0)
;
1865 }
1866
1867 *_gpo_cse_guids = talloc_steal(mem_ctx, gpo_cse_guids)({ __typeof__(gpo_cse_guids) __talloc_steal_ret = (__typeof__
(gpo_cse_guids))_talloc_steal_loc((mem_ctx),(gpo_cse_guids), "../sssd/src/providers/ad/ad_gpo.c"
":" "1867"); __talloc_steal_ret; })
;
1868 *_num_gpo_cse_guids = num_gpo_cse_guids;
1869 ret = EOK0;
1870
1871 done:
1872 talloc_free(tmp_ctx)_talloc_free(tmp_ctx, "../sssd/src/providers/ad/ad_gpo.c" ":"
"1872")
;
1873 return ret;
1874}
1875
1876enum ndr_err_code
1877ndr_pull_security_descriptor(struct ndr_pull *ndr, int ndr_flags,
1878 struct security_descriptor *r);
1879
1880/*
1881 * This function parses the input data blob and assigns the resulting
1882 * security_descriptor object to the _gpo_sd output parameter.
1883 */
1884static errno_t ad_gpo_parse_sd(TALLOC_CTX *mem_ctx,
1885 uint8_t *data,
1886 size_t length,
1887 struct security_descriptor **_gpo_sd)
1888{
1889
1890 struct ndr_pull *ndr_pull = NULL((void*)0);
1891 struct security_descriptor sd;
1892 DATA_BLOB blob;
1893
1894 blob.data = data;
1895 blob.length = length;
1896
1897 ndr_pull = ndr_pull_init_blob(&blob, mem_ctx);
1898 if (ndr_pull == NULL((void*)0)) {
1899 DEBUG(SSSDBG_OP_FAILURE, "ndr_pull_init_blob() failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1899, __FUNCTION__, __debug_macro_level, "ndr_pull_init_blob() failed.\n"
); } } while (0)
;
1900 return EINVAL22;
1901 }
1902
1903 ndr_pull_security_descriptor(ndr_pull, NDR_SCALARS0x100|NDR_BUFFERS0x200, &sd);
1904
1905 *_gpo_sd = talloc_memdup(mem_ctx, &sd, sizeof(struct security_descriptor))_talloc_memdup(mem_ctx, &sd, sizeof(struct security_descriptor
), "../sssd/src/providers/ad/ad_gpo.c" ":" "1905")
;
1906
1907 return EOK0;
1908}
1909
1910/* == ad_gpo_process_gpo_send/recv implementation ========================== */
1911
1912struct ad_gpo_process_gpo_state {
1913 struct tevent_context *ev;
1914 struct sdap_id_op *sdap_op;
1915 struct sdap_options *opts;
1916 int timeout;
1917 struct gp_gpo **candidate_gpos;
1918 int num_candidate_gpos;
1919 int gpo_index;
1920};
1921
1922static errno_t ad_gpo_get_gpo_attrs_step(struct tevent_req *req);
1923static void ad_gpo_get_gpo_attrs_done(struct tevent_req *subreq);
1924
1925/*
1926 * This function uses the input som_list to populate a prioritized list of
1927 * gp_gpo objects, prioritized based on SOM type, link order, and whether the
1928 * GPO is "enforced". This list represents the initial set of candidate GPOs
1929 * that might be applicable to the target. This list can not be expanded, but
1930 * it might be reduced based on subsequent filtering steps. The GPO object DNs
1931 * are used to retrieve certain LDAP attributes of each GPO object, that are
1932 * parsed into the various fields of the gp_gpo object.
1933 */
1934struct tevent_req *
1935ad_gpo_process_gpo_send(TALLOC_CTX *mem_ctx,
1936 struct tevent_context *ev,
1937 struct sdap_id_op *sdap_op,
1938 struct sdap_options *opts,
1939 int timeout,
1940 struct gp_som **som_list)
1941{
1942 struct tevent_req *req;
1943 struct ad_gpo_process_gpo_state *state;
1944 errno_t ret;
1945
1946 req = tevent_req_create(mem_ctx, &state, struct ad_gpo_process_gpo_state)_tevent_req_create((mem_ctx), (&state), sizeof(struct ad_gpo_process_gpo_state
), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "1946")
;
1947 if (req == NULL((void*)0)) {
1948 DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n")do { int __debug_macro_level = 0x0020; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1948, __FUNCTION__, __debug_macro_level, "tevent_req_create() failed\n"
); } } while (0)
;
1949 return NULL((void*)0);
1950 }
1951
1952 state->ev = ev;
1953 state->sdap_op = sdap_op;
1954 state->opts = opts;
1955 state->timeout = timeout;
1956 state->gpo_index = -1;
1957 state->candidate_gpos = NULL((void*)0);
1958 state->num_candidate_gpos = 0;
1959
1960 ret = ad_gpo_populate_candidate_gpos(state,
1961 som_list,
1962 &state->candidate_gpos,
1963 &state->num_candidate_gpos);
1964
1965 if (ret != EOK0) {
1966 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1968, __FUNCTION__, __debug_macro_level, "Unable to retrieve GPO List: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1967 "Unable to retrieve GPO List: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1968, __FUNCTION__, __debug_macro_level, "Unable to retrieve GPO List: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
1968 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1968, __FUNCTION__, __debug_macro_level, "Unable to retrieve GPO List: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
1969 ret = ENOENT2;
1970 goto immediately;
1971 }
1972
1973 if (state->candidate_gpos == NULL((void*)0)) {
1974 DEBUG(SSSDBG_OP_FAILURE, "no gpos found\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 1974, __FUNCTION__, __debug_macro_level, "no gpos found\n")
; } } while (0)
;
1975 ret = ENOENT2;
1976 goto immediately;
1977 }
1978
1979 ret = ad_gpo_get_gpo_attrs_step(req);
1980
1981immediately:
1982
1983 if (ret == EOK0) {
1984 tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":"
"1984")
;
1985 tevent_req_post(req, ev);
1986 } else if (ret != EAGAIN11) {
1987 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "1987")
;
1988 tevent_req_post(req, ev);
1989 }
1990
1991 return req;
1992}
1993
1994static errno_t
1995ad_gpo_get_gpo_attrs_step(struct tevent_req *req)
1996{
1997 const char *attrs[] = {AD_AT_NT_SEC_DESC"nTSecurityDescriptor", AD_AT_CN"cn", AD_AT_DISPLAY_NAME"displayName",
1998 AD_AT_FILE_SYS_PATH"gPCFileSysPath", AD_AT_VERSION_NUMBER"versionNumber",
1999 AD_AT_MACHINE_EXT_NAMES"gPCMachineExtensionNames", AD_AT_FUNC_VERSION"gPCFunctionalityVersion",
2000 AD_AT_FLAGS"flags", NULL((void*)0)};
2001 struct tevent_req *subreq;
2002 struct ad_gpo_process_gpo_state *state;
2003
2004 state = tevent_req_data(req, struct ad_gpo_process_gpo_state)(struct ad_gpo_process_gpo_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "2004")
;
2005
2006 state->gpo_index++;
2007 struct gp_gpo *gp_gpo = state->candidate_gpos[state->gpo_index];
2008
2009 /* gp_gpo is NULL only after all GPOs have been processed */
2010 if (gp_gpo == NULL((void*)0)) return EOK0;
2011
2012 const char *gpo_dn = gp_gpo->gpo_dn;
2013
2014 subreq = sdap_sd_search_send(state, state->ev,
2015 state->opts, sdap_id_op_handle(state->sdap_op),
2016 gpo_dn, SECINFO_DACL( 0x00000004 ), attrs, state->timeout);
2017
2018 if (subreq == NULL((void*)0)) {
2019 DEBUG(SSSDBG_OP_FAILURE, "sdap_get_generic_send failed.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2019, __FUNCTION__, __debug_macro_level, "sdap_get_generic_send failed.\n"
); } } while (0)
;
2020 return ENOMEM12;
2021 }
2022
2023 tevent_req_set_callback(subreq, ad_gpo_get_gpo_attrs_done, req);
2024 return EAGAIN11;
2025}
2026
2027static void
2028ad_gpo_get_gpo_attrs_done(struct tevent_req *subreq)
2029{
2030 struct tevent_req *req;
2031 struct ad_gpo_process_gpo_state *state;
2032 int ret;
2033 int dp_error;
2034 size_t num_results;
2035 struct sysdb_attrs **results;
2036 struct ldb_message_element *el = NULL((void*)0);
2037 const char *gpo_guid = NULL((void*)0);
2038 const char *smb_uri = NULL((void*)0);
2039 const char *gpo_display_name = NULL((void*)0);
2040 const char *raw_file_sys_path = NULL((void*)0);
2041 char *file_sys_path = NULL((void*)0);
2042 uint8_t *raw_machine_ext_names = NULL((void*)0);
2043
2044 req = tevent_req_callback_data(subreq, struct tevent_req)(struct tevent_req *)_talloc_get_type_abort(_tevent_req_callback_data
(subreq), "struct tevent_req", "../sssd/src/providers/ad/ad_gpo.c"
":" "2044")
;
2045 state = tevent_req_data(req, struct ad_gpo_process_gpo_state)(struct ad_gpo_process_gpo_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "2045")
;
2046
2047 ret = sdap_sd_search_recv(subreq, state, &num_results, &results);
2048 talloc_zfree(subreq)do { _talloc_free(((void *)((uintptr_t)(subreq))), "../sssd/src/providers/ad/ad_gpo.c"
":" "2048"); subreq = ((void*)0); } while(0)
;
2049
2050 if (ret != EOK0) {
2051 ret = sdap_id_op_done(state->sdap_op, ret, &dp_error);
2052 /* TBD: handle (dp_error == DP_ERR_OFFLINE) case */
2053
2054 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2056, __FUNCTION__, __debug_macro_level, "Unable to get GPO attributes: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2055 "Unable to get GPO attributes: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2056, __FUNCTION__, __debug_macro_level, "Unable to get GPO attributes: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2056 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2056, __FUNCTION__, __debug_macro_level, "Unable to get GPO attributes: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
2057 ret = ENOENT2;
2058 goto done;
2059 }
2060
2061 if ((num_results < 1) || (results == NULL((void*)0))) {
2062 DEBUG(SSSDBG_OP_FAILURE, "no attrs found for GPO; try next GPO.\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2062, __FUNCTION__, __debug_macro_level, "no attrs found for GPO; try next GPO.\n"
); } } while (0)
;
2063 ret = ad_gpo_get_gpo_attrs_step(req);
2064 goto done;
2065 }
2066 else if (num_results > 1) {
2067 DEBUG(SSSDBG_OP_FAILURE, "Received multiple replies\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2067, __FUNCTION__, __debug_macro_level, "Received multiple replies\n"
); } } while (0)
;
2068 ret = ERR_INTERNAL;
2069 goto done;
2070 }
2071
2072 struct gp_gpo *gp_gpo = state->candidate_gpos[state->gpo_index];
2073
2074 /* retrieve AD_AT_CN */
2075 ret = sysdb_attrs_get_string(results[0], AD_AT_CN"cn", &gpo_guid);
2076 if (ret != EOK0) {
2077 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2079, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2078 "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2079, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2079 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2079, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
2080 goto done;
2081 }
2082
2083 gp_gpo->gpo_guid = talloc_steal(gp_gpo, gpo_guid)({ __typeof__(gpo_guid) __talloc_steal_ret = (__typeof__(gpo_guid
))_talloc_steal_loc((gp_gpo),(gpo_guid), "../sssd/src/providers/ad/ad_gpo.c"
":" "2083"); __talloc_steal_ret; })
;
2084 if (gp_gpo->gpo_guid == NULL((void*)0)) {
2085 ret = ENOMEM12;
2086 goto done;
2087 }
2088
2089 DEBUG(SSSDBG_TRACE_ALL, "populating attrs for gpo_guid: %s\n",do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2090, __FUNCTION__, __debug_macro_level, "populating attrs for gpo_guid: %s\n"
, gp_gpo->gpo_guid); } } while (0)
2090 gp_gpo->gpo_guid)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2090, __FUNCTION__, __debug_macro_level, "populating attrs for gpo_guid: %s\n"
, gp_gpo->gpo_guid); } } while (0)
;
2091
2092 /* retrieve AD_AT_DISPLAY_NAME */
2093 ret = sysdb_attrs_get_string(results[0], AD_AT_DISPLAY_NAME"displayName",
2094 &gpo_display_name);
2095 if (ret != EOK0) {
2096 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2098, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2097 "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2098, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2098 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2098, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
2099 goto done;
2100 }
2101
2102 gp_gpo->gpo_display_name = talloc_steal(gp_gpo, gpo_display_name)({ __typeof__(gpo_display_name) __talloc_steal_ret = (__typeof__
(gpo_display_name))_talloc_steal_loc((gp_gpo),(gpo_display_name
), "../sssd/src/providers/ad/ad_gpo.c" ":" "2102"); __talloc_steal_ret
; })
;
2103 if (gp_gpo->gpo_display_name == NULL((void*)0)) {
2104 ret = ENOMEM12;
2105 goto done;
2106 }
2107
2108 DEBUG(SSSDBG_TRACE_ALL, "gpo_display_name: %s\n",do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2109, __FUNCTION__, __debug_macro_level, "gpo_display_name: %s\n"
, gp_gpo->gpo_display_name); } } while (0)
2109 gp_gpo->gpo_display_name)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2109, __FUNCTION__, __debug_macro_level, "gpo_display_name: %s\n"
, gp_gpo->gpo_display_name); } } while (0)
;
2110
2111 /* retrieve AD_AT_FILE_SYS_PATH */
2112 ret = sysdb_attrs_get_string(results[0],
2113 AD_AT_FILE_SYS_PATH"gPCFileSysPath",
2114 &raw_file_sys_path);
2115
2116 if (ret != EOK0) {
2117 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2119, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2118 "sysdb_attrs_get_string failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2119, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2119 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2119, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_string failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
2120 goto done;
2121 }
2122
2123 file_sys_path = talloc_strdup(gp_gpo, raw_file_sys_path);
2124 ad_gpo_convert_to_smb_uri(state, file_sys_path, &smb_uri);
2125
2126 gp_gpo->gpo_file_sys_path = talloc_asprintf(gp_gpo, "%s/Machine",
2127 smb_uri);
2128 if (gp_gpo->gpo_file_sys_path == NULL((void*)0)) {
2129 ret = ENOMEM12;
2130 goto done;
2131 }
2132
2133 DEBUG(SSSDBG_TRACE_FUNC, "gpo_file_sys_path: %s\n",do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2134, __FUNCTION__, __debug_macro_level, "gpo_file_sys_path: %s\n"
, gp_gpo->gpo_file_sys_path); } } while (0)
2134 gp_gpo->gpo_file_sys_path)do { int __debug_macro_level = 0x0400; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2134, __FUNCTION__, __debug_macro_level, "gpo_file_sys_path: %s\n"
, gp_gpo->gpo_file_sys_path); } } while (0)
;
2135
2136 /* retrieve AD_AT_VERSION_NUMBER */
2137 ret = sysdb_attrs_get_uint32_t(results[0], AD_AT_VERSION_NUMBER"versionNumber",
2138 &gp_gpo->gpo_container_version);
2139 if (ret != EOK0) {
2140 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2142, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2141 "sysdb_attrs_get_uint32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2142, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2142 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2142, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_uint32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
2143 goto done;
2144 }
2145
2146 DEBUG(SSSDBG_TRACE_ALL, "gpo_container_version: %d\n",do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2147, __FUNCTION__, __debug_macro_level, "gpo_container_version: %d\n"
, gp_gpo->gpo_container_version); } } while (0)
2147 gp_gpo->gpo_container_version)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2147, __FUNCTION__, __debug_macro_level, "gpo_container_version: %d\n"
, gp_gpo->gpo_container_version); } } while (0)
;
2148
2149 /* retrieve AD_AT_MACHINE_EXT_NAMES */
2150 ret = sysdb_attrs_get_el(results[0], AD_AT_MACHINE_EXT_NAMES"gPCMachineExtensionNames", &el);
2151 if (ret != EOK0 && ret != ENOENT2) {
2152 DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_el() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2152, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed\n"
); } } while (0)
;
2153 goto done;
2154 }
2155 if ((ret == ENOENT2) || (el->num_values == 0)) {
2156 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2157, __FUNCTION__, __debug_macro_level, "machine_ext_names not found or has no value\n"
); } } while (0)
2157 "machine_ext_names not found or has no value\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2157, __FUNCTION__, __debug_macro_level, "machine_ext_names not found or has no value\n"
); } } while (0)
;
2158 ret = ENOENT2;
2159 goto done;
2160 }
2161
2162 raw_machine_ext_names = el[0].values[0].data;
2163
2164 ret = ad_gpo_parse_machine_ext_names(gp_gpo,
2165 (char *)raw_machine_ext_names,
2166 &gp_gpo->gpo_cse_guids,
2167 &gp_gpo->num_gpo_cse_guids);
2168 if (ret != EOK0) {
2169 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2170, __FUNCTION__, __debug_macro_level, "ad_gpo_parse_machine_ext_names() failed\n"
); } } while (0)
2170 "ad_gpo_parse_machine_ext_names() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2170, __FUNCTION__, __debug_macro_level, "ad_gpo_parse_machine_ext_names() failed\n"
); } } while (0)
;
2171 goto done;
2172 }
2173
2174 /* retrieve AD_AT_FUNC_VERSION */
2175 ret = sysdb_attrs_get_int32_t(results[0], AD_AT_FUNC_VERSION"gPCFunctionalityVersion",
2176 &gp_gpo->gpo_func_version);
2177 if (ret != EOK0) {
2178 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2180, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2179 "sysdb_attrs_get_int32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2180, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2180 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2180, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
2181 goto done;
2182 }
2183
2184 DEBUG(SSSDBG_TRACE_ALL, "gpo_func_version: %d\n",do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2185, __FUNCTION__, __debug_macro_level, "gpo_func_version: %d\n"
, gp_gpo->gpo_func_version); } } while (0)
2185 gp_gpo->gpo_func_version)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2185, __FUNCTION__, __debug_macro_level, "gpo_func_version: %d\n"
, gp_gpo->gpo_func_version); } } while (0)
;
2186
2187 /* retrieve AD_AT_FLAGS */
2188 ret = sysdb_attrs_get_int32_t(results[0], AD_AT_FLAGS"flags",
2189 &gp_gpo->gpo_flags);
2190 if (ret != EOK0) {
2191 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2193, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2192 "sysdb_attrs_get_int32_t failed: [%d](%s)\n",do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2193, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
2193 ret, sss_strerror(ret))do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2193, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_int32_t failed: [%d](%s)\n"
, ret, sss_strerror(ret)); } } while (0)
;
2194 goto done;
2195 }
2196
2197 DEBUG(SSSDBG_TRACE_ALL, "gpo_flags: %d\n", gp_gpo->gpo_flags)do { int __debug_macro_level = 0x4000; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2197, __FUNCTION__, __debug_macro_level, "gpo_flags: %d\n",
gp_gpo->gpo_flags); } } while (0)
;
2198
2199 /* retrieve AD_AT_NT_SEC_DESC */
2200 ret = sysdb_attrs_get_el(results[0], AD_AT_NT_SEC_DESC"nTSecurityDescriptor", &el);
2201 if (ret != EOK0 && ret != ENOENT2) {
2202 DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_el() failed\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2202, __FUNCTION__, __debug_macro_level, "sysdb_attrs_get_el() failed\n"
); } } while (0)
;
2203 goto done;
2204 }
2205 if ((ret == ENOENT2) || (el->num_values == 0)) {
2206 DEBUG(SSSDBG_OP_FAILURE,do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2207, __FUNCTION__, __debug_macro_level, "nt_sec_desc attribute not found or has no value\n"
); } } while (0)
2207 "nt_sec_desc attribute not found or has no value\n")do { int __debug_macro_level = 0x0040; if ((debug_level &
(__debug_macro_level) || (debug_level == 0 && (__debug_macro_level
& (0x0010 | 0x0020))))) { debug_fn("../sssd/src/providers/ad/ad_gpo.c"
, 2207, __FUNCTION__, __debug_macro_level, "nt_sec_desc attribute not found or has no value\n"
); } } while (0)
;
2208 ret = ENOENT2;
2209 goto done;
2210 }
2211
2212 ret = ad_gpo_parse_sd(gp_gpo, el[0].values[0].data, el[0].values[0].length,
2213 &gp_gpo->gpo_sd);
2214
2215 ret = ad_gpo_get_gpo_attrs_step(req);
2216
2217 done:
2218
2219 if (ret == EOK0) {
2220 tevent_req_done(req)_tevent_req_done(req, "../sssd/src/providers/ad/ad_gpo.c" ":"
"2220")
;
2221 } else if (ret != EAGAIN11) {
2222 tevent_req_error(req, ret)_tevent_req_error(req, ret, "../sssd/src/providers/ad/ad_gpo.c"
":" "2222")
;
2223 }
2224}
2225
2226int
2227ad_gpo_process_gpo_recv(struct tevent_req *req,
2228 TALLOC_CTX *mem_ctx,
2229 struct gp_gpo ***candidate_gpos,
2230 int *num_candidate_gpos)
2231{
2232 struct ad_gpo_process_gpo_state *state =
2233 tevent_req_data(req, struct ad_gpo_process_gpo_state)(struct ad_gpo_process_gpo_state *)_talloc_get_type_abort(_tevent_req_data
(req), "struct ad_gpo_process_gpo_state", "../sssd/src/providers/ad/ad_gpo.c"
":" "2233")
;
2234
2235 TEVENT_REQ_RETURN_ON_ERROR(req)do { enum tevent_req_state TRROEstate; uint64_t TRROEerr; if (
tevent_req_is_error(req, &TRROEstate, &TRROEerr)) { if
(TRROEstate == TEVENT_REQ_USER_ERROR) { return TRROEerr; } return
ERR_INTERNAL; } } while (0)
;
2236
2237 *candidate_gpos = talloc_steal(mem_ctx, state->candidate_gpos)({ __typeof__(state->candidate_gpos) __talloc_steal_ret = (
__typeof__(state->candidate_gpos))_talloc_steal_loc((mem_ctx
),(state->candidate_gpos), "../sssd/src/providers/ad/ad_gpo.c"
":" "2237"); __talloc_steal_ret; })
;
2238 *num_candidate_gpos = state->num_candidate_gpos;
2239 return EOK0;
2240}