On Fri, Oct 22, 2010 at 08:10:10AM -0400, Stephen Gallagher wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 10/20/2010 05:34 AM, Sumit Bose wrote: > > Hi, > > > > there two patches add netgroups support for the proxy provider as > > requested in ticket #630. > > > > Nack. > > If ctx->ops.getnetgrent_r() returns an error in get_netgroup(), you're > leaking memory.
fixed > > Typo in make_netgroup_attr(): "netgrentoupt" fixed > > > Otherwise, it looks good. Thanks for the review, new version attached. bye, Sumit > > - -- > Stephen Gallagher > RHCE 804006346421761 > > Delivering value year after year. > Red Hat ranks #1 in value among software vendors. > http://www.redhat.com/promo/vendor/ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (GNU/Linux) > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ > > iEYEARECAAYFAkzBfyEACgkQeiVVYja6o6PlzwCfdqu4VFjMlRI3foXnfiTpxK5d > M1YAnAydAvINQ8ft1VaWGw7NvgJUfJkP > =aMTo > -----END PGP SIGNATURE----- > _______________________________________________ > sssd-devel mailing list > sssd-devel@lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/sssd-devel
From 31ac67dc8cb4eb127e05f6ad4c2df8fd2258c1bd Mon Sep 17 00:00:00 2001 From: Sumit Bose <sb...@redhat.com> Date: Wed, 13 Oct 2010 10:51:50 +0200 Subject: [PATCH 1/2] Add netgroups infrastructure to proxy provider --- src/providers/proxy/proxy.h | 6 ++++++ src/providers/proxy/proxy_id.c | 14 ++++++++++++++ src/providers/proxy/proxy_init.c | 22 ++++++++++++++++++++++ 3 files changed, 42 insertions(+), 0 deletions(-) diff --git a/src/providers/proxy/proxy.h b/src/providers/proxy/proxy.h index eefcce5..e35e91c 100644 --- a/src/providers/proxy/proxy.h +++ b/src/providers/proxy/proxy.h @@ -40,6 +40,7 @@ #include "providers/dp_backend.h" #include "db/sysdb.h" #include "proxy.h" +#include "sss_client/nss_compat.h" #include <dhash.h> struct proxy_nss_ops { @@ -64,6 +65,11 @@ struct proxy_nss_ops { long int *start, long int *size, gid_t **groups, long int limit, int *errnop); + enum nss_status (*setnetgrent)(const char *netgroup, + struct __netgrent *result); + enum nss_status (*getnetgrent_r)(struct __netgrent *result, char *buffer, + size_t buflen, int *errnop); + enum nss_status (*endnetgrent)(struct __netgrent *result); }; struct authtok_conv { diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c index 3fe58f3..ead6ce0 100644 --- a/src/providers/proxy/proxy_id.c +++ b/src/providers/proxy/proxy_id.c @@ -1138,6 +1138,20 @@ void proxy_get_account_info(struct be_req *breq) ret = get_initgr(breq, ctx, sysdb, domain, ar->filter_value); break; + case BE_REQ_NETGROUP: + if (ar->filter_type != BE_FILTER_NAME) { + return proxy_reply(breq, DP_ERR_FATAL, + EINVAL, "Invalid filter type"); + } + if (ctx->ops.setnetgrent == NULL || ctx->ops.getnetgrent_r == NULL || + ctx->ops.endnetgrent == NULL) { + return proxy_reply(breq, DP_ERR_FATAL, + ENODEV, "Netgroups are not supported"); + } + + return proxy_reply(breq, DP_ERR_FATAL, + ENOSYS, "Netgroups not implemented"); + default: /*fail*/ return proxy_reply(breq, DP_ERR_FATAL, EINVAL, "Invalid request type"); diff --git a/src/providers/proxy/proxy_init.c b/src/providers/proxy/proxy_init.c index 47c9e81..de1904c 100644 --- a/src/providers/proxy/proxy_init.c +++ b/src/providers/proxy/proxy_init.c @@ -207,6 +207,28 @@ int sssm_proxy_id_init(struct be_ctx *bectx, "full groups enumeration!\n", libname)); } + ctx->ops.setnetgrent = proxy_dlsym(handle, "_nss_%s_setnetgrent", libname); + if (!ctx->ops.setnetgrent) { + DEBUG(0, ("Failed to load _nss_%s_setnetgrent, error: %s. " + "The library does not support netgroups.\n", libname, + dlerror())); + } + + ctx->ops.getnetgrent_r = proxy_dlsym(handle, "_nss_%s_getnetgrent_r", + libname); + if (!ctx->ops.getgrent_r) { + DEBUG(0, ("Failed to load _nss_%s_getnetgrent_r, error: %s. " + "The library does not support netgroups.\n", libname, + dlerror())); + } + + ctx->ops.endnetgrent = proxy_dlsym(handle, "_nss_%s_endnetgrent", libname); + if (!ctx->ops.endnetgrent) { + DEBUG(0, ("Failed to load _nss_%s_endnetgrent, error: %s. " + "The library does not support netgroups.\n", libname, + dlerror())); + } + *ops = &proxy_id_ops; *pvt_data = ctx; ret = EOK; -- 1.7.2.3
From d17fc280867f656da09f71dafae4b2491432ff8e Mon Sep 17 00:00:00 2001 From: Sumit Bose <sb...@redhat.com> Date: Wed, 13 Oct 2010 21:52:26 +0200 Subject: [PATCH 2/2] Implement netgroups for proxy provider --- Makefile.am | 1 + src/providers/proxy/proxy.h | 7 ++ src/providers/proxy/proxy_id.c | 4 +- src/providers/proxy/proxy_netgroup.c | 134 ++++++++++++++++++++++++++++++++++ 4 files changed, 144 insertions(+), 2 deletions(-) create mode 100644 src/providers/proxy/proxy_netgroup.c diff --git a/Makefile.am b/Makefile.am index 65860b6..294b174 100644 --- a/Makefile.am +++ b/Makefile.am @@ -795,6 +795,7 @@ libsss_proxy_la_SOURCES = \ src/providers/proxy/proxy_common.c \ src/providers/proxy/proxy_init.c \ src/providers/proxy/proxy_id.c \ + src/providers/proxy/proxy_netgroup.c \ src/providers/proxy/proxy_auth.c libsss_proxy_la_CFLAGS = \ $(AM_CFLAGS) diff --git a/src/providers/proxy/proxy.h b/src/providers/proxy/proxy.h index e35e91c..9faa967 100644 --- a/src/providers/proxy/proxy.h +++ b/src/providers/proxy/proxy.h @@ -138,4 +138,11 @@ void proxy_get_account_info(struct be_req *breq); /* From proxy_auth.c */ void proxy_pam_handler(struct be_req *req); +/* From proxy_netgroup.c */ +errno_t get_netgroup(struct proxy_id_ctx *ctx, + struct sysdb_ctx *sysdb, + struct sss_domain_info *dom, + const char *name); + + #endif /* __PROXY_H__ */ diff --git a/src/providers/proxy/proxy_id.c b/src/providers/proxy/proxy_id.c index ead6ce0..ff3ddf8 100644 --- a/src/providers/proxy/proxy_id.c +++ b/src/providers/proxy/proxy_id.c @@ -1149,8 +1149,8 @@ void proxy_get_account_info(struct be_req *breq) ENODEV, "Netgroups are not supported"); } - return proxy_reply(breq, DP_ERR_FATAL, - ENOSYS, "Netgroups not implemented"); + ret = get_netgroup(ctx, sysdb, domain, ar->filter_value); + break; default: /*fail*/ return proxy_reply(breq, DP_ERR_FATAL, diff --git a/src/providers/proxy/proxy_netgroup.c b/src/providers/proxy/proxy_netgroup.c new file mode 100644 index 0000000..cdcb2a8 --- /dev/null +++ b/src/providers/proxy/proxy_netgroup.c @@ -0,0 +1,134 @@ +/* + SSSD + + Proxy netgroup handler + + Authors: + + Sumit Bose <sb...@redhat.com> + + Copyright (C) 2010 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "providers/proxy/proxy.h" +#include "util/util.h" + +#define BUFLEN 1024 + +static errno_t make_netgroup_attr(struct __netgrent netgrent, + struct sysdb_attrs *attrs) +{ + int ret; + char *dummy; + + if (netgrent.type == group_val) { + ret =sysdb_attrs_add_string(attrs, SYSDB_NETGROUP_MEMBER, + netgrent.val.group); + if (ret != EOK) { + DEBUG(1, ("sysdb_attrs_add_string failed.\n")); + return ret; + } + } else if (netgrent.type == triple_val) { + dummy = talloc_asprintf(attrs, "(%s,%s,%s)", netgrent.val.triple.host, + netgrent.val.triple.user, + netgrent.val.triple.domain); + if (dummy == NULL) { + DEBUG(1, ("talloc_asprintf failed.\n")); + return ENOMEM; + } + + ret = sysdb_attrs_add_string(attrs, SYSDB_NETGROUP_TRIPLE, dummy); + if (ret != EOK) { + DEBUG(1, ("sysdb_attrs_add_string failed.\n")); + return ret; + } + } else { + DEBUG(1, ("Unknown netgrent entry type [%d].\n", netgrent.type)); + return EINVAL; + } + + return EOK; +} + +errno_t get_netgroup(struct proxy_id_ctx *ctx, + struct sysdb_ctx *sysdb, + struct sss_domain_info *dom, + const char *name) +{ + struct __netgrent result; + enum nss_status status; + char buffer[BUFLEN]; + int ret; + TALLOC_CTX *tmp_ctx; + struct sysdb_attrs *attrs; + + memset(&result, 0 ,sizeof(result)); + status = ctx->ops.setnetgrent(name, &result); + if (status != NSS_STATUS_SUCCESS) { + DEBUG(5, ("setnetgrent failed for netgroup [%s].\n", name)); + return EIO; + } + + tmp_ctx = talloc_new(NULL); + if (tmp_ctx == NULL) { + DEBUG(1, ("talloc_new failed.\n")); + return ENOMEM; + } + + attrs = sysdb_new_attrs(tmp_ctx); + if (attrs == NULL) { + DEBUG(1, ("sysdb_new_attrs failed.\n")); + return ENOMEM; + } + + do { + status = ctx->ops.getnetgrent_r(&result, buffer, BUFLEN, &ret); + if (status != NSS_STATUS_SUCCESS && status != NSS_STATUS_RETURN) { + DEBUG(1, ("getnetgrent_r failed for netgroup [%s]: [%d][%s].\n", + name, ret, strerror(ret))); + goto done; + } + + if (status == NSS_STATUS_SUCCESS) { + ret = make_netgroup_attr(result, attrs); + if (ret != EOK) { + DEBUG(1, ("make_netgroup_attr failed.\n")); + goto done; + } + } + } while (status != NSS_STATUS_RETURN); + + status = ctx->ops.endnetgrent(&result); + if (status != NSS_STATUS_SUCCESS) { + DEBUG(1, ("endnetgrent failed.\n")); + ret = EIO; + goto done; + } + + ret = sysdb_add_netgroup(sysdb, dom, name, NULL, attrs, + ctx->entry_cache_timeout); + if (ret != EOK) { + DEBUG(1, ("sysdb_add_netgroup failed.\n")); + goto done; + } + + ret = EOK; + +done: + talloc_free(tmp_ctx); + + return ret; +} -- 1.7.2.3
_______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel