444 lines
17 KiB
Diff
444 lines
17 KiB
Diff
From 0dc81a52e2836010974e9f71b1f3e47c20fd498d Mon Sep 17 00:00:00 2001
|
|
From: Sumit Bose <sbose@redhat.com>
|
|
Date: Fri, 9 Oct 2020 11:56:21 +0200
|
|
Subject: [PATCH 7/8] negcache: make sure short names are added to sub-domains
|
|
|
|
If short names are used with filter_users or filter_groups in a
|
|
[domain/...] section they should be added to the sub-domains of this
|
|
domain as well.
|
|
|
|
Resolves: https://github.com/SSSD/sssd/issues/5238
|
|
|
|
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
|
|
---
|
|
src/responder/common/negcache.c | 105 +++++++------
|
|
src/tests/cmocka/test_negcache.c | 254 +++++++++++++++++++++++++++++++
|
|
2 files changed, 312 insertions(+), 47 deletions(-)
|
|
|
|
diff --git a/src/responder/common/negcache.c b/src/responder/common/negcache.c
|
|
index 139218420..9ee39ce3e 100644
|
|
--- a/src/responder/common/negcache.c
|
|
+++ b/src/responder/common/negcache.c
|
|
@@ -971,6 +971,7 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
|
|
char *name = NULL;
|
|
struct sss_domain_info *dom = NULL;
|
|
struct sss_domain_info *domain_list = rctx->domains;
|
|
+ struct sss_domain_info *ddom;
|
|
char *domainname = NULL;
|
|
char *conf_path = NULL;
|
|
TALLOC_CTX *tmpctx = talloc_new(NULL);
|
|
@@ -1013,39 +1014,44 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
|
|
continue;
|
|
}
|
|
|
|
- if (domainname && strcmp(domainname, dom->name)) {
|
|
- DEBUG(SSSDBG_TRACE_FUNC,
|
|
- "Mismatch between domain name (%s) and name "
|
|
- "set in FQN (%s), assuming %s is UPN\n",
|
|
- dom->name, domainname, filter_list[i]);
|
|
- ret = sss_ncache_set_upn(ncache, true, dom, filter_list[i]);
|
|
+ /* Check domain and its sub-domains */
|
|
+ for (ddom = dom; ddom != NULL;
|
|
+ ddom = get_next_domain(ddom, SSS_GND_ALL_SUBDOMAINS)) {
|
|
+
|
|
+ if (domainname && strcmp(domainname, ddom->name)) {
|
|
+ DEBUG(SSSDBG_TRACE_FUNC,
|
|
+ "Mismatch between domain name (%s) and name "
|
|
+ "set in FQN (%s), assuming %s is UPN\n",
|
|
+ ddom->name, domainname, filter_list[i]);
|
|
+ ret = sss_ncache_set_upn(ncache, true, ddom, filter_list[i]);
|
|
+ if (ret != EOK) {
|
|
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
+ "sss_ncache_set_upn failed (%d [%s]), ignored\n",
|
|
+ ret, sss_strerror(ret));
|
|
+ }
|
|
+ continue;
|
|
+ }
|
|
+
|
|
+ fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);
|
|
+ if (fqname == NULL) {
|
|
+ continue;
|
|
+ }
|
|
+
|
|
+ ret = sss_ncache_set_upn(ncache, true, ddom, fqname);
|
|
if (ret != EOK) {
|
|
DEBUG(SSSDBG_OP_FAILURE,
|
|
"sss_ncache_set_upn failed (%d [%s]), ignored\n",
|
|
ret, sss_strerror(ret));
|
|
}
|
|
- continue;
|
|
- }
|
|
-
|
|
- fqname = sss_create_internal_fqname(tmpctx, name, dom->name);
|
|
- if (fqname == NULL) {
|
|
- continue;
|
|
- }
|
|
-
|
|
- ret = sss_ncache_set_upn(ncache, true, dom, fqname);
|
|
- if (ret != EOK) {
|
|
- DEBUG(SSSDBG_OP_FAILURE,
|
|
- "sss_ncache_set_upn failed (%d [%s]), ignored\n",
|
|
- ret, sss_strerror(ret));
|
|
- }
|
|
- ret = sss_ncache_set_user(ncache, true, dom, fqname);
|
|
- talloc_zfree(fqname);
|
|
- if (ret != EOK) {
|
|
- DEBUG(SSSDBG_CRIT_FAILURE,
|
|
- "Failed to store permanent user filter for [%s]"
|
|
- " (%d [%s])\n", filter_list[i],
|
|
- ret, sss_strerror(ret));
|
|
- continue;
|
|
+ ret = sss_ncache_set_user(ncache, true, ddom, fqname);
|
|
+ talloc_zfree(fqname);
|
|
+ if (ret != EOK) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
+ "Failed to store permanent user filter for [%s]"
|
|
+ " (%d [%s])\n", filter_list[i],
|
|
+ ret, sss_strerror(ret));
|
|
+ continue;
|
|
+ }
|
|
}
|
|
}
|
|
}
|
|
@@ -1161,27 +1167,32 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
|
|
continue;
|
|
}
|
|
|
|
- if (domainname && strcmp(domainname, dom->name)) {
|
|
- DEBUG(SSSDBG_CRIT_FAILURE,
|
|
- "Mismatch between domain name (%s) and name "
|
|
- "set in FQN (%s), skipping group %s\n",
|
|
- dom->name, domainname, name);
|
|
- continue;
|
|
- }
|
|
+ /* Check domain and its sub-domains */
|
|
+ for (ddom = dom;
|
|
+ ddom != NULL && (ddom == dom || ddom->parent != NULL);
|
|
+ ddom = get_next_domain(ddom, SSS_GND_ALL_DOMAINS)) {
|
|
+ if (domainname && strcmp(domainname, ddom->name)) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
+ "Mismatch between domain name (%s) and name "
|
|
+ "set in FQN (%s), skipping group %s\n",
|
|
+ ddom->name, domainname, name);
|
|
+ continue;
|
|
+ }
|
|
|
|
- fqname = sss_create_internal_fqname(tmpctx, name, dom->name);
|
|
- if (fqname == NULL) {
|
|
- continue;
|
|
- }
|
|
+ fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);
|
|
+ if (fqname == NULL) {
|
|
+ continue;
|
|
+ }
|
|
|
|
- ret = sss_ncache_set_group(ncache, true, dom, fqname);
|
|
- talloc_zfree(fqname);
|
|
- if (ret != EOK) {
|
|
- DEBUG(SSSDBG_CRIT_FAILURE,
|
|
- "Failed to store permanent group filter for [%s]"
|
|
- " (%d [%s])\n", filter_list[i],
|
|
- ret, strerror(ret));
|
|
- continue;
|
|
+ ret = sss_ncache_set_group(ncache, true, ddom, fqname);
|
|
+ talloc_zfree(fqname);
|
|
+ if (ret != EOK) {
|
|
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
+ "Failed to store permanent group filter for [%s]"
|
|
+ " (%d [%s])\n", filter_list[i],
|
|
+ ret, strerror(ret));
|
|
+ continue;
|
|
+ }
|
|
}
|
|
}
|
|
}
|
|
diff --git a/src/tests/cmocka/test_negcache.c b/src/tests/cmocka/test_negcache.c
|
|
index b3a379227..fb306b110 100644
|
|
--- a/src/tests/cmocka/test_negcache.c
|
|
+++ b/src/tests/cmocka/test_negcache.c
|
|
@@ -119,6 +119,8 @@ static int setup(void **state)
|
|
int ret;
|
|
struct test_state *ts;
|
|
|
|
+ test_dom_suite_setup(TESTS_PATH);
|
|
+
|
|
ts = talloc(NULL, struct test_state);
|
|
assert_non_null(ts);
|
|
|
|
@@ -133,6 +135,7 @@ static int setup(void **state)
|
|
static int teardown(void **state)
|
|
{
|
|
struct test_state *ts = talloc_get_type_abort(*state, struct test_state);
|
|
+ test_dom_suite_cleanup(TESTS_PATH, TEST_CONF_DB, TEST_DOM_NAME);
|
|
talloc_free(ts);
|
|
return 0;
|
|
}
|
|
@@ -921,6 +924,255 @@ static void test_sss_ncache_reset_prepopulate(void **state)
|
|
assert_int_equal(ret, EEXIST);
|
|
}
|
|
|
|
+/* The main purpose of test_sss_ncache_short_name_in_domain is to test that
|
|
+ * short names in the filter_users or filter_groups options in a [domain/...]
|
|
+ * section are properly added to the related sub-domains as well (if there are
|
|
+ * any) and not added to domains from other [domain/...] sections. For
|
|
+ * completeness entries with fully-qualified names of the parent and the
|
|
+ * sub-domain and the generic UPN are added as well.
|
|
+ *
|
|
+ * The result should of course be independent of the present domains. To
|
|
+ * verify this the domains are added one after the other and the negative
|
|
+ * cache is repopulated each time.
|
|
+ *
|
|
+ * With the given domains, users and group we have to following expectations:
|
|
+ * - the short name entry will be added to the domain and all sub-domains as
|
|
+ * name and as upn by expanding it to a fully-qualified name with the
|
|
+ * domain name or sub-domain name respectively
|
|
+ * - the fully-qualified name from the parent domain is added as name and upn
|
|
+ * to the parent domain and as upn to all sub-domains
|
|
+ * - the fully-qualified name from the sub-domain is added as name to the
|
|
+ * sub-domain and as upn to the parent and all sub-domains
|
|
+ * - the generic upn is nowhere added as name and as upn to the parent and all
|
|
+ * sub-domains
|
|
+ * - none of the names is added to a different parent domain
|
|
+ *
|
|
+ * The following table should illustrated the expectations:
|
|
+ *
|
|
+ * user (name):
|
|
+ * | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom
|
|
+ *-----------------+-----------+-----------------------+--------------------------+------------
|
|
+ * TEST_DOM_NAME | PRESENT | PRESENT | MISSING | MISSING
|
|
+ * subTEST_DOM_NAME| PRESENT | MISSING | PRESENT | MISSING
|
|
+ * TEST_DOM_NAME2 | MISSING | MISSING | MISSING | MISSING
|
|
+ *
|
|
+ * user (upn):
|
|
+ * | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom
|
|
+ *-----------------+-----------+-----------------------+--------------------------+------------
|
|
+ * TEST_DOM_NAME | PRESENT | PRESENT | PRESENT | PRESENT
|
|
+ * subTEST_DOM_NAME| PRESENT | PRESENT | PRESENT | PRESENT
|
|
+ * TEST_DOM_NAME2 | MISSING | MISSING | MISSING | MISSING
|
|
+ *
|
|
+ *
|
|
+ *
|
|
+ * groups:
|
|
+ * | shortgroup | parentg@TEST_DOM_NAME | subdomg@subTEST_DOM_NAME
|
|
+ *-----------------+------------+-----------------------+-------------------------
|
|
+ * TEST_DOM_NAME | PRESENT | PRESENT | MISSING
|
|
+ * subTEST_DOM_NAME| PRESENT | MISSING | PRESENT
|
|
+ * TEST_DOM_NAME2 | MISSING | MISSING | MISSING
|
|
+ *
|
|
+ *
|
|
+ * The following expect_*() implement checks for the expextations:
|
|
+ */
|
|
+
|
|
+static void expect_in_parent(struct sss_nc_ctx *ncache,
|
|
+ struct sss_domain_info *dom)
|
|
+{
|
|
+ int ret;
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom, "shortuser");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+ ret = sss_ncache_check_upn(ncache, dom, "shortuser@"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom, "parentu");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+ ret = sss_ncache_check_upn(ncache, dom, "parentu@"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom, "subdomu");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, dom, "subdomu@sub"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom, "upn");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, dom, "upn@upn.dom");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, dom, "shortgroup");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, dom, "parentg");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, dom, "subdomg");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+}
|
|
+
|
|
+static void expect_in_subdomain(struct sss_nc_ctx *ncache,
|
|
+ struct sss_domain_info *sub_dom)
|
|
+{
|
|
+ int ret;
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, sub_dom, "shortuser");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+ ret = sss_ncache_check_upn(ncache, sub_dom, "shortuser@sub"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, sub_dom, "subdomu");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+ ret = sss_ncache_check_upn(ncache, sub_dom, "subdomu@sub"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, sub_dom, "upn");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, sub_dom, "upn@upn.dom");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, sub_dom, "parentu");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, sub_dom, "parentu@"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, sub_dom, "shortgroup");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, sub_dom, "parentg");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, sub_dom, "subdomg");
|
|
+ assert_int_equal(ret, EEXIST);
|
|
+}
|
|
+static void expect_no_entries_in_dom(struct sss_nc_ctx *ncache,
|
|
+ struct sss_domain_info *dom2)
|
|
+{
|
|
+ int ret;
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom2, "shortuser");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, dom2, "shortuser"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom2, "parentu");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, dom2, "parentu@"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom2, "subdomu");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, dom2, "subdomu@sub"TEST_DOM_NAME);
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+
|
|
+ ret = check_user_in_ncache(ncache, dom2, "upn");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+ ret = sss_ncache_check_upn(ncache, dom2, "upn@upn.dom");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, dom2, "shortgroup");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, dom2, "parentg");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+
|
|
+ ret = check_group_in_ncache(ncache, dom2, "subdomg");
|
|
+ assert_int_equal(ret, ENOENT);
|
|
+}
|
|
+
|
|
+static void test_sss_ncache_short_name_in_domain(void **state)
|
|
+{
|
|
+ int ret;
|
|
+ struct test_state *ts;
|
|
+ struct tevent_context *ev;
|
|
+ struct sss_nc_ctx *ncache;
|
|
+ struct sss_test_ctx *tc;
|
|
+ struct sss_domain_info *dom;
|
|
+ struct sss_domain_info *dom2;
|
|
+ struct sss_domain_info *sub_dom;
|
|
+
|
|
+ struct sss_test_conf_param params[] = {
|
|
+ { "filter_users", "shortuser, parentu@"TEST_DOM_NAME", "
|
|
+ "subdomu@sub"TEST_DOM_NAME", upn@upn.dom" },
|
|
+ { "filter_groups", "shortgroup, parentg@"TEST_DOM_NAME", "
|
|
+ "subdomg@sub"TEST_DOM_NAME },
|
|
+ { NULL, NULL },
|
|
+ };
|
|
+
|
|
+ const char *nss_filter_users[] = { params[0].value, NULL};
|
|
+ const char *nss_filter_groups[] = { params[1].value, NULL};
|
|
+
|
|
+ ts = talloc_get_type_abort(*state, struct test_state);
|
|
+
|
|
+ ev = tevent_context_init(ts);
|
|
+ assert_non_null(ev);
|
|
+
|
|
+ dom = talloc_zero(ts, struct sss_domain_info);
|
|
+ assert_non_null(dom);
|
|
+ dom->name = discard_const_p(char, TEST_DOM_NAME);
|
|
+ sss_domain_set_state(dom, DOM_ACTIVE);
|
|
+
|
|
+ ts->nctx = mock_nctx(ts);
|
|
+ assert_non_null(ts->nctx);
|
|
+
|
|
+ tc = create_dom_test_ctx(ts, TESTS_PATH, TEST_CONF_DB,
|
|
+ TEST_DOM_NAME, TEST_ID_PROVIDER, params);
|
|
+ assert_non_null(tc);
|
|
+
|
|
+ ret = confdb_add_param(tc->confdb, true, "config/domain/"TEST_DOM_NAME,
|
|
+ "filter_users", nss_filter_users);
|
|
+ assert_int_equal(ret, EOK);
|
|
+
|
|
+ ret = confdb_add_param(tc->confdb, true, "config/domain"TEST_DOM_NAME,
|
|
+ "filter_groups", nss_filter_groups);
|
|
+ assert_int_equal(ret, EOK);
|
|
+
|
|
+ ncache = ts->ctx;
|
|
+ ts->rctx = mock_rctx(ts, ev, dom, ts->nctx);
|
|
+ assert_non_null(ts->rctx);
|
|
+ ts->rctx->cdb = tc->confdb;
|
|
+
|
|
+ ret = sss_names_init(ts, tc->confdb, TEST_DOM_NAME, &dom->names);
|
|
+ assert_int_equal(ret, EOK);
|
|
+
|
|
+ ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
|
|
+ assert_int_equal(ret, EOK);
|
|
+
|
|
+ /* Add another domain */
|
|
+ dom2 = talloc_zero(ts, struct sss_domain_info);
|
|
+ assert_non_null(dom2);
|
|
+ dom2->name = discard_const_p(char, TEST_DOM_NAME"2");
|
|
+ sss_domain_set_state(dom2, DOM_ACTIVE);
|
|
+ dom->next = dom2;
|
|
+ dom2->names = dom->names;
|
|
+
|
|
+ expect_in_parent(ncache, dom);
|
|
+ expect_no_entries_in_dom(ncache, dom2);
|
|
+
|
|
+ ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
|
|
+ assert_int_equal(ret, EOK);
|
|
+
|
|
+ expect_in_parent(ncache, dom);
|
|
+ expect_no_entries_in_dom(ncache, dom2);
|
|
+
|
|
+ /* Add a sub domain */
|
|
+ sub_dom = talloc_zero(ts, struct sss_domain_info);
|
|
+ assert_non_null(sub_dom);
|
|
+ sub_dom->name = discard_const_p(char, "sub"TEST_DOM_NAME);
|
|
+ sss_domain_set_state(sub_dom, DOM_ACTIVE);
|
|
+ sub_dom->parent = dom;
|
|
+ dom->subdomains = sub_dom;
|
|
+ sub_dom->names = dom->names;
|
|
+
|
|
+ ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
|
|
+ assert_int_equal(ret, EOK);
|
|
+
|
|
+ expect_in_parent(ncache, dom);
|
|
+ expect_in_subdomain(ncache, sub_dom);
|
|
+ expect_no_entries_in_dom(ncache, dom2);
|
|
+}
|
|
+
|
|
static void test_sss_ncache_reset(void **state)
|
|
{
|
|
errno_t ret;
|
|
@@ -1083,6 +1335,8 @@ int main(void)
|
|
setup, teardown),
|
|
cmocka_unit_test_setup_teardown(test_sss_ncache_reset_prepopulate,
|
|
setup, teardown),
|
|
+ cmocka_unit_test_setup_teardown(test_sss_ncache_short_name_in_domain,
|
|
+ setup, teardown),
|
|
cmocka_unit_test_setup_teardown(test_sss_ncache_reset,
|
|
setup, teardown),
|
|
cmocka_unit_test_setup_teardown(test_sss_ncache_locate_uid_gid,
|
|
--
|
|
2.21.3
|
|
|