pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0094-ipa-kdb-simplify-trusted-domain-parent-search.patch

403b09
From 6c69ea75765b93768ccc3cf55a4813f2d4b81dac Mon Sep 17 00:00:00 2001
403b09
From: Alexander Bokovoy <abokovoy@redhat.com>
403b09
Date: Sun, 7 Aug 2016 21:42:14 +0300
403b09
Subject: [PATCH] ipa-kdb: simplify trusted domain parent search
403b09
403b09
In terms of cross-forest trust parent domain is the root domain of
403b09
the forest because we only have trust established with the forest root.
403b09
403b09
In FreeIPA LDAP store all sub-domains stored in cn=<forest root>,
403b09
cn=ad,cn=trusts,... subtree. Thus, a first RDN after cn=ad is the
403b09
forest root domain. This allows us to simplify logic of finding
403b09
the parent domain.
403b09
403b09
For complex hierachical forests with more than two levels of
403b09
sub-domains, this will still be true because of the forest trust:
403b09
as forest trust is established to the forest root domain, any
403b09
communication to any sub-domain must traverse forest root domain's
403b09
domain controller.
403b09
403b09
Note that SSSD also generated incorrectly CA paths information
403b09
for forests with non-hierarchical tree-roots. In such cases
403b09
IPA KDC got confused and mistakenly assumed direct trust to the
403b09
non-hierarchical tree-root instead of going through the forest
403b09
root domain. See https://fedorahosted.org/sssd/ticket/3103 for
403b09
details.
403b09
403b09
Resolves: https://fedorahosted.org/freeipa/ticket/5738
403b09
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
403b09
---
403b09
 daemons/ipa-kdb/ipa_kdb_mspac.c | 27 ++++++++++++++-------------
403b09
 1 file changed, 14 insertions(+), 13 deletions(-)
403b09
403b09
diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c
403b09
index 80e7055fd6cd7b962eeffbccc675a73d73700793..76e9e99d0b691d06ccc86e0e851fb7e226d62597 100644
403b09
--- a/daemons/ipa-kdb/ipa_kdb_mspac.c
403b09
+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c
403b09
@@ -2420,6 +2420,7 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
403b09
     char *base = NULL;
403b09
     char *dnstr = NULL;
403b09
     char *dnl = NULL;
403b09
+    LDAPDN dn = NULL;
403b09
     char **sid_blacklist_incoming = NULL;
403b09
     char **sid_blacklist_outgoing = NULL;
403b09
     int ret, n, i;
403b09
@@ -2547,26 +2548,26 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
403b09
             goto done;
403b09
         }
403b09
 
403b09
-        /* Note that after ldap_str2rdn() call dnl will point to end of one RDN
403b09
-         * which would be '\0' for trust root domain and ',' for subdomain */
403b09
         dnl--; dnl[0] = '\0';
403b09
-        ret = ldap_str2rdn(dnstr, &rdn, &dnl, LDAP_DN_FORMAT_LDAPV3);
403b09
+        /* Create a DN, which is now everything before the base,
403b09
+         * to get list of rdn values -- the last one would be a root domain.
403b09
+         * Since with cross-forest trust we have to route everything via root
403b09
+         * domain, that is enough for us to assign parentship. */
403b09
+        ret = ldap_str2dn(dnstr, &dn, LDAP_DN_FORMAT_LDAPV3);
403b09
         if (ret) {
403b09
             goto done;
403b09
         }
403b09
 
403b09
-        ldap_rdnfree(rdn);
403b09
-
403b09
-        if (dnl[0] != '\0') {
403b09
-            dnl++;
403b09
-            ret = ldap_str2rdn(dnl, &rdn, &dnl, LDAP_DN_FORMAT_LDAPV3);
403b09
-            if (ret) {
403b09
-                goto done;
403b09
-            }
403b09
-            t[n].parent_name = strndup(rdn[0]->la_value.bv_val, rdn[0]->la_value.bv_len);
403b09
-            ldap_rdnfree(rdn);
403b09
+        rdn = NULL;
403b09
+        for (i = 0; dn[i] != NULL; i++) {
403b09
+            rdn = dn[i];
403b09
         }
403b09
 
403b09
+        /* We should have a single AVA in the domain RDN */
403b09
+        t[n].parent_name = strndup(rdn[0]->la_value.bv_val, rdn[0]->la_value.bv_len);
403b09
+
403b09
+        ldap_dnfree(dn);
403b09
+
403b09
         free(dnstr);
403b09
         dnstr = NULL;
403b09
     }
403b09
-- 
403b09
2.7.4
403b09