pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone
Blob Blame History Raw
From 9cb4436694d2fa5f7a56fa774e5283f0b46cc18f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 31 Mar 2019 12:37:21 +0300
Subject: [PATCH 2/2] ipasam: use SID formatting calls to libsss_idmap

Samba 4.10 moved away to private libraries two functions we used to
convert a binary SID structre to strings:
 - sid_talloc_string()
 - sid_string_dbg()

We already used libsss_idmap to convert textual representation of SIDs
to a binary one, use the reverse function too.

libsss_idmap code operates on talloc structures, so we need to adopt a
bit a place where sid_string_dbg() was used because it assumed a static
buffer was provided by sid_string_dbg().

Finally, sid_talloc_string()'s replacement moves allocated memory to the
right context so that a memory will be freed earlier. Our SSSD idmap
context is a long-living one while in all cases where we were using
sid_talloc_string() we free the context much earlier.

Resolves: https://pagure.io/freeipa/issue/7893
Reviewed-By: Christian Heimes <cheimes@redhat.com>
(cherry picked from commit 137af1d2c38925404dc92f70321ac0f5fb1cf5eb)
---
 daemons/ipa-sam/ipa_sam.c | 52 ++++++++++++++++++++++++++++-----------
 1 file changed, 37 insertions(+), 15 deletions(-)

diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
index 2f78f82f9..851cbc39a 100644
--- a/daemons/ipa-sam/ipa_sam.c
+++ b/daemons/ipa-sam/ipa_sam.c
@@ -104,8 +104,6 @@ enum ndr_err_code ndr_pull_trustAuthInOutBlob(struct ndr_pull *ndr, int ndr_flag
 bool sid_check_is_builtin(const struct dom_sid *sid); /* available in libpdb.so */
 /* available in libpdb.so, renamed from sid_check_is_domain() in c43505b621725c9a754f0ee98318d451b093f2ed */
 bool sid_linearize(char *outbuf, size_t len, const struct dom_sid *sid); /* available in libsmbconf.so */
-char *sid_string_talloc(TALLOC_CTX *mem_ctx, const struct dom_sid *sid); /* available in libsmbconf.so */
-char *sid_string_dbg(const struct dom_sid *sid); /* available in libsmbconf.so */
 char *escape_ldap_string(TALLOC_CTX *mem_ctx, const char *s); /* available in libsmbconf.so */
 bool secrets_store(const char *key, const void *data, size_t size); /* available in libpdb.so */
 void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id); /* available in libsmbconf.so */
@@ -261,6 +259,18 @@ static bool sid_compose(struct dom_sid *dst, const struct dom_sid *dom_sid,
 	return true;
 }
 
+static char *sid_talloc_string(struct sss_idmap_ctx *ctx, void *final_ctx, const struct dom_sid *dom_sid)
+{
+	enum idmap_error_code ret;
+	char *result = NULL;
+	ret = sss_idmap_smb_sid_to_sid(ctx, discard_const(dom_sid), &result);
+	if (ret != IDMAP_SUCCESS) {
+		return NULL;
+	}
+
+	return talloc_move(final_ctx, &result);
+}
+
 static bool is_null_sid(const struct dom_sid *sid)
 {
 	size_t c;
@@ -519,8 +529,18 @@ static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
 	}
 
 	if (dom_sid_compare_domain(sid, domain_sid) != 0) {
-		DEBUG(10, ("SID %s is not in expected domain %s\n",
-			   str, sid_string_dbg(domain_sid)));
+		char *debug_domain_sid = NULL;
+		err = sss_idmap_smb_sid_to_sid(idmap_ctx,
+					       discard_const(domain_sid),
+					       &debug_domain_sid);
+		if (err != IDMAP_SUCCESS) {
+			DEBUG(10, ("SID %s is not in expected domain.\n",
+				   str));
+		} else {
+			DEBUG(10, ("SID %s is not in expected domain %s\n",
+				   str, debug_domain_sid));
+			talloc_free(debug_domain_sid);
+		}
 		res = false;
 		goto done;
 	}
@@ -589,7 +609,7 @@ static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
 		allsids = talloc_asprintf_append_buffer(
 			allsids, "(%s=%s)",
 			LDAP_ATTRIBUTE_SID,
-			sid_string_talloc(mem_ctx, &sid));
+			sid_talloc_string(ipasam_state->idmap_ctx, mem_ctx, &sid));
 		if (allsids == NULL) {
 			goto done;
 		}
@@ -790,7 +810,8 @@ static bool ldapsam_sid_to_id(struct pdb_methods *methods,
 	filter = talloc_asprintf(mem_ctx,
 				 "(&(%s=%s)"
 				 "(|(objectClass=%s)(objectClass=%s)))",
-				 LDAP_ATTRIBUTE_SID, sid_string_talloc(mem_ctx, sid),
+				 LDAP_ATTRIBUTE_SID,
+				 sid_talloc_string(priv->idmap_ctx, mem_ctx, sid),
 				 LDAP_OBJ_GROUPMAP, LDAP_OBJ_SAMBASAMACCOUNT);
 	if (filter == NULL) {
 		DEBUG(5, ("talloc_asprintf failed\n"));
@@ -936,7 +957,7 @@ static bool ipasam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
 	err = sss_idmap_sid_to_smb_sid(priv->idmap_ctx,
 				       user_sid_string, &user_sid);
 	if (err != IDMAP_SUCCESS) {
-		DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
+		DEBUG(3, ("Error creating sid structure for sid '%s'\n",
 			  user_sid_string));
 		goto done;
 	}
@@ -1052,7 +1073,7 @@ found:
 	err = sss_idmap_sid_to_smb_sid(priv->idmap_ctx,
 				       group_sid_string, &group_sid);
 	if (err != IDMAP_SUCCESS) {
-		DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
+		DEBUG(3, ("Error creating sid structure for sid '%s'\n",
 			  group_sid_string));
 		goto done;
 	}
@@ -1595,11 +1616,11 @@ static bool ipasam_search_grouptype(struct pdb_methods *methods,
 	state->base = talloc_strdup(search, ipasam_state->base_dn);
 	state->connection = ipasam_state->ldap_state;
 	state->scope = LDAP_SCOPE_SUBTREE;
-	state->filter =	talloc_asprintf(search, "(&(objectclass=%s)"
-					"(%s=%s*))",
-					 LDAP_OBJ_GROUPMAP,
-					 LDAP_ATTRIBUTE_SID,
-					 sid_string_talloc(search, sid));
+	state->filter =	talloc_asprintf(search, "(&(objectclass=%s)(%s=%s*))",
+					LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID,
+					sid_talloc_string(
+						ipasam_state->idmap_ctx,
+						search, sid));
 	state->attrs = talloc_attrs(search, "cn", LDAP_ATTRIBUTE_SID,
 				    "displayName", "description",
 				     NULL);
@@ -2412,7 +2433,7 @@ static NTSTATUS ipasam_get_trusted_domain_by_sid(struct pdb_methods *methods,
 	char *sid_str;
 	bool ok;
 
-	sid_str = sid_string_talloc(mem_ctx, sid);
+	sid_str = sid_talloc_string(ipasam_state->idmap_ctx, mem_ctx, sid);
 	if (sid_str == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -2593,7 +2614,8 @@ static NTSTATUS ipasam_set_trusted_domain(struct pdb_methods *methods,
 	if (!is_null_sid(&td->security_identifier)) {
 		smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
 				 LDAP_ATTRIBUTE_TRUST_SID,
-				 sid_string_talloc(tmp_ctx, &td->security_identifier));
+				 sid_talloc_string(ipasam_state->idmap_ctx,
+						   tmp_ctx, &td->security_identifier));
 	}
 
 	if (td->trust_type != 0) {
-- 
2.21.0