From 9cb4436694d2fa5f7a56fa774e5283f0b46cc18f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 31 Mar 2019 12:37:21 +0300
Subject: [PATCH 2/2] ipasam: use SID formatting calls to libsss_idmap
Samba 4.10 moved away to private libraries two functions we used to
convert a binary SID structre to strings:
- sid_talloc_string()
- sid_string_dbg()
We already used libsss_idmap to convert textual representation of SIDs
to a binary one, use the reverse function too.
libsss_idmap code operates on talloc structures, so we need to adopt a
bit a place where sid_string_dbg() was used because it assumed a static
buffer was provided by sid_string_dbg().
Finally, sid_talloc_string()'s replacement moves allocated memory to the
right context so that a memory will be freed earlier. Our SSSD idmap
context is a long-living one while in all cases where we were using
sid_talloc_string() we free the context much earlier.
Resolves: https://pagure.io/freeipa/issue/7893
Reviewed-By: Christian Heimes <cheimes@redhat.com>
(cherry picked from commit 137af1d2c38925404dc92f70321ac0f5fb1cf5eb)
---
daemons/ipa-sam/ipa_sam.c | 52 ++++++++++++++++++++++++++++-----------
1 file changed, 37 insertions(+), 15 deletions(-)
diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
index 2f78f82f9..851cbc39a 100644
--- a/daemons/ipa-sam/ipa_sam.c
+++ b/daemons/ipa-sam/ipa_sam.c
@@ -104,8 +104,6 @@ enum ndr_err_code ndr_pull_trustAuthInOutBlob(struct ndr_pull *ndr, int ndr_flag
bool sid_check_is_builtin(const struct dom_sid *sid); /* available in libpdb.so */
/* available in libpdb.so, renamed from sid_check_is_domain() in c43505b621725c9a754f0ee98318d451b093f2ed */
bool sid_linearize(char *outbuf, size_t len, const struct dom_sid *sid); /* available in libsmbconf.so */
-char *sid_string_talloc(TALLOC_CTX *mem_ctx, const struct dom_sid *sid); /* available in libsmbconf.so */
-char *sid_string_dbg(const struct dom_sid *sid); /* available in libsmbconf.so */
char *escape_ldap_string(TALLOC_CTX *mem_ctx, const char *s); /* available in libsmbconf.so */
bool secrets_store(const char *key, const void *data, size_t size); /* available in libpdb.so */
void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id); /* available in libsmbconf.so */
@@ -261,6 +259,18 @@ static bool sid_compose(struct dom_sid *dst, const struct dom_sid *dom_sid,
return true;
}
+static char *sid_talloc_string(struct sss_idmap_ctx *ctx, void *final_ctx, const struct dom_sid *dom_sid)
+{
+ enum idmap_error_code ret;
+ char *result = NULL;
+ ret = sss_idmap_smb_sid_to_sid(ctx, discard_const(dom_sid), &result);
+ if (ret != IDMAP_SUCCESS) {
+ return NULL;
+ }
+
+ return talloc_move(final_ctx, &result);
+}
+
static bool is_null_sid(const struct dom_sid *sid)
{
size_t c;
@@ -519,8 +529,18 @@ static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
}
if (dom_sid_compare_domain(sid, domain_sid) != 0) {
- DEBUG(10, ("SID %s is not in expected domain %s\n",
- str, sid_string_dbg(domain_sid)));
+ char *debug_domain_sid = NULL;
+ err = sss_idmap_smb_sid_to_sid(idmap_ctx,
+ discard_const(domain_sid),
+ &debug_domain_sid);
+ if (err != IDMAP_SUCCESS) {
+ DEBUG(10, ("SID %s is not in expected domain.\n",
+ str));
+ } else {
+ DEBUG(10, ("SID %s is not in expected domain %s\n",
+ str, debug_domain_sid));
+ talloc_free(debug_domain_sid);
+ }
res = false;
goto done;
}
@@ -589,7 +609,7 @@ static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
allsids = talloc_asprintf_append_buffer(
allsids, "(%s=%s)",
LDAP_ATTRIBUTE_SID,
- sid_string_talloc(mem_ctx, &sid));
+ sid_talloc_string(ipasam_state->idmap_ctx, mem_ctx, &sid));
if (allsids == NULL) {
goto done;
}
@@ -790,7 +810,8 @@ static bool ldapsam_sid_to_id(struct pdb_methods *methods,
filter = talloc_asprintf(mem_ctx,
"(&(%s=%s)"
"(|(objectClass=%s)(objectClass=%s)))",
- LDAP_ATTRIBUTE_SID, sid_string_talloc(mem_ctx, sid),
+ LDAP_ATTRIBUTE_SID,
+ sid_talloc_string(priv->idmap_ctx, mem_ctx, sid),
LDAP_OBJ_GROUPMAP, LDAP_OBJ_SAMBASAMACCOUNT);
if (filter == NULL) {
DEBUG(5, ("talloc_asprintf failed\n"));
@@ -936,7 +957,7 @@ static bool ipasam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
err = sss_idmap_sid_to_smb_sid(priv->idmap_ctx,
user_sid_string, &user_sid);
if (err != IDMAP_SUCCESS) {
- DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
+ DEBUG(3, ("Error creating sid structure for sid '%s'\n",
user_sid_string));
goto done;
}
@@ -1052,7 +1073,7 @@ found:
err = sss_idmap_sid_to_smb_sid(priv->idmap_ctx,
group_sid_string, &group_sid);
if (err != IDMAP_SUCCESS) {
- DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
+ DEBUG(3, ("Error creating sid structure for sid '%s'\n",
group_sid_string));
goto done;
}
@@ -1595,11 +1616,11 @@ static bool ipasam_search_grouptype(struct pdb_methods *methods,
state->base = talloc_strdup(search, ipasam_state->base_dn);
state->connection = ipasam_state->ldap_state;
state->scope = LDAP_SCOPE_SUBTREE;
- state->filter = talloc_asprintf(search, "(&(objectclass=%s)"
- "(%s=%s*))",
- LDAP_OBJ_GROUPMAP,
- LDAP_ATTRIBUTE_SID,
- sid_string_talloc(search, sid));
+ state->filter = talloc_asprintf(search, "(&(objectclass=%s)(%s=%s*))",
+ LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID,
+ sid_talloc_string(
+ ipasam_state->idmap_ctx,
+ search, sid));
state->attrs = talloc_attrs(search, "cn", LDAP_ATTRIBUTE_SID,
"displayName", "description",
NULL);
@@ -2412,7 +2433,7 @@ static NTSTATUS ipasam_get_trusted_domain_by_sid(struct pdb_methods *methods,
char *sid_str;
bool ok;
- sid_str = sid_string_talloc(mem_ctx, sid);
+ sid_str = sid_talloc_string(ipasam_state->idmap_ctx, mem_ctx, sid);
if (sid_str == NULL) {
return NT_STATUS_NO_MEMORY;
}
@@ -2593,7 +2614,8 @@ static NTSTATUS ipasam_set_trusted_domain(struct pdb_methods *methods,
if (!is_null_sid(&td->security_identifier)) {
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
LDAP_ATTRIBUTE_TRUST_SID,
- sid_string_talloc(tmp_ctx, &td->security_identifier));
+ sid_talloc_string(ipasam_state->idmap_ctx,
+ tmp_ctx, &td->security_identifier));
}
if (td->trust_type != 0) {
--
2.21.0