Blob Blame History Raw
From 20adfff6c0db657d302bd96f986f2e79a8b2d791 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 30 Oct 2020 13:20:46 +0100
Subject: [PATCH 2/6] service: allow to use ldaps for rootDSE lookup

Let the realmd service use ldaps for the rootDSE lookup when requested.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1826964
---
 service/realm-disco-dns.c      | 10 +++++++---
 service/realm-disco-dns.h      |  1 +
 service/realm-disco-domain.c   |  8 +++++++-
 service/realm-disco-domain.h   |  1 +
 service/realm-disco-mscldap.c  |  2 +-
 service/realm-disco-rootdse.c  |  3 ++-
 service/realm-disco-rootdse.h  |  1 +
 service/realm-ldap.c           |  5 ++++-
 service/realm-ldap.h           |  1 +
 service/realm-samba-provider.c |  5 ++++-
 service/realm-sssd-provider.c  |  5 ++++-
 11 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/service/realm-disco-dns.c b/service/realm-disco-dns.c
index 446010c..77d5034 100644
--- a/service/realm-disco-dns.c
+++ b/service/realm-disco-dns.c
@@ -32,6 +32,7 @@ typedef struct {
 	GQueue addresses;
 	GQueue targets;
 	gint current_port;
+	gboolean use_ldaps;
 	gint returned;
 	DiscoPhase phase;
 	GResolver *resolver;
@@ -180,7 +181,7 @@ return_or_resolve (RealmDiscoDns *self,
 
 	target = g_queue_pop_head (&self->targets);
 	if (target) {
-		self->current_port = g_srv_target_get_port (target);
+		self->current_port = self->use_ldaps ? 636 : g_srv_target_get_port (target);
 		g_resolver_lookup_by_name_async (self->resolver, g_srv_target_get_hostname (target),
 		                                 g_task_get_cancellable (task), on_name_resolved,
 		                                 g_object_ref (task));
@@ -201,7 +202,7 @@ return_or_resolve (RealmDiscoDns *self,
 		g_resolver_lookup_by_name_async (self->resolver, self->name,
 		                                 g_task_get_cancellable (task), on_name_resolved,
 		                                 g_object_ref (task));
-		self->current_port = 389;
+		self->current_port = self->use_ldaps ? 636 : 389;
 		self->phase = PHASE_HOST;
 		break;
 	case PHASE_HOST:
@@ -251,6 +252,7 @@ realm_disco_dns_class_init (RealmDiscoDnsClass *klass)
 
 GSocketAddressEnumerator *
 realm_disco_dns_enumerate_servers (const gchar *domain_or_server,
+                                   gboolean use_ldaps,
                                    GDBusMethodInvocation *invocation)
 {
 	RealmDiscoDns *self;
@@ -262,12 +264,14 @@ realm_disco_dns_enumerate_servers (const gchar *domain_or_server,
 
 	self = g_object_new (REALM_TYPE_DISCO_DNS, NULL);
 	self->name = g_hostname_to_ascii (input);
+	self->use_ldaps = use_ldaps;
 	self->invocation = g_object_ref (invocation);
 
 	/* If is an IP, skip resolution */
 	if (g_hostname_is_ip_address (input)) {
 		inet = g_inet_address_new_from_string (input);
-		g_queue_push_head (&self->addresses, g_inet_socket_address_new (inet, 389));
+		g_queue_push_head (&self->addresses,
+		                   g_inet_socket_address_new (inet, use_ldaps ? 636 : 389));
 		g_object_unref (inet);
 		self->phase = PHASE_HOST;
 	} else {
diff --git a/service/realm-disco-dns.h b/service/realm-disco-dns.h
index a51777f..5b20fe9 100644
--- a/service/realm-disco-dns.h
+++ b/service/realm-disco-dns.h
@@ -26,6 +26,7 @@ typedef enum {
 G_BEGIN_DECLS
 
 GSocketAddressEnumerator *  realm_disco_dns_enumerate_servers    (const gchar *domain_or_server,
+                                                                  gboolean use_ldaps,
                                                                   GDBusMethodInvocation *invocation);
 
 RealmDiscoDnsHint           realm_disco_dns_get_hint             (GSocketAddressEnumerator *enumerator);
diff --git a/service/realm-disco-domain.c b/service/realm-disco-domain.c
index 3f0ccb5..fdda8f6 100644
--- a/service/realm-disco-domain.c
+++ b/service/realm-disco-domain.c
@@ -37,6 +37,7 @@ typedef struct _Callback {
 typedef struct {
 	GObject parent;
 	gchar *input;
+	gboolean use_ldaps;
 	GCancellable *cancellable;
 	GDBusMethodInvocation *invocation;
 	GSocketAddressEnumerator *enumerator;
@@ -206,6 +207,7 @@ on_discover_next_address (GObject *source,
 
 		realm_diagnostics_info (self->invocation, "Performing LDAP DSE lookup on: %s", string);
 		realm_disco_rootdse_async (address, explicit_host,
+		                           self->use_ldaps,
 		                           self->invocation, self->cancellable,
 		                           on_discover_rootdse, g_object_ref (self));
 		self->outstanding++;
@@ -248,6 +250,7 @@ on_cancel_propagate (GCancellable *source,
 
 void
 realm_disco_domain_async (const gchar *string,
+                          gboolean use_ldaps,
                           GDBusMethodInvocation *invocation,
                           GAsyncReadyCallback callback,
                           gpointer user_data)
@@ -267,8 +270,11 @@ realm_disco_domain_async (const gchar *string,
 	if (self == NULL) {
 		self = g_object_new (REALM_TYPE_DISCO_DOMAIN, NULL);
 		self->input = g_strdup (string);
+		self->use_ldaps = use_ldaps;
 		self->invocation = g_object_ref (invocation);
-		self->enumerator = realm_disco_dns_enumerate_servers (string, invocation);
+		self->enumerator = realm_disco_dns_enumerate_servers (string,
+		                                                      use_ldaps,
+		                                                      invocation);
 
 		g_hash_table_insert (discover_cache, self->input, self);
 		g_assert (!self->completed);
diff --git a/service/realm-disco-domain.h b/service/realm-disco-domain.h
index 27dcc6c..02d4998 100644
--- a/service/realm-disco-domain.h
+++ b/service/realm-disco-domain.h
@@ -24,6 +24,7 @@
 G_BEGIN_DECLS
 
 void          realm_disco_domain_async    (const gchar *string,
+                                           gboolean use_ldaps,
                                            GDBusMethodInvocation *invocation,
                                            GAsyncReadyCallback callback,
                                            gpointer user_data);
diff --git a/service/realm-disco-mscldap.c b/service/realm-disco-mscldap.c
index d3d3c10..2504904 100644
--- a/service/realm-disco-mscldap.c
+++ b/service/realm-disco-mscldap.c
@@ -348,7 +348,7 @@ realm_disco_mscldap_async (GSocketAddress *address,
 		return;
 	}
 
-	clo->source = realm_ldap_connect_anonymous (address, protocol, cancellable);
+	clo->source = realm_ldap_connect_anonymous (address, protocol, FALSE, cancellable);
 	g_source_set_callback (clo->source, (GSourceFunc)on_ldap_io,
 	                       g_object_ref (task), g_object_unref);
 	g_source_attach (clo->source, g_task_get_context (task));
diff --git a/service/realm-disco-rootdse.c b/service/realm-disco-rootdse.c
index 7614071..4ed19e5 100644
--- a/service/realm-disco-rootdse.c
+++ b/service/realm-disco-rootdse.c
@@ -452,6 +452,7 @@ on_ldap_io (LDAP *ldap,
 void
 realm_disco_rootdse_async (GSocketAddress *address,
                            const gchar *explicit_server,
+                           gboolean use_ldaps,
                            GDBusMethodInvocation *invocation,
                            GCancellable *cancellable,
                            GAsyncReadyCallback callback,
@@ -473,7 +474,7 @@ realm_disco_rootdse_async (GSocketAddress *address,
 	g_task_set_task_data (task, clo, closure_free);
 
 	clo->source = realm_ldap_connect_anonymous (address, G_SOCKET_PROTOCOL_TCP,
-	                                            cancellable);
+	                                            use_ldaps, cancellable);
 	g_source_set_callback (clo->source, (GSourceFunc)on_ldap_io,
 	                       g_object_ref (task), g_object_unref);
 	g_source_attach (clo->source, g_task_get_context (task));
diff --git a/service/realm-disco-rootdse.h b/service/realm-disco-rootdse.h
index e024c84..7b21960 100644
--- a/service/realm-disco-rootdse.h
+++ b/service/realm-disco-rootdse.h
@@ -21,6 +21,7 @@
 
 void           realm_disco_rootdse_async    (GSocketAddress *address,
                                              const gchar *explicit_server,
+                                             gboolean use_ldaps,
                                              GDBusMethodInvocation *invocation,
                                              GCancellable *cancellable,
                                              GAsyncReadyCallback callback,
diff --git a/service/realm-ldap.c b/service/realm-ldap.c
index 7831b5b..28c5c8a 100644
--- a/service/realm-ldap.c
+++ b/service/realm-ldap.c
@@ -183,6 +183,7 @@ int ldap_init_fd (ber_socket_t fd, int proto, LDAP_CONST char *url, struct ldap
 GSource *
 realm_ldap_connect_anonymous (GSocketAddress *address,
                               GSocketProtocol protocol,
+                              gboolean use_ldaps,
                               GCancellable *cancellable)
 {
 	GSource *source;
@@ -238,7 +239,9 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
 		if (!g_unix_set_fd_nonblocking (ls->sock, FALSE, NULL))
 			g_warning ("couldn't set to blocking");
 
-		url = g_strdup_printf ("ldap://%s:%d", addrname, port);
+		url = g_strdup_printf ("%s://%s:%d",
+		                       use_ldaps ? "ldaps" : "ldap",
+		                       addrname, port);
 		rc = ldap_init_fd (ls->sock, 1, url, &ls->ldap);
 		g_free (url);
 
diff --git a/service/realm-ldap.h b/service/realm-ldap.h
index 263f72a..0f9f40e 100644
--- a/service/realm-ldap.h
+++ b/service/realm-ldap.h
@@ -37,6 +37,7 @@ typedef GIOCondition (* RealmLdapCallback)     (LDAP *ldap,
 
 GSource *     realm_ldap_connect_anonymous     (GSocketAddress *address,
                                                 GSocketProtocol protocol,
+                                                gboolean use_ldaps,
                                                 GCancellable *cancellable);
 
 void          realm_ldap_set_condition         (GSource *source,
diff --git a/service/realm-samba-provider.c b/service/realm-samba-provider.c
index 9b489ce..de9f5e6 100644
--- a/service/realm-samba-provider.c
+++ b/service/realm-samba-provider.c
@@ -27,6 +27,7 @@
 #include "realm-samba-enroll.h"
 #include "realm-samba-provider.h"
 #include "realm-samba-winbind.h"
+#include "realm-options.h"
 
 #include <glib/gstdio.h>
 
@@ -121,7 +122,9 @@ realm_samba_provider_discover_async (RealmProvider *provider,
 		g_task_return_pointer (task, NULL, NULL);
 
 	} else {
-		realm_disco_domain_async (string, invocation,
+		realm_disco_domain_async (string,
+		                          realm_option_use_ldaps (options),
+		                          invocation,
 		                          on_ad_discover, g_object_ref (task));
 	}
 
diff --git a/service/realm-sssd-provider.c b/service/realm-sssd-provider.c
index 7ac0645..db183c0 100644
--- a/service/realm-sssd-provider.c
+++ b/service/realm-sssd-provider.c
@@ -26,6 +26,7 @@
 #include "realm-sssd-ipa.h"
 #include "realm-sssd-provider.h"
 #include "realm-sssd-config.h"
+#include "realm-options.h"
 
 #include <glib/gstdio.h>
 
@@ -140,7 +141,9 @@ realm_sssd_provider_discover_async (RealmProvider *provider,
 		g_task_return_pointer (task, NULL, NULL);
 
 	} else {
-		realm_disco_domain_async (string, invocation, on_kerberos_discover,
+		realm_disco_domain_async (string,
+		                          realm_option_use_ldaps (options),
+		                          invocation, on_kerberos_discover,
 		                          g_object_ref (task));
 	}
 
-- 
2.26.2