Blame SOURCES/0008-LDAP-always-store-the-certificate-from-the-request.patch

bb7cd1
From a3cc501e36f5cf1e4a8187d723b53111f5481b36 Mon Sep 17 00:00:00 2001
bb7cd1
From: Sumit Bose <sbose@redhat.com>
bb7cd1
Date: Mon, 30 Nov 2015 12:14:55 +0100
bb7cd1
Subject: [PATCH 08/15] LDAP: always store the certificate from the request
bb7cd1
MIME-Version: 1.0
bb7cd1
Content-Type: text/plain; charset=UTF-8
bb7cd1
Content-Transfer-Encoding: 8bit
bb7cd1
bb7cd1
Store the certificate used to lookup a user as mapped attribute in the
bb7cd1
cached user object.
bb7cd1
bb7cd1
Related to https://pagure.io/SSSD/sssd/issue/3050
bb7cd1
bb7cd1
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
bb7cd1
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
bb7cd1
---
bb7cd1
 src/db/sysdb.h                  |  1 +
bb7cd1
 src/db/sysdb_ops.c              |  4 ++--
bb7cd1
 src/providers/ldap/ldap_id.c    | 19 ++++++++++++++++++-
bb7cd1
 src/tests/cmocka/test_nss_srv.c |  2 +-
bb7cd1
 src/tests/cmocka/test_pam_srv.c |  6 +++---
bb7cd1
 src/tests/sysdb-tests.c         |  4 ++--
bb7cd1
 6 files changed, 27 insertions(+), 9 deletions(-)
bb7cd1
bb7cd1
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
bb7cd1
index 098f47f91187aac75c58c02f0af738c344765762..3db22b3689bf6ffd9a48e29c229916e3fac9ca1b 100644
bb7cd1
--- a/src/db/sysdb.h
bb7cd1
+++ b/src/db/sysdb.h
bb7cd1
@@ -139,6 +139,7 @@
bb7cd1
 
bb7cd1
 #define SYSDB_AUTH_TYPE "authType"
bb7cd1
 #define SYSDB_USER_CERT "userCertificate"
bb7cd1
+#define SYSDB_USER_MAPPED_CERT "userMappedCertificate"
bb7cd1
 #define SYSDB_USER_EMAIL "mail"
bb7cd1
 
bb7cd1
 #define SYSDB_SUBDOMAIN_REALM "realmName"
bb7cd1
diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
bb7cd1
index 6c2254df2b75d3d3419528523103ad9cddb40c9d..8ae25764478e522255b177f9e8de1d3ca1ad43fd 100644
bb7cd1
--- a/src/db/sysdb_ops.c
bb7cd1
+++ b/src/db/sysdb_ops.c
bb7cd1
@@ -4660,7 +4660,7 @@ errno_t sysdb_search_object_by_cert(TALLOC_CTX *mem_ctx,
bb7cd1
     int ret;
bb7cd1
     char *user_filter;
bb7cd1
 
bb7cd1
-    ret = sss_cert_derb64_to_ldap_filter(mem_ctx, cert, SYSDB_USER_CERT,
bb7cd1
+    ret = sss_cert_derb64_to_ldap_filter(mem_ctx, cert, SYSDB_USER_MAPPED_CERT,
bb7cd1
                                          &user_filter);
bb7cd1
     if (ret != EOK) {
bb7cd1
         DEBUG(SSSDBG_OP_FAILURE, "sss_cert_derb64_to_ldap_filter failed.\n");
bb7cd1
@@ -4749,7 +4749,7 @@ errno_t sysdb_remove_mapped_data(struct sss_domain_info *domain,
bb7cd1
 errno_t sysdb_remove_cert(struct sss_domain_info *domain,
bb7cd1
                           const char *cert)
bb7cd1
 {
bb7cd1
-    struct ldb_message_element el = { 0, SYSDB_USER_CERT, 0, NULL };
bb7cd1
+    struct ldb_message_element el = { 0, SYSDB_USER_MAPPED_CERT, 0, NULL };
bb7cd1
     struct sysdb_attrs del_attrs = { 1, &el };
bb7cd1
     const char *attrs[] = {SYSDB_NAME, NULL};
bb7cd1
     struct ldb_result *res = NULL;
bb7cd1
diff --git a/src/providers/ldap/ldap_id.c b/src/providers/ldap/ldap_id.c
bb7cd1
index 898ddb18689d55fcc3fdf021b38df0e574003eb2..a8b4bc2cfc6e9d4e0d74b0e3e036afbcbf7eb26e 100644
bb7cd1
--- a/src/providers/ldap/ldap_id.c
bb7cd1
+++ b/src/providers/ldap/ldap_id.c
bb7cd1
@@ -60,6 +60,7 @@ struct users_get_state {
bb7cd1
     int dp_error;
bb7cd1
     int sdap_ret;
bb7cd1
     bool noexist_delete;
bb7cd1
+    struct sysdb_attrs *extra_attrs;
bb7cd1
 };
bb7cd1
 
bb7cd1
 static int users_get_retry(struct tevent_req *req);
bb7cd1
@@ -99,6 +100,7 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx,
bb7cd1
     state->conn = conn;
bb7cd1
     state->dp_error = DP_ERR_FATAL;
bb7cd1
     state->noexist_delete = noexist_delete;
bb7cd1
+    state->extra_attrs = NULL;
bb7cd1
 
bb7cd1
     state->op = sdap_id_op_create(state, state->conn->conn_cache);
bb7cd1
     if (!state->op) {
bb7cd1
@@ -251,6 +253,21 @@ struct tevent_req *users_get_send(TALLOC_CTX *memctx,
bb7cd1
                   "sss_cert_derb64_to_ldap_filter failed.\n");
bb7cd1
             goto done;
bb7cd1
         }
bb7cd1
+
bb7cd1
+        state->extra_attrs = sysdb_new_attrs(state);
bb7cd1
+        if (state->extra_attrs == NULL) {
bb7cd1
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_new_attrs failed.\n");
bb7cd1
+            ret = ENOMEM;
bb7cd1
+            goto done;
bb7cd1
+        }
bb7cd1
+
bb7cd1
+        ret = sysdb_attrs_add_base64_blob(state->extra_attrs,
bb7cd1
+                                          SYSDB_USER_MAPPED_CERT, filter_value);
bb7cd1
+        if (ret != EOK) {
bb7cd1
+            DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_add_base64_blob failed.\n");
bb7cd1
+            goto done;
bb7cd1
+        }
bb7cd1
+
bb7cd1
         break;
bb7cd1
     default:
bb7cd1
         ret = EINVAL;
bb7cd1
@@ -442,7 +459,7 @@ static void users_get_search(struct tevent_req *req)
bb7cd1
                                  state->attrs, state->filter,
bb7cd1
                                  dp_opt_get_int(state->ctx->opts->basic,
bb7cd1
                                                 SDAP_SEARCH_TIMEOUT),
bb7cd1
-                                 lookup_type, NULL);
bb7cd1
+                                 lookup_type, state->extra_attrs);
bb7cd1
     if (!subreq) {
bb7cd1
         tevent_req_error(req, ENOMEM);
bb7cd1
         return;
bb7cd1
diff --git a/src/tests/cmocka/test_nss_srv.c b/src/tests/cmocka/test_nss_srv.c
bb7cd1
index 72bbaf9bf35ebb3fc4208afaa3c7af95922afcb0..76b9c6fb05673130de0957e93291919c263a28f3 100644
bb7cd1
--- a/src/tests/cmocka/test_nss_srv.c
bb7cd1
+++ b/src/tests/cmocka/test_nss_srv.c
bb7cd1
@@ -3508,7 +3508,7 @@ static void test_nss_getnamebycert(void **state)
bb7cd1
     der = sss_base64_decode(nss_test_ctx, TEST_TOKEN_CERT, &der_size);
bb7cd1
     assert_non_null(der);
bb7cd1
 
bb7cd1
-    ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_CERT, der, der_size);
bb7cd1
+    ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_MAPPED_CERT, der, der_size);
bb7cd1
     talloc_free(der);
bb7cd1
     assert_int_equal(ret, EOK);
bb7cd1
 
bb7cd1
diff --git a/src/tests/cmocka/test_pam_srv.c b/src/tests/cmocka/test_pam_srv.c
bb7cd1
index ae2e555f7024027d1c0063031f8882bf81a31905..847419658bb983e6548722d6fa6fb22c63ee86b8 100644
bb7cd1
--- a/src/tests/cmocka/test_pam_srv.c
bb7cd1
+++ b/src/tests/cmocka/test_pam_srv.c
bb7cd1
@@ -1598,7 +1598,7 @@ static int test_lookup_by_cert_cb(void *pvt)
bb7cd1
         der = sss_base64_decode(pam_test_ctx, pvt, &der_size);
bb7cd1
         assert_non_null(der);
bb7cd1
 
bb7cd1
-        ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_CERT, der, der_size);
bb7cd1
+        ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_MAPPED_CERT, der, der_size);
bb7cd1
         talloc_free(der);
bb7cd1
         assert_int_equal(ret, EOK);
bb7cd1
 
bb7cd1
@@ -1630,7 +1630,7 @@ static int test_lookup_by_cert_double_cb(void *pvt)
bb7cd1
         der = sss_base64_decode(pam_test_ctx, pvt, &der_size);
bb7cd1
         assert_non_null(der);
bb7cd1
 
bb7cd1
-        ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_CERT, der, der_size);
bb7cd1
+        ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_MAPPED_CERT, der, der_size);
bb7cd1
         talloc_free(der);
bb7cd1
         assert_int_equal(ret, EOK);
bb7cd1
 
bb7cd1
@@ -1658,7 +1658,7 @@ static int test_lookup_by_cert_wrong_user_cb(void *pvt)
bb7cd1
         der = sss_base64_decode(pam_test_ctx, pvt, &der_size);
bb7cd1
         assert_non_null(der);
bb7cd1
 
bb7cd1
-        ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_CERT, der, der_size);
bb7cd1
+        ret = sysdb_attrs_add_mem(attrs, SYSDB_USER_MAPPED_CERT, der, der_size);
bb7cd1
         talloc_free(der);
bb7cd1
         assert_int_equal(ret, EOK);
bb7cd1
 
bb7cd1
diff --git a/src/tests/sysdb-tests.c b/src/tests/sysdb-tests.c
bb7cd1
index c343c734a27a335303974b6866a5d9e88d4c307e..5bdd631fbfa1b4463fb169e5f07b65fb2c784096 100644
bb7cd1
--- a/src/tests/sysdb-tests.c
bb7cd1
+++ b/src/tests/sysdb-tests.c
bb7cd1
@@ -5721,7 +5721,7 @@ START_TEST(test_sysdb_search_user_by_cert)
bb7cd1
     val.data = sss_base64_decode(test_ctx, TEST_USER_CERT_DERB64, &val.length);
bb7cd1
     fail_unless(val.data != NULL, "sss_base64_decode failed.");
bb7cd1
 
bb7cd1
-    ret = sysdb_attrs_add_val(data->attrs, SYSDB_USER_CERT, &val;;
bb7cd1
+    ret = sysdb_attrs_add_val(data->attrs, SYSDB_USER_MAPPED_CERT, &val;;
bb7cd1
     fail_unless(ret == EOK, "sysdb_attrs_add_val failed with [%d][%s].",
bb7cd1
                 ret, strerror(ret));
bb7cd1
 
bb7cd1
@@ -5750,7 +5750,7 @@ START_TEST(test_sysdb_search_user_by_cert)
bb7cd1
     data2 = test_data_new_user(test_ctx, 2345671);
bb7cd1
     fail_if(data2 == NULL);
bb7cd1
 
bb7cd1
-    ret = sysdb_attrs_add_val(data2->attrs, SYSDB_USER_CERT, &val;;
bb7cd1
+    ret = sysdb_attrs_add_val(data2->attrs, SYSDB_USER_MAPPED_CERT, &val;;
bb7cd1
     fail_unless(ret == EOK, "sysdb_attrs_add_val failed with [%d][%s].",
bb7cd1
                 ret, strerror(ret));
bb7cd1
 
bb7cd1
-- 
bb7cd1
2.9.3
bb7cd1