Blame SOURCES/0030-AD-consider-resource_groups-in-PAC-as-well.patch

cdf651
From a7b308a01914458234bc05539e773e4c0762ad4b Mon Sep 17 00:00:00 2001
cdf651
From: Sumit Bose <sbose@redhat.com>
cdf651
Date: Thu, 28 Jun 2018 12:41:41 +0200
cdf651
Subject: [PATCH] AD: consider resource_groups in PAC as well
cdf651
cdf651
With recent versions of Active Directory the SIDs of Domain Local groups
cdf651
might be only available in the resource_groups section of the PAC, this
cdf651
feature is also called SID compression. To get a complete list of groups
cdf651
the user is a member of the SIDs from this section must be extracted as
cdf651
well.
cdf651
cdf651
Resolves https://pagure.io/SSSD/sssd/issue/3767
cdf651
cdf651
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
cdf651
(cherry picked from commit 13c8450788a429fa49ba532b40ebfd7f3a4132e4)
cdf651
cdf651
DOWNSTREAM:
cdf651
Resolves: rhbz#1592964 - Groups go missing with PAC enabled in sssd
cdf651
---
cdf651
 src/external/samba.m4             |   8 ++
cdf651
 src/providers/ad/ad_pac.c         | 130 ++++++++++++++++++++++++------
cdf651
 src/tests/cmocka/test_ad_common.c |  95 ++++++++++++++++++++++
cdf651
 3 files changed, 210 insertions(+), 23 deletions(-)
cdf651
cdf651
diff --git a/src/external/samba.m4 b/src/external/samba.m4
cdf651
index 794cac2461d7fbd5e690ea105cd346cbe6fcce9a..7a8c1eb7b9069f18def4e915b0fb9ab054a68e01 100644
cdf651
--- a/src/external/samba.m4
cdf651
+++ b/src/external/samba.m4
cdf651
@@ -122,3 +122,11 @@ int main(void)
cdf651
     AC_DEFINE_UNQUOTED(SMB_IDMAP_INTERFACE_VERSION, $idmap_version,
cdf651
                        [Detected version of Samba's idmap plugin interface])
cdf651
 fi
cdf651
+
cdf651
+SAVE_CFLAGS=$CFLAGS
cdf651
+CFLAGS="$CFLAGS $SMBCLIENT_CFLAGS $NDR_NBT_CFLAGS $NDR_KRB5PAC_CFLAGS -I/usr/include/samba-4.0"
cdf651
+AC_CHECK_MEMBERS([struct PAC_LOGON_INFO.resource_groups], , ,
cdf651
+                 [[ #include <ndr.h>
cdf651
+                    #include <gen_ndr/krb5pac.h>
cdf651
+                    #include <gen_ndr/krb5pac.h>]])
cdf651
+CFLAGS=$SAVE_CFLAGS
cdf651
diff --git a/src/providers/ad/ad_pac.c b/src/providers/ad/ad_pac.c
cdf651
index 1a344725fbf57d4d95c46163f2e31d44e69b3e65..80424b44e334958402cb8cfebedc1898f1e2f9c8 100644
cdf651
--- a/src/providers/ad/ad_pac.c
cdf651
+++ b/src/providers/ad/ad_pac.c
cdf651
@@ -146,6 +146,87 @@ errno_t check_if_pac_is_available(TALLOC_CTX *mem_ctx,
cdf651
     return EOK;
cdf651
 }
cdf651
 
cdf651
+static errno_t
cdf651
+add_sids_from_rid_array_to_hash_table(struct dom_sid *dom_sid,
cdf651
+                                      struct samr_RidWithAttributeArray *groups,
cdf651
+                                      struct sss_idmap_ctx *idmap_ctx,
cdf651
+                                      hash_table_t *sid_table)
cdf651
+{
cdf651
+    enum idmap_error_code err;
cdf651
+    char *dom_sid_str = NULL;
cdf651
+    size_t dom_sid_str_len;
cdf651
+    char *sid_str = NULL;
cdf651
+    char *rid_start;
cdf651
+    hash_key_t key;
cdf651
+    hash_value_t value;
cdf651
+    int ret;
cdf651
+    size_t c;
cdf651
+    TALLOC_CTX *tmp_ctx = NULL;
cdf651
+
cdf651
+    tmp_ctx = talloc_new(NULL);
cdf651
+    if (tmp_ctx == NULL) {
cdf651
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
cdf651
+        return ENOMEM;
cdf651
+    }
cdf651
+
cdf651
+    key.type = HASH_KEY_STRING;
cdf651
+    value.type = HASH_VALUE_ULONG;
cdf651
+
cdf651
+    err = sss_idmap_smb_sid_to_sid(idmap_ctx, dom_sid, &dom_sid_str);
cdf651
+    if (err != IDMAP_SUCCESS) {
cdf651
+        DEBUG(SSSDBG_OP_FAILURE, "sss_idmap_smb_sid_to_sid failed.\n");
cdf651
+        ret = EFAULT;
cdf651
+        goto done;
cdf651
+    }
cdf651
+
cdf651
+    dom_sid_str_len = strlen(dom_sid_str);
cdf651
+    sid_str = talloc_zero_size(tmp_ctx, dom_sid_str_len + 12);
cdf651
+    if (sid_str == NULL) {
cdf651
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_zero_size failed.\n");
cdf651
+        ret = ENOMEM;
cdf651
+        goto done;
cdf651
+    }
cdf651
+    rid_start = sid_str + dom_sid_str_len;
cdf651
+
cdf651
+    memcpy(sid_str, dom_sid_str, dom_sid_str_len);
cdf651
+
cdf651
+    for (c = 0; c < groups->count; c++) {
cdf651
+        memset(rid_start, '\0', 12);
cdf651
+        ret = snprintf(rid_start, 12, "-%lu",
cdf651
+                       (unsigned long) groups->rids[c].rid);
cdf651
+        if (ret < 0 || ret > 12) {
cdf651
+            DEBUG(SSSDBG_OP_FAILURE, "snprintf failed.\n");
cdf651
+            ret = EIO;
cdf651
+            goto done;
cdf651
+        }
cdf651
+
cdf651
+        key.str = sid_str;
cdf651
+        value.ul = 0;
cdf651
+
cdf651
+        ret = hash_enter(sid_table, &key, &value);
cdf651
+        if (ret != HASH_SUCCESS) {
cdf651
+            DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed [%d][%s].\n",
cdf651
+                                      ret, hash_error_string(ret));
cdf651
+            ret = EIO;
cdf651
+            goto done;
cdf651
+        }
cdf651
+
cdf651
+    }
cdf651
+
cdf651
+    ret = EOK;
cdf651
+
cdf651
+done:
cdf651
+    sss_idmap_free_sid(idmap_ctx, dom_sid_str);
cdf651
+    talloc_free(tmp_ctx);
cdf651
+
cdf651
+    return ret;
cdf651
+}
cdf651
+
cdf651
+struct resource_groups {
cdf651
+    struct dom_sid2 *domain_sid;
cdf651
+    struct samr_RidWithAttributeArray groups;
cdf651
+};
cdf651
+
cdf651
 errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
cdf651
                              struct sss_idmap_ctx *idmap_ctx,
cdf651
                              struct PAC_LOGON_INFO *logon_info,
cdf651
@@ -157,6 +238,7 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
cdf651
     int ret;
cdf651
     size_t s;
cdf651
     struct netr_SamInfo3 *info3;
cdf651
+    struct resource_groups resource_groups = { 0 };
cdf651
     char *sid_str = NULL;
cdf651
     char *msid_str = NULL;
cdf651
     char *user_dom_sid_str = NULL;
cdf651
@@ -188,9 +270,15 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
cdf651
     }
cdf651
 
cdf651
     info3 = &logon_info->info3;
cdf651
+#ifdef HAVE_STRUCT_PAC_LOGON_INFO_RESOURCE_GROUPS
cdf651
+    resource_groups.domain_sid = logon_info->resource_groups.domain_sid;
cdf651
+    resource_groups.groups.count = logon_info->resource_groups.groups.count;
cdf651
+    resource_groups.groups.rids = logon_info->resource_groups.groups.rids;
cdf651
+#endif
cdf651
 
cdf651
     ret = sss_hash_create(tmp_ctx,
cdf651
-                          info3->sidcount + info3->base.groups.count + 2,
cdf651
+                          info3->sidcount + info3->base.groups.count + 2
cdf651
+                                          + resource_groups.groups.count,
cdf651
                           &sid_table);
cdf651
     if (ret != EOK) {
cdf651
         DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");
cdf651
@@ -265,28 +353,13 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
cdf651
         goto done;
cdf651
     }
cdf651
 
cdf651
-
cdf651
-    for (s = 0; s < info3->base.groups.count; s++) {
cdf651
-        memset(rid_start, '\0', 12);
cdf651
-        ret = snprintf(rid_start, 12, "-%lu",
cdf651
-                                (unsigned long) info3->base.groups.rids[s].rid);
cdf651
-        if (ret < 0 || ret > 12) {
cdf651
-            DEBUG(SSSDBG_OP_FAILURE, "snprintf failed.\n");
cdf651
-            ret = EIO;
cdf651
-            goto done;
cdf651
-        }
cdf651
-
cdf651
-        key.str = sid_str;
cdf651
-        value.ul = 0;
cdf651
-
cdf651
-        ret = hash_enter(sid_table, &key, &value);
cdf651
-        if (ret != HASH_SUCCESS) {
cdf651
-            DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed [%d][%s].\n",
cdf651
-                                      ret, hash_error_string(ret));
cdf651
-            ret = EIO;
cdf651
-            goto done;
cdf651
-        }
cdf651
-
cdf651
+    ret = add_sids_from_rid_array_to_hash_table(info3->base.domain_sid,
cdf651
+                                                &info3->base.groups,
cdf651
+                                                idmap_ctx, sid_table);
cdf651
+    if (ret != EOK) {
cdf651
+        DEBUG(SSSDBG_OP_FAILURE,
cdf651
+              "add_sids_from_rid_array_to_hash_table failed.\n");
cdf651
+        goto done;
cdf651
     }
cdf651
 
cdf651
     for(s = 0; s < info3->sidcount; s++) {
cdf651
@@ -311,6 +384,17 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
cdf651
         }
cdf651
     }
cdf651
 
cdf651
+    if (resource_groups.domain_sid != NULL) {
cdf651
+        ret = add_sids_from_rid_array_to_hash_table(resource_groups.domain_sid,
cdf651
+                                                    &resource_groups.groups,
cdf651
+                                                    idmap_ctx, sid_table);
cdf651
+        if (ret != EOK) {
cdf651
+            DEBUG(SSSDBG_OP_FAILURE,
cdf651
+                  "add_sids_from_rid_array_to_hash_table failed.\n");
cdf651
+            goto done;
cdf651
+        }
cdf651
+    }
cdf651
+
cdf651
     num_sids = hash_count(sid_table);
cdf651
     sid_list = talloc_array(tmp_ctx, char *, num_sids);
cdf651
     if (sid_list == NULL) {
cdf651
diff --git a/src/tests/cmocka/test_ad_common.c b/src/tests/cmocka/test_ad_common.c
cdf651
index 39ebbc63324ca40d071f30582d2f15d732f6c466..ac3b0d0ab3c7b0a0ee4d21d96e1b4783ff1b4139 100644
cdf651
--- a/src/tests/cmocka/test_ad_common.c
cdf651
+++ b/src/tests/cmocka/test_ad_common.c
cdf651
@@ -207,6 +207,29 @@ static void test_check_if_pac_is_available(void **state)
cdf651
     "BEAEUAVgBFAEwAdv///4yBQZ5ZQnp3qwj2lKGcd0UAAAAAdv//" \
cdf651
     "/39fn4UneD5l6YxP8w/U0coAAAAA"
cdf651
 
cdf651
+#define TEST_PAC_RESOURCE_GROUPS_BASE64 \
cdf651
+    "BQAAAAAAAAABAAAA8AEAAFgAAAAAAAAACgAAABQAAABIAgAA" \
cdf651
+    "AAAAAAwAAABYAAAAYAIAAAAAAAAGAAAAEAAAALgCAAAAAAAA" \
cdf651
+    "BwAAABQAAADIAgAAAAAAAAEQCADMzMzM4AEAAAAAAAAAAAIA" \
cdf651
+    "Rr0gPUQO1AH/////////f/////////9/TRPNRwtu0wFN0zZy" \
cdf651
+    "1G7TAf////////9/CgAKAAQAAgAKAAoACAACAAAAAAAMAAIA" \
cdf651
+    "AAAAABAAAgAAAAAAFAACAAAAAAAYAAIACwAAAFEEAAABAgAA" \
cdf651
+    "AwAAABwAAgAgAgAAAAAAAAAAAAAAAAAAAAAAAAQABgAgAAIA" \
cdf651
+    "BgAIACQAAgAoAAIAAAAAAAAAAAAQAgAAAAAAAAAAAAAAAAAA" \
cdf651
+    "AAAAAAAAAAAAAAAAAAAAAAEAAAAsAAIANAACAAEAAAA4AAIA" \
cdf651
+    "BQAAAAAAAAAFAAAAdAB1AHMAZQByAAAABQAAAAAAAAAFAAAA" \
cdf651
+    "dAB1AHMAZQByAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
cdf651
+    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAECAAAHAAAA" \
cdf651
+    "YgQAAAcAAABjBAAABwAAAAMAAAAAAAAAAgAAAEQAQwAEAAAA" \
cdf651
+    "AAAAAAMAAABXAEkATgAAAAQAAAABBAAAAAAABRUAAAAkYm0r" \
cdf651
+    "SyFumd73jX0BAAAAMAACAAcAAAABAAAAAQEAAAAAABIBAAAA" \
cdf651
+    "BAAAAAEEAAAAAAAFFQAAACRibStLIW6Z3veNfQEAAABoBAAA" \
cdf651
+    "BwAAIAAAAACAEuVfRA7UAQoAdAB1AHMAZQByAAAAAAAoABAA" \
cdf651
+    "HAA4AAAAAAAAAAAAdAB1AHMAZQByAEAAdwBpAG4ALgB0AHIA" \
cdf651
+    "dQBzAHQALgB0AGUAcwB0AFcASQBOAC4AVABSAFUAUwBUAC4A" \
cdf651
+    "VABFAFMAVAAAAAAAEAAAAOGTj7I9Qn7XebOqdHb///+fHhrZ" \
cdf651
+    "kBt0So4jOFBk84sDAAAAAA=="
cdf651
+
cdf651
 static void test_ad_get_data_from_pac(void **state)
cdf651
 {
cdf651
     int ret;
cdf651
@@ -303,6 +326,73 @@ static void test_ad_get_sids_from_pac(void **state)
cdf651
     sss_idmap_free(idmap_ctx);
cdf651
 }
cdf651
 
cdf651
+#ifdef HAVE_STRUCT_PAC_LOGON_INFO_RESOURCE_GROUPS
cdf651
+static void test_ad_get_sids_from_pac_with_resource_groups(void **state)
cdf651
+{
cdf651
+    int ret;
cdf651
+    struct PAC_LOGON_INFO *logon_info;
cdf651
+    uint8_t *test_pac_blob;
cdf651
+    size_t test_pac_blob_size;
cdf651
+    char *user_sid;
cdf651
+    char *primary_group_sid;
cdf651
+    size_t num_sids;
cdf651
+    char **sid_list;
cdf651
+    struct sss_idmap_ctx *idmap_ctx;
cdf651
+    enum idmap_error_code err;
cdf651
+    size_t c;
cdf651
+    size_t s;
cdf651
+
cdf651
+    const char *sid_check_list[] = { "S-1-5-21-728588836-2574131531-2106456030-513",
cdf651
+                                     "S-1-5-21-728588836-2574131531-2106456030-1122",
cdf651
+                                     "S-1-5-21-728588836-2574131531-2106456030-1123",
cdf651
+                                     "S-1-5-21-728588836-2574131531-2106456030-1128",
cdf651
+                                     "S-1-18-1",
cdf651
+                                     NULL };
cdf651
+
cdf651
+    struct ad_common_test_ctx *test_ctx = talloc_get_type(*state,
cdf651
+                                                  struct ad_common_test_ctx);
cdf651
+
cdf651
+    err = sss_idmap_init(sss_idmap_talloc, test_ctx, sss_idmap_talloc_free,
cdf651
+                         &idmap_ctx);
cdf651
+    assert_int_equal(err, IDMAP_SUCCESS);
cdf651
+
cdf651
+    test_pac_blob = sss_base64_decode(test_ctx, TEST_PAC_RESOURCE_GROUPS_BASE64,
cdf651
+                                      &test_pac_blob_size);
cdf651
+    assert_non_null(test_pac_blob_size);
cdf651
+
cdf651
+    ret = ad_get_data_from_pac(test_ctx, test_pac_blob, test_pac_blob_size,
cdf651
+                               &logon_info);
cdf651
+    assert_int_equal(ret, EOK);
cdf651
+
cdf651
+    ret = ad_get_sids_from_pac(test_ctx, idmap_ctx, logon_info, &user_sid,
cdf651
+                               &primary_group_sid, &num_sids, &sid_list);
cdf651
+    assert_int_equal(ret, EOK);
cdf651
+    assert_string_equal(user_sid,
cdf651
+                        "S-1-5-21-728588836-2574131531-2106456030-1105");
cdf651
+    assert_string_equal(primary_group_sid,
cdf651
+                        "S-1-5-21-728588836-2574131531-2106456030-513");
cdf651
+    assert_int_equal(num_sids, 5);
cdf651
+
cdf651
+    for (c = 0; sid_check_list[c] != NULL; c++) {
cdf651
+        for (s = 0; s < num_sids; s++) {
cdf651
+            if (strcmp(sid_check_list[c], sid_list[s]) == 0) {
cdf651
+                break;
cdf651
+            }
cdf651
+        }
cdf651
+        if (s == num_sids) {
cdf651
+            fail_msg("SID [%s] not found in SID list.", sid_check_list[c]);
cdf651
+        }
cdf651
+    }
cdf651
+
cdf651
+    talloc_free(test_pac_blob);
cdf651
+    talloc_free(logon_info);
cdf651
+    talloc_free(user_sid);
cdf651
+    talloc_free(primary_group_sid);
cdf651
+    talloc_free(sid_list);
cdf651
+    sss_idmap_free(idmap_ctx);
cdf651
+}
cdf651
+#endif
cdf651
+
cdf651
 static void test_ad_get_pac_data_from_user_entry(void **state)
cdf651
 {
cdf651
     int ret;
cdf651
@@ -912,6 +1002,11 @@ int main(int argc, const char *argv[])
cdf651
         cmocka_unit_test_setup_teardown(test_ad_get_sids_from_pac,
cdf651
                                         test_ad_common_setup,
cdf651
                                         test_ad_common_teardown),
cdf651
+#ifdef HAVE_STRUCT_PAC_LOGON_INFO_RESOURCE_GROUPS
cdf651
+        cmocka_unit_test_setup_teardown(test_ad_get_sids_from_pac_with_resource_groups,
cdf651
+                                        test_ad_common_setup,
cdf651
+                                        test_ad_common_teardown),
cdf651
+#endif
cdf651
         cmocka_unit_test_setup_teardown(test_ad_get_pac_data_from_user_entry,
cdf651
                                         test_ad_common_setup,
cdf651
                                         test_ad_common_teardown),
cdf651
-- 
cdf651
2.17.1
cdf651