From 2ea937af47c529ca827bcdd307a47e2b96690d38 Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Thu, 12 Sep 2019 14:49:30 +0200

Subject: [PATCH 93/97] utils: extend some find_domain_* calls to search

 disabled domain

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

This extension is needed to support disabled domains since it is

now important to know if a domain is really unknown or only disabled.

While an unknown domain might typically lead to an error, a caller might

just ignore requests for disabled domains or objects from disabled

domains.

Related to https://pagure.io/SSSD/sssd/issue/4078

Reviewed-by: Pavel Březina <pbrezina@redhat.com>

---

 src/providers/ipa/ipa_id.c                 |  3 +-

 src/responder/sudo/sudosrv_get_sudorules.c |  3 +-

 src/tests/cmocka/test_utils.c              | 90 ++++++++++++++++++++++

 src/util/domain_info_utils.c               | 31 +++++---

 src/util/util.h                            |  7 +-

 5 files changed, 122 insertions(+), 12 deletions(-)

diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c

index 9abee34cb..f34692aa2 100644

--- a/src/providers/ipa/ipa_id.c

+++ b/src/providers/ipa/ipa_id.c

@@ -138,7 +138,8 @@ static errno_t ipa_resolve_user_list_get_user_step(struct tevent_req *req)

     state->user_domain = find_domain_by_object_name_ex(

                                         state->ipa_ctx->sdap_id_ctx->be->domain,

-                                        ar->filter_value, true);

+                                        ar->filter_value, true,

+                                        SSS_GND_DESCEND);

     /* Use provided domain as fallback because no known domain was found in the

      * user name. */

     if (state->user_domain == NULL) {

diff --git a/src/responder/sudo/sudosrv_get_sudorules.c b/src/responder/sudo/sudosrv_get_sudorules.c

index d928a5ead..c9c11bfde 100644

--- a/src/responder/sudo/sudosrv_get_sudorules.c

+++ b/src/responder/sudo/sudosrv_get_sudorules.c

@@ -147,7 +147,8 @@ static errno_t sudosrv_format_runas(struct resp_ctx *rctx,

             continue;

         }

-        dom = find_domain_by_object_name_ex(rctx->domains, value, true);

+        dom = find_domain_by_object_name_ex(rctx->domains, value, true,

+                                            SSS_GND_DESCEND);

         if (dom == NULL) {

             continue;

         }

diff --git a/src/tests/cmocka/test_utils.c b/src/tests/cmocka/test_utils.c

index 1a8699a2a..d49eb9fbc 100644

--- a/src/tests/cmocka/test_utils.c

+++ b/src/tests/cmocka/test_utils.c

@@ -400,6 +400,92 @@ void test_find_domain_by_name_disabled(void **state)

     }

 }

+void test_find_domain_by_name_ex_disabled(void **state)

+{

+    struct dom_list_test_ctx *test_ctx = talloc_get_type(*state,

+                                                      struct dom_list_test_ctx);

+    struct sss_domain_info *dom;

+    struct sss_domain_info *disabled_dom;

+    size_t c;

+    size_t mis;

+

+    mis = test_ctx->dom_count/2;

+    assert_true((mis >= 1 && mis < test_ctx->dom_count));

+

+    dom = test_ctx->dom_list;

+    for (c = 0; c < mis; c++) {

+        assert_non_null(dom);

+        dom = dom->next;

+    }

+    assert_non_null(dom);

+    sss_domain_set_state(dom, DOM_DISABLED);

+    disabled_dom = dom;

+

+    dom = find_domain_by_name(test_ctx->dom_list, disabled_dom->name, true);

+    assert_null(dom);

+

+    dom = find_domain_by_name_ex(test_ctx->dom_list, disabled_dom->name, true,

+                                 SSS_GND_DESCEND);

+    assert_null(dom);

+

+    dom = find_domain_by_name_ex(test_ctx->dom_list, disabled_dom->name, true,

+                                 SSS_GND_DESCEND | SSS_GND_INCLUDE_DISABLED);

+    assert_non_null(dom);

+    assert_ptr_equal(disabled_dom, dom);

+

+    dom = find_domain_by_name_ex(test_ctx->dom_list, disabled_dom->name, true,

+                                 SSS_GND_ALL_DOMAINS);

+    assert_non_null(dom);

+    assert_ptr_equal(disabled_dom, dom);

+}

+

+void test_find_domain_by_object_name_ex(void **state)

+{

+    struct dom_list_test_ctx *test_ctx = talloc_get_type(*state,

+                                                      struct dom_list_test_ctx);

+    struct sss_domain_info *dom;

+    struct sss_domain_info *disabled_dom;

+    size_t c;

+    size_t mis;

+    char *obj_name;

+

+    mis = test_ctx->dom_count/2;

+    assert_true((mis >= 1 && mis < test_ctx->dom_count));

+

+    dom = test_ctx->dom_list;

+    for (c = 0; c < mis; c++) {

+        assert_non_null(dom);

+        dom = dom->next;

+    }

+    assert_non_null(dom);

+    sss_domain_set_state(dom, DOM_DISABLED);

+    disabled_dom = dom;

+

+    obj_name = talloc_asprintf(global_talloc_context, "myname@%s",

+                               disabled_dom->name);

+    assert_non_null(obj_name);

+

+

+    dom = find_domain_by_object_name(test_ctx->dom_list, obj_name);

+    assert_null(dom);

+

+    dom = find_domain_by_object_name_ex(test_ctx->dom_list, obj_name, true,

+                                        SSS_GND_DESCEND);

+    assert_null(dom);

+

+    dom = find_domain_by_object_name_ex(test_ctx->dom_list, obj_name, true,

+                                    SSS_GND_DESCEND | SSS_GND_INCLUDE_DISABLED);

+    assert_non_null(dom);

+    assert_ptr_equal(disabled_dom, dom);

+

+    dom = find_domain_by_object_name_ex(test_ctx->dom_list, obj_name, true,

+                                        SSS_GND_ALL_DOMAINS);

+    assert_non_null(dom);

+    assert_ptr_equal(disabled_dom, dom);

+

+    talloc_free(obj_name);

+}

+

 void test_find_domain_by_sid_null(void **state)

 {

     struct dom_list_test_ctx *test_ctx = talloc_get_type(*state,

@@ -1877,6 +1963,10 @@ int main(int argc, const char *argv[])

                                         setup_dom_list, teardown_dom_list),

         cmocka_unit_test_setup_teardown(test_find_domain_by_name_disabled,

                                         setup_dom_list, teardown_dom_list),

+        cmocka_unit_test_setup_teardown(test_find_domain_by_name_ex_disabled,

+                                        setup_dom_list, teardown_dom_list),

+        cmocka_unit_test_setup_teardown(test_find_domain_by_object_name_ex,

+                                        setup_dom_list, teardown_dom_list),

         cmocka_unit_test_setup_teardown(test_sss_names_init,

                                         confdb_test_setup,

diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c

index 4b1c9df39..c56a0611e 100644

--- a/src/util/domain_info_utils.c

+++ b/src/util/domain_info_utils.c

@@ -93,9 +93,10 @@ bool subdomain_enumerates(struct sss_domain_info *parent,

     return false;

 }

-struct sss_domain_info *find_domain_by_name(struct sss_domain_info *domain,

-                                            const char *name,

-                                            bool match_any)

+struct sss_domain_info *find_domain_by_name_ex(struct sss_domain_info *domain,

+                                                const char *name,

+                                                bool match_any,

+                                                uint32_t gnd_flags)

 {

     struct sss_domain_info *dom = domain;

@@ -103,21 +104,31 @@ struct sss_domain_info *find_domain_by_name(struct sss_domain_info *domain,

         return NULL;

     }

-    while (dom && sss_domain_get_state(dom) == DOM_DISABLED) {

-        dom = get_next_domain(dom, SSS_GND_DESCEND);

+    if (!(gnd_flags & SSS_GND_INCLUDE_DISABLED)) {

+        while (dom && sss_domain_get_state(dom) == DOM_DISABLED) {

+            dom = get_next_domain(dom, gnd_flags);

+        }

     }

+

     while (dom) {

         if (strcasecmp(dom->name, name) == 0 ||

             ((match_any == true) && (dom->flat_name != NULL) &&

              (strcasecmp(dom->flat_name, name) == 0))) {

             return dom;

         }

-        dom = get_next_domain(dom, SSS_GND_DESCEND);

+        dom = get_next_domain(dom, gnd_flags);

     }

     return NULL;

 }

+struct sss_domain_info *find_domain_by_name(struct sss_domain_info *domain,

+                                            const char *name,

+                                            bool match_any)

+{

+    return find_domain_by_name_ex(domain, name, match_any, SSS_GND_DESCEND);

+}

+

 struct sss_domain_info *find_domain_by_sid(struct sss_domain_info *domain,

                                               const char *sid)

 {

@@ -175,7 +186,8 @@ sss_get_domain_by_sid_ldap_fallback(struct sss_domain_info *domain,

 struct sss_domain_info *

 find_domain_by_object_name_ex(struct sss_domain_info *domain,

-                              const char *object_name, bool strict)

+                              const char *object_name, bool strict,

+                              uint32_t gnd_flags)

 {

     TALLOC_CTX *tmp_ctx;

     struct sss_domain_info *dom = NULL;

@@ -203,7 +215,7 @@ find_domain_by_object_name_ex(struct sss_domain_info *domain,

             dom = domain;

         }

     } else {

-        dom = find_domain_by_name(domain, domainname, true);

+        dom = find_domain_by_name_ex(domain, domainname, true, gnd_flags);

     }

 done:

@@ -215,7 +227,8 @@ struct sss_domain_info *

 find_domain_by_object_name(struct sss_domain_info *domain,

                            const char *object_name)

 {

-    return find_domain_by_object_name_ex(domain, object_name, false);

+    return find_domain_by_object_name_ex(domain, object_name, false,

+                                         SSS_GND_DESCEND);

 }

 errno_t sssd_domain_init(TALLOC_CTX *mem_ctx,

diff --git a/src/util/util.h b/src/util/util.h

index fce7e42c3..8a754dbfd 100644

--- a/src/util/util.h

+++ b/src/util/util.h

@@ -542,6 +542,10 @@ struct sss_domain_info *get_next_domain(struct sss_domain_info *domain,

 struct sss_domain_info *find_domain_by_name(struct sss_domain_info *domain,

                                             const char *name,

                                             bool match_any);

+struct sss_domain_info *find_domain_by_name_ex(struct sss_domain_info *domain,

+                                               const char *name,

+                                               bool match_any,

+                                               uint32_t gnd_flags);

 struct sss_domain_info *find_domain_by_sid(struct sss_domain_info *domain,

                                            const char *sid);

 enum sss_domain_state sss_domain_get_state(struct sss_domain_info *dom);

@@ -560,7 +564,8 @@ find_domain_by_object_name(struct sss_domain_info *domain,

 struct sss_domain_info *

 find_domain_by_object_name_ex(struct sss_domain_info *domain,

-                              const char *object_name, bool strict);

+                              const char *object_name, bool strict,

+                              uint32_t gnd_flags);

 bool subdomain_enumerates(struct sss_domain_info *parent,

                           const char *sd_name);

-- 

2.20.1