Blob Blame History Raw
From 0dc81a52e2836010974e9f71b1f3e47c20fd498d Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 9 Oct 2020 11:56:21 +0200
Subject: [PATCH 7/8] negcache: make sure short names are added to sub-domains

If short names are used with filter_users or filter_groups in a
[domain/...] section they should be added to the sub-domains of this
domain as well.

Resolves: https://github.com/SSSD/sssd/issues/5238

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
---
 src/responder/common/negcache.c  | 105 +++++++------
 src/tests/cmocka/test_negcache.c | 254 +++++++++++++++++++++++++++++++
 2 files changed, 312 insertions(+), 47 deletions(-)

diff --git a/src/responder/common/negcache.c b/src/responder/common/negcache.c
index 139218420..9ee39ce3e 100644
--- a/src/responder/common/negcache.c
+++ b/src/responder/common/negcache.c
@@ -971,6 +971,7 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
     char *name = NULL;
     struct sss_domain_info *dom = NULL;
     struct sss_domain_info *domain_list = rctx->domains;
+    struct sss_domain_info *ddom;
     char *domainname = NULL;
     char *conf_path = NULL;
     TALLOC_CTX *tmpctx = talloc_new(NULL);
@@ -1013,39 +1014,44 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
                 continue;
             }
 
-            if (domainname && strcmp(domainname, dom->name)) {
-                DEBUG(SSSDBG_TRACE_FUNC,
-                      "Mismatch between domain name (%s) and name "
-                          "set in FQN  (%s), assuming %s is UPN\n",
-                          dom->name, domainname, filter_list[i]);
-                ret = sss_ncache_set_upn(ncache, true, dom, filter_list[i]);
+            /* Check domain and its sub-domains */
+            for (ddom = dom; ddom != NULL;
+                        ddom = get_next_domain(ddom, SSS_GND_ALL_SUBDOMAINS)) {
+
+                if (domainname && strcmp(domainname, ddom->name)) {
+                    DEBUG(SSSDBG_TRACE_FUNC,
+                          "Mismatch between domain name (%s) and name "
+                              "set in FQN  (%s), assuming %s is UPN\n",
+                              ddom->name, domainname, filter_list[i]);
+                    ret = sss_ncache_set_upn(ncache, true, ddom, filter_list[i]);
+                    if (ret != EOK) {
+                        DEBUG(SSSDBG_OP_FAILURE,
+                              "sss_ncache_set_upn failed (%d [%s]), ignored\n",
+                              ret, sss_strerror(ret));
+                    }
+                    continue;
+                }
+
+                fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);
+                if (fqname == NULL) {
+                    continue;
+                }
+
+                ret = sss_ncache_set_upn(ncache, true, ddom, fqname);
                 if (ret != EOK) {
                     DEBUG(SSSDBG_OP_FAILURE,
                           "sss_ncache_set_upn failed (%d [%s]), ignored\n",
                           ret, sss_strerror(ret));
                 }
-                continue;
-            }
-
-            fqname = sss_create_internal_fqname(tmpctx, name, dom->name);
-            if (fqname == NULL) {
-                continue;
-            }
-
-            ret = sss_ncache_set_upn(ncache, true, dom, fqname);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_OP_FAILURE,
-                      "sss_ncache_set_upn failed (%d [%s]), ignored\n",
-                      ret, sss_strerror(ret));
-            }
-            ret = sss_ncache_set_user(ncache, true, dom, fqname);
-            talloc_zfree(fqname);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_CRIT_FAILURE,
-                      "Failed to store permanent user filter for [%s]"
-                          " (%d [%s])\n", filter_list[i],
-                          ret, sss_strerror(ret));
-                continue;
+                ret = sss_ncache_set_user(ncache, true, ddom, fqname);
+                talloc_zfree(fqname);
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_CRIT_FAILURE,
+                          "Failed to store permanent user filter for [%s]"
+                              " (%d [%s])\n", filter_list[i],
+                              ret, sss_strerror(ret));
+                    continue;
+                }
             }
         }
     }
@@ -1161,27 +1167,32 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,
                 continue;
             }
 
-            if (domainname && strcmp(domainname, dom->name)) {
-                DEBUG(SSSDBG_CRIT_FAILURE,
-                      "Mismatch between domain name (%s) and name "
-                          "set in FQN  (%s), skipping group %s\n",
-                          dom->name, domainname, name);
-                continue;
-            }
+            /* Check domain and its sub-domains */
+            for (ddom = dom;
+                        ddom != NULL && (ddom == dom || ddom->parent != NULL);
+                        ddom = get_next_domain(ddom, SSS_GND_ALL_DOMAINS)) {
+                if (domainname && strcmp(domainname, ddom->name)) {
+                    DEBUG(SSSDBG_CRIT_FAILURE,
+                          "Mismatch between domain name (%s) and name "
+                              "set in FQN  (%s), skipping group %s\n",
+                              ddom->name, domainname, name);
+                    continue;
+                }
 
-            fqname = sss_create_internal_fqname(tmpctx, name, dom->name);
-            if (fqname == NULL) {
-                continue;
-            }
+                fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);
+                if (fqname == NULL) {
+                    continue;
+                }
 
-            ret = sss_ncache_set_group(ncache, true, dom, fqname);
-            talloc_zfree(fqname);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_CRIT_FAILURE,
-                      "Failed to store permanent group filter for [%s]"
-                          " (%d [%s])\n", filter_list[i],
-                          ret, strerror(ret));
-                continue;
+                ret = sss_ncache_set_group(ncache, true, ddom, fqname);
+                talloc_zfree(fqname);
+                if (ret != EOK) {
+                    DEBUG(SSSDBG_CRIT_FAILURE,
+                          "Failed to store permanent group filter for [%s]"
+                              " (%d [%s])\n", filter_list[i],
+                              ret, strerror(ret));
+                    continue;
+                }
             }
         }
     }
diff --git a/src/tests/cmocka/test_negcache.c b/src/tests/cmocka/test_negcache.c
index b3a379227..fb306b110 100644
--- a/src/tests/cmocka/test_negcache.c
+++ b/src/tests/cmocka/test_negcache.c
@@ -119,6 +119,8 @@ static int setup(void **state)
     int ret;
     struct test_state *ts;
 
+    test_dom_suite_setup(TESTS_PATH);
+
     ts = talloc(NULL, struct test_state);
     assert_non_null(ts);
 
@@ -133,6 +135,7 @@ static int setup(void **state)
 static int teardown(void **state)
 {
     struct test_state *ts = talloc_get_type_abort(*state, struct test_state);
+    test_dom_suite_cleanup(TESTS_PATH, TEST_CONF_DB, TEST_DOM_NAME);
     talloc_free(ts);
     return 0;
 }
@@ -921,6 +924,255 @@ static void test_sss_ncache_reset_prepopulate(void **state)
     assert_int_equal(ret, EEXIST);
 }
 
+/* The main purpose of test_sss_ncache_short_name_in_domain is to test that
+ * short names in the filter_users or filter_groups options in a [domain/...]
+ * section are properly added to the related sub-domains as well (if there are
+ * any) and not added to domains from other [domain/...] sections. For
+ * completeness entries with fully-qualified names of the parent and the
+ * sub-domain and the generic UPN are added as well.
+ *
+ * The result should of course be independent of the present domains. To
+ * verify this the domains are added one after the other and the negative
+ * cache is repopulated each time.
+ *
+ * With the given domains, users and group we have to following expectations:
+ *  - the short name entry will be added to the domain and all sub-domains as
+ *    name and as upn by expanding it to a fully-qualified name with the
+ *    domain name or sub-domain name respectively
+ *  - the fully-qualified name from the parent domain is added as name and upn
+ *    to the parent domain and as upn to all sub-domains
+ *  - the fully-qualified name from the sub-domain is added as name to the
+ *    sub-domain and as upn to the parent and all sub-domains
+ *  - the generic upn is nowhere added as name and as upn to the parent and all
+ *    sub-domains
+ *  - none of the names is added to a different parent domain
+ *
+ * The following table should illustrated the expectations:
+ *
+ * user (name):
+ *                 | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom
+ *-----------------+-----------+-----------------------+--------------------------+------------
+ * TEST_DOM_NAME   |  PRESENT  |  PRESENT              |  MISSING                 |  MISSING
+ * subTEST_DOM_NAME|  PRESENT  |  MISSING              |  PRESENT                 |  MISSING
+ * TEST_DOM_NAME2  |  MISSING  |  MISSING              |  MISSING                 |  MISSING
+ *
+ * user (upn):
+ *                 | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom
+ *-----------------+-----------+-----------------------+--------------------------+------------
+ * TEST_DOM_NAME   |  PRESENT  |  PRESENT              |  PRESENT                 |  PRESENT
+ * subTEST_DOM_NAME|  PRESENT  |  PRESENT              |  PRESENT                 |  PRESENT
+ * TEST_DOM_NAME2  |  MISSING  |  MISSING              |  MISSING                 |  MISSING
+ *
+ *
+ *
+ * groups:
+ *                 | shortgroup | parentg@TEST_DOM_NAME | subdomg@subTEST_DOM_NAME
+ *-----------------+------------+-----------------------+-------------------------
+ * TEST_DOM_NAME   |  PRESENT   |  PRESENT              |  MISSING
+ * subTEST_DOM_NAME|  PRESENT   |  MISSING              |  PRESENT
+ * TEST_DOM_NAME2  |  MISSING   |  MISSING              |  MISSING
+ *
+ *
+ * The following expect_*() implement checks for the expextations:
+ */
+
+static void expect_in_parent(struct sss_nc_ctx *ncache,
+                             struct sss_domain_info *dom)
+{
+    int ret;
+
+    ret = check_user_in_ncache(ncache, dom, "shortuser");
+    assert_int_equal(ret, EEXIST);
+    ret = sss_ncache_check_upn(ncache, dom, "shortuser@"TEST_DOM_NAME);
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_user_in_ncache(ncache, dom, "parentu");
+    assert_int_equal(ret, EEXIST);
+    ret = sss_ncache_check_upn(ncache, dom, "parentu@"TEST_DOM_NAME);
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_user_in_ncache(ncache, dom, "subdomu");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, dom, "subdomu@sub"TEST_DOM_NAME);
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_user_in_ncache(ncache, dom, "upn");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, dom, "upn@upn.dom");
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_group_in_ncache(ncache, dom, "shortgroup");
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_group_in_ncache(ncache, dom, "parentg");
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_group_in_ncache(ncache, dom, "subdomg");
+    assert_int_equal(ret, ENOENT);
+}
+
+static void expect_in_subdomain(struct sss_nc_ctx *ncache,
+                                struct sss_domain_info *sub_dom)
+{
+    int ret;
+
+    ret = check_user_in_ncache(ncache, sub_dom, "shortuser");
+    assert_int_equal(ret, EEXIST);
+    ret = sss_ncache_check_upn(ncache, sub_dom, "shortuser@sub"TEST_DOM_NAME);
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_user_in_ncache(ncache, sub_dom, "subdomu");
+    assert_int_equal(ret, EEXIST);
+    ret = sss_ncache_check_upn(ncache, sub_dom, "subdomu@sub"TEST_DOM_NAME);
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_user_in_ncache(ncache, sub_dom, "upn");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, sub_dom, "upn@upn.dom");
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_user_in_ncache(ncache, sub_dom, "parentu");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, sub_dom, "parentu@"TEST_DOM_NAME);
+    assert_int_equal(ret, EEXIST);
+
+
+    ret = check_group_in_ncache(ncache, sub_dom, "shortgroup");
+    assert_int_equal(ret, EEXIST);
+
+    ret = check_group_in_ncache(ncache, sub_dom, "parentg");
+    assert_int_equal(ret, ENOENT);
+
+    ret = check_group_in_ncache(ncache, sub_dom, "subdomg");
+    assert_int_equal(ret, EEXIST);
+}
+static void expect_no_entries_in_dom(struct sss_nc_ctx *ncache,
+                                     struct sss_domain_info *dom2)
+{
+    int ret;
+
+    ret = check_user_in_ncache(ncache, dom2, "shortuser");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, dom2, "shortuser"TEST_DOM_NAME);
+    assert_int_equal(ret, ENOENT);
+
+    ret = check_user_in_ncache(ncache, dom2, "parentu");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, dom2, "parentu@"TEST_DOM_NAME);
+    assert_int_equal(ret, ENOENT);
+
+    ret = check_user_in_ncache(ncache, dom2, "subdomu");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, dom2, "subdomu@sub"TEST_DOM_NAME);
+    assert_int_equal(ret, ENOENT);
+
+    ret = check_user_in_ncache(ncache, dom2, "upn");
+    assert_int_equal(ret, ENOENT);
+    ret = sss_ncache_check_upn(ncache, dom2, "upn@upn.dom");
+    assert_int_equal(ret, ENOENT);
+
+    ret = check_group_in_ncache(ncache, dom2, "shortgroup");
+    assert_int_equal(ret, ENOENT);
+
+    ret = check_group_in_ncache(ncache, dom2, "parentg");
+    assert_int_equal(ret, ENOENT);
+
+    ret = check_group_in_ncache(ncache, dom2, "subdomg");
+    assert_int_equal(ret, ENOENT);
+}
+
+static void test_sss_ncache_short_name_in_domain(void **state)
+{
+    int ret;
+    struct test_state *ts;
+    struct tevent_context *ev;
+    struct sss_nc_ctx *ncache;
+    struct sss_test_ctx *tc;
+    struct sss_domain_info *dom;
+    struct sss_domain_info *dom2;
+    struct sss_domain_info *sub_dom;
+
+    struct sss_test_conf_param params[] = {
+        { "filter_users", "shortuser, parentu@"TEST_DOM_NAME", "
+          "subdomu@sub"TEST_DOM_NAME", upn@upn.dom" },
+        { "filter_groups", "shortgroup, parentg@"TEST_DOM_NAME", "
+          "subdomg@sub"TEST_DOM_NAME },
+        { NULL, NULL },
+    };
+
+    const char *nss_filter_users[] = { params[0].value, NULL};
+    const char *nss_filter_groups[] = { params[1].value, NULL};
+
+    ts = talloc_get_type_abort(*state, struct test_state);
+
+    ev = tevent_context_init(ts);
+    assert_non_null(ev);
+
+    dom = talloc_zero(ts, struct sss_domain_info);
+    assert_non_null(dom);
+    dom->name = discard_const_p(char, TEST_DOM_NAME);
+    sss_domain_set_state(dom, DOM_ACTIVE);
+
+    ts->nctx = mock_nctx(ts);
+    assert_non_null(ts->nctx);
+
+    tc = create_dom_test_ctx(ts, TESTS_PATH, TEST_CONF_DB,
+                             TEST_DOM_NAME, TEST_ID_PROVIDER, params);
+    assert_non_null(tc);
+
+    ret = confdb_add_param(tc->confdb, true, "config/domain/"TEST_DOM_NAME,
+                           "filter_users", nss_filter_users);
+    assert_int_equal(ret, EOK);
+
+    ret = confdb_add_param(tc->confdb, true, "config/domain"TEST_DOM_NAME,
+                           "filter_groups", nss_filter_groups);
+    assert_int_equal(ret, EOK);
+
+    ncache = ts->ctx;
+    ts->rctx = mock_rctx(ts, ev, dom, ts->nctx);
+    assert_non_null(ts->rctx);
+    ts->rctx->cdb = tc->confdb;
+
+    ret = sss_names_init(ts, tc->confdb, TEST_DOM_NAME, &dom->names);
+    assert_int_equal(ret, EOK);
+
+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
+    assert_int_equal(ret, EOK);
+
+    /* Add another domain */
+    dom2 = talloc_zero(ts, struct sss_domain_info);
+    assert_non_null(dom2);
+    dom2->name = discard_const_p(char, TEST_DOM_NAME"2");
+    sss_domain_set_state(dom2, DOM_ACTIVE);
+    dom->next = dom2;
+    dom2->names = dom->names;
+
+    expect_in_parent(ncache, dom);
+    expect_no_entries_in_dom(ncache, dom2);
+
+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
+    assert_int_equal(ret, EOK);
+
+    expect_in_parent(ncache, dom);
+    expect_no_entries_in_dom(ncache, dom2);
+
+    /* Add a sub domain */
+    sub_dom = talloc_zero(ts, struct sss_domain_info);
+    assert_non_null(sub_dom);
+    sub_dom->name = discard_const_p(char, "sub"TEST_DOM_NAME);
+    sss_domain_set_state(sub_dom, DOM_ACTIVE);
+    sub_dom->parent = dom;
+    dom->subdomains = sub_dom;
+    sub_dom->names = dom->names;
+
+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);
+    assert_int_equal(ret, EOK);
+
+    expect_in_parent(ncache, dom);
+    expect_in_subdomain(ncache, sub_dom);
+    expect_no_entries_in_dom(ncache, dom2);
+}
+
 static void test_sss_ncache_reset(void **state)
 {
     errno_t ret;
@@ -1083,6 +1335,8 @@ int main(void)
                                         setup, teardown),
         cmocka_unit_test_setup_teardown(test_sss_ncache_reset_prepopulate,
                                         setup, teardown),
+        cmocka_unit_test_setup_teardown(test_sss_ncache_short_name_in_domain,
+                                        setup, teardown),
         cmocka_unit_test_setup_teardown(test_sss_ncache_reset,
                                         setup, teardown),
         cmocka_unit_test_setup_teardown(test_sss_ncache_locate_uid_gid,
-- 
2.21.3