summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorPavel Březina <pbrezina@redhat.com>2013-04-16 15:41:33 +0200
committerJakub Hrozek <jhrozek@redhat.com>2013-05-02 16:48:12 +0200
commita679f0167b646cffdae86546ed77e105576991b0 (patch)
tree83dbeb4726485ab6ff833a6ef741002ba69def88 /src
parent5cc0b4ed2843ad093191f6dbe979a0afbe7c8619 (diff)
downloadsssd-a679f0167b646cffdae86546ed77e105576991b0.tar.gz
sssd-a679f0167b646cffdae86546ed77e105576991b0.tar.xz
sssd-a679f0167b646cffdae86546ed77e105576991b0.zip
DNS sites support - add AD SRV plugin
https://fedorahosted.org/sssd/ticket/1032
Diffstat (limited to 'src')
-rw-r--r--src/config/SSSDConfig/__init__.py.in1
-rw-r--r--src/config/etc/sssd.api.d/sssd-ad.conf1
-rw-r--r--src/external/libndr_nbt.m45
-rw-r--r--src/man/sssd-ad.5.xml21
-rw-r--r--src/providers/ad/ad_common.h1
-rw-r--r--src/providers/ad/ad_init.c30
-rw-r--r--src/providers/ad/ad_opts.h1
-rw-r--r--src/providers/ad/ad_srv.c773
-rw-r--r--src/providers/ad/ad_srv.h49
9 files changed, 877 insertions, 5 deletions
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index f603a2183..256c4b314 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -149,6 +149,7 @@ option_strings = {
'ad_server' : _('Active Directory server address'),
'ad_backup_server' : _('Active Directory backup server address'),
'ad_hostname' : _('Active Directory client hostname'),
+ 'ad_enable_dns_sites' : _('Enable DNS sites - location based service discovery'),
# [provider/krb5]
'krb5_kdcip' : _('Kerberos server address'),
diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf
index 4c257173c..b4b1d0ba1 100644
--- a/src/config/etc/sssd.api.d/sssd-ad.conf
+++ b/src/config/etc/sssd.api.d/sssd-ad.conf
@@ -3,6 +3,7 @@ ad_domain = str, None, false
ad_server = str, None, false
ad_backup_server = str, None, false
ad_hostname = str, None, false
+ad_enable_dns_sites = bool, None, false
ldap_uri = str, None, false
ldap_backup_uri = str, None, false
ldap_search_base = str, None, false
diff --git a/src/external/libndr_nbt.m4 b/src/external/libndr_nbt.m4
new file mode 100644
index 000000000..d4d94f2d6
--- /dev/null
+++ b/src/external/libndr_nbt.m4
@@ -0,0 +1,5 @@
+AC_SUBST(NDR_NBT_CFLAGS)
+AC_SUBST(NDR_NBT_LIBS)
+
+PKG_CHECK_MODULES(NDR_NBT, ndr_nbt, ,
+ AC_MSG_ERROR("Please install Samba 4 development libraries")) \ No newline at end of file
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 5513c2ee5..95a95f1ac 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -131,6 +131,27 @@ ldap_id_mapping = False
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>ad_enable_dns_sites (boolean)</term>
+ <listitem>
+ <para>
+ Enables DNS sites - location based
+ service discovery.
+ </para>
+ <para>
+ If true and service discovery (see Service
+ Discovery paragraph at the bottom of the man page)
+ is enabled, the SSSD will first attempt to discover
+ the Active Directory server to connect to using the
+ Active Directory Site Discovery and fall back to
+ the DNS SRV records if no AD site is found.
+ </para>
+ <para>
+ Default: true
+ </para>
+ </listitem>
+ </varlistentry>
+
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" />
<varlistentry>
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
index 320bf1c9d..7be15ba9b 100644
--- a/src/providers/ad/ad_common.h
+++ b/src/providers/ad/ad_common.h
@@ -37,6 +37,7 @@ enum ad_basic_opt {
AD_HOSTNAME,
AD_KEYTAB,
AD_KRB5_REALM,
+ AD_ENABLE_DNS_SITES,
AD_OPTS_BASIC /* opts counter */
};
diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c
index 087ec3c45..4d1098689 100644
--- a/src/providers/ad/ad_init.c
+++ b/src/providers/ad/ad_init.c
@@ -35,6 +35,7 @@
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_init_shared.h"
#include "providers/ad/ad_id.h"
+#include "providers/ad/ad_srv.h"
struct ad_options *ad_options = NULL;
@@ -108,6 +109,8 @@ sssm_ad_id_init(struct be_ctx *bectx,
struct ad_id_ctx *ad_ctx;
struct sdap_id_ctx *sdap_ctx;
const char *hostname;
+ const char *ad_domain;
+ struct ad_srv_plugin_ctx *srv_ctx;
if (!ad_options) {
ret = common_ad_init(bectx);
@@ -178,11 +181,28 @@ sssm_ad_id_init(struct be_ctx *bectx,
/* setup SRV lookup plugin */
hostname = dp_opt_get_string(ad_options->basic, AD_HOSTNAME);
- ret = be_fo_set_dns_srv_lookup_plugin(bectx, hostname);
- if (ret != EOK) {
- DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to set SRV lookup plugin "
- "[%d]: %s\n", ret, strerror(ret)));
- goto done;
+ if (dp_opt_get_bool(ad_options->basic, AD_ENABLE_DNS_SITES)) {
+ /* use AD plugin */
+ ad_domain = dp_opt_get_string(ad_options->basic, AD_DOMAIN);
+ srv_ctx = ad_srv_plugin_ctx_init(bectx, bectx->be_res,
+ default_host_dbs, ad_options->id,
+ hostname, ad_domain);
+ if (srv_ctx == NULL) {
+ DEBUG(SSSDBG_FATAL_FAILURE, ("Out of memory?\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ be_fo_set_srv_lookup_plugin(bectx, ad_srv_plugin_send,
+ ad_srv_plugin_recv, srv_ctx, "AD");
+ } else {
+ /* fall back to standard plugin */
+ ret = be_fo_set_dns_srv_lookup_plugin(bectx, hostname);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to set SRV lookup plugin "
+ "[%d]: %s\n", ret, strerror(ret)));
+ goto done;
+ }
}
*ops = &ad_id_ops;
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 4b87e0c04..c48be8674 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -34,6 +34,7 @@ struct dp_option ad_basic_opts[] = {
{ "ad_hostname", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING},
+ { "ad_enable_dns_sites", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
DP_OPTION_TERMINATOR
};
diff --git a/src/providers/ad/ad_srv.c b/src/providers/ad/ad_srv.c
new file mode 100644
index 000000000..5dd06f623
--- /dev/null
+++ b/src/providers/ad/ad_srv.c
@@ -0,0 +1,773 @@
+/*
+ Authors:
+ Pavel B??ezina <pbrezina@redhat.com>
+
+ Copyright (C) 2013 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <string.h>
+#include <talloc.h>
+#include <tevent.h>
+#include <ndr.h>
+#include <ndr/ndr_nbt.h>
+
+#include "util/util.h"
+#include "util/sss_ldap.h"
+#include "resolv/async_resolv.h"
+#include "providers/dp_backend.h"
+#include "providers/fail_over.h"
+#include "providers/fail_over_srv.h"
+#include "providers/ldap/sdap.h"
+#include "providers/ldap/sdap_async.h"
+
+#define AD_SITE_DOMAIN "%s._sites.%s"
+#define AD_AT_DNS_DOMAIN "DnsDomain"
+#define AD_AT_NT_VERSION "NtVer"
+#define AD_AT_NETLOGON "netlogon"
+
+struct ad_get_dc_servers_state {
+ struct fo_server_info *servers;
+ size_t num_servers;
+};
+
+static void ad_get_dc_servers_done(struct tevent_req *subreq);
+
+static struct tevent_req *ad_get_dc_servers_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct resolv_ctx *resolv_ctx,
+ const char *domain)
+{
+ struct ad_get_dc_servers_state *state = NULL;
+ struct tevent_req *req = NULL;
+ struct tevent_req *subreq = NULL;
+ const char **domains = NULL;
+ errno_t ret;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct ad_get_dc_servers_state);
+ if (req == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("tevent_req_create() failed\n"));
+ return NULL;
+ }
+
+ domains = talloc_zero_array(state, const char *, 2);
+ if (domains == NULL) {
+ ret = ENOMEM;
+ goto immediately;
+ }
+
+ domains[0] = talloc_strdup(domains, domain);
+ if (domains[0] == NULL) {
+ ret = ENOMEM;
+ goto immediately;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("Looking up domain controllers in domain %s\n",
+ domain));
+
+ subreq = fo_discover_srv_send(state, ev, resolv_ctx,
+ "ldap", FO_PROTO_TCP, domains);
+ if (subreq == NULL) {
+ ret = ENOMEM;
+ goto immediately;
+ }
+
+ tevent_req_set_callback(subreq, ad_get_dc_servers_done, req);
+
+ return req;
+
+immediately:
+ tevent_req_error(req, ret);
+ tevent_req_post(req, ev);
+
+ return req;
+}
+
+static void ad_get_dc_servers_done(struct tevent_req *subreq)
+{
+ struct ad_get_dc_servers_state *state = NULL;
+ struct tevent_req *req = NULL;
+ char *domain = NULL;
+ errno_t ret;
+
+ req = tevent_req_callback_data(subreq, struct tevent_req);
+ state = tevent_req_data(req, struct ad_get_dc_servers_state);
+
+ ret = fo_discover_srv_recv(state, subreq, &domain,
+ &state->servers, &state->num_servers);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ goto done;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("Found %lu domain controllers in domain %s\n",
+ state->num_servers, domain));
+
+done:
+ if (ret != EOK) {
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ tevent_req_done(req);
+}
+
+static int ad_get_dc_servers_recv(TALLOC_CTX *mem_ctx,
+ struct tevent_req *req,
+ struct fo_server_info **_dcs,
+ size_t *_num_dcs)
+{
+ struct ad_get_dc_servers_state *state = NULL;
+ state = tevent_req_data(req, struct ad_get_dc_servers_state);
+
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+
+ *_dcs = talloc_steal(mem_ctx, state->servers);
+ *_num_dcs = state->num_servers;
+
+ return EOK;
+}
+
+struct ad_get_client_site_state {
+ struct tevent_context *ev;
+ struct be_resolv_ctx *be_res;
+ enum host_database *host_db;
+ struct sdap_options *opts;
+ const char *ad_domain;
+ struct fo_server_info *dcs;
+ size_t num_dcs;
+ size_t dc_index;
+ struct fo_server_info dc;
+
+ struct sdap_handle *sh;
+ char *site;
+};
+
+static errno_t ad_get_client_site_next_dc(struct tevent_req *req);
+static void ad_get_client_site_connect_done(struct tevent_req *subreq);
+static void ad_get_client_site_done(struct tevent_req *subreq);
+
+struct tevent_req *ad_get_client_site_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ struct be_resolv_ctx *be_res,
+ enum host_database *host_db,
+ struct sdap_options *opts,
+ const char *ad_domain,
+ struct fo_server_info *dcs,
+ size_t num_dcs)
+{
+ struct ad_get_client_site_state *state = NULL;
+ struct tevent_req *req = NULL;
+ errno_t ret;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct ad_get_client_site_state);
+ if (req == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("tevent_req_create() failed\n"));
+ return NULL;
+ }
+
+ if (be_res == NULL || host_db == NULL || opts == NULL) {
+ ret = EINVAL;
+ goto immediately;
+ }
+
+ state->ev = ev;
+ state->be_res = be_res;
+ state->host_db = host_db;
+ state->opts = opts;
+ state->ad_domain = ad_domain;
+ state->dcs = dcs;
+ state->num_dcs = num_dcs;
+
+ state->dc_index = 0;
+ ret = ad_get_client_site_next_dc(req);
+ if (ret == EOK) {
+ ret = ENOENT;
+ goto immediately;
+ } else if (ret != EAGAIN) {
+ goto immediately;
+ }
+
+ return req;
+
+immediately:
+ if (ret == EOK) {
+ tevent_req_done(req);
+ } else {
+ tevent_req_error(req, ret);
+ }
+ tevent_req_post(req, ev);
+
+ return req;
+}
+
+static errno_t ad_get_client_site_next_dc(struct tevent_req *req)
+{
+ struct ad_get_client_site_state *state = NULL;
+ struct tevent_req *subreq = NULL;
+ errno_t ret;
+
+ state = tevent_req_data(req, struct ad_get_client_site_state);
+
+ if (state->dc_index >= state->num_dcs) {
+ ret = EOK;
+ goto done;
+ }
+
+ state->dc = state->dcs[state->dc_index];
+
+ subreq = sdap_connect_host_send(state, state->ev, state->opts,
+ state->be_res->resolv,
+ state->be_res->family_order,
+ state->host_db, "ldap", state->dc.host,
+ state->dc.port, false);
+ if (subreq == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ tevent_req_set_callback(subreq, ad_get_client_site_connect_done, req);
+
+ state->dc_index++;
+ ret = EAGAIN;
+
+done:
+ return ret;
+}
+
+static void ad_get_client_site_connect_done(struct tevent_req *subreq)
+{
+ struct ad_get_client_site_state *state = NULL;
+ struct tevent_req *req = NULL;
+ static const char *attrs[] = {AD_AT_NETLOGON, NULL};
+ char *filter = NULL;
+ char *ntver = NULL;
+ errno_t ret;
+
+ req = tevent_req_callback_data(subreq, struct tevent_req);
+ state = tevent_req_data(req, struct ad_get_client_site_state);
+
+ ret = sdap_connect_host_recv(state, subreq, &state->sh);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_MINOR_FAILURE, ("Unable to connect to domain controller "
+ "[%s:%d]\n", state->dc.host, state->dc.port));
+
+ ret = ad_get_client_site_next_dc(req);
+ if (ret == EOK) {
+ ret = ENOENT;
+ }
+
+ goto done;
+ }
+
+ ntver = sss_ldap_encode_ndr_uint32(state, NETLOGON_NT_VERSION_5EX |
+ NETLOGON_NT_VERSION_WITH_CLOSEST_SITE);
+ if (ntver == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ filter = talloc_asprintf(state, "(&(%s=%s)(%s=%s))",
+ AD_AT_DNS_DOMAIN, state->ad_domain,
+ AD_AT_NT_VERSION, ntver);
+ if (filter == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh,
+ "", LDAP_SCOPE_BASE, filter,
+ attrs, NULL, 0,
+ dp_opt_get_int(state->opts->basic,
+ SDAP_SEARCH_TIMEOUT),
+ false);
+ if (subreq == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ tevent_req_set_callback(subreq, ad_get_client_site_done, req);
+
+ ret = EAGAIN;
+
+done:
+ if (ret == EOK) {
+ tevent_req_done(req);
+ } else if (ret != EAGAIN) {
+ tevent_req_error(req, ret);
+ }
+
+ return;
+}
+
+static errno_t ad_get_client_site_parse_ndr(TALLOC_CTX *mem_ctx,
+ uint8_t *data,
+ size_t length,
+ char **_site_name)
+{
+ TALLOC_CTX *tmp_ctx = NULL;
+ struct ndr_pull *ndr_pull = NULL;
+ struct netlogon_samlogon_response response;
+ enum ndr_err_code ndr_err;
+ char *site = NULL;
+ DATA_BLOB blob;
+ errno_t ret;
+
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n"));
+ return ENOMEM;
+ }
+
+ blob.data = data;
+ blob.length = length;
+
+ ndr_pull = ndr_pull_init_blob(&blob, mem_ctx);
+ if (ndr_pull == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ndr_pull_init_blob() failed.\n"));
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ndr_err = ndr_pull_netlogon_samlogon_response(ndr_pull, NDR_SCALARS,
+ &response);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ DEBUG(SSSDBG_OP_FAILURE, ("ndr_pull_netlogon_samlogon_response() "
+ "failed [%d]\n", ndr_err));
+ ret = EBADMSG;
+ goto done;
+ }
+
+ if (!(response.ntver & NETLOGON_NT_VERSION_5EX)) {
+ DEBUG(SSSDBG_OP_FAILURE, ("This NT version does not provide site "
+ "information [%x]\n", response.ntver));
+ ret = EBADMSG;
+ goto done;
+ }
+
+ if (response.data.nt5_ex.client_site != NULL) {
+ site = talloc_strdup(tmp_ctx, response.data.nt5_ex.client_site);
+ } else if (response.data.nt5_ex.next_closest_site != NULL) {
+ site = talloc_strdup(tmp_ctx, response.data.nt5_ex.next_closest_site);
+ } else {
+ ret = ENOENT;
+ goto done;
+ }
+
+ if (site == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ *_site_name = talloc_steal(mem_ctx, site);
+
+ ret = EOK;
+
+done:
+ talloc_free(tmp_ctx);
+ return ret;
+}
+
+static void ad_get_client_site_done(struct tevent_req *subreq)
+{
+ struct ad_get_client_site_state *state = NULL;
+ struct tevent_req *req = NULL;
+ struct ldb_message_element *el = NULL;
+ struct sysdb_attrs **reply = NULL;
+ size_t reply_count;
+ errno_t ret;
+
+ req = tevent_req_callback_data(subreq, struct tevent_req);
+ state = tevent_req_data(req, struct ad_get_client_site_state);
+
+ ret = sdap_get_generic_recv(subreq, state, &reply_count, &reply);
+ talloc_zfree(subreq);
+
+ /* we're done with this LDAP, close connection */
+ talloc_zfree(state->sh);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Unable to get netlogon information\n"));
+
+ ret = ad_get_client_site_next_dc(req);
+ if (ret == EOK) {
+ ret = ENOENT;
+ }
+ goto done;
+ }
+
+ if (reply_count == 0) {
+ DEBUG(SSSDBG_OP_FAILURE, ("No netlogon information retrieved\n"));
+ ret = ENOENT;
+ goto done;
+ }
+
+ ret = sysdb_attrs_get_el(reply[0], AD_AT_NETLOGON, &el);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_el() failed\n"));
+ goto done;
+ }
+
+ if (el->num_values == 0) {
+ DEBUG(SSSDBG_OP_FAILURE, ("netlogon has no value\n"));
+ ret = ENOENT;
+ goto done;
+ } else if (el->num_values > 1) {
+ DEBUG(SSSDBG_OP_FAILURE, ("More than one netlogon value?\n"));
+ ret = EIO;
+ goto done;
+ }
+
+ ret = ad_get_client_site_parse_ndr(state, el->values[0].data,
+ el->values[0].length, &state->site);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Unable to retrieve site name [%d]: %s\n",
+ ret, strerror(ret)));
+ ret = ENOENT;
+ goto done;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("Found site: %s\n", state->site));
+
+done:
+ if (ret != EOK) {
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ tevent_req_done(req);
+}
+
+int ad_get_client_site_recv(TALLOC_CTX *mem_ctx,
+ struct tevent_req *req,
+ char **_site)
+{
+ struct ad_get_client_site_state *state = NULL;
+ state = tevent_req_data(req, struct ad_get_client_site_state);
+
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+
+ *_site = talloc_steal(mem_ctx, state->site);
+
+ return EOK;
+}
+
+struct ad_srv_plugin_ctx {
+ struct be_resolv_ctx *be_res;
+ enum host_database *host_dbs;
+ struct sdap_options *opts;
+ const char *hostname;
+ const char *ad_domain;
+};
+
+struct ad_srv_plugin_ctx *
+ad_srv_plugin_ctx_init(TALLOC_CTX *mem_ctx,
+ struct be_resolv_ctx *be_res,
+ enum host_database *host_dbs,
+ struct sdap_options *opts,
+ const char *hostname,
+ const char *ad_domain)
+{
+ struct ad_srv_plugin_ctx *ctx = NULL;
+
+ ctx = talloc_zero(mem_ctx, struct ad_srv_plugin_ctx);
+ if (ctx == NULL) {
+ return NULL;
+ }
+
+ ctx->be_res = be_res;
+ ctx->host_dbs = host_dbs;
+ ctx->opts = opts;
+
+ ctx->hostname = talloc_strdup(ctx, hostname);
+ if (ctx->hostname == NULL) {
+ goto fail;
+ }
+
+ ctx->ad_domain = talloc_strdup(ctx, ad_domain);
+ if (ctx->ad_domain == NULL) {
+ goto fail;
+ }
+
+ return ctx;
+
+fail:
+ talloc_free(ctx);
+ return NULL;
+}
+
+struct ad_srv_plugin_state {
+ struct tevent_context *ev;
+ struct ad_srv_plugin_ctx *ctx;
+ const char *service;
+ const char *protocol;
+ const char *discovery_domain;
+
+ char *site;
+ char *dns_domain;
+ struct fo_server_info *primary_servers;
+ size_t num_primary_servers;
+ struct fo_server_info *backup_servers;
+ size_t num_backup_servers;
+};
+
+static void ad_srv_plugin_dcs_done(struct tevent_req *subreq);
+static void ad_srv_plugin_site_done(struct tevent_req *subreq);
+static void ad_srv_plugin_servers_done(struct tevent_req *subreq);
+
+/* 1. Do a DNS lookup to find any DC in domain
+ * _ldap._tcp.domain.name
+ * 2. Send a CLDAP ping to the found DC to get the desirable site
+ * 3. Do a DNS lookup to find SRV in the site (a)
+ * _service._protocol.site-name._sites.domain.name
+ * 4. Do a DNS lookup to find global SRV records (b)
+ * _service._protocol.domain.name
+ * 5. If the site is found, use (a) as primary and (b) as backup servers,
+ * otherwise use (b) as primary servers
+ */
+struct tevent_req *ad_srv_plugin_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ const char *service,
+ const char *protocol,
+ const char *discovery_domain,
+ void *pvt)
+{
+ struct ad_srv_plugin_state *state = NULL;
+ struct ad_srv_plugin_ctx *ctx = NULL;
+ struct tevent_req *req = NULL;
+ struct tevent_req *subreq = NULL;
+ errno_t ret;
+
+ req = tevent_req_create(mem_ctx, &state,
+ struct ad_srv_plugin_state);
+ if (req == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("tevent_req_create() failed\n"));
+ return NULL;
+ }
+
+ ctx = talloc_get_type(pvt, struct ad_srv_plugin_ctx);
+ if (ctx == NULL) {
+ ret = EINVAL;
+ goto immediately;
+ }
+
+ state->ev = ev;
+ state->ctx = ctx;
+
+ state->service = talloc_strdup(state, service);
+ if (state->service == NULL) {
+ ret = ENOMEM;
+ goto immediately;
+ }
+
+ state->protocol = talloc_strdup(state, protocol);
+ if (state->protocol == NULL) {
+ ret = ENOMEM;
+ goto immediately;
+ }
+
+ if (discovery_domain != NULL) {
+ state->discovery_domain = talloc_strdup(state, discovery_domain);
+ } else {
+ state->discovery_domain = talloc_strdup(state, ctx->ad_domain);
+ }
+ if (state->discovery_domain == NULL) {
+ ret = ENOMEM;
+ goto immediately;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("About to find domain controllers\n"));
+
+ subreq = ad_get_dc_servers_send(state, ev, ctx->be_res->resolv,
+ state->discovery_domain);
+ if (subreq == NULL) {
+ ret = ENOMEM;
+ goto immediately;
+ }
+
+ tevent_req_set_callback(subreq, ad_srv_plugin_dcs_done, req);
+
+ return req;
+
+immediately:
+ tevent_req_error(req, ret);
+ tevent_req_post(req, ev);
+
+ return req;
+}
+
+static void ad_srv_plugin_dcs_done(struct tevent_req *subreq)
+{
+ struct ad_srv_plugin_state *state = NULL;
+ struct tevent_req *req = NULL;
+ struct fo_server_info *dcs = NULL;
+ size_t num_dcs = 0;
+ errno_t ret;
+
+ req = tevent_req_callback_data(subreq, struct tevent_req);
+ state = tevent_req_data(req, struct ad_srv_plugin_state);
+
+ ret = ad_get_dc_servers_recv(state, subreq, &dcs, &num_dcs);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ goto done;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("About to locate suitable site\n"));
+
+ subreq = ad_get_client_site_send(state, state->ev,
+ state->ctx->be_res,
+ state->ctx->host_dbs,
+ state->ctx->opts,
+ state->ctx->ad_domain,
+ dcs, num_dcs);
+ if (subreq == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ tevent_req_set_callback(subreq, ad_srv_plugin_site_done, req);
+
+ ret = EAGAIN;
+
+done:
+ if (ret == EOK) {
+ tevent_req_done(req);
+ } else if (ret != EAGAIN) {
+ tevent_req_error(req, ret);
+ }
+
+ return;
+}
+
+static void ad_srv_plugin_site_done(struct tevent_req *subreq)
+{
+ struct ad_srv_plugin_state *state = NULL;
+ struct tevent_req *req = NULL;
+ const char *primary_domain = NULL;
+ const char *backup_domain = NULL;
+ errno_t ret;
+
+ req = tevent_req_callback_data(subreq, struct tevent_req);
+ state = tevent_req_data(req, struct ad_srv_plugin_state);
+
+ ret = ad_get_client_site_recv(state, subreq, &state->site);
+ talloc_zfree(subreq);
+ if (ret == EOK) {
+ primary_domain = talloc_asprintf(state, AD_SITE_DOMAIN,
+ state->site, state->discovery_domain);
+ if (primary_domain == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ backup_domain = state->discovery_domain;
+ } else if (ret == ENOENT) {
+ primary_domain = state->discovery_domain;
+ backup_domain = NULL;
+ } else {
+ goto done;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("About to discover primary and "
+ "backup servers\n"));
+
+ subreq = fo_discover_servers_send(state, state->ev,
+ state->ctx->be_res->resolv,
+ state->service, state->protocol,
+ primary_domain, backup_domain);
+ if (subreq == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ tevent_req_set_callback(subreq, ad_srv_plugin_servers_done, req);
+
+ ret = EAGAIN;
+
+done:
+ if (ret == EOK) {
+ tevent_req_done(req);
+ } else if (ret != EAGAIN) {
+ tevent_req_error(req, ret);
+ }
+
+ return;
+}
+
+static void ad_srv_plugin_servers_done(struct tevent_req *subreq)
+{
+ struct ad_srv_plugin_state *state = NULL;
+ struct tevent_req *req = NULL;
+ errno_t ret;
+
+ req = tevent_req_callback_data(subreq, struct tevent_req);
+ state = tevent_req_data(req, struct ad_srv_plugin_state);
+
+ ret = fo_discover_servers_recv(state, subreq, &state->dns_domain,
+ &state->primary_servers,
+ &state->num_primary_servers,
+ &state->backup_servers,
+ &state->num_backup_servers);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("Got %lu primary and %lu backup servers\n",
+ state->num_primary_servers, state->num_backup_servers));
+
+ tevent_req_done(req);
+}
+
+errno_t ad_srv_plugin_recv(TALLOC_CTX *mem_ctx,
+ struct tevent_req *req,
+ char **_dns_domain,
+ struct fo_server_info **_primary_servers,
+ size_t *_num_primary_servers,
+ struct fo_server_info **_backup_servers,
+ size_t *_num_backup_servers)
+{
+ struct ad_srv_plugin_state *state = NULL;
+ state = tevent_req_data(req, struct ad_srv_plugin_state);
+
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+
+ if (_primary_servers) {
+ *_primary_servers = talloc_steal(mem_ctx, state->primary_servers);
+ }
+
+ if (_num_primary_servers) {
+ *_num_primary_servers = state->num_primary_servers;
+ }
+
+ if (_backup_servers) {
+ *_backup_servers = talloc_steal(mem_ctx, state->backup_servers);
+ }
+
+ if (_num_backup_servers) {
+ *_num_backup_servers = state->num_backup_servers;
+ }
+
+ if (_dns_domain) {
+ *_dns_domain = talloc_steal(mem_ctx, state->dns_domain);
+ }
+
+
+ return EOK;
+}
diff --git a/src/providers/ad/ad_srv.h b/src/providers/ad/ad_srv.h
new file mode 100644
index 000000000..adf29b07a
--- /dev/null
+++ b/src/providers/ad/ad_srv.h
@@ -0,0 +1,49 @@
+/*
+ Authors:
+ Pavel B??ezina <pbrezina@redhat.com>
+
+ Copyright (C) 2013 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef __AD_SRV_H__
+#define __AD_SRV_H__
+
+struct ad_srv_plugin_ctx;
+
+struct ad_srv_plugin_ctx *
+ad_srv_plugin_ctx_init(TALLOC_CTX *mem_ctx,
+ struct be_resolv_ctx *be_res,
+ enum host_database *host_dbs,
+ struct sdap_options *opts,
+ const char *hostname,
+ const char *ad_domain);
+
+struct tevent_req *ad_srv_plugin_send(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ const char *service,
+ const char *protocol,
+ const char *discovery_domain,
+ void *pvt);
+
+errno_t ad_srv_plugin_recv(TALLOC_CTX *mem_ctx,
+ struct tevent_req *req,
+ char **_dns_domain,
+ struct fo_server_info **_primary_servers,
+ size_t *_num_primary_servers,
+ struct fo_server_info **_backup_servers,
+ size_t *_num_backup_servers);
+
+#endif /* __AD_SRV_H__ */