HBAC: Use originalMember for identifying hostgroups

3 files changed, 165 insertions, 45 deletions

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index c10b2eeb..221d5e1b 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -691,14 +691,14 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
                        struct hbac_request_element **host_element)
 {
     errno_t ret;
-    size_t i, count;
+    size_t i, j, count;
     TALLOC_CTX *tmp_ctx;
     struct hbac_request_element *host;
     struct ldb_message **msgs;
-    const char *group_name;
+    struct ldb_message_element *el;
     struct ldb_dn *host_dn;
-    const char *attrs[] = { IPA_CN, NULL };
-    const char *host_filter;
+    const char *memberof_attrs[] = { SYSDB_ORIG_MEMBEROF, NULL };
+    char *name;
 
     tmp_ctx = talloc_new(mem_ctx);
     if (tmp_ctx == NULL) return ENOMEM;
@@ -715,68 +715,74 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
         /* We don't know the host (probably an rhost)
          * So we can't determine it's groups either.
          */
-        host->groups = talloc_array(host, const char *, 1);
-        if (host->groups == NULL) {
-            ret = ENOMEM;
-            goto done;
-        }
-        host->groups[0] = NULL;
+        host->groups = NULL;
         ret = EOK;
         goto done;
     }
 
-    host_filter = talloc_asprintf(tmp_ctx,
-                                  "(objectClass=%s)",
-                                  IPA_HOSTGROUP);
-    if (host_filter == NULL) {
+    host_dn = sysdb_custom_dn(sysdb, tmp_ctx, domain->name,
+                              host->name, HBAC_HOSTS_SUBDIR);
+    if (host_dn == NULL) {
         ret = ENOMEM;
         goto done;
     }
 
-    host_dn = sysdb_custom_dn(sysdb, tmp_ctx, domain->name,
-                             host->name, HBAC_HOSTS_SUBDIR);
-    if (host_dn == NULL) {
-        ret = ENOMEM;
+    /* Look up the host to get its originalMemberOf entries */
+    ret = sysdb_search_entry(tmp_ctx, sysdb, host_dn,
+                             LDB_SCOPE_BASE, NULL,
+                             memberof_attrs,
+                             &count, &msgs);
+    if (ret == ENOENT || count == 0) {
+        /* We won't be able to identify any groups
+         * This rule will only match the name or
+         * a host category of ALL
+         */
+        host->groups = NULL;
+        ret =  EOK;
+        goto done;
+    } else if (ret != EOK) {
+        goto done;
+    } else if (count > 1) {
+        DEBUG(1, ("More than one result for a BASE search!\n"));
+        ret = EIO;
         goto done;
     }
 
-    /* Find the host groups */
-    ret = sysdb_asq_search(tmp_ctx, sysdb, host_dn,
-                           host_filter, SYSDB_MEMBEROF,
-                           attrs, &count, &msgs);
-    if (ret != EOK && ret != ENOENT) {
-        DEBUG(1, ("Could not look up host groups\n"));
+    el = ldb_msg_find_element(msgs[0], SYSDB_ORIG_MEMBEROF);
+    if (!el) {
+        /* Host is not a member of any groups
+         * This rule will only match the name or
+         * a host category of ALL
+         */
+        host->groups = NULL;
+        ret = EOK;
         goto done;
-    } else if (ret == ENOENT) {
-        count = 0;
     }
 
-    host->groups = talloc_array(host, const char *, count + 1);
+
+    host->groups = talloc_array(host, const char *, el->num_values + 1);
     if (host->groups == NULL) {
         ret = ENOMEM;
         goto done;
     }
 
-    for (i = 0; i < count; i++) {
-        group_name = ldb_msg_find_attr_as_string(msgs[i],
-                                                 IPA_CN,
-                                                 NULL);
-        if (group_name == NULL) {
-            DEBUG(1, ("Group with no name?\n"));
-            ret = EINVAL;
-            goto done;
-        }
-        host->groups[i] = talloc_strdup(host->groups,
-                                       group_name);
-        if (host->groups[i] == NULL) {
-            ret = ENOMEM;
-            goto done;
-        }
+    for (i = j = 0; i < el->num_values; i++) {
+        ret = get_ipa_hostgroupname(tmp_ctx, sysdb,
+                                    (const char *)el->values[i].data,
+                                    &name);
+        if (ret != EOK && ret != ENOENT) goto done;
 
-        DEBUG(6, ("Added host group [%s] to the eval request\n",
-                  host->groups[i]));
+        /* ENOENT means we had a memberOf entry that wasn't a
+         * host group. We'll just ignore those (could be
+         * HBAC rules)
+         */
+
+        if (ret == EOK) {
+            host->groups[j] = talloc_steal(host->groups, name);
+            j++;
+        }
     }
-    host->groups[i] = NULL;
+    host->groups[j] = NULL;
 
     ret = EOK;
 
diff --git a/src/providers/ipa/ipa_hbac_hosts.c b/src/providers/ipa/ipa_hbac_hosts.c
index 31e96e54..42a3f5c1 100644
--- a/src/providers/ipa/ipa_hbac_hosts.c
+++ b/src/providers/ipa/ipa_hbac_hosts.c
@@ -522,3 +522,112 @@ done:
     talloc_free(tmp_ctx);
     return ret;
 }
+
+errno_t
+get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
+                      struct sysdb_ctx *sysdb,
+                      const char *host_dn,
+                      char **hostgroupname)
+{
+    errno_t ret;
+    struct ldb_dn *dn;
+    const char *rdn_name;
+    const char *hostgroup_comp_name;
+    const char *account_comp_name;
+    const struct ldb_val *rdn_val;
+    const struct ldb_val *hostgroup_comp_val;
+    const struct ldb_val *account_comp_val;
+
+    /* This is an IPA-specific hack. It may not
+     * work for non-IPA servers and will need to
+     * be changed if SSSD ever supports HBAC on
+     * a non-IPA server.
+     */
+    *hostgroupname = NULL;
+
+    dn = ldb_dn_new(mem_ctx, sysdb_ctx_get_ldb(sysdb), host_dn);
+    if (dn == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    if (!ldb_dn_validate(dn)) {
+        ret = EINVAL;
+        goto done;
+    }
+
+    if (ldb_dn_get_comp_num(dn) < 4) {
+        /* RDN, hostgroups, accounts, and at least one DC= */
+        /* If it's fewer, it's not a group DN */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* If the RDN name is 'cn' */
+    rdn_name = ldb_dn_get_rdn_name(dn);
+    if (rdn_name == NULL) {
+        /* Shouldn't happen if ldb_dn_validate()
+         * passed, but we'll be careful.
+         */
+        ret = EINVAL;
+        goto done;
+    }
+
+    if (strcasecmp("cn", rdn_name) != 0) {
+        /* RDN has the wrong attribute name.
+         * It's not a host.
+         */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* and the second component is "cn=hostgroups" */
+    hostgroup_comp_name = ldb_dn_get_component_name(dn, 1);
+    if (strcasecmp("cn", hostgroup_comp_name) != 0) {
+        /* The second component name is not "cn" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    hostgroup_comp_val = ldb_dn_get_component_val(dn, 1);
+    if (strncasecmp("hostgroups",
+                    (const char *) hostgroup_comp_val->data,
+                    hostgroup_comp_val->length) != 0) {
+        /* The second component value is not "hostgroups" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* and the third component is "accounts" */
+    account_comp_name = ldb_dn_get_component_name(dn, 2);
+    if (strcasecmp("cn", account_comp_name) != 0) {
+        /* The third component name is not "cn" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    account_comp_val = ldb_dn_get_component_val(dn, 2);
+    if (strncasecmp("accounts",
+                    (const char *) account_comp_val->data,
+                    account_comp_val->length) != 0) {
+        /* The third component value is not "accounts" */
+        ret = ENOENT;
+        goto done;
+    }
+
+    /* Then the value of the RDN is the group name */
+    rdn_val = ldb_dn_get_rdn_val(dn);
+    *hostgroupname = talloc_strndup(mem_ctx,
+                                    (const char *)rdn_val->data,
+                                    rdn_val->length);
+    if (*hostgroupname == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = EOK;
+
+done:
+    talloc_free(dn);
+    return ret;
+}
diff --git a/src/providers/ipa/ipa_hbac_private.h b/src/providers/ipa/ipa_hbac_private.h
index 4c637aa5..32b5d70c 100644
--- a/src/providers/ipa/ipa_hbac_private.h
+++ b/src/providers/ipa/ipa_hbac_private.h
@@ -131,6 +131,11 @@ hbac_shost_attrs_to_rule(TALLOC_CTX *mem_ctx,
                          const char *rule_name,
                          struct sysdb_attrs *rule_attrs,
                          struct hbac_rule_element **source_hosts);
+errno_t
+get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
+                      struct sysdb_ctx *sysdb,
+                      const char *host_dn,
+                      char **hostgroupname);
 
 /* From ipa_hbac_services.c */
 struct tevent_req *