diff options
Diffstat (limited to 'src/responder/nss')
-rw-r--r-- | src/responder/nss/nsssrv.c | 16 | ||||
-rw-r--r-- | src/responder/nss/nsssrv.h | 3 | ||||
-rw-r--r-- | src/responder/nss/nsssrv_cmd.c | 43 | ||||
-rw-r--r-- | src/responder/nss/nsssrv_nc.c | 321 | ||||
-rw-r--r-- | src/responder/nss/nsssrv_nc.h | 51 |
5 files changed, 31 insertions, 403 deletions
diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c index ea2dc518..24753674 100644 --- a/src/responder/nss/nsssrv.c +++ b/src/responder/nss/nsssrv.c @@ -33,7 +33,7 @@ #include "popt.h" #include "util/util.h" #include "responder/nss/nsssrv.h" -#include "responder/nss/nsssrv_nc.h" +#include "responder/common/negcache.h" #include "db/sysdb.h" #include "confdb/confdb.h" #include "dbus/dbus.h" @@ -135,7 +135,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } - ret = nss_ncache_set_user(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_user(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent user filter for [%s]" " (%d [%s])\n", filter_list[i], @@ -174,7 +174,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } if (domain) { - ret = nss_ncache_set_user(nctx->ncache, true, domain, name); + ret = sss_ncache_set_user(nctx->ncache, true, domain, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent user filter for [%s]" " (%d [%s])\n", filter_list[i], @@ -183,7 +183,7 @@ static int nss_get_config(struct nss_ctx *nctx, } } else { for (dom = rctx->domains; dom; dom = dom->next) { - ret = nss_ncache_set_user(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_user(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent user filter for" " [%s:%s] (%d [%s])\n", @@ -226,7 +226,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } - ret = nss_ncache_set_group(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_group(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent group filter for [%s]" " (%d [%s])\n", filter_list[i], @@ -265,7 +265,7 @@ static int nss_get_config(struct nss_ctx *nctx, continue; } if (domain) { - ret = nss_ncache_set_group(nctx->ncache, true, domain, name); + ret = sss_ncache_set_group(nctx->ncache, true, domain, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent group filter for" " [%s] (%d [%s])\n", filter_list[i], @@ -274,7 +274,7 @@ static int nss_get_config(struct nss_ctx *nctx, } } else { for (dom = rctx->domains; dom; dom = dom->next) { - ret = nss_ncache_set_group(nctx->ncache, true, dom->name, name); + ret = sss_ncache_set_group(nctx->ncache, true, dom->name, name); if (ret != EOK) { DEBUG(1, ("Failed to store permanent group filter for" " [%s:%s] (%d [%s])\n", @@ -351,7 +351,7 @@ int nss_process_init(TALLOC_CTX *mem_ctx, return ENOMEM; } - ret = nss_ncache_init(nctx, &nctx->ncache); + ret = sss_ncache_init(nctx, &nctx->ncache); if (ret != EOK) { DEBUG(0, ("fatal error initializing negative cache\n")); return ret; diff --git a/src/responder/nss/nsssrv.h b/src/responder/nss/nsssrv.h index a6c66183..d53143dc 100644 --- a/src/responder/nss/nsssrv.h +++ b/src/responder/nss/nsssrv.h @@ -32,7 +32,6 @@ #include "sbus/sssd_dbus.h" #include "responder/common/responder_packet.h" #include "responder/common/responder.h" -#include "responder/nss/nsssrv_nc.h" #define NSS_SBUS_SERVICE_VERSION 0x0001 #define NSS_SBUS_SERVICE_NAME "nss" @@ -45,7 +44,7 @@ struct nss_ctx { struct resp_ctx *rctx; int neg_timeout; - struct nss_nc_ctx *ncache; + struct sss_nc_ctx *ncache; int cache_refresh_percent; diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index 042517ad..45334e23 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -21,6 +21,7 @@ #include "util/util.h" #include "responder/nss/nsssrv.h" +#include "responder/common/negcache.h" #include "confdb/confdb.h" #include "db/sysdb.h" #include <time.h> @@ -164,7 +165,7 @@ static int fill_pwent(struct sss_packet *packet, } if (filter_users) { - ncret = nss_ncache_check_user(nctx->ncache, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, domain, name); if (ncret == EEXIST) { @@ -448,7 +449,7 @@ static void nss_cmd_getpwnam_callback(void *ptr, int status, if (dom->fqnames) continue; - ncret = nss_ncache_check_user(nctx->ncache, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dom->name, cmdctx->name); if (ncret == ENOENT) break; @@ -500,7 +501,7 @@ static void nss_cmd_getpwnam_callback(void *ptr, int status, /* set negative cache only if not result of cache check */ if (!neghit) { - ret = nss_ncache_set_user(nctx->ncache, false, + ret = sss_ncache_set_user(nctx->ncache, false, dctx->domain->name, cmdctx->name); if (ret != EOK) { NSS_CMD_FATAL_ERROR(cctx); @@ -662,7 +663,7 @@ static int nss_cmd_getpwnam(struct cli_ctx *cctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_user(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dctx->domain->name, cmdctx->name); if (ncret == EEXIST) { neghit = true; @@ -676,7 +677,7 @@ static int nss_cmd_getpwnam(struct cli_ctx *cctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_user(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dom->name, cmdctx->name); if (ncret == ENOENT) break; @@ -795,7 +796,7 @@ static void nss_cmd_getpwuid_callback(void *ptr, int status, ret = EOK; dom = dctx->domain->next; - ncret = nss_ncache_check_uid(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_uid(nctx->ncache, nctx->neg_timeout, cmdctx->id); if (ncret == EEXIST) { DEBUG(3, ("Uid [%lu] does not exist! (negative cache)\n", @@ -839,7 +840,7 @@ static void nss_cmd_getpwuid_callback(void *ptr, int status, /* set negative cache only if not result of cache check */ if (!neghit) { - ret = nss_ncache_set_uid(nctx->ncache, false, cmdctx->id); + ret = sss_ncache_set_uid(nctx->ncache, false, cmdctx->id); if (ret != EOK) { NSS_CMD_FATAL_ERROR(cctx); } @@ -982,7 +983,7 @@ static int nss_cmd_getpwuid(struct cli_ctx *cctx) for (dom = cctx->rctx->domains; dom; dom = dom->next) { /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_uid(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_uid(nctx->ncache, nctx->neg_timeout, cmdctx->id); if (ncret == EEXIST) { DEBUG(3, ("Uid [%lu] does not exist! (negative cache)\n", @@ -1542,7 +1543,7 @@ static int fill_grent(struct sss_packet *packet, } if (filter_groups) { - ret = nss_ncache_check_group(nctx->ncache, + ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout, domain, name); if (ret == EEXIST) { DEBUG(4, ("Group [%s@%s] filtered out! (negative cache)\n", @@ -1619,7 +1620,7 @@ static int fill_grent(struct sss_packet *packet, name = (const char *)el->values[j].data; if (nctx->filter_users_in_groups) { - ret = nss_ncache_check_user(nctx->ncache, + ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, domain, name); if (ret == EEXIST) { @@ -1764,7 +1765,7 @@ static void nss_cmd_getgrnam_callback(void *ptr, int status, if (dom->fqnames) continue; - ncret = nss_ncache_check_group(nctx->ncache, + ncret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout, dom->name, cmdctx->name); if (ncret == ENOENT) break; @@ -1817,7 +1818,7 @@ static void nss_cmd_getgrnam_callback(void *ptr, int status, /* set negative cache only if not result of cache check */ if (!neghit) { - ret = nss_ncache_set_group(nctx->ncache, false, + ret = sss_ncache_set_group(nctx->ncache, false, dctx->domain->name, cmdctx->name); if (ret != EOK) { NSS_CMD_FATAL_ERROR(cctx); @@ -1972,7 +1973,7 @@ static int nss_cmd_getgrnam(struct cli_ctx *cctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_group(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout, dctx->domain->name, cmdctx->name); if (ncret == EEXIST) { neghit = true; @@ -1986,7 +1987,7 @@ static int nss_cmd_getgrnam(struct cli_ctx *cctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_group(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout, dom->name, cmdctx->name); if (ncret == ENOENT) break; @@ -2106,7 +2107,7 @@ static void nss_cmd_getgrgid_callback(void *ptr, int status, dom = dctx->domain->next; - ncret = nss_ncache_check_gid(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_gid(nctx->ncache, nctx->neg_timeout, cmdctx->id); if (ncret == EEXIST) { DEBUG(3, ("Gid [%lu] does not exist! (negative cache)\n", @@ -2150,7 +2151,7 @@ static void nss_cmd_getgrgid_callback(void *ptr, int status, /* set negative cache only if not result of cache check */ if (!neghit) { - ret = nss_ncache_set_gid(nctx->ncache, false, cmdctx->id); + ret = sss_ncache_set_gid(nctx->ncache, false, cmdctx->id); if (ret != EOK) { NSS_CMD_FATAL_ERROR(cctx); } @@ -2285,7 +2286,7 @@ static int nss_cmd_getgrgid(struct cli_ctx *cctx) for (dom = cctx->rctx->domains; dom; dom = dom->next) { /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_gid(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_gid(nctx->ncache, nctx->neg_timeout, cmdctx->id); if (ncret == EEXIST) { DEBUG(3, ("Gid [%lu] does not exist! (negative cache)\n", @@ -2846,7 +2847,7 @@ static void nss_cmd_getinitgr_callback(void *ptr, int status, if (dom->fqnames) continue; - ncret = nss_ncache_check_user(nctx->ncache, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dom->name, cmdctx->name); if (ncret == ENOENT) break; @@ -2898,7 +2899,7 @@ static void nss_cmd_getinitgr_callback(void *ptr, int status, /* set negative cache only if not result of cache check */ if (!neghit) { - ret = nss_ncache_set_user(nctx->ncache, false, + ret = sss_ncache_set_user(nctx->ncache, false, dctx->domain->name, cmdctx->name); if (ret != EOK) { NSS_CMD_FATAL_ERROR(cctx); @@ -3048,7 +3049,7 @@ static int nss_cmd_initgroups(struct cli_ctx *cctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_user(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, domname, cmdctx->name); if (ncret == EEXIST) { neghit = true; @@ -3062,7 +3063,7 @@ static int nss_cmd_initgroups(struct cli_ctx *cctx) /* verify this user has not yet been negatively cached, * or has been permanently filtered */ - ncret = nss_ncache_check_user(nctx->ncache, nctx->neg_timeout, + ncret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout, dom->name, cmdctx->name); if (ncret == ENOENT) break; diff --git a/src/responder/nss/nsssrv_nc.c b/src/responder/nss/nsssrv_nc.c deleted file mode 100644 index 8d8ef01c..00000000 --- a/src/responder/nss/nsssrv_nc.c +++ /dev/null @@ -1,321 +0,0 @@ -/* - SSSD - - NSS Responder - - Copyright (C) Simo Sorce <ssorce@redhat.com> 2008 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see <http://www.gnu.org/licenses/>. -*/ - -#include "util/util.h" -#include <fcntl.h> -#include <time.h> -#include "tdb.h" - -#define NC_ENTRY_PREFIX "NCE/" -#define NC_USER_PREFIX NC_ENTRY_PREFIX"USER" -#define NC_GROUP_PREFIX NC_ENTRY_PREFIX"GROUP" -#define NC_UID_PREFIX NC_ENTRY_PREFIX"UID" -#define NC_GID_PREFIX NC_ENTRY_PREFIX"GID" - -struct nss_nc_ctx { - struct tdb_context *tdb; -}; - -static int string_to_tdb_data(char *str, TDB_DATA *ret) -{ - if (!str || !ret) return EINVAL; - - ret->dptr = (uint8_t *)str; - ret->dsize = strlen(str)+1; - - return EOK; -} - -int nss_ncache_init(TALLOC_CTX *memctx, struct nss_nc_ctx **_ctx) -{ - struct nss_nc_ctx *ctx; - - ctx = talloc_zero(memctx, struct nss_nc_ctx); - if (!ctx) return ENOMEM; - - errno = 0; - /* open a memory only tdb with default hash size */ - ctx->tdb = tdb_open("memcache", 0, TDB_INTERNAL, O_RDWR|O_CREAT, 0); - if (!ctx->tdb) return errno; - - *_ctx = ctx; - return EOK; -}; - -static int nss_ncache_check_str(struct nss_nc_ctx *ctx, char *str, int ttl) -{ - TDB_DATA key; - TDB_DATA data; - unsigned long long int timestamp; - bool expired = false; - char *ep; - int ret; - - ret = string_to_tdb_data(str, &key); - if (ret != EOK) goto done; - - data = tdb_fetch(ctx->tdb, key); - - if (!data.dptr) { - ret = ENOENT; - goto done; - } - - if (ttl == -1) { - /* a negative ttl means: never expires */ - ret = EEXIST; - goto done; - } - - errno = 0; - timestamp = strtoull((const char *)data.dptr, &ep, 0); - if (errno != 0 || *ep != '\0') { - /* Malformed entry, remove it and return no entry */ - expired = true; - goto done; - } - - if (timestamp == 0) { - /* a 0 timestamp means this is a permanent entry */ - ret = EEXIST; - goto done; - } - - if (timestamp + ttl > time(NULL)) { - /* still valid */ - ret = EEXIST; - goto done; - } - - expired = true; - -done: - if (expired) { - /* expired, remove and return no entry */ - tdb_delete(ctx->tdb, key); - ret = ENOENT; - } - - return ret; -} - -static int nss_ncache_set_str(struct nss_nc_ctx *ctx, - char *str, bool permanent) -{ - TDB_DATA key; - TDB_DATA data; - char *timest; - int ret; - - ret = string_to_tdb_data(str, &key); - if (ret != EOK) return ret; - - if (permanent) { - timest = talloc_strdup(ctx, "0"); - } else { - timest = talloc_asprintf(ctx, "%llu", - (unsigned long long int)time(NULL)); - } - if (!timest) return ENOMEM; - - ret = string_to_tdb_data(timest, &data); - if (ret != EOK) goto done; - - ret = tdb_store(ctx->tdb, key, data, TDB_REPLACE); - if (ret != 0) { - DEBUG(1, ("Negative cache failed to set entry: [%s]\n", - tdb_errorstr(ctx->tdb))); - ret = EFAULT; - } - -done: - talloc_free(timest); - return ret; -} - -int nss_ncache_check_user(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_USER_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_check_group(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_GROUP_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_check_uid(struct nss_nc_ctx *ctx, int ttl, uid_t uid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_UID_PREFIX, uid); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_check_gid(struct nss_nc_ctx *ctx, int ttl, gid_t gid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_GID_PREFIX, gid); - if (!str) return ENOMEM; - - ret = nss_ncache_check_str(ctx, str, ttl); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_user(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_USER_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_group(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name) -{ - char *str; - int ret; - - if (!name || !*name) return EINVAL; - - str = talloc_asprintf(ctx, "%s/%s/%s", NC_GROUP_PREFIX, domain, name); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_uid(struct nss_nc_ctx *ctx, bool permanent, uid_t uid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_UID_PREFIX, uid); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -int nss_ncache_set_gid(struct nss_nc_ctx *ctx, bool permanent, gid_t gid) -{ - char *str; - int ret; - - str = talloc_asprintf(ctx, "%s/%u", NC_GID_PREFIX, gid); - if (!str) return ENOMEM; - - ret = nss_ncache_set_str(ctx, str, permanent); - - talloc_free(str); - return ret; -} - -static int delete_permanent(struct tdb_context *tdb, - TDB_DATA key, TDB_DATA data, void *state) -{ - unsigned long long int timestamp; - bool remove_key = false; - char *ep; - - if (strncmp((char *)key.dptr, - NC_ENTRY_PREFIX, sizeof(NC_ENTRY_PREFIX)) != 0) { - /* not interested in this key */ - return 0; - } - - errno = 0; - timestamp = strtoull((const char *)data.dptr, &ep, 0); - if (errno != 0 || *ep != '\0') { - /* Malformed entry, remove it */ - remove_key = true; - goto done; - } - - if (timestamp == 0) { - /* a 0 timestamp means this is a permanent entry */ - remove_key = true; - } - -done: - if (remove_key) { - return tdb_delete(tdb, key); - } - - return 0; -} - -int nss_ncache_reset_permament(struct nss_nc_ctx *ctx) -{ - int ret; - - ret = tdb_traverse(ctx->tdb, delete_permanent, NULL); - if (ret < 0) - return EIO; - - return EOK; -} diff --git a/src/responder/nss/nsssrv_nc.h b/src/responder/nss/nsssrv_nc.h deleted file mode 100644 index c0fa197c..00000000 --- a/src/responder/nss/nsssrv_nc.h +++ /dev/null @@ -1,51 +0,0 @@ -/* - SSSD - - NSS Responder - - Copyright (C) Simo Sorce <ssorce@redhat.com> 2008 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see <http://www.gnu.org/licenses/>. -*/ - -#ifndef _NSS_NEG_CACHE_H_ -#define _NSS_NEG_CACHE_H_ - -struct nss_nc_ctx; - -/* init the in memory negative cache */ -int nss_ncache_init(TALLOC_CTX *memctx, struct nss_nc_ctx **_ctx); - -/* check if the user is expired according to the passed in time to live */ -int nss_ncache_check_user(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name); -int nss_ncache_check_group(struct nss_nc_ctx *ctx, int ttl, - const char *domain, const char *name); -int nss_ncache_check_uid(struct nss_nc_ctx *ctx, int ttl, uid_t uid); -int nss_ncache_check_gid(struct nss_nc_ctx *ctx, int ttl, gid_t gid); - -/* add a new neg-cache entry setting the timestamp to "now" unless - * "permanent" is set to true, in which case the timestamps is set to 0 - * and the negative cache never expires (used to permanently filter out - * users and groups) */ -int nss_ncache_set_user(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name); -int nss_ncache_set_group(struct nss_nc_ctx *ctx, bool permanent, - const char *domain, const char *name); -int nss_ncache_set_uid(struct nss_nc_ctx *ctx, bool permanent, uid_t uid); -int nss_ncache_set_gid(struct nss_nc_ctx *ctx, bool permanent, gid_t gid); - -int nss_ncache_reset_permament(struct nss_nc_ctx *ctx); - -#endif /* _NSS_NEG_CACHE_H_ */ |