diff options
| -rw-r--r-- | daemons/configure.ac | 2 | ||||
| -rw-r--r-- | daemons/ipa-slapi-plugins/Makefile.am | 1 | ||||
| -rw-r--r-- | daemons/ipa-slapi-plugins/ipa-cldap/Makefile.am | 49 | ||||
| -rw-r--r-- | daemons/ipa-slapi-plugins/ipa-cldap/ipa-cldap-conf.ldif | 16 | ||||
| -rw-r--r-- | daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.c | 238 | ||||
| -rw-r--r-- | daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.h | 72 | ||||
| -rw-r--r-- | daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c | 49 | ||||
| -rw-r--r-- | freeipa.spec.in | 15 |
8 files changed, 436 insertions, 6 deletions
diff --git a/daemons/configure.ac b/daemons/configure.ac index f89c50d6..46f47657 100644 --- a/daemons/configure.ac +++ b/daemons/configure.ac @@ -234,6 +234,7 @@ PKG_PROG_PKG_CONFIG() PKG_CHECK_MODULES([TALLOC], [talloc]) PKG_CHECK_MODULES([TEVENT], [tevent]) PKG_CHECK_MODULES([NDRPAC], [ndr_krb5pac]) +PKG_CHECK_MODULES([NDRNBT], [ndr_nbt]) dnl --------------------------------------------------------------------------- @@ -300,6 +301,7 @@ AC_CONFIG_FILES([ Makefile ipa-kdb/Makefile ipa-slapi-plugins/Makefile + ipa-slapi-plugins/ipa-cldap/Makefile ipa-slapi-plugins/ipa-enrollment/Makefile ipa-slapi-plugins/ipa-lockout/Makefile ipa-slapi-plugins/ipa-pwd-extop/Makefile diff --git a/daemons/ipa-slapi-plugins/Makefile.am b/daemons/ipa-slapi-plugins/Makefile.am index 25f50d5f..29b985e6 100644 --- a/daemons/ipa-slapi-plugins/Makefile.am +++ b/daemons/ipa-slapi-plugins/Makefile.am @@ -1,6 +1,7 @@ NULL = SUBDIRS = \ + ipa-cldap \ ipa-enrollment \ ipa-lockout \ ipa-modrdn \ diff --git a/daemons/ipa-slapi-plugins/ipa-cldap/Makefile.am b/daemons/ipa-slapi-plugins/ipa-cldap/Makefile.am new file mode 100644 index 00000000..b563e987 --- /dev/null +++ b/daemons/ipa-slapi-plugins/ipa-cldap/Makefile.am @@ -0,0 +1,49 @@ +NULL = + +PLUGIN_COMMON_DIR=../common + +INCLUDES = \ + -I. \ + -I$(srcdir) \ + -I$(PLUGIN_COMMON_DIR) \ + -I$(COMMON_BER_DIR) \ + -DPREFIX=\""$(prefix)"\" \ + -DBINDIR=\""$(bindir)"\" \ + -DLIBDIR=\""$(libdir)"\" \ + -DLIBEXECDIR=\""$(libexecdir)"\" \ + -DDATADIR=\""$(datadir)"\" \ + $(AM_CFLAGS) \ + $(LDAP_CFLAGS) \ + $(WARN_CFLAGS) \ + $(NDRNBT_CFLAGS) \ + $(NULL) + +plugindir = $(libdir)/dirsrv/plugins +plugin_LTLIBRARIES = \ + libipa_cldap.la \ + $(NULL) + +libipa_cldap_la_SOURCES = \ + ipa_cldap_worker.c \ + ipa_cldap.c \ + $(NULL) + +libipa_cldap_la_LDFLAGS = -avoid-version + +libipa_cldap_la_LIBADD = \ + $(LDAP_LIBS) \ + $(NDRNBT_LIBS) \ + $(NULL) + +appdir = $(IPA_DATA_DIR) +app_DATA = \ + ipa-cldap-conf.ldif \ + $(NULL) + +EXTRA_DIST = \ + $(app_DATA) \ + $(NULL) + +MAINTAINERCLEANFILES = \ + *~ \ + Makefile.in diff --git a/daemons/ipa-slapi-plugins/ipa-cldap/ipa-cldap-conf.ldif b/daemons/ipa-slapi-plugins/ipa-cldap/ipa-cldap-conf.ldif new file mode 100644 index 00000000..2d70b9ac --- /dev/null +++ b/daemons/ipa-slapi-plugins/ipa-cldap/ipa-cldap-conf.ldif @@ -0,0 +1,16 @@ +dn: cn=ipa_cldap,cn=plugins,cn=config +changetype: add +objectclass: top +objectclass: nsSlapdPlugin +objectclass: extensibleObject +cn: ipa_cldap +nsslapd-pluginpath: libipa_cldap +nsslapd-plugininitfunc: ipa_cldap_init +nsslapd-plugintype: postoperation +nsslapd-pluginenabled: on +nsslapd-pluginid: ipa_cldap_init +nsslapd-pluginversion: @PACKAGE_VERSION@ +nsslapd-pluginvendor: RedHat +nsslapd-plugindescription: CLDAP Server to interoperate with AD +nsslapd-plugin-depends-on-type: database +nsslapd-basedn: $SUFFIX diff --git a/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.c b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.c new file mode 100644 index 00000000..d7a59d51 --- /dev/null +++ b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.c @@ -0,0 +1,238 @@ +/** BEGIN COPYRIGHT BLOCK + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + * + * Additional permission under GPLv3 section 7: + * + * In the following paragraph, "GPL" means the GNU General Public + * License, version 3 or any later version, and "Non-GPL Code" means + * code that is governed neither by the GPL nor a license + * compatible with the GPL. + * + * You may link the code of this Program with Non-GPL Code and convey + * linked combinations including the two, provided that such Non-GPL + * Code only links to the code of this Program through those well + * defined interfaces identified in the file named EXCEPTION found in + * the source code files (the "Approved Interfaces"). The files of + * Non-GPL Code may instantiate templates or use macros or inline + * functions from the Approved Interfaces without causing the resulting + * work to be covered by the GPL. Only the copyright holders of this + * Program may make changes or additions to the list of Approved + * Interfaces. + * + * Authors: + * Simo Sorce <ssorce@redhat.com> + * + * Copyright (C) 2011 Red Hat, Inc. + * All rights reserved. + * END COPYRIGHT BLOCK **/ + +#include "ipa_cldap.h" +#include "util.h" + +Slapi_PluginDesc ipa_cldap_desc = { + IPA_CLDAP_PLUGIN_NAME, + "FreeIPA project", + "FreeIPA/3.0", + IPA_CLDAP_PLUGIN_DESC +}; + +static int ipa_cldap_start(Slapi_PBlock *pb) +{ + struct ipa_cldap_ctx *ctx; + int ret; + + ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx); + if (ret) { + LOG_FATAL("No plugin context ?!\n"); + return -1; + } + + ret = pthread_create(&ctx->tid, NULL, ipa_cldap_worker, ctx); + if (ret) { + LOG_FATAL("Failed to create worker thread\n"); + return -1; + } + + LOG("Plugin statrup completed.\n"); + + return 0; +} + +static int ipa_cldap_stop(Slapi_PBlock *pb) +{ + struct ipa_cldap_ctx *ctx; + void *retval; + int ret; + + ret = slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx); + if (ret) { + LOG_FATAL("No plugin context ?!\n"); + return -1; + } + + /* send stop signal to terminate worker thread */ + write(ctx->stopfd[1], "", 1); + close(ctx->stopfd[1]); + + ret = pthread_join(ctx->tid, &retval); + if (ret) { + LOG_FATAL("Failed to stop worker thread\n"); + return -1; + } + + LOG("Plugin shutdown completed.\n"); + + return 0; +} + +static int ipa_cldap_init_service(Slapi_PBlock *pb, + struct ipa_cldap_ctx **cldap_ctx) +{ + struct ipa_cldap_ctx *ctx; + struct sockaddr_in6 addr; + Slapi_Entry *e; + int flags; + int val; + int ret; + + ctx = calloc(1, sizeof(struct ipa_cldap_ctx)); + if (!ctx) { + return ENOMEM; + } + ctx->sd = -1; + + ret = slapi_pblock_get(pb, SLAPI_PLUGIN_IDENTITY, &ctx->plugin_id); + if ((ret != 0) || (NULL == ctx->plugin_id)) { + LOG_FATAL("Could not get identity or identity was NULL\n"); + if (ret == 0) { + ret = -1; + } + goto done; + } + + slapi_pblock_get(pb, SLAPI_PLUGIN_CONFIG_ENTRY, &e); + if (!e) { + LOG_FATAL("Plugin configuration not found!\n"); + return -1; + } + + ctx->base_dn = slapi_entry_attr_get_charptr(e, "nsslapd-basedn"); + if (!ctx->base_dn) { + LOG_FATAL("Plugin configuration not found!\n"); + return -1; + } + + /* create a stop pipe so the main DS thread can interrupt the poll() + * of the worker thread at any time and cause the worker thread to + * immediately exit without waiting for timeouts or such */ + ret = pipe(ctx->stopfd); + if (ret != 0) { + LOG_FATAL("Failed to stop pipe\n"); + ret = EIO; + goto done; + } + + ctx->sd = socket(PF_INET6, SOCK_DGRAM, 0); + if (ctx->sd == -1) { + LOG_FATAL("Failed to create socket\n"); + ret = EIO; + goto done; + } + + val = 1; + ret = setsockopt(ctx->sd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val)); + if (ret == -1) { + ret = errno; + LOG("Failed to make socket immediately reusable (%d, %s)\n", + ret, strerror(ret)); + } + + memset(&addr, 0, sizeof(addr)); + addr.sin6_family = AF_INET6; + addr.sin6_port = htons(CLDAP_PORT); + + ret = bind(ctx->sd, (struct sockaddr *)&addr, sizeof(addr)); + if (ret == -1) { + ret = errno; + LOG_FATAL("Failed to bind socket (%d, %s)\n", ret, strerror(ret)); + goto done; + } + + flags = fcntl(ctx->sd, F_GETFL); + if ((flags & O_NONBLOCK) == 0) { + ret = fcntl(ctx->sd, F_SETFL, flags | O_NONBLOCK); + if (ret == -1) { + ret = errno; + LOG_FATAL("Failed to set socket to non-blocking\n"); + goto done; + } + } + +done: + if (ret) { + if (ctx->sd != -1) { + close(ctx->sd); + } + free(ctx); + } else { + *cldap_ctx = ctx; + } + return ret; +} + +static int ipa_cldap_post_init(Slapi_PBlock *pb) +{ + return 0; +} + +/* Initialization function */ +int ipa_cldap_init(Slapi_PBlock *pb) +{ + struct ipa_cldap_ctx *cldap_ctx = NULL; + int ret; + + ret = ipa_cldap_init_service(pb, &cldap_ctx); + if (ret) { + LOG_FATAL("Failed to initialize CLDAP Plugin\n"); + /* do not cause DS to stop, simply do nothing */ + return 0; + } + + /* Register the plug-in */ + ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_03); + if (!ret) { + ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, &ipa_cldap_desc); + } + if (!ret) { + ret = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, &ipa_cldap_start); + } + if (!ret) { + ret = slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN, &ipa_cldap_stop); + } + if (!ret) { + ret = slapi_pblock_set(pb, SLAPI_PLUGIN_PRIVATE, cldap_ctx); + } + if (ret) { + LOG_FATAL("Failed to initialize plug-in\n" ); + return -1; + } + + slapi_register_plugin("postoperation", 1, + "ipa_cldap_post_init", + ipa_cldap_post_init, + "CLDAP post ops", NULL, + cldap_ctx->plugin_id); + + return 0; +} diff --git a/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.h b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.h new file mode 100644 index 00000000..013dad2f --- /dev/null +++ b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap.h @@ -0,0 +1,72 @@ +/** BEGIN COPYRIGHT BLOCK + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + * + * Additional permission under GPLv3 section 7: + * + * In the following paragraph, "GPL" means the GNU General Public + * License, version 3 or any later version, and "Non-GPL Code" means + * code that is governed neither by the GPL nor a license + * compatible with the GPL. + * + * You may link the code of this Program with Non-GPL Code and convey + * linked combinations including the two, provided that such Non-GPL + * Code only links to the code of this Program through those well + * defined interfaces identified in the file named EXCEPTION found in + * the source code files (the "Approved Interfaces"). The files of + * Non-GPL Code may instantiate templates or use macros or inline + * functions from the Approved Interfaces without causing the resulting + * work to be covered by the GPL. Only the copyright holders of this + * Program may make changes or additions to the list of Approved + * Interfaces. + * + * Authors: + * Simo Sorce <ssorce@redhat.com> + * + * Copyright (C) 2011 Red Hat, Inc. + * All rights reserved. + * END COPYRIGHT BLOCK **/ + +#ifndef _IPA_CLDAP_H_ +#define _IPA_CLDAP_H_ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <errno.h> +#include <unistd.h> +#include <fcntl.h> +#include <stdbool.h> +#include <stdlib.h> +#include <pthread.h> +#include <dirsrv/slapi-plugin.h> +#include "util.h" + +#define IPA_CLDAP_PLUGIN_NAME "CLDAP Server" +#define IPA_CLDAP_PLUGIN_DESC "MS/AD introperable CLDAP server" + +#define IPA_PLUGIN_NAME IPA_CLDAP_PLUGIN_NAME +#define CLDAP_PORT 389 + +struct ipa_cldap_ctx { + Slapi_ComponentId *plugin_id; + pthread_t tid; + char *base_dn; + int stopfd[2]; + int sd; +}; + +void *ipa_cldap_worker(struct ipa_cldap_ctx *ctx); + +#endif /* _IPA_CLDAP_H_ */ diff --git a/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c new file mode 100644 index 00000000..4bbba535 --- /dev/null +++ b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c @@ -0,0 +1,49 @@ +/** BEGIN COPYRIGHT BLOCK + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + * + * Additional permission under GPLv3 section 7: + * + * In the following paragraph, "GPL" means the GNU General Public + * License, version 3 or any later version, and "Non-GPL Code" means + * code that is governed neither by the GPL nor a license + * compatible with the GPL. + * + * You may link the code of this Program with Non-GPL Code and convey + * linked combinations including the two, provided that such Non-GPL + * Code only links to the code of this Program through those well + * defined interfaces identified in the file named EXCEPTION found in + * the source code files (the "Approved Interfaces"). The files of + * Non-GPL Code may instantiate templates or use macros or inline + * functions from the Approved Interfaces without causing the resulting + * work to be covered by the GPL. Only the copyright holders of this + * Program may make changes or additions to the list of Approved + * Interfaces. + * + * Authors: + * Simo Sorce <ssorce@redhat.com> + * + * Copyright (C) 2011 Red Hat, Inc. + * All rights reserved. + * END COPYRIGHT BLOCK **/ + +#include "ipa_cldap.h" + +void *ipa_cldap_worker(struct ipa_cldap_ctx *ctx) +{ + bool stop = false; + + while (!stop) { + sleep(1); + } +} diff --git a/freeipa.spec.in b/freeipa.spec.in index 6531cf5d..2da5d417 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -24,11 +24,7 @@ Source0: freeipa-%{version}.tar.gz BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %if ! %{ONLY_CLIENT} -%if 0%{?fedora} >= 16 -BuildRequires: 389-ds-base-devel >= 1.2.10 -%else -BuildRequires: 389-ds-base-devel >= 1.2.9 -%endif +BuildRequires: 389-ds-base-devel >= 1.2.10-0.5.a5 BuildRequires: svrcore-devel BuildRequires: /usr/share/selinux/devel/Makefile BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER} @@ -93,7 +89,7 @@ Requires: %{name}-python = %{version}-%{release} Requires: %{name}-client = %{version}-%{release} Requires: %{name}-admintools = %{version}-%{release} Requires: %{name}-server-selinux = %{version}-%{release} -Requires(pre): 389-ds-base >= 1.2.10-0.4.a4 +Requires(pre): 389-ds-base >= 1.2.10-0.5.a5 Requires: openldap-clients Requires: nss Requires: nss-tools @@ -330,6 +326,7 @@ rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la rm %{buildroot}/%{plugin_dir}/libipa_uuid.la rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la rm %{buildroot}/%{plugin_dir}/libipa_lockout.la +rm %{buildroot}/%{plugin_dir}/libipa_cldap.la rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la # Some user-modifiable HTML files are provided. Move these to /etc @@ -541,6 +538,7 @@ fi %attr(755,root,root) %{plugin_dir}/libipa_uuid.so %attr(755,root,root) %{plugin_dir}/libipa_modrdn.so %attr(755,root,root) %{plugin_dir}/libipa_lockout.so +%attr(755,root,root) %{plugin_dir}/libipa_cldap.so %dir %{_localstatedir}/lib/ipa %attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore %dir %{_localstatedir}/cache/ipa @@ -618,6 +616,11 @@ fi %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf %changelog +* Wed Nov 17 2011 Simo Sorce <simo@redhat.com> - 2.99.0-12 +- Add CLDAP plugin +- Set min nvr of 389-ds-base to 1.2.10-0.5.a5 for SLAPI_PLUGIN_CONFIG_ENTRY + support + * Wed Nov 14 2011 Endi S. Dewata <edewata@redhat.com> - 2.99.0-11 - Make sure changes to extension.js are not removed. |