From 216b846cb1acae47b80fd61fc9474b08eabe13b3 Mon Sep 17 00:00:00 2001 From: Pavel Březina Date: Jan 19 2016 16:30:02 +0000 Subject: SUDO: move code shared between ldap and ipa to separate module Reviewed-by: Sumit Bose (cherry picked from commit 85feb8d77a2c832787880944e02104846c4d5376) --- diff --git a/Makefile.am b/Makefile.am index 29dd73e..8b57640 100644 --- a/Makefile.am +++ b/Makefile.am @@ -619,6 +619,7 @@ dist_noinst_HEADERS = \ src/providers/ldap/sdap_async.h \ src/providers/ldap/sdap_async_private.h \ src/providers/ldap/sdap_sudo.h \ + src/providers/ldap/sdap_sudo_shared.h \ src/providers/ldap/sdap_autofs.h \ src/providers/ldap/sdap_id_op.h \ src/providers/ldap/ldap_opts.h \ @@ -2861,6 +2862,7 @@ libsss_ldap_common_la_SOURCES += \ src/providers/ldap/sdap_async_sudo.c \ src/providers/ldap/sdap_async_sudo_hostinfo.c \ src/providers/ldap/sdap_sudo_refresh.c \ + src/providers/ldap/sdap_sudo_shared.c \ src/providers/ldap/sdap_sudo.c endif diff --git a/src/providers/ldap/sdap_async_sudo.c b/src/providers/ldap/sdap_async_sudo.c index 2fcfa4a..d26d00f 100644 --- a/src/providers/ldap/sdap_async_sudo.c +++ b/src/providers/ldap/sdap_async_sudo.c @@ -31,6 +31,7 @@ #include "providers/ldap/sdap.h" #include "providers/ldap/sdap_ops.h" #include "providers/ldap/sdap_sudo.h" +#include "providers/ldap/sdap_sudo_shared.h" #include "db/sysdb_sudo.h" struct sdap_sudo_load_sudoers_state { @@ -135,36 +136,6 @@ static int sdap_sudo_load_sudoers_recv(struct tevent_req *req, return EOK; } -static void sdap_sudo_set_usn(struct sdap_server_opts *srv_opts, char *usn) -{ - unsigned int usn_number; - char *endptr = NULL; - - if (srv_opts == NULL) { - DEBUG(SSSDBG_TRACE_FUNC, "Bug: srv_opts is NULL\n"); - return; - } - - if (usn == NULL) { - DEBUG(SSSDBG_TRACE_FUNC, "Bug: usn is NULL\n"); - return; - } - - if (sysdb_compare_usn(usn, srv_opts->max_sudo_value) > 0) { - talloc_zfree(srv_opts->max_sudo_value); - srv_opts->max_sudo_value = talloc_steal(srv_opts, usn); - } - - usn_number = strtoul(usn, &endptr, 10); - if ((endptr == NULL || (*endptr == '\0' && endptr != usn)) - && (usn_number > srv_opts->last_usn)) { - srv_opts->last_usn = usn_number; - } - - DEBUG(SSSDBG_FUNC_DATA, "SUDO higher USN value: [%s]\n", - srv_opts->max_sudo_value); -} - static char *sdap_sudo_build_host_filter(TALLOC_CTX *mem_ctx, struct sdap_attr_map *map, char **hostnames, diff --git a/src/providers/ldap/sdap_sudo_refresh.c b/src/providers/ldap/sdap_sudo_refresh.c index e3df8f1..5697818 100644 --- a/src/providers/ldap/sdap_sudo_refresh.c +++ b/src/providers/ldap/sdap_sudo_refresh.c @@ -25,6 +25,7 @@ #include "util/util.h" #include "providers/dp_ptask.h" #include "providers/ldap/sdap_sudo.h" +#include "providers/ldap/sdap_sudo_shared.h" #include "db/sysdb_sudo.h" struct sdap_sudo_full_refresh_state { @@ -469,84 +470,10 @@ sdap_sudo_ptask_smart_refresh_recv(struct tevent_req *req) errno_t sdap_sudo_ptask_setup(struct be_ctx *be_ctx, struct sdap_sudo_ctx *sudo_ctx) { - struct dp_option *opts = sudo_ctx->id_ctx->opts->basic; - time_t smart; - time_t full; - time_t delay; - time_t last_refresh; - errno_t ret; - - smart = dp_opt_get_int(opts, SDAP_SUDO_SMART_REFRESH_INTERVAL); - full = dp_opt_get_int(opts, SDAP_SUDO_FULL_REFRESH_INTERVAL); - - if (smart == 0 && full == 0) { - /* We don't allow both types to be disabled. At least smart refresh - * needs to be enabled. In this case smart refresh will catch up new - * and modified rules and deleted rules are caught when expired. */ - smart = opts[SDAP_SUDO_SMART_REFRESH_INTERVAL].def_val.number; - - DEBUG(SSSDBG_CONF_SETTINGS, "At least smart refresh needs to be " - "enabled. Setting smart refresh interval to default value " - "(%ld) seconds.\n", smart); - } else if (full <= smart) { - /* In this case it does not make any sense to run smart refresh. */ - smart = 0; - - DEBUG(SSSDBG_CONF_SETTINGS, "Smart refresh interval has to be lower " - "than full refresh interval. Periodical smart refresh will be " - "disabled.\n"); - } - - ret = sysdb_sudo_get_last_full_refresh(be_ctx->domain, &last_refresh); - if (ret != EOK) { - DEBUG(SSSDBG_MINOR_FAILURE, "Unable to obtain time of last full " - "refresh. Assuming none was performed so far.\n"); - last_refresh = 0; - } - - if (last_refresh == 0) { - /* If this is the first startup, we need to kick off an refresh - * immediately, to close a window where clients requesting sudo - * information won't get an immediate reply with no entries */ - delay = 0; - } else { - /* At least one update has previously run, so clients will get cached - * data. We will delay the refresh so we don't slow down the startup - * process if this is happening during system boot. */ - delay = 10; - } - - /* Full refresh. - * - * Disable when offline and run immediately when SSSD goes back online. - * Since we have periodical online check we don't have to run this task - * when offline. */ - ret = be_ptask_create(be_ctx, be_ctx, full, delay, 0, 0, full, - BE_PTASK_OFFLINE_DISABLE, 0, - sdap_sudo_ptask_full_refresh_send, - sdap_sudo_ptask_full_refresh_recv, - sudo_ctx, "SUDO Full Refresh", NULL); - if (ret != EOK) { - DEBUG(SSSDBG_CRIT_FAILURE, "Unable to setup full refresh ptask " - "[%d]: %s\n", ret, sss_strerror(ret)); - return ret; - } - - /* Smart refresh. - * - * Disable when offline and reschedule normally when SSSD goes back online. - * Since we have periodical online check we don't have to run this task - * when offline. */ - ret = be_ptask_create(be_ctx, be_ctx, smart, delay + smart, smart, 0, smart, - BE_PTASK_OFFLINE_DISABLE, 0, - sdap_sudo_ptask_smart_refresh_send, - sdap_sudo_ptask_smart_refresh_recv, - sudo_ctx, "SUDO Smart Refresh", NULL); - if (ret != EOK) { - DEBUG(SSSDBG_CRIT_FAILURE, "Unable to setup smart refresh ptask " - "[%d]: %s\n", ret, sss_strerror(ret)); - return ret; - } - - return EOK; + return sdap_sudo_ptask_setup_generic(be_ctx, sudo_ctx->id_ctx->opts->basic, + sdap_sudo_ptask_full_refresh_send, + sdap_sudo_ptask_full_refresh_recv, + sdap_sudo_ptask_smart_refresh_send, + sdap_sudo_ptask_smart_refresh_recv, + sudo_ctx); } diff --git a/src/providers/ldap/sdap_sudo_shared.c b/src/providers/ldap/sdap_sudo_shared.c new file mode 100644 index 0000000..86a6acf --- /dev/null +++ b/src/providers/ldap/sdap_sudo_shared.c @@ -0,0 +1,149 @@ +/* + Authors: + Pavel Březina + + Copyright (C) 2015 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include +#include +#include + +#include "util/util.h" +#include "providers/dp_ptask.h" +#include "providers/ldap/sdap.h" +#include "providers/ldap/sdap_sudo_shared.h" +#include "db/sysdb_sudo.h" + +errno_t +sdap_sudo_ptask_setup_generic(struct be_ctx *be_ctx, + struct dp_option *opts, + be_ptask_send_t full_send_fn, + be_ptask_recv_t full_recv_fn, + be_ptask_send_t smart_send_fn, + be_ptask_recv_t smart_recv_fn, + void *pvt) +{ + time_t smart; + time_t full; + time_t delay; + time_t last_refresh; + errno_t ret; + + smart = dp_opt_get_int(opts, SDAP_SUDO_SMART_REFRESH_INTERVAL); + full = dp_opt_get_int(opts, SDAP_SUDO_FULL_REFRESH_INTERVAL); + + if (smart == 0 && full == 0) { + /* We don't allow both types to be disabled. At least smart refresh + * needs to be enabled. In this case smart refresh will catch up new + * and modified rules and deleted rules are caught when expired. */ + smart = opts[SDAP_SUDO_SMART_REFRESH_INTERVAL].def_val.number; + + DEBUG(SSSDBG_CONF_SETTINGS, "At least smart refresh needs to be " + "enabled. Setting smart refresh interval to default value " + "(%ld) seconds.\n", smart); + } else if (full <= smart) { + /* In this case it does not make any sense to run smart refresh. */ + smart = 0; + + DEBUG(SSSDBG_CONF_SETTINGS, "Smart refresh interval has to be lower " + "than full refresh interval. Periodical smart refresh will be " + "disabled.\n"); + } + + ret = sysdb_sudo_get_last_full_refresh(be_ctx->domain, &last_refresh); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, "Unable to obtain time of last full " + "refresh. Assuming none was performed so far.\n"); + last_refresh = 0; + } + + if (last_refresh == 0) { + /* If this is the first startup, we need to kick off an refresh + * immediately, to close a window where clients requesting sudo + * information won't get an immediate reply with no entries */ + delay = 0; + } else { + /* At least one update has previously run, so clients will get cached + * data. We will delay the refresh so we don't slow down the startup + * process if this is happening during system boot. */ + delay = 10; + } + + /* Full refresh. + * + * Disable when offline and run immediately when SSSD goes back online. + * Since we have periodical online check we don't have to run this task + * when offline. */ + ret = be_ptask_create(be_ctx, be_ctx, full, delay, 0, 0, full, + BE_PTASK_OFFLINE_DISABLE, 0, + full_send_fn, full_recv_fn, pvt, + "SUDO Full Refresh", NULL); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, "Unable to setup full refresh ptask " + "[%d]: %s\n", ret, sss_strerror(ret)); + return ret; + } + + /* Smart refresh. + * + * Disable when offline and reschedule normally when SSSD goes back online. + * Since we have periodical online check we don't have to run this task + * when offline. */ + ret = be_ptask_create(be_ctx, be_ctx, smart, delay + smart, smart, 0, smart, + BE_PTASK_OFFLINE_DISABLE, 0, + smart_send_fn, smart_recv_fn, pvt, + "SUDO Smart Refresh", NULL); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, "Unable to setup smart refresh ptask " + "[%d]: %s\n", ret, sss_strerror(ret)); + return ret; + } + + return EOK; +} + +void +sdap_sudo_set_usn(struct sdap_server_opts *srv_opts, + char *usn) +{ + unsigned int usn_number; + char *endptr = NULL; + + if (srv_opts == NULL) { + DEBUG(SSSDBG_TRACE_FUNC, "Bug: srv_opts is NULL\n"); + return; + } + + if (usn == NULL) { + DEBUG(SSSDBG_TRACE_FUNC, "Bug: usn is NULL\n"); + return; + } + + if (sysdb_compare_usn(usn, srv_opts->max_sudo_value) > 0) { + talloc_zfree(srv_opts->max_sudo_value); + srv_opts->max_sudo_value = talloc_steal(srv_opts, usn); + } + + usn_number = strtoul(usn, &endptr, 10); + if ((endptr == NULL || (*endptr == '\0' && endptr != usn)) + && (usn_number > srv_opts->last_usn)) { + srv_opts->last_usn = usn_number; + } + + DEBUG(SSSDBG_FUNC_DATA, "SUDO higher USN value: [%s]\n", + srv_opts->max_sudo_value); +} diff --git a/src/providers/ldap/sdap_sudo_shared.h b/src/providers/ldap/sdap_sudo_shared.h new file mode 100644 index 0000000..bbc6927 --- /dev/null +++ b/src/providers/ldap/sdap_sudo_shared.h @@ -0,0 +1,40 @@ +/* + Authors: + Pavel Březina + + Copyright (C) 2015 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#ifndef _SDAP_SUDO_SHARED_H_ +#define _SDAP_SUDO_SHARED_H_ + +#include "providers/dp_backend.h" +#include "providers/dp_ptask.h" + +errno_t +sdap_sudo_ptask_setup_generic(struct be_ctx *be_ctx, + struct dp_option *opts, + be_ptask_send_t full_send_fn, + be_ptask_recv_t full_recv_fn, + be_ptask_send_t smart_send_fn, + be_ptask_recv_t smart_recv_fn, + void *pvt); + +void +sdap_sudo_set_usn(struct sdap_server_opts *srv_opts, + char *usn); + +#endif /* _SDAP_SUDO_SHARED_H_ */