From 0dc81a52e2836010974e9f71b1f3e47c20fd498d Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Fri, 9 Oct 2020 11:56:21 +0200

Subject: [PATCH 7/8] negcache: make sure short names are added to sub-domains

If short names are used with filter_users or filter_groups in a

[domain/...] section they should be added to the sub-domains of this

domain as well.

Resolves: https://github.com/SSSD/sssd/issues/5238

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

---

 src/responder/common/negcache.c  | 105 +++++++------

 src/tests/cmocka/test_negcache.c | 254 +++++++++++++++++++++++++++++++

 2 files changed, 312 insertions(+), 47 deletions(-)

diff --git a/src/responder/common/negcache.c b/src/responder/common/negcache.c

index 139218420..9ee39ce3e 100644

--- a/src/responder/common/negcache.c

+++ b/src/responder/common/negcache.c

@@ -971,6 +971,7 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,

     char *name = NULL;

     struct sss_domain_info *dom = NULL;

     struct sss_domain_info *domain_list = rctx->domains;

+    struct sss_domain_info *ddom;

     char *domainname = NULL;

     char *conf_path = NULL;

     TALLOC_CTX *tmpctx = talloc_new(NULL);

@@ -1013,39 +1014,44 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,

                 continue;

             }

-            if (domainname && strcmp(domainname, dom->name)) {

-                DEBUG(SSSDBG_TRACE_FUNC,

-                      "Mismatch between domain name (%s) and name "

-                          "set in FQN  (%s), assuming %s is UPN\n",

-                          dom->name, domainname, filter_list[i]);

-                ret = sss_ncache_set_upn(ncache, true, dom, filter_list[i]);

+            /* Check domain and its sub-domains */

+            for (ddom = dom; ddom != NULL;

+                        ddom = get_next_domain(ddom, SSS_GND_ALL_SUBDOMAINS)) {

+

+                if (domainname && strcmp(domainname, ddom->name)) {

+                    DEBUG(SSSDBG_TRACE_FUNC,

+                          "Mismatch between domain name (%s) and name "

+                              "set in FQN  (%s), assuming %s is UPN\n",

+                              ddom->name, domainname, filter_list[i]);

+                    ret = sss_ncache_set_upn(ncache, true, ddom, filter_list[i]);

+                    if (ret != EOK) {

+                        DEBUG(SSSDBG_OP_FAILURE,

+                              "sss_ncache_set_upn failed (%d [%s]), ignored\n",

+                              ret, sss_strerror(ret));

+                    }

+                    continue;

+                }

+

+                fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);

+                if (fqname == NULL) {

+                    continue;

+                }

+

+                ret = sss_ncache_set_upn(ncache, true, ddom, fqname);

                 if (ret != EOK) {

                     DEBUG(SSSDBG_OP_FAILURE,

                           "sss_ncache_set_upn failed (%d [%s]), ignored\n",

                           ret, sss_strerror(ret));

                 }

-                continue;

-            }

-

-            fqname = sss_create_internal_fqname(tmpctx, name, dom->name);

-            if (fqname == NULL) {

-                continue;

-            }

-

-            ret = sss_ncache_set_upn(ncache, true, dom, fqname);

-            if (ret != EOK) {

-                DEBUG(SSSDBG_OP_FAILURE,

-                      "sss_ncache_set_upn failed (%d [%s]), ignored\n",

-                      ret, sss_strerror(ret));

-            }

-            ret = sss_ncache_set_user(ncache, true, dom, fqname);

-            talloc_zfree(fqname);

-            if (ret != EOK) {

-                DEBUG(SSSDBG_CRIT_FAILURE,

-                      "Failed to store permanent user filter for [%s]"

-                          " (%d [%s])\n", filter_list[i],

-                          ret, sss_strerror(ret));

-                continue;

+                ret = sss_ncache_set_user(ncache, true, ddom, fqname);

+                talloc_zfree(fqname);

+                if (ret != EOK) {

+                    DEBUG(SSSDBG_CRIT_FAILURE,

+                          "Failed to store permanent user filter for [%s]"

+                              " (%d [%s])\n", filter_list[i],

+                              ret, sss_strerror(ret));

+                    continue;

+                }

             }

         }

     }

@@ -1161,27 +1167,32 @@ errno_t sss_ncache_prepopulate(struct sss_nc_ctx *ncache,

                 continue;

             }

-            if (domainname && strcmp(domainname, dom->name)) {

-                DEBUG(SSSDBG_CRIT_FAILURE,

-                      "Mismatch between domain name (%s) and name "

-                          "set in FQN  (%s), skipping group %s\n",

-                          dom->name, domainname, name);

-                continue;

-            }

+            /* Check domain and its sub-domains */

+            for (ddom = dom;

+                        ddom != NULL && (ddom == dom || ddom->parent != NULL);

+                        ddom = get_next_domain(ddom, SSS_GND_ALL_DOMAINS)) {

+                if (domainname && strcmp(domainname, ddom->name)) {

+                    DEBUG(SSSDBG_CRIT_FAILURE,

+                          "Mismatch between domain name (%s) and name "

+                              "set in FQN  (%s), skipping group %s\n",

+                              ddom->name, domainname, name);

+                    continue;

+                }

-            fqname = sss_create_internal_fqname(tmpctx, name, dom->name);

-            if (fqname == NULL) {

-                continue;

-            }

+                fqname = sss_create_internal_fqname(tmpctx, name, ddom->name);

+                if (fqname == NULL) {

+                    continue;

+                }

-            ret = sss_ncache_set_group(ncache, true, dom, fqname);

-            talloc_zfree(fqname);

-            if (ret != EOK) {

-                DEBUG(SSSDBG_CRIT_FAILURE,

-                      "Failed to store permanent group filter for [%s]"

-                          " (%d [%s])\n", filter_list[i],

-                          ret, strerror(ret));

-                continue;

+                ret = sss_ncache_set_group(ncache, true, ddom, fqname);

+                talloc_zfree(fqname);

+                if (ret != EOK) {

+                    DEBUG(SSSDBG_CRIT_FAILURE,

+                          "Failed to store permanent group filter for [%s]"

+                              " (%d [%s])\n", filter_list[i],

+                              ret, strerror(ret));

+                    continue;

+                }

             }

         }

     }

diff --git a/src/tests/cmocka/test_negcache.c b/src/tests/cmocka/test_negcache.c

index b3a379227..fb306b110 100644

--- a/src/tests/cmocka/test_negcache.c

+++ b/src/tests/cmocka/test_negcache.c

@@ -119,6 +119,8 @@ static int setup(void **state)

     int ret;

     struct test_state *ts;

+    test_dom_suite_setup(TESTS_PATH);

+

     ts = talloc(NULL, struct test_state);

     assert_non_null(ts);

@@ -133,6 +135,7 @@ static int setup(void **state)

 static int teardown(void **state)

 {

     struct test_state *ts = talloc_get_type_abort(*state, struct test_state);

+    test_dom_suite_cleanup(TESTS_PATH, TEST_CONF_DB, TEST_DOM_NAME);

     talloc_free(ts);

     return 0;

 }

@@ -921,6 +924,255 @@ static void test_sss_ncache_reset_prepopulate(void **state)

     assert_int_equal(ret, EEXIST);

 }

+/* The main purpose of test_sss_ncache_short_name_in_domain is to test that

+ * short names in the filter_users or filter_groups options in a [domain/...]

+ * section are properly added to the related sub-domains as well (if there are

+ * any) and not added to domains from other [domain/...] sections. For

+ * completeness entries with fully-qualified names of the parent and the

+ * sub-domain and the generic UPN are added as well.

+ *

+ * The result should of course be independent of the present domains. To

+ * verify this the domains are added one after the other and the negative

+ * cache is repopulated each time.

+ *

+ * With the given domains, users and group we have to following expectations:

+ *  - the short name entry will be added to the domain and all sub-domains as

+ *    name and as upn by expanding it to a fully-qualified name with the

+ *    domain name or sub-domain name respectively

+ *  - the fully-qualified name from the parent domain is added as name and upn

+ *    to the parent domain and as upn to all sub-domains

+ *  - the fully-qualified name from the sub-domain is added as name to the

+ *    sub-domain and as upn to the parent and all sub-domains

+ *  - the generic upn is nowhere added as name and as upn to the parent and all

+ *    sub-domains

+ *  - none of the names is added to a different parent domain

+ *

+ * The following table should illustrated the expectations:

+ *

+ * user (name):

+ *                 | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom

+ *-----------------+-----------+-----------------------+--------------------------+------------

+ * TEST_DOM_NAME   |  PRESENT  |  PRESENT              |  MISSING                 |  MISSING

+ * subTEST_DOM_NAME|  PRESENT  |  MISSING              |  PRESENT                 |  MISSING

+ * TEST_DOM_NAME2  |  MISSING  |  MISSING              |  MISSING                 |  MISSING

+ *

+ * user (upn):

+ *                 | shortuser | parentu@TEST_DOM_NAME | subdomu@subTEST_DOM_NAME | upn@upn.dom

+ *-----------------+-----------+-----------------------+--------------------------+------------

+ * TEST_DOM_NAME   |  PRESENT  |  PRESENT              |  PRESENT                 |  PRESENT

+ * subTEST_DOM_NAME|  PRESENT  |  PRESENT              |  PRESENT                 |  PRESENT

+ * TEST_DOM_NAME2  |  MISSING  |  MISSING              |  MISSING                 |  MISSING

+ *

+ *

+ *

+ * groups:

+ *                 | shortgroup | parentg@TEST_DOM_NAME | subdomg@subTEST_DOM_NAME

+ *-----------------+------------+-----------------------+-------------------------

+ * TEST_DOM_NAME   |  PRESENT   |  PRESENT              |  MISSING

+ * subTEST_DOM_NAME|  PRESENT   |  MISSING              |  PRESENT

+ * TEST_DOM_NAME2  |  MISSING   |  MISSING              |  MISSING

+ *

+ *

+ * The following expect_*() implement checks for the expextations:

+ */

+

+static void expect_in_parent(struct sss_nc_ctx *ncache,

+                             struct sss_domain_info *dom)

+{

+    int ret;

+

+    ret = check_user_in_ncache(ncache, dom, "shortuser");

+    assert_int_equal(ret, EEXIST);

+    ret = sss_ncache_check_upn(ncache, dom, "shortuser@"TEST_DOM_NAME);

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_user_in_ncache(ncache, dom, "parentu");

+    assert_int_equal(ret, EEXIST);

+    ret = sss_ncache_check_upn(ncache, dom, "parentu@"TEST_DOM_NAME);

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_user_in_ncache(ncache, dom, "subdomu");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, dom, "subdomu@sub"TEST_DOM_NAME);

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_user_in_ncache(ncache, dom, "upn");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, dom, "upn@upn.dom");

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_group_in_ncache(ncache, dom, "shortgroup");

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_group_in_ncache(ncache, dom, "parentg");

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_group_in_ncache(ncache, dom, "subdomg");

+    assert_int_equal(ret, ENOENT);

+}

+

+static void expect_in_subdomain(struct sss_nc_ctx *ncache,

+                                struct sss_domain_info *sub_dom)

+{

+    int ret;

+

+    ret = check_user_in_ncache(ncache, sub_dom, "shortuser");

+    assert_int_equal(ret, EEXIST);

+    ret = sss_ncache_check_upn(ncache, sub_dom, "shortuser@sub"TEST_DOM_NAME);

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_user_in_ncache(ncache, sub_dom, "subdomu");

+    assert_int_equal(ret, EEXIST);

+    ret = sss_ncache_check_upn(ncache, sub_dom, "subdomu@sub"TEST_DOM_NAME);

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_user_in_ncache(ncache, sub_dom, "upn");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, sub_dom, "upn@upn.dom");

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_user_in_ncache(ncache, sub_dom, "parentu");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, sub_dom, "parentu@"TEST_DOM_NAME);

+    assert_int_equal(ret, EEXIST);

+

+

+    ret = check_group_in_ncache(ncache, sub_dom, "shortgroup");

+    assert_int_equal(ret, EEXIST);

+

+    ret = check_group_in_ncache(ncache, sub_dom, "parentg");

+    assert_int_equal(ret, ENOENT);

+

+    ret = check_group_in_ncache(ncache, sub_dom, "subdomg");

+    assert_int_equal(ret, EEXIST);

+}

+static void expect_no_entries_in_dom(struct sss_nc_ctx *ncache,

+                                     struct sss_domain_info *dom2)

+{

+    int ret;

+

+    ret = check_user_in_ncache(ncache, dom2, "shortuser");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, dom2, "shortuser"TEST_DOM_NAME);

+    assert_int_equal(ret, ENOENT);

+

+    ret = check_user_in_ncache(ncache, dom2, "parentu");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, dom2, "parentu@"TEST_DOM_NAME);

+    assert_int_equal(ret, ENOENT);

+

+    ret = check_user_in_ncache(ncache, dom2, "subdomu");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, dom2, "subdomu@sub"TEST_DOM_NAME);

+    assert_int_equal(ret, ENOENT);

+

+    ret = check_user_in_ncache(ncache, dom2, "upn");

+    assert_int_equal(ret, ENOENT);

+    ret = sss_ncache_check_upn(ncache, dom2, "upn@upn.dom");

+    assert_int_equal(ret, ENOENT);

+

+    ret = check_group_in_ncache(ncache, dom2, "shortgroup");

+    assert_int_equal(ret, ENOENT);

+

+    ret = check_group_in_ncache(ncache, dom2, "parentg");

+    assert_int_equal(ret, ENOENT);

+

+    ret = check_group_in_ncache(ncache, dom2, "subdomg");

+    assert_int_equal(ret, ENOENT);

+}

+

+static void test_sss_ncache_short_name_in_domain(void **state)

+{

+    int ret;

+    struct test_state *ts;

+    struct tevent_context *ev;

+    struct sss_nc_ctx *ncache;

+    struct sss_test_ctx *tc;

+    struct sss_domain_info *dom;

+    struct sss_domain_info *dom2;

+    struct sss_domain_info *sub_dom;

+

+    struct sss_test_conf_param params[] = {

+        { "filter_users", "shortuser, parentu@"TEST_DOM_NAME", "

+          "subdomu@sub"TEST_DOM_NAME", upn@upn.dom" },

+        { "filter_groups", "shortgroup, parentg@"TEST_DOM_NAME", "

+          "subdomg@sub"TEST_DOM_NAME },

+        { NULL, NULL },

+    };

+

+    const char *nss_filter_users[] = { params[0].value, NULL};

+    const char *nss_filter_groups[] = { params[1].value, NULL};

+

+    ts = talloc_get_type_abort(*state, struct test_state);

+

+    ev = tevent_context_init(ts);

+    assert_non_null(ev);

+

+    dom = talloc_zero(ts, struct sss_domain_info);

+    assert_non_null(dom);

+    dom->name = discard_const_p(char, TEST_DOM_NAME);

+    sss_domain_set_state(dom, DOM_ACTIVE);

+

+    ts->nctx = mock_nctx(ts);

+    assert_non_null(ts->nctx);

+

+    tc = create_dom_test_ctx(ts, TESTS_PATH, TEST_CONF_DB,

+                             TEST_DOM_NAME, TEST_ID_PROVIDER, params);

+    assert_non_null(tc);

+

+    ret = confdb_add_param(tc->confdb, true, "config/domain/"TEST_DOM_NAME,

+                           "filter_users", nss_filter_users);

+    assert_int_equal(ret, EOK);

+

+    ret = confdb_add_param(tc->confdb, true, "config/domain"TEST_DOM_NAME,

+                           "filter_groups", nss_filter_groups);

+    assert_int_equal(ret, EOK);

+

+    ncache = ts->ctx;

+    ts->rctx = mock_rctx(ts, ev, dom, ts->nctx);

+    assert_non_null(ts->rctx);

+    ts->rctx->cdb = tc->confdb;

+

+    ret = sss_names_init(ts, tc->confdb, TEST_DOM_NAME, &dom->names);

+    assert_int_equal(ret, EOK);

+

+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);

+    assert_int_equal(ret, EOK);

+

+    /* Add another domain */

+    dom2 = talloc_zero(ts, struct sss_domain_info);

+    assert_non_null(dom2);

+    dom2->name = discard_const_p(char, TEST_DOM_NAME"2");

+    sss_domain_set_state(dom2, DOM_ACTIVE);

+    dom->next = dom2;

+    dom2->names = dom->names;

+

+    expect_in_parent(ncache, dom);

+    expect_no_entries_in_dom(ncache, dom2);

+

+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);

+    assert_int_equal(ret, EOK);

+

+    expect_in_parent(ncache, dom);

+    expect_no_entries_in_dom(ncache, dom2);

+

+    /* Add a sub domain */

+    sub_dom = talloc_zero(ts, struct sss_domain_info);

+    assert_non_null(sub_dom);

+    sub_dom->name = discard_const_p(char, "sub"TEST_DOM_NAME);

+    sss_domain_set_state(sub_dom, DOM_ACTIVE);

+    sub_dom->parent = dom;

+    dom->subdomains = sub_dom;

+    sub_dom->names = dom->names;

+

+    ret = sss_ncache_reset_repopulate_permanent(ts->rctx, ncache);

+    assert_int_equal(ret, EOK);

+

+    expect_in_parent(ncache, dom);

+    expect_in_subdomain(ncache, sub_dom);

+    expect_no_entries_in_dom(ncache, dom2);

+}

+

 static void test_sss_ncache_reset(void **state)

 {

     errno_t ret;

@@ -1083,6 +1335,8 @@ int main(void)

                                         setup, teardown),

         cmocka_unit_test_setup_teardown(test_sss_ncache_reset_prepopulate,

                                         setup, teardown),

+        cmocka_unit_test_setup_teardown(test_sss_ncache_short_name_in_domain,

+                                        setup, teardown),

         cmocka_unit_test_setup_teardown(test_sss_ncache_reset,

                                         setup, teardown),

         cmocka_unit_test_setup_teardown(test_sss_ncache_locate_uid_gid,

-- 

2.21.3