From 27143e773371fd43c3c328e5996785b11e33b4a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Tue, 16 Apr 2013 15:41:33 +0200 Subject: [PATCH 6/7] DNS sites support - add AD SRV plugin https://fedorahosted.org/sssd/ticket/1032 --- Makefile.am | 6 +- configure.ac | 1 + src/config/SSSDConfig/__init__.py.in | 1 + src/config/etc/sssd.api.d/sssd-ad.conf | 1 + src/external/libndr_nbt.m4 | 5 + src/man/sssd-ad.5.xml | 20 + src/providers/ad/ad_common.h | 1 + src/providers/ad/ad_init.c | 31 +- src/providers/ad/ad_opts.h | 1 + src/providers/ad/ad_srv.c | 774 +++++++++++++++++++++++++++++++++ src/providers/ad/ad_srv.h | 50 +++ 11 files changed, 885 insertions(+), 6 deletions(-) create mode 100644 src/external/libndr_nbt.m4 create mode 100644 src/providers/ad/ad_srv.c create mode 100644 src/providers/ad/ad_srv.h diff --git a/Makefile.am b/Makefile.am index aadb2ff6af29f7d058fbf5c8c628976e52b802f2..83ea19a75764e7ef83ff6e4c0e437880263d8761 100644 --- a/Makefile.am +++ b/Makefile.am @@ -467,6 +467,7 @@ dist_noinst_HEADERS = \ src/providers/ipa/ipa_hostid.h \ src/providers/ipa/ipa_opts.h \ src/providers/ipa/ipa_srv.h \ + src/providers/ad/ad_srv.h \ src/providers/proxy/proxy.h \ src/tools/tools_util.h \ src/tools/sss_sync_ops.h \ @@ -1562,6 +1563,7 @@ libsss_ad_la_SOURCES = \ src/providers/ad/ad_access.c \ src/providers/ad/ad_access.h \ src/providers/ad/ad_opts.h \ + src/providers/ad/ad_srv.c \ src/util/find_uid.c \ src/util/user_info_msg.c \ src/util/sss_krb5.c \ @@ -1571,12 +1573,14 @@ libsss_ad_la_CFLAGS = \ $(AM_CFLAGS) \ $(LDAP_CFLAGS) \ $(DHASH_CFLAGS) \ - $(KRB5_CFLAGS) + $(KRB5_CFLAGS) \ + $(NDR_NBT_CFLAGS) libsss_ad_la_LIBADD = \ $(OPENLDAP_LIBS) \ $(DHASH_LIBS) \ $(KEYUTILS_LIBS) \ $(KRB5_LIBS) \ + $(NDR_NBT_LIBS) \ libsss_util.la \ libsss_ldap_common.la \ libsss_krb5_common.la \ diff --git a/configure.ac b/configure.ac index 5d47c4e632d0480b5673c3ec7f9bb0015f86baa3..b28fd05dc0e3dac3dbfedbf9b9cc295ae4b9ff00 100644 --- a/configure.ac +++ b/configure.ac @@ -149,6 +149,7 @@ m4_include([src/external/libnl.m4]) m4_include([src/external/systemd.m4]) m4_include([src/external/pac_responder.m4]) m4_include([src/external/signal.m4]) +m4_include([src/external/libndr_nbt.m4]) WITH_UNICODE_LIB if test x$unicode_lib = xlibunistring; then diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in index f603a21835d818523b9ced247334b5de5fd7031c..256c4b3147c3dcccc2df60e7fa7a18976231bbae 100644 --- a/src/config/SSSDConfig/__init__.py.in +++ b/src/config/SSSDConfig/__init__.py.in @@ -149,6 +149,7 @@ option_strings = { 'ad_server' : _('Active Directory server address'), 'ad_backup_server' : _('Active Directory backup server address'), 'ad_hostname' : _('Active Directory client hostname'), + 'ad_enable_dns_sites' : _('Enable DNS sites - location based service discovery'), # [provider/krb5] 'krb5_kdcip' : _('Kerberos server address'), diff --git a/src/config/etc/sssd.api.d/sssd-ad.conf b/src/config/etc/sssd.api.d/sssd-ad.conf index 4c257173c83d2bfc09627e403137f96780d178b1..b4b1d0ba11d600a8b9a300f15cc8058be470f422 100644 --- a/src/config/etc/sssd.api.d/sssd-ad.conf +++ b/src/config/etc/sssd.api.d/sssd-ad.conf @@ -3,6 +3,7 @@ ad_domain = str, None, false ad_server = str, None, false ad_backup_server = str, None, false ad_hostname = str, None, false +ad_enable_dns_sites = bool, None, false ldap_uri = str, None, false ldap_backup_uri = str, None, false ldap_search_base = str, None, false diff --git a/src/external/libndr_nbt.m4 b/src/external/libndr_nbt.m4 new file mode 100644 index 0000000000000000000000000000000000000000..d4d94f2d608454e1df855ab2d2c8396189c0d428 --- /dev/null +++ b/src/external/libndr_nbt.m4 @@ -0,0 +1,5 @@ +AC_SUBST(NDR_NBT_CFLAGS) +AC_SUBST(NDR_NBT_LIBS) + +PKG_CHECK_MODULES(NDR_NBT, ndr_nbt, , + AC_MSG_ERROR("Please install Samba 4 development libraries")) \ No newline at end of file diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index 5513c2ee5e9993a22b81ffed62abfa5fc200b444..34f5fee51aed87ea954228252e59c85ff4c9ce94 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -130,6 +130,26 @@ ldap_id_mapping = False + + + ad_enable_dns_sites (boolean) + + + Enables DNS sites - location based + service discovery. + + + If true and service discovery (see Service + Discovery paragraph at the bottom of the man page) + is enabled, then the SSSD will first attempt + location based discovery using an Active Directory + mechanism called Sites. + + + Default: true + + + diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h index 320bf1c9de7b5abacb270eb0cd09cb10227211cb..7be15ba9b44d38b884538b22268e6f4a5a47da9d 100644 --- a/src/providers/ad/ad_common.h +++ b/src/providers/ad/ad_common.h @@ -37,6 +37,7 @@ enum ad_basic_opt { AD_HOSTNAME, AD_KEYTAB, AD_KRB5_REALM, + AD_ENABLE_DNS_SITES, AD_OPTS_BASIC /* opts counter */ }; diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c index 087ec3c4507adc13be63242f15d5a1a9cd23e26c..615592a04140849e6d4fef5e4d4c9db471363d41 100644 --- a/src/providers/ad/ad_init.c +++ b/src/providers/ad/ad_init.c @@ -35,6 +35,7 @@ #include "providers/krb5/krb5_auth.h" #include "providers/krb5/krb5_init_shared.h" #include "providers/ad/ad_id.h" +#include "providers/ad/ad_srv.h" struct ad_options *ad_options = NULL; @@ -108,6 +109,8 @@ sssm_ad_id_init(struct be_ctx *bectx, struct ad_id_ctx *ad_ctx; struct sdap_id_ctx *sdap_ctx; const char *hostname; + const char *ad_domain; + struct ad_srv_plugin_ctx *srv_ctx; if (!ad_options) { ret = common_ad_init(bectx); @@ -178,11 +181,29 @@ sssm_ad_id_init(struct be_ctx *bectx, /* setup SRV lookup plugin */ hostname = dp_opt_get_string(ad_options->basic, AD_HOSTNAME); - ret = be_fo_set_dns_srv_lookup_plugin(bectx, hostname); - if (ret != EOK) { - DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to set SRV lookup plugin " - "[%d]: %s\n", ret, strerror(ret))); - goto done; + if (dp_opt_get_bool(ad_options->basic, AD_ENABLE_DNS_SITES)) { + /* use AD plugin */ + ad_domain = dp_opt_get_string(ad_options->basic, AD_DOMAIN); + srv_ctx = ad_srv_plugin_ctx_init(bectx, bectx->be_res->resolv, + bectx->be_res->family_order, + default_host_dbs, ad_options->id, + hostname, ad_domain); + if (srv_ctx == NULL) { + DEBUG(SSSDBG_FATAL_FAILURE, ("Out of memory?\n")); + ret = ENOMEM; + goto done; + } + + be_fo_set_srv_lookup_plugin(bectx, ad_srv_plugin_send, + ad_srv_plugin_recv, srv_ctx, "AD"); + } else { + /* fall back to standard plugin */ + ret = be_fo_set_dns_srv_lookup_plugin(bectx, hostname); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to set SRV lookup plugin " + "[%d]: %s\n", ret, strerror(ret))); + goto done; + } } *ops = &ad_id_ops; diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h index 4b87e0c04a489e2fb2fd21210d6d2bc60cd85162..c48be86749f41ee3031b64a1b244753866584cf5 100644 --- a/src/providers/ad/ad_opts.h +++ b/src/providers/ad/ad_opts.h @@ -34,6 +34,7 @@ struct dp_option ad_basic_opts[] = { { "ad_hostname", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING }, { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING}, + { "ad_enable_dns_sites", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }, DP_OPTION_TERMINATOR }; diff --git a/src/providers/ad/ad_srv.c b/src/providers/ad/ad_srv.c new file mode 100644 index 0000000000000000000000000000000000000000..b57d5017bef52cd2b203819aa5f0c238b9dbe244 --- /dev/null +++ b/src/providers/ad/ad_srv.c @@ -0,0 +1,774 @@ +/* + Authors: + Pavel Březina + + Copyright (C) 2013 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include +#include +#include +#include +#include + +#include "util/util.h" +#include "util/sss_ldap.h" +#include "resolv/async_resolv.h" +#include "providers/fail_over.h" +#include "providers/fail_over_srv.h" +#include "providers/ldap/sdap.h" +#include "providers/ldap/sdap_async.h" + +#define AD_SITE_DOMAIN "%s._sites.%s" +#define AD_AT_DNS_DOMAIN "DnsDomain" +#define AD_AT_NT_VERSION "NtVer" +#define AD_AT_NETLOGON "netlogon" + +struct ad_get_dc_servers_state { + struct fo_server_info *servers; + size_t num_servers; +}; + +static void ad_get_dc_servers_done(struct tevent_req *subreq); + +static struct tevent_req *ad_get_dc_servers_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct resolv_ctx *resolv_ctx, + const char *domain) +{ + struct ad_get_dc_servers_state *state = NULL; + struct tevent_req *req = NULL; + struct tevent_req *subreq = NULL; + const char **domains = NULL; + errno_t ret; + + req = tevent_req_create(mem_ctx, &state, + struct ad_get_dc_servers_state); + if (req == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("tevent_req_create() failed\n")); + return NULL; + } + + domains = talloc_zero_array(state, const char *, 2); + if (domains == NULL) { + ret = ENOMEM; + goto immediately; + } + + domains[0] = talloc_strdup(domains, domain); + if (domains[0] == NULL) { + ret = ENOMEM; + goto immediately; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("Looking up domain controllers in domain %s\n", + domain)); + + subreq = fo_discover_srv_send(state, ev, resolv_ctx, + "ldap", FO_PROTO_TCP, domains); + if (subreq == NULL) { + ret = ENOMEM; + goto immediately; + } + + tevent_req_set_callback(subreq, ad_get_dc_servers_done, req); + + return req; + +immediately: + tevent_req_error(req, ret); + tevent_req_post(req, ev); + + return req; +} + +static void ad_get_dc_servers_done(struct tevent_req *subreq) +{ + struct ad_get_dc_servers_state *state = NULL; + struct tevent_req *req = NULL; + char *domain = NULL; + errno_t ret; + + req = tevent_req_callback_data(subreq, struct tevent_req); + state = tevent_req_data(req, struct ad_get_dc_servers_state); + + ret = fo_discover_srv_recv(state, subreq, &domain, + &state->servers, &state->num_servers); + talloc_zfree(subreq); + if (ret != EOK) { + goto done; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("Found %lu domain controllers in domain %s\n", + state->num_servers, domain)); + +done: + if (ret != EOK) { + tevent_req_error(req, ret); + return; + } + + tevent_req_done(req); +} + +static int ad_get_dc_servers_recv(TALLOC_CTX *mem_ctx, + struct tevent_req *req, + struct fo_server_info **_dcs, + size_t *_num_dcs) +{ + struct ad_get_dc_servers_state *state = NULL; + state = tevent_req_data(req, struct ad_get_dc_servers_state); + + TEVENT_REQ_RETURN_ON_ERROR(req); + + *_dcs = talloc_steal(mem_ctx, state->servers); + *_num_dcs = state->num_servers; + + return EOK; +} + +struct ad_get_client_site_state { + struct tevent_context *ev; + struct resolv_ctx *resolv_ctx; + enum restrict_family family_order; + enum host_database *host_db; + struct sdap_options *opts; + const char *ad_domain; + struct fo_server_info *dcs; + size_t num_dcs; + size_t dc_index; + struct fo_server_info dc; + + struct sdap_handle *sh; + char *site; +}; + +static errno_t ad_get_client_site_next_dc(struct tevent_req *req); +static void ad_get_client_site_connect_done(struct tevent_req *subreq); +static void ad_get_client_site_done(struct tevent_req *subreq); + +struct tevent_req *ad_get_client_site_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct resolv_ctx *resolv_ctx, + enum restrict_family family_order, + enum host_database *host_db, + struct sdap_options *opts, + const char *ad_domain, + struct fo_server_info *dcs, + size_t num_dcs) +{ + struct ad_get_client_site_state *state = NULL; + struct tevent_req *req = NULL; + errno_t ret; + + req = tevent_req_create(mem_ctx, &state, + struct ad_get_client_site_state); + if (req == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("tevent_req_create() failed\n")); + return NULL; + } + + if (resolv_ctx == NULL || host_db == NULL || opts == NULL) { + ret = EINVAL; + goto immediately; + } + + state->ev = ev; + state->resolv_ctx = resolv_ctx; + state->family_order = family_order; + state->host_db = host_db; + state->opts = opts; + state->ad_domain = ad_domain; + state->dcs = dcs; + state->num_dcs = num_dcs; + + state->dc_index = 0; + ret = ad_get_client_site_next_dc(req); + if (ret == EOK) { + ret = ENOENT; + goto immediately; + } else if (ret != EAGAIN) { + goto immediately; + } + + return req; + +immediately: + if (ret == EOK) { + tevent_req_done(req); + } else { + tevent_req_error(req, ret); + } + tevent_req_post(req, ev); + + return req; +} + +static errno_t ad_get_client_site_next_dc(struct tevent_req *req) +{ + struct ad_get_client_site_state *state = NULL; + struct tevent_req *subreq = NULL; + errno_t ret; + + state = tevent_req_data(req, struct ad_get_client_site_state); + + if (state->dc_index >= state->num_dcs) { + ret = EOK; + goto done; + } + + state->dc = state->dcs[state->dc_index]; + + subreq = sdap_connect_host_send(state, state->ev, state->opts, + state->resolv_ctx, state->family_order, + state->host_db, "ldap", state->dc.host, + state->dc.port, false); + if (subreq == NULL) { + ret = ENOMEM; + goto done; + } + + tevent_req_set_callback(subreq, ad_get_client_site_connect_done, req); + + state->dc_index++; + ret = EAGAIN; + +done: + return ret; +} + +static void ad_get_client_site_connect_done(struct tevent_req *subreq) +{ + struct ad_get_client_site_state *state = NULL; + struct tevent_req *req = NULL; + static const char *attrs[] = {AD_AT_NETLOGON, NULL}; + char *filter = NULL; + char *ntver = NULL; + errno_t ret; + + req = tevent_req_callback_data(subreq, struct tevent_req); + state = tevent_req_data(req, struct ad_get_client_site_state); + + ret = sdap_connect_host_recv(state, subreq, &state->sh); + talloc_zfree(subreq); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, ("Unable to connect to domain controller " + "[%s:%d]\n", state->dc.host, state->dc.port)); + + ret = ad_get_client_site_next_dc(req); + if (ret == EOK) { + ret = ENOENT; + } + + goto done; + } + + ntver = sss_ldap_encode_ndr_uint32(state, NETLOGON_NT_VERSION_5EX | + NETLOGON_NT_VERSION_WITH_CLOSEST_SITE); + if (ntver == NULL) { + ret = ENOMEM; + goto done; + } + + filter = talloc_asprintf(state, "(&(%s=%s)(%s=%s))", + AD_AT_DNS_DOMAIN, state->ad_domain, + AD_AT_NT_VERSION, ntver); + if (filter == NULL) { + ret = ENOMEM; + goto done; + } + + subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh, + "", LDAP_SCOPE_BASE, filter, + attrs, NULL, 0, + dp_opt_get_int(state->opts->basic, + SDAP_SEARCH_TIMEOUT), + false); + if (subreq == NULL) { + ret = ENOMEM; + goto done; + } + + tevent_req_set_callback(subreq, ad_get_client_site_done, req); + + ret = EAGAIN; + +done: + if (ret == EOK) { + tevent_req_done(req); + } else if (ret != EAGAIN) { + tevent_req_error(req, ret); + } + + return; +} + +static errno_t ad_get_client_site_parse_ndr(TALLOC_CTX *mem_ctx, + uint8_t *data, + size_t length, + char **_site_name) +{ + TALLOC_CTX *tmp_ctx = NULL; + struct ndr_pull *ndr_pull = NULL; + struct netlogon_samlogon_response response; + enum ndr_err_code ndr_err; + char *site = NULL; + DATA_BLOB blob; + errno_t ret; + + tmp_ctx = talloc_new(NULL); + if (tmp_ctx == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n")); + return ENOMEM; + } + + blob.data = data; + blob.length = length; + + ndr_pull = ndr_pull_init_blob(&blob, mem_ctx); + if (ndr_pull == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("ndr_pull_init_blob() failed.\n")); + ret = ENOMEM; + goto done; + } + + ndr_err = ndr_pull_netlogon_samlogon_response(ndr_pull, NDR_SCALARS, + &response); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + DEBUG(SSSDBG_OP_FAILURE, ("ndr_pull_netlogon_samlogon_response() " + "failed [%d]\n", ndr_err)); + ret = EBADMSG; + goto done; + } + + if (!(response.ntver & NETLOGON_NT_VERSION_5EX)) { + DEBUG(SSSDBG_OP_FAILURE, ("This NT version does not provide site " + "information [%x]\n", response.ntver)); + ret = EBADMSG; + goto done; + } + + if (response.data.nt5_ex.client_site != NULL) { + site = talloc_strdup(tmp_ctx, response.data.nt5_ex.client_site); + } else if (response.data.nt5_ex.next_closest_site != NULL) { + site = talloc_strdup(tmp_ctx, response.data.nt5_ex.next_closest_site); + } else { + ret = ENOENT; + goto done; + } + + if (site == NULL) { + ret = ENOMEM; + goto done; + } + + *_site_name = talloc_steal(mem_ctx, site); + + ret = EOK; + +done: + talloc_free(tmp_ctx); + return ret; +} + +static void ad_get_client_site_done(struct tevent_req *subreq) +{ + struct ad_get_client_site_state *state = NULL; + struct tevent_req *req = NULL; + struct ldb_message_element *el = NULL; + struct sysdb_attrs **reply = NULL; + size_t reply_count; + errno_t ret; + + req = tevent_req_callback_data(subreq, struct tevent_req); + state = tevent_req_data(req, struct ad_get_client_site_state); + + ret = sdap_get_generic_recv(subreq, state, &reply_count, &reply); + talloc_zfree(subreq); + talloc_zfree(state->sh); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Unable to get netlogon information\n")); + + ret = ad_get_client_site_next_dc(req); + if (ret == EOK) { + ret = ENOENT; + } + goto done; + } + + if (reply_count == 0) { + DEBUG(SSSDBG_OP_FAILURE, ("No netlogon information retrieved\n")); + ret = ENOENT; + goto done; + } + + ret = sysdb_attrs_get_el(reply[0], AD_AT_NETLOGON, &el); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_el() failed\n")); + goto done; + } + + if (el->num_values == 0) { + DEBUG(SSSDBG_OP_FAILURE, ("netlogon has no value\n")); + ret = ENOENT; + goto done; + } else if (el->num_values > 1) { + DEBUG(SSSDBG_OP_FAILURE, ("More than one netlogon value?\n")); + ret = EIO; + goto done; + } + + ret = ad_get_client_site_parse_ndr(state, el->values[0].data, + el->values[0].length, &state->site); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Unable to retrieve site name [%d]: %s\n", + ret, strerror(ret))); + ret = ENOENT; + goto done; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("Found site: %s\n", state->site)); + +done: + if (ret != EOK) { + tevent_req_error(req, ret); + return; + } + + tevent_req_done(req); +} + +int ad_get_client_site_recv(TALLOC_CTX *mem_ctx, + struct tevent_req *req, + char **_site) +{ + struct ad_get_client_site_state *state = NULL; + state = tevent_req_data(req, struct ad_get_client_site_state); + + TEVENT_REQ_RETURN_ON_ERROR(req); + + *_site = talloc_steal(mem_ctx, state->site); + + return EOK; +} + +struct ad_srv_plugin_ctx { + struct resolv_ctx *resolv_ctx; + enum restrict_family family_order; + enum host_database *host_dbs; + struct sdap_options *opts; + const char *hostname; + const char *ad_domain; +}; + +struct ad_srv_plugin_ctx * +ad_srv_plugin_ctx_init(TALLOC_CTX *mem_ctx, + struct resolv_ctx *resolv_ctx, + enum restrict_family family_order, + enum host_database *host_dbs, + struct sdap_options *opts, + const char *hostname, + const char *ad_domain) +{ + struct ad_srv_plugin_ctx *ctx = NULL; + + ctx = talloc_zero(mem_ctx, struct ad_srv_plugin_ctx); + if (ctx == NULL) { + return NULL; + } + + ctx->resolv_ctx = resolv_ctx; + ctx->family_order = family_order; + ctx->host_dbs = host_dbs; + ctx->opts = opts; + + ctx->hostname = talloc_strdup(ctx, hostname); + if (ctx->hostname == NULL) { + goto fail; + } + + ctx->ad_domain = talloc_strdup(ctx, ad_domain); + if (ctx->ad_domain == NULL) { + goto fail; + } + + return ctx; + +fail: + talloc_free(ctx); + return NULL; +} + +struct ad_srv_plugin_state { + struct tevent_context *ev; + struct ad_srv_plugin_ctx *ctx; + const char *service; + const char *protocol; + const char *discovery_domain; + + char *site; + char *dns_domain; + struct fo_server_info *primary_servers; + size_t num_primary_servers; + struct fo_server_info *backup_servers; + size_t num_backup_servers; +}; + +static void ad_srv_plugin_dcs_done(struct tevent_req *subreq); +static void ad_srv_plugin_site_done(struct tevent_req *subreq); +static void ad_srv_plugin_servers_done(struct tevent_req *subreq); + +/* 1. Do a DNS lookup to find any DC in domain + * _ldap._tcp.domain.name + * 2. Send a CLDAP ping to the found DC to get the desirable site + * 3. Do a DNS lookup to find SRV in the site (a) + * _service._protocol.site-name._sites.domain.name + * 4. Do a DNS lookup to find global SRV records (b) + * _service._protocol.domain.name + * 5. If the site is found, use (a) as primary and (b) as backup servers, + * otherwise use (b) as primary servers + */ +struct tevent_req *ad_srv_plugin_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + const char *service, + const char *protocol, + const char *discovery_domain, + void *pvt) +{ + struct ad_srv_plugin_state *state = NULL; + struct ad_srv_plugin_ctx *ctx = NULL; + struct tevent_req *req = NULL; + struct tevent_req *subreq = NULL; + errno_t ret; + + req = tevent_req_create(mem_ctx, &state, + struct ad_srv_plugin_state); + if (req == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("tevent_req_create() failed\n")); + return NULL; + } + + ctx = talloc_get_type(pvt, struct ad_srv_plugin_ctx); + if (ctx == NULL) { + ret = EINVAL; + goto immediately; + } + + state->ev = ev; + state->ctx = ctx; + + state->service = talloc_strdup(state, service); + if (state->service == NULL) { + ret = ENOMEM; + goto immediately; + } + + state->protocol = talloc_strdup(state, protocol); + if (state->protocol == NULL) { + ret = ENOMEM; + goto immediately; + } + + if (discovery_domain != NULL) { + state->discovery_domain = talloc_strdup(state, discovery_domain); + } else { + state->discovery_domain = talloc_strdup(state, ctx->ad_domain); + } + if (state->discovery_domain == NULL) { + ret = ENOMEM; + goto immediately; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("About to find domain controllers\n")); + + subreq = ad_get_dc_servers_send(state, ev, ctx->resolv_ctx, + state->discovery_domain); + if (subreq == NULL) { + ret = ENOMEM; + goto immediately; + } + + tevent_req_set_callback(subreq, ad_srv_plugin_dcs_done, req); + + return req; + +immediately: + tevent_req_error(req, ret); + tevent_req_post(req, ev); + + return req; +} + +static void ad_srv_plugin_dcs_done(struct tevent_req *subreq) +{ + struct ad_srv_plugin_state *state = NULL; + struct tevent_req *req = NULL; + struct fo_server_info *dcs = NULL; + size_t num_dcs = 0; + errno_t ret; + + req = tevent_req_callback_data(subreq, struct tevent_req); + state = tevent_req_data(req, struct ad_srv_plugin_state); + + ret = ad_get_dc_servers_recv(state, subreq, &dcs, &num_dcs); + talloc_zfree(subreq); + if (ret != EOK) { + goto done; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("About to locate suitable site\n")); + + subreq = ad_get_client_site_send(state, state->ev, state->ctx->resolv_ctx, + state->ctx->family_order, + state->ctx->host_dbs, + state->ctx->opts, + state->ctx->ad_domain, + dcs, num_dcs); + if (subreq == NULL) { + ret = ENOMEM; + goto done; + } + + tevent_req_set_callback(subreq, ad_srv_plugin_site_done, req); + + ret = EAGAIN; + +done: + if (ret == EOK) { + tevent_req_done(req); + } else if (ret != EAGAIN) { + tevent_req_error(req, ret); + } + + return; +} + +static void ad_srv_plugin_site_done(struct tevent_req *subreq) +{ + struct ad_srv_plugin_state *state = NULL; + struct tevent_req *req = NULL; + const char *primary_domain = NULL; + const char *backup_domain = NULL; + errno_t ret; + + req = tevent_req_callback_data(subreq, struct tevent_req); + state = tevent_req_data(req, struct ad_srv_plugin_state); + + ret = ad_get_client_site_recv(state, subreq, &state->site); + talloc_zfree(subreq); + if (ret == EOK) { + primary_domain = talloc_asprintf(state, AD_SITE_DOMAIN, + state->site, state->discovery_domain); + if (primary_domain == NULL) { + ret = ENOMEM; + goto done; + } + + backup_domain = state->discovery_domain; + } else if (ret == ENOENT) { + primary_domain = state->discovery_domain; + backup_domain = NULL; + } else { + goto done; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("About to discover primary and " + "backup servers\n")); + + subreq = fo_discover_servers_send(state, state->ev, state->ctx->resolv_ctx, + state->service, state->protocol, + primary_domain, backup_domain); + if (subreq == NULL) { + ret = ENOMEM; + goto done; + } + + tevent_req_set_callback(subreq, ad_srv_plugin_servers_done, req); + + ret = EAGAIN; + +done: + if (ret == EOK) { + tevent_req_done(req); + } else if (ret != EAGAIN) { + tevent_req_error(req, ret); + } + + return; +} + +static void ad_srv_plugin_servers_done(struct tevent_req *subreq) +{ + struct ad_srv_plugin_state *state = NULL; + struct tevent_req *req = NULL; + errno_t ret; + + req = tevent_req_callback_data(subreq, struct tevent_req); + state = tevent_req_data(req, struct ad_srv_plugin_state); + + ret = fo_discover_servers_recv(state, subreq, &state->dns_domain, + &state->primary_servers, + &state->num_primary_servers, + &state->backup_servers, + &state->num_backup_servers); + talloc_zfree(subreq); + if (ret != EOK) { + tevent_req_error(req, ret); + return; + } + + DEBUG(SSSDBG_TRACE_FUNC, ("Got %lu primary and %lu backup servers\n", + state->num_primary_servers, state->num_backup_servers)); + + tevent_req_done(req); +} + +errno_t ad_srv_plugin_recv(TALLOC_CTX *mem_ctx, + struct tevent_req *req, + char **_dns_domain, + struct fo_server_info **_primary_servers, + size_t *_num_primary_servers, + struct fo_server_info **_backup_servers, + size_t *_num_backup_servers) +{ + struct ad_srv_plugin_state *state = NULL; + state = tevent_req_data(req, struct ad_srv_plugin_state); + + TEVENT_REQ_RETURN_ON_ERROR(req); + + if (_primary_servers) { + *_primary_servers = talloc_steal(mem_ctx, state->primary_servers); + } + + if (_num_primary_servers) { + *_num_primary_servers = state->num_primary_servers; + } + + if (_backup_servers) { + *_backup_servers = talloc_steal(mem_ctx, state->backup_servers); + } + + if (_num_backup_servers) { + *_num_backup_servers = state->num_backup_servers; + } + + if (_dns_domain) { + *_dns_domain = talloc_steal(mem_ctx, state->dns_domain); + } + + + return EOK; +} diff --git a/src/providers/ad/ad_srv.h b/src/providers/ad/ad_srv.h new file mode 100644 index 0000000000000000000000000000000000000000..1d9f561e024be0ec24c9443839d17521d6438b97 --- /dev/null +++ b/src/providers/ad/ad_srv.h @@ -0,0 +1,50 @@ +/* + Authors: + Pavel Březina + + Copyright (C) 2013 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#ifndef __AD_SRV_H__ +#define __AD_SRV_H__ + +struct ad_srv_plugin_ctx; + +struct ad_srv_plugin_ctx * +ad_srv_plugin_ctx_init(TALLOC_CTX *mem_ctx, + struct resolv_ctx *resolv_ctx, + enum restrict_family family_order, + enum host_database *host_dbs, + struct sdap_options *opts, + const char *hostname, + const char *ad_domain); + +struct tevent_req *ad_srv_plugin_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + const char *service, + const char *protocol, + const char *discovery_domain, + void *pvt); + +errno_t ad_srv_plugin_recv(TALLOC_CTX *mem_ctx, + struct tevent_req *req, + char **_dns_domain, + struct fo_server_info **_primary_servers, + size_t *_num_primary_servers, + struct fo_server_info **_backup_servers, + size_t *_num_backup_servers); + +#endif /* __AD_SRV_H__ */ -- 1.7.11.7