From 9c19e3e7c90a20999924642e813f2f6036768f6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Mon, 23 Apr 2012 16:33:30 +0200
Subject: [PATCH 09/10] sudo ldap provider: provide API for refresh of
 specific rules

---
 src/providers/ldap/sdap_sudo.c |   87 ++++++++++++++++++++++++++++++++++++++++
 src/providers/ldap/sdap_sudo.h |    3 +-
 2 files changed, 89 insertions(+), 1 deletions(-)

diff --git a/src/providers/ldap/sdap_sudo.c b/src/providers/ldap/sdap_sudo.c
index 0feabdb..cd286ff 100644
--- a/src/providers/ldap/sdap_sudo.c
+++ b/src/providers/ldap/sdap_sudo.c
@@ -31,6 +31,16 @@
 #include "providers/ldap/sdap_sudo_timer.h"
 #include "db/sysdb_sudo.h"
 
+static struct tevent_req *sdap_sudo_rules_refresh_send(TALLOC_CTX *mem_ctx,
+                                                       struct be_ctx *be_ctx,
+                                                       struct sdap_options *opts,
+                                                       struct sdap_id_conn_cache *conn_cache,
+                                                       char **rules);
+
+static int sdap_sudo_rules_refresh_recv(struct tevent_req *req,
+                                        int *dp_error,
+                                        int *error);
+
 static void
 sdap_sudo_shutdown(struct be_req *req)
 {
@@ -250,3 +260,80 @@ int sdap_sudo_full_refresh_recv(struct tevent_req *req,
 {
     return sdap_sudo_refresh_recv(req, dp_error, error);
 }
+
+/* issue refresh of specific sudo rules */
+static struct tevent_req *sdap_sudo_rules_refresh_send(TALLOC_CTX *mem_ctx,
+                                                       struct be_ctx *be_ctx,
+                                                       struct sdap_options *opts,
+                                                       struct sdap_id_conn_cache *conn_cache,
+                                                       char **rules)
+{
+    struct tevent_req *req = NULL;
+    TALLOC_CTX *tmp_ctx = NULL;
+    char *ldap_filter = NULL;
+    char *sysdb_filter = NULL;
+    int i;
+
+    if (rules == NULL) {
+        return NULL;
+    }
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_new() failed\n"));
+        return NULL;
+    }
+
+    /* Download only selected rules from LDAP */
+    /* Remove all selected rules from cache */
+    for (i = 0; rules[i] != NULL; i++) {
+        ldap_filter = talloc_asprintf_append_buffer(ldap_filter, "(%s=%s)",
+                                     opts->sudorule_map[SDAP_AT_SUDO_NAME].name,
+                                     rules[i]);
+        if (ldap_filter == NULL) {
+            goto done;
+        }
+
+        sysdb_filter = talloc_asprintf_append_buffer(sysdb_filter, "(%s=%s)",
+                                                     SYSDB_SUDO_CACHE_AT_CN,
+                                                     rules[i]);
+        if (sysdb_filter == NULL) {
+            goto done;
+        }
+    }
+
+    ldap_filter = talloc_asprintf(tmp_ctx, "(&"SDAP_SUDO_FILTER_CLASS"(|%s))",
+                                  opts->sudorule_map[SDAP_OC_SUDORULE].name,
+                                  ldap_filter);
+    if (ldap_filter == NULL) {
+        goto done;
+    }
+
+    sysdb_filter = talloc_asprintf(tmp_ctx, "(&(%s=%s)(|%s))",
+                                   SYSDB_OBJECTCLASS, SYSDB_SUDO_CACHE_AT_OC,
+                                   ldap_filter);
+    if (sysdb_filter == NULL) {
+        goto done;
+    }
+
+    req = sdap_sudo_refresh_send(mem_ctx, be_ctx, opts, conn_cache,
+                                 ldap_filter, sysdb_filter);
+    if (req == NULL) {
+        goto done;
+    }
+
+    /* free filters with the request */
+    talloc_steal(req, ldap_filter);
+    talloc_steal(req, sysdb_filter);
+
+done:
+    talloc_free(tmp_ctx);
+    return req;
+}
+
+static int sdap_sudo_rules_refresh_recv(struct tevent_req *req,
+                                        int *dp_error,
+                                        int *error)
+{
+    return sdap_sudo_refresh_recv(req, dp_error, error);
+}
diff --git a/src/providers/ldap/sdap_sudo.h b/src/providers/ldap/sdap_sudo.h
index 375b99a..2205603 100644
--- a/src/providers/ldap/sdap_sudo.h
+++ b/src/providers/ldap/sdap_sudo.h
@@ -52,7 +52,8 @@ int sdap_sudo_full_refresh_recv(struct tevent_req *req,
 
 /* (&(objectClass=sudoRole)(|(cn=defaults)(sudoUser=ALL)%s)) */
 #define SDAP_SUDO_FILTER_USER "(&(objectClass=%s)(|(%s=%s)(%s=ALL)%s))"
-#define SDAP_SUDO_FILTER_ALL  "(objectClass=%s)"
+#define SDAP_SUDO_FILTER_CLASS "(objectClass=%s)"
+#define SDAP_SUDO_FILTER_ALL   SDAP_SUDO_FILTER_CLASS
 #define SDAP_SUDO_FILTER_DEFAULTS  "(&(objectClass=%s)(%s=%s))"
 #define SDAP_SUDO_DEFAULTS    "defaults"
 
-- 
1.7.6.5

