From 6777831bc1b0d1218d635d2913326883f509f3e8 Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Wed, 24 Apr 2019 20:52:11 +0200

Subject: [PATCH 57/64] AD: Implement background refresh for AD domains

Split out the actual useful functionality from the AD account handler

into a tevent request. This tevent request is then subsequently used by

a new ad_refresh module.

Related:

https://pagure.io/SSSD/sssd/issue/4012

Reviewed-by: Sumit Bose <sbose@redhat.com>

(cherry picked from commit b72adfcc332b13489931483201bcc4c7ecf9ecb6)

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 Makefile.am                   |   5 +-

 src/providers/ad/ad_common.h  |   4 +

 src/providers/ad/ad_id.c      | 140 +++++++++++++----

 src/providers/ad/ad_id.h      |  10 ++

 src/providers/ad/ad_init.c    |   2 +-

 src/providers/ad/ad_refresh.c | 283 ++++++++++++++++++++++++++++++++++

 6 files changed, 412 insertions(+), 32 deletions(-)

 create mode 100644 src/providers/ad/ad_refresh.c

diff --git a/Makefile.am b/Makefile.am

index 0c24ae664..7d83b6847 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -4243,7 +4243,10 @@ libsss_ad_la_SOURCES = \

     src/providers/ad/ad_gpo_ndr.c \

     src/providers/ad/ad_srv.c \

     src/providers/ad/ad_subdomains.c \

-    src/providers/ad/ad_domain_info.c

+    src/providers/ad/ad_domain_info.c \

+    src/providers/ad/ad_refresh.c \

+    $(NULL)

+

 if BUILD_SUDO

 libsss_ad_la_SOURCES += \

diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h

index 2f624df3d..44369288e 100644

--- a/src/providers/ad/ad_common.h

+++ b/src/providers/ad/ad_common.h

@@ -221,4 +221,8 @@ errno_t ad_inherit_opts_if_needed(struct dp_option *parent_opts,

                                   struct confdb_ctx *cdb,

                                   const char *subdom_conf_path,

                                   int opt_id);

+

+errno_t ad_refresh_init(struct be_ctx *be_ctx,

+                        struct ad_id_ctx *id_ctx);

+

 #endif /* AD_COMMON_H_ */

diff --git a/src/providers/ad/ad_id.c b/src/providers/ad/ad_id.c

index c3bda1662..eb6e36824 100644

--- a/src/providers/ad/ad_id.c

+++ b/src/providers/ad/ad_id.c

@@ -360,44 +360,36 @@ get_conn_list(TALLOC_CTX *mem_ctx, struct ad_id_ctx *ad_ctx,

     return clist;

 }

-struct ad_account_info_handler_state {

-    struct sss_domain_info *domain;

-    struct dp_reply_std reply;

+struct ad_account_info_state {

+    const char *err_msg;

+    int dp_error;

 };

-static void ad_account_info_handler_done(struct tevent_req *subreq);

+static void ad_account_info_done(struct tevent_req *subreq);

 struct tevent_req *

-ad_account_info_handler_send(TALLOC_CTX *mem_ctx,

-                              struct ad_id_ctx *id_ctx,

-                              struct dp_id_data *data,

-                              struct dp_req_params *params)

+ad_account_info_send(TALLOC_CTX *mem_ctx,

+                     struct be_ctx *be_ctx,

+                     struct ad_id_ctx *id_ctx,

+                     struct dp_id_data *data)

 {

-    struct ad_account_info_handler_state *state;

-    struct sdap_id_conn_ctx **clist;

-    struct sdap_id_ctx *sdap_id_ctx;

-    struct sss_domain_info *domain;

+    struct sss_domain_info *domain = NULL;

+    struct ad_account_info_state *state = NULL;

+    struct tevent_req *req = NULL;

+    struct tevent_req *subreq = NULL;

+    struct sdap_id_conn_ctx **clist = NULL;

+    struct sdap_id_ctx *sdap_id_ctx = NULL;

     struct sdap_domain *sdom;

-    struct tevent_req *subreq;

-    struct tevent_req *req;

-    struct be_ctx *be_ctx;

     errno_t ret;

-    sdap_id_ctx = id_ctx->sdap_id_ctx;

-    be_ctx = params->be_ctx;

-

     req = tevent_req_create(mem_ctx, &state,

-                            struct ad_account_info_handler_state);

+                            struct ad_account_info_state);

     if (req == NULL) {

         DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");

         return NULL;

     }

-    if (sdap_is_enum_request(data)) {

-        DEBUG(SSSDBG_TRACE_LIBS, "Skipping enumeration on demand\n");

-        ret = EOK;

-        goto immediately;

-    }

+    sdap_id_ctx = id_ctx->sdap_id_ctx;

     domain = be_ctx->domain;

     if (strcasecmp(data->domain, be_ctx->domain->name) != 0) {

@@ -406,6 +398,7 @@ ad_account_info_handler_send(TALLOC_CTX *mem_ctx,

     }

     if (domain == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "Unknown domain\n");

         ret = EINVAL;

         goto immediately;

     }

@@ -413,6 +406,7 @@ ad_account_info_handler_send(TALLOC_CTX *mem_ctx,

     /* Determine whether to connect to GC, LDAP or try both. */

     clist = get_conn_list(state, id_ctx, domain, data);

     if (clist == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create conn list\n");

         ret = EIO;

         goto immediately;

     }

@@ -423,14 +417,100 @@ ad_account_info_handler_send(TALLOC_CTX *mem_ctx,

         goto immediately;

     }

-    state->domain = sdom->dom;

-

     subreq = ad_handle_acct_info_send(state, data, sdap_id_ctx,

                                       id_ctx->ad_options, sdom, clist);

     if (subreq == NULL) {

         ret = ENOMEM;

         goto immediately;

     }

+    tevent_req_set_callback(subreq, ad_account_info_done, req);

+    return req;

+

+immediately:

+    tevent_req_error(req, ret);

+    tevent_req_post(req, be_ctx->ev);

+    return req;

+}

+

+static void ad_account_info_done(struct tevent_req *subreq)

+{

+    struct ad_account_info_state *state = NULL;

+    struct tevent_req *req = NULL;

+    errno_t ret;

+

+    req = tevent_req_callback_data(subreq, struct tevent_req);

+    state = tevent_req_data(req, struct ad_account_info_state);

+

+    ret = ad_handle_acct_info_recv(subreq, &state->dp_error, &state->err_msg);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "ad_handle_acct_info_recv failed [%d]: %s\n",

+              ret, sss_strerror(ret));

+        /* The caller wouldn't fail either, just report the error up */

+    }

+    talloc_zfree(subreq);

+    tevent_req_done(req);

+}

+

+errno_t ad_account_info_recv(struct tevent_req *req,

+                             int *_dp_error,

+                             const char **_err_msg)

+{

+    struct ad_account_info_state *state = NULL;

+

+    state = tevent_req_data(req, struct ad_account_info_state);

+

+    if (_err_msg != NULL) {

+        *_err_msg = state->err_msg;

+    }

+

+    if (_dp_error) {

+        *_dp_error = state->dp_error;

+    }

+

+

+    TEVENT_REQ_RETURN_ON_ERROR(req);

+

+    return EOK;

+}

+

+struct ad_account_info_handler_state {

+    struct sss_domain_info *domain;

+    struct dp_reply_std reply;

+};

+

+static void ad_account_info_handler_done(struct tevent_req *subreq);

+

+struct tevent_req *

+ad_account_info_handler_send(TALLOC_CTX *mem_ctx,

+                              struct ad_id_ctx *id_ctx,

+                              struct dp_id_data *data,

+                              struct dp_req_params *params)

+{

+    struct ad_account_info_handler_state *state;

+    struct tevent_req *subreq;

+    struct tevent_req *req;

+    errno_t ret;

+

+

+    req = tevent_req_create(mem_ctx, &state,

+                            struct ad_account_info_handler_state);

+    if (req == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");

+        return NULL;

+    }

+

+    if (sdap_is_enum_request(data)) {

+        DEBUG(SSSDBG_TRACE_LIBS, "Skipping enumeration on demand\n");

+        ret = EOK;

+        goto immediately;

+    }

+

+    subreq = ad_account_info_send(state, params->be_ctx, id_ctx, data);

+    if (subreq == NULL) {

+        ret = ENOMEM;

+        goto immediately;

+    }

     tevent_req_set_callback(subreq, ad_account_info_handler_done, req);

@@ -451,13 +531,13 @@ static void ad_account_info_handler_done(struct tevent_req *subreq)

     struct ad_account_info_handler_state *state;

     struct tevent_req *req;

     const char *err_msg;

-    int dp_error;

+    int dp_error = DP_ERR_FATAL;

     errno_t ret;

     req = tevent_req_callback_data(subreq, struct tevent_req);

     state = tevent_req_data(req, struct ad_account_info_handler_state);

-    ret = ad_handle_acct_info_recv(subreq, &dp_error, &err_msg);

+    ret = ad_account_info_recv(subreq, &dp_error, &err_msg);

     talloc_zfree(subreq);

     /* TODO For backward compatibility we always return EOK to DP now. */

@@ -466,8 +546,8 @@ static void ad_account_info_handler_done(struct tevent_req *subreq)

 }

 errno_t ad_account_info_handler_recv(TALLOC_CTX *mem_ctx,

-                                      struct tevent_req *req,

-                                      struct dp_reply_std *data)

+                                     struct tevent_req *req,

+                                     struct dp_reply_std *data)

 {

     struct ad_account_info_handler_state *state = NULL;

diff --git a/src/providers/ad/ad_id.h b/src/providers/ad/ad_id.h

index 5154393c5..19cc54eec 100644

--- a/src/providers/ad/ad_id.h

+++ b/src/providers/ad/ad_id.h

@@ -33,6 +33,16 @@ errno_t ad_account_info_handler_recv(TALLOC_CTX *mem_ctx,

                                       struct tevent_req *req,

                                       struct dp_reply_std *data);

+struct tevent_req *

+ad_account_info_send(TALLOC_CTX *mem_ctx,

+                     struct be_ctx *be_ctx,

+                     struct ad_id_ctx *id_ctx,

+                     struct dp_id_data *data);

+

+errno_t ad_account_info_recv(struct tevent_req *req,

+                             int *_dp_error,

+                             const char **_err_msg);

+

 struct tevent_req *

 ad_handle_acct_info_send(TALLOC_CTX *mem_ctx,

                          struct dp_id_data *ar,

diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c

index 42c2f150a..f5aea8904 100644

--- a/src/providers/ad/ad_init.c

+++ b/src/providers/ad/ad_init.c

@@ -408,7 +408,7 @@ static errno_t ad_init_misc(struct be_ctx *be_ctx,

         return ret;

     }

-    ret = sdap_refresh_init(be_ctx, sdap_id_ctx);

+    ret = ad_refresh_init(be_ctx, ad_id_ctx);

     if (ret != EOK && ret != EEXIST) {

         DEBUG(SSSDBG_MINOR_FAILURE, "Periodical refresh "

               "will not work [%d]: %s\n", ret, sss_strerror(ret));

diff --git a/src/providers/ad/ad_refresh.c b/src/providers/ad/ad_refresh.c

new file mode 100644

index 000000000..ee541056f

--- /dev/null

+++ b/src/providers/ad/ad_refresh.c

@@ -0,0 +1,283 @@

+/*

+    Copyright (C) 2019 Red Hat

+

+    This program is free software; you can redistribute it and/or modify

+    it under the terms of the GNU General Public License as published by

+    the Free Software Foundation; either version 3 of the License, or

+    (at your option) any later version.

+

+    This program is distributed in the hope that it will be useful,

+    but WITHOUT ANY WARRANTY; without even the implied warranty of

+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+    GNU General Public License for more details.

+

+    You should have received a copy of the GNU General Public License

+    along with this program.  If not, see <http://www.gnu.org/licenses/>.

+*/

+

+#include <talloc.h>

+#include <tevent.h>

+

+#include "providers/ad/ad_common.h"

+#include "providers/ad/ad_id.h"

+

+struct ad_refresh_state {

+    struct tevent_context *ev;

+    struct be_ctx *be_ctx;

+    struct dp_id_data *account_req;

+    struct ad_id_ctx *id_ctx;

+    char **names;

+    size_t index;

+};

+

+static errno_t ad_refresh_step(struct tevent_req *req);

+static void ad_refresh_done(struct tevent_req *subreq);

+

+static struct tevent_req *ad_refresh_send(TALLOC_CTX *mem_ctx,

+                                            struct tevent_context *ev,

+                                            struct be_ctx *be_ctx,

+                                            struct sss_domain_info *domain,

+                                            int entry_type,

+                                            char **names,

+                                            void *pvt)

+{

+    struct ad_refresh_state *state = NULL;

+    struct tevent_req *req = NULL;

+    errno_t ret;

+    uint32_t filter_type;

+

+    req = tevent_req_create(mem_ctx, &state,

+                            struct ad_refresh_state);

+    if (req == NULL) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create() failed\n");

+        return NULL;

+    }

+

+    if (names == NULL) {

+        ret = EOK;

+        goto immediately;

+    }

+

+    state->ev = ev;

+    state->be_ctx = be_ctx;

+    state->id_ctx = talloc_get_type(pvt, struct ad_id_ctx);

+    state->names = names;

+    state->index = 0;

+

+    switch (entry_type) {

+    case BE_REQ_NETGROUP:

+        filter_type = BE_FILTER_NAME;

+        break;

+    case BE_REQ_USER:

+    case BE_REQ_GROUP:

+        filter_type = BE_FILTER_SECID;

+        break;

+    default:

+        ret = EINVAL;

+        goto immediately;

+    }

+

+    state->account_req = be_refresh_acct_req(state, entry_type,

+                                             filter_type, domain);

+    if (state->account_req == NULL) {

+        ret = ENOMEM;

+        goto immediately;

+    }

+

+    ret = ad_refresh_step(req);

+    if (ret == EOK) {

+        DEBUG(SSSDBG_TRACE_FUNC, "Nothing to refresh\n");

+        goto immediately;

+    } else if (ret != EAGAIN) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "ad_refresh_step() failed "

+                                   "[%d]: %s\n", ret, sss_strerror(ret));

+        goto immediately;

+    }

+

+    return req;

+

+immediately:

+    if (ret == EOK) {

+        tevent_req_done(req);

+    } else {

+        tevent_req_error(req, ret);

+    }

+    tevent_req_post(req, ev);

+

+    return req;

+}

+

+static errno_t ad_refresh_step(struct tevent_req *req)

+{

+    struct ad_refresh_state *state = NULL;

+    struct tevent_req *subreq = NULL;

+    errno_t ret;

+

+    state = tevent_req_data(req, struct ad_refresh_state);

+

+    if (state->names == NULL) {

+        ret = EOK;

+        goto done;

+    }

+

+    state->account_req->filter_value = state->names[state->index];

+    if (state->account_req->filter_value == NULL) {

+        ret = EOK;

+        goto done;

+    }

+

+    DEBUG(SSSDBG_TRACE_FUNC, "Issuing refresh of %s %s\n",

+          be_req2str(state->account_req->entry_type),

+          state->account_req->filter_value);

+

+    subreq = ad_account_info_send(state, state->be_ctx, state->id_ctx,

+                                  state->account_req);

+    if (subreq == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

+    tevent_req_set_callback(subreq, ad_refresh_done, req);

+

+    state->index++;

+    ret = EAGAIN;

+

+done:

+    return ret;

+}

+

+static void ad_refresh_done(struct tevent_req *subreq)

+{

+    struct ad_refresh_state *state = NULL;

+    struct tevent_req *req = NULL;

+    const char *err_msg = NULL;

+    errno_t dp_error;

+    errno_t ret;

+

+    req = tevent_req_callback_data(subreq, struct tevent_req);

+    state = tevent_req_data(req, struct ad_refresh_state);

+

+    ret = ad_account_info_recv(subreq, &dp_error, &err_msg);

+    talloc_zfree(subreq);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to refresh %s [dp_error: %d, "

+              "errno: %d]: %s\n", be_req2str(state->account_req->entry_type),

+              dp_error, ret, err_msg);

+        goto done;

+    }

+

+    ret = ad_refresh_step(req);

+    if (ret == EAGAIN) {

+        return;

+    }

+

+done:

+    if (ret != EOK) {

+        tevent_req_error(req, ret);

+        return;

+    }

+

+    tevent_req_done(req);

+}

+

+static errno_t ad_refresh_recv(struct tevent_req *req)

+{

+    TEVENT_REQ_RETURN_ON_ERROR(req);

+

+    return EOK;

+}

+

+static struct tevent_req *

+ad_refresh_users_send(TALLOC_CTX *mem_ctx,

+                      struct tevent_context *ev,

+                      struct be_ctx *be_ctx,

+                      struct sss_domain_info *domain,

+                      char **names,

+                      void *pvt)

+{

+    return ad_refresh_send(mem_ctx, ev, be_ctx, domain,

+                           BE_REQ_USER, names, pvt);

+}

+

+static errno_t ad_refresh_users_recv(struct tevent_req *req)

+{

+    return ad_refresh_recv(req);

+}

+

+static struct tevent_req *

+ad_refresh_groups_send(TALLOC_CTX *mem_ctx,

+                       struct tevent_context *ev,

+                       struct be_ctx *be_ctx,

+                       struct sss_domain_info *domain,

+                       char **names,

+                       void *pvt)

+{

+    return ad_refresh_send(mem_ctx, ev, be_ctx, domain,

+                           BE_REQ_GROUP, names, pvt);

+}

+

+static errno_t ad_refresh_groups_recv(struct tevent_req *req)

+{

+    return ad_refresh_recv(req);

+}

+

+static struct tevent_req *

+ad_refresh_netgroups_send(TALLOC_CTX *mem_ctx,

+                          struct tevent_context *ev,

+                          struct be_ctx *be_ctx,

+                          struct sss_domain_info *domain,

+                          char **names,

+                          void *pvt)

+{

+    return ad_refresh_send(mem_ctx, ev, be_ctx, domain,

+                           BE_REQ_NETGROUP, names, pvt);

+}

+

+static errno_t ad_refresh_netgroups_recv(struct tevent_req *req)

+{

+    return ad_refresh_recv(req);

+}

+

+errno_t ad_refresh_init(struct be_ctx *be_ctx,

+                        struct ad_id_ctx *id_ctx)

+{

+    errno_t ret;

+

+    ret = be_refresh_ctx_init(be_ctx, SYSDB_SID_STR);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_FATAL_FAILURE, "Unable to initialize refresh_ctx\n");

+        return ret;

+    }

+

+    ret = be_refresh_add_cb(be_ctx->refresh_ctx,

+                            BE_REFRESH_TYPE_USERS,

+                            ad_refresh_users_send,

+                            ad_refresh_users_recv,

+                            id_ctx);

+    if (ret != EOK && ret != EEXIST) {

+        DEBUG(SSSDBG_MINOR_FAILURE, "Periodical refresh of users "

+              "will not work [%d]: %s\n", ret, strerror(ret));

+    }

+

+    ret = be_refresh_add_cb(be_ctx->refresh_ctx,

+                            BE_REFRESH_TYPE_GROUPS,

+                            ad_refresh_groups_send,

+                            ad_refresh_groups_recv,

+                            id_ctx);

+    if (ret != EOK && ret != EEXIST) {

+        DEBUG(SSSDBG_MINOR_FAILURE, "Periodical refresh of groups "

+              "will not work [%d]: %s\n", ret, strerror(ret));

+    }

+

+    ret = be_refresh_add_cb(be_ctx->refresh_ctx,

+                            BE_REFRESH_TYPE_NETGROUPS,

+                            ad_refresh_netgroups_send,

+                            ad_refresh_netgroups_recv,

+                            id_ctx);

+    if (ret != EOK && ret != EEXIST) {

+        DEBUG(SSSDBG_MINOR_FAILURE, "Periodical refresh of netgroups "

+              "will not work [%d]: %s\n", ret, strerror(ret));

+    }

+

+    return ret;

+}

-- 

2.20.1