IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

ipa_range_check: Use special attributes to determine presence of RID bases

Browse Source 
The slapi_entry_attr_get_ulong which is used to get value of the RID base
attributes returns 0 in case the attribute is not set at all. We need
to distinguish this situation from the situation where RID base attributes
are present, but deliberately set to 0.

Otherwise this can cause false negative results of checks in the range_check
plugin.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Tomas Babej
2014-04-16 17:15:55 +02:00
committed by Martin Kosek
parent d28d37ebdb
commit 2011392246
1 changed files with 21 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
daemons/ipa-slapi-plugins/ipa-range-check/ipa_range_check.c
View File

@@ -88,6 +88,8 @@ struct range_info {
uint32_t id_range_size;
uint32_t base_rid;
uint32_t secondary_base_rid;
bool base_rid_set;
bool secondary_base_rid_set;
};
static void free_range_info(struct range_info *range) {
@@ -281,6 +283,7 @@ static int slapi_entry_to_range_info(struct domain_info *domain_info_head,
int ret;
unsigned long ul_val;
struct range_info *range = NULL;
Slapi_Attr *attr;
range = calloc(1, sizeof(struct range_info));
if (range == NULL) {
@@ -326,6 +329,10 @@ static int slapi_entry_to_range_info(struct domain_info *domain_info_head,
}
range->secondary_base_rid = ul_val;
/* slapi_entry_attr_find return 0 if requested attribute is present in entry */
range->base_rid_set = (slapi_entry_attr_find(entry, IPA_BASE_RID, &attr) == 0);
range->secondary_base_rid_set = (slapi_entry_attr_find(entry, IPA_SECONDARY_BASE_RID, &attr) == 0);
*_range = range;
ret = 0;
@@ -398,12 +405,14 @@ static int check_ranges(struct range_info *r1, struct range_info *r2)
/* For ipa-local or ipa-ad-trust range types primary RID ranges should
* not overlap */
if (strcasecmp(r1->id_range_type, AD_TRUST_RANGE_TYPE) == 0 ||
strcasecmp(r1->id_range_type, LOCAL_RANGE_TYPE) == 0) {
/* Check if rid range overlaps with existing rid range */
if (intervals_overlap(r1->base_rid, r2->base_rid,
r1->id_range_size, r2->id_range_size))
/* Check if primary rid range overlaps with existing primary rid range */
if ((r1->base_rid_set && r2->base_rid_set) &&
intervals_overlap(r1->base_rid, r2->base_rid,
r1->id_range_size, r2->id_range_size))
return 2;
}
@@ -412,18 +421,21 @@ static int check_ranges(struct range_info *r1, struct range_info *r2)
/* Check if secondary RID range overlaps with existing secondary or
* primary RID range. */
if (intervals_overlap(r1->secondary_base_rid,
r2->secondary_base_rid, r1->id_range_size, r2->id_range_size))
if ((r1->secondary_base_rid_set && r2->secondary_base_rid_set) &&
intervals_overlap(r1->secondary_base_rid, r2->secondary_base_rid,
r1->id_range_size, r2->id_range_size))
return 3;
/* Check if RID range overlaps with existing secondary RID range */
if (intervals_overlap(r1->base_rid, r2->secondary_base_rid,
r1->id_range_size, r2->id_range_size))
if ((r1->base_rid_set && r2->secondary_base_rid_set) &&
intervals_overlap(r1->base_rid, r2->secondary_base_rid,
r1->id_range_size, r2->id_range_size))
return 4;
/* Check if secondary RID range overlaps with existing RID range */
if (intervals_overlap(r1->secondary_base_rid, r2->base_rid,
r1->id_range_size, r2->id_range_size))
if ((r1->secondary_base_rid_set && r2->base_rid_set) &&
intervals_overlap(r1->secondary_base_rid, r2->base_rid,
r1->id_range_size, r2->id_range_size))
return 5;
}
}