r7680: Move to using our own private enum for the principal type inside the

hdb-ldb module.  This removes the need for the KRBTGT case to exist in
the broader heimdal code.

Andrew Bartlett

diff --git a/source/kdc/hdb-ldb.c b/source/kdc/hdb-ldb.c
index b751ff33c01f45b43424f10d7e3454aa1d236715..ee5bed2682a01ab1a1af4b8be89ec4953d58feb9 100644 (file)
--- a/source/kdc/hdb-ldb.c
+++ b/source/kdc/hdb-ldb.c
@@ -39,6 +39,8 @@
 #include "lib/ldb/include/ldb.h"
 #include "system/iconv.h"
 
+enum hdb_ldb_ent_type 
+{ HDB_LDB_ENT_TYPE_CLIENT, HDB_LDB_ENT_TYPE_SERVER, HDB_LDB_ENT_TYPE_KRBTGT, HDB_LDB_ENT_TYPE_ANY };
 
 static const char * const krb5_attrs[] = {
        "objectClass",
@@ -95,7 +97,7 @@ static KerberosTime ldb_msg_find_krb5time_ldap_time(struct ldb_message *msg, con
     return timegm(&tm);
 }
 
-static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum hdb_ent_type ent_type) 
+static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum hdb_ldb_ent_type ent_type) 
 {
        HDBFlags flags = int2HDBFlags(0);
 
@@ -109,32 +111,32 @@ static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum h
 
        /* Account types - clear the invalid bit if it turns out to be valid */
        if (userAccountControl & UF_NORMAL_ACCOUNT) {
-               if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) {
+               if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) {
                        flags.client = 1;
                }
                flags.invalid = 0;
        }
        
        if (userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT) {
-               if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) {
+               if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) {
                        flags.client = 1;
                }
                flags.invalid = 0;
        }
        if (userAccountControl & UF_WORKSTATION_TRUST_ACCOUNT) {
-               if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) {
+               if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) {
                        flags.client = 1;
                }
-               if (ent_type == HDB_ENT_TYPE_SERVER || ent_type == HDB_ENT_TYPE_ENUM) {
+               if (ent_type == HDB_LDB_ENT_TYPE_SERVER || ent_type == HDB_LDB_ENT_TYPE_ANY) {
                        flags.server = 1;
                }
                flags.invalid = 0;
        }
        if (userAccountControl & UF_SERVER_TRUST_ACCOUNT) {
-               if (ent_type == HDB_ENT_TYPE_CLIENT || ent_type == HDB_ENT_TYPE_ENUM) {
+               if (ent_type == HDB_LDB_ENT_TYPE_CLIENT || ent_type == HDB_LDB_ENT_TYPE_ANY) {
                        flags.client = 1;
                }
-               if (ent_type == HDB_ENT_TYPE_SERVER || ent_type == HDB_ENT_TYPE_ENUM) {
+               if (ent_type == HDB_LDB_ENT_TYPE_SERVER || ent_type == HDB_LDB_ENT_TYPE_ANY) {
                        flags.server = 1;
                }
                flags.invalid = 0;
@@ -208,7 +210,7 @@ static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum h
  */
 static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, 
                                         TALLOC_CTX *mem_ctx, krb5_const_principal principal,
-                                        enum hdb_ent_type ent_type, struct ldb_message *realm_msg,
+                                        enum hdb_ldb_ent_type ent_type, struct ldb_message *realm_msg,
                                         struct ldb_message *msg,
                                         hdb_entry *ent)
 {
@@ -217,18 +219,13 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db,
        int i;
        krb5_error_code ret = 0;
        const char *dnsdomain = ldb_msg_find_string(realm_msg, "dnsDomain", NULL);
-       char *realm = talloc_strdup(mem_ctx, dnsdomain);
+       char *realm = strupper_talloc(mem_ctx, dnsdomain);
 
        if (!realm) {
                krb5_set_error_string(context, "talloc_strdup: out of memory");
                ret = ENOMEM;
                goto out;
        }
-
-       /* TODO: Use Samba charset functions */
-       for (i=0; i< strlen(realm); i++) {
-               realm[i] = toupper(realm[i]);
-       }
                        
        krb5_warnx(context, "LDB_message2entry:\n");
 
@@ -237,7 +234,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db,
        userAccountControl = ldb_msg_find_int(msg, "userAccountControl", 0);
        
        ent->principal = malloc(sizeof(*(ent->principal)));
-       if (ent_type == HDB_ENT_TYPE_ENUM && principal == NULL) {
+       if (ent_type == HDB_LDB_ENT_TYPE_ANY && principal == NULL) {
                const char *samAccountName = ldb_msg_find_string(msg, "samAccountName", NULL);
                if (!samAccountName) {
                        krb5_set_error_string(context, "LDB_message2entry: no samAccountName present");
@@ -277,7 +274,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db,
 
        ent->flags = uf2HDBFlags(context, userAccountControl, ent_type);
 
-       if (ent_type == HDB_ENT_TYPE_KRBTGT) {
+       if (ent_type == HDB_LDB_ENT_TYPE_KRBTGT) {
                ent->flags.invalid = 0;
                ent->flags.server = 1;
        }
@@ -444,7 +441,7 @@ out:
 static krb5_error_code LDB_lookup_principal(krb5_context context, struct ldb_context *ldb_ctx,                                         
                                            TALLOC_CTX *mem_ctx,
                                            krb5_const_principal principal,
-                                           enum hdb_ent_type ent_type,
+                                           enum hdb_ldb_ent_type ent_type,
                                            const char *realm_dn,
                                            struct ldb_message ***pmsg)
 {
@@ -483,19 +480,19 @@ static krb5_error_code LDB_lookup_principal(krb5_context context, struct ldb_con
 
        
        switch (ent_type) {
-       case HDB_ENT_TYPE_KRBTGT:
+       case HDB_LDB_ENT_TYPE_KRBTGT:
                filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(samAccountName=%s))", 
                                         KRB5_TGS_NAME);
                break;
-       case HDB_ENT_TYPE_CLIENT:
+       case HDB_LDB_ENT_TYPE_CLIENT:
                filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(|(samAccountName=%s)(userPrincipalName=%s)))", 
                                         short_princ, princ_str_talloc);
                break;
-       case HDB_ENT_TYPE_SERVER:
+       case HDB_LDB_ENT_TYPE_SERVER:
                filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(|(samAccountName=%s)(servicePrincipalName=%s)))", 
                                         short_princ, short_princ);
                break;
-       case HDB_ENT_TYPE_ENUM:
+       case HDB_LDB_ENT_TYPE_ANY:
                filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(|(|(samAccountName=%s)(servicePrincipalName=%s))(userPrincipalName=%s)))", 
                                         short_princ, short_princ, princ_str_talloc);
                break;
@@ -710,6 +707,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags,
 {
        struct ldb_message **msg = NULL;
        struct ldb_message **realm_msg = NULL;
+       enum hdb_ldb_ent_type ldb_ent_type;
        krb5_error_code ret;
 
        const char *realm;
@@ -736,17 +734,29 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags,
        /* Cludge, cludge cludge.  If the realm part of krbtgt/realm,
         * is in our db, then direct the caller at our primary
         * krgtgt */
-       if (ent_type == HDB_ENT_TYPE_SERVER 
-           && principal->name.name_string.len == 2
-           && (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) == 0)
-           && (LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db,
-                                mem_ctx, principal->name.name_string.val[1], NULL) == 0)) {
-               ent_type = HDB_ENT_TYPE_KRBTGT;
+       
+       switch (ent_type) {
+       case HDB_ENT_TYPE_SERVER:
+               if (principal->name.name_string.len == 2
+                   && (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) == 0)
+                   && (LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db,
+                                        mem_ctx, principal->name.name_string.val[1], NULL) == 0)) {
+                       ldb_ent_type = HDB_LDB_ENT_TYPE_KRBTGT;
+               } else {
+                       ldb_ent_type = HDB_LDB_ENT_TYPE_SERVER;
+               }
+               break;
+       case HDB_ENT_TYPE_CLIENT:
+               ldb_ent_type = HDB_LDB_ENT_TYPE_CLIENT;
+               break;
+       case HDB_ENT_TYPE_ANY:
+               ldb_ent_type = HDB_LDB_ENT_TYPE_ANY;
+               break;
        }
 
        ret = LDB_lookup_principal(context, (struct ldb_context *)db->hdb_db, 
                                   mem_ctx, 
-                                  principal, ent_type, realm_dn, &msg);
+                                  principal, ldb_ent_type, realm_dn, &msg);
 
        if (ret != 0) {
                char *alias_from = principal->name.name_string.val[0];
@@ -754,7 +764,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags,
                Principal alias_principal;
                
                /* Try again with a servicePrincipal alias */
-               if (ent_type != HDB_ENT_TYPE_SERVER && ent_type != HDB_ENT_TYPE_ENUM) {
+               if (ent_type != HDB_LDB_ENT_TYPE_SERVER && ent_type != HDB_LDB_ENT_TYPE_ANY) {
                        talloc_free(mem_ctx);
                        return ret;
                }
@@ -857,7 +867,7 @@ static krb5_error_code LDB_seq(krb5_context context, HDB *db, unsigned flags, hd
 
        if (priv->index < priv->count) {
                ret = LDB_message2entry(context, db, mem_ctx, 
-                                       NULL, HDB_ENT_TYPE_ENUM, 
+                                       NULL, HDB_LDB_ENT_TYPE_ANY, 
                                        priv->realm_msgs[0], priv->msgs[priv->index++], entry);
        } else {
                ret = HDB_ERR_NOENTRY;