Re: Update to ldap.c
"Todd C. Miller" <[email protected]>
| Newsgroups | gmane.comp.tools.sudo.devel |
|---|---|
| Message-ID | <[email protected]> |
I haven't forgotten about this but there were some problems with the original patch, mostly having to do with memory allocation and freeing (including a use-after-free problem). I also had trouble making it work with OpenLDAP's slapd, which doesn't support searching on nisNetgroupTriple. It's not hard to modify the schema to support this though. I've reworked the patch to use a tail queue instead of an array and split the nisNetgroupTriple and memberNisNetgroup queries into separate functions. I think the result is a lot easier to read. The attached patch is relative to today's sudo tip from mercurial. It works fine in my test environment but I'd love to know how it fares in the real world. - todd ____________________________________________________________ sudo-workers mailing list <[email protected]> For list information, options, or to unsubscribe, visit: http://www.sudo.ws/mailman/listinfo/sudo-workers
ldap_netgroups.patch
(text/x-patch, 20.3 KB)
# HG changeset patch
# Parent 2646081246984b3f88041886121121f0caa8da6c
Add support for querying netgroups directly via LDAP since there
is no other way to look up all the netgroups for a user (unlike
regular groups). This introduces netgroup_base and netgroup_search_filter
options to ldap.conf. Based on a diff from Steven Soulen.
diff -r 264608124698 doc/sudoers.ldap.cat
--- a/doc/sudoers.ldap.cat Tue Jan 27 09:29:02 2015 -0700
+++ b/doc/sudoers.ldap.cat Tue Jan 27 11:05:26 2015 -0700
@@ -337,6 +337,35 @@
The version of the LDAP protocol to use when connecting to the
server. The default value is protocol version 3.
+ NNEETTGGRROOUUPP__BBAASSEE _b_a_s_e
+ The base DN to use when performing LDAP netgroup queries.
+ Typically this is of the form ou=netgroup,dc=example,dc=com for the
+ domain example.com. Multiple NNEETTGGRROOUUPP__BBAASSEE lines may be specified,
+ in which case they are queried in the order specified.
+
+ This option can be used to query a user's netgroups directly via
+ LDAP which is usually faster than fetching all sudoRole objects
+ containing a sudoUser that begins with a `+' prefix. The NIS
+ schema used by some LDAP servers need a modificaton to support
+ querying the nisNetgroup object by its nisNetgroupTriple member.
+ OpenLDAP's ssllaappdd requires the following change to the
+ nisNetgroupTriple attribute:
+
+ attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
+ DESC 'Netgroup triple'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+ NNEETTGGRROOUUPP__SSEEAARRCCHH__FFIILLTTEERR _l_d_a_p___f_i_l_t_e_r
+ An LDAP filter which is used to restrict the set of records
+ returned when performing an LDAP netgroup query. Typically, this
+ is of the form attribute=value or
+ (&(attribute=value)(attribute2=value2)). The default search filter
+ is: objectClass=nisNetgroup. If _l_d_a_p___f_i_l_t_e_r is omitted, no search
+ filter will be used. This option is only when querying netgroups
+ directly via LDAP.
+
NNEETTWWOORRKK__TTIIMMEEOOUUTT _s_e_c_o_n_d_s
An alias for BBIINNDD__TTIIMMEELLIIMMIITT provided for OpenLDAP compatibility.
diff -r 264608124698 doc/sudoers.ldap.man.in
--- a/doc/sudoers.ldap.man.in Tue Jan 27 09:29:02 2015 -0700
+++ b/doc/sudoers.ldap.man.in Tue Jan 27 11:05:26 2015 -0700
@@ -601,6 +601,61 @@
The version of the LDAP protocol to use when connecting to the server.
The default value is protocol version 3.
.TP 6n
+\fBNETGROUP_BASE\fR \fIbase\fR
+The base DN to use when performing LDAP netgroup queries.
+Typically this is of the form
+\fRou=netgroup,dc=example,dc=com\fR
+for the domain
+\fRexample.com\fR.
+Multiple
+\fBNETGROUP_BASE\fR
+lines may be specified, in which case they are queried in the order specified.
+.sp
+This option can be used to query a user's netgroups directly via LDAP
+which is usually faster than fetching all
+\fRsudoRole\fR
+objects containing a
+\fRsudoUser\fR
+that begins with a
+\(oq+\(cq
+prefix.
+The NIS schema used by some LDAP servers need a modificaton to
+support querying the
+\fRnisNetgroup\fR
+object by its
+\fRnisNetgroupTriple\fR
+member.
+OpenLDAP's
+\fBslapd\fR
+requires the following change to the
+\fRnisNetgroupTriple\fR
+attribute:
+.nf
+.sp
+.RS 10n
+attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
+ DESC 'Netgroup triple'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+.RE
+.fi
+.TP 6n
+\fBNETGROUP_SEARCH_FILTER\fR \fIldap_filter\fR
+An LDAP filter which is used to restrict the set of records returned
+when performing an LDAP netgroup query.
+Typically, this is of the
+form
+\fRattribute=value\fR
+or
+\fR(&(attribute=value)(attribute2=value2))\fR.
+The default search filter is:
+\fRobjectClass=nisNetgroup\fR.
+If
+\fIldap_filter\fR
+is omitted, no search filter will be used.
+This option is only when querying netgroups directly via LDAP.
+.TP 6n
\fBNETWORK_TIMEOUT\fR \fIseconds\fR
An alias for
\fBBIND_TIMELIMIT\fR
diff -r 264608124698 doc/sudoers.ldap.mdoc.in
--- a/doc/sudoers.ldap.mdoc.in Tue Jan 27 09:29:02 2015 -0700
+++ b/doc/sudoers.ldap.mdoc.in Tue Jan 27 11:05:26 2015 -0700
@@ -561,6 +561,56 @@
.It Sy LDAP_VERSION Ar number
The version of the LDAP protocol to use when connecting to the server.
The default value is protocol version 3.
+.It Sy NETGROUP_BASE Ar base
+The base DN to use when performing LDAP netgroup queries.
+Typically this is of the form
+.Li ou=netgroup,dc=example,dc=com
+for the domain
+.Li example.com .
+Multiple
+.Sy NETGROUP_BASE
+lines may be specified, in which case they are queried in the order specified.
+.Pp
+This option can be used to query a user's netgroups directly via LDAP
+which is usually faster than fetching all
+.Li sudoRole
+objects containing a
+.Li sudoUser
+that begins with a
+.Ql +
+prefix.
+The NIS schema used by some LDAP servers need a modificaton to
+support querying the
+.Li nisNetgroup
+object by its
+.Li nisNetgroupTriple
+member.
+OpenLDAP's
+.Sy slapd
+requires the following change to the
+.Li nisNetgroupTriple
+attribute:
+.Bd -literal -offset 4n
+attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
+ DESC 'Netgroup triple'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+.Ed
+.It Sy NETGROUP_SEARCH_FILTER Ar ldap_filter
+An LDAP filter which is used to restrict the set of records returned
+when performing an LDAP netgroup query.
+Typically, this is of the
+form
+.Li attribute=value
+or
+.Li (&(attribute=value)(attribute2=value2)) .
+The default search filter is:
+.Li objectClass=nisNetgroup .
+If
+.Ar ldap_filter
+is omitted, no search filter will be used.
+This option is only when querying netgroups directly via LDAP.
.It Sy NETWORK_TIMEOUT Ar seconds
An alias for
.Sy BIND_TIMELIMIT
diff -r 264608124698 plugins/sudoers/ldap.c
--- a/plugins/sudoers/ldap.c Tue Jan 27 09:29:02 2015 -0700
+++ b/plugins/sudoers/ldap.c Tue Jan 27 11:05:26 2015 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2003-2014 Todd C. Miller <[email protected]>
+ * Copyright (c) 2003-2015 Todd C. Miller <[email protected]>
*
* This code is derived from software contributed by Aaron Spangler.
*
@@ -162,6 +162,9 @@
/* Default search filter. */
#define DEFAULT_SEARCH_FILTER "(objectClass=sudoRole)"
+/* Default netgroup search filter. */
+#define DEFAULT_NETGROUP_SEARCH_FILTER "(objectClass=nisNetgroup)"
+
/* The TIMEFILTER_LENGTH is the length of the filter when timed entries
are used. The length is computed as follows:
81 for the filter itself
@@ -207,6 +210,16 @@
};
#define ALLOCATION_INCREMENT 100
+/*
+ * The ldap_netgroup structure implements a singly-linked tail queue of
+ * netgroups a user is a member of when querying netgroups directly.
+ */
+struct ldap_netgroup {
+ STAILQ_ENTRY(ldap_netgroup) entries;
+ char *name;
+};
+STAILQ_HEAD(ldap_netgroup_list, ldap_netgroup);
+
struct ldap_config_table {
const char *conf_str; /* config file string */
int type; /* CONF_BOOL, CONF_INT, CONF_STR */
@@ -218,7 +231,6 @@
STAILQ_ENTRY(ldap_config_str) entries;
char val[1];
};
-
STAILQ_HEAD(ldap_config_str_list, ldap_config_str);
/* LDAP configuration structure */
@@ -242,7 +254,9 @@
char *bindpw;
char *rootbinddn;
struct ldap_config_str_list base;
+ struct ldap_config_str_list netgroup_base;
char *search_filter;
+ char *netgroup_search_filter;
char *ssl;
char *tls_cacertfile;
char *tls_cacertdir;
@@ -315,6 +329,8 @@
{ "sudoers_base", CONF_LIST_STR, -1, &ldap_conf.base },
{ "sudoers_timed", CONF_BOOL, -1, &ldap_conf.timed },
{ "sudoers_search_filter", CONF_STR, -1, &ldap_conf.search_filter },
+ { "netgroup_base", CONF_LIST_STR, -1, &ldap_conf.netgroup_base },
+ { "netgroup_search_filter", CONF_STR, -1, &ldap_conf.netgroup_search_filter },
#ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
{ "use_sasl", CONF_BOOL, -1, &ldap_conf.use_sasl },
{ "sasl_auth_id", CONF_STR, -1, &ldap_conf.sasl_auth_id },
@@ -408,7 +424,6 @@
static bool
sudo_ldap_conf_add_ports(void)
{
-
char *host, *port, defport[13];
char hostbuf[LINE_MAX * 2];
int len;
@@ -1228,18 +1243,187 @@
}
/*
+ * Check the netgroups list beginning at "start" for nesting.
+ * Parent nodes with a memberNisNetgroup that match one of the
+ * netgroups are added to the list and checked for further nesting.
+ * Return true on success or false if there was an internal overflow.
+ */
+static bool
+sudo_netgroup_lookup_nested(LDAP *ld, char *base, struct timeval *timeout,
+ struct ldap_netgroup_list *netgroups, struct ldap_netgroup *start)
+{
+ struct ldap_netgroup *ng, *old_tail;
+ LDAPMessage *entry, *result;
+ size_t filt_len;
+ char *filt;
+ int rc;
+ debug_decl(sudo_netgroup_lookup_nested, SUDOERS_DEBUG_LDAP, sudoers_debug_instance);
+
+ DPRINTF1("Checking for nested netgroups from netgroup_base '%s'", base);
+ do {
+ old_tail = STAILQ_LAST(netgroups, ldap_netgroup, entries);
+ filt_len = strlen(ldap_conf.netgroup_search_filter) + 7;
+ for (ng = start; ng != NULL; ng = STAILQ_NEXT(ng, entries)) {
+ filt_len += sudo_ldap_value_len(ng->name) + 20;
+ }
+ filt = sudo_emalloc(filt_len);
+ CHECK_STRLCPY(filt, "(&", filt_len);
+ CHECK_STRLCAT(filt, ldap_conf.netgroup_search_filter, filt_len);
+ CHECK_STRLCAT(filt, "(|", filt_len);
+ for (ng = start; ng != NULL; ng = STAILQ_NEXT(ng, entries)) {
+ CHECK_STRLCAT(filt, "(memberNisNetgroup=", filt_len);
+ CHECK_LDAP_VCAT(filt, ng->name, filt_len);
+ CHECK_STRLCAT(filt, ")", filt_len);
+ }
+ CHECK_STRLCAT(filt, "))", filt_len);
+ DPRINTF1("ldap netgroup search filter: '%s'", filt);
+ result = NULL;
+ rc = ldap_search_ext_s(ld, base, LDAP_SCOPE_SUBTREE, filt,
+ NULL, 0, NULL, NULL, timeout, 0, &result);
+ if (rc == LDAP_SUCCESS) {
+ LDAP_FOREACH(entry, ld, result) {
+ struct berval **bv;
+
+ bv = ldap_get_values_len(ld, entry, "cn");
+ if (bv != NULL) {
+ /* Don't add a netgroup twice. */
+ STAILQ_FOREACH(ng, netgroups, entries) {
+ /* Assumes only one cn per entry. */
+ if (strcasecmp(ng->name, (*bv)->bv_val) == 0)
+ break;
+ }
+ if (ng == NULL) {
+ ng = sudo_emalloc(sizeof(*ng));
+ ng->name = sudo_estrdup((*bv)->bv_val);
+ STAILQ_INSERT_TAIL(netgroups, ng, entries);
+ DPRINTF1("Found new netgroup %s for %s", ng->name, base);
+ }
+ ldap_value_free_len(bv);
+ }
+ }
+ }
+ if (result)
+ ldap_msgfree(result);
+ sudo_efree(filt);
+
+ /* Check for nested netgroups in what we added. */
+ start = old_tail ? STAILQ_NEXT(old_tail, entries) : STAILQ_FIRST(netgroups);
+ } while (start != NULL);
+
+ debug_return_bool(true);
+overflow:
+ sudo_warnx(U_("internal error, %s overflow"), __func__);
+ debug_return_bool(false);
+}
+
+/*
+ * Look up netgroups that the specified user is a member of.
+ * Appends new entries to the netgroups list.
+ * Return true on success or false if there was an internal overflow.
+ */
+static bool
+sudo_netgroup_lookup(LDAP *ld, struct passwd *pw,
+ struct ldap_netgroup_list *netgroups)
+{
+ struct ldap_config_str *base;
+ struct ldap_netgroup *ng, *old_tail;
+ struct timeval tv, *tvp = NULL;
+ LDAPMessage *entry, *result;
+ int rc;
+ debug_decl(sudo_netgroup_lookup, SUDOERS_DEBUG_LDAP, sudoers_debug_instance);
+
+ if (ldap_conf.timeout > 0) {
+ tv.tv_sec = ldap_conf.timeout;
+ tv.tv_usec = 0;
+ tvp = &tv;
+ }
+
+ STAILQ_FOREACH(base, &ldap_conf.netgroup_base, entries) {
+ /* Build query. */
+ char *filt;
+ size_t filt_len = 2 + strlen(ldap_conf.netgroup_search_filter) +
+ 24 + (2 * sudo_ldap_value_len(pw->pw_name)) + 26 +
+ sudo_ldap_value_len(user_shost) + 1 + 7 + 1;
+
+ filt = sudo_emalloc(filt_len);
+ DPRINTF1("searching from netgroup_base '%s'", base->val);
+ CHECK_STRLCPY(filt, "(&", filt_len);
+ CHECK_STRLCAT(filt, ldap_conf.netgroup_search_filter, filt_len);
+ CHECK_STRLCAT(filt, "(|(nisNetgroupTriple=\\(,", filt_len);
+ CHECK_LDAP_VCAT(filt, pw->pw_name, filt_len);
+ CHECK_STRLCAT(filt, ",*\\))(nisNetgroupTriple=\\(", filt_len);
+ CHECK_LDAP_VCAT(filt, user_shost, filt_len);
+ CHECK_STRLCAT(filt, ",", filt_len);
+ CHECK_LDAP_VCAT(filt, pw->pw_name, filt_len);
+ CHECK_STRLCAT(filt, ",*\\))))", filt_len);
+
+ DPRINTF1("ldap netgroup search filter: '%s'", filt);
+ result = NULL;
+ rc = ldap_search_ext_s(ld, base->val, LDAP_SCOPE_SUBTREE, filt,
+ NULL, 0, NULL, NULL, tvp, 0, &result);
+ if (rc != LDAP_SUCCESS) {
+ DPRINTF1("nothing found for '%s'", filt);
+ if (result)
+ ldap_msgfree(result);
+ sudo_efree(filt);
+ continue;
+ }
+ sudo_efree(filt);
+
+ old_tail = STAILQ_LAST(netgroups, ldap_netgroup, entries);
+ LDAP_FOREACH(entry, ld, result) {
+ struct berval **bv;
+
+ bv = ldap_get_values_len(ld, entry, "cn");
+ if (bv != NULL) {
+ /* Don't add a netgroup twice. */
+ STAILQ_FOREACH(ng, netgroups, entries) {
+ /* Assumes only one cn per entry. */
+ if (strcasecmp(ng->name, (*bv)->bv_val) == 0)
+ break;
+ }
+ if (ng == NULL) {
+ ng = sudo_emalloc(sizeof(*ng));
+ ng->name = sudo_estrdup((*bv)->bv_val);
+ STAILQ_INSERT_TAIL(netgroups, ng, entries);
+ DPRINTF1("Found new netgroup %s for %s", ng->name,
+ base->val);
+ }
+ ldap_value_free_len(bv);
+ }
+ }
+ ldap_msgfree(result);
+
+ /* Check for nested netgroups in what we added. */
+ ng = old_tail ? STAILQ_NEXT(old_tail, entries) : STAILQ_FIRST(netgroups);
+ if (ng != NULL) {
+ if (!sudo_netgroup_lookup_nested(ld, base->val, tvp, netgroups, ng))
+ debug_return_bool(false);
+ }
+ }
+ debug_return_bool(true);
+overflow:
+ sudo_warnx(U_("internal error, %s overflow"), __func__);
+ debug_return_bool(false);
+}
+
+/*
* Builds up a filter to check against LDAP.
*/
static char *
-sudo_ldap_build_pass1(struct passwd *pw)
+sudo_ldap_build_pass1(LDAP *ld, struct passwd *pw)
{
+ char *buf, timebuffer[TIMEFILTER_LENGTH + 1], gidbuf[MAX_UID_T_LEN + 1];
+ struct ldap_netgroup_list netgroups;
+ struct ldap_netgroup *ng, *nextng;
+ struct group_list *grlist;
struct group *grp;
- char *buf, timebuffer[TIMEFILTER_LENGTH + 1], gidbuf[MAX_UID_T_LEN + 1];
- struct group_list *grlist;
size_t sz = 0;
int i;
debug_decl(sudo_ldap_build_pass1, SUDOERS_DEBUG_LDAP, sudoers_debug_instance)
+ STAILQ_INIT(&netgroups);
+
/* If there is a filter, allocate space for the global AND. */
if (ldap_conf.timed || ldap_conf.search_filter)
sz += 3;
@@ -1269,6 +1453,23 @@
}
}
+ /* Add space for user netgroups if netgroup_base specified. */
+ if (!STAILQ_EMPTY(&ldap_conf.netgroup_base)) {
+ DPRINTF1("Looking up netgroups for %s", pw->pw_name);
+ if (sudo_netgroup_lookup(ld, pw, &netgroups)) {
+ STAILQ_FOREACH(ng, &netgroups, entries) {
+ sz += 14 + strlen(ng->name);
+ }
+ } else {
+ /* sudo_netgroup_lookup() failed, clean up. */
+ STAILQ_FOREACH_SAFE(ng, &netgroups, entries, nextng) {
+ sudo_efree(ng->name);
+ sudo_efree(ng);
+ }
+ STAILQ_INIT(&netgroups);
+ }
+ }
+
/* If timed, add space for time limits. */
if (ldap_conf.timed)
sz += TIMEFILTER_LENGTH;
@@ -1327,7 +1528,16 @@
if (grp != NULL)
sudo_gr_delref(grp);
- /* Add ALL to list and end the global OR */
+ /* Add netgroups (if any), freeing the list as we go. */
+ STAILQ_FOREACH_SAFE(ng, &netgroups, entries, nextng) {
+ CHECK_STRLCAT(buf, "(sudoUser=+", sz);
+ CHECK_LDAP_VCAT(buf, ng->name, sz);
+ CHECK_STRLCAT(buf, ")", sz);
+ sudo_efree(ng->name);
+ sudo_efree(ng);
+ }
+
+ /* Add ALL to list and end the global OR. */
CHECK_STRLCAT(buf, "(sudoUser=ALL)", sz);
/* Add the time restriction, or simply end the global OR. */
@@ -1354,12 +1564,16 @@
sudo_ldap_build_pass2(void)
{
char *filt, timebuffer[TIMEFILTER_LENGTH + 1];
+ bool query_netgroups = def_use_netgroups;
debug_decl(sudo_ldap_build_pass2, SUDOERS_DEBUG_LDAP, sudoers_debug_instance)
- /* Short circuit if no non-Unix group support. */
- if (!def_use_netgroups && !def_group_plugin) {
+ /* No need to query netgroups if using netgroup_base. */
+ if (!STAILQ_EMPTY(&ldap_conf.netgroup_base))
+ query_netgroups = false;
+
+ /* Short circuit if no netgroups and no non-Unix groups. */
+ if (!query_netgroups && !def_group_plugin)
debug_return_str(NULL);
- }
if (ldap_conf.timed)
sudo_ldap_timefilter(timebuffer, sizeof(timebuffer));
@@ -1369,17 +1583,17 @@
* If a search filter or time restriction is specified,
* those get ANDed in to the expression.
*/
- if (def_group_plugin) {
- sudo_easprintf(&filt, "%s%s(|(sudoUser=%s*)(sudoUser=%%:*))%s%s",
+ if (query_netgroups && def_group_plugin) {
+ sudo_easprintf(&filt, "%s%s(|(sudoUser=+*)(sudoUser=%%:*))%s%s",
(ldap_conf.timed || ldap_conf.search_filter) ? "(&" : "",
ldap_conf.search_filter ? ldap_conf.search_filter : "",
- def_use_netgroups ? "+" : "",
ldap_conf.timed ? timebuffer : "",
(ldap_conf.timed || ldap_conf.search_filter) ? ")" : "");
} else {
- sudo_easprintf(&filt, "%s%s(sudoUser=*)(sudoUser=+*)%s%s",
+ sudo_easprintf(&filt, "%s%s(sudoUser=*)(sudoUser=%s*)%s%s",
(ldap_conf.timed || ldap_conf.search_filter) ? "(&" : "",
ldap_conf.search_filter ? ldap_conf.search_filter : "",
+ query_netgroups ? "+" : "%:",
ldap_conf.timed ? timebuffer : "",
(ldap_conf.timed || ldap_conf.search_filter) ? ")" : "");
}
@@ -1559,9 +1773,10 @@
static bool
sudo_ldap_read_config(void)
{
+ char *cp, *keyword, *value, *line = NULL;
+ struct ldap_config_str *conf_str;
+ size_t linesize = 0;
FILE *fp;
- char *cp, *keyword, *value, *line = NULL;
- size_t linesize = 0;
debug_decl(sudo_ldap_read_config, SUDOERS_DEBUG_LDAP, sudoers_debug_instance)
/* defaults */
@@ -1575,8 +1790,10 @@
ldap_conf.rootuse_sasl = -1;
ldap_conf.deref = -1;
ldap_conf.search_filter = sudo_estrdup(DEFAULT_SEARCH_FILTER);
+ ldap_conf.netgroup_search_filter = sudo_estrdup(DEFAULT_NETGROUP_SEARCH_FILTER);
STAILQ_INIT(&ldap_conf.uri);
STAILQ_INIT(&ldap_conf.base);
+ STAILQ_INIT(&ldap_conf.netgroup_base);
if ((fp = fopen(path_ldap_conf, "r")) == NULL)
debug_return_bool(false);
@@ -1610,10 +1827,8 @@
DPRINTF1("LDAP Config Summary");
DPRINTF1("===================");
if (!STAILQ_EMPTY(&ldap_conf.uri)) {
- struct ldap_config_str *uri;
-
- STAILQ_FOREACH(uri, &ldap_conf.uri, entries) {
- DPRINTF1("uri %s", uri->val);
+ STAILQ_FOREACH(conf_str, &ldap_conf.uri, entries) {
+ DPRINTF1("uri %s", conf_str->val);
}
} else {
DPRINTF1("host %s",
@@ -1623,9 +1838,8 @@
DPRINTF1("ldap_version %d", ldap_conf.version);
if (!STAILQ_EMPTY(&ldap_conf.base)) {
- struct ldap_config_str *base;
- STAILQ_FOREACH(base, &ldap_conf.base, entries) {
- DPRINTF1("sudoers_base %s", base->val);
+ STAILQ_FOREACH(conf_str, &ldap_conf.base, entries) {
+ DPRINTF1("sudoers_base %s", conf_str->val);
}
} else {
DPRINTF1("sudoers_base %s", "(NONE: LDAP disabled)");
@@ -1633,6 +1847,16 @@
if (ldap_conf.search_filter) {
DPRINTF1("search_filter %s", ldap_conf.search_filter);
}
+ if (!STAILQ_EMPTY(&ldap_conf.netgroup_base)) {
+ STAILQ_FOREACH(conf_str, &ldap_conf.netgroup_base, entries) {
+ DPRINTF1("netgroup_base %s", conf_str->val);
+ }
+ } else {
+ DPRINTF1("netgroup_base %s", "(NONE: will use nsswitch)");
+ }
+ if (ldap_conf.netgroup_search_filter) {
+ DPRINTF1("netgroup_search_filter %s", ldap_conf.netgroup_search_filter);
+ }
DPRINTF1("binddn %s",
ldap_conf.binddn ? ldap_conf.binddn : "(anonymous)");
DPRINTF1("bindpw %s",
@@ -2949,7 +3173,7 @@
*/
lres = sudo_ldap_result_alloc();
for (pass = 0; pass < 2; pass++) {
- filt = pass ? sudo_ldap_build_pass2() : sudo_ldap_build_pass1(pw);
+ filt = pass ? sudo_ldap_build_pass2() : sudo_ldap_build_pass1(ld, pw);
if (filt != NULL) {
DPRINTF1("ldap search '%s'", filt);
STAILQ_FOREACH(base, &ldap_conf.base, entries) {