source: branches/samba-3.2.x/source/utils/net_idmap.c

Last change on this file was 133, checked in by Paul Smedley, 17 years ago

Update trunk to 3.2.0pre3
File size: 9.0 KB
Line 
1/*
2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2003 Andrew Bartlett (abartlet@samba.org)
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>. */
18
19#include "includes.h"
20#include "utils/net.h"
21
22#define ALLOC_CHECK(mem) do { \
23 if (!mem) { \
24 d_fprintf(stderr, "Out of memory!\n"); \
25 talloc_free(ctx); \
26 return -1; \
27 } } while(0)
28
29/***********************************************************
30 Helper function for net_idmap_dump. Dump one entry.
31 **********************************************************/
32static int net_idmap_dump_one_entry(TDB_CONTEXT *tdb,
33 TDB_DATA key,
34 TDB_DATA data,
35 void *unused)
36{
37 if (strcmp((char *)key.dptr, "USER HWM") == 0) {
38 printf("USER HWM %d\n", IVAL(data.dptr,0));
39 return 0;
40 }
41
42 if (strcmp((char *)key.dptr, "GROUP HWM") == 0) {
43 printf("GROUP HWM %d\n", IVAL(data.dptr,0));
44 return 0;
45 }
46
47 if (strncmp((char *)key.dptr, "S-", 2) != 0)
48 return 0;
49
50 printf("%s %s\n", data.dptr, key.dptr);
51 return 0;
52}
53
54/***********************************************************
55 Dump the current idmap
56 **********************************************************/
57static int net_idmap_dump(int argc, const char **argv)
58{
59 TDB_CONTEXT *idmap_tdb;
60
61 if ( argc != 1 )
62 return net_help_idmap( argc, argv );
63
64 idmap_tdb = tdb_open_log(argv[0], 0, TDB_DEFAULT, O_RDONLY, 0);
65
66 if (idmap_tdb == NULL) {
67 d_fprintf(stderr, "Could not open idmap: %s\n", argv[0]);
68 return -1;
69 }
70
71 tdb_traverse(idmap_tdb, net_idmap_dump_one_entry, NULL);
72
73 tdb_close(idmap_tdb);
74
75 return 0;
76}
77
78/***********************************************************
79 Write entries from stdin to current local idmap
80 **********************************************************/
81
82static int net_idmap_restore(int argc, const char **argv)
83{
84 TALLOC_CTX *ctx;
85 FILE *input;
86
87 if (! winbind_ping()) {
88 d_fprintf(stderr, "To use net idmap Winbindd must be running.\n");
89 return -1;
90 }
91
92 ctx = talloc_new(NULL);
93 ALLOC_CHECK(ctx);
94
95 if (argc == 1) {
96 input = fopen(argv[0], "r");
97 } else {
98 input = stdin;
99 }
100
101 while (!feof(input)) {
102 char line[128], sid_string[128];
103 int len;
104 struct wbcDomainSid sid;
105 enum id_type type = ID_TYPE_NOT_SPECIFIED;
106 unsigned long idval;
107 wbcErr wbc_status;
108
109 if (fgets(line, 127, input) == NULL)
110 break;
111
112 len = strlen(line);
113
114 if ( (len > 0) && (line[len-1] == '\n') )
115 line[len-1] = '\0';
116
117 if (sscanf(line, "GID %lu %128s", &idval, sid_string) == 2) {
118 type = ID_TYPE_GID;
119 } else if (sscanf(line, "UID %lu %128s", &idval, sid_string) == 2) {
120 type = ID_TYPE_UID;
121 } else if (sscanf(line, "USER HWM %lu", &idval) == 1) {
122 /* set uid hwm */
123 wbc_status = wbcSetUidHwm(idval);
124 if (!WBC_ERROR_IS_OK(wbc_status)) {
125 d_fprintf(stderr, "Could not set USER HWM: %s\n",
126 wbcErrorString(wbc_status));
127 }
128 continue;
129 } else if (sscanf(line, "GROUP HWM %lu", &idval) == 1) {
130 /* set gid hwm */
131 wbc_status = wbcSetGidHwm(idval);
132 if (!WBC_ERROR_IS_OK(wbc_status)) {
133 d_fprintf(stderr, "Could not set GROUP HWM: %s\n",
134 wbcErrorString(wbc_status));
135 }
136 continue;
137 } else {
138 d_fprintf(stderr, "ignoring invalid line [%s]\n", line);
139 continue;
140 }
141
142 wbc_status = wbcStringToSid(sid_string, &sid);
143 if (!WBC_ERROR_IS_OK(wbc_status)) {
144 d_fprintf(stderr, "ignoring invalid sid [%s]: %s\n",
145 sid_string, wbcErrorString(wbc_status));
146 continue;
147 }
148
149 if (type == ID_TYPE_UID) {
150 wbc_status = wbcSetUidMapping(idval, &sid);
151 } else {
152 wbc_status = wbcSetGidMapping(idval, &sid);
153 }
154 if (!WBC_ERROR_IS_OK(wbc_status)) {
155 d_fprintf(stderr, "Could not set mapping of %s %lu to sid %s: %s\n",
156 (type == ID_TYPE_GID) ? "GID" : "UID",
157 idval, sid_string,
158 wbcErrorString(wbc_status));
159 continue;
160 }
161 }
162
163 if (input != stdin) {
164 fclose(input);
165 }
166
167 talloc_free(ctx);
168 return 0;
169}
170
171/***********************************************************
172 Delete a SID mapping from a winbindd_idmap.tdb
173 **********************************************************/
174static int net_idmap_delete(int argc, const char **argv)
175{
176 d_printf("Not Implemented yet\n");
177 return -1;
178}
179
180static int net_idmap_set(int argc, const char **argv)
181{
182 d_printf("Not Implemented yet\n");
183 return -1;
184}
185bool idmap_store_secret(const char *backend, bool alloc,
186 const char *domain, const char *identity,
187 const char *secret)
188{
189 char *tmp;
190 int r;
191 bool ret;
192
193 if (alloc) {
194 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
195 } else {
196 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
197 }
198
199 if (r < 0) return false;
200
201 strupper_m(tmp); /* make sure the key is case insensitive */
202 ret = secrets_store_generic(tmp, identity, secret);
203
204 free(tmp);
205 return ret;
206}
207
208
209static int net_idmap_secret(int argc, const char **argv)
210{
211 TALLOC_CTX *ctx;
212 const char *secret;
213 const char *dn;
214 char *domain;
215 char *backend;
216 char *opt = NULL;
217 bool ret;
218
219 if (argc != 2) {
220 return net_help_idmap(argc, argv);
221 }
222
223 secret = argv[1];
224
225 ctx = talloc_new(NULL);
226 ALLOC_CHECK(ctx);
227
228 if (strcmp(argv[0], "alloc") == 0) {
229 domain = NULL;
230 backend = lp_idmap_alloc_backend();
231 } else {
232 domain = talloc_strdup(ctx, argv[0]);
233 ALLOC_CHECK(domain);
234
235 opt = talloc_asprintf(ctx, "idmap config %s", domain);
236 ALLOC_CHECK(opt);
237
238 backend = talloc_strdup(ctx, lp_parm_const_string(-1, opt, "backend", "tdb"));
239 ALLOC_CHECK(backend);
240 }
241
242 if ( ( ! backend) || ( ! strequal(backend, "ldap"))) {
243 d_fprintf(stderr, "The only currently supported backend is LDAP\n");
244 talloc_free(ctx);
245 return -1;
246 }
247
248 if (domain) {
249
250 dn = lp_parm_const_string(-1, opt, "ldap_user_dn", NULL);
251 if ( ! dn) {
252 d_fprintf(stderr, "Missing ldap_user_dn option for domain %s\n", domain);
253 talloc_free(ctx);
254 return -1;
255 }
256
257 ret = idmap_store_secret("ldap", false, domain, dn, secret);
258 } else {
259 dn = lp_parm_const_string(-1, "idmap alloc config", "ldap_user_dn", NULL);
260 if ( ! dn) {
261 d_fprintf(stderr, "Missing ldap_user_dn option for alloc backend\n");
262 talloc_free(ctx);
263 return -1;
264 }
265
266 ret = idmap_store_secret("ldap", true, NULL, dn, secret);
267 }
268
269 if ( ! ret) {
270 d_fprintf(stderr, "Failed to store secret\n");
271 talloc_free(ctx);
272 return -1;
273 }
274
275 d_printf("Secret stored\n");
276 return 0;
277}
278
279int net_help_idmap(int argc, const char **argv)
280{
281 d_printf("net idmap dump <inputfile>\n"\
282 " Dump current id mapping\n");
283
284 d_printf("net idmap restore\n"\
285 " Restore entries from stdin\n");
286
287 /* Deliberately *not* document net idmap delete */
288
289 d_printf("net idmap secret <DOMAIN>|alloc <secret>\n"\
290 " Set the secret for the specified DOMAIN (or the alloc module)\n");
291
292 return -1;
293}
294
295static int net_idmap_aclmapset(int argc, const char **argv)
296{
297 TALLOC_CTX *mem_ctx;
298 int result = -1;
299 DOM_SID src_sid, dst_sid;
300 char *src, *dst;
301 struct db_context *db;
302 struct db_record *rec;
303 NTSTATUS status;
304
305 if (argc != 3) {
306 d_fprintf(stderr, "usage: net idmap aclmapset <tdb> "
307 "<src-sid> <dst-sid>\n");
308 return -1;
309 }
310
311 if (!(mem_ctx = talloc_init("net idmap aclmapset"))) {
312 d_fprintf(stderr, "talloc_init failed\n");
313 return -1;
314 }
315
316 if (!(db = db_open(mem_ctx, argv[0], 0, TDB_DEFAULT,
317 O_RDWR|O_CREAT, 0600))) {
318 d_fprintf(stderr, "db_open failed: %s\n", strerror(errno));
319 goto fail;
320 }
321
322 if (!string_to_sid(&src_sid, argv[1])) {
323 d_fprintf(stderr, "%s is not a valid sid\n", argv[1]);
324 goto fail;
325 }
326
327 if (!string_to_sid(&dst_sid, argv[2])) {
328 d_fprintf(stderr, "%s is not a valid sid\n", argv[2]);
329 goto fail;
330 }
331
332 if (!(src = sid_string_talloc(mem_ctx, &src_sid))
333 || !(dst = sid_string_talloc(mem_ctx, &dst_sid))) {
334 d_fprintf(stderr, "talloc_strdup failed\n");
335 goto fail;
336 }
337
338 if (!(rec = db->fetch_locked(
339 db, mem_ctx, string_term_tdb_data(src)))) {
340 d_fprintf(stderr, "could not fetch db record\n");
341 goto fail;
342 }
343
344 status = rec->store(rec, string_term_tdb_data(dst), 0);
345 TALLOC_FREE(rec);
346
347 if (!NT_STATUS_IS_OK(status)) {
348 d_fprintf(stderr, "could not store record: %s\n",
349 nt_errstr(status));
350 goto fail;
351 }
352
353 result = 0;
354fail:
355 TALLOC_FREE(mem_ctx);
356 return result;
357}
358
359/***********************************************************
360 Look at the current idmap
361 **********************************************************/
362int net_idmap(int argc, const char **argv)
363{
364 struct functable func[] = {
365 {"dump", net_idmap_dump},
366 {"restore", net_idmap_restore},
367 {"setmap", net_idmap_set },
368 {"delete", net_idmap_delete},
369 {"secret", net_idmap_secret},
370 {"aclmapset", net_idmap_aclmapset},
371 {"help", net_help_idmap},
372 {NULL, NULL}
373 };
374
375 return net_run_function(argc, argv, func, net_help_idmap);
376}
377
378
Note: See TracBrowser for help on using the repository browser.