Context Navigation

source: branches/samba-3.3.x/source/winbindd/idmap_tdb.c

Visit:

Last change on this file was 274, checked in by Herwig Bauernfeind, 16 years ago
Update 3.3 branch to 3.3.5
File size: 31.8 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3
4	idmap TDB backend
5
6	Copyright (C) Tim Potter 2000
7	Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
8	Copyright (C) Jeremy Allison 2006
9	Copyright (C) Simo Sorce 2003-2006
10
11	This program is free software; you can redistribute it and/or modify
12	it under the terms of the GNU General Public License as published by
13	the Free Software Foundation; either version 3 of the License, or
14	(at your option) any later version.
15
16	This program is distributed in the hope that it will be useful,
17	but WITHOUT ANY WARRANTY; without even the implied warranty of
18	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	GNU General Public License for more details.
20
21	You should have received a copy of the GNU General Public License
22	along with this program. If not, see <http://www.gnu.org/licenses/>.
23	*/
24
25	#include "includes.h"
26	#include "winbindd.h"
27
28	#undef DBGC_CLASS
29	#define DBGC_CLASS DBGC_IDMAP
30
31	/* High water mark keys */
32	#define HWM_GROUP "GROUP HWM"
33	#define HWM_USER "USER HWM"
34
35	static struct idmap_tdb_state {
36
37	/* User and group id pool */
38	uid_t low_uid, high_uid; /* Range of uids to allocate */
39	gid_t low_gid, high_gid; /* Range of gids to allocate */
40
41	} idmap_tdb_state;
42
43	/*****************************************************************************
44	For idmap conversion: convert one record to new format
45	Ancient versions (eg 2.2.3a) of winbindd_idmap.tdb mapped DOMAINNAME/rid
46	instead of the SID.
47	*****************************************************************************/
48	static int convert_fn(TDB_CONTEXT tdb, TDB_DATA key, TDB_DATA data, void state)
49	{
50	struct winbindd_domain *domain;
51	char *p;
52	DOM_SID sid;
53	uint32 rid;
54	fstring keystr;
55	fstring dom_name;
56	TDB_DATA key2;
57	bool failed = (bool )state;
58
59	DEBUG(10,("Converting %s\n", (const char *)key.dptr));
60
61	p = strchr((const char *)key.dptr, '/');
62	if (!p)
63	return 0;
64
65	*p = 0;
66	fstrcpy(dom_name, (const char *)key.dptr);
67	*p++ = '/';
68
69	domain = find_domain_from_name(dom_name);
70	if (domain == NULL) {
71	/* We must delete the old record. */
72	DEBUG(0,("Unable to find domain %s\n", dom_name ));
73	DEBUG(0,("deleting record %s\n", (const char *)key.dptr ));
74
75	if (tdb_delete(tdb, key) != 0) {
76	DEBUG(0, ("Unable to delete record %s\n", (const char *)key.dptr));
77	*failed = True;
78	return -1;
79	}
80
81	return 0;
82	}
83
84	rid = atoi(p);
85
86	sid_copy(&sid, &domain->sid);
87	sid_append_rid(&sid, rid);
88
89	sid_to_fstring(keystr, &sid);
90	key2 = string_term_tdb_data(keystr);
91
92	if (tdb_store(tdb, key2, data, TDB_INSERT) != 0) {
93	DEBUG(0,("Unable to add record %s\n", (const char *)key2.dptr ));
94	*failed = True;
95	return -1;
96	}
97
98	if (tdb_store(tdb, data, key2, TDB_REPLACE) != 0) {
99	DEBUG(0,("Unable to update record %s\n", (const char *)data.dptr ));
100	*failed = True;
101	return -1;
102	}
103
104	if (tdb_delete(tdb, key) != 0) {
105	DEBUG(0,("Unable to delete record %s\n", (const char *)key.dptr ));
106	*failed = True;
107	return -1;
108	}
109
110	return 0;
111	}
112
113	/*****************************************************************************
114	Convert the idmap database from an older version.
115	*****************************************************************************/
116
117	static bool idmap_tdb_upgrade(const char *idmap_name)
118	{
119	int32 vers;
120	bool bigendianheader;
121	bool failed = False;
122	TDB_CONTEXT *idmap_tdb;
123
124	DEBUG(0, ("Upgrading winbindd_idmap.tdb from an old version\n"));
125
126	if (!(idmap_tdb = tdb_open_log(idmap_name, 0,
127	TDB_DEFAULT, O_RDWR,
128	0600))) {
129	DEBUG(0, ("Unable to open idmap database\n"));
130	return False;
131	}
132
133	bigendianheader = (tdb_get_flags(idmap_tdb) & TDB_BIGENDIAN) ? True : False;
134
135	vers = tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION");
136
137	if (((vers == -1) && bigendianheader) \|\| (IREV(vers) == IDMAP_VERSION)) {
138	/* Arrggghh ! Bytereversed or old big-endian - make order independent ! */
139	/*
140	* high and low records were created on a
141	* big endian machine and will need byte-reversing.
142	*/
143
144	int32 wm;
145
146	wm = tdb_fetch_int32(idmap_tdb, HWM_USER);
147
148	if (wm != -1) {
149	wm = IREV(wm);
150	} else {
151	wm = idmap_tdb_state.low_uid;
152	}
153
154	if (tdb_store_int32(idmap_tdb, HWM_USER, wm) == -1) {
155	DEBUG(0, ("Unable to byteswap user hwm in idmap database\n"));
156	tdb_close(idmap_tdb);
157	return False;
158	}
159
160	wm = tdb_fetch_int32(idmap_tdb, HWM_GROUP);
161	if (wm != -1) {
162	wm = IREV(wm);
163	} else {
164	wm = idmap_tdb_state.low_gid;
165	}
166
167	if (tdb_store_int32(idmap_tdb, HWM_GROUP, wm) == -1) {
168	DEBUG(0, ("Unable to byteswap group hwm in idmap database\n"));
169	tdb_close(idmap_tdb);
170	return False;
171	}
172	}
173
174	/* the old format stored as DOMAIN/rid - now we store the SID direct */
175	tdb_traverse(idmap_tdb, convert_fn, &failed);
176
177	if (failed) {
178	DEBUG(0, ("Problem during conversion\n"));
179	tdb_close(idmap_tdb);
180	return False;
181	}
182
183	if (tdb_store_int32(idmap_tdb, "IDMAP_VERSION", IDMAP_VERSION) == -1) {
184	DEBUG(0, ("Unable to dtore idmap version in databse\n"));
185	tdb_close(idmap_tdb);
186	return False;
187	}
188
189	tdb_close(idmap_tdb);
190	return True;
191	}
192
193	/* WARNING: We can't open a tdb twice inthe same process, for that reason
194	* I'm going to use a hack with open ref counts to open the winbindd_idmap.tdb
195	* only once. We will later decide whether to split the db in multiple files
196	* or come up with a better solution to share them. */
197
198	static TDB_CONTEXT *idmap_tdb_common_ctx;
199	static int idmap_tdb_open_ref_count = 0;
200
201	static NTSTATUS idmap_tdb_open_db(TALLOC_CTX memctx, TDB_CONTEXT *tdbctx)
202	{
203	NTSTATUS ret;
204	TALLOC_CTX *ctx;
205	SMB_STRUCT_STAT stbuf;
206	char *tdbfile = NULL;
207	int32 version;
208	bool tdb_is_new = False;
209
210	if (idmap_tdb_open_ref_count) { /* the tdb has already been opened */
211	idmap_tdb_open_ref_count++;
212	*tdbctx = idmap_tdb_common_ctx;
213	return NT_STATUS_OK;
214	}
215
216	/* use our own context here */
217	ctx = talloc_new(memctx);
218	if (!ctx) {
219	DEBUG(0, ("Out of memory!\n"));
220	return NT_STATUS_NO_MEMORY;
221	}
222
223	/* use the old database if present */
224	tdbfile = talloc_strdup(ctx, state_path("winbindd_idmap.tdb"));
225	if (!tdbfile) {
226	DEBUG(0, ("Out of memory!\n"));
227	ret = NT_STATUS_NO_MEMORY;
228	goto done;
229	}
230
231	if (!file_exist(tdbfile, &stbuf)) {
232	tdb_is_new = True;
233	}
234
235	DEBUG(10,("Opening tdbfile %s\n", tdbfile ));
236
237	/* Open idmap repository */
238	if (!(idmap_tdb_common_ctx = tdb_open_log(tdbfile, 0, TDB_DEFAULT, O_RDWR \| O_CREAT, 0644))) {
239	DEBUG(0, ("Unable to open idmap database\n"));
240	ret = NT_STATUS_UNSUCCESSFUL;
241	goto done;
242	}
243
244	if (tdb_is_new) {
245	/* the file didn't existed before opening it, let's
246	* store idmap version as nobody else yet opened and
247	* stored it. I do not like this method but didn't
248	* found a way to understand if an opened tdb have
249	* been just created or not --- SSS */
250	tdb_store_int32(idmap_tdb_common_ctx, "IDMAP_VERSION", IDMAP_VERSION);
251	}
252
253	/* check against earlier versions */
254	version = tdb_fetch_int32(idmap_tdb_common_ctx, "IDMAP_VERSION");
255	if (version != IDMAP_VERSION) {
256
257	/* backup_tdb expects the tdb not to be open */
258	tdb_close(idmap_tdb_common_ctx);
259
260	if ( ! idmap_tdb_upgrade(tdbfile)) {
261
262	DEBUG(0, ("Unable to open idmap database, it's in an old formati, and upgrade failed!\n"));
263	ret = NT_STATUS_INTERNAL_DB_ERROR;
264	goto done;
265	}
266
267	/* Re-Open idmap repository */
268	if (!(idmap_tdb_common_ctx = tdb_open_log(tdbfile, 0, TDB_DEFAULT, O_RDWR \| O_CREAT, 0644))) {
269	DEBUG(0, ("Unable to open idmap database\n"));
270	ret = NT_STATUS_UNSUCCESSFUL;
271	goto done;
272	}
273	}
274
275	*tdbctx = idmap_tdb_common_ctx;
276	idmap_tdb_open_ref_count++;
277	ret = NT_STATUS_OK;
278
279	done:
280	talloc_free(ctx);
281	return ret;
282	}
283
284	/* NEVER use tdb_close() except for the conversion routines that are guaranteed
285	* to run only when the database is opened the first time, always use this function. */
286
287	bool idmap_tdb_tdb_close(TDB_CONTEXT *tdbctx)
288	{
289	if (tdbctx != idmap_tdb_common_ctx) {
290	DEBUG(0, ("ERROR: Invalid tdb context!"));
291	return False;
292	}
293
294	idmap_tdb_open_ref_count--;
295	if (idmap_tdb_open_ref_count) {
296	return True;
297	}
298
299	return tdb_close(idmap_tdb_common_ctx);
300	}
301
302	/**********************************************************************
303	IDMAP ALLOC TDB BACKEND
304	**********************************************************************/
305
306	static TDB_CONTEXT *idmap_alloc_tdb;
307
308	/**********************************
309	Initialise idmap alloc database.
310	**********************************/
311
312	static NTSTATUS idmap_tdb_alloc_init( const char *params )
313	{
314	NTSTATUS ret;
315	TALLOC_CTX *ctx;
316	uid_t low_uid = 0;
317	uid_t high_uid = 0;
318	gid_t low_gid = 0;
319	gid_t high_gid = 0;
320	uint32_t low_id;
321
322	/* use our own context here */
323	ctx = talloc_new(NULL);
324	if (!ctx) {
325	DEBUG(0, ("Out of memory!\n"));
326	return NT_STATUS_NO_MEMORY;
327	}
328
329	ret = idmap_tdb_open_db(ctx, &idmap_alloc_tdb);
330	if ( ! NT_STATUS_IS_OK(ret)) {
331	talloc_free(ctx);
332	return ret;
333	}
334
335	talloc_free(ctx);
336
337	/* load ranges */
338
339	if (!lp_idmap_uid(&low_uid, &high_uid)
340	\|\| !lp_idmap_gid(&low_gid, &high_gid)) {
341	DEBUG(1, ("idmap uid or idmap gid missing\n"));
342	return NT_STATUS_UNSUCCESSFUL;
343	}
344
345	idmap_tdb_state.low_uid = low_uid;
346	idmap_tdb_state.high_uid = high_uid;
347	idmap_tdb_state.low_gid = low_gid;
348	idmap_tdb_state.high_gid = high_gid;
349
350	if (idmap_tdb_state.high_uid <= idmap_tdb_state.low_uid) {
351	DEBUG(1, ("idmap uid range missing or invalid\n"));
352	DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
353	return NT_STATUS_UNSUCCESSFUL;
354	}
355
356	if (idmap_tdb_state.high_gid <= idmap_tdb_state.low_gid) {
357	DEBUG(1, ("idmap gid range missing or invalid\n"));
358	DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
359	return NT_STATUS_UNSUCCESSFUL;
360	}
361
362	if (((low_id = tdb_fetch_int32(idmap_alloc_tdb, HWM_USER)) == -1) \|\|
363	(low_id < idmap_tdb_state.low_uid)) {
364	if (tdb_store_int32(idmap_alloc_tdb, HWM_USER,
365	idmap_tdb_state.low_uid) == -1) {
366	DEBUG(0, ("Unable to initialise user hwm in idmap "
367	"database\n"));
368	return NT_STATUS_INTERNAL_DB_ERROR;
369	}
370	}
371
372	if (((low_id = tdb_fetch_int32(idmap_alloc_tdb, HWM_GROUP)) == -1) \|\|
373	(low_id < idmap_tdb_state.low_gid)) {
374	if (tdb_store_int32(idmap_alloc_tdb, HWM_GROUP,
375	idmap_tdb_state.low_gid) == -1) {
376	DEBUG(0, ("Unable to initialise group hwm in idmap "
377	"database\n"));
378	return NT_STATUS_INTERNAL_DB_ERROR;
379	}
380	}
381
382	return NT_STATUS_OK;
383	}
384
385	/**********************************
386	Allocate a new id.
387	**********************************/
388
389	static NTSTATUS idmap_tdb_allocate_id(struct unixid *xid)
390	{
391	bool ret;
392	const char *hwmkey;
393	const char *hwmtype;
394	uint32_t high_hwm;
395	uint32_t hwm;
396
397	/* Get current high water mark */
398	switch (xid->type) {
399
400	case ID_TYPE_UID:
401	hwmkey = HWM_USER;
402	hwmtype = "UID";
403	high_hwm = idmap_tdb_state.high_uid;
404	break;
405
406	case ID_TYPE_GID:
407	hwmkey = HWM_GROUP;
408	hwmtype = "GID";
409	high_hwm = idmap_tdb_state.high_gid;
410	break;
411
412	default:
413	DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
414	return NT_STATUS_INVALID_PARAMETER;
415	}
416
417	if ((hwm = tdb_fetch_int32(idmap_alloc_tdb, hwmkey)) == -1) {
418	return NT_STATUS_INTERNAL_DB_ERROR;
419	}
420
421	/* check it is in the range */
422	if (hwm > high_hwm) {
423	DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
424	hwmtype, (unsigned long)high_hwm));
425	return NT_STATUS_UNSUCCESSFUL;
426	}
427
428	/* fetch a new id and increment it */
429	ret = tdb_change_uint32_atomic(idmap_alloc_tdb, hwmkey, &hwm, 1);
430	if (!ret) {
431	DEBUG(1, ("Fatal error while fetching a new %s value\n!", hwmtype));
432	return NT_STATUS_UNSUCCESSFUL;
433	}
434
435	/* recheck it is in the range */
436	if (hwm > high_hwm) {
437	DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
438	hwmtype, (unsigned long)high_hwm));
439	return NT_STATUS_UNSUCCESSFUL;
440	}
441
442	xid->id = hwm;
443	DEBUG(10,("New %s = %d\n", hwmtype, hwm));
444
445	return NT_STATUS_OK;
446	}
447
448	/**********************************
449	Get current highest id.
450	**********************************/
451
452	static NTSTATUS idmap_tdb_get_hwm(struct unixid *xid)
453	{
454	const char *hwmkey;
455	const char *hwmtype;
456	uint32_t hwm;
457	uint32_t high_hwm;
458
459	/* Get current high water mark */
460	switch (xid->type) {
461
462	case ID_TYPE_UID:
463	hwmkey = HWM_USER;
464	hwmtype = "UID";
465	high_hwm = idmap_tdb_state.high_uid;
466	break;
467
468	case ID_TYPE_GID:
469	hwmkey = HWM_GROUP;
470	hwmtype = "GID";
471	high_hwm = idmap_tdb_state.high_gid;
472	break;
473
474	default:
475	return NT_STATUS_INVALID_PARAMETER;
476	}
477
478	if ((hwm = tdb_fetch_int32(idmap_alloc_tdb, hwmkey)) == -1) {
479	return NT_STATUS_INTERNAL_DB_ERROR;
480	}
481
482	xid->id = hwm;
483
484	/* Warn if it is out of range */
485	if (hwm >= high_hwm) {
486	DEBUG(0, ("Warning: %s range full!! (max: %lu)\n",
487	hwmtype, (unsigned long)high_hwm));
488	}
489
490	return NT_STATUS_OK;
491	}
492
493	/**********************************
494	Set high id.
495	**********************************/
496
497	static NTSTATUS idmap_tdb_set_hwm(struct unixid *xid)
498	{
499	const char *hwmkey;
500	const char *hwmtype;
501	uint32_t hwm;
502	uint32_t high_hwm;
503
504	/* Get current high water mark */
505	switch (xid->type) {
506
507	case ID_TYPE_UID:
508	hwmkey = HWM_USER;
509	hwmtype = "UID";
510	high_hwm = idmap_tdb_state.high_uid;
511	break;
512
513	case ID_TYPE_GID:
514	hwmkey = HWM_GROUP;
515	hwmtype = "GID";
516	high_hwm = idmap_tdb_state.high_gid;
517	break;
518
519	default:
520	return NT_STATUS_INVALID_PARAMETER;
521	}
522
523	hwm = xid->id;
524
525	if ((hwm = tdb_store_int32(idmap_alloc_tdb, hwmkey, hwm)) == -1) {
526	return NT_STATUS_INTERNAL_DB_ERROR;
527	}
528
529	/* Warn if it is out of range */
530	if (hwm >= high_hwm) {
531	DEBUG(0, ("Warning: %s range full!! (max: %lu)\n",
532	hwmtype, (unsigned long)high_hwm));
533	}
534
535	return NT_STATUS_OK;
536	}
537
538	/**********************************
539	Close the alloc tdb
540	**********************************/
541
542	static NTSTATUS idmap_tdb_alloc_close(void)
543	{
544	if (idmap_alloc_tdb) {
545	if (idmap_tdb_tdb_close(idmap_alloc_tdb) == 0) {
546	return NT_STATUS_OK;
547	} else {
548	return NT_STATUS_UNSUCCESSFUL;
549	}
550	}
551	return NT_STATUS_OK;
552	}
553
554	/**********************************************************************
555	IDMAP MAPPING TDB BACKEND
556	**********************************************************************/
557
558	struct idmap_tdb_context {
559	TDB_CONTEXT *tdb;
560	uint32_t filter_low_id;
561	uint32_t filter_high_id;
562	};
563
564	/*****************************
565	Initialise idmap database.
566	*****************************/
567
568	static NTSTATUS idmap_tdb_db_init(struct idmap_domain dom, const char params)
569	{
570	NTSTATUS ret;
571	struct idmap_tdb_context *ctx;
572
573	ctx = talloc(dom, struct idmap_tdb_context);
574	if ( ! ctx) {
575	DEBUG(0, ("Out of memory!\n"));
576	return NT_STATUS_NO_MEMORY;
577	}
578
579	if (strequal(dom->name, "*")) {
580	uid_t low_uid = 0;
581	uid_t high_uid = 0;
582	gid_t low_gid = 0;
583	gid_t high_gid = 0;
584
585	ctx->filter_low_id = 0;
586	ctx->filter_high_id = 0;
587
588	if (lp_idmap_uid(&low_uid, &high_uid)) {
589	ctx->filter_low_id = low_uid;
590	ctx->filter_high_id = high_uid;
591	} else {
592	DEBUG(3, ("Warning: 'idmap uid' not set!\n"));
593	}
594
595	if (lp_idmap_gid(&low_gid, &high_gid)) {
596	if ((low_gid != low_uid) \|\| (high_gid != high_uid)) {
597	DEBUG(1, ("Warning: 'idmap uid' and 'idmap gid'"
598	" ranges do not agree -- building "
599	"intersection\n"));
600	ctx->filter_low_id = MAX(ctx->filter_low_id,
601	low_gid);
602	ctx->filter_high_id = MIN(ctx->filter_high_id,
603	high_gid);
604	}
605	} else {
606	DEBUG(3, ("Warning: 'idmap gid' not set!\n"));
607	}
608	} else {
609	char *config_option = NULL;
610	const char *range;
611
612	config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
613	if ( ! config_option) {
614	DEBUG(0, ("Out of memory!\n"));
615	ret = NT_STATUS_NO_MEMORY;
616	goto failed;
617	}
618
619	range = lp_parm_const_string(-1, config_option, "range", NULL);
620	if (( ! range) \|\|
621	(sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2))
622	{
623	ctx->filter_low_id = 0;
624	ctx->filter_high_id = 0;
625	}
626
627	talloc_free(config_option);
628	}
629
630	if (ctx->filter_low_id > ctx->filter_high_id) {
631	ctx->filter_low_id = 0;
632	ctx->filter_high_id = 0;
633	}
634
635	DEBUG(10, ("idmap_tdb_db_init: filter range %u-%u loaded for domain "
636	"'%s'\n", ctx->filter_low_id, ctx->filter_high_id, dom->name));
637
638	ret = idmap_tdb_open_db(ctx, &ctx->tdb);
639	if ( ! NT_STATUS_IS_OK(ret)) {
640	goto failed;
641	}
642
643	dom->private_data = ctx;
644
645	return NT_STATUS_OK;
646
647	failed:
648	talloc_free(ctx);
649	return ret;
650	}
651
652	/**********************************
653	Single id to sid lookup function.
654	**********************************/
655
656	static NTSTATUS idmap_tdb_id_to_sid(struct idmap_tdb_context ctx, struct id_map map)
657	{
658	NTSTATUS ret;
659	TDB_DATA data;
660	char *keystr;
661
662	if (!ctx \|\| !map) {
663	return NT_STATUS_INVALID_PARAMETER;
664	}
665
666	/* apply filters before checking */
667	if ((ctx->filter_low_id && (map->xid.id < ctx->filter_low_id)) \|\|
668	(ctx->filter_high_id && (map->xid.id > ctx->filter_high_id))) {
669	DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
670	map->xid.id, ctx->filter_low_id, ctx->filter_high_id));
671	return NT_STATUS_NONE_MAPPED;
672	}
673
674	switch (map->xid.type) {
675
676	case ID_TYPE_UID:
677	keystr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
678	break;
679
680	case ID_TYPE_GID:
681	keystr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
682	break;
683
684	default:
685	DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
686	return NT_STATUS_INVALID_PARAMETER;
687	}
688
689	/* final SAFE_FREE safe */
690	data.dptr = NULL;
691
692	if (keystr == NULL) {
693	DEBUG(0, ("Out of memory!\n"));
694	ret = NT_STATUS_NO_MEMORY;
695	goto done;
696	}
697
698	DEBUG(10,("Fetching record %s\n", keystr));
699
700	/* Check if the mapping exists */
701	data = tdb_fetch_bystring(ctx->tdb, keystr);
702
703	if (!data.dptr) {
704	DEBUG(10,("Record %s not found\n", keystr));
705	ret = NT_STATUS_NONE_MAPPED;
706	goto done;
707	}
708
709	if (!string_to_sid(map->sid, (const char *)data.dptr)) {
710	DEBUG(10,("INVALID SID (%s) in record %s\n",
711	(const char *)data.dptr, keystr));
712	ret = NT_STATUS_INTERNAL_DB_ERROR;
713	goto done;
714	}
715
716	DEBUG(10,("Found record %s -> %s\n", keystr, (const char *)data.dptr));
717	ret = NT_STATUS_OK;
718
719	done:
720	SAFE_FREE(data.dptr);
721	talloc_free(keystr);
722	return ret;
723	}
724
725	/**********************************
726	Single sid to id lookup function.
727	**********************************/
728
729	static NTSTATUS idmap_tdb_sid_to_id(struct idmap_tdb_context ctx, struct id_map map)
730	{
731	NTSTATUS ret;
732	TDB_DATA data;
733	char *keystr;
734	unsigned long rec_id = 0;
735	fstring tmp;
736
737	if ((keystr = talloc_asprintf(
738	ctx, "%s", sid_to_fstring(tmp, map->sid))) == NULL) {
739	DEBUG(0, ("Out of memory!\n"));
740	ret = NT_STATUS_NO_MEMORY;
741	goto done;
742	}
743
744	DEBUG(10,("Fetching record %s\n", keystr));
745
746	/* Check if sid is present in database */
747	data = tdb_fetch_bystring(ctx->tdb, keystr);
748	if (!data.dptr) {
749	DEBUG(10,("Record %s not found\n", keystr));
750	ret = NT_STATUS_NONE_MAPPED;
751	goto done;
752	}
753
754	/* What type of record is this ? */
755	if (sscanf((const char )data.dptr, "UID %lu", &rec_id) == 1) { / Try a UID record. */
756	map->xid.id = rec_id;
757	map->xid.type = ID_TYPE_UID;
758	DEBUG(10,("Found uid record %s -> %s \n", keystr, (const char *)data.dptr ));
759	ret = NT_STATUS_OK;
760
761	} else if (sscanf((const char )data.dptr, "GID %lu", &rec_id) == 1) { / Try a GID record. */
762	map->xid.id = rec_id;
763	map->xid.type = ID_TYPE_GID;
764	DEBUG(10,("Found gid record %s -> %s \n", keystr, (const char *)data.dptr ));
765	ret = NT_STATUS_OK;
766
767	} else { /* Unknown record type ! */
768	DEBUG(2, ("Found INVALID record %s -> %s\n", keystr, (const char *)data.dptr));
769	ret = NT_STATUS_INTERNAL_DB_ERROR;
770	}
771
772	SAFE_FREE(data.dptr);
773
774	/* apply filters before returning result */
775	if ((ctx->filter_low_id && (map->xid.id < ctx->filter_low_id)) \|\|
776	(ctx->filter_high_id && (map->xid.id > ctx->filter_high_id))) {
777	DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
778	map->xid.id, ctx->filter_low_id, ctx->filter_high_id));
779	ret = NT_STATUS_NONE_MAPPED;
780	}
781
782	done:
783	talloc_free(keystr);
784	return ret;
785	}
786
787	/**********************************
788	lookup a set of unix ids.
789	**********************************/
790
791	static NTSTATUS idmap_tdb_unixids_to_sids(struct idmap_domain dom, struct id_map *ids)
792	{
793	struct idmap_tdb_context *ctx;
794	NTSTATUS ret;
795	int i;
796
797	/* initialize the status to avoid suprise */
798	for (i = 0; ids[i]; i++) {
799	ids[i]->status = ID_UNKNOWN;
800	}
801
802	ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
803
804	for (i = 0; ids[i]; i++) {
805	ret = idmap_tdb_id_to_sid(ctx, ids[i]);
806	if ( ! NT_STATUS_IS_OK(ret)) {
807
808	/* if it is just a failed mapping continue */
809	if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
810
811	/* make sure it is marked as unmapped */
812	ids[i]->status = ID_UNMAPPED;
813	continue;
814	}
815
816	/* some fatal error occurred, return immediately */
817	goto done;
818	}
819
820	/* all ok, id is mapped */
821	ids[i]->status = ID_MAPPED;
822	}
823
824	ret = NT_STATUS_OK;
825
826	done:
827	return ret;
828	}
829
830	/**********************************
831	lookup a set of sids.
832	**********************************/
833
834	static NTSTATUS idmap_tdb_sids_to_unixids(struct idmap_domain dom, struct id_map *ids)
835	{
836	struct idmap_tdb_context *ctx;
837	NTSTATUS ret;
838	int i;
839
840	/* initialize the status to avoid suprise */
841	for (i = 0; ids[i]; i++) {
842	ids[i]->status = ID_UNKNOWN;
843	}
844
845	ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
846
847	for (i = 0; ids[i]; i++) {
848	ret = idmap_tdb_sid_to_id(ctx, ids[i]);
849	if ( ! NT_STATUS_IS_OK(ret)) {
850
851	/* if it is just a failed mapping continue */
852	if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
853
854	/* make sure it is marked as unmapped */
855	ids[i]->status = ID_UNMAPPED;
856	continue;
857	}
858
859	/* some fatal error occurred, return immediately */
860	goto done;
861	}
862
863	/* all ok, id is mapped */
864	ids[i]->status = ID_MAPPED;
865	}
866
867	ret = NT_STATUS_OK;
868
869	done:
870	return ret;
871	}
872
873	/**********************************
874	set a mapping.
875	**********************************/
876
877	static NTSTATUS idmap_tdb_set_mapping(struct idmap_domain *dom,
878	const struct id_map *map)
879	{
880	struct idmap_tdb_context *ctx;
881	NTSTATUS ret;
882	TDB_DATA ksid, kid, data;
883	char ksidstr, kidstr;
884	fstring tmp;
885
886	if (!map \|\| !map->sid) {
887	return NT_STATUS_INVALID_PARAMETER;
888	}
889
890	ksidstr = kidstr = NULL;
891	data.dptr = NULL;
892
893	/* TODO: should we filter a set_mapping using low/high filters ? */
894
895	ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
896
897	switch (map->xid.type) {
898
899	case ID_TYPE_UID:
900	kidstr = talloc_asprintf(ctx, "UID %lu",
901	(unsigned long)map->xid.id);
902	break;
903
904	case ID_TYPE_GID:
905	kidstr = talloc_asprintf(ctx, "GID %lu",
906	(unsigned long)map->xid.id);
907	break;
908
909	default:
910	DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
911	return NT_STATUS_INVALID_PARAMETER;
912	}
913
914	if (kidstr == NULL) {
915	DEBUG(0, ("ERROR: Out of memory!\n"));
916	ret = NT_STATUS_NO_MEMORY;
917	goto done;
918	}
919
920	if ((ksidstr = talloc_asprintf(
921	ctx, "%s", sid_to_fstring(tmp, map->sid))) == NULL) {
922	DEBUG(0, ("Out of memory!\n"));
923	ret = NT_STATUS_NO_MEMORY;
924	goto done;
925	}
926
927	DEBUG(10, ("Storing %s <-> %s map\n", ksidstr, kidstr));
928	kid = string_term_tdb_data(kidstr);
929	ksid = string_term_tdb_data(ksidstr);
930
931	/* DELETE previous mappings if any.
932	* This is done for both the SID and [U\|G]ID passed in */
933
934	/* NOTE: We should lock both the ksid and kid records here, before
935	* making modifications. However, because tdb_chainlock() is a
936	* blocking call we could create an unrecoverable deadlock, so for now
937	* we only lock the ksid record. */
938
939	/* Lock the record for this SID. */
940	if (tdb_chainlock(ctx->tdb, ksid) != 0) {
941	DEBUG(10,("Failed to lock record %s. Error %s\n",
942	ksidstr, tdb_errorstr(ctx->tdb) ));
943	return NT_STATUS_UNSUCCESSFUL;
944	}
945
946	data = tdb_fetch(ctx->tdb, ksid);
947	if (data.dptr) {
948	DEBUG(10, ("Deleting existing mapping %s <-> %s\n",
949	(const char *)data.dptr, ksidstr ));
950	tdb_delete(ctx->tdb, data);
951	tdb_delete(ctx->tdb, ksid);
952	SAFE_FREE(data.dptr);
953	}
954
955	data = tdb_fetch(ctx->tdb, kid);
956	if (data.dptr) {
957	DEBUG(10,("Deleting existing mapping %s <-> %s\n",
958	(const char *)data.dptr, kidstr ));
959	tdb_delete(ctx->tdb, data);
960	tdb_delete(ctx->tdb, kid);
961	SAFE_FREE(data.dptr);
962	}
963
964	if (tdb_store(ctx->tdb, ksid, kid, TDB_INSERT) == -1) {
965	DEBUG(0, ("Error storing SID -> ID: %s\n",
966	tdb_errorstr(ctx->tdb)));
967	tdb_chainunlock(ctx->tdb, ksid);
968	ret = NT_STATUS_UNSUCCESSFUL;
969	goto done;
970	}
971	if (tdb_store(ctx->tdb, kid, ksid, TDB_INSERT) == -1) {
972	DEBUG(0, ("Error storing ID -> SID: %s\n",
973	tdb_errorstr(ctx->tdb)));
974	/* try to remove the previous stored SID -> ID map */
975	tdb_delete(ctx->tdb, ksid);
976	tdb_chainunlock(ctx->tdb, ksid);
977	ret = NT_STATUS_UNSUCCESSFUL;
978	goto done;
979	}
980
981	tdb_chainunlock(ctx->tdb, ksid);
982	DEBUG(10,("Stored %s <-> %s\n", ksidstr, kidstr));
983	ret = NT_STATUS_OK;
984
985	done:
986	talloc_free(ksidstr);
987	talloc_free(kidstr);
988	SAFE_FREE(data.dptr);
989	return ret;
990	}
991
992	/**********************************
993	remove a mapping.
994	**********************************/
995
996	static NTSTATUS idmap_tdb_remove_mapping(struct idmap_domain *dom,
997	const struct id_map *map)
998	{
999	struct idmap_tdb_context *ctx;
1000	NTSTATUS ret;
1001	TDB_DATA ksid, kid, data;
1002	char ksidstr, kidstr;
1003	fstring tmp;
1004
1005	if (!map \|\| !map->sid) {
1006	return NT_STATUS_INVALID_PARAMETER;
1007	}
1008
1009	ksidstr = kidstr = NULL;
1010	data.dptr = NULL;
1011
1012	/* TODO: should we filter a remove_mapping using low/high filters ? */
1013
1014	ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
1015
1016	switch (map->xid.type) {
1017
1018	case ID_TYPE_UID:
1019	kidstr = talloc_asprintf(ctx, "UID %lu",
1020	(unsigned long)map->xid.id);
1021	break;
1022
1023	case ID_TYPE_GID:
1024	kidstr = talloc_asprintf(ctx, "GID %lu",
1025	(unsigned long)map->xid.id);
1026	break;
1027
1028	default:
1029	DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
1030	return NT_STATUS_INVALID_PARAMETER;
1031	}
1032
1033	if (kidstr == NULL) {
1034	DEBUG(0, ("ERROR: Out of memory!\n"));
1035	ret = NT_STATUS_NO_MEMORY;
1036	goto done;
1037	}
1038
1039	if ((ksidstr = talloc_asprintf(
1040	ctx, "%s", sid_to_fstring(tmp, map->sid))) == NULL) {
1041	DEBUG(0, ("Out of memory!\n"));
1042	ret = NT_STATUS_NO_MEMORY;
1043	goto done;
1044	}
1045
1046	DEBUG(10, ("Checking %s <-> %s map\n", ksidstr, kidstr));
1047	ksid = string_term_tdb_data(ksidstr);
1048	kid = string_term_tdb_data(kidstr);
1049
1050	/* NOTE: We should lock both the ksid and kid records here, before
1051	* making modifications. However, because tdb_chainlock() is a
1052	* blocking call we could create an unrecoverable deadlock, so for now
1053	* we only lock the ksid record. */
1054
1055	/* Lock the record for this SID. */
1056	if (tdb_chainlock(ctx->tdb, ksid) != 0) {
1057	DEBUG(10,("Failed to lock record %s. Error %s\n",
1058	ksidstr, tdb_errorstr(ctx->tdb) ));
1059	return NT_STATUS_UNSUCCESSFUL;
1060	}
1061
1062	/* Check if sid is present in database */
1063	data = tdb_fetch(ctx->tdb, ksid);
1064	if (!data.dptr) {
1065	DEBUG(10,("Record %s not found\n", ksidstr));
1066	tdb_chainunlock(ctx->tdb, ksid);
1067	ret = NT_STATUS_NONE_MAPPED;
1068	goto done;
1069	}
1070
1071	/* Check if sid is mapped to the specified ID */
1072	if ((data.dsize != kid.dsize) \|\|
1073	(memcmp(data.dptr, kid.dptr, data.dsize) != 0)) {
1074	DEBUG(10,("Specified SID does not map to specified ID\n"));
1075	DEBUGADD(10,("Actual mapping is %s -> %s\n", ksidstr,
1076	(const char *)data.dptr));
1077	tdb_chainunlock(ctx->tdb, ksid);
1078	ret = NT_STATUS_NONE_MAPPED;
1079	goto done;
1080	}
1081
1082	DEBUG(10, ("Removing %s <-> %s map\n", ksidstr, kidstr));
1083
1084	/* Delete previous mappings. */
1085
1086	DEBUG(10, ("Deleting existing mapping %s -> %s\n", ksidstr, kidstr ));
1087	tdb_delete(ctx->tdb, ksid);
1088
1089	DEBUG(10,("Deleting existing mapping %s -> %s\n", kidstr, ksidstr ));
1090	tdb_delete(ctx->tdb, kid);
1091
1092	tdb_chainunlock(ctx->tdb, ksid);
1093	ret = NT_STATUS_OK;
1094
1095	done:
1096	talloc_free(ksidstr);
1097	talloc_free(kidstr);
1098	SAFE_FREE(data.dptr);
1099	return ret;
1100	}
1101
1102	/**********************************
1103	Close the idmap tdb instance
1104	**********************************/
1105
1106	static NTSTATUS idmap_tdb_close(struct idmap_domain *dom)
1107	{
1108	struct idmap_tdb_context *ctx;
1109
1110	if (dom->private_data) {
1111	ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
1112
1113	if (idmap_tdb_tdb_close(ctx->tdb) == 0) {
1114	return NT_STATUS_OK;
1115	} else {
1116	return NT_STATUS_UNSUCCESSFUL;
1117	}
1118	}
1119	return NT_STATUS_OK;
1120	}
1121
1122	struct dump_data {
1123	TALLOC_CTX *memctx;
1124	struct id_map **maps;
1125	int *num_maps;
1126	NTSTATUS ret;
1127	};
1128
1129	static int idmap_tdb_dump_one_entry(TDB_CONTEXT tdb, TDB_DATA key, TDB_DATA value, void pdata)
1130	{
1131	struct dump_data *data = talloc_get_type(pdata, struct dump_data);
1132	struct id_map *maps;
1133	int num_maps = *data->num_maps;
1134
1135	/* ignore any record but the ones with a SID as key */
1136	if (strncmp((const char *)key.dptr, "S-", 2) == 0) {
1137
1138	maps = talloc_realloc(NULL, *data->maps, struct id_map, num_maps+1);
1139	if ( ! maps) {
1140	DEBUG(0, ("Out of memory!\n"));
1141	data->ret = NT_STATUS_NO_MEMORY;
1142	return -1;
1143	}
1144	*data->maps = maps;
1145	maps[num_maps].sid = talloc(maps, DOM_SID);
1146	if ( ! maps[num_maps].sid) {
1147	DEBUG(0, ("Out of memory!\n"));
1148	data->ret = NT_STATUS_NO_MEMORY;
1149	return -1;
1150	}
1151
1152	if (!string_to_sid(maps[num_maps].sid, (const char *)key.dptr)) {
1153	DEBUG(10,("INVALID record %s\n", (const char *)key.dptr));
1154	/* continue even with errors */
1155	return 0;
1156	}
1157
1158	/* Try a UID record. */
1159	if (sscanf((const char *)value.dptr, "UID %u", &(maps[num_maps].xid.id)) == 1) {
1160	maps[num_maps].xid.type = ID_TYPE_UID;
1161	maps[num_maps].status = ID_MAPPED;
1162	*data->num_maps = num_maps + 1;
1163
1164	/* Try a GID record. */
1165	} else
1166	if (sscanf((const char *)value.dptr, "GID %u", &(maps[num_maps].xid.id)) == 1) {
1167	maps[num_maps].xid.type = ID_TYPE_GID;
1168	maps[num_maps].status = ID_MAPPED;
1169	*data->num_maps = num_maps + 1;
1170
1171	/* Unknown record type ! */
1172	} else {
1173	maps[num_maps].status = ID_UNKNOWN;
1174	DEBUG(2, ("Found INVALID record %s -> %s\n",
1175	(const char )key.dptr, (const char )value.dptr));
1176	/* do not increment num_maps */
1177	}
1178	}
1179
1180	return 0;
1181	}
1182
1183	/**********************************
1184	Dump all mappings out
1185	**********************************/
1186
1187	static NTSTATUS idmap_tdb_dump_data(struct idmap_domain dom, struct id_map maps, int num_maps)
1188	{
1189	struct idmap_tdb_context *ctx;
1190	struct dump_data *data;
1191	NTSTATUS ret = NT_STATUS_OK;
1192
1193	ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
1194
1195	data = TALLOC_ZERO_P(ctx, struct dump_data);
1196	if ( ! data) {
1197	DEBUG(0, ("Out of memory!\n"));
1198	return NT_STATUS_NO_MEMORY;
1199	}
1200	data->maps = maps;
1201	data->num_maps = num_maps;
1202	data->ret = NT_STATUS_OK;
1203
1204	tdb_traverse(ctx->tdb, idmap_tdb_dump_one_entry, data);
1205
1206	if ( ! NT_STATUS_IS_OK(data->ret)) {
1207	ret = data->ret;
1208	}
1209
1210	talloc_free(data);
1211	return ret;
1212	}
1213
1214	static struct idmap_methods db_methods = {
1215
1216	.init = idmap_tdb_db_init,
1217	.unixids_to_sids = idmap_tdb_unixids_to_sids,
1218	.sids_to_unixids = idmap_tdb_sids_to_unixids,
1219	.set_mapping = idmap_tdb_set_mapping,
1220	.remove_mapping = idmap_tdb_remove_mapping,
1221	.dump_data = idmap_tdb_dump_data,
1222	.close_fn = idmap_tdb_close
1223	};
1224
1225	static struct idmap_alloc_methods db_alloc_methods = {
1226
1227	.init = idmap_tdb_alloc_init,
1228	.allocate_id = idmap_tdb_allocate_id,
1229	.get_id_hwm = idmap_tdb_get_hwm,
1230	.set_id_hwm = idmap_tdb_set_hwm,
1231	.close_fn = idmap_tdb_alloc_close
1232	};
1233
1234	NTSTATUS idmap_alloc_tdb_init(void)
1235	{
1236	return smb_register_idmap_alloc(SMB_IDMAP_INTERFACE_VERSION, "tdb", &db_alloc_methods);
1237	}
1238
1239	NTSTATUS idmap_tdb_init(void)
1240	{
1241	NTSTATUS ret;
1242
1243	DEBUG(10, ("calling idmap_tdb_init\n"));
1244
1245	/* FIXME: bad hack to actually register also the alloc_tdb module without changining configure.in */
1246	ret = idmap_alloc_tdb_init();
1247	if (! NT_STATUS_IS_OK(ret)) {
1248	return ret;
1249	}
1250	return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "tdb", &db_methods);
1251	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: