source: trunk/samba-3.0.25pre1/source/nsswitch/idmap.c@ 1

Last change on this file since 1 was 1, checked in by Paul Smedley, 18 years ago

Initial code import
File size: 35.1 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003
7 Copyright (C) Jeremy Allison 2006
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22*/
23
24#include "includes.h"
25#include "winbindd.h"
26
27#undef DBGC_CLASS
28#define DBGC_CLASS DBGC_IDMAP
29
30static_decl_idmap;
31
32struct idmap_backend {
33 const char *name;
34 struct idmap_methods *methods;
35 struct idmap_backend *prev, *next;
36};
37
38struct idmap_alloc_backend {
39 const char *name;
40 struct idmap_alloc_methods *methods;
41 struct idmap_alloc_backend *prev, *next;
42};
43
44struct idmap_cache_ctx;
45
46static TALLOC_CTX *idmap_ctx = NULL;
47static struct idmap_cache_ctx *idmap_cache;
48
49static struct idmap_backend *backends = NULL;
50static struct idmap_domain **idmap_domains = NULL;
51static int num_domains = 0;
52static int pdb_dom_num = -1;
53static int def_dom_num = -1;
54
55static struct idmap_alloc_backend *alloc_backends = NULL;
56static struct idmap_alloc_methods *alloc_methods = NULL;
57
58#define IDMAP_CHECK_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); goto done; } } while(0)
59#define IDMAP_CHECK_ALLOC(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while(0)
60
61static struct idmap_methods *get_methods(struct idmap_backend *be, const char *name)
62{
63 struct idmap_backend *b;
64
65 for (b = be; b; b = b->next) {
66 if (strequal(b->name, name)) {
67 return b->methods;
68 }
69 }
70
71 return NULL;
72}
73
74static struct idmap_alloc_methods *get_alloc_methods(struct idmap_alloc_backend *be, const char *name)
75{
76 struct idmap_alloc_backend *b;
77
78 for (b = be; b; b = b->next) {
79 if (strequal(b->name, name)) {
80 return b->methods;
81 }
82 }
83
84 return NULL;
85}
86
87/**********************************************************************
88 Allow a module to register itself as a method.
89**********************************************************************/
90
91NTSTATUS smb_register_idmap(int version, const char *name, struct idmap_methods *methods)
92{
93 struct idmap_methods *test;
94 struct idmap_backend *entry;
95
96 if (!idmap_ctx) {
97 return NT_STATUS_INTERNAL_DB_ERROR;
98 }
99
100 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
101 DEBUG(0, ("Failed to register idmap module.\n"
102 "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
103 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
104 "Please recompile against the current version of samba!\n",
105 version, SMB_IDMAP_INTERFACE_VERSION));
106 return NT_STATUS_OBJECT_TYPE_MISMATCH;
107 }
108
109 if (!name || !name[0] || !methods) {
110 DEBUG(0,("Called with NULL pointer or empty name!\n"));
111 return NT_STATUS_INVALID_PARAMETER;
112 }
113
114 test = get_methods(backends, name);
115 if (test) {
116 DEBUG(0,("Idmap module %s already registered!\n", name));
117 return NT_STATUS_OBJECT_NAME_COLLISION;
118 }
119
120 entry = talloc(idmap_ctx, struct idmap_backend);
121 if ( ! entry) {
122 DEBUG(0,("Out of memory!\n"));
123 return NT_STATUS_NO_MEMORY;
124 }
125 entry->name = talloc_strdup(idmap_ctx, name);
126 if ( ! entry->name) {
127 DEBUG(0,("Out of memory!\n"));
128 return NT_STATUS_NO_MEMORY;
129 }
130 entry->methods = methods;
131
132 DLIST_ADD(backends, entry);
133 DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
134 return NT_STATUS_OK;
135}
136
137/**********************************************************************
138 Allow a module to register itself as a method.
139**********************************************************************/
140
141NTSTATUS smb_register_idmap_alloc(int version, const char *name, struct idmap_alloc_methods *methods)
142{
143 struct idmap_alloc_methods *test;
144 struct idmap_alloc_backend *entry;
145
146 if (!idmap_ctx) {
147 return NT_STATUS_INTERNAL_DB_ERROR;
148 }
149
150 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
151 DEBUG(0, ("Failed to register idmap alloc module.\n"
152 "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
153 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
154 "Please recompile against the current version of samba!\n",
155 version, SMB_IDMAP_INTERFACE_VERSION));
156 return NT_STATUS_OBJECT_TYPE_MISMATCH;
157 }
158
159 if (!name || !name[0] || !methods) {
160 DEBUG(0,("Called with NULL pointer or empty name!\n"));
161 return NT_STATUS_INVALID_PARAMETER;
162 }
163
164 test = get_alloc_methods(alloc_backends, name);
165 if (test) {
166 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
167 return NT_STATUS_OBJECT_NAME_COLLISION;
168 }
169
170 entry = talloc(idmap_ctx, struct idmap_alloc_backend);
171 if ( ! entry) {
172 DEBUG(0,("Out of memory!\n"));
173 return NT_STATUS_NO_MEMORY;
174 }
175 entry->name = talloc_strdup(idmap_ctx, name);
176 if ( ! entry->name) {
177 DEBUG(0,("Out of memory!\n"));
178 return NT_STATUS_NO_MEMORY;
179 }
180 entry->methods = methods;
181
182 DLIST_ADD(alloc_backends, entry);
183 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
184 return NT_STATUS_OK;
185}
186
187static int close_domain_destructor(struct idmap_domain *dom)
188{
189 NTSTATUS ret;
190
191 ret = dom->methods->close_fn(dom);
192 if (!NT_STATUS_IS_OK(ret)) {
193 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
194 }
195
196 return 0;
197}
198
199/**************************************************************************
200 Shutdown.
201**************************************************************************/
202
203NTSTATUS idmap_close(void)
204{
205 /* close the alloc backend first before freeing idmap_ctx */
206 if (alloc_methods) {
207 alloc_methods->close_fn();
208 alloc_methods = NULL;
209 }
210 alloc_backends = NULL;
211
212 /* this talloc_free call will fire the talloc destructors
213 * that will free all active backends resources */
214 TALLOC_FREE(idmap_ctx);
215 idmap_cache = NULL;
216 idmap_domains = NULL;
217 backends = NULL;
218
219 return NT_STATUS_OK;
220}
221
222/**********************************************************************
223 Initialise idmap cache and a remote backend (if configured).
224**********************************************************************/
225
226static const char *idmap_default_domain[] = { "default domain", NULL };
227
228/****************************************************************************
229 ****************************************************************************/
230
231NTSTATUS idmap_init_cache(void)
232{
233 /* Always initialize the cache. We'll have to delay initialization
234 of backends if we are offline */
235
236 if ( idmap_ctx ) {
237 return NT_STATUS_OK;
238 }
239
240 if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
241 return NT_STATUS_NO_MEMORY;
242 }
243
244 if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
245 return NT_STATUS_UNSUCCESSFUL;
246 }
247
248 return NT_STATUS_OK;
249}
250
251/****************************************************************************
252 ****************************************************************************/
253
254NTSTATUS idmap_init(void)
255{
256 NTSTATUS ret;
257 static NTSTATUS backend_init_status = NT_STATUS_UNSUCCESSFUL;
258 struct idmap_domain *dom;
259 char *compat_backend = NULL;
260 char *compat_params = NULL;
261 const char **dom_list = NULL;
262 char *alloc_backend;
263 BOOL default_already_defined = False;
264 BOOL pri_dom_is_in_list = False;
265 int compat = 0;
266 int i;
267
268 /* Always initialize the cache. We'll have to delay initialization
269 of backends if we are offline */
270
271 ret = idmap_init_cache();
272 if ( !NT_STATUS_IS_OK(ret) )
273 return ret;
274
275 if ( NT_STATUS_IS_OK(backend_init_status) ) {
276 return NT_STATUS_OK;
277 }
278
279 /* We can't reliably call intialization code here unless
280 we are online */
281
282 if ( get_global_winbindd_state_offline() ) {
283 backend_init_status = NT_STATUS_FILE_IS_OFFLINE;
284 return backend_init_status;
285 }
286
287 static_init_idmap;
288
289 dom_list = lp_idmap_domains();
290
291 if ( dom_list && lp_idmap_backend() ) {
292 DEBUG(0, ("WARNING: idmap backend and idmap domains are "
293 "mutually excusive!\n"));
294 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
295 } else if ( lp_idmap_backend() ) {
296 const char **compat_list = lp_idmap_backend();
297 char *p = NULL;
298 const char *q = NULL;
299
300 DEBUG(0, ("WARNING: idmap backend is deprecated!\n"));
301 compat = 1;
302
303 if ( (compat_backend = talloc_strdup( idmap_ctx, *compat_list )) == NULL ) {
304 ret = NT_STATUS_NO_MEMORY;
305 goto done;
306 }
307
308 /* strip any leading idmap_ prefix of */
309 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
310 q = *compat_list += 6;
311 DEBUG(0, ("WARNING: idmap backend uses obsolete and "
312 "deprecated 'idmap_' prefix.\n"
313 "Please replace 'idmap_%s' by '%s' in %s\n",
314 q, q, dyn_CONFIGFILE));
315 compat_backend = talloc_strdup( idmap_ctx, q);
316 } else {
317 compat_backend = talloc_strdup( idmap_ctx, *compat_list);
318 }
319
320 /* separate the backend and module arguements */
321 if ((p = strchr(compat_backend, ':')) != NULL) {
322 *p = '\0';
323 compat_params = p + 1;
324 }
325 }
326
327 if ( ! dom_list) {
328 dom_list = idmap_default_domain;
329 }
330
331 /***************************
332 * initialize idmap domains
333 */
334 DEBUG(1, ("Initializing idmap domains\n"));
335
336 for (i = 0; dom_list[i]; i++) {
337 const char *parm_backend;
338 char *config_option;
339
340 if (strequal(dom_list[i], lp_workgroup())) {
341 pri_dom_is_in_list = True;
342 }
343 /* init domain */
344
345 dom = talloc_zero(idmap_ctx, struct idmap_domain);
346 IDMAP_CHECK_ALLOC(dom);
347
348 dom->name = talloc_strdup(dom, dom_list[i]);
349 IDMAP_CHECK_ALLOC(dom->name);
350
351 config_option = talloc_asprintf(dom, "idmap config %s", dom->name);
352 IDMAP_CHECK_ALLOC(config_option);
353
354 /* default or specific ? */
355
356 dom->default_domain = lp_parm_bool(-1, config_option, "default", False);
357
358 if (dom->default_domain ||
359 strequal(dom_list[i], idmap_default_domain[0])) {
360
361 /* make sure this is set even when we match idmap_default_domain[0] */
362 dom->default_domain = True;
363
364 if (default_already_defined) {
365 DEBUG(1, ("ERROR: Multiple domains defined as default!\n"));
366 ret = NT_STATUS_INVALID_PARAMETER;
367 goto done;
368 }
369
370 default_already_defined = True;
371
372 }
373
374 dom->readonly = lp_parm_bool(-1, config_option, "readonly", False);
375
376 /* find associated backend (default: tdb) */
377 if (compat) {
378 parm_backend = talloc_strdup(idmap_ctx, compat_backend);
379 } else {
380 parm_backend = talloc_strdup(idmap_ctx,
381 lp_parm_const_string(-1, config_option, "backend", "tdb"));
382 }
383 IDMAP_CHECK_ALLOC(parm_backend);
384
385 /* get the backend methods for this domain */
386 dom->methods = get_methods(backends, parm_backend);
387
388 if ( ! dom->methods) {
389 ret = smb_probe_module("idmap", parm_backend);
390 if (NT_STATUS_IS_OK(ret)) {
391 dom->methods = get_methods(backends, parm_backend);
392 }
393 }
394 if ( ! dom->methods) {
395 DEBUG(0, ("ERROR: Could not get methods for backend %s\n", parm_backend));
396 ret = NT_STATUS_UNSUCCESSFUL;
397 goto done;
398 }
399
400 /* check the set_mapping function exists otherwise mark the module as readonly */
401 if ( ! dom->methods->set_mapping) {
402 dom->readonly = True;
403 }
404
405 /* now that we have methods, set the destructor for this domain */
406 talloc_set_destructor(dom, close_domain_destructor);
407
408 /* Finally instance a backend copy for this domain */
409 ret = dom->methods->init(dom, compat_params);
410 if ( ! NT_STATUS_IS_OK(ret)) {
411 DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s)\n",
412 parm_backend, dom->name));
413 ret = NT_STATUS_UNSUCCESSFUL;
414 goto done;
415 }
416 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, i+1);
417 if ( ! idmap_domains) {
418 DEBUG(0, ("Out of memory!\n"));
419 ret = NT_STATUS_NO_MEMORY;
420 goto done;
421 }
422 idmap_domains[i] = dom;
423
424 if (dom->default_domain) { /* save default domain position for future uses */
425 def_dom_num = i;
426 }
427
428 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
429 dom->name, parm_backend,
430 dom->default_domain?"":"not ", dom->readonly?"":"not "));
431
432 talloc_free(config_option);
433 }
434
435 /* save the number of domains we have */
436 num_domains = i;
437
438 /* automatically add idmap_nss backend if needed */
439 if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
440 ( ! pri_dom_is_in_list) &&
441 lp_winbind_trusted_domains_only()) {
442
443 dom = talloc_zero(idmap_ctx, struct idmap_domain);
444 IDMAP_CHECK_ALLOC(dom);
445
446 dom->name = talloc_strdup(dom, lp_workgroup());
447 IDMAP_CHECK_ALLOC(dom->name);
448
449 dom->default_domain = False;
450 dom->readonly = True;
451
452 /* get the backend methods for passdb */
453 dom->methods = get_methods(backends, "nss");
454
455 /* (the nss module is always statically linked) */
456 if ( ! dom->methods) {
457 DEBUG(0, ("ERROR: Could not get methods for idmap_nss ?!\n"));
458 ret = NT_STATUS_UNSUCCESSFUL;
459 goto done;
460 }
461
462 /* now that we have methods, set the destructor for this domain */
463 talloc_set_destructor(dom, close_domain_destructor);
464
465 /* Finally instance a backend copy for this domain */
466 ret = dom->methods->init(dom, compat_params);
467 if ( ! NT_STATUS_IS_OK(ret)) {
468 DEBUG(0, ("ERROR: Initialization failed for idmap_nss ?!\n"));
469 ret = NT_STATUS_UNSUCCESSFUL;
470 goto done;
471 }
472
473 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, num_domains+1);
474 if ( ! idmap_domains) {
475 DEBUG(0, ("Out of memory!\n"));
476 ret = NT_STATUS_NO_MEMORY;
477 goto done;
478 }
479 idmap_domains[num_domains] = dom;
480
481 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n", dom->name ));
482
483 num_domains++;
484 }
485
486 /**** automatically add idmap_passdb backend ****/
487 dom = talloc_zero(idmap_ctx, struct idmap_domain);
488 IDMAP_CHECK_ALLOC(dom);
489
490 dom->name = talloc_strdup(dom, get_global_sam_name());
491 IDMAP_CHECK_ALLOC(dom->name);
492
493 dom->default_domain = False;
494 dom->readonly = True;
495
496 /* get the backend methods for passdb */
497 dom->methods = get_methods(backends, "passdb");
498
499 /* (the passdb module is always statically linked) */
500 if ( ! dom->methods) {
501 DEBUG(0, ("ERROR: Could not get methods for idmap_passdb ?!\n"));
502 ret = NT_STATUS_UNSUCCESSFUL;
503 goto done;
504 }
505
506 /* now that we have methods, set the destructor for this domain */
507 talloc_set_destructor(dom, close_domain_destructor);
508
509 /* Finally instance a backend copy for this domain */
510 ret = dom->methods->init(dom, compat_params);
511 if ( ! NT_STATUS_IS_OK(ret)) {
512 DEBUG(0, ("ERROR: Initialization failed for idmap_passdb ?!\n"));
513 ret = NT_STATUS_UNSUCCESSFUL;
514 goto done;
515 }
516
517 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, num_domains+1);
518 if ( ! idmap_domains) {
519 DEBUG(0, ("Out of memory!\n"));
520 ret = NT_STATUS_NO_MEMORY;
521 goto done;
522 }
523 idmap_domains[num_domains] = dom;
524
525 /* needed to handle special BUILTIN and wellknown SIDs cases */
526 pdb_dom_num = num_domains;
527
528 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n", dom->name));
529
530 num_domains++;
531 /**** finished adding idmap_passdb backend ****/
532
533 /* sort domains so that the default is the last one */
534 /* don't sort if no default domain defined */
535 if (def_dom_num != -1 && def_dom_num != num_domains-1) { /* default is not last, move it */
536 struct idmap_domain *tmp;
537
538 if (pdb_dom_num > def_dom_num) {
539 pdb_dom_num --;
540
541 } else if (pdb_dom_num == def_dom_num) { /* ?? */
542 pdb_dom_num = num_domains - 1;
543 }
544
545 tmp = idmap_domains[def_dom_num];
546
547 for (i = def_dom_num; i < num_domains-1; i++) {
548 idmap_domains[i] = idmap_domains[i+1];
549 }
550 idmap_domains[i] = tmp;
551 def_dom_num = i;
552 }
553
554
555 /***************************
556 * initialize alloc module
557 */
558 DEBUG(1, ("Initializing idmap alloc module\n"));
559
560 if (compat) {
561 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
562 } else {
563 char *ab = lp_idmap_alloc_backend();
564
565 if (ab && (ab[0] != '\0')) {
566 alloc_backend = talloc_strdup(idmap_ctx, lp_idmap_alloc_backend());
567 } else {
568 alloc_backend = talloc_strdup(idmap_ctx, "tdb");
569 }
570 }
571 IDMAP_CHECK_ALLOC(alloc_backend);
572
573 alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
574 if ( ! alloc_methods) {
575 ret = smb_probe_module("idmap", alloc_backend);
576 if (NT_STATUS_IS_OK(ret)) {
577 alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
578 }
579 }
580 if ( ! alloc_methods) {
581 DEBUG(0, ("ERROR: Could not get methods for alloc backend %s\n", alloc_backend));
582 ret = NT_STATUS_UNSUCCESSFUL;
583 goto done;
584 }
585
586 ret = alloc_methods->init(compat_params);
587 if ( ! NT_STATUS_IS_OK(ret)) {
588 DEBUG(0, ("ERROR: Initialization failed for alloc backend %s\n", alloc_backend));
589 ret = NT_STATUS_UNSUCCESSFUL;
590 goto done;
591 }
592
593 /* cleanpu temporary strings */
594 TALLOC_FREE( compat_backend );
595
596 backend_init_status = NT_STATUS_OK;
597
598 return NT_STATUS_OK;
599
600done:
601 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
602 idmap_close();
603
604 /* save the init status for later checks */
605 backend_init_status = ret;
606
607 return ret;
608}
609
610/**************************************************************************
611 idmap allocator interface functions
612**************************************************************************/
613
614NTSTATUS idmap_allocate_uid(struct unixid *id)
615{
616 NTSTATUS ret;
617
618 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
619 return ret;
620 }
621
622 id->type = ID_TYPE_UID;
623 return alloc_methods->allocate_id(id);
624}
625
626NTSTATUS idmap_allocate_gid(struct unixid *id)
627{
628 NTSTATUS ret;
629
630 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
631 return ret;
632 }
633
634 id->type = ID_TYPE_GID;
635 return alloc_methods->allocate_id(id);
636}
637
638NTSTATUS idmap_set_uid_hwm(struct unixid *id)
639{
640 NTSTATUS ret;
641
642 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
643 return ret;
644 }
645
646 id->type = ID_TYPE_UID;
647 return alloc_methods->set_id_hwm(id);
648}
649
650NTSTATUS idmap_set_gid_hwm(struct unixid *id)
651{
652 NTSTATUS ret;
653
654 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
655 return ret;
656 }
657
658 id->type = ID_TYPE_GID;
659 return alloc_methods->set_id_hwm(id);
660}
661
662/******************************************************************************
663 Lookup an idmap_domain give a full user or group SID
664 ******************************************************************************/
665
666static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
667{
668 DOM_SID domain_sid;
669 uint32 rid;
670 struct winbindd_domain *domain = NULL;
671 int i;
672
673 /* 1. Handle BUILTIN or Special SIDs and prevent them from
674 falling into the default domain space (if we have a
675 configured passdb backend. */
676
677 if ( (pdb_dom_num != -1) &&
678 (sid_check_is_in_builtin(account_sid) ||
679 sid_check_is_in_wellknown_domain(account_sid)) )
680 {
681 return idmap_domains[pdb_dom_num];
682 }
683
684 /* 2. Lookup the winbindd_domain from the account_sid */
685
686 sid_copy( &domain_sid, account_sid );
687 sid_split_rid( &domain_sid, &rid );
688 domain = find_domain_from_sid_noinit( &domain_sid );
689
690 for (i = 0; domain && i < num_domains; i++) {
691 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
692 return idmap_domains[i];
693 }
694 }
695
696 /* 3. Fall back to the default domain */
697
698 if ( def_dom_num != -1 ) {
699 return idmap_domains[def_dom_num];
700 }
701
702 return NULL;
703}
704
705/******************************************************************************
706 Lookup an index given an idmap_domain pointer
707 ******************************************************************************/
708
709static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
710{
711 int i;
712
713 for (i = 0; i < num_domains; i++) {
714 if ( idmap_domains[i] == id_domain )
715 return i;
716 }
717
718 return -1;
719}
720
721
722/*********************************************************
723 Check if creating a mapping is permitted for the domain
724*********************************************************/
725
726static NTSTATUS idmap_can_map(const struct id_map *map, struct idmap_domain **ret_dom)
727{
728 struct idmap_domain *dom;
729
730 /* Check we do not create mappings for our own local domain, or BUILTIN or special SIDs */
731 if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
732 sid_check_is_in_builtin(map->sid) ||
733 sid_check_is_in_wellknown_domain(map->sid)) {
734 DEBUG(10, ("We are not supposed to create mappings for our own domains (local, builtin, specials)\n"));
735 return NT_STATUS_UNSUCCESSFUL;
736 }
737
738 /* Special check for trusted domain only = Yes */
739 if (lp_winbind_trusted_domains_only()) {
740 struct winbindd_domain *wdom = find_our_domain();
741 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
742 DEBUG(10, ("We are not supposed to create mappings for our primary domain when <trusted domain only> is True\n"));
743 DEBUGADD(10, ("Leave [%s] unmapped\n", sid_string_static(map->sid)));
744 return NT_STATUS_UNSUCCESSFUL;
745 }
746 }
747
748 if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
749 /* huh, couldn't find a suitable domain, let's just leave it unmapped */
750 DEBUG(10, ("Could not find idmap backend for SID %s", sid_string_static(map->sid)));
751 return NT_STATUS_NO_SUCH_DOMAIN;
752 }
753
754 if (dom->readonly) {
755 /* ouch the domain is read only, let's just leave it unmapped */
756 DEBUG(10, ("idmap backend for SID %s is READONLY!\n", sid_string_static(map->sid)));
757 return NT_STATUS_UNSUCCESSFUL;
758 }
759
760 *ret_dom = dom;
761 return NT_STATUS_OK;
762}
763
764static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
765{
766 NTSTATUS ret;
767 struct idmap_domain *dom;
768 const char *domname, *name;
769 enum lsa_SidType sid_type;
770 BOOL wbret;
771
772 ret = idmap_can_map(map, &dom);
773 if ( ! NT_STATUS_IS_OK(ret)) {
774 return NT_STATUS_NONE_MAPPED;
775 }
776
777 /* by default calls to winbindd are disabled
778 the following call will not recurse so this is safe */
779 winbind_on();
780 wbret = winbind_lookup_sid(ctx, map->sid, &domname, &name, &sid_type);
781 winbind_off();
782
783 /* check if this is a valid SID and then map it */
784 if (wbret) {
785 switch (sid_type) {
786 case SID_NAME_USER:
787 ret = idmap_allocate_uid(&map->xid);
788 if ( ! NT_STATUS_IS_OK(ret)) {
789 /* can't allocate id, let's just leave it unmapped */
790 DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
791 return NT_STATUS_NONE_MAPPED;
792 }
793 break;
794 case SID_NAME_DOM_GRP:
795 case SID_NAME_ALIAS:
796 case SID_NAME_WKN_GRP:
797 ret = idmap_allocate_gid(&map->xid);
798 if ( ! NT_STATUS_IS_OK(ret)) {
799 /* can't allocate id, let's just leave it unmapped */
800 DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
801 return NT_STATUS_NONE_MAPPED;
802 }
803 break;
804 default:
805 /* invalid sid, let's just leave it unmapped */
806 DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid)));
807 return NT_STATUS_NONE_MAPPED;
808 }
809
810 /* ok, got a new id, let's set a mapping */
811 map->status = ID_MAPPED;
812
813 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
814 sid_string_static(map->sid),
815 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
816 (unsigned long)map->xid.id));
817 ret = dom->methods->set_mapping(dom, map);
818
819 if ( ! NT_STATUS_IS_OK(ret)) {
820 /* something wrong here :-( */
821 DEBUG(2, ("Failed to commit mapping\n!"));
822
823 /* TODO: would it make sense to have an "unalloc_id function?" */
824
825 return NT_STATUS_NONE_MAPPED;
826 }
827 } else {
828 DEBUG(2,("Invalid SID, not mapping %s (type %d)\n",
829 sid_string_static(map->sid), sid_type));
830 return NT_STATUS_NONE_MAPPED;
831 }
832
833 return NT_STATUS_OK;
834}
835
836static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
837{
838 struct idmap_domain *dom;
839 NTSTATUS ret;
840
841 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
842 sid_string_static(map->sid),
843 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
844 (unsigned long)map->xid.id));
845
846 ret = idmap_can_map(map, &dom);
847 if ( ! NT_STATUS_IS_OK(ret)) {
848 return ret;
849 }
850
851 DEBUG(10,("set_mapping for domain %s\n", dom->name ));
852
853 return dom->methods->set_mapping(dom, map);
854}
855
856static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
857{
858 struct idmap_domain *dom;
859 struct id_map **unmapped;
860 struct id_map **_ids;
861 TALLOC_CTX *ctx;
862 NTSTATUS ret;
863 int i, u, n;
864
865 if (!ids || !*ids) {
866 DEBUG(1, ("Invalid list of maps\n"));
867 return NT_STATUS_INVALID_PARAMETER;
868 }
869
870 ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
871 if ( ! ctx) {
872 DEBUG(0, ("Out of memory!\n"));
873 return NT_STATUS_NO_MEMORY;
874 }
875
876 DEBUG(10, ("Query backends to map ids->sids\n"));
877
878 /* start from the default (the last one) and then if there are still
879 * unmapped entries cycle through the others */
880
881 _ids = ids;
882
883 /* make sure all maps are marked as in UNKNOWN status */
884 for (i = 0; _ids[i]; i++) {
885 _ids[i]->status = ID_UNKNOWN;
886 }
887
888 unmapped = NULL;
889 for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
890
891 dom = idmap_domains[n];
892
893 DEBUG(10, ("Query sids from domain %s\n", dom->name));
894
895 ret = dom->methods->unixids_to_sids(dom, _ids);
896 IDMAP_CHECK_RET(ret);
897
898 unmapped = NULL;
899
900 for (i = 0, u = 0; _ids[i]; i++) {
901 if (_ids[i]->status == ID_UNKNOWN || _ids[i]->status == ID_UNMAPPED) {
902 unmapped = talloc_realloc(ctx, unmapped, struct id_map *, u + 2);
903 IDMAP_CHECK_ALLOC(unmapped);
904 unmapped[u] = _ids[i];
905 u++;
906 }
907 }
908 if (unmapped) {
909 /* terminate the unmapped list */
910 unmapped[u] = NULL;
911 } else { /* no more entries, get out */
912 break;
913 }
914
915 _ids = unmapped;
916
917 }
918
919 if (unmapped) {
920 /* there are still unmapped ids, map them to the unix users/groups domains */
921 for (i = 0; unmapped[i]; i++) {
922 switch (unmapped[i]->xid.type) {
923 case ID_TYPE_UID:
924 uid_to_unix_users_sid((uid_t)unmapped[i]->xid.id, unmapped[i]->sid);
925 unmapped[i]->status = ID_MAPPED;
926 break;
927 case ID_TYPE_GID:
928 gid_to_unix_groups_sid((gid_t)unmapped[i]->xid.id, unmapped[i]->sid);
929 unmapped[i]->status = ID_MAPPED;
930 break;
931 default: /* what?! */
932 unmapped[i]->status = ID_UNKNOWN;
933 break;
934 }
935 }
936 }
937
938 ret = NT_STATUS_OK;
939
940done:
941 talloc_free(ctx);
942 return ret;
943}
944
945static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
946{
947 struct id_map ***dom_ids;
948 struct idmap_domain *dom;
949 TALLOC_CTX *ctx;
950 NTSTATUS ret;
951 int i, *counters;
952
953 if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
954 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
955 return NT_STATUS_NO_MEMORY;
956 }
957
958 DEBUG(10, ("Query backends to map sids->ids\n"));
959
960 /* split list per domain */
961
962 dom_ids = talloc_zero_array(ctx, struct id_map **, num_domains);
963 IDMAP_CHECK_ALLOC(dom_ids);
964 counters = talloc_zero_array(ctx, int, num_domains);
965
966 /* partition the requests by domain */
967
968 for (i = 0; ids[i]; i++) {
969 uint32 idx;
970
971 /* make sure they are unknown to start off */
972 ids[i]->status = ID_UNKNOWN;
973
974 if ( (dom = find_idmap_domain_from_sid( ids[i]->sid )) == NULL ) {
975 /* no vailable idmap_domain. Move on */
976 continue;
977 }
978
979 DEBUG(10,("SID %s is being handled by %s\n",
980 sid_string_static(ids[i]->sid),
981 dom ? dom->name : "none" ));
982
983 idx = find_idmap_domain_index( dom );
984 SMB_ASSERT( idx != -1 );
985
986 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
987 struct id_map *, counters[idx] + 2);
988 IDMAP_CHECK_ALLOC(dom_ids[idx]);
989
990 dom_ids[idx][counters[idx]] = ids[i];
991 counters[idx]++;
992 dom_ids[idx][counters[idx]] = NULL;
993 }
994
995 /* All the ids have been dispatched in the right queues.
996 Let's cycle through the filled ones */
997
998 for (i = 0; i < num_domains; i++) {
999 if (dom_ids[i]) {
1000 dom = idmap_domains[i];
1001 DEBUG(10, ("Query ids from domain %s\n", dom->name));
1002 ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1003 IDMAP_CHECK_RET(ret);
1004 }
1005 }
1006
1007 /* ok all the backends have been contacted at this point */
1008 /* let's see if we have any unmapped SID left and act accordingly */
1009
1010 for (i = 0; ids[i]; i++) {
1011 if (ids[i]->status == ID_UNKNOWN || ids[i]->status == ID_UNMAPPED) {
1012 /* ok this is an unmapped one, see if we can map it */
1013 ret = idmap_new_mapping(ctx, ids[i]);
1014 if (NT_STATUS_IS_OK(ret)) {
1015 /* successfully mapped */
1016 ids[i]->status = ID_MAPPED;
1017 } else if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1018 /* could not map it */
1019 ids[i]->status = ID_UNMAPPED;
1020 } else {
1021 /* Something very bad happened down there */
1022 ids[i]->status = ID_UNKNOWN;
1023 }
1024 }
1025 }
1026
1027 ret = NT_STATUS_OK;
1028
1029done:
1030 talloc_free(ctx);
1031 return ret;
1032}
1033
1034/**************************************************************************
1035 idmap interface functions
1036**************************************************************************/
1037
1038NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1039{
1040 TALLOC_CTX *ctx;
1041 NTSTATUS ret;
1042 struct id_map **bids;
1043 int i, bi;
1044 int bn = 0;
1045
1046 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1047 return ret;
1048 }
1049
1050 if (!ids || !*ids) {
1051 DEBUG(1, ("Invalid list of maps\n"));
1052 return NT_STATUS_INVALID_PARAMETER;
1053 }
1054
1055 ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1056 if ( ! ctx) {
1057 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1058 return NT_STATUS_NO_MEMORY;
1059 }
1060
1061 /* no ids to be asked to the backends by default */
1062 bids = NULL;
1063 bi = 0;
1064
1065 for (i = 0; ids[i]; i++) {
1066
1067 if ( ! ids[i]->sid) {
1068 DEBUG(1, ("invalid null SID in id_map array"));
1069 talloc_free(ctx);
1070 return NT_STATUS_INVALID_PARAMETER;
1071 }
1072
1073 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1074
1075 if ( ! NT_STATUS_IS_OK(ret)) {
1076
1077 if ( ! bids) {
1078 /* alloc space for ids to be resolved by backends (realloc ten by ten) */
1079 bids = talloc_array(ctx, struct id_map *, 10);
1080 if ( ! bids) {
1081 DEBUG(1, ("Out of memory!\n"));
1082 talloc_free(ctx);
1083 return NT_STATUS_NO_MEMORY;
1084 }
1085 bn = 10;
1086 }
1087
1088 /* add this id to the ones to be retrieved from the backends */
1089 bids[bi] = ids[i];
1090 bi++;
1091
1092 /* check if we need to allocate new space on the rids array */
1093 if (bi == bn) {
1094 bn += 10;
1095 bids = talloc_realloc(ctx, bids, struct id_map *, bn);
1096 if ( ! bids) {
1097 DEBUG(1, ("Out of memory!\n"));
1098 talloc_free(ctx);
1099 return NT_STATUS_NO_MEMORY;
1100 }
1101 }
1102
1103 /* make sure the last element is NULL */
1104 bids[bi] = NULL;
1105 }
1106 }
1107
1108 /* let's see if there is any id mapping to be retieved from the backends */
1109 if (bi) {
1110 /* Only do query if we are online */
1111 if ( lp_winbind_offline_logon() &&
1112 get_global_winbindd_state_offline() )
1113 {
1114 ret = NT_STATUS_FILE_IS_OFFLINE;
1115 goto done;
1116 }
1117
1118 ret = idmap_backends_unixids_to_sids(bids);
1119 IDMAP_CHECK_RET(ret);
1120
1121 /* update the cache */
1122 for (i = 0; i < bi; i++) {
1123 if (bids[i]->status == ID_MAPPED) {
1124 ret = idmap_cache_set(idmap_cache, bids[i]);
1125 } else if (bids[i]->status == ID_UNKNOWN) {
1126 /* return an expired entry in the cache or an unknown */
1127 /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1128 * for disconnected mode */
1129 idmap_cache_map_id(idmap_cache, ids[i]);
1130 } else { /* unmapped */
1131 ret = idmap_cache_set_negative_id(idmap_cache, bids[i]);
1132 }
1133 IDMAP_CHECK_RET(ret);
1134 }
1135 }
1136
1137 ret = NT_STATUS_OK;
1138done:
1139 talloc_free(ctx);
1140 return ret;
1141}
1142
1143NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1144{
1145 TALLOC_CTX *ctx;
1146 NTSTATUS ret;
1147 struct id_map **bids;
1148 int i, bi;
1149 int bn = 0;
1150
1151 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1152 return ret;
1153 }
1154
1155 if (!ids || !*ids) {
1156 DEBUG(1, ("Invalid list of maps\n"));
1157 return NT_STATUS_INVALID_PARAMETER;
1158 }
1159
1160 ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1161 if ( ! ctx) {
1162 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1163 return NT_STATUS_NO_MEMORY;
1164 }
1165
1166 /* no ids to be asked to the backends by default */
1167 bids = NULL;
1168 bi = 0;
1169
1170 for (i = 0; ids[i]; i++) {
1171
1172 if ( ! ids[i]->sid) {
1173 DEBUG(1, ("invalid null SID in id_map array\n"));
1174 talloc_free(ctx);
1175 return NT_STATUS_INVALID_PARAMETER;
1176 }
1177
1178 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1179
1180 if ( ! NT_STATUS_IS_OK(ret)) {
1181
1182 if ( ! bids) {
1183 /* alloc space for ids to be resolved
1184 by backends (realloc ten by ten) */
1185 bids = talloc_array(ctx, struct id_map *, 10);
1186 if ( ! bids) {
1187 DEBUG(1, ("Out of memory!\n"));
1188 talloc_free(ctx);
1189 return NT_STATUS_NO_MEMORY;
1190 }
1191 bn = 10;
1192 }
1193
1194 /* add this id to the ones to be retrieved from the backends */
1195 bids[bi] = ids[i];
1196 bi++;
1197
1198 /* check if we need to allocate new space on the ids array */
1199 if (bi == bn) {
1200 bn += 10;
1201 bids = talloc_realloc(ctx, bids, struct id_map *, bn);
1202 if ( ! bids) {
1203 DEBUG(1, ("Out of memory!\n"));
1204 talloc_free(ctx);
1205 return NT_STATUS_NO_MEMORY;
1206 }
1207 }
1208
1209 /* make sure the last element is NULL */
1210 bids[bi] = NULL;
1211 }
1212 }
1213
1214 /* let's see if there is any id mapping to be retieved from the backends */
1215 if (bids) {
1216 /* Only do query if we are online */
1217 if ( lp_winbind_offline_logon() &&
1218 get_global_winbindd_state_offline() )
1219 {
1220 ret = NT_STATUS_FILE_IS_OFFLINE;
1221 goto done;
1222 }
1223
1224 ret = idmap_backends_sids_to_unixids(bids);
1225 IDMAP_CHECK_RET(ret);
1226
1227 /* update the cache */
1228 for (i = 0; bids[i]; i++) {
1229 if (bids[i]->status == ID_MAPPED) {
1230 ret = idmap_cache_set(idmap_cache, bids[i]);
1231 } else if (bids[i]->status == ID_UNKNOWN) {
1232 /* return an expired entry in the cache or an unknown */
1233 /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1234 * for disconnected mode */
1235 idmap_cache_map_id(idmap_cache, ids[i]);
1236 } else {
1237 ret = idmap_cache_set_negative_sid(idmap_cache, bids[i]);
1238 }
1239 IDMAP_CHECK_RET(ret);
1240 }
1241 }
1242
1243 ret = NT_STATUS_OK;
1244done:
1245 talloc_free(ctx);
1246 return ret;
1247}
1248
1249NTSTATUS idmap_set_mapping(const struct id_map *id)
1250{
1251 TALLOC_CTX *ctx;
1252 NTSTATUS ret;
1253
1254 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1255 return ret;
1256 }
1257
1258 /* sanity checks */
1259 if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1260 DEBUG(1, ("NULL SID or unmapped entry\n"));
1261 return NT_STATUS_INVALID_PARAMETER;
1262 }
1263
1264 /* TODO: check uid/gid range ? */
1265
1266 ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1267 if ( ! ctx) {
1268 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1269 return NT_STATUS_NO_MEMORY;
1270 }
1271
1272 /* set the new mapping */
1273 ret = idmap_backends_set_mapping(id);
1274 IDMAP_CHECK_RET(ret);
1275
1276 /* set the mapping in the cache */
1277 ret = idmap_cache_set(idmap_cache, id);
1278 IDMAP_CHECK_RET(ret);
1279
1280done:
1281 talloc_free(ctx);
1282 return ret;
1283}
1284
1285/**************************************************************************
1286 Dump backend status.
1287**************************************************************************/
1288
1289void idmap_dump_maps(char *logfile)
1290{
1291 NTSTATUS ret;
1292 struct unixid allid;
1293 struct id_map *maps;
1294 int num_maps;
1295 FILE *dump;
1296 int i;
1297
1298 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1299 return;
1300 }
1301
1302 dump = fopen(logfile, "w");
1303 if ( ! dump) {
1304 DEBUG(0, ("Unable to open open stream for file [%s], errno: %d\n", logfile, errno));
1305 return;
1306 }
1307
1308 allid.type = ID_TYPE_UID;
1309 allid.id = 0;
1310 alloc_methods->get_id_hwm(&allid);
1311 fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
1312
1313 allid.type = ID_TYPE_GID;
1314 allid.id = 0;
1315 alloc_methods->get_id_hwm(&allid);
1316 fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
1317
1318 maps = talloc(idmap_ctx, struct id_map);
1319 num_maps = 0;
1320
1321 for (i = 0; i < num_domains; i++) {
1322 if (idmap_domains[i]->methods->dump_data) {
1323 idmap_domains[i]->methods->dump_data(idmap_domains[i], &maps, &num_maps);
1324 }
1325 }
1326
1327 for (i = 0; i < num_maps; i++) {
1328 switch (maps[i].xid.type) {
1329 case ID_TYPE_UID:
1330 fprintf(dump, "UID %lu %s\n",
1331 (unsigned long)maps[i].xid.id,
1332 sid_string_static(maps[i].sid));
1333 break;
1334 case ID_TYPE_GID:
1335 fprintf(dump, "GID %lu %s\n",
1336 (unsigned long)maps[i].xid.id,
1337 sid_string_static(maps[i].sid));
1338 break;
1339 }
1340 }
1341
1342 fflush(dump);
1343 fclose(dump);
1344}
1345
1346char *idmap_fetch_secret(const char *backend, bool alloc,
1347 const char *domain, const char *identity)
1348{
1349 char *tmp, *ret;
1350 int r;
1351
1352 if (alloc) {
1353 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1354 } else {
1355 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1356 }
1357
1358 if (r < 0)
1359 return NULL;
1360
1361 strupper_m(tmp); /* make sure the key is case insensitive */
1362 ret = secrets_fetch_generic(tmp, identity);
1363
1364 SAFE_FREE( tmp );
1365
1366 return ret;
1367}
Note: See TracBrowser for help on using the repository browser.