source: vendor/3.6.0/source3/winbindd/idmap_util.c

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago

Samba Server: update vendor to 3.6.0
File size: 8.5 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Simo Sorce 2003
5 Copyright (C) Jeremy Allison 2006
6 Copyright (C) Michael Adam 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
20
21#include "includes.h"
22#include "winbindd.h"
23#include "winbindd_proto.h"
24#include "idmap.h"
25#include "idmap_cache.h"
26#include "../libcli/security/security.h"
27
28#undef DBGC_CLASS
29#define DBGC_CLASS DBGC_IDMAP
30
31/*****************************************************************
32 Returns the SID mapped to the given UID.
33 If mapping is not possible returns an error.
34*****************************************************************/
35
36NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid)
37{
38 NTSTATUS ret;
39 struct id_map map;
40 bool expired;
41
42 DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
43 (unsigned long)uid, domname?domname:"NULL"));
44
45 if (winbindd_use_idmap_cache()
46 && idmap_cache_find_uid2sid(uid, sid, &expired)) {
47 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
48 (unsigned int)uid,
49 expired ? " (expired)": ""));
50 if (expired && idmap_is_online()) {
51 DEBUG(10, ("revalidating expired entry\n"));
52 goto backend;
53 }
54 if (is_null_sid(sid)) {
55 DEBUG(10, ("Returning negative cache entry\n"));
56 return NT_STATUS_NONE_MAPPED;
57 }
58 DEBUG(10, ("Returning positive cache entry\n"));
59 return NT_STATUS_OK;
60 }
61
62backend:
63 map.sid = sid;
64 map.xid.type = ID_TYPE_UID;
65 map.xid.id = uid;
66
67 ret = idmap_backends_unixid_to_sid(domname, &map);
68 if ( ! NT_STATUS_IS_OK(ret)) {
69 DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid));
70 return ret;
71 }
72
73 if (map.status != ID_MAPPED) {
74 if (winbindd_use_idmap_cache()) {
75 struct dom_sid null_sid;
76 ZERO_STRUCT(null_sid);
77 idmap_cache_set_sid2uid(&null_sid, uid);
78 }
79 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
80 return NT_STATUS_NONE_MAPPED;
81 }
82
83 if (winbindd_use_idmap_cache()) {
84 idmap_cache_set_sid2uid(sid, uid);
85 }
86
87 return NT_STATUS_OK;
88}
89
90/*****************************************************************
91 Returns SID mapped to the given GID.
92 If mapping is not possible returns an error.
93*****************************************************************/
94
95NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid)
96{
97 NTSTATUS ret;
98 struct id_map map;
99 bool expired;
100
101 DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
102 (unsigned long)gid, domname?domname:"NULL"));
103
104 if (winbindd_use_idmap_cache()
105 && idmap_cache_find_gid2sid(gid, sid, &expired)) {
106 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
107 (unsigned int)gid,
108 expired ? " (expired)": ""));
109 if (expired && idmap_is_online()) {
110 DEBUG(10, ("revalidating expired entry\n"));
111 goto backend;
112 }
113 if (is_null_sid(sid)) {
114 DEBUG(10, ("Returning negative cache entry\n"));
115 return NT_STATUS_NONE_MAPPED;
116 }
117 DEBUG(10, ("Returning positive cache entry\n"));
118 return NT_STATUS_OK;
119 }
120
121backend:
122 map.sid = sid;
123 map.xid.type = ID_TYPE_GID;
124 map.xid.id = gid;
125
126 ret = idmap_backends_unixid_to_sid(domname, &map);
127 if ( ! NT_STATUS_IS_OK(ret)) {
128 DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid));
129 return ret;
130 }
131
132 if (map.status != ID_MAPPED) {
133 if (winbindd_use_idmap_cache()) {
134 struct dom_sid null_sid;
135 ZERO_STRUCT(null_sid);
136 idmap_cache_set_sid2gid(&null_sid, gid);
137 }
138 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
139 return NT_STATUS_NONE_MAPPED;
140 }
141
142 if (winbindd_use_idmap_cache()) {
143 idmap_cache_set_sid2gid(sid, gid);
144 }
145
146 return NT_STATUS_OK;
147}
148
149/*****************************************************************
150 Returns the UID mapped to the given SID.
151 If mapping is not possible or SID maps to a GID returns an error.
152*****************************************************************/
153
154NTSTATUS idmap_sid_to_uid(const char *dom_name, struct dom_sid *sid, uid_t *uid)
155{
156 NTSTATUS ret;
157 struct id_map map;
158 bool expired;
159
160 DEBUG(10,("idmap_sid_to_uid: sid = [%s], domain = '%s'\n",
161 sid_string_dbg(sid), dom_name));
162
163 if (winbindd_use_idmap_cache()
164 && idmap_cache_find_sid2uid(sid, uid, &expired)) {
165 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
166 (int)(*uid), expired ? " (expired)": ""));
167 if (expired && idmap_is_online()) {
168 DEBUG(10, ("revalidating expired entry\n"));
169 goto backend;
170 }
171 if ((*uid) == -1) {
172 DEBUG(10, ("Returning negative cache entry\n"));
173 return NT_STATUS_NONE_MAPPED;
174 }
175 DEBUG(10, ("Returning positive cache entry\n"));
176 return NT_STATUS_OK;
177 }
178
179backend:
180 map.sid = sid;
181 map.xid.type = ID_TYPE_UID;
182
183 ret = idmap_backends_sid_to_unixid(dom_name, &map);
184
185 if (!NT_STATUS_IS_OK(ret)) {
186 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
187 nt_errstr(ret)));
188 if (winbindd_use_idmap_cache()) {
189 idmap_cache_set_sid2uid(sid, -1);
190 }
191 return ret;
192 }
193
194 if (map.status != ID_MAPPED) {
195 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
196 if (winbindd_use_idmap_cache()) {
197 idmap_cache_set_sid2uid(sid, -1);
198 }
199 return NT_STATUS_NONE_MAPPED;
200 }
201
202 if (map.xid.type != ID_TYPE_UID) {
203 DEBUG(10, ("sid [%s] not mapped to a uid "
204 "[%u,%u,%u]\n",
205 sid_string_dbg(sid),
206 map.status,
207 map.xid.type,
208 map.xid.id));
209 if (winbindd_use_idmap_cache()) {
210 idmap_cache_set_sid2uid(sid, -1);
211 }
212 return NT_STATUS_NONE_MAPPED;
213 }
214
215 *uid = (uid_t)map.xid.id;
216 if (winbindd_use_idmap_cache()) {
217 idmap_cache_set_sid2uid(sid, *uid);
218 }
219 return NT_STATUS_OK;
220}
221
222/*****************************************************************
223 Returns the GID mapped to the given SID.
224 If mapping is not possible or SID maps to a UID returns an error.
225*****************************************************************/
226
227NTSTATUS idmap_sid_to_gid(const char *domname, struct dom_sid *sid, gid_t *gid)
228{
229 NTSTATUS ret;
230 struct id_map map;
231 bool expired;
232
233 DEBUG(10,("idmap_sid_to_gid: sid = [%s], domain = '%s'\n",
234 sid_string_dbg(sid), domname));
235
236 if (winbindd_use_idmap_cache()
237 && idmap_cache_find_sid2gid(sid, gid, &expired)) {
238 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
239 (int)(*gid), expired ? " (expired)": ""));
240 if (expired && idmap_is_online()) {
241 DEBUG(10, ("revalidating expired entry\n"));
242 goto backend;
243 }
244 if ((*gid) == -1) {
245 DEBUG(10, ("Returning negative cache entry\n"));
246 return NT_STATUS_NONE_MAPPED;
247 }
248 DEBUG(10, ("Returning positive cache entry\n"));
249 return NT_STATUS_OK;
250 }
251
252backend:
253 map.sid = sid;
254 map.xid.type = ID_TYPE_GID;
255
256 ret = idmap_backends_sid_to_unixid(domname, &map);
257
258 if (!NT_STATUS_IS_OK(ret)) {
259 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
260 nt_errstr(ret)));
261 if (winbindd_use_idmap_cache()) {
262 idmap_cache_set_sid2gid(sid, -1);
263 }
264 return ret;
265 }
266
267 if (map.status != ID_MAPPED) {
268 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
269 if (winbindd_use_idmap_cache()) {
270 idmap_cache_set_sid2gid(sid, -1);
271 }
272 return NT_STATUS_NONE_MAPPED;
273 }
274
275 if (map.xid.type != ID_TYPE_GID) {
276 DEBUG(10, ("sid [%s] not mapped to a gid "
277 "[%u,%u,%u]\n",
278 sid_string_dbg(sid),
279 map.status,
280 map.xid.type,
281 map.xid.id));
282 if (winbindd_use_idmap_cache()) {
283 idmap_cache_set_sid2gid(sid, -1);
284 }
285 return NT_STATUS_NONE_MAPPED;
286 }
287
288 *gid = map.xid.id;
289 if (winbindd_use_idmap_cache()) {
290 idmap_cache_set_sid2gid(sid, *gid);
291 }
292 return NT_STATUS_OK;
293}
294
295/**
296 * check whether a given unix id is inside the filter range of an idmap domain
297 */
298bool idmap_unix_id_is_in_range(uint32_t id, struct idmap_domain *dom)
299{
300 if (id == 0) {
301 /* 0 is not an allowed unix id for id mapping */
302 return false;
303 }
304
305 if ((dom->low_id && (id < dom->low_id)) ||
306 (dom->high_id && (id > dom->high_id)))
307 {
308 return false;
309 }
310
311 return true;
312}
Note: See TracBrowser for help on using the repository browser.