source: vendor/3.6.9/source3/utils/net_idmap.c

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago

Samba Server: update vendor to 3.6.0
File size: 17.6 KB
Line 
1/*
2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2003 Andrew Bartlett (abartlet@samba.org)
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20#include "includes.h"
21#include "system/filesys.h"
22#include "utils/net.h"
23#include "secrets.h"
24#include "idmap.h"
25#include "dbwrap.h"
26#include "../libcli/security/security.h"
27#include "net_idmap_check.h"
28#include "util_tdb.h"
29
30#define ALLOC_CHECK(mem) do { \
31 if (!mem) { \
32 d_fprintf(stderr, _("Out of memory!\n")); \
33 talloc_free(ctx); \
34 return -1; \
35 } } while(0)
36
37/***********************************************************
38 Helper function for net_idmap_dump. Dump one entry.
39 **********************************************************/
40static int net_idmap_dump_one_entry(struct db_record *rec,
41 void *unused)
42{
43 if (strcmp((char *)rec->key.dptr, "USER HWM") == 0) {
44 printf(_("USER HWM %d\n"), IVAL(rec->value.dptr,0));
45 return 0;
46 }
47
48 if (strcmp((char *)rec->key.dptr, "GROUP HWM") == 0) {
49 printf(_("GROUP HWM %d\n"), IVAL(rec->value.dptr,0));
50 return 0;
51 }
52
53 if (strncmp((char *)rec->key.dptr, "S-", 2) != 0)
54 return 0;
55
56 printf("%s %s\n", rec->value.dptr, rec->key.dptr);
57 return 0;
58}
59
60static const char* net_idmap_dbfile(struct net_context *c)
61{
62 const char* dbfile = NULL;
63
64 if (c->opt_db != NULL) {
65 dbfile = talloc_strdup(talloc_tos(), c->opt_db);
66 if (dbfile == NULL) {
67 d_fprintf(stderr, _("Out of memory!\n"));
68 }
69 } else if (strequal(lp_idmap_backend(), "tdb")) {
70 dbfile = state_path("winbindd_idmap.tdb");
71 if (dbfile == NULL) {
72 d_fprintf(stderr, _("Out of memory!\n"));
73 }
74 } else if (strequal(lp_idmap_backend(), "tdb2")) {
75 dbfile = lp_parm_talloc_string(-1, "tdb", "idmap2.tdb", NULL);
76 if (dbfile == NULL) {
77 dbfile = talloc_asprintf(talloc_tos(), "%s/idmap2.tdb",
78 lp_private_dir());
79 }
80 if (dbfile == NULL) {
81 d_fprintf(stderr, _("Out of memory!\n"));
82 }
83 } else {
84 char* backend = talloc_strdup(talloc_tos(), lp_idmap_backend());
85 char* args = strchr(backend, ':');
86 if (args != NULL) {
87 *args = '\0';
88 }
89
90 d_printf(_("Sorry, 'idmap backend = %s' is currently not supported\n"),
91 backend);
92
93 talloc_free(backend);
94 }
95
96 return dbfile;
97}
98
99/***********************************************************
100 Dump the current idmap
101 **********************************************************/
102static int net_idmap_dump(struct net_context *c, int argc, const char **argv)
103{
104 struct db_context *db;
105 TALLOC_CTX *mem_ctx;
106 const char* dbfile;
107 int ret = -1;
108
109 if ( argc > 1 || c->display_usage) {
110 d_printf("%s\n%s",
111 _("Usage:"),
112 _("net idmap dump [[--db=]<inputfile>]\n"
113 " Dump current ID mapping.\n"
114 " inputfile\tTDB file to read mappings from.\n"));
115 return c->display_usage?0:-1;
116 }
117
118 mem_ctx = talloc_stackframe();
119
120 dbfile = (argc > 0) ? argv[0] : net_idmap_dbfile(c);
121 if (dbfile == NULL) {
122 goto done;
123 }
124 d_fprintf(stderr, _("dumping id mapping from %s\n"), dbfile);
125
126 db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDONLY, 0);
127 if (db == NULL) {
128 d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
129 dbfile, strerror(errno));
130 goto done;
131 }
132
133 db->traverse_read(db, net_idmap_dump_one_entry, NULL);
134 ret = 0;
135
136done:
137 talloc_free(mem_ctx);
138 return ret;
139}
140
141/***********************************************************
142 Write entries from stdin to current local idmap
143 **********************************************************/
144
145static int net_idmap_store_id_mapping(struct db_context *db,
146 enum id_type type,
147 unsigned long idval,
148 const char *sid_string)
149{
150 NTSTATUS status;
151 char *idstr = NULL;
152
153 switch(type) {
154 case ID_TYPE_UID:
155 idstr = talloc_asprintf(talloc_tos(), "UID %lu", idval);
156 break;
157 case ID_TYPE_GID:
158 idstr = talloc_asprintf(talloc_tos(), "GID %lu", idval);
159 break;
160 default:
161 d_fprintf(stderr, "Invalid id mapping type: %d\n", type);
162 return -1;
163 }
164
165 status = dbwrap_store_bystring(db, idstr,
166 string_term_tdb_data(sid_string),
167 TDB_REPLACE);
168 if (!NT_STATUS_IS_OK(status)) {
169 d_fprintf(stderr, "Error storing ID -> SID: "
170 "%s\n", nt_errstr(status));
171 talloc_free(idstr);
172 return -1;
173 }
174 status = dbwrap_store_bystring(db, sid_string,
175 string_term_tdb_data(idstr),
176 TDB_REPLACE);
177 if (!NT_STATUS_IS_OK(status)) {
178 d_fprintf(stderr, "Error storing SID -> ID: "
179 "%s\n", nt_errstr(status));
180 talloc_free(idstr);
181 return -1;
182 }
183
184 return 0;
185}
186
187static int net_idmap_restore(struct net_context *c, int argc, const char **argv)
188{
189 TALLOC_CTX *mem_ctx;
190 FILE *input = NULL;
191 struct db_context *db;
192 const char *dbfile = NULL;
193 int ret = 0;
194
195 if (c->display_usage) {
196 d_printf("%s\n%s",
197 _("Usage:"),
198 _("net idmap restore [--db=<TDB>] [<inputfile>]\n"
199 " Restore ID mappings from file\n"
200 " TDB\tFile to store ID mappings to."
201 " inputfile\tFile to load ID mappings from. If not "
202 "given, load data from stdin.\n"));
203 return 0;
204 }
205
206 mem_ctx = talloc_stackframe();
207
208 dbfile = net_idmap_dbfile(c);
209
210 if (dbfile == NULL) {
211 ret = -1;
212 goto done;
213 }
214
215 d_fprintf(stderr, _("restoring id mapping to %s\n"), dbfile);
216
217 if (argc == 1) {
218 input = fopen(argv[0], "r");
219 if (input == NULL) {
220 d_fprintf(stderr, _("Could not open input file (%s): %s\n"),
221 argv[0], strerror(errno));
222 ret = -1;
223 goto done;
224 }
225 } else {
226 input = stdin;
227 }
228
229 db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644);
230 if (db == NULL) {
231 d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
232 dbfile, strerror(errno));
233 ret = -1;
234 goto done;
235 }
236
237 if (db->transaction_start(db) != 0) {
238 d_fprintf(stderr, _("Failed to start transaction.\n"));
239 ret = -1;
240 goto done;
241 }
242
243 while (!feof(input)) {
244 char line[128], sid_string[128];
245 int len;
246 unsigned long idval;
247
248 if (fgets(line, 127, input) == NULL)
249 break;
250
251 len = strlen(line);
252
253 if ( (len > 0) && (line[len-1] == '\n') )
254 line[len-1] = '\0';
255
256 if (sscanf(line, "GID %lu %128s", &idval, sid_string) == 2)
257 {
258 ret = net_idmap_store_id_mapping(db, ID_TYPE_GID,
259 idval, sid_string);
260 if (ret != 0) {
261 break;
262 }
263 } else if (sscanf(line, "UID %lu %128s", &idval, sid_string) == 2)
264 {
265 ret = net_idmap_store_id_mapping(db, ID_TYPE_UID,
266 idval, sid_string);
267 if (ret != 0) {
268 break;
269 }
270 } else if (sscanf(line, "USER HWM %lu", &idval) == 1) {
271 ret = dbwrap_store_int32(db, "USER HWM", idval);
272 if (ret != 0) {
273 d_fprintf(stderr, _("Could not store USER HWM.\n"));
274 break;
275 }
276 } else if (sscanf(line, "GROUP HWM %lu", &idval) == 1) {
277 ret = dbwrap_store_int32(db, "GROUP HWM", idval);
278 if (ret != 0) {
279 d_fprintf(stderr,
280 _("Could not store GROUP HWM.\n"));
281 break;
282 }
283 } else {
284 d_fprintf(stderr, _("ignoring invalid line [%s]\n"),
285 line);
286 continue;
287 }
288 }
289
290 if (ret == 0) {
291 if(db->transaction_commit(db) != 0) {
292 d_fprintf(stderr, _("Failed to commit transaction.\n"));
293 ret = -1;
294 }
295 } else {
296 if (db->transaction_cancel(db) != 0) {
297 d_fprintf(stderr, _("Failed to cancel transaction.\n"));
298 }
299 }
300
301done:
302 if ((input != NULL) && (input != stdin)) {
303 fclose(input);
304 }
305
306 talloc_free(mem_ctx);
307 return ret;
308}
309
310static
311NTSTATUS dbwrap_delete_mapping(struct db_context *db, TDB_DATA key1, bool force)
312{
313 TALLOC_CTX* mem_ctx = talloc_tos();
314 struct db_record *rec1=NULL, *rec2=NULL;
315 TDB_DATA key2;
316 bool is_valid_mapping;
317 NTSTATUS status = NT_STATUS_OK;
318
319 rec1 = db->fetch_locked(db, mem_ctx, key1);
320 if (rec1 == NULL) {
321 DEBUG(1, ("failed to fetch: %.*s\n", (int)key1.dsize, key1.dptr));
322 status = NT_STATUS_NO_MEMORY;
323 goto done;
324 }
325 key2 = rec1->value;
326 if (key2.dptr == NULL) {
327 DEBUG(1, ("could not find %.*s\n", (int)key1.dsize, key1.dptr));
328 status = NT_STATUS_NOT_FOUND;
329 goto done;
330 }
331
332 DEBUG(2, ("mapping: %.*s -> %.*s\n",
333 (int)key1.dsize, key1.dptr, (int)key2.dsize, key2.dptr));
334
335 rec2 = db->fetch_locked(db, mem_ctx, key2);
336 if (rec2 == NULL) {
337 DEBUG(1, ("failed to fetch: %.*s\n", (int)key2.dsize, key2.dptr));
338 status = NT_STATUS_NO_MEMORY;
339 goto done;
340 }
341
342 is_valid_mapping = tdb_data_equal(key1, rec2->value);
343
344 if (!is_valid_mapping) {
345 DEBUG(1, ("invalid mapping: %.*s -> %.*s -> %.*s\n",
346 (int)key1.dsize, key1.dptr, (int)key2.dsize, key2.dptr,
347 (int)rec2->value.dsize, rec2->value.dptr ));
348 if ( !force ) {
349 status = NT_STATUS_FILE_INVALID;
350 goto done;
351 }
352 }
353
354 status = rec1->delete_rec(rec1);
355 if (!NT_STATUS_IS_OK(status)) {
356 DEBUG(1, ("failed to delete: %.*s\n", (int)key1.dsize, key1.dptr));
357 goto done;
358 }
359
360 if (is_valid_mapping) {
361 status = rec2->delete_rec(rec2);
362 if (!NT_STATUS_IS_OK(status)) {
363 DEBUG(1, ("failed to delete: %.*s\n", (int)key2.dsize, key2.dptr));
364 }
365 }
366done:
367 TALLOC_FREE(rec1);
368 TALLOC_FREE(rec2);
369 return status;
370}
371
372static
373NTSTATUS delete_mapping_action(struct db_context *db, void* data)
374{
375 return dbwrap_delete_mapping(db, *(TDB_DATA*)data, false);
376}
377static
378NTSTATUS delete_mapping_action_force(struct db_context *db, void* data)
379{
380 return dbwrap_delete_mapping(db, *(TDB_DATA*)data, true);
381}
382
383/***********************************************************
384 Delete a SID mapping from a winbindd_idmap.tdb
385 **********************************************************/
386static bool delete_args_ok(int argc, const char **argv)
387{
388 if (argc != 1)
389 return false;
390 if (strncmp(argv[0], "S-", 2) == 0)
391 return true;
392 if (strncmp(argv[0], "GID ", 4) == 0)
393 return true;
394 if (strncmp(argv[0], "UID ", 4) == 0)
395 return true;
396 return false;
397}
398
399static int net_idmap_delete(struct net_context *c, int argc, const char **argv)
400{
401 int ret = -1;
402 struct db_context *db;
403 TALLOC_CTX *mem_ctx;
404 TDB_DATA key;
405 NTSTATUS status;
406 const char* dbfile;
407
408 if ( !delete_args_ok(argc,argv) || c->display_usage) {
409 d_printf("%s\n%s",
410 _("Usage:"),
411 _("net idmap delete [-f] [--db=<TDB>] <ID>\n"
412 " Delete mapping of ID from TDB.\n"
413 " -f\tforce\n"
414 " TDB\tidmap database\n"
415 " ID\tSID|GID|UID\n"));
416 return c->display_usage ? 0 : -1;
417 }
418
419 mem_ctx = talloc_stackframe();
420
421 dbfile = net_idmap_dbfile(c);
422 if (dbfile == NULL) {
423 goto done;
424 }
425 d_fprintf(stderr, _("deleting id mapping from %s\n"), dbfile);
426
427 db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR, 0);
428 if (db == NULL) {
429 d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
430 dbfile, strerror(errno));
431 goto done;
432 }
433
434 key = string_term_tdb_data(argv[0]);
435
436 status = dbwrap_trans_do(db, (c->opt_force
437 ? delete_mapping_action_force
438 : delete_mapping_action), &key);
439
440 if (!NT_STATUS_IS_OK(status)) {
441 d_fprintf(stderr, _("could not delete mapping: %s\n"),
442 nt_errstr(status));
443 goto done;
444 }
445 ret = 0;
446done:
447 talloc_free(mem_ctx);
448 return ret;
449}
450
451static int net_idmap_set(struct net_context *c, int argc, const char **argv)
452{
453 d_printf("%s\n", _("Not implemented yet"));
454 return -1;
455}
456static bool idmap_store_secret(const char *backend,
457 const char *domain,
458 const char *identity,
459 const char *secret)
460{
461 char *tmp;
462 int r;
463 bool ret;
464
465 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
466
467 if (r < 0) return false;
468
469 strupper_m(tmp); /* make sure the key is case insensitive */
470 ret = secrets_store_generic(tmp, identity, secret);
471
472 free(tmp);
473 return ret;
474}
475
476
477static int net_idmap_secret(struct net_context *c, int argc, const char **argv)
478{
479 TALLOC_CTX *ctx;
480 const char *secret;
481 const char *dn;
482 char *domain;
483 char *backend;
484 char *opt = NULL;
485 bool ret;
486
487 if (argc != 2 || c->display_usage) {
488 d_printf("%s\n%s",
489 _("Usage:\n"),
490 _("net idmap secret <DOMAIN> <secret>\n"
491 " Set the secret for the specified domain\n"
492 " DOMAIN\tDomain to set secret for.\n"
493 " secret\tNew secret to set.\n"));
494 return c->display_usage?0:-1;
495 }
496
497 secret = argv[1];
498
499 ctx = talloc_new(NULL);
500 ALLOC_CHECK(ctx);
501
502 domain = talloc_strdup(ctx, argv[0]);
503 ALLOC_CHECK(domain);
504
505 opt = talloc_asprintf(ctx, "idmap config %s", domain);
506 ALLOC_CHECK(opt);
507
508 backend = talloc_strdup(ctx, lp_parm_const_string(-1, opt, "backend", "tdb"));
509 ALLOC_CHECK(backend);
510
511 if ( ( ! backend) || ( ! strequal(backend, "ldap"))) {
512 d_fprintf(stderr,
513 _("The only currently supported backend is LDAP\n"));
514 talloc_free(ctx);
515 return -1;
516 }
517
518 dn = lp_parm_const_string(-1, opt, "ldap_user_dn", NULL);
519 if ( ! dn) {
520 d_fprintf(stderr,
521 _("Missing ldap_user_dn option for domain %s\n"),
522 domain);
523 talloc_free(ctx);
524 return -1;
525 }
526
527 ret = idmap_store_secret("ldap", domain, dn, secret);
528
529 if ( ! ret) {
530 d_fprintf(stderr, _("Failed to store secret\n"));
531 talloc_free(ctx);
532 return -1;
533 }
534
535 d_printf(_("Secret stored\n"));
536 return 0;
537}
538
539static int net_idmap_check(struct net_context *c, int argc, const char **argv)
540{
541 const char* dbfile;
542 struct check_options opts;
543
544 if ( argc > 1 || c->display_usage) {
545 d_printf("%s\n%s",
546 _("Usage:"),
547 _("net idmap check [-v] [-r] [-a] [-T] [-f] [-l] [[--db=]<TDB>]\n"
548 " Check an idmap database.\n"
549 " --verbose,-v\tverbose\n"
550 " --repair,-r\trepair\n"
551 " --auto,-a\tnoninteractive mode\n"
552 " --test,-T\tdry run\n"
553 " --fore,-f\tforce\n"
554 " --lock,-l\tlock db while doing the check\n"
555 " TDB\tidmap database\n"));
556 return c->display_usage ? 0 : -1;
557 }
558
559 dbfile = (argc > 0) ? argv[0] : net_idmap_dbfile(c);
560 if (dbfile == NULL) {
561 return -1;
562 }
563 d_fprintf(stderr, _("check database: %s\n"), dbfile);
564
565 opts = (struct check_options) {
566 .lock = c->opt_lock || c->opt_long_list_entries,
567 .test = c->opt_testmode,
568 .automatic = c->opt_auto,
569 .verbose = c->opt_verbose,
570 .force = c->opt_force,
571 .repair = c->opt_repair || c->opt_reboot,
572 };
573
574 return net_idmap_check_db(dbfile, &opts);
575}
576
577static int net_idmap_aclmapset(struct net_context *c, int argc, const char **argv)
578{
579 TALLOC_CTX *mem_ctx;
580 int result = -1;
581 struct dom_sid src_sid, dst_sid;
582 char *src, *dst;
583 struct db_context *db;
584 struct db_record *rec;
585 NTSTATUS status;
586
587 if (argc != 3 || c->display_usage) {
588 d_fprintf(stderr, "%s net idmap aclmapset <tdb> "
589 "<src-sid> <dst-sid>\n", _("Usage:"));
590 return -1;
591 }
592
593 if (!(mem_ctx = talloc_init("net idmap aclmapset"))) {
594 d_fprintf(stderr, _("talloc_init failed\n"));
595 return -1;
596 }
597
598 if (!(db = db_open(mem_ctx, argv[0], 0, TDB_DEFAULT,
599 O_RDWR|O_CREAT, 0600))) {
600 d_fprintf(stderr, _("db_open failed: %s\n"), strerror(errno));
601 goto fail;
602 }
603
604 if (!string_to_sid(&src_sid, argv[1])) {
605 d_fprintf(stderr, _("%s is not a valid sid\n"), argv[1]);
606 goto fail;
607 }
608
609 if (!string_to_sid(&dst_sid, argv[2])) {
610 d_fprintf(stderr, _("%s is not a valid sid\n"), argv[2]);
611 goto fail;
612 }
613
614 if (!(src = sid_string_talloc(mem_ctx, &src_sid))
615 || !(dst = sid_string_talloc(mem_ctx, &dst_sid))) {
616 d_fprintf(stderr, _("talloc_strdup failed\n"));
617 goto fail;
618 }
619
620 if (!(rec = db->fetch_locked(
621 db, mem_ctx, string_term_tdb_data(src)))) {
622 d_fprintf(stderr, _("could not fetch db record\n"));
623 goto fail;
624 }
625
626 status = rec->store(rec, string_term_tdb_data(dst), 0);
627 TALLOC_FREE(rec);
628
629 if (!NT_STATUS_IS_OK(status)) {
630 d_fprintf(stderr, _("could not store record: %s\n"),
631 nt_errstr(status));
632 goto fail;
633 }
634
635 result = 0;
636fail:
637 TALLOC_FREE(mem_ctx);
638 return result;
639}
640
641/***********************************************************
642 Look at the current idmap
643 **********************************************************/
644int net_idmap(struct net_context *c, int argc, const char **argv)
645{
646 struct functable func[] = {
647 {
648 "dump",
649 net_idmap_dump,
650 NET_TRANSPORT_LOCAL,
651 N_("Dump the current ID mappings"),
652 N_("net idmap dump\n"
653 " Dump the current ID mappings")
654 },
655 {
656 "restore",
657 net_idmap_restore,
658 NET_TRANSPORT_LOCAL,
659 N_("Restore entries from stdin"),
660 N_("net idmap restore\n"
661 " Restore entries from stdin")
662 },
663 {
664 "setmap",
665 net_idmap_set,
666 NET_TRANSPORT_LOCAL,
667 N_("Not implemented yet"),
668 N_("net idmap setmap\n"
669 " Not implemented yet")
670 },
671 {
672 "delete",
673 net_idmap_delete,
674 NET_TRANSPORT_LOCAL,
675 N_("Delete ID mapping"),
676 N_("net idmap delete <ID>\n"
677 " Delete ID mapping")
678 },
679 {
680 "secret",
681 net_idmap_secret,
682 NET_TRANSPORT_LOCAL,
683 N_("Set secret for specified domain"),
684 N_("net idmap secret <DOMAIN> <secret>\n"
685 " Set secret for specified domain")
686 },
687 {
688 "aclmapset",
689 net_idmap_aclmapset,
690 NET_TRANSPORT_LOCAL,
691 N_("Set acl map"),
692 N_("net idmap aclmapset\n"
693 " Set acl map")
694 },
695 {
696 "check",
697 net_idmap_check,
698 NET_TRANSPORT_LOCAL,
699 N_("Check id mappings"),
700 N_("net idmap check\n"
701 " Check id mappings")
702 },
703 {NULL, NULL, 0, NULL, NULL}
704 };
705
706 return net_run_function(c, argc, argv, "net idmap", func);
707}
708
709
Note: See TracBrowser for help on using the repository browser.