source: vendor/current/source3/lib/idmap_cache.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 10.4 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 ID Mapping Cache
4
5 Copyright (C) Volker Lendecke 2008
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
19
20#include "includes.h"
21#include "idmap_cache.h"
22#include "../libcli/security/security.h"
23#include "../librpc/gen_ndr/idmap.h"
24
25/**
26 * Find a sid2xid mapping
27 * @param[in] sid the sid to map
28 * @param[out] id where to put the result
29 * @param[out] expired is the cache entry expired?
30 * @retval Was anything in the cache at all?
31 *
32 * If id->id == -1 this was a negative mapping.
33 */
34
35bool idmap_cache_find_sid2unixid(const struct dom_sid *sid, struct unixid *id,
36 bool *expired)
37{
38 fstring sidstr;
39 char *key;
40 char *value = NULL;
41 char *endptr;
42 time_t timeout;
43 bool ret;
44 struct unixid tmp_id;
45
46 key = talloc_asprintf(talloc_tos(), "IDMAP/SID2XID/%s",
47 sid_to_fstring(sidstr, sid));
48 if (key == NULL) {
49 return false;
50 }
51 ret = gencache_get(key, talloc_tos(), &value, &timeout);
52 if (!ret) {
53 goto done;
54 }
55
56 DEBUG(10, ("Parsing value for key [%s]: value=[%s]\n", key, value));
57
58 if (value[0] == '\0') {
59 DEBUG(0, ("Failed to parse value for key [%s]: "
60 "value is empty\n", key));
61 ret = false;
62 goto done;
63 }
64
65 tmp_id.id = strtol(value, &endptr, 10);
66
67 if ((value == endptr) && (tmp_id.id == 0)) {
68 DEBUG(0, ("Failed to parse value for key [%s]: value[%s] does "
69 "not start with a number\n", key, value));
70 ret = false;
71 goto done;
72 }
73
74 DEBUG(10, ("Parsing value for key [%s]: id=[%llu], endptr=[%s]\n",
75 key, (unsigned long long)tmp_id.id, endptr));
76
77 ret = (*endptr == ':');
78 if (ret) {
79 switch (endptr[1]) {
80 case 'U':
81 tmp_id.type = ID_TYPE_UID;
82 break;
83
84 case 'G':
85 tmp_id.type = ID_TYPE_GID;
86 break;
87
88 case 'B':
89 tmp_id.type = ID_TYPE_BOTH;
90 break;
91
92 case 'N':
93 tmp_id.type = ID_TYPE_NOT_SPECIFIED;
94 break;
95
96 case '\0':
97 DEBUG(0, ("FAILED to parse value for key [%s] "
98 "(id=[%llu], endptr=[%s]): "
99 "no type character after colon\n",
100 key, (unsigned long long)tmp_id.id, endptr));
101 ret = false;
102 goto done;
103 default:
104 DEBUG(0, ("FAILED to parse value for key [%s] "
105 "(id=[%llu], endptr=[%s]): "
106 "illegal type character '%c'\n",
107 key, (unsigned long long)tmp_id.id, endptr,
108 endptr[1]));
109 ret = false;
110 goto done;
111 }
112 if (endptr[2] != '\0') {
113 DEBUG(0, ("FAILED to parse value for key [%s] "
114 "(id=[%llu], endptr=[%s]): "
115 "more than 1 type character after colon\n",
116 key, (unsigned long long)tmp_id.id, endptr));
117 ret = false;
118 goto done;
119 }
120
121 *id = tmp_id;
122 *expired = (timeout <= time(NULL));
123 } else {
124 DEBUG(0, ("FAILED to parse value for key [%s] (value=[%s]): "
125 "colon missing after id=[%llu]\n",
126 key, value, (unsigned long long)tmp_id.id));
127 }
128
129done:
130 TALLOC_FREE(key);
131 TALLOC_FREE(value);
132 return ret;
133}
134
135/**
136 * Find a sid2uid mapping
137 * @param[in] sid the sid to map
138 * @param[out] puid where to put the result
139 * @param[out] expired is the cache entry expired?
140 * @retval Was anything in the cache at all?
141 *
142 * If *puid == -1 this was a negative mapping.
143 */
144
145bool idmap_cache_find_sid2uid(const struct dom_sid *sid, uid_t *puid,
146 bool *expired)
147{
148 bool ret;
149 struct unixid id;
150 ret = idmap_cache_find_sid2unixid(sid, &id, expired);
151 if (!ret) {
152 return false;
153 }
154
155 if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_UID) {
156 *puid = id.id;
157 } else {
158 *puid = -1;
159 }
160 return true;
161}
162
163/**
164 * Find a sid2gid mapping
165 * @param[in] sid the sid to map
166 * @param[out] pgid where to put the result
167 * @param[out] expired is the cache entry expired?
168 * @retval Was anything in the cache at all?
169 *
170 * If *pgid == -1 this was a negative mapping.
171 */
172
173bool idmap_cache_find_sid2gid(const struct dom_sid *sid, gid_t *pgid,
174 bool *expired)
175{
176 bool ret;
177 struct unixid id;
178 ret = idmap_cache_find_sid2unixid(sid, &id, expired);
179 if (!ret) {
180 return false;
181 }
182
183 if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_GID) {
184 *pgid = id.id;
185 } else {
186 *pgid = -1;
187 }
188 return true;
189}
190
191struct idmap_cache_xid2sid_state {
192 struct dom_sid *sid;
193 bool *expired;
194 bool ret;
195};
196
197static void idmap_cache_xid2sid_parser(time_t timeout, DATA_BLOB blob,
198 void *private_data)
199{
200 struct idmap_cache_xid2sid_state *state =
201 (struct idmap_cache_xid2sid_state *)private_data;
202 char *value;
203
204 ZERO_STRUCTP(state->sid);
205 state->ret = false;
206
207 if ((blob.length == 0) || (blob.data[blob.length-1] != 0)) {
208 /*
209 * Not a string, can't be a valid mapping
210 */
211 return;
212 }
213
214 value = (char *)blob.data;
215
216 if (value[0] != '-') {
217 state->ret = string_to_sid(state->sid, value);
218 }
219 if (state->ret) {
220 *state->expired = (timeout <= time(NULL));
221 }
222}
223
224/**
225 * Find a uid2sid mapping
226 * @param[in] uid the uid to map
227 * @param[out] sid where to put the result
228 * @param[out] expired is the cache entry expired?
229 * @retval Was anything in the cache at all?
230 *
231 * If "is_null_sid(sid)", this was a negative mapping.
232 */
233
234bool idmap_cache_find_uid2sid(uid_t uid, struct dom_sid *sid, bool *expired)
235{
236 fstring key;
237 struct idmap_cache_xid2sid_state state;
238
239 fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)uid);
240
241 state.sid = sid;
242 state.expired = expired;
243 state.ret = false;
244
245 gencache_parse(key, idmap_cache_xid2sid_parser, &state);
246 return state.ret;
247}
248
249/**
250 * Find a gid2sid mapping
251 * @param[in] gid the gid to map
252 * @param[out] sid where to put the result
253 * @param[out] expired is the cache entry expired?
254 * @retval Was anything in the cache at all?
255 *
256 * If "is_null_sid(sid)", this was a negative mapping.
257 */
258
259bool idmap_cache_find_gid2sid(gid_t gid, struct dom_sid *sid, bool *expired)
260{
261 fstring key;
262 struct idmap_cache_xid2sid_state state;
263
264 fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)gid);
265
266 state.sid = sid;
267 state.expired = expired;
268 state.ret = false;
269
270 gencache_parse(key, idmap_cache_xid2sid_parser, &state);
271 return state.ret;
272}
273
274/**
275 * Store a mapping in the idmap cache
276 * @param[in] sid the sid to map
277 * @param[in] gid the gid to map
278 *
279 * If both parameters are valid values, then a positive mapping in both
280 * directions is stored. If "is_null_sid(sid)" is true, then this will be a
281 * negative mapping of gid, we want to cache that for this gid we could not
282 * find anything. Likewise if "gid==-1", then we want to cache that we did not
283 * find a mapping for the sid passed here.
284 */
285
286void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id)
287{
288 time_t now = time(NULL);
289 time_t timeout;
290 fstring sidstr, key, value;
291
292 if (!is_null_sid(sid)) {
293 fstr_sprintf(key, "IDMAP/SID2XID/%s",
294 sid_to_fstring(sidstr, sid));
295 switch (unix_id->type) {
296 case ID_TYPE_UID:
297 fstr_sprintf(value, "%d:U", (int)unix_id->id);
298 break;
299 case ID_TYPE_GID:
300 fstr_sprintf(value, "%d:G", (int)unix_id->id);
301 break;
302 case ID_TYPE_BOTH:
303 fstr_sprintf(value, "%d:B", (int)unix_id->id);
304 break;
305 case ID_TYPE_NOT_SPECIFIED:
306 fstr_sprintf(value, "%d:N", (int)unix_id->id);
307 break;
308 default:
309 return;
310 }
311 timeout = (unix_id->id == -1)
312 ? lp_idmap_negative_cache_time()
313 : lp_idmap_cache_time();
314 gencache_set(key, value, now + timeout);
315 }
316 if (unix_id->id != -1) {
317 if (is_null_sid(sid)) {
318 /* negative gid mapping */
319 fstrcpy(value, "-");
320 timeout = lp_idmap_negative_cache_time();
321 }
322 else {
323 sid_to_fstring(value, sid);
324 timeout = lp_idmap_cache_time();
325 }
326 switch (unix_id->type) {
327 case ID_TYPE_BOTH:
328 fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
329 gencache_set(key, value, now + timeout);
330 fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
331 gencache_set(key, value, now + timeout);
332 return;
333
334 case ID_TYPE_UID:
335 fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
336 break;
337
338 case ID_TYPE_GID:
339 fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
340 break;
341
342 default:
343 return;
344 }
345 gencache_set(key, value, now + timeout);
346 }
347}
348
349static char* key_xid2sid_str(TALLOC_CTX* mem_ctx, char t, const char* id) {
350 return talloc_asprintf(mem_ctx, "IDMAP/%cID2SID/%s", t, id);
351}
352
353static char* key_xid2sid(TALLOC_CTX* mem_ctx, char t, int id) {
354 char str[32];
355 snprintf(str, sizeof(str), "%d", id);
356 return key_xid2sid_str(mem_ctx, t, str);
357}
358
359static char* key_sid2xid_str(TALLOC_CTX* mem_ctx, const char* id) {
360 return talloc_asprintf(mem_ctx, "IDMAP/SID2XID/%s", id);
361}
362
363static bool idmap_cache_del_xid(char t, int xid)
364{
365 TALLOC_CTX* mem_ctx = talloc_stackframe();
366 const char* key = key_xid2sid(mem_ctx, t, xid);
367 char* sid_str = NULL;
368 time_t timeout;
369 bool ret = true;
370
371 if (!gencache_get(key, mem_ctx, &sid_str, &timeout)) {
372 DEBUG(3, ("no entry: %s\n", key));
373 ret = false;
374 goto done;
375 }
376
377 if (sid_str[0] != '-') {
378 const char* sid_key = key_sid2xid_str(mem_ctx, sid_str);
379 if (!gencache_del(sid_key)) {
380 DEBUG(2, ("failed to delete: %s\n", sid_key));
381 ret = false;
382 } else {
383 DEBUG(5, ("delete: %s\n", sid_key));
384 }
385
386 }
387
388 if (!gencache_del(key)) {
389 DEBUG(1, ("failed to delete: %s\n", key));
390 ret = false;
391 } else {
392 DEBUG(5, ("delete: %s\n", key));
393 }
394
395done:
396 talloc_free(mem_ctx);
397 return ret;
398}
399
400bool idmap_cache_del_uid(uid_t uid) {
401 return idmap_cache_del_xid('U', uid);
402}
403
404bool idmap_cache_del_gid(gid_t gid) {
405 return idmap_cache_del_xid('G', gid);
406}
407
408bool idmap_cache_del_sid(const struct dom_sid *sid)
409{
410 TALLOC_CTX* mem_ctx = talloc_stackframe();
411 bool ret = true;
412 bool expired;
413 struct unixid id;
414 const char *sid_key;
415
416 if (!idmap_cache_find_sid2unixid(sid, &id, &expired)) {
417 ret = false;
418 goto done;
419 }
420
421 if (id.id != -1) {
422 switch (id.type) {
423 case ID_TYPE_BOTH:
424 idmap_cache_del_xid('U', id.id);
425 idmap_cache_del_xid('G', id.id);
426 break;
427 case ID_TYPE_UID:
428 idmap_cache_del_xid('U', id.id);
429 break;
430 case ID_TYPE_GID:
431 idmap_cache_del_xid('G', id.id);
432 break;
433 default:
434 break;
435 }
436 }
437
438 sid_key = key_sid2xid_str(mem_ctx, dom_sid_string(mem_ctx, sid));
439 if (sid_key == NULL) {
440 return false;
441 }
442 /* If the mapping was symmetric, then this should fail */
443 gencache_del(sid_key);
444done:
445 talloc_free(mem_ctx);
446 return ret;
447}
Note: See TracBrowser for help on using the repository browser.