source: vendor/current/source4/winbind/idmap.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 23.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Map SIDs to unixids and back
5
6 Copyright (C) Kai Blin 2008
7 Copyright (C) Andrew Bartlett 2012
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "auth/auth.h"
25#include "librpc/gen_ndr/ndr_security.h"
26#include <ldb.h>
27#include "ldb_wrap.h"
28#include "param/param.h"
29#include "winbind/idmap.h"
30#include "libcli/security/security.h"
31#include "libcli/ldap/ldap_ndr.h"
32#include "dsdb/samdb/samdb.h"
33#include "../libds/common/flags.h"
34
35/**
36 * Get uid/gid bounds from idmap database
37 *
38 * \param idmap_ctx idmap context to use
39 * \param low lower uid/gid bound is stored here
40 * \param high upper uid/gid bound is stored here
41 * \return 0 on success, nonzero on failure
42 */
43static int idmap_get_bounds(struct idmap_context *idmap_ctx, uint32_t *low,
44 uint32_t *high)
45{
46 int ret = -1;
47 struct ldb_context *ldb = idmap_ctx->ldb_ctx;
48 struct ldb_dn *dn;
49 struct ldb_result *res = NULL;
50 TALLOC_CTX *tmp_ctx = talloc_new(idmap_ctx);
51 uint32_t lower_bound = (uint32_t) -1;
52 uint32_t upper_bound = (uint32_t) -1;
53
54 dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
55 if (dn == NULL) goto failed;
56
57 ret = ldb_search(ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE, NULL, NULL);
58 if (ret != LDB_SUCCESS) goto failed;
59
60 if (res->count != 1) {
61 ret = -1;
62 goto failed;
63 }
64
65 lower_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "lowerBound", -1);
66 if (lower_bound != (uint32_t) -1) {
67 ret = LDB_SUCCESS;
68 } else {
69 ret = -1;
70 goto failed;
71 }
72
73 upper_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "upperBound", -1);
74 if (upper_bound != (uint32_t) -1) {
75 ret = LDB_SUCCESS;
76 } else {
77 ret = -1;
78 }
79
80failed:
81 talloc_free(tmp_ctx);
82 *low = lower_bound;
83 *high = upper_bound;
84 return ret;
85}
86
87/**
88 * Add a dom_sid structure to a ldb_message
89 * \param idmap_ctx idmap context to use
90 * \param mem_ctx talloc context to use
91 * \param ldb_message ldb message to add dom_sid to
92 * \param attr_name name of the attribute to store the dom_sid in
93 * \param sid dom_sid to store
94 * \return 0 on success, an ldb error code on failure.
95 */
96static int idmap_msg_add_dom_sid(struct idmap_context *idmap_ctx,
97 TALLOC_CTX *mem_ctx, struct ldb_message *msg,
98 const char *attr_name, const struct dom_sid *sid)
99{
100 struct ldb_val val;
101 enum ndr_err_code ndr_err;
102
103 ndr_err = ndr_push_struct_blob(&val, mem_ctx, sid,
104 (ndr_push_flags_fn_t)ndr_push_dom_sid);
105
106 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
107 return -1;
108 }
109
110 return ldb_msg_add_value(msg, attr_name, &val, NULL);
111}
112
113/**
114 * Get a dom_sid structure from a ldb message.
115 *
116 * \param mem_ctx talloc context to allocate dom_sid memory in
117 * \param msg ldb_message to get dom_sid from
118 * \param attr_name key that has the dom_sid as data
119 * \return dom_sid structure on success, NULL on failure
120 */
121static struct dom_sid *idmap_msg_get_dom_sid(TALLOC_CTX *mem_ctx,
122 struct ldb_message *msg, const char *attr_name)
123{
124 struct dom_sid *sid;
125 const struct ldb_val *val;
126 enum ndr_err_code ndr_err;
127
128 val = ldb_msg_find_ldb_val(msg, attr_name);
129 if (val == NULL) {
130 return NULL;
131 }
132
133 sid = talloc(mem_ctx, struct dom_sid);
134 if (sid == NULL) {
135 return NULL;
136 }
137
138 ndr_err = ndr_pull_struct_blob(val, sid, sid,
139 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
140 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
141 talloc_free(sid);
142 return NULL;
143 }
144
145 return sid;
146}
147
148/**
149 * Initialize idmap context
150 *
151 * talloc_free to close.
152 *
153 * \param mem_ctx talloc context to use.
154 * \return allocated idmap_context on success, NULL on error
155 */
156struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
157 struct tevent_context *ev_ctx,
158 struct loadparm_context *lp_ctx)
159{
160 struct idmap_context *idmap_ctx;
161
162 idmap_ctx = talloc(mem_ctx, struct idmap_context);
163 if (idmap_ctx == NULL) {
164 return NULL;
165 }
166
167 idmap_ctx->lp_ctx = lp_ctx;
168
169 idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, ev_ctx, lp_ctx,
170 "idmap.ldb",
171 system_session(lp_ctx),
172 NULL, 0);
173 if (idmap_ctx->ldb_ctx == NULL) {
174 return NULL;
175 }
176
177 idmap_ctx->unix_groups_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-2");
178 if (idmap_ctx->unix_groups_sid == NULL) {
179 return NULL;
180 }
181
182 idmap_ctx->unix_users_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-1");
183 if (idmap_ctx->unix_users_sid == NULL) {
184 return NULL;
185 }
186
187 idmap_ctx->samdb = samdb_connect(idmap_ctx, ev_ctx, lp_ctx, system_session(lp_ctx), 0);
188 if (idmap_ctx->samdb == NULL) {
189 DEBUG(0, ("Failed to load sam.ldb in idmap_init\n"));
190 return NULL;
191 }
192
193 return idmap_ctx;
194}
195
196/**
197 * Convert an unixid to the corresponding SID
198 *
199 * \param idmap_ctx idmap context to use
200 * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
201 * from.
202 * \param unixid pointer to a unixid struct to convert
203 * \param sid pointer that will take the struct dom_sid pointer if the mapping
204 * succeeds.
205 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
206 * possible or some other NTSTATUS that is more descriptive on failure.
207 */
208
209static NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx,
210 TALLOC_CTX *mem_ctx,
211 struct unixid *unixid,
212 struct dom_sid **sid)
213{
214 int ret;
215 NTSTATUS status = NT_STATUS_NONE_MAPPED;
216 struct ldb_context *ldb = idmap_ctx->ldb_ctx;
217 struct ldb_result *res = NULL;
218 struct ldb_message *msg;
219 struct dom_sid *unix_sid, *new_sid;
220 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
221 const char *id_type;
222
223 const char *sam_attrs[] = {"objectSid", NULL};
224
225 /*
226 * First check against our local DB, to see if this user has a
227 * mapping there. This means that the Samba4 AD DC behaves
228 * much like a winbindd member server running idmap_ad
229 */
230
231 switch (unixid->type) {
232 case ID_TYPE_UID:
233 if (lpcfg_parm_bool(idmap_ctx->lp_ctx, NULL, "idmap_ldb", "use rfc2307", false)) {
234 ret = dsdb_search_one(idmap_ctx->samdb, tmp_ctx, &msg,
235 ldb_get_default_basedn(idmap_ctx->samdb),
236 LDB_SCOPE_SUBTREE,
237 sam_attrs, 0,
238 "(&(|(sAMaccountType=%u)(sAMaccountType=%u)(sAMaccountType=%u))"
239 "(uidNumber=%u)(objectSid=*))",
240 ATYPE_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST, unixid->id);
241 } else {
242 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
243 ret = LDB_ERR_NO_SUCH_OBJECT;
244 }
245
246 if (ret == LDB_ERR_CONSTRAINT_VIOLATION) {
247 DEBUG(1, ("Search for uidNumber=%lu gave duplicate results, failing to map to a SID!\n",
248 (unsigned long)unixid->id));
249 status = NT_STATUS_NONE_MAPPED;
250 goto failed;
251 } else if (ret == LDB_SUCCESS) {
252 *sid = samdb_result_dom_sid(mem_ctx, msg, "objectSid");
253 if (*sid == NULL) {
254 DEBUG(1, ("Search for uidNumber=%lu did not return an objectSid!\n",
255 (unsigned long)unixid->id));
256 status = NT_STATUS_NONE_MAPPED;
257 goto failed;
258 }
259 talloc_free(tmp_ctx);
260 return NT_STATUS_OK;
261 } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
262 DEBUG(1, ("Search for uidNumber=%lu gave '%s', failing to map to a SID!\n",
263 (unsigned long)unixid->id, ldb_errstring(idmap_ctx->samdb)));
264 status = NT_STATUS_NONE_MAPPED;
265 goto failed;
266 }
267
268 id_type = "ID_TYPE_UID";
269 break;
270 case ID_TYPE_GID:
271 if (lpcfg_parm_bool(idmap_ctx->lp_ctx, NULL, "idmap_ldb", "use rfc2307", false)) {
272 ret = dsdb_search_one(idmap_ctx->samdb, tmp_ctx, &msg,
273 ldb_get_default_basedn(idmap_ctx->samdb),
274 LDB_SCOPE_SUBTREE,
275 sam_attrs, 0,
276 "(&(|(sAMaccountType=%u)(sAMaccountType=%u))(gidNumber=%u))",
277 ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP,
278 unixid->id);
279 } else {
280 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
281 ret = LDB_ERR_NO_SUCH_OBJECT;
282 }
283 if (ret == LDB_ERR_CONSTRAINT_VIOLATION) {
284 DEBUG(1, ("Search for gidNumber=%lu gave duplicate results, failing to map to a SID!\n",
285 (unsigned long)unixid->id));
286 status = NT_STATUS_NONE_MAPPED;
287 goto failed;
288 } else if (ret == LDB_SUCCESS) {
289 *sid = samdb_result_dom_sid(mem_ctx, msg, "objectSid");
290 if (*sid == NULL) {
291 DEBUG(1, ("Search for gidNumber=%lu did not return an objectSid!\n",
292 (unsigned long)unixid->id));
293 status = NT_STATUS_NONE_MAPPED;
294 goto failed;
295 }
296 talloc_free(tmp_ctx);
297 return NT_STATUS_OK;
298 } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
299 DEBUG(1, ("Search for gidNumber=%lu gave '%s', failing to map to a SID!\n",
300 (unsigned long)unixid->id, ldb_errstring(idmap_ctx->samdb)));
301 status = NT_STATUS_NONE_MAPPED;
302 goto failed;
303 }
304
305 id_type = "ID_TYPE_GID";
306 break;
307 default:
308 DEBUG(1, ("unixid->type must be type gid or uid (got %u) for lookup with id %lu\n",
309 (unsigned)unixid->type, (unsigned long)unixid->id));
310 status = NT_STATUS_NONE_MAPPED;
311 goto failed;
312 }
313
314 ret = ldb_search(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
315 NULL, "(&(|(type=ID_TYPE_BOTH)(type=%s))"
316 "(xidNumber=%u))", id_type, unixid->id);
317 if (ret != LDB_SUCCESS) {
318 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
319 status = NT_STATUS_NONE_MAPPED;
320 goto failed;
321 }
322
323 if (res->count == 1) {
324 const char *type = ldb_msg_find_attr_as_string(res->msgs[0],
325 "type", NULL);
326
327 *sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
328 "objectSid");
329 if (*sid == NULL) {
330 DEBUG(1, ("Failed to get sid from db: %u\n", ret));
331 status = NT_STATUS_NONE_MAPPED;
332 goto failed;
333 }
334
335 if (type == NULL) {
336 DEBUG(1, ("Invalid type for mapping entry.\n"));
337 talloc_free(tmp_ctx);
338 return NT_STATUS_NONE_MAPPED;
339 }
340
341 if (strcmp(type, "ID_TYPE_BOTH") == 0) {
342 unixid->type = ID_TYPE_BOTH;
343 } else if (strcmp(type, "ID_TYPE_UID") == 0) {
344 unixid->type = ID_TYPE_UID;
345 } else {
346 unixid->type = ID_TYPE_GID;
347 }
348
349 talloc_free(tmp_ctx);
350 return NT_STATUS_OK;
351 }
352
353 DEBUG(6, ("xid not found in idmap db, create S-1-22- SID.\n"));
354
355 /* For local users/groups , we just create a rid = uid/gid */
356 if (unixid->type == ID_TYPE_UID) {
357 unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
358 } else {
359 unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
360 }
361 if (unix_sid == NULL) {
362 status = NT_STATUS_NO_MEMORY;
363 goto failed;
364 }
365
366 new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id);
367 if (new_sid == NULL) {
368 status = NT_STATUS_NO_MEMORY;
369 goto failed;
370 }
371
372 *sid = new_sid;
373 talloc_free(tmp_ctx);
374 return NT_STATUS_OK;
375
376failed:
377 talloc_free(tmp_ctx);
378 return status;
379}
380
381
382/**
383 * Map a SID to an unixid struct.
384 *
385 * If no mapping exists, a new mapping will be created.
386 *
387 * \param idmap_ctx idmap context to use
388 * \param mem_ctx talloc context to use
389 * \param sid SID to map to an unixid struct
390 * \param unixid pointer to a unixid struct
391 * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
392 * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
393 * mapping failed.
394 */
395static NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx,
396 TALLOC_CTX *mem_ctx,
397 const struct dom_sid *sid,
398 struct unixid *unixid)
399{
400 int ret;
401 NTSTATUS status = NT_STATUS_NONE_MAPPED;
402 struct ldb_context *ldb = idmap_ctx->ldb_ctx;
403 struct ldb_dn *dn;
404 struct ldb_message *hwm_msg, *map_msg, *sam_msg;
405 struct ldb_result *res = NULL;
406 int trans = -1;
407 uint32_t low, high, hwm, new_xid;
408 char *sid_string, *unixid_string, *hwm_string;
409 bool hwm_entry_exists;
410 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
411 const char *sam_attrs[] = {"uidNumber", "gidNumber", "samAccountType", NULL};
412
413 if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
414 uint32_t rid;
415 DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
416 status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
417 if (!NT_STATUS_IS_OK(status)) {
418 talloc_free(tmp_ctx);
419 return status;
420 }
421
422 unixid->id = rid;
423 unixid->type = ID_TYPE_UID;
424
425 talloc_free(tmp_ctx);
426 return NT_STATUS_OK;
427 }
428
429 if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
430 uint32_t rid;
431 DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
432 status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
433 if (!NT_STATUS_IS_OK(status)) {
434 talloc_free(tmp_ctx);
435 return status;
436 }
437
438 unixid->id = rid;
439 unixid->type = ID_TYPE_GID;
440
441 talloc_free(tmp_ctx);
442 return NT_STATUS_OK;
443 }
444
445 /*
446 * First check against our local DB, to see if this user has a
447 * mapping there. This means that the Samba4 AD DC behaves
448 * much like a winbindd member server running idmap_ad
449 */
450
451 if (lpcfg_parm_bool(idmap_ctx->lp_ctx, NULL, "idmap_ldb", "use rfc2307", false)) {
452 ret = dsdb_search_one(idmap_ctx->samdb, tmp_ctx, &sam_msg,
453 ldb_get_default_basedn(idmap_ctx->samdb),
454 LDB_SCOPE_SUBTREE, sam_attrs, 0,
455 "(&(objectSid=%s)"
456 "(|(sAMaccountType=%u)(sAMaccountType=%u)(sAMaccountType=%u)"
457 "(sAMaccountType=%u)(sAMaccountType=%u))"
458 "(|(uidNumber=*)(gidNumber=*)))",
459 dom_sid_string(tmp_ctx, sid),
460 ATYPE_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
461 ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
462 } else {
463 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
464 ret = LDB_ERR_NO_SUCH_OBJECT;
465 }
466
467 if (ret == LDB_ERR_CONSTRAINT_VIOLATION) {
468 DEBUG(1, ("Search for objectSid=%s gave duplicate results, failing to map to a unix ID!\n",
469 dom_sid_string(tmp_ctx, sid)));
470 status = NT_STATUS_NONE_MAPPED;
471 goto failed;
472 } else if (ret == LDB_SUCCESS) {
473 uint32_t account_type = ldb_msg_find_attr_as_uint(sam_msg, "sAMaccountType", 0);
474 if ((account_type == ATYPE_ACCOUNT) ||
475 (account_type == ATYPE_WORKSTATION_TRUST ) ||
476 (account_type == ATYPE_INTERDOMAIN_TRUST ))
477 {
478 const struct ldb_val *v = ldb_msg_find_ldb_val(sam_msg, "uidNumber");
479 if (v) {
480 unixid->type = ID_TYPE_UID;
481 unixid->id = ldb_msg_find_attr_as_uint(sam_msg, "uidNumber", -1);
482 talloc_free(tmp_ctx);
483 return NT_STATUS_OK;
484 }
485
486 } else if ((account_type == ATYPE_SECURITY_GLOBAL_GROUP) ||
487 (account_type == ATYPE_SECURITY_LOCAL_GROUP))
488 {
489 const struct ldb_val *v = ldb_msg_find_ldb_val(sam_msg, "gidNumber");
490 if (v) {
491 unixid->type = ID_TYPE_GID;
492 unixid->id = ldb_msg_find_attr_as_uint(sam_msg, "gidNumber", -1);
493 talloc_free(tmp_ctx);
494 return NT_STATUS_OK;
495 }
496 }
497 } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
498 DEBUG(1, ("Search for objectSid=%s gave '%s', failing to map to a SID!\n",
499 dom_sid_string(tmp_ctx, sid), ldb_errstring(idmap_ctx->samdb)));
500
501 status = NT_STATUS_NONE_MAPPED;
502 goto failed;
503 }
504
505 ret = ldb_search(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
506 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
507 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
508 if (ret != LDB_SUCCESS) {
509 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
510 talloc_free(tmp_ctx);
511 return NT_STATUS_NONE_MAPPED;
512 }
513
514 if (res->count == 1) {
515 const char *type = ldb_msg_find_attr_as_string(res->msgs[0],
516 "type", NULL);
517 new_xid = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber",
518 -1);
519 if (new_xid == (uint32_t) -1) {
520 DEBUG(1, ("Invalid xid mapping.\n"));
521 talloc_free(tmp_ctx);
522 return NT_STATUS_NONE_MAPPED;
523 }
524
525 if (type == NULL) {
526 DEBUG(1, ("Invalid type for mapping entry.\n"));
527 talloc_free(tmp_ctx);
528 return NT_STATUS_NONE_MAPPED;
529 }
530
531 unixid->id = new_xid;
532
533 if (strcmp(type, "ID_TYPE_BOTH") == 0) {
534 unixid->type = ID_TYPE_BOTH;
535 } else if (strcmp(type, "ID_TYPE_UID") == 0) {
536 unixid->type = ID_TYPE_UID;
537 } else {
538 unixid->type = ID_TYPE_GID;
539 }
540
541 talloc_free(tmp_ctx);
542 return NT_STATUS_OK;
543 }
544
545 DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
546
547 trans = ldb_transaction_start(ldb);
548 if (trans != LDB_SUCCESS) {
549 status = NT_STATUS_NONE_MAPPED;
550 goto failed;
551 }
552
553 /* Redo the search to make sure noone changed the mapping while we
554 * weren't looking */
555 ret = ldb_search(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
556 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
557 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
558 if (ret != LDB_SUCCESS) {
559 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
560 status = NT_STATUS_NONE_MAPPED;
561 goto failed;
562 }
563
564 if (res->count > 0) {
565 DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
566 status = NT_STATUS_RETRY;
567 goto failed;
568 }
569
570 ret = idmap_get_bounds(idmap_ctx, &low, &high);
571 if (ret != LDB_SUCCESS) {
572 status = NT_STATUS_NONE_MAPPED;
573 goto failed;
574 }
575
576 dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
577 if (dn == NULL) {
578 status = NT_STATUS_NO_MEMORY;
579 goto failed;
580 }
581
582 ret = ldb_search(ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE, NULL, NULL);
583 if (ret != LDB_SUCCESS) {
584 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
585 status = NT_STATUS_NONE_MAPPED;
586 goto failed;
587 }
588
589 if (res->count != 1) {
590 DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
591 status = NT_STATUS_NONE_MAPPED;
592 goto failed;
593 }
594
595 hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber", -1);
596 if (hwm == (uint32_t)-1) {
597 hwm = low;
598 hwm_entry_exists = false;
599 } else {
600 hwm_entry_exists = true;
601 }
602
603 if (hwm > high) {
604 DEBUG(1, ("Out of xids to allocate.\n"));
605 status = NT_STATUS_NONE_MAPPED;
606 goto failed;
607 }
608
609 hwm_msg = ldb_msg_new(tmp_ctx);
610 if (hwm_msg == NULL) {
611 DEBUG(1, ("Out of memory when creating ldb_message\n"));
612 status = NT_STATUS_NO_MEMORY;
613 goto failed;
614 }
615
616 hwm_msg->dn = dn;
617
618 new_xid = hwm;
619 hwm++;
620
621 hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
622 if (hwm_string == NULL) {
623 status = NT_STATUS_NO_MEMORY;
624 goto failed;
625 }
626
627 sid_string = dom_sid_string(tmp_ctx, sid);
628 if (sid_string == NULL) {
629 status = NT_STATUS_NO_MEMORY;
630 goto failed;
631 }
632
633 unixid_string = talloc_asprintf(tmp_ctx, "%u", new_xid);
634 if (unixid_string == NULL) {
635 status = NT_STATUS_NO_MEMORY;
636 goto failed;
637 }
638
639 if (hwm_entry_exists) {
640 struct ldb_message_element *els;
641 struct ldb_val *vals;
642
643 /* We're modifying the entry, not just adding a new one. */
644 els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
645 if (els == NULL) {
646 status = NT_STATUS_NO_MEMORY;
647 goto failed;
648 }
649
650 vals = talloc_array(tmp_ctx, struct ldb_val, 2);
651 if (els == NULL) {
652 status = NT_STATUS_NO_MEMORY;
653 goto failed;
654 }
655
656 hwm_msg->num_elements = 2;
657 hwm_msg->elements = els;
658
659 els[0].num_values = 1;
660 els[0].values = &vals[0];
661 els[0].flags = LDB_FLAG_MOD_DELETE;
662 els[0].name = talloc_strdup(tmp_ctx, "xidNumber");
663 if (els[0].name == NULL) {
664 status = NT_STATUS_NO_MEMORY;
665 goto failed;
666 }
667
668 els[1].num_values = 1;
669 els[1].values = &vals[1];
670 els[1].flags = LDB_FLAG_MOD_ADD;
671 els[1].name = els[0].name;
672
673 vals[0].data = (uint8_t *)unixid_string;
674 vals[0].length = strlen(unixid_string);
675 vals[1].data = (uint8_t *)hwm_string;
676 vals[1].length = strlen(hwm_string);
677 } else {
678 ret = ldb_msg_add_empty(hwm_msg, "xidNumber", LDB_FLAG_MOD_ADD,
679 NULL);
680 if (ret != LDB_SUCCESS) {
681 status = NT_STATUS_NONE_MAPPED;
682 goto failed;
683 }
684
685 ret = ldb_msg_add_string(hwm_msg, "xidNumber", hwm_string);
686 if (ret != LDB_SUCCESS)
687 {
688 status = NT_STATUS_NONE_MAPPED;
689 goto failed;
690 }
691 }
692
693 ret = ldb_modify(ldb, hwm_msg);
694 if (ret != LDB_SUCCESS) {
695 DEBUG(1, ("Updating the xid high water mark failed: %s\n",
696 ldb_errstring(ldb)));
697 status = NT_STATUS_NONE_MAPPED;
698 goto failed;
699 }
700
701 map_msg = ldb_msg_new(tmp_ctx);
702 if (map_msg == NULL) {
703 status = NT_STATUS_NO_MEMORY;
704 goto failed;
705 }
706
707 map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
708 if (map_msg->dn == NULL) {
709 status = NT_STATUS_NO_MEMORY;
710 goto failed;
711 }
712
713 ret = ldb_msg_add_string(map_msg, "xidNumber", unixid_string);
714 if (ret != LDB_SUCCESS) {
715 status = NT_STATUS_NONE_MAPPED;
716 goto failed;
717 }
718
719 ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
720 sid);
721 if (ret != LDB_SUCCESS) {
722 status = NT_STATUS_NONE_MAPPED;
723 goto failed;
724 }
725
726 ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
727 if (ret != LDB_SUCCESS) {
728 status = NT_STATUS_NONE_MAPPED;
729 goto failed;
730 }
731
732 ret = ldb_msg_add_string(map_msg, "type", "ID_TYPE_BOTH");
733 if (ret != LDB_SUCCESS) {
734 status = NT_STATUS_NONE_MAPPED;
735 goto failed;
736 }
737
738 ret = ldb_msg_add_string(map_msg, "cn", sid_string);
739 if (ret != LDB_SUCCESS) {
740 status = NT_STATUS_NONE_MAPPED;
741 goto failed;
742 }
743
744 ret = ldb_add(ldb, map_msg);
745 if (ret != LDB_SUCCESS) {
746 DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
747 status = NT_STATUS_NONE_MAPPED;
748 goto failed;
749 }
750
751 trans = ldb_transaction_commit(ldb);
752 if (trans != LDB_SUCCESS) {
753 DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
754 status = NT_STATUS_NONE_MAPPED;
755 goto failed;
756 }
757
758 unixid->id = new_xid;
759 unixid->type = ID_TYPE_BOTH;
760 talloc_free(tmp_ctx);
761 return NT_STATUS_OK;
762
763failed:
764 if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
765 talloc_free(tmp_ctx);
766 return status;
767}
768
769/**
770 * Convert an array of unixids to the corresponding array of SIDs
771 *
772 * \param idmap_ctx idmap context to use
773 * \param mem_ctx talloc context the memory for the dom_sids is allocated
774 * from.
775 * \param count length of id_mapping array.
776 * \param id array of id_mappings.
777 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
778 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
779 * did not.
780 */
781
782NTSTATUS idmap_xids_to_sids(struct idmap_context *idmap_ctx,
783 TALLOC_CTX *mem_ctx,
784 struct id_map **id)
785{
786 unsigned int i, error_count = 0;
787 NTSTATUS status;
788
789 for (i = 0; id && id[i]; i++) {
790 status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
791 &id[i]->xid, &id[i]->sid);
792 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
793 status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
794 &id[i]->xid,
795 &id[i]->sid);
796 }
797 if (!NT_STATUS_IS_OK(status)) {
798 DEBUG(1, ("idmapping xid_to_sid failed for id[%d]=%lu: %s\n",
799 i, (unsigned long)id[i]->xid.id, nt_errstr(status)));
800 error_count++;
801 id[i]->status = ID_UNMAPPED;
802 } else {
803 id[i]->status = ID_MAPPED;
804 }
805 }
806
807 if (error_count == i) {
808 /* Mapping did not work at all. */
809 return NT_STATUS_NONE_MAPPED;
810 } else if (error_count > 0) {
811 /* Some mappings worked, some did not. */
812 return STATUS_SOME_UNMAPPED;
813 } else {
814 return NT_STATUS_OK;
815 }
816}
817
818/**
819 * Convert an array of SIDs to the corresponding array of unixids
820 *
821 * \param idmap_ctx idmap context to use
822 * \param mem_ctx talloc context the memory for the unixids is allocated
823 * from.
824 * \param count length of id_mapping array.
825 * \param id array of id_mappings.
826 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
827 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
828 * did not.
829 */
830
831NTSTATUS idmap_sids_to_xids(struct idmap_context *idmap_ctx,
832 TALLOC_CTX *mem_ctx,
833 struct id_map **id)
834{
835 unsigned int i, error_count = 0;
836 NTSTATUS status;
837
838 for (i = 0; id && id[i]; i++) {
839 status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
840 id[i]->sid, &id[i]->xid);
841 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
842 status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
843 id[i]->sid,
844 &id[i]->xid);
845 }
846 if (!NT_STATUS_IS_OK(status)) {
847 char *str = dom_sid_string(mem_ctx, id[i]->sid);
848 DEBUG(1, ("idmapping sid_to_xid failed for id[%d]=%s: %s\n",
849 i, str, nt_errstr(status)));
850 talloc_free(str);
851 error_count++;
852 id[i]->status = ID_UNMAPPED;
853 } else {
854 id[i]->status = ID_MAPPED;
855 }
856 }
857
858 if (error_count == i) {
859 /* Mapping did not work at all. */
860 return NT_STATUS_NONE_MAPPED;
861 } else if (error_count > 0) {
862 /* Some mappings worked, some did not. */
863 return STATUS_SOME_UNMAPPED;
864 } else {
865 return NT_STATUS_OK;
866 }
867}
868
Note: See TracBrowser for help on using the repository browser.