Changeset 745 for trunk/server/source3/groupdb

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/groupdb/mapping.c (modified) (33 diffs)
• source3/groupdb/mapping.h (modified) (2 diffs)
• source3/groupdb/mapping_ldb.c (deleted)
• source3/groupdb/mapping_tdb.c (modified) (22 diffs)
• source3/groupdb/proto.h (copied) (copied from vendor/current/source3/groupdb/proto.h )

trunk/server/source3/groupdb/mapping.c

@@ -22 +22 @@
 
 #include "includes.h"
+#include "system/passwd.h"
+#include "passdb.h"
 #include "groupdb/mapping.h"
+#include "../libcli/security/security.h"
+#include "lib/winbind_util.h"
+#include <tdb.h>
 
 static const struct mapping_backend *backend;
@@ -31 +36 @@
 static bool init_group_mapping(void)
 {
-        const char *backend_string;
-
         if (backend != NULL) {
                 /* already initialised */
@@ -38 +41 @@
         }
 
-        /*
-         * default to using the ldb backend. This parameter should
-         * disappear in future versions of Samba3.
-         *
-         * But it's needed for cluster setups, because it's
-         * not yet possible to distribute a ldb inside a cluster.
-         */
-        backend_string = lp_parm_const_string(-1, "groupdb", "backend", "ldb");
-
-        if (strcmp(backend_string, "ldb") == 0) {
-                backend = groupdb_ldb_init();
-        } else if (strcmp(backend_string, "tdb") == 0) {
-                backend = groupdb_tdb_init();
-        } else {
-                DEBUG(0,("Unknown groupdb backend '%s'\n", backend_string));
-                smb_panic("Unknown groupdb backend");
-        }
+        backend = groupdb_tdb_init();
 
         return backend != NULL;
@@ -70 +57 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        
+
         map.gid=gid;
         if (!string_to_sid(&map.sid, sid)) {
@@ -76 +63 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-        
+
         map.sid_name_use=sid_name_use;
         fstrcpy(map.nt_name, nt_name);
@@ -84 +71 @@
 }
 
-static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
-                                  DOM_SID **sids, size_t *num)
+static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
+                                  struct dom_sid **sids, size_t *num)
 {
         size_t i;
@@ -101 +88 @@
 
 struct aliasmem_closure {
-        const DOM_SID *alias;
-        DOM_SID **sids;
+        const struct dom_sid *alias;
+        struct dom_sid **sids;
         size_t *num;
 };
@@ -120 +107 @@
 /* get a domain group from it's SID */
 
-bool get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
+bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
 {
         struct group *grp;
         bool ret;
-        
+
         if(!init_group_mapping()) {
                 DEBUG(0,("failed to initialize group mapping\n"));
@@ -133 +120 @@
 
         /* if the group is NOT in the database, it CAN NOT be a domain group */
-        
+
         become_root();
         ret = pdb_getgrsid(map, sid);
         unbecome_root();
-        
+
         /* special case check for rid 513 */
-        
+
         if ( !ret ) {
                 uint32 rid;
-                
+
                 sid_peek_rid( &sid, &rid );
-                
-                if ( rid == DOMAIN_GROUP_RID_USERS ) {
+
+                if ( rid == DOMAIN_RID_USERS ) {
                         fstrcpy( map->nt_name, "None" );
                         fstrcpy( map->comment, "Ordinary Users" );
@@ -151 +138 @@
                         map->sid_name_use = SID_NAME_DOM_GRP;
                         map->gid = (gid_t)-1;
-                        
                         return True;
                 }
-                
                 return False;
         }
 
-        DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
+        DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
 
         /* if it's not a domain group, continue */
@@ -166 +151 @@
 
         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
-        
+
         if (map->gid==-1) {
                 return False;
@@ -172 +157 @@
 
         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
-        
+
         grp = getgrgid(map->gid);
         if ( !grp ) {
@@ -344 +329 @@
                         return -1;
                 }
-                add_script = talloc_string_sub(ctx,
-                                add_script, "%u", unix_user);
+                add_script = talloc_string_sub2(ctx,
+                                add_script, "%u", unix_user, true, false, true);
                 if (!add_script) {
                         return -1;
@@ -384 +369 @@
                         return -1;
                 }
-                del_script = talloc_string_sub(ctx,
-                                del_script, "%u", unix_user);
+                del_script = talloc_string_sub2(ctx,
+                                del_script, "%u", unix_user, true, false, true);
                 if (!del_script) {
                         return -1;
@@ -402 +387 @@
 
 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
-                                 DOM_SID sid)
+                                 struct dom_sid sid)
 {
         if (!init_group_mapping()) {
@@ -457 +442 @@
 
 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
-                                                   DOM_SID sid)
+                                                   struct dom_sid sid)
 {
         if (!init_group_mapping()) {
@@ -468 +453 @@
 
 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
-                                           const DOM_SID *sid, enum lsa_SidType sid_name_use,
+                                           const struct dom_sid *sid, enum lsa_SidType sid_name_use,
                                            GROUP_MAP **pp_rmap, size_t *p_num_entries,
                                            bool unix_only)
@@ -483 +468 @@
                                   const char *name, uint32 *rid)
 {
-        DOM_SID sid;
+        struct dom_sid sid;
         enum lsa_SidType type;
         uint32 new_rid;
@@ -507 +492 @@
         }
 
+        if (!pdb_new_rid(&new_rid)) {
+                DEBUG(0, ("Could not allocate a RID.\n"));
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        sid_compose(&sid, get_global_sam_sid(), new_rid);
+
         if (!winbind_allocate_gid(&gid)) {
-                DEBUG(3, ("Could not get a gid out of winbind\n"));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (!pdb_new_rid(&new_rid)) {
-                DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
+                DEBUG(3, ("Could not get a gid out of winbind - "
+                          "wasted a rid :-(\n"));
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -519 +507 @@
         DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
                    name, (unsigned int)gid, (unsigned int)new_rid));
-
-        sid_copy(&sid, get_global_sam_sid());
-        sid_append_rid(&sid, new_rid);
 
         map.gid = gid;
@@ -543 +528 @@
 
 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
-                                  const DOM_SID *sid)
+                                  const struct dom_sid *sid)
 {
         return pdb_delete_group_mapping_entry(*sid);
@@ -549 +534 @@
 
 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
-                                   const DOM_SID *sid,
+                                   const struct dom_sid *sid,
                                    struct acct_info *info)
 {
@@ -572 +557 @@
 
 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
-                                   const DOM_SID *sid,
+                                   const struct dom_sid *sid,
                                    struct acct_info *info)
 {
@@ -587 +572 @@
 
 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
-                                  const DOM_SID *alias, const DOM_SID *member)
+                                  const struct dom_sid *alias, const struct dom_sid *member)
 {
         if (!init_group_mapping()) {
@@ -597 +582 @@
 
 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
-                                  const DOM_SID *alias, const DOM_SID *member)
+                                  const struct dom_sid *alias, const struct dom_sid *member)
 {
         if (!init_group_mapping()) {
@@ -607 +592 @@
 
 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
-                                   const DOM_SID *alias, TALLOC_CTX *mem_ctx,
-                                   DOM_SID **pp_members, size_t *p_num_members)
+                                   const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
+                                   struct dom_sid **pp_members, size_t *p_num_members)
 {
         if (!init_group_mapping()) {
@@ -620 +605 @@
 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
                                        TALLOC_CTX *mem_ctx,
-                                       const DOM_SID *domain_sid,
-                                       const DOM_SID *members,
+                                       const struct dom_sid *domain_sid,
+                                       const struct dom_sid *members,
                                        size_t num_members,
                                        uint32 **pp_alias_rids,
                                        size_t *p_num_alias_rids)
 {
-        DOM_SID *alias_sids;
+        struct dom_sid *alias_sids;
         size_t i, num_alias_sids;
         NTSTATUS result;
@@ -672 +657 @@
 
 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
-                                 DOM_SID sid)
+                                 struct dom_sid sid)
 {
         return NT_STATUS_UNSUCCESSFUL;
@@ -702 +687 @@
 
 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
-                                                   DOM_SID sid)
+                                                   struct dom_sid sid)
 {
         return NT_STATUS_UNSUCCESSFUL;
@@ -718 +703 @@
  These need to be redirected through pdb_interface.c
 ****************************************************************************/
-bool pdb_get_dom_grp_info(const DOM_SID *sid, struct acct_info *info)
+bool pdb_get_dom_grp_info(const struct dom_sid *sid, struct acct_info *info)
 {
         GROUP_MAP map;
@@ -736 +721 @@
 }
 
-bool pdb_set_dom_grp_info(const DOM_SID *sid, const struct acct_info *info)
+bool pdb_set_dom_grp_info(const struct dom_sid *sid, const struct acct_info *info)
 {
         GROUP_MAP map;
@@ -755 +740 @@
 NTSTATUS pdb_create_builtin_alias(uint32 rid)
 {
-        DOM_SID sid;
+        struct dom_sid sid;
         enum lsa_SidType type;
         gid_t gid;
@@ -765 +750 @@
 
         DEBUG(10, ("Trying to create builtin alias %d\n", rid));
-        
+
         if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
                 return NT_STATUS_NO_SUCH_ALIAS;
         }
-        
+
         if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
         if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
                 TALLOC_FREE( mem_ctx );
                 return NT_STATUS_NO_SUCH_ALIAS;
         }
-        
+
         /* validate RID so copy the name and move on */
-                
+
         fstrcpy( groupname, name );
         TALLOC_FREE( mem_ctx );

trunk/server/source3/groupdb/mapping.h

@@ +1 @@
+/*
+ *  Unix SMB/CIFS implementation.
+ *  RPC Pipe client / server routines
+ *  Copyright (C) Andrew Tridgell              1992-2000,
+ *  Copyright (C) Jean François Micouleau      1998-2001.
+ *  Copyright (C) Volker Lendecke              2006.
+ *  Copyright (C) Gerald Carter                2006.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
 #define DATABASE_VERSION_V1 1 /* native byte format. */
 #define DATABASE_VERSION_V2 2 /* le format. */
@@ -19 +41 @@
         bool (*init_group_mapping)(void);
         bool (*add_mapping_entry)(GROUP_MAP *map, int flag);
-        bool (*get_group_map_from_sid)(DOM_SID sid, GROUP_MAP *map);
+        bool (*get_group_map_from_sid)(struct dom_sid sid, GROUP_MAP *map);
         bool (*get_group_map_from_gid)(gid_t gid, GROUP_MAP *map);
         bool (*get_group_map_from_ntname)(const char *name, GROUP_MAP *map);
-        bool (*group_map_remove)(const DOM_SID *sid);
-        bool (*enum_group_mapping)(const DOM_SID *domsid, enum lsa_SidType sid_name_use, 
+        bool (*group_map_remove)(const struct dom_sid *sid);
+        bool (*enum_group_mapping)(const struct dom_sid *domsid, enum lsa_SidType sid_name_use,
                                    GROUP_MAP **pp_rmap,
                                    size_t *p_num_entries, bool unix_only);
-        NTSTATUS (*one_alias_membership)(const DOM_SID *member,
-                                         DOM_SID **sids, size_t *num);
-        NTSTATUS (*add_aliasmem)(const DOM_SID *alias, const DOM_SID *member);
-        NTSTATUS (*del_aliasmem)(const DOM_SID *alias, const DOM_SID *member);
-        NTSTATUS (*enum_aliasmem)(const DOM_SID *alias, TALLOC_CTX *mem_ctx,
-                                  DOM_SID **sids, size_t *num);
+        NTSTATUS (*one_alias_membership)(const struct dom_sid *member,
+                                         struct dom_sid **sids, size_t *num);
+        NTSTATUS (*add_aliasmem)(const struct dom_sid *alias, const struct dom_sid *member);
+        NTSTATUS (*del_aliasmem)(const struct dom_sid *alias, const struct dom_sid *member);
+        NTSTATUS (*enum_aliasmem)(const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
+                                  struct dom_sid **sids, size_t *num);
 };

trunk/server/source3/groupdb/mapping_tdb.c

@@ -22 +22 @@
 
 #include "includes.h"
+#include "system/filesys.h"
+#include "passdb.h"
 #include "groupdb/mapping.h"
+#include "dbwrap.h"
+#include "util_tdb.h"
+#include "../libcli/security/security.h"
 
 static struct db_context *db; /* used for driver files */
 
-static bool enum_group_mapping(const DOM_SID *domsid, enum lsa_SidType sid_name_use, GROUP_MAP **pp_rmap,
-                               size_t *p_num_entries, bool unix_only);
-static bool group_map_remove(const DOM_SID *sid);
-        
+static bool enum_group_mapping(const struct dom_sid *domsid,
+                               enum lsa_SidType sid_name_use,
+                               GROUP_MAP **pp_rmap,
+                               size_t *p_num_entries,
+                               bool unix_only);
+static bool group_map_remove(const struct dom_sid *sid);
+
+static bool mapping_switch(const char *ldb_path);
+
 /****************************************************************************
  Open the group mapping tdb.
@@ -35 +45 @@
 static bool init_group_mapping(void)
 {
+        const char *ldb_path;
+
         if (db != NULL) {
                 return true;
@@ -47 +59 @@
         }
 
-#if 0
-        /*
-         * This code was designed to handle a group mapping version
-         * upgrade. mapping_tdb is not active by default anymore, so ignore
-         * this here.
-         */
-        {
+        ldb_path = state_path("group_mapping.ldb");
+        if (file_exist(ldb_path) && !mapping_switch(ldb_path)) {
+                unlink(state_path("group_mapping.tdb"));
+                return false;
+
+        } else {
+                /* handle upgrade from old versions of the database */
+#if 0 /* -- Needs conversion to dbwrap -- */
                 const char *vstring = "INFO/version";
                 int32 vers_id;
@@ -97 +110 @@
                         SAFE_FREE( map_table );
                 }
-        }
 #endif
-
+        }
         return true;
 }
 
-static char *group_mapping_key(TALLOC_CTX *mem_ctx, const DOM_SID *sid)
+static char *group_mapping_key(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
 {
         char *sidstr, *result;
@@ -156 +168 @@
 ****************************************************************************/
 
-static bool get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map)
+static bool get_group_map_from_sid(struct dom_sid sid, GROUP_MAP *map)
 {
         TDB_DATA dbuf;
@@ -280 +292 @@
 ****************************************************************************/
 
-static bool group_map_remove(const DOM_SID *sid)
+static bool group_map_remove(const struct dom_sid *sid)
 {
         char *key;
@@ -301 +313 @@
 
 struct enum_map_state {
-        const DOM_SID *domsid;
+        const struct dom_sid *domsid;
         enum lsa_SidType sid_name_use;
         bool unix_only;
@@ -333 +345 @@
 
         if ((state->domsid != NULL) &&
-            (sid_compare_domain(state->domsid, &map.sid) != 0)) {
+            (dom_sid_compare_domain(state->domsid, &map.sid) != 0)) {
                 DEBUG(11,("enum_group_mapping: group %s is not in domain\n",
                           sid_string_dbg(&map.sid)));
@@ -352 +364 @@
 }
 
-static bool enum_group_mapping(const DOM_SID *domsid,
+static bool enum_group_mapping(const struct dom_sid *domsid,
                                enum lsa_SidType sid_name_use,
                                GROUP_MAP **pp_rmap,
@@ -378 +390 @@
  * store a list of aliases a SID is member of hanging off MEMBEROF/SID. */
 
-static NTSTATUS one_alias_membership(const DOM_SID *member,
-                               DOM_SID **sids, size_t *num)
+static NTSTATUS one_alias_membership(const struct dom_sid *member,
+                               struct dom_sid **sids, size_t *num)
 {
         fstring tmp;
@@ -401 +413 @@
 
         while (next_token_talloc(frame, &p, &string_sid, " ")) {
-                DOM_SID alias;
+                struct dom_sid alias;
+                uint32_t num_sids;
 
                 if (!string_to_sid(&alias, string_sid))
                         continue;
 
-                status= add_sid_to_array_unique(NULL, &alias, sids, num);
+                num_sids = *num;
+                status= add_sid_to_array_unique(NULL, &alias, sids, &num_sids);
                 if (!NT_STATUS_IS_OK(status)) {
                         goto done;
                 }
+                *num = num_sids;
         }
 
@@ -417 +432 @@
 }
 
-static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
-                                  DOM_SID **sids, size_t *num)
+static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
+                                  struct dom_sid **sids, size_t *num)
 {
         size_t i;
@@ -433 +448 @@
 }
 
-static bool is_aliasmem(const DOM_SID *alias, const DOM_SID *member)
-{
-        DOM_SID *sids;
-        size_t i, num;
+static bool is_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
+{
+        struct dom_sid *sids;
+        size_t i;
+        size_t num;
 
         /* This feels the wrong way round, but the on-disk data structure
@@ -444 +460 @@
 
         for (i=0; i<num; i++) {
-                if (sid_compare(alias, &sids[i]) == 0) {
+                if (dom_sid_compare(alias, &sids[i]) == 0) {
                         TALLOC_FREE(sids);
                         return True;
@@ -454 +470 @@
 
 
-static NTSTATUS add_aliasmem(const DOM_SID *alias, const DOM_SID *member)
+static NTSTATUS add_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
 {
         GROUP_MAP map;
@@ -537 +553 @@
 struct aliasmem_state {
         TALLOC_CTX *mem_ctx;
-        const DOM_SID *alias;
-        DOM_SID **sids;
+        const struct dom_sid *alias;
+        struct dom_sid **sids;
         size_t *num;
 };
@@ -558 +574 @@
 
         while (next_token_talloc(frame, &p, &alias_string, " ")) {
-                DOM_SID alias, member;
+                struct dom_sid alias, member;
                 const char *member_string;
+                uint32_t num_sids;
 
                 if (!string_to_sid(&alias, alias_string))
                         continue;
 
-                if (sid_compare(state->alias, &alias) != 0)
+                if (dom_sid_compare(state->alias, &alias) != 0)
                         continue;
 
@@ -582 +599 @@
                         continue;
 
+                num_sids = *state->num;
                 if (!NT_STATUS_IS_OK(add_sid_to_array(state->mem_ctx, &member,
                                                       state->sids,
-                                                      state->num)))
+                                                      &num_sids)))
                 {
                         /* talloc fail. */
                         break;
                 }
+                *state->num = num_sids;
         }
 
@@ -595 +614 @@
 }
 
-static NTSTATUS enum_aliasmem(const DOM_SID *alias, TALLOC_CTX *mem_ctx,
-                              DOM_SID **sids, size_t *num)
+static NTSTATUS enum_aliasmem(const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
+                              struct dom_sid **sids, size_t *num)
 {
         GROUP_MAP map;
@@ -620 +639 @@
 }
 
-static NTSTATUS del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
+static NTSTATUS del_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
 {
         NTSTATUS status;
-        DOM_SID *sids;
+        struct dom_sid *sids;
         size_t i, num;
         bool found = False;
@@ -642 +661 @@
 
         for (i=0; i<num; i++) {
-                if (sid_compare(&sids[i], alias) == 0) {
+                if (dom_sid_compare(&sids[i], alias) == 0) {
                         found = True;
                         break;
@@ -718 +737 @@
         }
         return status;
+}
+
+
+/* -- ldb->tdb switching code -------------------------------------------- */
+
+/* change this if the data format ever changes */
+#define LTDB_PACKING_FORMAT 0x26011967
+
+/* old packing formats (not supported for now,
+ * it was never used for group mapping AFAIK) */
+#define LTDB_PACKING_FORMAT_NODN 0x26011966
+
+static unsigned int pull_uint32(uint8_t *p, int ofs)
+{
+        p += ofs;
+        return p[0] | (p[1]<<8) | (p[2]<<16) | (p[3]<<24);
+}
+
+/*
+  unpack a ldb message from a linear buffer in TDB_DATA
+*/
+static int convert_ldb_record(TDB_CONTEXT *ltdb, TDB_DATA key,
+                              TDB_DATA data, void *ptr)
+{
+        TALLOC_CTX *tmp_ctx = talloc_tos();
+        GROUP_MAP map;
+        uint8_t *p;
+        uint32_t format;
+        uint32_t num_el;
+        unsigned int remaining;
+        unsigned int i, j;
+        size_t len;
+        char *name;
+        char *val;
+        char *q;
+        uint32_t num_mem = 0;
+        struct dom_sid *members = NULL;
+
+        p = (uint8_t *)data.dptr;
+        if (data.dsize < 8) {
+                errno = EIO;
+                goto failed;
+        }
+
+        format = pull_uint32(p, 0);
+        num_el = pull_uint32(p, 4);
+        p += 8;
+
+        remaining = data.dsize - 8;
+
+        switch (format) {
+        case LTDB_PACKING_FORMAT:
+                len = strnlen((char *)p, remaining);
+                if (len == remaining) {
+                        errno = EIO;
+                        goto failed;
+                }
+
+                if (*p == '@') {
+                        /* ignore special LDB attributes */
+                        return 0;
+                }
+
+                if (strncmp((char *)p, "rid=", 4)) {
+                        /* unknown entry, ignore */
+                        DEBUG(3, ("Found unknown entry in group mapping "
+                                  "database named [%s]\n", (char *)p));
+                        return 0;
+                }
+
+                remaining -= len + 1;
+                p += len + 1;
+                break;
+
+        case LTDB_PACKING_FORMAT_NODN:
+        default:
+                errno = EIO;
+                goto failed;
+        }
+
+        if (num_el == 0) {
+                /* bad entry, ignore */
+                return 0;
+        }
+
+        if (num_el > remaining / 6) {
+                errno = EIO;
+                goto failed;
+        }
+
+        ZERO_STRUCT(map);
+
+        for (i = 0; i < num_el; i++) {
+                uint32_t num_vals;
+
+                if (remaining < 10) {
+                        errno = EIO;
+                        goto failed;
+                }
+                len = strnlen((char *)p, remaining - 6);
+                if (len == remaining - 6) {
+                        errno = EIO;
+                        goto failed;
+                }
+                name = talloc_strndup(tmp_ctx, (char *)p, len);
+                if (name == NULL) {
+                        errno = ENOMEM;
+                        goto failed;
+                }
+                remaining -= len + 1;
+                p += len + 1;
+
+                num_vals = pull_uint32(p, 0);
+                if (StrCaseCmp(name, "member") == 0) {
+                        num_mem = num_vals;
+                        members = talloc_array(tmp_ctx, struct dom_sid, num_mem);
+                        if (members == NULL) {
+                                errno = ENOMEM;
+                                goto failed;
+                        }
+                } else if (num_vals != 1) {
+                        errno = EIO;
+                        goto failed;
+                }
+
+                p += 4;
+                remaining -= 4;
+
+                for (j = 0; j < num_vals; j++) {
+                        len = pull_uint32(p, 0);
+                        if (len > remaining-5) {
+                                errno = EIO;
+                                goto failed;
+                        }
+
+                        val = talloc_strndup(tmp_ctx, (char *)(p + 4), len);
+                        if (val == NULL) {
+                                errno = ENOMEM;
+                                goto failed;
+                        }
+
+                        remaining -= len+4+1;
+                        p += len+4+1;
+
+                        /* we ignore unknown or uninteresting attributes
+                         * (objectclass, etc.) */
+                        if (StrCaseCmp(name, "gidNumber") == 0) {
+                                map.gid = strtoul(val, &q, 10);
+                                if (*q) {
+                                        errno = EIO;
+                                        goto failed;
+                                }
+                        } else if (StrCaseCmp(name, "sid") == 0) {
+                                if (!string_to_sid(&map.sid, val)) {
+                                        errno = EIO;
+                                        goto failed;
+                                }
+                        } else if (StrCaseCmp(name, "sidNameUse") == 0) {
+                                map.sid_name_use = strtoul(val, &q, 10);
+                                if (*q) {
+                                        errno = EIO;
+                                        goto failed;
+                                }
+                        } else if (StrCaseCmp(name, "ntname") == 0) {
+                                strlcpy(map.nt_name, val,
+                                        sizeof(map.nt_name));
+                        } else if (StrCaseCmp(name, "comment") == 0) {
+                                strlcpy(map.comment, val,
+                                        sizeof(map.comment));
+                        } else if (StrCaseCmp(name, "member") == 0) {
+                                if (!string_to_sid(&members[j], val)) {
+                                        errno = EIO;
+                                        goto failed;
+                                }
+                        }
+
+                        TALLOC_FREE(val);
+                }
+
+                TALLOC_FREE(name);
+        }
+
+        if (!add_mapping_entry(&map, 0)) {
+                errno = EIO;
+                goto failed;
+        }
+
+        if (num_mem) {
+                for (j = 0; j < num_mem; j++) {
+                        NTSTATUS status;
+                        status = add_aliasmem(&map.sid, &members[j]);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                errno = EIO;
+                                goto failed;
+                        }
+                }
+        }
+
+        if (remaining != 0) {
+                DEBUG(0, ("Errror: %d bytes unread in ltdb_unpack_data\n",
+                          remaining));
+        }
+
+        return 0;
+
+failed:
+        return -1;
+}
+
+static bool mapping_switch(const char *ldb_path)
+{
+        TDB_CONTEXT *ltdb;
+        TALLOC_CTX *frame;
+        char *new_path;
+        int ret;
+
+        frame = talloc_stackframe();
+
+        ltdb = tdb_open_log(ldb_path, 0, TDB_DEFAULT, O_RDONLY, 0600);
+        if (ltdb == NULL) goto failed;
+
+        /* ldb is just a very fancy tdb, read out raw data and perform
+         * conversion */
+        ret = tdb_traverse(ltdb, convert_ldb_record, NULL);
+        if (ret == -1) goto failed;
+
+        if (ltdb) {
+                tdb_close(ltdb);
+                ltdb = NULL;
+        }
+
+        /* now rename the old db out of the way */
+        new_path = state_path("group_mapping.ldb.replaced");
+        if (!new_path) {
+                goto failed;
+        }
+        if (rename(ldb_path, new_path) != 0) {
+                DEBUG(0,("Failed to rename old group mapping database\n"));
+                goto failed;
+        }
+        TALLOC_FREE(frame);
+        return True;
+
+failed:
+        DEBUG(0, ("Failed to switch to tdb group mapping database\n"));
+        if (ltdb) tdb_close(ltdb);
+        TALLOC_FREE(frame);
+        return False;
 }