Changeset 745 for trunk/server/source3/winbindd/idmap_util.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/winbindd/idmap_util.c (modified) (11 diffs)

trunk/server/source3/winbindd/idmap_util.c

@@ -4 +4 @@
    Copyright (C) Simo Sorce 2003
    Copyright (C) Jeremy Allison 2006
+   Copyright (C) Michael Adam 2010
 
    This program is free software; you can redistribute it and/or modify
@@ -21 +22 @@
 #include "winbindd.h"
 #include "winbindd_proto.h"
+#include "idmap.h"
+#include "idmap_cache.h"
+#include "../libcli/security/security.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_IDMAP
-
-/*****************************************************************
- Returns true if the request was for a specific domain, or
- for a sid we are authoritative for - BUILTIN, or our own domain.
-*****************************************************************/
-
-static bool is_specific_domain_request(const char *dom_name, DOM_SID *sid)
-{
-        if (dom_name && dom_name[0] != '\0') {
-                return true;
-        }
-        if (sid_check_is_in_builtin(sid) ||
-                        sid_check_is_in_our_domain(sid)) {
-                return true;
-        }
-        return false;
-}
 
 /*****************************************************************
@@ -47 +34 @@
 *****************************************************************/  
 
-NTSTATUS idmap_uid_to_sid(const char *domname, DOM_SID *sid, uid_t uid)
+NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid)
 {
         NTSTATUS ret;
@@ -106 +93 @@
 *****************************************************************/  
 
-NTSTATUS idmap_gid_to_sid(const char *domname, DOM_SID *sid, gid_t gid)
+NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid)
 {
         NTSTATUS ret;
@@ -147 +134 @@
                         struct dom_sid null_sid;
                         ZERO_STRUCT(null_sid);
-                        idmap_cache_set_sid2uid(&null_sid, gid);
+                        idmap_cache_set_sid2gid(&null_sid, gid);
                 }
                 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
@@ -165 +152 @@
 *****************************************************************/  
 
-NTSTATUS idmap_sid_to_uid(const char *dom_name, DOM_SID *sid, uid_t *uid)
+NTSTATUS idmap_sid_to_uid(const char *dom_name, struct dom_sid *sid, uid_t *uid)
 {
         NTSTATUS ret;
@@ -196 +183 @@
         ret = idmap_backends_sid_to_unixid(dom_name, &map);
 
-        if (NT_STATUS_IS_OK(ret) && (map.status == ID_MAPPED)) {
-                if (map.xid.type != ID_TYPE_UID) {
-                        DEBUG(10, ("sid [%s] not mapped to a uid "
-                                   "[%u,%u,%u]\n",
-                                   sid_string_dbg(sid),
-                                   map.status,
-                                   map.xid.type,
-                                   map.xid.id));
-                        if (winbindd_use_idmap_cache()) {
-                                idmap_cache_set_sid2uid(sid, -1);
-                        }
-                        return NT_STATUS_NONE_MAPPED;
-                }
-                goto done;
-        }
-
-        if (is_specific_domain_request(dom_name, sid)) {
-                /*
-                 * We had the task to go to a specific domain or
-                 * a domain for which we are authoritative for and
-                 * it could not answer our request. Fail.
-                 */
+        if (!NT_STATUS_IS_OK(ret)) {
+                DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
+                           nt_errstr(ret)));
                 if (winbindd_use_idmap_cache()) {
                         idmap_cache_set_sid2uid(sid, -1);
                 }
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        ret = idmap_new_mapping(sid, ID_TYPE_UID, &map.xid);
-
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(10, ("idmap_new_mapping failed: %s\n",
-                           nt_errstr(ret)));
+                return ret;
+        }
+
+        if (map.status != ID_MAPPED) {
+                DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
                 if (winbindd_use_idmap_cache()) {
                         idmap_cache_set_sid2uid(sid, -1);
                 }
-                return ret;
-        }
-
-done:
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        if (map.xid.type != ID_TYPE_UID) {
+                DEBUG(10, ("sid [%s] not mapped to a uid "
+                           "[%u,%u,%u]\n",
+                           sid_string_dbg(sid),
+                           map.status,
+                           map.xid.type,
+                           map.xid.id));
+                if (winbindd_use_idmap_cache()) {
+                        idmap_cache_set_sid2uid(sid, -1);
+                }
+                return NT_STATUS_NONE_MAPPED;
+        }
+
         *uid = (uid_t)map.xid.id;
         if (winbindd_use_idmap_cache()) {
@@ -248 +225 @@
 *****************************************************************/  
 
-NTSTATUS idmap_sid_to_gid(const char *domname, DOM_SID *sid, gid_t *gid)
+NTSTATUS idmap_sid_to_gid(const char *domname, struct dom_sid *sid, gid_t *gid)
 {
         NTSTATUS ret;
@@ -278 +255 @@
 
         ret = idmap_backends_sid_to_unixid(domname, &map);
-        if (NT_STATUS_IS_OK(ret) && (map.status == ID_MAPPED)) {
-                if (map.xid.type != ID_TYPE_GID) {
-                        DEBUG(10, ("sid [%s] not mapped to a gid "
-                                   "[%u,%u,%u]\n",
-                                   sid_string_dbg(sid),
-                                   map.status,
-                                   map.xid.type,
-                                   map.xid.id));
-                        if (winbindd_use_idmap_cache()) {
-                                idmap_cache_set_sid2gid(sid, -1);
-                        }
-                        return NT_STATUS_NONE_MAPPED;
-                }
-                goto done;
-        }
-
-        if (is_specific_domain_request(domname, sid)) {
-                /*
-                 * We had the task to go to a specific domain or
-                 * a domain for which we are authoritative for and
-                 * it could not answer our request. Fail.
-                 */
-                if (winbindd_use_idmap_cache()) {
-                        idmap_cache_set_sid2uid(sid, -1);
-                }
-                return NT_STATUS_NONE_MAPPED;
-        }
-
-        ret = idmap_new_mapping(sid, ID_TYPE_GID, &map.xid);
 
         if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(10, ("idmap_new_mapping failed: %s\n",
+                DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
                            nt_errstr(ret)));
                 if (winbindd_use_idmap_cache()) {
@@ -317 +265 @@
         }
 
-done:
+        if (map.status != ID_MAPPED) {
+                DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
+                if (winbindd_use_idmap_cache()) {
+                        idmap_cache_set_sid2gid(sid, -1);
+                }
+                return NT_STATUS_NONE_MAPPED;
+        }
+
+        if (map.xid.type != ID_TYPE_GID) {
+                DEBUG(10, ("sid [%s] not mapped to a gid "
+                           "[%u,%u,%u]\n",
+                           sid_string_dbg(sid),
+                           map.status,
+                           map.xid.type,
+                           map.xid.id));
+                if (winbindd_use_idmap_cache()) {
+                        idmap_cache_set_sid2gid(sid, -1);
+                }
+                return NT_STATUS_NONE_MAPPED;
+        }
+
         *gid = map.xid.id;
         if (winbindd_use_idmap_cache()) {
@@ -324 +292 @@
         return NT_STATUS_OK;
 }
+
+/**
+ * check whether a given unix id is inside the filter range of an idmap domain
+ */
+bool idmap_unix_id_is_in_range(uint32_t id, struct idmap_domain *dom)
+{
+        if (id == 0) {
+                /* 0 is not an allowed unix id for id mapping */
+                return false;
+        }
+
+        if ((dom->low_id && (id < dom->low_id)) ||
+            (dom->high_id && (id > dom->high_id)))
+        {
+                return false;
+        }
+
+        return true;
+}