source/nsswitch/idmap_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping Cache
   4
   5    based on gencache
   6
   7    Copyright (C) Simo Sorce             2006
   8    Copyright (C) Rafal Szczesniak       2002
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26
  27 #define TIMEOUT_LEN 12
  28 #define IDMAP_CACHE_DATA_FMT    "%12u/%s"
  29 #define IDMAP_READ_CACHE_DATA_FMT_TEMPLATE "%%12u/%%%us"
  30
  31 struct idmap_cache_ctx {
  32         TDB_CONTEXT *tdb;
  33 };
  34
  35 static int idmap_cache_destructor(struct idmap_cache_ctx *cache)
  36 {
  37         int ret = 0;
  38
  39         if (cache && cache->tdb) {
  40                 ret = tdb_close(cache->tdb);
  41                 cache->tdb = NULL;
  42         }
  43
  44         return ret;
  45 }
  46
  47 struct idmap_cache_ctx *idmap_cache_init(TALLOC_CTX *memctx)
  48 {
  49         struct idmap_cache_ctx *cache;
  50         char* cache_fname = NULL;
  51
  52         cache = talloc(memctx, struct idmap_cache_ctx);
  53         if ( ! cache) {
  54                 DEBUG(0, ("Out of memory!\n"));
  55                 return NULL;
  56         }
  57
  58         cache_fname = lock_path("idmap_cache.tdb");
  59
  60         DEBUG(10, ("Opening cache file at %s\n", cache_fname));
  61
  62         cache->tdb = tdb_open_log(cache_fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  63
  64         if (!cache->tdb) {
  65                 DEBUG(5, ("Attempt to open %s has failed.\n", cache_fname));
  66                 return NULL;
  67         }
  68
  69         talloc_set_destructor(cache, idmap_cache_destructor);
  70
  71         return cache;
  72 }
  73
  74 void idmap_cache_shutdown(struct idmap_cache_ctx *cache)
  75 {
  76         talloc_free(cache);
  77 }
  78
  79 NTSTATUS idmap_cache_build_sidkey(TALLOC_CTX *ctx, char **sidkey, const struct id_map *id)
  80 {
  81         *sidkey = talloc_asprintf(ctx, "IDMAP/SID/%s", sid_string_static(id->sid));
  82         if ( ! *sidkey) {
  83                 DEBUG(1, ("failed to build sidkey, OOM?\n"));
  84                 return NT_STATUS_NO_MEMORY;
  85         }
  86
  87         return NT_STATUS_OK;
  88 }
  89
  90 NTSTATUS idmap_cache_build_idkey(TALLOC_CTX *ctx, char **idkey, const struct id_map *id)
  91 {
  92         *idkey = talloc_asprintf(ctx, "IDMAP/%s/%lu",
  93                                 (id->xid.type==ID_TYPE_UID)?"UID":"GID",
  94                                 (unsigned long)id->xid.id);
  95         if ( ! *idkey) {
  96                 DEBUG(1, ("failed to build idkey, OOM?\n"));
  97                 return NT_STATUS_NO_MEMORY;
  98         }
  99
 100         return NT_STATUS_OK;
 101 }
 102
 103 NTSTATUS idmap_cache_set(struct idmap_cache_ctx *cache, const struct id_map *id)
 104 {
 105         NTSTATUS ret;
 106         time_t timeout = time(NULL) + lp_idmap_cache_time();
 107         TDB_DATA keybuf, databuf;
 108         char *sidkey;
 109         char *idkey;
 110         char *valstr;
 111
 112         /* Don't cache lookups in the S-1-22-{1,2} domain */
 113         if ( (id->xid.type == ID_TYPE_UID) &&
 114              sid_check_is_in_unix_users(id->sid) )
 115         {
 116                 return NT_STATUS_OK;
 117         }
 118         if ( (id->xid.type == ID_TYPE_GID) &&
 119              sid_check_is_in_unix_groups(id->sid) )
 120         {
 121                 return NT_STATUS_OK;
 122         }
 123
 124
 125         ret = idmap_cache_build_sidkey(cache, &sidkey, id);
 126         if (!NT_STATUS_IS_OK(ret)) return ret;
 127
 128         /* use sidkey as the local memory ctx */
 129         ret = idmap_cache_build_idkey(sidkey, &idkey, id);
 130         if (!NT_STATUS_IS_OK(ret)) {
 131                 goto done;
 132         }
 133
 134         /* save SID -> ID */
 135
 136         /* use sidkey as the local memory ctx */
 137         valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, idkey);
 138         if (!valstr) {
 139                 DEBUG(0, ("Out of memory!\n"));
 140                 ret = NT_STATUS_NO_MEMORY;
 141                 goto done;
 142         }
 143
 144         keybuf.dptr = sidkey;
 145         keybuf.dsize = strlen(sidkey)+1;
 146         databuf.dptr = valstr;
 147         databuf.dsize = strlen(valstr)+1;
 148         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 149                    " %s (%d seconds %s)\n", keybuf.dptr, valstr , ctime(&timeout),
 150                    (int)(timeout - time(NULL)),
 151                    timeout > time(NULL) ? "ahead" : "in the past"));
 152
 153         if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
 154                 DEBUG(3, ("Failed to store cache entry!\n"));
 155                 ret = NT_STATUS_UNSUCCESSFUL;
 156                 goto done;
 157         }
 158
 159         /* save ID -> SID */
 160
 161         /* use sidkey as the local memory ctx */
 162         valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, sidkey);
 163         if (!valstr) {
 164                 DEBUG(0, ("Out of memory!\n"));
 165                 ret = NT_STATUS_NO_MEMORY;
 166                 goto done;
 167         }
 168
 169         keybuf.dptr = idkey;
 170         keybuf.dsize = strlen(idkey)+1;
 171         databuf.dptr = valstr;
 172         databuf.dsize = strlen(valstr)+1;
 173         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 174                    " %s (%d seconds %s)\n", keybuf.dptr, valstr, ctime(&timeout),
 175                    (int)(timeout - time(NULL)),
 176                    timeout > time(NULL) ? "ahead" : "in the past"));
 177
 178         if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
 179                 DEBUG(3, ("Failed to store cache entry!\n"));
 180                 ret = NT_STATUS_UNSUCCESSFUL;
 181                 goto done;
 182         }
 183
 184         ret = NT_STATUS_OK;
 185
 186 done:
 187         talloc_free(sidkey);
 188         return ret;
 189 }
 190
 191 NTSTATUS idmap_cache_del(struct idmap_cache_ctx *cache, const struct id_map *id)
 192 {
 193         NTSTATUS ret;
 194         TDB_DATA keybuf;
 195         char *sidkey = NULL;
 196         char *idkey = NULL;
 197
 198         ret = idmap_cache_build_sidkey(cache, &sidkey, id);
 199         if (!NT_STATUS_IS_OK(ret)) return ret;
 200
 201         ret = idmap_cache_build_idkey(cache, &idkey, id);
 202         if (!NT_STATUS_IS_OK(ret)) {
 203                 goto done;
 204         }
 205
 206         /* delete SID */
 207
 208         keybuf.dptr = sidkey;
 209         keybuf.dsize = strlen(sidkey)+1;
 210         DEBUG(10, ("Deleting cache entry (key = %s)\n", keybuf.dptr));
 211
 212         if (tdb_delete(cache->tdb, keybuf) != 0) {
 213                 DEBUG(3, ("Failed to delete cache entry!\n"));
 214         }
 215
 216         /* delete ID */
 217
 218         keybuf.dptr = idkey;
 219         keybuf.dsize = strlen(idkey)+1;
 220         DEBUG(10, ("Deleting cache entry (key = %s)\n", keybuf.dptr));
 221
 222         if (tdb_delete(cache->tdb, keybuf) != 0) {
 223                 DEBUG(3, ("Failed to delete cache entry!\n"));
 224         }
 225
 226 done:
 227         talloc_free(sidkey);
 228         talloc_free(idkey);
 229         return ret;
 230 }
 231
 232 NTSTATUS idmap_cache_set_negative_sid(struct idmap_cache_ctx *cache, const struct id_map *id)
 233 {
 234         NTSTATUS ret;
 235         time_t timeout = time(NULL) + lp_idmap_negative_cache_time();
 236         TDB_DATA keybuf, databuf;
 237         char *sidkey;
 238         char *valstr;
 239
 240         ret = idmap_cache_build_sidkey(cache, &sidkey, id);
 241         if (!NT_STATUS_IS_OK(ret)) return ret;
 242
 243         /* use sidkey as the local memory ctx */
 244         valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
 245         if (!valstr) {
 246                 DEBUG(0, ("Out of memory!\n"));
 247                 ret = NT_STATUS_NO_MEMORY;
 248                 goto done;
 249         }
 250
 251         keybuf.dptr = sidkey;
 252         keybuf.dsize = strlen(sidkey)+1;
 253         databuf.dptr = valstr;
 254         databuf.dsize = strlen(valstr)+1;
 255         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 256                    " %s (%d seconds %s)\n", keybuf.dptr, valstr, ctime(&timeout),
 257                    (int)(timeout - time(NULL)),
 258                    timeout > time(NULL) ? "ahead" : "in the past"));
 259
 260         if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
 261                 DEBUG(3, ("Failed to store cache entry!\n"));
 262                 ret = NT_STATUS_UNSUCCESSFUL;
 263                 goto done;
 264         }
 265
 266 done:
 267         talloc_free(sidkey);
 268         return ret;
 269 }
 270
 271 NTSTATUS idmap_cache_set_negative_id(struct idmap_cache_ctx *cache, const struct id_map *id)
 272 {
 273         NTSTATUS ret;
 274         time_t timeout = time(NULL) + lp_idmap_negative_cache_time();
 275         TDB_DATA keybuf, databuf;
 276         char *idkey;
 277         char *valstr;
 278
 279         ret = idmap_cache_build_idkey(cache, &idkey, id);
 280         if (!NT_STATUS_IS_OK(ret)) return ret;
 281
 282         /* use idkey as the local memory ctx */
 283         valstr = talloc_asprintf(idkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
 284         if (!valstr) {
 285                 DEBUG(0, ("Out of memory!\n"));
 286                 ret = NT_STATUS_NO_MEMORY;
 287                 goto done;
 288         }
 289
 290         keybuf.dptr = idkey;
 291         keybuf.dsize = strlen(idkey)+1;
 292         databuf.dptr = valstr;
 293         databuf.dsize = strlen(valstr)+1;
 294         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 295                    " %s (%d seconds %s)\n", keybuf.dptr, valstr, ctime(&timeout),
 296                    (int)(timeout - time(NULL)),
 297                    timeout > time(NULL) ? "ahead" : "in the past"));
 298
 299         if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
 300                 DEBUG(3, ("Failed to store cache entry!\n"));
 301                 ret = NT_STATUS_UNSUCCESSFUL;
 302                 goto done;
 303         }
 304
 305 done:
 306         talloc_free(idkey);
 307         return ret;
 308 }
 309
 310 NTSTATUS idmap_cache_fill_map(struct id_map *id, const char *value)
 311 {
 312         char *rem;
 313
 314         /* see if it is a sid */
 315         if ( ! strncmp("IDMAP/SID/", value, 10)) {
 316
 317                 if ( ! string_to_sid(id->sid, &value[10])) {
 318                         goto failed;
 319                 }
 320
 321                 id->status = ID_MAPPED;
 322
 323                 return NT_STATUS_OK;
 324         }
 325
 326         /* not a SID see if it is an UID or a GID */
 327         if ( ! strncmp("IDMAP/UID/", value, 10)) {
 328
 329                 /* a uid */
 330                 id->xid.type = ID_TYPE_UID;
 331
 332         } else if ( ! strncmp("IDMAP/GID/", value, 10)) {
 333
 334                 /* a gid */
 335                 id->xid.type = ID_TYPE_GID;
 336
 337         } else {
 338
 339                 /* a completely bogus value bail out */
 340                 goto failed;
 341         }
 342
 343         id->xid.id = strtol(&value[10], &rem, 0);
 344         if (*rem != '\0') {
 345                 goto failed;
 346         }
 347
 348         id->status = ID_MAPPED;
 349
 350         return NT_STATUS_OK;
 351
 352 failed:
 353         DEBUG(1, ("invalid value: %s\n", value));
 354         id->status = ID_UNKNOWN;
 355         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 356 }
 357
 358 BOOL idmap_cache_is_negative(const char *val)
 359 {
 360         if ( ! strcmp("IDMAP/NEGATIVE", val)) {
 361                 return True;
 362         }
 363         return False;
 364 }
 365
 366 /* search the cahce for the SID an return a mapping if found *
 367  *
 368  * 4 cases are possible
 369  *
 370  * 1 map found
 371  *      in this case id->status = ID_MAPPED and NT_STATUS_OK is returned
 372  * 2 map not found
 373  *      in this case id->status = ID_UNKNOWN and NT_STATUS_NONE_MAPPED is returned
 374  * 3 negative cache found
 375  *      in this case id->status = ID_UNMAPPED and NT_STATUS_OK is returned
 376  * 4 map found but timer expired
 377  *      in this case id->status = ID_EXPIRED and NT_STATUS_SYNCHRONIZATION_REQUIRED
 378  *      is returned. In this case revalidation of the cache is needed.
 379  */
 380
 381 NTSTATUS idmap_cache_map_sid(struct idmap_cache_ctx *cache, struct id_map *id)
 382 {
 383         NTSTATUS ret;
 384         TDB_DATA keybuf, databuf;
 385         time_t t, now;
 386         char *sidkey;
 387         char *endptr;
 388
 389         /* make sure it is marked as unknown by default */
 390         id->status = ID_UNKNOWN;
 391
 392         ret = idmap_cache_build_sidkey(cache, &sidkey, id);
 393         if (!NT_STATUS_IS_OK(ret)) return ret;
 394
 395         keybuf.dptr = sidkey;
 396         keybuf.dsize = strlen(sidkey)+1;
 397
 398         databuf = tdb_fetch(cache->tdb, keybuf);
 399
 400         if (databuf.dptr == NULL) {
 401                 DEBUG(10, ("Cache entry with key = %s couldn't be found\n", sidkey));
 402                 ret = NT_STATUS_NONE_MAPPED;
 403                 goto done;
 404         }
 405
 406         t = strtol(databuf.dptr, &endptr, 10);
 407
 408         if ((endptr == NULL) || (*endptr != '/')) {
 409                 DEBUG(2, ("Invalid gencache data format: %s\n", databuf.dptr));
 410                 /* remove the entry */
 411                 tdb_delete(cache->tdb, keybuf);
 412                 ret = NT_STATUS_NONE_MAPPED;
 413                 goto done;
 414         }
 415
 416         now = time(NULL);
 417
 418         /* check it is not negative */
 419         if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
 420
 421                 DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
 422                            "timeout = %s", t > now ? "valid" :
 423                            "expired", sidkey, endptr+1, ctime(&t)));
 424
 425                 /* this call if successful will also mark the entry as mapped */
 426                 ret = idmap_cache_fill_map(id, endptr+1);
 427                 if ( ! NT_STATUS_IS_OK(ret)) {
 428                         /* if not valid form delete the entry */
 429                         tdb_delete(cache->tdb, keybuf);
 430                         ret = NT_STATUS_NONE_MAPPED;
 431                         goto done;
 432                 }
 433
 434                 /* here ret == NT_STATUS_OK and id->status = ID_MAPPED */
 435
 436                 if (t <= now) {
 437
 438                         /* we have it, but it is expired */
 439                         id->status = ID_EXPIRED;
 440
 441                         /* We're expired, set an error code
 442                            for upper layer */
 443                         ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 444                 }
 445         } else {
 446                 if (t <= now) {
 447                         /* We're expired, delete the NEGATIVE entry and return
 448                            not mapped */
 449                         tdb_delete(cache->tdb, keybuf);
 450                         ret = NT_STATUS_NONE_MAPPED;
 451                 } else {
 452                         /* this is not mapped as it was a negative cache hit */
 453                         id->status = ID_UNMAPPED;
 454                         ret = NT_STATUS_OK;
 455                 }
 456         }
 457
 458 done:
 459         SAFE_FREE(databuf.dptr);
 460         talloc_free(sidkey);
 461         return ret;
 462 }
 463
 464 /* search the cahce for the ID an return a mapping if found *
 465  *
 466  * 3 cases are possible
 467  *
 468  * 1 map found
 469  *      in this case id->status = ID_MAPPED and NT_STATUS_OK is returned
 470  * 2 map not found
 471  *      in this case id->status = ID_UNKNOWN and NT_STATUS_NONE_MAPPED is returned
 472  * 3 negative cache found
 473  *      in this case id->status = ID_UNMAPPED and NT_STATUS_OK is returned
 474  * 4 map found but timer expired
 475  *      in this case id->status = ID_EXPIRED and NT_STATUS_SYNCHRONIZATION_REQUIRED
 476  *      is returned. In this case revalidation of the cache is needed.
 477  */
 478
 479 NTSTATUS idmap_cache_map_id(struct idmap_cache_ctx *cache, struct id_map *id)
 480 {
 481         NTSTATUS ret;
 482         TDB_DATA keybuf, databuf;
 483         time_t t, now;
 484         char *idkey;
 485         char *endptr;
 486
 487         /* make sure it is marked as unknown by default */
 488         id->status = ID_UNKNOWN;
 489
 490         ret = idmap_cache_build_idkey(cache, &idkey, id);
 491         if (!NT_STATUS_IS_OK(ret)) return ret;
 492
 493         keybuf.dptr = idkey;
 494         keybuf.dsize = strlen(idkey)+1;
 495
 496         databuf = tdb_fetch(cache->tdb, keybuf);
 497
 498         if (databuf.dptr == NULL) {
 499                 DEBUG(10, ("Cache entry with key = %s couldn't be found\n", idkey));
 500                 ret = NT_STATUS_NONE_MAPPED;
 501                 goto done;
 502         }
 503
 504         t = strtol(databuf.dptr, &endptr, 10);
 505
 506         if ((endptr == NULL) || (*endptr != '/')) {
 507                 DEBUG(2, ("Invalid gencache data format: %s\n", databuf.dptr));
 508                 /* remove the entry */
 509                 tdb_delete(cache->tdb, keybuf);
 510                 ret = NT_STATUS_NONE_MAPPED;
 511                 goto done;
 512         }
 513
 514         now = time(NULL);
 515
 516         /* check it is not negative */
 517         if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
 518
 519                 DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
 520                            "timeout = %s", t > now ? "valid" :
 521                            "expired", idkey, endptr+1, ctime(&t)));
 522
 523                 /* this call if successful will also mark the entry as mapped */
 524                 ret = idmap_cache_fill_map(id, endptr+1);
 525                 if ( ! NT_STATUS_IS_OK(ret)) {
 526                         /* if not valid form delete the entry */
 527                         tdb_delete(cache->tdb, keybuf);
 528                         ret = NT_STATUS_NONE_MAPPED;
 529                         goto done;
 530                 }
 531
 532                 /* here ret == NT_STATUS_OK and id->mapped = ID_MAPPED */
 533
 534                 if (t <= now) {
 535
 536                         /* we have it, but it is expired */
 537                         id->status = ID_EXPIRED;
 538
 539                         /* We're expired, set an error code
 540                            for upper layer */
 541                         ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 542                 }
 543         } else {
 544                 if (t <= now) {
 545                         /* We're expired, delete the NEGATIVE entry and return
 546                            not mapped */
 547                         tdb_delete(cache->tdb, keybuf);
 548                         ret = NT_STATUS_NONE_MAPPED;
 549                 } else {
 550                         /* this is not mapped as it was a negative cache hit */
 551                         id->status = ID_UNMAPPED;
 552                         ret = NT_STATUS_OK;
 553                 }
 554         }
 555 done:
 556         SAFE_FREE(databuf.dptr);
 557         talloc_free(idkey);
 558         return ret;
 559 }
 560