source3/winbindd/idmap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping
   4    Copyright (C) Tim Potter 2000
   5    Copyright (C) Jim McDonough <jmcd@us.ibm.com>        2003
   6    Copyright (C) Simo Sorce 2003-2007
   7    Copyright (C) Jeremy Allison 2006
   8    Copyright (C) Michael Adam 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26 #include "idmap.h"
  27 #include "passdb/machine_sid.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_IDMAP
  31
  32 static_decl_idmap;
  33
  34 static void idmap_init(void)
  35 {
  36         static bool initialized;
  37
  38         if (initialized) {
  39                 return;
  40         }
  41
  42         DEBUG(10, ("idmap_init(): calling static_init_idmap\n"));
  43
  44         static_init_idmap;
  45
  46         initialized = true;
  47 }
  48
  49 /**
  50  * Pointer to the backend methods. Modules register themselves here via
  51  * smb_register_idmap.
  52  */
  53
  54 struct idmap_backend {
  55         const char *name;
  56         struct idmap_methods *methods;
  57         struct idmap_backend *prev, *next;
  58 };
  59 static struct idmap_backend *backends = NULL;
  60
  61 /**
  62  * Default idmap domain configured via "idmap backend".
  63  */
  64 static struct idmap_domain *default_idmap_domain;
  65
  66 /**
  67  * Passdb idmap domain, not configurable. winbind must always give passdb a
  68  * chance to map ids.
  69  */
  70 static struct idmap_domain *passdb_idmap_domain;
  71
  72 /**
  73  * List of specially configured idmap domains. This list is filled on demand
  74  * in the winbind idmap child when the parent winbind figures out via the
  75  * special range parameter or via the domain SID that a special "idmap config
  76  * domain" configuration is present.
  77  */
  78 static struct idmap_domain **idmap_domains = NULL;
  79 static int num_domains = 0;
  80
  81 static struct idmap_methods *get_methods(const char *name)
  82 {
  83         struct idmap_backend *b;
  84
  85         for (b = backends; b; b = b->next) {
  86                 if (strequal(b->name, name)) {
  87                         return b->methods;
  88                 }
  89         }
  90
  91         return NULL;
  92 }
  93
  94 bool idmap_is_offline(void)
  95 {
  96         return ( lp_winbind_offline_logon() &&
  97              get_global_winbindd_state_offline() );
  98 }
  99
 100 bool idmap_is_online(void)
 101 {
 102         return !idmap_is_offline();
 103 }
 104
 105 /**********************************************************************
 106  Allow a module to register itself as a method.
 107 **********************************************************************/
 108
 109 NTSTATUS smb_register_idmap(int version, const char *name,
 110                             struct idmap_methods *methods)
 111 {
 112         struct idmap_backend *entry;
 113
 114         if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
 115                 DEBUG(0, ("Failed to register idmap module.\n"
 116                           "The module was compiled against "
 117                           "SMB_IDMAP_INTERFACE_VERSION %d,\n"
 118                           "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
 119                           "Please recompile against the current version "
 120                           "of samba!\n",
 121                           version, SMB_IDMAP_INTERFACE_VERSION));
 122                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 123         }
 124
 125         if (!name || !name[0] || !methods) {
 126                 DEBUG(0,("Called with NULL pointer or empty name!\n"));
 127                 return NT_STATUS_INVALID_PARAMETER;
 128         }
 129
 130         for (entry = backends; entry != NULL; entry = entry->next) {
 131                 if (strequal(entry->name, name)) {
 132                         DEBUG(0,("Idmap module %s already registered!\n",
 133                                  name));
 134                         return NT_STATUS_OBJECT_NAME_COLLISION;
 135                 }
 136         }
 137
 138         entry = talloc(NULL, struct idmap_backend);
 139         if ( ! entry) {
 140                 DEBUG(0,("Out of memory!\n"));
 141                 TALLOC_FREE(entry);
 142                 return NT_STATUS_NO_MEMORY;
 143         }
 144         entry->name = talloc_strdup(entry, name);
 145         if ( ! entry->name) {
 146                 DEBUG(0,("Out of memory!\n"));
 147                 TALLOC_FREE(entry);
 148                 return NT_STATUS_NO_MEMORY;
 149         }
 150         entry->methods = methods;
 151
 152         DLIST_ADD(backends, entry);
 153         DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
 154         return NT_STATUS_OK;
 155 }
 156
 157 /**
 158  * Initialize a domain structure
 159  * @param[in] mem_ctx           memory context for the result
 160  * @param[in] domainname        which domain is this for
 161  * @param[in] modulename        which backend module
 162  * @param[in] check_range       whether range checking should be done
 163  * @result The initialized structure
 164  */
 165 static struct idmap_domain *idmap_init_domain(TALLOC_CTX *mem_ctx,
 166                                               const char *domainname,
 167                                               const char *modulename,
 168                                               bool check_range)
 169 {
 170         struct idmap_domain *result;
 171         NTSTATUS status;
 172         char *config_option = NULL;
 173         const char *range;
 174
 175         result = talloc_zero(mem_ctx, struct idmap_domain);
 176         if (result == NULL) {
 177                 DEBUG(0, ("talloc failed\n"));
 178                 return NULL;
 179         }
 180
 181         result->name = talloc_strdup(result, domainname);
 182         if (result->name == NULL) {
 183                 DEBUG(0, ("talloc failed\n"));
 184                 goto fail;
 185         }
 186
 187         /*
 188          * load ranges and read only information from the config
 189          */
 190
 191         config_option = talloc_asprintf(result, "idmap config %s",
 192                                         result->name);
 193         if (config_option == NULL) {
 194                 DEBUG(0, ("Out of memory!\n"));
 195                 goto fail;
 196         }
 197
 198         range = lp_parm_const_string(-1, config_option, "range", NULL);
 199         if (range == NULL) {
 200                 DEBUG(1, ("idmap range not specified for domain %s\n",
 201                           result->name));
 202                 if (check_range) {
 203                         goto fail;
 204                 }
 205         } else if (sscanf(range, "%u - %u", &result->low_id,
 206                           &result->high_id) != 2)
 207         {
 208                 DEBUG(1, ("invalid range '%s' specified for domain "
 209                           "'%s'\n", range, result->name));
 210                 if (check_range) {
 211                         goto fail;
 212                 }
 213         }
 214
 215         result->read_only = lp_parm_bool(-1, config_option, "read only", false);
 216
 217         talloc_free(config_option);
 218
 219         if (result->low_id > result->high_id) {
 220                 DEBUG(1, ("Error: invalid idmap range detected: %lu - %lu\n",
 221                           (unsigned long)result->low_id,
 222                           (unsigned long)result->high_id));
 223                 if (check_range) {
 224                         goto fail;
 225                 }
 226         }
 227
 228         result->methods = get_methods(modulename);
 229         if (result->methods == NULL) {
 230                 DEBUG(3, ("idmap backend %s not found\n", modulename));
 231
 232                 status = smb_probe_module("idmap", modulename);
 233                 if (!NT_STATUS_IS_OK(status)) {
 234                         DEBUG(3, ("Could not probe idmap module %s\n",
 235                                   modulename));
 236                         goto fail;
 237                 }
 238
 239                 result->methods = get_methods(modulename);
 240         }
 241         if (result->methods == NULL) {
 242                 DEBUG(1, ("idmap backend %s not found\n", modulename));
 243                 goto fail;
 244         }
 245
 246         status = result->methods->init(result);
 247         if (!NT_STATUS_IS_OK(status)) {
 248                 DEBUG(1, ("idmap initialization returned %s\n",
 249                           nt_errstr(status)));
 250                 goto fail;
 251         }
 252
 253         return result;
 254
 255 fail:
 256         TALLOC_FREE(result);
 257         return NULL;
 258 }
 259
 260 /**
 261  * Initialize a named domain structure
 262  * @param[in] mem_ctx           memory context for the result
 263  * @param[in] domname           the domain name
 264  * @result The default domain structure
 265  *
 266  * This routine looks at the "idmap config <domname>" parameters to figure out
 267  * the configuration.
 268  */
 269
 270 static struct idmap_domain *idmap_init_named_domain(TALLOC_CTX *mem_ctx,
 271                                                     const char *domname)
 272 {
 273         struct idmap_domain *result = NULL;
 274         char *config_option;
 275         const char *backend;
 276
 277         idmap_init();
 278
 279         config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
 280                                         domname);
 281         if (config_option == NULL) {
 282                 DEBUG(0, ("talloc failed\n"));
 283                 goto fail;
 284         }
 285
 286         backend = lp_parm_const_string(-1, config_option, "backend", NULL);
 287         if (backend == NULL) {
 288                 DEBUG(1, ("no backend defined for %s\n", config_option));
 289                 goto fail;
 290         }
 291
 292         result = idmap_init_domain(mem_ctx, domname, backend, true);
 293         if (result == NULL) {
 294                 goto fail;
 295         }
 296
 297         TALLOC_FREE(config_option);
 298         return result;
 299
 300 fail:
 301         TALLOC_FREE(config_option);
 302         TALLOC_FREE(result);
 303         return NULL;
 304 }
 305
 306 /**
 307  * Initialize the default domain structure
 308  * @param[in] mem_ctx           memory context for the result
 309  * @result The default domain structure
 310  *
 311  * This routine takes the module name from the "idmap backend" parameter,
 312  * passing a possible parameter like ldap:ldap://ldap-url/ to the module.
 313  */
 314
 315 static struct idmap_domain *idmap_init_default_domain(TALLOC_CTX *mem_ctx)
 316 {
 317         return idmap_init_named_domain(mem_ctx, "*");
 318 }
 319
 320 /**
 321  * Initialize the passdb domain structure
 322  * @param[in] mem_ctx           memory context for the result
 323  * @result The default domain structure
 324  *
 325  * No config, passdb has its own configuration.
 326  */
 327
 328 static struct idmap_domain *idmap_init_passdb_domain(TALLOC_CTX *mem_ctx)
 329 {
 330         idmap_init();
 331
 332         /*
 333          * Always init the default domain, we can't go without one
 334          */
 335         if (default_idmap_domain == NULL) {
 336                 default_idmap_domain = idmap_init_default_domain(NULL);
 337         }
 338         if (default_idmap_domain == NULL) {
 339                 return NULL;
 340         }
 341
 342         if (passdb_idmap_domain != NULL) {
 343                 return passdb_idmap_domain;
 344         }
 345
 346         passdb_idmap_domain = idmap_init_domain(NULL, get_global_sam_name(),
 347                                                 "passdb", false);
 348         if (passdb_idmap_domain == NULL) {
 349                 DEBUG(1, ("Could not init passdb idmap domain\n"));
 350         }
 351
 352         return passdb_idmap_domain;
 353 }
 354
 355 /**
 356  * Find a domain struct according to a domain name
 357  * @param[in] domname           Domain name to get the config for
 358  * @result The default domain structure that fits
 359  *
 360  * This is the central routine in the winbindd-idmap child to pick the correct
 361  * domain for looking up IDs. If domname is NULL or empty, we use the default
 362  * domain. If it contains something, we try to use idmap_init_named_domain()
 363  * to fetch the correct backend.
 364  *
 365  * The choice about "domname" is being made by the winbind parent, look at the
 366  * "have_idmap_config" of "struct winbindd_domain" which is set in
 367  * add_trusted_domain.
 368  */
 369
 370 struct idmap_domain *idmap_find_domain(const char *domname)
 371 {
 372         struct idmap_domain *result;
 373         int i;
 374
 375         DEBUG(10, ("idmap_find_domain called for domain '%s'\n",
 376                    domname?domname:"NULL"));
 377
 378         idmap_init();
 379
 380         /*
 381          * Always init the default domain, we can't go without one
 382          */
 383         if (default_idmap_domain == NULL) {
 384                 default_idmap_domain = idmap_init_default_domain(NULL);
 385         }
 386         if (default_idmap_domain == NULL) {
 387                 return NULL;
 388         }
 389
 390         if ((domname == NULL) || (domname[0] == '\0')) {
 391                 return default_idmap_domain;
 392         }
 393
 394         for (i=0; i<num_domains; i++) {
 395                 if (strequal(idmap_domains[i]->name, domname)) {
 396                         return idmap_domains[i];
 397                 }
 398         }
 399
 400         if (idmap_domains == NULL) {
 401                 /*
 402                  * talloc context for all idmap domains
 403                  */
 404                 idmap_domains = talloc_array(NULL, struct idmap_domain *, 1);
 405         }
 406
 407         if (idmap_domains == NULL) {
 408                 DEBUG(0, ("talloc failed\n"));
 409                 return NULL;
 410         }
 411
 412         result = idmap_init_named_domain(idmap_domains, domname);
 413         if (result == NULL) {
 414                 /*
 415                  * Could not init that domain -- try the default one
 416                  */
 417                 return default_idmap_domain;
 418         }
 419
 420         ADD_TO_ARRAY(idmap_domains, struct idmap_domain *, result,
 421                      &idmap_domains, &num_domains);
 422         return result;
 423 }
 424
 425 void idmap_close(void)
 426 {
 427         TALLOC_FREE(default_idmap_domain);
 428         TALLOC_FREE(passdb_idmap_domain);
 429         TALLOC_FREE(idmap_domains);
 430         num_domains = 0;
 431 }
 432
 433 /**************************************************************************
 434  idmap allocator interface functions
 435 **************************************************************************/
 436
 437 static NTSTATUS idmap_allocate_unixid(struct unixid *id)
 438 {
 439         struct idmap_domain *dom;
 440         NTSTATUS ret;
 441
 442         dom = idmap_find_domain(NULL);
 443
 444         if (dom == NULL) {
 445                 return NT_STATUS_UNSUCCESSFUL;
 446         }
 447
 448         if (dom->methods->allocate_id == NULL) {
 449                 return NT_STATUS_NOT_IMPLEMENTED;
 450         }
 451
 452         ret = dom->methods->allocate_id(dom, id);
 453
 454         return ret;
 455 }
 456
 457
 458 NTSTATUS idmap_allocate_uid(struct unixid *id)
 459 {
 460         id->type = ID_TYPE_UID;
 461         return idmap_allocate_unixid(id);
 462 }
 463
 464 NTSTATUS idmap_allocate_gid(struct unixid *id)
 465 {
 466         id->type = ID_TYPE_GID;
 467         return idmap_allocate_unixid(id);
 468 }
 469
 470 NTSTATUS idmap_backends_unixid_to_sid(const char *domname, struct id_map *id)
 471 {
 472         struct idmap_domain *dom;
 473         struct id_map *maps[2];
 474
 475          DEBUG(10, ("idmap_backend_unixid_to_sid: domain = '%s', xid = %d "
 476                     "(type %d)\n",
 477                     domname?domname:"NULL", id->xid.id, id->xid.type));
 478
 479         maps[0] = id;
 480         maps[1] = NULL;
 481
 482         /*
 483          * Always give passdb a chance first
 484          */
 485
 486         dom = idmap_init_passdb_domain(NULL);
 487         if ((dom != NULL)
 488             && NT_STATUS_IS_OK(dom->methods->unixids_to_sids(dom, maps))
 489             && id->status == ID_MAPPED) {
 490                 return NT_STATUS_OK;
 491         }
 492
 493         dom = idmap_find_domain(domname);
 494         if (dom == NULL) {
 495                 return NT_STATUS_NONE_MAPPED;
 496         }
 497
 498         return dom->methods->unixids_to_sids(dom, maps);
 499 }
 500
 501 NTSTATUS idmap_backends_sid_to_unixid(const char *domain, struct id_map *id)
 502 {
 503         struct idmap_domain *dom;
 504         struct id_map *maps[2];
 505
 506         DEBUG(10, ("idmap_backends_sid_to_unixid: domain = '%s', sid = [%s]\n",
 507                    domain?domain:"NULL", sid_string_dbg(id->sid)));
 508
 509         maps[0] = id;
 510         maps[1] = NULL;
 511
 512         if (sid_check_is_in_builtin(id->sid)
 513             || (sid_check_is_in_our_domain(id->sid)))
 514         {
 515                 NTSTATUS status;
 516
 517                 DEBUG(10, ("asking passdb...\n"));
 518
 519                 dom = idmap_init_passdb_domain(NULL);
 520                 if (dom == NULL) {
 521                         return NT_STATUS_NONE_MAPPED;
 522                 }
 523                 status = dom->methods->sids_to_unixids(dom, maps);
 524
 525                 if (NT_STATUS_IS_OK(status) && id->status == ID_MAPPED) {
 526                         return status;
 527                 }
 528
 529                 DEBUG(10, ("passdb could not map.\n"));
 530
 531                 return NT_STATUS_NONE_MAPPED;
 532         }
 533
 534         dom = idmap_find_domain(domain);
 535         if (dom == NULL) {
 536                 return NT_STATUS_NONE_MAPPED;
 537         }
 538
 539         return dom->methods->sids_to_unixids(dom, maps);
 540 }