selftest: mark samba3.smb2.durable-open reopen tests knownfail
[Samba.git] / source3 / winbindd / idmap_util.c
blob2ddf576dc83e2b2481465a6e06f5d3959c537af7
1 /*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Simo Sorce 2003
5 Copyright (C) Jeremy Allison 2006
6 Copyright (C) Michael Adam 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
21 #include "includes.h"
22 #include "winbindd.h"
23 #include "winbindd_proto.h"
24 #include "idmap.h"
25 #include "idmap_cache.h"
26 #include "../libcli/security/security.h"
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_IDMAP
31 /*****************************************************************
32 Returns the SID mapped to the given UID.
33 If mapping is not possible returns an error.
34 *****************************************************************/
36 NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid)
38 NTSTATUS ret;
39 struct id_map map;
40 bool expired;
42 DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
43 (unsigned long)uid, domname?domname:"NULL"));
45 if (winbindd_use_idmap_cache()
46 && idmap_cache_find_uid2sid(uid, sid, &expired)) {
47 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
48 (unsigned int)uid,
49 expired ? " (expired)": ""));
50 if (expired && idmap_is_online()) {
51 DEBUG(10, ("revalidating expired entry\n"));
52 goto backend;
54 if (is_null_sid(sid)) {
55 DEBUG(10, ("Returning negative cache entry\n"));
56 return NT_STATUS_NONE_MAPPED;
58 DEBUG(10, ("Returning positive cache entry\n"));
59 return NT_STATUS_OK;
62 backend:
63 ZERO_STRUCT(map);
64 map.sid = sid;
65 map.xid.type = ID_TYPE_UID;
66 map.xid.id = uid;
68 ret = idmap_backends_unixid_to_sid(domname, &map);
69 if ( ! NT_STATUS_IS_OK(ret)) {
70 DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid));
71 return ret;
74 if (map.status != ID_MAPPED) {
75 if (winbindd_use_idmap_cache()) {
76 struct dom_sid null_sid;
77 ZERO_STRUCT(null_sid);
78 idmap_cache_set_sid2uid(&null_sid, uid);
80 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
81 return NT_STATUS_NONE_MAPPED;
84 if (winbindd_use_idmap_cache()) {
85 idmap_cache_set_sid2uid(sid, uid);
88 return NT_STATUS_OK;
91 /*****************************************************************
92 Returns SID mapped to the given GID.
93 If mapping is not possible returns an error.
94 *****************************************************************/
96 NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid)
98 NTSTATUS ret;
99 struct id_map map;
100 bool expired;
102 DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
103 (unsigned long)gid, domname?domname:"NULL"));
105 if (winbindd_use_idmap_cache()
106 && idmap_cache_find_gid2sid(gid, sid, &expired)) {
107 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
108 (unsigned int)gid,
109 expired ? " (expired)": ""));
110 if (expired && idmap_is_online()) {
111 DEBUG(10, ("revalidating expired entry\n"));
112 goto backend;
114 if (is_null_sid(sid)) {
115 DEBUG(10, ("Returning negative cache entry\n"));
116 return NT_STATUS_NONE_MAPPED;
118 DEBUG(10, ("Returning positive cache entry\n"));
119 return NT_STATUS_OK;
122 backend:
123 ZERO_STRUCT(map);
124 map.sid = sid;
125 map.xid.type = ID_TYPE_GID;
126 map.xid.id = gid;
128 ret = idmap_backends_unixid_to_sid(domname, &map);
129 if ( ! NT_STATUS_IS_OK(ret)) {
130 DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid));
131 return ret;
134 if (map.status != ID_MAPPED) {
135 if (winbindd_use_idmap_cache()) {
136 struct dom_sid null_sid;
137 ZERO_STRUCT(null_sid);
138 idmap_cache_set_sid2gid(&null_sid, gid);
140 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
141 return NT_STATUS_NONE_MAPPED;
144 if (winbindd_use_idmap_cache()) {
145 idmap_cache_set_sid2gid(sid, gid);
148 return NT_STATUS_OK;
151 /*****************************************************************
152 Returns the UID mapped to the given SID.
153 If mapping is not possible or SID maps to a GID returns an error.
154 *****************************************************************/
156 NTSTATUS idmap_sid_to_uid(const char *dom_name, struct dom_sid *sid, uid_t *uid)
158 NTSTATUS ret;
159 struct id_map map;
160 bool expired;
162 DEBUG(10,("idmap_sid_to_uid: sid = [%s], domain = '%s'\n",
163 sid_string_dbg(sid), dom_name));
165 if (winbindd_use_idmap_cache()
166 && idmap_cache_find_sid2uid(sid, uid, &expired)) {
167 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
168 (int)(*uid), expired ? " (expired)": ""));
169 if (expired && idmap_is_online()) {
170 DEBUG(10, ("revalidating expired entry\n"));
171 goto backend;
173 if ((*uid) == -1) {
174 DEBUG(10, ("Returning negative cache entry\n"));
175 return NT_STATUS_NONE_MAPPED;
177 DEBUG(10, ("Returning positive cache entry\n"));
178 return NT_STATUS_OK;
181 backend:
182 ZERO_STRUCT(map);
183 map.sid = sid;
184 map.xid.type = ID_TYPE_UID;
186 ret = idmap_backends_sid_to_unixid(dom_name, &map);
188 if (!NT_STATUS_IS_OK(ret)) {
189 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
190 nt_errstr(ret)));
191 if (winbindd_use_idmap_cache()) {
192 idmap_cache_set_sid2uid(sid, -1);
194 return ret;
197 if (map.status != ID_MAPPED) {
198 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
199 if (winbindd_use_idmap_cache()) {
200 idmap_cache_set_sid2uid(sid, -1);
202 return NT_STATUS_NONE_MAPPED;
205 if (map.xid.type != ID_TYPE_UID) {
206 DEBUG(10, ("sid [%s] not mapped to a uid "
207 "[%u,%u,%u]\n",
208 sid_string_dbg(sid),
209 map.status,
210 map.xid.type,
211 map.xid.id));
212 if (winbindd_use_idmap_cache()) {
213 idmap_cache_set_sid2uid(sid, -1);
215 return NT_STATUS_NONE_MAPPED;
218 *uid = (uid_t)map.xid.id;
219 if (winbindd_use_idmap_cache()) {
220 idmap_cache_set_sid2uid(sid, *uid);
222 return NT_STATUS_OK;
225 /*****************************************************************
226 Returns the GID mapped to the given SID.
227 If mapping is not possible or SID maps to a UID returns an error.
228 *****************************************************************/
230 NTSTATUS idmap_sid_to_gid(const char *domname, struct dom_sid *sid, gid_t *gid)
232 NTSTATUS ret;
233 struct id_map map;
234 bool expired;
236 DEBUG(10,("idmap_sid_to_gid: sid = [%s], domain = '%s'\n",
237 sid_string_dbg(sid), domname));
239 if (winbindd_use_idmap_cache()
240 && idmap_cache_find_sid2gid(sid, gid, &expired)) {
241 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
242 (int)(*gid), expired ? " (expired)": ""));
243 if (expired && idmap_is_online()) {
244 DEBUG(10, ("revalidating expired entry\n"));
245 goto backend;
247 if ((*gid) == -1) {
248 DEBUG(10, ("Returning negative cache entry\n"));
249 return NT_STATUS_NONE_MAPPED;
251 DEBUG(10, ("Returning positive cache entry\n"));
252 return NT_STATUS_OK;
255 backend:
256 ZERO_STRUCT(map);
257 map.sid = sid;
258 map.xid.type = ID_TYPE_GID;
260 ret = idmap_backends_sid_to_unixid(domname, &map);
262 if (!NT_STATUS_IS_OK(ret)) {
263 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
264 nt_errstr(ret)));
265 if (winbindd_use_idmap_cache()) {
266 idmap_cache_set_sid2gid(sid, -1);
268 return ret;
271 if (map.status != ID_MAPPED) {
272 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
273 if (winbindd_use_idmap_cache()) {
274 idmap_cache_set_sid2gid(sid, -1);
276 return NT_STATUS_NONE_MAPPED;
279 if (map.xid.type != ID_TYPE_GID) {
280 DEBUG(10, ("sid [%s] not mapped to a gid "
281 "[%u,%u,%u]\n",
282 sid_string_dbg(sid),
283 map.status,
284 map.xid.type,
285 map.xid.id));
286 if (winbindd_use_idmap_cache()) {
287 idmap_cache_set_sid2gid(sid, -1);
289 return NT_STATUS_NONE_MAPPED;
292 *gid = map.xid.id;
293 if (winbindd_use_idmap_cache()) {
294 idmap_cache_set_sid2gid(sid, *gid);
296 return NT_STATUS_OK;
300 * check whether a given unix id is inside the filter range of an idmap domain
302 bool idmap_unix_id_is_in_range(uint32_t id, struct idmap_domain *dom)
304 if (id == 0) {
305 /* 0 is not an allowed unix id for id mapping */
306 return false;
309 if ((dom->low_id && (id < dom->low_id)) ||
310 (dom->high_id && (id > dom->high_id)))
312 return false;
315 return true;