source3/winbindd/idmap_rid.c

   1 /*
   2  *  idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
   3  *  Copyright (C) Guenther Deschner, 2004
   4  *  Copyright (C) Sumit Bose, 2004
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "includes.h"
  22 #include "winbindd.h"
  23 #include "idmap.h"
  24 #include "../libcli/security/dom_sid.h"
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_IDMAP
  28
  29 struct idmap_rid_context {
  30         uint32_t base_rid;
  31 };
  32
  33 /******************************************************************************
  34   compat params can't be used because of the completely different way
  35   we support multiple domains in the new idmap
  36  *****************************************************************************/
  37
  38 static NTSTATUS idmap_rid_initialize(struct idmap_domain *dom)
  39 {
  40         struct idmap_rid_context *ctx;
  41
  42         ctx = talloc_zero(dom, struct idmap_rid_context);
  43         if (ctx == NULL) {
  44                 DEBUG(0, ("Out of memory!\n"));
  45                 return NT_STATUS_NO_MEMORY;
  46         }
  47
  48         ctx->base_rid = idmap_config_int(dom->name, "base_rid", 0);
  49
  50         dom->private_data = ctx;
  51
  52         return NT_STATUS_OK;
  53 }
  54
  55 static NTSTATUS idmap_rid_id_to_sid(struct idmap_domain *dom, struct id_map *map)
  56 {
  57         struct idmap_rid_context *ctx;
  58
  59         ctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
  60
  61         /* apply filters before checking */
  62         if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
  63                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
  64                                 map->xid.id, dom->low_id, dom->high_id));
  65                 return NT_STATUS_NONE_MAPPED;
  66         }
  67
  68         if (is_null_sid(&dom->dom_sid)) {
  69                 DBG_INFO("idmap domain '%s' without SID\n", dom->name);
  70                 return NT_STATUS_NONE_MAPPED;
  71         }
  72
  73         sid_compose(map->sid, &dom->dom_sid,
  74                     map->xid.id - dom->low_id + ctx->base_rid);
  75
  76         map->status = ID_MAPPED;
  77         map->xid.type = ID_TYPE_BOTH;
  78
  79         return NT_STATUS_OK;
  80 }
  81
  82 /**********************************
  83  Single sid to id lookup function.
  84 **********************************/
  85
  86 static NTSTATUS idmap_rid_sid_to_id(struct idmap_domain *dom, struct id_map *map)
  87 {
  88         uint32_t rid;
  89         struct idmap_rid_context *ctx;
  90
  91         ctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
  92
  93         sid_peek_rid(map->sid, &rid);
  94         map->xid.id = rid - ctx->base_rid + dom->low_id;
  95         map->xid.type = ID_TYPE_BOTH;
  96
  97         /* apply filters before returning result */
  98
  99         if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
 100                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 101                                 map->xid.id, dom->low_id, dom->high_id));
 102                 map->status = ID_UNMAPPED;
 103                 return NT_STATUS_NONE_MAPPED;
 104         }
 105
 106         map->status = ID_MAPPED;
 107
 108         return NT_STATUS_OK;
 109 }
 110
 111 /**********************************
 112  lookup a set of unix ids.
 113 **********************************/
 114
 115 static NTSTATUS idmap_rid_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 116 {
 117         NTSTATUS ret;
 118         int i;
 119
 120         /* initialize the status to avoid suprise */
 121         for (i = 0; ids[i]; i++) {
 122                 ids[i]->status = ID_UNKNOWN;
 123         }
 124
 125         for (i = 0; ids[i]; i++) {
 126
 127                 ret = idmap_rid_id_to_sid(dom, ids[i]);
 128
 129                 if (( ! NT_STATUS_IS_OK(ret)) &&
 130                     ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 131                         /* some fatal error occurred, log it */
 132                         DBG_NOTICE("Unexpected error resolving an ID "
 133                                    "(%d): %s\n", ids[i]->xid.id,
 134                                    nt_errstr(ret));
 135                 }
 136         }
 137
 138         return NT_STATUS_OK;
 139 }
 140
 141 /**********************************
 142  lookup a set of sids.
 143 **********************************/
 144
 145 static NTSTATUS idmap_rid_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 146 {
 147         NTSTATUS ret;
 148         int i;
 149
 150         /* initialize the status to avoid suprise */
 151         for (i = 0; ids[i]; i++) {
 152                 ids[i]->status = ID_UNKNOWN;
 153         }
 154
 155         for (i = 0; ids[i]; i++) {
 156
 157                 ret = idmap_rid_sid_to_id(dom, ids[i]);
 158
 159                 if (( ! NT_STATUS_IS_OK(ret)) &&
 160                     ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 161                         /* some fatal error occurred, log it */
 162                         DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
 163                                   sid_string_dbg(ids[i]->sid)));
 164                 }
 165         }
 166
 167         return NT_STATUS_OK;
 168 }
 169
 170 static struct idmap_methods rid_methods = {
 171         .init = idmap_rid_initialize,
 172         .unixids_to_sids = idmap_rid_unixids_to_sids,
 173         .sids_to_unixids = idmap_rid_sids_to_unixids,
 174 };
 175
 176 static_decl_idmap;
 177 NTSTATUS idmap_rid_init(TALLOC_CTX *ctx)
 178 {
 179         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "rid", &rid_methods);
 180 }
 181