source/winbindd/idmap_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping Cache
   4
   5    based on gencache
   6
   7    Copyright (C) Simo Sorce             2006
   8    Copyright (C) Rafal Szczesniak       2002
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.*/
  22
  23 #include "includes.h"
  24 #include "winbindd.h"
  25
  26 #define TIMEOUT_LEN 12
  27 #define IDMAP_CACHE_DATA_FMT    "%12u/%s"
  28 #define IDMAP_READ_CACHE_DATA_FMT_TEMPLATE "%%12u/%%%us"
  29
  30 struct idmap_cache_ctx {
  31         TDB_CONTEXT *tdb;
  32 };
  33
  34 static int idmap_cache_destructor(struct idmap_cache_ctx *cache)
  35 {
  36         int ret = 0;
  37
  38         if (cache && cache->tdb) {
  39                 ret = tdb_close(cache->tdb);
  40                 cache->tdb = NULL;
  41         }
  42
  43         return ret;
  44 }
  45
  46 struct idmap_cache_ctx *idmap_cache_init(TALLOC_CTX *memctx)
  47 {
  48         struct idmap_cache_ctx *cache;
  49         char* cache_fname = NULL;
  50
  51         cache = talloc(memctx, struct idmap_cache_ctx);
  52         if ( ! cache) {
  53                 DEBUG(0, ("Out of memory!\n"));
  54                 return NULL;
  55         }
  56
  57         cache_fname = lock_path("idmap_cache.tdb");
  58
  59         DEBUG(10, ("Opening cache file at %s\n", cache_fname));
  60
  61         cache->tdb = tdb_open_log(cache_fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  62
  63         if (!cache->tdb) {
  64                 DEBUG(5, ("Attempt to open %s has failed.\n", cache_fname));
  65                 return NULL;
  66         }
  67
  68         talloc_set_destructor(cache, idmap_cache_destructor);
  69
  70         return cache;
  71 }
  72
  73 static NTSTATUS idmap_cache_build_sidkey(TALLOC_CTX *ctx, char **sidkey,
  74                                          const struct id_map *id)
  75 {
  76         fstring sidstr;
  77
  78         *sidkey = talloc_asprintf(ctx, "IDMAP/SID/%s",
  79                                   sid_to_fstring(sidstr, id->sid));
  80         if ( ! *sidkey) {
  81                 DEBUG(1, ("failed to build sidkey, OOM?\n"));
  82                 return NT_STATUS_NO_MEMORY;
  83         }
  84
  85         return NT_STATUS_OK;
  86 }
  87
  88 static NTSTATUS idmap_cache_build_idkey(TALLOC_CTX *ctx, char **idkey,
  89                                         const struct id_map *id)
  90 {
  91         *idkey = talloc_asprintf(ctx, "IDMAP/%s/%lu",
  92                                 (id->xid.type==ID_TYPE_UID)?"UID":"GID",
  93                                 (unsigned long)id->xid.id);
  94         if ( ! *idkey) {
  95                 DEBUG(1, ("failed to build idkey, OOM?\n"));
  96                 return NT_STATUS_NO_MEMORY;
  97         }
  98
  99         return NT_STATUS_OK;
 100 }
 101
 102 NTSTATUS idmap_cache_set(struct idmap_cache_ctx *cache, const struct id_map *id)
 103 {
 104         NTSTATUS ret;
 105         time_t timeout = time(NULL) + lp_idmap_cache_time();
 106         TDB_DATA databuf;
 107         char *sidkey;
 108         char *idkey;
 109         char *valstr;
 110
 111         /* Don't cache lookups in the S-1-22-{1,2} domain */
 112         if ( (id->xid.type == ID_TYPE_UID) &&
 113              sid_check_is_in_unix_users(id->sid) )
 114         {
 115                 return NT_STATUS_OK;
 116         }
 117         if ( (id->xid.type == ID_TYPE_GID) &&
 118              sid_check_is_in_unix_groups(id->sid) )
 119         {
 120                 return NT_STATUS_OK;
 121         }
 122
 123
 124         ret = idmap_cache_build_sidkey(cache, &sidkey, id);
 125         if (!NT_STATUS_IS_OK(ret)) return ret;
 126
 127         /* use sidkey as the local memory ctx */
 128         ret = idmap_cache_build_idkey(sidkey, &idkey, id);
 129         if (!NT_STATUS_IS_OK(ret)) {
 130                 goto done;
 131         }
 132
 133         /* save SID -> ID */
 134
 135         /* use sidkey as the local memory ctx */
 136         valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, idkey);
 137         if (!valstr) {
 138                 DEBUG(0, ("Out of memory!\n"));
 139                 ret = NT_STATUS_NO_MEMORY;
 140                 goto done;
 141         }
 142
 143         databuf = string_term_tdb_data(valstr);
 144         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 145                    " %s (%d seconds %s)\n", sidkey, valstr , ctime(&timeout),
 146                    (int)(timeout - time(NULL)),
 147                    timeout > time(NULL) ? "ahead" : "in the past"));
 148
 149         if (tdb_store_bystring(cache->tdb, sidkey, databuf, TDB_REPLACE) != 0) {
 150                 DEBUG(3, ("Failed to store cache entry!\n"));
 151                 ret = NT_STATUS_UNSUCCESSFUL;
 152                 goto done;
 153         }
 154
 155         /* save ID -> SID */
 156
 157         /* use sidkey as the local memory ctx */
 158         valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, sidkey);
 159         if (!valstr) {
 160                 DEBUG(0, ("Out of memory!\n"));
 161                 ret = NT_STATUS_NO_MEMORY;
 162                 goto done;
 163         }
 164
 165         databuf = string_term_tdb_data(valstr);
 166         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 167                    " %s (%d seconds %s)\n", idkey, valstr, ctime(&timeout),
 168                    (int)(timeout - time(NULL)),
 169                    timeout > time(NULL) ? "ahead" : "in the past"));
 170
 171         if (tdb_store_bystring(cache->tdb, idkey, databuf, TDB_REPLACE) != 0) {
 172                 DEBUG(3, ("Failed to store cache entry!\n"));
 173                 ret = NT_STATUS_UNSUCCESSFUL;
 174                 goto done;
 175         }
 176
 177         ret = NT_STATUS_OK;
 178
 179 done:
 180         talloc_free(sidkey);
 181         return ret;
 182 }
 183
 184 NTSTATUS idmap_cache_set_negative_sid(struct idmap_cache_ctx *cache, const struct id_map *id)
 185 {
 186         NTSTATUS ret;
 187         time_t timeout = time(NULL) + lp_idmap_negative_cache_time();
 188         TDB_DATA databuf;
 189         char *sidkey;
 190         char *valstr;
 191
 192         ret = idmap_cache_build_sidkey(cache, &sidkey, id);
 193         if (!NT_STATUS_IS_OK(ret)) return ret;
 194
 195         /* use sidkey as the local memory ctx */
 196         valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
 197         if (!valstr) {
 198                 DEBUG(0, ("Out of memory!\n"));
 199                 ret = NT_STATUS_NO_MEMORY;
 200                 goto done;
 201         }
 202
 203         databuf = string_term_tdb_data(valstr);
 204         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 205                    " %s (%d seconds %s)\n", sidkey, valstr, ctime(&timeout),
 206                    (int)(timeout - time(NULL)),
 207                    timeout > time(NULL) ? "ahead" : "in the past"));
 208
 209         if (tdb_store_bystring(cache->tdb, sidkey, databuf, TDB_REPLACE) != 0) {
 210                 DEBUG(3, ("Failed to store cache entry!\n"));
 211                 ret = NT_STATUS_UNSUCCESSFUL;
 212                 goto done;
 213         }
 214
 215 done:
 216         talloc_free(sidkey);
 217         return ret;
 218 }
 219
 220 NTSTATUS idmap_cache_set_negative_id(struct idmap_cache_ctx *cache, const struct id_map *id)
 221 {
 222         NTSTATUS ret;
 223         time_t timeout = time(NULL) + lp_idmap_negative_cache_time();
 224         TDB_DATA databuf;
 225         char *idkey;
 226         char *valstr;
 227
 228         ret = idmap_cache_build_idkey(cache, &idkey, id);
 229         if (!NT_STATUS_IS_OK(ret)) return ret;
 230
 231         /* use idkey as the local memory ctx */
 232         valstr = talloc_asprintf(idkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
 233         if (!valstr) {
 234                 DEBUG(0, ("Out of memory!\n"));
 235                 ret = NT_STATUS_NO_MEMORY;
 236                 goto done;
 237         }
 238
 239         databuf = string_term_tdb_data(valstr);
 240         DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
 241                    " %s (%d seconds %s)\n", idkey, valstr, ctime(&timeout),
 242                    (int)(timeout - time(NULL)),
 243                    timeout > time(NULL) ? "ahead" : "in the past"));
 244
 245         if (tdb_store_bystring(cache->tdb, idkey, databuf, TDB_REPLACE) != 0) {
 246                 DEBUG(3, ("Failed to store cache entry!\n"));
 247                 ret = NT_STATUS_UNSUCCESSFUL;
 248                 goto done;
 249         }
 250
 251 done:
 252         talloc_free(idkey);
 253         return ret;
 254 }
 255
 256 static NTSTATUS idmap_cache_fill_map(struct id_map *id, const char *value)
 257 {
 258         char *rem;
 259
 260         /* see if it is a sid */
 261         if ( ! strncmp("IDMAP/SID/", value, 10)) {
 262
 263                 if ( ! string_to_sid(id->sid, &value[10])) {
 264                         goto failed;
 265                 }
 266
 267                 id->status = ID_MAPPED;
 268
 269                 return NT_STATUS_OK;
 270         }
 271
 272         /* not a SID see if it is an UID or a GID */
 273         if ( ! strncmp("IDMAP/UID/", value, 10)) {
 274
 275                 /* a uid */
 276                 id->xid.type = ID_TYPE_UID;
 277
 278         } else if ( ! strncmp("IDMAP/GID/", value, 10)) {
 279
 280                 /* a gid */
 281                 id->xid.type = ID_TYPE_GID;
 282
 283         } else {
 284
 285                 /* a completely bogus value bail out */
 286                 goto failed;
 287         }
 288
 289         id->xid.id = strtol(&value[10], &rem, 0);
 290         if (*rem != '\0') {
 291                 goto failed;
 292         }
 293
 294         id->status = ID_MAPPED;
 295
 296         return NT_STATUS_OK;
 297
 298 failed:
 299         DEBUG(1, ("invalid value: %s\n", value));
 300         id->status = ID_UNKNOWN;
 301         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 302 }
 303
 304 /* search the cahce for the SID an return a mapping if found *
 305  *
 306  * 4 cases are possible
 307  *
 308  * 1 map found
 309  *      in this case id->status = ID_MAPPED and NT_STATUS_OK is returned
 310  * 2 map not found
 311  *      in this case id->status = ID_UNKNOWN and NT_STATUS_NONE_MAPPED is returned
 312  * 3 negative cache found
 313  *      in this case id->status = ID_UNMAPPED and NT_STATUS_OK is returned
 314  * 4 map found but timer expired
 315  *      in this case id->status = ID_EXPIRED and NT_STATUS_SYNCHRONIZATION_REQUIRED
 316  *      is returned. In this case revalidation of the cache is needed.
 317  */
 318
 319 NTSTATUS idmap_cache_map_sid(struct idmap_cache_ctx *cache, struct id_map *id)
 320 {
 321         NTSTATUS ret;
 322         TDB_DATA databuf;
 323         time_t t;
 324         char *sidkey;
 325         char *endptr;
 326         struct winbindd_domain *our_domain = find_our_domain();
 327         time_t now = time(NULL);
 328
 329         /* make sure it is marked as not mapped by default */
 330         id->status = ID_UNKNOWN;
 331
 332         ret = idmap_cache_build_sidkey(cache, &sidkey, id);
 333         if (!NT_STATUS_IS_OK(ret)) return ret;
 334
 335         databuf = tdb_fetch_bystring(cache->tdb, sidkey);
 336
 337         if (databuf.dptr == NULL) {
 338                 DEBUG(10, ("Cache entry with key = %s couldn't be found\n", sidkey));
 339                 ret = NT_STATUS_NONE_MAPPED;
 340                 goto done;
 341         }
 342
 343         t = strtol((const char *)databuf.dptr, &endptr, 10);
 344
 345         if ((endptr == NULL) || (*endptr != '/')) {
 346                 DEBUG(2, ("Invalid gencache data format: %s\n", (const char *)databuf.dptr));
 347                 /* remove the entry */
 348                 tdb_delete_bystring(cache->tdb, sidkey);
 349                 ret = NT_STATUS_NONE_MAPPED;
 350                 goto done;
 351         }
 352
 353         /* check it is not negative */
 354         if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
 355
 356                 DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
 357                            "timeout = %s", t > now ? "valid" :
 358                            "expired", sidkey, endptr+1, ctime(&t)));
 359
 360                 /* this call if successful will also mark the entry as mapped */
 361                 ret = idmap_cache_fill_map(id, endptr+1);
 362                 if ( ! NT_STATUS_IS_OK(ret)) {
 363                         /* if not valid form delete the entry */
 364                         tdb_delete_bystring(cache->tdb, sidkey);
 365                         ret = NT_STATUS_NONE_MAPPED;
 366                         goto done;
 367                 }
 368
 369                 /* here ret == NT_STATUS_OK and id->status = ID_MAPPED */
 370
 371                 if (t <= now) {
 372                         /* If we've been told to be offline - stay in
 373                            that state... */
 374                         if ( IS_DOMAIN_OFFLINE(our_domain) ) {
 375                                 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
 376                                 goto done;
 377                         }
 378
 379                         /* We're expired, set an error code
 380                            for upper layer */
 381                         ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 382                 }
 383
 384                 goto done;
 385         }
 386
 387         /* Was a negative cache hit */
 388
 389         /* Ignore the negative cache when offline */
 390
 391         if ( IS_DOMAIN_OFFLINE(our_domain) ) {
 392                 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
 393                 goto done;
 394         }
 395
 396
 397         /* Check for valid or expired cache hits */
 398                 if (t <= now) {
 399                 /* We're expired. Return not mapped */
 400                         ret = NT_STATUS_NONE_MAPPED;
 401                 } else {
 402                         /* this is not mapped as it was a negative cache hit */
 403                         id->status = ID_UNMAPPED;
 404                         ret = NT_STATUS_OK;
 405                 }
 406
 407 done:
 408         SAFE_FREE(databuf.dptr);
 409         talloc_free(sidkey);
 410         return ret;
 411 }
 412
 413 /* search the cahce for the ID an return a mapping if found *
 414  *
 415  * 4 cases are possible
 416  *
 417  * 1 map found
 418  *      in this case id->status = ID_MAPPED and NT_STATUS_OK is returned
 419  * 2 map not found
 420  *      in this case id->status = ID_UNKNOWN and NT_STATUS_NONE_MAPPED is returned
 421  * 3 negative cache found
 422  *      in this case id->status = ID_UNMAPPED and NT_STATUS_OK is returned
 423  * 4 map found but timer expired
 424  *      in this case id->status = ID_EXPIRED and NT_STATUS_SYNCHRONIZATION_REQUIRED
 425  *      is returned. In this case revalidation of the cache is needed.
 426  */
 427
 428 NTSTATUS idmap_cache_map_id(struct idmap_cache_ctx *cache, struct id_map *id)
 429 {
 430         NTSTATUS ret;
 431         TDB_DATA databuf;
 432         time_t t;
 433         char *idkey;
 434         char *endptr;
 435         struct winbindd_domain *our_domain = find_our_domain();
 436         time_t now = time(NULL);
 437
 438         /* make sure it is marked as unknown by default */
 439         id->status = ID_UNKNOWN;
 440
 441         ret = idmap_cache_build_idkey(cache, &idkey, id);
 442         if (!NT_STATUS_IS_OK(ret)) return ret;
 443
 444         databuf = tdb_fetch_bystring(cache->tdb, idkey);
 445
 446         if (databuf.dptr == NULL) {
 447                 DEBUG(10, ("Cache entry with key = %s couldn't be found\n", idkey));
 448                 ret = NT_STATUS_NONE_MAPPED;
 449                 goto done;
 450         }
 451
 452         t = strtol((const char *)databuf.dptr, &endptr, 10);
 453
 454         if ((endptr == NULL) || (*endptr != '/')) {
 455                 DEBUG(2, ("Invalid gencache data format: %s\n", (const char *)databuf.dptr));
 456                 /* remove the entry */
 457                 tdb_delete_bystring(cache->tdb, idkey);
 458                 ret = NT_STATUS_NONE_MAPPED;
 459                 goto done;
 460         }
 461
 462         /* check it is not negative */
 463         if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
 464
 465                 DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
 466                            "timeout = %s", t > now ? "valid" :
 467                            "expired", idkey, endptr+1, ctime(&t)));
 468
 469                 /* this call if successful will also mark the entry as mapped */
 470                 ret = idmap_cache_fill_map(id, endptr+1);
 471                 if ( ! NT_STATUS_IS_OK(ret)) {
 472                         /* if not valid form delete the entry */
 473                         tdb_delete_bystring(cache->tdb, idkey);
 474                         ret = NT_STATUS_NONE_MAPPED;
 475                         goto done;
 476                 }
 477
 478                 /* here ret == NT_STATUS_OK and id->mapped = ID_MAPPED */
 479
 480                 if (t <= now) {
 481                         /* If we've been told to be offline - stay in
 482                            that state... */
 483                         if ( IS_DOMAIN_OFFLINE(our_domain) ) {
 484                                 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
 485                                 goto done;
 486                         }
 487
 488                         /* We're expired, set an error code
 489                            for upper layer */
 490                         ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 491                 }
 492
 493                 goto done;
 494         }
 495
 496         /* Was a negative cache hit */
 497
 498         /* Ignore the negative cache when offline */
 499
 500         if ( IS_DOMAIN_OFFLINE(our_domain) ) {
 501                 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
 502                 ret = NT_STATUS_NONE_MAPPED;
 503
 504                 goto done;
 505         }
 506
 507         /* Process the negative cache hit */
 508
 509                 if (t <= now) {
 510                 /* We're expired.  Return not mapped */
 511                         ret = NT_STATUS_NONE_MAPPED;
 512                 } else {
 513                 /* this is not mapped is it was a negative cache hit */
 514                         id->status = ID_UNMAPPED;
 515                         ret = NT_STATUS_OK;
 516                 }
 517
 518 done:
 519         SAFE_FREE(databuf.dptr);
 520         talloc_free(idkey);
 521         return ret;
 522 }
 523
 524 bool idmap_cache_find_sid2uid(const struct dom_sid *sid, uid_t *puid,
 525                               bool *expired)
 526 {
 527         fstring sidstr;
 528         char *key;
 529         char *value;
 530         char *endptr;
 531         time_t timeout;
 532         uid_t uid;
 533         bool ret;
 534
 535         key = talloc_asprintf(talloc_tos(), "IDMAP/SID2UID/%s",
 536                               sid_to_fstring(sidstr, sid));
 537         if (key == NULL) {
 538                 return false;
 539         }
 540         ret = gencache_get(key, &value, &timeout);
 541         TALLOC_FREE(key);
 542         if (!ret) {
 543                 return false;
 544         }
 545         uid = strtol(value, &endptr, 10);
 546         ret = (*endptr == '\0');
 547         SAFE_FREE(value);
 548         if (ret) {
 549                 *puid = uid;
 550                 *expired = (timeout <= time(NULL));
 551         }
 552         return ret;
 553 }
 554
 555 bool idmap_cache_find_uid2sid(uid_t uid, struct dom_sid *sid, bool *expired)
 556 {
 557         char *key;
 558         char *value;
 559         time_t timeout;
 560         bool ret;
 561
 562         key = talloc_asprintf(talloc_tos(), "IDMAP/UID2SID/%d", (int)uid);
 563         if (key == NULL) {
 564                 return false;
 565         }
 566         ret = gencache_get(key, &value, &timeout);
 567         TALLOC_FREE(key);
 568         if (!ret) {
 569                 return false;
 570         }
 571         ZERO_STRUCTP(sid);
 572         ret = string_to_sid(sid, value);
 573         SAFE_FREE(value);
 574         if (ret) {
 575                 *expired = (timeout <= time(NULL));
 576         }
 577         return ret;
 578 }
 579
 580 void idmap_cache_set_sid2uid(const struct dom_sid *sid, uid_t uid)
 581 {
 582         time_t now = time(NULL);
 583         time_t timeout;
 584         fstring sidstr, key, value;
 585
 586         if (!is_null_sid(sid)) {
 587                 fstr_sprintf(key, "IDMAP/SID2UID/%s",
 588                              sid_to_fstring(sidstr, sid));
 589                 fstr_sprintf(value, "%d", (int)uid);
 590                 timeout = (uid == -1)
 591                         ? lp_idmap_negative_cache_time()
 592                         : lp_idmap_cache_time();
 593                 gencache_set(key, value, now + timeout);
 594         }
 595         if (uid != -1) {
 596                 fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)uid);
 597                 sid_to_fstring(value, sid);
 598                 timeout = is_null_sid(sid)
 599                         ? lp_idmap_negative_cache_time()
 600                         : lp_idmap_cache_time();
 601                 gencache_set(key, value, now + timeout);
 602         }
 603 }