source3/winbindd/idmap_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping
   4    Copyright (C) Simo Sorce 2003
   5    Copyright (C) Jeremy Allison 2006
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.*/
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "winbindd_proto.h"
  23
  24 #undef DBGC_CLASS
  25 #define DBGC_CLASS DBGC_IDMAP
  26
  27 /*****************************************************************
  28  Returns true if the request was for a specific domain, or
  29  for a sid we are authoritative for - BUILTIN, or our own domain.
  30 *****************************************************************/
  31
  32 static bool is_specific_domain_request(const char *dom_name, DOM_SID *sid)
  33 {
  34         if (dom_name && dom_name[0] != '\0') {
  35                 return true;
  36         }
  37         if (sid_check_is_in_builtin(sid) ||
  38                         sid_check_is_in_our_domain(sid)) {
  39                 return true;
  40         }
  41         return false;
  42 }
  43
  44 /*****************************************************************
  45  Returns the SID mapped to the given UID.
  46  If mapping is not possible returns an error.
  47 *****************************************************************/
  48
  49 NTSTATUS idmap_uid_to_sid(const char *domname, DOM_SID *sid, uid_t uid)
  50 {
  51         NTSTATUS ret;
  52         struct id_map map;
  53         bool expired;
  54
  55         DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
  56                   (unsigned long)uid, domname?domname:"NULL"));
  57
  58         if (winbindd_use_idmap_cache()
  59             && idmap_cache_find_uid2sid(uid, sid, &expired)) {
  60                 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
  61                         (unsigned int)uid,
  62                            expired ? " (expired)": ""));
  63                 if (expired && idmap_is_online()) {
  64                         DEBUG(10, ("revalidating expired entry\n"));
  65                         goto backend;
  66                 }
  67                 if (is_null_sid(sid)) {
  68                         DEBUG(10, ("Returning negative cache entry\n"));
  69                         return NT_STATUS_NONE_MAPPED;
  70                 }
  71                 DEBUG(10, ("Returning positive cache entry\n"));
  72                 return NT_STATUS_OK;
  73         }
  74
  75 backend:
  76         map.sid = sid;
  77         map.xid.type = ID_TYPE_UID;
  78         map.xid.id = uid;
  79
  80         ret = idmap_backends_unixid_to_sid(domname, &map);
  81         if ( ! NT_STATUS_IS_OK(ret)) {
  82                 DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid));
  83                 return ret;
  84         }
  85
  86         if (map.status != ID_MAPPED) {
  87                 if (winbindd_use_idmap_cache()) {
  88                         struct dom_sid null_sid;
  89                         ZERO_STRUCT(null_sid);
  90                         idmap_cache_set_sid2uid(&null_sid, uid);
  91                 }
  92                 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
  93                 return NT_STATUS_NONE_MAPPED;
  94         }
  95
  96         if (winbindd_use_idmap_cache()) {
  97                 idmap_cache_set_sid2uid(sid, uid);
  98         }
  99
 100         return NT_STATUS_OK;
 101 }
 102
 103 /*****************************************************************
 104  Returns SID mapped to the given GID.
 105  If mapping is not possible returns an error.
 106 *****************************************************************/
 107
 108 NTSTATUS idmap_gid_to_sid(const char *domname, DOM_SID *sid, gid_t gid)
 109 {
 110         NTSTATUS ret;
 111         struct id_map map;
 112         bool expired;
 113
 114         DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
 115                   (unsigned long)gid, domname?domname:"NULL"));
 116
 117         if (winbindd_use_idmap_cache()
 118             && idmap_cache_find_gid2sid(gid, sid, &expired)) {
 119                 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
 120                         (unsigned int)gid,
 121                            expired ? " (expired)": ""));
 122                 if (expired && idmap_is_online()) {
 123                         DEBUG(10, ("revalidating expired entry\n"));
 124                         goto backend;
 125                 }
 126                 if (is_null_sid(sid)) {
 127                         DEBUG(10, ("Returning negative cache entry\n"));
 128                         return NT_STATUS_NONE_MAPPED;
 129                 }
 130                 DEBUG(10, ("Returning positive cache entry\n"));
 131                 return NT_STATUS_OK;
 132         }
 133
 134 backend:
 135         map.sid = sid;
 136         map.xid.type = ID_TYPE_GID;
 137         map.xid.id = gid;
 138
 139         ret = idmap_backends_unixid_to_sid(domname, &map);
 140         if ( ! NT_STATUS_IS_OK(ret)) {
 141                 DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid));
 142                 return ret;
 143         }
 144
 145         if (map.status != ID_MAPPED) {
 146                 if (winbindd_use_idmap_cache()) {
 147                         struct dom_sid null_sid;
 148                         ZERO_STRUCT(null_sid);
 149                         idmap_cache_set_sid2uid(&null_sid, gid);
 150                 }
 151                 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
 152                 return NT_STATUS_NONE_MAPPED;
 153         }
 154
 155         if (winbindd_use_idmap_cache()) {
 156                 idmap_cache_set_sid2gid(sid, gid);
 157         }
 158
 159         return NT_STATUS_OK;
 160 }
 161
 162 /*****************************************************************
 163  Returns the UID mapped to the given SID.
 164  If mapping is not possible or SID maps to a GID returns an error.
 165 *****************************************************************/
 166
 167 NTSTATUS idmap_sid_to_uid(const char *dom_name, DOM_SID *sid, uid_t *uid)
 168 {
 169         NTSTATUS ret;
 170         struct id_map map;
 171         bool expired;
 172
 173         DEBUG(10,("idmap_sid_to_uid: sid = [%s], domain = '%s'\n",
 174                   sid_string_dbg(sid), dom_name));
 175
 176         if (winbindd_use_idmap_cache()
 177             && idmap_cache_find_sid2uid(sid, uid, &expired)) {
 178                 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
 179                            (int)(*uid), expired ? " (expired)": ""));
 180                 if (expired && idmap_is_online()) {
 181                         DEBUG(10, ("revalidating expired entry\n"));
 182                         goto backend;
 183                 }
 184                 if ((*uid) == -1) {
 185                         DEBUG(10, ("Returning negative cache entry\n"));
 186                         return NT_STATUS_NONE_MAPPED;
 187                 }
 188                 DEBUG(10, ("Returning positive cache entry\n"));
 189                 return NT_STATUS_OK;
 190         }
 191
 192 backend:
 193         map.sid = sid;
 194         map.xid.type = ID_TYPE_UID;
 195
 196         ret = idmap_backends_sid_to_unixid(dom_name, &map);
 197
 198         if (NT_STATUS_IS_OK(ret) && (map.status == ID_MAPPED)) {
 199                 if (map.xid.type != ID_TYPE_UID) {
 200                         DEBUG(10, ("sid [%s] not mapped to a uid "
 201                                    "[%u,%u,%u]\n",
 202                                    sid_string_dbg(sid),
 203                                    map.status,
 204                                    map.xid.type,
 205                                    map.xid.id));
 206                         if (winbindd_use_idmap_cache()) {
 207                                 idmap_cache_set_sid2uid(sid, -1);
 208                         }
 209                         return NT_STATUS_NONE_MAPPED;
 210                 }
 211                 goto done;
 212         }
 213
 214         if (is_specific_domain_request(dom_name, sid)) {
 215                 /*
 216                  * We had the task to go to a specific domain or
 217                  * a domain for which we are authoritative for and
 218                  * it could not answer our request. Fail.
 219                  */
 220                 if (winbindd_use_idmap_cache()) {
 221                         idmap_cache_set_sid2uid(sid, -1);
 222                 }
 223                 return NT_STATUS_NONE_MAPPED;
 224         }
 225
 226         ret = idmap_new_mapping(sid, ID_TYPE_UID, &map.xid);
 227
 228         if (!NT_STATUS_IS_OK(ret)) {
 229                 DEBUG(10, ("idmap_new_mapping failed: %s\n",
 230                            nt_errstr(ret)));
 231                 if (winbindd_use_idmap_cache()) {
 232                         idmap_cache_set_sid2uid(sid, -1);
 233                 }
 234                 return ret;
 235         }
 236
 237 done:
 238         *uid = (uid_t)map.xid.id;
 239         if (winbindd_use_idmap_cache()) {
 240                 idmap_cache_set_sid2uid(sid, *uid);
 241         }
 242         return NT_STATUS_OK;
 243 }
 244
 245 /*****************************************************************
 246  Returns the GID mapped to the given SID.
 247  If mapping is not possible or SID maps to a UID returns an error.
 248 *****************************************************************/
 249
 250 NTSTATUS idmap_sid_to_gid(const char *domname, DOM_SID *sid, gid_t *gid)
 251 {
 252         NTSTATUS ret;
 253         struct id_map map;
 254         bool expired;
 255
 256         DEBUG(10,("idmap_sid_to_gid: sid = [%s], domain = '%s'\n",
 257                   sid_string_dbg(sid), domname));
 258
 259         if (winbindd_use_idmap_cache()
 260             && idmap_cache_find_sid2gid(sid, gid, &expired)) {
 261                 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
 262                            (int)(*gid), expired ? " (expired)": ""));
 263                 if (expired && idmap_is_online()) {
 264                         DEBUG(10, ("revalidating expired entry\n"));
 265                         goto backend;
 266                 }
 267                 if ((*gid) == -1) {
 268                         DEBUG(10, ("Returning negative cache entry\n"));
 269                         return NT_STATUS_NONE_MAPPED;
 270                 }
 271                 DEBUG(10, ("Returning positive cache entry\n"));
 272                 return NT_STATUS_OK;
 273         }
 274
 275 backend:
 276         map.sid = sid;
 277         map.xid.type = ID_TYPE_GID;
 278
 279         ret = idmap_backends_sid_to_unixid(domname, &map);
 280         if (NT_STATUS_IS_OK(ret) && (map.status == ID_MAPPED)) {
 281                 if (map.xid.type != ID_TYPE_GID) {
 282                         DEBUG(10, ("sid [%s] not mapped to a gid "
 283                                    "[%u,%u,%u]\n",
 284                                    sid_string_dbg(sid),
 285                                    map.status,
 286                                    map.xid.type,
 287                                    map.xid.id));
 288                         if (winbindd_use_idmap_cache()) {
 289                                 idmap_cache_set_sid2gid(sid, -1);
 290                         }
 291                         return NT_STATUS_NONE_MAPPED;
 292                 }
 293                 goto done;
 294         }
 295
 296         if (is_specific_domain_request(domname, sid)) {
 297                 /*
 298                  * We had the task to go to a specific domain or
 299                  * a domain for which we are authoritative for and
 300                  * it could not answer our request. Fail.
 301                  */
 302                 if (winbindd_use_idmap_cache()) {
 303                         idmap_cache_set_sid2uid(sid, -1);
 304                 }
 305                 return NT_STATUS_NONE_MAPPED;
 306         }
 307
 308         ret = idmap_new_mapping(sid, ID_TYPE_GID, &map.xid);
 309
 310         if (!NT_STATUS_IS_OK(ret)) {
 311                 DEBUG(10, ("idmap_new_mapping failed: %s\n",
 312                            nt_errstr(ret)));
 313                 if (winbindd_use_idmap_cache()) {
 314                         idmap_cache_set_sid2gid(sid, -1);
 315                 }
 316                 return ret;
 317         }
 318
 319 done:
 320         *gid = map.xid.id;
 321         if (winbindd_use_idmap_cache()) {
 322                 idmap_cache_set_sid2gid(sid, *gid);
 323         }
 324         return NT_STATUS_OK;
 325 }