source/winbindd/idmap_tdb2.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    idmap TDB2 backend, used for clustered Samba setups.
   5
   6    This uses 2 tdb files. One is permanent, and is in shared storage
   7    on the cluster (using "tdb:idmap2.tdb =" in smb.conf). The other is a
   8    temporary cache tdb on local storage.
   9
  10    Copyright (C) Andrew Tridgell 2007
  11
  12    This is heavily based upon idmap_tdb.c, which is:
  13
  14    Copyright (C) Tim Potter 2000
  15    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
  16    Copyright (C) Jeremy Allison 2006
  17    Copyright (C) Simo Sorce 2003-2006
  18
  19    This program is free software; you can redistribute it and/or modify
  20    it under the terms of the GNU General Public License as published by
  21    the Free Software Foundation; either version 2 of the License, or
  22    (at your option) any later version.
  23
  24    This program is distributed in the hope that it will be useful,
  25    but WITHOUT ANY WARRANTY; without even the implied warranty of
  26    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27    GNU General Public License for more details.
  28
  29    You should have received a copy of the GNU General Public License
  30    along with this program; if not, write to the Free Software
  31    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  32 */
  33
  34 #include "includes.h"
  35 #include "winbindd.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_IDMAP
  39
  40 /* High water mark keys */
  41 #define HWM_GROUP  "GROUP HWM"
  42 #define HWM_USER   "USER HWM"
  43
  44 static struct idmap_tdb2_state {
  45         /* User and group id pool */
  46         uid_t low_uid, high_uid;               /* Range of uids to allocate */
  47         gid_t low_gid, high_gid;               /* Range of gids to allocate */
  48         const char *idmap_script;
  49 } idmap_tdb2_state;
  50
  51
  52
  53 /* tdb context for the local cache tdb */
  54 static TDB_CONTEXT *idmap_tdb2_tmp;
  55
  56 /* handle to the permanent tdb */
  57 static struct db_context *idmap_tdb2_perm;
  58
  59 /*
  60   open the cache tdb
  61  */
  62 static NTSTATUS idmap_tdb2_open_cache_db(void)
  63 {
  64         const char *db_path;
  65
  66         if (idmap_tdb2_tmp) {
  67                 /* its already open */
  68                 return NT_STATUS_OK;
  69         }
  70
  71         db_path = lock_path("idmap2_cache.tdb");
  72
  73         /* Open idmap repository */
  74         if (!(idmap_tdb2_tmp = tdb_open_log(db_path, 0, TDB_CLEAR_IF_FIRST, O_RDWR|O_CREAT, 0644))) {
  75                 DEBUG(0, ("Unable to open cache idmap database '%s'\n", db_path));
  76                 return NT_STATUS_UNSUCCESSFUL;
  77         }
  78
  79         return NT_STATUS_OK;
  80 }
  81
  82
  83 static NTSTATUS idmap_tdb2_alloc_load(void);
  84
  85 /*
  86   open the permanent tdb
  87  */
  88 static NTSTATUS idmap_tdb2_open_perm_db(void)
  89 {
  90         char *db_path;
  91
  92         if (idmap_tdb2_perm) {
  93                 /* its already open */
  94                 return NT_STATUS_OK;
  95         }
  96
  97         db_path = lp_parm_talloc_string(-1, "tdb", "idmap2.tdb", NULL);
  98         if (db_path == NULL) {
  99                 /* fall back to the private directory, which, despite
 100                    its name, is usually on shared storage */
 101                 db_path = talloc_asprintf(NULL, "%s/idmap2.tdb", lp_private_dir());
 102         }
 103         NT_STATUS_HAVE_NO_MEMORY(db_path);
 104
 105         /* Open idmap repository */
 106         idmap_tdb2_perm = db_open(NULL, db_path, 0, TDB_DEFAULT,
 107                                   O_RDWR|O_CREAT, 0644);
 108         TALLOC_FREE(db_path);
 109
 110         if (idmap_tdb2_perm == NULL) {
 111                 DEBUG(0, ("Unable to open permanent idmap database '%s'\n",
 112                           db_path));
 113                 return NT_STATUS_UNSUCCESSFUL;
 114         }
 115
 116         /* load the ranges and high/low water marks */
 117         return idmap_tdb2_alloc_load();
 118 }
 119
 120
 121 /*
 122   load the idmap allocation ranges and high/low water marks
 123 */
 124 static NTSTATUS idmap_tdb2_alloc_load(void)
 125 {
 126         const char *range;
 127         uid_t low_uid = 0;
 128         uid_t high_uid = 0;
 129         gid_t low_gid = 0;
 130         gid_t high_gid = 0;
 131
 132         /* load ranges */
 133         idmap_tdb2_state.low_uid = 0;
 134         idmap_tdb2_state.high_uid = 0;
 135         idmap_tdb2_state.low_gid = 0;
 136         idmap_tdb2_state.high_gid = 0;
 137
 138         /* see if a idmap script is configured */
 139         idmap_tdb2_state.idmap_script = lp_parm_const_string(-1, "idmap", "script", NULL);
 140
 141         if (idmap_tdb2_state.idmap_script) {
 142                 DEBUG(1, ("using idmap script '%s'\n", idmap_tdb2_state.idmap_script));
 143         }
 144
 145         range = lp_parm_const_string(-1, "idmap alloc config", "range", NULL);
 146         if (range && range[0]) {
 147                 unsigned low_id, high_id;
 148                 if (sscanf(range, "%u - %u", &low_id, &high_id) == 2) {
 149                         if (low_id < high_id) {
 150                                 idmap_tdb2_state.low_gid = idmap_tdb2_state.low_uid = low_id;
 151                                 idmap_tdb2_state.high_gid = idmap_tdb2_state.high_uid = high_id;
 152                         } else {
 153                                 DEBUG(1, ("ERROR: invalid idmap alloc range [%s]", range));
 154                         }
 155                 } else {
 156                         DEBUG(1, ("ERROR: invalid syntax for idmap alloc config:range [%s]", range));
 157                 }
 158         }
 159
 160         /* Create high water marks for group and user id */
 161         if (lp_idmap_uid(&low_uid, &high_uid)) {
 162                 idmap_tdb2_state.low_uid = low_uid;
 163                 idmap_tdb2_state.high_uid = high_uid;
 164         }
 165
 166         if (lp_idmap_gid(&low_gid, &high_gid)) {
 167                 idmap_tdb2_state.low_gid = low_gid;
 168                 idmap_tdb2_state.high_gid = high_gid;
 169         }
 170
 171         if (idmap_tdb2_state.high_uid <= idmap_tdb2_state.low_uid) {
 172                 DEBUG(1, ("idmap uid range missing or invalid\n"));
 173                 DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
 174                 return NT_STATUS_UNSUCCESSFUL;
 175         } else {
 176                 uint32 low_id;
 177
 178                 if (((low_id = dbwrap_fetch_int32(idmap_tdb2_perm,
 179                                                   HWM_USER)) == -1) ||
 180                     (low_id < idmap_tdb2_state.low_uid)) {
 181                         if (dbwrap_store_int32(
 182                                     idmap_tdb2_perm, HWM_USER,
 183                                     idmap_tdb2_state.low_uid) == -1) {
 184                                 DEBUG(0, ("Unable to initialise user hwm in idmap database\n"));
 185                                 return NT_STATUS_INTERNAL_DB_ERROR;
 186                         }
 187                 }
 188         }
 189
 190         if (idmap_tdb2_state.high_gid <= idmap_tdb2_state.low_gid) {
 191                 DEBUG(1, ("idmap gid range missing or invalid\n"));
 192                 DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
 193                 return NT_STATUS_UNSUCCESSFUL;
 194         } else {
 195                 uint32 low_id;
 196
 197                 if (((low_id = dbwrap_fetch_int32(idmap_tdb2_perm,
 198                                                   HWM_GROUP)) == -1) ||
 199                     (low_id < idmap_tdb2_state.low_gid)) {
 200                         if (dbwrap_store_int32(
 201                                     idmap_tdb2_perm, HWM_GROUP,
 202                                     idmap_tdb2_state.low_gid) == -1) {
 203                                 DEBUG(0, ("Unable to initialise group hwm in idmap database\n"));
 204                                 return NT_STATUS_INTERNAL_DB_ERROR;
 205                         }
 206                 }
 207         }
 208
 209         return NT_STATUS_OK;
 210 }
 211
 212
 213 /*
 214   Initialise idmap alloc database.
 215 */
 216 static NTSTATUS idmap_tdb2_alloc_init(const char *params)
 217 {
 218         /* nothing to do - we want to avoid opening the permanent
 219            database if possible. Instead we load the params when we
 220            first need it. */
 221         return NT_STATUS_OK;
 222 }
 223
 224
 225 /*
 226   Allocate a new id.
 227 */
 228 static NTSTATUS idmap_tdb2_allocate_id(struct unixid *xid)
 229 {
 230         bool ret;
 231         const char *hwmkey;
 232         const char *hwmtype;
 233         uint32_t high_hwm;
 234         uint32_t hwm;
 235         NTSTATUS status;
 236
 237         status = idmap_tdb2_open_perm_db();
 238         if (!NT_STATUS_IS_OK(status)) {
 239                 return status;
 240         }
 241
 242         /* Get current high water mark */
 243         switch (xid->type) {
 244
 245         case ID_TYPE_UID:
 246                 hwmkey = HWM_USER;
 247                 hwmtype = "UID";
 248                 high_hwm = idmap_tdb2_state.high_uid;
 249                 break;
 250
 251         case ID_TYPE_GID:
 252                 hwmkey = HWM_GROUP;
 253                 hwmtype = "GID";
 254                 high_hwm = idmap_tdb2_state.high_gid;
 255                 break;
 256
 257         default:
 258                 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
 259                 return NT_STATUS_INVALID_PARAMETER;
 260         }
 261
 262         if ((hwm = dbwrap_fetch_int32(idmap_tdb2_perm, hwmkey)) == -1) {
 263                 return NT_STATUS_INTERNAL_DB_ERROR;
 264         }
 265
 266         /* check it is in the range */
 267         if (hwm > high_hwm) {
 268                 DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
 269                           hwmtype, (unsigned long)high_hwm));
 270                 return NT_STATUS_UNSUCCESSFUL;
 271         }
 272
 273         /* fetch a new id and increment it */
 274         ret = dbwrap_change_uint32_atomic(idmap_tdb2_perm, hwmkey, &hwm, 1);
 275         if (ret == -1) {
 276                 DEBUG(1, ("Fatal error while fetching a new %s value\n!", hwmtype));
 277                 return NT_STATUS_UNSUCCESSFUL;
 278         }
 279
 280         /* recheck it is in the range */
 281         if (hwm > high_hwm) {
 282                 DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
 283                           hwmtype, (unsigned long)high_hwm));
 284                 return NT_STATUS_UNSUCCESSFUL;
 285         }
 286
 287         xid->id = hwm;
 288         DEBUG(10,("New %s = %d\n", hwmtype, hwm));
 289
 290         return NT_STATUS_OK;
 291 }
 292
 293 /*
 294   Get current highest id.
 295 */
 296 static NTSTATUS idmap_tdb2_get_hwm(struct unixid *xid)
 297 {
 298         const char *hwmkey;
 299         const char *hwmtype;
 300         uint32_t hwm;
 301         uint32_t high_hwm;
 302         NTSTATUS status;
 303
 304         status = idmap_tdb2_open_perm_db();
 305         if (!NT_STATUS_IS_OK(status)) {
 306                 return status;
 307         }
 308
 309         /* Get current high water mark */
 310         switch (xid->type) {
 311
 312         case ID_TYPE_UID:
 313                 hwmkey = HWM_USER;
 314                 hwmtype = "UID";
 315                 high_hwm = idmap_tdb2_state.high_uid;
 316                 break;
 317
 318         case ID_TYPE_GID:
 319                 hwmkey = HWM_GROUP;
 320                 hwmtype = "GID";
 321                 high_hwm = idmap_tdb2_state.high_gid;
 322                 break;
 323
 324         default:
 325                 return NT_STATUS_INVALID_PARAMETER;
 326         }
 327
 328         if ((hwm = dbwrap_fetch_int32(idmap_tdb2_perm, hwmkey)) == -1) {
 329                 return NT_STATUS_INTERNAL_DB_ERROR;
 330         }
 331
 332         xid->id = hwm;
 333
 334         /* Warn if it is out of range */
 335         if (hwm >= high_hwm) {
 336                 DEBUG(0, ("Warning: %s range full!! (max: %lu)\n",
 337                           hwmtype, (unsigned long)high_hwm));
 338         }
 339
 340         return NT_STATUS_OK;
 341 }
 342
 343 /*
 344   Set high id.
 345 */
 346 static NTSTATUS idmap_tdb2_set_hwm(struct unixid *xid)
 347 {
 348         /* not supported, or we would invalidate the cache tdb on
 349            other nodes */
 350         DEBUG(0,("idmap_tdb2_set_hwm not supported\n"));
 351         return NT_STATUS_NOT_SUPPORTED;
 352 }
 353
 354 /*
 355   Close the alloc tdb
 356 */
 357 static NTSTATUS idmap_tdb2_alloc_close(void)
 358 {
 359         /* don't actually close it */
 360         return NT_STATUS_OK;
 361 }
 362
 363 /*
 364   IDMAP MAPPING TDB BACKEND
 365 */
 366 struct idmap_tdb2_context {
 367         uint32_t filter_low_id;
 368         uint32_t filter_high_id;
 369 };
 370
 371 /*
 372   try fetching from the cache tdb, and if that fails then
 373   fetch from the permanent tdb
 374  */
 375 static TDB_DATA tdb2_fetch_bystring(TALLOC_CTX *mem_ctx, const char *keystr)
 376 {
 377         TDB_DATA ret;
 378         NTSTATUS status;
 379
 380         ret = tdb_fetch_bystring(idmap_tdb2_tmp, keystr);
 381         if (ret.dptr != NULL) {
 382                 /* got it from cache */
 383                 unsigned char *tmp;
 384
 385                 tmp = (unsigned char *)talloc_memdup(mem_ctx, ret.dptr,
 386                                                      ret.dsize);
 387                 SAFE_FREE(ret.dptr);
 388                 ret.dptr = tmp;
 389
 390                 if (ret.dptr == NULL) {
 391                         return make_tdb_data(NULL, 0);
 392                 }
 393                 return ret;
 394         }
 395
 396         status = idmap_tdb2_open_perm_db();
 397         if (!NT_STATUS_IS_OK(status)) {
 398                 return ret;
 399         }
 400
 401         /* fetch from the permanent tdb */
 402         return dbwrap_fetch_bystring(idmap_tdb2_perm, mem_ctx, keystr);
 403 }
 404
 405 /*
 406   store into both databases
 407  */
 408 static NTSTATUS tdb2_store_bystring(const char *keystr, TDB_DATA data, int flags)
 409 {
 410         NTSTATUS ret;
 411         NTSTATUS status = idmap_tdb2_open_perm_db();
 412         if (!NT_STATUS_IS_OK(status)) {
 413                 return NT_STATUS_UNSUCCESSFUL;
 414         }
 415         ret = dbwrap_store_bystring(idmap_tdb2_perm, keystr, data, flags);
 416         if (!NT_STATUS_IS_OK(ret)) {
 417                 ret = tdb_store_bystring(idmap_tdb2_tmp, keystr, data, flags) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 418         }
 419         return ret;
 420 }
 421
 422 /*
 423   delete from both databases
 424  */
 425 static NTSTATUS tdb2_delete_bystring(const char *keystr)
 426 {
 427         NTSTATUS ret;
 428         NTSTATUS status = idmap_tdb2_open_perm_db();
 429         if (!NT_STATUS_IS_OK(status)) {
 430                 return NT_STATUS_UNSUCCESSFUL;
 431         }
 432         ret = dbwrap_delete_bystring(idmap_tdb2_perm, keystr);
 433         if (!NT_STATUS_IS_OK(ret)) {
 434                 ret = tdb_delete_bystring(idmap_tdb2_tmp, keystr)  ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 435         }
 436         return ret;
 437 }
 438
 439 /*
 440   Initialise idmap database.
 441 */
 442 static NTSTATUS idmap_tdb2_db_init(struct idmap_domain *dom)
 443 {
 444         NTSTATUS ret;
 445         struct idmap_tdb2_context *ctx;
 446         char *config_option = NULL;
 447         const char *range;
 448         NTSTATUS status;
 449
 450         status = idmap_tdb2_open_cache_db();
 451         NT_STATUS_NOT_OK_RETURN(status);
 452
 453         ctx = talloc(dom, struct idmap_tdb2_context);
 454         if ( ! ctx) {
 455                 DEBUG(0, ("Out of memory!\n"));
 456                 return NT_STATUS_NO_MEMORY;
 457         }
 458
 459         config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
 460         if ( ! config_option) {
 461                 DEBUG(0, ("Out of memory!\n"));
 462                 ret = NT_STATUS_NO_MEMORY;
 463                 goto failed;
 464         }
 465
 466         range = lp_parm_const_string(-1, config_option, "range", NULL);
 467         if (( ! range) ||
 468             (sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
 469             (ctx->filter_low_id > ctx->filter_high_id)) {
 470                 ctx->filter_low_id = 0;
 471                 ctx->filter_high_id = 0;
 472         }
 473
 474         dom->private_data = ctx;
 475         dom->initialized = True;
 476
 477         talloc_free(config_option);
 478         return NT_STATUS_OK;
 479
 480 failed:
 481         talloc_free(ctx);
 482         return ret;
 483 }
 484
 485
 486 /*
 487   run a script to perform a mapping
 488
 489   The script should the following command lines:
 490
 491       SIDTOID S-1-xxxx
 492       IDTOSID UID xxxx
 493       IDTOSID GID xxxx
 494
 495   and should return one of the following as a single line of text
 496      UID:xxxx
 497      GID:xxxx
 498      SID:xxxx
 499      ERR:xxxx
 500  */
 501 static NTSTATUS idmap_tdb2_script(struct idmap_tdb2_context *ctx, struct id_map *map,
 502                                   const char *fmt, ...)
 503 {
 504         va_list ap;
 505         char *cmd;
 506         FILE *p;
 507         char line[64];
 508         unsigned long v;
 509
 510         cmd = talloc_asprintf(ctx, "%s ", idmap_tdb2_state.idmap_script);
 511         NT_STATUS_HAVE_NO_MEMORY(cmd);
 512
 513         va_start(ap, fmt);
 514         cmd = talloc_vasprintf_append(cmd, fmt, ap);
 515         va_end(ap);
 516         NT_STATUS_HAVE_NO_MEMORY(cmd);
 517
 518         p = popen(cmd, "r");
 519         talloc_free(cmd);
 520         if (p == NULL) {
 521                 return NT_STATUS_NONE_MAPPED;
 522         }
 523
 524         if (fgets(line, sizeof(line)-1, p) == NULL) {
 525                 pclose(p);
 526                 return NT_STATUS_NONE_MAPPED;
 527         }
 528         pclose(p);
 529
 530         DEBUG(10,("idmap script gave: %s\n", line));
 531
 532         if (sscanf(line, "UID:%lu", &v) == 1) {
 533                 map->xid.id   = v;
 534                 map->xid.type = ID_TYPE_UID;
 535         } else if (sscanf(line, "GID:%lu", &v) == 1) {
 536                 map->xid.id   = v;
 537                 map->xid.type = ID_TYPE_GID;
 538         } else if (strncmp(line, "SID:S-", 6) == 0) {
 539                 if (!string_to_sid(map->sid, &line[4])) {
 540                         DEBUG(0,("Bad SID in '%s' from idmap script %s\n",
 541                                  line, idmap_tdb2_state.idmap_script));
 542                         return NT_STATUS_NONE_MAPPED;
 543                 }
 544         } else {
 545                 DEBUG(0,("Bad reply '%s' from idmap script %s\n",
 546                          line, idmap_tdb2_state.idmap_script));
 547                 return NT_STATUS_NONE_MAPPED;
 548         }
 549
 550         return NT_STATUS_OK;
 551 }
 552
 553
 554
 555 /*
 556   Single id to sid lookup function.
 557 */
 558 static NTSTATUS idmap_tdb2_id_to_sid(struct idmap_tdb2_context *ctx, struct id_map *map)
 559 {
 560         NTSTATUS ret;
 561         TDB_DATA data;
 562         char *keystr;
 563         NTSTATUS status;
 564
 565         status = idmap_tdb2_open_perm_db();
 566         if (!NT_STATUS_IS_OK(status)) {
 567                 return status;
 568         }
 569
 570         if (!ctx || !map) {
 571                 return NT_STATUS_INVALID_PARAMETER;
 572         }
 573
 574         /* apply filters before checking */
 575         if ((ctx->filter_low_id && (map->xid.id < ctx->filter_low_id)) ||
 576             (ctx->filter_high_id && (map->xid.id > ctx->filter_high_id))) {
 577                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 578                                 map->xid.id, ctx->filter_low_id, ctx->filter_high_id));
 579                 return NT_STATUS_NONE_MAPPED;
 580         }
 581
 582         switch (map->xid.type) {
 583
 584         case ID_TYPE_UID:
 585                 keystr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
 586                 break;
 587
 588         case ID_TYPE_GID:
 589                 keystr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
 590                 break;
 591
 592         default:
 593                 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
 594                 return NT_STATUS_INVALID_PARAMETER;
 595         }
 596
 597         /* final SAFE_FREE safe */
 598         data.dptr = NULL;
 599
 600         if (keystr == NULL) {
 601                 DEBUG(0, ("Out of memory!\n"));
 602                 ret = NT_STATUS_NO_MEMORY;
 603                 goto done;
 604         }
 605
 606         DEBUG(10,("Fetching record %s\n", keystr));
 607
 608         /* Check if the mapping exists */
 609         data = tdb2_fetch_bystring(keystr, keystr);
 610
 611         if (!data.dptr) {
 612                 fstring sidstr;
 613
 614                 DEBUG(10,("Record %s not found\n", keystr));
 615                 if (idmap_tdb2_state.idmap_script == NULL) {
 616                         ret = NT_STATUS_NONE_MAPPED;
 617                         goto done;
 618                 }
 619
 620                 ret = idmap_tdb2_script(ctx, map, "IDTOSID %s", keystr);
 621
 622                 /* store it on shared storage */
 623                 if (!NT_STATUS_IS_OK(ret)) {
 624                         goto done;
 625                 }
 626
 627                 if (sid_to_fstring(sidstr, map->sid)) {
 628                         /* both forward and reverse mappings */
 629                         tdb2_store_bystring(keystr,
 630                                             string_term_tdb_data(sidstr),
 631                                             TDB_REPLACE);
 632                         tdb2_store_bystring(sidstr,
 633                                             string_term_tdb_data(keystr),
 634                                             TDB_REPLACE);
 635                 }
 636                 goto done;
 637         }
 638
 639         if (!string_to_sid(map->sid, (const char *)data.dptr)) {
 640                 DEBUG(10,("INVALID SID (%s) in record %s\n",
 641                         (const char *)data.dptr, keystr));
 642                 ret = NT_STATUS_INTERNAL_DB_ERROR;
 643                 goto done;
 644         }
 645
 646         DEBUG(10,("Found record %s -> %s\n", keystr, (const char *)data.dptr));
 647         ret = NT_STATUS_OK;
 648
 649 done:
 650         talloc_free(keystr);
 651         return ret;
 652 }
 653
 654
 655 /*
 656  Single sid to id lookup function.
 657 */
 658 static NTSTATUS idmap_tdb2_sid_to_id(struct idmap_tdb2_context *ctx, struct id_map *map)
 659 {
 660         NTSTATUS ret;
 661         TDB_DATA data;
 662         char *keystr;
 663         unsigned long rec_id = 0;
 664         NTSTATUS status;
 665
 666         status = idmap_tdb2_open_perm_db();
 667         if (!NT_STATUS_IS_OK(status)) {
 668                 return status;
 669         }
 670
 671         if ((keystr = sid_string_talloc(ctx, map->sid)) == NULL) {
 672                 DEBUG(0, ("Out of memory!\n"));
 673                 ret = NT_STATUS_NO_MEMORY;
 674                 goto done;
 675         }
 676
 677         DEBUG(10,("Fetching record %s\n", keystr));
 678
 679         /* Check if sid is present in database */
 680         data = tdb2_fetch_bystring(keystr, keystr);
 681         if (!data.dptr) {
 682                 fstring idstr;
 683
 684                 DEBUG(10,(__location__ " Record %s not found\n", keystr));
 685
 686                 if (idmap_tdb2_state.idmap_script == NULL) {
 687                         ret = NT_STATUS_NONE_MAPPED;
 688                         goto done;
 689                 }
 690
 691                 ret = idmap_tdb2_script(ctx, map, "SIDTOID %s", keystr);
 692                 /* store it on shared storage */
 693                 if (!NT_STATUS_IS_OK(ret)) {
 694                         goto done;
 695                 }
 696
 697                 snprintf(idstr, sizeof(idstr), "%cID %lu",
 698                          map->xid.type == ID_TYPE_UID?'U':'G',
 699                          (unsigned long)map->xid.id);
 700                 /* store both forward and reverse mappings */
 701                 tdb2_store_bystring(keystr, string_term_tdb_data(idstr),
 702                                     TDB_REPLACE);
 703                 tdb2_store_bystring(idstr, string_term_tdb_data(keystr),
 704                                     TDB_REPLACE);
 705                 goto done;
 706         }
 707
 708         /* What type of record is this ? */
 709         if (sscanf((const char *)data.dptr, "UID %lu", &rec_id) == 1) { /* Try a UID record. */
 710                 map->xid.id = rec_id;
 711                 map->xid.type = ID_TYPE_UID;
 712                 DEBUG(10,("Found uid record %s -> %s \n", keystr, (const char *)data.dptr ));
 713                 ret = NT_STATUS_OK;
 714
 715         } else if (sscanf((const char *)data.dptr, "GID %lu", &rec_id) == 1) { /* Try a GID record. */
 716                 map->xid.id = rec_id;
 717                 map->xid.type = ID_TYPE_GID;
 718                 DEBUG(10,("Found gid record %s -> %s \n", keystr, (const char *)data.dptr ));
 719                 ret = NT_STATUS_OK;
 720
 721         } else { /* Unknown record type ! */
 722                 DEBUG(2, ("Found INVALID record %s -> %s\n", keystr, (const char *)data.dptr));
 723                 ret = NT_STATUS_INTERNAL_DB_ERROR;
 724         }
 725
 726         /* apply filters before returning result */
 727         if ((ctx->filter_low_id && (map->xid.id < ctx->filter_low_id)) ||
 728             (ctx->filter_high_id && (map->xid.id > ctx->filter_high_id))) {
 729                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 730                                 map->xid.id, ctx->filter_low_id, ctx->filter_high_id));
 731                 ret = NT_STATUS_NONE_MAPPED;
 732         }
 733
 734 done:
 735         talloc_free(keystr);
 736         return ret;
 737 }
 738
 739 /*
 740   lookup a set of unix ids.
 741 */
 742 static NTSTATUS idmap_tdb2_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 743 {
 744         struct idmap_tdb2_context *ctx;
 745         NTSTATUS ret;
 746         int i;
 747
 748         /* make sure we initialized */
 749         if ( ! dom->initialized) {
 750                 ret = idmap_tdb2_db_init(dom);
 751                 if ( ! NT_STATUS_IS_OK(ret)) {
 752                         return ret;
 753                 }
 754         }
 755
 756         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 757
 758         for (i = 0; ids[i]; i++) {
 759                 ret = idmap_tdb2_id_to_sid(ctx, ids[i]);
 760                 if ( ! NT_STATUS_IS_OK(ret)) {
 761
 762                         /* if it is just a failed mapping continue */
 763                         if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 764
 765                                 /* make sure it is marked as unmapped */
 766                                 ids[i]->status = ID_UNMAPPED;
 767                                 continue;
 768                         }
 769
 770                         /* some fatal error occurred, return immediately */
 771                         goto done;
 772                 }
 773
 774                 /* all ok, id is mapped */
 775                 ids[i]->status = ID_MAPPED;
 776         }
 777
 778         ret = NT_STATUS_OK;
 779
 780 done:
 781         return ret;
 782 }
 783
 784 /*
 785   lookup a set of sids.
 786 */
 787 static NTSTATUS idmap_tdb2_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 788 {
 789         struct idmap_tdb2_context *ctx;
 790         NTSTATUS ret;
 791         int i;
 792
 793         /* make sure we initialized */
 794         if ( ! dom->initialized) {
 795                 ret = idmap_tdb2_db_init(dom);
 796                 if ( ! NT_STATUS_IS_OK(ret)) {
 797                         return ret;
 798                 }
 799         }
 800
 801         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 802
 803         for (i = 0; ids[i]; i++) {
 804                 ret = idmap_tdb2_sid_to_id(ctx, ids[i]);
 805                 if ( ! NT_STATUS_IS_OK(ret)) {
 806
 807                         /* if it is just a failed mapping continue */
 808                         if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 809
 810                                 /* make sure it is marked as unmapped */
 811                                 ids[i]->status = ID_UNMAPPED;
 812                                 continue;
 813                         }
 814
 815                         /* some fatal error occurred, return immediately */
 816                         goto done;
 817                 }
 818
 819                 /* all ok, id is mapped */
 820                 ids[i]->status = ID_MAPPED;
 821         }
 822
 823         ret = NT_STATUS_OK;
 824
 825 done:
 826         return ret;
 827 }
 828
 829
 830 /*
 831   set a mapping.
 832 */
 833 static NTSTATUS idmap_tdb2_set_mapping(struct idmap_domain *dom, const struct id_map *map)
 834 {
 835         struct idmap_tdb2_context *ctx;
 836         NTSTATUS ret;
 837         TDB_DATA data;
 838         char *ksidstr, *kidstr;
 839         struct db_record *update_lock = NULL;
 840         struct db_record *rec = NULL;
 841
 842         /* make sure we initialized */
 843         if ( ! dom->initialized) {
 844                 ret = idmap_tdb2_db_init(dom);
 845                 if ( ! NT_STATUS_IS_OK(ret)) {
 846                         return ret;
 847                 }
 848         }
 849
 850         if (!map || !map->sid) {
 851                 return NT_STATUS_INVALID_PARAMETER;
 852         }
 853
 854         ksidstr = kidstr = NULL;
 855         data.dptr = NULL;
 856
 857         /* TODO: should we filter a set_mapping using low/high filters ? */
 858
 859         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 860
 861         switch (map->xid.type) {
 862
 863         case ID_TYPE_UID:
 864                 kidstr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
 865                 break;
 866
 867         case ID_TYPE_GID:
 868                 kidstr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
 869                 break;
 870
 871         default:
 872                 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
 873                 return NT_STATUS_INVALID_PARAMETER;
 874         }
 875
 876         if (kidstr == NULL) {
 877                 DEBUG(0, ("ERROR: Out of memory!\n"));
 878                 ret = NT_STATUS_NO_MEMORY;
 879                 goto done;
 880         }
 881
 882         if (!(ksidstr = sid_string_talloc(ctx, map->sid))) {
 883                 DEBUG(0, ("Out of memory!\n"));
 884                 ret = NT_STATUS_NO_MEMORY;
 885                 goto done;
 886         }
 887
 888         DEBUG(10, ("Storing %s <-> %s map\n", ksidstr, kidstr));
 889
 890         /*
 891          * Get us the update lock. This is necessary to get the lock orders
 892          * right, we need to deal with two records under a lock.
 893          */
 894
 895         if (!(update_lock = idmap_tdb2_perm->fetch_locked(
 896                       idmap_tdb2_perm, ctx,
 897                       string_term_tdb_data("UPDATELOCK")))) {
 898                 DEBUG(10,("Failed to lock record %s\n", ksidstr));
 899                 ret = NT_STATUS_UNSUCCESSFUL;
 900                 goto done;
 901         }
 902
 903         /*
 904          * *DELETE* previous mappings if any. *
 905          */
 906
 907         /* First delete indexed on SID */
 908
 909         if (((rec = idmap_tdb2_perm->fetch_locked(
 910                      idmap_tdb2_perm, update_lock,
 911                      string_term_tdb_data(ksidstr))) != NULL)
 912             && (rec->value.dsize != 0)) {
 913                 struct db_record *rec2;
 914
 915                 if ((rec2 = idmap_tdb2_perm->fetch_locked(
 916                              idmap_tdb2_perm, update_lock, rec->value))
 917                     != NULL) {
 918                         rec2->delete_rec(rec2);
 919                         TALLOC_FREE(rec2);
 920                 }
 921
 922                 rec->delete_rec(rec);
 923
 924                 tdb_delete(idmap_tdb2_tmp, rec->key);
 925                 tdb_delete(idmap_tdb2_tmp, rec->value);
 926         }
 927         TALLOC_FREE(rec);
 928
 929         /* Now delete indexed on unix ID */
 930
 931         if (((rec = idmap_tdb2_perm->fetch_locked(
 932                      idmap_tdb2_perm, update_lock,
 933                      string_term_tdb_data(kidstr))) != NULL)
 934             && (rec->value.dsize != 0)) {
 935                 struct db_record *rec2;
 936
 937                 if ((rec2 = idmap_tdb2_perm->fetch_locked(
 938                              idmap_tdb2_perm, update_lock, rec->value))
 939                     != NULL) {
 940                         rec2->delete_rec(rec2);
 941                         TALLOC_FREE(rec2);
 942                 }
 943
 944                 rec->delete_rec(rec);
 945
 946                 tdb_delete(idmap_tdb2_tmp, rec->key);
 947                 tdb_delete(idmap_tdb2_tmp, rec->value);
 948         }
 949         TALLOC_FREE(rec);
 950
 951         if (!NT_STATUS_IS_OK(tdb2_store_bystring(ksidstr, string_term_tdb_data(kidstr),
 952                                 TDB_INSERT))) {
 953                 DEBUG(0, ("Error storing SID -> ID\n"));
 954                 ret = NT_STATUS_UNSUCCESSFUL;
 955                 goto done;
 956         }
 957         if (!NT_STATUS_IS_OK(tdb2_store_bystring(kidstr, string_term_tdb_data(ksidstr),
 958                                 TDB_INSERT))) {
 959                 DEBUG(0, ("Error storing ID -> SID\n"));
 960                 /* try to remove the previous stored SID -> ID map */
 961                 tdb2_delete_bystring(ksidstr);
 962                 ret = NT_STATUS_UNSUCCESSFUL;
 963                 goto done;
 964         }
 965
 966         DEBUG(10,("Stored %s <-> %s\n", ksidstr, kidstr));
 967         ret = NT_STATUS_OK;
 968
 969 done:
 970         talloc_free(ksidstr);
 971         talloc_free(kidstr);
 972         SAFE_FREE(data.dptr);
 973         TALLOC_FREE(update_lock);
 974         return ret;
 975 }
 976
 977 /*
 978   remove a mapping.
 979 */
 980 static NTSTATUS idmap_tdb2_remove_mapping(struct idmap_domain *dom, const struct id_map *map)
 981 {
 982         /* not supported as it would invalidate the cache tdb on other
 983            nodes */
 984         DEBUG(0,("idmap_tdb2_remove_mapping not supported\n"));
 985         return NT_STATUS_NOT_SUPPORTED;
 986 }
 987
 988 /*
 989   Close the idmap tdb instance
 990 */
 991 static NTSTATUS idmap_tdb2_close(struct idmap_domain *dom)
 992 {
 993         /* don't do anything */
 994         return NT_STATUS_OK;
 995 }
 996
 997
 998 /*
 999   Dump all mappings out
1000 */
1001 static NTSTATUS idmap_tdb2_dump_data(struct idmap_domain *dom, struct id_map **maps, int *num_maps)
1002 {
1003         DEBUG(0,("idmap_tdb2_dump_data not supported\n"));
1004         return NT_STATUS_NOT_SUPPORTED;
1005 }
1006
1007 static struct idmap_methods db_methods = {
1008         .init            = idmap_tdb2_db_init,
1009         .unixids_to_sids = idmap_tdb2_unixids_to_sids,
1010         .sids_to_unixids = idmap_tdb2_sids_to_unixids,
1011         .set_mapping     = idmap_tdb2_set_mapping,
1012         .remove_mapping  = idmap_tdb2_remove_mapping,
1013         .dump_data       = idmap_tdb2_dump_data,
1014         .close_fn        = idmap_tdb2_close
1015 };
1016
1017 static struct idmap_alloc_methods db_alloc_methods = {
1018         .init        = idmap_tdb2_alloc_init,
1019         .allocate_id = idmap_tdb2_allocate_id,
1020         .get_id_hwm  = idmap_tdb2_get_hwm,
1021         .set_id_hwm  = idmap_tdb2_set_hwm,
1022         .close_fn    = idmap_tdb2_alloc_close
1023 };
1024
1025 NTSTATUS idmap_tdb2_init(void)
1026 {
1027         NTSTATUS ret;
1028
1029         /* register both backends */
1030         ret = smb_register_idmap_alloc(SMB_IDMAP_INTERFACE_VERSION, "tdb2", &db_alloc_methods);
1031         if (! NT_STATUS_IS_OK(ret)) {
1032                 DEBUG(0, ("Unable to register idmap alloc tdb2 module: %s\n", get_friendly_nt_error_msg(ret)));
1033                 return ret;
1034         }
1035
1036         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "tdb2", &db_methods);
1037 }