winbind: Avoid a few talloc_tos() in winbindd_cache.c
[Samba.git] / source3 / winbindd / idmap_tdb2.c
blob1abc938064202dc052e90ec723325b7be0eb8b59
1 /*
2 Unix SMB/CIFS implementation.
4 idmap TDB2 backend, used for clustered Samba setups.
6 This uses dbwrap to access tdb files. The location can be set
7 using tdb:idmap2.tdb =" in smb.conf
9 Copyright (C) Andrew Tridgell 2007
11 This is heavily based upon idmap_tdb.c, which is:
13 Copyright (C) Tim Potter 2000
14 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
15 Copyright (C) Jeremy Allison 2006
16 Copyright (C) Simo Sorce 2003-2006
17 Copyright (C) Michael Adam 2009-2010
19 This program is free software; you can redistribute it and/or modify
20 it under the terms of the GNU General Public License as published by
21 the Free Software Foundation; either version 2 of the License, or
22 (at your option) any later version.
24 This program is distributed in the hope that it will be useful,
25 but WITHOUT ANY WARRANTY; without even the implied warranty of
26 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27 GNU General Public License for more details.
29 You should have received a copy of the GNU General Public License
30 along with this program; if not, write to the Free Software
31 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
34 #include "includes.h"
35 #include "system/filesys.h"
36 #include "winbindd.h"
37 #include "idmap.h"
38 #include "idmap_rw.h"
39 #include "dbwrap/dbwrap.h"
40 #include "dbwrap/dbwrap_open.h"
41 #include "../libcli/security/dom_sid.h"
42 #include "util_tdb.h"
43 #include "idmap_tdb_common.h"
45 #undef DBGC_CLASS
46 #define DBGC_CLASS DBGC_IDMAP
48 struct idmap_tdb2_context {
49 const char *script; /* script to provide idmaps */
52 /* High water mark keys */
53 #define HWM_GROUP "GROUP HWM"
54 #define HWM_USER "USER HWM"
57 * check and initialize high/low water marks in the db
59 static NTSTATUS idmap_tdb2_init_hwm(struct idmap_domain *dom)
61 NTSTATUS status;
62 uint32 low_id;
63 struct idmap_tdb_common_context *ctx;
65 ctx = talloc_get_type(dom->private_data,
66 struct idmap_tdb_common_context);
68 /* Create high water marks for group and user id */
70 status = dbwrap_fetch_uint32_bystring(ctx->db, HWM_USER, &low_id);
71 if (!NT_STATUS_IS_OK(status) || (low_id < dom->low_id)) {
72 status = dbwrap_trans_store_uint32_bystring(ctx->db, HWM_USER,
73 dom->low_id);
74 if (!NT_STATUS_IS_OK(status)) {
75 DEBUG(0, ("Unable to initialise user hwm in idmap "
76 "database: %s\n", nt_errstr(status)));
77 return NT_STATUS_INTERNAL_DB_ERROR;
81 status = dbwrap_fetch_uint32_bystring(ctx->db, HWM_GROUP, &low_id);
82 if (!NT_STATUS_IS_OK(status) || (low_id < dom->low_id)) {
83 status = dbwrap_trans_store_uint32_bystring(ctx->db, HWM_GROUP,
84 dom->low_id);
85 if (!NT_STATUS_IS_OK(status)) {
86 DEBUG(0, ("Unable to initialise group hwm in idmap "
87 "database: %s\n", nt_errstr(status)));
88 return NT_STATUS_INTERNAL_DB_ERROR;
92 return NT_STATUS_OK;
97 open the permanent tdb
99 static NTSTATUS idmap_tdb2_open_db(struct idmap_domain *dom)
101 char *db_path;
102 struct idmap_tdb_common_context *ctx;
104 ctx = talloc_get_type(dom->private_data,
105 struct idmap_tdb_common_context);
107 if (ctx->db) {
108 /* its already open */
109 return NT_STATUS_OK;
112 db_path = talloc_asprintf(NULL, "%s/idmap2.tdb", lp_private_dir());
113 NT_STATUS_HAVE_NO_MEMORY(db_path);
115 /* Open idmap repository */
116 ctx->db = db_open(ctx, db_path, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644,
117 DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
118 TALLOC_FREE(db_path);
120 if (ctx->db == NULL) {
121 DEBUG(0, ("Unable to open idmap_tdb2 database '%s'\n",
122 db_path));
123 return NT_STATUS_UNSUCCESSFUL;
126 return idmap_tdb2_init_hwm(dom);
130 * store a mapping in the database.
133 struct idmap_tdb2_set_mapping_context {
134 const char *ksidstr;
135 const char *kidstr;
138 static NTSTATUS idmap_tdb2_set_mapping_action(struct db_context *db,
139 void *private_data)
141 TDB_DATA data;
142 NTSTATUS ret;
143 struct idmap_tdb2_set_mapping_context *state;
144 TALLOC_CTX *tmp_ctx = talloc_stackframe();
146 state = (struct idmap_tdb2_set_mapping_context *)private_data;
148 DEBUG(10, ("Storing %s <-> %s map\n", state->ksidstr, state->kidstr));
150 /* check wheter sid mapping is already present in db */
151 ret = dbwrap_fetch_bystring(db, tmp_ctx, state->ksidstr, &data);
152 if (NT_STATUS_IS_OK(ret)) {
153 ret = NT_STATUS_OBJECT_NAME_COLLISION;
154 goto done;
157 ret = dbwrap_store_bystring(db, state->ksidstr,
158 string_term_tdb_data(state->kidstr),
159 TDB_INSERT);
160 if (!NT_STATUS_IS_OK(ret)) {
161 DEBUG(0, ("Error storing SID -> ID: %s\n", nt_errstr(ret)));
162 goto done;
165 ret = dbwrap_store_bystring(db, state->kidstr,
166 string_term_tdb_data(state->ksidstr),
167 TDB_INSERT);
168 if (!NT_STATUS_IS_OK(ret)) {
169 DEBUG(0, ("Error storing ID -> SID: %s\n", nt_errstr(ret)));
170 /* try to remove the previous stored SID -> ID map */
171 dbwrap_delete_bystring(db, state->ksidstr);
172 goto done;
175 DEBUG(10,("Stored %s <-> %s\n", state->ksidstr, state->kidstr));
177 done:
178 talloc_free(tmp_ctx);
179 return ret;
182 static NTSTATUS idmap_tdb2_set_mapping(struct idmap_domain *dom, const struct id_map *map)
184 struct idmap_tdb2_context *ctx;
185 NTSTATUS ret;
186 char *ksidstr, *kidstr;
187 struct idmap_tdb_common_context *commonctx;
188 struct idmap_tdb2_set_mapping_context state;
190 if (!map || !map->sid) {
191 return NT_STATUS_INVALID_PARAMETER;
194 ksidstr = kidstr = NULL;
196 /* TODO: should we filter a set_mapping using low/high filters ? */
198 commonctx = talloc_get_type(dom->private_data,
199 struct idmap_tdb_common_context);
201 ctx = talloc_get_type(commonctx->private_data,
202 struct idmap_tdb2_context);
204 switch (map->xid.type) {
206 case ID_TYPE_UID:
207 kidstr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
208 break;
210 case ID_TYPE_GID:
211 kidstr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
212 break;
214 default:
215 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
216 return NT_STATUS_INVALID_PARAMETER;
219 if (kidstr == NULL) {
220 DEBUG(0, ("ERROR: Out of memory!\n"));
221 ret = NT_STATUS_NO_MEMORY;
222 goto done;
225 ksidstr = sid_string_talloc(ctx, map->sid);
226 if (ksidstr == NULL) {
227 DEBUG(0, ("Out of memory!\n"));
228 ret = NT_STATUS_NO_MEMORY;
229 goto done;
232 state.ksidstr = ksidstr;
233 state.kidstr = kidstr;
235 ret = dbwrap_trans_do(commonctx->db, idmap_tdb2_set_mapping_action,
236 &state);
238 done:
239 talloc_free(ksidstr);
240 talloc_free(kidstr);
241 return ret;
245 run a script to perform a mapping
247 The script should the following command lines:
249 SIDTOID S-1-xxxx
250 IDTOSID UID xxxx
251 IDTOSID GID xxxx
253 and should return one of the following as a single line of text
254 UID:xxxx
255 GID:xxxx
256 SID:xxxx
257 ERR:xxxx
259 static NTSTATUS idmap_tdb2_script(struct idmap_tdb2_context *ctx, struct id_map *map,
260 const char *fmt, ...)
262 va_list ap;
263 char *cmd;
264 FILE *p;
265 char line[64];
266 unsigned long v;
268 cmd = talloc_asprintf(ctx, "%s ", ctx->script);
269 NT_STATUS_HAVE_NO_MEMORY(cmd);
271 va_start(ap, fmt);
272 cmd = talloc_vasprintf_append(cmd, fmt, ap);
273 va_end(ap);
274 NT_STATUS_HAVE_NO_MEMORY(cmd);
276 p = popen(cmd, "r");
277 talloc_free(cmd);
278 if (p == NULL) {
279 return NT_STATUS_NONE_MAPPED;
282 if (fgets(line, sizeof(line)-1, p) == NULL) {
283 pclose(p);
284 return NT_STATUS_NONE_MAPPED;
286 pclose(p);
288 DEBUG(10,("idmap script gave: %s\n", line));
290 if (sscanf(line, "UID:%lu", &v) == 1) {
291 map->xid.id = v;
292 map->xid.type = ID_TYPE_UID;
293 } else if (sscanf(line, "GID:%lu", &v) == 1) {
294 map->xid.id = v;
295 map->xid.type = ID_TYPE_GID;
296 } else if (strncmp(line, "SID:S-", 6) == 0) {
297 if (!string_to_sid(map->sid, &line[4])) {
298 DEBUG(0,("Bad SID in '%s' from idmap script %s\n",
299 line, ctx->script));
300 return NT_STATUS_NONE_MAPPED;
302 } else {
303 DEBUG(0,("Bad reply '%s' from idmap script %s\n",
304 line, ctx->script));
305 return NT_STATUS_NONE_MAPPED;
308 return NT_STATUS_OK;
314 Single id to sid lookup function.
316 static NTSTATUS idmap_tdb2_id_to_sid(struct idmap_domain *dom, struct id_map *map)
318 NTSTATUS ret;
319 TDB_DATA data;
320 char *keystr;
321 NTSTATUS status;
322 struct idmap_tdb_common_context *commonctx;
323 struct idmap_tdb2_context *ctx;
326 if (!dom || !map) {
327 return NT_STATUS_INVALID_PARAMETER;
330 status = idmap_tdb2_open_db(dom);
331 NT_STATUS_NOT_OK_RETURN(status);
333 commonctx = talloc_get_type(dom->private_data,
334 struct idmap_tdb_common_context);
336 ctx = talloc_get_type(commonctx->private_data,
337 struct idmap_tdb2_context);
339 /* apply filters before checking */
340 if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
341 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
342 map->xid.id, dom->low_id, dom->high_id));
343 return NT_STATUS_NONE_MAPPED;
346 switch (map->xid.type) {
348 case ID_TYPE_UID:
349 keystr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
350 break;
352 case ID_TYPE_GID:
353 keystr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
354 break;
356 default:
357 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
358 return NT_STATUS_INVALID_PARAMETER;
361 if (keystr == NULL) {
362 DEBUG(0, ("Out of memory!\n"));
363 ret = NT_STATUS_NO_MEMORY;
364 goto done;
367 DEBUG(10,("Fetching record %s\n", keystr));
369 /* Check if the mapping exists */
370 status = dbwrap_fetch_bystring(commonctx->db, keystr, keystr, &data);
372 if (!NT_STATUS_IS_OK(status)) {
373 char *sidstr;
374 struct idmap_tdb2_set_mapping_context store_state;
376 DEBUG(10,("Record %s not found\n", keystr));
377 if (ctx->script == NULL) {
378 ret = NT_STATUS_NONE_MAPPED;
379 goto done;
382 ret = idmap_tdb2_script(ctx, map, "IDTOSID %s", keystr);
383 if (!NT_STATUS_IS_OK(ret)) {
384 goto done;
387 sidstr = sid_string_talloc(keystr, map->sid);
388 if (!sidstr) {
389 ret = NT_STATUS_NO_MEMORY;
390 goto done;
393 store_state.ksidstr = sidstr;
394 store_state.kidstr = keystr;
396 ret = dbwrap_trans_do(commonctx->db,
397 idmap_tdb2_set_mapping_action,
398 &store_state);
399 goto done;
402 if (!string_to_sid(map->sid, (const char *)data.dptr)) {
403 DEBUG(10,("INVALID SID (%s) in record %s\n",
404 (const char *)data.dptr, keystr));
405 ret = NT_STATUS_INTERNAL_DB_ERROR;
406 goto done;
409 DEBUG(10,("Found record %s -> %s\n", keystr, (const char *)data.dptr));
410 ret = NT_STATUS_OK;
412 done:
413 talloc_free(keystr);
414 return ret;
419 Single sid to id lookup function.
421 static NTSTATUS idmap_tdb2_sid_to_id(struct idmap_domain *dom, struct id_map *map)
423 NTSTATUS ret;
424 TDB_DATA data;
425 char *keystr;
426 unsigned long rec_id = 0;
427 struct idmap_tdb_common_context *commonctx;
428 struct idmap_tdb2_context *ctx;
429 TALLOC_CTX *tmp_ctx = talloc_stackframe();
431 ret = idmap_tdb2_open_db(dom);
432 NT_STATUS_NOT_OK_RETURN(ret);
434 commonctx = talloc_get_type(dom->private_data,
435 struct idmap_tdb_common_context);
437 ctx = talloc_get_type(commonctx->private_data,
438 struct idmap_tdb2_context);
440 keystr = sid_string_talloc(tmp_ctx, map->sid);
441 if (keystr == NULL) {
442 DEBUG(0, ("Out of memory!\n"));
443 ret = NT_STATUS_NO_MEMORY;
444 goto done;
447 DEBUG(10,("Fetching record %s\n", keystr));
449 /* Check if sid is present in database */
450 ret = dbwrap_fetch_bystring(commonctx->db, tmp_ctx, keystr, &data);
451 if (!NT_STATUS_IS_OK(ret)) {
452 char *idstr;
453 struct idmap_tdb2_set_mapping_context store_state;
455 DEBUG(10,(__location__ " Record %s not found\n", keystr));
457 if (ctx->script == NULL) {
458 ret = NT_STATUS_NONE_MAPPED;
459 goto done;
462 ret = idmap_tdb2_script(ctx, map, "SIDTOID %s", keystr);
463 if (!NT_STATUS_IS_OK(ret)) {
464 goto done;
467 /* apply filters before returning result */
468 if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
469 DEBUG(5, ("Script returned id (%u) out of range "
470 "(%u - %u). Filtered!\n",
471 map->xid.id, dom->low_id, dom->high_id));
472 ret = NT_STATUS_NONE_MAPPED;
473 goto done;
476 idstr = talloc_asprintf(tmp_ctx, "%cID %lu",
477 map->xid.type == ID_TYPE_UID?'U':'G',
478 (unsigned long)map->xid.id);
479 if (idstr == NULL) {
480 ret = NT_STATUS_NO_MEMORY;
481 goto done;
484 store_state.ksidstr = keystr;
485 store_state.kidstr = idstr;
487 ret = dbwrap_trans_do(commonctx->db,
488 idmap_tdb2_set_mapping_action,
489 &store_state);
490 goto done;
493 /* What type of record is this ? */
494 if (sscanf((const char *)data.dptr, "UID %lu", &rec_id) == 1) { /* Try a UID record. */
495 map->xid.id = rec_id;
496 map->xid.type = ID_TYPE_UID;
497 DEBUG(10,("Found uid record %s -> %s \n", keystr, (const char *)data.dptr ));
498 ret = NT_STATUS_OK;
500 } else if (sscanf((const char *)data.dptr, "GID %lu", &rec_id) == 1) { /* Try a GID record. */
501 map->xid.id = rec_id;
502 map->xid.type = ID_TYPE_GID;
503 DEBUG(10,("Found gid record %s -> %s \n", keystr, (const char *)data.dptr ));
504 ret = NT_STATUS_OK;
506 } else { /* Unknown record type ! */
507 DEBUG(2, ("Found INVALID record %s -> %s\n", keystr, (const char *)data.dptr));
508 ret = NT_STATUS_INTERNAL_DB_ERROR;
509 goto done;
512 /* apply filters before returning result */
513 if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
514 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
515 map->xid.id, dom->low_id, dom->high_id));
516 ret = NT_STATUS_NONE_MAPPED;
519 done:
520 talloc_free(tmp_ctx);
521 return ret;
525 Initialise idmap database.
527 static NTSTATUS idmap_tdb2_db_init(struct idmap_domain *dom)
529 NTSTATUS ret;
530 struct idmap_tdb_common_context *commonctx;
531 struct idmap_tdb2_context *ctx;
532 char *config_option = NULL;
533 const char * idmap_script = NULL;
535 commonctx = talloc_zero(dom, struct idmap_tdb_common_context);
536 if(!commonctx) {
537 DEBUG(0, ("Out of memory!\n"));
538 return NT_STATUS_NO_MEMORY;
541 commonctx->rw_ops = talloc_zero(commonctx, struct idmap_rw_ops);
542 if (commonctx->rw_ops == NULL) {
543 DEBUG(0, ("Out of memory!\n"));
544 ret = NT_STATUS_NO_MEMORY;
545 goto failed;
548 ctx = talloc_zero(commonctx, struct idmap_tdb2_context);
549 if (!ctx) {
550 DEBUG(0, ("Out of memory!\n"));
551 ret = NT_STATUS_NO_MEMORY;
552 goto failed;
555 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
556 if (config_option == NULL) {
557 DEBUG(0, ("Out of memory!\n"));
558 ret = NT_STATUS_NO_MEMORY;
559 goto failed;
561 ctx->script = lp_parm_const_string(-1, config_option, "script", NULL);
562 talloc_free(config_option);
564 idmap_script = lp_parm_const_string(-1, "idmap", "script", NULL);
565 if (idmap_script != NULL) {
566 DEBUG(0, ("Warning: 'idmap:script' is deprecated. "
567 " Please use 'idmap config * : script' instead!\n"));
570 if (strequal(dom->name, "*") && ctx->script == NULL) {
571 /* fall back to idmap:script for backwards compatibility */
572 ctx->script = idmap_script;
575 if (ctx->script) {
576 DEBUG(1, ("using idmap script '%s'\n", ctx->script));
579 commonctx->max_id = dom->high_id;
580 commonctx->hwmkey_uid = HWM_USER;
581 commonctx->hwmkey_gid = HWM_GROUP;
583 commonctx->sid_to_unixid_fn = idmap_tdb2_sid_to_id;
584 commonctx->unixid_to_sid_fn = idmap_tdb2_id_to_sid;
586 commonctx->rw_ops->get_new_id = idmap_tdb_common_get_new_id;
587 commonctx->rw_ops->set_mapping = idmap_tdb2_set_mapping;
589 commonctx->private_data = ctx;
590 dom->private_data = commonctx;
592 ret = idmap_tdb2_open_db(dom);
593 if (!NT_STATUS_IS_OK(ret)) {
594 goto failed;
597 return NT_STATUS_OK;
599 failed:
600 talloc_free(commonctx);
601 return ret;
605 static struct idmap_methods db_methods = {
606 .init = idmap_tdb2_db_init,
607 .unixids_to_sids = idmap_tdb_common_unixids_to_sids,
608 .sids_to_unixids = idmap_tdb_common_sids_to_unixids,
609 .allocate_id = idmap_tdb_common_get_new_id
612 NTSTATUS idmap_tdb2_init(void)
614 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "tdb2", &db_methods);