2 Unix SMB/CIFS implementation.
5 Copyright (C) Volker Lendecke 2008
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
21 #include "idmap_cache.h"
22 #include "../libcli/security/security.h"
23 #include "../librpc/gen_ndr/idmap.h"
26 * Find a sid2xid mapping
27 * @param[in] sid the sid to map
28 * @param[out] id where to put the result
29 * @param[out] expired is the cache entry expired?
30 * @retval Was anything in the cache at all?
32 * If id->id == -1 this was a negative mapping.
35 bool idmap_cache_find_sid2unixid(const struct dom_sid
*sid
, struct unixid
*id
,
46 key
= talloc_asprintf(talloc_tos(), "IDMAP/SID2XID/%s",
47 sid_to_fstring(sidstr
, sid
));
51 ret
= gencache_get(key
, talloc_tos(), &value
, &timeout
);
56 DEBUG(10, ("Parsing value for key [%s]: value=[%s]\n", key
, value
));
58 if (value
[0] == '\0') {
59 DEBUG(0, ("Failed to parse value for key [%s]: "
60 "value is empty\n", key
));
65 tmp_id
.id
= strtol(value
, &endptr
, 10);
67 if ((value
== endptr
) && (tmp_id
.id
== 0)) {
68 DEBUG(0, ("Failed to parse value for key [%s]: value[%s] does "
69 "not start with a number\n", key
, value
));
74 DEBUG(10, ("Parsing value for key [%s]: id=[%llu], endptr=[%s]\n",
75 key
, (unsigned long long)tmp_id
.id
, endptr
));
77 ret
= (*endptr
== ':');
81 tmp_id
.type
= ID_TYPE_UID
;
85 tmp_id
.type
= ID_TYPE_GID
;
89 tmp_id
.type
= ID_TYPE_BOTH
;
93 tmp_id
.type
= ID_TYPE_NOT_SPECIFIED
;
97 DEBUG(0, ("FAILED to parse value for key [%s] "
98 "(id=[%llu], endptr=[%s]): "
99 "no type character after colon\n",
100 key
, (unsigned long long)tmp_id
.id
, endptr
));
104 DEBUG(0, ("FAILED to parse value for key [%s] "
105 "(id=[%llu], endptr=[%s]): "
106 "illegal type character '%c'\n",
107 key
, (unsigned long long)tmp_id
.id
, endptr
,
112 if (endptr
[2] != '\0') {
113 DEBUG(0, ("FAILED to parse value for key [%s] "
114 "(id=[%llu], endptr=[%s]): "
115 "more than 1 type character after colon\n",
116 key
, (unsigned long long)tmp_id
.id
, endptr
));
122 *expired
= (timeout
<= time(NULL
));
124 DEBUG(0, ("FAILED to parse value for key [%s] (value=[%s]): "
125 "colon missing after id=[%llu]\n",
126 key
, value
, (unsigned long long)tmp_id
.id
));
136 * Find a sid2uid mapping
137 * @param[in] sid the sid to map
138 * @param[out] puid where to put the result
139 * @param[out] expired is the cache entry expired?
140 * @retval Was anything in the cache at all?
142 * If *puid == -1 this was a negative mapping.
145 bool idmap_cache_find_sid2uid(const struct dom_sid
*sid
, uid_t
*puid
,
150 ret
= idmap_cache_find_sid2unixid(sid
, &id
, expired
);
155 if (id
.type
== ID_TYPE_BOTH
|| id
.type
== ID_TYPE_UID
) {
164 * Find a sid2gid mapping
165 * @param[in] sid the sid to map
166 * @param[out] pgid where to put the result
167 * @param[out] expired is the cache entry expired?
168 * @retval Was anything in the cache at all?
170 * If *pgid == -1 this was a negative mapping.
173 bool idmap_cache_find_sid2gid(const struct dom_sid
*sid
, gid_t
*pgid
,
178 ret
= idmap_cache_find_sid2unixid(sid
, &id
, expired
);
183 if (id
.type
== ID_TYPE_BOTH
|| id
.type
== ID_TYPE_GID
) {
192 * Find a uid2sid mapping
193 * @param[in] uid the uid to map
194 * @param[out] sid where to put the result
195 * @param[out] expired is the cache entry expired?
196 * @retval Was anything in the cache at all?
198 * If "is_null_sid(sid)", this was a negative mapping.
201 bool idmap_cache_find_uid2sid(uid_t uid
, struct dom_sid
*sid
, bool *expired
)
208 fstr_sprintf(key
, "IDMAP/UID2SID/%d", (int)uid
);
210 ret
= gencache_get(key
, talloc_tos(), &value
, &timeout
);
215 if (value
[0] != '-') {
216 ret
= string_to_sid(sid
, value
);
220 *expired
= (timeout
<= time(NULL
));
226 * Find a gid2sid mapping
227 * @param[in] gid the gid to map
228 * @param[out] sid where to put the result
229 * @param[out] expired is the cache entry expired?
230 * @retval Was anything in the cache at all?
232 * If "is_null_sid(sid)", this was a negative mapping.
235 bool idmap_cache_find_gid2sid(gid_t gid
, struct dom_sid
*sid
, bool *expired
)
242 fstr_sprintf(key
, "IDMAP/GID2SID/%d", (int)gid
);
244 ret
= gencache_get(key
, talloc_tos(), &value
, &timeout
);
249 if (value
[0] != '-') {
250 ret
= string_to_sid(sid
, value
);
254 *expired
= (timeout
<= time(NULL
));
260 * Store a mapping in the idmap cache
261 * @param[in] sid the sid to map
262 * @param[in] gid the gid to map
264 * If both parameters are valid values, then a positive mapping in both
265 * directions is stored. If "is_null_sid(sid)" is true, then this will be a
266 * negative mapping of gid, we want to cache that for this gid we could not
267 * find anything. Likewise if "gid==-1", then we want to cache that we did not
268 * find a mapping for the sid passed here.
271 void idmap_cache_set_sid2unixid(const struct dom_sid
*sid
, struct unixid
*unix_id
)
273 time_t now
= time(NULL
);
275 fstring sidstr
, key
, value
;
277 if (!is_null_sid(sid
)) {
278 fstr_sprintf(key
, "IDMAP/SID2XID/%s",
279 sid_to_fstring(sidstr
, sid
));
280 switch (unix_id
->type
) {
282 fstr_sprintf(value
, "%d:U", (int)unix_id
->id
);
285 fstr_sprintf(value
, "%d:G", (int)unix_id
->id
);
288 fstr_sprintf(value
, "%d:B", (int)unix_id
->id
);
290 case ID_TYPE_NOT_SPECIFIED
:
291 fstr_sprintf(value
, "%d:N", (int)unix_id
->id
);
296 timeout
= (unix_id
->id
== -1)
297 ? lp_idmap_negative_cache_time()
298 : lp_idmap_cache_time();
299 gencache_set(key
, value
, now
+ timeout
);
301 if (unix_id
->id
!= -1) {
302 if (is_null_sid(sid
)) {
303 /* negative gid mapping */
305 timeout
= lp_idmap_negative_cache_time();
308 sid_to_fstring(value
, sid
);
309 timeout
= lp_idmap_cache_time();
311 switch (unix_id
->type
) {
313 fstr_sprintf(key
, "IDMAP/UID2SID/%d", (int)unix_id
->id
);
314 gencache_set(key
, value
, now
+ timeout
);
315 fstr_sprintf(key
, "IDMAP/GID2SID/%d", (int)unix_id
->id
);
316 gencache_set(key
, value
, now
+ timeout
);
320 fstr_sprintf(key
, "IDMAP/UID2SID/%d", (int)unix_id
->id
);
324 fstr_sprintf(key
, "IDMAP/GID2SID/%d", (int)unix_id
->id
);
330 gencache_set(key
, value
, now
+ timeout
);
335 * Store a mapping in the idmap cache
336 * @param[in] sid the sid to map
337 * @param[in] uid the uid to map
339 * If both parameters are valid values, then a positive mapping in both
340 * directions is stored. If "is_null_sid(sid)" is true, then this will be a
341 * negative mapping of uid, we want to cache that for this uid we could not
342 * find anything. Likewise if "uid==-1", then we want to cache that we did not
343 * find a mapping for the sid passed here.
346 void idmap_cache_set_sid2uid(const struct dom_sid
*sid
, uid_t uid
)
349 id
.type
= ID_TYPE_UID
;
355 /* If we were asked to invalidate this SID -> UID
356 * mapping, it was because we found out that this was
357 * not a UID at all. Do not overwrite a valid GID or
359 if (idmap_cache_find_sid2gid(sid
, &tmp_gid
, &expired
)) {
366 idmap_cache_set_sid2unixid(sid
, &id
);
371 * Store a mapping in the idmap cache
372 * @param[in] sid the sid to map
373 * @param[in] gid the gid to map
375 * If both parameters are valid values, then a positive mapping in both
376 * directions is stored. If "is_null_sid(sid)" is true, then this will be a
377 * negative mapping of gid, we want to cache that for this gid we could not
378 * find anything. Likewise if "gid==-1", then we want to cache that we did not
379 * find a mapping for the sid passed here.
382 void idmap_cache_set_sid2gid(const struct dom_sid
*sid
, gid_t gid
)
385 id
.type
= ID_TYPE_GID
;
391 /* If we were asked to invalidate this SID -> GID
392 * mapping, it was because we found out that this was
393 * not a GID at all. Do not overwrite a valid UID or
395 if (idmap_cache_find_sid2uid(sid
, &tmp_uid
, &expired
)) {
402 idmap_cache_set_sid2unixid(sid
, &id
);
406 static char* key_xid2sid_str(TALLOC_CTX
* mem_ctx
, char t
, const char* id
) {
407 return talloc_asprintf(mem_ctx
, "IDMAP/%cID2SID/%s", t
, id
);
410 static char* key_xid2sid(TALLOC_CTX
* mem_ctx
, char t
, int id
) {
412 snprintf(str
, sizeof(str
), "%d", id
);
413 return key_xid2sid_str(mem_ctx
, t
, str
);
416 static char* key_sid2xid_str(TALLOC_CTX
* mem_ctx
, const char* id
) {
417 return talloc_asprintf(mem_ctx
, "IDMAP/SID2XID/%s", id
);
420 static bool idmap_cache_del_xid(char t
, int xid
)
422 TALLOC_CTX
* mem_ctx
= talloc_stackframe();
423 const char* key
= key_xid2sid(mem_ctx
, t
, xid
);
424 char* sid_str
= NULL
;
428 if (!gencache_get(key
, mem_ctx
, &sid_str
, &timeout
)) {
429 DEBUG(3, ("no entry: %s\n", key
));
434 if (sid_str
[0] != '-') {
435 const char* sid_key
= key_sid2xid_str(mem_ctx
, sid_str
);
436 if (!gencache_del(sid_key
)) {
437 DEBUG(2, ("failed to delete: %s\n", sid_key
));
440 DEBUG(5, ("delete: %s\n", sid_key
));
445 if (!gencache_del(key
)) {
446 DEBUG(1, ("failed to delete: %s\n", key
));
449 DEBUG(5, ("delete: %s\n", key
));
453 talloc_free(mem_ctx
);
457 bool idmap_cache_del_uid(uid_t uid
) {
458 return idmap_cache_del_xid('U', uid
);
461 bool idmap_cache_del_gid(gid_t gid
) {
462 return idmap_cache_del_xid('G', gid
);
465 bool idmap_cache_del_sid(const struct dom_sid
*sid
)
467 TALLOC_CTX
* mem_ctx
= talloc_stackframe();
473 if (!idmap_cache_find_sid2unixid(sid
, &id
, &expired
)) {
481 idmap_cache_del_xid('U', id
.id
);
482 idmap_cache_del_xid('G', id
.id
);
485 idmap_cache_del_xid('U', id
.id
);
488 idmap_cache_del_xid('G', id
.id
);
495 sid_key
= key_sid2xid_str(mem_ctx
, dom_sid_string(mem_ctx
, sid
));
496 if (sid_key
== NULL
) {
499 /* If the mapping was symmetric, then this should fail */
500 gencache_del(sid_key
);
502 talloc_free(mem_ctx
);