source/winbindd/idmap_rid.c

   1 /*
   2  *  idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
   3  *  Copyright (C) Guenther Deschner, 2004
   4  *  Copyright (C) Sumit Bose, 2004
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "includes.h"
  22 #include "winbindd.h"
  23
  24 #undef DBGC_CLASS
  25 #define DBGC_CLASS DBGC_IDMAP
  26
  27 struct idmap_rid_context {
  28         const char *domain_name;
  29         uint32_t low_id;
  30         uint32_t high_id;
  31         uint32_t base_rid;
  32 };
  33
  34 /******************************************************************************
  35   compat params can't be used because of the completely different way
  36   we support multiple domains in the new idmap
  37  *****************************************************************************/
  38
  39 static NTSTATUS idmap_rid_initialize(struct idmap_domain *dom)
  40 {
  41         NTSTATUS ret;
  42         struct idmap_rid_context *ctx;
  43         char *config_option = NULL;
  44         const char *range;
  45         uid_t low_uid = 0;
  46         uid_t high_uid = 0;
  47         gid_t low_gid = 0;
  48         gid_t high_gid = 0;
  49
  50         if ( (ctx = TALLOC_ZERO_P(dom, struct idmap_rid_context)) == NULL ) {
  51                 DEBUG(0, ("Out of memory!\n"));
  52                 return NT_STATUS_NO_MEMORY;
  53         }
  54
  55         config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
  56         if ( ! config_option) {
  57                 DEBUG(0, ("Out of memory!\n"));
  58                 ret = NT_STATUS_NO_MEMORY;
  59                 goto failed;
  60         }
  61
  62         range = lp_parm_const_string(-1, config_option, "range", NULL);
  63         if ( !range ||
  64             (sscanf(range, "%u - %u", &ctx->low_id, &ctx->high_id) != 2) ||
  65             (ctx->low_id > ctx->high_id))
  66         {
  67                 ctx->low_id = 0;
  68                 ctx->high_id = 0;
  69         }
  70
  71         /* lets see if the range is defined by the old idmap uid/idmap gid */
  72         if (!ctx->low_id && !ctx->high_id) {
  73                 if (lp_idmap_uid(&low_uid, &high_uid)) {
  74                         ctx->low_id = low_uid;
  75                         ctx->high_id = high_uid;
  76                 }
  77
  78                 if (lp_idmap_gid(&low_gid, &high_gid)) {
  79                         if ((ctx->low_id != low_gid) ||
  80                             (ctx->high_id != high_uid)) {
  81                                 DEBUG(1, ("ERROR: idmap uid range must match idmap gid range\n"));
  82                                 ret = NT_STATUS_UNSUCCESSFUL;
  83                                 goto failed;
  84                         }
  85                 }
  86         }
  87
  88         if (!ctx->low_id || !ctx->high_id) {
  89                 DEBUG(1, ("ERROR: Invalid configuration, ID range missing or invalid\n"));
  90                 ret = NT_STATUS_UNSUCCESSFUL;
  91                 goto failed;
  92         }
  93
  94         ctx->base_rid = lp_parm_int(-1, config_option, "base_rid", 0);
  95         ctx->domain_name = talloc_strdup( ctx, dom->name );
  96
  97         dom->private_data = ctx;
  98         dom->initialized = True;
  99
 100         talloc_free(config_option);
 101         return NT_STATUS_OK;
 102
 103 failed:
 104         talloc_free(ctx);
 105         return ret;
 106 }
 107
 108 static NTSTATUS idmap_rid_id_to_sid(TALLOC_CTX *memctx, struct idmap_rid_context *ctx, struct id_map *map)
 109 {
 110         struct winbindd_domain *domain;
 111
 112         /* apply filters before checking */
 113         if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) {
 114                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 115                                 map->xid.id, ctx->low_id, ctx->high_id));
 116                 return NT_STATUS_NONE_MAPPED;
 117         }
 118
 119         if ( (domain = find_domain_from_name_noinit(ctx->domain_name)) == NULL ) {
 120                 return NT_STATUS_NO_SUCH_DOMAIN;
 121         }
 122
 123         sid_compose(map->sid, &domain->sid, map->xid.id - ctx->low_id + ctx->base_rid);
 124
 125         /* We **really** should have some way of validating
 126            the SID exists and is the correct type here.  But
 127            that is a deficiency in the idmap_rid design. */
 128
 129         map->status = ID_MAPPED;
 130
 131         return NT_STATUS_OK;
 132 }
 133
 134 /**********************************
 135  Single sid to id lookup function.
 136 **********************************/
 137
 138 static NTSTATUS idmap_rid_sid_to_id(TALLOC_CTX *memctx, struct idmap_rid_context *ctx, struct id_map *map)
 139 {
 140         uint32_t rid;
 141
 142         sid_peek_rid(map->sid, &rid);
 143         map->xid.id = rid - ctx->base_rid + ctx->low_id;
 144
 145         /* apply filters before returning result */
 146
 147         if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) {
 148                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 149                                 map->xid.id, ctx->low_id, ctx->high_id));
 150                 map->status = ID_UNMAPPED;
 151                 return NT_STATUS_NONE_MAPPED;
 152         }
 153
 154         /* We **really** should have some way of validating
 155            the SID exists and is the correct type here.  But
 156            that is a deficiency in the idmap_rid design. */
 157
 158         map->status = ID_MAPPED;
 159
 160         return NT_STATUS_OK;
 161 }
 162
 163 /**********************************
 164  lookup a set of unix ids.
 165 **********************************/
 166
 167 static NTSTATUS idmap_rid_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 168 {
 169         struct idmap_rid_context *ridctx;
 170         TALLOC_CTX *ctx;
 171         NTSTATUS ret;
 172         int i;
 173
 174         /* Initilization my have been deferred because of an error, retry or fail */
 175         if ( ! dom->initialized) {
 176                 ret = idmap_rid_initialize(dom);
 177                 if ( ! NT_STATUS_IS_OK(ret)) {
 178                         return ret;
 179                 }
 180         }
 181
 182         ridctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
 183
 184         ctx = talloc_new(dom);
 185         if ( ! ctx) {
 186                 DEBUG(0, ("Out of memory!\n"));
 187                 return NT_STATUS_NO_MEMORY;
 188         }
 189
 190         for (i = 0; ids[i]; i++) {
 191
 192                 ret = idmap_rid_id_to_sid(ctx, ridctx, ids[i]);
 193
 194                 if (( ! NT_STATUS_IS_OK(ret)) &&
 195                     ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 196                         /* some fatal error occurred, log it */
 197                         DEBUG(3, ("Unexpected error resolving an ID (%d)\n", ids[i]->xid.id));
 198                 }
 199         }
 200
 201         talloc_free(ctx);
 202         return NT_STATUS_OK;
 203 }
 204
 205 /**********************************
 206  lookup a set of sids.
 207 **********************************/
 208
 209 static NTSTATUS idmap_rid_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 210 {
 211         struct idmap_rid_context *ridctx;
 212         TALLOC_CTX *ctx;
 213         NTSTATUS ret;
 214         int i;
 215
 216         /* Initilization my have been deferred because of an error, retry or fail */
 217         if ( ! dom->initialized) {
 218                 ret = idmap_rid_initialize(dom);
 219                 if ( ! NT_STATUS_IS_OK(ret)) {
 220                         return ret;
 221                 }
 222         }
 223
 224         ridctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
 225
 226         ctx = talloc_new(dom);
 227         if ( ! ctx) {
 228                 DEBUG(0, ("Out of memory!\n"));
 229                 return NT_STATUS_NO_MEMORY;
 230         }
 231
 232         for (i = 0; ids[i]; i++) {
 233
 234                 ret = idmap_rid_sid_to_id(ctx, ridctx, ids[i]);
 235
 236                 if (( ! NT_STATUS_IS_OK(ret)) &&
 237                     ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 238                         /* some fatal error occurred, log it */
 239                         DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
 240                                   sid_string_dbg(ids[i]->sid)));
 241                 }
 242         }
 243
 244         talloc_free(ctx);
 245         return NT_STATUS_OK;
 246 }
 247
 248 static NTSTATUS idmap_rid_close(struct idmap_domain *dom)
 249 {
 250         if (dom->private_data) {
 251                 TALLOC_FREE(dom->private_data);
 252         }
 253         return NT_STATUS_OK;
 254 }
 255
 256 static struct idmap_methods rid_methods = {
 257         .init = idmap_rid_initialize,
 258         .unixids_to_sids = idmap_rid_unixids_to_sids,
 259         .sids_to_unixids = idmap_rid_sids_to_unixids,
 260         .close_fn = idmap_rid_close
 261 };
 262
 263 NTSTATUS idmap_rid_init(void)
 264 {
 265         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "rid", &rid_methods);
 266 }
 267