2 Unix SMB/CIFS implementation.
4 common functions for TDB based idmapping backends
6 Copyright (C) Christian Ambach 2012
8 These functions were initially copied over from idmap_tdb.c and idmap_tdb2.c
11 Copyright (C) Tim Potter 2000
12 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
13 Copyright (C) Jeremy Allison 2006
14 Copyright (C) Simo Sorce 2003-2006
15 Copyright (C) Michael Adam 2009-2010
16 Copyright (C) Andrew Tridgell 2007
18 This program is free software; you can redistribute it and/or modify
19 it under the terms of the GNU General Public License as published by
20 the Free Software Foundation; either version 2 of the License, or
21 (at your option) any later version.
23 This program is distributed in the hope that it will be useful,
24 but WITHOUT ANY WARRANTY; without even the implied warranty of
25 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 GNU General Public License for more details.
28 You should have received a copy of the GNU General Public License
29 along with this program; if not, write to the Free Software
30 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
34 #include "idmap_tdb_common.h"
35 #include "dbwrap/dbwrap.h"
38 #include "../libcli/security/dom_sid.h"
41 #define DBGC_CLASS DBGC_IDMAP
43 struct idmap_tdb_common_allocate_id_context
{
50 static NTSTATUS
idmap_tdb_common_allocate_id_action(struct db_context
*db
,
54 struct idmap_tdb_common_allocate_id_context
*state
;
57 state
= (struct idmap_tdb_common_allocate_id_context
*)private_data
;
59 ret
= dbwrap_fetch_uint32_bystring(db
, state
->hwmkey
, &hwm
);
60 if (!NT_STATUS_IS_OK(ret
)) {
61 ret
= NT_STATUS_INTERNAL_DB_ERROR
;
65 /* check it is in the range */
66 if (hwm
> state
->high_hwm
) {
67 DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
68 state
->hwmtype
, (unsigned long)state
->high_hwm
));
69 ret
= NT_STATUS_UNSUCCESSFUL
;
73 /* fetch a new id and increment it */
74 ret
= dbwrap_change_uint32_atomic_bystring(db
, state
->hwmkey
, &hwm
, 1);
75 if (!NT_STATUS_IS_OK(ret
)) {
76 DEBUG(1, ("Fatal error while fetching a new %s value\n!",
81 /* recheck it is in the range */
82 if (hwm
> state
->high_hwm
) {
83 DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
84 state
->hwmtype
, (unsigned long)state
->high_hwm
));
85 ret
= NT_STATUS_UNSUCCESSFUL
;
96 static NTSTATUS
idmap_tdb_common_allocate_id(struct idmap_domain
*dom
,
103 struct idmap_tdb_common_allocate_id_context state
;
104 struct idmap_tdb_common_context
*ctx
;
107 talloc_get_type_abort(dom
->private_data
,
108 struct idmap_tdb_common_context
);
110 /* Get current high water mark */
114 hwmkey
= ctx
->hwmkey_uid
;
119 hwmkey
= ctx
->hwmkey_gid
;
124 DEBUG(2, ("Invalid ID type (0x%x)\n", xid
->type
));
125 return NT_STATUS_INVALID_PARAMETER
;
129 state
.high_hwm
= ctx
->max_id
;
130 state
.hwmtype
= hwmtype
;
131 state
.hwmkey
= hwmkey
;
133 status
= dbwrap_trans_do(ctx
->db
, idmap_tdb_common_allocate_id_action
,
136 if (NT_STATUS_IS_OK(status
)) {
138 DEBUG(10, ("New %s = %d\n", hwmtype
, state
.hwm
));
140 DEBUG(1, ("Error allocating a new %s\n", hwmtype
));
147 * Allocate a new unix-ID.
148 * For now this is for the default idmap domain only.
149 * Should be extended later on.
151 NTSTATUS
idmap_tdb_common_get_new_id(struct idmap_domain
* dom
,
156 if (!strequal(dom
->name
, "*")) {
157 DEBUG(3, ("idmap_tdb_common_get_new_id: "
158 "Refusing allocation of a new unixid for domain'%s'. "
159 "Currently only supported for the default "
160 "domain \"*\".\n", dom
->name
));
161 return NT_STATUS_NOT_IMPLEMENTED
;
164 ret
= idmap_tdb_common_allocate_id(dom
, id
);
170 * store a mapping in the database.
173 struct idmap_tdb_common_set_mapping_context
{
178 static NTSTATUS
idmap_tdb_common_set_mapping_action(struct db_context
*db
,
183 struct idmap_tdb_common_set_mapping_context
*state
;
184 TALLOC_CTX
*tmp_ctx
= talloc_stackframe();
186 state
= (struct idmap_tdb_common_set_mapping_context
*)private_data
;
188 DEBUG(10, ("Storing %s <-> %s map\n", state
->ksidstr
, state
->kidstr
));
190 /* check whether sid mapping is already present in db */
191 ret
= dbwrap_fetch_bystring(db
, tmp_ctx
, state
->ksidstr
, &data
);
192 if (NT_STATUS_IS_OK(ret
)) {
193 ret
= NT_STATUS_OBJECT_NAME_COLLISION
;
197 ret
= dbwrap_store_bystring(db
, state
->ksidstr
,
198 string_term_tdb_data(state
->kidstr
),
200 if (!NT_STATUS_IS_OK(ret
)) {
201 DEBUG(0, ("Error storing SID -> ID: %s\n", nt_errstr(ret
)));
205 ret
= dbwrap_store_bystring(db
, state
->kidstr
,
206 string_term_tdb_data(state
->ksidstr
),
208 if (!NT_STATUS_IS_OK(ret
)) {
209 DEBUG(0, ("Error storing ID -> SID: %s\n", nt_errstr(ret
)));
210 /* try to remove the previous stored SID -> ID map */
211 dbwrap_delete_bystring(db
, state
->ksidstr
);
215 DEBUG(10, ("Stored %s <-> %s\n", state
->ksidstr
, state
->kidstr
));
218 talloc_free(tmp_ctx
);
222 NTSTATUS
idmap_tdb_common_set_mapping(struct idmap_domain
* dom
,
223 const struct id_map
* map
)
225 struct idmap_tdb_common_context
*ctx
;
226 struct idmap_tdb_common_set_mapping_context state
;
228 char *ksidstr
, *kidstr
;
230 if (!map
|| !map
->sid
) {
231 return NT_STATUS_INVALID_PARAMETER
;
234 ksidstr
= kidstr
= NULL
;
236 /* TODO: should we filter a set_mapping using low/high filters ? */
239 talloc_get_type_abort(dom
->private_data
,
240 struct idmap_tdb_common_context
);
242 switch (map
->xid
.type
) {
246 talloc_asprintf(ctx
, "UID %lu", (unsigned long)map
->xid
.id
);
251 talloc_asprintf(ctx
, "GID %lu", (unsigned long)map
->xid
.id
);
255 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map
->xid
.type
));
256 return NT_STATUS_INVALID_PARAMETER
;
259 if (kidstr
== NULL
) {
260 DEBUG(0, ("ERROR: Out of memory!\n"));
261 ret
= NT_STATUS_NO_MEMORY
;
265 ksidstr
= sid_string_talloc(ctx
, map
->sid
);
266 if (ksidstr
== NULL
) {
267 DEBUG(0, ("Out of memory!\n"));
268 ret
= NT_STATUS_NO_MEMORY
;
272 state
.ksidstr
= ksidstr
;
273 state
.kidstr
= kidstr
;
275 ret
= dbwrap_trans_do(ctx
->db
, idmap_tdb_common_set_mapping_action
,
279 talloc_free(ksidstr
);
285 * Create a new mapping for an unmapped SID, also allocating a new ID.
286 * This should be run inside a transaction.
289 * Properly integrate this with multi domain idmap config:
290 * Currently, the allocator is default-config only.
292 NTSTATUS
idmap_tdb_common_new_mapping(struct idmap_domain
* dom
,
296 struct idmap_tdb_common_context
*ctx
;
299 talloc_get_type_abort(dom
->private_data
,
300 struct idmap_tdb_common_context
);
302 ret
= idmap_rw_new_mapping(dom
, ctx
->rw_ops
, map
);
308 lookup a set of unix ids
310 NTSTATUS
idmap_tdb_common_unixids_to_sids(struct idmap_domain
* dom
,
311 struct id_map
** ids
)
314 int i
, num_mapped
= 0;
315 struct idmap_tdb_common_context
*ctx
;
317 NTSTATUS(*unixid_to_sid_fn
) (struct idmap_domain
* dom
,
318 struct id_map
* map
);
320 talloc_get_type_abort(dom
->private_data
,
321 struct idmap_tdb_common_context
);
324 (ctx
->unixid_to_sid_fn
==
325 NULL
) ? idmap_tdb_common_unixid_to_sid
: ctx
->unixid_to_sid_fn
;
327 /* initialize the status to avoid surprise */
328 for (i
= 0; ids
[i
]; i
++) {
329 ids
[i
]->status
= ID_UNKNOWN
;
332 for (i
= 0; ids
[i
]; i
++) {
333 ret
= unixid_to_sid_fn(dom
, ids
[i
]);
334 if (!NT_STATUS_IS_OK(ret
)) {
336 /* if it is just a failed mapping continue */
337 if (NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
)) {
339 /* make sure it is marked as unmapped */
340 ids
[i
]->status
= ID_UNMAPPED
;
344 /* some fatal error occurred, return immediately */
348 /* all ok, id is mapped */
349 ids
[i
]->status
= ID_MAPPED
;
357 if (NT_STATUS_IS_OK(ret
)) {
358 if (i
== 0 || num_mapped
== 0) {
359 ret
= NT_STATUS_NONE_MAPPED
;
360 } else if (num_mapped
< i
) {
361 ret
= STATUS_SOME_UNMAPPED
;
371 default single id to sid lookup function
373 NTSTATUS
idmap_tdb_common_unixid_to_sid(struct idmap_domain
* dom
,
379 struct idmap_tdb_common_context
*ctx
;
382 return NT_STATUS_INVALID_PARAMETER
;
384 /* TODO: do we really make sure the database is open again? should have been
385 * done while initing the module
386 status = idmap_tdb2_open_db(dom);
387 NT_STATUS_NOT_OK_RETURN(status);
390 talloc_get_type_abort(dom
->private_data
,
391 struct idmap_tdb_common_context
);
393 /* apply filters before checking */
394 if (!idmap_unix_id_is_in_range(map
->xid
.id
, dom
)) {
396 ("Requested id (%u) out of range (%u - %u). Filtered!\n",
397 map
->xid
.id
, dom
->low_id
, dom
->high_id
));
398 return NT_STATUS_NONE_MAPPED
;
401 switch (map
->xid
.type
) {
405 talloc_asprintf(ctx
, "UID %lu", (unsigned long)map
->xid
.id
);
410 talloc_asprintf(ctx
, "GID %lu", (unsigned long)map
->xid
.id
);
414 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map
->xid
.type
));
415 return NT_STATUS_INVALID_PARAMETER
;
418 if (keystr
== NULL
) {
419 DEBUG(0, ("Out of memory!\n"));
420 ret
= NT_STATUS_NO_MEMORY
;
424 DEBUG(10, ("Fetching record %s\n", keystr
));
426 /* Check if the mapping exists */
427 ret
= dbwrap_fetch_bystring(ctx
->db
, keystr
, keystr
, &data
);
429 if (!NT_STATUS_IS_OK(ret
)) {
430 DEBUG(10, ("Record %s not found\n", keystr
));
431 ret
= NT_STATUS_NONE_MAPPED
;
435 if (!string_to_sid(map
->sid
, (const char *)data
.dptr
)) {
436 DEBUG(10, ("INVALID SID (%s) in record %s\n",
437 (const char *)data
.dptr
, keystr
));
438 ret
= NT_STATUS_INTERNAL_DB_ERROR
;
442 DEBUG(10, ("Found record %s -> %s\n", keystr
, (const char *)data
.dptr
));
450 /**********************************
451 Single sid to id lookup function.
452 **********************************/
454 NTSTATUS
idmap_tdb_common_sid_to_unixid(struct idmap_domain
* dom
,
460 unsigned long rec_id
= 0;
461 struct idmap_tdb_common_context
*ctx
;
462 TALLOC_CTX
*tmp_ctx
= talloc_stackframe();
465 talloc_free(tmp_ctx
);
466 return NT_STATUS_INVALID_PARAMETER
;
470 talloc_get_type_abort(dom
->private_data
,
471 struct idmap_tdb_common_context
);
473 keystr
= sid_string_talloc(tmp_ctx
, map
->sid
);
474 if (keystr
== NULL
) {
475 DEBUG(0, ("Out of memory!\n"));
476 ret
= NT_STATUS_NO_MEMORY
;
480 DEBUG(10, ("Fetching record %s\n", keystr
));
482 /* Check if sid is present in database */
483 ret
= dbwrap_fetch_bystring(ctx
->db
, tmp_ctx
, keystr
, &data
);
484 if (!NT_STATUS_IS_OK(ret
)) {
485 DEBUG(10, ("Record %s not found\n", keystr
));
486 ret
= NT_STATUS_NONE_MAPPED
;
490 /* What type of record is this ? */
491 if (sscanf((const char *)data
.dptr
, "UID %lu", &rec_id
) == 1) {
492 /* Try a UID record. */
493 map
->xid
.id
= rec_id
;
494 map
->xid
.type
= ID_TYPE_UID
;
496 ("Found uid record %s -> %s \n", keystr
,
497 (const char *)data
.dptr
));
500 } else if (sscanf((const char *)data
.dptr
, "GID %lu", &rec_id
) == 1) {
501 /* Try a GID record. */
502 map
->xid
.id
= rec_id
;
503 map
->xid
.type
= ID_TYPE_GID
;
505 ("Found gid record %s -> %s \n", keystr
,
506 (const char *)data
.dptr
));
509 } else { /* Unknown record type ! */
511 ("Found INVALID record %s -> %s\n", keystr
,
512 (const char *)data
.dptr
));
513 ret
= NT_STATUS_INTERNAL_DB_ERROR
;
517 /* apply filters before returning result */
518 if (!idmap_unix_id_is_in_range(map
->xid
.id
, dom
)) {
520 ("Requested id (%u) out of range (%u - %u). Filtered!\n",
521 map
->xid
.id
, dom
->low_id
, dom
->high_id
));
522 ret
= NT_STATUS_NONE_MAPPED
;
526 talloc_free(tmp_ctx
);
530 /**********************************
532 **********************************/
534 struct idmap_tdb_common_sids_to_unixids_context
{
535 struct idmap_domain
*dom
;
537 bool allocate_unmapped
;
538 NTSTATUS(*sid_to_unixid_fn
) (struct idmap_domain
* dom
,
539 struct id_map
* map
);
542 static NTSTATUS
idmap_tdb_common_sids_to_unixids_action(struct db_context
*db
,
545 struct idmap_tdb_common_sids_to_unixids_context
*state
;
546 int i
, num_mapped
= 0;
547 NTSTATUS ret
= NT_STATUS_OK
;
549 state
= (struct idmap_tdb_common_sids_to_unixids_context
*)private_data
;
551 DEBUG(10, ("idmap_tdb_common_sids_to_unixids: "
552 " domain: [%s], allocate: %s\n",
553 state
->dom
->name
, state
->allocate_unmapped
? "yes" : "no"));
555 for (i
= 0; state
->ids
[i
]; i
++) {
556 if ((state
->ids
[i
]->status
== ID_UNKNOWN
) ||
557 /* retry if we could not map in previous run: */
558 (state
->ids
[i
]->status
== ID_UNMAPPED
)) {
561 ret2
= state
->sid_to_unixid_fn(state
->dom
,
564 if (!NT_STATUS_IS_OK(ret2
)) {
566 /* if it is just a failed mapping, continue */
568 (ret2
, NT_STATUS_NONE_MAPPED
)) {
570 /* make sure it is marked as unmapped */
571 state
->ids
[i
]->status
= ID_UNMAPPED
;
572 ret
= STATUS_SOME_UNMAPPED
;
575 * some fatal error occurred,
582 /* all ok, id is mapped */
583 state
->ids
[i
]->status
= ID_MAPPED
;
587 if (state
->ids
[i
]->status
== ID_MAPPED
) {
591 if ((state
->ids
[i
]->status
== ID_UNMAPPED
) &&
592 state
->allocate_unmapped
) {
594 idmap_tdb_common_new_mapping(state
->dom
,
596 if (!NT_STATUS_IS_OK(ret
)) {
605 if (NT_STATUS_IS_OK(ret
) ||
606 NT_STATUS_EQUAL(ret
, STATUS_SOME_UNMAPPED
)) {
607 if (i
== 0 || num_mapped
== 0) {
608 ret
= NT_STATUS_NONE_MAPPED
;
609 } else if (num_mapped
< i
) {
610 ret
= STATUS_SOME_UNMAPPED
;
619 NTSTATUS
idmap_tdb_common_sids_to_unixids(struct idmap_domain
* dom
,
620 struct id_map
** ids
)
624 struct idmap_tdb_common_sids_to_unixids_context state
;
625 struct idmap_tdb_common_context
*ctx
;
628 talloc_get_type_abort(dom
->private_data
,
629 struct idmap_tdb_common_context
);
631 /* initialize the status to avoid surprise */
632 for (i
= 0; ids
[i
]; i
++) {
633 ids
[i
]->status
= ID_UNKNOWN
;
638 state
.allocate_unmapped
= false;
639 state
.sid_to_unixid_fn
=
640 (ctx
->sid_to_unixid_fn
==
641 NULL
) ? idmap_tdb_common_sid_to_unixid
: ctx
->sid_to_unixid_fn
;
643 ret
= idmap_tdb_common_sids_to_unixids_action(ctx
->db
, &state
);
645 if ( (NT_STATUS_EQUAL(ret
, STATUS_SOME_UNMAPPED
) ||
646 NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
)) &&
648 state
.allocate_unmapped
= true;
649 ret
= dbwrap_trans_do(ctx
->db
,
650 idmap_tdb_common_sids_to_unixids_action
,