2 Unix SMB/CIFS implementation.
4 idmap script backend, used for Samba setups where you need to map SIDs to
7 Copyright (C) Richard Sharpe 2014.
9 This is heavily based upon idmap_tdb2.c, which is:
11 Copyright (C) Tim Potter 2000
12 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
13 Copyright (C) Jeremy Allison 2006
14 Copyright (C) Simo Sorce 2003-2006
15 Copyright (C) Michael Adam 2009-2010
17 This program is free software; you can redistribute it and/or modify
18 it under the terms of the GNU General Public License as published by
19 the Free Software Foundation; either version 2 of the License, or
20 (at your option) any later version.
22 This program is distributed in the hope that it will be useful,
23 but WITHOUT ANY WARRANTY; without even the implied warranty of
24 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25 GNU General Public License for more details.
27 You should have received a copy of the GNU General Public License
28 along with this program; if not, write to the Free Software
29 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
33 #include "system/filesys.h"
37 #include "../libcli/security/dom_sid.h"
38 #include "lib/util_file.h"
39 #include "lib/util/tevent_unix.h"
42 #define DBGC_CLASS DBGC_IDMAP
44 struct idmap_script_context
{
45 const char *script
; /* script to provide idmaps */
49 run a script to perform a mapping
51 The script should accept the following command lines:
53 SIDTOID S-1-xxxx -> XID:<id> | ERR:<str>
54 SIDTOID S-1-xxxx -> UID:<id> | ERR:<str>
55 SIDTOID S-1-xxxx -> GID:<id> | ERR:<str>
56 IDTOSID XID xxxx -> SID:<sid> | ERR:<str>
57 IDTOSID UID xxxx -> SID:<sid> | ERR:<str>
58 IDTOSID GID xxxx -> SID:<sid> | ERR:<str>
60 where XID means both a UID and a GID. This is the case for ID_TYPE_BOTH.
62 TODO: Needs more validation ... like that we got a UID when we asked for one.
65 struct idmap_script_xid2sid_state
{
71 static void idmap_script_xid2sid_done(struct tevent_req
*subreq
);
73 static struct tevent_req
*idmap_script_xid2sid_send(
74 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
75 struct unixid xid
, const char *script
, size_t idx
)
77 struct tevent_req
*req
, *subreq
;
78 struct idmap_script_xid2sid_state
*state
;
81 req
= tevent_req_create(mem_ctx
, &state
,
82 struct idmap_script_xid2sid_state
);
99 DBG_WARNING("INVALID unix ID type: 0x02%x\n", xid
.type
);
100 tevent_req_error(req
, EINVAL
);
101 return tevent_req_post(req
, ev
);
104 state
->syscmd
= talloc_asprintf(state
, "%s IDTOSID %cID %lu", script
, key
,
105 (unsigned long)xid
.id
);
106 if (tevent_req_nomem(state
->syscmd
, req
)) {
107 return tevent_req_post(req
, ev
);
110 subreq
= file_pload_send(state
, ev
, state
->syscmd
, 1024);
111 if (tevent_req_nomem(subreq
, req
)) {
112 return tevent_req_post(req
, ev
);
114 tevent_req_set_callback(subreq
, idmap_script_xid2sid_done
, req
);
118 static void idmap_script_xid2sid_done(struct tevent_req
*subreq
)
120 struct tevent_req
*req
= tevent_req_callback_data(
121 subreq
, struct tevent_req
);
122 struct idmap_script_xid2sid_state
*state
= tevent_req_data(
123 req
, struct idmap_script_xid2sid_state
);
126 ret
= file_pload_recv(subreq
, state
, &state
->out
);
128 if (tevent_req_error(req
, ret
)) {
131 tevent_req_done(req
);
134 static int idmap_script_xid2sid_recv(struct tevent_req
*req
, size_t *idx
,
135 enum id_mapping
*status
,
138 struct idmap_script_xid2sid_state
*state
= tevent_req_data(
139 req
, struct idmap_script_xid2sid_state
);
140 char *out
= (char *)state
->out
;
141 size_t out_size
= talloc_get_size(out
);
144 if (tevent_req_is_unix_error(req
, &err
)) {
151 if (state
->out
[out_size
-1] != '\0') {
157 if ((strncmp(out
, "SID:S-", 6) != 0) ||
158 !dom_sid_parse(out
+4, sid
)) {
159 DBG_WARNING("Bad sid from script: %s\n", out
);
167 *sid
= (struct dom_sid
) {0};
168 *status
= ID_UNMAPPED
;
172 struct idmap_script_xids2sids_state
{
178 static void idmap_script_xids2sids_done(struct tevent_req
*subreq
);
180 static struct tevent_req
*idmap_script_xids2sids_send(
181 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
182 struct id_map
**ids
, size_t num_ids
, const char *script
)
184 struct tevent_req
*req
;
185 struct idmap_script_xids2sids_state
*state
;
188 req
= tevent_req_create(mem_ctx
, &state
,
189 struct idmap_script_xids2sids_state
);
194 state
->num_ids
= num_ids
;
196 if (state
->num_ids
== 0) {
197 tevent_req_done(req
);
198 return tevent_req_post(req
, ev
);
201 for (i
=0; i
<num_ids
; i
++) {
202 struct tevent_req
*subreq
;
204 subreq
= idmap_script_xid2sid_send(
205 state
, ev
, ids
[i
]->xid
, script
, i
);
206 if (tevent_req_nomem(subreq
, req
)) {
207 return tevent_req_post(req
, ev
);
209 tevent_req_set_callback(subreq
, idmap_script_xids2sids_done
,
216 static void idmap_script_xids2sids_done(struct tevent_req
*subreq
)
218 struct tevent_req
*req
= tevent_req_callback_data(
219 subreq
, struct tevent_req
);
220 struct idmap_script_xids2sids_state
*state
= tevent_req_data(
221 req
, struct idmap_script_xids2sids_state
);
223 enum id_mapping status
= ID_UNKNOWN
;
224 struct dom_sid sid
= {0};
227 ret
= idmap_script_xid2sid_recv(subreq
, &idx
, &status
, &sid
);
229 if (tevent_req_error(req
, ret
)) {
233 if (idx
>= state
->num_ids
) {
234 tevent_req_error(req
, EINVAL
);
238 state
->ids
[idx
]->status
= status
;
240 state
->ids
[idx
]->sid
= dom_sid_dup(state
->ids
, &sid
);
241 if (tevent_req_nomem(state
->ids
[idx
]->sid
, req
)) {
245 state
->num_done
+= 1;
247 if (state
->num_done
>= state
->num_ids
) {
248 tevent_req_done(req
);
252 static int idmap_script_xids2sids_recv(struct tevent_req
*req
)
254 return tevent_req_simple_recv_unix(req
);
257 static int idmap_script_xids2sids(struct id_map
**ids
, size_t num_ids
,
260 TALLOC_CTX
*frame
= talloc_stackframe();
261 struct tevent_context
*ev
;
262 struct tevent_req
*req
;
265 ev
= samba_tevent_context_init(frame
);
269 req
= idmap_script_xids2sids_send(frame
, ev
, ids
, num_ids
, script
);
273 if (!tevent_req_poll(req
, ev
)) {
277 ret
= idmap_script_xids2sids_recv(req
);
283 static NTSTATUS
idmap_script_unixids_to_sids(struct idmap_domain
*dom
,
286 struct idmap_script_context
*ctx
= talloc_get_type_abort(
287 dom
->private_data
, struct idmap_script_context
);
289 size_t i
, num_ids
, num_mapped
;
291 DEBUG(10, ("%s called ...\n", __func__
));
292 /* Init status to avoid surprise ... */
293 for (i
= 0; ids
[i
]; i
++) {
294 ids
[i
]->status
= ID_UNKNOWN
;
298 ret
= idmap_script_xids2sids(ids
, num_ids
, ctx
->script
);
300 DBG_DEBUG("idmap_script_xids2sids returned %s\n",
302 return map_nt_error_from_unix(ret
);
307 for (i
= 0; ids
[i
]; i
++) {
308 if (ids
[i
]->status
== ID_MAPPED
) {
313 if (num_mapped
== 0) {
314 return NT_STATUS_NONE_MAPPED
;
316 if (num_mapped
< num_ids
) {
317 return STATUS_SOME_UNMAPPED
;
322 struct idmap_script_sid2xid_state
{
328 static void idmap_script_sid2xid_done(struct tevent_req
*subreq
);
330 static struct tevent_req
*idmap_script_sid2xid_send(
331 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
332 const struct dom_sid
*sid
, const char *script
, size_t idx
)
334 struct tevent_req
*req
, *subreq
;
335 struct idmap_script_sid2xid_state
*state
;
336 char sidbuf
[DOM_SID_STR_BUFLEN
];
338 req
= tevent_req_create(mem_ctx
, &state
,
339 struct idmap_script_sid2xid_state
);
345 dom_sid_string_buf(sid
, sidbuf
, sizeof(sidbuf
));
347 state
->syscmd
= talloc_asprintf(state
, "%s SIDTOID %s",
349 if (tevent_req_nomem(state
->syscmd
, req
)) {
350 return tevent_req_post(req
, ev
);
353 subreq
= file_pload_send(state
, ev
, state
->syscmd
, 1024);
354 if (tevent_req_nomem(subreq
, req
)) {
355 return tevent_req_post(req
, ev
);
357 tevent_req_set_callback(subreq
, idmap_script_sid2xid_done
, req
);
361 static void idmap_script_sid2xid_done(struct tevent_req
*subreq
)
363 struct tevent_req
*req
= tevent_req_callback_data(
364 subreq
, struct tevent_req
);
365 struct idmap_script_sid2xid_state
*state
= tevent_req_data(
366 req
, struct idmap_script_sid2xid_state
);
369 ret
= file_pload_recv(subreq
, state
, &state
->out
);
371 if (tevent_req_error(req
, ret
)) {
374 tevent_req_done(req
);
377 static int idmap_script_sid2xid_recv(struct tevent_req
*req
,
378 size_t *idx
, enum id_mapping
*status
,
381 struct idmap_script_sid2xid_state
*state
= tevent_req_data(
382 req
, struct idmap_script_sid2xid_state
);
383 char *out
= (char *)state
->out
;
384 size_t out_size
= talloc_get_size(out
);
388 if (tevent_req_is_unix_error(req
, &err
)) {
395 if (state
->out
[out_size
-1] != '\0') {
401 if (sscanf(out
, "XID:%lu\n", &v
) == 1) {
402 *xid
= (struct unixid
) { .id
= v
, .type
= ID_TYPE_BOTH
};
403 } else if (sscanf(out
, "UID:%lu\n", &v
) == 1) {
404 *xid
= (struct unixid
) { .id
= v
, .type
= ID_TYPE_UID
};
405 } else if (sscanf(out
, "GID:%lu\n", &v
) == 1) {
406 *xid
= (struct unixid
) { .id
= v
, .type
= ID_TYPE_GID
};
415 *xid
= (struct unixid
) { .id
= UINT32_MAX
,
416 .type
= ID_TYPE_NOT_SPECIFIED
};
417 *status
= ID_UNMAPPED
;
421 struct idmap_script_sids2xids_state
{
427 static void idmap_script_sids2xids_done(struct tevent_req
*subreq
);
429 static struct tevent_req
*idmap_script_sids2xids_send(
430 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
431 struct id_map
**ids
, size_t num_ids
, const char *script
)
433 struct tevent_req
*req
;
434 struct idmap_script_sids2xids_state
*state
;
437 req
= tevent_req_create(mem_ctx
, &state
,
438 struct idmap_script_sids2xids_state
);
443 state
->num_ids
= num_ids
;
445 if (state
->num_ids
== 0) {
446 tevent_req_done(req
);
447 return tevent_req_post(req
, ev
);
450 for (i
=0; i
<num_ids
; i
++) {
451 struct tevent_req
*subreq
;
453 subreq
= idmap_script_sid2xid_send(
454 state
, ev
, ids
[i
]->sid
, script
, i
);
455 if (tevent_req_nomem(subreq
, req
)) {
456 return tevent_req_post(req
, ev
);
458 tevent_req_set_callback(subreq
, idmap_script_sids2xids_done
,
465 static void idmap_script_sids2xids_done(struct tevent_req
*subreq
)
467 struct tevent_req
*req
= tevent_req_callback_data(
468 subreq
, struct tevent_req
);
469 struct idmap_script_sids2xids_state
*state
= tevent_req_data(
470 req
, struct idmap_script_sids2xids_state
);
472 enum id_mapping status
= ID_UNKNOWN
;
473 struct unixid xid
= { .id
= UINT32_MAX
,
474 .type
= ID_TYPE_NOT_SPECIFIED
};
477 ret
= idmap_script_sid2xid_recv(subreq
, &idx
, &status
, &xid
);
479 if (tevent_req_error(req
, ret
)) {
483 if (idx
>= state
->num_ids
) {
484 tevent_req_error(req
, EINVAL
);
488 state
->ids
[idx
]->status
= status
;
489 state
->ids
[idx
]->xid
= xid
;
491 state
->num_done
+= 1;
493 if (state
->num_done
>= state
->num_ids
) {
494 tevent_req_done(req
);
498 static int idmap_script_sids2xids_recv(struct tevent_req
*req
)
500 return tevent_req_simple_recv_unix(req
);
503 static int idmap_script_sids2xids(struct id_map
**ids
, size_t num_ids
,
506 TALLOC_CTX
*frame
= talloc_stackframe();
507 struct tevent_context
*ev
;
508 struct tevent_req
*req
;
511 ev
= samba_tevent_context_init(frame
);
515 req
= idmap_script_sids2xids_send(frame
, ev
, ids
, num_ids
, script
);
519 if (!tevent_req_poll(req
, ev
)) {
523 ret
= idmap_script_sids2xids_recv(req
);
529 static NTSTATUS
idmap_script_sids_to_unixids(struct idmap_domain
*dom
,
532 struct idmap_script_context
*ctx
= talloc_get_type_abort(
533 dom
->private_data
, struct idmap_script_context
);
535 size_t i
, num_ids
, num_mapped
;
537 DEBUG(10, ("%s called ...\n", __func__
));
538 /* Init status to avoid surprise ... */
539 for (i
= 0; ids
[i
]; i
++) {
540 ids
[i
]->status
= ID_UNKNOWN
;
544 ret
= idmap_script_sids2xids(ids
, num_ids
, ctx
->script
);
546 DBG_DEBUG("idmap_script_sids2xids returned %s\n",
548 return map_nt_error_from_unix(ret
);
553 for (i
=0; i
<num_ids
; i
++) {
554 struct id_map
*map
= ids
[i
];
556 if ((map
->status
== ID_MAPPED
) &&
557 !idmap_unix_id_is_in_range(map
->xid
.id
, dom
)) {
558 DBG_INFO("Script returned id (%u) out of range "
559 "(%u - %u). Filtered!\n",
560 map
->xid
.id
, dom
->low_id
, dom
->high_id
);
561 map
->status
= ID_UNMAPPED
;
564 if (map
->status
== ID_MAPPED
) {
569 if (num_mapped
== 0) {
570 return NT_STATUS_NONE_MAPPED
;
572 if (num_mapped
< num_ids
) {
573 return STATUS_SOME_UNMAPPED
;
579 * Initialise idmap_script database.
581 static NTSTATUS
idmap_script_db_init(struct idmap_domain
*dom
)
584 struct idmap_script_context
*ctx
;
585 const char * idmap_script
= NULL
;
587 DEBUG(10, ("%s called ...\n", __func__
));
589 ctx
= talloc_zero(dom
, struct idmap_script_context
);
591 DEBUG(0, ("Out of memory!\n"));
592 ret
= NT_STATUS_NO_MEMORY
;
596 ctx
->script
= idmap_config_const_string(dom
->name
, "script", NULL
);
598 /* Do we even need to handle this? */
599 idmap_script
= lp_parm_const_string(-1, "idmap", "script", NULL
);
600 if (idmap_script
!= NULL
) {
601 DEBUG(0, ("Warning: 'idmap:script' is deprecated. "
602 " Please use 'idmap config * : script' instead!\n"));
605 if (strequal(dom
->name
, "*") && ctx
->script
== NULL
) {
606 /* fall back to idmap:script for backwards compatibility */
607 ctx
->script
= idmap_script
;
611 DEBUG(1, ("using idmap script '%s'\n", ctx
->script
));
614 dom
->private_data
= ctx
;
615 dom
->read_only
= true; /* We do not allocate!*/
624 static struct idmap_methods db_methods
= {
625 .init
= idmap_script_db_init
,
626 .unixids_to_sids
= idmap_script_unixids_to_sids
,
627 .sids_to_unixids
= idmap_script_sids_to_unixids
,
631 NTSTATUS
idmap_script_init(TALLOC_CTX
*ctx
)
633 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION
, "script", &db_methods
);