source3/winbindd/idmap_tdb2.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    idmap TDB2 backend, used for clustered Samba setups.
   5
   6    This uses dbwrap to access tdb files. The location can be set
   7    using tdb:idmap2.tdb =" in smb.conf
   8
   9    Copyright (C) Andrew Tridgell 2007
  10
  11    This is heavily based upon idmap_tdb.c, which is:
  12
  13    Copyright (C) Tim Potter 2000
  14    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
  15    Copyright (C) Jeremy Allison 2006
  16    Copyright (C) Simo Sorce 2003-2006
  17    Copyright (C) Michael Adam 2009-2010
  18
  19    This program is free software; you can redistribute it and/or modify
  20    it under the terms of the GNU General Public License as published by
  21    the Free Software Foundation; either version 2 of the License, or
  22    (at your option) any later version.
  23
  24    This program is distributed in the hope that it will be useful,
  25    but WITHOUT ANY WARRANTY; without even the implied warranty of
  26    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27    GNU General Public License for more details.
  28
  29    You should have received a copy of the GNU General Public License
  30    along with this program; if not, write to the Free Software
  31    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  32 */
  33
  34 #include "includes.h"
  35 #include "winbindd.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_IDMAP
  39
  40 struct idmap_tdb2_context {
  41         struct db_context *db;
  42         const char *script; /* script to provide idmaps */
  43 };
  44
  45 /* High water mark keys */
  46 #define HWM_GROUP  "GROUP HWM"
  47 #define HWM_USER   "USER HWM"
  48
  49
  50 /*
  51  * check and initialize high/low water marks in the db
  52  */
  53 static NTSTATUS idmap_tdb2_init_hwm(struct idmap_domain *dom)
  54 {
  55         uint32 low_id;
  56         struct idmap_tdb2_context *ctx;
  57
  58         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
  59
  60         /* Create high water marks for group and user id */
  61
  62         low_id = dbwrap_fetch_int32(ctx->db, HWM_USER);
  63         if ((low_id == -1) || (low_id < dom->low_id)) {
  64                 if (!NT_STATUS_IS_OK(dbwrap_trans_store_int32(
  65                                              ctx->db, HWM_USER,
  66                                              dom->low_id))) {
  67                         DEBUG(0, ("Unable to initialise user hwm in idmap "
  68                                   "database\n"));
  69                         return NT_STATUS_INTERNAL_DB_ERROR;
  70                 }
  71         }
  72
  73         low_id = dbwrap_fetch_int32(ctx->db, HWM_GROUP);
  74         if ((low_id == -1) || (low_id < dom->low_id)) {
  75                 if (!NT_STATUS_IS_OK(dbwrap_trans_store_int32(
  76                                              ctx->db, HWM_GROUP,
  77                                              dom->low_id))) {
  78                         DEBUG(0, ("Unable to initialise group hwm in idmap "
  79                                   "database\n"));
  80                         return NT_STATUS_INTERNAL_DB_ERROR;
  81                 }
  82         }
  83
  84         return NT_STATUS_OK;
  85 }
  86
  87
  88 /*
  89   open the permanent tdb
  90  */
  91 static NTSTATUS idmap_tdb2_open_db(struct idmap_domain *dom)
  92 {
  93         char *db_path;
  94         struct idmap_tdb2_context *ctx;
  95
  96         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
  97
  98         if (ctx->db) {
  99                 /* its already open */
 100                 return NT_STATUS_OK;
 101         }
 102
 103         db_path = lp_parm_talloc_string(-1, "tdb", "idmap2.tdb", NULL);
 104         if (db_path == NULL) {
 105                 /* fall back to the private directory, which, despite
 106                    its name, is usually on shared storage */
 107                 db_path = talloc_asprintf(NULL, "%s/idmap2.tdb", lp_private_dir());
 108         }
 109         NT_STATUS_HAVE_NO_MEMORY(db_path);
 110
 111         /* Open idmap repository */
 112         ctx->db = db_open(ctx, db_path, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644);
 113         TALLOC_FREE(db_path);
 114
 115         if (ctx->db == NULL) {
 116                 DEBUG(0, ("Unable to open idmap_tdb2 database '%s'\n",
 117                           db_path));
 118                 return NT_STATUS_UNSUCCESSFUL;
 119         }
 120
 121         return idmap_tdb2_init_hwm(dom);
 122 }
 123
 124
 125 /*
 126   Allocate a new id.
 127 */
 128
 129 struct idmap_tdb2_allocate_id_context {
 130         const char *hwmkey;
 131         const char *hwmtype;
 132         uint32_t high_hwm;
 133         uint32_t hwm;
 134 };
 135
 136 static NTSTATUS idmap_tdb2_allocate_id_action(struct db_context *db,
 137                                               void *private_data)
 138 {
 139         NTSTATUS ret;
 140         struct idmap_tdb2_allocate_id_context *state;
 141         uint32_t hwm;
 142
 143         state = (struct idmap_tdb2_allocate_id_context *)private_data;
 144
 145         hwm = dbwrap_fetch_int32(db, state->hwmkey);
 146         if (hwm == -1) {
 147                 ret = NT_STATUS_INTERNAL_DB_ERROR;
 148                 goto done;
 149         }
 150
 151         /* check it is in the range */
 152         if (hwm > state->high_hwm) {
 153                 DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
 154                           state->hwmtype, (unsigned long)state->high_hwm));
 155                 ret = NT_STATUS_UNSUCCESSFUL;
 156                 goto done;
 157         }
 158
 159         /* fetch a new id and increment it */
 160         ret = dbwrap_trans_change_uint32_atomic(db, state->hwmkey, &hwm, 1);
 161         if (!NT_STATUS_IS_OK(ret)) {
 162                 DEBUG(1, ("Fatal error while fetching a new %s value\n!",
 163                           state->hwmtype));
 164                 goto done;
 165         }
 166
 167         /* recheck it is in the range */
 168         if (hwm > state->high_hwm) {
 169                 DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
 170                           state->hwmtype, (unsigned long)state->high_hwm));
 171                 ret = NT_STATUS_UNSUCCESSFUL;
 172                 goto done;
 173         }
 174
 175         ret = NT_STATUS_OK;
 176         state->hwm = hwm;
 177
 178 done:
 179         return ret;
 180 }
 181
 182 static NTSTATUS idmap_tdb2_allocate_id(struct idmap_domain *dom,
 183                                        struct unixid *xid)
 184 {
 185         const char *hwmkey;
 186         const char *hwmtype;
 187         uint32_t high_hwm;
 188         uint32_t hwm = 0;
 189         NTSTATUS status;
 190         struct idmap_tdb2_allocate_id_context state;
 191         struct idmap_tdb2_context *ctx;
 192
 193         status = idmap_tdb2_open_db(dom);
 194         NT_STATUS_NOT_OK_RETURN(status);
 195
 196         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 197
 198         /* Get current high water mark */
 199         switch (xid->type) {
 200
 201         case ID_TYPE_UID:
 202                 hwmkey = HWM_USER;
 203                 hwmtype = "UID";
 204                 break;
 205
 206         case ID_TYPE_GID:
 207                 hwmkey = HWM_GROUP;
 208                 hwmtype = "GID";
 209                 break;
 210
 211         default:
 212                 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
 213                 return NT_STATUS_INVALID_PARAMETER;
 214         }
 215
 216         high_hwm = dom->high_id;
 217
 218         state.hwm = hwm;
 219         state.high_hwm = high_hwm;
 220         state.hwmtype = hwmtype;
 221         state.hwmkey = hwmkey;
 222
 223         status = dbwrap_trans_do(ctx->db, idmap_tdb2_allocate_id_action,
 224                                  &state);
 225
 226         if (NT_STATUS_IS_OK(status)) {
 227                 xid->id = state.hwm;
 228                 DEBUG(10,("New %s = %d\n", hwmtype, state.hwm));
 229         } else {
 230                 DEBUG(1, ("Error allocating a new %s\n", hwmtype));
 231         }
 232
 233         return status;
 234 }
 235
 236 /**
 237  * Allocate a new unix-ID.
 238  * For now this is for the default idmap domain only.
 239  * Should be extended later on.
 240  */
 241 static NTSTATUS idmap_tdb2_get_new_id(struct idmap_domain *dom,
 242                                       struct unixid *id)
 243 {
 244         NTSTATUS ret;
 245
 246         if (!strequal(dom->name, "*")) {
 247                 DEBUG(3, ("idmap_tdb2_get_new_id: "
 248                           "Refusing creation of mapping for domain'%s'. "
 249                           "Currently only supported for the default "
 250                           "domain \"*\".\n",
 251                            dom->name));
 252                 return NT_STATUS_NOT_IMPLEMENTED;
 253         }
 254
 255         ret = idmap_tdb2_allocate_id(dom, id);
 256
 257         return ret;
 258 }
 259
 260 /*
 261   IDMAP MAPPING TDB BACKEND
 262 */
 263
 264 /*
 265   Initialise idmap database.
 266 */
 267 static NTSTATUS idmap_tdb2_db_init(struct idmap_domain *dom,
 268                                    const char *params)
 269 {
 270         NTSTATUS ret;
 271         struct idmap_tdb2_context *ctx;
 272
 273         ctx = talloc_zero(dom, struct idmap_tdb2_context);
 274         if ( ! ctx) {
 275                 DEBUG(0, ("Out of memory!\n"));
 276                 return NT_STATUS_NO_MEMORY;
 277         }
 278
 279         if (strequal(dom->name, "*")) {
 280                 ctx->script = lp_parm_const_string(-1, "idmap", "script", NULL);
 281                 if (ctx->script) {
 282                         DEBUG(1, ("using idmap script '%s'\n", ctx->script));
 283                 }
 284         } else {
 285                 char *config_option = NULL;
 286
 287                 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
 288                 if ( ! config_option) {
 289                         DEBUG(0, ("Out of memory!\n"));
 290                         ret = NT_STATUS_NO_MEMORY;
 291                         goto failed;
 292                 }
 293
 294                 ctx->script = lp_parm_const_string(-1, config_option, "script", NULL);
 295                 if (ctx->script) {
 296                         DEBUG(1, ("using idmap script '%s'\n", ctx->script));
 297                 }
 298
 299                 talloc_free(config_option);
 300         }
 301
 302         dom->private_data = ctx;
 303
 304         ret = idmap_tdb2_open_db(dom);
 305         if (!NT_STATUS_IS_OK(ret)) {
 306                 goto failed;
 307         }
 308
 309         return NT_STATUS_OK;
 310
 311 failed:
 312         talloc_free(ctx);
 313         return ret;
 314 }
 315
 316
 317 /**
 318  * store a mapping in the database.
 319  */
 320
 321 struct idmap_tdb2_set_mapping_context {
 322         const char *ksidstr;
 323         const char *kidstr;
 324 };
 325
 326 static NTSTATUS idmap_tdb2_set_mapping_action(struct db_context *db,
 327                                               void *private_data)
 328 {
 329         TDB_DATA data;
 330         NTSTATUS ret;
 331         struct idmap_tdb2_set_mapping_context *state;
 332         TALLOC_CTX *tmp_ctx = talloc_stackframe();
 333
 334         state = (struct idmap_tdb2_set_mapping_context *)private_data;
 335
 336         DEBUG(10, ("Storing %s <-> %s map\n", state->ksidstr, state->kidstr));
 337
 338         /* check wheter sid mapping is already present in db */
 339         data = dbwrap_fetch_bystring(db, tmp_ctx, state->ksidstr);
 340         if (data.dptr) {
 341                 ret = NT_STATUS_OBJECT_NAME_COLLISION;
 342                 goto done;
 343         }
 344
 345         ret = dbwrap_store_bystring(db, state->ksidstr,
 346                                     string_term_tdb_data(state->kidstr),
 347                                     TDB_INSERT);
 348         if (!NT_STATUS_IS_OK(ret)) {
 349                 DEBUG(0, ("Error storing SID -> ID: %s\n", nt_errstr(ret)));
 350                 goto done;
 351         }
 352
 353         ret = dbwrap_store_bystring(db, state->kidstr,
 354                                     string_term_tdb_data(state->ksidstr),
 355                                     TDB_INSERT);
 356         if (!NT_STATUS_IS_OK(ret)) {
 357                 DEBUG(0, ("Error storing ID -> SID: %s\n", nt_errstr(ret)));
 358                 /* try to remove the previous stored SID -> ID map */
 359                 dbwrap_delete_bystring(db, state->ksidstr);
 360                 goto done;
 361         }
 362
 363         DEBUG(10,("Stored %s <-> %s\n", state->ksidstr, state->kidstr));
 364
 365 done:
 366         talloc_free(tmp_ctx);
 367         return ret;
 368 }
 369
 370 static NTSTATUS idmap_tdb2_set_mapping(struct idmap_domain *dom, const struct id_map *map)
 371 {
 372         struct idmap_tdb2_context *ctx;
 373         NTSTATUS ret;
 374         char *ksidstr, *kidstr;
 375         struct idmap_tdb2_set_mapping_context state;
 376
 377         if (!map || !map->sid) {
 378                 return NT_STATUS_INVALID_PARAMETER;
 379         }
 380
 381         ksidstr = kidstr = NULL;
 382
 383         /* TODO: should we filter a set_mapping using low/high filters ? */
 384
 385         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 386
 387         switch (map->xid.type) {
 388
 389         case ID_TYPE_UID:
 390                 kidstr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
 391                 break;
 392
 393         case ID_TYPE_GID:
 394                 kidstr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
 395                 break;
 396
 397         default:
 398                 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
 399                 return NT_STATUS_INVALID_PARAMETER;
 400         }
 401
 402         if (kidstr == NULL) {
 403                 DEBUG(0, ("ERROR: Out of memory!\n"));
 404                 ret = NT_STATUS_NO_MEMORY;
 405                 goto done;
 406         }
 407
 408         ksidstr = sid_string_talloc(ctx, map->sid);
 409         if (ksidstr == NULL) {
 410                 DEBUG(0, ("Out of memory!\n"));
 411                 ret = NT_STATUS_NO_MEMORY;
 412                 goto done;
 413         }
 414
 415         state.ksidstr = ksidstr;
 416         state.kidstr = kidstr;
 417
 418         ret = dbwrap_trans_do(ctx->db, idmap_tdb2_set_mapping_action,
 419                               &state);
 420
 421 done:
 422         talloc_free(ksidstr);
 423         talloc_free(kidstr);
 424         return ret;
 425 }
 426
 427 /**
 428  * Create a new mapping for an unmapped SID, also allocating a new ID.
 429  * This should be run inside a transaction.
 430  *
 431  * TODO:
 432 *  Properly integrate this with multi domain idmap config:
 433  * Currently, the allocator is default-config only.
 434  */
 435 static NTSTATUS idmap_tdb2_new_mapping(struct idmap_domain *dom, struct id_map *map)
 436 {
 437         NTSTATUS ret;
 438
 439         if (map == NULL) {
 440                 ret = NT_STATUS_INVALID_PARAMETER;
 441                 goto done;
 442         }
 443
 444         if ((map->xid.type != ID_TYPE_UID) && (map->xid.type != ID_TYPE_GID)) {
 445                 ret = NT_STATUS_INVALID_PARAMETER;
 446                 goto done;
 447         }
 448
 449         if (map->sid == NULL) {
 450                 ret = NT_STATUS_INVALID_PARAMETER;
 451                 goto done;
 452         }
 453
 454         ret = idmap_tdb2_get_new_id(dom, &map->xid);
 455         if (!NT_STATUS_IS_OK(ret)) {
 456                 DEBUG(3, ("Could not allocate id: %s\n", nt_errstr(ret)));
 457                 goto done;
 458         }
 459
 460         DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
 461                    sid_string_dbg(map->sid),
 462                    (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
 463                    (unsigned long)map->xid.id));
 464
 465         map->status = ID_MAPPED;
 466
 467         /* store the mapping */
 468         ret = idmap_tdb2_set_mapping(dom, map);
 469         if (!NT_STATUS_IS_OK(ret)) {
 470                 DEBUG(3, ("Could not store the new mapping: %s\n",
 471                           nt_errstr(ret)));
 472         }
 473
 474 done:
 475         return ret;
 476 }
 477
 478
 479 /*
 480   run a script to perform a mapping
 481
 482   The script should the following command lines:
 483
 484       SIDTOID S-1-xxxx
 485       IDTOSID UID xxxx
 486       IDTOSID GID xxxx
 487
 488   and should return one of the following as a single line of text
 489      UID:xxxx
 490      GID:xxxx
 491      SID:xxxx
 492      ERR:xxxx
 493  */
 494 static NTSTATUS idmap_tdb2_script(struct idmap_tdb2_context *ctx, struct id_map *map,
 495                                   const char *fmt, ...)
 496 {
 497         va_list ap;
 498         char *cmd;
 499         FILE *p;
 500         char line[64];
 501         unsigned long v;
 502
 503         cmd = talloc_asprintf(ctx, "%s ", ctx->script);
 504         NT_STATUS_HAVE_NO_MEMORY(cmd);
 505
 506         va_start(ap, fmt);
 507         cmd = talloc_vasprintf_append(cmd, fmt, ap);
 508         va_end(ap);
 509         NT_STATUS_HAVE_NO_MEMORY(cmd);
 510
 511         p = popen(cmd, "r");
 512         talloc_free(cmd);
 513         if (p == NULL) {
 514                 return NT_STATUS_NONE_MAPPED;
 515         }
 516
 517         if (fgets(line, sizeof(line)-1, p) == NULL) {
 518                 pclose(p);
 519                 return NT_STATUS_NONE_MAPPED;
 520         }
 521         pclose(p);
 522
 523         DEBUG(10,("idmap script gave: %s\n", line));
 524
 525         if (sscanf(line, "UID:%lu", &v) == 1) {
 526                 map->xid.id   = v;
 527                 map->xid.type = ID_TYPE_UID;
 528         } else if (sscanf(line, "GID:%lu", &v) == 1) {
 529                 map->xid.id   = v;
 530                 map->xid.type = ID_TYPE_GID;
 531         } else if (strncmp(line, "SID:S-", 6) == 0) {
 532                 if (!string_to_sid(map->sid, &line[4])) {
 533                         DEBUG(0,("Bad SID in '%s' from idmap script %s\n",
 534                                  line, ctx->script));
 535                         return NT_STATUS_NONE_MAPPED;
 536                 }
 537         } else {
 538                 DEBUG(0,("Bad reply '%s' from idmap script %s\n",
 539                          line, ctx->script));
 540                 return NT_STATUS_NONE_MAPPED;
 541         }
 542
 543         return NT_STATUS_OK;
 544 }
 545
 546
 547
 548 /*
 549   Single id to sid lookup function.
 550 */
 551 static NTSTATUS idmap_tdb2_id_to_sid(struct idmap_domain *dom, struct id_map *map)
 552 {
 553         NTSTATUS ret;
 554         TDB_DATA data;
 555         char *keystr;
 556         NTSTATUS status;
 557         struct idmap_tdb2_context *ctx;
 558
 559
 560         if (!dom || !map) {
 561                 return NT_STATUS_INVALID_PARAMETER;
 562         }
 563
 564         status = idmap_tdb2_open_db(dom);
 565         NT_STATUS_NOT_OK_RETURN(status);
 566
 567         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 568
 569         /* apply filters before checking */
 570         if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
 571                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 572                                 map->xid.id, dom->low_id, dom->high_id));
 573                 return NT_STATUS_NONE_MAPPED;
 574         }
 575
 576         switch (map->xid.type) {
 577
 578         case ID_TYPE_UID:
 579                 keystr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
 580                 break;
 581
 582         case ID_TYPE_GID:
 583                 keystr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
 584                 break;
 585
 586         default:
 587                 DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
 588                 return NT_STATUS_INVALID_PARAMETER;
 589         }
 590
 591         /* final SAFE_FREE safe */
 592         data.dptr = NULL;
 593
 594         if (keystr == NULL) {
 595                 DEBUG(0, ("Out of memory!\n"));
 596                 ret = NT_STATUS_NO_MEMORY;
 597                 goto done;
 598         }
 599
 600         DEBUG(10,("Fetching record %s\n", keystr));
 601
 602         /* Check if the mapping exists */
 603         data = dbwrap_fetch_bystring(ctx->db, keystr, keystr);
 604
 605         if (!data.dptr) {
 606                 char *sidstr;
 607                 struct idmap_tdb2_set_mapping_context store_state;
 608
 609                 DEBUG(10,("Record %s not found\n", keystr));
 610                 if (ctx->script == NULL) {
 611                         ret = NT_STATUS_NONE_MAPPED;
 612                         goto done;
 613                 }
 614
 615                 ret = idmap_tdb2_script(ctx, map, "IDTOSID %s", keystr);
 616
 617                 /* store it on shared storage */
 618                 if (!NT_STATUS_IS_OK(ret)) {
 619                         goto done;
 620                 }
 621
 622                 sidstr = sid_string_talloc(keystr, map->sid);
 623                 if (!sidstr) {
 624                         ret = NT_STATUS_NO_MEMORY;
 625                         goto done;
 626                 }
 627
 628                 store_state.ksidstr = sidstr;
 629                 store_state.kidstr = keystr;
 630
 631                 ret = dbwrap_trans_do(ctx->db, idmap_tdb2_set_mapping_action,
 632                                       &store_state);
 633                 goto done;
 634         }
 635
 636         if (!string_to_sid(map->sid, (const char *)data.dptr)) {
 637                 DEBUG(10,("INVALID SID (%s) in record %s\n",
 638                         (const char *)data.dptr, keystr));
 639                 ret = NT_STATUS_INTERNAL_DB_ERROR;
 640                 goto done;
 641         }
 642
 643         DEBUG(10,("Found record %s -> %s\n", keystr, (const char *)data.dptr));
 644         ret = NT_STATUS_OK;
 645
 646 done:
 647         talloc_free(keystr);
 648         return ret;
 649 }
 650
 651
 652 /*
 653  Single sid to id lookup function.
 654 */
 655 static NTSTATUS idmap_tdb2_sid_to_id(struct idmap_domain *dom, struct id_map *map)
 656 {
 657         NTSTATUS ret;
 658         TDB_DATA data;
 659         char *keystr;
 660         unsigned long rec_id = 0;
 661         struct idmap_tdb2_context *ctx;
 662         TALLOC_CTX *tmp_ctx = talloc_stackframe();
 663
 664         ret = idmap_tdb2_open_db(dom);
 665         NT_STATUS_NOT_OK_RETURN(ret);
 666
 667         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 668
 669         keystr = sid_string_talloc(tmp_ctx, map->sid);
 670         if (keystr == NULL) {
 671                 DEBUG(0, ("Out of memory!\n"));
 672                 ret = NT_STATUS_NO_MEMORY;
 673                 goto done;
 674         }
 675
 676         DEBUG(10,("Fetching record %s\n", keystr));
 677
 678         /* Check if sid is present in database */
 679         data = dbwrap_fetch_bystring(ctx->db, tmp_ctx, keystr);
 680         if (!data.dptr) {
 681                 char *idstr;
 682                 struct idmap_tdb2_set_mapping_context store_state;
 683
 684                 DEBUG(10,(__location__ " Record %s not found\n", keystr));
 685
 686                 if (ctx->script == NULL) {
 687                         ret = NT_STATUS_NONE_MAPPED;
 688                         goto done;
 689                 }
 690
 691                 ret = idmap_tdb2_script(ctx, map, "SIDTOID %s", keystr);
 692                 /* store it on shared storage */
 693                 if (!NT_STATUS_IS_OK(ret)) {
 694                         goto done;
 695                 }
 696
 697                 /* apply filters before returning result */
 698                 if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
 699                         DEBUG(5, ("Script returned id (%u) out of range "
 700                                   "(%u - %u). Filtered!\n",
 701                                   map->xid.id, dom->low_id, dom->high_id));
 702                         ret = NT_STATUS_NONE_MAPPED;
 703                         goto done;
 704                 }
 705
 706                 idstr = talloc_asprintf(tmp_ctx, "%cID %lu",
 707                                         map->xid.type == ID_TYPE_UID?'U':'G',
 708                                         (unsigned long)map->xid.id);
 709                 if (idstr == NULL) {
 710                         ret = NT_STATUS_NO_MEMORY;
 711                         goto done;
 712                 }
 713
 714                 store_state.ksidstr = keystr;
 715                 store_state.kidstr = idstr;
 716
 717                 ret = dbwrap_trans_do(ctx->db, idmap_tdb2_set_mapping_action,
 718                                       &store_state);
 719                 goto done;
 720         }
 721
 722         /* What type of record is this ? */
 723         if (sscanf((const char *)data.dptr, "UID %lu", &rec_id) == 1) { /* Try a UID record. */
 724                 map->xid.id = rec_id;
 725                 map->xid.type = ID_TYPE_UID;
 726                 DEBUG(10,("Found uid record %s -> %s \n", keystr, (const char *)data.dptr ));
 727                 ret = NT_STATUS_OK;
 728
 729         } else if (sscanf((const char *)data.dptr, "GID %lu", &rec_id) == 1) { /* Try a GID record. */
 730                 map->xid.id = rec_id;
 731                 map->xid.type = ID_TYPE_GID;
 732                 DEBUG(10,("Found gid record %s -> %s \n", keystr, (const char *)data.dptr ));
 733                 ret = NT_STATUS_OK;
 734
 735         } else { /* Unknown record type ! */
 736                 DEBUG(2, ("Found INVALID record %s -> %s\n", keystr, (const char *)data.dptr));
 737                 ret = NT_STATUS_INTERNAL_DB_ERROR;
 738                 goto done;
 739         }
 740
 741         /* apply filters before returning result */
 742         if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
 743                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 744                                 map->xid.id, dom->low_id, dom->high_id));
 745                 ret = NT_STATUS_NONE_MAPPED;
 746         }
 747
 748 done:
 749         talloc_free(tmp_ctx);
 750         return ret;
 751 }
 752
 753 /*
 754   lookup a set of unix ids.
 755 */
 756 static NTSTATUS idmap_tdb2_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 757 {
 758         NTSTATUS ret;
 759         int i;
 760
 761         /* initialize the status to avoid suprise */
 762         for (i = 0; ids[i]; i++) {
 763                 ids[i]->status = ID_UNKNOWN;
 764         }
 765
 766         for (i = 0; ids[i]; i++) {
 767                 ret = idmap_tdb2_id_to_sid(dom, ids[i]);
 768                 if ( ! NT_STATUS_IS_OK(ret)) {
 769
 770                         /* if it is just a failed mapping continue */
 771                         if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 772
 773                                 /* make sure it is marked as unmapped */
 774                                 ids[i]->status = ID_UNMAPPED;
 775                                 continue;
 776                         }
 777
 778                         /* some fatal error occurred, return immediately */
 779                         goto done;
 780                 }
 781
 782                 /* all ok, id is mapped */
 783                 ids[i]->status = ID_MAPPED;
 784         }
 785
 786         ret = NT_STATUS_OK;
 787
 788 done:
 789         return ret;
 790 }
 791
 792 /*
 793   lookup a set of sids.
 794 */
 795
 796 struct idmap_tdb2_sids_to_unixids_context {
 797         struct idmap_domain *dom;
 798         struct id_map **ids;
 799         bool allocate_unmapped;
 800 };
 801
 802 static NTSTATUS idmap_tdb2_sids_to_unixids_action(struct db_context *db,
 803                                                   void *private_data)
 804 {
 805         struct idmap_tdb2_sids_to_unixids_context *state;
 806         int i;
 807         NTSTATUS ret = NT_STATUS_OK;
 808
 809         state = (struct idmap_tdb2_sids_to_unixids_context *)private_data;
 810
 811         DEBUG(10, ("idmap_tdb2_sids_to_unixids_action: "
 812                    " domain: [%s], allocate: %s\n",
 813                    state->dom->name,
 814                    state->allocate_unmapped ? "yes" : "no"));
 815
 816         for (i = 0; state->ids[i]; i++) {
 817                 if ((state->ids[i]->status == ID_UNKNOWN) ||
 818                     /* retry if we could not map in previous run: */
 819                     (state->ids[i]->status == ID_UNMAPPED))
 820                 {
 821                         NTSTATUS ret2;
 822
 823                         ret2 = idmap_tdb2_sid_to_id(state->dom, state->ids[i]);
 824                         if (!NT_STATUS_IS_OK(ret2)) {
 825
 826                                 /* if it is just a failed mapping, continue */
 827                                 if (NT_STATUS_EQUAL(ret2, NT_STATUS_NONE_MAPPED)) {
 828
 829                                         /* make sure it is marked as unmapped */
 830                                         state->ids[i]->status = ID_UNMAPPED;
 831                                         ret = STATUS_SOME_UNMAPPED;
 832                                 } else {
 833                                         /* some fatal error occurred, return immediately */
 834                                         ret = ret2;
 835                                         goto done;
 836                                 }
 837                         } else {
 838                                 /* all ok, id is mapped */
 839                                 state->ids[i]->status = ID_MAPPED;
 840                         }
 841                 }
 842
 843                 if ((state->ids[i]->status == ID_UNMAPPED) &&
 844                     state->allocate_unmapped)
 845                 {
 846                         ret = idmap_tdb2_new_mapping(state->dom, state->ids[i]);
 847                         if (!NT_STATUS_IS_OK(ret)) {
 848                                 goto done;
 849                         }
 850                 }
 851         }
 852
 853 done:
 854         return ret;
 855 }
 856
 857 static NTSTATUS idmap_tdb2_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 858 {
 859         NTSTATUS ret;
 860         int i;
 861         struct idmap_tdb2_sids_to_unixids_context state;
 862         struct idmap_tdb2_context *ctx;
 863
 864         ctx = talloc_get_type(dom->private_data, struct idmap_tdb2_context);
 865
 866         /* initialize the status to avoid suprise */
 867         for (i = 0; ids[i]; i++) {
 868                 ids[i]->status = ID_UNKNOWN;
 869         }
 870
 871         state.dom = dom;
 872         state.ids = ids;
 873         state.allocate_unmapped = false;
 874
 875         ret = idmap_tdb2_sids_to_unixids_action(ctx->db, &state);
 876
 877         if (NT_STATUS_EQUAL(ret, STATUS_SOME_UNMAPPED) && !dom->read_only) {
 878                 state.allocate_unmapped = true;
 879                 ret = dbwrap_trans_do(ctx->db,
 880                                       idmap_tdb2_sids_to_unixids_action,
 881                                       &state);
 882         }
 883
 884         return ret;
 885 }
 886
 887
 888 /*
 889   Close the idmap tdb instance
 890 */
 891 static NTSTATUS idmap_tdb2_close(struct idmap_domain *dom)
 892 {
 893         /* don't do anything */
 894         return NT_STATUS_OK;
 895 }
 896
 897 static struct idmap_methods db_methods = {
 898         .init            = idmap_tdb2_db_init,
 899         .unixids_to_sids = idmap_tdb2_unixids_to_sids,
 900         .sids_to_unixids = idmap_tdb2_sids_to_unixids,
 901         .allocate_id     = idmap_tdb2_get_new_id,
 902         .close_fn        = idmap_tdb2_close
 903 };
 904
 905 NTSTATUS idmap_tdb2_init(void)
 906 {
 907         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "tdb2", &db_methods);
 908 }