?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
fixing typo in the 'map readonly = permissions' explanation reported by Thomas Bork
[Samba.git] / source / nsswitch / idmap.c
blob96c90c38d20871aa21ecbca4de8f75bb7f43bbee
1 /*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25 #include "winbindd.h"
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_IDMAP
29
30 static_decl_idmap;
31
32 struct idmap_backend {
33 const char *name;
34 struct idmap_methods *methods;
35 struct idmap_backend *prev, *next;
36 };
37
38 struct idmap_alloc_backend {
39 const char *name;
40 struct idmap_alloc_methods *methods;
41 struct idmap_alloc_backend *prev, *next;
42 };
43
44 struct idmap_cache_ctx;
45
46 struct idmap_alloc_context {
47 const char *params;
48 struct idmap_alloc_methods *methods;
49 BOOL initialized;
50 };
51
52 static TALLOC_CTX *idmap_ctx = NULL;
53 static struct idmap_cache_ctx *idmap_cache;
54
55 static struct idmap_backend *backends = NULL;
56 static struct idmap_domain **idmap_domains = NULL;
57 static int num_domains = 0;
58 static int pdb_dom_num = -1;
59 static int def_dom_num = -1;
60
61 static struct idmap_alloc_backend *alloc_backends = NULL;
62 static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
63
64 #define IDMAP_CHECK_RET(ret) do { \
65 if ( ! NT_STATUS_IS_OK(ret)) { \
66 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
67 goto done; \
68 } } while(0)
69 #define IDMAP_REPORT_RET(ret) do { \
70 if ( ! NT_STATUS_IS_OK(ret)) { \
71 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
72 } } while(0)
73 #define IDMAP_CHECK_ALLOC(mem) do { \
74 if (!mem) { \
75 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
76 goto done; \
77 } } while(0)
78
79 static struct idmap_methods *get_methods(struct idmap_backend *be,
80 const char *name)
81 {
82 struct idmap_backend *b;
83
84 for (b = be; b; b = b->next) {
85 if (strequal(b->name, name)) {
86 return b->methods;
87 }
88 }
89
90 return NULL;
91 }
92
93 static struct idmap_alloc_methods *get_alloc_methods(
94 struct idmap_alloc_backend *be,
95 const char *name)
96 {
97 struct idmap_alloc_backend *b;
98
99 for (b = be; b; b = b->next) {
100 if (strequal(b->name, name)) {
101 return b->methods;
102 }
103 }
104
105 return NULL;
106 }
107
108 BOOL idmap_is_offline(void)
109 {
110 return ( lp_winbind_offline_logon() &&
111 get_global_winbindd_state_offline() );
112 }
113
114 /**********************************************************************
115 Allow a module to register itself as a method.
116 **********************************************************************/
117
118 NTSTATUS smb_register_idmap(int version, const char *name,
119 struct idmap_methods *methods)
120 {
121 struct idmap_methods *test;
122 struct idmap_backend *entry;
123
124 if (!idmap_ctx) {
125 return NT_STATUS_INTERNAL_DB_ERROR;
126 }
127
128 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
129 DEBUG(0, ("Failed to register idmap module.\n"
130 "The module was compiled against "
131 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
132 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
133 "Please recompile against the current version "
134 "of samba!\n",
135 version, SMB_IDMAP_INTERFACE_VERSION));
136 return NT_STATUS_OBJECT_TYPE_MISMATCH;
137 }
138
139 if (!name || !name[0] || !methods) {
140 DEBUG(0,("Called with NULL pointer or empty name!\n"));
141 return NT_STATUS_INVALID_PARAMETER;
142 }
143
144 test = get_methods(backends, name);
145 if (test) {
146 DEBUG(0,("Idmap module %s already registered!\n", name));
147 return NT_STATUS_OBJECT_NAME_COLLISION;
148 }
149
150 entry = talloc(idmap_ctx, struct idmap_backend);
151 if ( ! entry) {
152 DEBUG(0,("Out of memory!\n"));
153 return NT_STATUS_NO_MEMORY;
154 }
155 entry->name = talloc_strdup(idmap_ctx, name);
156 if ( ! entry->name) {
157 DEBUG(0,("Out of memory!\n"));
158 return NT_STATUS_NO_MEMORY;
159 }
160 entry->methods = methods;
161
162 DLIST_ADD(backends, entry);
163 DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
164 return NT_STATUS_OK;
165 }
166
167 /**********************************************************************
168 Allow a module to register itself as a method.
169 **********************************************************************/
170
171 NTSTATUS smb_register_idmap_alloc(int version, const char *name,
172 struct idmap_alloc_methods *methods)
173 {
174 struct idmap_alloc_methods *test;
175 struct idmap_alloc_backend *entry;
176
177 if (!idmap_ctx) {
178 return NT_STATUS_INTERNAL_DB_ERROR;
179 }
180
181 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
182 DEBUG(0, ("Failed to register idmap alloc module.\n"
183 "The module was compiled against "
184 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
185 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
186 "Please recompile against the current version "
187 "of samba!\n",
188 version, SMB_IDMAP_INTERFACE_VERSION));
189 return NT_STATUS_OBJECT_TYPE_MISMATCH;
190 }
191
192 if (!name || !name[0] || !methods) {
193 DEBUG(0,("Called with NULL pointer or empty name!\n"));
194 return NT_STATUS_INVALID_PARAMETER;
195 }
196
197 test = get_alloc_methods(alloc_backends, name);
198 if (test) {
199 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
200 return NT_STATUS_OBJECT_NAME_COLLISION;
201 }
202
203 entry = talloc(idmap_ctx, struct idmap_alloc_backend);
204 if ( ! entry) {
205 DEBUG(0,("Out of memory!\n"));
206 return NT_STATUS_NO_MEMORY;
207 }
208 entry->name = talloc_strdup(idmap_ctx, name);
209 if ( ! entry->name) {
210 DEBUG(0,("Out of memory!\n"));
211 return NT_STATUS_NO_MEMORY;
212 }
213 entry->methods = methods;
214
215 DLIST_ADD(alloc_backends, entry);
216 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
217 return NT_STATUS_OK;
218 }
219
220 static int close_domain_destructor(struct idmap_domain *dom)
221 {
222 NTSTATUS ret;
223
224 ret = dom->methods->close_fn(dom);
225 if (!NT_STATUS_IS_OK(ret)) {
226 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
227 }
228
229 return 0;
230 }
231
232 /**************************************************************************
233 Shutdown.
234 **************************************************************************/
235
236 NTSTATUS idmap_close(void)
237 {
238 /* close the alloc backend first before freeing idmap_ctx */
239 if (idmap_alloc_ctx) {
240 idmap_alloc_ctx->methods->close_fn();
241 idmap_alloc_ctx->methods = NULL;
242 }
243 alloc_backends = NULL;
244
245 /* this talloc_free call will fire the talloc destructors
246 * that will free all active backends resources */
247 TALLOC_FREE(idmap_ctx);
248 idmap_cache = NULL;
249 idmap_domains = NULL;
250 backends = NULL;
251
252 return NT_STATUS_OK;
253 }
254
255 /****************************************************************************
256 ****************************************************************************/
257
258 NTSTATUS idmap_init_cache(void)
259 {
260 /* Always initialize the cache. We'll have to delay initialization
261 of backends if we are offline */
262
263 if ( idmap_ctx ) {
264 return NT_STATUS_OK;
265 }
266
267 if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
268 return NT_STATUS_NO_MEMORY;
269 }
270
271 if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
272 return NT_STATUS_UNSUCCESSFUL;
273 }
274
275 return NT_STATUS_OK;
276 }
277
278 /****************************************************************************
279 ****************************************************************************/
280
281 NTSTATUS idmap_init(void)
282 {
283 NTSTATUS ret;
284 static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
285 struct idmap_domain *dom;
286 char *compat_backend = NULL;
287 char *compat_params = NULL;
288 const char **dom_list = NULL;
289 const char *default_domain = NULL;
290 char *alloc_backend = NULL;
291 BOOL default_already_defined = False;
292 BOOL pri_dom_is_in_list = False;
293 int compat = 0;
294 int i;
295
296 ret = idmap_init_cache();
297 if (!NT_STATUS_IS_OK(ret))
298 return ret;
299
300 if (NT_STATUS_IS_OK(idmap_init_status))
301 return NT_STATUS_OK;
302
303 static_init_idmap;
304
305 dom_list = lp_idmap_domains();
306
307 if ( lp_idmap_backend() ) {
308 const char **compat_list = lp_idmap_backend();
309 char *p = NULL;
310 const char *q = NULL;
311
312 if (dom_list) {
313 DEBUG(0, ("WARNING: idmap backend and idmap domains "
314 "are mutually excusive!\n"));
315 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
316 } else {
317 compat = 1;
318
319 /* strip any leading idmap_ prefix of */
320 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
321 q = *compat_list += 6;
322 DEBUG(0, ("WARNING: idmap backend uses obsolete"
323 " and deprecated 'idmap_' prefix.\n"
324 "Please replace 'idmap_%s' by '%s' in"
325 " %s\n", q, q, dyn_CONFIGFILE));
326 compat_backend = talloc_strdup(idmap_ctx, q);
327 } else {
328 compat_backend = talloc_strdup(idmap_ctx,
329 *compat_list);
330 }
331
332 if (compat_backend == NULL) {
333 ret = NT_STATUS_NO_MEMORY;
334 goto done;
335 }
336
337 /* separate the backend and module arguements */
338 if ((p = strchr(compat_backend, ':')) != NULL) {
339 *p = '\0';
340 compat_params = p + 1;
341 }
342 }
343 } else if ( !dom_list ) {
344 /* Back compatible: without idmap domains and explicit
345 idmap backend. Taking default idmap backend: tdb */
346
347 compat = 1;
348 compat_backend = talloc_strdup( idmap_ctx, "tdb");
349 compat_params = compat_backend;
350 }
351
352 if ( ! dom_list) {
353 /* generate a list with our main domain */
354 char ** dl;
355
356 dl = talloc_array(idmap_ctx, char *, 2);
357 if (dl == NULL) {
358 ret = NT_STATUS_NO_MEMORY;
359 goto done;
360 }
361 dl[0] = talloc_strdup(dl, lp_workgroup());
362 if (dl[0] == NULL) {
363 ret = NT_STATUS_NO_MEMORY;
364 goto done;
365 }
366
367 /* terminate */
368 dl[1] = NULL;
369
370 dom_list = (const char **)dl;
371 default_domain = dl[0];
372 }
373
374 /***************************
375 * initialize idmap domains
376 */
377 DEBUG(1, ("Initializing idmap domains\n"));
378
379 for (i=0, num_domains=0; dom_list[i]; i++) {
380 const char *parm_backend;
381 char *config_option;
382
383 /* ignore BUILTIN and local MACHINE domains */
384 if (strequal(dom_list[i], "BUILTIN")
385 || strequal(dom_list[i], get_global_sam_name()))
386 {
387 DEBUG(0,("idmap_init: Ignoring domain %s\n",
388 dom_list[i]));
389 continue;
390 }
391
392 if ((dom_list[i] != default_domain) &&
393 strequal(dom_list[i], lp_workgroup())) {
394 pri_dom_is_in_list = True;
395 }
396 /* init domain */
397
398 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
399 IDMAP_CHECK_ALLOC(dom);
400
401 dom->name = talloc_strdup(dom, dom_list[i]);
402 IDMAP_CHECK_ALLOC(dom->name);
403
404 config_option = talloc_asprintf(dom, "idmap config %s",
405 dom->name);
406 IDMAP_CHECK_ALLOC(config_option);
407
408 /* default or specific ? */
409
410 dom->default_domain = lp_parm_bool(-1, config_option,
411 "default", False);
412
413 if (dom->default_domain ||
414 (default_domain && strequal(dom_list[i], default_domain))) {
415
416 /* make sure this is set even when we match
417 * default_domain */
418 dom->default_domain = True;
419
420 if (default_already_defined) {
421 DEBUG(1, ("ERROR: Multiple domains defined as"
422 " default!\n"));
423 ret = NT_STATUS_INVALID_PARAMETER;
424 goto done;
425 }
426
427 default_already_defined = True;
428
429 }
430
431 dom->readonly = lp_parm_bool(-1, config_option,
432 "readonly", False);
433
434 /* find associated backend (default: tdb) */
435 if (compat) {
436 parm_backend = talloc_strdup(idmap_ctx, compat_backend);
437 } else {
438 parm_backend = talloc_strdup(idmap_ctx,
439 lp_parm_const_string(
440 -1, config_option,
441 "backend", "tdb"));
442 }
443 IDMAP_CHECK_ALLOC(parm_backend);
444
445 /* get the backend methods for this domain */
446 dom->methods = get_methods(backends, parm_backend);
447
448 if ( ! dom->methods) {
449 ret = smb_probe_module("idmap", parm_backend);
450 if (NT_STATUS_IS_OK(ret)) {
451 dom->methods = get_methods(backends,
452 parm_backend);
453 }
454 }
455 if ( ! dom->methods) {
456 DEBUG(0, ("ERROR: Could not get methods for "
457 "backend %s\n", parm_backend));
458 ret = NT_STATUS_UNSUCCESSFUL;
459 goto done;
460 }
461
462 /* check the set_mapping function exists otherwise mark the
463 * module as readonly */
464 if ( ! dom->methods->set_mapping) {
465 DEBUG(5, ("Forcing to readonly, as this module can't"
466 " store arbitrary mappings.\n"));
467 dom->readonly = True;
468 }
469
470 /* now that we have methods,
471 * set the destructor for this domain */
472 talloc_set_destructor(dom, close_domain_destructor);
473
474 if (compat_params) {
475 dom->params = talloc_strdup(dom, compat_params);
476 IDMAP_CHECK_ALLOC(dom->params);
477 } else {
478 dom->params = NULL;
479 }
480
481 /* Finally instance a backend copy for this domain */
482 ret = dom->methods->init(dom);
483 if ( ! NT_STATUS_IS_OK(ret)) {
484 DEBUG(0, ("ERROR: Initialization failed for backend "
485 "%s (domain %s), deferred!\n",
486 parm_backend, dom->name));
487 }
488 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
489 struct idmap_domain *, i+1);
490 if ( ! idmap_domains) {
491 DEBUG(0, ("Out of memory!\n"));
492 ret = NT_STATUS_NO_MEMORY;
493 goto done;
494 }
495 idmap_domains[num_domains] = dom;
496
497 /* save default domain position for future uses */
498 if (dom->default_domain) {
499 def_dom_num = num_domains;
500 }
501
502 /* Bump counter to next available slot */
503
504 num_domains++;
505
506 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
507 dom->name, parm_backend,
508 dom->default_domain?"":"not ",
509 dom->readonly?"":"not "));
510
511 talloc_free(config_option);
512 }
513
514 /* on DCs we need to add idmap_tdb as the default backend if compat is
515 * defined (when the old implicit configuration is used)
516 * This is not done in the previous loop a on member server we exclude
517 * the local domain. But on a DC the local domain is the only domain
518 * available therefore we are left with no default domain */
519 if (((lp_server_role() == ROLE_DOMAIN_PDC) ||
520 (lp_server_role() == ROLE_DOMAIN_BDC)) &&
521 ((num_domains == 0) && (compat == 1))) {
522
523 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
524 IDMAP_CHECK_ALLOC(dom);
525
526 dom->name = talloc_strdup(dom, "__default__");
527 IDMAP_CHECK_ALLOC(dom->name);
528
529 dom->default_domain = True;
530 dom->readonly = False;
531
532 /* get the backend methods for this domain */
533 dom->methods = get_methods(backends, compat_backend);
534
535 if ( ! dom->methods) {
536 ret = smb_probe_module("idmap", compat_backend);
537 if (NT_STATUS_IS_OK(ret)) {
538 dom->methods = get_methods(backends,
539 compat_backend);
540 }
541 }
542 if ( ! dom->methods) {
543 DEBUG(0, ("ERROR: Could not get methods for "
544 "backend %s\n", compat_backend));
545 ret = NT_STATUS_UNSUCCESSFUL;
546 goto done;
547 }
548
549 /* now that we have methods,
550 * set the destructor for this domain */
551 talloc_set_destructor(dom, close_domain_destructor);
552
553 dom->params = talloc_strdup(dom, compat_params);
554 IDMAP_CHECK_ALLOC(dom->params);
555
556 /* Finally instance a backend copy for this domain */
557 ret = dom->methods->init(dom);
558 if ( ! NT_STATUS_IS_OK(ret)) {
559 DEBUG(0, ("ERROR: Initialization failed for backend "
560 "%s (domain %s), deferred!\n",
561 compat_backend, dom->name));
562 }
563 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
564 struct idmap_domain *, 2);
565 if ( ! idmap_domains) {
566 DEBUG(0, ("Out of memory!\n"));
567 ret = NT_STATUS_NO_MEMORY;
568 goto done;
569 }
570 idmap_domains[num_domains] = dom;
571
572 def_dom_num = num_domains;
573
574 /* Bump counter to next available slot */
575
576 num_domains++;
577
578 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
579 dom->name, compat_backend,
580 dom->default_domain?"":"not ",
581 dom->readonly?"":"not "));
582 }
583
584 /* automatically add idmap_nss backend if needed */
585 if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
586 ( ! pri_dom_is_in_list) &&
587 lp_winbind_trusted_domains_only()) {
588
589 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
590 IDMAP_CHECK_ALLOC(dom);
591
592 dom->name = talloc_strdup(dom, lp_workgroup());
593 IDMAP_CHECK_ALLOC(dom->name);
594
595 dom->default_domain = False;
596 dom->readonly = True;
597
598 /* get the backend methods for passdb */
599 dom->methods = get_methods(backends, "nss");
600
601 /* (the nss module is always statically linked) */
602 if ( ! dom->methods) {
603 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
604 ret = NT_STATUS_UNSUCCESSFUL;
605 goto done;
606 }
607
608 /* now that we have methods,
609 * set the destructor for this domain */
610 talloc_set_destructor(dom, close_domain_destructor);
611
612 if (compat_params) {
613 dom->params = talloc_strdup(dom, compat_params);
614 IDMAP_CHECK_ALLOC(dom->params);
615 } else {
616 dom->params = NULL;
617 }
618
619 /* Finally instance a backend copy for this domain */
620 ret = dom->methods->init(dom);
621 if ( ! NT_STATUS_IS_OK(ret)) {
622 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
623 ret = NT_STATUS_UNSUCCESSFUL;
624 goto done;
625 }
626
627 idmap_domains = talloc_realloc(idmap_ctx,
628 idmap_domains,
629 struct idmap_domain *,
630 num_domains+1);
631 if ( ! idmap_domains) {
632 DEBUG(0, ("Out of memory!\n"));
633 ret = NT_STATUS_NO_MEMORY;
634 goto done;
635 }
636 idmap_domains[num_domains] = dom;
637
638 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
639 dom->name ));
640
641 num_domains++;
642 }
643
644 /**** automatically add idmap_passdb backend ****/
645 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
646 IDMAP_CHECK_ALLOC(dom);
647
648 dom->name = talloc_strdup(dom, get_global_sam_name());
649 IDMAP_CHECK_ALLOC(dom->name);
650
651 dom->default_domain = False;
652 dom->readonly = True;
653
654 /* get the backend methods for passdb */
655 dom->methods = get_methods(backends, "passdb");
656
657 /* (the passdb module is always statically linked) */
658 if ( ! dom->methods) {
659 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
660 ret = NT_STATUS_UNSUCCESSFUL;
661 goto done;
662 }
663
664 /* now that we have methods, set the destructor for this domain */
665 talloc_set_destructor(dom, close_domain_destructor);
666
667 if (compat_params) {
668 dom->params = talloc_strdup(dom, compat_params);
669 IDMAP_CHECK_ALLOC(dom->params);
670 } else {
671 dom->params = NULL;
672 }
673
674 /* Finally instance a backend copy for this domain */
675 ret = dom->methods->init(dom);
676 if ( ! NT_STATUS_IS_OK(ret)) {
677 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
678 ret = NT_STATUS_UNSUCCESSFUL;
679 goto done;
680 }
681
682 idmap_domains = talloc_realloc(idmap_ctx,
683 idmap_domains,
684 struct idmap_domain *,
685 num_domains+1);
686 if ( ! idmap_domains) {
687 DEBUG(0, ("Out of memory!\n"));
688 ret = NT_STATUS_NO_MEMORY;
689 goto done;
690 }
691 idmap_domains[num_domains] = dom;
692
693 /* needed to handle special BUILTIN and wellknown SIDs cases */
694 pdb_dom_num = num_domains;
695
696 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
697 dom->name));
698
699 num_domains++;
700 /**** finished adding idmap_passdb backend ****/
701
702 /* sort domains so that the default is the last one */
703 /* don't sort if no default domain defined */
704 if (def_dom_num != -1 && def_dom_num != num_domains-1) {
705 /* default is not last, move it */
706 struct idmap_domain *tmp;
707
708 if (pdb_dom_num > def_dom_num) {
709 pdb_dom_num --;
710
711 } else if (pdb_dom_num == def_dom_num) { /* ?? */
712 pdb_dom_num = num_domains - 1;
713 }
714
715 tmp = idmap_domains[def_dom_num];
716
717 for (i = def_dom_num; i < num_domains-1; i++) {
718 idmap_domains[i] = idmap_domains[i+1];
719 }
720 idmap_domains[i] = tmp;
721 def_dom_num = i;
722 }
723
724
725 /* Initialize alloc module */
726
727 DEBUG(3, ("Initializing idmap alloc module\n"));
728
729 alloc_backend = NULL;
730 if (compat) {
731 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
732 } else {
733 char *ab = lp_idmap_alloc_backend();
734
735 if (ab && (ab[0] != '\0')) {
736 alloc_backend = talloc_strdup(idmap_ctx,
737 lp_idmap_alloc_backend());
738 }
739 }
740
741 if ( alloc_backend ) {
742
743 idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx,
744 struct idmap_alloc_context);
745 IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
746
747 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends,
748 alloc_backend);
749 if ( ! idmap_alloc_ctx->methods) {
750 ret = smb_probe_module("idmap", alloc_backend);
751 if (NT_STATUS_IS_OK(ret)) {
752 idmap_alloc_ctx->methods =
753 get_alloc_methods(alloc_backends,
754 alloc_backend);
755 }
756 }
757 if (idmap_alloc_ctx->methods) {
758
759 if (compat_params) {
760 idmap_alloc_ctx->params =
761 talloc_strdup(idmap_alloc_ctx,
762 compat_params);
763 IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
764 } else {
765 idmap_alloc_ctx->params = NULL;
766 }
767
768 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
769 if ( ! NT_STATUS_IS_OK(ret)) {
770 DEBUG(0, ("ERROR: Initialization failed for "
771 "alloc backend %s, deferred!\n",
772 alloc_backend));
773 } else {
774 idmap_alloc_ctx->initialized = True;
775 }
776 } else {
777 DEBUG(2, ("idmap_init: Unable to get methods for "
778 "alloc backend %s\n",
779 alloc_backend));
780 /* certain compat backends are just readonly */
781 if ( compat ) {
782 TALLOC_FREE(idmap_alloc_ctx);
783 ret = NT_STATUS_OK;
784 } else {
785 ret = NT_STATUS_UNSUCCESSFUL;
786 }
787 }
788 }
789
790 /* cleanpu temporary strings */
791 TALLOC_FREE( compat_backend );
792
793 idmap_init_status = NT_STATUS_OK;
794
795 return ret;
796
797 done:
798 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
799 idmap_close();
800
801 return ret;
802 }
803
804 static NTSTATUS idmap_alloc_init(void)
805 {
806 NTSTATUS ret;
807
808 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
809 return ret;
810 }
811
812 if ( ! idmap_alloc_ctx) {
813 return NT_STATUS_NOT_SUPPORTED;
814 }
815
816 if ( ! idmap_alloc_ctx->initialized) {
817 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
818 if ( ! NT_STATUS_IS_OK(ret)) {
819 DEBUG(0, ("ERROR: Initialization failed for alloc "
820 "backend, deferred!\n"));
821 return ret;
822 } else {
823 idmap_alloc_ctx->initialized = True;
824 }
825 }
826
827 return NT_STATUS_OK;
828 }
829
830 /**************************************************************************
831 idmap allocator interface functions
832 **************************************************************************/
833
834 NTSTATUS idmap_allocate_uid(struct unixid *id)
835 {
836 NTSTATUS ret;
837
838 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
839 return ret;
840 }
841
842 id->type = ID_TYPE_UID;
843 return idmap_alloc_ctx->methods->allocate_id(id);
844 }
845
846 NTSTATUS idmap_allocate_gid(struct unixid *id)
847 {
848 NTSTATUS ret;
849
850 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
851 return ret;
852 }
853
854 id->type = ID_TYPE_GID;
855 return idmap_alloc_ctx->methods->allocate_id(id);
856 }
857
858 NTSTATUS idmap_set_uid_hwm(struct unixid *id)
859 {
860 NTSTATUS ret;
861
862 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
863 return ret;
864 }
865
866 id->type = ID_TYPE_UID;
867 return idmap_alloc_ctx->methods->set_id_hwm(id);
868 }
869
870 NTSTATUS idmap_set_gid_hwm(struct unixid *id)
871 {
872 NTSTATUS ret;
873
874 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
875 return ret;
876 }
877
878 id->type = ID_TYPE_GID;
879 return idmap_alloc_ctx->methods->set_id_hwm(id);
880 }
881
882 /******************************************************************************
883 Lookup an idmap_domain give a full user or group SID
884 ******************************************************************************/
885
886 static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
887 {
888 DOM_SID domain_sid;
889 uint32 rid;
890 struct winbindd_domain *domain = NULL;
891 int i;
892
893 /* 1. Handle BUILTIN or Special SIDs and prevent them from
894 falling into the default domain space (if we have a
895 configured passdb backend. */
896
897 if ( (pdb_dom_num != -1) &&
898 (sid_check_is_in_builtin(account_sid) ||
899 sid_check_is_in_wellknown_domain(account_sid) ||
900 sid_check_is_in_unix_groups(account_sid) ||
901 sid_check_is_in_unix_users(account_sid)) )
902 {
903 return idmap_domains[pdb_dom_num];
904 }
905
906 /* 2. Lookup the winbindd_domain from the account_sid */
907
908 sid_copy( &domain_sid, account_sid );
909 sid_split_rid( &domain_sid, &rid );
910 domain = find_domain_from_sid_noinit( &domain_sid );
911
912 for (i = 0; domain && i < num_domains; i++) {
913 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
914 return idmap_domains[i];
915 }
916 }
917
918 /* 3. Fall back to the default domain */
919
920 if ( def_dom_num != -1 ) {
921 return idmap_domains[def_dom_num];
922 }
923
924 return NULL;
925 }
926
927 /******************************************************************************
928 Lookup an index given an idmap_domain pointer
929 ******************************************************************************/
930
931 static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
932 {
933 int i;
934
935 for (i = 0; i < num_domains; i++) {
936 if ( idmap_domains[i] == id_domain )
937 return i;
938 }
939
940 return -1;
941 }
942
943
944 /*********************************************************
945 Check if creating a mapping is permitted for the domain
946 *********************************************************/
947
948 static NTSTATUS idmap_can_map(const struct id_map *map,
949 struct idmap_domain **ret_dom)
950 {
951 struct idmap_domain *dom;
952
953 /* Check we do not create mappings for our own local domain,
954 * or BUILTIN or special SIDs */
955 if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
956 sid_check_is_in_builtin(map->sid) ||
957 sid_check_is_in_wellknown_domain(map->sid)) {
958 DEBUG(10, ("We are not supposed to create mappings for "
959 "our own domains (local, builtin, specials)\n"));
960 return NT_STATUS_UNSUCCESSFUL;
961 }
962
963 /* Special check for trusted domain only = Yes */
964 if (lp_winbind_trusted_domains_only()) {
965 struct winbindd_domain *wdom = find_our_domain();
966 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
967 DEBUG(10, ("We are not supposed to create mappings for "
968 "our primary domain when <trusted domain "
969 "only> is True\n"));
970 DEBUGADD(10, ("Leave [%s] unmapped\n",
971 sid_string_static(map->sid)));
972 return NT_STATUS_UNSUCCESSFUL;
973 }
974 }
975
976 if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
977 /* huh, couldn't find a suitable domain,
978 * let's just leave it unmapped */
979 DEBUG(10, ("Could not find idmap backend for SID %s\n",
980 sid_string_static(map->sid)));
981 return NT_STATUS_NO_SUCH_DOMAIN;
982 }
983
984 if (dom->readonly) {
985 /* ouch the domain is read only,
986 * let's just leave it unmapped */
987 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
988 sid_string_static(map->sid)));
989 return NT_STATUS_UNSUCCESSFUL;
990 }
991
992 *ret_dom = dom;
993 return NT_STATUS_OK;
994 }
995
996 static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
997 {
998 NTSTATUS ret;
999 struct idmap_domain *dom;
1000
1001 /* If we are offline we cannot lookup SIDs, deny mapping */
1002 if (idmap_is_offline()) {
1003 return NT_STATUS_FILE_IS_OFFLINE;
1004 }
1005
1006 ret = idmap_can_map(map, &dom);
1007 if ( ! NT_STATUS_IS_OK(ret)) {
1008 return NT_STATUS_NONE_MAPPED;
1009 }
1010
1011 /* check if this is a valid SID and then map it */
1012 switch (map->xid.type) {
1013 case ID_TYPE_UID:
1014 ret = idmap_allocate_uid(&map->xid);
1015 if ( ! NT_STATUS_IS_OK(ret)) {
1016 /* can't allocate id, let's just leave it unmapped */
1017 DEBUG(2, ("uid allocation failed! "
1018 "Can't create mapping\n"));
1019 return NT_STATUS_NONE_MAPPED;
1020 }
1021 break;
1022 case ID_TYPE_GID:
1023 ret = idmap_allocate_gid(&map->xid);
1024 if ( ! NT_STATUS_IS_OK(ret)) {
1025 /* can't allocate id, let's just leave it unmapped */
1026 DEBUG(2, ("gid allocation failed! "
1027 "Can't create mapping\n"));
1028 return NT_STATUS_NONE_MAPPED;
1029 }
1030 break;
1031 default:
1032 /* invalid sid, let's just leave it unmapped */
1033 DEBUG(3,("idmap_new_mapping: Refusing to create a "
1034 "mapping for an unspecified ID type.\n"));
1035 return NT_STATUS_NONE_MAPPED;
1036 }
1037
1038 /* ok, got a new id, let's set a mapping */
1039 map->status = ID_MAPPED;
1040
1041 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
1042 sid_string_static(map->sid),
1043 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1044 (unsigned long)map->xid.id));
1045 ret = dom->methods->set_mapping(dom, map);
1046
1047 if ( ! NT_STATUS_IS_OK(ret)) {
1048 /* something wrong here :-( */
1049 DEBUG(2, ("Failed to commit mapping\n!"));
1050
1051 /* TODO: would it make sense to have an "unalloc_id function?" */
1052
1053 return NT_STATUS_NONE_MAPPED;
1054 }
1055
1056 return NT_STATUS_OK;
1057 }
1058
1059 static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
1060 {
1061 struct idmap_domain *dom;
1062 NTSTATUS ret;
1063
1064 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
1065 sid_string_static(map->sid),
1066 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1067 (unsigned long)map->xid.id));
1068
1069 ret = idmap_can_map(map, &dom);
1070 if ( ! NT_STATUS_IS_OK(ret)) {
1071 return ret;
1072 }
1073
1074 DEBUG(10,("set_mapping for domain %s\n", dom->name ));
1075
1076 return dom->methods->set_mapping(dom, map);
1077 }
1078
1079 static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
1080 {
1081 struct idmap_domain *dom;
1082 struct id_map **unmapped;
1083 struct id_map **_ids;
1084 TALLOC_CTX *ctx;
1085 NTSTATUS ret;
1086 int i, u, n;
1087
1088 if (!ids || !*ids) {
1089 DEBUG(1, ("Invalid list of maps\n"));
1090 return NT_STATUS_INVALID_PARAMETER;
1091 }
1092
1093 ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
1094 if ( ! ctx) {
1095 DEBUG(0, ("Out of memory!\n"));
1096 return NT_STATUS_NO_MEMORY;
1097 }
1098
1099 DEBUG(10, ("Query backends to map ids->sids\n"));
1100
1101 /* start from the default (the last one) and then if there are still
1102 * unmapped entries cycle through the others */
1103
1104 _ids = ids;
1105
1106 unmapped = NULL;
1107 for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
1108
1109 dom = idmap_domains[n];
1110
1111 DEBUG(10, ("Query sids from domain %s\n", dom->name));
1112
1113 ret = dom->methods->unixids_to_sids(dom, _ids);
1114 IDMAP_REPORT_RET(ret);
1115
1116 unmapped = NULL;
1117
1118 for (i = 0, u = 0; _ids[i]; i++) {
1119 if (_ids[i]->status != ID_MAPPED) {
1120 unmapped = talloc_realloc(ctx, unmapped,
1121 struct id_map *, u + 2);
1122 IDMAP_CHECK_ALLOC(unmapped);
1123 unmapped[u] = _ids[i];
1124 u++;
1125 }
1126 }
1127 if (unmapped) {
1128 /* terminate the unmapped list */
1129 unmapped[u] = NULL;
1130 } else { /* no more entries, get out */
1131 break;
1132 }
1133
1134 _ids = unmapped;
1135
1136 }
1137
1138 if (unmapped) {
1139 /* there are still unmapped ids,
1140 * map them to the unix users/groups domains */
1141 /* except for expired entries,
1142 * these will be returned as valid (offline mode) */
1143 for (i = 0; unmapped[i]; i++) {
1144 if (unmapped[i]->status == ID_EXPIRED) continue;
1145 switch (unmapped[i]->xid.type) {
1146 case ID_TYPE_UID:
1147 uid_to_unix_users_sid(
1148 (uid_t)unmapped[i]->xid.id,
1149 unmapped[i]->sid);
1150 unmapped[i]->status = ID_MAPPED;
1151 break;
1152 case ID_TYPE_GID:
1153 gid_to_unix_groups_sid(
1154 (gid_t)unmapped[i]->xid.id,
1155 unmapped[i]->sid);
1156 unmapped[i]->status = ID_MAPPED;
1157 break;
1158 default: /* what?! */
1159 unmapped[i]->status = ID_UNKNOWN;
1160 break;
1161 }
1162 }
1163 }
1164
1165 ret = NT_STATUS_OK;
1166
1167 done:
1168 talloc_free(ctx);
1169 return ret;
1170 }
1171
1172 static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
1173 {
1174 struct id_map ***dom_ids;
1175 struct idmap_domain *dom;
1176 TALLOC_CTX *ctx;
1177 NTSTATUS ret;
1178 int i, *counters;
1179
1180 if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
1181 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1182 return NT_STATUS_NO_MEMORY;
1183 }
1184
1185 DEBUG(10, ("Query backends to map sids->ids\n"));
1186
1187 /* split list per domain */
1188 if (num_domains == 0) {
1189 DEBUG(1, ("No domains available?\n"));
1190 return NT_STATUS_UNSUCCESSFUL;
1191 }
1192
1193 dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
1194 IDMAP_CHECK_ALLOC(dom_ids);
1195 counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
1196 IDMAP_CHECK_ALLOC(counters);
1197
1198 /* partition the requests by domain */
1199
1200 for (i = 0; ids[i]; i++) {
1201 uint32 idx;
1202
1203 if ((dom = find_idmap_domain_from_sid(ids[i]->sid)) == NULL) {
1204 /* no available idmap_domain. Move on */
1205 continue;
1206 }
1207
1208 DEBUG(10,("SID %s is being handled by %s\n",
1209 sid_string_static(ids[i]->sid),
1210 dom ? dom->name : "none" ));
1211
1212 idx = find_idmap_domain_index( dom );
1213 SMB_ASSERT( idx != -1 );
1214
1215 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
1216 struct id_map *,
1217 counters[idx] + 2);
1218 IDMAP_CHECK_ALLOC(dom_ids[idx]);
1219
1220 dom_ids[idx][counters[idx]] = ids[i];
1221 counters[idx]++;
1222 dom_ids[idx][counters[idx]] = NULL;
1223 }
1224
1225 /* All the ids have been dispatched in the right queues.
1226 Let's cycle through the filled ones */
1227
1228 for (i = 0; i < num_domains; i++) {
1229 if (dom_ids[i]) {
1230 dom = idmap_domains[i];
1231 DEBUG(10, ("Query ids from domain %s\n", dom->name));
1232 ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1233 IDMAP_REPORT_RET(ret);
1234 }
1235 }
1236
1237 /* ok all the backends have been contacted at this point */
1238 /* let's see if we have any unmapped SID left and act accordingly */
1239
1240 for (i = 0; ids[i]; i++) {
1241 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1242 * was not able to confirm/deny (offline mode) */
1243 if (ids[i]->status == ID_UNKNOWN ||
1244 ids[i]->status == ID_UNMAPPED) {
1245 /* ok this is an unmapped one, see if we can map it */
1246 ret = idmap_new_mapping(ctx, ids[i]);
1247 if (NT_STATUS_IS_OK(ret)) {
1248 /* successfully mapped */
1249 ids[i]->status = ID_MAPPED;
1250 } else
1251 if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1252 /* could not map it */
1253 ids[i]->status = ID_UNMAPPED;
1254 } else {
1255 /* Something very bad happened down there
1256 * OR we are offline */
1257 ids[i]->status = ID_UNKNOWN;
1258 }
1259 }
1260 }
1261
1262 ret = NT_STATUS_OK;
1263
1264 done:
1265 talloc_free(ctx);
1266 return ret;
1267 }
1268
1269 /**************************************************************************
1270 idmap interface functions
1271 **************************************************************************/
1272
1273 NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1274 {
1275 TALLOC_CTX *ctx;
1276 NTSTATUS ret;
1277 struct id_map **bids;
1278 int i, bi;
1279 int bn = 0;
1280
1281 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1282 return ret;
1283 }
1284
1285 if (!ids || !*ids) {
1286 DEBUG(1, ("Invalid list of maps\n"));
1287 return NT_STATUS_INVALID_PARAMETER;
1288 }
1289
1290 ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1291 if ( ! ctx) {
1292 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1293 return NT_STATUS_NO_MEMORY;
1294 }
1295
1296 /* no ids to be asked to the backends by default */
1297 bids = NULL;
1298 bi = 0;
1299
1300 for (i = 0; ids[i]; i++) {
1301
1302 if ( ! ids[i]->sid) {
1303 DEBUG(1, ("invalid null SID in id_map array"));
1304 talloc_free(ctx);
1305 return NT_STATUS_INVALID_PARAMETER;
1306 }
1307
1308 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1309
1310 if ( ! NT_STATUS_IS_OK(ret)) {
1311
1312 if ( ! bids) {
1313 /* alloc space for ids to be resolved by
1314 * backends (realloc ten by ten) */
1315 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1316 if ( ! bids) {
1317 DEBUG(1, ("Out of memory!\n"));
1318 talloc_free(ctx);
1319 return NT_STATUS_NO_MEMORY;
1320 }
1321 bn = 10;
1322 }
1323
1324 /* add this id to the ones to be retrieved
1325 * from the backends */
1326 bids[bi] = ids[i];
1327 bi++;
1328
1329 /* check if we need to allocate new space
1330 * on the rids array */
1331 if (bi == bn) {
1332 bn += 10;
1333 bids = talloc_realloc(ctx, bids,
1334 struct id_map *, bn);
1335 if ( ! bids) {
1336 DEBUG(1, ("Out of memory!\n"));
1337 talloc_free(ctx);
1338 return NT_STATUS_NO_MEMORY;
1339 }
1340 }
1341
1342 /* make sure the last element is NULL */
1343 bids[bi] = NULL;
1344 }
1345 }
1346
1347 /* let's see if there is any id mapping to be retieved
1348 * from the backends */
1349 if (bi) {
1350
1351 ret = idmap_backends_unixids_to_sids(bids);
1352 IDMAP_CHECK_RET(ret);
1353
1354 /* update the cache */
1355 for (i = 0; i < bi; i++) {
1356 if (bids[i]->status == ID_MAPPED) {
1357 ret = idmap_cache_set(idmap_cache, bids[i]);
1358 } else if (bids[i]->status == ID_EXPIRED) {
1359 /* the cache returned an expired entry and the
1360 * backend was not able to clear the situation
1361 * (offline). This handles a previous
1362 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1363 * for disconnected mode, */
1364 bids[i]->status = ID_MAPPED;
1365 } else if (bids[i]->status == ID_UNKNOWN) {
1366 /* something bad here. We were not able to
1367 * handle this for some reason, mark it as
1368 * unmapped and hope next time things will
1369 * settle down. */
1370 bids[i]->status = ID_UNMAPPED;
1371 } else { /* unmapped */
1372 ret = idmap_cache_set_negative_id(idmap_cache,
1373 bids[i]);
1374 }
1375 IDMAP_CHECK_RET(ret);
1376 }
1377 }
1378
1379 ret = NT_STATUS_OK;
1380 done:
1381 talloc_free(ctx);
1382 return ret;
1383 }
1384
1385 NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1386 {
1387 TALLOC_CTX *ctx;
1388 NTSTATUS ret;
1389 struct id_map **bids;
1390 int i, bi;
1391 int bn = 0;
1392
1393 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1394 return ret;
1395 }
1396
1397 if (!ids || !*ids) {
1398 DEBUG(1, ("Invalid list of maps\n"));
1399 return NT_STATUS_INVALID_PARAMETER;
1400 }
1401
1402 ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1403 if ( ! ctx) {
1404 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1405 return NT_STATUS_NO_MEMORY;
1406 }
1407
1408 /* no ids to be asked to the backends by default */
1409 bids = NULL;
1410 bi = 0;
1411
1412 for (i = 0; ids[i]; i++) {
1413
1414 if ( ! ids[i]->sid) {
1415 DEBUG(1, ("invalid null SID in id_map array\n"));
1416 talloc_free(ctx);
1417 return NT_STATUS_INVALID_PARAMETER;
1418 }
1419
1420 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1421
1422 if ( ! NT_STATUS_IS_OK(ret)) {
1423
1424 if ( ! bids) {
1425 /* alloc space for ids to be resolved
1426 by backends (realloc ten by ten) */
1427 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1428 if ( ! bids) {
1429 DEBUG(1, ("Out of memory!\n"));
1430 talloc_free(ctx);
1431 return NT_STATUS_NO_MEMORY;
1432 }
1433 bn = 10;
1434 }
1435
1436 /* add this id to the ones to be retrieved
1437 * from the backends */
1438 bids[bi] = ids[i];
1439 bi++;
1440
1441 /* check if we need to allocate new space
1442 * on the ids array */
1443 if (bi == bn) {
1444 bn += 10;
1445 bids = talloc_realloc(ctx, bids,
1446 struct id_map *, bn);
1447 if ( ! bids) {
1448 DEBUG(1, ("Out of memory!\n"));
1449 talloc_free(ctx);
1450 return NT_STATUS_NO_MEMORY;
1451 }
1452 }
1453
1454 /* make sure the last element is NULL */
1455 bids[bi] = NULL;
1456 }
1457 }
1458
1459 /* let's see if there is any id mapping to be retieved
1460 * from the backends */
1461 if (bids) {
1462
1463 ret = idmap_backends_sids_to_unixids(bids);
1464 IDMAP_CHECK_RET(ret);
1465
1466 /* update the cache */
1467 for (i = 0; bids[i]; i++) {
1468 if (bids[i]->status == ID_MAPPED) {
1469 ret = idmap_cache_set(idmap_cache, bids[i]);
1470 } else if (bids[i]->status == ID_EXPIRED) {
1471 /* the cache returned an expired entry and the
1472 * backend was not able to clear the situation
1473 * (offline). This handles a previous
1474 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1475 * for disconnected mode, */
1476 bids[i]->status = ID_MAPPED;
1477 } else if (bids[i]->status == ID_UNKNOWN) {
1478 /* something bad here. We were not able to
1479 * handle this for some reason, mark it as
1480 * unmapped and hope next time things will
1481 * settle down. */
1482 bids[i]->status = ID_UNMAPPED;
1483 } else { /* unmapped */
1484 ret = idmap_cache_set_negative_sid(idmap_cache,
1485 bids[i]);
1486 }
1487 IDMAP_CHECK_RET(ret);
1488 }
1489 }
1490
1491 ret = NT_STATUS_OK;
1492 done:
1493 talloc_free(ctx);
1494 return ret;
1495 }
1496
1497 NTSTATUS idmap_set_mapping(const struct id_map *id)
1498 {
1499 TALLOC_CTX *ctx;
1500 NTSTATUS ret;
1501
1502 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1503 return ret;
1504 }
1505
1506 /* sanity checks */
1507 if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1508 DEBUG(1, ("NULL SID or unmapped entry\n"));
1509 return NT_STATUS_INVALID_PARAMETER;
1510 }
1511
1512 /* TODO: check uid/gid range ? */
1513
1514 ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1515 if ( ! ctx) {
1516 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1517 return NT_STATUS_NO_MEMORY;
1518 }
1519
1520 /* set the new mapping */
1521 ret = idmap_backends_set_mapping(id);
1522 IDMAP_CHECK_RET(ret);
1523
1524 /* set the mapping in the cache */
1525 ret = idmap_cache_set(idmap_cache, id);
1526 IDMAP_CHECK_RET(ret);
1527
1528 done:
1529 talloc_free(ctx);
1530 return ret;
1531 }
1532
1533 /**************************************************************************
1534 Dump backend status.
1535 **************************************************************************/
1536
1537 void idmap_dump_maps(char *logfile)
1538 {
1539 NTSTATUS ret;
1540 struct unixid allid;
1541 struct id_map *maps;
1542 int num_maps;
1543 FILE *dump;
1544 int i;
1545
1546 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1547 return;
1548 }
1549
1550 dump = fopen(logfile, "w");
1551 if ( ! dump) {
1552 DEBUG(0, ("Unable to open open stream for file [%s], "
1553 "errno: %d\n", logfile, errno));
1554 return;
1555 }
1556
1557 if (NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
1558 allid.type = ID_TYPE_UID;
1559 allid.id = 0;
1560 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1561 fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
1562
1563 allid.type = ID_TYPE_GID;
1564 allid.id = 0;
1565 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1566 fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
1567 }
1568
1569 maps = talloc(idmap_ctx, struct id_map);
1570 num_maps = 0;
1571
1572 for (i = 0; i < num_domains; i++) {
1573 if (idmap_domains[i]->methods->dump_data) {
1574 idmap_domains[i]->methods->dump_data(idmap_domains[i],
1575 &maps, &num_maps);
1576 }
1577 }
1578
1579 for (i = 0; i < num_maps; i++) {
1580 switch (maps[i].xid.type) {
1581 case ID_TYPE_UID:
1582 fprintf(dump, "UID %lu %s\n",
1583 (unsigned long)maps[i].xid.id,
1584 sid_string_static(maps[i].sid));
1585 break;
1586 case ID_TYPE_GID:
1587 fprintf(dump, "GID %lu %s\n",
1588 (unsigned long)maps[i].xid.id,
1589 sid_string_static(maps[i].sid));
1590 break;
1591 case ID_TYPE_NOT_SPECIFIED:
1592 break;
1593 }
1594 }
1595
1596 fflush(dump);
1597 fclose(dump);
1598 }
1599
1600 char *idmap_fetch_secret(const char *backend, bool alloc,
1601 const char *domain, const char *identity)
1602 {
1603 char *tmp, *ret;
1604 int r;
1605
1606 if (alloc) {
1607 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1608 } else {
1609 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1610 }
1611
1612 if (r < 0)
1613 return NULL;
1614
1615 strupper_m(tmp); /* make sure the key is case insensitive */
1616 ret = secrets_fetch_generic(tmp, identity);
1617
1618 SAFE_FREE(tmp);
1619
1620 return ret;
1621 }
1622
Samba GIT mirror