source3/winbindd/idmap_rid.c

   1 /*
   2  *  idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
   3  *  Copyright (C) Guenther Deschner, 2004
   4  *  Copyright (C) Sumit Bose, 2004
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "includes.h"
  22 #include "winbindd.h"
  23 #include "idmap.h"
  24 #include "../libcli/security/dom_sid.h"
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_IDMAP
  28
  29 struct idmap_rid_context {
  30         uint32_t base_rid;
  31 };
  32
  33 /******************************************************************************
  34   compat params can't be used because of the completely different way
  35   we support multiple domains in the new idmap
  36  *****************************************************************************/
  37
  38 static NTSTATUS idmap_rid_initialize(struct idmap_domain *dom)
  39 {
  40         NTSTATUS ret;
  41         struct idmap_rid_context *ctx;
  42         char *config_option = NULL;
  43
  44         ctx = talloc_zero(dom, struct idmap_rid_context);
  45         if (ctx == NULL) {
  46                 DEBUG(0, ("Out of memory!\n"));
  47                 return NT_STATUS_NO_MEMORY;
  48         }
  49
  50         config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
  51         if ( ! config_option) {
  52                 DEBUG(0, ("Out of memory!\n"));
  53                 ret = NT_STATUS_NO_MEMORY;
  54                 goto failed;
  55         }
  56
  57         ctx->base_rid = lp_parm_int(-1, config_option, "base_rid", 0);
  58
  59         dom->private_data = ctx;
  60
  61         talloc_free(config_option);
  62         return NT_STATUS_OK;
  63
  64 failed:
  65         talloc_free(ctx);
  66         return ret;
  67 }
  68
  69 static NTSTATUS idmap_rid_id_to_sid(struct idmap_domain *dom, struct id_map *map)
  70 {
  71         struct winbindd_domain *domain;
  72         struct idmap_rid_context *ctx;
  73
  74         ctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
  75
  76         /* apply filters before checking */
  77         if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
  78                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
  79                                 map->xid.id, dom->low_id, dom->high_id));
  80                 return NT_STATUS_NONE_MAPPED;
  81         }
  82
  83         domain = find_domain_from_name_noinit(dom->name);
  84         if (domain == NULL ) {
  85                 return NT_STATUS_NO_SUCH_DOMAIN;
  86         }
  87
  88         sid_compose(map->sid, &domain->sid, map->xid.id - dom->low_id + ctx->base_rid);
  89
  90         /* We **really** should have some way of validating
  91            the SID exists and is the correct type here.  But
  92            that is a deficiency in the idmap_rid design. */
  93
  94         map->status = ID_MAPPED;
  95         map->xid.type = ID_TYPE_BOTH;
  96
  97         return NT_STATUS_OK;
  98 }
  99
 100 /**********************************
 101  Single sid to id lookup function.
 102 **********************************/
 103
 104 static NTSTATUS idmap_rid_sid_to_id(struct idmap_domain *dom, struct id_map *map)
 105 {
 106         uint32_t rid;
 107         struct idmap_rid_context *ctx;
 108
 109         ctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
 110
 111         sid_peek_rid(map->sid, &rid);
 112         map->xid.id = rid - ctx->base_rid + dom->low_id;
 113         map->xid.type = ID_TYPE_BOTH;
 114
 115         /* apply filters before returning result */
 116
 117         if (!idmap_unix_id_is_in_range(map->xid.id, dom)) {
 118                 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 119                                 map->xid.id, dom->low_id, dom->high_id));
 120                 map->status = ID_UNMAPPED;
 121                 return NT_STATUS_NONE_MAPPED;
 122         }
 123
 124         map->status = ID_MAPPED;
 125
 126         return NT_STATUS_OK;
 127 }
 128
 129 /**********************************
 130  lookup a set of unix ids.
 131 **********************************/
 132
 133 static NTSTATUS idmap_rid_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 134 {
 135         NTSTATUS ret;
 136         int i;
 137
 138         /* initialize the status to avoid suprise */
 139         for (i = 0; ids[i]; i++) {
 140                 ids[i]->status = ID_UNKNOWN;
 141         }
 142
 143         for (i = 0; ids[i]; i++) {
 144
 145                 ret = idmap_rid_id_to_sid(dom, ids[i]);
 146
 147                 if (( ! NT_STATUS_IS_OK(ret)) &&
 148                     ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 149                         /* some fatal error occurred, log it */
 150                         DEBUG(3, ("Unexpected error resolving an ID (%d)\n", ids[i]->xid.id));
 151                 }
 152         }
 153
 154         return NT_STATUS_OK;
 155 }
 156
 157 /**********************************
 158  lookup a set of sids.
 159 **********************************/
 160
 161 static NTSTATUS idmap_rid_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 162 {
 163         NTSTATUS ret;
 164         int i;
 165
 166         /* initialize the status to avoid suprise */
 167         for (i = 0; ids[i]; i++) {
 168                 ids[i]->status = ID_UNKNOWN;
 169         }
 170
 171         for (i = 0; ids[i]; i++) {
 172
 173                 ret = idmap_rid_sid_to_id(dom, ids[i]);
 174
 175                 if (( ! NT_STATUS_IS_OK(ret)) &&
 176                     ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 177                         /* some fatal error occurred, log it */
 178                         DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
 179                                   sid_string_dbg(ids[i]->sid)));
 180                 }
 181         }
 182
 183         return NT_STATUS_OK;
 184 }
 185
 186 static struct idmap_methods rid_methods = {
 187         .init = idmap_rid_initialize,
 188         .unixids_to_sids = idmap_rid_unixids_to_sids,
 189         .sids_to_unixids = idmap_rid_sids_to_unixids,
 190 };
 191
 192 NTSTATUS samba_init_module(void)
 193 {
 194         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "rid", &rid_methods);
 195 }
 196