?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:build: fix typo in definition of --enable-external-libtdb
[Samba/gbeck.git] / source3 / groupdb / mapping_tdb.c
blob548d3a31c7ba24314018da4b46eea2f5d205f4f3
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2006,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "system/filesys.h"
25 #include "passdb.h"
26 #include "groupdb/mapping.h"
27 #include "dbwrap.h"
28 #include "../libcli/security/security.h"
29
30 static struct db_context *db; /* used for driver files */
31
32 static bool enum_group_mapping(const struct dom_sid *domsid,
33 enum lsa_SidType sid_name_use,
34 GROUP_MAP **pp_rmap,
35 size_t *p_num_entries,
36 bool unix_only);
37 static bool group_map_remove(const struct dom_sid *sid);
38
39 static bool mapping_switch(const char *ldb_path);
40
41 /****************************************************************************
42 Open the group mapping tdb.
43 ****************************************************************************/
44 static bool init_group_mapping(void)
45 {
46 const char *ldb_path;
47
48 if (db != NULL) {
49 return true;
50 }
51
52 db = db_open(NULL, state_path("group_mapping.tdb"), 0,
53 TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
54 if (db == NULL) {
55 DEBUG(0, ("Failed to open group mapping database: %s\n",
56 strerror(errno)));
57 return false;
58 }
59
60 ldb_path = state_path("group_mapping.ldb");
61 if (file_exist(ldb_path) && !mapping_switch(ldb_path)) {
62 unlink(state_path("group_mapping.tdb"));
63 return false;
64
65 } else {
66 /* handle upgrade from old versions of the database */
67 #if 0 /* -- Needs conversion to dbwrap -- */
68 const char *vstring = "INFO/version";
69 int32 vers_id;
70 GROUP_MAP *map_table = NULL;
71 size_t num_entries = 0;
72
73 /* handle a Samba upgrade */
74 tdb_lock_bystring(tdb, vstring);
75
76 /* Cope with byte-reversed older versions of the db. */
77 vers_id = tdb_fetch_int32(tdb, vstring);
78 if ((vers_id == DATABASE_VERSION_V1)
79 || (IREV(vers_id) == DATABASE_VERSION_V1)) {
80 /*
81 * Written on a bigendian machine with old fetch_int
82 * code. Save as le.
83 */
84 tdb_store_int32(tdb, vstring, DATABASE_VERSION_V2);
85 vers_id = DATABASE_VERSION_V2;
86 }
87
88 /* if its an unknown version we remove everthing in the db */
89
90 if (vers_id != DATABASE_VERSION_V2) {
91 tdb_wipe_all(tdb);
92 tdb_store_int32(tdb, vstring, DATABASE_VERSION_V2);
93 }
94
95 tdb_unlock_bystring(tdb, vstring);
96
97 /* cleanup any map entries with a gid == -1 */
98
99 if ( enum_group_mapping( NULL, SID_NAME_UNKNOWN, &map_table,
100 &num_entries, False ) ) {
101 int i;
102
103 for ( i=0; i<num_entries; i++ ) {
104 if ( map_table[i].gid == -1 ) {
105 group_map_remove( &map_table[i].sid );
106 }
107 }
108
109 SAFE_FREE( map_table );
110 }
111 #endif
112 }
113 return true;
114 }
115
116 static char *group_mapping_key(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
117 {
118 char *sidstr, *result;
119
120 sidstr = sid_string_talloc(talloc_tos(), sid);
121 if (sidstr == NULL) {
122 return NULL;
123 }
124
125 result = talloc_asprintf(mem_ctx, "%s%s", GROUP_PREFIX, sidstr);
126
127 TALLOC_FREE(sidstr);
128 return result;
129 }
130
131 /****************************************************************************
132 ****************************************************************************/
133 static bool add_mapping_entry(GROUP_MAP *map, int flag)
134 {
135 char *key, *buf;
136 int len;
137 NTSTATUS status;
138
139 key = group_mapping_key(talloc_tos(), &map->sid);
140 if (key == NULL) {
141 return false;
142 }
143
144 len = tdb_pack(NULL, 0, "ddff",
145 map->gid, map->sid_name_use, map->nt_name, map->comment);
146
147 buf = TALLOC_ARRAY(key, char, len);
148 if (!buf) {
149 TALLOC_FREE(key);
150 return false;
151 }
152 len = tdb_pack((uint8 *)buf, len, "ddff", map->gid,
153 map->sid_name_use, map->nt_name, map->comment);
154
155 status = dbwrap_trans_store(
156 db, string_term_tdb_data(key),
157 make_tdb_data((uint8_t *)buf, len), TDB_REPLACE);
158
159 TALLOC_FREE(key);
160
161 return NT_STATUS_IS_OK(status);
162 }
163
164
165 /****************************************************************************
166 Return the sid and the type of the unix group.
167 ****************************************************************************/
168
169 static bool get_group_map_from_sid(struct dom_sid sid, GROUP_MAP *map)
170 {
171 TDB_DATA dbuf;
172 char *key;
173 int ret = 0;
174
175 /* the key is the SID, retrieving is direct */
176
177 key = group_mapping_key(talloc_tos(), &sid);
178 if (key == NULL) {
179 return false;
180 }
181
182 dbuf = dbwrap_fetch_bystring(db, key, key);
183 if (dbuf.dptr == NULL) {
184 TALLOC_FREE(key);
185 return false;
186 }
187
188 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
189 &map->gid, &map->sid_name_use,
190 &map->nt_name, &map->comment);
191
192 TALLOC_FREE(key);
193
194 if ( ret == -1 ) {
195 DEBUG(3,("get_group_map_from_sid: tdb_unpack failure\n"));
196 return false;
197 }
198
199 sid_copy(&map->sid, &sid);
200
201 return true;
202 }
203
204 static bool dbrec2map(const struct db_record *rec, GROUP_MAP *map)
205 {
206 if ((rec->key.dsize < strlen(GROUP_PREFIX))
207 || (strncmp((char *)rec->key.dptr, GROUP_PREFIX,
208 GROUP_PREFIX_LEN) != 0)) {
209 return False;
210 }
211
212 if (!string_to_sid(&map->sid, (const char *)rec->key.dptr
213 + GROUP_PREFIX_LEN)) {
214 return False;
215 }
216
217 return tdb_unpack(rec->value.dptr, rec->value.dsize, "ddff",
218 &map->gid, &map->sid_name_use, &map->nt_name,
219 &map->comment) != -1;
220 }
221
222 struct find_map_state {
223 bool found;
224 const char *name; /* If != NULL, look for name */
225 gid_t gid; /* valid iff name == NULL */
226 GROUP_MAP *map;
227 };
228
229 static int find_map(struct db_record *rec, void *private_data)
230 {
231 struct find_map_state *state = (struct find_map_state *)private_data;
232
233 if (!dbrec2map(rec, state->map)) {
234 DEBUG(10, ("failed to unpack map\n"));
235 return 0;
236 }
237
238 if (state->name != NULL) {
239 if (strequal(state->name, state->map->nt_name)) {
240 state->found = true;
241 return 1;
242 }
243 }
244 else {
245 if (state->map->gid == state->gid) {
246 state->found = true;
247 return 1;
248 }
249 }
250
251 return 0;
252 }
253
254 /****************************************************************************
255 Return the sid and the type of the unix group.
256 ****************************************************************************/
257
258 static bool get_group_map_from_gid(gid_t gid, GROUP_MAP *map)
259 {
260 struct find_map_state state;
261
262 state.found = false;
263 state.name = NULL; /* Indicate we're looking for gid */
264 state.gid = gid;
265 state.map = map;
266
267 db->traverse_read(db, find_map, (void *)&state);
268
269 return state.found;
270 }
271
272 /****************************************************************************
273 Return the sid and the type of the unix group.
274 ****************************************************************************/
275
276 static bool get_group_map_from_ntname(const char *name, GROUP_MAP *map)
277 {
278 struct find_map_state state;
279
280 state.found = false;
281 state.name = name;
282 state.map = map;
283
284 db->traverse_read(db, find_map, (void *)&state);
285
286 return state.found;
287 }
288
289 /****************************************************************************
290 Remove a group mapping entry.
291 ****************************************************************************/
292
293 static bool group_map_remove(const struct dom_sid *sid)
294 {
295 char *key;
296 NTSTATUS status;
297
298 key = group_mapping_key(talloc_tos(), sid);
299 if (key == NULL) {
300 return false;
301 }
302
303 status = dbwrap_trans_delete(db, string_term_tdb_data(key));
304
305 TALLOC_FREE(key);
306 return NT_STATUS_IS_OK(status);
307 }
308
309 /****************************************************************************
310 Enumerate the group mapping.
311 ****************************************************************************/
312
313 struct enum_map_state {
314 const struct dom_sid *domsid;
315 enum lsa_SidType sid_name_use;
316 bool unix_only;
317
318 size_t num_maps;
319 GROUP_MAP *maps;
320 };
321
322 static int collect_map(struct db_record *rec, void *private_data)
323 {
324 struct enum_map_state *state = (struct enum_map_state *)private_data;
325 GROUP_MAP map;
326 GROUP_MAP *tmp;
327
328 if (!dbrec2map(rec, &map)) {
329 return 0;
330 }
331 /* list only the type or everything if UNKNOWN */
332 if (state->sid_name_use != SID_NAME_UNKNOWN
333 && state->sid_name_use != map.sid_name_use) {
334 DEBUG(11,("enum_group_mapping: group %s is not of the "
335 "requested type\n", map.nt_name));
336 return 0;
337 }
338
339 if ((state->unix_only == ENUM_ONLY_MAPPED) && (map.gid == -1)) {
340 DEBUG(11,("enum_group_mapping: group %s is non mapped\n",
341 map.nt_name));
342 return 0;
343 }
344
345 if ((state->domsid != NULL) &&
346 (dom_sid_compare_domain(state->domsid, &map.sid) != 0)) {
347 DEBUG(11,("enum_group_mapping: group %s is not in domain\n",
348 sid_string_dbg(&map.sid)));
349 return 0;
350 }
351
352 if (!(tmp = SMB_REALLOC_ARRAY(state->maps, GROUP_MAP,
353 state->num_maps+1))) {
354 DEBUG(0,("enum_group_mapping: Unable to enlarge group "
355 "map!\n"));
356 return 1;
357 }
358
359 state->maps = tmp;
360 state->maps[state->num_maps] = map;
361 state->num_maps++;
362 return 0;
363 }
364
365 static bool enum_group_mapping(const struct dom_sid *domsid,
366 enum lsa_SidType sid_name_use,
367 GROUP_MAP **pp_rmap,
368 size_t *p_num_entries, bool unix_only)
369 {
370 struct enum_map_state state;
371
372 state.domsid = domsid;
373 state.sid_name_use = sid_name_use;
374 state.unix_only = unix_only;
375 state.num_maps = 0;
376 state.maps = NULL;
377
378 if (db->traverse_read(db, collect_map, (void *)&state) < 0) {
379 return false;
380 }
381
382 *pp_rmap = state.maps;
383 *p_num_entries = state.num_maps;
384
385 return true;
386 }
387
388 /* This operation happens on session setup, so it should better be fast. We
389 * store a list of aliases a SID is member of hanging off MEMBEROF/SID. */
390
391 static NTSTATUS one_alias_membership(const struct dom_sid *member,
392 struct dom_sid **sids, size_t *num)
393 {
394 fstring tmp;
395 fstring key;
396 char *string_sid;
397 TDB_DATA dbuf;
398 const char *p;
399 NTSTATUS status = NT_STATUS_OK;
400 TALLOC_CTX *frame = talloc_stackframe();
401
402 slprintf(key, sizeof(key), "%s%s", MEMBEROF_PREFIX,
403 sid_to_fstring(tmp, member));
404
405 dbuf = dbwrap_fetch_bystring(db, frame, key);
406 if (dbuf.dptr == NULL) {
407 TALLOC_FREE(frame);
408 return NT_STATUS_OK;
409 }
410
411 p = (const char *)dbuf.dptr;
412
413 while (next_token_talloc(frame, &p, &string_sid, " ")) {
414 struct dom_sid alias;
415 uint32_t num_sids;
416
417 if (!string_to_sid(&alias, string_sid))
418 continue;
419
420 num_sids = *num;
421 status= add_sid_to_array_unique(NULL, &alias, sids, &num_sids);
422 if (!NT_STATUS_IS_OK(status)) {
423 goto done;
424 }
425 *num = num_sids;
426 }
427
428 done:
429 TALLOC_FREE(frame);
430 return status;
431 }
432
433 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
434 struct dom_sid **sids, size_t *num)
435 {
436 size_t i;
437
438 *num = 0;
439 *sids = NULL;
440
441 for (i=0; i<num_members; i++) {
442 NTSTATUS status = one_alias_membership(&members[i], sids, num);
443 if (!NT_STATUS_IS_OK(status))
444 return status;
445 }
446 return NT_STATUS_OK;
447 }
448
449 static bool is_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
450 {
451 struct dom_sid *sids;
452 size_t i;
453 size_t num;
454
455 /* This feels the wrong way round, but the on-disk data structure
456 * dictates it this way. */
457 if (!NT_STATUS_IS_OK(alias_memberships(member, 1, &sids, &num)))
458 return False;
459
460 for (i=0; i<num; i++) {
461 if (dom_sid_compare(alias, &sids[i]) == 0) {
462 TALLOC_FREE(sids);
463 return True;
464 }
465 }
466 TALLOC_FREE(sids);
467 return False;
468 }
469
470
471 static NTSTATUS add_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
472 {
473 GROUP_MAP map;
474 char *key;
475 fstring string_sid;
476 char *new_memberstring;
477 struct db_record *rec;
478 NTSTATUS status;
479
480 if (!get_group_map_from_sid(*alias, &map))
481 return NT_STATUS_NO_SUCH_ALIAS;
482
483 if ( (map.sid_name_use != SID_NAME_ALIAS) &&
484 (map.sid_name_use != SID_NAME_WKN_GRP) )
485 return NT_STATUS_NO_SUCH_ALIAS;
486
487 if (is_aliasmem(alias, member))
488 return NT_STATUS_MEMBER_IN_ALIAS;
489
490 sid_to_fstring(string_sid, member);
491
492 key = talloc_asprintf(talloc_tos(), "%s%s", MEMBEROF_PREFIX,
493 string_sid);
494 if (key == NULL) {
495 return NT_STATUS_NO_MEMORY;
496 }
497
498 if (db->transaction_start(db) != 0) {
499 DEBUG(0, ("transaction_start failed\n"));
500 return NT_STATUS_INTERNAL_DB_CORRUPTION;
501 }
502
503 rec = db->fetch_locked(db, key, string_term_tdb_data(key));
504
505 if (rec == NULL) {
506 DEBUG(10, ("fetch_lock failed\n"));
507 TALLOC_FREE(key);
508 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
509 goto cancel;
510 }
511
512 sid_to_fstring(string_sid, alias);
513
514 if (rec->value.dptr != NULL) {
515 new_memberstring = talloc_asprintf(
516 key, "%s %s", (char *)(rec->value.dptr), string_sid);
517 } else {
518 new_memberstring = talloc_strdup(key, string_sid);
519 }
520
521 if (new_memberstring == NULL) {
522 TALLOC_FREE(key);
523 status = NT_STATUS_NO_MEMORY;
524 goto cancel;
525 }
526
527 status = rec->store(rec, string_term_tdb_data(new_memberstring), 0);
528
529 TALLOC_FREE(key);
530
531 if (!NT_STATUS_IS_OK(status)) {
532 DEBUG(10, ("Could not store record: %s\n", nt_errstr(status)));
533 goto cancel;
534 }
535
536 if (db->transaction_commit(db) != 0) {
537 DEBUG(0, ("transaction_commit failed\n"));
538 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
539 return status;
540 }
541
542 return NT_STATUS_OK;
543
544 cancel:
545 if (db->transaction_cancel(db) != 0) {
546 smb_panic("transaction_cancel failed");
547 }
548
549 return status;
550 }
551
552 struct aliasmem_state {
553 TALLOC_CTX *mem_ctx;
554 const struct dom_sid *alias;
555 struct dom_sid **sids;
556 size_t *num;
557 };
558
559 static int collect_aliasmem(struct db_record *rec, void *priv)
560 {
561 struct aliasmem_state *state = (struct aliasmem_state *)priv;
562 const char *p;
563 char *alias_string;
564 TALLOC_CTX *frame;
565
566 if (strncmp((const char *)rec->key.dptr, MEMBEROF_PREFIX,
567 MEMBEROF_PREFIX_LEN) != 0)
568 return 0;
569
570 p = (const char *)rec->value.dptr;
571
572 frame = talloc_stackframe();
573
574 while (next_token_talloc(frame, &p, &alias_string, " ")) {
575 struct dom_sid alias, member;
576 const char *member_string;
577 uint32_t num_sids;
578
579 if (!string_to_sid(&alias, alias_string))
580 continue;
581
582 if (dom_sid_compare(state->alias, &alias) != 0)
583 continue;
584
585 /* Ok, we found the alias we're looking for in the membership
586 * list currently scanned. The key represents the alias
587 * member. Add that. */
588
589 member_string = strchr((const char *)rec->key.dptr, '/');
590
591 /* Above we tested for MEMBEROF_PREFIX which includes the
592 * slash. */
593
594 SMB_ASSERT(member_string != NULL);
595 member_string += 1;
596
597 if (!string_to_sid(&member, member_string))
598 continue;
599
600 num_sids = *state->num;
601 if (!NT_STATUS_IS_OK(add_sid_to_array(state->mem_ctx, &member,
602 state->sids,
603 &num_sids)))
604 {
605 /* talloc fail. */
606 break;
607 }
608 *state->num = num_sids;
609 }
610
611 TALLOC_FREE(frame);
612 return 0;
613 }
614
615 static NTSTATUS enum_aliasmem(const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
616 struct dom_sid **sids, size_t *num)
617 {
618 GROUP_MAP map;
619 struct aliasmem_state state;
620
621 if (!get_group_map_from_sid(*alias, &map))
622 return NT_STATUS_NO_SUCH_ALIAS;
623
624 if ( (map.sid_name_use != SID_NAME_ALIAS) &&
625 (map.sid_name_use != SID_NAME_WKN_GRP) )
626 return NT_STATUS_NO_SUCH_ALIAS;
627
628 *sids = NULL;
629 *num = 0;
630
631 state.alias = alias;
632 state.sids = sids;
633 state.num = num;
634 state.mem_ctx = mem_ctx;
635
636 db->traverse_read(db, collect_aliasmem, &state);
637 return NT_STATUS_OK;
638 }
639
640 static NTSTATUS del_aliasmem(const struct dom_sid *alias, const struct dom_sid *member)
641 {
642 NTSTATUS status;
643 struct dom_sid *sids;
644 size_t i, num;
645 bool found = False;
646 char *member_string;
647 char *key;
648 fstring sid_string;
649
650 if (db->transaction_start(db) != 0) {
651 DEBUG(0, ("transaction_start failed\n"));
652 return NT_STATUS_INTERNAL_DB_CORRUPTION;
653 }
654
655 status = alias_memberships(member, 1, &sids, &num);
656
657 if (!NT_STATUS_IS_OK(status)) {
658 goto cancel;
659 }
660
661 for (i=0; i<num; i++) {
662 if (dom_sid_compare(&sids[i], alias) == 0) {
663 found = True;
664 break;
665 }
666 }
667
668 if (!found) {
669 TALLOC_FREE(sids);
670 status = NT_STATUS_MEMBER_NOT_IN_ALIAS;
671 goto cancel;
672 }
673
674 if (i < num)
675 sids[i] = sids[num-1];
676
677 num -= 1;
678
679 sid_to_fstring(sid_string, member);
680
681 key = talloc_asprintf(sids, "%s%s", MEMBEROF_PREFIX, sid_string);
682 if (key == NULL) {
683 TALLOC_FREE(sids);
684 status = NT_STATUS_NO_MEMORY;
685 goto cancel;
686 }
687
688 if (num == 0) {
689 status = dbwrap_delete_bystring(db, key);
690 goto commit;
691 }
692
693 member_string = talloc_strdup(sids, "");
694 if (member_string == NULL) {
695 TALLOC_FREE(sids);
696 status = NT_STATUS_NO_MEMORY;
697 goto cancel;
698 }
699
700 for (i=0; i<num; i++) {
701
702 sid_to_fstring(sid_string, &sids[i]);
703
704 member_string = talloc_asprintf_append_buffer(
705 member_string, " %s", sid_string);
706
707 if (member_string == NULL) {
708 TALLOC_FREE(sids);
709 status = NT_STATUS_NO_MEMORY;
710 goto cancel;
711 }
712 }
713
714 status = dbwrap_store_bystring(
715 db, key, string_term_tdb_data(member_string), 0);
716 commit:
717 TALLOC_FREE(sids);
718
719 if (!NT_STATUS_IS_OK(status)) {
720 DEBUG(10, ("dbwrap_store_bystring failed: %s\n",
721 nt_errstr(status)));
722 goto cancel;
723 }
724
725 if (db->transaction_commit(db) != 0) {
726 DEBUG(0, ("transaction_commit failed\n"));
727 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
728 return status;
729 }
730
731 return NT_STATUS_OK;
732
733 cancel:
734 if (db->transaction_cancel(db) != 0) {
735 smb_panic("transaction_cancel failed");
736 }
737 return status;
738 }
739
740
741 /* -- ldb->tdb switching code -------------------------------------------- */
742
743 /* change this if the data format ever changes */
744 #define LTDB_PACKING_FORMAT 0x26011967
745
746 /* old packing formats (not supported for now,
747 * it was never used for group mapping AFAIK) */
748 #define LTDB_PACKING_FORMAT_NODN 0x26011966
749
750 static unsigned int pull_uint32(uint8_t *p, int ofs)
751 {
752 p += ofs;
753 return p[0] | (p[1]<<8) | (p[2]<<16) | (p[3]<<24);
754 }
755
756 /*
757 unpack a ldb message from a linear buffer in TDB_DATA
758 */
759 static int convert_ldb_record(TDB_CONTEXT *ltdb, TDB_DATA key,
760 TDB_DATA data, void *ptr)
761 {
762 TALLOC_CTX *tmp_ctx = talloc_tos();
763 GROUP_MAP map;
764 uint8_t *p;
765 uint32_t format;
766 uint32_t num_el;
767 unsigned int remaining;
768 unsigned int i, j;
769 size_t len;
770 char *name;
771 char *val;
772 char *q;
773 uint32_t num_mem = 0;
774 struct dom_sid *members = NULL;
775
776 p = (uint8_t *)data.dptr;
777 if (data.dsize < 8) {
778 errno = EIO;
779 goto failed;
780 }
781
782 format = pull_uint32(p, 0);
783 num_el = pull_uint32(p, 4);
784 p += 8;
785
786 remaining = data.dsize - 8;
787
788 switch (format) {
789 case LTDB_PACKING_FORMAT:
790 len = strnlen((char *)p, remaining);
791 if (len == remaining) {
792 errno = EIO;
793 goto failed;
794 }
795
796 if (*p == '@') {
797 /* ignore special LDB attributes */
798 return 0;
799 }
800
801 if (strncmp((char *)p, "rid=", 4)) {
802 /* unknown entry, ignore */
803 DEBUG(3, ("Found unknown entry in group mapping "
804 "database named [%s]\n", (char *)p));
805 return 0;
806 }
807
808 remaining -= len + 1;
809 p += len + 1;
810 break;
811
812 case LTDB_PACKING_FORMAT_NODN:
813 default:
814 errno = EIO;
815 goto failed;
816 }
817
818 if (num_el == 0) {
819 /* bad entry, ignore */
820 return 0;
821 }
822
823 if (num_el > remaining / 6) {
824 errno = EIO;
825 goto failed;
826 }
827
828 ZERO_STRUCT(map);
829
830 for (i = 0; i < num_el; i++) {
831 uint32_t num_vals;
832
833 if (remaining < 10) {
834 errno = EIO;
835 goto failed;
836 }
837 len = strnlen((char *)p, remaining - 6);
838 if (len == remaining - 6) {
839 errno = EIO;
840 goto failed;
841 }
842 name = talloc_strndup(tmp_ctx, (char *)p, len);
843 if (name == NULL) {
844 errno = ENOMEM;
845 goto failed;
846 }
847 remaining -= len + 1;
848 p += len + 1;
849
850 num_vals = pull_uint32(p, 0);
851 if (StrCaseCmp(name, "member") == 0) {
852 num_mem = num_vals;
853 members = talloc_array(tmp_ctx, struct dom_sid, num_mem);
854 if (members == NULL) {
855 errno = ENOMEM;
856 goto failed;
857 }
858 } else if (num_vals != 1) {
859 errno = EIO;
860 goto failed;
861 }
862
863 p += 4;
864 remaining -= 4;
865
866 for (j = 0; j < num_vals; j++) {
867 len = pull_uint32(p, 0);
868 if (len > remaining-5) {
869 errno = EIO;
870 goto failed;
871 }
872
873 val = talloc_strndup(tmp_ctx, (char *)(p + 4), len);
874 if (val == NULL) {
875 errno = ENOMEM;
876 goto failed;
877 }
878
879 remaining -= len+4+1;
880 p += len+4+1;
881
882 /* we ignore unknown or uninteresting attributes
883 * (objectclass, etc.) */
884 if (StrCaseCmp(name, "gidNumber") == 0) {
885 map.gid = strtoul(val, &q, 10);
886 if (*q) {
887 errno = EIO;
888 goto failed;
889 }
890 } else if (StrCaseCmp(name, "sid") == 0) {
891 if (!string_to_sid(&map.sid, val)) {
892 errno = EIO;
893 goto failed;
894 }
895 } else if (StrCaseCmp(name, "sidNameUse") == 0) {
896 map.sid_name_use = strtoul(val, &q, 10);
897 if (*q) {
898 errno = EIO;
899 goto failed;
900 }
901 } else if (StrCaseCmp(name, "ntname") == 0) {
902 strlcpy(map.nt_name, val,
903 sizeof(map.nt_name));
904 } else if (StrCaseCmp(name, "comment") == 0) {
905 strlcpy(map.comment, val,
906 sizeof(map.comment));
907 } else if (StrCaseCmp(name, "member") == 0) {
908 if (!string_to_sid(&members[j], val)) {
909 errno = EIO;
910 goto failed;
911 }
912 }
913
914 TALLOC_FREE(val);
915 }
916
917 TALLOC_FREE(name);
918 }
919
920 if (!add_mapping_entry(&map, 0)) {
921 errno = EIO;
922 goto failed;
923 }
924
925 if (num_mem) {
926 for (j = 0; j < num_mem; j++) {
927 NTSTATUS status;
928 status = add_aliasmem(&map.sid, &members[j]);
929 if (!NT_STATUS_IS_OK(status)) {
930 errno = EIO;
931 goto failed;
932 }
933 }
934 }
935
936 if (remaining != 0) {
937 DEBUG(0, ("Errror: %d bytes unread in ltdb_unpack_data\n",
938 remaining));
939 }
940
941 return 0;
942
943 failed:
944 return -1;
945 }
946
947 static bool mapping_switch(const char *ldb_path)
948 {
949 TDB_CONTEXT *ltdb;
950 TALLOC_CTX *frame;
951 char *new_path;
952 int ret;
953
954 frame = talloc_stackframe();
955
956 ltdb = tdb_open_log(ldb_path, 0, TDB_DEFAULT, O_RDONLY, 0600);
957 if (ltdb == NULL) goto failed;
958
959 /* ldb is just a very fancy tdb, read out raw data and perform
960 * conversion */
961 ret = tdb_traverse(ltdb, convert_ldb_record, NULL);
962 if (ret == -1) goto failed;
963
964 if (ltdb) {
965 tdb_close(ltdb);
966 ltdb = NULL;
967 }
968
969 /* now rename the old db out of the way */
970 new_path = state_path("group_mapping.ldb.replaced");
971 if (!new_path) {
972 goto failed;
973 }
974 if (rename(ldb_path, new_path) != 0) {
975 DEBUG(0,("Failed to rename old group mapping database\n"));
976 goto failed;
977 }
978 TALLOC_FREE(frame);
979 return True;
980
981 failed:
982 DEBUG(0, ("Failed to switch to tdb group mapping database\n"));
983 if (ltdb) tdb_close(ltdb);
984 TALLOC_FREE(frame);
985 return False;
986 }
987
988 static const struct mapping_backend tdb_backend = {
989 .add_mapping_entry = add_mapping_entry,
990 .get_group_map_from_sid = get_group_map_from_sid,
991 .get_group_map_from_gid = get_group_map_from_gid,
992 .get_group_map_from_ntname = get_group_map_from_ntname,
993 .group_map_remove = group_map_remove,
994 .enum_group_mapping = enum_group_mapping,
995 .one_alias_membership = one_alias_membership,
996 .add_aliasmem = add_aliasmem,
997 .del_aliasmem = del_aliasmem,
998 .enum_aliasmem = enum_aliasmem
999 };
1000
1001 /*
1002 initialise the tdb mapping backend
1003 */
1004 const struct mapping_backend *groupdb_tdb_init(void)
1005 {
1006 if (!init_group_mapping()) {
1007 DEBUG(0,("Failed to initialise tdb mapping backend\n"));
1008 return NULL;
1009 }
1010
1011 return &tdb_backend;
1012 }
WIP