source3/lib/idmap_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping Cache
   4
   5    Copyright (C) Volker Lendecke        2008
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.*/
  19
  20 #include "includes.h"
  21 #include "idmap_cache.h"
  22 #include "../libcli/security/security.h"
  23 #include "../librpc/gen_ndr/idmap.h"
  24
  25 /**
  26  * Find a sid2xid mapping
  27  * @param[in] sid               the sid to map
  28  * @param[out] id               where to put the result
  29  * @param[out] expired          is the cache entry expired?
  30  * @retval Was anything in the cache at all?
  31  *
  32  * If id->id == -1 this was a negative mapping.
  33  */
  34
  35 bool idmap_cache_find_sid2unixid(const struct dom_sid *sid, struct unixid *id,
  36                                  bool *expired)
  37 {
  38         fstring sidstr;
  39         char *key;
  40         char *value;
  41         char *endptr;
  42         time_t timeout;
  43         bool ret;
  44         struct unixid tmp_id;
  45
  46         key = talloc_asprintf(talloc_tos(), "IDMAP/SID2XID/%s",
  47                               sid_to_fstring(sidstr, sid));
  48         if (key == NULL) {
  49                 return false;
  50         }
  51         ret = gencache_get(key, &value, &timeout);
  52         if (!ret) {
  53                 TALLOC_FREE(key);
  54                 return false;
  55         }
  56
  57         DEBUG(10, ("Parsing value for key [%s]: value=[%s]\n", key, value));
  58
  59         tmp_id.id = strtol(value, &endptr, 10);
  60         DEBUG(10, ("Parsing value for key [%s]: id=[%llu], endptr=[%s]\n",
  61                    key, (unsigned long long)tmp_id.id, endptr));
  62
  63         ret = (*endptr == ':');
  64         if (ret) {
  65                 switch (endptr[1]) {
  66                 case 'U':
  67                         tmp_id.type = ID_TYPE_UID;
  68                         break;
  69
  70                 case 'G':
  71                         tmp_id.type = ID_TYPE_GID;
  72                         break;
  73
  74                 case 'B':
  75                         tmp_id.type = ID_TYPE_BOTH;
  76                         break;
  77
  78                 case '\0':
  79                         TALLOC_FREE(key);
  80                         SAFE_FREE(value);
  81                         DEBUG(0, ("FAILED to parse value for key [%s] "
  82                                   "(id=[%llu], endptr=[%s]): "
  83                                   "no type character after colon\n",
  84                                   key, (unsigned long long)tmp_id.id, endptr));
  85                         return false;
  86                 default:
  87                         TALLOC_FREE(key);
  88                         SAFE_FREE(value);
  89                         DEBUG(0, ("FAILED to parse value for key [%s] "
  90                                   "(id=[%llu], endptr=[%s]): "
  91                                   "illegal type character '%c'\n",
  92                                   key, (unsigned long long)tmp_id.id, endptr,
  93                                   endptr[1]));
  94                         return false;
  95                 }
  96                 if (endptr[2] != '\0') {
  97                         TALLOC_FREE(key);
  98                         SAFE_FREE(value);
  99                         DEBUG(0, ("FAILED to parse value for key [%s] "
 100                                   "(id=[%llu], endptr=[%s]): "
 101                                   "more than 1 type character after colon\n",
 102                                   key, (unsigned long long)tmp_id.id, endptr));
 103                         return false;
 104                 }
 105
 106                 *id = tmp_id;
 107                 *expired = (timeout <= time(NULL));
 108         } else {
 109                 DEBUG(0, ("FAILED to parse value for key [%s] (value=[%s]): "
 110                           "colon missing after id=[%llu]\n",
 111                           key, value, (unsigned long long)tmp_id.id));
 112         }
 113         TALLOC_FREE(key);
 114         SAFE_FREE(value);
 115         return ret;
 116 }
 117
 118 /**
 119  * Find a sid2uid mapping
 120  * @param[in] sid               the sid to map
 121  * @param[out] puid             where to put the result
 122  * @param[out] expired          is the cache entry expired?
 123  * @retval Was anything in the cache at all?
 124  *
 125  * If *puid == -1 this was a negative mapping.
 126  */
 127
 128 bool idmap_cache_find_sid2uid(const struct dom_sid *sid, uid_t *puid,
 129                               bool *expired)
 130 {
 131         bool ret;
 132         struct unixid id;
 133         ret = idmap_cache_find_sid2unixid(sid, &id, expired);
 134         if (!ret) {
 135                 return false;
 136         }
 137
 138         if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_UID) {
 139                 *puid = id.id;
 140         } else {
 141                 *puid = -1;
 142         }
 143         return true;
 144 }
 145
 146 /**
 147  * Find a sid2gid mapping
 148  * @param[in] sid               the sid to map
 149  * @param[out] pgid             where to put the result
 150  * @param[out] expired          is the cache entry expired?
 151  * @retval Was anything in the cache at all?
 152  *
 153  * If *pgid == -1 this was a negative mapping.
 154  */
 155
 156 bool idmap_cache_find_sid2gid(const struct dom_sid *sid, gid_t *pgid,
 157                               bool *expired)
 158 {
 159         bool ret;
 160         struct unixid id;
 161         ret = idmap_cache_find_sid2unixid(sid, &id, expired);
 162         if (!ret) {
 163                 return false;
 164         }
 165
 166         if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_GID) {
 167                 *pgid = id.id;
 168         } else {
 169                 *pgid = -1;
 170         }
 171         return true;
 172 }
 173
 174 /**
 175  * Find a uid2sid mapping
 176  * @param[in] uid               the uid to map
 177  * @param[out] sid              where to put the result
 178  * @param[out] expired          is the cache entry expired?
 179  * @retval Was anything in the cache at all?
 180  *
 181  * If "is_null_sid(sid)", this was a negative mapping.
 182  */
 183
 184 bool idmap_cache_find_uid2sid(uid_t uid, struct dom_sid *sid, bool *expired)
 185 {
 186         char *key;
 187         char *value;
 188         time_t timeout;
 189         bool ret = true;
 190
 191         key = talloc_asprintf(talloc_tos(), "IDMAP/UID2SID/%d", (int)uid);
 192         if (key == NULL) {
 193                 return false;
 194         }
 195         ret = gencache_get(key, &value, &timeout);
 196         TALLOC_FREE(key);
 197         if (!ret) {
 198                 return false;
 199         }
 200         ZERO_STRUCTP(sid);
 201         if (value[0] != '-') {
 202                 ret = string_to_sid(sid, value);
 203         }
 204         SAFE_FREE(value);
 205         if (ret) {
 206                 *expired = (timeout <= time(NULL));
 207         }
 208         return ret;
 209 }
 210
 211 /**
 212  * Find a gid2sid mapping
 213  * @param[in] gid               the gid to map
 214  * @param[out] sid              where to put the result
 215  * @param[out] expired          is the cache entry expired?
 216  * @retval Was anything in the cache at all?
 217  *
 218  * If "is_null_sid(sid)", this was a negative mapping.
 219  */
 220
 221 bool idmap_cache_find_gid2sid(gid_t gid, struct dom_sid *sid, bool *expired)
 222 {
 223         char *key;
 224         char *value;
 225         time_t timeout;
 226         bool ret = true;
 227
 228         key = talloc_asprintf(talloc_tos(), "IDMAP/GID2SID/%d", (int)gid);
 229         if (key == NULL) {
 230                 return false;
 231         }
 232         ret = gencache_get(key, &value, &timeout);
 233         TALLOC_FREE(key);
 234         if (!ret) {
 235                 return false;
 236         }
 237         ZERO_STRUCTP(sid);
 238         if (value[0] != '-') {
 239                 ret = string_to_sid(sid, value);
 240         }
 241         SAFE_FREE(value);
 242         if (ret) {
 243                 *expired = (timeout <= time(NULL));
 244         }
 245         return ret;
 246 }
 247
 248 /**
 249  * Store a mapping in the idmap cache
 250  * @param[in] sid               the sid to map
 251  * @param[in] gid               the gid to map
 252  *
 253  * If both parameters are valid values, then a positive mapping in both
 254  * directions is stored. If "is_null_sid(sid)" is true, then this will be a
 255  * negative mapping of gid, we want to cache that for this gid we could not
 256  * find anything. Likewise if "gid==-1", then we want to cache that we did not
 257  * find a mapping for the sid passed here.
 258  */
 259
 260 void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id)
 261 {
 262         time_t now = time(NULL);
 263         time_t timeout;
 264         fstring sidstr, key, value;
 265
 266         if (!is_null_sid(sid)) {
 267                 fstr_sprintf(key, "IDMAP/SID2XID/%s",
 268                              sid_to_fstring(sidstr, sid));
 269                 switch (unix_id->type) {
 270                 case ID_TYPE_UID:
 271                         fstr_sprintf(value, "%d:U", (int)unix_id->id);
 272                         break;
 273                 case ID_TYPE_GID:
 274                         fstr_sprintf(value, "%d:G", (int)unix_id->id);
 275                         break;
 276                 case ID_TYPE_BOTH:
 277                         fstr_sprintf(value, "%d:B", (int)unix_id->id);
 278                         break;
 279                 default:
 280                         return;
 281                 }
 282                 timeout = (unix_id->id == -1)
 283                         ? lp_idmap_negative_cache_time()
 284                         : lp_idmap_cache_time();
 285                 gencache_set(key, value, now + timeout);
 286         }
 287         if (unix_id->id != -1) {
 288                 if (is_null_sid(sid)) {
 289                         /* negative gid mapping */
 290                         fstrcpy(value, "-");
 291                         timeout = lp_idmap_negative_cache_time();
 292                 }
 293                 else {
 294                         sid_to_fstring(value, sid);
 295                         timeout = lp_idmap_cache_time();
 296                 }
 297                 switch (unix_id->type) {
 298                 case ID_TYPE_BOTH:
 299                         fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
 300                         gencache_set(key, value, now + timeout);
 301                         fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
 302                         gencache_set(key, value, now + timeout);
 303                         return;
 304
 305                 case ID_TYPE_UID:
 306                         fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
 307                         break;
 308
 309                 case ID_TYPE_GID:
 310                         fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
 311                         break;
 312
 313                 default:
 314                         return;
 315                 }
 316                 gencache_set(key, value, now + timeout);
 317         }
 318 }
 319
 320 /**
 321  * Store a mapping in the idmap cache
 322  * @param[in] sid               the sid to map
 323  * @param[in] uid               the uid to map
 324  *
 325  * If both parameters are valid values, then a positive mapping in both
 326  * directions is stored. If "is_null_sid(sid)" is true, then this will be a
 327  * negative mapping of uid, we want to cache that for this uid we could not
 328  * find anything. Likewise if "uid==-1", then we want to cache that we did not
 329  * find a mapping for the sid passed here.
 330  */
 331
 332 void idmap_cache_set_sid2uid(const struct dom_sid *sid, uid_t uid)
 333 {
 334         struct unixid id;
 335         id.type = ID_TYPE_UID;
 336         id.id = uid;
 337
 338         if (uid == -1) {
 339                 uid_t tmp_gid;
 340                 bool expired;
 341                 /* If we were asked to invalidate this SID -> UID
 342                  * mapping, it was because we found out that this was
 343                  * not a UID at all.  Do not overwrite a valid GID or
 344                  * BOTH mapping */
 345                 if (idmap_cache_find_sid2gid(sid, &tmp_gid, &expired)) {
 346                         if (!expired) {
 347                                 return;
 348                         }
 349                 }
 350         }
 351
 352         idmap_cache_set_sid2unixid(sid, &id);
 353         return;
 354 }
 355
 356 /**
 357  * Store a mapping in the idmap cache
 358  * @param[in] sid               the sid to map
 359  * @param[in] gid               the gid to map
 360  *
 361  * If both parameters are valid values, then a positive mapping in both
 362  * directions is stored. If "is_null_sid(sid)" is true, then this will be a
 363  * negative mapping of gid, we want to cache that for this gid we could not
 364  * find anything. Likewise if "gid==-1", then we want to cache that we did not
 365  * find a mapping for the sid passed here.
 366  */
 367
 368 void idmap_cache_set_sid2gid(const struct dom_sid *sid, gid_t gid)
 369 {
 370         struct unixid id;
 371         id.type = ID_TYPE_GID;
 372         id.id = gid;
 373
 374         if (gid == -1) {
 375                 uid_t tmp_uid;
 376                 bool expired;
 377                 /* If we were asked to invalidate this SID -> GID
 378                  * mapping, it was because we found out that this was
 379                  * not a GID at all.  Do not overwrite a valid UID or
 380                  * BOTH mapping */
 381                 if (idmap_cache_find_sid2uid(sid, &tmp_uid, &expired)) {
 382                         if (!expired) {
 383                                 return;
 384                         }
 385                 }
 386         }
 387
 388         idmap_cache_set_sid2unixid(sid, &id);
 389         return;
 390 }
 391
 392 static char* key_xid2sid_str(TALLOC_CTX* mem_ctx, char t, const char* id) {
 393         return talloc_asprintf(mem_ctx, "IDMAP/%cID2SID/%s", t, id);
 394 }
 395
 396 static char* key_xid2sid(TALLOC_CTX* mem_ctx, char t, int id) {
 397         char str[32];
 398         snprintf(str, sizeof(str), "%d", id);
 399         return key_xid2sid_str(mem_ctx, t, str);
 400 }
 401
 402 static char* key_sid2xid_str(TALLOC_CTX* mem_ctx, const char* id) {
 403         return talloc_asprintf(mem_ctx, "IDMAP/SID2XID/%s", id);
 404 }
 405
 406 static bool idmap_cache_del_xid(char t, int xid)
 407 {
 408         TALLOC_CTX* mem_ctx = talloc_stackframe();
 409         const char* key = key_xid2sid(mem_ctx, t, xid);
 410         char* sid_str = NULL;
 411         time_t timeout;
 412         bool ret = true;
 413
 414         if (!gencache_get(key, &sid_str, &timeout)) {
 415                 DEBUG(3, ("no entry: %s\n", key));
 416                 ret = false;
 417                 goto done;
 418         }
 419
 420         if (sid_str[0] != '-') {
 421                 const char* sid_key = key_sid2xid_str(mem_ctx, sid_str);
 422                 if (!gencache_del(sid_key)) {
 423                         DEBUG(2, ("failed to delete: %s\n", sid_key));
 424                         ret = false;
 425                 } else {
 426                         DEBUG(5, ("delete: %s\n", sid_key));
 427                 }
 428
 429         }
 430
 431         if (!gencache_del(key)) {
 432                 DEBUG(1, ("failed to delete: %s\n", key));
 433                 ret = false;
 434         } else {
 435                 DEBUG(5, ("delete: %s\n", key));
 436         }
 437
 438 done:
 439         talloc_free(mem_ctx);
 440         return ret;
 441 }
 442
 443 bool idmap_cache_del_uid(uid_t uid) {
 444         return idmap_cache_del_xid('U', uid);
 445 }
 446
 447 bool idmap_cache_del_gid(gid_t gid) {
 448         return idmap_cache_del_xid('G', gid);
 449 }
 450
 451 bool idmap_cache_del_sid(const struct dom_sid *sid)
 452 {
 453         TALLOC_CTX* mem_ctx = talloc_stackframe();
 454         bool ret = true;
 455         bool expired;
 456         struct unixid id;
 457         const char *sid_key;
 458
 459         if (!idmap_cache_find_sid2unixid(sid, &id, &expired)) {
 460                 ret = false;
 461                 goto done;
 462         }
 463
 464         if (id.id != -1) {
 465                 switch (id.type) {
 466                 case ID_TYPE_BOTH:
 467                         idmap_cache_del_xid('U', id.id);
 468                         idmap_cache_del_xid('G', id.id);
 469                         break;
 470                 case ID_TYPE_UID:
 471                         idmap_cache_del_xid('U', id.id);
 472                         break;
 473                 case ID_TYPE_GID:
 474                         idmap_cache_del_xid('G', id.id);
 475                         break;
 476                 default:
 477                         break;
 478                 }
 479         }
 480
 481         sid_key = key_sid2xid_str(mem_ctx, dom_sid_string(mem_ctx, sid));
 482         if (sid_key == NULL) {
 483                 return false;
 484         }
 485         /* If the mapping was symmetric, then this should fail */
 486         gencache_del(sid_key);
 487 done:
 488         talloc_free(mem_ctx);
 489         return ret;
 490 }