?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: change blocking.c to use fsp_fnum_dbg() for fsp->fnum logging.
[Samba/gebeck_regimport.git] / source3 / winbindd / idmap_autorid.c
blobdf63fa99207257bf8a9015c3212c581e123cbc42
1 /*
2 * idmap_autorid: static map between Active Directory/NT RIDs
3 * and RFC 2307 accounts
4 *
5 * based on the idmap_rid module, but this module defines the ranges
6 * for the domains by automatically allocating a range for each domain
7 *
8 * Copyright (C) Christian Ambach, 2010-2012
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 *
23 */
24
25 #include "includes.h"
26 #include "system/filesys.h"
27 #include "winbindd.h"
28 #include "dbwrap/dbwrap.h"
29 #include "dbwrap/dbwrap_open.h"
30 #include "idmap.h"
31 #include "idmap_rw.h"
32 #include "../libcli/security/dom_sid.h"
33 #include "util_tdb.h"
34 #include "winbindd/idmap_tdb_common.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_IDMAP
38
39 #define HWM "NEXT RANGE"
40 #define ALLOC_HWM_UID "NEXT ALLOC UID"
41 #define ALLOC_HWM_GID "NEXT ALLOC GID"
42 #define ALLOC_RANGE "ALLOC"
43 #define CONFIGKEY "CONFIG"
44
45 struct autorid_global_config {
46 uint32_t minvalue;
47 uint32_t rangesize;
48 uint32_t maxranges;
49 bool ignore_builtin;
50 };
51
52 struct autorid_domain_config {
53 fstring sid;
54 uint32_t domainnum;
55 struct autorid_global_config *globalcfg;
56 };
57
58 /* handle to the tdb storing domain <-> range assignments */
59 static struct db_context *autorid_db;
60
61 static NTSTATUS idmap_autorid_get_domainrange_action(struct db_context *db,
62 void *private_data)
63 {
64 NTSTATUS ret;
65 uint32_t domainnum, hwm;
66 char *numstr;
67 struct autorid_domain_config *cfg;
68
69 cfg = (struct autorid_domain_config *)private_data;
70
71 ret = dbwrap_fetch_uint32(db, cfg->sid, &(cfg->domainnum));
72
73 if (NT_STATUS_IS_OK(ret)) {
74 /* entry is already present*/
75 return ret;
76 }
77
78 DEBUG(10, ("Acquiring new range for domain %s\n", cfg->sid));
79
80 /* fetch the current HWM */
81 ret = dbwrap_fetch_uint32(db, HWM, &hwm);
82 if (!NT_STATUS_IS_OK(ret)) {
83 DEBUG(1, ("Fatal error while fetching current "
84 "HWM value: %s\n", nt_errstr(ret)));
85 ret = NT_STATUS_INTERNAL_ERROR;
86 goto error;
87 }
88
89 /* do we have a range left? */
90 if (hwm >= cfg->globalcfg->maxranges) {
91 DEBUG(1, ("No more domain ranges available!\n"));
92 ret = NT_STATUS_NO_MEMORY;
93 goto error;
94 }
95
96 /* increase the HWM */
97 ret = dbwrap_change_uint32_atomic(db, HWM, &domainnum, 1);
98 if (!NT_STATUS_IS_OK(ret)) {
99 DEBUG(1, ("Fatal error while fetching a new "
100 "domain range value!\n"));
101 goto error;
102 }
103
104 /* store away the new mapping in both directions */
105 ret = dbwrap_store_uint32(db, cfg->sid, domainnum);
106 if (!NT_STATUS_IS_OK(ret)) {
107 DEBUG(1, ("Fatal error while storing new "
108 "domain->range assignment!\n"));
109 goto error;
110 }
111
112 numstr = talloc_asprintf(db, "%u", domainnum);
113 if (!numstr) {
114 ret = NT_STATUS_NO_MEMORY;
115 goto error;
116 }
117
118 ret = dbwrap_store_bystring(db, numstr,
119 string_term_tdb_data(cfg->sid), TDB_INSERT);
120
121 talloc_free(numstr);
122 if (!NT_STATUS_IS_OK(ret)) {
123 DEBUG(1, ("Fatal error while storing "
124 "new domain->range assignment!\n"));
125 goto error;
126 }
127 DEBUG(5, ("Acquired new range #%d for domain %s\n",
128 domainnum, cfg->sid));
129
130 cfg->domainnum = domainnum;
131
132 return NT_STATUS_OK;
133
134 error:
135 return ret;
136
137 }
138
139 static NTSTATUS idmap_autorid_get_domainrange(struct autorid_domain_config *dom,
140 bool read_only)
141 {
142 NTSTATUS ret;
143
144 /*
145 * try to find mapping without locking the database,
146 * if it is not found create a mapping in a transaction unless
147 * read-only mode has been set
148 */
149 ret = dbwrap_fetch_uint32(autorid_db, dom->sid, &(dom->domainnum));
150
151 if (!NT_STATUS_IS_OK(ret)) {
152 if (read_only) {
153 return NT_STATUS_NOT_FOUND;
154 }
155 ret = dbwrap_trans_do(autorid_db,
156 idmap_autorid_get_domainrange_action, dom);
157 }
158
159 DEBUG(10, ("Using range #%d for domain %s\n", dom->domainnum,
160 dom->sid));
161
162 return ret;
163 }
164
165 static NTSTATUS idmap_autorid_allocate_id(struct idmap_domain *dom,
166 struct unixid *xid) {
167
168 NTSTATUS ret;
169 struct idmap_tdb_common_context *commoncfg;
170 struct autorid_global_config *globalcfg;
171 struct autorid_domain_config domaincfg;
172
173 commoncfg =
174 talloc_get_type_abort(dom->private_data,
175 struct idmap_tdb_common_context);
176
177 globalcfg = talloc_get_type(commoncfg->private_data,
178 struct autorid_global_config);
179
180 if (dom->read_only) {
181 DEBUG(3, ("Backend is read-only, refusing "
182 "new allocation request\n"));
183 return NT_STATUS_UNSUCCESSFUL;
184 }
185
186 /* fetch the range for the allocation pool */
187
188 ZERO_STRUCT(domaincfg);
189
190 domaincfg.globalcfg = globalcfg;
191 fstrcpy(domaincfg.sid, ALLOC_RANGE);
192
193 ret = idmap_autorid_get_domainrange(&domaincfg, dom->read_only);
194
195 if (!NT_STATUS_IS_OK(ret)) {
196 DEBUG(3, ("Could not determine range for allocation pool, "
197 "check previous messages for reason\n"));
198 return ret;
199 }
200
201 ret = idmap_tdb_common_get_new_id(dom, xid);
202
203 if (!NT_STATUS_IS_OK(ret)) {
204 DEBUG(1, ("Fatal error while allocating new ID!\n"));
205 return ret;
206 }
207
208 xid->id = globalcfg->minvalue +
209 globalcfg->rangesize * domaincfg.domainnum +
210 xid->id;
211
212 DEBUG(10, ("Returned new %s %d from allocation range\n",
213 (xid->type==ID_TYPE_UID)?"uid":"gid", xid->id));
214
215 return ret;
216 }
217
218 /*
219 * map a SID to xid using the idmap_tdb like pool
220 */
221 static NTSTATUS idmap_autorid_map_id_to_sid(struct idmap_domain *dom,
222 struct id_map *map)
223 {
224 NTSTATUS ret;
225
226 /* look out for the mapping */
227 ret = idmap_tdb_common_unixid_to_sid(dom, map);
228
229 if (NT_STATUS_IS_OK(ret)) {
230 map->status = ID_MAPPED;
231 return ret;
232 }
233
234 map->status = ID_UNKNOWN;
235
236 DEBUG(10, ("no ID->SID mapping for %d could be found\n", map->xid.id));
237
238 return ret;
239 }
240
241 static NTSTATUS idmap_autorid_id_to_sid(struct autorid_global_config *cfg,
242 struct idmap_domain *dom,
243 struct id_map *map)
244 {
245 uint32_t range;
246 TDB_DATA data;
247 char *keystr;
248 struct dom_sid sid;
249 NTSTATUS status;
250
251 /* can this be one of our ids? */
252 if (map->xid.id < cfg->minvalue) {
253 DEBUG(10, ("id %d is lower than minimum value, "
254 "ignoring mapping request\n", map->xid.id));
255 map->status = ID_UNKNOWN;
256 return NT_STATUS_OK;
257 }
258
259 if (map->xid.id > (cfg->minvalue + cfg->rangesize * cfg->maxranges)) {
260 DEBUG(10, ("id %d is outside of maximum id value, "
261 "ignoring mapping request\n", map->xid.id));
262 map->status = ID_UNKNOWN;
263 return NT_STATUS_OK;
264 }
265
266 /* determine the range of this uid */
267 range = ((map->xid.id - cfg->minvalue) / cfg->rangesize);
268
269 keystr = talloc_asprintf(talloc_tos(), "%u", range);
270 if (!keystr) {
271 return NT_STATUS_NO_MEMORY;
272 }
273
274 status = dbwrap_fetch_bystring(autorid_db, talloc_tos(), keystr, &data);
275 TALLOC_FREE(keystr);
276
277 if (!NT_STATUS_IS_OK(status)) {
278 DEBUG(4, ("id %d belongs to range %d which does not have "
279 "domain mapping, ignoring mapping request\n",
280 map->xid.id, range));
281 TALLOC_FREE(data.dptr);
282 map->status = ID_UNKNOWN;
283 return NT_STATUS_OK;
284 }
285
286 if (strncmp((const char *)data.dptr,
287 ALLOC_RANGE,
288 strlen(ALLOC_RANGE)) == 0) {
289 /*
290 * this is from the alloc range, check if there is a mapping
291 */
292 DEBUG(5, ("id %d belongs to allocation range, "
293 "checking for mapping\n",
294 map->xid.id));
295 TALLOC_FREE(data.dptr);
296 return idmap_autorid_map_id_to_sid(dom, map);
297 }
298
299 string_to_sid(&sid, (const char *)data.dptr);
300 TALLOC_FREE(data.dptr);
301
302 sid_compose(map->sid, &sid,
303 (map->xid.id - cfg->minvalue -
304 range * cfg->rangesize));
305
306 /* We **really** should have some way of validating
307 the SID exists and is the correct type here. But
308 that is a deficiency in the idmap_rid design. */
309
310 map->status = ID_MAPPED;
311 return NT_STATUS_OK;
312 }
313
314 /**********************************
315 Single sid to id lookup function.
316 **********************************/
317
318 static NTSTATUS idmap_autorid_sid_to_id(struct autorid_global_config *global,
319 struct autorid_domain_config *domain,
320 struct id_map *map)
321 {
322 uint32_t rid;
323
324 sid_peek_rid(map->sid, &rid);
325
326 /* if the rid is higher than the size of the range, we cannot map it */
327 if (rid >= global->rangesize) {
328 map->status = ID_UNKNOWN;
329 DEBUG(2, ("RID %d is larger then size of range (%d), "
330 "user cannot be mapped\n", rid, global->rangesize));
331 return NT_STATUS_UNSUCCESSFUL;
332 }
333 map->xid.id = global->minvalue +
334 (global->rangesize * domain->domainnum)+rid;
335
336 /* We **really** should have some way of validating
337 the SID exists and is the correct type here. But
338 that is a deficiency in the idmap_rid design. */
339
340 map->status = ID_MAPPED;
341
342 return NT_STATUS_OK;
343 }
344
345 /**********************************
346 lookup a set of unix ids.
347 **********************************/
348
349 static NTSTATUS idmap_autorid_unixids_to_sids(struct idmap_domain *dom,
350 struct id_map **ids)
351 {
352 struct idmap_tdb_common_context *commoncfg;
353 struct autorid_global_config *globalcfg;
354 NTSTATUS ret;
355 int i;
356 int num_tomap = 0;
357 int num_mapped = 0;
358
359 /* initialize the status to avoid surprise */
360 for (i = 0; ids[i]; i++) {
361 ids[i]->status = ID_UNKNOWN;
362 num_tomap++;
363 }
364
365 commoncfg =
366 talloc_get_type_abort(dom->private_data,
367 struct idmap_tdb_common_context);
368
369 globalcfg = talloc_get_type(commoncfg->private_data,
370 struct autorid_global_config);
371
372 for (i = 0; ids[i]; i++) {
373
374 ret = idmap_autorid_id_to_sid(globalcfg, dom, ids[i]);
375
376 if ((!NT_STATUS_IS_OK(ret)) &&
377 (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
378 /* some fatal error occurred, log it */
379 DEBUG(3, ("Unexpected error resolving an ID "
380 " (%d)\n", ids[i]->xid.id));
381 goto failure;
382 }
383
384 if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
385 num_mapped++;
386 }
387
388 }
389
390 if (num_tomap == num_mapped) {
391 return NT_STATUS_OK;
392 } else if (num_mapped == 0) {
393 return NT_STATUS_NONE_MAPPED;
394 }
395
396 return STATUS_SOME_UNMAPPED;
397
398
399 failure:
400 return ret;
401 }
402
403 /*
404 * map a SID to xid using the idmap_tdb like pool
405 */
406 static NTSTATUS idmap_autorid_map_sid_to_id(struct idmap_domain *dom,
407 struct id_map *map,
408 struct idmap_tdb_common_context *ctx)
409 {
410 NTSTATUS ret;
411 int res;
412
413 /* see if we already have a mapping */
414 ret = idmap_tdb_common_sid_to_unixid(dom, map);
415
416 if (NT_STATUS_IS_OK(ret)) {
417 map->status = ID_MAPPED;
418 return ret;
419 }
420
421 /* bad things happened */
422 if (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
423 DEBUG(1, ("Looking up SID->ID mapping for %s failed\n",
424 sid_string_dbg(map->sid)));
425 return ret;
426 }
427
428 if (dom->read_only) {
429 DEBUG(3, ("Not allocating new mapping for %s, because backend "
430 "is read-only\n", sid_string_dbg(map->sid)));
431 return NT_STATUS_NONE_MAPPED;
432 }
433
434 DEBUG(10, ("Creating new mapping in pool for %s\n",
435 sid_string_dbg(map->sid)));
436
437 /* create new mapping */
438 res = dbwrap_transaction_start(ctx->db);
439 if (res != 0) {
440 DEBUG(2, ("transaction_start failed\n"));
441 return NT_STATUS_INTERNAL_DB_CORRUPTION;
442 }
443
444 ret = idmap_tdb_common_new_mapping(dom, map);
445
446 map->status = (NT_STATUS_IS_OK(ret))?ID_MAPPED:ID_UNMAPPED;
447
448 if (!NT_STATUS_IS_OK(ret)) {
449 if (dbwrap_transaction_cancel(ctx->db) != 0) {
450 smb_panic("Cancelling transaction failed");
451 }
452 return ret;
453 }
454
455 res = dbwrap_transaction_commit(ctx->db);
456 if (res == 0) {
457 return ret;
458 }
459
460 DEBUG(2, ("transaction_commit failed\n"));
461 return NT_STATUS_INTERNAL_DB_CORRUPTION;
462
463 }
464
465 /**********************************
466 lookup a set of sids.
467 **********************************/
468
469 static NTSTATUS idmap_autorid_sids_to_unixids(struct idmap_domain *dom,
470 struct id_map **ids)
471 {
472 struct idmap_tdb_common_context *commoncfg;
473 struct autorid_global_config *global;
474 NTSTATUS ret;
475 int i;
476 int num_tomap = 0;
477 int num_mapped = 0;
478
479 /* initialize the status to avoid surprise */
480 for (i = 0; ids[i]; i++) {
481 ids[i]->status = ID_UNKNOWN;
482 num_tomap++;
483 }
484
485 commoncfg =
486 talloc_get_type_abort(dom->private_data,
487 struct idmap_tdb_common_context);
488
489 global = talloc_get_type(commoncfg->private_data,
490 struct autorid_global_config);
491
492 for (i = 0; ids[i]; i++) {
493 struct winbindd_tdc_domain *domain;
494 struct autorid_domain_config domaincfg;
495 uint32_t rid;
496 struct dom_sid domainsid;
497
498 ZERO_STRUCT(domaincfg);
499
500 DEBUG(10, ("Trying to map %s\n", sid_string_dbg(ids[i]->sid)));
501
502 sid_copy(&domainsid, ids[i]->sid);
503 if (!sid_split_rid(&domainsid, &rid)) {
504 DEBUG(4, ("Could not determine domain SID from %s, "
505 "ignoring mapping request\n",
506 sid_string_dbg(ids[i]->sid)));
507 continue;
508 }
509
510 /* is this a well-known SID? */
511
512 if (sid_check_is_wellknown_domain(&domainsid, NULL)) {
513
514 DEBUG(10, ("SID %s is well-known, using pool\n",
515 sid_string_dbg(ids[i]->sid)));
516
517 ret = idmap_autorid_map_sid_to_id(dom, ids[i],
518 commoncfg);
519
520 if (!NT_STATUS_IS_OK(ret) &&
521 !NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
522 DEBUG(3, ("Unexpected error resolving "
523 "SID (%s)\n",
524 sid_string_dbg(ids[i]->sid)));
525 goto failure;
526 }
527
528 if (ids[i]->status == ID_MAPPED) {
529 num_mapped++;
530 }
531
532 continue;
533 }
534
535 /* BUILTIN is passdb's job */
536 if (dom_sid_equal(&domainsid, &global_sid_Builtin) &&
537 global->ignore_builtin) {
538 DEBUG(10, ("Ignoring request for BUILTIN domain\n"));
539 continue;
540 }
541
542 /*
543 * Check if the domain is around
544 */
545 domain = wcache_tdc_fetch_domainbysid(talloc_tos(),
546 &domainsid);
547 if (domain == NULL) {
548 DEBUG(10, ("Ignoring unknown domain sid %s\n",
549 sid_string_dbg(&domainsid)));
550 continue;
551 }
552 TALLOC_FREE(domain);
553
554 domaincfg.globalcfg = global;
555 sid_to_fstring(domaincfg.sid, &domainsid);
556
557 ret = idmap_autorid_get_domainrange(&domaincfg, dom->read_only);
558
559 /* read-only mode and a new domain range would be required? */
560 if (NT_STATUS_EQUAL(ret, NT_STATUS_NOT_FOUND) &&
561 dom->read_only) {
562 DEBUG(10, ("read-only is enabled, did not allocate "
563 "new range for domain %s\n",
564 sid_string_dbg(&domainsid)));
565 continue;
566 }
567
568 if (!NT_STATUS_IS_OK(ret)) {
569 DEBUG(3, ("Could not determine range for domain, "
570 "check previous messages for reason\n"));
571 goto failure;
572 }
573
574 ret = idmap_autorid_sid_to_id(global, &domaincfg, ids[i]);
575
576 if ((!NT_STATUS_IS_OK(ret)) &&
577 (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
578 /* some fatal error occurred, log it */
579 DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
580 sid_string_dbg(ids[i]->sid)));
581 goto failure;
582 }
583
584 if (NT_STATUS_IS_OK(ret)) {
585 num_mapped++;
586 }
587 }
588
589 if (num_tomap == num_mapped) {
590 return NT_STATUS_OK;
591 } else if (num_mapped == 0) {
592 return NT_STATUS_NONE_MAPPED;
593 }
594
595 return STATUS_SOME_UNMAPPED;
596
597 failure:
598 return ret;
599
600 }
601
602 /* initialize the given HWM to 0 if it does not exist yet */
603 static NTSTATUS idmap_autorid_init_hwm(const char *hwm) {
604
605 NTSTATUS status;
606 uint32_t hwmval;
607
608 status = dbwrap_fetch_uint32(autorid_db, hwm, &hwmval);
609 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
610 status = dbwrap_trans_store_int32(autorid_db, hwm, 0);
611 if (!NT_STATUS_IS_OK(status)) {
612 DEBUG(0,
613 ("Unable to initialise HWM (%s) in autorid "
614 "database: %s\n", hwm, nt_errstr(status)));
615 return NT_STATUS_INTERNAL_DB_ERROR;
616 }
617 } else if (!NT_STATUS_IS_OK(status)) {
618 DEBUG(0, ("unable to fetch HWM (%s) from autorid "
619 "database: %s\n", hwm, nt_errstr(status)));
620 return status;
621 }
622
623 return NT_STATUS_OK;
624 }
625
626 /*
627 * open and initialize the database which stores the ranges for the domains
628 */
629 static NTSTATUS idmap_autorid_db_init(void)
630 {
631 NTSTATUS status;
632
633 if (autorid_db) {
634 /* its already open */
635 return NT_STATUS_OK;
636 }
637
638 /* Open idmap repository */
639 autorid_db = db_open(NULL, state_path("autorid.tdb"), 0,
640 TDB_DEFAULT, O_RDWR | O_CREAT, 0644,
641 DBWRAP_LOCK_ORDER_1);
642
643 if (!autorid_db) {
644 DEBUG(0, ("Unable to open idmap_autorid database '%s'\n",
645 state_path("autorid.tdb")));
646 return NT_STATUS_UNSUCCESSFUL;
647 }
648
649 /* Initialize high water mark for the currently used range to 0 */
650
651 status = idmap_autorid_init_hwm(HWM);
652 NT_STATUS_NOT_OK_RETURN(status);
653
654 status = idmap_autorid_init_hwm(ALLOC_HWM_UID);
655 NT_STATUS_NOT_OK_RETURN(status);
656
657 status = idmap_autorid_init_hwm(ALLOC_HWM_GID);
658
659 return status;
660 }
661
662 static struct autorid_global_config *idmap_autorid_loadconfig(TALLOC_CTX * ctx)
663 {
664
665 TDB_DATA data;
666 struct autorid_global_config *cfg;
667 unsigned long minvalue, rangesize, maxranges;
668 NTSTATUS status;
669
670 status = dbwrap_fetch_bystring(autorid_db, ctx, CONFIGKEY, &data);
671
672 if (!NT_STATUS_IS_OK(status)) {
673 DEBUG(10, ("No saved config found\n"));
674 return NULL;
675 }
676
677 cfg = talloc_zero(ctx, struct autorid_global_config);
678 if (!cfg) {
679 return NULL;
680 }
681
682 if (sscanf((char *)data.dptr,
683 "minvalue:%lu rangesize:%lu maxranges:%lu",
684 &minvalue, &rangesize, &maxranges) != 3) {
685 DEBUG(1,
686 ("Found invalid configuration data"
687 "creating new config\n"));
688 return NULL;
689 }
690
691 cfg->minvalue = minvalue;
692 cfg->rangesize = rangesize;
693 cfg->maxranges = maxranges;
694
695 DEBUG(10, ("Loaded previously stored configuration "
696 "minvalue:%d rangesize:%d\n",
697 cfg->minvalue, cfg->rangesize));
698
699 return cfg;
700
701 }
702
703 static NTSTATUS idmap_autorid_saveconfig(struct autorid_global_config *cfg)
704 {
705
706 NTSTATUS status;
707 TDB_DATA data;
708 char *cfgstr;
709
710 cfgstr =
711 talloc_asprintf(talloc_tos(),
712 "minvalue:%u rangesize:%u maxranges:%u",
713 cfg->minvalue, cfg->rangesize, cfg->maxranges);
714
715 if (!cfgstr) {
716 return NT_STATUS_NO_MEMORY;
717 }
718
719 data = string_tdb_data(cfgstr);
720
721 status = dbwrap_trans_store_bystring(autorid_db, CONFIGKEY,
722 data, TDB_REPLACE);
723
724 talloc_free(cfgstr);
725
726 return status;
727 }
728
729 static NTSTATUS idmap_autorid_preallocate_wellknown(struct idmap_domain *dom)
730 {
731 const char *groups[] = { "S-1-1-0", "S-1-2-0", "S-1-2-1",
732 "S-1-3-0", "S-1-3-1", "S-1-3-2", "S-1-3-3", "S-1-3-4",
733 "S-1-5-1", "S-1-5-2", "S-1-5-3", "S-1-5-4", "S-1-5-6",
734 "S-1-5-7", "S-1-5-8", "S-1-5-9", "S-1-5-10", "S-1-5-11",
735 "S-1-5-12", "S-1-5-13", "S-1-5-14", "S-1-5-15",
736 "S-1-5-17", "S-1-5-18", "S-1-5-19", "S-1-5-20"
737 };
738
739 struct id_map **maps;
740 int i, num;
741 NTSTATUS status;
742
743 if (dom->read_only) {
744 return NT_STATUS_OK;
745 }
746
747 num = sizeof(groups)/sizeof(char*);
748
749 maps = talloc_zero_array(talloc_tos(), struct id_map*, num+1);
750 if (!maps) {
751 return NT_STATUS_NO_MEMORY;
752 }
753
754 for (i = 0; i < num; i++) {
755 maps[i] = talloc(maps, struct id_map);
756 maps[i]->xid.type = ID_TYPE_GID;
757 maps[i]->sid = dom_sid_parse_talloc(maps, groups[i]);
758 }
759
760 maps[num] = NULL;
761
762 status = idmap_autorid_sids_to_unixids(dom, maps);
763
764 DEBUG(10,("Preallocation run finished with status %s\n",
765 nt_errstr(status)));
766
767 talloc_free(maps);
768
769 return NT_STATUS_IS_OK(status)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
770 }
771
772 static NTSTATUS idmap_autorid_initialize(struct idmap_domain *dom)
773 {
774 struct idmap_tdb_common_context *commonconfig;
775 struct autorid_global_config *config;
776 struct autorid_global_config *storedconfig = NULL;
777 NTSTATUS status;
778 uint32_t hwm;
779
780 if (!strequal(dom->name, "*")) {
781 DEBUG(0, ("idmap_autorid_initialize: Error: autorid configured "
782 "for domain '%s'. But autorid can only be used for "
783 "the default idmap configuration.\n", dom->name));
784 return NT_STATUS_INVALID_PARAMETER;
785 }
786
787 commonconfig = talloc_zero(dom, struct idmap_tdb_common_context);
788 if (!commonconfig) {
789 DEBUG(0, ("Out of memory!\n"));
790 return NT_STATUS_NO_MEMORY;
791 }
792
793 commonconfig->rw_ops = talloc_zero(commonconfig, struct idmap_rw_ops);
794 if (commonconfig->rw_ops == NULL) {
795 DEBUG(0, ("Out of memory!\n"));
796 return NT_STATUS_NO_MEMORY;
797 }
798
799 config = talloc_zero(commonconfig, struct autorid_global_config);
800 if (!config) {
801 DEBUG(0, ("Out of memory!\n"));
802 return NT_STATUS_NO_MEMORY;
803 }
804
805 status = idmap_autorid_db_init();
806 if (!NT_STATUS_IS_OK(status)) {
807 goto error;
808 }
809
810 config->minvalue = dom->low_id;
811 config->rangesize = lp_parm_int(-1, "idmap config *",
812 "rangesize", 100000);
813
814 if (config->rangesize < 2000) {
815 DEBUG(1, ("autorid rangesize must be at least 2000\n"));
816 status = NT_STATUS_INVALID_PARAMETER;
817 goto error;
818 }
819
820 config->maxranges = (dom->high_id - dom->low_id + 1) /
821 config->rangesize;
822
823 if (config->maxranges == 0) {
824 DEBUG(1, ("allowed uid range is smaller then rangesize, "
825 "increase uid range or decrease rangesize\n"));
826 status = NT_STATUS_INVALID_PARAMETER;
827 goto error;
828 }
829
830 /* check if the high-low limit is a multiple of the rangesize */
831 if ((dom->high_id - dom->low_id + 1) % config->rangesize != 0) {
832 DEBUG(5, ("High uid-low uid difference of %d "
833 "is not a multiple of the rangesize %d, "
834 "limiting ranges to lower boundary number of %d\n",
835 (dom->high_id - dom->low_id + 1), config->rangesize,
836 config->maxranges));
837 }
838
839 DEBUG(10, ("Current configuration in config is "
840 "minvalue:%d rangesize:%d maxranges:%d\n",
841 config->minvalue, config->rangesize, config->maxranges));
842
843 /* read previously stored config and current HWM */
844 storedconfig = idmap_autorid_loadconfig(talloc_tos());
845
846 status = dbwrap_fetch_uint32(autorid_db, HWM, &hwm);
847 if (!NT_STATUS_IS_OK(status)) {
848 DEBUG(1, ("Fatal error while fetching current "
849 "HWM value: %s\n", nt_errstr(status)));
850 status = NT_STATUS_INTERNAL_ERROR;
851 goto error;
852 }
853
854 /* did the minimum value or rangesize change? */
855 if (storedconfig &&
856 ((storedconfig->minvalue != config->minvalue) ||
857 (storedconfig->rangesize != config->rangesize))) {
858 DEBUG(1, ("New configuration values for rangesize or "
859 "minimum uid value conflict with previously "
860 "used values! Aborting initialization\n"));
861 status = NT_STATUS_INVALID_PARAMETER;
862 goto error;
863 }
864
865 /*
866 * has the highest uid value been reduced to setting that is not
867 * sufficient any more for already existing ranges?
868 */
869 if (hwm > config->maxranges) {
870 DEBUG(1, ("New upper uid limit is too low to cover "
871 "existing mappings! Aborting initialization\n"));
872 status = NT_STATUS_INVALID_PARAMETER;
873 goto error;
874 }
875
876 status = idmap_autorid_saveconfig(config);
877
878 if (!NT_STATUS_IS_OK(status)) {
879 DEBUG(1, ("Failed to store configuration data!\n"));
880 goto error;
881 }
882
883 DEBUG(5, ("%d domain ranges with a size of %d are available\n",
884 config->maxranges, config->rangesize));
885
886 config->ignore_builtin = lp_parm_bool(-1, "idmap config *",
887 "ignore builtin", false);
888
889 /* fill the TDB common configuration */
890 commonconfig->private_data = config;
891
892 commonconfig->db = autorid_db;
893 commonconfig->max_id = config->rangesize -1;
894 commonconfig->hwmkey_uid = ALLOC_HWM_UID;
895 commonconfig->hwmkey_gid = ALLOC_HWM_GID;
896 commonconfig->rw_ops->get_new_id = idmap_autorid_allocate_id;
897 commonconfig->rw_ops->set_mapping = idmap_tdb_common_set_mapping;
898
899 dom->private_data = commonconfig;
900
901 /* preallocate well-known SIDs in the pool */
902 status = idmap_autorid_preallocate_wellknown(dom);
903
904 goto done;
905
906 error:
907 talloc_free(config);
908
909 done:
910 talloc_free(storedconfig);
911
912 return status;
913 }
914
915 /*
916 Close the idmap tdb instance
917 */
918 static struct idmap_methods autorid_methods = {
919 .init = idmap_autorid_initialize,
920 .unixids_to_sids = idmap_autorid_unixids_to_sids,
921 .sids_to_unixids = idmap_autorid_sids_to_unixids,
922 .allocate_id = idmap_autorid_allocate_id
923 };
924
925 NTSTATUS samba_init_module(void)
926 {
927 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
928 "autorid", &autorid_methods);
929 }
reg import