?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:winbindd/autorid preallocate well-known SIDs
[Samba/id10ts.git] / source3 / winbindd / idmap_autorid.c
blob554a033512d8fac1f80bb12ad4fb023badec658b
1 /*
2 * idmap_autorid: static map between Active Directory/NT RIDs
3 * and RFC 2307 accounts
4 *
5 * based on the idmap_rid module, but this module defines the ranges
6 * for the domains by automatically allocating a range for each domain
7 *
8 * Copyright (C) Christian Ambach, 2010-2012
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 *
23 */
24
25 #include "includes.h"
26 #include "system/filesys.h"
27 #include "winbindd.h"
28 #include "dbwrap/dbwrap.h"
29 #include "dbwrap/dbwrap_open.h"
30 #include "idmap.h"
31 #include "idmap_rw.h"
32 #include "../libcli/security/dom_sid.h"
33 #include "util_tdb.h"
34 #include "winbindd/idmap_tdb_common.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_IDMAP
38
39 #define HWM "NEXT RANGE"
40 #define ALLOC_HWM_UID "NEXT ALLOC UID"
41 #define ALLOC_HWM_GID "NEXT ALLOC GID"
42 #define ALLOC_RANGE "ALLOC"
43 #define CONFIGKEY "CONFIG"
44
45 struct autorid_global_config {
46 uint32_t minvalue;
47 uint32_t rangesize;
48 uint32_t maxranges;
49 };
50
51 struct autorid_domain_config {
52 fstring sid;
53 uint32_t domainnum;
54 struct autorid_global_config *globalcfg;
55 };
56
57 /* handle to the tdb storing domain <-> range assignments */
58 static struct db_context *autorid_db;
59
60 static NTSTATUS idmap_autorid_get_domainrange_action(struct db_context *db,
61 void *private_data)
62 {
63 NTSTATUS ret;
64 uint32_t domainnum, hwm;
65 char *numstr;
66 struct autorid_domain_config *cfg;
67
68 cfg = (struct autorid_domain_config *)private_data;
69
70 ret = dbwrap_fetch_uint32(db, cfg->sid, &(cfg->domainnum));
71
72 if (NT_STATUS_IS_OK(ret)) {
73 /* entry is already present*/
74 return ret;
75 }
76
77 DEBUG(10, ("Acquiring new range for domain %s\n", cfg->sid));
78
79 /* fetch the current HWM */
80 ret = dbwrap_fetch_uint32(db, HWM, &hwm);
81 if (!NT_STATUS_IS_OK(ret)) {
82 DEBUG(1, ("Fatal error while fetching current "
83 "HWM value: %s\n", nt_errstr(ret)));
84 ret = NT_STATUS_INTERNAL_ERROR;
85 goto error;
86 }
87
88 /* do we have a range left? */
89 if (hwm >= cfg->globalcfg->maxranges) {
90 DEBUG(1, ("No more domain ranges available!\n"));
91 ret = NT_STATUS_NO_MEMORY;
92 goto error;
93 }
94
95 /* increase the HWM */
96 ret = dbwrap_change_uint32_atomic(db, HWM, &domainnum, 1);
97 if (!NT_STATUS_IS_OK(ret)) {
98 DEBUG(1, ("Fatal error while fetching a new "
99 "domain range value!\n"));
100 goto error;
101 }
102
103 /* store away the new mapping in both directions */
104 ret = dbwrap_store_uint32(db, cfg->sid, domainnum);
105 if (!NT_STATUS_IS_OK(ret)) {
106 DEBUG(1, ("Fatal error while storing new "
107 "domain->range assignment!\n"));
108 goto error;
109 }
110
111 numstr = talloc_asprintf(db, "%u", domainnum);
112 if (!numstr) {
113 ret = NT_STATUS_NO_MEMORY;
114 goto error;
115 }
116
117 ret = dbwrap_store_bystring(db, numstr,
118 string_term_tdb_data(cfg->sid), TDB_INSERT);
119
120 talloc_free(numstr);
121 if (!NT_STATUS_IS_OK(ret)) {
122 DEBUG(1, ("Fatal error while storing "
123 "new domain->range assignment!\n"));
124 goto error;
125 }
126 DEBUG(5, ("Acquired new range #%d for domain %s\n",
127 domainnum, cfg->sid));
128
129 cfg->domainnum = domainnum;
130
131 return NT_STATUS_OK;
132
133 error:
134 return ret;
135
136 }
137
138 static NTSTATUS idmap_autorid_get_domainrange(struct autorid_domain_config *dom)
139 {
140 NTSTATUS ret;
141
142 /*
143 * try to find mapping without locking the database,
144 * if it is not found create a mapping in a transaction
145 */
146 ret = dbwrap_fetch_uint32(autorid_db, dom->sid, &(dom->domainnum));
147
148 if (!NT_STATUS_IS_OK(ret)) {;
149 ret = dbwrap_trans_do(autorid_db,
150 idmap_autorid_get_domainrange_action, dom);
151 }
152
153 DEBUG(10, ("Using range #%d for domain %s\n", dom->domainnum,
154 dom->sid));
155
156 return ret;
157 }
158
159 static NTSTATUS idmap_autorid_allocate_id(struct idmap_domain *dom,
160 struct unixid *xid) {
161
162 NTSTATUS ret;
163 struct idmap_tdb_common_context *commoncfg;
164 struct autorid_global_config *globalcfg;
165 struct autorid_domain_config domaincfg;
166
167 commoncfg =
168 talloc_get_type_abort(dom->private_data,
169 struct idmap_tdb_common_context);
170
171 globalcfg = talloc_get_type(commoncfg->private_data,
172 struct autorid_global_config);
173
174 /* fetch the range for the allocation pool */
175
176 ZERO_STRUCT(domaincfg);
177
178 domaincfg.globalcfg = globalcfg;
179 fstrcpy(domaincfg.sid, ALLOC_RANGE);
180
181 ret = idmap_autorid_get_domainrange(&domaincfg);
182
183 if (!NT_STATUS_IS_OK(ret)) {
184 DEBUG(3, ("Could not determine range for allocation pool, "
185 "check previous messages for reason\n"));
186 return ret;
187 }
188
189 ret = idmap_tdb_common_get_new_id(dom, xid);
190
191 if (!NT_STATUS_IS_OK(ret)) {
192 DEBUG(1, ("Fatal error while allocating new ID!\n"));
193 return ret;
194 }
195
196 xid->id = globalcfg->minvalue +
197 globalcfg->rangesize * domaincfg.domainnum +
198 xid->id;
199
200 DEBUG(10, ("Returned new %s %d from allocation range\n",
201 (xid->type==ID_TYPE_UID)?"uid":"gid", xid->id));
202
203 return ret;
204 }
205
206 /*
207 * map a SID to xid using the idmap_tdb like pool
208 */
209 static NTSTATUS idmap_autorid_map_id_to_sid(struct idmap_domain *dom,
210 struct id_map *map)
211 {
212 NTSTATUS ret;
213
214 /* look out for the mapping */
215 ret = idmap_tdb_common_unixid_to_sid(dom, map);
216
217 if (NT_STATUS_IS_OK(ret)) {
218 map->status = ID_MAPPED;
219 return ret;
220 }
221
222 map->status = ID_UNKNOWN;
223
224 DEBUG(10, ("no ID->SID mapping for %d could be found\n", map->xid.id));
225
226 return ret;
227 }
228
229 static NTSTATUS idmap_autorid_id_to_sid(struct autorid_global_config *cfg,
230 struct idmap_domain *dom,
231 struct id_map *map)
232 {
233 uint32_t range;
234 TDB_DATA data;
235 char *keystr;
236 struct dom_sid sid;
237 NTSTATUS status;
238
239 /* can this be one of our ids? */
240 if (map->xid.id < cfg->minvalue) {
241 DEBUG(10, ("id %d is lower than minimum value, "
242 "ignoring mapping request\n", map->xid.id));
243 map->status = ID_UNKNOWN;
244 return NT_STATUS_OK;
245 }
246
247 if (map->xid.id > (cfg->minvalue + cfg->rangesize * cfg->maxranges)) {
248 DEBUG(10, ("id %d is outside of maximum id value, "
249 "ignoring mapping request\n", map->xid.id));
250 map->status = ID_UNKNOWN;
251 return NT_STATUS_OK;
252 }
253
254 /* determine the range of this uid */
255 range = ((map->xid.id - cfg->minvalue) / cfg->rangesize);
256
257 keystr = talloc_asprintf(talloc_tos(), "%u", range);
258 if (!keystr) {
259 return NT_STATUS_NO_MEMORY;
260 }
261
262 status = dbwrap_fetch_bystring(autorid_db, talloc_tos(), keystr, &data);
263 TALLOC_FREE(keystr);
264
265 if (!NT_STATUS_IS_OK(status)) {
266 DEBUG(4, ("id %d belongs to range %d which does not have "
267 "domain mapping, ignoring mapping request\n",
268 map->xid.id, range));
269 TALLOC_FREE(data.dptr);
270 map->status = ID_UNKNOWN;
271 return NT_STATUS_OK;
272 }
273
274 if (strncmp((const char *)data.dptr,
275 ALLOC_RANGE,
276 strlen(ALLOC_RANGE)) == 0) {
277 /*
278 * this is from the alloc range, check if there is a mapping
279 */
280 DEBUG(5, ("id %d belongs to allocation range, "
281 "checking for mapping\n",
282 map->xid.id));
283 TALLOC_FREE(data.dptr);
284 return idmap_autorid_map_id_to_sid(dom, map);
285 }
286
287 string_to_sid(&sid, (const char *)data.dptr);
288 TALLOC_FREE(data.dptr);
289
290 sid_compose(map->sid, &sid,
291 (map->xid.id - cfg->minvalue -
292 range * cfg->rangesize));
293
294 /* We **really** should have some way of validating
295 the SID exists and is the correct type here. But
296 that is a deficiency in the idmap_rid design. */
297
298 map->status = ID_MAPPED;
299 return NT_STATUS_OK;
300 }
301
302 /**********************************
303 Single sid to id lookup function.
304 **********************************/
305
306 static NTSTATUS idmap_autorid_sid_to_id(struct autorid_global_config *global,
307 struct autorid_domain_config *domain,
308 struct id_map *map)
309 {
310 uint32_t rid;
311
312 sid_peek_rid(map->sid, &rid);
313
314 /* if the rid is higher than the size of the range, we cannot map it */
315 if (rid >= global->rangesize) {
316 map->status = ID_UNKNOWN;
317 DEBUG(2, ("RID %d is larger then size of range (%d), "
318 "user cannot be mapped\n", rid, global->rangesize));
319 return NT_STATUS_UNSUCCESSFUL;
320 }
321 map->xid.id = global->minvalue +
322 (global->rangesize * domain->domainnum)+rid;
323
324 /* We **really** should have some way of validating
325 the SID exists and is the correct type here. But
326 that is a deficiency in the idmap_rid design. */
327
328 map->status = ID_MAPPED;
329
330 return NT_STATUS_OK;
331 }
332
333 /**********************************
334 lookup a set of unix ids.
335 **********************************/
336
337 static NTSTATUS idmap_autorid_unixids_to_sids(struct idmap_domain *dom,
338 struct id_map **ids)
339 {
340 struct idmap_tdb_common_context *commoncfg;
341 struct autorid_global_config *globalcfg;
342 NTSTATUS ret;
343 int i;
344 int num_tomap = 0;
345 int num_mapped = 0;
346
347 /* initialize the status to avoid surprise */
348 for (i = 0; ids[i]; i++) {
349 ids[i]->status = ID_UNKNOWN;
350 num_tomap++;
351 }
352
353 commoncfg =
354 talloc_get_type_abort(dom->private_data,
355 struct idmap_tdb_common_context);
356
357 globalcfg = talloc_get_type(commoncfg->private_data,
358 struct autorid_global_config);
359
360 for (i = 0; ids[i]; i++) {
361
362 ret = idmap_autorid_id_to_sid(globalcfg, dom, ids[i]);
363
364 if ((!NT_STATUS_IS_OK(ret)) &&
365 (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
366 /* some fatal error occurred, log it */
367 DEBUG(3, ("Unexpected error resolving an ID "
368 " (%d)\n", ids[i]->xid.id));
369 goto failure;
370 }
371
372 if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
373 num_mapped++;
374 }
375
376 }
377
378 if (num_tomap == num_mapped) {
379 return NT_STATUS_OK;
380 } else if (num_mapped == 0) {
381 return NT_STATUS_NONE_MAPPED;
382 }
383
384 return STATUS_SOME_UNMAPPED;
385
386
387 failure:
388 return ret;
389 }
390
391 /*
392 * map a SID to xid using the idmap_tdb like pool
393 */
394 static NTSTATUS idmap_autorid_map_sid_to_id(struct idmap_domain *dom,
395 struct id_map *map,
396 struct idmap_tdb_common_context *ctx)
397 {
398 NTSTATUS ret;
399 int res;
400
401 /* see if we already have a mapping */
402 ret = idmap_tdb_common_sid_to_unixid(dom, map);
403
404 if (NT_STATUS_IS_OK(ret)) {
405 map->status = ID_MAPPED;
406 return ret;
407 }
408
409 /* bad things happened */
410 if (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
411 DEBUG(1, ("Looking up SID->ID mapping for %s failed\n",
412 sid_string_dbg(map->sid)));
413 return ret;
414 }
415
416 DEBUG(10, ("Creating new mapping in pool for %s\n",
417 sid_string_dbg(map->sid)));
418
419 /* create new mapping */
420 dbwrap_transaction_start(ctx->db);
421
422 ret = idmap_tdb_common_new_mapping(dom, map);
423
424 map->status = (NT_STATUS_IS_OK(ret))?ID_MAPPED:ID_UNMAPPED;
425
426 if (!NT_STATUS_IS_OK(ret)) {
427 if (dbwrap_transaction_cancel(ctx->db) != 0) {
428 smb_panic("Cancelling transaction failed");
429 }
430 return ret;
431 }
432
433 res = dbwrap_transaction_commit(ctx->db);
434 if (res == 0) {
435 return ret;
436 }
437
438 DEBUG(2, ("transaction_commit failed\n"));
439 return NT_STATUS_INTERNAL_DB_CORRUPTION;
440
441 }
442
443 /**********************************
444 lookup a set of sids.
445 **********************************/
446
447 static NTSTATUS idmap_autorid_sids_to_unixids(struct idmap_domain *dom,
448 struct id_map **ids)
449 {
450 struct idmap_tdb_common_context *commoncfg;
451 struct autorid_global_config *global;
452 NTSTATUS ret;
453 int i;
454 int num_tomap = 0;
455 int num_mapped = 0;
456
457 /* initialize the status to avoid surprise */
458 for (i = 0; ids[i]; i++) {
459 ids[i]->status = ID_UNKNOWN;
460 num_tomap++;
461 }
462
463 commoncfg =
464 talloc_get_type_abort(dom->private_data,
465 struct idmap_tdb_common_context);
466
467 global = talloc_get_type(commoncfg->private_data,
468 struct autorid_global_config);
469
470 for (i = 0; ids[i]; i++) {
471 struct winbindd_tdc_domain *domain;
472 struct autorid_domain_config domaincfg;
473 uint32_t rid;
474 struct dom_sid domainsid;
475
476 ZERO_STRUCT(domaincfg);
477
478 sid_copy(&domainsid, ids[i]->sid);
479 if (!sid_split_rid(&domainsid, &rid)) {
480 DEBUG(4, ("Could not determine domain SID from %s, "
481 "ignoring mapping request\n",
482 sid_string_dbg(ids[i]->sid)));
483 continue;
484 }
485
486 /* is this a well-known SID? */
487
488 if (sid_check_is_wellknown_domain(&domainsid, NULL)) {
489
490 DEBUG(10, ("SID %s is well-known, using pool\n",
491 sid_string_dbg(ids[i]->sid)));
492
493 ret = idmap_autorid_map_sid_to_id(dom, ids[i],
494 commoncfg);
495
496 if (!NT_STATUS_IS_OK(ret) &&
497 !NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
498 DEBUG(3, ("Unexpected error resolving "
499 "SID (%s)\n",
500 sid_string_dbg(ids[i]->sid)));
501 goto failure;
502 }
503
504 num_mapped++;
505
506 continue;
507 }
508
509 /*
510 * Check if the domain is around
511 */
512 domain = wcache_tdc_fetch_domainbysid(talloc_tos(),
513 &domainsid);
514 if (domain == NULL) {
515 DEBUG(10, ("Ignoring unknown domain sid %s\n",
516 sid_string_dbg(&domainsid)));
517 continue;
518 }
519 TALLOC_FREE(domain);
520
521 domaincfg.globalcfg = global;
522 sid_to_fstring(domaincfg.sid, &domainsid);
523
524 ret = idmap_autorid_get_domainrange(&domaincfg);
525
526 if (!NT_STATUS_IS_OK(ret)) {
527 DEBUG(3, ("Could not determine range for domain, "
528 "check previous messages for reason\n"));
529 goto failure;
530 }
531
532 ret = idmap_autorid_sid_to_id(global, &domaincfg, ids[i]);
533
534 if ((!NT_STATUS_IS_OK(ret)) &&
535 (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
536 /* some fatal error occurred, log it */
537 DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
538 sid_string_dbg(ids[i]->sid)));
539 goto failure;
540 }
541
542 if (NT_STATUS_IS_OK(ret)) {
543 num_mapped++;
544 }
545 }
546
547 if (num_tomap == num_mapped) {
548 return NT_STATUS_OK;
549 } else if (num_mapped == 0) {
550 return NT_STATUS_NONE_MAPPED;
551 }
552
553 return STATUS_SOME_UNMAPPED;
554
555 failure:
556 return ret;
557
558 }
559
560 /* initialize the given HWM to 0 if it does not exist yet */
561 static NTSTATUS idmap_autorid_init_hwm(const char *hwm) {
562
563 NTSTATUS status;
564 uint32_t hwmval;
565
566 status = dbwrap_fetch_uint32(autorid_db, hwm, &hwmval);
567 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
568 status = dbwrap_trans_store_int32(autorid_db, hwm, 0);
569 if (!NT_STATUS_IS_OK(status)) {
570 DEBUG(0,
571 ("Unable to initialise HWM (%s) in autorid "
572 "database: %s\n", hwm, nt_errstr(status)));
573 return NT_STATUS_INTERNAL_DB_ERROR;
574 }
575 } else if (!NT_STATUS_IS_OK(status)) {
576 DEBUG(0, ("unable to fetch HWM (%s) from autorid "
577 "database: %s\n", hwm, nt_errstr(status)));
578 return status;
579 }
580
581 return NT_STATUS_OK;
582 }
583
584 /*
585 * open and initialize the database which stores the ranges for the domains
586 */
587 static NTSTATUS idmap_autorid_db_init(void)
588 {
589 NTSTATUS status;
590
591 if (autorid_db) {
592 /* its already open */
593 return NT_STATUS_OK;
594 }
595
596 /* Open idmap repository */
597 autorid_db = db_open(NULL, state_path("autorid.tdb"), 0,
598 TDB_DEFAULT, O_RDWR | O_CREAT, 0644,
599 DBWRAP_LOCK_ORDER_1);
600
601 if (!autorid_db) {
602 DEBUG(0, ("Unable to open idmap_autorid database '%s'\n",
603 state_path("autorid.tdb")));
604 return NT_STATUS_UNSUCCESSFUL;
605 }
606
607 /* Initialize high water mark for the currently used range to 0 */
608
609 status = idmap_autorid_init_hwm(HWM);
610 NT_STATUS_NOT_OK_RETURN(status);
611
612 status = idmap_autorid_init_hwm(ALLOC_HWM_UID);
613 NT_STATUS_NOT_OK_RETURN(status);
614
615 status = idmap_autorid_init_hwm(ALLOC_HWM_GID);
616
617 return status;
618 }
619
620 static struct autorid_global_config *idmap_autorid_loadconfig(TALLOC_CTX * ctx)
621 {
622
623 TDB_DATA data;
624 struct autorid_global_config *cfg;
625 unsigned long minvalue, rangesize, maxranges;
626 NTSTATUS status;
627
628 status = dbwrap_fetch_bystring(autorid_db, ctx, CONFIGKEY, &data);
629
630 if (!NT_STATUS_IS_OK(status)) {
631 DEBUG(10, ("No saved config found\n"));
632 return NULL;
633 }
634
635 cfg = talloc_zero(ctx, struct autorid_global_config);
636 if (!cfg) {
637 return NULL;
638 }
639
640 if (sscanf((char *)data.dptr,
641 "minvalue:%lu rangesize:%lu maxranges:%lu",
642 &minvalue, &rangesize, &maxranges) != 3) {
643 DEBUG(1,
644 ("Found invalid configuration data"
645 "creating new config\n"));
646 return NULL;
647 }
648
649 cfg->minvalue = minvalue;
650 cfg->rangesize = rangesize;
651 cfg->maxranges = maxranges;
652
653 DEBUG(10, ("Loaded previously stored configuration "
654 "minvalue:%d rangesize:%d\n",
655 cfg->minvalue, cfg->rangesize));
656
657 return cfg;
658
659 }
660
661 static NTSTATUS idmap_autorid_saveconfig(struct autorid_global_config *cfg)
662 {
663
664 NTSTATUS status;
665 TDB_DATA data;
666 char *cfgstr;
667
668 cfgstr =
669 talloc_asprintf(talloc_tos(),
670 "minvalue:%u rangesize:%u maxranges:%u",
671 cfg->minvalue, cfg->rangesize, cfg->maxranges);
672
673 if (!cfgstr) {
674 return NT_STATUS_NO_MEMORY;
675 }
676
677 data = string_tdb_data(cfgstr);
678
679 status = dbwrap_trans_store_bystring(autorid_db, CONFIGKEY,
680 data, TDB_REPLACE);
681
682 talloc_free(cfgstr);
683
684 return status;
685 }
686
687 static NTSTATUS idmap_autorid_preallocate_wellknown(struct idmap_domain *dom)
688 {
689 const char *groups[] = { "S-1-1-0", "S-1-2-0", "S-1-2-1",
690 "S-1-3-0", "S-1-3-1", "S-1-3-2", "S-1-3-3", "S-1-3-4",
691 "S-1-5-1", "S-1-5-2", "S-1-5-3", "S-1-5-4", "S-1-5-6",
692 "S-1-5-7", "S-1-5-8", "S-1-5-9", "S-1-5-10", "S-1-5-11",
693 "S-1-5-12", "S-1-5-13", "S-1-5-14", "S-1-5-15",
694 "S-1-5-17", "S-1-5-18", "S-1-5-19", "S-1-5-20"
695 };
696
697 struct id_map **maps;
698 int i, num;
699 NTSTATUS status;
700
701 num = sizeof(groups)/sizeof(char*);
702
703 maps = talloc_zero_array(talloc_tos(), struct id_map*, num+1);
704 if (!maps) {
705 return NT_STATUS_NO_MEMORY;
706 }
707
708 for (i = 0; i < num; i++) {
709 maps[i] = talloc(maps, struct id_map);
710 maps[i]->xid.type = ID_TYPE_GID;
711 maps[i]->sid = dom_sid_parse_talloc(maps, groups[i]);
712 }
713
714 maps[num] = NULL;
715
716 status = idmap_autorid_sids_to_unixids(dom, maps);
717
718 DEBUG(10,("Preallocation run finished with status %s\n",
719 nt_errstr(status)));
720
721 talloc_free(maps);
722
723 return NT_STATUS_IS_OK(status)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
724 }
725
726 static NTSTATUS idmap_autorid_initialize(struct idmap_domain *dom)
727 {
728 struct idmap_tdb_common_context *commonconfig;
729 struct autorid_global_config *config;
730 struct autorid_global_config *storedconfig = NULL;
731 NTSTATUS status;
732 uint32_t hwm;
733
734 if (!strequal(dom->name, "*")) {
735 DEBUG(0, ("idmap_autorid_initialize: Error: autorid configured "
736 "for domain '%s'. But autorid can only be used for "
737 "the default idmap configuration.\n", dom->name));
738 return NT_STATUS_INVALID_PARAMETER;
739 }
740
741 commonconfig = talloc_zero(dom, struct idmap_tdb_common_context);
742 if (!commonconfig) {
743 DEBUG(0, ("Out of memory!\n"));
744 return NT_STATUS_NO_MEMORY;
745 }
746
747 commonconfig->rw_ops = talloc_zero(commonconfig, struct idmap_rw_ops);
748 if (commonconfig->rw_ops == NULL) {
749 DEBUG(0, ("Out of memory!\n"));
750 return NT_STATUS_NO_MEMORY;
751 }
752
753 config = talloc_zero(commonconfig, struct autorid_global_config);
754 if (!config) {
755 DEBUG(0, ("Out of memory!\n"));
756 return NT_STATUS_NO_MEMORY;
757 }
758
759 status = idmap_autorid_db_init();
760 if (!NT_STATUS_IS_OK(status)) {
761 goto error;
762 }
763
764 config->minvalue = dom->low_id;
765 config->rangesize = lp_parm_int(-1, "idmap config *",
766 "rangesize", 100000);
767
768 if (config->rangesize < 2000) {
769 DEBUG(1, ("autorid rangesize must be at least 2000\n"));
770 status = NT_STATUS_INVALID_PARAMETER;
771 goto error;
772 }
773
774 config->maxranges = (dom->high_id - dom->low_id + 1) /
775 config->rangesize;
776
777 if (config->maxranges == 0) {
778 DEBUG(1, ("allowed uid range is smaller then rangesize, "
779 "increase uid range or decrease rangesize\n"));
780 status = NT_STATUS_INVALID_PARAMETER;
781 goto error;
782 }
783
784 /* check if the high-low limit is a multiple of the rangesize */
785 if ((dom->high_id - dom->low_id + 1) % config->rangesize != 0) {
786 DEBUG(5, ("High uid-low uid difference of %d "
787 "is not a multiple of the rangesize %d, "
788 "limiting ranges to lower boundary number of %d\n",
789 (dom->high_id - dom->low_id + 1), config->rangesize,
790 config->maxranges));
791 }
792
793 DEBUG(10, ("Current configuration in config is "
794 "minvalue:%d rangesize:%d maxranges:%d\n",
795 config->minvalue, config->rangesize, config->maxranges));
796
797 /* read previously stored config and current HWM */
798 storedconfig = idmap_autorid_loadconfig(talloc_tos());
799
800 status = dbwrap_fetch_uint32(autorid_db, HWM, &hwm);
801 if (!NT_STATUS_IS_OK(status)) {
802 DEBUG(1, ("Fatal error while fetching current "
803 "HWM value: %s\n", nt_errstr(status)));
804 status = NT_STATUS_INTERNAL_ERROR;
805 goto error;
806 }
807
808 /* did the minimum value or rangesize change? */
809 if (storedconfig &&
810 ((storedconfig->minvalue != config->minvalue) ||
811 (storedconfig->rangesize != config->rangesize))) {
812 DEBUG(1, ("New configuration values for rangesize or "
813 "minimum uid value conflict with previously "
814 "used values! Aborting initialization\n"));
815 status = NT_STATUS_INVALID_PARAMETER;
816 goto error;
817 }
818
819 /*
820 * has the highest uid value been reduced to setting that is not
821 * sufficient any more for already existing ranges?
822 */
823 if (hwm > config->maxranges) {
824 DEBUG(1, ("New upper uid limit is too low to cover "
825 "existing mappings! Aborting initialization\n"));
826 status = NT_STATUS_INVALID_PARAMETER;
827 goto error;
828 }
829
830 status = idmap_autorid_saveconfig(config);
831
832 if (!NT_STATUS_IS_OK(status)) {
833 DEBUG(1, ("Failed to store configuration data!\n"));
834 goto error;
835 }
836
837 DEBUG(5, ("%d domain ranges with a size of %d are available\n",
838 config->maxranges, config->rangesize));
839
840 /* fill the TDB common configuration */
841 commonconfig->private_data = config;
842
843 commonconfig->db = autorid_db;
844 commonconfig->max_id = config->rangesize -1;
845 commonconfig->hwmkey_uid = ALLOC_HWM_UID;
846 commonconfig->hwmkey_gid = ALLOC_HWM_GID;
847 commonconfig->rw_ops->get_new_id = idmap_autorid_allocate_id;
848 commonconfig->rw_ops->set_mapping = idmap_tdb_common_set_mapping;
849
850 dom->private_data = commonconfig;
851
852 /* preallocate well-known SIDs in the pool */
853 status = idmap_autorid_preallocate_wellknown(dom);
854
855 goto done;
856
857 error:
858 talloc_free(config);
859
860 done:
861 talloc_free(storedconfig);
862
863 return status;
864 }
865
866 /*
867 Close the idmap tdb instance
868 */
869 static struct idmap_methods autorid_methods = {
870 .init = idmap_autorid_initialize,
871 .unixids_to_sids = idmap_autorid_unixids_to_sids,
872 .sids_to_unixids = idmap_autorid_sids_to_unixids,
873 .allocate_id = idmap_autorid_allocate_id
874 };
875
876 NTSTATUS samba_init_module(void)
877 {
878 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
879 "autorid", &autorid_methods);
880 }
Working branch of Samba for id10ts