summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source4/winbind/idmap.c257
-rw-r--r--source4/winbind/wb_sid2gid.c11
2 files changed, 263 insertions, 5 deletions
diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index 53276114dd..3372ad51ee 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -801,7 +801,7 @@ failed:
*
* If no mapping exist, a new mapping will be created.
*
- * \todo Create mappings for groups not from our primary domain.
+ * \todo Check if SID resolve when lp_idmap_trusted_only() == true
*
* \param idmap_ctx idmap context to use
* \param mem_ctx talloc context to use
@@ -814,6 +814,259 @@ failed:
NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
const struct dom_sid *sid, gid_t *gid)
{
- return NT_STATUS_NONE_MAPPED;
+ int ret;
+ NTSTATUS status = NT_STATUS_NONE_MAPPED;
+ struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+ struct ldb_dn *dn;
+ struct ldb_message *hwm_msg, *map_msg;
+ struct ldb_result *res = NULL;
+ int trans = -1;
+ gid_t low, high, hwm, new_gid;
+ char *sid_string, *gid_string, *hwm_string;
+ bool hwm_entry_exists;
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+ ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count == 1) {
+ new_gid = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber",
+ -1);
+ if (new_gid == (gid_t) -1) {
+ DEBUG(1, ("Invalid gid mapping.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ *gid = new_gid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+ }
+
+ DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
+
+ trans = ldb_transaction_start(ldb);
+ if (trans != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ /* Redo the search to make sure noone changed the mapping while we
+ * weren't looking */
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+ ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count > 0) {
+ DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
+ status = NT_STATUS_RETRY;
+ goto failed;
+ }
+
+ /*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
+ * resolved here. */
+
+ ret = idmap_get_bounds(idmap_ctx, &low, &high);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+ if (dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ talloc_steal(tmp_ctx, res);
+
+ if (res->count != 1) {
+ DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber", -1);
+ if (hwm == (gid_t)-1) {
+ hwm = low;
+ hwm_entry_exists = false;
+ } else {
+ hwm_entry_exists = true;
+ }
+
+ if (hwm > high) {
+ DEBUG(1, ("Out of gids to allocate.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ hwm_msg = ldb_msg_new(tmp_ctx);
+ if (hwm_msg == NULL) {
+ DEBUG(1, ("Out of memory when creating ldb_message\n"));
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ hwm_msg->dn = dn;
+
+ new_gid = hwm;
+ hwm++;
+
+ hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
+ if (hwm_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ sid_string = dom_sid_string(tmp_ctx, sid);
+ if (sid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ gid_string = talloc_asprintf(tmp_ctx, "%u", new_gid);
+ if (gid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ if (hwm_entry_exists) {
+ struct ldb_message_element *els;
+ struct ldb_val *vals;
+
+ /* We're modifying the entry, not just adding a new one. */
+ els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
+ if (els == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ vals = talloc_array(tmp_ctx, struct ldb_val, 2);
+ if (els == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ hwm_msg->num_elements = 2;
+ hwm_msg->elements = els;
+
+ els[0].num_values = 1;
+ els[0].values = &vals[0];
+ els[0].flags = LDB_FLAG_MOD_DELETE;
+ els[0].name = talloc_strdup(tmp_ctx, "gidNumber");
+ if (els[0].name == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ els[1].num_values = 1;
+ els[1].values = &vals[1];
+ els[1].flags = LDB_FLAG_MOD_ADD;
+ els[1].name = els[0].name;
+
+ vals[0].data = (uint8_t *)gid_string;
+ vals[0].length = strlen(gid_string);
+ vals[1].data = (uint8_t *)hwm_string;
+ vals[1].length = strlen(hwm_string);
+ } else {
+ ret = ldb_msg_add_empty(hwm_msg, "gidNumber", LDB_FLAG_MOD_ADD,
+ NULL);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(hwm_msg, "gidNumber", hwm_string);
+ if (ret != LDB_SUCCESS)
+ {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ }
+
+ ret = ldb_modify(ldb, hwm_msg);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Updating the gid high water mark failed: %s\n",
+ ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ map_msg = ldb_msg_new(tmp_ctx);
+ if (map_msg == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+ if (map_msg->dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "gidNumber", gid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
+ sid);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "cn", sid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_add(ldb, map_msg);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ trans = ldb_transaction_commit(ldb);
+ if (trans != LDB_SUCCESS) {
+ DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ *gid = new_gid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+
+failed:
+ if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+ talloc_free(tmp_ctx);
+ return status;
}
diff --git a/source4/winbind/wb_sid2gid.c b/source4/winbind/wb_sid2gid.c
index 8cb5608b2f..12129226be 100644
--- a/source4/winbind/wb_sid2gid.c
+++ b/source4/winbind/wb_sid2gid.c
@@ -25,6 +25,7 @@
#include "smbd/service_task.h"
#include "winbind/wb_helper.h"
#include "libcli/security/proto.h"
+#include "winbind/idmap.h"
struct sid2gid_state {
struct composite_context *ctx;
@@ -50,9 +51,13 @@ struct composite_context *wb_sid2gid_send(TALLOC_CTX *mem_ctx,
result->private_data = state;
state->service = service;
- /*FIXME: This is a stub so far. */
- state->ctx->status = dom_sid_split_rid(result, sid, NULL, &state->gid);
- if(!composite_is_ok(state->ctx)) return result;
+ state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state, sid,
+ &state->gid);
+ if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+ state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state,
+ sid, &state->gid);
+ }
+ if (!composite_is_ok(state->ctx)) return result;
composite_done(state->ctx);
return result;