From 4225f9a4bd5eece4d57820bbabb7b882610aa7cc Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Tue, 12 Dec 2006 14:52:13 +0000 Subject: r20116: Start merging in the work done to create the new idmap subsystem. Simo. (This used to be commit 50cd8bffeeed2cac755f75fc3d76fe41c451976b) --- source3/nsswitch/idmap_rid.c | 262 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 262 insertions(+) create mode 100644 source3/nsswitch/idmap_rid.c (limited to 'source3/nsswitch/idmap_rid.c') diff --git a/source3/nsswitch/idmap_rid.c b/source3/nsswitch/idmap_rid.c new file mode 100644 index 0000000000..55b04df9aa --- /dev/null +++ b/source3/nsswitch/idmap_rid.c @@ -0,0 +1,262 @@ +/* + * idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts + * Copyright (C) Guenther Deschner, 2004 + * Copyright (C) Sumit Bose, 2004 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * + */ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_IDMAP + +struct idmap_rid_context { + DOM_SID dom_sid; + uint32_t low_id; + uint32_t high_id; + uint32_t base_rid; +}; + +/* compat params can't be used because of the completely different way we support multiple domains in the new idmap */ +static NTSTATUS idmap_rid_initialize(struct idmap_domain *dom, const char *compat_params) +{ + NTSTATUS ret; + struct idmap_rid_context *ctx; + char *config_option = NULL; + const char *range; + + ctx = talloc_zero(dom, struct idmap_rid_context); + if ( ! ctx) { + DEBUG(0, ("Out of memory!\n")); + return NT_STATUS_NO_MEMORY; + } + + config_option = talloc_asprintf(ctx, "idmap config %s", dom->name); + if ( ! config_option) { + DEBUG(0, ("Out of memory!\n")); + ret = NT_STATUS_NO_MEMORY; + goto failed; + } + + range = lp_parm_const_string(-1, config_option, "range", NULL); + if (( ! range) || + (sscanf(range, "%u - %u", &ctx->low_id, &ctx->high_id) != 2) || + (ctx->low_id > ctx->high_id)) { + ctx->low_id = 0; + ctx->high_id = 0; + } + + if (( ! ctx->low_id) || ( ! ctx->high_id)) { + DEBUG(1, ("ERROR: Invalid configuration, ID range missing\n")); + ret = NT_STATUS_UNSUCCESSFUL; + goto failed; + } + + ctx->base_rid = lp_parm_int(-1, config_option, "base_rid", 0); + + sid_copy(&ctx->dom_sid, dom->sid); + + dom->private_data = ctx; + + talloc_free(config_option); + return NT_STATUS_OK; + +failed: + talloc_free(ctx); + return ret; +} + +static NTSTATUS idmap_rid_id_to_sid(struct idmap_rid_context *ctx, struct id_map *map) +{ + char *domname, *name; + enum lsa_SidType sid_type; + + if (!ctx || !map) { + return NT_STATUS_INVALID_PARAMETER; + } + + /* apply filters before checking */ + if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) { + DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n", + map->xid.id, ctx->low_id, ctx->high_id)); + return NT_STATUS_NONE_MAPPED; + } + + sid_compose(map->sid, &ctx->dom_sid, map->xid.id - ctx->low_id + ctx->base_rid); + + if (winbindd_lookup_name_by_sid(ctx, map->sid, &domname, &name, &sid_type)) { + switch (sid_type) { + case SID_NAME_USER: + if (map->xid.type != ID_TYPE_UID) { + /* wrong type */ + DEBUG(5, ("Resulting SID is of wrong ID type\n")); + return NT_STATUS_NONE_MAPPED; + } + break; + case SID_NAME_DOM_GRP: + case SID_NAME_ALIAS: + case SID_NAME_WKN_GRP: + if (map->xid.type != ID_TYPE_GID) { + /* wrong type */ + DEBUG(5, ("Resulting SID is of wrong ID type\n")); + return NT_STATUS_NONE_MAPPED; + } + break; + default: + /* invalid sid, let's just leave it unmapped */ + DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid))); + return NT_STATUS_NONE_MAPPED; + } + } else { + DEBUG(2, ("Failed: to resolve SID\n")); + return NT_STATUS_UNSUCCESSFUL; + } + + map->mapped = True; + + return NT_STATUS_OK; +} + +/********************************** + Single sid to id lookup function. +**********************************/ + +static NTSTATUS idmap_rid_sid_to_id(struct idmap_rid_context *ctx, struct id_map *map) +{ + char *domname, *name; + enum lsa_SidType sid_type; + uint32_t rid; + + if (!ctx || !map) { + return NT_STATUS_INVALID_PARAMETER; + } + + sid_peek_rid(map->sid, &rid); + map->xid.id = rid - ctx->base_rid + ctx->low_id; + + /* check if this is a valid SID and set the type */ + if (winbindd_lookup_name_by_sid(ctx, map->sid, &domname, &name, &sid_type)) { + switch (sid_type) { + case SID_NAME_USER: + map->xid.type = ID_TYPE_UID; + break; + case SID_NAME_DOM_GRP: + case SID_NAME_ALIAS: + case SID_NAME_WKN_GRP: + map->xid.type = ID_TYPE_GID; + break; + default: + /* invalid sid, let's just leave it unmapped */ + DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid))); + return NT_STATUS_NONE_MAPPED; + } + } else { + DEBUG(2, ("Failed: to resolve SID\n")); + return NT_STATUS_UNSUCCESSFUL; + } + + /* apply filters before returning result */ + if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) { + DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n", + map->xid.id, ctx->low_id, ctx->high_id)); + return NT_STATUS_NONE_MAPPED; + } + + map->mapped = True; + + return NT_STATUS_OK; +} + +/********************************** + lookup a set of unix ids. +**********************************/ + +static NTSTATUS idmap_rid_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids) +{ + struct idmap_rid_context *ctx; + NTSTATUS ret; + int i; + + ctx = talloc_get_type(dom->private_data, struct idmap_rid_context); + + for (i = 0; ids[i]; i++) { + /* make sure it is marked as unmapped before resolveing */ + ids[i]->mapped = False; + + ret = idmap_rid_id_to_sid(ctx, ids[i]); + + if (( ! NT_STATUS_IS_OK(ret)) && + ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) { + /* some fatal error occurred, log it */ + DEBUG(3, ("Unexpected error resolving an ID (%d)\n", ids[i]->xid.id)); + } + } + + return NT_STATUS_OK; +} + +/********************************** + lookup a set of sids. +**********************************/ + +static NTSTATUS idmap_rid_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids) +{ + struct idmap_rid_context *ctx; + NTSTATUS ret; + int i; + + ctx = talloc_get_type(dom->private_data, struct idmap_rid_context); + + for (i = 0; ids[i]; i++) { + /* make sure it is marked as unmapped before resolveing */ + ids[i]->mapped = False; + + ret = idmap_rid_sid_to_id(ctx, ids[i]); + + if (( ! NT_STATUS_IS_OK(ret)) && + ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) { + /* some fatal error occurred, log it */ + DEBUG(3, ("Unexpected error resolving a SID (%s)\n", + sid_string_static(ids[i]->sid))); + } + } + + return NT_STATUS_OK; +} + +static NTSTATUS idmap_rid_close(struct idmap_domain *dom) +{ + struct idmap_tdb_context *ctx; + + if (dom->private_data) { + TALLOC_FREE(dom->private_data); + } + return NT_STATUS_OK; +} + +static struct idmap_methods rid_methods = { + .init = idmap_rid_initialize, + .unixids_to_sids = idmap_rid_unixids_to_sids, + .sids_to_unixids = idmap_rid_sids_to_unixids, + .close_fn = idmap_rid_close +}; + +NTSTATUS idmap_rid_init(void) +{ + return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "rid", &rid_methods); +} + -- cgit