mirror of
https://github.com/samba-team/samba.git
synced 2024-12-22 13:34:15 +03:00
idmap: Map SIDs to unixids instead of uids/gids
This commit is contained in:
parent
f56912e3b5
commit
73ac7c4a1c
@ -16,6 +16,8 @@ OBJ_FILES = \
|
||||
wb_dom_info_trusted.o \
|
||||
wb_sid2domain.o \
|
||||
wb_name2domain.o \
|
||||
wb_sids2xids.o \
|
||||
wb_xids2sids.o \
|
||||
wb_gid2sid.o \
|
||||
wb_sid2uid.o \
|
||||
wb_sid2gid.o \
|
||||
|
@ -1,7 +1,7 @@
|
||||
/*
|
||||
Unix SMB/CIFS implementation.
|
||||
|
||||
Map SIDs to uids/gids and back
|
||||
Map SIDs to unixids and back
|
||||
|
||||
Copyright (C) Kai Blin 2008
|
||||
|
||||
@ -177,39 +177,46 @@ struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
|
||||
return NULL;
|
||||
}
|
||||
|
||||
idmap_ctx->unix_groups_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-2");
|
||||
if (idmap_ctx->unix_groups_sid == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
idmap_ctx->unix_users_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-1");
|
||||
if (idmap_ctx->unix_users_sid == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return idmap_ctx;
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert a uid to the corresponding SID
|
||||
* Convert an unixid to the corresponding SID
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context the memory for the struct dom_sid is allocated
|
||||
* from.
|
||||
* \param uid Unix uid to map to a SID
|
||||
* \param sid Pointer that will take the struct dom_sid pointer if the mapping
|
||||
* \param unixid pointer to a unixid struct to convert
|
||||
* \param sid pointer that will take the struct dom_sid pointer if the mapping
|
||||
* succeeds.
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
|
||||
* possible or some other NTSTATUS that is more descriptive on failure.
|
||||
*/
|
||||
|
||||
NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const uid_t uid, struct dom_sid **sid)
|
||||
NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const struct unixid *unixid, struct dom_sid **sid)
|
||||
{
|
||||
int ret;
|
||||
NTSTATUS status = NT_STATUS_NONE_MAPPED;
|
||||
struct ldb_context *ldb = idmap_ctx->ldb_ctx;
|
||||
struct ldb_message *msg;
|
||||
struct ldb_result *res = NULL;
|
||||
int trans = -1;
|
||||
uid_t low, high;
|
||||
char *sid_string, *uid_string;
|
||||
struct dom_sid *unix_users_sid, *new_sid;
|
||||
uint32_t low, high;
|
||||
struct dom_sid *unix_sid, *new_sid;
|
||||
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
|
||||
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
|
||||
uid);
|
||||
NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
|
||||
unixid->id);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
@ -228,19 +235,13 @@ NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
DEBUG(6, ("uid not found in idmap db, trying to allocate SID.\n"));
|
||||
|
||||
trans = ldb_transaction_start(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
DEBUG(6, ("xid not found in idmap db, trying to allocate SID.\n"));
|
||||
|
||||
/* Now redo the search to make sure noone added a mapping for that SID
|
||||
* while we weren't looking.*/
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
|
||||
uid);
|
||||
NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
|
||||
unixid->id);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
@ -260,285 +261,58 @@ NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (uid >= low && uid <= high) {
|
||||
/* An existing user would have been mapped before */
|
||||
status = NT_STATUS_NO_SUCH_USER;
|
||||
if (unixid->id >= low && unixid->id <= high) {
|
||||
/* An existing xid would have been mapped before */
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* For local users, we just create a rid = uid +1, so root doesn't end
|
||||
* up with a 0 rid */
|
||||
unix_users_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
|
||||
if (unix_users_sid == NULL) {
|
||||
if (unixid->type == ID_TYPE_UID) {
|
||||
unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
|
||||
} else {
|
||||
unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
|
||||
}
|
||||
if (unix_sid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
new_sid = dom_sid_add_rid(mem_ctx, unix_users_sid, uid + 1);
|
||||
new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id + 1);
|
||||
if (new_sid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
sid_string = dom_sid_string(tmp_ctx, new_sid);
|
||||
if (sid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
uid_string = talloc_asprintf(tmp_ctx, "%u", uid);
|
||||
if (uid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
msg = ldb_msg_new(tmp_ctx);
|
||||
if (msg == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
|
||||
if (msg->dn == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "uidNumber", uid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
|
||||
new_sid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "cn", sid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_add(ldb, msg);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
trans = ldb_transaction_commit(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
*sid = new_sid;
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
|
||||
failed:
|
||||
if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
|
||||
talloc_free(tmp_ctx);
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Map a Unix gid to the corresponding SID
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context the memory for the struct dom_sid is allocated
|
||||
* from.
|
||||
* \param gid Unix gid to map to a SID
|
||||
* \param sid Pointer that will take the struct dom_sid pointer if mapping
|
||||
* succeeds.
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
|
||||
* possible or some other NTSTATUS that is more descriptive on failure.
|
||||
*/
|
||||
NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const gid_t gid, struct dom_sid **sid)
|
||||
{
|
||||
int ret;
|
||||
NTSTATUS status = NT_STATUS_NONE_MAPPED;
|
||||
struct ldb_context *ldb = idmap_ctx->ldb_ctx;
|
||||
struct ldb_message *msg;
|
||||
struct ldb_result *res = NULL;
|
||||
int trans = -1;
|
||||
gid_t low, high;
|
||||
char *sid_string, *gid_string;
|
||||
struct dom_sid *unix_groups_sid, *new_sid;
|
||||
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
|
||||
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(gidNumber=%u))", gid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (res->count == 1) {
|
||||
*sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
|
||||
"objectSid");
|
||||
if (*sid == NULL) {
|
||||
DEBUG(1, ("Failed to get sid from db: %u\n", ret));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
/* No change, so cancel the transaction */
|
||||
ldb_transaction_cancel(ldb);
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
DEBUG(6, ("gid not found in idmap db, trying to allocate SID.\n"));
|
||||
|
||||
trans = ldb_transaction_start(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* Now redo the search to make sure noone added a mapping for that SID
|
||||
* while we weren't looking.*/
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(gidNumber=%u))",
|
||||
gid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (res->count > 0) {
|
||||
DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
|
||||
status = NT_STATUS_RETRY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = idmap_get_bounds(idmap_ctx, &low, &high);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (gid >= low && gid <= high) {
|
||||
/* An existing group would have been mapped before */
|
||||
status = NT_STATUS_NO_SUCH_USER;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* For local groups, we just create a rid = gid +1, so root doesn't end
|
||||
* up with a 0 rid */
|
||||
unix_groups_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
|
||||
if (unix_groups_sid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
new_sid = dom_sid_add_rid(mem_ctx, unix_groups_sid, gid + 1);
|
||||
if (new_sid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
sid_string = dom_sid_string(tmp_ctx, new_sid);
|
||||
if (sid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
gid_string = talloc_asprintf(tmp_ctx, "%u", gid);
|
||||
if (gid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
msg = ldb_msg_new(tmp_ctx);
|
||||
if (msg == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
|
||||
if (msg->dn == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "gidNumber", gid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
|
||||
new_sid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "cn", sid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_add(ldb, msg);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
trans = ldb_transaction_commit(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
*sid = new_sid;
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
|
||||
failed:
|
||||
if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
|
||||
talloc_free(tmp_ctx);
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Map a SID to a Unix uid.
|
||||
* Map a SID to an unixid struct.
|
||||
*
|
||||
* If no mapping exists, a new mapping will be created.
|
||||
*
|
||||
* \todo Check if SIDs can be resolved if lp_idmap_trusted_only() == true
|
||||
* \todo Fix backwards compatibility for Samba3
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context to use
|
||||
* \param sid SID to map to a Unix uid
|
||||
* \param uid pointer to receive the mapped uid
|
||||
* \param sid SID to map to an unixid struct
|
||||
* \param unixid pointer to a unixid struct pointer
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
|
||||
* a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
|
||||
* mapping failed.
|
||||
*/
|
||||
NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *sid, uid_t *uid)
|
||||
NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *sid, struct unixid **unixid)
|
||||
{
|
||||
int ret;
|
||||
NTSTATUS status = NT_STATUS_NONE_MAPPED;
|
||||
@ -547,8 +321,8 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
struct ldb_message *hwm_msg, *map_msg;
|
||||
struct ldb_result *res = NULL;
|
||||
int trans;
|
||||
uid_t low, high, hwm, new_uid;
|
||||
char *sid_string, *uid_string, *hwm_string;
|
||||
uint32_t low, high, hwm, new_xid;
|
||||
char *sid_string, *unixid_string, *hwm_string;
|
||||
bool hwm_entry_exists;
|
||||
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
|
||||
|
||||
@ -562,20 +336,65 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
}
|
||||
|
||||
if (res->count == 1) {
|
||||
new_uid = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber",
|
||||
new_xid = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber",
|
||||
-1);
|
||||
if (new_uid == (uid_t) -1) {
|
||||
DEBUG(1, ("Invalid uid mapping.\n"));
|
||||
if (new_xid == (uint32_t) -1) {
|
||||
DEBUG(1, ("Invalid xid mapping.\n"));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
*uid = new_uid;
|
||||
|
||||
*unixid = talloc(mem_ctx, struct unixid);
|
||||
if (*unixid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
(*unixid)->id = new_xid;
|
||||
(*unixid)->type = ID_TYPE_BOTH;
|
||||
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
|
||||
|
||||
if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
|
||||
uint32_t rid;
|
||||
DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
|
||||
status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
|
||||
if (!NT_STATUS_IS_OK(status)) goto failed;
|
||||
|
||||
*unixid = talloc(mem_ctx, struct unixid);
|
||||
if (*unixid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
(*unixid)->id = rid - 1;
|
||||
(*unixid)->type = ID_TYPE_UID;
|
||||
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
|
||||
uint32_t rid;
|
||||
DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
|
||||
status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
|
||||
if (!NT_STATUS_IS_OK(status)) goto failed;
|
||||
|
||||
*unixid = talloc(mem_ctx, struct unixid);
|
||||
if (*unixid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
(*unixid)->id = rid - 1;
|
||||
(*unixid)->type = ID_TYPE_GID;
|
||||
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
trans = ldb_transaction_start(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
@ -629,8 +448,8 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
goto failed;
|
||||
}
|
||||
|
||||
hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber", -1);
|
||||
if (hwm == (uid_t)-1) {
|
||||
hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber", -1);
|
||||
if (hwm == (uint32_t)-1) {
|
||||
hwm = low;
|
||||
hwm_entry_exists = false;
|
||||
} else {
|
||||
@ -638,7 +457,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
}
|
||||
|
||||
if (hwm > high) {
|
||||
DEBUG(1, ("Out of uids to allocate.\n"));
|
||||
DEBUG(1, ("Out of xids to allocate.\n"));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
@ -652,7 +471,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
|
||||
hwm_msg->dn = dn;
|
||||
|
||||
new_uid = hwm;
|
||||
new_xid = hwm;
|
||||
hwm++;
|
||||
|
||||
hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
|
||||
@ -667,8 +486,8 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
goto failed;
|
||||
}
|
||||
|
||||
uid_string = talloc_asprintf(tmp_ctx, "%u", new_uid);
|
||||
if (uid_string == NULL) {
|
||||
unixid_string = talloc_asprintf(tmp_ctx, "%u", new_xid);
|
||||
if (unixid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
@ -696,7 +515,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
els[0].num_values = 1;
|
||||
els[0].values = &vals[0];
|
||||
els[0].flags = LDB_FLAG_MOD_DELETE;
|
||||
els[0].name = talloc_strdup(tmp_ctx, "uidNumber");
|
||||
els[0].name = talloc_strdup(tmp_ctx, "xidNumber");
|
||||
if (els[0].name == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
@ -707,19 +526,19 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
els[1].flags = LDB_FLAG_MOD_ADD;
|
||||
els[1].name = els[0].name;
|
||||
|
||||
vals[0].data = (uint8_t *)uid_string;
|
||||
vals[0].length = strlen(uid_string);
|
||||
vals[0].data = (uint8_t *)unixid_string;
|
||||
vals[0].length = strlen(unixid_string);
|
||||
vals[1].data = (uint8_t *)hwm_string;
|
||||
vals[1].length = strlen(hwm_string);
|
||||
} else {
|
||||
ret = ldb_msg_add_empty(hwm_msg, "uidNumber", LDB_FLAG_MOD_ADD,
|
||||
ret = ldb_msg_add_empty(hwm_msg, "xidNumber", LDB_FLAG_MOD_ADD,
|
||||
NULL);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(hwm_msg, "uidNumber", hwm_string);
|
||||
ret = ldb_msg_add_string(hwm_msg, "xidNumber", hwm_string);
|
||||
if (ret != LDB_SUCCESS)
|
||||
{
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
@ -729,7 +548,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
|
||||
ret = ldb_modify(ldb, hwm_msg);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Updating the uid high water mark failed: %s\n",
|
||||
DEBUG(1, ("Updating the xid high water mark failed: %s\n",
|
||||
ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
@ -747,7 +566,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(map_msg, "uidNumber", uid_string);
|
||||
ret = ldb_msg_add_string(map_msg, "xidNumber", unixid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
@ -786,7 +605,14 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
goto failed;
|
||||
}
|
||||
|
||||
*uid = new_uid;
|
||||
*unixid = talloc(mem_ctx, struct unixid);
|
||||
if (*unixid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
(*unixid)->id = new_xid;
|
||||
(*unixid)->type = ID_TYPE_BOTH;
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
|
||||
@ -797,276 +623,92 @@ failed:
|
||||
}
|
||||
|
||||
/**
|
||||
* Map a SID to a Unix gid.
|
||||
*
|
||||
* If no mapping exist, a new mapping will be created.
|
||||
*
|
||||
* \todo Check if SID resolve when lp_idmap_trusted_only() == true
|
||||
* Convert an array of unixids to the corresponding array of SIDs
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context to use
|
||||
* \param sid SID to map to a Unix gid
|
||||
* \param gid pointer to receive the mapped gid
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
|
||||
* a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
|
||||
* mapping failed.
|
||||
* \param mem_ctx talloc context the memory for the dom_sids is allocated
|
||||
* from.
|
||||
* \param count length of id_mapping array.
|
||||
* \param id array of id_mappings.
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
|
||||
* possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
|
||||
* did not.
|
||||
*/
|
||||
NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *sid, gid_t *gid)
|
||||
{
|
||||
int ret;
|
||||
NTSTATUS status = NT_STATUS_NONE_MAPPED;
|
||||
struct ldb_context *ldb = idmap_ctx->ldb_ctx;
|
||||
struct ldb_dn *dn;
|
||||
struct ldb_message *hwm_msg, *map_msg;
|
||||
struct ldb_result *res = NULL;
|
||||
int trans = -1;
|
||||
gid_t low, high, hwm, new_gid;
|
||||
char *sid_string, *gid_string, *hwm_string;
|
||||
bool hwm_entry_exists;
|
||||
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
|
||||
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(objectSid=%s))",
|
||||
ldap_encode_ndr_dom_sid(tmp_ctx, sid));
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
NTSTATUS idmap_xids_to_sids(struct idmap_context *idmap_ctx,
|
||||
TALLOC_CTX *mem_ctx, int count,
|
||||
struct id_mapping *id)
|
||||
{
|
||||
int i;
|
||||
int error_count = 0;
|
||||
|
||||
for (i = 0; i < count; ++i) {
|
||||
id[i].status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
|
||||
id[i].unixid, &id[i].sid);
|
||||
if (NT_STATUS_EQUAL(id[i].status, NT_STATUS_RETRY)) {
|
||||
id[i].status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
|
||||
id[i].unixid,
|
||||
&id[i].sid);
|
||||
}
|
||||
if (!NT_STATUS_IS_OK(id[i].status)) {
|
||||
DEBUG(1, ("idmapping failed for id[%d]\n", i));
|
||||
error_count++;
|
||||
}
|
||||
}
|
||||
|
||||
if (res->count == 1) {
|
||||
new_gid = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber",
|
||||
-1);
|
||||
if (new_gid == (gid_t) -1) {
|
||||
DEBUG(1, ("Invalid gid mapping.\n"));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
*gid = new_gid;
|
||||
talloc_free(tmp_ctx);
|
||||
if (error_count == count) {
|
||||
/* Mapping did not work at all. */
|
||||
return NT_STATUS_NONE_MAPPED;
|
||||
} else if (error_count > 0) {
|
||||
/* Some mappings worked, some did not. */
|
||||
return STATUS_SOME_UNMAPPED;
|
||||
} else {
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert an array of SIDs to the corresponding array of unixids
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context the memory for the unixids is allocated
|
||||
* from.
|
||||
* \param count length of id_mapping array.
|
||||
* \param id array of id_mappings.
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
|
||||
* possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
|
||||
* did not.
|
||||
*/
|
||||
|
||||
NTSTATUS idmap_sids_to_xids(struct idmap_context *idmap_ctx,
|
||||
TALLOC_CTX *mem_ctx, int count,
|
||||
struct id_mapping *id)
|
||||
{
|
||||
int i;
|
||||
int error_count = 0;
|
||||
|
||||
for (i = 0; i < count; ++i) {
|
||||
id[i].status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
|
||||
id[i].sid, &id[i].unixid);
|
||||
if (NT_STATUS_EQUAL(id[i].status, NT_STATUS_RETRY)) {
|
||||
id[i].status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
|
||||
id[i].sid,
|
||||
&id[i].unixid);
|
||||
}
|
||||
if (!NT_STATUS_IS_OK(id[i].status)) {
|
||||
DEBUG(1, ("idmapping failed for id[%d]\n", i));
|
||||
error_count++;
|
||||
}
|
||||
}
|
||||
|
||||
if (error_count == count) {
|
||||
/* Mapping did not work at all. */
|
||||
return NT_STATUS_NONE_MAPPED;
|
||||
} else if (error_count > 0) {
|
||||
/* Some mappings worked, some did not. */
|
||||
return STATUS_SOME_UNMAPPED;
|
||||
} else {
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
|
||||
|
||||
trans = ldb_transaction_start(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* Redo the search to make sure noone changed the mapping while we
|
||||
* weren't looking */
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(objectSid=%s))",
|
||||
ldap_encode_ndr_dom_sid(tmp_ctx, sid));
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (res->count > 0) {
|
||||
DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
|
||||
status = NT_STATUS_RETRY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
|
||||
* resolved here. */
|
||||
|
||||
ret = idmap_get_bounds(idmap_ctx, &low, &high);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
|
||||
if (dn == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
talloc_steal(tmp_ctx, res);
|
||||
|
||||
if (res->count != 1) {
|
||||
DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber", -1);
|
||||
if (hwm == (gid_t)-1) {
|
||||
hwm = low;
|
||||
hwm_entry_exists = false;
|
||||
} else {
|
||||
hwm_entry_exists = true;
|
||||
}
|
||||
|
||||
if (hwm > high) {
|
||||
DEBUG(1, ("Out of gids to allocate.\n"));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
hwm_msg = ldb_msg_new(tmp_ctx);
|
||||
if (hwm_msg == NULL) {
|
||||
DEBUG(1, ("Out of memory when creating ldb_message\n"));
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
hwm_msg->dn = dn;
|
||||
|
||||
new_gid = hwm;
|
||||
hwm++;
|
||||
|
||||
hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
|
||||
if (hwm_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
sid_string = dom_sid_string(tmp_ctx, sid);
|
||||
if (sid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
gid_string = talloc_asprintf(tmp_ctx, "%u", new_gid);
|
||||
if (gid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (hwm_entry_exists) {
|
||||
struct ldb_message_element *els;
|
||||
struct ldb_val *vals;
|
||||
|
||||
/* We're modifying the entry, not just adding a new one. */
|
||||
els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
|
||||
if (els == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
vals = talloc_array(tmp_ctx, struct ldb_val, 2);
|
||||
if (els == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
hwm_msg->num_elements = 2;
|
||||
hwm_msg->elements = els;
|
||||
|
||||
els[0].num_values = 1;
|
||||
els[0].values = &vals[0];
|
||||
els[0].flags = LDB_FLAG_MOD_DELETE;
|
||||
els[0].name = talloc_strdup(tmp_ctx, "gidNumber");
|
||||
if (els[0].name == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
els[1].num_values = 1;
|
||||
els[1].values = &vals[1];
|
||||
els[1].flags = LDB_FLAG_MOD_ADD;
|
||||
els[1].name = els[0].name;
|
||||
|
||||
vals[0].data = (uint8_t *)gid_string;
|
||||
vals[0].length = strlen(gid_string);
|
||||
vals[1].data = (uint8_t *)hwm_string;
|
||||
vals[1].length = strlen(hwm_string);
|
||||
} else {
|
||||
ret = ldb_msg_add_empty(hwm_msg, "gidNumber", LDB_FLAG_MOD_ADD,
|
||||
NULL);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(hwm_msg, "gidNumber", hwm_string);
|
||||
if (ret != LDB_SUCCESS)
|
||||
{
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
}
|
||||
|
||||
ret = ldb_modify(ldb, hwm_msg);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Updating the gid high water mark failed: %s\n",
|
||||
ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
map_msg = ldb_msg_new(tmp_ctx);
|
||||
if (map_msg == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
|
||||
if (map_msg->dn == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(map_msg, "gidNumber", gid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
|
||||
sid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(map_msg, "cn", sid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_add(ldb, map_msg);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
trans = ldb_transaction_commit(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
*gid = new_gid;
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
|
||||
failed:
|
||||
if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
|
||||
talloc_free(tmp_ctx);
|
||||
return status;
|
||||
}
|
||||
|
||||
|
@ -25,6 +25,26 @@
|
||||
struct idmap_context {
|
||||
struct loadparm_context *lp_ctx;
|
||||
struct ldb_context *ldb_ctx;
|
||||
struct dom_sid *unix_groups_sid;
|
||||
struct dom_sid *unix_users_sid;
|
||||
};
|
||||
|
||||
enum id_type {
|
||||
ID_TYPE_NOT_SPECIFIED = 0,
|
||||
ID_TYPE_UID,
|
||||
ID_TYPE_GID,
|
||||
ID_TYPE_BOTH
|
||||
};
|
||||
|
||||
struct unixid {
|
||||
uint32_t id;
|
||||
enum id_type type;
|
||||
};
|
||||
|
||||
struct id_mapping {
|
||||
struct unixid *unixid;
|
||||
struct dom_sid *sid;
|
||||
NTSTATUS status;
|
||||
};
|
||||
|
||||
#include "winbind/idmap_proto.h"
|
||||
|
@ -3,7 +3,7 @@
|
||||
|
||||
Command backend for wbinfo -G
|
||||
|
||||
Copyright (C) Kai Blin 2007
|
||||
Copyright (C) 2007-2008 Kai Blin
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -33,37 +33,62 @@ struct gid2sid_state {
|
||||
struct dom_sid *sid;
|
||||
};
|
||||
|
||||
static void gid2sid_recv_sid(struct composite_context *ctx);
|
||||
|
||||
struct composite_context *wb_gid2sid_send(TALLOC_CTX *mem_ctx,
|
||||
struct wbsrv_service *service, gid_t gid)
|
||||
{
|
||||
struct composite_context *result;
|
||||
struct composite_context *result, *ctx;
|
||||
struct gid2sid_state *state;
|
||||
struct unixid *unixid;
|
||||
struct id_mapping *ids;
|
||||
|
||||
DEBUG(5, ("wb_gid2sid_send called\n"));
|
||||
|
||||
result = composite_create(mem_ctx, service->task->event_ctx);
|
||||
if (!result) return NULL;
|
||||
|
||||
state = talloc(mem_ctx, struct gid2sid_state);
|
||||
state = talloc(result, struct gid2sid_state);
|
||||
if (composite_nomem(state, result)) return result;
|
||||
|
||||
state->ctx = result;
|
||||
result->private_data = state;
|
||||
state->service = service;
|
||||
|
||||
state->ctx->status = idmap_gid_to_sid(service->idmap_ctx, mem_ctx, gid,
|
||||
&state->sid);
|
||||
if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
|
||||
state->ctx->status = idmap_gid_to_sid(service->idmap_ctx,
|
||||
mem_ctx, gid,
|
||||
&state->sid);
|
||||
}
|
||||
if (!composite_is_ok(state->ctx)) return result;
|
||||
unixid = talloc(result, struct unixid);
|
||||
if (composite_nomem(unixid, result)) return result;
|
||||
unixid->id = gid;
|
||||
unixid->type = ID_TYPE_GID;
|
||||
|
||||
composite_done(state->ctx);
|
||||
ids = talloc(result, struct id_mapping);
|
||||
if (composite_nomem(ids, result)) return result;
|
||||
ids->unixid = unixid;
|
||||
ids->sid = NULL;
|
||||
|
||||
ctx = wb_xids2sids_send(result, service, 1, ids);
|
||||
if (composite_nomem(ctx, result)) return result;
|
||||
|
||||
composite_continue(result, ctx, gid2sid_recv_sid, state);
|
||||
return result;
|
||||
}
|
||||
|
||||
static void gid2sid_recv_sid(struct composite_context *ctx)
|
||||
{
|
||||
struct gid2sid_state *state = talloc_get_type(ctx->async.private_data,
|
||||
struct gid2sid_state);
|
||||
struct id_mapping *ids = NULL;
|
||||
state->ctx->status = wb_xids2sids_recv(ctx, &ids);
|
||||
if (!composite_is_ok(state->ctx)) return;
|
||||
|
||||
if (!NT_STATUS_IS_OK(ids->status)) {
|
||||
composite_error(state->ctx, ids->status);
|
||||
return;
|
||||
}
|
||||
|
||||
state->sid = ids->sid;
|
||||
composite_done(state->ctx);
|
||||
}
|
||||
|
||||
NTSTATUS wb_gid2sid_recv(struct composite_context *ctx, TALLOC_CTX *mem_ctx,
|
||||
struct dom_sid **sid)
|
||||
{
|
||||
|
@ -3,7 +3,7 @@
|
||||
|
||||
Map a SID to a gid
|
||||
|
||||
Copyright (C) Kai Blin 2007
|
||||
Copyright (C) 2007-2008 Kai Blin
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -33,11 +33,14 @@ struct sid2gid_state {
|
||||
gid_t gid;
|
||||
};
|
||||
|
||||
static void sid2gid_recv_gid(struct composite_context *ctx);
|
||||
|
||||
struct composite_context *wb_sid2gid_send(TALLOC_CTX *mem_ctx,
|
||||
struct wbsrv_service *service, const struct dom_sid *sid)
|
||||
{
|
||||
struct composite_context *result;
|
||||
struct composite_context *result, *ctx;
|
||||
struct sid2gid_state *state;
|
||||
struct id_mapping *ids;
|
||||
|
||||
DEBUG(5, ("wb_sid2gid_send called\n"));
|
||||
|
||||
@ -51,18 +54,43 @@ struct composite_context *wb_sid2gid_send(TALLOC_CTX *mem_ctx,
|
||||
result->private_data = state;
|
||||
state->service = service;
|
||||
|
||||
state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state, sid,
|
||||
&state->gid);
|
||||
if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
|
||||
state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state,
|
||||
sid, &state->gid);
|
||||
}
|
||||
if (!composite_is_ok(state->ctx)) return result;
|
||||
ids = talloc(result, struct id_mapping);
|
||||
if (composite_nomem(ids, result)) return result;
|
||||
|
||||
composite_done(state->ctx);
|
||||
ids->sid = dom_sid_dup(result, sid);
|
||||
if (composite_nomem(ids->sid, result)) return result;
|
||||
|
||||
ctx = wb_sids2xids_send(result, service, 1, ids);
|
||||
if (composite_nomem(ctx, result)) return result;
|
||||
|
||||
composite_continue(result, ctx, sid2gid_recv_gid, state);
|
||||
return result;
|
||||
}
|
||||
|
||||
static void sid2gid_recv_gid(struct composite_context *ctx)
|
||||
{
|
||||
struct sid2gid_state *state = talloc_get_type(ctx->async.private_data,
|
||||
struct sid2gid_state);
|
||||
|
||||
struct id_mapping *ids = NULL;
|
||||
|
||||
state->ctx->status = wb_sids2xids_recv(ctx, &ids);
|
||||
if (!composite_is_ok(state->ctx)) return;
|
||||
|
||||
if (!NT_STATUS_IS_OK(ids->status)) {
|
||||
composite_error(state->ctx, ids->status);
|
||||
return;
|
||||
}
|
||||
|
||||
if (ids->unixid->type == ID_TYPE_BOTH ||
|
||||
ids->unixid->type == ID_TYPE_GID) {
|
||||
state->gid = ids->unixid->id;
|
||||
composite_done(state->ctx);
|
||||
} else {
|
||||
composite_error(state->ctx, NT_STATUS_INVALID_SID);
|
||||
}
|
||||
}
|
||||
|
||||
NTSTATUS wb_sid2gid_recv(struct composite_context *ctx, gid_t *gid)
|
||||
{
|
||||
NTSTATUS status = composite_wait(ctx);
|
||||
|
@ -3,7 +3,7 @@
|
||||
|
||||
Map a SID to a uid
|
||||
|
||||
Copyright (C) Kai Blin 2007-2008
|
||||
Copyright (C) 2007-2008 Kai Blin
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -33,11 +33,14 @@ struct sid2uid_state {
|
||||
uid_t uid;
|
||||
};
|
||||
|
||||
static void sid2uid_recv_uid(struct composite_context *ctx);
|
||||
|
||||
struct composite_context *wb_sid2uid_send(TALLOC_CTX *mem_ctx,
|
||||
struct wbsrv_service *service, const struct dom_sid *sid)
|
||||
{
|
||||
struct composite_context *result;
|
||||
struct composite_context *result, *ctx;
|
||||
struct sid2uid_state *state;
|
||||
struct id_mapping *ids;
|
||||
|
||||
DEBUG(5, ("wb_sid2uid_send called\n"));
|
||||
|
||||
@ -45,24 +48,49 @@ struct composite_context *wb_sid2uid_send(TALLOC_CTX *mem_ctx,
|
||||
if (!result) return NULL;
|
||||
|
||||
state = talloc(result, struct sid2uid_state);
|
||||
if(composite_nomem(state, result)) return result;
|
||||
if (composite_nomem(state, result)) return result;
|
||||
|
||||
state->ctx = result;
|
||||
result->private_data = state;
|
||||
state->service = service;
|
||||
|
||||
state->ctx->status = idmap_sid_to_uid(service->idmap_ctx, state, sid,
|
||||
&state->uid);
|
||||
if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
|
||||
state->ctx->status = idmap_sid_to_uid(service->idmap_ctx, state,
|
||||
sid, &state->uid);
|
||||
}
|
||||
if (!composite_is_ok(state->ctx)) return result;
|
||||
ids = talloc(result, struct id_mapping);
|
||||
if (composite_nomem(ids, result)) return result;
|
||||
|
||||
composite_done(state->ctx);
|
||||
ids->sid = dom_sid_dup(result, sid);
|
||||
if (composite_nomem(ids->sid, result)) return result;
|
||||
|
||||
ctx = wb_sids2xids_send(result, service, 1, ids);
|
||||
if (composite_nomem(ctx, result)) return result;
|
||||
|
||||
composite_continue(result, ctx, sid2uid_recv_uid, state);
|
||||
return result;
|
||||
}
|
||||
|
||||
static void sid2uid_recv_uid(struct composite_context *ctx)
|
||||
{
|
||||
struct sid2uid_state *state = talloc_get_type(ctx->async.private_data,
|
||||
struct sid2uid_state);
|
||||
|
||||
struct id_mapping *ids = NULL;
|
||||
|
||||
state->ctx->status = wb_sids2xids_recv(ctx, &ids);
|
||||
if (!composite_is_ok(state->ctx)) return;
|
||||
|
||||
if (!NT_STATUS_IS_OK(ids->status)) {
|
||||
composite_error(state->ctx, ids->status);
|
||||
return;
|
||||
}
|
||||
|
||||
if (ids->unixid->type == ID_TYPE_BOTH ||
|
||||
ids->unixid->type == ID_TYPE_UID) {
|
||||
state->uid = ids->unixid->id;
|
||||
composite_done(state->ctx);
|
||||
} else {
|
||||
composite_error(state->ctx, NT_STATUS_INVALID_SID);
|
||||
}
|
||||
}
|
||||
|
||||
NTSTATUS wb_sid2uid_recv(struct composite_context *ctx, uid_t *uid)
|
||||
{
|
||||
NTSTATUS status = composite_wait(ctx);
|
||||
|
82
source/winbind/wb_sids2xids.c
Normal file
82
source/winbind/wb_sids2xids.c
Normal file
@ -0,0 +1,82 @@
|
||||
/*
|
||||
Unix SMB/CIFS implementation.
|
||||
|
||||
Map SIDs to unixids.
|
||||
|
||||
Copyright (C) 2008 Kai Blin
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
#include "libcli/composite/composite.h"
|
||||
#include "winbind/wb_server.h"
|
||||
#include "smbd/service_task.h"
|
||||
#include "winbind/wb_helper.h"
|
||||
#include "libcli/security/proto.h"
|
||||
#include "winbind/idmap.h"
|
||||
|
||||
struct sids2xids_state {
|
||||
struct composite_context *ctx;
|
||||
struct wbsrv_service *service;
|
||||
struct id_mapping *ids;
|
||||
int count;
|
||||
};
|
||||
|
||||
struct composite_context *wb_sids2xids_send(TALLOC_CTX *mem_ctx,
|
||||
struct wbsrv_service *service,
|
||||
int count, struct id_mapping *ids)
|
||||
{
|
||||
struct composite_context *result;
|
||||
struct sids2xids_state *state;
|
||||
|
||||
DEBUG(5, ("wb_sids2xids_send called\n"));
|
||||
|
||||
result = composite_create(mem_ctx, service->task->event_ctx);
|
||||
if (!result) return NULL;
|
||||
|
||||
state = talloc(result, struct sids2xids_state);
|
||||
if (composite_nomem(state, result)) return result;
|
||||
|
||||
state->ctx = result;
|
||||
result->private_data = state;
|
||||
state->service = service;
|
||||
state->count = count;
|
||||
state->ids = ids;
|
||||
|
||||
state->ctx->status = idmap_sids_to_xids(service->idmap_ctx, mem_ctx,
|
||||
count, state->ids);
|
||||
if (!composite_is_ok(state->ctx)) return result;
|
||||
|
||||
composite_done(state->ctx);
|
||||
return result;
|
||||
}
|
||||
|
||||
NTSTATUS wb_sids2xids_recv(struct composite_context *ctx,
|
||||
struct id_mapping **ids)
|
||||
{
|
||||
NTSTATUS status = composite_wait(ctx);
|
||||
|
||||
DEBUG(5, ("wb_sids2xids_recv called\n"));
|
||||
|
||||
if (NT_STATUS_IS_OK(status)) {
|
||||
struct sids2xids_state *state =
|
||||
talloc_get_type(ctx->private_data,
|
||||
struct sids2xids_state);
|
||||
*ids = state->ids;
|
||||
}
|
||||
talloc_free(ctx);
|
||||
return status;
|
||||
}
|
||||
|
@ -3,7 +3,7 @@
|
||||
|
||||
Command backend for wbinfo -U
|
||||
|
||||
Copyright (C) Kai Blin 2007-2008
|
||||
Copyright (C) 2007-2008 Kai Blin
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -33,35 +33,62 @@ struct uid2sid_state {
|
||||
struct dom_sid *sid;
|
||||
};
|
||||
|
||||
static void uid2sid_recv_sid(struct composite_context *ctx);
|
||||
|
||||
struct composite_context *wb_uid2sid_send(TALLOC_CTX *mem_ctx,
|
||||
struct wbsrv_service *service, uid_t uid)
|
||||
{
|
||||
struct composite_context *result;
|
||||
struct composite_context *result, *ctx;
|
||||
struct uid2sid_state *state;
|
||||
struct unixid *unixid;
|
||||
struct id_mapping *ids;
|
||||
|
||||
DEBUG(5, ("wb_uid2sid_send called\n"));
|
||||
|
||||
result = composite_create(mem_ctx, service->task->event_ctx);
|
||||
if (!result) return NULL;
|
||||
|
||||
state = talloc(mem_ctx, struct uid2sid_state);
|
||||
state = talloc(result, struct uid2sid_state);
|
||||
if (composite_nomem(state, result)) return result;
|
||||
|
||||
state->ctx = result;
|
||||
result->private_data = state;
|
||||
state->service = service;
|
||||
|
||||
state->ctx->status = idmap_uid_to_sid(service->idmap_ctx, mem_ctx, uid,
|
||||
&state->sid);
|
||||
if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
|
||||
state->ctx->status = idmap_uid_to_sid(service->idmap_ctx,
|
||||
mem_ctx, uid,
|
||||
&state->sid);
|
||||
unixid = talloc(result, struct unixid);
|
||||
if (composite_nomem(unixid, result)) return result;
|
||||
unixid->id = uid;
|
||||
unixid->type = ID_TYPE_UID;
|
||||
|
||||
ids = talloc(result, struct id_mapping);
|
||||
if (composite_nomem(ids, result)) return result;
|
||||
ids->unixid = unixid;
|
||||
ids->sid = NULL;
|
||||
|
||||
ctx = wb_xids2sids_send(result, service, 1, ids);
|
||||
if (composite_nomem(ctx, result)) return result;
|
||||
|
||||
composite_continue(result, ctx, uid2sid_recv_sid, state);
|
||||
return result;
|
||||
}
|
||||
|
||||
static void uid2sid_recv_sid(struct composite_context *ctx)
|
||||
{
|
||||
struct uid2sid_state *state = talloc_get_type(ctx->async.private_data,
|
||||
struct uid2sid_state);
|
||||
struct id_mapping *ids = NULL;
|
||||
|
||||
state->ctx->status = wb_xids2sids_recv(ctx, &ids);
|
||||
if (!composite_is_ok(state->ctx)) return;
|
||||
|
||||
if (!NT_STATUS_IS_OK(ids->status)) {
|
||||
composite_error(state->ctx, ids->status);
|
||||
return;
|
||||
}
|
||||
if (!composite_is_ok(state->ctx)) return result;
|
||||
|
||||
state->sid = ids->sid;
|
||||
|
||||
composite_done(state->ctx);
|
||||
return result;
|
||||
}
|
||||
|
||||
NTSTATUS wb_uid2sid_recv(struct composite_context *ctx, TALLOC_CTX *mem_ctx,
|
||||
|
82
source/winbind/wb_xids2sids.c
Normal file
82
source/winbind/wb_xids2sids.c
Normal file
@ -0,0 +1,82 @@
|
||||
/*
|
||||
Unix SMB/CIFS implementation.
|
||||
|
||||
Convet an unixid struct to a SID
|
||||
|
||||
Copyright (C) 2008 Kai Blin
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
#include "libcli/composite/composite.h"
|
||||
#include "winbind/wb_server.h"
|
||||
#include "smbd/service_task.h"
|
||||
#include "winbind/wb_helper.h"
|
||||
#include "libcli/security/proto.h"
|
||||
#include "winbind/idmap.h"
|
||||
|
||||
struct xids2sids_state {
|
||||
struct composite_context *ctx;
|
||||
struct wbsrv_service *service;
|
||||
struct id_mapping *ids;
|
||||
int count;
|
||||
};
|
||||
|
||||
struct composite_context *wb_xids2sids_send(TALLOC_CTX *mem_ctx,
|
||||
struct wbsrv_service *service,
|
||||
int count, struct id_mapping *ids)
|
||||
{
|
||||
struct composite_context *result;
|
||||
struct xids2sids_state *state;
|
||||
|
||||
DEBUG(0, ("wb_xids2sids_send called\n"));
|
||||
|
||||
result = composite_create(mem_ctx, service->task->event_ctx);
|
||||
if (!result) return NULL;
|
||||
|
||||
state = talloc(mem_ctx, struct xids2sids_state);
|
||||
if (composite_nomem(state, result)) return result;
|
||||
|
||||
state->ctx = result;
|
||||
result->private_data = state;
|
||||
state->service = service;
|
||||
state->count = count;
|
||||
state->ids = ids;
|
||||
|
||||
state->ctx->status = idmap_xids_to_sids(service->idmap_ctx, mem_ctx,
|
||||
count, state->ids);
|
||||
if (!composite_is_ok(state->ctx)) return result;
|
||||
|
||||
composite_done(state->ctx);
|
||||
return result;
|
||||
}
|
||||
|
||||
NTSTATUS wb_xids2sids_recv(struct composite_context *ctx,
|
||||
struct id_mapping **ids)
|
||||
{
|
||||
NTSTATUS status = composite_wait(ctx);
|
||||
|
||||
DEBUG(0, ("wb_xids2sids_recv called.\n"));
|
||||
|
||||
if (NT_STATUS_IS_OK(status)) {
|
||||
struct xids2sids_state *state =
|
||||
talloc_get_type(ctx->private_data,
|
||||
struct xids2sids_state);
|
||||
*ids = state->ids;
|
||||
}
|
||||
talloc_free(ctx);
|
||||
return status;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user