samba-mirror/source3/lib/idmap_cache.c

/*
   Unix SMB/CIFS implementation.
   ID Mapping Cache

   Copyright (C) Volker Lendecke	2008

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.*/

#include "includes.h"
#include "idmap_cache.h"
#include "../libcli/security/security.h"
#include "../librpc/gen_ndr/idmap.h"

/**
 * Find a sid2xid mapping
 * @param[in] sid		the sid to map
 * @param[out] id		where to put the result
 * @param[out] expired		is the cache entry expired?
 * @retval Was anything in the cache at all?
 *
 * If id->id == -1 this was a negative mapping.
 */

bool idmap_cache_find_sid2unixid(const struct dom_sid *sid, struct unixid *id,
				 bool *expired)
{
	fstring sidstr;
	char *key;
	char *value = NULL;
	char *endptr;
	time_t timeout;
	bool ret;
	struct unixid tmp_id;

	key = talloc_asprintf(talloc_tos(), "IDMAP/SID2XID/%s",
			      sid_to_fstring(sidstr, sid));
	if (key == NULL) {
		return false;
	}
	ret = gencache_get(key, &value, &timeout);
	if (!ret) {
		goto done;
	}

	DEBUG(10, ("Parsing value for key [%s]: value=[%s]\n", key, value));

	if (value[0] == '\0') {
		DEBUG(0, ("Failed to parse value for key [%s]: "
			  "value is empty\n", key));
		ret = false;
		goto done;
	}

	tmp_id.id = strtol(value, &endptr, 10);

	if ((value == endptr) && (tmp_id.id == 0)) {
		DEBUG(0, ("Failed to parse value for key [%s]: value[%s] does "
			  "not start with a number\n", key, value));
		ret = false;
		goto done;
	}

	DEBUG(10, ("Parsing value for key [%s]: id=[%llu], endptr=[%s]\n",
		   key, (unsigned long long)tmp_id.id, endptr));

	ret = (*endptr == ':');
	if (ret) {
		switch (endptr[1]) {
		case 'U':
			tmp_id.type = ID_TYPE_UID;
			break;

		case 'G':
			tmp_id.type = ID_TYPE_GID;
			break;

		case 'B':
			tmp_id.type = ID_TYPE_BOTH;
			break;

		case 'N':
			tmp_id.type = ID_TYPE_NOT_SPECIFIED;
			break;

		case '\0':
			DEBUG(0, ("FAILED to parse value for key [%s] "
				  "(id=[%llu], endptr=[%s]): "
				  "no type character after colon\n",
				  key, (unsigned long long)tmp_id.id, endptr));
			ret = false;
			goto done;
		default:
			DEBUG(0, ("FAILED to parse value for key [%s] "
				  "(id=[%llu], endptr=[%s]): "
				  "illegal type character '%c'\n",
				  key, (unsigned long long)tmp_id.id, endptr,
				  endptr[1]));
			ret = false;
			goto done;
		}
		if (endptr[2] != '\0') {
			DEBUG(0, ("FAILED to parse value for key [%s] "
				  "(id=[%llu], endptr=[%s]): "
				  "more than 1 type character after colon\n",
				  key, (unsigned long long)tmp_id.id, endptr));
			ret = false;
			goto done;
		}

		*id = tmp_id;
		*expired = (timeout <= time(NULL));
	} else {
		DEBUG(0, ("FAILED to parse value for key [%s] (value=[%s]): "
			  "colon missing after id=[%llu]\n",
			  key, value, (unsigned long long)tmp_id.id));
	}

done:
	TALLOC_FREE(key);
	SAFE_FREE(value);
	return ret;
}

/**
 * Find a sid2uid mapping
 * @param[in] sid		the sid to map
 * @param[out] puid		where to put the result
 * @param[out] expired		is the cache entry expired?
 * @retval Was anything in the cache at all?
 *
 * If *puid == -1 this was a negative mapping.
 */

bool idmap_cache_find_sid2uid(const struct dom_sid *sid, uid_t *puid,
			      bool *expired)
{
	bool ret;
	struct unixid id;
	ret = idmap_cache_find_sid2unixid(sid, &id, expired);
	if (!ret) {
		return false;
	}

	if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_UID) {
		*puid = id.id;
	} else {
		*puid = -1;
	}
	return true;
}

/**
 * Find a sid2gid mapping
 * @param[in] sid		the sid to map
 * @param[out] pgid		where to put the result
 * @param[out] expired		is the cache entry expired?
 * @retval Was anything in the cache at all?
 *
 * If *pgid == -1 this was a negative mapping.
 */

bool idmap_cache_find_sid2gid(const struct dom_sid *sid, gid_t *pgid,
			      bool *expired)
{
	bool ret;
	struct unixid id;
	ret = idmap_cache_find_sid2unixid(sid, &id, expired);
	if (!ret) {
		return false;
	}

	if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_GID) {
		*pgid = id.id;
	} else {
		*pgid = -1;
	}
	return true;
}

/**
 * Find a uid2sid mapping
 * @param[in] uid		the uid to map
 * @param[out] sid		where to put the result
 * @param[out] expired		is the cache entry expired?
 * @retval Was anything in the cache at all?
 *
 * If "is_null_sid(sid)", this was a negative mapping.
 */

bool idmap_cache_find_uid2sid(uid_t uid, struct dom_sid *sid, bool *expired)
{
	char *key;
	char *value;
	time_t timeout;
	bool ret = true;

	key = talloc_asprintf(talloc_tos(), "IDMAP/UID2SID/%d", (int)uid);
	if (key == NULL) {
		return false;
	}
	ret = gencache_get(key, &value, &timeout);
	TALLOC_FREE(key);
	if (!ret) {
		return false;
	}
	ZERO_STRUCTP(sid);
	if (value[0] != '-') {
		ret = string_to_sid(sid, value);
	}
	SAFE_FREE(value);
	if (ret) {
		*expired = (timeout <= time(NULL));
	}
	return ret;
}

/**
 * Find a gid2sid mapping
 * @param[in] gid		the gid to map
 * @param[out] sid		where to put the result
 * @param[out] expired		is the cache entry expired?
 * @retval Was anything in the cache at all?
 *
 * If "is_null_sid(sid)", this was a negative mapping.
 */

bool idmap_cache_find_gid2sid(gid_t gid, struct dom_sid *sid, bool *expired)
{
	char *key;
	char *value;
	time_t timeout;
	bool ret = true;

	key = talloc_asprintf(talloc_tos(), "IDMAP/GID2SID/%d", (int)gid);
	if (key == NULL) {
		return false;
	}
	ret = gencache_get(key, &value, &timeout);
	TALLOC_FREE(key);
	if (!ret) {
		return false;
	}
	ZERO_STRUCTP(sid);
	if (value[0] != '-') {
		ret = string_to_sid(sid, value);
	}
	SAFE_FREE(value);
	if (ret) {
		*expired = (timeout <= time(NULL));
	}
	return ret;
}

/**
 * Store a mapping in the idmap cache
 * @param[in] sid		the sid to map
 * @param[in] gid		the gid to map
 *
 * If both parameters are valid values, then a positive mapping in both
 * directions is stored. If "is_null_sid(sid)" is true, then this will be a
 * negative mapping of gid, we want to cache that for this gid we could not
 * find anything. Likewise if "gid==-1", then we want to cache that we did not
 * find a mapping for the sid passed here.
 */

void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id)
{
	time_t now = time(NULL);
	time_t timeout;
	fstring sidstr, key, value;

	if (!is_null_sid(sid)) {
		fstr_sprintf(key, "IDMAP/SID2XID/%s",
			     sid_to_fstring(sidstr, sid));
		switch (unix_id->type) {
		case ID_TYPE_UID:
			fstr_sprintf(value, "%d:U", (int)unix_id->id);
			break;
		case ID_TYPE_GID:
			fstr_sprintf(value, "%d:G", (int)unix_id->id);
			break;
		case ID_TYPE_BOTH:
			fstr_sprintf(value, "%d:B", (int)unix_id->id);
			break;
		case ID_TYPE_NOT_SPECIFIED:
			fstr_sprintf(value, "%d:N", (int)unix_id->id);
			break;
		default:
			return;
		}
		timeout = (unix_id->id == -1)
			? lp_idmap_negative_cache_time()
			: lp_idmap_cache_time();
		gencache_set(key, value, now + timeout);
	}
	if (unix_id->id != -1) {
		if (is_null_sid(sid)) {
			/* negative gid mapping */
			fstrcpy(value, "-");
			timeout = lp_idmap_negative_cache_time();
		}
		else {
			sid_to_fstring(value, sid);
			timeout = lp_idmap_cache_time();
		}
		switch (unix_id->type) {
		case ID_TYPE_BOTH:
			fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
			gencache_set(key, value, now + timeout);
			fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
			gencache_set(key, value, now + timeout);
			return;

		case ID_TYPE_UID:
			fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
			break;

		case ID_TYPE_GID:
			fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
			break;

		default:
			return;
		}
		gencache_set(key, value, now + timeout);
	}
}

/**
 * Store a mapping in the idmap cache
 * @param[in] sid		the sid to map
 * @param[in] uid		the uid to map
 *
 * If both parameters are valid values, then a positive mapping in both
 * directions is stored. If "is_null_sid(sid)" is true, then this will be a
 * negative mapping of uid, we want to cache that for this uid we could not
 * find anything. Likewise if "uid==-1", then we want to cache that we did not
 * find a mapping for the sid passed here.
 */

void idmap_cache_set_sid2uid(const struct dom_sid *sid, uid_t uid)
{
	struct unixid id;
	id.type = ID_TYPE_UID;
	id.id = uid;

	if (uid == -1) {
		uid_t tmp_gid;
		bool expired;
		/* If we were asked to invalidate this SID -> UID
		 * mapping, it was because we found out that this was
		 * not a UID at all.  Do not overwrite a valid GID or
		 * BOTH mapping */
		if (idmap_cache_find_sid2gid(sid, &tmp_gid, &expired)) {
			if (!expired) {
				return;
			}
		}
	}

	idmap_cache_set_sid2unixid(sid, &id);
	return;
}

/**
 * Store a mapping in the idmap cache
 * @param[in] sid		the sid to map
 * @param[in] gid		the gid to map
 *
 * If both parameters are valid values, then a positive mapping in both
 * directions is stored. If "is_null_sid(sid)" is true, then this will be a
 * negative mapping of gid, we want to cache that for this gid we could not
 * find anything. Likewise if "gid==-1", then we want to cache that we did not
 * find a mapping for the sid passed here.
 */

void idmap_cache_set_sid2gid(const struct dom_sid *sid, gid_t gid)
{
	struct unixid id;
	id.type = ID_TYPE_GID;
	id.id = gid;

	if (gid == -1) {
		uid_t tmp_uid;
		bool expired;
		/* If we were asked to invalidate this SID -> GID
		 * mapping, it was because we found out that this was
		 * not a GID at all.  Do not overwrite a valid UID or
		 * BOTH mapping */
		if (idmap_cache_find_sid2uid(sid, &tmp_uid, &expired)) {
			if (!expired) {
				return;
			}
		}
	}

	idmap_cache_set_sid2unixid(sid, &id);
	return;
}

static char* key_xid2sid_str(TALLOC_CTX* mem_ctx, char t, const char* id) {
	return talloc_asprintf(mem_ctx, "IDMAP/%cID2SID/%s", t, id);
}

static char* key_xid2sid(TALLOC_CTX* mem_ctx, char t, int id) {
	char str[32];
	snprintf(str, sizeof(str), "%d", id);
	return key_xid2sid_str(mem_ctx, t, str);
}

static char* key_sid2xid_str(TALLOC_CTX* mem_ctx, const char* id) {
	return talloc_asprintf(mem_ctx, "IDMAP/SID2XID/%s", id);
}

static bool idmap_cache_del_xid(char t, int xid)
{
	TALLOC_CTX* mem_ctx = talloc_stackframe();
	const char* key = key_xid2sid(mem_ctx, t, xid);
	char* sid_str = NULL;
	time_t timeout;
	bool ret = true;

	if (!gencache_get(key, &sid_str, &timeout)) {
		DEBUG(3, ("no entry: %s\n", key));
		ret = false;
		goto done;
	}

	if (sid_str[0] != '-') {
		const char* sid_key = key_sid2xid_str(mem_ctx, sid_str);
		if (!gencache_del(sid_key)) {
			DEBUG(2, ("failed to delete: %s\n", sid_key));
			ret = false;
		} else {
			DEBUG(5, ("delete: %s\n", sid_key));
		}

	}

	if (!gencache_del(key)) {
		DEBUG(1, ("failed to delete: %s\n", key));
		ret = false;
	} else {
		DEBUG(5, ("delete: %s\n", key));
	}

done:
	talloc_free(mem_ctx);
	return ret;
}

bool idmap_cache_del_uid(uid_t uid) {
	return idmap_cache_del_xid('U', uid);
}

bool idmap_cache_del_gid(gid_t gid) {
	return idmap_cache_del_xid('G', gid);
}

bool idmap_cache_del_sid(const struct dom_sid *sid)
{
	TALLOC_CTX* mem_ctx = talloc_stackframe();
	bool ret = true;
	bool expired;
	struct unixid id;
	const char *sid_key;

	if (!idmap_cache_find_sid2unixid(sid, &id, &expired)) {
		ret = false;
		goto done;
	}

	if (id.id != -1) {
		switch (id.type) {
		case ID_TYPE_BOTH:
			idmap_cache_del_xid('U', id.id);
			idmap_cache_del_xid('G', id.id);
			break;
		case ID_TYPE_UID:
			idmap_cache_del_xid('U', id.id);
			break;
		case ID_TYPE_GID:
			idmap_cache_del_xid('G', id.id);
			break;
		default:
			break;
		}
	}

	sid_key = key_sid2xid_str(mem_ctx, dom_sid_string(mem_ctx, sid));
	if (sid_key == NULL) {
		return false;
	}
	/* If the mapping was symmetric, then this should fail */
	gencache_del(sid_key);
done:
	talloc_free(mem_ctx);
	return ret;
}