mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
055650ecb6
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
448 lines
10 KiB
C
448 lines
10 KiB
C
/*
|
|
Unix SMB/CIFS implementation.
|
|
ID Mapping Cache
|
|
|
|
Copyright (C) Volker Lendecke 2008
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.*/
|
|
|
|
#include "includes.h"
|
|
#include "idmap_cache.h"
|
|
#include "../libcli/security/security.h"
|
|
#include "../librpc/gen_ndr/idmap.h"
|
|
|
|
/**
|
|
* Find a sid2xid mapping
|
|
* @param[in] sid the sid to map
|
|
* @param[out] id where to put the result
|
|
* @param[out] expired is the cache entry expired?
|
|
* @retval Was anything in the cache at all?
|
|
*
|
|
* If id->id == -1 this was a negative mapping.
|
|
*/
|
|
|
|
bool idmap_cache_find_sid2unixid(const struct dom_sid *sid, struct unixid *id,
|
|
bool *expired)
|
|
{
|
|
fstring sidstr;
|
|
char *key;
|
|
char *value = NULL;
|
|
char *endptr;
|
|
time_t timeout;
|
|
bool ret;
|
|
struct unixid tmp_id;
|
|
|
|
key = talloc_asprintf(talloc_tos(), "IDMAP/SID2XID/%s",
|
|
sid_to_fstring(sidstr, sid));
|
|
if (key == NULL) {
|
|
return false;
|
|
}
|
|
ret = gencache_get(key, talloc_tos(), &value, &timeout);
|
|
if (!ret) {
|
|
goto done;
|
|
}
|
|
|
|
DEBUG(10, ("Parsing value for key [%s]: value=[%s]\n", key, value));
|
|
|
|
if (value[0] == '\0') {
|
|
DEBUG(0, ("Failed to parse value for key [%s]: "
|
|
"value is empty\n", key));
|
|
ret = false;
|
|
goto done;
|
|
}
|
|
|
|
tmp_id.id = strtol(value, &endptr, 10);
|
|
|
|
if ((value == endptr) && (tmp_id.id == 0)) {
|
|
DEBUG(0, ("Failed to parse value for key [%s]: value[%s] does "
|
|
"not start with a number\n", key, value));
|
|
ret = false;
|
|
goto done;
|
|
}
|
|
|
|
DEBUG(10, ("Parsing value for key [%s]: id=[%llu], endptr=[%s]\n",
|
|
key, (unsigned long long)tmp_id.id, endptr));
|
|
|
|
ret = (*endptr == ':');
|
|
if (ret) {
|
|
switch (endptr[1]) {
|
|
case 'U':
|
|
tmp_id.type = ID_TYPE_UID;
|
|
break;
|
|
|
|
case 'G':
|
|
tmp_id.type = ID_TYPE_GID;
|
|
break;
|
|
|
|
case 'B':
|
|
tmp_id.type = ID_TYPE_BOTH;
|
|
break;
|
|
|
|
case 'N':
|
|
tmp_id.type = ID_TYPE_NOT_SPECIFIED;
|
|
break;
|
|
|
|
case '\0':
|
|
DEBUG(0, ("FAILED to parse value for key [%s] "
|
|
"(id=[%llu], endptr=[%s]): "
|
|
"no type character after colon\n",
|
|
key, (unsigned long long)tmp_id.id, endptr));
|
|
ret = false;
|
|
goto done;
|
|
default:
|
|
DEBUG(0, ("FAILED to parse value for key [%s] "
|
|
"(id=[%llu], endptr=[%s]): "
|
|
"illegal type character '%c'\n",
|
|
key, (unsigned long long)tmp_id.id, endptr,
|
|
endptr[1]));
|
|
ret = false;
|
|
goto done;
|
|
}
|
|
if (endptr[2] != '\0') {
|
|
DEBUG(0, ("FAILED to parse value for key [%s] "
|
|
"(id=[%llu], endptr=[%s]): "
|
|
"more than 1 type character after colon\n",
|
|
key, (unsigned long long)tmp_id.id, endptr));
|
|
ret = false;
|
|
goto done;
|
|
}
|
|
|
|
*id = tmp_id;
|
|
*expired = (timeout <= time(NULL));
|
|
} else {
|
|
DEBUG(0, ("FAILED to parse value for key [%s] (value=[%s]): "
|
|
"colon missing after id=[%llu]\n",
|
|
key, value, (unsigned long long)tmp_id.id));
|
|
}
|
|
|
|
done:
|
|
TALLOC_FREE(key);
|
|
TALLOC_FREE(value);
|
|
return ret;
|
|
}
|
|
|
|
/**
|
|
* Find a sid2uid mapping
|
|
* @param[in] sid the sid to map
|
|
* @param[out] puid where to put the result
|
|
* @param[out] expired is the cache entry expired?
|
|
* @retval Was anything in the cache at all?
|
|
*
|
|
* If *puid == -1 this was a negative mapping.
|
|
*/
|
|
|
|
bool idmap_cache_find_sid2uid(const struct dom_sid *sid, uid_t *puid,
|
|
bool *expired)
|
|
{
|
|
bool ret;
|
|
struct unixid id;
|
|
ret = idmap_cache_find_sid2unixid(sid, &id, expired);
|
|
if (!ret) {
|
|
return false;
|
|
}
|
|
|
|
if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_UID) {
|
|
*puid = id.id;
|
|
} else {
|
|
*puid = -1;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Find a sid2gid mapping
|
|
* @param[in] sid the sid to map
|
|
* @param[out] pgid where to put the result
|
|
* @param[out] expired is the cache entry expired?
|
|
* @retval Was anything in the cache at all?
|
|
*
|
|
* If *pgid == -1 this was a negative mapping.
|
|
*/
|
|
|
|
bool idmap_cache_find_sid2gid(const struct dom_sid *sid, gid_t *pgid,
|
|
bool *expired)
|
|
{
|
|
bool ret;
|
|
struct unixid id;
|
|
ret = idmap_cache_find_sid2unixid(sid, &id, expired);
|
|
if (!ret) {
|
|
return false;
|
|
}
|
|
|
|
if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_GID) {
|
|
*pgid = id.id;
|
|
} else {
|
|
*pgid = -1;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
struct idmap_cache_xid2sid_state {
|
|
struct dom_sid *sid;
|
|
bool *expired;
|
|
bool ret;
|
|
};
|
|
|
|
static void idmap_cache_xid2sid_parser(time_t timeout, DATA_BLOB blob,
|
|
void *private_data)
|
|
{
|
|
struct idmap_cache_xid2sid_state *state =
|
|
(struct idmap_cache_xid2sid_state *)private_data;
|
|
char *value;
|
|
|
|
ZERO_STRUCTP(state->sid);
|
|
state->ret = false;
|
|
|
|
if ((blob.length == 0) || (blob.data[blob.length-1] != 0)) {
|
|
/*
|
|
* Not a string, can't be a valid mapping
|
|
*/
|
|
return;
|
|
}
|
|
|
|
value = (char *)blob.data;
|
|
|
|
if (value[0] != '-') {
|
|
state->ret = string_to_sid(state->sid, value);
|
|
}
|
|
if (state->ret) {
|
|
*state->expired = (timeout <= time(NULL));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Find a uid2sid mapping
|
|
* @param[in] uid the uid to map
|
|
* @param[out] sid where to put the result
|
|
* @param[out] expired is the cache entry expired?
|
|
* @retval Was anything in the cache at all?
|
|
*
|
|
* If "is_null_sid(sid)", this was a negative mapping.
|
|
*/
|
|
|
|
bool idmap_cache_find_uid2sid(uid_t uid, struct dom_sid *sid, bool *expired)
|
|
{
|
|
fstring key;
|
|
struct idmap_cache_xid2sid_state state;
|
|
|
|
fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)uid);
|
|
|
|
state.sid = sid;
|
|
state.expired = expired;
|
|
state.ret = false;
|
|
|
|
gencache_parse(key, idmap_cache_xid2sid_parser, &state);
|
|
return state.ret;
|
|
}
|
|
|
|
/**
|
|
* Find a gid2sid mapping
|
|
* @param[in] gid the gid to map
|
|
* @param[out] sid where to put the result
|
|
* @param[out] expired is the cache entry expired?
|
|
* @retval Was anything in the cache at all?
|
|
*
|
|
* If "is_null_sid(sid)", this was a negative mapping.
|
|
*/
|
|
|
|
bool idmap_cache_find_gid2sid(gid_t gid, struct dom_sid *sid, bool *expired)
|
|
{
|
|
fstring key;
|
|
struct idmap_cache_xid2sid_state state;
|
|
|
|
fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)gid);
|
|
|
|
state.sid = sid;
|
|
state.expired = expired;
|
|
state.ret = false;
|
|
|
|
gencache_parse(key, idmap_cache_xid2sid_parser, &state);
|
|
return state.ret;
|
|
}
|
|
|
|
/**
|
|
* Store a mapping in the idmap cache
|
|
* @param[in] sid the sid to map
|
|
* @param[in] unix_id the unix_id to map
|
|
*
|
|
* If both parameters are valid values, then a positive mapping in both
|
|
* directions is stored. If "is_null_sid(sid)" is true, then this will be a
|
|
* negative mapping of xid, we want to cache that for this xid we could not
|
|
* find anything. Likewise if "xid==-1", then we want to cache that we did not
|
|
* find a mapping for the sid passed here.
|
|
*/
|
|
|
|
void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id)
|
|
{
|
|
time_t now = time(NULL);
|
|
time_t timeout;
|
|
fstring sidstr, key, value;
|
|
|
|
if (!is_null_sid(sid)) {
|
|
fstr_sprintf(key, "IDMAP/SID2XID/%s",
|
|
sid_to_fstring(sidstr, sid));
|
|
switch (unix_id->type) {
|
|
case ID_TYPE_UID:
|
|
fstr_sprintf(value, "%d:U", (int)unix_id->id);
|
|
break;
|
|
case ID_TYPE_GID:
|
|
fstr_sprintf(value, "%d:G", (int)unix_id->id);
|
|
break;
|
|
case ID_TYPE_BOTH:
|
|
fstr_sprintf(value, "%d:B", (int)unix_id->id);
|
|
break;
|
|
case ID_TYPE_NOT_SPECIFIED:
|
|
fstr_sprintf(value, "%d:N", (int)unix_id->id);
|
|
break;
|
|
default:
|
|
return;
|
|
}
|
|
timeout = (unix_id->id == -1)
|
|
? lp_idmap_negative_cache_time()
|
|
: lp_idmap_cache_time();
|
|
gencache_set(key, value, now + timeout);
|
|
}
|
|
if (unix_id->id != -1) {
|
|
if (is_null_sid(sid)) {
|
|
/* negative xid mapping */
|
|
fstrcpy(value, "-");
|
|
timeout = lp_idmap_negative_cache_time();
|
|
}
|
|
else {
|
|
sid_to_fstring(value, sid);
|
|
timeout = lp_idmap_cache_time();
|
|
}
|
|
switch (unix_id->type) {
|
|
case ID_TYPE_BOTH:
|
|
fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
|
|
gencache_set(key, value, now + timeout);
|
|
fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
|
|
gencache_set(key, value, now + timeout);
|
|
return;
|
|
|
|
case ID_TYPE_UID:
|
|
fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
|
|
break;
|
|
|
|
case ID_TYPE_GID:
|
|
fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
|
|
break;
|
|
|
|
default:
|
|
return;
|
|
}
|
|
gencache_set(key, value, now + timeout);
|
|
}
|
|
}
|
|
|
|
static char* key_xid2sid_str(TALLOC_CTX* mem_ctx, char t, const char* id) {
|
|
return talloc_asprintf(mem_ctx, "IDMAP/%cID2SID/%s", t, id);
|
|
}
|
|
|
|
static char* key_xid2sid(TALLOC_CTX* mem_ctx, char t, int id) {
|
|
char str[32];
|
|
snprintf(str, sizeof(str), "%d", id);
|
|
return key_xid2sid_str(mem_ctx, t, str);
|
|
}
|
|
|
|
static char* key_sid2xid_str(TALLOC_CTX* mem_ctx, const char* id) {
|
|
return talloc_asprintf(mem_ctx, "IDMAP/SID2XID/%s", id);
|
|
}
|
|
|
|
static bool idmap_cache_del_xid(char t, int xid)
|
|
{
|
|
TALLOC_CTX* mem_ctx = talloc_stackframe();
|
|
const char* key = key_xid2sid(mem_ctx, t, xid);
|
|
char* sid_str = NULL;
|
|
time_t timeout;
|
|
bool ret = true;
|
|
|
|
if (!gencache_get(key, mem_ctx, &sid_str, &timeout)) {
|
|
DEBUG(3, ("no entry: %s\n", key));
|
|
ret = false;
|
|
goto done;
|
|
}
|
|
|
|
if (sid_str[0] != '-') {
|
|
const char* sid_key = key_sid2xid_str(mem_ctx, sid_str);
|
|
if (!gencache_del(sid_key)) {
|
|
DEBUG(2, ("failed to delete: %s\n", sid_key));
|
|
ret = false;
|
|
} else {
|
|
DEBUG(5, ("delete: %s\n", sid_key));
|
|
}
|
|
|
|
}
|
|
|
|
if (!gencache_del(key)) {
|
|
DEBUG(1, ("failed to delete: %s\n", key));
|
|
ret = false;
|
|
} else {
|
|
DEBUG(5, ("delete: %s\n", key));
|
|
}
|
|
|
|
done:
|
|
talloc_free(mem_ctx);
|
|
return ret;
|
|
}
|
|
|
|
bool idmap_cache_del_uid(uid_t uid) {
|
|
return idmap_cache_del_xid('U', uid);
|
|
}
|
|
|
|
bool idmap_cache_del_gid(gid_t gid) {
|
|
return idmap_cache_del_xid('G', gid);
|
|
}
|
|
|
|
bool idmap_cache_del_sid(const struct dom_sid *sid)
|
|
{
|
|
TALLOC_CTX* mem_ctx = talloc_stackframe();
|
|
bool ret = true;
|
|
bool expired;
|
|
struct unixid id;
|
|
const char *sid_key;
|
|
|
|
if (!idmap_cache_find_sid2unixid(sid, &id, &expired)) {
|
|
ret = false;
|
|
goto done;
|
|
}
|
|
|
|
if (id.id != -1) {
|
|
switch (id.type) {
|
|
case ID_TYPE_BOTH:
|
|
idmap_cache_del_xid('U', id.id);
|
|
idmap_cache_del_xid('G', id.id);
|
|
break;
|
|
case ID_TYPE_UID:
|
|
idmap_cache_del_xid('U', id.id);
|
|
break;
|
|
case ID_TYPE_GID:
|
|
idmap_cache_del_xid('G', id.id);
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
|
|
sid_key = key_sid2xid_str(mem_ctx, dom_sid_string(mem_ctx, sid));
|
|
if (sid_key == NULL) {
|
|
return false;
|
|
}
|
|
/* If the mapping was symmetric, then this should fail */
|
|
gencache_del(sid_key);
|
|
done:
|
|
talloc_free(mem_ctx);
|
|
return ret;
|
|
}
|