1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source3/winbindd/idmap_nss.c
Samuel Cabrero 086a90d52b idmap_nss: Install a messaging filter to reload the configuration
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2023-12-13 15:07:38 +00:00

447 lines
10 KiB
C

/*
Unix SMB/CIFS implementation.
idmap NSS backend
Copyright (C) Simo Sorce 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "system/passwd.h"
#include "winbindd.h"
#include "nsswitch/winbind_client.h"
#include "idmap.h"
#include "lib/winbind_util.h"
#include "libcli/security/dom_sid.h"
#include "lib/global_contexts.h"
#include "messages.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_IDMAP
struct idmap_nss_context {
struct idmap_domain *dom;
bool use_upn;
};
static int idmap_nss_context_destructor(struct idmap_nss_context *ctx)
{
if ((ctx->dom != NULL) && (ctx->dom->private_data == ctx)) {
ctx->dom->private_data = NULL;
}
return 0;
}
static NTSTATUS idmap_nss_context_create(TALLOC_CTX *mem_ctx,
struct idmap_domain *dom,
struct idmap_nss_context **pctx)
{
struct idmap_nss_context *ctx = NULL;
ctx = talloc_zero(mem_ctx, struct idmap_nss_context);
if (ctx == NULL) {
return NT_STATUS_NO_MEMORY;
}
ctx->dom = dom;
talloc_set_destructor(ctx, idmap_nss_context_destructor);
ctx->use_upn = idmap_config_bool(dom->name, "use_upn", false);
*pctx = ctx;
return NT_STATUS_OK;
}
static NTSTATUS idmap_nss_get_context(struct idmap_domain *dom,
struct idmap_nss_context **pctx)
{
struct idmap_nss_context *ctx = NULL;
NTSTATUS status;
if (dom->private_data != NULL) {
*pctx = talloc_get_type_abort(dom->private_data,
struct idmap_nss_context);
return NT_STATUS_OK;
}
status = idmap_nss_context_create(dom, dom, &ctx);
if (!NT_STATUS_IS_OK(status)) {
DBG_WARNING("idmap_nss_context_create failed: %s\n",
nt_errstr(status));
return status;
}
dom->private_data = ctx;
*pctx = ctx;
return NT_STATUS_OK;
}
static bool idmap_nss_msg_filter(struct messaging_rec *rec, void *private_data)
{
struct idmap_domain *dom = talloc_get_type_abort(private_data,
struct idmap_domain);
struct idmap_nss_context *ctx = NULL;
NTSTATUS status;
bool ret;
if (rec->msg_type == MSG_SMB_CONF_UPDATED) {
ret = lp_load_global(get_dyn_CONFIGFILE());
if (!ret) {
DBG_WARNING("Failed to reload configuration\n");
return false;
}
status = idmap_nss_get_context(dom, &ctx);
if (NT_STATUS_IS_ERR(status)) {
DBG_WARNING("Failed to get idmap nss context: %s\n",
nt_errstr(status));
return false;
}
ctx->use_upn = idmap_config_bool(dom->name, "use_upn", false);
}
return false;
}
/*****************************
Initialise idmap database.
*****************************/
static NTSTATUS idmap_nss_int_init(struct idmap_domain *dom)
{
struct idmap_nss_context *ctx = NULL;
NTSTATUS status;
struct messaging_context *msg_ctx = global_messaging_context();
struct tevent_req *req = NULL;
status = idmap_nss_context_create(dom, dom, &ctx);
if (NT_STATUS_IS_ERR(status)) {
return status;
}
dom->private_data = ctx;
req = messaging_filtered_read_send(
dom,
messaging_tevent_context(msg_ctx),
msg_ctx,
idmap_nss_msg_filter,
dom);
if (req == NULL) {
DBG_WARNING("messaging_filtered_read_send failed\n");
return NT_STATUS_UNSUCCESSFUL;
}
return status;
}
static NTSTATUS idmap_nss_lookup_name(const char *namespace,
const char *username,
struct dom_sid *sid,
enum lsa_SidType *type)
{
bool ret;
/*
* By default calls to winbindd are disabled
* the following call will not recurse so this is safe
*/
(void)winbind_on();
ret = winbind_lookup_name(namespace, username, sid, type);
(void)winbind_off();
if (!ret) {
DBG_NOTICE("Failed to lookup name [%s] in namespace [%s]\n",
username, namespace);
return NT_STATUS_NOT_FOUND;
}
return NT_STATUS_OK;
}
/**********************************
lookup a set of unix ids.
**********************************/
static NTSTATUS idmap_nss_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
{
struct idmap_nss_context *ctx = NULL;
NTSTATUS status;
int i;
status = idmap_nss_get_context(dom, &ctx);
if (NT_STATUS_IS_ERR(status)) {
DBG_WARNING("Failed to get idmap nss context: %s\n",
nt_errstr(status));
return status;
}
/* initialize the status to avoid surprise */
for (i = 0; ids[i]; i++) {
ids[i]->status = ID_UNKNOWN;
}
for (i = 0; ids[i]; i++) {
struct passwd *pw;
struct group *gr;
const char *name;
struct dom_sid sid;
enum lsa_SidType type;
switch (ids[i]->xid.type) {
case ID_TYPE_UID:
errno = 0;
pw = getpwuid((uid_t)ids[i]->xid.id);
if (!pw) {
DBG_DEBUG("getpwuid(%lu) failed: %s\n",
(unsigned long)ids[i]->xid.id,
errno != 0
? strerror(errno)
: "not found");
ids[i]->status = ID_UNMAPPED;
continue;
}
name = pw->pw_name;
break;
case ID_TYPE_GID:
errno = 0;
gr = getgrgid((gid_t)ids[i]->xid.id);
if (!gr) {
DBG_DEBUG("getgrgid(%lu) failed: %s\n",
(unsigned long)ids[i]->xid.id,
errno != 0
? strerror(errno)
: "not found");
ids[i]->status = ID_UNMAPPED;
continue;
}
name = gr->gr_name;
break;
default: /* ?? */
DBG_WARNING("Unexpected xid type %d\n",
ids[i]->xid.type);
ids[i]->status = ID_UNKNOWN;
continue;
}
/* Lookup name from PDC using lsa_lookup_names() */
if (ctx->use_upn) {
char *p = NULL;
const char *namespace = NULL;
const char *domname = NULL;
const char *domuser = NULL;
p = strstr(name, lp_winbind_separator());
if (p != NULL) {
*p = '\0';
domname = name;
namespace = domname;
domuser = p + 1;
} else {
p = strchr(name, '@');
if (p != NULL) {
*p = '\0';
namespace = p + 1;
domname = "";
domuser = name;
} else {
namespace = dom->name;
domuser = name;
}
}
DBG_DEBUG("Using namespace [%s] from UPN instead "
"of [%s] to lookup the name [%s]\n",
namespace, dom->name, domuser);
status = idmap_nss_lookup_name(namespace,
domuser,
&sid,
&type);
} else {
status = idmap_nss_lookup_name(dom->name,
name,
&sid,
&type);
}
if (NT_STATUS_IS_ERR(status)) {
/*
* TODO: how do we know if the name is really
* not mapped, or something just failed ?
*/
ids[i]->status = ID_UNMAPPED;
continue;
}
switch (type) {
case SID_NAME_USER:
if (ids[i]->xid.type == ID_TYPE_UID) {
sid_copy(ids[i]->sid, &sid);
ids[i]->status = ID_MAPPED;
}
break;
case SID_NAME_DOM_GRP:
case SID_NAME_ALIAS:
case SID_NAME_WKN_GRP:
if (ids[i]->xid.type == ID_TYPE_GID) {
sid_copy(ids[i]->sid, &sid);
ids[i]->status = ID_MAPPED;
}
break;
default:
ids[i]->status = ID_UNKNOWN;
break;
}
}
return NT_STATUS_OK;
}
/**********************************
lookup a set of sids.
**********************************/
static NTSTATUS idmap_nss_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
{
struct idmap_nss_context *ctx = NULL;
NTSTATUS status;
int i;
status = idmap_nss_get_context(dom, &ctx);
if (NT_STATUS_IS_ERR(status)) {
DBG_WARNING("Failed to get idmap nss context: %s\n",
nt_errstr(status));
return status;
}
/* initialize the status to avoid surprise */
for (i = 0; ids[i]; i++) {
ids[i]->status = ID_UNKNOWN;
}
for (i = 0; ids[i]; i++) {
struct group *gr;
enum lsa_SidType type;
const char *_domain = NULL;
const char *_name = NULL;
char *domain = NULL;
char *name = NULL;
char *fqdn = NULL;
char *sname = NULL;
bool ret;
/* by default calls to winbindd are disabled
the following call will not recurse so this is safe */
(void)winbind_on();
ret = winbind_lookup_sid(talloc_tos(),
ids[i]->sid,
&_domain,
&_name,
&type);
(void)winbind_off();
if (!ret) {
/* TODO: how do we know if the name is really not mapped,
* or something just failed ? */
ids[i]->status = ID_UNMAPPED;
continue;
}
domain = discard_const_p(char, _domain);
name = discard_const_p(char, _name);
if (!strequal(domain, dom->name)) {
struct dom_sid_buf buf;
DBG_ERR("DOMAIN[%s] ignoring SID[%s] belongs to %s [%s\\%s]\n",
dom->name, dom_sid_str_buf(ids[i]->sid, &buf),
sid_type_lookup(type), domain, name);
ids[i]->status = ID_UNMAPPED;
continue;
}
if (ctx->use_upn) {
fqdn = talloc_asprintf(talloc_tos(),
"%s%s%s",
domain,
lp_winbind_separator(),
name);
if (fqdn == NULL) {
DBG_ERR("No memory\n");
ids[i]->status = ID_UNMAPPED;
continue;
}
DBG_DEBUG("Using UPN [%s] instead of plain name [%s]\n",
fqdn, name);
sname = fqdn;
} else {
sname = name;
}
switch (type) {
case SID_NAME_USER: {
struct passwd *pw;
/* this will find also all lower case name and use username level */
pw = Get_Pwnam_alloc(talloc_tos(), sname);
if (pw) {
ids[i]->xid.id = pw->pw_uid;
ids[i]->xid.type = ID_TYPE_UID;
ids[i]->status = ID_MAPPED;
}
TALLOC_FREE(pw);
break;
}
case SID_NAME_DOM_GRP:
case SID_NAME_ALIAS:
case SID_NAME_WKN_GRP:
gr = getgrnam(sname);
if (gr) {
ids[i]->xid.id = gr->gr_gid;
ids[i]->xid.type = ID_TYPE_GID;
ids[i]->status = ID_MAPPED;
}
break;
default:
ids[i]->status = ID_UNKNOWN;
break;
}
TALLOC_FREE(domain);
TALLOC_FREE(name);
TALLOC_FREE(fqdn);
}
return NT_STATUS_OK;
}
/**********************************
Close the idmap tdb instance
**********************************/
static const struct idmap_methods nss_methods = {
.init = idmap_nss_int_init,
.unixids_to_sids = idmap_nss_unixids_to_sids,
.sids_to_unixids = idmap_nss_sids_to_unixids,
};
NTSTATUS idmap_nss_init(TALLOC_CTX *mem_ctx)
{
return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "nss", &nss_methods);
}