source3/winbindd/idmap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping
   4    Copyright (C) Tim Potter 2000
   5    Copyright (C) Jim McDonough <jmcd@us.ibm.com>        2003
   6    Copyright (C) Simo Sorce 2003-2007
   7    Copyright (C) Jeremy Allison 2006
   8    Copyright (C) Michael Adam 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26 #include "idmap.h"
  27 #include "lib/util_sid_passdb.h"
  28 #include "libcli/security/dom_sid.h"
  29 #include "passdb.h"
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_IDMAP
  33
  34 static_decl_idmap;
  35
  36 /**
  37  * Pointer to the backend methods. Modules register themselves here via
  38  * smb_register_idmap.
  39  */
  40
  41 struct idmap_backend {
  42         const char *name;
  43         struct idmap_methods *methods;
  44         struct idmap_backend *prev, *next;
  45 };
  46 static struct idmap_backend *backends = NULL;
  47
  48 /**
  49  * Default idmap domain configured via "idmap backend".
  50  */
  51 static struct idmap_domain *default_idmap_domain;
  52
  53 /**
  54  * Passdb idmap domain, not configurable. winbind must always give passdb a
  55  * chance to map ids.
  56  */
  57 static struct idmap_domain *passdb_idmap_domain;
  58
  59 /**
  60  * List of specially configured idmap domains. This list is filled on demand
  61  * in the winbind idmap child when the parent winbind figures out via the
  62  * special range parameter or via the domain SID that a special "idmap config
  63  * domain" configuration is present.
  64  */
  65 static struct idmap_domain **idmap_domains = NULL;
  66 static int num_domains = 0;
  67
  68 static struct idmap_domain *idmap_init_named_domain(TALLOC_CTX *mem_ctx,
  69                                                     const char *domname);
  70 static struct idmap_domain *idmap_init_domain(TALLOC_CTX *mem_ctx,
  71                                               const char *domainname,
  72                                               const char *modulename,
  73                                               bool check_range);
  74
  75 struct lp_scan_idmap_domains_state {
  76         bool (*fn)(const char *domname, void *private_data);
  77         void *private_data;
  78 };
  79
  80 static bool lp_scan_idmap_found_domain(
  81         const char *string, regmatch_t matches[], void *private_data);
  82
  83 bool lp_scan_idmap_domains(bool (*fn)(const char *domname,
  84                                       void *private_data),
  85                            void *private_data)
  86 {
  87         struct lp_scan_idmap_domains_state state = {
  88                 .fn = fn, .private_data = private_data };
  89         int ret;
  90
  91         ret = lp_wi_scan_global_parametrics(
  92                 "idmapconfig\\(.*\\):backend", 2,
  93                 lp_scan_idmap_found_domain, &state);
  94         if (ret != 0) {
  95                 DBG_WARNING("wi_scan_global_parametrics returned %d\n", ret);
  96                 return false;
  97         }
  98
  99         return true;
 100 }
 101
 102 static bool lp_scan_idmap_found_domain(
 103         const char *string, regmatch_t matches[], void *private_data)
 104 {
 105         bool ok;
 106
 107         if (matches[1].rm_so == -1) {
 108                 DBG_WARNING("Found match, but no name??\n");
 109                 return false;
 110         }
 111         if (matches[1].rm_eo <= matches[1].rm_so) {
 112                 DBG_WARNING("Invalid match\n");
 113                 return false;
 114         }
 115
 116         {
 117                 struct lp_scan_idmap_domains_state *state = private_data;
 118                 regoff_t len = matches[1].rm_eo - matches[1].rm_so;
 119                 char domname[len+1];
 120
 121                 memcpy(domname, string + matches[1].rm_so, len);
 122                 domname[len] = '\0';
 123
 124                 DBG_DEBUG("Found idmap domain \"%s\"\n", domname);
 125
 126                 ok = state->fn(domname, state->private_data);
 127         }
 128
 129         return ok;
 130 }
 131
 132 static bool idmap_found_domain_backend(const char *domname,
 133                                        void *private_data);
 134
 135 static bool idmap_init(void)
 136 {
 137         static bool initialized;
 138         bool ok;
 139
 140         if (initialized) {
 141                 return true;
 142         }
 143
 144         DEBUG(10, ("idmap_init(): calling static_init_idmap\n"));
 145
 146         static_init_idmap(NULL);
 147
 148         initialized = true;
 149
 150         if (!pdb_is_responsible_for_everything_else()) {
 151                 default_idmap_domain = idmap_init_named_domain(NULL, "*");
 152                 if (default_idmap_domain == NULL) {
 153                         return false;
 154                 }
 155         }
 156
 157         passdb_idmap_domain = idmap_init_domain(
 158                 NULL, get_global_sam_name(), "passdb", false);
 159         if (passdb_idmap_domain == NULL) {
 160                 TALLOC_FREE(default_idmap_domain);
 161                 return false;
 162         }
 163
 164         idmap_domains = talloc_array(NULL, struct idmap_domain *, 0);
 165         if (idmap_domains == NULL) {
 166                 TALLOC_FREE(passdb_idmap_domain);
 167                 TALLOC_FREE(default_idmap_domain);
 168                 return false;
 169         }
 170
 171         ok = lp_scan_idmap_domains(idmap_found_domain_backend, NULL);
 172         if (!ok) {
 173                 DBG_WARNING("lp_scan_idmap_domains failed\n");
 174                 return false;
 175         }
 176
 177         return true;
 178 }
 179
 180 const char *idmap_config_const_string(const char *domname, const char *option,
 181                                       const char *def)
 182 {
 183         int len = snprintf(NULL, 0, "idmap config %s", domname);
 184
 185         if (len == -1) {
 186                 return NULL;
 187         }
 188         {
 189                 char config_option[len+1];
 190                 snprintf(config_option, sizeof(config_option),
 191                          "idmap config %s", domname);
 192                 return lp_parm_const_string(-1, config_option, option, def);
 193         }
 194 }
 195
 196 bool idmap_config_bool(const char *domname, const char *option, bool def)
 197 {
 198         int len = snprintf(NULL, 0, "idmap config %s", domname);
 199
 200         if (len == -1) {
 201                 return def;
 202         }
 203         {
 204                 char config_option[len+1];
 205                 snprintf(config_option, sizeof(config_option),
 206                          "idmap config %s", domname);
 207                 return lp_parm_bool(-1, config_option, option, def);
 208         }
 209 }
 210
 211 int idmap_config_int(const char *domname, const char *option, int def)
 212 {
 213         int len = snprintf(NULL, 0, "idmap config %s", domname);
 214
 215         if (len == -1) {
 216                 return def;
 217         }
 218         {
 219                 char config_option[len+1];
 220                 snprintf(config_option, sizeof(config_option),
 221                          "idmap config %s", domname);
 222                 return lp_parm_int(-1, config_option, option, def);
 223         }
 224 }
 225
 226 bool domain_has_idmap_config(const char *domname)
 227 {
 228         int i;
 229         const char *range = NULL;
 230         const char *backend = NULL;
 231         bool ok;
 232
 233         ok = idmap_init();
 234         if (!ok) {
 235                 return false;
 236         }
 237
 238         for (i=0; i<num_domains; i++) {
 239                 if (strequal(idmap_domains[i]->name, domname)) {
 240                         return true;
 241                 }
 242         }
 243
 244         /* fallback: also check loadparm */
 245
 246         range = idmap_config_const_string(domname, "range", NULL);
 247         backend = idmap_config_const_string(domname, "backend", NULL);
 248         if (range != NULL && backend != NULL) {
 249                 DEBUG(5, ("idmap configuration specified for domain '%s'\n",
 250                         domname));
 251                 return true;
 252         }
 253
 254         return false;
 255 }
 256
 257 static bool idmap_found_domain_backend(const char *domname,
 258                                        void *private_data)
 259 {
 260         struct idmap_domain *dom, **tmp;
 261
 262         DBG_DEBUG("Found idmap domain \"%s\"\n", domname);
 263
 264         if (strcmp(domname, "*") == 0) {
 265                 return false;
 266         }
 267
 268         dom = idmap_init_named_domain(idmap_domains, domname);
 269         if (dom == NULL) {
 270                 DBG_NOTICE("Could not init idmap domain %s\n", domname);
 271                 return false;
 272         }
 273
 274         tmp = talloc_realloc(idmap_domains, idmap_domains,
 275                              struct idmap_domain *, num_domains + 1);
 276         if (tmp == NULL) {
 277                 DBG_WARNING("talloc_realloc failed\n");
 278                 TALLOC_FREE(dom);
 279                 return false;
 280         }
 281         idmap_domains = tmp;
 282         idmap_domains[num_domains] = dom;
 283         num_domains += 1;
 284
 285         return false;
 286 }
 287
 288 static struct idmap_methods *get_methods(const char *name)
 289 {
 290         struct idmap_backend *b;
 291
 292         for (b = backends; b; b = b->next) {
 293                 if (strequal(b->name, name)) {
 294                         return b->methods;
 295                 }
 296         }
 297
 298         return NULL;
 299 }
 300
 301 bool idmap_is_offline(void)
 302 {
 303         return ( lp_winbind_offline_logon() &&
 304              get_global_winbindd_state_offline() );
 305 }
 306
 307 bool idmap_is_online(void)
 308 {
 309         return !idmap_is_offline();
 310 }
 311
 312 /**********************************************************************
 313  Allow a module to register itself as a method.
 314 **********************************************************************/
 315
 316 NTSTATUS smb_register_idmap(int version, const char *name,
 317                             struct idmap_methods *methods)
 318 {
 319         struct idmap_backend *entry;
 320
 321         if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
 322                 DEBUG(0, ("Failed to register idmap module.\n"
 323                           "The module was compiled against "
 324                           "SMB_IDMAP_INTERFACE_VERSION %d,\n"
 325                           "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
 326                           "Please recompile against the current version "
 327                           "of samba!\n",
 328                           version, SMB_IDMAP_INTERFACE_VERSION));
 329                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 330         }
 331
 332         if (!name || !name[0] || !methods) {
 333                 DEBUG(0,("Called with NULL pointer or empty name!\n"));
 334                 return NT_STATUS_INVALID_PARAMETER;
 335         }
 336
 337         for (entry = backends; entry != NULL; entry = entry->next) {
 338                 if (strequal(entry->name, name)) {
 339                         DEBUG(5,("Idmap module %s already registered!\n",
 340                                  name));
 341                         return NT_STATUS_OBJECT_NAME_COLLISION;
 342                 }
 343         }
 344
 345         entry = talloc(NULL, struct idmap_backend);
 346         if ( ! entry) {
 347                 DEBUG(0,("Out of memory!\n"));
 348                 TALLOC_FREE(entry);
 349                 return NT_STATUS_NO_MEMORY;
 350         }
 351         entry->name = talloc_strdup(entry, name);
 352         if ( ! entry->name) {
 353                 DEBUG(0,("Out of memory!\n"));
 354                 TALLOC_FREE(entry);
 355                 return NT_STATUS_NO_MEMORY;
 356         }
 357         entry->methods = methods;
 358
 359         DLIST_ADD(backends, entry);
 360         DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
 361         return NT_STATUS_OK;
 362 }
 363
 364 /**
 365  * Initialize a domain structure
 366  * @param[in] mem_ctx           memory context for the result
 367  * @param[in] domainname        which domain is this for
 368  * @param[in] modulename        which backend module
 369  * @param[in] check_range       whether range checking should be done
 370  * @result The initialized structure
 371  */
 372 static struct idmap_domain *idmap_init_domain(TALLOC_CTX *mem_ctx,
 373                                               const char *domainname,
 374                                               const char *modulename,
 375                                               bool check_range)
 376 {
 377         struct idmap_domain *result;
 378         NTSTATUS status;
 379         const char *range;
 380         unsigned low_id = 0;
 381         unsigned high_id = 0;
 382
 383         result = talloc_zero(mem_ctx, struct idmap_domain);
 384         if (result == NULL) {
 385                 DEBUG(0, ("talloc failed\n"));
 386                 return NULL;
 387         }
 388
 389         result->name = talloc_strdup(result, domainname);
 390         if (result->name == NULL) {
 391                 DEBUG(0, ("talloc failed\n"));
 392                 goto fail;
 393         }
 394
 395         /*
 396          * Check whether the requested backend module exists and
 397          * load the methods.
 398          */
 399
 400         result->methods = get_methods(modulename);
 401         if (result->methods == NULL) {
 402                 DEBUG(3, ("idmap backend %s not found\n", modulename));
 403
 404                 status = smb_probe_module("idmap", modulename);
 405                 if (!NT_STATUS_IS_OK(status)) {
 406                         DEBUG(3, ("Could not probe idmap module %s\n",
 407                                   modulename));
 408                         goto fail;
 409                 }
 410
 411                 result->methods = get_methods(modulename);
 412         }
 413         if (result->methods == NULL) {
 414                 DEBUG(1, ("idmap backend %s not found\n", modulename));
 415                 goto fail;
 416         }
 417
 418         /*
 419          * load ranges and read only information from the config
 420          */
 421
 422         result->read_only = idmap_config_bool(result->name, "read only", false);
 423         range = idmap_config_const_string(result->name, "range", NULL);
 424
 425         if (range == NULL) {
 426                 if (check_range) {
 427                         DEBUG(1, ("idmap range not specified for domain %s\n",
 428                                   result->name));
 429                         goto fail;
 430                 }
 431         } else if (sscanf(range, "%u - %u", &low_id, &high_id) != 2)
 432         {
 433                 DEBUG(1, ("invalid range '%s' specified for domain "
 434                           "'%s'\n", range, result->name));
 435                 if (check_range) {
 436                         goto fail;
 437                 }
 438         } else if (low_id > high_id) {
 439                 DEBUG(1, ("Error: invalid idmap range detected: %u - %u\n",
 440                           low_id, high_id));
 441                 if (check_range) {
 442                         goto fail;
 443                 }
 444         }
 445
 446         result->low_id = low_id;
 447         result->high_id = high_id;
 448
 449         status = result->methods->init(result);
 450         if (!NT_STATUS_IS_OK(status)) {
 451                 DEBUG(1, ("idmap initialization returned %s\n",
 452                           nt_errstr(status)));
 453                 goto fail;
 454         }
 455
 456         return result;
 457
 458 fail:
 459         TALLOC_FREE(result);
 460         return NULL;
 461 }
 462
 463 /**
 464  * Initialize a named domain structure
 465  * @param[in] mem_ctx           memory context for the result
 466  * @param[in] domname           the domain name
 467  * @result The default domain structure
 468  *
 469  * This routine looks at the "idmap config <domname>" parameters to figure out
 470  * the configuration.
 471  */
 472
 473 static struct idmap_domain *idmap_init_named_domain(TALLOC_CTX *mem_ctx,
 474                                                     const char *domname)
 475 {
 476         struct idmap_domain *result = NULL;
 477         const char *backend;
 478         bool ok;
 479
 480         ok = idmap_init();
 481         if (!ok) {
 482                 return NULL;
 483         }
 484
 485         backend = idmap_config_const_string(domname, "backend", NULL);
 486         if (backend == NULL) {
 487                 DEBUG(10, ("no idmap backend configured for domain '%s'\n",
 488                            domname));
 489                 goto fail;
 490         }
 491
 492         result = idmap_init_domain(mem_ctx, domname, backend, true);
 493         if (result == NULL) {
 494                 goto fail;
 495         }
 496
 497         return result;
 498
 499 fail:
 500         TALLOC_FREE(result);
 501         return NULL;
 502 }
 503
 504 /**
 505  * Find a domain struct according to a domain name
 506  * @param[in] domname           Domain name to get the config for
 507  * @result The default domain structure that fits
 508  *
 509  * This is the central routine in the winbindd-idmap child to pick the correct
 510  * domain for looking up IDs. If domname is NULL or empty, we use the default
 511  * domain. If it contains something, we try to use idmap_init_named_domain()
 512  * to fetch the correct backend.
 513  *
 514  * The choice about "domname" is being made by the winbind parent, look at the
 515  * "have_idmap_config" of "struct winbindd_domain" which is set in
 516  * add_trusted_domain.
 517  */
 518
 519 struct idmap_domain *idmap_find_domain(const char *domname)
 520 {
 521         bool ok;
 522         int i;
 523
 524         DEBUG(10, ("idmap_find_domain called for domain '%s'\n",
 525                    domname?domname:"NULL"));
 526
 527         ok = idmap_init();
 528         if (!ok) {
 529                 return NULL;
 530         }
 531
 532         if ((domname == NULL) || (domname[0] == '\0')) {
 533                 return default_idmap_domain;
 534         }
 535
 536         for (i=0; i<num_domains; i++) {
 537                 if (strequal(idmap_domains[i]->name, domname)) {
 538                         return idmap_domains[i];
 539                 }
 540         }
 541
 542         return default_idmap_domain;
 543 }
 544
 545 struct idmap_domain *idmap_find_domain_with_sid(const char *domname,
 546                                                 const struct dom_sid *sid)
 547 {
 548         bool ok;
 549
 550         ok = idmap_init();
 551         if (!ok) {
 552                 return NULL;
 553         }
 554
 555         if (sid_check_is_for_passdb(sid)) {
 556                 return passdb_idmap_domain;
 557         }
 558
 559         return idmap_find_domain(domname);
 560 }
 561
 562 void idmap_close(void)
 563 {
 564         TALLOC_FREE(default_idmap_domain);
 565         TALLOC_FREE(passdb_idmap_domain);
 566         TALLOC_FREE(idmap_domains);
 567         num_domains = 0;
 568 }
 569
 570 /**************************************************************************
 571  idmap allocator interface functions
 572 **************************************************************************/
 573
 574 static NTSTATUS idmap_allocate_unixid(struct unixid *id)
 575 {
 576         struct idmap_domain *dom;
 577         NTSTATUS ret;
 578
 579         dom = idmap_find_domain(NULL);
 580
 581         if (dom == NULL) {
 582                 return NT_STATUS_UNSUCCESSFUL;
 583         }
 584
 585         if (dom->methods->allocate_id == NULL) {
 586                 return NT_STATUS_NOT_IMPLEMENTED;
 587         }
 588
 589         ret = dom->methods->allocate_id(dom, id);
 590
 591         return ret;
 592 }
 593
 594
 595 NTSTATUS idmap_allocate_uid(struct unixid *id)
 596 {
 597         id->type = ID_TYPE_UID;
 598         return idmap_allocate_unixid(id);
 599 }
 600
 601 NTSTATUS idmap_allocate_gid(struct unixid *id)
 602 {
 603         id->type = ID_TYPE_GID;
 604         return idmap_allocate_unixid(id);
 605 }
 606
 607 NTSTATUS idmap_backend_unixids_to_sids(struct id_map **maps,
 608                                        const char *domain_name)
 609 {
 610         struct idmap_domain *dom = NULL;
 611         NTSTATUS status;
 612         bool ok;
 613
 614         ok = idmap_init();
 615         if (!ok) {
 616                 return NT_STATUS_NONE_MAPPED;
 617         }
 618
 619         if (strequal(domain_name, get_global_sam_name())) {
 620                 dom = passdb_idmap_domain;
 621         }
 622         if (dom == NULL) {
 623                 dom = idmap_find_domain(domain_name);
 624         }
 625         if (dom == NULL) {
 626                 return NT_STATUS_NONE_MAPPED;
 627         }
 628
 629         status = dom->methods->unixids_to_sids(dom, maps);
 630
 631         DBG_DEBUG("unixid_to_sids for domain %s returned %s\n",
 632                   domain_name, nt_errstr(status));
 633
 634         return status;
 635 }