2 Unix SMB/CIFS implementation.
4 idmap script backend, used for Samba setups where you need to map SIDs to
7 Copyright (C) Richard Sharpe 2014.
9 This is heavily based upon idmap_tdb2.c, which is:
11 Copyright (C) Tim Potter 2000
12 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
13 Copyright (C) Jeremy Allison 2006
14 Copyright (C) Simo Sorce 2003-2006
15 Copyright (C) Michael Adam 2009-2010
17 This program is free software; you can redistribute it and/or modify
18 it under the terms of the GNU General Public License as published by
19 the Free Software Foundation; either version 2 of the License, or
20 (at your option) any later version.
22 This program is distributed in the hope that it will be useful,
23 but WITHOUT ANY WARRANTY; without even the implied warranty of
24 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25 GNU General Public License for more details.
27 You should have received a copy of the GNU General Public License
28 along with this program; if not, write to the Free Software
29 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
33 #include "system/filesys.h"
37 #include "../libcli/security/dom_sid.h"
38 #include "lib/util_file.h"
39 #include "lib/util/tevent_unix.h"
42 #define DBGC_CLASS DBGC_IDMAP
44 struct idmap_script_context {
45 const char *script; /* script to provide idmaps */
49 run a script to perform a mapping
51 The script should accept the following command lines:
53 SIDTOID S-1-xxxx -> XID:<id> | ERR:<str>
54 SIDTOID S-1-xxxx -> UID:<id> | ERR:<str>
55 SIDTOID S-1-xxxx -> GID:<id> | ERR:<str>
56 IDTOSID XID xxxx -> SID:<sid> | ERR:<str>
57 IDTOSID UID xxxx -> SID:<sid> | ERR:<str>
58 IDTOSID GID xxxx -> SID:<sid> | ERR:<str>
60 where XID means both a UID and a GID. This is the case for ID_TYPE_BOTH.
62 TODO: Needs more validation ... like that we got a UID when we asked for one.
65 struct idmap_script_xid2sid_state {
71 static void idmap_script_xid2sid_done(struct tevent_req *subreq);
73 static struct tevent_req *idmap_script_xid2sid_send(
74 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
75 struct unixid xid, const char *script, size_t idx)
77 struct tevent_req *req, *subreq;
78 struct idmap_script_xid2sid_state *state;
81 req = tevent_req_create(mem_ctx, &state,
82 struct idmap_script_xid2sid_state);
99 DBG_WARNING("INVALID unix ID type: 0x02%x\n", xid.type);
100 tevent_req_error(req, EINVAL);
101 return tevent_req_post(req, ev);
104 state->argl = str_list_make_empty(state);
105 str_list_add_printf(&state->argl, "%s", script);
106 str_list_add_printf(&state->argl, "IDTOSID");
107 str_list_add_printf(&state->argl, "%cID", key);
108 str_list_add_printf(&state->argl, "%lu", (unsigned long)xid.id);
109 if (tevent_req_nomem(state->argl, req)) {
110 return tevent_req_post(req, ev);
113 subreq = file_ploadv_send(state, ev, state->argl, 1024);
114 if (tevent_req_nomem(subreq, req)) {
115 return tevent_req_post(req, ev);
117 tevent_req_set_callback(subreq, idmap_script_xid2sid_done, req);
121 static void idmap_script_xid2sid_done(struct tevent_req *subreq)
123 struct tevent_req *req = tevent_req_callback_data(
124 subreq, struct tevent_req);
125 struct idmap_script_xid2sid_state *state = tevent_req_data(
126 req, struct idmap_script_xid2sid_state);
129 ret = file_ploadv_recv(subreq, state, &state->out);
131 if (tevent_req_error(req, ret)) {
134 tevent_req_done(req);
137 static int idmap_script_xid2sid_recv(struct tevent_req *req, size_t *idx,
138 enum id_mapping *status,
141 struct idmap_script_xid2sid_state *state = tevent_req_data(
142 req, struct idmap_script_xid2sid_state);
143 char *out = (char *)state->out;
144 size_t out_size = talloc_get_size(out);
147 if (tevent_req_is_unix_error(req, &err)) {
154 if (state->out[out_size-1] != '\0') {
160 if ((strncmp(out, "SID:S-", 6) != 0) ||
161 !dom_sid_parse(out+4, sid)) {
162 DBG_WARNING("Bad sid from script: %s\n", out);
170 *sid = (struct dom_sid) {0};
171 *status = ID_UNMAPPED;
175 struct idmap_script_xids2sids_state {
181 static void idmap_script_xids2sids_done(struct tevent_req *subreq);
183 static struct tevent_req *idmap_script_xids2sids_send(
184 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
185 struct id_map **ids, size_t num_ids, const char *script)
187 struct tevent_req *req;
188 struct idmap_script_xids2sids_state *state;
191 req = tevent_req_create(mem_ctx, &state,
192 struct idmap_script_xids2sids_state);
197 state->num_ids = num_ids;
199 if (state->num_ids == 0) {
200 tevent_req_done(req);
201 return tevent_req_post(req, ev);
204 for (i=0; i<num_ids; i++) {
205 struct tevent_req *subreq;
207 subreq = idmap_script_xid2sid_send(
208 state, ev, ids[i]->xid, script, i);
209 if (tevent_req_nomem(subreq, req)) {
210 return tevent_req_post(req, ev);
212 tevent_req_set_callback(subreq, idmap_script_xids2sids_done,
219 static void idmap_script_xids2sids_done(struct tevent_req *subreq)
221 struct tevent_req *req = tevent_req_callback_data(
222 subreq, struct tevent_req);
223 struct idmap_script_xids2sids_state *state = tevent_req_data(
224 req, struct idmap_script_xids2sids_state);
226 enum id_mapping status = ID_UNKNOWN;
227 struct dom_sid sid = {0};
230 ret = idmap_script_xid2sid_recv(subreq, &idx, &status, &sid);
232 if (tevent_req_error(req, ret)) {
236 if (idx >= state->num_ids) {
237 tevent_req_error(req, EINVAL);
241 state->ids[idx]->status = status;
243 state->ids[idx]->sid = dom_sid_dup(state->ids, &sid);
244 if (tevent_req_nomem(state->ids[idx]->sid, req)) {
248 state->num_done += 1;
250 if (state->num_done >= state->num_ids) {
251 tevent_req_done(req);
255 static int idmap_script_xids2sids_recv(struct tevent_req *req)
257 return tevent_req_simple_recv_unix(req);
260 static int idmap_script_xids2sids(struct id_map **ids, size_t num_ids,
263 TALLOC_CTX *frame = talloc_stackframe();
264 struct tevent_context *ev;
265 struct tevent_req *req;
268 ev = samba_tevent_context_init(frame);
272 req = idmap_script_xids2sids_send(frame, ev, ids, num_ids, script);
276 if (!tevent_req_poll(req, ev)) {
280 ret = idmap_script_xids2sids_recv(req);
286 static NTSTATUS idmap_script_unixids_to_sids(struct idmap_domain *dom,
289 struct idmap_script_context *ctx = talloc_get_type_abort(
290 dom->private_data, struct idmap_script_context);
292 size_t i, num_ids, num_mapped;
294 DEBUG(10, ("%s called ...\n", __func__));
295 /* Init status to avoid surprise ... */
296 for (i = 0; ids[i]; i++) {
297 ids[i]->status = ID_UNKNOWN;
301 ret = idmap_script_xids2sids(ids, num_ids, ctx->script);
303 DBG_DEBUG("idmap_script_xids2sids returned %s\n",
305 return map_nt_error_from_unix(ret);
310 for (i = 0; ids[i]; i++) {
311 if (ids[i]->status == ID_MAPPED) {
316 if (num_mapped == 0) {
317 return NT_STATUS_NONE_MAPPED;
319 if (num_mapped < num_ids) {
320 return STATUS_SOME_UNMAPPED;
325 struct idmap_script_sid2xid_state {
331 static void idmap_script_sid2xid_done(struct tevent_req *subreq);
333 static struct tevent_req *idmap_script_sid2xid_send(
334 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
335 const struct dom_sid *sid, const char *script, size_t idx)
337 struct tevent_req *req, *subreq;
338 struct idmap_script_sid2xid_state *state;
339 struct dom_sid_buf sidbuf;
341 req = tevent_req_create(mem_ctx, &state,
342 struct idmap_script_sid2xid_state);
348 state->argl = str_list_make_empty(state);
349 str_list_add_printf(&state->argl, "%s", script);
350 str_list_add_printf(&state->argl, "SIDTOID");
352 &state->argl, "%s", dom_sid_str_buf(sid, &sidbuf));
353 if (tevent_req_nomem(state->argl, req)) {
354 return tevent_req_post(req, ev);
357 subreq = file_ploadv_send(state, ev, state->argl, 1024);
358 if (tevent_req_nomem(subreq, req)) {
359 return tevent_req_post(req, ev);
361 tevent_req_set_callback(subreq, idmap_script_sid2xid_done, req);
365 static void idmap_script_sid2xid_done(struct tevent_req *subreq)
367 struct tevent_req *req = tevent_req_callback_data(
368 subreq, struct tevent_req);
369 struct idmap_script_sid2xid_state *state = tevent_req_data(
370 req, struct idmap_script_sid2xid_state);
373 ret = file_ploadv_recv(subreq, state, &state->out);
375 if (tevent_req_error(req, ret)) {
378 tevent_req_done(req);
381 static int idmap_script_sid2xid_recv(struct tevent_req *req,
382 size_t *idx, enum id_mapping *status,
385 struct idmap_script_sid2xid_state *state = tevent_req_data(
386 req, struct idmap_script_sid2xid_state);
387 char *out = (char *)state->out;
388 size_t out_size = talloc_get_size(out);
392 if (tevent_req_is_unix_error(req, &err)) {
399 if (state->out[out_size-1] != '\0') {
405 if (sscanf(out, "XID:%lu\n", &v) == 1) {
406 *xid = (struct unixid) { .id = v, .type = ID_TYPE_BOTH };
407 } else if (sscanf(out, "UID:%lu\n", &v) == 1) {
408 *xid = (struct unixid) { .id = v, .type = ID_TYPE_UID };
409 } else if (sscanf(out, "GID:%lu\n", &v) == 1) {
410 *xid = (struct unixid) { .id = v, .type = ID_TYPE_GID };
419 *xid = (struct unixid) { .id = UINT32_MAX,
420 .type = ID_TYPE_NOT_SPECIFIED };
421 *status = ID_UNMAPPED;
425 struct idmap_script_sids2xids_state {
431 static void idmap_script_sids2xids_done(struct tevent_req *subreq);
433 static struct tevent_req *idmap_script_sids2xids_send(
434 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
435 struct id_map **ids, size_t num_ids, const char *script)
437 struct tevent_req *req;
438 struct idmap_script_sids2xids_state *state;
441 req = tevent_req_create(mem_ctx, &state,
442 struct idmap_script_sids2xids_state);
447 state->num_ids = num_ids;
449 if (state->num_ids == 0) {
450 tevent_req_done(req);
451 return tevent_req_post(req, ev);
454 for (i=0; i<num_ids; i++) {
455 struct tevent_req *subreq;
457 subreq = idmap_script_sid2xid_send(
458 state, ev, ids[i]->sid, script, i);
459 if (tevent_req_nomem(subreq, req)) {
460 return tevent_req_post(req, ev);
462 tevent_req_set_callback(subreq, idmap_script_sids2xids_done,
469 static void idmap_script_sids2xids_done(struct tevent_req *subreq)
471 struct tevent_req *req = tevent_req_callback_data(
472 subreq, struct tevent_req);
473 struct idmap_script_sids2xids_state *state = tevent_req_data(
474 req, struct idmap_script_sids2xids_state);
476 enum id_mapping status = ID_UNKNOWN;
477 struct unixid xid = { .id = UINT32_MAX,
478 .type = ID_TYPE_NOT_SPECIFIED };
481 ret = idmap_script_sid2xid_recv(subreq, &idx, &status, &xid);
483 if (tevent_req_error(req, ret)) {
487 if (idx >= state->num_ids) {
488 tevent_req_error(req, EINVAL);
492 state->ids[idx]->status = status;
493 state->ids[idx]->xid = xid;
495 state->num_done += 1;
497 if (state->num_done >= state->num_ids) {
498 tevent_req_done(req);
502 static int idmap_script_sids2xids_recv(struct tevent_req *req)
504 return tevent_req_simple_recv_unix(req);
507 static int idmap_script_sids2xids(struct id_map **ids, size_t num_ids,
510 TALLOC_CTX *frame = talloc_stackframe();
511 struct tevent_context *ev;
512 struct tevent_req *req;
515 ev = samba_tevent_context_init(frame);
519 req = idmap_script_sids2xids_send(frame, ev, ids, num_ids, script);
523 if (!tevent_req_poll(req, ev)) {
527 ret = idmap_script_sids2xids_recv(req);
533 static NTSTATUS idmap_script_sids_to_unixids(struct idmap_domain *dom,
536 struct idmap_script_context *ctx = talloc_get_type_abort(
537 dom->private_data, struct idmap_script_context);
539 size_t i, num_ids, num_mapped;
541 DEBUG(10, ("%s called ...\n", __func__));
542 /* Init status to avoid surprise ... */
543 for (i = 0; ids[i]; i++) {
544 ids[i]->status = ID_UNKNOWN;
548 ret = idmap_script_sids2xids(ids, num_ids, ctx->script);
550 DBG_DEBUG("idmap_script_sids2xids returned %s\n",
552 return map_nt_error_from_unix(ret);
557 for (i=0; i<num_ids; i++) {
558 struct id_map *map = ids[i];
560 if ((map->status == ID_MAPPED) &&
561 !idmap_unix_id_is_in_range(map->xid.id, dom)) {
562 DBG_INFO("Script returned id (%u) out of range "
563 "(%u - %u). Filtered!\n",
564 map->xid.id, dom->low_id, dom->high_id);
565 map->status = ID_UNMAPPED;
568 if (map->status == ID_MAPPED) {
573 if (num_mapped == 0) {
574 return NT_STATUS_NONE_MAPPED;
576 if (num_mapped < num_ids) {
577 return STATUS_SOME_UNMAPPED;
583 * Initialise idmap_script database.
585 static NTSTATUS idmap_script_db_init(struct idmap_domain *dom)
588 struct idmap_script_context *ctx;
589 const char * idmap_script = NULL;
590 const char *ctx_script = NULL;
592 DEBUG(10, ("%s called ...\n", __func__));
594 ctx = talloc_zero(dom, struct idmap_script_context);
596 DEBUG(0, ("Out of memory!\n"));
597 ret = NT_STATUS_NO_MEMORY;
601 ctx_script = idmap_config_const_string(dom->name, "script", NULL);
603 /* Do we even need to handle this? */
604 idmap_script = lp_parm_const_string(-1, "idmap", "script", NULL);
605 if (idmap_script != NULL) {
606 DEBUG(0, ("Warning: 'idmap:script' is deprecated. "
607 " Please use 'idmap config * : script' instead!\n"));
610 if (strequal(dom->name, "*") && ctx_script == NULL) {
611 /* fall back to idmap:script for backwards compatibility */
612 ctx_script = idmap_script;
616 DEBUG(1, ("using idmap script '%s'\n", ctx->script));
618 * We must ensure this memory is owned by ctx.
619 * The ctx_script const pointer is a pointer into
620 * the config file data and may become invalid
621 * on config file reload. BUG: 13956
623 ctx->script = talloc_strdup(ctx, ctx_script);
624 if (ctx->script == NULL) {
625 ret = NT_STATUS_NO_MEMORY;
630 dom->private_data = ctx;
631 dom->read_only = true; /* We do not allocate!*/
640 static const struct idmap_methods db_methods = {
641 .init = idmap_script_db_init,
642 .unixids_to_sids = idmap_script_unixids_to_sids,
643 .sids_to_unixids = idmap_script_sids_to_unixids,
647 NTSTATUS idmap_script_init(TALLOC_CTX *ctx)
649 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "script", &db_methods);