2 Unix SMB/CIFS implementation.
4 idmap script backend, used for Samba setups where you need to map SIDs to
7 Copyright (C) Richard Sharpe 2014.
9 This is heavily based upon idmap_tdb2.c, which is:
11 Copyright (C) Tim Potter 2000
12 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
13 Copyright (C) Jeremy Allison 2006
14 Copyright (C) Simo Sorce 2003-2006
15 Copyright (C) Michael Adam 2009-2010
17 This program is free software; you can redistribute it and/or modify
18 it under the terms of the GNU General Public License as published by
19 the Free Software Foundation; either version 2 of the License, or
20 (at your option) any later version.
22 This program is distributed in the hope that it will be useful,
23 but WITHOUT ANY WARRANTY; without even the implied warranty of
24 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25 GNU General Public License for more details.
27 You should have received a copy of the GNU General Public License
28 along with this program; if not, write to the Free Software
29 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
33 #include "system/filesys.h"
37 #include "../libcli/security/dom_sid.h"
38 #include "lib/util_file.h"
39 #include "lib/util/tevent_unix.h"
42 #define DBGC_CLASS DBGC_IDMAP
44 struct idmap_script_context {
45 const char *script; /* script to provide idmaps */
49 run a script to perform a mapping
51 The script should accept the following command lines:
53 SIDTOID S-1-xxxx -> XID:<id> | ERR:<str>
54 SIDTOID S-1-xxxx -> UID:<id> | ERR:<str>
55 SIDTOID S-1-xxxx -> GID:<id> | ERR:<str>
56 IDTOSID XID xxxx -> SID:<sid> | ERR:<str>
57 IDTOSID UID xxxx -> SID:<sid> | ERR:<str>
58 IDTOSID GID xxxx -> SID:<sid> | ERR:<str>
60 where XID means both a UID and a GID. This is the case for ID_TYPE_BOTH.
62 TODO: Needs more validation ... like that we got a UID when we asked for one.
65 struct idmap_script_xid2sid_state {
71 static void idmap_script_xid2sid_done(struct tevent_req *subreq);
73 static struct tevent_req *idmap_script_xid2sid_send(
74 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
75 struct unixid xid, const char *script, size_t idx)
77 struct tevent_req *req, *subreq;
78 struct idmap_script_xid2sid_state *state;
81 req = tevent_req_create(mem_ctx, &state,
82 struct idmap_script_xid2sid_state);
99 DBG_WARNING("INVALID unix ID type: 0x02%x\n", xid.type);
100 tevent_req_error(req, EINVAL);
101 return tevent_req_post(req, ev);
104 state->syscmd = talloc_asprintf(state, "%s IDTOSID %cID %lu", script, key,
105 (unsigned long)xid.id);
106 if (tevent_req_nomem(state->syscmd, req)) {
107 return tevent_req_post(req, ev);
110 subreq = file_pload_send(state, ev, state->syscmd, 1024);
111 if (tevent_req_nomem(subreq, req)) {
112 return tevent_req_post(req, ev);
114 tevent_req_set_callback(subreq, idmap_script_xid2sid_done, req);
118 static void idmap_script_xid2sid_done(struct tevent_req *subreq)
120 struct tevent_req *req = tevent_req_callback_data(
121 subreq, struct tevent_req);
122 struct idmap_script_xid2sid_state *state = tevent_req_data(
123 req, struct idmap_script_xid2sid_state);
126 ret = file_pload_recv(subreq, state, &state->out);
128 if (tevent_req_error(req, ret)) {
131 tevent_req_done(req);
134 static int idmap_script_xid2sid_recv(struct tevent_req *req, size_t *idx,
135 enum id_mapping *status,
138 struct idmap_script_xid2sid_state *state = tevent_req_data(
139 req, struct idmap_script_xid2sid_state);
140 char *out = (char *)state->out;
141 size_t out_size = talloc_get_size(out);
144 if (tevent_req_is_unix_error(req, &err)) {
151 if (state->out[out_size-1] != '\0') {
157 if ((strncmp(out, "SID:S-", 6) != 0) ||
158 !dom_sid_parse(out+4, sid)) {
159 DBG_WARNING("Bad sid from script: %s\n", out);
167 *sid = (struct dom_sid) {0};
168 *status = ID_UNMAPPED;
172 struct idmap_script_xids2sids_state {
178 static void idmap_script_xids2sids_done(struct tevent_req *subreq);
180 static struct tevent_req *idmap_script_xids2sids_send(
181 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
182 struct id_map **ids, size_t num_ids, const char *script)
184 struct tevent_req *req;
185 struct idmap_script_xids2sids_state *state;
188 req = tevent_req_create(mem_ctx, &state,
189 struct idmap_script_xids2sids_state);
194 state->num_ids = num_ids;
196 if (state->num_ids == 0) {
197 tevent_req_done(req);
198 return tevent_req_post(req, ev);
201 for (i=0; i<num_ids; i++) {
202 struct tevent_req *subreq;
204 subreq = idmap_script_xid2sid_send(
205 state, ev, ids[i]->xid, script, i);
206 if (tevent_req_nomem(subreq, req)) {
207 return tevent_req_post(req, ev);
209 tevent_req_set_callback(subreq, idmap_script_xids2sids_done,
216 static void idmap_script_xids2sids_done(struct tevent_req *subreq)
218 struct tevent_req *req = tevent_req_callback_data(
219 subreq, struct tevent_req);
220 struct idmap_script_xids2sids_state *state = tevent_req_data(
221 req, struct idmap_script_xids2sids_state);
223 enum id_mapping status = ID_UNKNOWN;
224 struct dom_sid sid = {0};
227 ret = idmap_script_xid2sid_recv(subreq, &idx, &status, &sid);
229 if (tevent_req_error(req, ret)) {
233 if (idx >= state->num_ids) {
234 tevent_req_error(req, EINVAL);
238 state->ids[idx]->status = status;
240 state->ids[idx]->sid = dom_sid_dup(state->ids, &sid);
241 if (tevent_req_nomem(state->ids[idx]->sid, req)) {
245 state->num_done += 1;
247 if (state->num_done >= state->num_ids) {
248 tevent_req_done(req);
252 static int idmap_script_xids2sids_recv(struct tevent_req *req)
254 return tevent_req_simple_recv_unix(req);
257 static int idmap_script_xids2sids(struct id_map **ids, size_t num_ids,
260 TALLOC_CTX *frame = talloc_stackframe();
261 struct tevent_context *ev;
262 struct tevent_req *req;
265 ev = samba_tevent_context_init(frame);
269 req = idmap_script_xids2sids_send(frame, ev, ids, num_ids, script);
273 if (!tevent_req_poll(req, ev)) {
277 ret = idmap_script_xids2sids_recv(req);
283 static NTSTATUS idmap_script_unixids_to_sids(struct idmap_domain *dom,
286 struct idmap_script_context *ctx = talloc_get_type_abort(
287 dom->private_data, struct idmap_script_context);
289 size_t i, num_ids, num_mapped;
291 DEBUG(10, ("%s called ...\n", __func__));
292 /* Init status to avoid surprise ... */
293 for (i = 0; ids[i]; i++) {
294 ids[i]->status = ID_UNKNOWN;
298 ret = idmap_script_xids2sids(ids, num_ids, ctx->script);
300 DBG_DEBUG("idmap_script_xids2sids returned %s\n",
302 return map_nt_error_from_unix(ret);
307 for (i = 0; ids[i]; i++) {
308 if (ids[i]->status == ID_MAPPED) {
313 if (num_mapped == 0) {
314 return NT_STATUS_NONE_MAPPED;
316 if (num_mapped < num_ids) {
317 return STATUS_SOME_UNMAPPED;
322 struct idmap_script_sid2xid_state {
328 static void idmap_script_sid2xid_done(struct tevent_req *subreq);
330 static struct tevent_req *idmap_script_sid2xid_send(
331 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
332 const struct dom_sid *sid, const char *script, size_t idx)
334 struct tevent_req *req, *subreq;
335 struct idmap_script_sid2xid_state *state;
336 char sidbuf[DOM_SID_STR_BUFLEN];
338 req = tevent_req_create(mem_ctx, &state,
339 struct idmap_script_sid2xid_state);
345 dom_sid_string_buf(sid, sidbuf, sizeof(sidbuf));
347 state->syscmd = talloc_asprintf(state, "%s SIDTOID %s",
349 if (tevent_req_nomem(state->syscmd, req)) {
350 return tevent_req_post(req, ev);
353 subreq = file_pload_send(state, ev, state->syscmd, 1024);
354 if (tevent_req_nomem(subreq, req)) {
355 return tevent_req_post(req, ev);
357 tevent_req_set_callback(subreq, idmap_script_sid2xid_done, req);
361 static void idmap_script_sid2xid_done(struct tevent_req *subreq)
363 struct tevent_req *req = tevent_req_callback_data(
364 subreq, struct tevent_req);
365 struct idmap_script_sid2xid_state *state = tevent_req_data(
366 req, struct idmap_script_sid2xid_state);
369 ret = file_pload_recv(subreq, state, &state->out);
371 if (tevent_req_error(req, ret)) {
374 tevent_req_done(req);
377 static int idmap_script_sid2xid_recv(struct tevent_req *req,
378 size_t *idx, enum id_mapping *status,
381 struct idmap_script_sid2xid_state *state = tevent_req_data(
382 req, struct idmap_script_sid2xid_state);
383 char *out = (char *)state->out;
384 size_t out_size = talloc_get_size(out);
388 if (tevent_req_is_unix_error(req, &err)) {
395 if (state->out[out_size-1] != '\0') {
401 if (sscanf(out, "XID:%lu\n", &v) == 1) {
402 *xid = (struct unixid) { .id = v, .type = ID_TYPE_BOTH };
403 } else if (sscanf(out, "UID:%lu\n", &v) == 1) {
404 *xid = (struct unixid) { .id = v, .type = ID_TYPE_UID };
405 } else if (sscanf(out, "GID:%lu\n", &v) == 1) {
406 *xid = (struct unixid) { .id = v, .type = ID_TYPE_GID };
415 *xid = (struct unixid) { .id = UINT32_MAX,
416 .type = ID_TYPE_NOT_SPECIFIED };
417 *status = ID_UNMAPPED;
421 struct idmap_script_sids2xids_state {
427 static void idmap_script_sids2xids_done(struct tevent_req *subreq);
429 static struct tevent_req *idmap_script_sids2xids_send(
430 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
431 struct id_map **ids, size_t num_ids, const char *script)
433 struct tevent_req *req;
434 struct idmap_script_sids2xids_state *state;
437 req = tevent_req_create(mem_ctx, &state,
438 struct idmap_script_sids2xids_state);
443 state->num_ids = num_ids;
445 if (state->num_ids == 0) {
446 tevent_req_done(req);
447 return tevent_req_post(req, ev);
450 for (i=0; i<num_ids; i++) {
451 struct tevent_req *subreq;
453 subreq = idmap_script_sid2xid_send(
454 state, ev, ids[i]->sid, script, i);
455 if (tevent_req_nomem(subreq, req)) {
456 return tevent_req_post(req, ev);
458 tevent_req_set_callback(subreq, idmap_script_sids2xids_done,
465 static void idmap_script_sids2xids_done(struct tevent_req *subreq)
467 struct tevent_req *req = tevent_req_callback_data(
468 subreq, struct tevent_req);
469 struct idmap_script_sids2xids_state *state = tevent_req_data(
470 req, struct idmap_script_sids2xids_state);
472 enum id_mapping status = ID_UNKNOWN;
473 struct unixid xid = { .id = UINT32_MAX,
474 .type = ID_TYPE_NOT_SPECIFIED };
477 ret = idmap_script_sid2xid_recv(subreq, &idx, &status, &xid);
479 if (tevent_req_error(req, ret)) {
483 if (idx >= state->num_ids) {
484 tevent_req_error(req, EINVAL);
488 state->ids[idx]->status = status;
489 state->ids[idx]->xid = xid;
491 state->num_done += 1;
493 if (state->num_done >= state->num_ids) {
494 tevent_req_done(req);
498 static int idmap_script_sids2xids_recv(struct tevent_req *req)
500 return tevent_req_simple_recv_unix(req);
503 static int idmap_script_sids2xids(struct id_map **ids, size_t num_ids,
506 TALLOC_CTX *frame = talloc_stackframe();
507 struct tevent_context *ev;
508 struct tevent_req *req;
511 ev = samba_tevent_context_init(frame);
515 req = idmap_script_sids2xids_send(frame, ev, ids, num_ids, script);
519 if (!tevent_req_poll(req, ev)) {
523 ret = idmap_script_sids2xids_recv(req);
529 static NTSTATUS idmap_script_sids_to_unixids(struct idmap_domain *dom,
532 struct idmap_script_context *ctx = talloc_get_type_abort(
533 dom->private_data, struct idmap_script_context);
535 size_t i, num_ids, num_mapped;
537 DEBUG(10, ("%s called ...\n", __func__));
538 /* Init status to avoid surprise ... */
539 for (i = 0; ids[i]; i++) {
540 ids[i]->status = ID_UNKNOWN;
544 ret = idmap_script_sids2xids(ids, num_ids, ctx->script);
546 DBG_DEBUG("idmap_script_sids2xids returned %s\n",
548 return map_nt_error_from_unix(ret);
553 for (i=0; i<num_ids; i++) {
554 struct id_map *map = ids[i];
556 if ((map->status == ID_MAPPED) &&
557 !idmap_unix_id_is_in_range(map->xid.id, dom)) {
558 DBG_INFO("Script returned id (%u) out of range "
559 "(%u - %u). Filtered!\n",
560 map->xid.id, dom->low_id, dom->high_id);
561 map->status = ID_UNMAPPED;
564 if (map->status == ID_MAPPED) {
569 if (num_mapped == 0) {
570 return NT_STATUS_NONE_MAPPED;
572 if (num_mapped < num_ids) {
573 return STATUS_SOME_UNMAPPED;
579 * Initialise idmap_script database.
581 static NTSTATUS idmap_script_db_init(struct idmap_domain *dom)
584 struct idmap_script_context *ctx;
585 const char * idmap_script = NULL;
587 DEBUG(10, ("%s called ...\n", __func__));
589 ctx = talloc_zero(dom, struct idmap_script_context);
591 DEBUG(0, ("Out of memory!\n"));
592 ret = NT_STATUS_NO_MEMORY;
596 ctx->script = idmap_config_const_string(dom->name, "script", NULL);
598 /* Do we even need to handle this? */
599 idmap_script = lp_parm_const_string(-1, "idmap", "script", NULL);
600 if (idmap_script != NULL) {
601 DEBUG(0, ("Warning: 'idmap:script' is deprecated. "
602 " Please use 'idmap config * : script' instead!\n"));
605 if (strequal(dom->name, "*") && ctx->script == NULL) {
606 /* fall back to idmap:script for backwards compatibility */
607 ctx->script = idmap_script;
611 DEBUG(1, ("using idmap script '%s'\n", ctx->script));
614 dom->private_data = ctx;
615 dom->read_only = true; /* We do not allocate!*/
624 static struct idmap_methods db_methods = {
625 .init = idmap_script_db_init,
626 .unixids_to_sids = idmap_script_unixids_to_sids,
627 .sids_to_unixids = idmap_script_sids_to_unixids,
631 NTSTATUS idmap_script_init(void)
633 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "script", &db_methods);