2 Unix SMB/CIFS implementation.
7 Copyright (C) Simo Sorce 2006
8 Copyright (C) Rafal Szczesniak 2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
27 #define TIMEOUT_LEN 12
28 #define IDMAP_CACHE_DATA_FMT "%12u/%s"
29 #define IDMAP_READ_CACHE_DATA_FMT_TEMPLATE "%%12u/%%%us"
31 struct idmap_cache_ctx {
35 static int idmap_cache_destructor(struct idmap_cache_ctx *cache)
39 if (cache && cache->tdb) {
40 ret = tdb_close(cache->tdb);
47 struct idmap_cache_ctx *idmap_cache_init(TALLOC_CTX *memctx)
49 struct idmap_cache_ctx *cache;
50 char* cache_fname = NULL;
52 cache = talloc(memctx, struct idmap_cache_ctx);
54 DEBUG(0, ("Out of memory!\n"));
58 cache_fname = lock_path("idmap_cache.tdb");
60 DEBUG(10, ("Opening cache file at %s\n", cache_fname));
62 cache->tdb = tdb_open_log(cache_fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
65 DEBUG(5, ("Attempt to open %s has failed.\n", cache_fname));
69 talloc_set_destructor(cache, idmap_cache_destructor);
74 void idmap_cache_shutdown(struct idmap_cache_ctx *cache)
79 NTSTATUS idmap_cache_build_sidkey(TALLOC_CTX *ctx, char **sidkey, const struct id_map *id)
81 *sidkey = talloc_asprintf(ctx, "IDMAP/SID/%s", sid_string_static(id->sid));
83 DEBUG(1, ("failed to build sidkey, OOM?\n"));
84 return NT_STATUS_NO_MEMORY;
90 NTSTATUS idmap_cache_build_idkey(TALLOC_CTX *ctx, char **idkey, const struct id_map *id)
92 *idkey = talloc_asprintf(ctx, "IDMAP/%s/%lu",
93 (id->xid.type==ID_TYPE_UID)?"UID":"GID",
94 (unsigned long)id->xid.id);
96 DEBUG(1, ("failed to build idkey, OOM?\n"));
97 return NT_STATUS_NO_MEMORY;
103 NTSTATUS idmap_cache_set(struct idmap_cache_ctx *cache, const struct id_map *id)
106 time_t timeout = time(NULL) + lp_idmap_cache_time();
112 /* Don't cache lookups in the S-1-22-{1,2} domain */
113 if ( (id->xid.type == ID_TYPE_UID) &&
114 sid_check_is_in_unix_users(id->sid) )
118 if ( (id->xid.type == ID_TYPE_GID) &&
119 sid_check_is_in_unix_groups(id->sid) )
125 ret = idmap_cache_build_sidkey(cache, &sidkey, id);
126 if (!NT_STATUS_IS_OK(ret)) return ret;
128 /* use sidkey as the local memory ctx */
129 ret = idmap_cache_build_idkey(sidkey, &idkey, id);
130 if (!NT_STATUS_IS_OK(ret)) {
136 /* use sidkey as the local memory ctx */
137 valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, idkey);
139 DEBUG(0, ("Out of memory!\n"));
140 ret = NT_STATUS_NO_MEMORY;
144 databuf = string_term_tdb_data(valstr);
145 DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
146 " %s (%d seconds %s)\n", sidkey, valstr , ctime(&timeout),
147 (int)(timeout - time(NULL)),
148 timeout > time(NULL) ? "ahead" : "in the past"));
150 if (tdb_store_bystring(cache->tdb, sidkey, databuf, TDB_REPLACE) != 0) {
151 DEBUG(3, ("Failed to store cache entry!\n"));
152 ret = NT_STATUS_UNSUCCESSFUL;
158 /* use sidkey as the local memory ctx */
159 valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, sidkey);
161 DEBUG(0, ("Out of memory!\n"));
162 ret = NT_STATUS_NO_MEMORY;
166 databuf = string_term_tdb_data(valstr);
167 DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
168 " %s (%d seconds %s)\n", idkey, valstr, ctime(&timeout),
169 (int)(timeout - time(NULL)),
170 timeout > time(NULL) ? "ahead" : "in the past"));
172 if (tdb_store_bystring(cache->tdb, idkey, databuf, TDB_REPLACE) != 0) {
173 DEBUG(3, ("Failed to store cache entry!\n"));
174 ret = NT_STATUS_UNSUCCESSFUL;
185 NTSTATUS idmap_cache_set_negative_sid(struct idmap_cache_ctx *cache, const struct id_map *id)
188 time_t timeout = time(NULL) + lp_idmap_negative_cache_time();
193 ret = idmap_cache_build_sidkey(cache, &sidkey, id);
194 if (!NT_STATUS_IS_OK(ret)) return ret;
196 /* use sidkey as the local memory ctx */
197 valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
199 DEBUG(0, ("Out of memory!\n"));
200 ret = NT_STATUS_NO_MEMORY;
204 databuf = string_term_tdb_data(valstr);
205 DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
206 " %s (%d seconds %s)\n", sidkey, valstr, ctime(&timeout),
207 (int)(timeout - time(NULL)),
208 timeout > time(NULL) ? "ahead" : "in the past"));
210 if (tdb_store_bystring(cache->tdb, sidkey, databuf, TDB_REPLACE) != 0) {
211 DEBUG(3, ("Failed to store cache entry!\n"));
212 ret = NT_STATUS_UNSUCCESSFUL;
221 NTSTATUS idmap_cache_set_negative_id(struct idmap_cache_ctx *cache, const struct id_map *id)
224 time_t timeout = time(NULL) + lp_idmap_negative_cache_time();
229 ret = idmap_cache_build_idkey(cache, &idkey, id);
230 if (!NT_STATUS_IS_OK(ret)) return ret;
232 /* use idkey as the local memory ctx */
233 valstr = talloc_asprintf(idkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
235 DEBUG(0, ("Out of memory!\n"));
236 ret = NT_STATUS_NO_MEMORY;
240 databuf = string_term_tdb_data(valstr);
241 DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
242 " %s (%d seconds %s)\n", idkey, valstr, ctime(&timeout),
243 (int)(timeout - time(NULL)),
244 timeout > time(NULL) ? "ahead" : "in the past"));
246 if (tdb_store_bystring(cache->tdb, idkey, databuf, TDB_REPLACE) != 0) {
247 DEBUG(3, ("Failed to store cache entry!\n"));
248 ret = NT_STATUS_UNSUCCESSFUL;
257 NTSTATUS idmap_cache_fill_map(struct id_map *id, const char *value)
261 /* see if it is a sid */
262 if ( ! strncmp("IDMAP/SID/", value, 10)) {
264 if ( ! string_to_sid(id->sid, &value[10])) {
268 id->status = ID_MAPPED;
273 /* not a SID see if it is an UID or a GID */
274 if ( ! strncmp("IDMAP/UID/", value, 10)) {
277 id->xid.type = ID_TYPE_UID;
279 } else if ( ! strncmp("IDMAP/GID/", value, 10)) {
282 id->xid.type = ID_TYPE_GID;
286 /* a completely bogus value bail out */
290 id->xid.id = strtol(&value[10], &rem, 0);
295 id->status = ID_MAPPED;
300 DEBUG(1, ("invalid value: %s\n", value));
301 id->status = ID_UNKNOWN;
302 return NT_STATUS_INTERNAL_DB_CORRUPTION;
305 BOOL idmap_cache_is_negative(const char *val)
307 if ( ! strcmp("IDMAP/NEGATIVE", val)) {
313 /* search the cahce for the SID an return a mapping if found *
315 * 4 cases are possible
318 * in this case id->status = ID_MAPPED and NT_STATUS_OK is returned
320 * in this case id->status = ID_UNKNOWN and NT_STATUS_NONE_MAPPED is returned
321 * 3 negative cache found
322 * in this case id->status = ID_UNMAPPED and NT_STATUS_OK is returned
323 * 4 map found but timer expired
324 * in this case id->status = ID_EXPIRED and NT_STATUS_SYNCHRONIZATION_REQUIRED
325 * is returned. In this case revalidation of the cache is needed.
328 NTSTATUS idmap_cache_map_sid(struct idmap_cache_ctx *cache, struct id_map *id)
335 struct winbindd_domain *our_domain = find_our_domain();
336 time_t now = time(NULL);
338 /* make sure it is marked as not mapped by default */
339 id->status = ID_UNKNOWN;
341 ret = idmap_cache_build_sidkey(cache, &sidkey, id);
342 if (!NT_STATUS_IS_OK(ret)) return ret;
344 databuf = tdb_fetch_bystring(cache->tdb, sidkey);
346 if (databuf.dptr == NULL) {
347 DEBUG(10, ("Cache entry with key = %s couldn't be found\n", sidkey));
348 return NT_STATUS_NONE_MAPPED;
351 t = strtol((const char *)databuf.dptr, &endptr, 10);
353 if ((endptr == NULL) || (*endptr != '/')) {
354 DEBUG(2, ("Invalid gencache data format: %s\n", (const char *)databuf.dptr));
355 /* remove the entry */
356 tdb_delete_bystring(cache->tdb, sidkey);
357 ret = NT_STATUS_NONE_MAPPED;
361 /* check it is not negative */
362 if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
364 DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
365 "timeout = %s", t > now ? "valid" :
366 "expired", sidkey, endptr+1, ctime(&t)));
368 /* this call if successful will also mark the entry as mapped */
369 ret = idmap_cache_fill_map(id, endptr+1);
370 if ( ! NT_STATUS_IS_OK(ret)) {
371 /* if not valid form delete the entry */
372 tdb_delete_bystring(cache->tdb, sidkey);
373 ret = NT_STATUS_NONE_MAPPED;
377 /* here ret == NT_STATUS_OK and id->status = ID_MAPPED */
380 /* If we've been told to be offline - stay in
382 if ( IS_DOMAIN_OFFLINE(our_domain) ) {
383 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
387 /* We're expired, set an error code
389 ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
395 /* Was a negative cache hit */
397 /* Ignore the negative cache when offline */
399 if ( IS_DOMAIN_OFFLINE(our_domain) ) {
400 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
405 /* Check for valid or expired cache hits */
407 /* We're expired. Return not mapped */
408 ret = NT_STATUS_NONE_MAPPED;
410 /* this is not mapped as it was a negative cache hit */
411 id->status = ID_UNMAPPED;
416 SAFE_FREE(databuf.dptr);
421 /* search the cahce for the ID an return a mapping if found *
423 * 4 cases are possible
426 * in this case id->status = ID_MAPPED and NT_STATUS_OK is returned
428 * in this case id->status = ID_UNKNOWN and NT_STATUS_NONE_MAPPED is returned
429 * 3 negative cache found
430 * in this case id->status = ID_UNMAPPED and NT_STATUS_OK is returned
431 * 4 map found but timer expired
432 * in this case id->status = ID_EXPIRED and NT_STATUS_SYNCHRONIZATION_REQUIRED
433 * is returned. In this case revalidation of the cache is needed.
436 NTSTATUS idmap_cache_map_id(struct idmap_cache_ctx *cache, struct id_map *id)
443 struct winbindd_domain *our_domain = find_our_domain();
444 time_t now = time(NULL);
446 /* make sure it is marked as unknown by default */
447 id->status = ID_UNKNOWN;
449 ret = idmap_cache_build_idkey(cache, &idkey, id);
450 if (!NT_STATUS_IS_OK(ret)) return ret;
452 databuf = tdb_fetch_bystring(cache->tdb, idkey);
454 if (databuf.dptr == NULL) {
455 DEBUG(10, ("Cache entry with key = %s couldn't be found\n", idkey));
456 return NT_STATUS_NONE_MAPPED;
459 t = strtol((const char *)databuf.dptr, &endptr, 10);
461 if ((endptr == NULL) || (*endptr != '/')) {
462 DEBUG(2, ("Invalid gencache data format: %s\n", (const char *)databuf.dptr));
463 /* remove the entry */
464 tdb_delete_bystring(cache->tdb, idkey);
465 ret = NT_STATUS_NONE_MAPPED;
469 /* check it is not negative */
470 if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
472 DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
473 "timeout = %s", t > now ? "valid" :
474 "expired", idkey, endptr+1, ctime(&t)));
476 /* this call if successful will also mark the entry as mapped */
477 ret = idmap_cache_fill_map(id, endptr+1);
478 if ( ! NT_STATUS_IS_OK(ret)) {
479 /* if not valid form delete the entry */
480 tdb_delete_bystring(cache->tdb, idkey);
481 ret = NT_STATUS_NONE_MAPPED;
485 /* here ret == NT_STATUS_OK and id->mapped = ID_MAPPED */
488 /* If we've been told to be offline - stay in
490 if ( IS_DOMAIN_OFFLINE(our_domain) ) {
491 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
495 /* We're expired, set an error code
497 ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
503 /* Was a negative cache hit */
505 /* Ignore the negative cache when offline */
507 if ( IS_DOMAIN_OFFLINE(our_domain) ) {
508 DEBUG(10,("idmap_cache_map_sid: idmap is offline\n"));
509 ret = NT_STATUS_NONE_MAPPED;
514 /* Process the negative cache hit */
517 /* We're expired. Return not mapped */
518 ret = NT_STATUS_NONE_MAPPED;
520 /* this is not mapped is it was a negative cache hit */
521 id->status = ID_UNMAPPED;
526 SAFE_FREE(databuf.dptr);