This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
struct idmap_cache_ctx;
+struct idmap_alloc_context {
+ const char *params;
+ struct idmap_alloc_methods *methods;
+ BOOL initialized;
+};
+
static TALLOC_CTX *idmap_ctx = NULL;
static struct idmap_cache_ctx *idmap_cache;
static int def_dom_num = -1;
static struct idmap_alloc_backend *alloc_backends = NULL;
-static struct idmap_alloc_methods *alloc_methods = NULL;
+static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
#define IDMAP_CHECK_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); goto done; } } while(0)
+#define IDMAP_REPORT_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); } } while(0)
#define IDMAP_CHECK_ALLOC(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while(0)
static struct idmap_methods *get_methods(struct idmap_backend *be, const char *name)
return NULL;
}
+BOOL idmap_is_offline(void)
+{
+ return ( lp_winbind_offline_logon() &&
+ get_global_winbindd_state_offline() );
+}
+
/**********************************************************************
Allow a module to register itself as a method.
**********************************************************************/
NTSTATUS idmap_close(void)
{
/* close the alloc backend first before freeing idmap_ctx */
- if (alloc_methods) {
- alloc_methods->close_fn();
- alloc_methods = NULL;
+ if (idmap_alloc_ctx) {
+ idmap_alloc_ctx->methods->close_fn();
+ idmap_alloc_ctx->methods = NULL;
}
alloc_backends = NULL;
static const char *idmap_default_domain[] = { "default domain", NULL };
+/****************************************************************************
+ ****************************************************************************/
+
+NTSTATUS idmap_init_cache(void)
+{
+ /* Always initialize the cache. We'll have to delay initialization
+ of backends if we are offline */
+
+ if ( idmap_ctx ) {
+ return NT_STATUS_OK;
+ }
+
+ if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/****************************************************************************
+ ****************************************************************************/
+
NTSTATUS idmap_init(void)
{
NTSTATUS ret;
+ static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
struct idmap_domain *dom;
char *compat_backend = NULL;
char *compat_params = NULL;
const char **dom_list = NULL;
- char *alloc_backend;
+ char *alloc_backend = NULL;
BOOL default_already_defined = False;
BOOL pri_dom_is_in_list = False;
int compat = 0;
int i;
- if (idmap_ctx) {
- return NT_STATUS_OK;
- }
+ ret = idmap_init_cache();
+ if ( !NT_STATUS_IS_OK(ret) )
+ return ret;
- if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
- return NT_STATUS_NO_MEMORY;
+ if (NT_STATUS_IS_OK(idmap_init_status)) {
+ return NT_STATUS_OK;
}
+
+ /* We can't reliably call intialization code here unless
+ we are online. But return NT_STATUS_OK so the upper
+ level code doesn't abort idmap lookups. */
- if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
- return NT_STATUS_UNSUCCESSFUL;
+ if ( get_global_winbindd_state_offline() ) {
+ idmap_init_status = NT_STATUS_FILE_IS_OFFLINE;
+ return NT_STATUS_OK;
}
static_init_idmap;
dom_list = lp_idmap_domains();
- if ( dom_list && lp_idmap_backend() ) {
- DEBUG(0, ("WARNING: idmap backend and idmap domains are "
- "mutually excusive!\n"));
- DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
- } else if ( lp_idmap_backend() ) {
- const char **compat_list = lp_idmap_backend();
+ if ( lp_idmap_backend() ) {
+ const char **compat_list = lp_idmap_backend();
char *p = NULL;
const char *q = NULL;
- DEBUG(0, ("WARNING: idmap backend is deprecated!\n"));
- compat = 1;
+ if ( dom_list ) {
+ DEBUG(0, ("WARNING: idmap backend and idmap domains are "
+ "mutually exclusive!\n"));
+ DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
+ } else {
+ compat = 1;
- if ( (compat_backend = talloc_strdup( idmap_ctx, *compat_list )) == NULL ) {
- ret = NT_STATUS_NO_MEMORY;
- goto done;
- }
+ if ( (compat_backend = talloc_strdup( idmap_ctx, *compat_list )) == NULL ) {
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
- /* strip any leading idmap_ prefix of */
- if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
- q = *compat_list += 6;
- DEBUG(0, ("WARNING: idmap backend uses obsolete and "
- "deprecated 'idmap_' prefix.\n"
- "Please replace 'idmap_%s' by '%s' in %s\n",
- q, q, dyn_CONFIGFILE));
- compat_backend = talloc_strdup( idmap_ctx, q);
- } else {
- compat_backend = talloc_strdup( idmap_ctx, *compat_list);
- }
+ /* strip any leading idmap_ prefix of */
+ if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
+ q = *compat_list += 6;
+ DEBUG(0, ("WARNING: idmap backend uses obsolete and "
+ "deprecated 'idmap_' prefix.\n"
+ "Please replace 'idmap_%s' by '%s' in %s\n",
+ q, q, dyn_CONFIGFILE));
+ compat_backend = talloc_strdup( idmap_ctx, q);
+ } else {
+ compat_backend = talloc_strdup( idmap_ctx, *compat_list);
+ }
- /* separate the backend and module arguements */
- if ((p = strchr(compat_backend, ':')) != NULL) {
- *p = '\0';
- compat_params = p + 1;
- }
+ /* separate the backend and module arguements */
+ if ((p = strchr(compat_backend, ':')) != NULL) {
+ *p = '\0';
+ compat_params = p + 1;
+ }
+ }
+ } else if ( !dom_list ) {
+ /* Back compatible: without idmap domains and explicit
+ idmap backend. Taking default idmap backend: tdb */
+
+ compat = 1;
+ compat_backend = talloc_strdup( idmap_ctx, "tdb");
+ compat_params = compat_backend;
}
if ( ! dom_list) {
const char *parm_backend;
char *config_option;
+ /* ignore BUILTIN and local MACHINE domains */
+ if ( strequal(dom_list[i], "BUILTIN")
+ || strequal(dom_list[i], get_global_sam_name() ) )
+ {
+ DEBUG(0,("idmap_init: Ignoring invalid domain %s\n",
+ dom_list[i]));
+ continue;
+ }
+
if (strequal(dom_list[i], lp_workgroup())) {
pri_dom_is_in_list = True;
}
/* init domain */
- dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
IDMAP_CHECK_ALLOC(dom);
dom->name = talloc_strdup(dom, dom_list[i]);
/* check the set_mapping function exists otherwise mark the module as readonly */
if ( ! dom->methods->set_mapping) {
+ DEBUG(5, ("Forcing to readonly, as this module can't store arbitrary mappings.\n"));
dom->readonly = True;
}
/* now that we have methods, set the destructor for this domain */
talloc_set_destructor(dom, close_domain_destructor);
+ if (compat_params) {
+ dom->params = talloc_strdup(dom, compat_params);
+ IDMAP_CHECK_ALLOC(dom->params);
+ } else {
+ dom->params = NULL;
+ }
+
/* Finally instance a backend copy for this domain */
- ret = dom->methods->init(dom, compat_params);
+ ret = dom->methods->init(dom);
if ( ! NT_STATUS_IS_OK(ret)) {
- DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s)\n",
+ DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s), deferred!\n",
parm_backend, dom->name));
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
}
idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, i+1);
if ( ! idmap_domains) {
( ! pri_dom_is_in_list) &&
lp_winbind_trusted_domains_only()) {
- dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
IDMAP_CHECK_ALLOC(dom);
dom->name = talloc_strdup(dom, lp_workgroup());
/* now that we have methods, set the destructor for this domain */
talloc_set_destructor(dom, close_domain_destructor);
+ if (compat_params) {
+ dom->params = talloc_strdup(dom, compat_params);
+ IDMAP_CHECK_ALLOC(dom->params);
+ } else {
+ dom->params = NULL;
+ }
+
/* Finally instance a backend copy for this domain */
- ret = dom->methods->init(dom, compat_params);
+ ret = dom->methods->init(dom);
if ( ! NT_STATUS_IS_OK(ret)) {
DEBUG(0, ("ERROR: Initialization failed for idmap_nss ?!\n"));
ret = NT_STATUS_UNSUCCESSFUL;
}
/**** automatically add idmap_passdb backend ****/
- dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
IDMAP_CHECK_ALLOC(dom);
dom->name = talloc_strdup(dom, get_global_sam_name());
/* now that we have methods, set the destructor for this domain */
talloc_set_destructor(dom, close_domain_destructor);
+ if (compat_params) {
+ dom->params = talloc_strdup(dom, compat_params);
+ IDMAP_CHECK_ALLOC(dom->params);
+ } else {
+ dom->params = NULL;
+ }
+
/* Finally instance a backend copy for this domain */
- ret = dom->methods->init(dom, compat_params);
+ ret = dom->methods->init(dom);
if ( ! NT_STATUS_IS_OK(ret)) {
DEBUG(0, ("ERROR: Initialization failed for idmap_passdb ?!\n"));
ret = NT_STATUS_UNSUCCESSFUL;
}
- /***************************
- * initialize alloc module
- */
- DEBUG(1, ("Initializing idmap alloc module\n"));
+ /* Initialize alloc module */
+ DEBUG(3, ("Initializing idmap alloc module\n"));
+
+ alloc_backend = NULL;
if (compat) {
alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
} else {
if (ab && (ab[0] != '\0')) {
alloc_backend = talloc_strdup(idmap_ctx, lp_idmap_alloc_backend());
- } else {
- alloc_backend = talloc_strdup(idmap_ctx, "tdb");
}
}
- IDMAP_CHECK_ALLOC(alloc_backend);
- alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
- if ( ! alloc_methods) {
- ret = smb_probe_module("idmap", alloc_backend);
- if (NT_STATUS_IS_OK(ret)) {
- alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
+ if ( alloc_backend ) {
+
+ idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx, struct idmap_alloc_context);
+ IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
+
+ idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends, alloc_backend);
+ if ( ! idmap_alloc_ctx->methods) {
+ ret = smb_probe_module("idmap", alloc_backend);
+ if (NT_STATUS_IS_OK(ret)) {
+ idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends, alloc_backend);
+ }
}
- }
- if ( ! alloc_methods) {
- DEBUG(0, ("ERROR: Could not get methods for alloc backend %s\n", alloc_backend));
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
- }
+ if (idmap_alloc_ctx->methods) {
- ret = alloc_methods->init(compat_params);
- if ( ! NT_STATUS_IS_OK(ret)) {
- DEBUG(0, ("ERROR: Initialization failed for alloc backend %s\n", alloc_backend));
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
- }
+ if (compat_params) {
+ idmap_alloc_ctx->params = talloc_strdup(idmap_alloc_ctx, compat_params);
+ IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
+ } else {
+ idmap_alloc_ctx->params = NULL;
+ }
+ ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for alloc "
+ "backend %s, deferred!\n", alloc_backend));
+ } else {
+ idmap_alloc_ctx->initialized = True;
+ }
+ } else {
+ DEBUG(2, ("idmap_init: Unable to get methods for alloc backend %s\n",
+ alloc_backend));
+ /* certain compat backends are just readonly */
+ if ( compat ) {
+ TALLOC_FREE(idmap_alloc_ctx);
+ ret = NT_STATUS_OK;
+ } else {
+ ret = NT_STATUS_UNSUCCESSFUL;
+ }
+ }
+ }
+
/* cleanpu temporary strings */
TALLOC_FREE( compat_backend );
+
+ idmap_init_status = NT_STATUS_OK;
- return NT_STATUS_OK;
+ return ret;
done:
DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
idmap_close();
+
return ret;
}
+static NTSTATUS idmap_alloc_init(void)
+{
+ NTSTATUS ret;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ if ( ! idmap_alloc_ctx) {
+ return NT_STATUS_NOT_SUPPORTED;
+ }
+
+ if ( ! idmap_alloc_ctx->initialized) {
+ ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for alloc "
+ "backend, deferred!\n"));
+ return ret;
+ } else {
+ idmap_alloc_ctx->initialized = True;
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
/**************************************************************************
idmap allocator interface functions
**************************************************************************/
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_UID;
- return alloc_methods->allocate_id(id);
+ return idmap_alloc_ctx->methods->allocate_id(id);
}
NTSTATUS idmap_allocate_gid(struct unixid *id)
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_GID;
- return alloc_methods->allocate_id(id);
+ return idmap_alloc_ctx->methods->allocate_id(id);
}
NTSTATUS idmap_set_uid_hwm(struct unixid *id)
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_UID;
- return alloc_methods->set_id_hwm(id);
+ return idmap_alloc_ctx->methods->set_id_hwm(id);
}
NTSTATUS idmap_set_gid_hwm(struct unixid *id)
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_GID;
- return alloc_methods->set_id_hwm(id);
+ return idmap_alloc_ctx->methods->set_id_hwm(id);
}
/******************************************************************************
if ( (pdb_dom_num != -1) &&
(sid_check_is_in_builtin(account_sid) ||
- sid_check_is_in_wellknown_domain(account_sid)) )
+ sid_check_is_in_wellknown_domain(account_sid) ||
+ sid_check_is_in_unix_groups(account_sid) ||
+ sid_check_is_in_unix_users(account_sid)) )
{
return idmap_domains[pdb_dom_num];
}
/* Check we do not create mappings for our own local domain, or BUILTIN or special SIDs */
if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
sid_check_is_in_builtin(map->sid) ||
- sid_check_is_in_wellknown_domain(map->sid)) {
+ sid_check_is_in_wellknown_domain(map->sid) ||
+ sid_check_is_in_unix_users(map->sid) ||
+ sid_check_is_in_unix_groups(map->sid) )
+ {
DEBUG(10, ("We are not supposed to create mappings for our own domains (local, builtin, specials)\n"));
return NT_STATUS_UNSUCCESSFUL;
}
{
NTSTATUS ret;
struct idmap_domain *dom;
- const char *domname, *name;
- enum lsa_SidType sid_type;
- BOOL wbret;
+
+ /* If we are offline we cannot lookup SIDs, deny mapping */
+ if (idmap_is_offline()) {
+ return NT_STATUS_FILE_IS_OFFLINE;
+ }
ret = idmap_can_map(map, &dom);
if ( ! NT_STATUS_IS_OK(ret)) {
return NT_STATUS_NONE_MAPPED;
}
-
- /* by default calls to winbindd are disabled
- the following call will not recurse so this is safe */
- winbind_on();
- wbret = winbind_lookup_sid(ctx, map->sid, &domname, &name, &sid_type);
- winbind_off();
/* check if this is a valid SID and then map it */
- if (wbret) {
- switch (sid_type) {
- case SID_NAME_USER:
- ret = idmap_allocate_uid(&map->xid);
- if ( ! NT_STATUS_IS_OK(ret)) {
- /* can't allocate id, let's just leave it unmapped */
- DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
- return NT_STATUS_NONE_MAPPED;
- }
- break;
- case SID_NAME_DOM_GRP:
- case SID_NAME_ALIAS:
- case SID_NAME_WKN_GRP:
- ret = idmap_allocate_gid(&map->xid);
- if ( ! NT_STATUS_IS_OK(ret)) {
- /* can't allocate id, let's just leave it unmapped */
- DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
- return NT_STATUS_NONE_MAPPED;
- }
- break;
- default:
- /* invalid sid, let's just leave it unmapped */
- DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid)));
+ switch (map->xid.type) {
+ case ID_TYPE_UID:
+ ret = idmap_allocate_uid(&map->xid);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* can't allocate id, let's just leave it unmapped */
+ DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ break;
+ case ID_TYPE_GID:
+ ret = idmap_allocate_gid(&map->xid);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* can't allocate id, let's just leave it unmapped */
+ DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
return NT_STATUS_NONE_MAPPED;
}
+ break;
+ default:
+ /* invalid sid, let's just leave it unmapped */
+ DEBUG(3,("idmap_new_mapping: Refusing to create a "
+ "mapping for an unspecified ID type.\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
- /* ok, got a new id, let's set a mapping */
- map->status = ID_MAPPED;
+ /* ok, got a new id, let's set a mapping */
+ map->status = ID_MAPPED;
- DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
- sid_string_static(map->sid),
- (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
- (unsigned long)map->xid.id));
- ret = dom->methods->set_mapping(dom, map);
+ DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
+ sid_string_static(map->sid),
+ (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
+ (unsigned long)map->xid.id));
+ ret = dom->methods->set_mapping(dom, map);
- if ( ! NT_STATUS_IS_OK(ret)) {
- /* something wrong here :-( */
- DEBUG(2, ("Failed to commit mapping\n!"));
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* something wrong here :-( */
+ DEBUG(2, ("Failed to commit mapping\n!"));
- /* TODO: would it make sense to have an "unalloc_id function?" */
+ /* TODO: would it make sense to have an "unalloc_id function?" */
- return NT_STATUS_NONE_MAPPED;
- }
- } else {
- DEBUG(2,("Invalid SID, not mapping %s (type %d)\n",
- sid_string_static(map->sid), sid_type));
return NT_STATUS_NONE_MAPPED;
}
_ids = ids;
- /* make sure all maps are marked as in UNKNOWN status */
- for (i = 0; _ids[i]; i++) {
- _ids[i]->status = ID_UNKNOWN;
- }
-
unmapped = NULL;
for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
DEBUG(10, ("Query sids from domain %s\n", dom->name));
ret = dom->methods->unixids_to_sids(dom, _ids);
- IDMAP_CHECK_RET(ret);
+ IDMAP_REPORT_RET(ret);
unmapped = NULL;
for (i = 0, u = 0; _ids[i]; i++) {
- if (_ids[i]->status == ID_UNKNOWN || _ids[i]->status == ID_UNMAPPED) {
+ if (_ids[i]->status != ID_MAPPED) {
unmapped = talloc_realloc(ctx, unmapped, struct id_map *, u + 2);
IDMAP_CHECK_ALLOC(unmapped);
unmapped[u] = _ids[i];
if (unmapped) {
/* there are still unmapped ids, map them to the unix users/groups domains */
+ /* except for expired entries, these will be returned as valid (offline mode) */
for (i = 0; unmapped[i]; i++) {
+ if (unmapped[i]->status == ID_EXPIRED) continue;
switch (unmapped[i]->xid.type) {
case ID_TYPE_UID:
uid_to_unix_users_sid((uid_t)unmapped[i]->xid.id, unmapped[i]->sid);
DEBUG(10, ("Query backends to map sids->ids\n"));
/* split list per domain */
+ if (num_domains == 0) {
+ DEBUG(1, ("No domains available?\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
- dom_ids = talloc_zero_array(ctx, struct id_map **, num_domains);
+ dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
IDMAP_CHECK_ALLOC(dom_ids);
- counters = talloc_zero_array(ctx, int, num_domains);
+ counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
+ IDMAP_CHECK_ALLOC(counters);
/* partition the requests by domain */
for (i = 0; ids[i]; i++) {
uint32 idx;
- /* make sure they are unknown to start off */
- ids[i]->status = ID_UNKNOWN;
-
if ( (dom = find_idmap_domain_from_sid( ids[i]->sid )) == NULL ) {
- /* no vailable idmap_domain. Move on */
+ /* no available idmap_domain. Move on */
continue;
}
dom = idmap_domains[i];
DEBUG(10, ("Query ids from domain %s\n", dom->name));
ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
- IDMAP_CHECK_RET(ret);
+ IDMAP_REPORT_RET(ret);
}
}
/* let's see if we have any unmapped SID left and act accordingly */
for (i = 0; ids[i]; i++) {
+ /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
+ * was not able to confirm/deny (offline mode) */
if (ids[i]->status == ID_UNKNOWN || ids[i]->status == ID_UNMAPPED) {
/* ok this is an unmapped one, see if we can map it */
ret = idmap_new_mapping(ctx, ids[i]);
/* could not map it */
ids[i]->status = ID_UNMAPPED;
} else {
- /* Something very bad happened down there */
+ /* Something very bad happened down there
+ * OR we are offline */
ids[i]->status = ID_UNKNOWN;
}
}
struct id_map **bids;
int i, bi;
int bn = 0;
+ struct winbindd_domain *our_domain = find_our_domain();
if (! NT_STATUS_IS_OK(ret = idmap_init())) {
return ret;
if ( ! bids) {
/* alloc space for ids to be resolved by backends (realloc ten by ten) */
- bids = talloc_array(ctx, struct id_map *, 10);
+ bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
if ( ! bids) {
DEBUG(1, ("Out of memory!\n"));
talloc_free(ctx);
/* let's see if there is any id mapping to be retieved from the backends */
if (bi) {
+ /* Only do query if we are online */
+ if ( IS_DOMAIN_OFFLINE(our_domain) ) {
+ ret = NT_STATUS_FILE_IS_OFFLINE;
+ goto done;
+ }
+
ret = idmap_backends_unixids_to_sids(bids);
IDMAP_CHECK_RET(ret);
for (i = 0; i < bi; i++) {
if (bids[i]->status == ID_MAPPED) {
ret = idmap_cache_set(idmap_cache, bids[i]);
+ } else if (bids[i]->status == ID_EXPIRED) {
+ /* the cache returned an expired entry and the backend was
+ * was not able to clear the situation (offline).
+ * This handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
+ * for disconnected mode, */
+ bids[i]->status = ID_MAPPED;
} else if (bids[i]->status == ID_UNKNOWN) {
- /* return an expired entry in the cache or an unknown */
- /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
- * for disconnected mode */
- idmap_cache_map_id(idmap_cache, ids[i]);
+ /* something bad here. We were not able to handle this for some
+ * reason, mark it as unmapped and hope next time things will
+ * settle down. */
+ bids[i]->status = ID_UNMAPPED;
} else { /* unmapped */
ret = idmap_cache_set_negative_id(idmap_cache, bids[i]);
}
struct id_map **bids;
int i, bi;
int bn = 0;
+ struct winbindd_domain *our_domain = find_our_domain();
if (! NT_STATUS_IS_OK(ret = idmap_init())) {
return ret;
if ( ! NT_STATUS_IS_OK(ret)) {
if ( ! bids) {
- /* alloc space for ids to be resolved by backends (realloc ten by ten) */
- bids = talloc_array(ctx, struct id_map *, 10);
+ /* alloc space for ids to be resolved
+ by backends (realloc ten by ten) */
+ bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
if ( ! bids) {
DEBUG(1, ("Out of memory!\n"));
talloc_free(ctx);
/* let's see if there is any id mapping to be retieved from the backends */
if (bids) {
+ /* Only do query if we are online */
+ if ( IS_DOMAIN_OFFLINE(our_domain) ) {
+ ret = NT_STATUS_FILE_IS_OFFLINE;
+ goto done;
+ }
+
ret = idmap_backends_sids_to_unixids(bids);
IDMAP_CHECK_RET(ret);
for (i = 0; bids[i]; i++) {
if (bids[i]->status == ID_MAPPED) {
ret = idmap_cache_set(idmap_cache, bids[i]);
+ } else if (bids[i]->status == ID_EXPIRED) {
+ /* the cache returned an expired entry and the backend was
+ * was not able to clear the situation (offline).
+ * This handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
+ * for disconnected mode, */
+ bids[i]->status = ID_MAPPED;
} else if (bids[i]->status == ID_UNKNOWN) {
- /* return an expired entry in the cache or an unknown */
- /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
- * for disconnected mode */
- idmap_cache_map_id(idmap_cache, ids[i]);
- } else {
+ /* something bad here. We were not able to handle this for some
+ * reason, mark it as unmapped and hope next time things will
+ * settle down. */
+ bids[i]->status = ID_UNMAPPED;
+ } else { /* unmapped */
ret = idmap_cache_set_negative_sid(idmap_cache, bids[i]);
}
IDMAP_CHECK_RET(ret);
return;
}
- allid.type = ID_TYPE_UID;
- allid.id = 0;
- alloc_methods->get_id_hwm(&allid);
- fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
-
- allid.type = ID_TYPE_GID;
- allid.id = 0;
- alloc_methods->get_id_hwm(&allid);
- fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
-
+ if (NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
+ allid.type = ID_TYPE_UID;
+ allid.id = 0;
+ idmap_alloc_ctx->methods->get_id_hwm(&allid);
+ fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
+
+ allid.type = ID_TYPE_GID;
+ allid.id = 0;
+ idmap_alloc_ctx->methods->get_id_hwm(&allid);
+ fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
+ }
+
maps = talloc(idmap_ctx, struct id_map);
num_maps = 0;
(unsigned long)maps[i].xid.id,
sid_string_static(maps[i].sid));
break;
+ case ID_TYPE_NOT_SPECIFIED:
+ break;
}
}
return ret;
}
+
git.samba.org / tprouty / samba.git / blobdiff