Copyright (C) Andrew Tridgell 1992-1998
Copyright (C) Gerald (Jerry) Carter 2003
Copyright (C) Volker Lendecke 2005
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
+#include "passdb.h"
#include "../librpc/gen_ndr/ndr_security.h"
#include "secrets.h"
#include "memcache.h"
#include "idmap_cache.h"
#include "../libcli/security/security.h"
+#include "lib/winbind_util.h"
/*****************************************************************
Dissect a user-provided name into domain, name, sid and type.
if (IS_DC && winbind_lookup_name("", name, &sid, &type)) {
struct dom_sid dom_sid;
- uint32 tmp_rid;
enum lsa_SidType domain_type;
-
+
if (type == SID_NAME_DOMAIN) {
/* Swap name and type */
tmp = name; name = domain; domain = tmp;
* domain it figured out itself. Maybe fix that later... */
sid_copy(&dom_sid, &sid);
- sid_split_rid(&dom_sid, &tmp_rid);
+ sid_split_rid(&dom_sid, NULL);
if (!winbind_lookup_sid(tmp_ctx, &dom_sid, &domain, NULL,
&domain_type) ||
ret_sid, ret_type)) {
return true;
}
-
+
/* Finally try with "Unix Users" or "Unix Group" */
qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
flags & LOOKUP_NAME_GROUP ?
* This attempts to be as efficient as possible: It collects all SIDs
* belonging to a domain and hands them in bulk to the appropriate lookup
* function. In particular pdb_lookup_rids with ldapsam_trusted benefits
- * *hugely* from this. Winbind is going to be extended with a lookup_rids
- * interface as well, so on a DC we can do a bulk lsa_lookuprids to the
- * appropriate DC.
+ * *hugely* from this.
*/
NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
result = NT_STATUS_NO_MEMORY;
goto fail;
}
-
+
name_infos[i].rid = 0;
name_infos[i].type = SID_NAME_DOMAIN;
name_infos[i].name = NULL;
result = NT_STATUS_NO_MEMORY;
goto fail;
}
-
+
for (j=0; j<dom->num_idxs; j++) {
int idx = dom->idxs[j];
name_infos[idx].type = types[j];
/* This is a mapped group */
goto done;
}
-
+
/* This is an unmapped group */
gid_to_unix_groups_sid(gid, psid);
*pgid = id.gid;
goto done;
}
-
+
/* This was ours, but it was not mapped. Fail */
}
DEBUG(10,("LEGACY: mapping failed for sid %s\n",
sid_string_dbg(psid)));
return false;
-
+
done:
DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_dbg(psid),
(unsigned int)*pgid ));
return;
}
+bool sids_to_unix_ids(const struct dom_sid *sids, uint32_t num_sids,
+ struct wbcUnixId *ids)
+{
+ struct wbcDomainSid *wbc_sids = NULL;
+ struct wbcUnixId *wbc_ids = NULL;
+ uint32_t i, num_not_cached;
+ wbcErr err;
+ bool ret = false;
+
+ wbc_sids = TALLOC_ARRAY(talloc_tos(), struct wbcDomainSid, num_sids);
+ if (wbc_sids == NULL) {
+ return false;
+ }
+
+ num_not_cached = 0;
+
+ for (i=0; i<num_sids; i++) {
+ bool expired;
+ uint32_t rid;
+
+ if (fetch_uid_from_cache(&ids[i].id.uid, &sids[i])) {
+ ids[i].type = WBC_ID_TYPE_UID;
+ continue;
+ }
+ if (fetch_gid_from_cache(&ids[i].id.gid, &sids[i])) {
+ ids[i].type = WBC_ID_TYPE_GID;
+ continue;
+ }
+ if (sid_peek_check_rid(&global_sid_Unix_Users,
+ &sids[i], &rid)) {
+ ids[i].type = WBC_ID_TYPE_UID;
+ ids[i].id.uid = rid;
+ continue;
+ }
+ if (sid_peek_check_rid(&global_sid_Unix_Groups,
+ &sids[i], &rid)) {
+ ids[i].type = WBC_ID_TYPE_GID;
+ ids[i].id.gid = rid;
+ continue;
+ }
+ if (idmap_cache_find_sid2uid(&sids[i], &ids[i].id.uid,
+ &expired)
+ && !expired) {
+ ids[i].type = WBC_ID_TYPE_UID;
+ continue;
+ }
+ if (idmap_cache_find_sid2gid(&sids[i], &ids[i].id.gid,
+ &expired)
+ && !expired) {
+ ids[i].type = WBC_ID_TYPE_GID;
+ continue;
+ }
+ ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+ memcpy(&wbc_sids[num_not_cached], &sids[i],
+ ndr_size_dom_sid(&sids[i], 0));
+ num_not_cached += 1;
+ }
+ if (num_not_cached == 0) {
+ goto done;
+ }
+ wbc_ids = TALLOC_ARRAY(talloc_tos(), struct wbcUnixId, num_not_cached);
+ if (wbc_ids == NULL) {
+ goto fail;
+ }
+ for (i=0; i<num_not_cached; i++) {
+ wbc_ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+ }
+ err = wbcSidsToUnixIds(wbc_sids, num_not_cached, wbc_ids);
+ if (!WBC_ERROR_IS_OK(err)) {
+ DEBUG(10, ("wbcSidsToUnixIds returned %s\n",
+ wbcErrorString(err)));
+ }
+
+ num_not_cached = 0;
+
+ for (i=0; i<num_sids; i++) {
+ if (ids[i].type == WBC_ID_TYPE_NOT_SPECIFIED) {
+ ids[i] = wbc_ids[num_not_cached];
+ num_not_cached += 1;
+ }
+ }
+
+ for (i=0; i<num_sids; i++) {
+ if (ids[i].type != WBC_ID_TYPE_NOT_SPECIFIED) {
+ continue;
+ }
+ if (legacy_sid_to_gid(&sids[i], &ids[i].id.gid)) {
+ ids[i].type = WBC_ID_TYPE_GID;
+ continue;
+ }
+ if (legacy_sid_to_uid(&sids[i], &ids[i].id.uid)) {
+ ids[i].type = WBC_ID_TYPE_UID;
+ continue;
+ }
+ }
+
+done:
+ for (i=0; i<num_sids; i++) {
+ switch(ids[i].type) {
+ case WBC_ID_TYPE_GID:
+ if (ids[i].id.gid == (gid_t)-1) {
+ ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+ }
+ break;
+ case WBC_ID_TYPE_UID:
+ if (ids[i].id.uid == (uid_t)-1) {
+ ids[i].type = WBC_ID_TYPE_NOT_SPECIFIED;
+ }
+ break;
+ case WBC_ID_TYPE_NOT_SPECIFIED:
+ break;
+ }
+ }
+ ret = true;
+fail:
+ TALLOC_FREE(wbc_ids);
+ TALLOC_FREE(wbc_sids);
+ return ret;
+}
+
/*****************************************************************
*THE CANONICAL* convert SID to uid function.
*****************************************************************/
TALLOC_FREE(tmp_ctx);
return NT_STATUS_OK;
}
+
+bool delete_uid_cache(uid_t puid)
+{
+ DATA_BLOB uid = data_blob_const(&puid, sizeof(puid));
+ DATA_BLOB sid;
+
+ if (!memcache_lookup(NULL, UID_SID_CACHE, uid, &sid)) {
+ DEBUG(3, ("UID %d is not memcached!\n", (int)puid));
+ return false;
+ }
+ DEBUG(3, ("Delete mapping UID %d <-> %s from memcache\n", (int)puid,
+ sid_string_dbg((struct dom_sid*)sid.data)));
+ memcache_delete(NULL, SID_UID_CACHE, sid);
+ memcache_delete(NULL, UID_SID_CACHE, uid);
+ return true;
+}
+
+bool delete_gid_cache(gid_t pgid)
+{
+ DATA_BLOB gid = data_blob_const(&pgid, sizeof(pgid));
+ DATA_BLOB sid;
+ if (!memcache_lookup(NULL, GID_SID_CACHE, gid, &sid)) {
+ DEBUG(3, ("GID %d is not memcached!\n", (int)pgid));
+ return false;
+ }
+ DEBUG(3, ("Delete mapping GID %d <-> %s from memcache\n", (int)pgid,
+ sid_string_dbg((struct dom_sid*)sid.data)));
+ memcache_delete(NULL, SID_GID_CACHE, sid);
+ memcache_delete(NULL, GID_SID_CACHE, gid);
+ return true;
+}
+
+bool delete_sid_cache(const struct dom_sid* psid)
+{
+ DATA_BLOB sid = data_blob_const(psid, ndr_size_dom_sid(psid, 0));
+ DATA_BLOB id;
+ if (memcache_lookup(NULL, SID_GID_CACHE, sid, &id)) {
+ DEBUG(3, ("Delete mapping %s <-> GID %d from memcache\n",
+ sid_string_dbg(psid), *(int*)id.data));
+ memcache_delete(NULL, SID_GID_CACHE, sid);
+ memcache_delete(NULL, GID_SID_CACHE, id);
+ } else if (memcache_lookup(NULL, SID_UID_CACHE, sid, &id)) {
+ DEBUG(3, ("Delete mapping %s <-> UID %d from memcache\n",
+ sid_string_dbg(psid), *(int*)id.data));
+ memcache_delete(NULL, SID_UID_CACHE, sid);
+ memcache_delete(NULL, UID_SID_CACHE, id);
+ } else {
+ DEBUG(3, ("SID %s is not memcached!\n", sid_string_dbg(psid)));
+ return false;
+ }
+ return true;
+}
+
+void flush_gid_cache(void)
+{
+ DEBUG(3, ("Flush GID <-> SID memcache\n"));
+ memcache_flush(NULL, SID_GID_CACHE);
+ memcache_flush(NULL, GID_SID_CACHE);
+}
+
+void flush_uid_cache(void)
+{
+ DEBUG(3, ("Flush UID <-> SID memcache\n"));
+ memcache_flush(NULL, SID_UID_CACHE);
+ memcache_flush(NULL, UID_SID_CACHE);
+}
git.samba.org / samba.git / blobdiff