2 Unix SMB/CIFS implementation.
4 idmap script backend, used for Samba setups where you need to map SIDs to
7 Copyright (C) Richard Sharpe 2014.
9 This is heavily based upon idmap_tdb2.c, which is:
11 Copyright (C) Tim Potter 2000
12 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
13 Copyright (C) Jeremy Allison 2006
14 Copyright (C) Simo Sorce 2003-2006
15 Copyright (C) Michael Adam 2009-2010
17 This program is free software; you can redistribute it and/or modify
18 it under the terms of the GNU General Public License as published by
19 the Free Software Foundation; either version 2 of the License, or
20 (at your option) any later version.
22 This program is distributed in the hope that it will be useful,
23 but WITHOUT ANY WARRANTY; without even the implied warranty of
24 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25 GNU General Public License for more details.
27 You should have received a copy of the GNU General Public License
28 along with this program; if not, write to the Free Software
29 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
33 #include "system/filesys.h"
37 #include "../libcli/security/dom_sid.h"
38 #include "lib/util_file.h"
39 #include "lib/util/tevent_unix.h"
42 #define DBGC_CLASS DBGC_IDMAP
44 struct idmap_script_context {
45 const char *script; /* script to provide idmaps */
49 run a script to perform a mapping
51 The script should accept the following command lines:
53 SIDTOID S-1-xxxx -> XID:<id> | ERR:<str>
54 SIDTOID S-1-xxxx -> UID:<id> | ERR:<str>
55 SIDTOID S-1-xxxx -> GID:<id> | ERR:<str>
56 IDTOSID XID xxxx -> SID:<sid> | ERR:<str>
57 IDTOSID UID xxxx -> SID:<sid> | ERR:<str>
58 IDTOSID GID xxxx -> SID:<sid> | ERR:<str>
60 where XID means both a UID and a GID. This is the case for ID_TYPE_BOTH.
62 TODO: Needs more validation ... like that we got a UID when we asked for one.
65 struct idmap_script_xid2sid_state {
71 static void idmap_script_xid2sid_done(struct tevent_req *subreq);
73 static struct tevent_req *idmap_script_xid2sid_send(
74 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
75 struct unixid xid, const char *script, size_t idx)
77 struct tevent_req *req, *subreq;
78 struct idmap_script_xid2sid_state *state;
81 req = tevent_req_create(mem_ctx, &state,
82 struct idmap_script_xid2sid_state);
99 DBG_WARNING("INVALID unix ID type: 0x02%x\n", xid.type);
100 tevent_req_error(req, EINVAL);
101 return tevent_req_post(req, ev);
104 state->argl = talloc_zero_array(state,
107 if (tevent_req_nomem(state->argl, req)) {
108 return tevent_req_post(req, ev);
110 state->argl[0] = talloc_strdup(state->argl, script);
111 if (tevent_req_nomem(state->argl[0], req)) {
112 return tevent_req_post(req, ev);
114 state->argl[1] = talloc_strdup(state->argl, "IDTOSID");
115 if (tevent_req_nomem(state->argl[1], req)) {
116 return tevent_req_post(req, ev);
118 state->argl[2] = talloc_asprintf(state->argl, "%cID", key);
119 if (tevent_req_nomem(state->argl[2], req)) {
120 return tevent_req_post(req, ev);
122 state->argl[3] = talloc_asprintf(state->argl, "%lu",
123 (unsigned long)xid.id);
124 if (tevent_req_nomem(state->argl[3], req)) {
125 return tevent_req_post(req, ev);
127 state->argl[4] = NULL;
129 subreq = file_ploadv_send(state, ev, state->argl, 1024);
130 if (tevent_req_nomem(subreq, req)) {
131 return tevent_req_post(req, ev);
133 tevent_req_set_callback(subreq, idmap_script_xid2sid_done, req);
137 static void idmap_script_xid2sid_done(struct tevent_req *subreq)
139 struct tevent_req *req = tevent_req_callback_data(
140 subreq, struct tevent_req);
141 struct idmap_script_xid2sid_state *state = tevent_req_data(
142 req, struct idmap_script_xid2sid_state);
145 ret = file_ploadv_recv(subreq, state, &state->out);
147 if (tevent_req_error(req, ret)) {
150 tevent_req_done(req);
153 static int idmap_script_xid2sid_recv(struct tevent_req *req, size_t *idx,
154 enum id_mapping *status,
157 struct idmap_script_xid2sid_state *state = tevent_req_data(
158 req, struct idmap_script_xid2sid_state);
159 char *out = (char *)state->out;
160 size_t out_size = talloc_get_size(out);
163 if (tevent_req_is_unix_error(req, &err)) {
170 if (state->out[out_size-1] != '\0') {
176 if ((strncmp(out, "SID:S-", 6) != 0) ||
177 !dom_sid_parse(out+4, sid)) {
178 DBG_WARNING("Bad sid from script: %s\n", out);
186 *sid = (struct dom_sid) {0};
187 *status = ID_UNMAPPED;
191 struct idmap_script_xids2sids_state {
197 static void idmap_script_xids2sids_done(struct tevent_req *subreq);
199 static struct tevent_req *idmap_script_xids2sids_send(
200 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
201 struct id_map **ids, size_t num_ids, const char *script)
203 struct tevent_req *req;
204 struct idmap_script_xids2sids_state *state;
207 req = tevent_req_create(mem_ctx, &state,
208 struct idmap_script_xids2sids_state);
213 state->num_ids = num_ids;
215 if (state->num_ids == 0) {
216 tevent_req_done(req);
217 return tevent_req_post(req, ev);
220 for (i=0; i<num_ids; i++) {
221 struct tevent_req *subreq;
223 subreq = idmap_script_xid2sid_send(
224 state, ev, ids[i]->xid, script, i);
225 if (tevent_req_nomem(subreq, req)) {
226 return tevent_req_post(req, ev);
228 tevent_req_set_callback(subreq, idmap_script_xids2sids_done,
235 static void idmap_script_xids2sids_done(struct tevent_req *subreq)
237 struct tevent_req *req = tevent_req_callback_data(
238 subreq, struct tevent_req);
239 struct idmap_script_xids2sids_state *state = tevent_req_data(
240 req, struct idmap_script_xids2sids_state);
242 enum id_mapping status = ID_UNKNOWN;
243 struct dom_sid sid = {0};
246 ret = idmap_script_xid2sid_recv(subreq, &idx, &status, &sid);
248 if (tevent_req_error(req, ret)) {
252 if (idx >= state->num_ids) {
253 tevent_req_error(req, EINVAL);
257 state->ids[idx]->status = status;
259 state->ids[idx]->sid = dom_sid_dup(state->ids, &sid);
260 if (tevent_req_nomem(state->ids[idx]->sid, req)) {
264 state->num_done += 1;
266 if (state->num_done >= state->num_ids) {
267 tevent_req_done(req);
271 static int idmap_script_xids2sids_recv(struct tevent_req *req)
273 return tevent_req_simple_recv_unix(req);
276 static int idmap_script_xids2sids(struct id_map **ids, size_t num_ids,
279 TALLOC_CTX *frame = talloc_stackframe();
280 struct tevent_context *ev;
281 struct tevent_req *req;
284 ev = samba_tevent_context_init(frame);
288 req = idmap_script_xids2sids_send(frame, ev, ids, num_ids, script);
292 if (!tevent_req_poll(req, ev)) {
296 ret = idmap_script_xids2sids_recv(req);
302 static NTSTATUS idmap_script_unixids_to_sids(struct idmap_domain *dom,
305 struct idmap_script_context *ctx = talloc_get_type_abort(
306 dom->private_data, struct idmap_script_context);
308 size_t i, num_ids, num_mapped;
310 DEBUG(10, ("%s called ...\n", __func__));
311 /* Init status to avoid surprise ... */
312 for (i = 0; ids[i]; i++) {
313 ids[i]->status = ID_UNKNOWN;
317 ret = idmap_script_xids2sids(ids, num_ids, ctx->script);
319 DBG_DEBUG("idmap_script_xids2sids returned %s\n",
321 return map_nt_error_from_unix(ret);
326 for (i = 0; ids[i]; i++) {
327 if (ids[i]->status == ID_MAPPED) {
332 if (num_mapped == 0) {
333 return NT_STATUS_NONE_MAPPED;
335 if (num_mapped < num_ids) {
336 return STATUS_SOME_UNMAPPED;
341 struct idmap_script_sid2xid_state {
347 static void idmap_script_sid2xid_done(struct tevent_req *subreq);
349 static struct tevent_req *idmap_script_sid2xid_send(
350 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
351 const struct dom_sid *sid, const char *script, size_t idx)
353 struct tevent_req *req, *subreq;
354 struct idmap_script_sid2xid_state *state;
355 struct dom_sid_buf sidbuf;
357 req = tevent_req_create(mem_ctx, &state,
358 struct idmap_script_sid2xid_state);
364 state->argl = talloc_zero_array(state,
367 if (tevent_req_nomem(state->argl, req)) {
368 return tevent_req_post(req, ev);
370 state->argl[0] = talloc_strdup(state->argl, script);
371 if (tevent_req_nomem(state->argl[0], req)) {
372 return tevent_req_post(req, ev);
374 state->argl[1] = talloc_strdup(state->argl, "SIDTOID");
375 if (tevent_req_nomem(state->argl[1], req)) {
376 return tevent_req_post(req, ev);
378 state->argl[2] = talloc_asprintf(state->argl, "%s",
379 dom_sid_str_buf(sid, &sidbuf));
380 if (tevent_req_nomem(state->argl[2], req)) {
381 return tevent_req_post(req, ev);
383 state->argl[3] = NULL;
385 subreq = file_ploadv_send(state, ev, state->argl, 1024);
386 if (tevent_req_nomem(subreq, req)) {
387 return tevent_req_post(req, ev);
389 tevent_req_set_callback(subreq, idmap_script_sid2xid_done, req);
393 static void idmap_script_sid2xid_done(struct tevent_req *subreq)
395 struct tevent_req *req = tevent_req_callback_data(
396 subreq, struct tevent_req);
397 struct idmap_script_sid2xid_state *state = tevent_req_data(
398 req, struct idmap_script_sid2xid_state);
401 ret = file_ploadv_recv(subreq, state, &state->out);
403 if (tevent_req_error(req, ret)) {
406 tevent_req_done(req);
409 static int idmap_script_sid2xid_recv(struct tevent_req *req,
410 size_t *idx, enum id_mapping *status,
413 struct idmap_script_sid2xid_state *state = tevent_req_data(
414 req, struct idmap_script_sid2xid_state);
415 char *out = (char *)state->out;
416 size_t out_size = talloc_get_size(out);
420 if (tevent_req_is_unix_error(req, &err)) {
427 if (state->out[out_size-1] != '\0') {
433 if (sscanf(out, "XID:%lu\n", &v) == 1) {
434 *xid = (struct unixid) { .id = v, .type = ID_TYPE_BOTH };
435 } else if (sscanf(out, "UID:%lu\n", &v) == 1) {
436 *xid = (struct unixid) { .id = v, .type = ID_TYPE_UID };
437 } else if (sscanf(out, "GID:%lu\n", &v) == 1) {
438 *xid = (struct unixid) { .id = v, .type = ID_TYPE_GID };
447 *xid = (struct unixid) { .id = UINT32_MAX,
448 .type = ID_TYPE_NOT_SPECIFIED };
449 *status = ID_UNMAPPED;
453 struct idmap_script_sids2xids_state {
459 static void idmap_script_sids2xids_done(struct tevent_req *subreq);
461 static struct tevent_req *idmap_script_sids2xids_send(
462 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
463 struct id_map **ids, size_t num_ids, const char *script)
465 struct tevent_req *req;
466 struct idmap_script_sids2xids_state *state;
469 req = tevent_req_create(mem_ctx, &state,
470 struct idmap_script_sids2xids_state);
475 state->num_ids = num_ids;
477 if (state->num_ids == 0) {
478 tevent_req_done(req);
479 return tevent_req_post(req, ev);
482 for (i=0; i<num_ids; i++) {
483 struct tevent_req *subreq;
485 subreq = idmap_script_sid2xid_send(
486 state, ev, ids[i]->sid, script, i);
487 if (tevent_req_nomem(subreq, req)) {
488 return tevent_req_post(req, ev);
490 tevent_req_set_callback(subreq, idmap_script_sids2xids_done,
497 static void idmap_script_sids2xids_done(struct tevent_req *subreq)
499 struct tevent_req *req = tevent_req_callback_data(
500 subreq, struct tevent_req);
501 struct idmap_script_sids2xids_state *state = tevent_req_data(
502 req, struct idmap_script_sids2xids_state);
504 enum id_mapping status = ID_UNKNOWN;
505 struct unixid xid = { .id = UINT32_MAX,
506 .type = ID_TYPE_NOT_SPECIFIED };
509 ret = idmap_script_sid2xid_recv(subreq, &idx, &status, &xid);
511 if (tevent_req_error(req, ret)) {
515 if (idx >= state->num_ids) {
516 tevent_req_error(req, EINVAL);
520 state->ids[idx]->status = status;
521 state->ids[idx]->xid = xid;
523 state->num_done += 1;
525 if (state->num_done >= state->num_ids) {
526 tevent_req_done(req);
530 static int idmap_script_sids2xids_recv(struct tevent_req *req)
532 return tevent_req_simple_recv_unix(req);
535 static int idmap_script_sids2xids(struct id_map **ids, size_t num_ids,
538 TALLOC_CTX *frame = talloc_stackframe();
539 struct tevent_context *ev;
540 struct tevent_req *req;
543 ev = samba_tevent_context_init(frame);
547 req = idmap_script_sids2xids_send(frame, ev, ids, num_ids, script);
551 if (!tevent_req_poll(req, ev)) {
555 ret = idmap_script_sids2xids_recv(req);
561 static NTSTATUS idmap_script_sids_to_unixids(struct idmap_domain *dom,
564 struct idmap_script_context *ctx = talloc_get_type_abort(
565 dom->private_data, struct idmap_script_context);
567 size_t i, num_ids, num_mapped;
569 DEBUG(10, ("%s called ...\n", __func__));
570 /* Init status to avoid surprise ... */
571 for (i = 0; ids[i]; i++) {
572 ids[i]->status = ID_UNKNOWN;
576 ret = idmap_script_sids2xids(ids, num_ids, ctx->script);
578 DBG_DEBUG("idmap_script_sids2xids returned %s\n",
580 return map_nt_error_from_unix(ret);
585 for (i=0; i<num_ids; i++) {
586 struct id_map *map = ids[i];
588 if ((map->status == ID_MAPPED) &&
589 !idmap_unix_id_is_in_range(map->xid.id, dom)) {
590 DBG_INFO("Script returned id (%u) out of range "
591 "(%u - %u). Filtered!\n",
592 map->xid.id, dom->low_id, dom->high_id);
593 map->status = ID_UNMAPPED;
596 if (map->status == ID_MAPPED) {
601 if (num_mapped == 0) {
602 return NT_STATUS_NONE_MAPPED;
604 if (num_mapped < num_ids) {
605 return STATUS_SOME_UNMAPPED;
611 * Initialise idmap_script database.
613 static NTSTATUS idmap_script_db_init(struct idmap_domain *dom)
616 struct idmap_script_context *ctx;
617 const char * idmap_script = NULL;
618 const char *ctx_script = NULL;
620 DEBUG(10, ("%s called ...\n", __func__));
622 ctx = talloc_zero(dom, struct idmap_script_context);
624 DEBUG(0, ("Out of memory!\n"));
625 ret = NT_STATUS_NO_MEMORY;
629 ctx_script = idmap_config_const_string(dom->name, "script", NULL);
631 /* Do we even need to handle this? */
632 idmap_script = lp_parm_const_string(-1, "idmap", "script", NULL);
633 if (idmap_script != NULL) {
634 DEBUG(0, ("Warning: 'idmap:script' is deprecated. "
635 " Please use 'idmap config * : script' instead!\n"));
638 if (strequal(dom->name, "*") && ctx_script == NULL) {
639 /* fall back to idmap:script for backwards compatibility */
640 ctx_script = idmap_script;
644 DEBUG(1, ("using idmap script '%s'\n", ctx->script));
646 * We must ensure this memory is owned by ctx.
647 * The ctx_script const pointer is a pointer into
648 * the config file data and may become invalid
649 * on config file reload. BUG: 13956
651 ctx->script = talloc_strdup(ctx, ctx_script);
652 if (ctx->script == NULL) {
653 ret = NT_STATUS_NO_MEMORY;
658 dom->private_data = ctx;
659 dom->read_only = true; /* We do not allocate!*/
668 static struct idmap_methods db_methods = {
669 .init = idmap_script_db_init,
670 .unixids_to_sids = idmap_script_unixids_to_sids,
671 .sids_to_unixids = idmap_script_sids_to_unixids,
675 NTSTATUS idmap_script_init(TALLOC_CTX *ctx)
677 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "script", &db_methods);