idmap.c

samba最新软件

						    -1);
		if (new_xid == (uint32_t) -1) {
			DEBUG(1, ("Invalid xid mapping.\n"));
			status = NT_STATUS_NONE_MAPPED;
			goto failed;
		}

		if (type == NULL) {
			DEBUG(1, ("Invalid type for mapping entry.\n"));
			status = NT_STATUS_NONE_MAPPED;
			goto failed;
		}

		*unixid = talloc(mem_ctx, struct unixid);
		if (*unixid == NULL) {
			status = NT_STATUS_NO_MEMORY;
			goto failed;
		}

		(*unixid)->id = new_xid;

		if (strcmp(type, "ID_TYPE_BOTH") == 0) {
			(*unixid)->type = ID_TYPE_BOTH;
		} else if (strcmp(type, "ID_TYPE_UID") == 0) {
			(*unixid)->type = ID_TYPE_UID;
		} else {
			(*unixid)->type = ID_TYPE_GID;
		}

		talloc_free(tmp_ctx);
		return NT_STATUS_OK;
	}

	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));

	trans = ldb_transaction_start(ldb);
	if (trans != LDB_SUCCESS) {
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	/* Redo the search to make sure noone changed the mapping while we
	 * weren't looking */
	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
	if (ret != LDB_SUCCESS) {
		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	if (res->count > 0) {
		DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
		status = NT_STATUS_RETRY;
		goto failed;
	}

	/*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
	 * resolved here. */

	ret = idmap_get_bounds(idmap_ctx, &low, &high);
	if (ret != LDB_SUCCESS) {
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
	if (dn == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
	if (ret != LDB_SUCCESS) {
		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	talloc_steal(tmp_ctx, res);

	if (res->count != 1) {
		DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber", -1);
	if (hwm == (uint32_t)-1) {
		hwm = low;
		hwm_entry_exists = false;
	} else {
		hwm_entry_exists = true;
	}

	if (hwm > high) {
		DEBUG(1, ("Out of xids to allocate.\n"));
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	hwm_msg = ldb_msg_new(tmp_ctx);
	if (hwm_msg == NULL) {
		DEBUG(1, ("Out of memory when creating ldb_message\n"));
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	hwm_msg->dn = dn;

	new_xid = hwm;
	hwm++;

	hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
	if (hwm_string == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	sid_string = dom_sid_string(tmp_ctx, sid);
	if (sid_string == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	unixid_string = talloc_asprintf(tmp_ctx, "%u", new_xid);
	if (unixid_string == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	if (hwm_entry_exists) {
		struct ldb_message_element *els;
		struct ldb_val *vals;

		/* We're modifying the entry, not just adding a new one. */
		els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
		if (els == NULL) {
			status = NT_STATUS_NO_MEMORY;
			goto failed;
		}

		vals = talloc_array(tmp_ctx, struct ldb_val, 2);
		if (els == NULL) {
			status = NT_STATUS_NO_MEMORY;
			goto failed;
		}

		hwm_msg->num_elements = 2;
		hwm_msg->elements = els;

		els[0].num_values = 1;
		els[0].values = &vals[0];
		els[0].flags = LDB_FLAG_MOD_DELETE;
		els[0].name = talloc_strdup(tmp_ctx, "xidNumber");
		if (els[0].name == NULL) {
			status = NT_STATUS_NO_MEMORY;
			goto failed;
		}

		els[1].num_values = 1;
		els[1].values = &vals[1];
		els[1].flags = LDB_FLAG_MOD_ADD;
		els[1].name = els[0].name;

		vals[0].data = (uint8_t *)unixid_string;
		vals[0].length = strlen(unixid_string);
		vals[1].data = (uint8_t *)hwm_string;
		vals[1].length = strlen(hwm_string);
	} else {
		ret = ldb_msg_add_empty(hwm_msg, "xidNumber", LDB_FLAG_MOD_ADD,
					NULL);
		if (ret != LDB_SUCCESS) {
			status = NT_STATUS_NONE_MAPPED;
			goto failed;
		}

		ret = ldb_msg_add_string(hwm_msg, "xidNumber", hwm_string);
		if (ret != LDB_SUCCESS)
		{
			status = NT_STATUS_NONE_MAPPED;
			goto failed;
		}
	}

	ret = ldb_modify(ldb, hwm_msg);
	if (ret != LDB_SUCCESS) {
		DEBUG(1, ("Updating the xid high water mark failed: %s\n",
			  ldb_errstring(ldb)));
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	map_msg = ldb_msg_new(tmp_ctx);
	if (map_msg == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
	if (map_msg->dn == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	ret = ldb_msg_add_string(map_msg, "xidNumber", unixid_string);
	if (ret != LDB_SUCCESS) {
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
			sid);
	if (ret != LDB_SUCCESS) {
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
	if (ret != LDB_SUCCESS) {
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	ret = ldb_msg_add_string(map_msg, "type", "ID_TYPE_BOTH");
	if (ret != LDB_SUCCESS) {
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
	if (ret != LDB_SUCCESS) {
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	ret = ldb_add(ldb, map_msg);
	if (ret != LDB_SUCCESS) {
		DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	trans = ldb_transaction_commit(ldb);
	if (trans != LDB_SUCCESS) {
		DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
		status = NT_STATUS_NONE_MAPPED;
		goto failed;
	}

	*unixid = talloc(mem_ctx, struct unixid);
	if (*unixid == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto failed;
	}

	(*unixid)->id = new_xid;
	(*unixid)->type = ID_TYPE_BOTH;
	talloc_free(tmp_ctx);
	return NT_STATUS_OK;

failed:
	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
	talloc_free(tmp_ctx);
	return status;
}

/**
 * Convert an array of unixids to the corresponding array of SIDs
 *
 * \param idmap_ctx idmap context to use
 * \param mem_ctx talloc context the memory for the dom_sids is allocated
 * from.
 * \param count length of id_mapping array.
 * \param id array of id_mappings.
 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
 * did not.
 */

NTSTATUS idmap_xids_to_sids(struct idmap_context *idmap_ctx,
			    TALLOC_CTX *mem_ctx, int count,
			    struct id_mapping *id)
{
	int i;
	int error_count = 0;

	for (i = 0; i < count; ++i) {
		id[i].status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
						id[i].unixid, &id[i].sid);
		if (NT_STATUS_EQUAL(id[i].status, NT_STATUS_RETRY)) {
			id[i].status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
							id[i].unixid,
							&id[i].sid);
		}
		if (!NT_STATUS_IS_OK(id[i].status)) {
			DEBUG(1, ("idmapping xid_to_sid failed for id[%d]\n", i));
			error_count++;
		}
	}

	if (error_count == count) {
		/* Mapping did not work at all. */
		return NT_STATUS_NONE_MAPPED;
	} else if (error_count > 0) {
		/* Some mappings worked, some did not. */
		return STATUS_SOME_UNMAPPED;
	} else {
		return NT_STATUS_OK;
	}
}

/**
 * Convert an array of SIDs to the corresponding array of unixids
 *
 * \param idmap_ctx idmap context to use
 * \param mem_ctx talloc context the memory for the unixids is allocated
 * from.
 * \param count length of id_mapping array.
 * \param id array of id_mappings.
 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
 * did not.
 */

NTSTATUS idmap_sids_to_xids(struct idmap_context *idmap_ctx,
			    TALLOC_CTX *mem_ctx, int count,
			    struct id_mapping *id)
{
	int i;
	int error_count = 0;

	for (i = 0; i < count; ++i) {
		id[i].status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
						id[i].sid, &id[i].unixid);
		if (NT_STATUS_EQUAL(id[i].status, NT_STATUS_RETRY)) {
			id[i].status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
							id[i].sid,
							&id[i].unixid);
		}
		if (!NT_STATUS_IS_OK(id[i].status)) {
			DEBUG(1, ("idmapping sid_to_xid failed for id[%d]\n", i));
			error_count++;
		}
	}

	if (error_count == count) {
		/* Mapping did not work at all. */
		return NT_STATUS_NONE_MAPPED;
	} else if (error_count > 0) {
		/* Some mappings worked, some did not. */
		return STATUS_SOME_UNMAPPED;
	} else {
		return NT_STATUS_OK;
	}
}