9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek#include "util/util.h"

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek#include "util/dlinklist.h"

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek#include "util/murmurhash3.h"

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek#include "providers/ldap/sdap_idmap.h"

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozekstatic void *

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozeksdap_idmap_talloc(size_t size, void *pvt)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek{

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return talloc_size(pvt, size);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek}

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozekstatic void

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozeksdap_idmap_talloc_free(void *ptr, void *pvt)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek{

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek talloc_free(ptr);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek}

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozekstatic errno_t

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozeksdap_idmap_add_configured_external_range(struct sdap_idmap_ctx *idmap_ctx)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek{

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek int int_id;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct sss_idmap_range range;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct sdap_id_ctx *id_ctx;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek enum idmap_error_code err;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (idmap_ctx == NULL) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_ctx = idmap_ctx->id_ctx;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek int_id = dp_opt_get_int(id_ctx->opts->basic, SDAP_MIN_ID);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (int_id < 0) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CONF_SETTINGS, ("ldap_min_id must be greater than 0.\n"));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek range.min = int_id;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek int_id = dp_opt_get_int(id_ctx->opts->basic, SDAP_MAX_ID);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (int_id < 0) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CONF_SETTINGS, ("ldap_min_id must be greater than 0.\n"));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek range.max = int_id;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if ((range.min == 0 && range.max != 0)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek || (range.min != 0 && range.max == 0)) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CONF_SETTINGS, ("Both ldap_min_id and ldap_max_id " \

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek "either must be 0 (not set) " \

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek "or positive integers.\n"));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (range.min == 0 && range.max == 0) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* ldap_min_id and ldap_max_id not set, using min_id and max_id */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek range.min = id_ctx->be->domain->id_min;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek range.max = id_ctx->be->domain->id_max;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (range.max == 0) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek range.max = UINT32_MAX;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err = sss_idmap_add_domain_ex(idmap_ctx->map, id_ctx->be->domain->name,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_ctx->be->domain->domain_id, &range,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek NULL, 0, true);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (err != IDMAP_SUCCESS) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

2cba1c86f48db866fc72738a32eecbbdcdf3dbdbJakub Hrozek ("Could not add domain [%s] to the map: [%d]\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_ctx->be->domain->name, err));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EIO;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EOK;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek}

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozeksdap_idmap_init(TALLOC_CTX *mem_ctx,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct sdap_id_ctx *id_ctx,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct sdap_idmap_ctx **_idmap_ctx)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek{

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek errno_t ret;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek TALLOC_CTX *tmp_ctx;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek enum idmap_error_code err;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek size_t i;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct ldb_result *res;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek const char *dom_name;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek const char *sid_str;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_t slice_num;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_t idmap_lower;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_t idmap_upper;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_t rangesize;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek bool autorid_mode;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct sdap_idmap_ctx *idmap_ctx = NULL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct sysdb_ctx *sysdb = id_ctx->be->domain->sysdb;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek tmp_ctx = talloc_new(NULL);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (!tmp_ctx) return ENOMEM;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek idmap_ctx = talloc_zero(tmp_ctx, struct sdap_idmap_ctx);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (!idmap_ctx) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = ENOMEM;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek idmap_ctx->id_ctx = id_ctx;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek idmap_lower = dp_opt_get_int(idmap_ctx->id_ctx->opts->basic,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SDAP_IDMAP_LOWER);

5dfb1257f62839eea1c31669cf3bbcb114c22183Jakub Hrozek idmap_upper = dp_opt_get_int(idmap_ctx->id_ctx->opts->basic,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SDAP_IDMAP_UPPER);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek rangesize = dp_opt_get_int(idmap_ctx->id_ctx->opts->basic,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SDAP_IDMAP_RANGESIZE);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek autorid_mode = dp_opt_get_bool(idmap_ctx->id_ctx->opts->basic,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SDAP_IDMAP_AUTORID_COMPAT);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Validate that the values make sense */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (rangesize <= 0

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek || idmap_upper <= idmap_lower

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek || (idmap_upper-idmap_lower) < rangesize)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_FATAL_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Invalid settings for range selection: [%d][%d][%d]\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek idmap_lower, idmap_upper, rangesize));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (((idmap_upper - idmap_lower) % rangesize) != 0) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CONF_SETTINGS,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Range size does not divide evenly. Uppermost range will "

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek "not be used\n"));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Initialize the map */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err = sss_idmap_init(sdap_idmap_talloc, idmap_ctx,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sdap_idmap_talloc_free,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek &idmap_ctx->map);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (err != IDMAP_SUCCESS) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not initialize the ID map: [%s]\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek idmap_error_string(err)));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (err == IDMAP_OUT_OF_MEMORY) {

5dfb1257f62839eea1c31669cf3bbcb114c22183Jakub Hrozek ret = ENOMEM;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek } else {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err = sss_idmap_ctx_set_autorid(idmap_ctx->map, autorid_mode);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err |= sss_idmap_ctx_set_lower(idmap_ctx->map, idmap_lower);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err |= sss_idmap_ctx_set_upper(idmap_ctx->map, idmap_upper);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err |= sss_idmap_ctx_set_rangesize(idmap_ctx->map, rangesize);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (err != IDMAP_SUCCESS) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* This should never happen */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, ("sss_idmap_ctx corrupted\n"));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EIO;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Setup range for externally managed IDs, i.e. IDs are read from the

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (!dp_opt_get_bool(idmap_ctx->id_ctx->opts->basic, SDAP_ID_MAPPING)) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sdap_idmap_add_configured_external_range(idmap_ctx);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != EOK) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("sdap_idmap_add_configured_external_range failed.\n"));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Read in any existing mappings from the cache */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sysdb_idmap_get_mappings(tmp_ctx, sysdb, id_ctx->be->domain, &res);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != EOK && ret != ENOENT) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_FATAL_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not read ID mappings from the cache: [%s]\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek strerror(ret)));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret == EOK && res->count > 0) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CONF_SETTINGS,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Initializing [%d] domains for ID-mapping\n", res->count));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek for (i = 0; i < res->count; i++) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name = ldb_msg_find_attr_as_string(res->msgs[i],

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SYSDB_NAME,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek NULL);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (!dom_name) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* This should never happen */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str = ldb_msg_find_attr_as_string(res->msgs[i],

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SYSDB_IDMAP_SID_ATTR,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek NULL);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (!sid_str) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* This should never happen */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EINVAL;

5dfb1257f62839eea1c31669cf3bbcb114c22183Jakub Hrozek goto done;

5dfb1257f62839eea1c31669cf3bbcb114c22183Jakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek slice_num = ldb_msg_find_attr_as_int(res->msgs[i],

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SYSDB_IDMAP_SLICE_ATTR,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek -1);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (slice_num == -1) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* This should never happen */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sdap_idmap_add_domain(idmap_ctx, dom_name,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str, slice_num);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != EOK) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not add domain [%s][%s][%u] to ID map: [%s]\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name, sid_str, slice_num, strerror(ret)));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek } else {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* This is the first time we're setting up id-mapping

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name = dp_opt_get_string(idmap_ctx->id_ctx->opts->basic, SDAP_IDMAP_DEFAULT_DOMAIN);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (!dom_name) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* If it's not explicitly specified, use the SSSD domain name */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name = idmap_ctx->id_ctx->be->domain->name;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = dp_opt_set_string(idmap_ctx->id_ctx->opts->basic,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek SDAP_IDMAP_DEFAULT_DOMAIN,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != EOK) goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str = dp_opt_get_string(idmap_ctx->id_ctx->opts->basic, SDAP_IDMAP_DEFAULT_DOMAIN_SID);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (sid_str) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Set the default domain as slice 0 */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sdap_idmap_add_domain(idmap_ctx, dom_name,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str, 0);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != EOK) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not add domain [%s][%s][%u] to ID map: [%s]\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name, sid_str, 0, strerror(ret)));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek } else {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (dp_opt_get_bool(idmap_ctx->id_ctx->opts->basic, SDAP_IDMAP_AUTORID_COMPAT)) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* In autorid compatibility mode, we MUST have a slice 0 */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("WARNING: Autorid compatibility mode selected, "

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek "but %s is not set. UID/GID values may differ "

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek "between clients.\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek idmap_ctx->id_ctx->opts->basic[SDAP_IDMAP_DEFAULT_DOMAIN_SID].opt_name));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Otherwise, we'll just fall back to hash values as they are seen */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek *_idmap_ctx = talloc_steal(mem_ctx, idmap_ctx);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EOK;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozekdone:

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek talloc_free(tmp_ctx);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return ret;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek}

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozeksdap_idmap_add_domain(struct sdap_idmap_ctx *idmap_ctx,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek const char *dom_name,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek const char *dom_sid,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_t slice)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek{

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek errno_t ret;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct sss_idmap_range range;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek enum idmap_error_code err;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_t idmap_upper;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sss_idmap_ctx_get_upper(idmap_ctx->map, &idmap_upper);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != IDMAP_SUCCESS) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Failed to get upper bound of available ID range.\n"));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EIO;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sss_idmap_calculate_range(idmap_ctx->map, dom_sid, &slice, &range);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != IDMAP_SUCCESS) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Failed to calculate range for domain [%s]: [%d]\n", dom_name,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EIO;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Adding domain [%s] as slice [%llu]\n", dom_sid, slice));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (range.max > idmap_upper) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* This should never happen */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("BUG: Range maximum exceeds the global maximum: %d > %d\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek range.max, idmap_upper));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Add this domain to the map */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err = sss_idmap_add_domain(idmap_ctx->map, dom_name, dom_sid, &range);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (err != IDMAP_SUCCESS) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not add domain [%s] to the map: [%d]\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name, err));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EIO;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Add this domain to the SYSDB cache so it will survive reboot */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sysdb_idmap_store_mapping(idmap_ctx->id_ctx->be->domain->sysdb,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek idmap_ctx->id_ctx->be->domain,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_name, dom_sid,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek slice);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozekdone:

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return ret;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek}

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozeksdap_idmap_get_dom_sid_from_object(TALLOC_CTX *mem_ctx,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek const char *object_sid,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek char **dom_sid_str)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek{

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek const char *p;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek long long a;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek size_t c;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek char *endptr;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (object_sid == NULL

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek || strncmp(object_sid, DOM_SID_PREFIX, DOM_SID_PREFIX_LEN) != 0) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek p = object_sid + DOM_SID_PREFIX_LEN;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek c = 0;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek do {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek errno = 0;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek a = strtoull(p, &endptr, 10);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (errno != 0 || a > UINT32_MAX) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (*endptr == '-') {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek p = endptr + 1;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek } else {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EINVAL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek c++;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek } while(c < 3);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* If we made it here, we are now one character past

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek *dom_sid_str = talloc_strndup(mem_ctx, object_sid,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek (endptr-object_sid));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (!*dom_sid_str) return ENOMEM;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return EOK;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek}

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozeksdap_idmap_sid_to_unix(struct sdap_idmap_ctx *idmap_ctx,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek const char *sid_str,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek id_t *id)

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek{

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek errno_t ret;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek enum idmap_error_code err;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek char *dom_sid_str = NULL;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Convert the SID into a UNIX ID */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err = sss_idmap_sid_to_unix(idmap_ctx->map,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek (uint32_t *)id);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek switch (err) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek case IDMAP_SUCCESS:

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek break;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek case IDMAP_NO_DOMAIN:

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* This is the first time we've seen this domain

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sdap_idmap_get_dom_sid_from_object(NULL, sid_str,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek &dom_sid_str);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != EOK) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not parse domain SID from [%s]\n", sid_str));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = sdap_idmap_add_domain(idmap_ctx,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek dom_sid_str, dom_sid_str,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek -1);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (ret != EOK) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not add new domain for sid [%s]\n", sid_str));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Now try converting to a UNIX ID again */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek err = sss_idmap_sid_to_unix(idmap_ctx->map,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek (uint32_t *)id);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek if (err != IDMAP_SUCCESS) {

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not convert objectSID [%s] to a UNIX ID\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EIO;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

129310e872a0a70e721ba59363e518176ef406d6Jakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek break;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek case IDMAP_BUILTIN_SID:

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_TRACE_FUNC,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Object SID [%s] is a built-in one.\n", sid_str));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* ENOTSUP indicates built-in SID */

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = ENOTSUP;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek break;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek default:

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek DEBUG(SSSDBG_MINOR_FAILURE,

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ("Could not convert objectSID [%s] to a UNIX ID\n",

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek sid_str));

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EIO;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek goto done;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek }

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek ret = EOK;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozekdone:

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek talloc_free(dom_sid_str);

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek return ret;

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek}

9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek