Adding upstream version 2:4.17.12+dfsg.upstream/2%4.17.12+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 442 insertions, 0 deletions

diff --git a/source3/lib/idmap_cache.c b/source3/lib/idmap_cache.c
new file mode 100644
index 0000000..a4b8861
--- /dev/null
+++ b/source3/lib/idmap_cache.c
@@ -0,0 +1,442 @@
+/*
+   Unix SMB/CIFS implementation.
+   ID Mapping Cache
+
+   Copyright (C) Volker Lendecke	2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.*/
+
+#include "includes.h"
+#include "idmap_cache.h"
+#include "../libcli/security/security.h"
+#include "../librpc/gen_ndr/idmap.h"
+#include "lib/gencache.h"
+#include "lib/util/string_wrappers.h"
+
+/**
+ * Find a sid2xid mapping
+ * @param[in] sid		the sid to map
+ * @param[out] id		where to put the result
+ * @param[out] expired		is the cache entry expired?
+ * @retval Was anything in the cache at all?
+ *
+ * If id->id == -1 this was a negative mapping.
+ */
+
+bool idmap_cache_find_sid2unixid(const struct dom_sid *sid, struct unixid *id,
+				 bool *expired)
+{
+	struct dom_sid_buf sidstr;
+	char *key;
+	char *value = NULL;
+	char *endptr;
+	time_t timeout;
+	bool ret;
+	struct unixid tmp_id;
+
+	key = talloc_asprintf(talloc_tos(), "IDMAP/SID2XID/%s",
+			      dom_sid_str_buf(sid, &sidstr));
+	if (key == NULL) {
+		return false;
+	}
+	ret = gencache_get(key, talloc_tos(), &value, &timeout);
+	if (!ret) {
+		goto done;
+	}
+
+	DEBUG(10, ("Parsing value for key [%s]: value=[%s]\n", key, value));
+
+	if (value[0] == '\0') {
+		DEBUG(0, ("Failed to parse value for key [%s]: "
+			  "value is empty\n", key));
+		ret = false;
+		goto done;
+	}
+
+	tmp_id.id = strtol(value, &endptr, 10);
+
+	if ((value == endptr) && (tmp_id.id == 0)) {
+		DEBUG(0, ("Failed to parse value for key [%s]: value[%s] does "
+			  "not start with a number\n", key, value));
+		ret = false;
+		goto done;
+	}
+
+	DEBUG(10, ("Parsing value for key [%s]: id=[%llu], endptr=[%s]\n",
+		   key, (unsigned long long)tmp_id.id, endptr));
+
+	ret = (*endptr == ':');
+	if (ret) {
+		switch (endptr[1]) {
+		case 'U':
+			tmp_id.type = ID_TYPE_UID;
+			break;
+
+		case 'G':
+			tmp_id.type = ID_TYPE_GID;
+			break;
+
+		case 'B':
+			tmp_id.type = ID_TYPE_BOTH;
+			break;
+
+		case 'N':
+			tmp_id.type = ID_TYPE_NOT_SPECIFIED;
+			break;
+
+		case '\0':
+			DEBUG(0, ("FAILED to parse value for key [%s] "
+				  "(id=[%llu], endptr=[%s]): "
+				  "no type character after colon\n",
+				  key, (unsigned long long)tmp_id.id, endptr));
+			ret = false;
+			goto done;
+		default:
+			DEBUG(0, ("FAILED to parse value for key [%s] "
+				  "(id=[%llu], endptr=[%s]): "
+				  "illegal type character '%c'\n",
+				  key, (unsigned long long)tmp_id.id, endptr,
+				  endptr[1]));
+			ret = false;
+			goto done;
+		}
+		if (endptr[2] != '\0') {
+			DEBUG(0, ("FAILED to parse value for key [%s] "
+				  "(id=[%llu], endptr=[%s]): "
+				  "more than 1 type character after colon\n",
+				  key, (unsigned long long)tmp_id.id, endptr));
+			ret = false;
+			goto done;
+		}
+
+		*id = tmp_id;
+		*expired = (timeout <= time(NULL));
+	} else {
+		DEBUG(0, ("FAILED to parse value for key [%s] (value=[%s]): "
+			  "colon missing after id=[%llu]\n",
+			  key, value, (unsigned long long)tmp_id.id));
+	}
+
+done:
+	TALLOC_FREE(key);
+	TALLOC_FREE(value);
+	return ret;
+}
+
+/**
+ * Find a sid2uid mapping
+ * @param[in] sid		the sid to map
+ * @param[out] puid		where to put the result
+ * @param[out] expired		is the cache entry expired?
+ * @retval Was anything in the cache at all?
+ *
+ * If *puid == -1 this was a negative mapping.
+ */
+
+bool idmap_cache_find_sid2uid(const struct dom_sid *sid, uid_t *puid,
+			      bool *expired)
+{
+	bool ret;
+	struct unixid id;
+	ret = idmap_cache_find_sid2unixid(sid, &id, expired);
+	if (!ret) {
+		return false;
+	}
+
+	if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_UID) {
+		*puid = id.id;
+	} else {
+		*puid = -1;
+	}
+	return true;
+}
+
+/**
+ * Find a sid2gid mapping
+ * @param[in] sid		the sid to map
+ * @param[out] pgid		where to put the result
+ * @param[out] expired		is the cache entry expired?
+ * @retval Was anything in the cache at all?
+ *
+ * If *pgid == -1 this was a negative mapping.
+ */
+
+bool idmap_cache_find_sid2gid(const struct dom_sid *sid, gid_t *pgid,
+			      bool *expired)
+{
+	bool ret;
+	struct unixid id;
+	ret = idmap_cache_find_sid2unixid(sid, &id, expired);
+	if (!ret) {
+		return false;
+	}
+
+	if (id.type == ID_TYPE_BOTH || id.type == ID_TYPE_GID) {
+		*pgid = id.id;
+	} else {
+		*pgid = -1;
+	}
+	return true;
+}
+
+struct idmap_cache_xid2sid_state {
+	struct dom_sid *sid;
+	bool *expired;
+	bool ret;
+};
+
+static void idmap_cache_xid2sid_parser(const struct gencache_timeout *timeout,
+				       DATA_BLOB blob,
+				       void *private_data)
+{
+	struct idmap_cache_xid2sid_state *state =
+		(struct idmap_cache_xid2sid_state *)private_data;
+	char *value;
+
+	if ((blob.length == 0) || (blob.data[blob.length-1] != 0)) {
+		/*
+		 * Not a string, can't be a valid mapping
+		 */
+		state->ret = false;
+		return;
+	}
+
+	value = (char *)blob.data;
+
+	if ((value[0] == '-') && (value[1] == '\0')) {
+		/*
+		 * Return NULL SID, see comment to uid2sid
+		 */
+		*state->sid = (struct dom_sid) {0};
+		state->ret = true;
+	} else {
+		state->ret = string_to_sid(state->sid, value);
+	}
+	if (state->ret) {
+		*state->expired = gencache_timeout_expired(timeout);
+	}
+}
+
+/**
+ * Find a xid2sid mapping
+ * @param[in] id		the unix id to map
+ * @param[out] sid		where to put the result
+ * @param[out] expired		is the cache entry expired?
+ * @retval Was anything in the cache at all?
+ *
+ * If "is_null_sid(sid)", this was a negative mapping.
+ */
+bool idmap_cache_find_xid2sid(
+	const struct unixid *id, struct dom_sid *sid, bool *expired)
+{
+	struct idmap_cache_xid2sid_state state = {
+		.sid = sid, .expired = expired
+	};
+	fstring key;
+	char c;
+
+	switch (id->type) {
+	case ID_TYPE_UID:
+		c = 'U';
+		break;
+	case ID_TYPE_GID:
+		c = 'G';
+		break;
+	default:
+		return false;
+	}
+
+	fstr_sprintf(key, "IDMAP/%cID2SID/%d", c, (int)id->id);
+
+	gencache_parse(key, idmap_cache_xid2sid_parser, &state);
+	return state.ret;
+}
+
+
+/**
+ * Store a mapping in the idmap cache
+ * @param[in] sid		the sid to map
+ * @param[in] unix_id		the unix_id to map
+ *
+ * If both parameters are valid values, then a positive mapping in both
+ * directions is stored. If "is_null_sid(sid)" is true, then this will be a
+ * negative mapping of xid, we want to cache that for this xid we could not
+ * find anything. Likewise if "xid==-1", then we want to cache that we did not
+ * find a mapping for the sid passed here.
+ */
+
+void idmap_cache_set_sid2unixid(const struct dom_sid *sid, struct unixid *unix_id)
+{
+	time_t now = time(NULL);
+	time_t timeout;
+	fstring key, value;
+
+	if (!is_null_sid(sid)) {
+		struct dom_sid_buf sidstr;
+		fstr_sprintf(key, "IDMAP/SID2XID/%s",
+			     dom_sid_str_buf(sid, &sidstr));
+		switch (unix_id->type) {
+		case ID_TYPE_UID:
+			fstr_sprintf(value, "%d:U", (int)unix_id->id);
+			break;
+		case ID_TYPE_GID:
+			fstr_sprintf(value, "%d:G", (int)unix_id->id);
+			break;
+		case ID_TYPE_BOTH:
+			fstr_sprintf(value, "%d:B", (int)unix_id->id);
+			break;
+		case ID_TYPE_NOT_SPECIFIED:
+			fstr_sprintf(value, "%d:N", (int)unix_id->id);
+			break;
+		default:
+			return;
+		}
+		timeout = (unix_id->id == -1)
+			? lp_idmap_negative_cache_time()
+			: lp_idmap_cache_time();
+		gencache_set(key, value, now + timeout);
+	}
+	if (unix_id->id != -1) {
+		if (is_null_sid(sid)) {
+			/* negative xid mapping */
+			fstrcpy(value, "-");
+			timeout = lp_idmap_negative_cache_time();
+		}
+		else {
+			sid_to_fstring(value, sid);
+			timeout = lp_idmap_cache_time();
+		}
+		switch (unix_id->type) {
+		case ID_TYPE_BOTH:
+			fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
+			gencache_set(key, value, now + timeout);
+			fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
+			gencache_set(key, value, now + timeout);
+			return;
+
+		case ID_TYPE_UID:
+			fstr_sprintf(key, "IDMAP/UID2SID/%d", (int)unix_id->id);
+			break;
+
+		case ID_TYPE_GID:
+			fstr_sprintf(key, "IDMAP/GID2SID/%d", (int)unix_id->id);
+			break;
+
+		default:
+			return;
+		}
+		gencache_set(key, value, now + timeout);
+	}
+}
+
+static char* key_xid2sid_str(TALLOC_CTX* mem_ctx, char t, const char* id) {
+	return talloc_asprintf(mem_ctx, "IDMAP/%cID2SID/%s", t, id);
+}
+
+static char* key_xid2sid(TALLOC_CTX* mem_ctx, char t, int id) {
+	char str[32];
+	snprintf(str, sizeof(str), "%d", id);
+	return key_xid2sid_str(mem_ctx, t, str);
+}
+
+static char* key_sid2xid_str(TALLOC_CTX* mem_ctx, const char* id) {
+	return talloc_asprintf(mem_ctx, "IDMAP/SID2XID/%s", id);
+}
+
+static bool idmap_cache_del_xid(char t, int xid)
+{
+	TALLOC_CTX* mem_ctx = talloc_stackframe();
+	const char* key = key_xid2sid(mem_ctx, t, xid);
+	char* sid_str = NULL;
+	time_t timeout;
+	bool ret = true;
+
+	if (!gencache_get(key, mem_ctx, &sid_str, &timeout)) {
+		DEBUG(3, ("no entry: %s\n", key));
+		ret = false;
+		goto done;
+	}
+
+	if (sid_str[0] != '-') {
+		const char* sid_key = key_sid2xid_str(mem_ctx, sid_str);
+		if (!gencache_del(sid_key)) {
+			DEBUG(2, ("failed to delete: %s\n", sid_key));
+			ret = false;
+		} else {
+			DEBUG(5, ("delete: %s\n", sid_key));
+		}
+
+	}
+
+	if (!gencache_del(key)) {
+		DEBUG(1, ("failed to delete: %s\n", key));
+		ret = false;
+	} else {
+		DEBUG(5, ("delete: %s\n", key));
+	}
+
+done:
+	talloc_free(mem_ctx);
+	return ret;
+}
+
+bool idmap_cache_del_uid(uid_t uid) {
+	return idmap_cache_del_xid('U', uid);
+}
+
+bool idmap_cache_del_gid(gid_t gid) {
+	return idmap_cache_del_xid('G', gid);
+}
+
+bool idmap_cache_del_sid(const struct dom_sid *sid)
+{
+	TALLOC_CTX* mem_ctx = talloc_stackframe();
+	bool ret = true;
+	bool expired;
+	struct unixid id;
+	struct dom_sid_buf sidbuf;
+	const char *sid_key;
+
+	if (!idmap_cache_find_sid2unixid(sid, &id, &expired)) {
+		ret = false;
+		goto done;
+	}
+
+	if (id.id != -1) {
+		switch (id.type) {
+		case ID_TYPE_BOTH:
+			idmap_cache_del_xid('U', id.id);
+			idmap_cache_del_xid('G', id.id);
+			break;
+		case ID_TYPE_UID:
+			idmap_cache_del_xid('U', id.id);
+			break;
+		case ID_TYPE_GID:
+			idmap_cache_del_xid('G', id.id);
+			break;
+		default:
+			break;
+		}
+	}
+
+	sid_key = key_sid2xid_str(mem_ctx, dom_sid_str_buf(sid, &sidbuf));
+	if (sid_key == NULL) {
+		return false;
+	}
+	/* If the mapping was symmetric, then this should fail */
+	gencache_del(sid_key);
+done:
+	talloc_free(mem_ctx);
+	return ret;
+}