LDAP: Add helper routines for ID-mapping

3 files changed, 340 insertions, 2 deletions

diff --git a/Makefile.am b/Makefile.am
index d31515e9..348ad278 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1096,6 +1096,8 @@ libsss_ldap_common_la_SOURCES = \
     src/providers/ldap/sdap_child_helpers.c \
     src/providers/ldap/sdap_fd_events.c \
     src/providers/ldap/sdap_id_op.c \
+    src/providers/ldap/sdap_idmap.c \
+    src/providers/ldap/sdap_idmap.h \
     src/providers/ldap/sdap.c
 
 if BUILD_SUDO
@@ -1140,7 +1142,8 @@ libsss_ldap_la_LIBADD = \
     $(DHASH_LIBS) \
     $(KRB5_LIBS) \
     libsss_util.la \
-    libsss_ldap_common.la
+    libsss_ldap_common.la \
+    libsss_idmap.la
 libsss_ldap_la_LDFLAGS = \
     -avoid-version \
     -module
@@ -1231,7 +1234,8 @@ libsss_ipa_la_LIBADD = \
     libsss_util.la \
     libsss_ldap_common.la \
     libsss_krb5_common.la \
-    libipa_hbac.la
+    libipa_hbac.la \
+    libsss_idmap.la
 libsss_ipa_la_LDFLAGS = \
     -avoid-version \
     -module
diff --git a/src/providers/ldap/sdap_idmap.c b/src/providers/ldap/sdap_idmap.c
new file mode 100644
index 00000000..ea65195a
--- /dev/null
+++ b/src/providers/ldap/sdap_idmap.c
@@ -0,0 +1,282 @@
+/*
+    SSSD
+
+    Authors:
+        Stephen Gallagher <sgallagh@redhat.com>
+
+    Copyright (C) 2012 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "util/util.h"
+#include "util/dlinklist.h"
+#include "util/murmurhash3.h"
+#include "providers/ldap/sdap_idmap.h"
+
+static void *
+sdap_idmap_talloc(size_t size, void *pvt)
+{
+    return talloc_size(pvt, size);
+}
+
+static void
+sdap_idmap_talloc_free(void *ptr, void *pvt)
+{
+    talloc_free(ptr);
+}
+
+errno_t
+sdap_idmap_init(TALLOC_CTX *mem_ctx,
+                struct sdap_id_ctx *id_ctx,
+                struct sdap_idmap_ctx **_idmap_ctx)
+{
+    errno_t ret;
+    TALLOC_CTX *tmp_ctx;
+    enum idmap_error_code err;
+    size_t i;
+    struct ldb_result *res;
+    const char *dom_name;
+    const char *sid_str;
+    id_t slice_num;
+    struct sdap_idmap_ctx *idmap_ctx = NULL;
+    struct sysdb_ctx *sysdb = id_ctx->be->sysdb;
+
+    tmp_ctx = talloc_new(NULL);
+    if (!tmp_ctx) return ENOMEM;
+
+    idmap_ctx = talloc_zero(tmp_ctx, struct sdap_idmap_ctx);
+    if (!idmap_ctx) {
+        ret = ENOMEM;
+        goto done;
+    }
+    idmap_ctx->id_ctx = id_ctx;
+
+    /* Initialize the map */
+    err = sss_idmap_init(sdap_idmap_talloc, idmap_ctx,
+                         sdap_idmap_talloc_free,
+                         &idmap_ctx->map);
+    if (err != IDMAP_SUCCESS) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("Could not initialize the ID map: [%s]\n",
+               idmap_error_string(err)));
+        if (err == IDMAP_OUT_OF_MEMORY) {
+            ret = ENOMEM;
+        } else {
+            ret = EINVAL;
+        }
+        goto done;
+    }
+
+    /* Read in any existing mappings from the cache */
+    ret = sysdb_idmap_get_mappings(tmp_ctx, sysdb, &res);
+    if (ret != EOK && ret != ENOENT) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              ("Could not read ID mappings from the cache: [%s]\n",
+               strerror(ret)));
+        goto done;
+    }
+
+    if (ret == EOK && res->count > 0) {
+        DEBUG(SSSDBG_CONF_SETTINGS,
+              ("Initializing [%d] domains for ID-mapping\n", res->count));
+
+        for (i = 0; i < res->count; i++) {
+            dom_name = ldb_msg_find_attr_as_string(res->msgs[i],
+                                                   SYSDB_NAME,
+                                                   NULL);
+            if (!dom_name) {
+                /* This should never happen */
+                ret = EINVAL;
+                goto done;
+            }
+
+            sid_str = ldb_msg_find_attr_as_string(res->msgs[i],
+                                                  SYSDB_IDMAP_SID_ATTR,
+                                                  NULL);
+            if (!sid_str) {
+                /* This should never happen */
+                ret = EINVAL;
+                goto done;
+            }
+
+            slice_num = ldb_msg_find_attr_as_int(res->msgs[i],
+                                                 SYSDB_IDMAP_SLICE_ATTR,
+                                                 -1);
+            if (slice_num == -1) {
+                /* This should never happen */
+                ret = EINVAL;
+                goto done;
+            }
+
+            ret = sdap_idmap_add_domain(idmap_ctx, dom_name,
+                                        sid_str, slice_num);
+            if (ret != EOK) {
+                DEBUG(SSSDBG_CRIT_FAILURE,
+                      ("Could not add domain [%s][%s][%u] to ID map: [%s]\n",
+                       dom_name, sid_str, slice_num, strerror(ret)));
+                goto done;
+            }
+        }
+    }
+
+    *_idmap_ctx = talloc_steal(mem_ctx, idmap_ctx);
+    ret = EOK;
+
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+errno_t
+sdap_idmap_add_domain(struct sdap_idmap_ctx *idmap_ctx,
+                      const char *dom_name,
+                      const char *dom_sid,
+                      id_t slice)
+{
+    errno_t ret;
+    struct sdap_idmap_slice *new_slice;
+    id_t idmap_lower;
+    id_t idmap_upper;
+    id_t rangesize;
+    id_t max_slices;
+    id_t orig_slice;
+    uint32_t hash_val;
+    struct sdap_idmap_slice *s;
+    struct sss_idmap_range range;
+    enum idmap_error_code err;
+
+    idmap_lower = dp_opt_get_int(idmap_ctx->id_ctx->opts->basic,
+                                 SDAP_IDMAP_LOWER);
+    idmap_upper = dp_opt_get_int(idmap_ctx->id_ctx->opts->basic,
+                                 SDAP_IDMAP_UPPER);
+    rangesize = dp_opt_get_int(idmap_ctx->id_ctx->opts->basic,
+                               SDAP_IDMAP_RANGESIZE);
+
+    /* Validate that the values make sense */
+    if (rangesize <= 0
+            || idmap_upper <= idmap_lower
+            || (idmap_upper-idmap_lower) < rangesize)
+    {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("Invalid settings for range selection: [%d][%d][%d]\n",
+               idmap_lower, idmap_upper, rangesize));
+        return EINVAL;
+    }
+
+    max_slices = (idmap_upper - idmap_lower + 1) / rangesize;
+    if (((idmap_upper - idmap_lower + 1) % rangesize) != 0) {
+        DEBUG(SSSDBG_CONF_SETTINGS,
+              ("Range size does not divide evenly. Uppermost range will "
+               "not be used\n"));
+    }
+
+    new_slice = talloc_zero(idmap_ctx, struct sdap_idmap_slice);
+    if (!new_slice) return ENOMEM;
+
+    if (slice != -1) {
+        /* The slice is being set explicitly.
+         * This may happen at system startup when we're loading
+         * previously-determined slices. In the future, we may also
+         * permit configuration to select the slice for a domain
+         * explicitly.
+         */
+        new_slice->slice_num = slice;
+    } else {
+        /* If slice is -1, we're being asked to pick a new slice */
+
+        /* Hash the domain sid string */
+        hash_val = murmurhash3(dom_sid, strlen(dom_sid), 0xdeadbeef);
+
+        /* Now get take the modulus of the hash val and the max_slices
+         * to determine its optimal position in the range.
+         */
+        new_slice->slice_num = hash_val % max_slices;
+        orig_slice = new_slice->slice_num;
+
+        /* Verify that this slice is not already in use */
+        do {
+            DLIST_FOR_EACH(s, idmap_ctx->slices) {
+                if (s->slice_num == new_slice->slice_num) {
+                    /* This slice number matches one already registered
+                     * We'll try the next available slot
+                     */
+                    new_slice->slice_num++;
+                    if (new_slice->slice_num > max_slices) {
+                        /* loop around to the beginning if necessary */
+                        new_slice->slice_num = 0;
+                    }
+                    break;
+                }
+            }
+
+            /* Keep trying until s is NULL (meaning we got to the end
+             * without matching) or we have run out of slices and gotten
+             * back to the first one we tried.
+             */
+        } while (s && new_slice->slice_num != orig_slice);
+
+        if (s) {
+            /* We looped all the way through and found no empty slots */
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  ("Could not add domain [%s]: no free slices\n",
+                   dom_name));
+            ret = ENOSPC;
+            goto done;
+        }
+    }
+
+    DEBUG(SSSDBG_CONF_SETTINGS,
+          ("Adding domain [%s] as slice [%d]\n",
+           dom_name, new_slice->slice_num));
+
+    DLIST_ADD_END(idmap_ctx->slices, new_slice, struct sdap_idmap_slice *);
+    /* Not adding a destructor to remove from this list, because it
+     * should never be possible. Removal from this list can only
+     * destabilize the system.
+     */
+
+    /* Create a range object to add to the mapping */
+    range.min = (rangesize * new_slice->slice_num) + idmap_lower;
+    range.max = range.min + rangesize;
+
+    if (range.max > idmap_upper) {
+        /* This should never happen */
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("BUG: Range maximum exceeds the global maximum: %d > %d\n",
+               range.max, idmap_upper));
+        ret = EINVAL;
+        goto done;
+    }
+
+    /* Add this domain to the map */
+    err = sss_idmap_add_domain(idmap_ctx->map, dom_name, dom_sid, &range);
+    if (err != IDMAP_SUCCESS) {
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("Could not add domain [%s] to the map: [%d]\n",
+               dom_name, err));
+        ret = EIO;
+        goto done;
+    }
+
+    /* Add this domain to the SYSDB cache so it will survive reboot */
+    ret = sysdb_idmap_store_mapping(idmap_ctx->id_ctx->be->sysdb,
+                                    dom_name, dom_sid,
+                                    new_slice->slice_num);
+done:
+    if (ret != EOK) {
+        talloc_free(new_slice);
+    }
+    return ret;
+}
diff --git a/src/providers/ldap/sdap_idmap.h b/src/providers/ldap/sdap_idmap.h
new file mode 100644
index 00000000..9ac8be13
--- /dev/null
+++ b/src/providers/ldap/sdap_idmap.h
@@ -0,0 +1,52 @@
+/*
+    SSSD
+
+    Authors:
+        Stephen Gallagher <sgallagh@redhat.com>
+
+    Copyright (C) 2012 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef SDAP_IDMAP_H_
+#define SDAP_IDMAP_H_
+
+#include "src/providers/ldap/sdap.h"
+#include "src/providers/ldap/ldap_common.h"
+
+struct sdap_idmap_slice {
+    struct sdap_idmap_slice *prev;
+    struct sdap_idmap_slice *next;
+
+    id_t slice_num;
+};
+
+struct sdap_idmap_ctx {
+    struct sss_idmap_ctx *map;
+    struct sdap_idmap_slice *slices;
+
+    struct sdap_id_ctx *id_ctx;
+};
+
+errno_t sdap_idmap_init(TALLOC_CTX *mem_ctx,
+                        struct sdap_id_ctx *id_ctx,
+                        struct sdap_idmap_ctx **_idmap_ctx);
+
+errno_t
+sdap_idmap_add_domain(struct sdap_idmap_ctx *idmap_ctx,
+                      const char *dom_name,
+                      const char *dom_sid,
+                      id_t slice);
+#endif /* SDAP_IDMAP_H_ */