source/winbindd/winbindd_sid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - sid related functions
   5
   6    Copyright (C) Tim Potter 2000
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "winbindd.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_WINBIND
  27
  28 /* Convert a string  */
  29
  30 static void lookupsid_recv(void *private_data, bool success,
  31                            const char *dom_name, const char *name,
  32                            enum lsa_SidType type);
  33
  34 void winbindd_lookupsid(struct winbindd_cli_state *state)
  35 {
  36         DOM_SID sid;
  37
  38         /* Ensure null termination */
  39         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
  40
  41         DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state->pid,
  42                   state->request.data.sid));
  43
  44         if (!string_to_sid(&sid, state->request.data.sid)) {
  45                 DEBUG(5, ("%s not a SID\n", state->request.data.sid));
  46                 request_error(state);
  47                 return;
  48         }
  49
  50         winbindd_lookupsid_async(state->mem_ctx, &sid, lookupsid_recv, state);
  51 }
  52
  53 static void lookupsid_recv(void *private_data, bool success,
  54                            const char *dom_name, const char *name,
  55                            enum lsa_SidType type)
  56 {
  57         struct winbindd_cli_state *state =
  58                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
  59
  60         if (!success) {
  61                 DEBUG(5, ("lookupsid returned an error\n"));
  62                 request_error(state);
  63                 return;
  64         }
  65
  66         fstrcpy(state->response.data.name.dom_name, dom_name);
  67         fstrcpy(state->response.data.name.name, name);
  68         state->response.data.name.type = type;
  69         request_ok(state);
  70 }
  71
  72 /**
  73  * Look up the SID for a qualified name.
  74  **/
  75
  76 static void lookupname_recv(void *private_data, bool success,
  77                             const DOM_SID *sid, enum lsa_SidType type);
  78
  79 void winbindd_lookupname(struct winbindd_cli_state *state)
  80 {
  81         char *name_domain, *name_user;
  82         char *p;
  83
  84         /* Ensure null termination */
  85         state->request.data.name.dom_name[sizeof(state->request.data.name.dom_name)-1]='\0';
  86
  87         /* Ensure null termination */
  88         state->request.data.name.name[sizeof(state->request.data.name.name)-1]='\0';
  89
  90         /* cope with the name being a fully qualified name */
  91         p = strstr(state->request.data.name.name, lp_winbind_separator());
  92         if (p) {
  93                 *p = 0;
  94                 name_domain = state->request.data.name.name;
  95                 name_user = p+1;
  96         } else {
  97                 name_domain = state->request.data.name.dom_name;
  98                 name_user = state->request.data.name.name;
  99         }
 100
 101         DEBUG(3, ("[%5lu]: lookupname %s%s%s\n", (unsigned long)state->pid,
 102                   name_domain, lp_winbind_separator(), name_user));
 103
 104         winbindd_lookupname_async(state->mem_ctx, name_domain, name_user,
 105                                   lookupname_recv, WINBINDD_LOOKUPNAME,
 106                                   state);
 107 }
 108
 109 static void lookupname_recv(void *private_data, bool success,
 110                             const DOM_SID *sid, enum lsa_SidType type)
 111 {
 112         struct winbindd_cli_state *state =
 113                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 114
 115         if (!success) {
 116                 DEBUG(5, ("lookupname returned an error\n"));
 117                 request_error(state);
 118                 return;
 119         }
 120
 121         sid_to_fstring(state->response.data.sid.sid, sid);
 122         state->response.data.sid.type = type;
 123         request_ok(state);
 124         return;
 125 }
 126
 127 void winbindd_lookuprids(struct winbindd_cli_state *state)
 128 {
 129         struct winbindd_domain *domain;
 130         DOM_SID domain_sid;
 131
 132         /* Ensure null termination */
 133         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
 134
 135         DEBUG(10, ("lookup_rids: %s\n", state->request.data.sid));
 136
 137         if (!string_to_sid(&domain_sid, state->request.data.sid)) {
 138                 DEBUG(5, ("Could not convert %s to SID\n",
 139                           state->request.data.sid));
 140                 request_error(state);
 141                 return;
 142         }
 143
 144         domain = find_lookup_domain_from_sid(&domain_sid);
 145         if (domain == NULL) {
 146                 DEBUG(10, ("Could not find domain for name %s\n",
 147                            state->request.domain_name));
 148                 request_error(state);
 149                 return;
 150         }
 151
 152         sendto_domain(state, domain);
 153 }
 154
 155 /* Convert a sid to a uid.  We assume we only have one rid attached to the
 156    sid. */
 157
 158 static void sid2uid_recv(void *private_data, bool success, uid_t uid)
 159 {
 160         struct winbindd_cli_state *state =
 161                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 162
 163         if (!success) {
 164                 DEBUG(5, ("Could not convert sid %s\n",
 165                           state->request.data.sid));
 166                 request_error(state);
 167                 return;
 168         }
 169
 170         state->response.data.uid = uid;
 171         request_ok(state);
 172 }
 173
 174 static void sid2uid_lookupsid_recv( void *private_data, bool success,
 175                                     const char *domain_name,
 176                                     const char *name,
 177                                     enum lsa_SidType type)
 178 {
 179         struct winbindd_cli_state *state =
 180                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 181         DOM_SID sid;
 182
 183         if (!success) {
 184                 DEBUG(5, ("sid2uid_lookupsid_recv Could not convert get sid type for %s\n",
 185                           state->request.data.sid));
 186                 request_error(state);
 187                 return;
 188         }
 189
 190         if ( (type!=SID_NAME_USER) && (type!=SID_NAME_COMPUTER) ) {
 191                 DEBUG(5,("sid2uid_lookupsid_recv: Sid %s is not a user or a computer.\n",
 192                          state->request.data.sid));
 193                 request_error(state);
 194                 return;
 195         }
 196
 197         if (!string_to_sid(&sid, state->request.data.sid)) {
 198                 DEBUG(1, ("sid2uid_lookupsid_recv: Could not get convert sid %s from string\n",
 199                           state->request.data.sid));
 200                 request_error(state);
 201                 return;
 202         }
 203
 204         /* always use the async interface (may block) */
 205         winbindd_sid2uid_async(state->mem_ctx, &sid, sid2uid_recv, state);
 206 }
 207
 208 void winbindd_sid_to_uid(struct winbindd_cli_state *state)
 209 {
 210         DOM_SID sid;
 211
 212         /* Ensure null termination */
 213         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
 214
 215         DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state->pid,
 216                   state->request.data.sid));
 217
 218         if (!string_to_sid(&sid, state->request.data.sid)) {
 219                 DEBUG(1, ("Could not get convert sid %s from string\n",
 220                           state->request.data.sid));
 221                 request_error(state);
 222                 return;
 223         }
 224
 225         /* Validate the SID as a user.  Hopefully this will hit cache.
 226            Needed to prevent DoS by exhausting the uid allocation
 227            range from random SIDs. */
 228
 229         winbindd_lookupsid_async( state->mem_ctx, &sid, sid2uid_lookupsid_recv, state );
 230 }
 231
 232 /* Convert a sid to a gid.  We assume we only have one rid attached to the
 233    sid.*/
 234
 235 static void sid2gid_recv(void *private_data, bool success, gid_t gid)
 236 {
 237         struct winbindd_cli_state *state =
 238                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 239
 240         if (!success) {
 241                 DEBUG(5, ("Could not convert sid %s\n",
 242                           state->request.data.sid));
 243                 request_error(state);
 244                 return;
 245         }
 246
 247         state->response.data.gid = gid;
 248         request_ok(state);
 249 }
 250
 251 static void sid2gid_lookupsid_recv( void *private_data, bool success,
 252                                     const char *domain_name,
 253                                     const char *name,
 254                                     enum lsa_SidType type)
 255 {
 256         struct winbindd_cli_state *state =
 257                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 258         DOM_SID sid;
 259
 260         if (!success) {
 261                 DEBUG(5, ("sid2gid_lookupsid_recv: Could not get sid type for %s\n",
 262                           state->request.data.sid));
 263                 request_error(state);
 264                 return;
 265         }
 266
 267         if ( (type!=SID_NAME_DOM_GRP) &&
 268              (type!=SID_NAME_ALIAS) &&
 269              (type!=SID_NAME_WKN_GRP) )
 270         {
 271                 DEBUG(5,("sid2gid_lookupsid_recv: Sid %s is not a group.\n",
 272                          state->request.data.sid));
 273                 request_error(state);
 274                 return;
 275         }
 276
 277         if (!string_to_sid(&sid, state->request.data.sid)) {
 278                 DEBUG(1, ("sid2gid_lookupsid_recv: Could not get convert sid %s from string\n",
 279                           state->request.data.sid));
 280                 request_error(state);
 281                 return;
 282         }
 283
 284         /* always use the async interface (may block) */
 285         winbindd_sid2gid_async(state->mem_ctx, &sid, sid2gid_recv, state);
 286 }
 287
 288 void winbindd_sid_to_gid(struct winbindd_cli_state *state)
 289 {
 290         DOM_SID sid;
 291
 292         /* Ensure null termination */
 293         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
 294
 295         DEBUG(3, ("[%5lu]: sid to gid %s\n", (unsigned long)state->pid,
 296                   state->request.data.sid));
 297
 298         if (!string_to_sid(&sid, state->request.data.sid)) {
 299                 DEBUG(1, ("Could not get convert sid %s from string\n",
 300                           state->request.data.sid));
 301                 request_error(state);
 302                 return;
 303         }
 304
 305         /* Validate the SID as a group.  Hopefully this will hit cache.
 306            Needed to prevent DoS by exhausting the uid allocation
 307            range from random SIDs. */
 308
 309         winbindd_lookupsid_async( state->mem_ctx, &sid, sid2gid_lookupsid_recv, state );
 310 }
 311
 312 static void sids2xids_recv(void *private_data, bool success, void *data, int len)
 313 {
 314         struct winbindd_cli_state *state =
 315                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 316
 317         if (!success) {
 318                 DEBUG(5, ("Could not convert sids to xids\n"));
 319                 request_error(state);
 320                 return;
 321         }
 322
 323         state->response.extra_data.data = data;
 324         state->response.length = sizeof(state->response) + len;
 325         request_ok(state);
 326 }
 327
 328 void winbindd_sids_to_unixids(struct winbindd_cli_state *state)
 329 {
 330         DEBUG(3, ("[%5lu]: sids to xids\n", (unsigned long)state->pid));
 331
 332         winbindd_sids2xids_async(state->mem_ctx,
 333                         state->request.extra_data.data,
 334                         state->request.extra_len,
 335                         sids2xids_recv, state);
 336 }
 337
 338 static void set_mapping_recv(void *private_data, bool success)
 339 {
 340         struct winbindd_cli_state *state =
 341                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 342
 343         if (!success) {
 344                 DEBUG(5, ("Could not set sid mapping\n"));
 345                 request_error(state);
 346                 return;
 347         }
 348
 349         request_ok(state);
 350 }
 351
 352 void winbindd_set_mapping(struct winbindd_cli_state *state)
 353 {
 354         struct id_map map;
 355         DOM_SID sid;
 356
 357         DEBUG(3, ("[%5lu]: set id map\n", (unsigned long)state->pid));
 358
 359         if ( ! state->privileged) {
 360                 DEBUG(0, ("Only root is allowed to set mappings!\n"));
 361                 request_error(state);
 362                 return;
 363         }
 364
 365         if (!string_to_sid(&sid, state->request.data.dual_idmapset.sid)) {
 366                 DEBUG(1, ("Could not get convert sid %s from string\n",
 367                           state->request.data.sid));
 368                 request_error(state);
 369                 return;
 370         }
 371
 372         map.sid = &sid;
 373         map.xid.id = state->request.data.dual_idmapset.id;
 374         map.xid.type = state->request.data.dual_idmapset.type;
 375
 376         winbindd_set_mapping_async(state->mem_ctx, &map,
 377                         set_mapping_recv, state);
 378 }
 379
 380 static void set_hwm_recv(void *private_data, bool success)
 381 {
 382         struct winbindd_cli_state *state =
 383                 talloc_get_type_abort(private_data, struct winbindd_cli_state);
 384
 385         if (!success) {
 386                 DEBUG(5, ("Could not set sid mapping\n"));
 387                 request_error(state);
 388                 return;
 389         }
 390
 391         request_ok(state);
 392 }
 393
 394 void winbindd_set_hwm(struct winbindd_cli_state *state)
 395 {
 396         struct unixid xid;
 397
 398         DEBUG(3, ("[%5lu]: set hwm\n", (unsigned long)state->pid));
 399
 400         if ( ! state->privileged) {
 401                 DEBUG(0, ("Only root is allowed to set mappings!\n"));
 402                 request_error(state);
 403                 return;
 404         }
 405
 406         xid.id = state->request.data.dual_idmapset.id;
 407         xid.type = state->request.data.dual_idmapset.type;
 408
 409         winbindd_set_hwm_async(state->mem_ctx, &xid, set_hwm_recv, state);
 410 }
 411
 412 /* Convert a uid to a sid */
 413
 414 static void uid2sid_recv(void *private_data, bool success, const char *sid)
 415 {
 416         struct winbindd_cli_state *state =
 417                 (struct winbindd_cli_state *)private_data;
 418
 419         if (success) {
 420                 DEBUG(10,("uid2sid: uid %lu has sid %s\n",
 421                           (unsigned long)(state->request.data.uid), sid));
 422                 fstrcpy(state->response.data.sid.sid, sid);
 423                 state->response.data.sid.type = SID_NAME_USER;
 424                 request_ok(state);
 425                 return;
 426         }
 427
 428         request_error(state);
 429         return;
 430 }
 431
 432 void winbindd_uid_to_sid(struct winbindd_cli_state *state)
 433 {
 434         DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state->pid,
 435                   (unsigned long)state->request.data.uid));
 436
 437         /* always go via the async interface (may block) */
 438         winbindd_uid2sid_async(state->mem_ctx, state->request.data.uid, uid2sid_recv, state);
 439 }
 440
 441 /* Convert a gid to a sid */
 442
 443 static void gid2sid_recv(void *private_data, bool success, const char *sid)
 444 {
 445         struct winbindd_cli_state *state =
 446                 (struct winbindd_cli_state *)private_data;
 447
 448         if (success) {
 449                 DEBUG(10,("gid2sid: gid %lu has sid %s\n",
 450                           (unsigned long)(state->request.data.gid), sid));
 451                 fstrcpy(state->response.data.sid.sid, sid);
 452                 state->response.data.sid.type = SID_NAME_DOM_GRP;
 453                 request_ok(state);
 454                 return;
 455         }
 456
 457         request_error(state);
 458         return;
 459 }
 460
 461
 462 void winbindd_gid_to_sid(struct winbindd_cli_state *state)
 463 {
 464         DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state->pid,
 465                   (unsigned long)state->request.data.gid));
 466
 467         /* always use async calls (may block) */
 468         winbindd_gid2sid_async(state->mem_ctx, state->request.data.gid, gid2sid_recv, state);
 469 }
 470
 471 void winbindd_allocate_uid(struct winbindd_cli_state *state)
 472 {
 473         if ( !state->privileged ) {
 474                 DEBUG(2, ("winbindd_allocate_uid: non-privileged access "
 475                           "denied!\n"));
 476                 request_error(state);
 477                 return;
 478         }
 479
 480         sendto_child(state, idmap_child());
 481 }
 482
 483 enum winbindd_result winbindd_dual_allocate_uid(struct winbindd_domain *domain,
 484                                                 struct winbindd_cli_state *state)
 485 {
 486         struct unixid xid;
 487
 488         if (!NT_STATUS_IS_OK(idmap_allocate_uid(&xid))) {
 489                 return WINBINDD_ERROR;
 490         }
 491         state->response.data.uid = xid.id;
 492         return WINBINDD_OK;
 493 }
 494
 495 void winbindd_allocate_gid(struct winbindd_cli_state *state)
 496 {
 497         if ( !state->privileged ) {
 498                 DEBUG(2, ("winbindd_allocate_gid: non-privileged access "
 499                           "denied!\n"));
 500                 request_error(state);
 501                 return;
 502         }
 503
 504         sendto_child(state, idmap_child());
 505 }
 506
 507 enum winbindd_result winbindd_dual_allocate_gid(struct winbindd_domain *domain,
 508                                                 struct winbindd_cli_state *state)
 509 {
 510         struct unixid xid;
 511
 512         if (!NT_STATUS_IS_OK(idmap_allocate_gid(&xid))) {
 513                 return WINBINDD_ERROR;
 514         }
 515         state->response.data.gid = xid.id;
 516         return WINBINDD_OK;
 517 }