source/nsswitch/wb_client.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    winbind client code
   5
   6    Copyright (C) Tim Potter 2000
   7    Copyright (C) Andrew Tridgell 2000
   8
   9    This library is free software; you can redistribute it and/or
  10    modify it under the terms of the GNU Library General Public
  11    License as published by the Free Software Foundation; either
  12    version 2 of the License, or (at your option) any later version.
  13
  14    This library is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17    Library General Public License for more details.
  18
  19    You should have received a copy of the GNU Library General Public
  20    License along with this library; if not, write to the
  21    Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  22    Boston, MA  02111-1307, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "nsswitch/sys_nss.h"
  27
  28 NSS_STATUS winbindd_request(int req_type,
  29                                  struct winbindd_request *request,
  30                                  struct winbindd_response *response);
  31
  32 static BOOL parse_domain_user(const char *domuser, fstring domain, fstring user)
  33 {
  34         char *p = strchr(domuser,*lp_winbind_separator());
  35
  36         if (!p)
  37                 return False;
  38
  39         fstrcpy(user, p+1);
  40         fstrcpy(domain, domuser);
  41         domain[PTR_DIFF(p, domuser)] = 0;
  42         strupper_unix(domain);
  43         return True;
  44 }
  45
  46 /* Call winbindd to convert a name to a sid */
  47
  48 BOOL winbind_lookup_name(const char *dom_name, const char *name, DOM_SID *sid,
  49                          enum SID_NAME_USE *name_type)
  50 {
  51         struct winbindd_request request;
  52         struct winbindd_response response;
  53         NSS_STATUS result;
  54
  55         if (!sid || !name_type)
  56                 return False;
  57
  58         /* Send off request */
  59
  60         ZERO_STRUCT(request);
  61         ZERO_STRUCT(response);
  62
  63         if (dom_name == NULL) {
  64                 if (!parse_domain_user(name, request.data.name.dom_name, request.data.name.name))
  65                         return False;
  66         } else {
  67                 fstrcpy(request.data.name.dom_name, dom_name);
  68                 fstrcpy(request.data.name.name, name);
  69         }
  70
  71         if ((result = winbindd_request(WINBINDD_LOOKUPNAME, &request,
  72                                        &response)) == NSS_STATUS_SUCCESS) {
  73                 string_to_sid(sid, response.data.sid.sid);
  74                 *name_type = (enum SID_NAME_USE)response.data.sid.type;
  75         }
  76
  77         return result == NSS_STATUS_SUCCESS;
  78 }
  79
  80 /* Call winbindd to convert sid to name */
  81
  82 BOOL winbind_lookup_sid(DOM_SID *sid,
  83                         fstring dom_name, fstring name,
  84                         enum SID_NAME_USE *name_type)
  85 {
  86         struct winbindd_request request;
  87         struct winbindd_response response;
  88         NSS_STATUS result;
  89         fstring sid_str;
  90
  91         /* Initialise request */
  92
  93         ZERO_STRUCT(request);
  94         ZERO_STRUCT(response);
  95
  96         sid_to_string(sid_str, sid);
  97         fstrcpy(request.data.sid, sid_str);
  98
  99         /* Make request */
 100
 101         result = winbindd_request(WINBINDD_LOOKUPSID, &request, &response);
 102
 103         /* Copy out result */
 104
 105         if (result == NSS_STATUS_SUCCESS) {
 106                 fstrcpy(dom_name, response.data.name.dom_name);
 107                 fstrcpy(name, response.data.name.name);
 108                 *name_type = (enum SID_NAME_USE)response.data.name.type;
 109
 110                 DEBUG(10, ("winbind_lookup_sid: SUCCESS: SID %s -> %s %s\n",
 111                            sid_str, dom_name, name));
 112         }
 113
 114         return (result == NSS_STATUS_SUCCESS);
 115 }
 116
 117 /* Call winbindd to convert SID to uid */
 118
 119 BOOL winbind_sid_to_uid(uid_t *puid, DOM_SID *sid)
 120 {
 121         struct winbindd_request request;
 122         struct winbindd_response response;
 123         int result;
 124         fstring sid_str;
 125
 126         if (!puid)
 127                 return False;
 128
 129         /* Initialise request */
 130
 131         ZERO_STRUCT(request);
 132         ZERO_STRUCT(response);
 133
 134         sid_to_string(sid_str, sid);
 135         fstrcpy(request.data.sid, sid_str);
 136
 137         /* Make request */
 138
 139         result = winbindd_request(WINBINDD_SID_TO_UID, &request, &response);
 140
 141         /* Copy out result */
 142
 143         if (result == NSS_STATUS_SUCCESS) {
 144                 *puid = response.data.uid;
 145         }
 146
 147         return (result == NSS_STATUS_SUCCESS);
 148 }
 149
 150 /* Call winbindd to convert uid to sid */
 151
 152 BOOL winbind_uid_to_sid(DOM_SID *sid, uid_t uid)
 153 {
 154         struct winbindd_request request;
 155         struct winbindd_response response;
 156         int result;
 157
 158         if (!sid)
 159                 return False;
 160
 161         /* Initialise request */
 162
 163         ZERO_STRUCT(request);
 164         ZERO_STRUCT(response);
 165
 166         request.data.uid = uid;
 167
 168         /* Make request */
 169
 170         result = winbindd_request(WINBINDD_UID_TO_SID, &request, &response);
 171
 172         /* Copy out result */
 173
 174         if (result == NSS_STATUS_SUCCESS) {
 175                 string_to_sid(sid, response.data.sid.sid);
 176         } else {
 177                 sid_copy(sid, &global_sid_NULL);
 178         }
 179
 180         return (result == NSS_STATUS_SUCCESS);
 181 }
 182
 183 /* Call winbindd to convert SID to gid */
 184
 185 BOOL winbind_sid_to_gid(gid_t *pgid, DOM_SID *sid)
 186 {
 187         struct winbindd_request request;
 188         struct winbindd_response response;
 189         int result;
 190         fstring sid_str;
 191
 192         if (!pgid)
 193                 return False;
 194
 195         /* Initialise request */
 196
 197         ZERO_STRUCT(request);
 198         ZERO_STRUCT(response);
 199
 200         sid_to_string(sid_str, sid);
 201         fstrcpy(request.data.sid, sid_str);
 202
 203         /* Make request */
 204
 205         result = winbindd_request(WINBINDD_SID_TO_GID, &request, &response);
 206
 207         /* Copy out result */
 208
 209         if (result == NSS_STATUS_SUCCESS) {
 210                 *pgid = response.data.gid;
 211         }
 212
 213         return (result == NSS_STATUS_SUCCESS);
 214 }
 215
 216 /* Call winbindd to convert gid to sid */
 217
 218 BOOL winbind_gid_to_sid(DOM_SID *sid, gid_t gid)
 219 {
 220         struct winbindd_request request;
 221         struct winbindd_response response;
 222         int result;
 223
 224         if (!sid)
 225                 return False;
 226
 227         /* Initialise request */
 228
 229         ZERO_STRUCT(request);
 230         ZERO_STRUCT(response);
 231
 232         request.data.gid = gid;
 233
 234         /* Make request */
 235
 236         result = winbindd_request(WINBINDD_GID_TO_SID, &request, &response);
 237
 238         /* Copy out result */
 239
 240         if (result == NSS_STATUS_SUCCESS) {
 241                 string_to_sid(sid, response.data.sid.sid);
 242         } else {
 243                 sid_copy(sid, &global_sid_NULL);
 244         }
 245
 246         return (result == NSS_STATUS_SUCCESS);
 247 }
 248
 249 /* Fetch the list of groups a user is a member of from winbindd.  This is
 250    used by winbind_getgroups. */
 251
 252 static int wb_getgroups(const char *user, gid_t **groups)
 253 {
 254         struct winbindd_request request;
 255         struct winbindd_response response;
 256         int result;
 257
 258         /* Call winbindd */
 259
 260         fstrcpy(request.data.username, user);
 261
 262         ZERO_STRUCT(response);
 263
 264         result = winbindd_request(WINBINDD_GETGROUPS, &request, &response);
 265
 266         if (result == NSS_STATUS_SUCCESS) {
 267
 268                 /* Return group list.  Don't forget to free the group list
 269                    when finished. */
 270
 271                 *groups = (gid_t *)response.extra_data;
 272                 return response.data.num_entries;
 273         }
 274
 275         return -1;
 276 }
 277
 278 /* Call winbindd to initialise group membership.  This is necessary for
 279    some systems (i.e RH5.2) that do not have an initgroups function as part
 280    of the nss extension.  In RH5.2 this is implemented using getgrent()
 281    which can be amazingly inefficient as well as having problems with
 282    username case. */
 283
 284 int winbind_initgroups(char *user, gid_t gid)
 285 {
 286         gid_t *tgr, *groups = NULL;
 287         int result;
 288
 289         /* Call normal initgroups if we are a local user */
 290
 291         if (!strchr(user, *lp_winbind_separator())) {
 292                 return initgroups(user, gid);
 293         }
 294
 295         result = wb_getgroups(user, &groups);
 296
 297         DEBUG(10,("winbind_getgroups: %s: result = %s\n", user,
 298                   result == -1 ? "FAIL" : "SUCCESS"));
 299
 300         if (result != -1) {
 301                 int ngroups = result, i;
 302                 BOOL is_member = False;
 303
 304                 /* Check to see if the passed gid is already in the list */
 305
 306                 for (i = 0; i < ngroups; i++) {
 307                         if (groups[i] == gid) {
 308                                 is_member = True;
 309                         }
 310                 }
 311
 312                 /* Add group to list if necessary */
 313
 314                 if (!is_member) {
 315                         tgr = (gid_t *)Realloc(groups, sizeof(gid_t) * ngroups + 1);
 316
 317                         if (!tgr) {
 318                                 errno = ENOMEM;
 319                                 result = -1;
 320                                 goto done;
 321                         }
 322                         else groups = tgr;
 323
 324                         groups[ngroups] = gid;
 325                         ngroups++;
 326                 }
 327
 328                 /* Set the groups */
 329
 330                 if (sys_setgroups(ngroups, groups) == -1) {
 331                         errno = EPERM;
 332                         result = -1;
 333                         goto done;
 334                 }
 335
 336         } else {
 337
 338                 /* The call failed.  Set errno to something so we don't get
 339                    a bogus value from the last failed system call. */
 340
 341                 errno = EIO;
 342         }
 343
 344         /* Free response data if necessary */
 345
 346  done:
 347         SAFE_FREE(groups);
 348
 349         return result;
 350 }
 351
 352 /* Return a list of groups the user is a member of.  This function is
 353    useful for large systems where inverting the group database would be too
 354    time consuming.  If size is zero, list is not modified and the total
 355    number of groups for the user is returned. */
 356
 357 int winbind_getgroups(const char *user, int size, gid_t *list)
 358 {
 359         gid_t *groups = NULL;
 360         int result, i;
 361
 362         /*
 363          * Don't do the lookup if the name has no separator _and_ we are not in
 364          * 'winbind use default domain' mode.
 365          */
 366
 367         if (!(strchr(user, *lp_winbind_separator()) || lp_winbind_use_default_domain()))
 368                 return -1;
 369
 370         /* Fetch list of groups */
 371
 372         result = wb_getgroups(user, &groups);
 373
 374         if (size == 0)
 375                 goto done;
 376
 377         if (result > size) {
 378                 result = -1;
 379                 errno = EINVAL; /* This is what getgroups() does */
 380                 goto done;
 381         }
 382
 383         /* Copy list of groups across */
 384
 385         for (i = 0; i < result; i++) {
 386                 list[i] = groups[i];
 387         }
 388
 389  done:
 390         SAFE_FREE(groups);
 391         return result;
 392 }
 393
 394 /* Similar to winbind_getgroups but allocates memory and only
 395    needs one call.  Really just a wrapper around wb_getgroups() */
 396
 397 int winbind_getgroups2(const char *user, gid_t **list)
 398 {
 399         /*
 400          * Don't do the lookup if the name has no separator _and_ we are not in
 401          * 'winbind use default domain' mode.
 402          */
 403
 404         if (!(strchr(user, *lp_winbind_separator()) || lp_winbind_use_default_domain()))
 405                 return -1;
 406
 407         /* Fetch list of groups */
 408
 409         return wb_getgroups(user, list);
 410 }
 411
 412 /* Utility function. Convert a uid_t to a name if possible. */
 413
 414 BOOL winbind_uidtoname(fstring name, uid_t uid)
 415 {
 416         DOM_SID sid;
 417         fstring dom_name;
 418         fstring user_name;
 419         enum SID_NAME_USE name_type;
 420
 421         if (!winbind_uid_to_sid(&sid, uid))
 422                 return False;
 423         if (!winbind_lookup_sid(&sid, dom_name, user_name, &name_type))
 424                 return False;
 425
 426         if (name_type != SID_NAME_USER)
 427                 return False;
 428
 429         slprintf(name, sizeof(fstring)-1, "%s%s%s", dom_name,
 430                  lp_winbind_separator(), user_name);
 431
 432         return True;
 433 }
 434
 435 /* Utility function. Convert a gid_t to a name if possible. */
 436
 437 BOOL winbind_gidtoname(fstring name, gid_t gid)
 438 {
 439         DOM_SID sid;
 440         fstring dom_name;
 441         fstring group_name;
 442         enum SID_NAME_USE name_type;
 443
 444         if (!winbind_gid_to_sid(&sid, gid))
 445                 return False;
 446         if (!winbind_lookup_sid(&sid, dom_name, group_name, &name_type))
 447                 return False;
 448
 449         if (name_type != SID_NAME_DOM_GRP && name_type != SID_NAME_ALIAS )
 450                 return False;
 451
 452         slprintf(name, sizeof(fstring)-1, "%s%s%s", dom_name,
 453                  lp_winbind_separator(), group_name);
 454
 455         return True;
 456 }
 457
 458 /* Utility function. Convert a name to a uid_t if possible. */
 459
 460 BOOL winbind_nametouid(uid_t *puid, const char *name)
 461 {
 462         DOM_SID sid;
 463         enum SID_NAME_USE name_type;
 464
 465         if (!winbind_lookup_name(NULL, name, &sid, &name_type))
 466                 return False;
 467
 468         if (name_type != SID_NAME_USER)
 469                 return False;
 470
 471         return winbind_sid_to_uid(puid, &sid);
 472 }
 473
 474 /* Utility function. Convert a name to a gid_t if possible. */
 475
 476 BOOL winbind_nametogid(gid_t *pgid, const char *gname)
 477 {
 478         DOM_SID g_sid;
 479         enum SID_NAME_USE name_type;
 480
 481         if (!winbind_lookup_name(NULL, gname, &g_sid, &name_type))
 482                 return False;
 483
 484         if (name_type != SID_NAME_DOM_GRP && name_type != SID_NAME_ALIAS )
 485                 return False;
 486
 487         return winbind_sid_to_gid(pgid, &g_sid);
 488 }
 489
 490 NTSTATUS winbind_smb_auth_crap(const char *domain, const char *username,
 491                         const unsigned char proof[16],
 492                         const unsigned char challenge[8],
 493                         const unsigned char lm_resp[24],
 494                         const unsigned char nt_resp[24],
 495                         char **pp_raw,
 496                         size_t *pdata_len)
 497 {
 498         struct winbindd_request request;
 499         struct winbindd_response response;
 500         struct _smbd_auth_crap *psmbd_auth_crap;
 501         int result;
 502
 503         *pp_raw = NULL;
 504         *pdata_len = 0;
 505
 506         /* Send off request */
 507         ZERO_STRUCT(request);
 508         ZERO_STRUCT(response);
 509
 510         psmbd_auth_crap = &request.data.smbd_auth_crap;
 511
 512         memcpy(psmbd_auth_crap->proof, proof, 16);
 513         fstrcpy(psmbd_auth_crap->user, username);
 514         fstrcpy(psmbd_auth_crap->domain, domain);
 515
 516         memcpy(psmbd_auth_crap->chal, challenge, 8);
 517
 518         if (lm_resp) {
 519                 memcpy(psmbd_auth_crap->lm_resp, lm_resp, 24);
 520                 psmbd_auth_crap->lm_resp_len = 24;
 521         }
 522         if (nt_resp) {
 523                 memcpy(psmbd_auth_crap->nt_resp, nt_resp, 24);
 524                 psmbd_auth_crap->nt_resp_len = 24;
 525         }
 526
 527         result = winbindd_request(WINBINDD_SMBD_AUTH_CRAP, &request, &response);
 528
 529         DEBUG(5,("winbind_smb_auth_crap for user %s\\%s %s\n",
 530                         domain, username,
 531                         (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed"));
 532
 533         if (result != NSS_STATUS_SUCCESS) {
 534                 if (response.data.auth.nt_status) {
 535                         DEBUG(5,("winbind_smb_auth_crap error code was %s (0x%x)\n",
 536                                 response.data.auth.nt_status_string,
 537                                 response.data.auth.nt_status));
 538                         return  NT_STATUS(response.data.auth.nt_status);
 539                 }
 540                 /*
 541                  * If we can't talk to winbindd return pipe not available. Allows
 542                  * caller to decide what to do.
 543                  */
 544
 545                 if (result == NSS_STATUS_NOTFOUND || result == NSS_STATUS_UNAVAIL)
 546                                 return NT_STATUS_PIPE_NOT_AVAILABLE;
 547                 return NT_STATUS_UNSUCCESSFUL;
 548         }
 549         /* Return the raw INFO3 data. */
 550
 551         if (response.extra_data) {
 552                  *pp_raw = response.extra_data;
 553                  *pdata_len = response.length - sizeof(struct winbindd_response);;
 554         }
 555         return NT_STATUS_OK;
 556 }