2 Unix SMB/CIFS implementation.
4 Winbind daemon for ntdom nss module
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_WINBIND
29 /***************************************************************
30 Empty static struct for negative caching.
31 ****************************************************************/
33 /* Fill a grent structure from various other information */
35 static BOOL
fill_grent(struct winbindd_gr
*gr
, const char *dom_name
,
36 const char *gr_name
, gid_t unix_gid
)
38 fstring full_group_name
;
40 fill_domain_username(full_group_name
, dom_name
, gr_name
);
42 gr
->gr_gid
= unix_gid
;
44 /* Group name and password */
46 safe_strcpy(gr
->gr_name
, full_group_name
, sizeof(gr
->gr_name
) - 1);
47 safe_strcpy(gr
->gr_passwd
, "x", sizeof(gr
->gr_passwd
) - 1);
52 /* Fill in the group membership field of a NT group given by group_rid */
54 static BOOL
fill_grent_mem(struct winbindd_domain
*domain
,
56 enum SID_NAME_USE group_name_type
,
57 int *num_gr_mem
, char **gr_mem
, int *gr_mem_len
)
59 uint32
*rid_mem
= NULL
, num_names
= 0;
60 uint32
*name_types
= NULL
;
61 int buf_len
, buf_ndx
, i
;
62 char **names
= NULL
, *buf
;
67 if (!(mem_ctx
= talloc_init("fill_grent_mem(%s)", domain
->name
)))
70 /* Initialise group membership information */
72 DEBUG(10, ("group %s rid 0x%x\n", domain
? domain
->name
: "NULL",
77 if (group_name_type
!= SID_NAME_DOM_GRP
) {
78 DEBUG(1, ("rid %d in domain %s isn't a domain group\n",
79 group_rid
, domain
->name
));
83 /* Lookup group members */
84 status
= domain
->methods
->lookup_groupmem(domain
, mem_ctx
, group_rid
, &num_names
,
85 &rid_mem
, &names
, &name_types
);
86 if (!NT_STATUS_IS_OK(status
)) {
87 DEBUG(1, ("could not lookup membership for group rid %d in domain %s (error: %s)\n",
88 group_rid
, domain
->name
, nt_errstr(status
)));
93 DEBUG(10, ("looked up %d names\n", num_names
));
95 if (DEBUGLEVEL
>= 10) {
96 for (i
= 0; i
< num_names
; i
++)
97 DEBUG(10, ("\t%20s %x %d\n", names
[i
], rid_mem
[i
],
101 /* Add members to list */
104 buf_len
= buf_ndx
= 0;
108 for (i
= 0; i
< num_names
; i
++) {
115 DEBUG(10, ("processing name %s\n", the_name
));
117 /* FIXME: need to cope with groups within groups. These
118 occur in Universal groups on a Windows 2000 native mode
121 if (name_types
[i
] != SID_NAME_USER
) {
122 DEBUG(3, ("name %s isn't a domain user\n", the_name
));
126 /* Don't bother with machine accounts */
128 if (the_name
[strlen(the_name
) - 1] == '$') {
129 DEBUG(10, ("%s is machine account\n", the_name
));
133 /* Append domain name */
135 fill_domain_username(name
, domain
->name
, the_name
);
139 /* Add to list or calculate buffer length */
142 buf_len
+= len
+ 1; /* List is comma separated */
144 DEBUG(10, ("buf_len + %d = %d\n", len
+ 1, buf_len
));
146 DEBUG(10, ("appending %s at ndx %d\n", name
, len
));
147 safe_strcpy(&buf
[buf_ndx
], name
, len
);
154 /* Allocate buffer */
156 if (!buf
&& buf_len
!= 0) {
157 if (!(buf
= malloc(buf_len
))) {
158 DEBUG(1, ("out of memory\n"));
162 memset(buf
, 0, buf_len
);
166 if (buf
&& buf_ndx
> 0) {
167 buf
[buf_ndx
- 1] = '\0';
171 *gr_mem_len
= buf_len
;
173 DEBUG(10, ("num_mem = %d, len = %d, mem = %s\n", *num_gr_mem
,
174 buf_len
, *num_gr_mem
? buf
: "NULL"));
179 talloc_destroy(mem_ctx
);
181 DEBUG(10, ("fill_grent_mem returning %d\n", result
));
186 /* Return a group structure from a group name */
188 enum winbindd_result
winbindd_getgrnam(struct winbindd_cli_state
*state
)
191 struct winbindd_domain
*domain
;
192 enum SID_NAME_USE name_type
;
194 fstring name_domain
, name_group
;
199 /* Ensure null termination */
200 state
->request
.data
.groupname
[sizeof(state
->request
.data
.groupname
)-1]='\0';
202 DEBUG(3, ("[%5d]: getgrnam %s\n", state
->pid
,
203 state
->request
.data
.groupname
));
205 /* Parse domain and groupname */
207 memset(name_group
, 0, sizeof(fstring
));
209 tmp
= state
->request
.data
.groupname
;
210 if (!parse_domain_user(tmp
, name_domain
, name_group
))
211 return WINBINDD_ERROR
;
213 /* Get info for the domain */
215 if ((domain
= find_domain_from_name(name_domain
)) == NULL
) {
216 DEBUG(0, ("could not get domain sid for domain %s\n",
218 return WINBINDD_ERROR
;
221 /* Get rid and name type from name */
223 if (!winbindd_lookup_sid_by_name(domain
, name_group
, &group_sid
,
225 DEBUG(1, ("group %s in domain %s does not exist\n",
226 name_group
, name_domain
));
227 return WINBINDD_ERROR
;
230 if ((name_type
!= SID_NAME_ALIAS
) && (name_type
!= SID_NAME_DOM_GRP
)) {
231 DEBUG(1, ("name '%s' is not a local or domain group: %d\n",
232 name_group
, name_type
));
233 return WINBINDD_ERROR
;
236 /* Fill in group structure */
237 if (!sid_peek_check_rid(&domain
->sid
, &group_sid
, &group_rid
))
238 return WINBINDD_ERROR
;
240 if (!winbindd_idmap_get_gid_from_sid(&group_sid
, &gid
)) {
241 DEBUG(1, ("error converting unix gid to sid\n"));
242 return WINBINDD_ERROR
;
245 if (!fill_grent(&state
->response
.data
.gr
, name_domain
,
247 !fill_grent_mem(domain
, group_rid
, name_type
,
248 &state
->response
.data
.gr
.num_gr_mem
,
249 &gr_mem
, &gr_mem_len
)) {
250 return WINBINDD_ERROR
;
253 /* Group membership lives at start of extra data */
255 state
->response
.data
.gr
.gr_mem_ofs
= 0;
257 state
->response
.length
+= gr_mem_len
;
258 state
->response
.extra_data
= gr_mem
;
263 /* Return a group structure from a gid number */
265 enum winbindd_result
winbindd_getgrgid(struct winbindd_cli_state
*state
)
267 struct winbindd_domain
*domain
;
269 enum SID_NAME_USE name_type
;
276 DEBUG(3, ("[%5d]: getgrgid %d\n", state
->pid
,
277 state
->request
.data
.gid
));
279 /* Bug out if the gid isn't in the winbind range */
281 if ((state
->request
.data
.gid
< server_state
.gid_low
) ||
282 (state
->request
.data
.gid
> server_state
.gid_high
))
283 return WINBINDD_ERROR
;
285 /* Get rid from gid */
287 if (!winbindd_idmap_get_rid_from_gid(state
->request
.data
.gid
,
288 &group_rid
, &domain
)) {
289 DEBUG(1, ("could not convert gid %d to rid\n",
290 state
->request
.data
.gid
));
291 return WINBINDD_ERROR
;
294 /* Get sid from gid */
296 sid_copy(&group_sid
, &domain
->sid
);
297 sid_append_rid(&group_sid
, group_rid
);
299 if (!winbindd_lookup_name_by_sid(&group_sid
, dom_name
, group_name
, &name_type
)) {
300 DEBUG(1, ("could not lookup sid\n"));
301 return WINBINDD_ERROR
;
304 if (!((name_type
== SID_NAME_ALIAS
) ||
305 (name_type
== SID_NAME_DOM_GRP
))) {
306 DEBUG(1, ("name '%s' is not a local or domain group: %d\n",
307 group_name
, name_type
));
308 return WINBINDD_ERROR
;
311 /* Fill in group structure */
313 if (!fill_grent(&state
->response
.data
.gr
, dom_name
, group_name
,
314 state
->request
.data
.gid
) ||
315 !fill_grent_mem(domain
, group_rid
, name_type
,
316 &state
->response
.data
.gr
.num_gr_mem
,
317 &gr_mem
, &gr_mem_len
))
318 return WINBINDD_ERROR
;
320 /* Group membership lives at start of extra data */
322 state
->response
.data
.gr
.gr_mem_ofs
= 0;
324 state
->response
.length
+= gr_mem_len
;
325 state
->response
.extra_data
= gr_mem
;
331 * set/get/endgrent functions
334 /* "Rewind" file pointer for group database enumeration */
336 enum winbindd_result
winbindd_setgrent(struct winbindd_cli_state
*state
)
338 struct winbindd_domain
*domain
;
340 DEBUG(3, ("[%5d]: setgrent\n", state
->pid
));
342 /* Check user has enabled this */
344 if (!lp_winbind_enum_groups())
345 return WINBINDD_ERROR
;
347 /* Free old static data if it exists */
349 if (state
->getgrent_state
!= NULL
) {
350 free_getent_state(state
->getgrent_state
);
351 state
->getgrent_state
= NULL
;
354 /* Create sam pipes for each domain we know about */
356 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
357 struct getent_state
*domain_state
;
359 /* Create a state record for this domain */
361 if ((domain_state
= (struct getent_state
*)
362 malloc(sizeof(struct getent_state
))) == NULL
) {
363 DEBUG(1, ("winbindd_setgrent: malloc failed for domain_state!\n"));
364 return WINBINDD_ERROR
;
367 ZERO_STRUCTP(domain_state
);
369 fstrcpy(domain_state
->domain_name
, domain
->name
);
371 /* Add to list of open domains */
373 DLIST_ADD(state
->getgrent_state
, domain_state
);
379 /* Close file pointer to ntdom group database */
381 enum winbindd_result
winbindd_endgrent(struct winbindd_cli_state
*state
)
383 DEBUG(3, ("[%5d]: endgrent\n", state
->pid
));
385 free_getent_state(state
->getgrent_state
);
386 state
->getgrent_state
= NULL
;
391 /* Get the list of domain groups and domain aliases for a domain. We fill in
392 the sam_entries and num_sam_entries fields with domain group information.
393 The dispinfo_ndx field is incremented to the index of the next group to
394 fetch. Return True if some groups were returned, False otherwise. */
396 #define MAX_FETCH_SAM_ENTRIES 100
398 static BOOL
get_sam_group_entries(struct getent_state
*ent
)
402 struct acct_info
*name_list
= NULL
, *tmp_name_list
= NULL
;
405 struct acct_info
*sam_grp_entries
= NULL
;
406 struct winbindd_domain
*domain
;
408 if (ent
->got_sam_entries
)
411 if (!(mem_ctx
= talloc_init("get_sam_group_entries(%s)",
412 ent
->domain_name
))) {
413 DEBUG(1, ("get_sam_group_entries: could not create talloc context!\n"));
417 /* Free any existing group info */
419 SAFE_FREE(ent
->sam_entries
);
420 ent
->num_sam_entries
= 0;
421 ent
->got_sam_entries
= True
;
423 /* Enumerate domain groups */
427 if (!(domain
= find_domain_from_name(ent
->domain_name
))) {
428 DEBUG(3, ("no such domain %s in get_sam_group_entries\n", ent
->domain_name
));
432 /* always get the domain global groups */
434 status
= domain
->methods
->enum_dom_groups(domain
, mem_ctx
, &num_entries
, &sam_grp_entries
);
436 if (!NT_STATUS_IS_OK(status
)) {
437 DEBUG(3, ("get_sam_group_entries: could not enumerate domain groups! Error: %s", nt_errstr(status
)));
442 /* Copy entries into return buffer */
445 if ( !(name_list
= malloc(sizeof(struct acct_info
) * num_entries
)) ) {
446 DEBUG(0,("get_sam_group_entries: Failed to malloc memory for %d domain groups!\n",
451 memcpy( name_list
, sam_grp_entries
, num_entries
* sizeof(struct acct_info
) );
454 ent
->num_sam_entries
= num_entries
;
456 /* get the domain local groups if we are a member of
457 a native win2k domain */
459 if ( domain
->native_mode
&& domain
->methods
->enum_local_groups
)
461 DEBUG(4,("get_sam_group_entries: Native Mode 2k domain; enumerating local groups as well\n"));
463 status
= domain
->methods
->enum_local_groups(domain
, mem_ctx
, &num_entries
, &sam_grp_entries
);
465 if ( !NT_STATUS_IS_OK(status
) ) {
466 DEBUG(3,("get_sam_group_entries: Failed to enumerate domain local groups!\n"));
470 DEBUG(4,("get_sam_group_entries: Returned %d local groups\n", num_entries
));
472 /* Copy entries into return buffer */
475 if ( !(tmp_name_list
= Realloc( name_list
, sizeof(struct acct_info
) * (ent
->num_sam_entries
+num_entries
))) )
477 DEBUG(0,("get_sam_group_entries: Failed to realloc more memory for %d local groups!\n",
480 SAFE_FREE( name_list
);
484 name_list
= tmp_name_list
;
486 memcpy( &name_list
[ent
->num_sam_entries
], sam_grp_entries
,
487 num_entries
* sizeof(struct acct_info
) );
490 ent
->num_sam_entries
+= num_entries
;
494 /* Fill in remaining fields */
496 ent
->sam_entries
= name_list
;
497 ent
->sam_entry_index
= 0;
499 result
= (ent
->num_sam_entries
> 0);
502 talloc_destroy(mem_ctx
);
507 /* Fetch next group entry from ntdom database */
509 #define MAX_GETGRENT_GROUPS 500
511 enum winbindd_result
winbindd_getgrent(struct winbindd_cli_state
*state
)
513 struct getent_state
*ent
;
514 struct winbindd_gr
*group_list
= NULL
;
515 int num_groups
, group_list_ndx
= 0, i
, gr_mem_list_len
= 0;
516 char *new_extra_data
, *gr_mem_list
= NULL
;
518 DEBUG(3, ("[%5d]: getgrent\n", state
->pid
));
520 /* Check user has enabled this */
522 if (!lp_winbind_enum_groups())
523 return WINBINDD_ERROR
;
525 num_groups
= MIN(MAX_GETGRENT_GROUPS
, state
->request
.data
.num_entries
);
527 if ((state
->response
.extra_data
=
528 malloc(num_groups
* sizeof(struct winbindd_gr
))) == NULL
)
529 return WINBINDD_ERROR
;
531 state
->response
.data
.num_entries
= 0;
533 group_list
= (struct winbindd_gr
*)state
->response
.extra_data
;
535 if (!(ent
= state
->getgrent_state
))
536 return WINBINDD_ERROR
;
538 /* Start sending back groups */
540 for (i
= 0; i
< num_groups
; i
++) {
541 struct acct_info
*name_list
= NULL
;
542 fstring domain_group_name
;
546 char *gr_mem
, *new_gr_mem_list
;
548 /* Do we need to fetch another chunk of groups? */
552 DEBUG(10, ("entry_index = %d, num_entries = %d\n",
553 ent
->sam_entry_index
, ent
->num_sam_entries
));
555 if (ent
->num_sam_entries
== ent
->sam_entry_index
) {
557 while(ent
&& !get_sam_group_entries(ent
)) {
558 struct getent_state
*next_ent
;
560 DEBUG(10, ("freeing state info for domain %s\n", ent
->domain_name
));
562 /* Free state information for this domain */
564 SAFE_FREE(ent
->sam_entries
);
566 next_ent
= ent
->next
;
567 DLIST_REMOVE(state
->getgrent_state
, ent
);
573 /* No more domains */
579 name_list
= ent
->sam_entries
;
581 /* Lookup group info */
583 if (!winbindd_idmap_get_gid_from_rid(
585 name_list
[ent
->sam_entry_index
].rid
,
588 DEBUG(1, ("could not look up gid for group %s\n",
589 name_list
[ent
->sam_entry_index
].acct_name
));
591 ent
->sam_entry_index
++;
595 DEBUG(10, ("got gid %d for group %x\n", group_gid
,
596 name_list
[ent
->sam_entry_index
].rid
));
598 /* Fill in group entry */
600 fill_domain_username(domain_group_name
, ent
->domain_name
,
601 name_list
[ent
->sam_entry_index
].acct_name
);
603 result
= fill_grent(&group_list
[group_list_ndx
],
605 name_list
[ent
->sam_entry_index
].acct_name
,
608 /* Fill in group membership entry */
611 struct winbindd_domain
*domain
;
614 find_domain_from_name(ent
->domain_name
))) {
615 DEBUG(3, ("No such domain %s in winbindd_getgrent\n", ent
->domain_name
));
620 group_list
[group_list_ndx
].num_gr_mem
= 0;
624 /* Get group membership */
625 if (state
->request
.cmd
== WINBINDD_GETGRLST
) {
628 result
= fill_grent_mem(
630 name_list
[ent
->sam_entry_index
].rid
,
632 &group_list
[group_list_ndx
].num_gr_mem
,
633 &gr_mem
, &gr_mem_len
);
638 /* Append to group membership list */
639 new_gr_mem_list
= Realloc(
641 gr_mem_list_len
+ gr_mem_len
);
643 if (!new_gr_mem_list
&& (group_list
[group_list_ndx
].num_gr_mem
!= 0)) {
644 DEBUG(0, ("out of memory\n"));
645 SAFE_FREE(gr_mem_list
);
650 DEBUG(10, ("list_len = %d, mem_len = %d\n",
651 gr_mem_list_len
, gr_mem_len
));
653 gr_mem_list
= new_gr_mem_list
;
655 memcpy(&gr_mem_list
[gr_mem_list_len
], gr_mem
,
660 group_list
[group_list_ndx
].gr_mem_ofs
=
663 gr_mem_list_len
+= gr_mem_len
;
666 ent
->sam_entry_index
++;
668 /* Add group to return list */
672 DEBUG(10, ("adding group num_entries = %d\n",
673 state
->response
.data
.num_entries
));
676 state
->response
.data
.num_entries
++;
678 state
->response
.length
+=
679 sizeof(struct winbindd_gr
);
682 DEBUG(0, ("could not lookup domain group %s\n",
687 /* Copy the list of group memberships to the end of the extra data */
689 if (group_list_ndx
== 0)
692 new_extra_data
= Realloc(
693 state
->response
.extra_data
,
694 group_list_ndx
* sizeof(struct winbindd_gr
) + gr_mem_list_len
);
696 if (!new_extra_data
) {
697 DEBUG(0, ("out of memory\n"));
699 SAFE_FREE(state
->response
.extra_data
);
700 SAFE_FREE(gr_mem_list
);
702 return WINBINDD_ERROR
;
705 state
->response
.extra_data
= new_extra_data
;
707 memcpy(&((char *)state
->response
.extra_data
)
708 [group_list_ndx
* sizeof(struct winbindd_gr
)],
709 gr_mem_list
, gr_mem_list_len
);
711 SAFE_FREE(gr_mem_list
);
713 state
->response
.length
+= gr_mem_list_len
;
715 DEBUG(10, ("returning %d groups, length = %d\n",
716 group_list_ndx
, gr_mem_list_len
));
722 return (group_list_ndx
> 0) ? WINBINDD_OK
: WINBINDD_ERROR
;
725 /* List domain groups without mapping to unix ids */
727 enum winbindd_result
winbindd_list_groups(struct winbindd_cli_state
*state
)
729 uint32 total_entries
= 0;
730 struct winbindd_domain
*domain
;
731 char *extra_data
= NULL
;
733 int extra_data_len
= 0, i
;
735 DEBUG(3, ("[%5d]: list groups\n", state
->pid
));
737 /* Enumerate over trusted domains */
739 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
740 struct getent_state groups
;
744 /* Get list of sam groups */
746 fstrcpy(groups
.domain_name
, domain
->name
);
748 get_sam_group_entries(&groups
);
750 if (groups
.num_sam_entries
== 0) {
751 /* this domain is empty or in an error state */
755 /* keep track the of the total number of groups seen so
756 far over all domains */
757 total_entries
+= groups
.num_sam_entries
;
759 /* Allocate some memory for extra data. Note that we limit
760 account names to sizeof(fstring) = 128 characters. */
761 ted
= Realloc(extra_data
, sizeof(fstring
) * total_entries
);
764 DEBUG(0,("failed to enlarge buffer!\n"));
765 SAFE_FREE(extra_data
);
766 return WINBINDD_ERROR
;
770 /* Pack group list into extra data fields */
771 for (i
= 0; i
< groups
.num_sam_entries
; i
++) {
772 char *group_name
= ((struct acct_info
*)
773 groups
.sam_entries
)[i
].acct_name
;
776 fill_domain_username(name
, domain
->name
, group_name
);
777 /* Append to extra data */
778 memcpy(&extra_data
[extra_data_len
], name
,
780 extra_data_len
+= strlen(name
);
781 extra_data
[extra_data_len
++] = ',';
784 free(groups
.sam_entries
);
787 /* Assign extra_data fields in response structure */
789 extra_data
[extra_data_len
- 1] = '\0';
790 state
->response
.extra_data
= extra_data
;
791 state
->response
.length
+= extra_data_len
;
794 /* No domains may have responded but that's still OK so don't
800 /* Get user supplementary groups. This is much quicker than trying to
801 invert the groups database. */
803 enum winbindd_result
winbindd_getgroups(struct winbindd_cli_state
*state
)
805 fstring name_domain
, name_user
;
807 enum SID_NAME_USE name_type
;
808 uint32 user_rid
, num_groups
, num_gids
;
811 struct winbindd_domain
*domain
;
812 enum winbindd_result result
= WINBINDD_ERROR
;
817 /* Ensure null termination */
818 state
->request
.data
.username
[sizeof(state
->request
.data
.username
)-1]='\0';
820 DEBUG(3, ("[%5d]: getgroups %s\n", state
->pid
,
821 state
->request
.data
.username
));
823 if (!(mem_ctx
= talloc_init("winbindd_getgroups(%s)",
824 state
->request
.data
.username
)))
825 return WINBINDD_ERROR
;
827 /* Parse domain and username */
829 if (!parse_domain_user(state
->request
.data
.username
, name_domain
,
833 /* Get info for the domain */
835 if ((domain
= find_domain_from_name(name_domain
)) == NULL
) {
836 DEBUG(0, ("could not find domain entry for domain %s\n",
841 /* Get rid and name type from name. The following costs 1 packet */
843 if (!winbindd_lookup_sid_by_name(domain
, name_user
, &user_sid
,
845 DEBUG(1, ("user '%s' does not exist\n", name_user
));
849 if (name_type
!= SID_NAME_USER
) {
850 DEBUG(1, ("name '%s' is not a user name: %d\n",
851 name_user
, name_type
));
855 sid_split_rid(&user_sid
, &user_rid
);
857 status
= domain
->methods
->lookup_usergroups(domain
, mem_ctx
, user_rid
, &num_groups
, &user_gids
);
858 if (!NT_STATUS_IS_OK(status
)) goto done
;
860 /* Copy data back to client */
863 gid_list
= malloc(sizeof(gid_t
) * num_groups
);
865 if (state
->response
.extra_data
)
868 for (i
= 0; i
< num_groups
; i
++) {
869 if (!winbindd_idmap_get_gid_from_rid(domain
->name
,
871 &gid_list
[num_gids
])) {
873 DEBUG(1, ("unable to convert group rid %d to gid\n",
881 state
->response
.data
.num_entries
= num_gids
;
882 state
->response
.extra_data
= gid_list
;
883 state
->response
.length
+= num_gids
* sizeof(gid_t
);
885 result
= WINBINDD_OK
;
889 talloc_destroy(mem_ctx
);