source/nsswitch/wb_client.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    winbind client code
   5
   6    Copyright (C) Tim Potter 2000
   7    Copyright (C) Andrew Tridgell 2000
   8
   9    This library is free software; you can redistribute it and/or
  10    modify it under the terms of the GNU Library General Public
  11    License as published by the Free Software Foundation; either
  12    version 2 of the License, or (at your option) any later version.
  13
  14    This library is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17    Library General Public License for more details.
  18
  19    You should have received a copy of the GNU Library General Public
  20    License along with this library; if not, write to the
  21    Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  22    Boston, MA  02111-1307, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "nsswitch/sys_nss.h"
  27
  28 NSS_STATUS winbindd_request(int req_type,
  29                                  struct winbindd_request *request,
  30                                  struct winbindd_response *response);
  31
  32 static BOOL parse_domain_user(const char *domuser, fstring domain, fstring user)
  33 {
  34         char *p = strchr(domuser,*lp_winbind_separator());
  35
  36         if (!p)
  37                 return False;
  38
  39         fstrcpy(user, p+1);
  40         fstrcpy(domain, domuser);
  41         domain[PTR_DIFF(p, domuser)] = 0;
  42         strupper(domain);
  43         return True;
  44 }
  45
  46 /* Call winbindd to convert a name to a sid */
  47
  48 BOOL winbind_lookup_name(const char *dom_name, const char *name, DOM_SID *sid,
  49                          enum SID_NAME_USE *name_type)
  50 {
  51         struct winbindd_request request;
  52         struct winbindd_response response;
  53         NSS_STATUS result;
  54
  55         if (!sid || !name_type)
  56                 return False;
  57
  58         /* Send off request */
  59
  60         ZERO_STRUCT(request);
  61         ZERO_STRUCT(response);
  62
  63         if (dom_name == NULL) {
  64                 if (!parse_domain_user(name, request.data.name.dom_name, request.data.name.name))
  65                         return False;
  66         } else {
  67                 fstrcpy(request.data.name.dom_name, dom_name);
  68                 fstrcpy(request.data.name.name, name);
  69         }
  70
  71         if ((result = winbindd_request(WINBINDD_LOOKUPNAME, &request,
  72                                        &response)) == NSS_STATUS_SUCCESS) {
  73                 string_to_sid(sid, response.data.sid.sid);
  74                 *name_type = (enum SID_NAME_USE)response.data.sid.type;
  75         }
  76
  77         return result == NSS_STATUS_SUCCESS;
  78 }
  79
  80 /* Call winbindd to convert sid to name */
  81
  82 BOOL winbind_lookup_sid(DOM_SID *sid,
  83                         fstring dom_name, fstring name,
  84                         enum SID_NAME_USE *name_type)
  85 {
  86         struct winbindd_request request;
  87         struct winbindd_response response;
  88         NSS_STATUS result;
  89         fstring sid_str;
  90
  91         /* Initialise request */
  92
  93         ZERO_STRUCT(request);
  94         ZERO_STRUCT(response);
  95
  96         sid_to_string(sid_str, sid);
  97         fstrcpy(request.data.sid, sid_str);
  98
  99         /* Make request */
 100
 101         result = winbindd_request(WINBINDD_LOOKUPSID, &request, &response);
 102
 103         /* Copy out result */
 104
 105         if (result == NSS_STATUS_SUCCESS) {
 106                 fstrcpy(dom_name, response.data.name.dom_name);
 107                 fstrcpy(name, response.data.name.name);
 108                 *name_type = (enum SID_NAME_USE)response.data.name.type;
 109
 110                 DEBUG(10, ("winbind_lookup_sid: SUCCESS: SID %s -> %s %s\n",
 111                            sid_str, dom_name, name));
 112         }
 113
 114         return (result == NSS_STATUS_SUCCESS);
 115 }
 116
 117 /* Call winbindd to convert SID to uid */
 118
 119 BOOL winbind_sid_to_uid(uid_t *puid, DOM_SID *sid)
 120 {
 121         struct winbindd_request request;
 122         struct winbindd_response response;
 123         int result;
 124         fstring sid_str;
 125
 126         if (!puid)
 127                 return False;
 128
 129         /* Initialise request */
 130
 131         ZERO_STRUCT(request);
 132         ZERO_STRUCT(response);
 133
 134         sid_to_string(sid_str, sid);
 135         fstrcpy(request.data.sid, sid_str);
 136
 137         /* Make request */
 138
 139         result = winbindd_request(WINBINDD_SID_TO_UID, &request, &response);
 140
 141         /* Copy out result */
 142
 143         if (result == NSS_STATUS_SUCCESS) {
 144                 *puid = response.data.uid;
 145         }
 146
 147         return (result == NSS_STATUS_SUCCESS);
 148 }
 149
 150 /* Call winbindd to convert uid to sid */
 151
 152 BOOL winbind_uid_to_sid(DOM_SID *sid, uid_t uid)
 153 {
 154         struct winbindd_request request;
 155         struct winbindd_response response;
 156         int result;
 157
 158         if (!sid)
 159                 return False;
 160
 161         /* Initialise request */
 162
 163         ZERO_STRUCT(request);
 164         ZERO_STRUCT(response);
 165
 166         request.data.uid = uid;
 167
 168         /* Make request */
 169
 170         result = winbindd_request(WINBINDD_UID_TO_SID, &request, &response);
 171
 172         /* Copy out result */
 173
 174         if (result == NSS_STATUS_SUCCESS) {
 175                 string_to_sid(sid, response.data.sid.sid);
 176         } else {
 177                 sid_copy(sid, &global_sid_NULL);
 178         }
 179
 180         return (result == NSS_STATUS_SUCCESS);
 181 }
 182
 183 /* Call winbindd to convert SID to gid */
 184
 185 BOOL winbind_sid_to_gid(gid_t *pgid, DOM_SID *sid)
 186 {
 187         struct winbindd_request request;
 188         struct winbindd_response response;
 189         int result;
 190         fstring sid_str;
 191
 192         if (!pgid)
 193                 return False;
 194
 195         /* Initialise request */
 196
 197         ZERO_STRUCT(request);
 198         ZERO_STRUCT(response);
 199
 200         sid_to_string(sid_str, sid);
 201         fstrcpy(request.data.sid, sid_str);
 202
 203         /* Make request */
 204
 205         result = winbindd_request(WINBINDD_SID_TO_GID, &request, &response);
 206
 207         /* Copy out result */
 208
 209         if (result == NSS_STATUS_SUCCESS) {
 210                 *pgid = response.data.gid;
 211         }
 212
 213         return (result == NSS_STATUS_SUCCESS);
 214 }
 215
 216 /* Call winbindd to convert gid to sid */
 217
 218 BOOL winbind_gid_to_sid(DOM_SID *sid, gid_t gid)
 219 {
 220         struct winbindd_request request;
 221         struct winbindd_response response;
 222         int result;
 223
 224         if (!sid)
 225                 return False;
 226
 227         /* Initialise request */
 228
 229         ZERO_STRUCT(request);
 230         ZERO_STRUCT(response);
 231
 232         request.data.gid = gid;
 233
 234         /* Make request */
 235
 236         result = winbindd_request(WINBINDD_GID_TO_SID, &request, &response);
 237
 238         /* Copy out result */
 239
 240         if (result == NSS_STATUS_SUCCESS) {
 241                 string_to_sid(sid, response.data.sid.sid);
 242         } else {
 243                 sid_copy(sid, &global_sid_NULL);
 244         }
 245
 246         return (result == NSS_STATUS_SUCCESS);
 247 }
 248
 249 /* Fetch the list of groups a user is a member of from winbindd.  This is
 250    used by winbind_getgroups. */
 251
 252 static int wb_getgroups(const char *user, gid_t **groups)
 253 {
 254         struct winbindd_request request;
 255         struct winbindd_response response;
 256         int result;
 257
 258         /* Call winbindd */
 259
 260         fstrcpy(request.data.username, user);
 261
 262         ZERO_STRUCT(response);
 263
 264         result = winbindd_request(WINBINDD_GETGROUPS, &request, &response);
 265
 266         if (result == NSS_STATUS_SUCCESS) {
 267
 268                 /* Return group list.  Don't forget to free the group list
 269                    when finished. */
 270
 271                 *groups = (gid_t *)response.extra_data;
 272                 return response.data.num_entries;
 273         }
 274
 275         return -1;
 276 }
 277
 278 /* Call winbindd to initialise group membership.  This is necessary for
 279    some systems (i.e RH5.2) that do not have an initgroups function as part
 280    of the nss extension.  In RH5.2 this is implemented using getgrent()
 281    which can be amazingly inefficient as well as having problems with
 282    username case. */
 283
 284 int winbind_initgroups(char *user, gid_t gid)
 285 {
 286         gid_t *tgr, *groups = NULL;
 287         int result;
 288
 289         /* Call normal initgroups if we are a local user */
 290
 291         if (!strchr(user, *lp_winbind_separator())) {
 292                 return initgroups(user, gid);
 293         }
 294
 295         result = wb_getgroups(user, &groups);
 296
 297         DEBUG(10,("winbind_getgroups: %s: result = %s\n", user,
 298                   result == -1 ? "FAIL" : "SUCCESS"));
 299
 300         if (result != -1) {
 301                 int ngroups = result, i;
 302                 BOOL is_member = False;
 303
 304                 /* Check to see if the passed gid is already in the list */
 305
 306                 for (i = 0; i < ngroups; i++) {
 307                         if (groups[i] == gid) {
 308                                 is_member = True;
 309                         }
 310                 }
 311
 312                 /* Add group to list if necessary */
 313
 314                 if (!is_member) {
 315                         tgr = (gid_t *)Realloc(groups, sizeof(gid_t) * ngroups + 1);
 316
 317                         if (!tgr) {
 318                                 errno = ENOMEM;
 319                                 result = -1;
 320                                 goto done;
 321                         }
 322                         else groups = tgr;
 323
 324                         groups[ngroups] = gid;
 325                         ngroups++;
 326                 }
 327
 328                 /* Set the groups */
 329
 330                 if (sys_setgroups(ngroups, groups) == -1) {
 331                         errno = EPERM;
 332                         result = -1;
 333                         goto done;
 334                 }
 335
 336         } else {
 337
 338                 /* The call failed.  Set errno to something so we don't get
 339                    a bogus value from the last failed system call. */
 340
 341                 errno = EIO;
 342         }
 343
 344         /* Free response data if necessary */
 345
 346  done:
 347         SAFE_FREE(groups);
 348
 349         return result;
 350 }
 351
 352 /* Return a list of groups the user is a member of.  This function is
 353    useful for large systems where inverting the group database would be too
 354    time consuming.  If size is zero, list is not modified and the total
 355    number of groups for the user is returned. */
 356
 357 int winbind_getgroups(const char *user, int size, gid_t *list)
 358 {
 359         gid_t *groups = NULL;
 360         int result, i;
 361
 362         /*
 363          * Don't do the lookup if the name has no separator _and_ we are not in
 364          * 'winbind use default domain' mode.
 365          */
 366
 367         if (!(strchr(user, *lp_winbind_separator()) || lp_winbind_use_default_domain()))
 368                 return -1;
 369
 370         /* Fetch list of groups */
 371
 372         result = wb_getgroups(user, &groups);
 373
 374         if (size == 0)
 375                 goto done;
 376
 377         if (result > size) {
 378                 result = -1;
 379                 errno = EINVAL; /* This is what getgroups() does */
 380                 goto done;
 381         }
 382
 383         /* Copy list of groups across */
 384
 385         for (i = 0; i < result; i++) {
 386                 list[i] = groups[i];
 387         }
 388
 389  done:
 390         SAFE_FREE(groups);
 391         return result;
 392 }
 393
 394 /* Utility function. Convert a uid_t to a name if possible. */
 395
 396 BOOL winbind_uidtoname(fstring name, uid_t uid)
 397 {
 398         DOM_SID sid;
 399         fstring dom_name;
 400         fstring user_name;
 401         enum SID_NAME_USE name_type;
 402
 403         if (!winbind_uid_to_sid(&sid, uid))
 404                 return False;
 405         if (!winbind_lookup_sid(&sid, dom_name, user_name, &name_type))
 406                 return False;
 407
 408         if (name_type != SID_NAME_USER)
 409                 return False;
 410
 411         slprintf(name, sizeof(fstring)-1, "%s%s%s", dom_name,
 412                  lp_winbind_separator(), user_name);
 413
 414         return True;
 415 }
 416
 417 /* Utility function. Convert a gid_t to a name if possible. */
 418
 419 BOOL winbind_gidtoname(fstring name, gid_t gid)
 420 {
 421         DOM_SID sid;
 422         fstring dom_name;
 423         fstring group_name;
 424         enum SID_NAME_USE name_type;
 425
 426         if (!winbind_gid_to_sid(&sid, gid))
 427                 return False;
 428         if (!winbind_lookup_sid(&sid, dom_name, group_name, &name_type))
 429                 return False;
 430
 431         if (name_type != SID_NAME_DOM_GRP)
 432                 return False;
 433
 434         slprintf(name, sizeof(fstring)-1, "%s%s%s", dom_name,
 435                  lp_winbind_separator(), group_name);
 436
 437         return True;
 438 }
 439
 440 /* Utility function. Convert a name to a uid_t if possible. */
 441
 442 BOOL winbind_nametouid(uid_t *puid, const char *name)
 443 {
 444         DOM_SID sid;
 445         enum SID_NAME_USE name_type;
 446
 447         if (!winbind_lookup_name(NULL, name, &sid, &name_type))
 448                 return False;
 449
 450         if (name_type != SID_NAME_USER)
 451                 return False;
 452
 453         return winbind_sid_to_uid(puid, &sid);
 454 }
 455
 456 /* Utility function. Convert a name to a gid_t if possible. */
 457
 458 BOOL winbind_nametogid(gid_t *pgid, const char *gname)
 459 {
 460         DOM_SID g_sid;
 461         enum SID_NAME_USE name_type;
 462
 463         if (!winbind_lookup_name(NULL, gname, &g_sid, &name_type))
 464                 return False;
 465
 466         if (name_type != SID_NAME_DOM_GRP)
 467                 return False;
 468
 469         return winbind_sid_to_gid(pgid, &g_sid);
 470 }