2 Unix SMB/CIFS implementation.
4 Copyright (C) Volker Lendecke 2011
5 Copyright (C) Michael Adam 2012
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "../libcli/security/security.h"
24 #include "idmap_cache.h"
25 #include "librpc/gen_ndr/ndr_winbind_c.h"
26 #include "librpc/gen_ndr/ndr_netlogon.h"
29 struct wb_sids2xids_state
{
30 struct tevent_context
*ev
;
35 struct id_map
*cached
;
37 struct dom_sid
*non_cached
;
38 uint32_t num_non_cached
;
41 * Domain array to use for the idmap call. The output from
42 * lookupsids cannot be used directly since for migrated
43 * objects the returned domain SID can be different than the
44 * original one. The new domain SID cannot be combined with
45 * the RID from the previous domain.
47 * The proper way would be asking for the correct RID in the
48 * new domain, but this approach avoids id mappings for
51 struct lsa_RefDomainList idmap_doms
;
54 struct wbint_TransIDArray
*dom_ids
;
55 struct lsa_RefDomainList idmap_dom
;
58 struct wbint_TransIDArray ids
;
62 static bool wb_sids2xids_in_cache(struct dom_sid
*sid
, struct id_map
*map
);
63 static void wb_sids2xids_lookupsids_done(struct tevent_req
*subreq
);
64 static void wb_sids2xids_done(struct tevent_req
*subreq
);
65 static void wb_sids2xids_gotdc(struct tevent_req
*subreq
);
67 struct tevent_req
*wb_sids2xids_send(TALLOC_CTX
*mem_ctx
,
68 struct tevent_context
*ev
,
69 const struct dom_sid
*sids
,
70 const uint32_t num_sids
)
72 struct tevent_req
*req
, *subreq
;
73 struct wb_sids2xids_state
*state
;
76 req
= tevent_req_create(mem_ctx
, &state
,
77 struct wb_sids2xids_state
);
84 state
->num_sids
= num_sids
;
86 state
->sids
= talloc_zero_array(state
, struct dom_sid
, num_sids
);
87 if (tevent_req_nomem(state
->sids
, req
)) {
88 return tevent_req_post(req
, ev
);
91 for (i
= 0; i
< num_sids
; i
++) {
92 sid_copy(&state
->sids
[i
], &sids
[i
]);
95 state
->cached
= talloc_zero_array(state
, struct id_map
, num_sids
);
96 if (tevent_req_nomem(state
->cached
, req
)) {
97 return tevent_req_post(req
, ev
);
100 state
->non_cached
= talloc_array(state
, struct dom_sid
, num_sids
);
101 if (tevent_req_nomem(state
->non_cached
, req
)) {
102 return tevent_req_post(req
, ev
);
106 * Extract those sids that can not be resolved from cache
107 * into a separate list to be handed to id mapping, keeping
110 for (i
=0; i
<state
->num_sids
; i
++) {
112 DEBUG(10, ("SID %d: %s\n", (int)i
,
113 sid_string_dbg(&state
->sids
[i
])));
115 if (wb_sids2xids_in_cache(&state
->sids
[i
], &state
->cached
[i
])) {
118 sid_copy(&state
->non_cached
[state
->num_non_cached
],
120 state
->num_non_cached
+= 1;
123 if (state
->num_non_cached
== 0) {
124 tevent_req_done(req
);
125 return tevent_req_post(req
, ev
);
128 subreq
= wb_lookupsids_send(state
, ev
, state
->non_cached
,
129 state
->num_non_cached
);
130 if (tevent_req_nomem(subreq
, req
)) {
131 return tevent_req_post(req
, ev
);
133 tevent_req_set_callback(subreq
, wb_sids2xids_lookupsids_done
, req
);
137 static bool wb_sids2xids_in_cache(struct dom_sid
*sid
, struct id_map
*map
)
142 if (!winbindd_use_idmap_cache()) {
145 if (idmap_cache_find_sid2unixid(sid
, &id
, &expired
)) {
146 if (expired
&& is_domain_online(find_our_domain())) {
151 map
->status
= ID_MAPPED
;
157 static enum id_type
lsa_SidType_to_id_type(const enum lsa_SidType sid_type
);
158 static struct wbint_TransIDArray
*wb_sids2xids_extract_for_domain_index(
159 TALLOC_CTX
*mem_ctx
, const struct wbint_TransIDArray
*src
,
160 uint32_t domain_index
);
162 static void wb_sids2xids_lookupsids_done(struct tevent_req
*subreq
)
164 struct tevent_req
*req
= tevent_req_callback_data(
165 subreq
, struct tevent_req
);
166 struct wb_sids2xids_state
*state
= tevent_req_data(
167 req
, struct wb_sids2xids_state
);
168 struct lsa_RefDomainList
*domains
= NULL
;
169 struct lsa_TransNameArray
*names
= NULL
;
170 struct winbindd_child
*child
;
174 status
= wb_lookupsids_recv(subreq
, state
, &domains
, &names
);
176 if (tevent_req_nterror(req
, status
)) {
180 state
->ids
.num_ids
= state
->num_non_cached
;
181 state
->ids
.ids
= talloc_array(state
, struct wbint_TransID
,
182 state
->num_non_cached
);
183 if (tevent_req_nomem(state
->ids
.ids
, req
)) {
187 for (i
=0; i
<state
->num_non_cached
; i
++) {
188 struct dom_sid dom_sid
;
189 struct lsa_DomainInfo
*info
;
190 struct lsa_TranslatedName
*n
= &names
->names
[i
];
191 struct wbint_TransID
*t
= &state
->ids
.ids
[i
];
194 sid_copy(&dom_sid
, &state
->non_cached
[i
]);
195 sid_split_rid(&dom_sid
, &t
->rid
);
197 info
= &domains
->domains
[n
->sid_index
];
198 t
->type
= lsa_SidType_to_id_type(n
->sid_type
);
200 domain_index
= init_lsa_ref_domain_list(
201 state
, &state
->idmap_doms
, info
->name
.string
, &dom_sid
);
202 if (domain_index
== -1) {
206 t
->domain_index
= domain_index
;
208 t
->xid
.id
= UINT32_MAX
;
209 t
->xid
.type
= t
->type
;
213 TALLOC_FREE(domains
);
215 child
= idmap_child();
217 state
->dom_ids
= wb_sids2xids_extract_for_domain_index(
218 state
, &state
->ids
, state
->dom_index
);
219 if (tevent_req_nomem(state
->dom_ids
, req
)) {
223 state
->idmap_dom
= (struct lsa_RefDomainList
) {
225 .domains
= &state
->idmap_doms
.domains
[state
->dom_index
],
229 subreq
= dcerpc_wbint_Sids2UnixIDs_send(
230 state
, state
->ev
, child
->binding_handle
, &state
->idmap_dom
,
232 if (tevent_req_nomem(subreq
, req
)) {
235 tevent_req_set_callback(subreq
, wb_sids2xids_done
, req
);
238 static enum id_type
lsa_SidType_to_id_type(const enum lsa_SidType sid_type
)
243 case SID_NAME_COMPUTER
:
247 case SID_NAME_DOM_GRP
:
249 case SID_NAME_WKN_GRP
:
253 type
= ID_TYPE_NOT_SPECIFIED
;
260 static void wb_sids2xids_done(struct tevent_req
*subreq
)
262 struct tevent_req
*req
= tevent_req_callback_data(
263 subreq
, struct tevent_req
);
264 struct wb_sids2xids_state
*state
= tevent_req_data(
265 req
, struct wb_sids2xids_state
);
266 NTSTATUS status
, result
;
267 struct winbindd_child
*child
;
269 struct wbint_TransIDArray
*src
, *dst
;
272 status
= dcerpc_wbint_Sids2UnixIDs_recv(subreq
, state
, &result
);
275 if (tevent_req_nterror(req
, status
)) {
279 if (NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) &&
280 !state
->tried_dclookup
) {
282 struct lsa_DomainInfo
*d
;
284 d
= &state
->idmap_doms
.domains
[state
->dom_index
];
286 subreq
= wb_dsgetdcname_send(
287 state
, state
->ev
, d
->name
.string
, NULL
, NULL
,
289 if (tevent_req_nomem(subreq
, req
)) {
292 tevent_req_set_callback(subreq
, wb_sids2xids_gotdc
, req
);
296 src
= state
->dom_ids
;
300 if (any_nt_status_not_ok(status
, result
, &status
)) {
301 DBG_DEBUG("status=%s, result=%s\n", nt_errstr(status
),
305 * All we can do here is to report "not mapped"
307 for (i
=0; i
<src
->num_ids
; i
++) {
308 src
->ids
[i
].xid
.type
= ID_TYPE_NOT_SPECIFIED
;
312 for (i
=0; i
<dst
->num_ids
; i
++) {
313 if (dst
->ids
[i
].domain_index
== state
->dom_index
) {
314 dst
->ids
[i
].type
= src
->ids
[src_idx
].type
;
315 dst
->ids
[i
].xid
= src
->ids
[src_idx
].xid
;
320 TALLOC_FREE(state
->dom_ids
);
322 state
->dom_index
+= 1;
323 state
->tried_dclookup
= false;
325 if (state
->dom_index
== state
->idmap_doms
.count
) {
326 tevent_req_done(req
);
330 child
= idmap_child();
332 state
->dom_ids
= wb_sids2xids_extract_for_domain_index(
333 state
, &state
->ids
, state
->dom_index
);
334 if (tevent_req_nomem(state
->dom_ids
, req
)) {
338 state
->idmap_dom
= (struct lsa_RefDomainList
) {
340 .domains
= &state
->idmap_doms
.domains
[state
->dom_index
],
344 subreq
= dcerpc_wbint_Sids2UnixIDs_send(
345 state
, state
->ev
, child
->binding_handle
, &state
->idmap_dom
,
347 if (tevent_req_nomem(subreq
, req
)) {
350 tevent_req_set_callback(subreq
, wb_sids2xids_done
, req
);
353 static void wb_sids2xids_gotdc(struct tevent_req
*subreq
)
355 struct tevent_req
*req
= tevent_req_callback_data(
356 subreq
, struct tevent_req
);
357 struct wb_sids2xids_state
*state
= tevent_req_data(
358 req
, struct wb_sids2xids_state
);
359 struct winbindd_child
*child
= idmap_child();
360 struct netr_DsRGetDCNameInfo
*dcinfo
;
363 status
= wb_dsgetdcname_recv(subreq
, state
, &dcinfo
);
365 if (tevent_req_nterror(req
, status
)) {
369 state
->tried_dclookup
= true;
372 struct lsa_DomainInfo
*d
=
373 &state
->idmap_doms
.domains
[state
->dom_index
];
374 const char *dom_name
= d
->name
.string
;
376 status
= wb_dsgetdcname_gencache_set(dom_name
, dcinfo
);
377 if (tevent_req_nterror(req
, status
)) {
382 subreq
= dcerpc_wbint_Sids2UnixIDs_send(
383 state
, state
->ev
, child
->binding_handle
, &state
->idmap_dom
,
385 if (tevent_req_nomem(subreq
, req
)) {
388 tevent_req_set_callback(subreq
, wb_sids2xids_done
, req
);
391 NTSTATUS
wb_sids2xids_recv(struct tevent_req
*req
,
392 struct unixid xids
[], uint32_t num_xids
)
394 struct wb_sids2xids_state
*state
= tevent_req_data(
395 req
, struct wb_sids2xids_state
);
397 uint32_t i
, num_non_cached
;
399 if (tevent_req_is_nterror(req
, &status
)) {
400 DEBUG(5, ("wb_sids_to_xids failed: %s\n", nt_errstr(status
)));
404 if (num_xids
!= state
->num_sids
) {
405 DEBUG(1, ("%s: Have %u xids, caller wants %u\n", __func__
,
406 (unsigned)state
->num_sids
, num_xids
));
407 return NT_STATUS_INTERNAL_ERROR
;
412 for (i
=0; i
<state
->num_sids
; i
++) {
417 if (state
->cached
[i
].sid
!= NULL
) {
418 xid
= state
->cached
[i
].xid
;
420 xid
= state
->ids
.ids
[num_non_cached
].xid
;
422 idmap_cache_set_sid2unixid(
423 &state
->non_cached
[num_non_cached
],
435 static struct wbint_TransIDArray
*wb_sids2xids_extract_for_domain_index(
436 TALLOC_CTX
*mem_ctx
, const struct wbint_TransIDArray
*src
,
437 uint32_t domain_index
)
439 struct wbint_TransIDArray
*ret
;
442 ret
= talloc_zero(mem_ctx
, struct wbint_TransIDArray
);
446 ret
->ids
= talloc_array(ret
, struct wbint_TransID
, src
->num_ids
);
447 if (ret
->ids
== NULL
) {
452 for (i
=0; i
<src
->num_ids
; i
++) {
453 if (src
->ids
[i
].domain_index
== domain_index
) {
454 ret
->ids
[ret
->num_ids
] = src
->ids
[i
];
455 ret
->ids
[ret
->num_ids
].domain_index
= 0;