2 Unix SMB/CIFS implementation.
4 Winbind daemon - sid related functions
6 Copyright (C) Tim Potter 2000
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #define DBGC_CLASS DBGC_WINBIND
28 /* Convert a string */
30 static void lookupsid_recv(void *private_data
, bool success
,
31 const char *dom_name
, const char *name
,
32 enum lsa_SidType type
);
34 void winbindd_lookupsid(struct winbindd_cli_state
*state
)
38 /* Ensure null termination */
39 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
41 DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state
->pid
,
42 state
->request
.data
.sid
));
44 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
45 DEBUG(5, ("%s not a SID\n", state
->request
.data
.sid
));
50 winbindd_lookupsid_async(state
->mem_ctx
, &sid
, lookupsid_recv
, state
);
53 static void lookupsid_recv(void *private_data
, bool success
,
54 const char *dom_name
, const char *name
,
55 enum lsa_SidType type
)
57 struct winbindd_cli_state
*state
=
58 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
61 DEBUG(5, ("lookupsid returned an error\n"));
66 fstrcpy(state
->response
.data
.name
.dom_name
, dom_name
);
67 fstrcpy(state
->response
.data
.name
.name
, name
);
68 state
->response
.data
.name
.type
= type
;
73 * Look up the SID for a qualified name.
76 static void lookupname_recv(void *private_data
, bool success
,
77 const DOM_SID
*sid
, enum lsa_SidType type
);
79 void winbindd_lookupname(struct winbindd_cli_state
*state
)
81 char *name_domain
, *name_user
;
84 /* Ensure null termination */
85 state
->request
.data
.name
.dom_name
[sizeof(state
->request
.data
.name
.dom_name
)-1]='\0';
87 /* Ensure null termination */
88 state
->request
.data
.name
.name
[sizeof(state
->request
.data
.name
.name
)-1]='\0';
90 /* cope with the name being a fully qualified name */
91 p
= strstr(state
->request
.data
.name
.name
, lp_winbind_separator());
94 name_domain
= state
->request
.data
.name
.name
;
97 name_domain
= state
->request
.data
.name
.dom_name
;
98 name_user
= state
->request
.data
.name
.name
;
101 DEBUG(3, ("[%5lu]: lookupname %s%s%s\n", (unsigned long)state
->pid
,
102 name_domain
, lp_winbind_separator(), name_user
));
104 winbindd_lookupname_async(state
->mem_ctx
, name_domain
, name_user
,
105 lookupname_recv
, WINBINDD_LOOKUPNAME
,
109 static void lookupname_recv(void *private_data
, bool success
,
110 const DOM_SID
*sid
, enum lsa_SidType type
)
112 struct winbindd_cli_state
*state
=
113 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
116 DEBUG(5, ("lookupname returned an error\n"));
117 request_error(state
);
121 sid_to_fstring(state
->response
.data
.sid
.sid
, sid
);
122 state
->response
.data
.sid
.type
= type
;
127 void winbindd_lookuprids(struct winbindd_cli_state
*state
)
129 struct winbindd_domain
*domain
;
132 /* Ensure null termination */
133 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
135 DEBUG(10, ("lookup_rids: %s\n", state
->request
.data
.sid
));
137 if (!string_to_sid(&domain_sid
, state
->request
.data
.sid
)) {
138 DEBUG(5, ("Could not convert %s to SID\n",
139 state
->request
.data
.sid
));
140 request_error(state
);
144 domain
= find_lookup_domain_from_sid(&domain_sid
);
145 if (domain
== NULL
) {
146 DEBUG(10, ("Could not find domain for name %s\n",
147 state
->request
.domain_name
));
148 request_error(state
);
152 sendto_domain(state
, domain
);
155 /* Convert a sid to a uid. We assume we only have one rid attached to the
158 static void sid2uid_recv(void *private_data
, bool success
, uid_t uid
)
160 struct winbindd_cli_state
*state
=
161 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
164 string_to_sid(&sid
, state
->request
.data
.sid
);
167 DEBUG(5, ("Could not convert sid %s\n",
168 state
->request
.data
.sid
));
169 idmap_cache_set_sid2uid(&sid
, -1);
170 request_error(state
);
174 idmap_cache_set_sid2uid(&sid
, uid
);
175 state
->response
.data
.uid
= uid
;
179 static void sid2uid_lookupsid_recv( void *private_data
, bool success
,
180 const char *domain_name
,
182 enum lsa_SidType type
)
184 struct winbindd_cli_state
*state
=
185 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
188 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
189 DEBUG(1, ("sid2uid_lookupsid_recv: Could not get convert sid "
190 "%s from string\n", state
->request
.data
.sid
));
191 request_error(state
);
196 DEBUG(5, ("sid2uid_lookupsid_recv Could not convert get sid type for %s\n",
197 state
->request
.data
.sid
));
201 if ( (type
!=SID_NAME_USER
) && (type
!=SID_NAME_COMPUTER
) ) {
202 DEBUG(5,("sid2uid_lookupsid_recv: Sid %s is not a user or a computer.\n",
203 state
->request
.data
.sid
));
207 /* always use the async interface (may block) */
208 winbindd_sid2uid_async(state
->mem_ctx
, &sid
, sid2uid_recv
, state
);
212 idmap_cache_set_sid2uid(&sid
, -1);
213 request_error(state
);
217 void winbindd_sid_to_uid(struct winbindd_cli_state
*state
)
223 /* Ensure null termination */
224 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
226 DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state
->pid
,
227 state
->request
.data
.sid
));
229 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
230 DEBUG(1, ("Could not get convert sid %s from string\n",
231 state
->request
.data
.sid
));
232 request_error(state
);
236 if (idmap_cache_find_sid2uid(&sid
, &uid
, &expired
)) {
237 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
238 (int)uid
, expired
? " (expired)": ""));
239 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
240 DEBUG(10, ("revalidating expired entry\n"));
244 DEBUG(10, ("Returning negative cache entry\n"));
245 request_error(state
);
248 DEBUG(10, ("Returning positive cache entry\n"));
249 state
->response
.data
.uid
= uid
;
254 /* Validate the SID as a user. Hopefully this will hit cache.
255 Needed to prevent DoS by exhausting the uid allocation
256 range from random SIDs. */
259 winbindd_lookupsid_async( state
->mem_ctx
, &sid
, sid2uid_lookupsid_recv
, state
);
262 /* Convert a sid to a gid. We assume we only have one rid attached to the
265 static void sid2gid_recv(void *private_data
, bool success
, gid_t gid
)
267 struct winbindd_cli_state
*state
=
268 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
271 string_to_sid(&sid
, state
->request
.data
.sid
);
274 DEBUG(5, ("Could not convert sid %s\n",
275 state
->request
.data
.sid
));
276 idmap_cache_set_sid2gid(&sid
, -1);
277 request_error(state
);
281 idmap_cache_set_sid2gid(&sid
, gid
);
282 state
->response
.data
.gid
= gid
;
286 static void sid2gid_lookupsid_recv( void *private_data
, bool success
,
287 const char *domain_name
,
289 enum lsa_SidType type
)
291 struct winbindd_cli_state
*state
=
292 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
295 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
296 DEBUG(1, ("sid2gid_lookupsid_recv: Could not get convert sid "
297 "%s from string\n", state
->request
.data
.sid
));
298 request_error(state
);
303 DEBUG(5, ("sid2gid_lookupsid_recv: Could not get sid type for %s\n",
304 state
->request
.data
.sid
));
308 if ( (type
!=SID_NAME_DOM_GRP
) &&
309 (type
!=SID_NAME_ALIAS
) &&
310 (type
!=SID_NAME_WKN_GRP
) )
312 DEBUG(5,("sid2gid_lookupsid_recv: Sid %s is not a group.\n",
313 state
->request
.data
.sid
));
317 /* always use the async interface (may block) */
318 winbindd_sid2gid_async(state
->mem_ctx
, &sid
, sid2gid_recv
, state
);
322 idmap_cache_set_sid2gid(&sid
, -1);
323 request_error(state
);
327 void winbindd_sid_to_gid(struct winbindd_cli_state
*state
)
333 /* Ensure null termination */
334 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
336 DEBUG(3, ("[%5lu]: sid to gid %s\n", (unsigned long)state
->pid
,
337 state
->request
.data
.sid
));
339 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
340 DEBUG(1, ("Could not get convert sid %s from string\n",
341 state
->request
.data
.sid
));
342 request_error(state
);
346 if (idmap_cache_find_sid2gid(&sid
, &gid
, &expired
)) {
347 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
348 (int)gid
, expired
? " (expired)": ""));
349 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
350 DEBUG(10, ("revalidating expired entry\n"));
354 DEBUG(10, ("Returning negative cache entry\n"));
355 request_error(state
);
358 DEBUG(10, ("Returning positive cache entry\n"));
359 state
->response
.data
.gid
= gid
;
364 /* Validate the SID as a group. Hopefully this will hit cache.
365 Needed to prevent DoS by exhausting the uid allocation
366 range from random SIDs. */
369 winbindd_lookupsid_async( state
->mem_ctx
, &sid
, sid2gid_lookupsid_recv
, state
);
372 static void sids2xids_recv(void *private_data
, bool success
, void *data
, int len
)
374 struct winbindd_cli_state
*state
=
375 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
378 DEBUG(5, ("Could not convert sids to xids\n"));
379 request_error(state
);
383 state
->response
.extra_data
.data
= data
;
384 state
->response
.length
= sizeof(state
->response
) + len
;
388 void winbindd_sids_to_unixids(struct winbindd_cli_state
*state
)
390 DEBUG(3, ("[%5lu]: sids to xids\n", (unsigned long)state
->pid
));
392 winbindd_sids2xids_async(state
->mem_ctx
,
393 state
->request
.extra_data
.data
,
394 state
->request
.extra_len
,
395 sids2xids_recv
, state
);
398 static void set_mapping_recv(void *private_data
, bool success
)
400 struct winbindd_cli_state
*state
=
401 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
404 DEBUG(5, ("Could not set sid mapping\n"));
405 request_error(state
);
412 void winbindd_set_mapping(struct winbindd_cli_state
*state
)
417 DEBUG(3, ("[%5lu]: set id map\n", (unsigned long)state
->pid
));
419 if ( ! state
->privileged
) {
420 DEBUG(0, ("Only root is allowed to set mappings!\n"));
421 request_error(state
);
425 if (!string_to_sid(&sid
, state
->request
.data
.dual_idmapset
.sid
)) {
426 DEBUG(1, ("Could not get convert sid %s from string\n",
427 state
->request
.data
.sid
));
428 request_error(state
);
433 map
.xid
.id
= state
->request
.data
.dual_idmapset
.id
;
434 map
.xid
.type
= state
->request
.data
.dual_idmapset
.type
;
436 winbindd_set_mapping_async(state
->mem_ctx
, &map
,
437 set_mapping_recv
, state
);
440 static void set_hwm_recv(void *private_data
, bool success
)
442 struct winbindd_cli_state
*state
=
443 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
446 DEBUG(5, ("Could not set sid mapping\n"));
447 request_error(state
);
454 void winbindd_set_hwm(struct winbindd_cli_state
*state
)
458 DEBUG(3, ("[%5lu]: set hwm\n", (unsigned long)state
->pid
));
460 if ( ! state
->privileged
) {
461 DEBUG(0, ("Only root is allowed to set mappings!\n"));
462 request_error(state
);
466 xid
.id
= state
->request
.data
.dual_idmapset
.id
;
467 xid
.type
= state
->request
.data
.dual_idmapset
.type
;
469 winbindd_set_hwm_async(state
->mem_ctx
, &xid
, set_hwm_recv
, state
);
472 /* Convert a uid to a sid */
474 static void uid2sid_recv(void *private_data
, bool success
, const char *sidstr
)
476 struct winbindd_cli_state
*state
=
477 (struct winbindd_cli_state
*)private_data
;
480 if (!success
|| !string_to_sid(&sid
, sidstr
)) {
482 idmap_cache_set_sid2uid(&sid
, state
->request
.data
.uid
);
483 request_error(state
);
487 DEBUG(10,("uid2sid: uid %lu has sid %s\n",
488 (unsigned long)(state
->request
.data
.uid
), sidstr
));
490 idmap_cache_set_sid2uid(&sid
, state
->request
.data
.uid
);
491 fstrcpy(state
->response
.data
.sid
.sid
, sidstr
);
492 state
->response
.data
.sid
.type
= SID_NAME_USER
;
497 void winbindd_uid_to_sid(struct winbindd_cli_state
*state
)
502 DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state
->pid
,
503 (unsigned long)state
->request
.data
.uid
));
505 if (idmap_cache_find_uid2sid(state
->request
.data
.uid
, &sid
,
507 DEBUG(10, ("idmap_cache_find_uid2sid found %d%s\n",
508 (int)state
->request
.data
.uid
,
509 expired
? " (expired)": ""));
510 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
511 DEBUG(10, ("revalidating expired entry\n"));
514 if (is_null_sid(&sid
)) {
515 DEBUG(10, ("Returning negative cache entry\n"));
516 request_error(state
);
519 DEBUG(10, ("Returning positive cache entry\n"));
520 sid_to_fstring(state
->response
.data
.sid
.sid
, &sid
);
525 /* always go via the async interface (may block) */
527 winbindd_uid2sid_async(state
->mem_ctx
, state
->request
.data
.uid
, uid2sid_recv
, state
);
530 /* Convert a gid to a sid */
532 static void gid2sid_recv(void *private_data
, bool success
, const char *sidstr
)
534 struct winbindd_cli_state
*state
=
535 (struct winbindd_cli_state
*)private_data
;
538 if (!success
|| !string_to_sid(&sid
, sidstr
)) {
540 idmap_cache_set_sid2gid(&sid
, state
->request
.data
.gid
);
541 request_error(state
);
544 DEBUG(10,("gid2sid: gid %lu has sid %s\n",
545 (unsigned long)(state
->request
.data
.gid
), sid
));
547 idmap_cache_set_sid2gid(&sid
, state
->request
.data
.gid
);
548 fstrcpy(state
->response
.data
.sid
.sid
, sidstr
);
549 state
->response
.data
.sid
.type
= SID_NAME_DOM_GRP
;
555 void winbindd_gid_to_sid(struct winbindd_cli_state
*state
)
560 DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state
->pid
,
561 (unsigned long)state
->request
.data
.gid
));
563 if (idmap_cache_find_gid2sid(state
->request
.data
.gid
, &sid
,
565 DEBUG(10, ("idmap_cache_find_gid2sid found %d%s\n",
566 (int)state
->request
.data
.gid
,
567 expired
? " (expired)": ""));
568 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
569 DEBUG(10, ("revalidating expired entry\n"));
572 if (is_null_sid(&sid
)) {
573 DEBUG(10, ("Returning negative cache entry\n"));
574 request_error(state
);
577 DEBUG(10, ("Returning positive cache entry\n"));
578 sid_to_fstring(state
->response
.data
.sid
.sid
, &sid
);
583 /* always use async calls (may block) */
585 winbindd_gid2sid_async(state
->mem_ctx
, state
->request
.data
.gid
, gid2sid_recv
, state
);
588 void winbindd_allocate_uid(struct winbindd_cli_state
*state
)
590 if ( !state
->privileged
) {
591 DEBUG(2, ("winbindd_allocate_uid: non-privileged access "
593 request_error(state
);
597 sendto_child(state
, idmap_child());
600 enum winbindd_result
winbindd_dual_allocate_uid(struct winbindd_domain
*domain
,
601 struct winbindd_cli_state
*state
)
605 if (!NT_STATUS_IS_OK(idmap_allocate_uid(&xid
))) {
606 return WINBINDD_ERROR
;
608 state
->response
.data
.uid
= xid
.id
;
612 void winbindd_allocate_gid(struct winbindd_cli_state
*state
)
614 if ( !state
->privileged
) {
615 DEBUG(2, ("winbindd_allocate_gid: non-privileged access "
617 request_error(state
);
621 sendto_child(state
, idmap_child());
624 enum winbindd_result
winbindd_dual_allocate_gid(struct winbindd_domain
*domain
,
625 struct winbindd_cli_state
*state
)
629 if (!NT_STATUS_IS_OK(idmap_allocate_gid(&xid
))) {
630 return WINBINDD_ERROR
;
632 state
->response
.data
.gid
= xid
.id
;