source3/winbindd/wb_group_members.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    async lookupgroupmembers
   4    Copyright (C) Volker Lendecke 2009
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "librpc/gen_ndr/ndr_winbind_c.h"
  23 #include "../librpc/gen_ndr/ndr_security.h"
  24 #include "../libcli/security/security.h"
  25 #include "lib/util/util_tdb.h"
  26 #include "lib/dbwrap/dbwrap.h"
  27 #include "lib/dbwrap/dbwrap_rbt.h"
  28
  29 /*
  30  * We have 3 sets of routines here:
  31  *
  32  * wb_lookupgroupmem is the low-level one-group routine
  33  *
  34  * wb_groups_members walks a list of groups
  35  *
  36  * wb_group_members finally is the high-level routine expanding groups
  37  * recursively
  38  */
  39
  40 /*
  41  * TODO: fill_grent_mem_domusers must be re-added
  42  */
  43
  44 /*
  45  * Look up members of a single group. Essentially a wrapper around the
  46  * lookup_groupmem winbindd_methods routine.
  47  */
  48
  49 struct wb_lookupgroupmem_state {
  50         struct dom_sid sid;
  51         struct wbint_Principals members;
  52 };
  53
  54 static void wb_lookupgroupmem_done(struct tevent_req *subreq);
  55
  56 static struct tevent_req *wb_lookupgroupmem_send(TALLOC_CTX *mem_ctx,
  57                                                  struct tevent_context *ev,
  58                                                  const struct dom_sid *group_sid,
  59                                                  enum lsa_SidType type)
  60 {
  61         struct tevent_req *req, *subreq;
  62         struct wb_lookupgroupmem_state *state;
  63         struct winbindd_domain *domain;
  64
  65         req = tevent_req_create(mem_ctx, &state,
  66                                 struct wb_lookupgroupmem_state);
  67         if (req == NULL) {
  68                 return NULL;
  69         }
  70         sid_copy(&state->sid, group_sid);
  71
  72         domain = find_domain_from_sid_noinit(group_sid);
  73         if (domain == NULL) {
  74                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
  75                 return tevent_req_post(req, ev);
  76         }
  77
  78         subreq = dcerpc_wbint_LookupGroupMembers_send(
  79                 state, ev, dom_child_handle(domain), &state->sid, type,
  80                 &state->members);
  81         if (tevent_req_nomem(subreq, req)) {
  82                 return tevent_req_post(req, ev);
  83         }
  84         tevent_req_set_callback(subreq, wb_lookupgroupmem_done, req);
  85         return req;
  86 }
  87
  88 static void wb_lookupgroupmem_done(struct tevent_req *subreq)
  89 {
  90         struct tevent_req *req = tevent_req_callback_data(
  91                 subreq, struct tevent_req);
  92         struct wb_lookupgroupmem_state *state = tevent_req_data(
  93                 req, struct wb_lookupgroupmem_state);
  94         NTSTATUS status, result;
  95
  96         status = dcerpc_wbint_LookupGroupMembers_recv(subreq, state, &result);
  97         TALLOC_FREE(subreq);
  98         if (any_nt_status_not_ok(status, result, &status)) {
  99                 tevent_req_nterror(req, status);
 100                 return;
 101         }
 102         tevent_req_done(req);
 103 }
 104
 105 static NTSTATUS wb_lookupgroupmem_recv(struct tevent_req *req,
 106                                        TALLOC_CTX *mem_ctx,
 107                                        uint32_t *num_members,
 108                                        struct wbint_Principal **members)
 109 {
 110         struct wb_lookupgroupmem_state *state = tevent_req_data(
 111                 req, struct wb_lookupgroupmem_state);
 112         NTSTATUS status;
 113
 114         if (tevent_req_is_nterror(req, &status)) {
 115                 return status;
 116         }
 117
 118         *num_members = state->members.num_principals;
 119         *members = talloc_move(mem_ctx, &state->members.principals);
 120         return NT_STATUS_OK;
 121 }
 122
 123 /*
 124  * Same as wb_lookupgroupmem for a list of groups
 125  */
 126
 127 struct wb_groups_members_state {
 128         struct tevent_context *ev;
 129         struct wbint_Principal *groups;
 130         uint32_t num_groups;
 131         uint32_t next_group;
 132         struct wbint_Principal *all_members;
 133 };
 134
 135 static NTSTATUS wb_groups_members_next_subreq(
 136         struct wb_groups_members_state *state,
 137         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq);
 138 static void wb_groups_members_done(struct tevent_req *subreq);
 139
 140 static struct tevent_req *wb_groups_members_send(TALLOC_CTX *mem_ctx,
 141                                                  struct tevent_context *ev,
 142                                                  uint32_t num_groups,
 143                                                  struct wbint_Principal *groups)
 144 {
 145         struct tevent_req *req, *subreq = NULL;
 146         struct wb_groups_members_state *state;
 147         NTSTATUS status;
 148
 149         req = tevent_req_create(mem_ctx, &state,
 150                                 struct wb_groups_members_state);
 151         if (req == NULL) {
 152                 return NULL;
 153         }
 154         state->ev = ev;
 155         state->groups = groups;
 156         state->num_groups = num_groups;
 157         state->next_group = 0;
 158         state->all_members = NULL;
 159
 160         D_DEBUG("Looking up %"PRIu32" group(s).\n", num_groups);
 161         status = wb_groups_members_next_subreq(state, state, &subreq);
 162         if (tevent_req_nterror(req, status)) {
 163                 return tevent_req_post(req, ev);
 164         }
 165         if (subreq == NULL) {
 166                 tevent_req_done(req);
 167                 return tevent_req_post(req, ev);
 168         }
 169         tevent_req_set_callback(subreq, wb_groups_members_done, req);
 170         return req;
 171 }
 172
 173 static NTSTATUS wb_groups_members_next_subreq(
 174         struct wb_groups_members_state *state,
 175         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq)
 176 {
 177         struct tevent_req *subreq;
 178         struct wbint_Principal *g;
 179
 180         if (state->next_group >= state->num_groups) {
 181                 *psubreq = NULL;
 182                 return NT_STATUS_OK;
 183         }
 184
 185         g = &state->groups[state->next_group];
 186         state->next_group += 1;
 187
 188         subreq = wb_lookupgroupmem_send(mem_ctx, state->ev, &g->sid, g->type);
 189         if (subreq == NULL) {
 190                 return NT_STATUS_NO_MEMORY;
 191         }
 192         *psubreq = subreq;
 193         return NT_STATUS_OK;
 194 }
 195
 196 static void wb_groups_members_done(struct tevent_req *subreq)
 197 {
 198         struct tevent_req *req = tevent_req_callback_data(
 199                 subreq, struct tevent_req);
 200         struct wb_groups_members_state *state = tevent_req_data(
 201                 req, struct wb_groups_members_state);
 202         uint32_t i, num_all_members;
 203         uint32_t num_members = 0;
 204         struct wbint_Principal *members = NULL;
 205         NTSTATUS status;
 206
 207         status = wb_lookupgroupmem_recv(subreq, state, &num_members, &members);
 208         TALLOC_FREE(subreq);
 209
 210         /*
 211          * In this error handling here we might have to be a bit more generous
 212          * and just continue if an error occurred.
 213          */
 214
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 if (!NT_STATUS_EQUAL(
 217                             status, NT_STATUS_TRUSTED_DOMAIN_FAILURE)) {
 218                         tevent_req_nterror(req, status);
 219                         return;
 220                 }
 221                 num_members = 0;
 222         }
 223
 224         num_all_members = talloc_array_length(state->all_members);
 225
 226         D_DEBUG("Adding %"PRIu32" new member(s) to existing %"PRIu32" member(s)\n",
 227                 num_members,
 228                 num_all_members);
 229
 230         state->all_members = talloc_realloc(
 231                 state, state->all_members, struct wbint_Principal,
 232                 num_all_members + num_members);
 233         if ((num_all_members + num_members != 0)
 234             && tevent_req_nomem(state->all_members, req)) {
 235                 return;
 236         }
 237         for (i=0; i<num_members; i++) {
 238                 struct wbint_Principal *src, *dst;
 239                 src = &members[i];
 240                 dst = &state->all_members[num_all_members + i];
 241                 sid_copy(&dst->sid, &src->sid);
 242                 dst->name = talloc_move(state->all_members, &src->name);
 243                 dst->type = src->type;
 244         }
 245         TALLOC_FREE(members);
 246
 247         status = wb_groups_members_next_subreq(state, state, &subreq);
 248         if (tevent_req_nterror(req, status)) {
 249                 return;
 250         }
 251         if (subreq == NULL) {
 252                 tevent_req_done(req);
 253                 return;
 254         }
 255         tevent_req_set_callback(subreq, wb_groups_members_done, req);
 256 }
 257
 258 static NTSTATUS wb_groups_members_recv(struct tevent_req *req,
 259                                        TALLOC_CTX *mem_ctx,
 260                                        uint32_t *num_members,
 261                                        struct wbint_Principal **members)
 262 {
 263         struct wb_groups_members_state *state = tevent_req_data(
 264                 req, struct wb_groups_members_state);
 265         NTSTATUS status;
 266
 267         if (tevent_req_is_nterror(req, &status)) {
 268                 return status;
 269         }
 270         *num_members = talloc_array_length(state->all_members);
 271         *members = talloc_move(mem_ctx, &state->all_members);
 272         return NT_STATUS_OK;
 273 }
 274
 275
 276 /*
 277  * This is the routine expanding a list of groups up to a certain level. We
 278  * collect the users in a rbt database: We have to add them without duplicates,
 279  * and the db is indexed by SID.
 280  */
 281
 282 struct wb_group_members_state {
 283         struct tevent_context *ev;
 284         int depth;
 285         struct db_context *users;
 286         struct wbint_Principal *groups;
 287 };
 288
 289 static NTSTATUS wb_group_members_next_subreq(
 290         struct wb_group_members_state *state,
 291         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq);
 292 static void wb_group_members_done(struct tevent_req *subreq);
 293
 294 struct tevent_req *wb_group_members_send(TALLOC_CTX *mem_ctx,
 295                                          struct tevent_context *ev,
 296                                          const struct dom_sid *sid,
 297                                          enum lsa_SidType type,
 298                                          int max_depth)
 299 {
 300         struct tevent_req *req, *subreq = NULL;
 301         struct wb_group_members_state *state;
 302         NTSTATUS status;
 303         struct dom_sid_buf buf;
 304
 305         req = tevent_req_create(mem_ctx, &state,
 306                                 struct wb_group_members_state);
 307         if (req == NULL) {
 308                 return NULL;
 309         }
 310         D_INFO("WB command group_members start.\n"
 311                "Looking up domain SID %s with SID type %d and max_depth %d.\n",
 312                dom_sid_str_buf(sid, &buf),
 313                type,
 314                max_depth);
 315
 316         state->ev = ev;
 317         state->depth = max_depth;
 318         state->users = db_open_rbt(state);
 319         if (tevent_req_nomem(state->users, req)) {
 320                 return tevent_req_post(req, ev);
 321         }
 322
 323         state->groups = talloc(state, struct wbint_Principal);
 324         if (tevent_req_nomem(state->groups, req)) {
 325                 return tevent_req_post(req, ev);
 326         }
 327         state->groups->name = NULL;
 328         sid_copy(&state->groups->sid, sid);
 329         state->groups->type = type;
 330
 331         status = wb_group_members_next_subreq(state, state, &subreq);
 332         if (tevent_req_nterror(req, status)) {
 333                 return tevent_req_post(req, ev);
 334         }
 335         if (subreq == NULL) {
 336                 tevent_req_done(req);
 337                 return tevent_req_post(req, ev);
 338         }
 339         tevent_req_set_callback(subreq, wb_group_members_done, req);
 340         return req;
 341 }
 342
 343 static NTSTATUS wb_group_members_next_subreq(
 344         struct wb_group_members_state *state,
 345         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq)
 346 {
 347         struct tevent_req *subreq;
 348
 349         if ((talloc_array_length(state->groups) == 0)
 350             || (state->depth <= 0)) {
 351                 *psubreq = NULL;
 352                 D_DEBUG("Finished. The depth is %d.\n", state->depth);
 353                 return NT_STATUS_OK;
 354         }
 355         state->depth -= 1;
 356
 357         D_DEBUG("The depth is decremented to %d.\n", state->depth);
 358         subreq = wb_groups_members_send(
 359                 mem_ctx, state->ev, talloc_array_length(state->groups),
 360                 state->groups);
 361         if (subreq == NULL) {
 362                 return NT_STATUS_NO_MEMORY;
 363         }
 364         *psubreq = subreq;
 365         return NT_STATUS_OK;
 366 }
 367
 368 NTSTATUS add_member_to_db(struct db_context *db, struct dom_sid *sid,
 369                           const char *name)
 370 {
 371         size_t len = ndr_size_dom_sid(sid, 0);
 372         uint8_t sidbuf[len];
 373         TDB_DATA key = { .dptr = sidbuf, .dsize = sizeof(sidbuf) };
 374         NTSTATUS status;
 375
 376         sid_linearize(sidbuf, sizeof(sidbuf), sid);
 377
 378         status = dbwrap_store(db, key, string_term_tdb_data(name), 0);
 379         return status;
 380 }
 381
 382 static void wb_group_members_done(struct tevent_req *subreq)
 383 {
 384         struct tevent_req *req = tevent_req_callback_data(
 385                 subreq, struct tevent_req);
 386         struct wb_group_members_state *state = tevent_req_data(
 387                 req, struct wb_group_members_state);
 388         uint32_t i, num_groups, new_groups;
 389         uint32_t num_members = 0;
 390         struct wbint_Principal *members = NULL;
 391         NTSTATUS status;
 392
 393         status = wb_groups_members_recv(subreq, state, &num_members, &members);
 394         TALLOC_FREE(subreq);
 395         if (tevent_req_nterror(req, status)) {
 396                 return;
 397         }
 398
 399         new_groups = 0;
 400         for (i=0; i<num_members; i++) {
 401                 switch (members[i].type) {
 402                 case SID_NAME_DOM_GRP:
 403                 case SID_NAME_ALIAS:
 404                 case SID_NAME_WKN_GRP:
 405                         new_groups += 1;
 406                         break;
 407                 default:
 408                         /* Ignore everything else */
 409                         break;
 410                 }
 411         }
 412
 413         num_groups = 0;
 414         TALLOC_FREE(state->groups);
 415         state->groups = talloc_array(state, struct wbint_Principal,
 416                                      new_groups);
 417
 418         /*
 419          * Collect the users into state->users and the groups into
 420          * state->groups for the next iteration.
 421          */
 422
 423         for (i=0; i<num_members; i++) {
 424                 switch (members[i].type) {
 425                 case SID_NAME_USER:
 426                 case SID_NAME_COMPUTER: {
 427                         /*
 428                          * Add a copy of members[i] to state->users
 429                          */
 430                         status = add_member_to_db(state->users, &members[i].sid,
 431                                                   members[i].name);
 432                         if (tevent_req_nterror(req, status)) {
 433                                 return;
 434                         }
 435
 436                         break;
 437                 }
 438                 case SID_NAME_DOM_GRP:
 439                 case SID_NAME_ALIAS:
 440                 case SID_NAME_WKN_GRP: {
 441                         struct wbint_Principal *g;
 442                         /*
 443                          * Save members[i] for the next round
 444                          */
 445                         g = &state->groups[num_groups];
 446                         sid_copy(&g->sid, &members[i].sid);
 447                         g->name = talloc_move(state->groups, &members[i].name);
 448                         g->type = members[i].type;
 449                         num_groups += 1;
 450                         break;
 451                 }
 452                 default:
 453                         /* Ignore everything else */
 454                         break;
 455                 }
 456         }
 457
 458         status = wb_group_members_next_subreq(state, state, &subreq);
 459         if (tevent_req_nterror(req, status)) {
 460                 return;
 461         }
 462         if (subreq == NULL) {
 463                 tevent_req_done(req);
 464                 return;
 465         }
 466         tevent_req_set_callback(subreq, wb_group_members_done, req);
 467 }
 468
 469 NTSTATUS wb_group_members_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 470                                struct db_context **members)
 471 {
 472         struct wb_group_members_state *state = tevent_req_data(
 473                 req, struct wb_group_members_state);
 474         NTSTATUS status;
 475
 476         D_INFO("WB command group_members end.\n");
 477         if (tevent_req_is_nterror(req, &status)) {
 478                 D_WARNING("Failed with %s.\n", nt_errstr(status));
 479                 return status;
 480         }
 481         *members = talloc_move(mem_ctx, &state->users);
 482         return NT_STATUS_OK;
 483 }