2 Unix SMB/CIFS implementation.
4 Winbind daemon - sid related functions
6 Copyright (C) Tim Potter 2000
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #define DBGC_CLASS DBGC_WINBIND
28 /* Convert a string */
30 static void lookupsid_recv(void *private_data
, bool success
,
31 const char *dom_name
, const char *name
,
32 enum lsa_SidType type
);
34 void winbindd_lookupsid(struct winbindd_cli_state
*state
)
38 /* Ensure null termination */
39 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
41 DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state
->pid
,
42 state
->request
.data
.sid
));
44 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
45 DEBUG(5, ("%s not a SID\n", state
->request
.data
.sid
));
50 winbindd_lookupsid_async(state
->mem_ctx
, &sid
, lookupsid_recv
, state
);
53 static void lookupsid_recv(void *private_data
, bool success
,
54 const char *dom_name
, const char *name
,
55 enum lsa_SidType type
)
57 struct winbindd_cli_state
*state
=
58 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
61 DEBUG(5, ("lookupsid returned an error\n"));
66 fstrcpy(state
->response
.data
.name
.dom_name
, dom_name
);
67 fstrcpy(state
->response
.data
.name
.name
, name
);
68 state
->response
.data
.name
.type
= type
;
73 * Look up the SID for a qualified name.
76 static void lookupname_recv(void *private_data
, bool success
,
77 const DOM_SID
*sid
, enum lsa_SidType type
);
79 void winbindd_lookupname(struct winbindd_cli_state
*state
)
81 char *name_domain
, *name_user
;
84 /* Ensure null termination */
85 state
->request
.data
.name
.dom_name
[sizeof(state
->request
.data
.name
.dom_name
)-1]='\0';
87 /* Ensure null termination */
88 state
->request
.data
.name
.name
[sizeof(state
->request
.data
.name
.name
)-1]='\0';
90 /* cope with the name being a fully qualified name */
91 p
= strstr(state
->request
.data
.name
.name
, lp_winbind_separator());
94 name_domain
= state
->request
.data
.name
.name
;
96 } else if ((p
= strchr(state
->request
.data
.name
.name
, '@')) != NULL
) {
100 name_user
= state
->request
.data
.name
.name
;
102 name_domain
= state
->request
.data
.name
.dom_name
;
103 name_user
= state
->request
.data
.name
.name
;
106 DEBUG(3, ("[%5lu]: lookupname %s%s%s\n", (unsigned long)state
->pid
,
107 name_domain
, lp_winbind_separator(), name_user
));
109 winbindd_lookupname_async(state
->mem_ctx
, name_domain
, name_user
,
110 lookupname_recv
, WINBINDD_LOOKUPNAME
,
114 static void lookupname_recv(void *private_data
, bool success
,
115 const DOM_SID
*sid
, enum lsa_SidType type
)
117 struct winbindd_cli_state
*state
=
118 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
121 DEBUG(5, ("lookupname returned an error\n"));
122 request_error(state
);
126 sid_to_fstring(state
->response
.data
.sid
.sid
, sid
);
127 state
->response
.data
.sid
.type
= type
;
132 void winbindd_lookuprids(struct winbindd_cli_state
*state
)
134 struct winbindd_domain
*domain
;
137 /* Ensure null termination */
138 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
140 DEBUG(10, ("lookup_rids: %s\n", state
->request
.data
.sid
));
142 if (!string_to_sid(&domain_sid
, state
->request
.data
.sid
)) {
143 DEBUG(5, ("Could not convert %s to SID\n",
144 state
->request
.data
.sid
));
145 request_error(state
);
149 domain
= find_lookup_domain_from_sid(&domain_sid
);
150 if (domain
== NULL
) {
151 DEBUG(10, ("Could not find domain for name %s\n",
152 state
->request
.domain_name
));
153 request_error(state
);
157 sendto_domain(state
, domain
);
160 /* Convert a sid to a uid. We assume we only have one rid attached to the
163 static void sid2uid_recv(void *private_data
, bool success
, uid_t uid
)
165 struct winbindd_cli_state
*state
=
166 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
169 string_to_sid(&sid
, state
->request
.data
.sid
);
172 DEBUG(5, ("Could not convert sid %s\n",
173 state
->request
.data
.sid
));
174 request_error(state
);
178 state
->response
.data
.uid
= uid
;
182 static void sid2uid_lookupsid_recv( void *private_data
, bool success
,
183 const char *domain_name
,
185 enum lsa_SidType type
)
187 struct winbindd_cli_state
*state
=
188 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
191 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
192 DEBUG(1, ("sid2uid_lookupsid_recv: Could not get convert sid "
193 "%s from string\n", state
->request
.data
.sid
));
194 request_error(state
);
199 DEBUG(5, ("sid2uid_lookupsid_recv Could not convert get sid type for %s\n",
200 state
->request
.data
.sid
));
204 if ( (type
!=SID_NAME_USER
) && (type
!=SID_NAME_COMPUTER
) ) {
205 DEBUG(5,("sid2uid_lookupsid_recv: Sid %s is not a user or a computer.\n",
206 state
->request
.data
.sid
));
210 /* always use the async interface (may block) */
211 winbindd_sid2uid_async(state
->mem_ctx
, &sid
, sid2uid_recv
, state
);
216 * We have to set the cache ourselves here, the child which is
217 * normally responsible was not queried yet.
219 idmap_cache_set_sid2uid(&sid
, -1);
220 request_error(state
);
224 void winbindd_sid_to_uid(struct winbindd_cli_state
*state
)
230 /* Ensure null termination */
231 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
233 DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state
->pid
,
234 state
->request
.data
.sid
));
236 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
237 DEBUG(1, ("Could not get convert sid %s from string\n",
238 state
->request
.data
.sid
));
239 request_error(state
);
243 if (idmap_cache_find_sid2uid(&sid
, &uid
, &expired
)) {
244 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
245 (int)uid
, expired
? " (expired)": ""));
246 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
247 DEBUG(10, ("revalidating expired entry\n"));
251 DEBUG(10, ("Returning negative cache entry\n"));
252 request_error(state
);
255 DEBUG(10, ("Returning positive cache entry\n"));
256 state
->response
.data
.uid
= uid
;
261 /* Validate the SID as a user. Hopefully this will hit cache.
262 Needed to prevent DoS by exhausting the uid allocation
263 range from random SIDs. */
266 winbindd_lookupsid_async( state
->mem_ctx
, &sid
, sid2uid_lookupsid_recv
, state
);
269 /* Convert a sid to a gid. We assume we only have one rid attached to the
272 static void sid2gid_recv(void *private_data
, bool success
, gid_t gid
)
274 struct winbindd_cli_state
*state
=
275 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
278 string_to_sid(&sid
, state
->request
.data
.sid
);
281 DEBUG(5, ("Could not convert sid %s\n",
282 state
->request
.data
.sid
));
283 request_error(state
);
287 state
->response
.data
.gid
= gid
;
291 static void sid2gid_lookupsid_recv( void *private_data
, bool success
,
292 const char *domain_name
,
294 enum lsa_SidType type
)
296 struct winbindd_cli_state
*state
=
297 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
300 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
301 DEBUG(1, ("sid2gid_lookupsid_recv: Could not get convert sid "
302 "%s from string\n", state
->request
.data
.sid
));
303 request_error(state
);
308 DEBUG(5, ("sid2gid_lookupsid_recv: Could not get sid type for %s\n",
309 state
->request
.data
.sid
));
313 if ( (type
!=SID_NAME_DOM_GRP
) &&
314 (type
!=SID_NAME_ALIAS
) &&
315 (type
!=SID_NAME_WKN_GRP
) )
317 DEBUG(5,("sid2gid_lookupsid_recv: Sid %s is not a group.\n",
318 state
->request
.data
.sid
));
322 /* always use the async interface (may block) */
323 winbindd_sid2gid_async(state
->mem_ctx
, &sid
, sid2gid_recv
, state
);
328 * We have to set the cache ourselves here, the child which is
329 * normally responsible was not queried yet.
331 idmap_cache_set_sid2gid(&sid
, -1);
332 request_error(state
);
336 void winbindd_sid_to_gid(struct winbindd_cli_state
*state
)
342 /* Ensure null termination */
343 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
345 DEBUG(3, ("[%5lu]: sid to gid %s\n", (unsigned long)state
->pid
,
346 state
->request
.data
.sid
));
348 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
349 DEBUG(1, ("Could not get convert sid %s from string\n",
350 state
->request
.data
.sid
));
351 request_error(state
);
355 if (idmap_cache_find_sid2gid(&sid
, &gid
, &expired
)) {
356 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
357 (int)gid
, expired
? " (expired)": ""));
358 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
359 DEBUG(10, ("revalidating expired entry\n"));
363 DEBUG(10, ("Returning negative cache entry\n"));
364 request_error(state
);
367 DEBUG(10, ("Returning positive cache entry\n"));
368 state
->response
.data
.gid
= gid
;
373 /* Validate the SID as a group. Hopefully this will hit cache.
374 Needed to prevent DoS by exhausting the uid allocation
375 range from random SIDs. */
378 winbindd_lookupsid_async( state
->mem_ctx
, &sid
, sid2gid_lookupsid_recv
,
382 static void set_mapping_recv(void *private_data
, bool success
)
384 struct winbindd_cli_state
*state
=
385 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
388 DEBUG(5, ("Could not set sid mapping\n"));
389 request_error(state
);
396 void winbindd_set_mapping(struct winbindd_cli_state
*state
)
401 DEBUG(3, ("[%5lu]: set id map\n", (unsigned long)state
->pid
));
403 if ( ! state
->privileged
) {
404 DEBUG(0, ("Only root is allowed to set mappings!\n"));
405 request_error(state
);
409 if (!string_to_sid(&sid
, state
->request
.data
.dual_idmapset
.sid
)) {
410 DEBUG(1, ("Could not get convert sid %s from string\n",
411 state
->request
.data
.sid
));
412 request_error(state
);
417 map
.xid
.id
= state
->request
.data
.dual_idmapset
.id
;
418 map
.xid
.type
= state
->request
.data
.dual_idmapset
.type
;
420 winbindd_set_mapping_async(state
->mem_ctx
, &map
,
421 set_mapping_recv
, state
);
424 static void remove_mapping_recv(void *private_data
, bool success
)
426 struct winbindd_cli_state
*state
=
427 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
430 DEBUG(5, ("Could not remove sid mapping\n"));
431 request_error(state
);
438 void winbindd_remove_mapping(struct winbindd_cli_state
*state
)
443 DEBUG(3, ("[%5lu]: remove id map\n", (unsigned long)state
->pid
));
445 if ( ! state
->privileged
) {
446 DEBUG(0, ("Only root is allowed to remove mappings!\n"));
447 request_error(state
);
451 if (!string_to_sid(&sid
, state
->request
.data
.dual_idmapset
.sid
)) {
452 DEBUG(1, ("Could not get convert sid %s from string\n",
453 state
->request
.data
.sid
));
454 request_error(state
);
459 map
.xid
.id
= state
->request
.data
.dual_idmapset
.id
;
460 map
.xid
.type
= state
->request
.data
.dual_idmapset
.type
;
462 winbindd_remove_mapping_async(state
->mem_ctx
, &map
,
463 remove_mapping_recv
, state
);
466 static void set_hwm_recv(void *private_data
, bool success
)
468 struct winbindd_cli_state
*state
=
469 talloc_get_type_abort(private_data
, struct winbindd_cli_state
);
472 DEBUG(5, ("Could not set sid mapping\n"));
473 request_error(state
);
480 void winbindd_set_hwm(struct winbindd_cli_state
*state
)
484 DEBUG(3, ("[%5lu]: set hwm\n", (unsigned long)state
->pid
));
486 if ( ! state
->privileged
) {
487 DEBUG(0, ("Only root is allowed to set mappings!\n"));
488 request_error(state
);
492 xid
.id
= state
->request
.data
.dual_idmapset
.id
;
493 xid
.type
= state
->request
.data
.dual_idmapset
.type
;
495 winbindd_set_hwm_async(state
->mem_ctx
, &xid
, set_hwm_recv
, state
);
498 /* Convert a uid to a sid */
500 static void uid2sid_recv(void *private_data
, bool success
, const char *sidstr
)
502 struct winbindd_cli_state
*state
=
503 (struct winbindd_cli_state
*)private_data
;
506 if (!success
|| !string_to_sid(&sid
, sidstr
)) {
508 idmap_cache_set_sid2uid(&sid
, state
->request
.data
.uid
);
509 request_error(state
);
513 DEBUG(10,("uid2sid: uid %lu has sid %s\n",
514 (unsigned long)(state
->request
.data
.uid
), sidstr
));
516 idmap_cache_set_sid2uid(&sid
, state
->request
.data
.uid
);
517 fstrcpy(state
->response
.data
.sid
.sid
, sidstr
);
518 state
->response
.data
.sid
.type
= SID_NAME_USER
;
523 void winbindd_uid_to_sid(struct winbindd_cli_state
*state
)
528 DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state
->pid
,
529 (unsigned long)state
->request
.data
.uid
));
531 if (idmap_cache_find_uid2sid(state
->request
.data
.uid
, &sid
,
533 DEBUG(10, ("idmap_cache_find_uid2sid found %d%s\n",
534 (int)state
->request
.data
.uid
,
535 expired
? " (expired)": ""));
536 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
537 DEBUG(10, ("revalidating expired entry\n"));
540 if (is_null_sid(&sid
)) {
541 DEBUG(10, ("Returning negative cache entry\n"));
542 request_error(state
);
545 DEBUG(10, ("Returning positive cache entry\n"));
546 sid_to_fstring(state
->response
.data
.sid
.sid
, &sid
);
551 /* always go via the async interface (may block) */
553 winbindd_uid2sid_async(state
->mem_ctx
, state
->request
.data
.uid
, uid2sid_recv
, state
);
556 /* Convert a gid to a sid */
558 static void gid2sid_recv(void *private_data
, bool success
, const char *sidstr
)
560 struct winbindd_cli_state
*state
=
561 (struct winbindd_cli_state
*)private_data
;
564 if (!success
|| !string_to_sid(&sid
, sidstr
)) {
566 idmap_cache_set_sid2gid(&sid
, state
->request
.data
.gid
);
567 request_error(state
);
570 DEBUG(10,("gid2sid: gid %lu has sid %s\n",
571 (unsigned long)(state
->request
.data
.gid
), sidstr
));
573 idmap_cache_set_sid2gid(&sid
, state
->request
.data
.gid
);
574 fstrcpy(state
->response
.data
.sid
.sid
, sidstr
);
575 state
->response
.data
.sid
.type
= SID_NAME_DOM_GRP
;
581 void winbindd_gid_to_sid(struct winbindd_cli_state
*state
)
586 DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state
->pid
,
587 (unsigned long)state
->request
.data
.gid
));
589 if (idmap_cache_find_gid2sid(state
->request
.data
.gid
, &sid
,
591 DEBUG(10, ("idmap_cache_find_gid2sid found %d%s\n",
592 (int)state
->request
.data
.gid
,
593 expired
? " (expired)": ""));
594 if (expired
&& IS_DOMAIN_ONLINE(find_our_domain())) {
595 DEBUG(10, ("revalidating expired entry\n"));
598 if (is_null_sid(&sid
)) {
599 DEBUG(10, ("Returning negative cache entry\n"));
600 request_error(state
);
603 DEBUG(10, ("Returning positive cache entry\n"));
604 sid_to_fstring(state
->response
.data
.sid
.sid
, &sid
);
609 /* always use async calls (may block) */
611 winbindd_gid2sid_async(state
->mem_ctx
, state
->request
.data
.gid
, gid2sid_recv
, state
);
614 void winbindd_allocate_uid(struct winbindd_cli_state
*state
)
616 if ( !state
->privileged
) {
617 DEBUG(2, ("winbindd_allocate_uid: non-privileged access "
619 request_error(state
);
623 sendto_child(state
, idmap_child());
626 enum winbindd_result
winbindd_dual_allocate_uid(struct winbindd_domain
*domain
,
627 struct winbindd_cli_state
*state
)
631 if (!NT_STATUS_IS_OK(idmap_allocate_uid(&xid
))) {
632 return WINBINDD_ERROR
;
634 state
->response
.data
.uid
= xid
.id
;
638 void winbindd_allocate_gid(struct winbindd_cli_state
*state
)
640 if ( !state
->privileged
) {
641 DEBUG(2, ("winbindd_allocate_gid: non-privileged access "
643 request_error(state
);
647 sendto_child(state
, idmap_child());
650 enum winbindd_result
winbindd_dual_allocate_gid(struct winbindd_domain
*domain
,
651 struct winbindd_cli_state
*state
)
655 if (!NT_STATUS_IS_OK(idmap_allocate_gid(&xid
))) {
656 return WINBINDD_ERROR
;
658 state
->response
.data
.gid
= xid
.id
;