From e47491e83c27c5cd8dbc10e69b57f54ff570f703 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 27 Aug 2009 23:33:45 +0200 Subject: [PATCH] s3:winbind: Convert the getgrent functions to the new API --- source3/Makefile.in | 3 + source3/winbindd/winbindd.c | 13 +- source3/winbindd/winbindd_endgrent.c | 49 + source3/winbindd/winbindd_getgrent.c | 203 ++++ source3/winbindd/winbindd_group.c | 1893 ++++++++-------------------------- source3/winbindd/winbindd_proto.h | 19 + source3/winbindd/winbindd_setgrent.c | 55 + 7 files changed, 766 insertions(+), 1469 deletions(-) create mode 100644 source3/winbindd/winbindd_endgrent.c create mode 100644 source3/winbindd/winbindd_getgrent.c rewrite source3/winbindd/winbindd_group.c (69%) create mode 100644 source3/winbindd/winbindd_setgrent.c diff --git a/source3/Makefile.in b/source3/Makefile.in index bea41ff3b05..55baff23b32 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -1204,6 +1204,9 @@ WINBINDD_OBJ1 = \ winbindd/winbindd_setpwent.o \ winbindd/winbindd_getpwent.o \ winbindd/winbindd_endpwent.o \ + winbindd/winbindd_setgrent.o \ + winbindd/winbindd_getgrent.o \ + winbindd/winbindd_endgrent.o \ winbindd/winbindd_dsgetdcname.o \ winbindd/winbindd_getdcname.o \ auth/token_util.o \ diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c index 10538d3f21b..5dac9322f68 100644 --- a/source3/winbindd/winbindd.c +++ b/source3/winbindd/winbindd.c @@ -425,13 +425,6 @@ static struct winbindd_dispatch_table { const char *winbindd_cmd_name; } dispatch_table[] = { - /* Group functions */ - - { WINBINDD_SETGRENT, winbindd_setgrent, "SETGRENT" }, - { WINBINDD_ENDGRENT, winbindd_endgrent, "ENDGRENT" }, - { WINBINDD_GETGRENT, winbindd_getgrent, "GETGRENT" }, - { WINBINDD_GETGRLST, winbindd_getgrent, "GETGRLST" }, - /* PAM auth functions */ { WINBINDD_PAM_AUTH, winbindd_pam_auth, "PAM_AUTH" }, @@ -538,6 +531,12 @@ static struct winbindd_async_dispatch_table async_nonpriv_table[] = { winbindd_dsgetdcname_send, winbindd_dsgetdcname_recv }, { WINBINDD_GETDCNAME, "GETDCNAME", winbindd_getdcname_send, winbindd_getdcname_recv }, + { WINBINDD_SETGRENT, "SETGRENT", + winbindd_setgrent_send, winbindd_setgrent_recv }, + { WINBINDD_GETGRENT, "GETGRENT", + winbindd_getgrent_send, winbindd_getgrent_recv }, + { WINBINDD_ENDGRENT, "ENDGRENT", + winbindd_endgrent_send, winbindd_endgrent_recv }, { 0, NULL, NULL, NULL } }; diff --git a/source3/winbindd/winbindd_endgrent.c b/source3/winbindd/winbindd_endgrent.c new file mode 100644 index 00000000000..08dfc552f43 --- /dev/null +++ b/source3/winbindd/winbindd_endgrent.c @@ -0,0 +1,49 @@ +/* + Unix SMB/CIFS implementation. + async implementation of WINBINDD_ENDGRENT + Copyright (C) Volker Lendecke 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "winbindd.h" + +struct winbindd_endgrent_state { + uint8_t dummy; +}; + +struct tevent_req *winbindd_endgrent_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct winbindd_cli_state *cli, + struct winbindd_request *request) +{ + struct tevent_req *req; + struct winbindd_endgrent_state *state; + + req = tevent_req_create(mem_ctx, &state, + struct winbindd_endgrent_state); + if (req == NULL) { + return NULL; + } + TALLOC_FREE(cli->grent_state); + tevent_req_done(req); + return tevent_req_post(req, ev); +} + +NTSTATUS winbindd_endgrent_recv(struct tevent_req *req, + struct winbindd_response *presp) +{ + return NT_STATUS_OK; +} diff --git a/source3/winbindd/winbindd_getgrent.c b/source3/winbindd/winbindd_getgrent.c new file mode 100644 index 00000000000..a3ea8dd0dfb --- /dev/null +++ b/source3/winbindd/winbindd_getgrent.c @@ -0,0 +1,203 @@ +/* + Unix SMB/CIFS implementation. + async implementation of WINBINDD_GETGRENT + Copyright (C) Volker Lendecke 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "winbindd.h" + +struct winbindd_getgrent_state { + struct tevent_context *ev; + struct winbindd_cli_state *cli; + int max_groups; + int num_groups; + struct winbindd_gr *groups; + struct talloc_dict **members; +}; + +static void winbindd_getgrent_done(struct tevent_req *subreq); + +struct tevent_req *winbindd_getgrent_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct winbindd_cli_state *cli, + struct winbindd_request *request) +{ + struct tevent_req *req, *subreq; + struct winbindd_getgrent_state *state; + + req = tevent_req_create(mem_ctx, &state, + struct winbindd_getgrent_state); + if (req == NULL) { + return NULL; + } + state->ev = ev; + state->num_groups = 0; + state->cli = cli; + + DEBUG(3, ("[%5lu]: getgrent\n", (unsigned long)cli->pid)); + + if (!lp_winbind_enum_groups()) { + tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES); + return tevent_req_post(req, ev); + } + + if (cli->grent_state == NULL) { + tevent_req_nterror(req, NT_STATUS_NO_MORE_ENTRIES); + return tevent_req_post(req, ev); + } + + state->max_groups = MIN(500, request->data.num_entries); + if (state->max_groups == 0) { + tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER); + return tevent_req_post(req, ev); + } + + state->groups = talloc_zero_array(state, struct winbindd_gr, + state->max_groups); + if (tevent_req_nomem(state->groups, req)) { + return tevent_req_post(req, ev); + } + + state->members = talloc_array(state, struct talloc_dict *, + state->max_groups); + if (tevent_req_nomem(state->members, req)) { + TALLOC_FREE(state->groups); + return tevent_req_post(req, ev); + } + + subreq = wb_next_grent_send(state, ev, lp_winbind_expand_groups(), + cli->grent_state, + &state->groups[state->num_groups]); + if (tevent_req_nomem(subreq, req)) { + return tevent_req_post(req, ev); + } + tevent_req_set_callback(subreq, winbindd_getgrent_done, req); + return req; +} + +static void winbindd_getgrent_done(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data( + subreq, struct tevent_req); + struct winbindd_getgrent_state *state = tevent_req_data( + req, struct winbindd_getgrent_state); + NTSTATUS status; + + status = wb_next_grent_recv(subreq, state, + &state->members[state->num_groups]); + TALLOC_FREE(subreq); + if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) { + DEBUG(10, ("winbindd_getgrent_done: done with %d groups\n", + (int)state->num_groups)); + TALLOC_FREE(state->cli->grent_state); + tevent_req_done(req); + return; + } + if (!NT_STATUS_IS_OK(status)) { + tevent_req_nterror(req, status); + return; + } + state->num_groups += 1; + if (state->num_groups >= state->max_groups) { + DEBUG(10, ("winbindd_getgrent_done: Got enough groups: %d\n", + (int)state->num_groups)); + tevent_req_done(req); + return; + } + if (state->cli->grent_state == NULL) { + DEBUG(10, ("winbindd_getgrent_done: endgrent called in " + "between\n")); + tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER); + return; + } + subreq = wb_next_grent_send(state, state->ev, + lp_winbind_expand_groups(), + state->cli->grent_state, + &state->groups[state->num_groups]); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, winbindd_getgrent_done, req); +} + +NTSTATUS winbindd_getgrent_recv(struct tevent_req *req, + struct winbindd_response *response) +{ + struct winbindd_getgrent_state *state = tevent_req_data( + req, struct winbindd_getgrent_state); + NTSTATUS status; + char **memberstrings; + char *result; + size_t base_memberofs, total_memberlen; + int i; + + if (tevent_req_is_nterror(req, &status)) { + DEBUG(5, ("getgrent failed: %s\n", nt_errstr(status))); + return status; + } + + if (state->num_groups == 0) { + return NT_STATUS_NO_MORE_ENTRIES; + } + + memberstrings = talloc_array(talloc_tos(), char *, state->num_groups); + if (memberstrings == NULL) { + return NT_STATUS_NO_MEMORY; + } + + total_memberlen = 0; + + for (i=0; inum_groups; i++) { + int num_members; + + status = winbindd_print_groupmembers( + state->members[i], memberstrings, &num_members, + &memberstrings[i]); + + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(memberstrings); + return status; + } + TALLOC_FREE(state->members[i]); + + state->groups[i].num_gr_mem = num_members; + state->groups[i].gr_mem_ofs = total_memberlen; + + total_memberlen += talloc_get_size(memberstrings[i]); + } + + base_memberofs = state->num_groups * sizeof(struct winbindd_gr); + + result = talloc_realloc(state, state->groups, char, + base_memberofs + total_memberlen); + if (result == NULL) { + return NT_STATUS_NO_MEMORY; + } + + for (i=0; inum_groups; i++) { + memcpy(result + base_memberofs + state->groups[i].gr_mem_ofs, + memberstrings[i], talloc_get_size(memberstrings[i])); + TALLOC_FREE(memberstrings[i]); + } + + TALLOC_FREE(memberstrings); + + response->data.num_entries = state->num_groups; + response->length += talloc_get_size(result); + response->extra_data.data = talloc_move(response, &result); + return NT_STATUS_OK; +} diff --git a/source3/winbindd/winbindd_group.c b/source3/winbindd/winbindd_group.c dissimilarity index 69% index 21ab3f7ef99..8a76071265f 100644 --- a/source3/winbindd/winbindd_group.c +++ b/source3/winbindd/winbindd_group.c @@ -1,1462 +1,431 @@ -/* - Unix SMB/CIFS implementation. - - Winbind daemon for ntdom nss module - - Copyright (C) Tim Potter 2000 - Copyright (C) Jeremy Allison 2001. - Copyright (C) Gerald (Jerry) Carter 2003. - Copyright (C) Volker Lendecke 2005 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "winbindd.h" - -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_WINBIND - -static void add_member(const char *domain, const char *user, - char **pp_members, size_t *p_num_members) -{ - fstring name; - - if (domain != NULL) { - fill_domain_username(name, domain, user, True); - } else { - fstrcpy(name, user); - } - safe_strcat(name, ",", sizeof(name)-1); - string_append(pp_members, name); - *p_num_members += 1; -} - -/********************************************************************** - Add member users resulting from sid. Expand if it is a domain group. -**********************************************************************/ - -static void add_expanded_sid(const DOM_SID *sid, - char **pp_members, - size_t *p_num_members) -{ - DOM_SID dom_sid; - uint32 rid; - struct winbindd_domain *domain; - size_t i; - - char *domain_name = NULL; - char *name = NULL; - enum lsa_SidType type; - - uint32 num_names; - DOM_SID *sid_mem; - char **names; - uint32 *types; - - NTSTATUS result; - - TALLOC_CTX *mem_ctx = talloc_init("add_expanded_sid"); - - if (mem_ctx == NULL) { - DEBUG(1, ("talloc_init failed\n")); - return; - } - - sid_copy(&dom_sid, sid); - sid_split_rid(&dom_sid, &rid); - - domain = find_lookup_domain_from_sid(sid); - - if (domain == NULL) { - DEBUG(3, ("Could not find domain for sid %s\n", - sid_string_dbg(sid))); - goto done; - } - - result = domain->methods->sid_to_name(domain, mem_ctx, sid, - &domain_name, &name, &type); - - if (!NT_STATUS_IS_OK(result)) { - DEBUG(3, ("sid_to_name failed for sid %s\n", - sid_string_dbg(sid))); - goto done; - } - - DEBUG(10, ("Found name %s, type %d\n", name, type)); - - if (type == SID_NAME_USER) { - add_member(domain_name, name, pp_members, p_num_members); - goto done; - } - - if (type != SID_NAME_DOM_GRP) { - DEBUG(10, ("Alias member %s neither user nor group, ignore\n", - name)); - goto done; - } - - /* Expand the domain group, this must be done via the target domain */ - - domain = find_domain_from_sid(sid); - - if (domain == NULL) { - DEBUG(3, ("Could not find domain from SID %s\n", - sid_string_dbg(sid))); - goto done; - } - - result = domain->methods->lookup_groupmem(domain, mem_ctx, - sid, SID_NAME_DOM_GRP, - &num_names, - &sid_mem, &names, - &types); - - if (!NT_STATUS_IS_OK(result)) { - DEBUG(10, ("Could not lookup group members for %s: %s\n", - name, nt_errstr(result))); - goto done; - } - - for (i=0; igr_gid = unix_gid; - - /* Group name and password */ - - safe_strcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name) - 1); - safe_strcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd) - 1); - - return True; -} - -/*********************************************************************** - If "enum users" is set to false, and the group being looked - up is the Domain Users SID: S-1-5-domain-513, then for the - list of members check if the querying user is in that group, - and if so only return that user as the gr_mem array. - We can change this to a different parameter than "enum users" - if neccessaey, or parameterize the group list we do this for. -***********************************************************************/ - -static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx, - struct winbindd_domain *domain, - struct winbindd_cli_state *state, - DOM_SID *group_sid, - enum lsa_SidType group_name_type, - size_t *num_gr_mem, char **gr_mem, - size_t *gr_mem_len) -{ - DOM_SID querying_user_sid; - DOM_SID *pquerying_user_sid = NULL; - uint32 num_groups = 0; - DOM_SID *user_sids = NULL; - bool u_in_group = False; - NTSTATUS status; - int i; - unsigned int buf_len = 0; - char *buf = NULL; - - DEBUG(10,("fill_grent_mem_domain_users: domain %s\n", - domain->name )); - - if (state) { - uid_t ret_uid = (uid_t)-1; - if (sys_getpeereid(state->sock, &ret_uid)==0) { - /* We know who's asking - look up their SID if - it's one we've mapped before. */ - status = idmap_uid_to_sid(domain->name, - &querying_user_sid, ret_uid); - if (NT_STATUS_IS_OK(status)) { - pquerying_user_sid = &querying_user_sid; - DEBUG(10,("fill_grent_mem_domain_users: " - "querying uid %u -> %s\n", - (unsigned int)ret_uid, - sid_string_dbg(pquerying_user_sid))); - } - } - } - - /* Only look up if it was a winbindd user in this domain. */ - if (pquerying_user_sid && - (sid_compare_domain(pquerying_user_sid, &domain->sid) == 0)) { - - DEBUG(10,("fill_grent_mem_domain_users: querying user = %s\n", - sid_string_dbg(pquerying_user_sid) )); - - status = domain->methods->lookup_usergroups(domain, - mem_ctx, - pquerying_user_sid, - &num_groups, - &user_sids); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(1, ("fill_grent_mem_domain_users: " - "lookup_usergroups failed " - "for sid %s in domain %s (error: %s)\n", - sid_string_dbg(pquerying_user_sid), - domain->name, - nt_errstr(status))); - return False; - } - - for (i = 0; i < num_groups; i++) { - if (sid_equal(group_sid, &user_sids[i])) { - /* User is in Domain Users, add their name - as the only group member. */ - u_in_group = True; - break; - } - } - } - - if (u_in_group) { - size_t len = 0; - char *domainname = NULL; - char *username = NULL; - fstring name; - char *mapped_name = NULL; - enum lsa_SidType type; - struct winbindd_domain *target_domain = NULL; - NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL; - - DEBUG(10,("fill_grent_mem_domain_users: " - "sid %s in 'Domain Users' in domain %s\n", - sid_string_dbg(pquerying_user_sid), - domain->name )); - - status = domain->methods->sid_to_name(domain, mem_ctx, - pquerying_user_sid, - &domainname, - &username, - &type); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(1, ("could not lookup username for user " - "sid %s in domain %s (error: %s)\n", - sid_string_dbg(pquerying_user_sid), - domain->name, - nt_errstr(status))); - return False; - } - - target_domain = find_domain_from_name_noinit(domainname); - name_map_status = normalize_name_map(mem_ctx, target_domain, - username, &mapped_name); - - /* Basic whitespace replacement */ - if (NT_STATUS_IS_OK(name_map_status)) { - fill_domain_username(name, domainname, mapped_name, true); - } - /* Mapped to an alias */ - else if (NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED)) { - fstrcpy(name, mapped_name); - } - /* no mapping done...use original name */ - else { - fill_domain_username(name, domainname, username, true); - } - - len = strlen(name); - buf_len = len + 1; - if (!(buf = (char *)SMB_MALLOC(buf_len))) { - DEBUG(1, ("out of memory\n")); - return False; - } - memcpy(buf, name, buf_len); - - DEBUG(10,("fill_grent_mem_domain_users: user %s in " - "'Domain Users' in domain %s\n", - name, domain->name )); - - /* user is the only member */ - *num_gr_mem = 1; - } - - *gr_mem = buf; - *gr_mem_len = buf_len; - - DEBUG(10, ("fill_grent_mem_domain_users: " - "num_mem = %u, len = %u, mem = %s\n", - (unsigned int)*num_gr_mem, - (unsigned int)buf_len, *num_gr_mem ? buf : "NULL")); - - return True; -} - -/*********************************************************************** - Add names to a list. Assumes a canonical version of the string - in DOMAIN\user -***********************************************************************/ - -static int namecmp( const void *a, const void *b ) -{ - return StrCaseCmp( * (char * const *) a, * (char * const *) b); -} - -static void sort_unique_list(char ***list, uint32 *n_list) -{ - uint32_t i; - - /* search for duplicates for sorting and looking for matching - neighbors */ - - qsort(*list, *n_list, sizeof(char*), QSORT_CAST namecmp); - - for (i=1; i < *n_list; i++) { - if (strcmp((*list)[i-1], (*list)[i]) == 0) { - memmove(&((*list)[i-1]), &((*list)[i]), - sizeof(char*)*((*n_list)-i)); - (*n_list)--; - } - } -} - -static NTSTATUS add_names_to_list( TALLOC_CTX *ctx, - char ***list, uint32 *n_list, - char **names, uint32 n_names ) -{ - char **new_list = NULL; - uint32 n_new_list = 0; - int i, j; - - if ( !names || (n_names == 0) ) - return NT_STATUS_OK; - - /* Alloc the maximum size we'll need */ - - if ( *list == NULL ) { - if ((new_list = TALLOC_ARRAY(ctx, char *, n_names)) == NULL) { - return NT_STATUS_NO_MEMORY; - } - n_new_list = n_names; - } else { - new_list = TALLOC_REALLOC_ARRAY( ctx, *list, char *, - (*n_list) + n_names ); - if ( !new_list ) - return NT_STATUS_NO_MEMORY; - n_new_list = (*n_list) + n_names; - } - - /* Add all names */ - - for ( i=*n_list, j=0; imethods->lookup_groupmem(d, tmp_ctx, - &glist[i], - SID_NAME_DOM_GRP, - &num_names, - &sid_mem, &names, - &name_types); - if (!NT_STATUS_IS_OK(lookup_status)) { - DEBUG(10,("expand_groups: lookup_groupmem for " - "sid %s failed with: %s\n", - sid_string_dbg(&glist[i]), - nt_errstr(lookup_status))); - - /* we might have hit a logic error when called for an - * alias, in that case just continue with group - * expansion - Guenther */ - - if (NT_STATUS_EQUAL(lookup_status, NT_STATUS_NO_SUCH_GROUP)) { - continue; - } - status = lookup_status; - goto out; - } - - /* Separate users and groups into two lists */ - - for ( j=0; jname))) - return False; - - DEBUG(10, ("group SID %s\n", sid_string_dbg(group_sid))); - - /* Initialize with no members */ - - *num_gr_mem = 0; - - /* HACK ALERT!! This whole routine does not cope with group members - * from more than one domain, ie aliases. Thus we have to work it out - * ourselves in a special routine. */ - - if (domain->internal) { - result = fill_passdb_alias_grmem(domain, group_sid, - num_gr_mem, - gr_mem, gr_mem_len); - goto done; - } - - /* Verify name type */ - - if ( !((group_name_type==SID_NAME_DOM_GRP) || - ((group_name_type==SID_NAME_ALIAS) && domain->primary)) ) - { - DEBUG(1, ("SID %s in domain %s isn't a domain group (%d)\n", - sid_string_dbg(group_sid), - domain->name, group_name_type)); - goto done; - } - - /* OPTIMIZATION / HACK. See comment in - fill_grent_mem_domusers() */ - - sid_peek_rid( group_sid, &group_rid ); - if (!lp_winbind_enum_users() && group_rid == DOMAIN_GROUP_RID_USERS) { - result = fill_grent_mem_domusers( mem_ctx, domain, state, - group_sid, group_name_type, - num_gr_mem, gr_mem, - gr_mem_len ); - goto done; - } - - /* Real work goes here. Create a list of group names to - expand starting with the initial one. Pass that to - expand_groups() which returns a list of more group names - to expand. Do this up to the max search depth. */ - - if ( (glist = TALLOC_ARRAY(mem_ctx, DOM_SID, 1 )) == NULL ) { - result = False; - DEBUG(0,("fill_grent_mem: talloc failure!\n")); - goto done; - } - sid_copy( &glist[0], group_sid ); - n_glist = 1; - - for ( i=0; i 0) { - buf[buf_ndx - 1] = '\0'; - } - - *gr_mem = buf; - *gr_mem_len = buf_len; - - DEBUG(10, ("num_mem = %u, len = %u, mem = %s\n", - (unsigned int)*num_gr_mem, - (unsigned int)buf_len, *num_gr_mem ? buf : "NULL")); - result = True; - -done: - - talloc_destroy(mem_ctx); - - DEBUG(10,("fill_grent_mem returning %s\n", - result == true ? "true" : "false")); - - return result; -} - -/* - * set/get/endgrent functions - */ - -/* "Rewind" file pointer for group database enumeration */ - -static bool winbindd_setgrent_internal(struct winbindd_cli_state *state) -{ - struct winbindd_domain *domain; - - DEBUG(3, ("[%5lu]: setgrent\n", (unsigned long)state->pid)); - - /* Check user has enabled this */ - - if (!lp_winbind_enum_groups()) { - return False; - } - - /* Free old static data if it exists */ - - if (state->getgrent_state != NULL) { - free_getent_state(state->getgrent_state); - state->getgrent_state = NULL; - } - - /* Create sam pipes for each domain we know about */ - - for (domain = domain_list(); domain != NULL; domain = domain->next) { - struct getent_state *domain_state; - - /* Create a state record for this domain */ - - /* don't add our domaina if we are a PDC or if we - are a member of a Samba domain */ - - if ( lp_winbind_trusted_domains_only() && domain->primary ) - { - continue; - } - - domain_state = SMB_MALLOC_P(struct getent_state); - if (!domain_state) { - DEBUG(1, ("winbindd_setgrent: " - "malloc failed for domain_state!\n")); - return False; - } - - ZERO_STRUCTP(domain_state); - - fstrcpy(domain_state->domain_name, domain->name); - - /* Add to list of open domains */ - - DLIST_ADD(state->getgrent_state, domain_state); - } - - state->getgrent_initialized = True; - return True; -} - -void winbindd_setgrent(struct winbindd_cli_state *state) -{ - if (winbindd_setgrent_internal(state)) { - request_ok(state); - } else { - request_error(state); - } -} - -/* Close file pointer to ntdom group database */ - -void winbindd_endgrent(struct winbindd_cli_state *state) -{ - DEBUG(3, ("[%5lu]: endgrent\n", (unsigned long)state->pid)); - - free_getent_state(state->getgrent_state); - state->getgrent_initialized = False; - state->getgrent_state = NULL; - request_ok(state); -} - -/* Get the list of domain groups and domain aliases for a domain. We fill in - the sam_entries and num_sam_entries fields with domain group information. - Return True if some groups were returned, False otherwise. */ - -bool get_sam_group_entries(struct getent_state *ent) -{ - NTSTATUS status; - uint32 num_entries; - struct acct_info *name_list = NULL; - TALLOC_CTX *mem_ctx; - bool result = False; - struct acct_info *sam_grp_entries = NULL; - struct winbindd_domain *domain; - - if (ent->got_sam_entries) - return False; - - if (!(mem_ctx = talloc_init("get_sam_group_entries(%s)", - ent->domain_name))) { - DEBUG(1, ("get_sam_group_entries: " - "could not create talloc context!\n")); - return False; - } - - /* Free any existing group info */ - - SAFE_FREE(ent->sam_entries); - ent->num_sam_entries = 0; - ent->got_sam_entries = True; - - /* Enumerate domain groups */ - - num_entries = 0; - - if (!(domain = find_domain_from_name(ent->domain_name))) { - DEBUG(3, ("no such domain %s in get_sam_group_entries\n", - ent->domain_name)); - goto done; - } - - /* always get the domain global groups */ - - status = domain->methods->enum_dom_groups(domain, mem_ctx, &num_entries, - &sam_grp_entries); - - if (!NT_STATUS_IS_OK(status)) { - DEBUG(3, ("get_sam_group_entries: " - "could not enumerate domain groups! Error: %s\n", - nt_errstr(status))); - result = False; - goto done; - } - - /* Copy entries into return buffer */ - - if (num_entries) { - name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries); - if (!name_list) { - DEBUG(0,("get_sam_group_entries: Failed to malloc " - "memory for %d domain groups!\n", - num_entries)); - result = False; - goto done; - } - memcpy(name_list, sam_grp_entries, - num_entries * sizeof(struct acct_info)); - } - - ent->num_sam_entries = num_entries; - - /* get the domain local groups if we are a member of a native win2k - * domain and are not using LDAP to get the groups */ - - if ( ( lp_security() != SEC_ADS && domain->native_mode - && domain->primary) || domain->internal ) - { - DEBUG(4,("get_sam_group_entries: %s domain; " - "enumerating local groups as well\n", - domain->native_mode ? "Native Mode 2k": - "BUILTIN or local")); - - status = domain->methods->enum_local_groups(domain, mem_ctx, - &num_entries, - &sam_grp_entries); - - if ( !NT_STATUS_IS_OK(status) ) { - DEBUG(3,("get_sam_group_entries: " - "Failed to enumerate " - "domain local groups with error %s!\n", - nt_errstr(status))); - num_entries = 0; - } - else - DEBUG(4,("get_sam_group_entries: " - "Returned %d local groups\n", - num_entries)); - - /* Copy entries into return buffer */ - - if ( num_entries ) { - name_list = SMB_REALLOC_ARRAY(name_list, - struct acct_info, - ent->num_sam_entries+ - num_entries); - if (!name_list) { - DEBUG(0,("get_sam_group_entries: " - "Failed to realloc more memory " - "for %d local groups!\n", - num_entries)); - result = False; - goto done; - } - - memcpy(&name_list[ent->num_sam_entries], - sam_grp_entries, - num_entries * sizeof(struct acct_info)); - } - - ent->num_sam_entries += num_entries; - } - - - /* Fill in remaining fields */ - - ent->sam_entries = name_list; - ent->sam_entry_index = 0; - - result = (ent->num_sam_entries > 0); - - done: - talloc_destroy(mem_ctx); - - return result; -} - -/* Fetch next group entry from ntdom database */ - -#define MAX_GETGRENT_GROUPS 500 - -void winbindd_getgrent(struct winbindd_cli_state *state) -{ - struct getent_state *ent; - struct winbindd_gr *group_list = NULL; - int num_groups, group_list_ndx, gr_mem_list_len = 0; - char *gr_mem_list = NULL; - - DEBUG(3, ("[%5lu]: getgrent\n", (unsigned long)state->pid)); - - /* Check user has enabled this */ - - if (!lp_winbind_enum_groups()) { - request_error(state); - return; - } - - num_groups = MIN(MAX_GETGRENT_GROUPS, state->request->data.num_entries); - - if (num_groups == 0) { - request_error(state); - return; - } - - group_list = talloc_zero_array(state->mem_ctx, struct winbindd_gr, - num_groups); - if (!group_list) { - request_error(state); - return; - } - state->response->extra_data.data = group_list; - - state->response->data.num_entries = 0; - - if (!state->getgrent_initialized) - winbindd_setgrent_internal(state); - - if (!(ent = state->getgrent_state)) { - request_error(state); - return; - } - - /* Start sending back groups */ - - for (group_list_ndx = 0; group_list_ndx < num_groups; ) { - struct acct_info *name_list = NULL; - fstring domain_group_name; - uint32 result; - gid_t group_gid; - size_t gr_mem_len; - char *gr_mem; - DOM_SID group_sid; - struct winbindd_domain *domain; - - /* Do we need to fetch another chunk of groups? */ - - tryagain: - - DEBUG(10, ("entry_index = %d, num_entries = %d\n", - ent->sam_entry_index, ent->num_sam_entries)); - - if (ent->num_sam_entries == ent->sam_entry_index) { - - while(ent && !get_sam_group_entries(ent)) { - struct getent_state *next_ent; - - DEBUG(10, ("freeing state info for domain %s\n", - ent->domain_name)); - - /* Free state information for this domain */ - - SAFE_FREE(ent->sam_entries); - - next_ent = ent->next; - DLIST_REMOVE(state->getgrent_state, ent); - - SAFE_FREE(ent); - ent = next_ent; - } - - /* No more domains */ - - if (!ent) - break; - } - - name_list = (struct acct_info *)ent->sam_entries; - - if (!(domain = find_domain_from_name(ent->domain_name))) { - DEBUG(3, ("No such domain %s in winbindd_getgrent\n", - ent->domain_name)); - result = False; - goto done; - } - - /* Lookup group info */ - - sid_copy(&group_sid, &domain->sid); - sid_append_rid(&group_sid, name_list[ent->sam_entry_index].rid); - - if (!NT_STATUS_IS_OK(idmap_sid_to_gid(domain->have_idmap_config - ? domain->name : "", - &group_sid, &group_gid))) - { - union unid_t id; - enum lsa_SidType type; - - DEBUG(10, ("SID %s not in idmap\n", - sid_string_dbg(&group_sid))); - - if (!pdb_sid_to_id(&group_sid, &id, &type)) { - DEBUG(1,("could not look up gid for group %s\n", - name_list[ent->sam_entry_index].acct_name)); - ent->sam_entry_index++; - goto tryagain; - } - - if ((type != SID_NAME_DOM_GRP) && - (type != SID_NAME_ALIAS) && - (type != SID_NAME_WKN_GRP)) { - DEBUG(1, ("Group %s is a %s, not a group\n", - sid_type_lookup(type), - name_list[ent->sam_entry_index].acct_name)); - ent->sam_entry_index++; - goto tryagain; - } - group_gid = id.gid; - } - - DEBUG(10, ("got gid %lu for group %lu\n", - (unsigned long)group_gid, - (unsigned long)name_list[ent->sam_entry_index].rid)); - - /* Fill in group entry */ - - fill_domain_username(domain_group_name, ent->domain_name, - name_list[ent->sam_entry_index].acct_name, True); - - result = fill_grent(state->mem_ctx, &group_list[group_list_ndx], - ent->domain_name, - name_list[ent->sam_entry_index].acct_name, - group_gid); - - /* Fill in group membership entry */ - - if (result) { - size_t num_gr_mem = 0; - DOM_SID member_sid; - group_list[group_list_ndx].num_gr_mem = 0; - gr_mem = NULL; - gr_mem_len = 0; - - /* Get group membership */ - if (state->request->cmd == WINBINDD_GETGRLST) { - result = True; - } else { - sid_copy(&member_sid, &domain->sid); - sid_append_rid(&member_sid, name_list[ent->sam_entry_index].rid); - result = fill_grent_mem( - domain, - NULL, - &member_sid, - SID_NAME_DOM_GRP, - &num_gr_mem, - &gr_mem, &gr_mem_len); - - group_list[group_list_ndx].num_gr_mem = (uint32)num_gr_mem; - } - } - - if (result) { - /* Append to group membership list */ - gr_mem_list = (char *)SMB_REALLOC( - gr_mem_list, gr_mem_list_len + gr_mem_len); - - if (!gr_mem_list && - (group_list[group_list_ndx].num_gr_mem != 0)) { - DEBUG(0, ("out of memory\n")); - gr_mem_list_len = 0; - break; - } - - DEBUG(10, ("list_len = %d, mem_len = %u\n", - gr_mem_list_len, (unsigned int)gr_mem_len)); - - memcpy(&gr_mem_list[gr_mem_list_len], gr_mem, - gr_mem_len); - - SAFE_FREE(gr_mem); - - group_list[group_list_ndx].gr_mem_ofs = - gr_mem_list_len; - - gr_mem_list_len += gr_mem_len; - } - - ent->sam_entry_index++; - - /* Add group to return list */ - - if (result) { - - DEBUG(10, ("adding group num_entries = %d\n", - state->response->data.num_entries)); - - group_list_ndx++; - state->response->data.num_entries++; - - state->response->length += - sizeof(struct winbindd_gr); - - } else { - DEBUG(0, ("could not lookup domain group %s\n", - domain_group_name)); - } - } - - /* Copy the list of group memberships to the end of the extra data */ - - if (group_list_ndx == 0) - goto done; - - state->response->extra_data.data = talloc_realloc_size( - state->mem_ctx, state->response->extra_data.data, - group_list_ndx * sizeof(struct winbindd_gr) + gr_mem_list_len); - - if (!state->response->extra_data.data) { - DEBUG(0, ("out of memory\n")); - group_list_ndx = 0; - SAFE_FREE(gr_mem_list); - request_error(state); - return; - } - - memcpy(&((char *)state->response->extra_data.data) - [group_list_ndx * sizeof(struct winbindd_gr)], - gr_mem_list, gr_mem_list_len); - - state->response->length += gr_mem_list_len; - - DEBUG(10, ("returning %d groups, length = %d\n", - group_list_ndx, gr_mem_list_len)); - - /* Out of domains */ - - done: - - SAFE_FREE(gr_mem_list); - - if (group_list_ndx > 0) - request_ok(state); - else - request_error(state); -} - -/* List domain groups without mapping to unix ids */ -void winbindd_list_groups(struct winbindd_cli_state *state) -{ - winbindd_list_ent(state, LIST_GROUPS); -} - -/* Get user supplementary groups. This is much quicker than trying to - invert the groups database. We merge the groups from the gids and - other_sids info3 fields as trusted domain, universal group - memberships, and nested groups (win2k native mode only) are not - returned by the getgroups RPC call but are present in the info3. */ - -struct getgroups_state { - struct winbindd_cli_state *state; - struct winbindd_domain *domain; - char *domname; - char *username; - DOM_SID user_sid; - - const DOM_SID *token_sids; - size_t i, num_token_sids; - - gid_t *token_gids; - size_t num_token_gids; -}; - -enum winbindd_result winbindd_dual_getuserdomgroups(struct winbindd_domain *domain, - struct winbindd_cli_state *state) -{ - DOM_SID user_sid; - NTSTATUS status; - - char *sidstring; - ssize_t len; - DOM_SID *groups; - uint32 num_groups; - - /* Ensure null termination */ - state->request->data.sid[sizeof(state->request->data.sid)-1]='\0'; - - if (!string_to_sid(&user_sid, state->request->data.sid)) { - DEBUG(1, ("Could not get convert sid %s from string\n", - state->request->data.sid)); - return WINBINDD_ERROR; - } - - status = domain->methods->lookup_usergroups(domain, state->mem_ctx, - &user_sid, &num_groups, - &groups); - if (!NT_STATUS_IS_OK(status)) - return WINBINDD_ERROR; - - if (num_groups == 0) { - state->response->data.num_entries = 0; - state->response->extra_data.data = NULL; - return WINBINDD_OK; - } - - if (!print_sidlist(state->mem_ctx, - groups, num_groups, - &sidstring, &len)) { - DEBUG(0, ("talloc failed\n")); - return WINBINDD_ERROR; - } - - state->response->extra_data.data = sidstring; - state->response->length += len+1; - state->response->data.num_entries = num_groups; - - return WINBINDD_OK; -} - -enum winbindd_result winbindd_dual_getsidaliases(struct winbindd_domain *domain, - struct winbindd_cli_state *state) -{ - DOM_SID *sids = NULL; - size_t num_sids = 0; - char *sidstr = NULL; - ssize_t len; - size_t i; - uint32 num_aliases; - uint32 *alias_rids; - NTSTATUS result; - - DEBUG(3, ("[%5lu]: getsidaliases\n", (unsigned long)state->pid)); - - sidstr = state->request->extra_data.data; - if (sidstr == NULL) { - sidstr = talloc_strdup(state->mem_ctx, "\n"); /* No SID */ - if (!sidstr) { - DEBUG(0, ("Out of memory\n")); - return WINBINDD_ERROR; - } - } - - DEBUG(10, ("Sidlist: %s\n", sidstr)); - - if (!parse_sidlist(state->mem_ctx, sidstr, &sids, &num_sids)) { - DEBUG(0, ("Could not parse SID list: %s\n", sidstr)); - return WINBINDD_ERROR; - } - - num_aliases = 0; - alias_rids = NULL; - - result = domain->methods->lookup_useraliases(domain, - state->mem_ctx, - num_sids, sids, - &num_aliases, - &alias_rids); - - if (!NT_STATUS_IS_OK(result)) { - DEBUG(3, ("Could not lookup_useraliases: %s\n", - nt_errstr(result))); - return WINBINDD_ERROR; - } - - num_sids = 0; - sids = NULL; - sidstr = NULL; - - DEBUG(10, ("Got %d aliases\n", num_aliases)); - - for (i=0; isid); - sid_append_rid(&sid, alias_rids[i]); - result = add_sid_to_array(state->mem_ctx, &sid, &sids, - &num_sids); - if (!NT_STATUS_IS_OK(result)) { - return WINBINDD_ERROR; - } - } - - - if (!print_sidlist(state->mem_ctx, sids, num_sids, &sidstr, &len)) { - DEBUG(0, ("Could not print_sidlist\n")); - state->response->extra_data.data = NULL; - return WINBINDD_ERROR; - } - - state->response->extra_data.data = NULL; - - if (sidstr) { - state->response->extra_data.data = sidstr; - DEBUG(10, ("aliases_list: %s\n", - (char *)state->response->extra_data.data)); - state->response->length += len+1; - state->response->data.num_entries = num_sids; - } - - return WINBINDD_OK; -} - -struct getgr_countmem { - int num; - size_t len; -}; - -static int getgr_calc_memberlen(DATA_BLOB key, void *data, void *priv) -{ - struct wbint_Principal *m = talloc_get_type_abort( - data, struct wbint_Principal); - struct getgr_countmem *buf = (struct getgr_countmem *)priv; - - buf->num += 1; - buf->len += strlen(m->name) + 1; - return 0; -} - -struct getgr_stringmem { - size_t ofs; - char *buf; -}; - -static int getgr_unparse_members(DATA_BLOB key, void *data, void *priv) -{ - struct wbint_Principal *m = talloc_get_type_abort( - data, struct wbint_Principal); - struct getgr_stringmem *buf = (struct getgr_stringmem *)priv; - int len; - - len = strlen(m->name); - - memcpy(buf->buf + buf->ofs, m->name, len); - buf->ofs += len; - buf->buf[buf->ofs] = ','; - buf->ofs += 1; - return 0; -} - -NTSTATUS winbindd_print_groupmembers(struct talloc_dict *members, - TALLOC_CTX *mem_ctx, - int *num_members, char **result) -{ - struct getgr_countmem c; - struct getgr_stringmem m; - int res; - - c.num = 0; - c.len = 0; - - res = talloc_dict_traverse(members, getgr_calc_memberlen, &c); - if (res != 0) { - DEBUG(5, ("talloc_dict_traverse failed\n")); - return NT_STATUS_INTERNAL_ERROR; - } - - m.ofs = 0; - m.buf = talloc_array(mem_ctx, char, c.len); - if (m.buf == NULL) { - DEBUG(5, ("talloc failed\n")); - return NT_STATUS_NO_MEMORY; - } - - res = talloc_dict_traverse(members, getgr_unparse_members, &m); - if (res != 0) { - DEBUG(5, ("talloc_dict_traverse failed\n")); - TALLOC_FREE(m.buf); - return NT_STATUS_INTERNAL_ERROR; - } - m.buf[c.len-1] = '\0'; - - *num_members = c.num; - *result = m.buf; - return NT_STATUS_OK; -} +/* + Unix SMB/CIFS implementation. + + Winbind daemon for ntdom nss module + + Copyright (C) Tim Potter 2000 + Copyright (C) Jeremy Allison 2001. + Copyright (C) Gerald (Jerry) Carter 2003. + Copyright (C) Volker Lendecke 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "winbindd.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_WINBIND + +/* Fill a grent structure from various other information */ + +bool fill_grent(TALLOC_CTX *mem_ctx, struct winbindd_gr *gr, + const char *dom_name, const char *gr_name, gid_t unix_gid) +{ + fstring full_group_name; + char *mapped_name = NULL; + struct winbindd_domain *domain = find_domain_from_name_noinit(dom_name); + NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; + + nt_status = normalize_name_map(mem_ctx, domain, gr_name, + &mapped_name); + + /* Basic whitespace replacement */ + if (NT_STATUS_IS_OK(nt_status)) { + fill_domain_username(full_group_name, dom_name, + mapped_name, true); + } + /* Mapped to an aliase */ + else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED)) { + fstrcpy(full_group_name, mapped_name); + } + /* no change */ + else { + fill_domain_username( full_group_name, dom_name, + gr_name, True ); + } + + gr->gr_gid = unix_gid; + + /* Group name and password */ + + safe_strcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name) - 1); + safe_strcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd) - 1); + + return True; +} + +/* Get the list of domain groups and domain aliases for a domain. We fill in + the sam_entries and num_sam_entries fields with domain group information. + Return True if some groups were returned, False otherwise. */ + +bool get_sam_group_entries(struct getent_state *ent) +{ + NTSTATUS status; + uint32 num_entries; + struct acct_info *name_list = NULL; + TALLOC_CTX *mem_ctx; + bool result = False; + struct acct_info *sam_grp_entries = NULL; + struct winbindd_domain *domain; + + if (ent->got_sam_entries) + return False; + + if (!(mem_ctx = talloc_init("get_sam_group_entries(%s)", + ent->domain_name))) { + DEBUG(1, ("get_sam_group_entries: " + "could not create talloc context!\n")); + return False; + } + + /* Free any existing group info */ + + SAFE_FREE(ent->sam_entries); + ent->num_sam_entries = 0; + ent->got_sam_entries = True; + + /* Enumerate domain groups */ + + num_entries = 0; + + if (!(domain = find_domain_from_name(ent->domain_name))) { + DEBUG(3, ("no such domain %s in get_sam_group_entries\n", + ent->domain_name)); + goto done; + } + + /* always get the domain global groups */ + + status = domain->methods->enum_dom_groups(domain, mem_ctx, &num_entries, + &sam_grp_entries); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(3, ("get_sam_group_entries: " + "could not enumerate domain groups! Error: %s\n", + nt_errstr(status))); + result = False; + goto done; + } + + /* Copy entries into return buffer */ + + if (num_entries) { + name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries); + if (!name_list) { + DEBUG(0,("get_sam_group_entries: Failed to malloc " + "memory for %d domain groups!\n", + num_entries)); + result = False; + goto done; + } + memcpy(name_list, sam_grp_entries, + num_entries * sizeof(struct acct_info)); + } + + ent->num_sam_entries = num_entries; + + /* get the domain local groups if we are a member of a native win2k + * domain and are not using LDAP to get the groups */ + + if ( ( lp_security() != SEC_ADS && domain->native_mode + && domain->primary) || domain->internal ) + { + DEBUG(4,("get_sam_group_entries: %s domain; " + "enumerating local groups as well\n", + domain->native_mode ? "Native Mode 2k": + "BUILTIN or local")); + + status = domain->methods->enum_local_groups(domain, mem_ctx, + &num_entries, + &sam_grp_entries); + + if ( !NT_STATUS_IS_OK(status) ) { + DEBUG(3,("get_sam_group_entries: " + "Failed to enumerate " + "domain local groups with error %s!\n", + nt_errstr(status))); + num_entries = 0; + } + else + DEBUG(4,("get_sam_group_entries: " + "Returned %d local groups\n", + num_entries)); + + /* Copy entries into return buffer */ + + if ( num_entries ) { + name_list = SMB_REALLOC_ARRAY(name_list, + struct acct_info, + ent->num_sam_entries+ + num_entries); + if (!name_list) { + DEBUG(0,("get_sam_group_entries: " + "Failed to realloc more memory " + "for %d local groups!\n", + num_entries)); + result = False; + goto done; + } + + memcpy(&name_list[ent->num_sam_entries], + sam_grp_entries, + num_entries * sizeof(struct acct_info)); + } + + ent->num_sam_entries += num_entries; + } + + + /* Fill in remaining fields */ + + ent->sam_entries = name_list; + ent->sam_entry_index = 0; + + result = (ent->num_sam_entries > 0); + + done: + talloc_destroy(mem_ctx); + + return result; +} + +/* List domain groups without mapping to unix ids */ +void winbindd_list_groups(struct winbindd_cli_state *state) +{ + winbindd_list_ent(state, LIST_GROUPS); +} + +/* Get user supplementary groups. This is much quicker than trying to + invert the groups database. We merge the groups from the gids and + other_sids info3 fields as trusted domain, universal group + memberships, and nested groups (win2k native mode only) are not + returned by the getgroups RPC call but are present in the info3. */ + +struct getgroups_state { + struct winbindd_cli_state *state; + struct winbindd_domain *domain; + char *domname; + char *username; + DOM_SID user_sid; + + const DOM_SID *token_sids; + size_t i, num_token_sids; + + gid_t *token_gids; + size_t num_token_gids; +}; + +enum winbindd_result winbindd_dual_getuserdomgroups(struct winbindd_domain *domain, + struct winbindd_cli_state *state) +{ + DOM_SID user_sid; + NTSTATUS status; + + char *sidstring; + ssize_t len; + DOM_SID *groups; + uint32 num_groups; + + /* Ensure null termination */ + state->request->data.sid[sizeof(state->request->data.sid)-1]='\0'; + + if (!string_to_sid(&user_sid, state->request->data.sid)) { + DEBUG(1, ("Could not get convert sid %s from string\n", + state->request->data.sid)); + return WINBINDD_ERROR; + } + + status = domain->methods->lookup_usergroups(domain, state->mem_ctx, + &user_sid, &num_groups, + &groups); + if (!NT_STATUS_IS_OK(status)) + return WINBINDD_ERROR; + + if (num_groups == 0) { + state->response->data.num_entries = 0; + state->response->extra_data.data = NULL; + return WINBINDD_OK; + } + + if (!print_sidlist(state->mem_ctx, + groups, num_groups, + &sidstring, &len)) { + DEBUG(0, ("talloc failed\n")); + return WINBINDD_ERROR; + } + + state->response->extra_data.data = sidstring; + state->response->length += len+1; + state->response->data.num_entries = num_groups; + + return WINBINDD_OK; +} + +enum winbindd_result winbindd_dual_getsidaliases(struct winbindd_domain *domain, + struct winbindd_cli_state *state) +{ + DOM_SID *sids = NULL; + size_t num_sids = 0; + char *sidstr = NULL; + ssize_t len; + size_t i; + uint32 num_aliases; + uint32 *alias_rids; + NTSTATUS result; + + DEBUG(3, ("[%5lu]: getsidaliases\n", (unsigned long)state->pid)); + + sidstr = state->request->extra_data.data; + if (sidstr == NULL) { + sidstr = talloc_strdup(state->mem_ctx, "\n"); /* No SID */ + if (!sidstr) { + DEBUG(0, ("Out of memory\n")); + return WINBINDD_ERROR; + } + } + + DEBUG(10, ("Sidlist: %s\n", sidstr)); + + if (!parse_sidlist(state->mem_ctx, sidstr, &sids, &num_sids)) { + DEBUG(0, ("Could not parse SID list: %s\n", sidstr)); + return WINBINDD_ERROR; + } + + num_aliases = 0; + alias_rids = NULL; + + result = domain->methods->lookup_useraliases(domain, + state->mem_ctx, + num_sids, sids, + &num_aliases, + &alias_rids); + + if (!NT_STATUS_IS_OK(result)) { + DEBUG(3, ("Could not lookup_useraliases: %s\n", + nt_errstr(result))); + return WINBINDD_ERROR; + } + + num_sids = 0; + sids = NULL; + sidstr = NULL; + + DEBUG(10, ("Got %d aliases\n", num_aliases)); + + for (i=0; isid); + sid_append_rid(&sid, alias_rids[i]); + result = add_sid_to_array(state->mem_ctx, &sid, &sids, + &num_sids); + if (!NT_STATUS_IS_OK(result)) { + return WINBINDD_ERROR; + } + } + + + if (!print_sidlist(state->mem_ctx, sids, num_sids, &sidstr, &len)) { + DEBUG(0, ("Could not print_sidlist\n")); + state->response->extra_data.data = NULL; + return WINBINDD_ERROR; + } + + state->response->extra_data.data = NULL; + + if (sidstr) { + state->response->extra_data.data = sidstr; + DEBUG(10, ("aliases_list: %s\n", + (char *)state->response->extra_data.data)); + state->response->length += len+1; + state->response->data.num_entries = num_sids; + } + + return WINBINDD_OK; +} + +struct getgr_countmem { + int num; + size_t len; +}; + +static int getgr_calc_memberlen(DATA_BLOB key, void *data, void *priv) +{ + struct wbint_Principal *m = talloc_get_type_abort( + data, struct wbint_Principal); + struct getgr_countmem *buf = (struct getgr_countmem *)priv; + + buf->num += 1; + buf->len += strlen(m->name) + 1; + return 0; +} + +struct getgr_stringmem { + size_t ofs; + char *buf; +}; + +static int getgr_unparse_members(DATA_BLOB key, void *data, void *priv) +{ + struct wbint_Principal *m = talloc_get_type_abort( + data, struct wbint_Principal); + struct getgr_stringmem *buf = (struct getgr_stringmem *)priv; + int len; + + len = strlen(m->name); + + memcpy(buf->buf + buf->ofs, m->name, len); + buf->ofs += len; + buf->buf[buf->ofs] = ','; + buf->ofs += 1; + return 0; +} + +NTSTATUS winbindd_print_groupmembers(struct talloc_dict *members, + TALLOC_CTX *mem_ctx, + int *num_members, char **result) +{ + struct getgr_countmem c; + struct getgr_stringmem m; + int res; + + c.num = 0; + c.len = 0; + + res = talloc_dict_traverse(members, getgr_calc_memberlen, &c); + if (res != 0) { + DEBUG(5, ("talloc_dict_traverse failed\n")); + return NT_STATUS_INTERNAL_ERROR; + } + + m.ofs = 0; + m.buf = talloc_array(mem_ctx, char, c.len); + if (m.buf == NULL) { + DEBUG(5, ("talloc failed\n")); + return NT_STATUS_NO_MEMORY; + } + + res = talloc_dict_traverse(members, getgr_unparse_members, &m); + if (res != 0) { + DEBUG(5, ("talloc_dict_traverse failed\n")); + TALLOC_FREE(m.buf); + return NT_STATUS_INTERNAL_ERROR; + } + m.buf[c.len-1] = '\0'; + + *num_members = c.num; + *result = m.buf; + return NT_STATUS_OK; +} diff --git a/source3/winbindd/winbindd_proto.h b/source3/winbindd/winbindd_proto.h index 689da8016d8..acf55efcdb1 100644 --- a/source3/winbindd/winbindd_proto.h +++ b/source3/winbindd/winbindd_proto.h @@ -924,4 +924,23 @@ struct tevent_req *wb_next_grent_send(TALLOC_CTX *mem_ctx, NTSTATUS wb_next_grent_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx, struct talloc_dict **members); +struct tevent_req *winbindd_setgrent_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct winbindd_cli_state *cli, + struct winbindd_request *request); +NTSTATUS winbindd_setgrent_recv(struct tevent_req *req, + struct winbindd_response *response); +struct tevent_req *winbindd_getgrent_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct winbindd_cli_state *cli, + struct winbindd_request *request); +NTSTATUS winbindd_getgrent_recv(struct tevent_req *req, + struct winbindd_response *response); +struct tevent_req *winbindd_endgrent_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct winbindd_cli_state *cli, + struct winbindd_request *request); +NTSTATUS winbindd_endgrent_recv(struct tevent_req *req, + struct winbindd_response *response); + #endif /* _WINBINDD_PROTO_H_ */ diff --git a/source3/winbindd/winbindd_setgrent.c b/source3/winbindd/winbindd_setgrent.c new file mode 100644 index 00000000000..79aa8c35962 --- /dev/null +++ b/source3/winbindd/winbindd_setgrent.c @@ -0,0 +1,55 @@ +/* + Unix SMB/CIFS implementation. + async implementation of WINBINDD_SETGRENT + Copyright (C) Volker Lendecke 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "winbindd.h" + +struct winbindd_setgrent_state { + uint8_t dummy; +}; + +struct tevent_req *winbindd_setgrent_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct winbindd_cli_state *cli, + struct winbindd_request *request) +{ + struct tevent_req *req; + struct winbindd_setgrent_state *state; + + req = tevent_req_create(mem_ctx, &state, + struct winbindd_setgrent_state); + if (req == NULL) { + return NULL; + } + TALLOC_FREE(cli->grent_state); + + cli->grent_state = talloc_zero(cli, struct getgrent_state); + if (tevent_req_nomem(cli->grent_state, req)) { + return tevent_req_post(req, ev); + } + + tevent_req_done(req); + return tevent_req_post(req, ev); +} + +NTSTATUS winbindd_setgrent_recv(struct tevent_req *req, + struct winbindd_response *presp) +{ + return NT_STATUS_OK; +} -- 2.11.4.GIT