?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Explicitly include ldb_handlers.h where necessary
[Samba/fernandojvsilva.git] / source3 / winbindd / winbindd_group.c
blobbc532bbce7ca71afb8534a765ac890cf84075122
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon for ntdom nss module
5
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
9 Copyright (C) Volker Lendecke 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27
28 extern bool opt_nocache;
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
32
33 static void add_member(const char *domain, const char *user,
34 char **pp_members, size_t *p_num_members)
35 {
36 fstring name;
37
38 if (domain != NULL) {
39 fill_domain_username(name, domain, user, True);
40 } else {
41 fstrcpy(name, user);
42 }
43 safe_strcat(name, ",", sizeof(name)-1);
44 string_append(pp_members, name);
45 *p_num_members += 1;
46 }
47
48 /**********************************************************************
49 Add member users resulting from sid. Expand if it is a domain group.
50 **********************************************************************/
51
52 static void add_expanded_sid(const DOM_SID *sid,
53 char **pp_members,
54 size_t *p_num_members)
55 {
56 DOM_SID dom_sid;
57 uint32 rid;
58 struct winbindd_domain *domain;
59 size_t i;
60
61 char *domain_name = NULL;
62 char *name = NULL;
63 enum lsa_SidType type;
64
65 uint32 num_names;
66 DOM_SID *sid_mem;
67 char **names;
68 uint32 *types;
69
70 NTSTATUS result;
71
72 TALLOC_CTX *mem_ctx = talloc_init("add_expanded_sid");
73
74 if (mem_ctx == NULL) {
75 DEBUG(1, ("talloc_init failed\n"));
76 return;
77 }
78
79 sid_copy(&dom_sid, sid);
80 sid_split_rid(&dom_sid, &rid);
81
82 domain = find_lookup_domain_from_sid(sid);
83
84 if (domain == NULL) {
85 DEBUG(3, ("Could not find domain for sid %s\n",
86 sid_string_dbg(sid)));
87 goto done;
88 }
89
90 result = domain->methods->sid_to_name(domain, mem_ctx, sid,
91 &domain_name, &name, &type);
92
93 if (!NT_STATUS_IS_OK(result)) {
94 DEBUG(3, ("sid_to_name failed for sid %s\n",
95 sid_string_dbg(sid)));
96 goto done;
97 }
98
99 DEBUG(10, ("Found name %s, type %d\n", name, type));
100
101 if (type == SID_NAME_USER) {
102 add_member(domain_name, name, pp_members, p_num_members);
103 goto done;
104 }
105
106 if (type != SID_NAME_DOM_GRP) {
107 DEBUG(10, ("Alias member %s neither user nor group, ignore\n",
108 name));
109 goto done;
110 }
111
112 /* Expand the domain group, this must be done via the target domain */
113
114 domain = find_domain_from_sid(sid);
115
116 if (domain == NULL) {
117 DEBUG(3, ("Could not find domain from SID %s\n",
118 sid_string_dbg(sid)));
119 goto done;
120 }
121
122 result = domain->methods->lookup_groupmem(domain, mem_ctx,
123 sid, &num_names,
124 &sid_mem, &names,
125 &types);
126
127 if (!NT_STATUS_IS_OK(result)) {
128 DEBUG(10, ("Could not lookup group members for %s: %s\n",
129 name, nt_errstr(result)));
130 goto done;
131 }
132
133 for (i=0; i<num_names; i++) {
134 DEBUG(10, ("Adding group member SID %s\n",
135 sid_string_dbg(&sid_mem[i])));
136
137 if (types[i] != SID_NAME_USER) {
138 DEBUG(1, ("Hmmm. Member %s of group %s is no user. "
139 "Ignoring.\n", names[i], name));
140 continue;
141 }
142
143 add_member(NULL, names[i], pp_members, p_num_members);
144 }
145
146 done:
147 talloc_destroy(mem_ctx);
148 return;
149 }
150
151 static bool fill_passdb_alias_grmem(struct winbindd_domain *domain,
152 DOM_SID *group_sid, size_t *num_gr_mem,
153 char **gr_mem, size_t *gr_mem_len)
154 {
155 DOM_SID *members;
156 size_t i, num_members;
157
158 *num_gr_mem = 0;
159 *gr_mem = NULL;
160 *gr_mem_len = 0;
161
162 if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(group_sid, &members,
163 &num_members)))
164 return True;
165
166 for (i=0; i<num_members; i++) {
167 add_expanded_sid(&members[i], gr_mem, num_gr_mem);
168 }
169
170 TALLOC_FREE(members);
171
172 if (*gr_mem != NULL) {
173 size_t len;
174
175 /* We have at least one member, strip off the last "," */
176 len = strlen(*gr_mem);
177 (*gr_mem)[len-1] = '\0';
178 *gr_mem_len = len;
179 }
180
181 return True;
182 }
183
184 /* Fill a grent structure from various other information */
185
186 static bool fill_grent(TALLOC_CTX *mem_ctx, struct winbindd_gr *gr,
187 const char *dom_name,
188 char *gr_name, gid_t unix_gid)
189 {
190 fstring full_group_name;
191 char *mapped_name = NULL;
192 struct winbindd_domain *domain = find_domain_from_name_noinit(dom_name);
193 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
194
195 nt_status = normalize_name_map(mem_ctx, domain, gr_name,
196 &mapped_name);
197
198 /* Basic whitespace replacement */
199 if (NT_STATUS_IS_OK(nt_status)) {
200 fill_domain_username(full_group_name, dom_name,
201 mapped_name, true);
202 }
203 /* Mapped to an aliase */
204 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED)) {
205 fstrcpy(full_group_name, mapped_name);
206 }
207 /* no change */
208 else {
209 fill_domain_username( full_group_name, dom_name,
210 gr_name, True );
211 }
212
213 gr->gr_gid = unix_gid;
214
215 /* Group name and password */
216
217 safe_strcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name) - 1);
218 safe_strcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd) - 1);
219
220 return True;
221 }
222
223 /***********************************************************************
224 If "enum users" is set to false, and the group being looked
225 up is the Domain Users SID: S-1-5-domain-513, then for the
226 list of members check if the querying user is in that group,
227 and if so only return that user as the gr_mem array.
228 We can change this to a different parameter than "enum users"
229 if neccessaey, or parameterize the group list we do this for.
230 ***********************************************************************/
231
232 static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
233 struct winbindd_domain *domain,
234 struct winbindd_cli_state *state,
235 DOM_SID *group_sid,
236 enum lsa_SidType group_name_type,
237 size_t *num_gr_mem, char **gr_mem,
238 size_t *gr_mem_len)
239 {
240 DOM_SID querying_user_sid;
241 DOM_SID *pquerying_user_sid = NULL;
242 uint32 num_groups = 0;
243 DOM_SID *user_sids = NULL;
244 bool u_in_group = False;
245 NTSTATUS status;
246 int i;
247 unsigned int buf_len = 0;
248 char *buf = NULL;
249
250 DEBUG(10,("fill_grent_mem_domain_users: domain %s\n",
251 domain->name ));
252
253 if (state) {
254 uid_t ret_uid = (uid_t)-1;
255 if (sys_getpeereid(state->sock, &ret_uid)==0) {
256 /* We know who's asking - look up their SID if
257 it's one we've mapped before. */
258 status = idmap_uid_to_sid(domain->name,
259 &querying_user_sid, ret_uid);
260 if (NT_STATUS_IS_OK(status)) {
261 pquerying_user_sid = &querying_user_sid;
262 DEBUG(10,("fill_grent_mem_domain_users: "
263 "querying uid %u -> %s\n",
264 (unsigned int)ret_uid,
265 sid_string_dbg(pquerying_user_sid)));
266 }
267 }
268 }
269
270 /* Only look up if it was a winbindd user in this domain. */
271 if (pquerying_user_sid &&
272 (sid_compare_domain(pquerying_user_sid, &domain->sid) == 0)) {
273
274 DEBUG(10,("fill_grent_mem_domain_users: querying user = %s\n",
275 sid_string_dbg(pquerying_user_sid) ));
276
277 status = domain->methods->lookup_usergroups(domain,
278 mem_ctx,
279 pquerying_user_sid,
280 &num_groups,
281 &user_sids);
282 if (!NT_STATUS_IS_OK(status)) {
283 DEBUG(1, ("fill_grent_mem_domain_users: "
284 "lookup_usergroups failed "
285 "for sid %s in domain %s (error: %s)\n",
286 sid_string_dbg(pquerying_user_sid),
287 domain->name,
288 nt_errstr(status)));
289 return False;
290 }
291
292 for (i = 0; i < num_groups; i++) {
293 if (sid_equal(group_sid, &user_sids[i])) {
294 /* User is in Domain Users, add their name
295 as the only group member. */
296 u_in_group = True;
297 break;
298 }
299 }
300 }
301
302 if (u_in_group) {
303 size_t len = 0;
304 char *domainname = NULL;
305 char *username = NULL;
306 fstring name;
307 char *mapped_name = NULL;
308 enum lsa_SidType type;
309 struct winbindd_domain *target_domain = NULL;
310 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
311
312 DEBUG(10,("fill_grent_mem_domain_users: "
313 "sid %s in 'Domain Users' in domain %s\n",
314 sid_string_dbg(pquerying_user_sid),
315 domain->name ));
316
317 status = domain->methods->sid_to_name(domain, mem_ctx,
318 pquerying_user_sid,
319 &domainname,
320 &username,
321 &type);
322 if (!NT_STATUS_IS_OK(status)) {
323 DEBUG(1, ("could not lookup username for user "
324 "sid %s in domain %s (error: %s)\n",
325 sid_string_dbg(pquerying_user_sid),
326 domain->name,
327 nt_errstr(status)));
328 return False;
329 }
330
331 target_domain = find_domain_from_name_noinit(domainname);
332 name_map_status = normalize_name_map(mem_ctx, target_domain,
333 username, &mapped_name);
334
335 /* Basic whitespace replacement */
336 if (NT_STATUS_IS_OK(name_map_status)) {
337 fill_domain_username(name, domainname, mapped_name, true);
338 }
339 /* Mapped to an alias */
340 else if (NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED)) {
341 fstrcpy(name, mapped_name);
342 }
343 /* no mapping done...use original name */
344 else {
345 fill_domain_username(name, domainname, username, true);
346 }
347
348 len = strlen(name);
349 buf_len = len + 1;
350 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
351 DEBUG(1, ("out of memory\n"));
352 return False;
353 }
354 memcpy(buf, name, buf_len);
355
356 DEBUG(10,("fill_grent_mem_domain_users: user %s in "
357 "'Domain Users' in domain %s\n",
358 name, domain->name ));
359
360 /* user is the only member */
361 *num_gr_mem = 1;
362 }
363
364 *gr_mem = buf;
365 *gr_mem_len = buf_len;
366
367 DEBUG(10, ("fill_grent_mem_domain_users: "
368 "num_mem = %u, len = %u, mem = %s\n",
369 (unsigned int)*num_gr_mem,
370 (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
371
372 return True;
373 }
374
375 /***********************************************************************
376 Add names to a list. Assumes a canonical version of the string
377 in DOMAIN\user
378 ***********************************************************************/
379
380 static int namecmp( const void *a, const void *b )
381 {
382 return StrCaseCmp( * (char * const *) a, * (char * const *) b);
383 }
384
385 static void sort_unique_list(char ***list, uint32 *n_list)
386 {
387 uint32_t i;
388
389 /* search for duplicates for sorting and looking for matching
390 neighbors */
391
392 qsort(*list, *n_list, sizeof(char*), QSORT_CAST namecmp);
393
394 for (i=1; i < *n_list; i++) {
395 if (strcmp((*list)[i-1], (*list)[i]) == 0) {
396 memmove(&((*list)[i-1]), &((*list)[i]),
397 sizeof(char*)*((*n_list)-i));
398 (*n_list)--;
399 }
400 }
401 }
402
403 static NTSTATUS add_names_to_list( TALLOC_CTX *ctx,
404 char ***list, uint32 *n_list,
405 char **names, uint32 n_names )
406 {
407 char **new_list = NULL;
408 uint32 n_new_list = 0;
409 int i, j;
410
411 if ( !names || (n_names == 0) )
412 return NT_STATUS_OK;
413
414 /* Alloc the maximum size we'll need */
415
416 if ( *list == NULL ) {
417 if ((new_list = TALLOC_ARRAY(ctx, char *, n_names)) == NULL) {
418 return NT_STATUS_NO_MEMORY;
419 }
420 n_new_list = n_names;
421 } else {
422 new_list = TALLOC_REALLOC_ARRAY( ctx, *list, char *,
423 (*n_list) + n_names );
424 if ( !new_list )
425 return NT_STATUS_NO_MEMORY;
426 n_new_list = (*n_list) + n_names;
427 }
428
429 /* Add all names */
430
431 for ( i=*n_list, j=0; i<n_new_list; i++, j++ ) {
432 new_list[i] = talloc_strdup( new_list, names[j] );
433 }
434
435 *list = new_list;
436 *n_list = n_new_list;
437
438 return NT_STATUS_OK;
439 }
440
441 /***********************************************************************
442 ***********************************************************************/
443
444 static NTSTATUS expand_groups( TALLOC_CTX *ctx,
445 struct winbindd_domain *d,
446 DOM_SID *glist, uint32 n_glist,
447 DOM_SID **new_glist, uint32 *n_new_glist,
448 char ***members, uint32 *n_members )
449 {
450 int i, j;
451 NTSTATUS status = NT_STATUS_OK;
452 uint32 num_names = 0;
453 uint32 *name_types = NULL;
454 char **names = NULL;
455 DOM_SID *sid_mem = NULL;
456 TALLOC_CTX *tmp_ctx = NULL;
457 DOM_SID *new_groups = NULL;
458 size_t new_groups_size = 0;
459
460 *members = NULL;
461 *n_members = 0;
462 *new_glist = NULL;
463 *n_new_glist = 0;
464
465 for ( i=0; i<n_glist; i++ ) {
466 tmp_ctx = talloc_new( ctx );
467
468 /* Lookup the group membership */
469
470 status = d->methods->lookup_groupmem(d, tmp_ctx,
471 &glist[i], &num_names,
472 &sid_mem, &names,
473 &name_types);
474 if ( !NT_STATUS_IS_OK(status) )
475 goto out;
476
477 /* Separate users and groups into two lists */
478
479 for ( j=0; j<num_names; j++ ) {
480
481 /* Users */
482 if ( name_types[j] == SID_NAME_USER ||
483 name_types[j] == SID_NAME_COMPUTER )
484 {
485 status = add_names_to_list( ctx, members,
486 n_members,
487 names+j, 1 );
488 if ( !NT_STATUS_IS_OK(status) )
489 goto out;
490
491 continue;
492 }
493
494 /* Groups */
495 if ( name_types[j] == SID_NAME_DOM_GRP ||
496 name_types[j] == SID_NAME_ALIAS )
497 {
498 status = add_sid_to_array_unique(ctx,
499 &sid_mem[j],
500 &new_groups,
501 &new_groups_size);
502 if (!NT_STATUS_IS_OK(status)) {
503 goto out;
504 }
505
506 continue;
507 }
508 }
509
510 TALLOC_FREE( tmp_ctx );
511 }
512
513 *new_glist = new_groups;
514 *n_new_glist = (uint32)new_groups_size;
515
516 out:
517 TALLOC_FREE( tmp_ctx );
518
519 return status;
520 }
521
522 /***********************************************************************
523 Fill in the group membership field of a NT group given by group_sid
524 ***********************************************************************/
525
526 static bool fill_grent_mem(struct winbindd_domain *domain,
527 struct winbindd_cli_state *state,
528 DOM_SID *group_sid,
529 enum lsa_SidType group_name_type,
530 size_t *num_gr_mem, char **gr_mem,
531 size_t *gr_mem_len)
532 {
533 uint32 num_names = 0;
534 unsigned int buf_len = 0, buf_ndx = 0, i;
535 char **names = NULL, *buf = NULL;
536 bool result = False;
537 TALLOC_CTX *mem_ctx;
538 uint32 group_rid;
539 DOM_SID *glist = NULL;
540 DOM_SID *new_glist = NULL;
541 uint32 n_glist, n_new_glist;
542 int max_depth = lp_winbind_expand_groups();
543
544 if (!(mem_ctx = talloc_init("fill_grent_mem(%s)", domain->name)))
545 return False;
546
547 DEBUG(10, ("group SID %s\n", sid_string_dbg(group_sid)));
548
549 /* Initialize with no members */
550
551 *num_gr_mem = 0;
552
553 /* HACK ALERT!! This whole routine does not cope with group members
554 * from more than one domain, ie aliases. Thus we have to work it out
555 * ourselves in a special routine. */
556
557 if (domain->internal) {
558 result = fill_passdb_alias_grmem(domain, group_sid,
559 num_gr_mem,
560 gr_mem, gr_mem_len);
561 goto done;
562 }
563
564 /* Verify name type */
565
566 if ( !((group_name_type==SID_NAME_DOM_GRP) ||
567 ((group_name_type==SID_NAME_ALIAS) && domain->primary)) )
568 {
569 DEBUG(1, ("SID %s in domain %s isn't a domain group (%d)\n",
570 sid_string_dbg(group_sid),
571 domain->name, group_name_type));
572 goto done;
573 }
574
575 /* OPTIMIZATION / HACK. See comment in
576 fill_grent_mem_domusers() */
577
578 sid_peek_rid( group_sid, &group_rid );
579 if (!lp_winbind_enum_users() && group_rid == DOMAIN_GROUP_RID_USERS) {
580 result = fill_grent_mem_domusers( mem_ctx, domain, state,
581 group_sid, group_name_type,
582 num_gr_mem, gr_mem,
583 gr_mem_len );
584 goto done;
585 }
586
587 /* Real work goes here. Create a list of group names to
588 expand starting with the initial one. Pass that to
589 expand_groups() which returns a list of more group names
590 to expand. Do this up to the max search depth. */
591
592 if ( (glist = TALLOC_ARRAY(mem_ctx, DOM_SID, 1 )) == NULL ) {
593 result = False;
594 DEBUG(0,("fill_grent_mem: talloc failure!\n"));
595 goto done;
596 }
597 sid_copy( &glist[0], group_sid );
598 n_glist = 1;
599
600 for ( i=0; i<max_depth && glist; i++ ) {
601 uint32 n_members = 0;
602 char **members = NULL;
603 NTSTATUS nt_status;
604 int j;
605
606 nt_status = expand_groups( mem_ctx, domain,
607 glist, n_glist,
608 &new_glist, &n_new_glist,
609 &members, &n_members);
610 if ( !NT_STATUS_IS_OK(nt_status) ) {
611 result = False;
612 goto done;
613 }
614
615 /* Add new group members to list. Pass through the
616 alias mapping function */
617
618 for (j=0; j<n_members; j++) {
619 fstring name_domain, name_acct;
620 fstring qualified_name;
621 char *mapped_name = NULL;
622 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
623 struct winbindd_domain *target_domain = NULL;
624
625 if (parse_domain_user(members[j], name_domain, name_acct)) {
626 target_domain = find_domain_from_name_noinit(name_domain);
627 /* NOW WHAT ? */
628 }
629 if (!target_domain) {
630 target_domain = domain;
631 }
632
633 name_map_status = normalize_name_map(members, target_domain,
634 name_acct, &mapped_name);
635
636 /* Basic whitespace replacement */
637 if (NT_STATUS_IS_OK(name_map_status)) {
638 fill_domain_username(qualified_name, name_domain,
639 mapped_name, true);
640 mapped_name = qualified_name;
641 }
642 /* no mapping at all */
643 else if (!NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED)) {
644 mapped_name = members[j];
645 }
646
647 nt_status = add_names_to_list( mem_ctx, &names,
648 &num_names,
649 &mapped_name, 1);
650 if ( !NT_STATUS_IS_OK(nt_status) ) {
651 result = False;
652 goto done;
653 }
654 }
655
656 TALLOC_FREE( members );
657
658 /* If we have no more groups to expand, break out
659 early */
660
661 if (new_glist == NULL)
662 break;
663
664 /* One more round */
665 TALLOC_FREE(glist);
666 glist = new_glist;
667 n_glist = n_new_glist;
668 }
669 TALLOC_FREE( glist );
670
671 sort_unique_list(&names, &num_names);
672
673 DEBUG(10, ("looked up %d names\n", num_names));
674
675 again:
676 /* Add members to list */
677
678 for (i = 0; i < num_names; i++) {
679 int len;
680
681 DEBUG(10, ("processing name %s\n", names[i]));
682
683 len = strlen(names[i]);
684
685 /* Add to list or calculate buffer length */
686
687 if (!buf) {
688 buf_len += len + 1; /* List is comma separated */
689 (*num_gr_mem)++;
690 DEBUG(10, ("buf_len + %d = %d\n", len + 1, buf_len));
691 } else {
692 DEBUG(10, ("appending %s at ndx %d\n",
693 names[i], buf_ndx));
694 parse_add_domuser(&buf[buf_ndx], names[i], &len);
695 buf_ndx += len;
696 buf[buf_ndx] = ',';
697 buf_ndx++;
698 }
699 }
700
701 /* Allocate buffer */
702
703 if (!buf && buf_len != 0) {
704 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
705 DEBUG(1, ("out of memory\n"));
706 result = False;
707 goto done;
708 }
709 memset(buf, 0, buf_len);
710 goto again;
711 }
712
713 /* Now we're done */
714
715 if (buf && buf_ndx > 0) {
716 buf[buf_ndx - 1] = '\0';
717 }
718
719 *gr_mem = buf;
720 *gr_mem_len = buf_len;
721
722 DEBUG(10, ("num_mem = %u, len = %u, mem = %s\n",
723 (unsigned int)*num_gr_mem,
724 (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
725 result = True;
726
727 done:
728
729 talloc_destroy(mem_ctx);
730
731 DEBUG(10, ("fill_grent_mem returning %d\n", result));
732
733 return result;
734 }
735
736 static void winbindd_getgrsid(struct winbindd_cli_state *state, DOM_SID group_sid);
737
738 static void getgrnam_recv( void *private_data, bool success, const DOM_SID *sid,
739 enum lsa_SidType type )
740 {
741 struct winbindd_cli_state *state = (struct winbindd_cli_state*)private_data;
742
743 if (!success) {
744 DEBUG(5,("getgrnam_recv: lookupname failed!\n"));
745 request_error(state);
746 return;
747 }
748
749 if ( (type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) ) {
750 DEBUG(5,("getgrnam_recv: not a group!\n"));
751 request_error(state);
752 return;
753 }
754
755 winbindd_getgrsid( state, *sid );
756 }
757
758
759 /* Return a group structure from a group name */
760
761 void winbindd_getgrnam(struct winbindd_cli_state *state)
762 {
763 struct winbindd_domain *domain;
764 fstring name_domain, name_group;
765 char *tmp;
766 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
767
768 /* Ensure null termination */
769 state->request.data.groupname[sizeof(state->request.data.groupname)-1]='\0';
770
771 DEBUG(3, ("[%5lu]: getgrnam %s\n", (unsigned long)state->pid,
772 state->request.data.groupname));
773
774 nt_status = normalize_name_unmap(state->mem_ctx,
775 state->request.data.groupname,
776 &tmp);
777 /* If we didn't map anything in the above call, just reset the
778 tmp pointer to the original string */
779 if (!NT_STATUS_IS_OK(nt_status) &&
780 !NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED))
781 {
782 tmp = state->request.data.groupname;
783 }
784
785 /* Parse domain and groupname */
786
787 memset(name_group, 0, sizeof(name_group));
788
789 name_domain[0] = '\0';
790 name_group[0] = '\0';
791
792 parse_domain_user(tmp, name_domain, name_group);
793
794 /* if no domain or our local domain and no local tdb group, default to
795 * our local domain for aliases */
796
797 if ( !*name_domain || strequal(name_domain, get_global_sam_name()) ) {
798 fstrcpy(name_domain, get_global_sam_name());
799 }
800
801 /* Get info for the domain */
802
803 if ((domain = find_domain_from_name_noinit(name_domain)) == NULL) {
804 DEBUG(3, ("could not get domain sid for domain %s\n",
805 name_domain));
806 request_error(state);
807 return;
808 }
809 /* should we deal with users for our domain? */
810
811 if ( lp_winbind_trusted_domains_only() && domain->primary) {
812 DEBUG(7,("winbindd_getgrnam: My domain -- rejecting "
813 "getgrnam() for %s\\%s.\n", name_domain, name_group));
814 request_error(state);
815 return;
816 }
817
818 /* Get rid and name type from name */
819
820 fstrcpy( name_group, tmp );
821
822 winbindd_lookupname_async( state->mem_ctx, domain->name, name_group,
823 getgrnam_recv, WINBINDD_GETGRNAM, state );
824 }
825
826 struct getgrsid_state {
827 struct winbindd_cli_state *state;
828 struct winbindd_domain *domain;
829 char *group_name;
830 enum lsa_SidType group_type;
831 uid_t gid;
832 DOM_SID group_sid;
833 };
834
835 static void getgrsid_sid2gid_recv(void *private_data, bool success, gid_t gid)
836 {
837 struct getgrsid_state *s =
838 (struct getgrsid_state *)private_data;
839 struct winbindd_domain *domain;
840 size_t gr_mem_len;
841 size_t num_gr_mem;
842 char *gr_mem;
843 fstring dom_name, group_name;
844
845 if (!success) {
846 DEBUG(5,("getgrsid_sid2gid_recv: sid2gid failed!\n"));
847 request_error(s->state);
848 return;
849 }
850
851 s->gid = gid;
852
853 if ( !parse_domain_user( s->group_name, dom_name, group_name ) ) {
854 DEBUG(5,("getgrsid_sid2gid_recv: parse_domain_user() failed!\n"));
855 request_error(s->state);
856 return;
857 }
858
859
860 /* Fill in group structure */
861
862 if ( (domain = find_domain_from_name_noinit(dom_name)) == NULL ) {
863 DEBUG(1,("Can't find domain from name (%s)\n", dom_name));
864 request_error(s->state);
865 return;
866 }
867
868 if (!fill_grent(s->state->mem_ctx, &s->state->response.data.gr,
869 dom_name, group_name, gid) ||
870 !fill_grent_mem(domain, s->state, &s->group_sid, s->group_type,
871 &num_gr_mem, &gr_mem, &gr_mem_len))
872 {
873 request_error(s->state);
874 return;
875 }
876
877 s->state->response.data.gr.num_gr_mem = (uint32)num_gr_mem;
878
879 /* Group membership lives at start of extra data */
880
881 s->state->response.data.gr.gr_mem_ofs = 0;
882
883 s->state->response.length += gr_mem_len;
884 s->state->response.extra_data.data = gr_mem;
885
886 request_ok(s->state);
887 }
888
889 static void getgrsid_lookupsid_recv( void *private_data, bool success,
890 const char *dom_name, const char *name,
891 enum lsa_SidType name_type )
892 {
893 struct getgrsid_state *s = (struct getgrsid_state *)private_data;
894 char *mapped_name = NULL;
895 fstring raw_name;
896 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
897
898 if (!success) {
899 DEBUG(5,("getgrsid_lookupsid_recv: lookupsid failed!\n"));
900 request_error(s->state);
901 return;
902 }
903
904 /* either it's a domain group, a domain local group, or a
905 local group in an internal domain */
906
907 if ( !( (name_type==SID_NAME_DOM_GRP) ||
908 ((name_type==SID_NAME_ALIAS) &&
909 (s->domain->primary || s->domain->internal)) ) )
910 {
911 DEBUG(1, ("name '%s\\%s' is not a local or domain group: %d\n",
912 dom_name, name, name_type));
913 request_error(s->state);
914 return;
915 }
916
917 /* normalize the name and ensure that we have the DOM\name
918 coming out of here */
919
920 fstrcpy(raw_name, name);
921
922 nt_status = normalize_name_unmap(s->state->mem_ctx, raw_name,
923 &mapped_name);
924
925 /* basic whitespace reversal */
926 if (NT_STATUS_IS_OK(nt_status)) {
927 s->group_name = talloc_asprintf(s->state->mem_ctx,
928 "%s%c%s",
929 dom_name,
930 *lp_winbind_separator(),
931 mapped_name);
932 }
933 /* mapped from alias */
934 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED)) {
935 s->group_name = mapped_name;
936 }
937 /* no mapping at all. use original string */
938 else {
939 s->group_name = talloc_asprintf(s->state->mem_ctx,
940 "%s%c%s",
941 dom_name,
942 *lp_winbind_separator(),
943 raw_name);
944 }
945
946 if (s->group_name == NULL) {
947 DEBUG(1, ("getgrsid_lookupsid_recv: group_name is NULL!\n"));
948 request_error(s->state);
949 return;
950 }
951
952 s->group_type = name_type;
953
954 winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
955 getgrsid_sid2gid_recv, s);
956 }
957
958 static void winbindd_getgrsid( struct winbindd_cli_state *state, const DOM_SID group_sid )
959 {
960 struct getgrsid_state *s;
961
962 if ( (s = TALLOC_ZERO_P(state->mem_ctx, struct getgrsid_state)) == NULL ) {
963 DEBUG(0, ("talloc failed\n"));
964 request_error(state);
965 return;
966 }
967
968 s->state = state;
969
970 if ( (s->domain = find_domain_from_sid_noinit(&group_sid)) == NULL ) {
971 DEBUG(3, ("Could not find domain for sid %s\n",
972 sid_string_dbg(&group_sid)));
973 request_error(state);
974 return;
975 }
976
977 sid_copy(&s->group_sid, &group_sid);
978
979 winbindd_lookupsid_async( s->state->mem_ctx, &group_sid,
980 getgrsid_lookupsid_recv, s );
981 }
982
983
984 static void getgrgid_recv(void *private_data, bool success, const char *sid)
985 {
986 struct winbindd_cli_state *state = talloc_get_type_abort(private_data, struct winbindd_cli_state);
987 enum lsa_SidType name_type;
988 DOM_SID group_sid;
989
990 if (success) {
991 DEBUG(10,("getgrgid_recv: gid %lu has sid %s\n",
992 (unsigned long)(state->request.data.gid), sid));
993
994 if (!string_to_sid(&group_sid, sid)) {
995 DEBUG(1,("getgrgid_recv: Could not convert sid %s "
996 "from string\n", sid));
997 request_error(state);
998 return;
999 }
1000
1001 winbindd_getgrsid(state, group_sid);
1002 return;
1003 }
1004
1005 /* Ok, this might be "ours", i.e. an alias */
1006 if (pdb_gid_to_sid(state->request.data.gid, &group_sid) &&
1007 lookup_sid(state->mem_ctx, &group_sid, NULL, NULL, &name_type) &&
1008 (name_type == SID_NAME_ALIAS)) {
1009 /* Hey, got an alias */
1010 DEBUG(10,("getgrgid_recv: we have an alias with gid %lu and sid %s\n",
1011 (unsigned long)(state->request.data.gid), sid));
1012 winbindd_getgrsid(state, group_sid);
1013 return;
1014 }
1015
1016 DEBUG(1, ("could not convert gid %lu to sid\n",
1017 (unsigned long)state->request.data.gid));
1018 request_error(state);
1019 }
1020
1021 /* Return a group structure from a gid number */
1022 void winbindd_getgrgid(struct winbindd_cli_state *state)
1023 {
1024 gid_t gid = state->request.data.gid;
1025
1026 DEBUG(3, ("[%5lu]: getgrgid %lu\n",
1027 (unsigned long)state->pid,
1028 (unsigned long)gid));
1029
1030 /* always use the async interface */
1031 winbindd_gid2sid_async(state->mem_ctx, gid, getgrgid_recv, state);
1032 }
1033
1034 /*
1035 * set/get/endgrent functions
1036 */
1037
1038 /* "Rewind" file pointer for group database enumeration */
1039
1040 static bool winbindd_setgrent_internal(struct winbindd_cli_state *state)
1041 {
1042 struct winbindd_domain *domain;
1043
1044 DEBUG(3, ("[%5lu]: setgrent\n", (unsigned long)state->pid));
1045
1046 /* Check user has enabled this */
1047
1048 if (!lp_winbind_enum_groups()) {
1049 return False;
1050 }
1051
1052 /* Free old static data if it exists */
1053
1054 if (state->getgrent_state != NULL) {
1055 free_getent_state(state->getgrent_state);
1056 state->getgrent_state = NULL;
1057 }
1058
1059 /* Create sam pipes for each domain we know about */
1060
1061 for (domain = domain_list(); domain != NULL; domain = domain->next) {
1062 struct getent_state *domain_state;
1063
1064 /* Create a state record for this domain */
1065
1066 /* don't add our domaina if we are a PDC or if we
1067 are a member of a Samba domain */
1068
1069 if ( lp_winbind_trusted_domains_only() && domain->primary )
1070 {
1071 continue;
1072 }
1073
1074 domain_state = SMB_MALLOC_P(struct getent_state);
1075 if (!domain_state) {
1076 DEBUG(1, ("winbindd_setgrent: "
1077 "malloc failed for domain_state!\n"));
1078 return False;
1079 }
1080
1081 ZERO_STRUCTP(domain_state);
1082
1083 fstrcpy(domain_state->domain_name, domain->name);
1084
1085 /* Add to list of open domains */
1086
1087 DLIST_ADD(state->getgrent_state, domain_state);
1088 }
1089
1090 state->getgrent_initialized = True;
1091 return True;
1092 }
1093
1094 void winbindd_setgrent(struct winbindd_cli_state *state)
1095 {
1096 if (winbindd_setgrent_internal(state)) {
1097 request_ok(state);
1098 } else {
1099 request_error(state);
1100 }
1101 }
1102
1103 /* Close file pointer to ntdom group database */
1104
1105 void winbindd_endgrent(struct winbindd_cli_state *state)
1106 {
1107 DEBUG(3, ("[%5lu]: endgrent\n", (unsigned long)state->pid));
1108
1109 free_getent_state(state->getgrent_state);
1110 state->getgrent_initialized = False;
1111 state->getgrent_state = NULL;
1112 request_ok(state);
1113 }
1114
1115 /* Get the list of domain groups and domain aliases for a domain. We fill in
1116 the sam_entries and num_sam_entries fields with domain group information.
1117 Return True if some groups were returned, False otherwise. */
1118
1119 bool get_sam_group_entries(struct getent_state *ent)
1120 {
1121 NTSTATUS status;
1122 uint32 num_entries;
1123 struct acct_info *name_list = NULL;
1124 TALLOC_CTX *mem_ctx;
1125 bool result = False;
1126 struct acct_info *sam_grp_entries = NULL;
1127 struct winbindd_domain *domain;
1128
1129 if (ent->got_sam_entries)
1130 return False;
1131
1132 if (!(mem_ctx = talloc_init("get_sam_group_entries(%s)",
1133 ent->domain_name))) {
1134 DEBUG(1, ("get_sam_group_entries: "
1135 "could not create talloc context!\n"));
1136 return False;
1137 }
1138
1139 /* Free any existing group info */
1140
1141 SAFE_FREE(ent->sam_entries);
1142 ent->num_sam_entries = 0;
1143 ent->got_sam_entries = True;
1144
1145 /* Enumerate domain groups */
1146
1147 num_entries = 0;
1148
1149 if (!(domain = find_domain_from_name(ent->domain_name))) {
1150 DEBUG(3, ("no such domain %s in get_sam_group_entries\n",
1151 ent->domain_name));
1152 goto done;
1153 }
1154
1155 /* always get the domain global groups */
1156
1157 status = domain->methods->enum_dom_groups(domain, mem_ctx, &num_entries,
1158 &sam_grp_entries);
1159
1160 if (!NT_STATUS_IS_OK(status)) {
1161 DEBUG(3, ("get_sam_group_entries: "
1162 "could not enumerate domain groups! Error: %s\n",
1163 nt_errstr(status)));
1164 result = False;
1165 goto done;
1166 }
1167
1168 /* Copy entries into return buffer */
1169
1170 if (num_entries) {
1171 name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries);
1172 if (!name_list) {
1173 DEBUG(0,("get_sam_group_entries: Failed to malloc "
1174 "memory for %d domain groups!\n",
1175 num_entries));
1176 result = False;
1177 goto done;
1178 }
1179 memcpy(name_list, sam_grp_entries,
1180 num_entries * sizeof(struct acct_info));
1181 }
1182
1183 ent->num_sam_entries = num_entries;
1184
1185 /* get the domain local groups if we are a member of a native win2k
1186 * domain and are not using LDAP to get the groups */
1187
1188 if ( ( lp_security() != SEC_ADS && domain->native_mode
1189 && domain->primary) || domain->internal )
1190 {
1191 DEBUG(4,("get_sam_group_entries: %s domain; "
1192 "enumerating local groups as well\n",
1193 domain->native_mode ? "Native Mode 2k":
1194 "BUILTIN or local"));
1195
1196 status = domain->methods->enum_local_groups(domain, mem_ctx,
1197 &num_entries,
1198 &sam_grp_entries);
1199
1200 if ( !NT_STATUS_IS_OK(status) ) {
1201 DEBUG(3,("get_sam_group_entries: "
1202 "Failed to enumerate "
1203 "domain local groups with error %s!\n",
1204 nt_errstr(status)));
1205 num_entries = 0;
1206 }
1207 else
1208 DEBUG(4,("get_sam_group_entries: "
1209 "Returned %d local groups\n",
1210 num_entries));
1211
1212 /* Copy entries into return buffer */
1213
1214 if ( num_entries ) {
1215 name_list = SMB_REALLOC_ARRAY(name_list,
1216 struct acct_info,
1217 ent->num_sam_entries+
1218 num_entries);
1219 if (!name_list) {
1220 DEBUG(0,("get_sam_group_entries: "
1221 "Failed to realloc more memory "
1222 "for %d local groups!\n",
1223 num_entries));
1224 result = False;
1225 goto done;
1226 }
1227
1228 memcpy(&name_list[ent->num_sam_entries],
1229 sam_grp_entries,
1230 num_entries * sizeof(struct acct_info));
1231 }
1232
1233 ent->num_sam_entries += num_entries;
1234 }
1235
1236
1237 /* Fill in remaining fields */
1238
1239 ent->sam_entries = name_list;
1240 ent->sam_entry_index = 0;
1241
1242 result = (ent->num_sam_entries > 0);
1243
1244 done:
1245 talloc_destroy(mem_ctx);
1246
1247 return result;
1248 }
1249
1250 /* Fetch next group entry from ntdom database */
1251
1252 #define MAX_GETGRENT_GROUPS 500
1253
1254 void winbindd_getgrent(struct winbindd_cli_state *state)
1255 {
1256 struct getent_state *ent;
1257 struct winbindd_gr *group_list = NULL;
1258 int num_groups, group_list_ndx, gr_mem_list_len = 0;
1259 char *gr_mem_list = NULL;
1260
1261 DEBUG(3, ("[%5lu]: getgrent\n", (unsigned long)state->pid));
1262
1263 /* Check user has enabled this */
1264
1265 if (!lp_winbind_enum_groups()) {
1266 request_error(state);
1267 return;
1268 }
1269
1270 num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);
1271
1272 if (num_groups == 0) {
1273 request_error(state);
1274 return;
1275 }
1276
1277 group_list = SMB_MALLOC_ARRAY(struct winbindd_gr, num_groups);
1278 if (!group_list) {
1279 request_error(state);
1280 return;
1281 }
1282 /* will be freed by process_request() */
1283 state->response.extra_data.data = group_list;
1284
1285 memset(state->response.extra_data.data, '\0',
1286 num_groups * sizeof(struct winbindd_gr) );
1287
1288 state->response.data.num_entries = 0;
1289
1290 if (!state->getgrent_initialized)
1291 winbindd_setgrent_internal(state);
1292
1293 if (!(ent = state->getgrent_state)) {
1294 request_error(state);
1295 return;
1296 }
1297
1298 /* Start sending back groups */
1299
1300 for (group_list_ndx = 0; group_list_ndx < num_groups; ) {
1301 struct acct_info *name_list = NULL;
1302 fstring domain_group_name;
1303 uint32 result;
1304 gid_t group_gid;
1305 size_t gr_mem_len;
1306 char *gr_mem;
1307 DOM_SID group_sid;
1308 struct winbindd_domain *domain;
1309
1310 /* Do we need to fetch another chunk of groups? */
1311
1312 tryagain:
1313
1314 DEBUG(10, ("entry_index = %d, num_entries = %d\n",
1315 ent->sam_entry_index, ent->num_sam_entries));
1316
1317 if (ent->num_sam_entries == ent->sam_entry_index) {
1318
1319 while(ent && !get_sam_group_entries(ent)) {
1320 struct getent_state *next_ent;
1321
1322 DEBUG(10, ("freeing state info for domain %s\n",
1323 ent->domain_name));
1324
1325 /* Free state information for this domain */
1326
1327 SAFE_FREE(ent->sam_entries);
1328
1329 next_ent = ent->next;
1330 DLIST_REMOVE(state->getgrent_state, ent);
1331
1332 SAFE_FREE(ent);
1333 ent = next_ent;
1334 }
1335
1336 /* No more domains */
1337
1338 if (!ent)
1339 break;
1340 }
1341
1342 name_list = (struct acct_info *)ent->sam_entries;
1343
1344 if (!(domain = find_domain_from_name(ent->domain_name))) {
1345 DEBUG(3, ("No such domain %s in winbindd_getgrent\n",
1346 ent->domain_name));
1347 result = False;
1348 goto done;
1349 }
1350
1351 /* Lookup group info */
1352
1353 sid_copy(&group_sid, &domain->sid);
1354 sid_append_rid(&group_sid, name_list[ent->sam_entry_index].rid);
1355
1356 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(domain->name, &group_sid,
1357 &group_gid))) {
1358 union unid_t id;
1359 enum lsa_SidType type;
1360
1361 DEBUG(10, ("SID %s not in idmap\n",
1362 sid_string_dbg(&group_sid)));
1363
1364 if (!pdb_sid_to_id(&group_sid, &id, &type)) {
1365 DEBUG(1,("could not look up gid for group %s\n",
1366 name_list[ent->sam_entry_index].acct_name));
1367 ent->sam_entry_index++;
1368 goto tryagain;
1369 }
1370
1371 if ((type != SID_NAME_DOM_GRP) &&
1372 (type != SID_NAME_ALIAS) &&
1373 (type != SID_NAME_WKN_GRP)) {
1374 DEBUG(1, ("Group %s is a %s, not a group\n",
1375 sid_type_lookup(type),
1376 name_list[ent->sam_entry_index].acct_name));
1377 ent->sam_entry_index++;
1378 goto tryagain;
1379 }
1380 group_gid = id.gid;
1381 }
1382
1383 DEBUG(10, ("got gid %lu for group %lu\n",
1384 (unsigned long)group_gid,
1385 (unsigned long)name_list[ent->sam_entry_index].rid));
1386
1387 /* Fill in group entry */
1388
1389 fill_domain_username(domain_group_name, ent->domain_name,
1390 name_list[ent->sam_entry_index].acct_name, True);
1391
1392 result = fill_grent(state->mem_ctx, &group_list[group_list_ndx],
1393 ent->domain_name,
1394 name_list[ent->sam_entry_index].acct_name,
1395 group_gid);
1396
1397 /* Fill in group membership entry */
1398
1399 if (result) {
1400 size_t num_gr_mem = 0;
1401 DOM_SID member_sid;
1402 group_list[group_list_ndx].num_gr_mem = 0;
1403 gr_mem = NULL;
1404 gr_mem_len = 0;
1405
1406 /* Get group membership */
1407 if (state->request.cmd == WINBINDD_GETGRLST) {
1408 result = True;
1409 } else {
1410 sid_copy(&member_sid, &domain->sid);
1411 sid_append_rid(&member_sid, name_list[ent->sam_entry_index].rid);
1412 result = fill_grent_mem(
1413 domain,
1414 NULL,
1415 &member_sid,
1416 SID_NAME_DOM_GRP,
1417 &num_gr_mem,
1418 &gr_mem, &gr_mem_len);
1419
1420 group_list[group_list_ndx].num_gr_mem = (uint32)num_gr_mem;
1421 }
1422 }
1423
1424 if (result) {
1425 /* Append to group membership list */
1426 gr_mem_list = (char *)SMB_REALLOC(
1427 gr_mem_list, gr_mem_list_len + gr_mem_len);
1428
1429 if (!gr_mem_list &&
1430 (group_list[group_list_ndx].num_gr_mem != 0)) {
1431 DEBUG(0, ("out of memory\n"));
1432 gr_mem_list_len = 0;
1433 break;
1434 }
1435
1436 DEBUG(10, ("list_len = %d, mem_len = %u\n",
1437 gr_mem_list_len, (unsigned int)gr_mem_len));
1438
1439 memcpy(&gr_mem_list[gr_mem_list_len], gr_mem,
1440 gr_mem_len);
1441
1442 SAFE_FREE(gr_mem);
1443
1444 group_list[group_list_ndx].gr_mem_ofs =
1445 gr_mem_list_len;
1446
1447 gr_mem_list_len += gr_mem_len;
1448 }
1449
1450 ent->sam_entry_index++;
1451
1452 /* Add group to return list */
1453
1454 if (result) {
1455
1456 DEBUG(10, ("adding group num_entries = %d\n",
1457 state->response.data.num_entries));
1458
1459 group_list_ndx++;
1460 state->response.data.num_entries++;
1461
1462 state->response.length +=
1463 sizeof(struct winbindd_gr);
1464
1465 } else {
1466 DEBUG(0, ("could not lookup domain group %s\n",
1467 domain_group_name));
1468 }
1469 }
1470
1471 /* Copy the list of group memberships to the end of the extra data */
1472
1473 if (group_list_ndx == 0)
1474 goto done;
1475
1476 state->response.extra_data.data = SMB_REALLOC(
1477 state->response.extra_data.data,
1478 group_list_ndx * sizeof(struct winbindd_gr) + gr_mem_list_len);
1479
1480 if (!state->response.extra_data.data) {
1481 DEBUG(0, ("out of memory\n"));
1482 group_list_ndx = 0;
1483 SAFE_FREE(gr_mem_list);
1484 request_error(state);
1485 return;
1486 }
1487
1488 memcpy(&((char *)state->response.extra_data.data)
1489 [group_list_ndx * sizeof(struct winbindd_gr)],
1490 gr_mem_list, gr_mem_list_len);
1491
1492 state->response.length += gr_mem_list_len;
1493
1494 DEBUG(10, ("returning %d groups, length = %d\n",
1495 group_list_ndx, gr_mem_list_len));
1496
1497 /* Out of domains */
1498
1499 done:
1500
1501 SAFE_FREE(gr_mem_list);
1502
1503 if (group_list_ndx > 0)
1504 request_ok(state);
1505 else
1506 request_error(state);
1507 }
1508
1509 /* List domain groups without mapping to unix ids */
1510 void winbindd_list_groups(struct winbindd_cli_state *state)
1511 {
1512 winbindd_list_ent(state, LIST_GROUPS);
1513 }
1514
1515 /* Get user supplementary groups. This is much quicker than trying to
1516 invert the groups database. We merge the groups from the gids and
1517 other_sids info3 fields as trusted domain, universal group
1518 memberships, and nested groups (win2k native mode only) are not
1519 returned by the getgroups RPC call but are present in the info3. */
1520
1521 struct getgroups_state {
1522 struct winbindd_cli_state *state;
1523 struct winbindd_domain *domain;
1524 char *domname;
1525 char *username;
1526 DOM_SID user_sid;
1527
1528 const DOM_SID *token_sids;
1529 size_t i, num_token_sids;
1530
1531 gid_t *token_gids;
1532 size_t num_token_gids;
1533 };
1534
1535 static void getgroups_usersid_recv(void *private_data, bool success,
1536 const DOM_SID *sid, enum lsa_SidType type);
1537 static void getgroups_tokensids_recv(void *private_data, bool success,
1538 DOM_SID *token_sids, size_t num_token_sids);
1539 static void getgroups_sid2gid_recv(void *private_data, bool success, gid_t gid);
1540
1541 void winbindd_getgroups(struct winbindd_cli_state *state)
1542 {
1543 struct getgroups_state *s;
1544 char *real_name = NULL;
1545 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
1546
1547 /* Ensure null termination */
1548 state->request.data.username
1549 [sizeof(state->request.data.username)-1]='\0';
1550
1551 DEBUG(3, ("[%5lu]: getgroups %s\n", (unsigned long)state->pid,
1552 state->request.data.username));
1553
1554 /* Parse domain and username */
1555
1556 s = TALLOC_P(state->mem_ctx, struct getgroups_state);
1557 if (s == NULL) {
1558 DEBUG(0, ("talloc failed\n"));
1559 request_error(state);
1560 return;
1561 }
1562
1563 s->state = state;
1564
1565 nt_status = normalize_name_unmap(state->mem_ctx,
1566 state->request.data.username,
1567 &real_name);
1568
1569 /* Reset the real_name pointer if we didn't do anything
1570 productive in the above call */
1571 if (!NT_STATUS_IS_OK(nt_status) &&
1572 !NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED))
1573 {
1574 real_name = state->request.data.username;
1575 }
1576
1577 if (!parse_domain_user_talloc(state->mem_ctx, real_name,
1578 &s->domname, &s->username)) {
1579 DEBUG(5, ("Could not parse domain user: %s\n",
1580 real_name));
1581
1582 /* error out if we do not have nested group support */
1583
1584 if ( !lp_winbind_nested_groups() ) {
1585 request_error(state);
1586 return;
1587 }
1588
1589 s->domname = talloc_strdup(state->mem_ctx,
1590 get_global_sam_name());
1591 s->username = talloc_strdup(state->mem_ctx,
1592 state->request.data.username);
1593 }
1594
1595 /* Get info for the domain (either by short domain name or
1596 DNS name in the case of a UPN) */
1597
1598 s->domain = find_domain_from_name_noinit(s->domname);
1599 if (!s->domain) {
1600 char *p = strchr(s->username, '@');
1601
1602 if (p) {
1603 s->domain = find_domain_from_name_noinit(p+1);
1604 }
1605
1606 }
1607
1608 if (s->domain == NULL) {
1609 DEBUG(7, ("could not find domain entry for domain %s\n",
1610 s->domname));
1611 request_error(state);
1612 return;
1613 }
1614
1615 if ( s->domain->primary && lp_winbind_trusted_domains_only()) {
1616 DEBUG(7,("winbindd_getgroups: My domain -- rejecting "
1617 "getgroups() for %s\\%s.\n", s->domname,
1618 s->username));
1619 request_error(state);
1620 return;
1621 }
1622
1623 /* Get rid and name type from name. The following costs 1 packet */
1624
1625 winbindd_lookupname_async(state->mem_ctx,
1626 s->domname, s->username,
1627 getgroups_usersid_recv,
1628 WINBINDD_GETGROUPS, s);
1629 }
1630
1631 static void getgroups_usersid_recv(void *private_data, bool success,
1632 const DOM_SID *sid, enum lsa_SidType type)
1633 {
1634 struct getgroups_state *s =
1635 (struct getgroups_state *)private_data;
1636
1637 if ((!success) ||
1638 ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER))) {
1639 request_error(s->state);
1640 return;
1641 }
1642
1643 sid_copy(&s->user_sid, sid);
1644
1645 winbindd_gettoken_async(s->state->mem_ctx, &s->user_sid,
1646 getgroups_tokensids_recv, s);
1647 }
1648
1649 static void getgroups_tokensids_recv(void *private_data, bool success,
1650 DOM_SID *token_sids, size_t num_token_sids)
1651 {
1652 struct getgroups_state *s =
1653 (struct getgroups_state *)private_data;
1654
1655 /* We need at least the user sid and the primary group in the token,
1656 * otherwise it's an error */
1657
1658 if ((!success) || (num_token_sids < 2)) {
1659 request_error(s->state);
1660 return;
1661 }
1662
1663 s->token_sids = token_sids;
1664 s->num_token_sids = num_token_sids;
1665 s->i = 0;
1666
1667 s->token_gids = NULL;
1668 s->num_token_gids = 0;
1669
1670 getgroups_sid2gid_recv(s, False, 0);
1671 }
1672
1673 static void getgroups_sid2gid_recv(void *private_data, bool success, gid_t gid)
1674 {
1675 struct getgroups_state *s =
1676 (struct getgroups_state *)private_data;
1677
1678 if (success) {
1679 if (!add_gid_to_array_unique(s->state->mem_ctx, gid,
1680 &s->token_gids,
1681 &s->num_token_gids)) {
1682 return;
1683 }
1684 }
1685
1686 if (s->i < s->num_token_sids) {
1687 const DOM_SID *sid = &s->token_sids[s->i];
1688 s->i += 1;
1689
1690 if (sid_equal(sid, &s->user_sid)) {
1691 getgroups_sid2gid_recv(s, False, 0);
1692 return;
1693 }
1694
1695 winbindd_sid2gid_async(s->state->mem_ctx, sid,
1696 getgroups_sid2gid_recv, s);
1697 return;
1698 }
1699
1700 s->state->response.data.num_entries = s->num_token_gids;
1701 if (s->num_token_gids) {
1702 /* s->token_gids are talloced */
1703 s->state->response.extra_data.data =
1704 smb_xmemdup(s->token_gids,
1705 s->num_token_gids * sizeof(gid_t));
1706 s->state->response.length += s->num_token_gids * sizeof(gid_t);
1707 }
1708 request_ok(s->state);
1709 }
1710
1711 /* Get user supplementary sids. This is equivalent to the
1712 winbindd_getgroups() function but it involves a SID->SIDs mapping
1713 rather than a NAME->SID->SIDS->GIDS mapping, which means we avoid
1714 idmap. This call is designed to be used with applications that need
1715 to do ACL evaluation themselves. Note that the cached info3 data is
1716 not used
1717
1718 this function assumes that the SID that comes in is a user SID. If
1719 you pass in another type of SID then you may get unpredictable
1720 results.
1721 */
1722
1723 static void getusersids_recv(void *private_data, bool success, DOM_SID *sids,
1724 size_t num_sids);
1725
1726 void winbindd_getusersids(struct winbindd_cli_state *state)
1727 {
1728 DOM_SID *user_sid;
1729
1730 /* Ensure null termination */
1731 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1732
1733 user_sid = TALLOC_P(state->mem_ctx, DOM_SID);
1734 if (user_sid == NULL) {
1735 DEBUG(1, ("talloc failed\n"));
1736 request_error(state);
1737 return;
1738 }
1739
1740 if (!string_to_sid(user_sid, state->request.data.sid)) {
1741 DEBUG(1, ("Could not get convert sid %s from string\n",
1742 state->request.data.sid));
1743 request_error(state);
1744 return;
1745 }
1746
1747 winbindd_gettoken_async(state->mem_ctx, user_sid, getusersids_recv,
1748 state);
1749 }
1750
1751 static void getusersids_recv(void *private_data, bool success, DOM_SID *sids,
1752 size_t num_sids)
1753 {
1754 struct winbindd_cli_state *state =
1755 (struct winbindd_cli_state *)private_data;
1756 char *ret = NULL;
1757 unsigned ofs, ret_size = 0;
1758 size_t i;
1759
1760 if (!success) {
1761 request_error(state);
1762 return;
1763 }
1764
1765 /* work out the response size */
1766 for (i = 0; i < num_sids; i++) {
1767 fstring s;
1768 sid_to_fstring(s, &sids[i]);
1769 ret_size += strlen(s) + 1;
1770 }
1771
1772 /* build the reply */
1773 ret = (char *)SMB_MALLOC(ret_size);
1774 if (!ret) {
1775 DEBUG(0, ("malloc failed\n"));
1776 request_error(state);
1777 return;
1778 }
1779 ofs = 0;
1780 for (i = 0; i < num_sids; i++) {
1781 fstring s;
1782 sid_to_fstring(s, &sids[i]);
1783 safe_strcpy(ret + ofs, s, ret_size - ofs - 1);
1784 ofs += strlen(ret+ofs) + 1;
1785 }
1786
1787 /* Send data back to client */
1788 state->response.data.num_entries = num_sids;
1789 state->response.extra_data.data = ret;
1790 state->response.length += ret_size;
1791 request_ok(state);
1792 }
1793
1794 void winbindd_getuserdomgroups(struct winbindd_cli_state *state)
1795 {
1796 DOM_SID user_sid;
1797 struct winbindd_domain *domain;
1798
1799 /* Ensure null termination */
1800 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1801
1802 if (!string_to_sid(&user_sid, state->request.data.sid)) {
1803 DEBUG(1, ("Could not get convert sid %s from string\n",
1804 state->request.data.sid));
1805 request_error(state);
1806 return;
1807 }
1808
1809 /* Get info for the domain */
1810 if ((domain = find_domain_from_sid_noinit(&user_sid)) == NULL) {
1811 DEBUG(0,("could not find domain entry for sid %s\n",
1812 sid_string_dbg(&user_sid)));
1813 request_error(state);
1814 return;
1815 }
1816
1817 sendto_domain(state, domain);
1818 }
1819
1820 enum winbindd_result winbindd_dual_getuserdomgroups(struct winbindd_domain *domain,
1821 struct winbindd_cli_state *state)
1822 {
1823 DOM_SID user_sid;
1824 NTSTATUS status;
1825
1826 char *sidstring;
1827 ssize_t len;
1828 DOM_SID *groups;
1829 uint32 num_groups;
1830
1831 /* Ensure null termination */
1832 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1833
1834 if (!string_to_sid(&user_sid, state->request.data.sid)) {
1835 DEBUG(1, ("Could not get convert sid %s from string\n",
1836 state->request.data.sid));
1837 return WINBINDD_ERROR;
1838 }
1839
1840 status = domain->methods->lookup_usergroups(domain, state->mem_ctx,
1841 &user_sid, &num_groups,
1842 &groups);
1843 if (!NT_STATUS_IS_OK(status))
1844 return WINBINDD_ERROR;
1845
1846 if (num_groups == 0) {
1847 state->response.data.num_entries = 0;
1848 state->response.extra_data.data = NULL;
1849 return WINBINDD_OK;
1850 }
1851
1852 if (!print_sidlist(state->mem_ctx,
1853 groups, num_groups,
1854 &sidstring, &len)) {
1855 DEBUG(0, ("talloc failed\n"));
1856 return WINBINDD_ERROR;
1857 }
1858
1859 state->response.extra_data.data = SMB_STRDUP(sidstring);
1860 if (!state->response.extra_data.data) {
1861 return WINBINDD_ERROR;
1862 }
1863 state->response.length += len+1;
1864 state->response.data.num_entries = num_groups;
1865
1866 return WINBINDD_OK;
1867 }
fernandojvsilva's samba4 branch