?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
More updates - more node-type doco is required.
[Samba/gebeck_regimport.git] / source3 / winbindd / winbindd_group.c
blob63fde9f495d11e08c879e8b5e83c8b41195a5733
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon for ntdom nss module
5
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
9 Copyright (C) Volker Lendecke 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27
28 extern bool opt_nocache;
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
32
33 static void add_member(const char *domain, const char *user,
34 char **pp_members, size_t *p_num_members)
35 {
36 fstring name;
37
38 fill_domain_username(name, domain, user, True);
39 safe_strcat(name, ",", sizeof(name)-1);
40 string_append(pp_members, name);
41 *p_num_members += 1;
42 }
43
44 /**********************************************************************
45 Add member users resulting from sid. Expand if it is a domain group.
46 **********************************************************************/
47
48 static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_num_members)
49 {
50 DOM_SID dom_sid;
51 uint32 rid;
52 struct winbindd_domain *domain;
53 size_t i;
54
55 char *domain_name = NULL;
56 char *name = NULL;
57 enum lsa_SidType type;
58
59 uint32 num_names;
60 DOM_SID *sid_mem;
61 char **names;
62 uint32 *types;
63
64 NTSTATUS result;
65
66 TALLOC_CTX *mem_ctx = talloc_init("add_expanded_sid");
67
68 if (mem_ctx == NULL) {
69 DEBUG(1, ("talloc_init failed\n"));
70 return;
71 }
72
73 sid_copy(&dom_sid, sid);
74 sid_split_rid(&dom_sid, &rid);
75
76 domain = find_lookup_domain_from_sid(sid);
77
78 if (domain == NULL) {
79 DEBUG(3, ("Could not find domain for sid %s\n",
80 sid_string_dbg(sid)));
81 goto done;
82 }
83
84 result = domain->methods->sid_to_name(domain, mem_ctx, sid,
85 &domain_name, &name, &type);
86
87 if (!NT_STATUS_IS_OK(result)) {
88 DEBUG(3, ("sid_to_name failed for sid %s\n",
89 sid_string_dbg(sid)));
90 goto done;
91 }
92
93 DEBUG(10, ("Found name %s, type %d\n", name, type));
94
95 if (type == SID_NAME_USER) {
96 add_member(domain_name, name, pp_members, p_num_members);
97 goto done;
98 }
99
100 if (type != SID_NAME_DOM_GRP) {
101 DEBUG(10, ("Alias member %s neither user nor group, ignore\n",
102 name));
103 goto done;
104 }
105
106 /* Expand the domain group, this must be done via the target domain */
107
108 domain = find_domain_from_sid(sid);
109
110 if (domain == NULL) {
111 DEBUG(3, ("Could not find domain from SID %s\n",
112 sid_string_dbg(sid)));
113 goto done;
114 }
115
116 result = domain->methods->lookup_groupmem(domain, mem_ctx,
117 sid, &num_names,
118 &sid_mem, &names,
119 &types);
120
121 if (!NT_STATUS_IS_OK(result)) {
122 DEBUG(10, ("Could not lookup group members for %s: %s\n",
123 name, nt_errstr(result)));
124 goto done;
125 }
126
127 for (i=0; i<num_names; i++) {
128 DEBUG(10, ("Adding group member SID %s\n",
129 sid_string_dbg(&sid_mem[i])));
130
131 if (types[i] != SID_NAME_USER) {
132 DEBUG(1, ("Hmmm. Member %s of group %s is no user. "
133 "Ignoring.\n", names[i], name));
134 continue;
135 }
136
137 add_member(domain->name, names[i], pp_members, p_num_members);
138 }
139
140 done:
141 talloc_destroy(mem_ctx);
142 return;
143 }
144
145 static bool fill_passdb_alias_grmem(struct winbindd_domain *domain,
146 DOM_SID *group_sid,
147 size_t *num_gr_mem, char **gr_mem, size_t *gr_mem_len)
148 {
149 DOM_SID *members;
150 size_t i, num_members;
151
152 *num_gr_mem = 0;
153 *gr_mem = NULL;
154 *gr_mem_len = 0;
155
156 if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(group_sid, &members,
157 &num_members)))
158 return True;
159
160 for (i=0; i<num_members; i++) {
161 add_expanded_sid(&members[i], gr_mem, num_gr_mem);
162 }
163
164 TALLOC_FREE(members);
165
166 if (*gr_mem != NULL) {
167 size_t len;
168
169 /* We have at least one member, strip off the last "," */
170 len = strlen(*gr_mem);
171 (*gr_mem)[len-1] = '\0';
172 *gr_mem_len = len;
173 }
174
175 return True;
176 }
177
178 /* Fill a grent structure from various other information */
179
180 static bool fill_grent(struct winbindd_gr *gr, const char *dom_name,
181 const char *gr_name, gid_t unix_gid)
182 {
183 fstring full_group_name;
184
185 fill_domain_username( full_group_name, dom_name, gr_name, True );
186
187 gr->gr_gid = unix_gid;
188
189 /* Group name and password */
190
191 safe_strcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name) - 1);
192 safe_strcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd) - 1);
193
194 return True;
195 }
196
197 /***********************************************************************
198 If "enum users" is set to false, and the group being looked
199 up is the Domain Users SID: S-1-5-domain-513, then for the
200 list of members check if the querying user is in that group,
201 and if so only return that user as the gr_mem array.
202 We can change this to a different parameter than "enum users"
203 if neccessaey, or parameterize the group list we do this for.
204 ***********************************************************************/
205
206 static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
207 struct winbindd_domain *domain,
208 struct winbindd_cli_state *state,
209 DOM_SID *group_sid,
210 enum lsa_SidType group_name_type,
211 size_t *num_gr_mem, char **gr_mem,
212 size_t *gr_mem_len)
213 {
214 DOM_SID querying_user_sid;
215 DOM_SID *pquerying_user_sid = NULL;
216 uint32 num_groups = 0;
217 DOM_SID *user_sids = NULL;
218 bool u_in_group = False;
219 NTSTATUS status;
220 int i;
221 unsigned int buf_len = 0;
222 char *buf = NULL;
223
224 DEBUG(10,("fill_grent_mem_domain_users: domain %s\n",
225 domain->name ));
226
227 if (state) {
228 uid_t ret_uid = (uid_t)-1;
229 if (sys_getpeereid(state->sock, &ret_uid)==0) {
230 /* We know who's asking - look up their SID if
231 it's one we've mapped before. */
232 status = idmap_uid_to_sid(&querying_user_sid, ret_uid);
233 if (NT_STATUS_IS_OK(status)) {
234 pquerying_user_sid = &querying_user_sid;
235 DEBUG(10,("fill_grent_mem_domain_users: querying uid %u -> %s\n",
236 (unsigned int)ret_uid,
237 sid_string_dbg(pquerying_user_sid)));
238 }
239 }
240 }
241
242 /* Only look up if it was a winbindd user in this domain. */
243 if (pquerying_user_sid &&
244 (sid_compare_domain(pquerying_user_sid, &domain->sid) == 0)) {
245
246 DEBUG(10,("fill_grent_mem_domain_users: querying user = %s\n",
247 sid_string_dbg(pquerying_user_sid) ));
248
249 status = domain->methods->lookup_usergroups(domain,
250 mem_ctx,
251 pquerying_user_sid,
252 &num_groups,
253 &user_sids);
254 if (!NT_STATUS_IS_OK(status)) {
255 DEBUG(1, ("fill_grent_mem_domain_users: lookup_usergroups failed "
256 "for sid %s in domain %s (error: %s)\n",
257 sid_string_dbg(pquerying_user_sid),
258 domain->name,
259 nt_errstr(status)));
260 return False;
261 }
262
263 for (i = 0; i < num_groups; i++) {
264 if (sid_equal(group_sid, &user_sids[i])) {
265 /* User is in Domain Users, add their name
266 as the only group member. */
267 u_in_group = True;
268 break;
269 }
270 }
271 }
272
273 if (u_in_group) {
274 size_t len = 0;
275 char *domainname = NULL;
276 char *username = NULL;
277 fstring name;
278 enum lsa_SidType type;
279
280 DEBUG(10,("fill_grent_mem_domain_users: sid %s in 'Domain Users' in domain %s\n",
281 sid_string_dbg(pquerying_user_sid),
282 domain->name ));
283
284 status = domain->methods->sid_to_name(domain, mem_ctx,
285 pquerying_user_sid,
286 &domainname,
287 &username,
288 &type);
289 if (!NT_STATUS_IS_OK(status)) {
290 DEBUG(1, ("could not lookup username for user "
291 "sid %s in domain %s (error: %s)\n",
292 sid_string_dbg(pquerying_user_sid),
293 domain->name,
294 nt_errstr(status)));
295 return False;
296 }
297 fill_domain_username(name, domain->name, username, True);
298 len = strlen(name);
299 buf_len = len + 1;
300 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
301 DEBUG(1, ("out of memory\n"));
302 return False;
303 }
304 memcpy(buf, name, buf_len);
305
306 DEBUG(10,("fill_grent_mem_domain_users: user %s in "
307 "'Domain Users' in domain %s\n",
308 name, domain->name ));
309
310 /* user is the only member */
311 *num_gr_mem = 1;
312 }
313
314 *gr_mem = buf;
315 *gr_mem_len = buf_len;
316
317 DEBUG(10, ("fill_grent_mem_domain_users: num_mem = %u, len = %u, mem = %s\n",
318 (unsigned int)*num_gr_mem,
319 (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
320
321 return True;
322 }
323
324 /***********************************************************************
325 Add names to a list. Assumes a canonical version of the string
326 in DOMAIN\user
327 ***********************************************************************/
328
329 static int namecmp( const void *a, const void *b )
330 {
331 return StrCaseCmp( * (char * const *) a, * (char * const *) b);
332 }
333
334 static NTSTATUS add_names_to_list( TALLOC_CTX *ctx,
335 char ***list, uint32 *n_list,
336 char **names, uint32 n_names )
337 {
338 char **new_list = NULL;
339 uint32 n_new_list = 0;
340 int i, j;
341
342 if ( !names || (n_names == 0) )
343 return NT_STATUS_OK;
344
345 /* Alloc the maximum size we'll need */
346
347 if ( *list == NULL ) {
348 if ( (new_list = TALLOC_ARRAY( ctx, char *, n_names )) == NULL )
349 return NT_STATUS_NO_MEMORY;
350 n_new_list = n_names;
351 } else {
352 new_list = TALLOC_REALLOC_ARRAY( ctx, *list, char *,
353 (*n_list) + n_names );
354 if ( !new_list )
355 return NT_STATUS_NO_MEMORY;
356 n_new_list = (*n_list) + n_names;
357 }
358
359 /* Add all names */
360
361 for ( i=*n_list, j=0; i<n_new_list; i++, j++ ) {
362 new_list[i] = talloc_strdup( new_list, names[j] );
363 }
364
365 /* search for duplicates for sorting and looking for matching
366 neighbors */
367
368 qsort( new_list, n_new_list, sizeof(char*), QSORT_CAST namecmp );
369
370 for ( i=1; i<n_new_list; i++ ) {
371 if ( strcmp( new_list[i-1], new_list[i] ) == 0 ) {
372 memmove( &new_list[i-1], &new_list[i],
373 sizeof(char*)*(n_new_list-i) );
374 n_new_list--;
375 }
376 }
377
378 *list = new_list;
379 *n_list = n_new_list;
380
381 return NT_STATUS_OK;
382 }
383
384 /***********************************************************************
385 ***********************************************************************/
386
387 static NTSTATUS expand_groups( TALLOC_CTX *ctx,
388 struct winbindd_domain *d,
389 DOM_SID *glist, uint32 n_glist,
390 DOM_SID **new_glist, uint32 *n_new_glist,
391 char ***members, uint32 *n_members )
392 {
393 int i, j;
394 NTSTATUS status = NT_STATUS_OK;
395 uint32 num_names = 0;
396 uint32 *name_types = NULL;
397 char **names = NULL;
398 DOM_SID *sid_mem = NULL;
399 TALLOC_CTX *tmp_ctx = NULL;
400 DOM_SID *new_groups = NULL;
401 size_t new_groups_size = 0;
402
403 *members = NULL;
404 *n_members = 0;
405 *new_glist = NULL;
406 *n_new_glist = 0;
407
408 for ( i=0; i<n_glist; i++ ) {
409 tmp_ctx = talloc_new( ctx );
410
411 /* Lookup the group membership */
412
413 status = d->methods->lookup_groupmem(d, tmp_ctx,
414 &glist[i], &num_names,
415 &sid_mem, &names,
416 &name_types);
417 if ( !NT_STATUS_IS_OK(status) )
418 goto out;
419
420 /* Separate users and groups into two lists */
421
422 for ( j=0; j<num_names; j++ ) {
423
424 /* Users */
425 if ( name_types[j] == SID_NAME_USER ||
426 name_types[j] == SID_NAME_COMPUTER )
427 {
428 status = add_names_to_list( ctx, members,
429 n_members,
430 names+j, 1 );
431 if ( !NT_STATUS_IS_OK(status) )
432 goto out;
433
434 continue;
435 }
436
437 /* Groups */
438 if ( name_types[j] == SID_NAME_DOM_GRP ||
439 name_types[j] == SID_NAME_ALIAS )
440 {
441 status = add_sid_to_array_unique(ctx,
442 &sid_mem[j],
443 &new_groups,
444 &new_groups_size);
445 if (NT_STATUS_IS_OK(status)) {
446 goto out;
447 }
448
449 continue;
450 }
451 }
452
453 TALLOC_FREE( tmp_ctx );
454 }
455
456 *new_glist = new_groups;
457 *n_new_glist = (uint32)new_groups_size;
458
459 out:
460 TALLOC_FREE( tmp_ctx );
461
462 return status;
463 }
464
465 /***********************************************************************
466 Fill in the group membership field of a NT group given by group_sid
467 ***********************************************************************/
468
469 static bool fill_grent_mem(struct winbindd_domain *domain,
470 struct winbindd_cli_state *state,
471 DOM_SID *group_sid,
472 enum lsa_SidType group_name_type,
473 size_t *num_gr_mem, char **gr_mem, size_t *gr_mem_len)
474 {
475 uint32 num_names = 0;
476 unsigned int buf_len = 0, buf_ndx = 0, i;
477 char **names = NULL, *buf = NULL;
478 bool result = False;
479 TALLOC_CTX *mem_ctx;
480 uint32 group_rid;
481 DOM_SID *glist = NULL;
482 DOM_SID *new_glist = NULL;
483 uint32 n_glist, n_new_glist;
484 int max_depth = lp_winbind_expand_groups();
485
486 if (!(mem_ctx = talloc_init("fill_grent_mem(%s)", domain->name)))
487 return False;
488
489 DEBUG(10, ("group SID %s\n", sid_string_dbg(group_sid)));
490
491 /* Initialize with no members */
492
493 *num_gr_mem = 0;
494
495 /* HACK ALERT!! This whole routine does not cope with group members
496 * from more than one domain, ie aliases. Thus we have to work it out
497 * ourselves in a special routine. */
498
499 if (domain->internal) {
500 result = fill_passdb_alias_grmem(domain, group_sid,
501 num_gr_mem,
502 gr_mem, gr_mem_len);
503 goto done;
504 }
505
506 /* Verify name type */
507
508 if ( !((group_name_type==SID_NAME_DOM_GRP) ||
509 ((group_name_type==SID_NAME_ALIAS) && domain->primary)) )
510 {
511 DEBUG(1, ("SID %s in domain %s isn't a domain group (%d)\n",
512 sid_string_dbg(group_sid),
513 domain->name, group_name_type));
514 goto done;
515 }
516
517 /* OPTIMIZATION / HACK. See comment in
518 fill_grent_mem_domusers() */
519
520 sid_peek_rid( group_sid, &group_rid );
521 if (!lp_winbind_enum_users() && group_rid == DOMAIN_GROUP_RID_USERS) {
522 result = fill_grent_mem_domusers( mem_ctx, domain, state,
523 group_sid, group_name_type,
524 num_gr_mem, gr_mem,
525 gr_mem_len );
526 goto done;
527 }
528
529 /* Real work goes here. Create a list of group names to
530 expand startign with the initial one. Pass that to
531 expand_groups() which returns a list of more group names
532 to expand. Do this up to the max search depth. */
533
534 if ( (glist = TALLOC_ARRAY(mem_ctx, DOM_SID, 1 )) == NULL ) {
535 result = False;
536 DEBUG(0,("fill_grent_mem: talloc failure!\n"));
537 goto done;
538 }
539 sid_copy( &glist[0], group_sid );
540 n_glist = 1;
541
542 for ( i=0; i<max_depth && glist; i++ ) {
543 uint32 n_members = 0;
544 char **members = NULL;
545 NTSTATUS nt_status;
546
547 nt_status = expand_groups( mem_ctx, domain,
548 glist, n_glist,
549 &new_glist, &n_new_glist,
550 &members, &n_members);
551 if ( !NT_STATUS_IS_OK(nt_status) ) {
552 result = False;
553 goto done;
554 }
555
556 /* Add new group members to list */
557
558 nt_status = add_names_to_list( mem_ctx, &names, &num_names,
559 members, n_members );
560 if ( !NT_STATUS_IS_OK(nt_status) ) {
561 result = False;
562 goto done;
563 }
564
565 TALLOC_FREE( members );
566
567 /* If we have no more groups to expand, break out
568 early */
569
570 if (new_glist == NULL)
571 break;
572
573 /* One more round */
574 TALLOC_FREE(glist);
575 glist = new_glist;
576 n_glist = n_new_glist;
577 }
578 TALLOC_FREE( glist );
579
580 DEBUG(10, ("looked up %d names\n", num_names));
581
582 again:
583 /* Add members to list */
584
585 for (i = 0; i < num_names; i++) {
586 int len;
587
588 DEBUG(10, ("processing name %s\n", names[i]));
589
590 len = strlen(names[i]);
591
592 /* Add to list or calculate buffer length */
593
594 if (!buf) {
595 buf_len += len + 1; /* List is comma separated */
596 (*num_gr_mem)++;
597 DEBUG(10, ("buf_len + %d = %d\n", len + 1, buf_len));
598 } else {
599 DEBUG(10, ("appending %s at ndx %d\n", names[i], buf_ndx));
600 safe_strcpy(&buf[buf_ndx], names[i], len);
601 buf_ndx += len;
602 buf[buf_ndx] = ',';
603 buf_ndx++;
604 }
605 }
606
607 /* Allocate buffer */
608
609 if (!buf && buf_len != 0) {
610 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
611 DEBUG(1, ("out of memory\n"));
612 result = False;
613 goto done;
614 }
615 memset(buf, 0, buf_len);
616 goto again;
617 }
618
619 /* Now we're done */
620
621 if (buf && buf_ndx > 0) {
622 buf[buf_ndx - 1] = '\0';
623 }
624
625 *gr_mem = buf;
626 *gr_mem_len = buf_len;
627
628 DEBUG(10, ("num_mem = %u, len = %u, mem = %s\n", (unsigned int)*num_gr_mem,
629 (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
630 result = True;
631
632 done:
633
634 talloc_destroy(mem_ctx);
635
636 DEBUG(10, ("fill_grent_mem returning %d\n", result));
637
638 return result;
639 }
640
641 static void winbindd_getgrsid( struct winbindd_cli_state *state, DOM_SID group_sid );
642
643 static void getgrnam_recv( void *private_data, bool success, const DOM_SID *sid,
644 enum lsa_SidType type )
645 {
646 struct winbindd_cli_state *state = (struct winbindd_cli_state*)private_data;
647
648 if (!success) {
649 DEBUG(5,("getgrnam_recv: lookupname failed!\n"));
650 request_error(state);
651 return;
652 }
653
654 if ( (type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) ) {
655 DEBUG(5,("getgrnam_recv: not a group!\n"));
656 request_error(state);
657 return;
658 }
659
660 winbindd_getgrsid( state, *sid );
661 }
662
663
664 /* Return a group structure from a group name */
665
666 void winbindd_getgrnam(struct winbindd_cli_state *state)
667 {
668 struct winbindd_domain *domain;
669 fstring name_domain, name_group;
670 char *tmp;
671
672 /* Ensure null termination */
673 state->request.data.groupname[sizeof(state->request.data.groupname)-1]='\0';
674
675 DEBUG(3, ("[%5lu]: getgrnam %s\n", (unsigned long)state->pid,
676 state->request.data.groupname));
677
678 /* Parse domain and groupname */
679
680 memset(name_group, 0, sizeof(fstring));
681
682 tmp = state->request.data.groupname;
683
684 name_domain[0] = '\0';
685 name_group[0] = '\0';
686
687 parse_domain_user(tmp, name_domain, name_group);
688
689 /* if no domain or our local domain and no local tdb group, default to
690 * our local domain for aliases */
691
692 if ( !*name_domain || strequal(name_domain, get_global_sam_name()) ) {
693 fstrcpy(name_domain, get_global_sam_name());
694 }
695
696 /* Get info for the domain */
697
698 if ((domain = find_domain_from_name(name_domain)) == NULL) {
699 DEBUG(3, ("could not get domain sid for domain %s\n",
700 name_domain));
701 request_error(state);
702 return;
703 }
704 /* should we deal with users for our domain? */
705
706 if ( lp_winbind_trusted_domains_only() && domain->primary) {
707 DEBUG(7,("winbindd_getgrnam: My domain -- rejecting "
708 "getgrnam() for %s\\%s.\n", name_domain, name_group));
709 request_error(state);
710 return;
711 }
712
713 /* Get rid and name type from name */
714
715 ws_name_replace( name_group, WB_REPLACE_CHAR );
716
717 winbindd_lookupname_async( state->mem_ctx, domain->name, name_group,
718 getgrnam_recv, WINBINDD_GETGRNAM, state );
719 }
720
721 struct getgrsid_state {
722 struct winbindd_cli_state *state;
723 struct winbindd_domain *domain;
724 char *group_name;
725 enum lsa_SidType group_type;
726 uid_t gid;
727 DOM_SID group_sid;
728 };
729
730 static void getgrsid_sid2gid_recv(void *private_data, bool success, gid_t gid)
731 {
732 struct getgrsid_state *s =
733 (struct getgrsid_state *)private_data;
734 struct winbindd_domain *domain;
735 size_t gr_mem_len;
736 size_t num_gr_mem;
737 char *gr_mem;
738 fstring dom_name, group_name;
739
740 if (!success) {
741 DEBUG(5,("getgrsid_sid2gid_recv: sid2gid failed!\n"));
742 request_error(s->state);
743 return;
744 }
745
746 s->gid = gid;
747
748 if ( !parse_domain_user( s->group_name, dom_name, group_name ) ) {
749 DEBUG(5,("getgrsid_sid2gid_recv: parse_domain_user() failed!\n"));
750 request_error(s->state);
751 return;
752 }
753
754
755 /* Fill in group structure */
756
757 if ( (domain = find_domain_from_name_noinit(dom_name)) == NULL ) {
758 DEBUG(1,("Can't find domain from name (%s)\n", dom_name));
759 request_error(s->state);
760 return;
761 }
762
763 if (!fill_grent(&s->state->response.data.gr, dom_name, group_name, gid) ||
764 !fill_grent_mem(domain, s->state, &s->group_sid, s->group_type,
765 &num_gr_mem, &gr_mem, &gr_mem_len))
766 {
767 request_error(s->state);
768 return;
769 }
770
771 s->state->response.data.gr.num_gr_mem = (uint32)num_gr_mem;
772
773 /* Group membership lives at start of extra data */
774
775 s->state->response.data.gr.gr_mem_ofs = 0;
776
777 s->state->response.length += gr_mem_len;
778 s->state->response.extra_data.data = gr_mem;
779
780 request_ok(s->state);
781 }
782
783 static void getgrsid_lookupsid_recv( void *private_data, bool success,
784 const char *dom_name, const char *name,
785 enum lsa_SidType name_type )
786 {
787 struct getgrsid_state *s = (struct getgrsid_state *)private_data;
788
789 if (!success) {
790 DEBUG(5,("getgrsid_lookupsid_recv: lookupsid failed!\n"));
791 request_error(s->state);
792 return;
793 }
794
795 /* either it's a domain group, a domain local group, or a
796 local group in an internal domain */
797
798 if ( !( (name_type==SID_NAME_DOM_GRP) ||
799 ((name_type==SID_NAME_ALIAS) &&
800 (s->domain->primary || s->domain->internal)) ) )
801 {
802 DEBUG(1, ("name '%s\\%s' is not a local or domain group: %d\n",
803 dom_name, name, name_type));
804 request_error(s->state);
805 return;
806 }
807
808 if ( (s->group_name = talloc_asprintf( s->state->mem_ctx,
809 "%s%c%s",
810 dom_name,
811 *lp_winbind_separator(),
812 name)) == NULL )
813 {
814 DEBUG(1, ("getgrsid_lookupsid_recv: talloc_asprintf() Failed!\n"));
815 request_error(s->state);
816 return;
817 }
818
819 s->group_type = name_type;
820
821 winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
822 getgrsid_sid2gid_recv, s);
823 }
824
825 static void winbindd_getgrsid( struct winbindd_cli_state *state, const DOM_SID group_sid )
826 {
827 struct getgrsid_state *s;
828
829 if ( (s = TALLOC_ZERO_P(state->mem_ctx, struct getgrsid_state)) == NULL ) {
830 DEBUG(0, ("talloc failed\n"));
831 request_error(state);
832 return;
833 }
834
835 s->state = state;
836
837 if ( (s->domain = find_domain_from_sid_noinit(&group_sid)) == NULL ) {
838 DEBUG(3, ("Could not find domain for sid %s\n",
839 sid_string_dbg(&group_sid)));
840 request_error(state);
841 return;
842 }
843
844 sid_copy(&s->group_sid, &group_sid);
845
846 winbindd_lookupsid_async( s->state->mem_ctx, &group_sid,
847 getgrsid_lookupsid_recv, s );
848 }
849
850
851 static void getgrgid_recv(void *private_data, bool success, const char *sid)
852 {
853 struct winbindd_cli_state *state = talloc_get_type_abort(private_data, struct winbindd_cli_state);
854 enum lsa_SidType name_type;
855 DOM_SID group_sid;
856
857 if (success) {
858 DEBUG(10,("getgrgid_recv: gid %lu has sid %s\n",
859 (unsigned long)(state->request.data.gid), sid));
860
861 string_to_sid(&group_sid, sid);
862 winbindd_getgrsid(state, group_sid);
863 return;
864 }
865
866 /* Ok, this might be "ours", i.e. an alias */
867 if (pdb_gid_to_sid(state->request.data.gid, &group_sid) &&
868 lookup_sid(state->mem_ctx, &group_sid, NULL, NULL, &name_type) &&
869 (name_type == SID_NAME_ALIAS)) {
870 /* Hey, got an alias */
871 DEBUG(10,("getgrgid_recv: we have an alias with gid %lu and sid %s\n",
872 (unsigned long)(state->request.data.gid), sid));
873 winbindd_getgrsid(state, group_sid);
874 return;
875 }
876
877 DEBUG(1, ("could not convert gid %lu to sid\n",
878 (unsigned long)state->request.data.gid));
879 request_error(state);
880 }
881
882 /* Return a group structure from a gid number */
883 void winbindd_getgrgid(struct winbindd_cli_state *state)
884 {
885 DEBUG(3, ("[%5lu]: getgrgid %lu\n", (unsigned long)state->pid,
886 (unsigned long)state->request.data.gid));
887
888 /* always use the async interface */
889 winbindd_gid2sid_async(state->mem_ctx, state->request.data.gid, getgrgid_recv, state);
890 }
891
892 /*
893 * set/get/endgrent functions
894 */
895
896 /* "Rewind" file pointer for group database enumeration */
897
898 static bool winbindd_setgrent_internal(struct winbindd_cli_state *state)
899 {
900 struct winbindd_domain *domain;
901
902 DEBUG(3, ("[%5lu]: setgrent\n", (unsigned long)state->pid));
903
904 /* Check user has enabled this */
905
906 if (!lp_winbind_enum_groups()) {
907 return False;
908 }
909
910 /* Free old static data if it exists */
911
912 if (state->getgrent_state != NULL) {
913 free_getent_state(state->getgrent_state);
914 state->getgrent_state = NULL;
915 }
916
917 /* Create sam pipes for each domain we know about */
918
919 for (domain = domain_list(); domain != NULL; domain = domain->next) {
920 struct getent_state *domain_state;
921
922 /* Create a state record for this domain */
923
924 /* don't add our domaina if we are a PDC or if we
925 are a member of a Samba domain */
926
927 if ( lp_winbind_trusted_domains_only() && domain->primary )
928 {
929 continue;
930 }
931
932
933 if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL) {
934 DEBUG(1, ("winbindd_setgrent: malloc failed for domain_state!\n"));
935 return False;
936 }
937
938 ZERO_STRUCTP(domain_state);
939
940 fstrcpy(domain_state->domain_name, domain->name);
941
942 /* Add to list of open domains */
943
944 DLIST_ADD(state->getgrent_state, domain_state);
945 }
946
947 state->getgrent_initialized = True;
948 return True;
949 }
950
951 void winbindd_setgrent(struct winbindd_cli_state *state)
952 {
953 if (winbindd_setgrent_internal(state)) {
954 request_ok(state);
955 } else {
956 request_error(state);
957 }
958 }
959
960 /* Close file pointer to ntdom group database */
961
962 void winbindd_endgrent(struct winbindd_cli_state *state)
963 {
964 DEBUG(3, ("[%5lu]: endgrent\n", (unsigned long)state->pid));
965
966 free_getent_state(state->getgrent_state);
967 state->getgrent_initialized = False;
968 state->getgrent_state = NULL;
969 request_ok(state);
970 }
971
972 /* Get the list of domain groups and domain aliases for a domain. We fill in
973 the sam_entries and num_sam_entries fields with domain group information.
974 The dispinfo_ndx field is incremented to the index of the next group to
975 fetch. Return True if some groups were returned, False otherwise. */
976
977 static bool get_sam_group_entries(struct getent_state *ent)
978 {
979 NTSTATUS status;
980 uint32 num_entries;
981 struct acct_info *name_list = NULL;
982 TALLOC_CTX *mem_ctx;
983 bool result = False;
984 struct acct_info *sam_grp_entries = NULL;
985 struct winbindd_domain *domain;
986
987 if (ent->got_sam_entries)
988 return False;
989
990 if (!(mem_ctx = talloc_init("get_sam_group_entries(%s)",
991 ent->domain_name))) {
992 DEBUG(1, ("get_sam_group_entries: could not create talloc context!\n"));
993 return False;
994 }
995
996 /* Free any existing group info */
997
998 SAFE_FREE(ent->sam_entries);
999 ent->num_sam_entries = 0;
1000 ent->got_sam_entries = True;
1001
1002 /* Enumerate domain groups */
1003
1004 num_entries = 0;
1005
1006 if (!(domain = find_domain_from_name(ent->domain_name))) {
1007 DEBUG(3, ("no such domain %s in get_sam_group_entries\n", ent->domain_name));
1008 goto done;
1009 }
1010
1011 /* always get the domain global groups */
1012
1013 status = domain->methods->enum_dom_groups(domain, mem_ctx, &num_entries, &sam_grp_entries);
1014
1015 if (!NT_STATUS_IS_OK(status)) {
1016 DEBUG(3, ("get_sam_group_entries: could not enumerate domain groups! Error: %s\n", nt_errstr(status)));
1017 result = False;
1018 goto done;
1019 }
1020
1021 /* Copy entries into return buffer */
1022
1023 if (num_entries) {
1024 if ( !(name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries)) ) {
1025 DEBUG(0,("get_sam_group_entries: Failed to malloc memory for %d domain groups!\n",
1026 num_entries));
1027 result = False;
1028 goto done;
1029 }
1030 memcpy( name_list, sam_grp_entries, num_entries * sizeof(struct acct_info) );
1031 }
1032
1033 ent->num_sam_entries = num_entries;
1034
1035 /* get the domain local groups if we are a member of a native win2k domain
1036 and are not using LDAP to get the groups */
1037
1038 if ( ( lp_security() != SEC_ADS && domain->native_mode
1039 && domain->primary) || domain->internal )
1040 {
1041 DEBUG(4,("get_sam_group_entries: %s domain; enumerating local groups as well\n",
1042 domain->native_mode ? "Native Mode 2k":"BUILTIN or local"));
1043
1044 status = domain->methods->enum_local_groups(domain, mem_ctx, &num_entries, &sam_grp_entries);
1045
1046 if ( !NT_STATUS_IS_OK(status) ) {
1047 DEBUG(3,("get_sam_group_entries: "
1048 "Failed to enumerate "
1049 "domain local groups with error %s!\n",
1050 nt_errstr(status)));
1051 num_entries = 0;
1052 }
1053 else
1054 DEBUG(4,("get_sam_group_entries: Returned %d local groups\n", num_entries));
1055
1056 /* Copy entries into return buffer */
1057
1058 if ( num_entries ) {
1059 if ( !(name_list = SMB_REALLOC_ARRAY( name_list, struct acct_info, ent->num_sam_entries+num_entries)) )
1060 {
1061 DEBUG(0,("get_sam_group_entries: Failed to realloc more memory for %d local groups!\n",
1062 num_entries));
1063 result = False;
1064 goto done;
1065 }
1066
1067 memcpy( &name_list[ent->num_sam_entries], sam_grp_entries,
1068 num_entries * sizeof(struct acct_info) );
1069 }
1070
1071 ent->num_sam_entries += num_entries;
1072 }
1073
1074
1075 /* Fill in remaining fields */
1076
1077 ent->sam_entries = name_list;
1078 ent->sam_entry_index = 0;
1079
1080 result = (ent->num_sam_entries > 0);
1081
1082 done:
1083 talloc_destroy(mem_ctx);
1084
1085 return result;
1086 }
1087
1088 /* Fetch next group entry from ntdom database */
1089
1090 #define MAX_GETGRENT_GROUPS 500
1091
1092 void winbindd_getgrent(struct winbindd_cli_state *state)
1093 {
1094 struct getent_state *ent;
1095 struct winbindd_gr *group_list = NULL;
1096 int num_groups, group_list_ndx, gr_mem_list_len = 0;
1097 char *gr_mem_list = NULL;
1098
1099 DEBUG(3, ("[%5lu]: getgrent\n", (unsigned long)state->pid));
1100
1101 /* Check user has enabled this */
1102
1103 if (!lp_winbind_enum_groups()) {
1104 request_error(state);
1105 return;
1106 }
1107
1108 num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);
1109
1110 if (num_groups == 0) {
1111 request_error(state);
1112 return;
1113 }
1114
1115 if ((state->response.extra_data.data = SMB_MALLOC_ARRAY(struct winbindd_gr, num_groups)) == NULL) {
1116 request_error(state);
1117 return;
1118 }
1119
1120 memset(state->response.extra_data.data, '\0',
1121 num_groups * sizeof(struct winbindd_gr) );
1122
1123 state->response.data.num_entries = 0;
1124
1125 group_list = (struct winbindd_gr *)state->response.extra_data.data;
1126
1127 if (!state->getgrent_initialized)
1128 winbindd_setgrent_internal(state);
1129
1130 if (!(ent = state->getgrent_state)) {
1131 request_error(state);
1132 return;
1133 }
1134
1135 /* Start sending back groups */
1136
1137 for (group_list_ndx = 0; group_list_ndx < num_groups; ) {
1138 struct acct_info *name_list = NULL;
1139 fstring domain_group_name;
1140 uint32 result;
1141 gid_t group_gid;
1142 size_t gr_mem_len;
1143 char *gr_mem;
1144 DOM_SID group_sid;
1145 struct winbindd_domain *domain;
1146
1147 /* Do we need to fetch another chunk of groups? */
1148
1149 tryagain:
1150
1151 DEBUG(10, ("entry_index = %d, num_entries = %d\n",
1152 ent->sam_entry_index, ent->num_sam_entries));
1153
1154 if (ent->num_sam_entries == ent->sam_entry_index) {
1155
1156 while(ent && !get_sam_group_entries(ent)) {
1157 struct getent_state *next_ent;
1158
1159 DEBUG(10, ("freeing state info for domain %s\n", ent->domain_name));
1160
1161 /* Free state information for this domain */
1162
1163 SAFE_FREE(ent->sam_entries);
1164
1165 next_ent = ent->next;
1166 DLIST_REMOVE(state->getgrent_state, ent);
1167
1168 SAFE_FREE(ent);
1169 ent = next_ent;
1170 }
1171
1172 /* No more domains */
1173
1174 if (!ent)
1175 break;
1176 }
1177
1178 name_list = (struct acct_info *)ent->sam_entries;
1179
1180 if (!(domain =
1181 find_domain_from_name(ent->domain_name))) {
1182 DEBUG(3, ("No such domain %s in winbindd_getgrent\n", ent->domain_name));
1183 result = False;
1184 goto done;
1185 }
1186
1187 /* Lookup group info */
1188
1189 sid_copy(&group_sid, &domain->sid);
1190 sid_append_rid(&group_sid, name_list[ent->sam_entry_index].rid);
1191
1192 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid, &group_gid))) {
1193 union unid_t id;
1194 enum lsa_SidType type;
1195
1196 DEBUG(10, ("SID %s not in idmap\n",
1197 sid_string_dbg(&group_sid)));
1198
1199 if (!pdb_sid_to_id(&group_sid, &id, &type)) {
1200 DEBUG(1, ("could not look up gid for group "
1201 "%s\n",
1202 name_list[ent->sam_entry_index].acct_name));
1203 ent->sam_entry_index++;
1204 goto tryagain;
1205 }
1206
1207 if ((type != SID_NAME_DOM_GRP) &&
1208 (type != SID_NAME_ALIAS) &&
1209 (type != SID_NAME_WKN_GRP)) {
1210 DEBUG(1, ("Group %s is a %s, not a group\n",
1211 sid_type_lookup(type),
1212 name_list[ent->sam_entry_index].acct_name));
1213 ent->sam_entry_index++;
1214 goto tryagain;
1215 }
1216 group_gid = id.gid;
1217 }
1218
1219 DEBUG(10, ("got gid %lu for group %lu\n", (unsigned long)group_gid,
1220 (unsigned long)name_list[ent->sam_entry_index].rid));
1221
1222 /* Fill in group entry */
1223
1224 fill_domain_username(domain_group_name, ent->domain_name,
1225 name_list[ent->sam_entry_index].acct_name, True);
1226
1227 result = fill_grent(&group_list[group_list_ndx],
1228 ent->domain_name,
1229 name_list[ent->sam_entry_index].acct_name,
1230 group_gid);
1231
1232 /* Fill in group membership entry */
1233
1234 if (result) {
1235 size_t num_gr_mem = 0;
1236 DOM_SID member_sid;
1237 group_list[group_list_ndx].num_gr_mem = 0;
1238 gr_mem = NULL;
1239 gr_mem_len = 0;
1240
1241 /* Get group membership */
1242 if (state->request.cmd == WINBINDD_GETGRLST) {
1243 result = True;
1244 } else {
1245 sid_copy(&member_sid, &domain->sid);
1246 sid_append_rid(&member_sid, name_list[ent->sam_entry_index].rid);
1247 result = fill_grent_mem(
1248 domain,
1249 NULL,
1250 &member_sid,
1251 SID_NAME_DOM_GRP,
1252 &num_gr_mem,
1253 &gr_mem, &gr_mem_len);
1254
1255 group_list[group_list_ndx].num_gr_mem = (uint32)num_gr_mem;
1256 }
1257 }
1258
1259 if (result) {
1260 /* Append to group membership list */
1261 gr_mem_list = (char *)SMB_REALLOC(
1262 gr_mem_list, gr_mem_list_len + gr_mem_len);
1263
1264 if (!gr_mem_list && (group_list[group_list_ndx].num_gr_mem != 0)) {
1265 DEBUG(0, ("out of memory\n"));
1266 gr_mem_list_len = 0;
1267 break;
1268 }
1269
1270 DEBUG(10, ("list_len = %d, mem_len = %u\n",
1271 gr_mem_list_len, (unsigned int)gr_mem_len));
1272
1273 memcpy(&gr_mem_list[gr_mem_list_len], gr_mem,
1274 gr_mem_len);
1275
1276 SAFE_FREE(gr_mem);
1277
1278 group_list[group_list_ndx].gr_mem_ofs =
1279 gr_mem_list_len;
1280
1281 gr_mem_list_len += gr_mem_len;
1282 }
1283
1284 ent->sam_entry_index++;
1285
1286 /* Add group to return list */
1287
1288 if (result) {
1289
1290 DEBUG(10, ("adding group num_entries = %d\n",
1291 state->response.data.num_entries));
1292
1293 group_list_ndx++;
1294 state->response.data.num_entries++;
1295
1296 state->response.length +=
1297 sizeof(struct winbindd_gr);
1298
1299 } else {
1300 DEBUG(0, ("could not lookup domain group %s\n",
1301 domain_group_name));
1302 }
1303 }
1304
1305 /* Copy the list of group memberships to the end of the extra data */
1306
1307 if (group_list_ndx == 0)
1308 goto done;
1309
1310 state->response.extra_data.data = SMB_REALLOC(
1311 state->response.extra_data.data,
1312 group_list_ndx * sizeof(struct winbindd_gr) + gr_mem_list_len);
1313
1314 if (!state->response.extra_data.data) {
1315 DEBUG(0, ("out of memory\n"));
1316 group_list_ndx = 0;
1317 SAFE_FREE(gr_mem_list);
1318 request_error(state);
1319 return;
1320 }
1321
1322 memcpy(&((char *)state->response.extra_data.data)
1323 [group_list_ndx * sizeof(struct winbindd_gr)],
1324 gr_mem_list, gr_mem_list_len);
1325
1326 state->response.length += gr_mem_list_len;
1327
1328 DEBUG(10, ("returning %d groups, length = %d\n",
1329 group_list_ndx, gr_mem_list_len));
1330
1331 /* Out of domains */
1332
1333 done:
1334
1335 SAFE_FREE(gr_mem_list);
1336
1337 if (group_list_ndx > 0)
1338 request_ok(state);
1339 else
1340 request_error(state);
1341 }
1342
1343 /* List domain groups without mapping to unix ids */
1344
1345 void winbindd_list_groups(struct winbindd_cli_state *state)
1346 {
1347 uint32 total_entries = 0;
1348 struct winbindd_domain *domain;
1349 const char *which_domain;
1350 char *extra_data = NULL;
1351 unsigned int extra_data_len = 0, i;
1352
1353 DEBUG(3, ("[%5lu]: list groups\n", (unsigned long)state->pid));
1354
1355 /* Ensure null termination */
1356 state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
1357 which_domain = state->request.domain_name;
1358
1359 /* Enumerate over trusted domains */
1360
1361 for (domain = domain_list(); domain; domain = domain->next) {
1362 struct getent_state groups;
1363
1364 /* if we have a domain name restricting the request and this
1365 one in the list doesn't match, then just bypass the remainder
1366 of the loop */
1367
1368 if ( *which_domain && !strequal(which_domain, domain->name) )
1369 continue;
1370
1371 ZERO_STRUCT(groups);
1372
1373 /* Get list of sam groups */
1374
1375 fstrcpy(groups.domain_name, domain->name);
1376
1377 get_sam_group_entries(&groups);
1378
1379 if (groups.num_sam_entries == 0) {
1380 /* this domain is empty or in an error state */
1381 continue;
1382 }
1383
1384 /* keep track the of the total number of groups seen so
1385 far over all domains */
1386 total_entries += groups.num_sam_entries;
1387
1388 /* Allocate some memory for extra data. Note that we limit
1389 account names to sizeof(fstring) = 128 characters. */
1390 extra_data = (char *)SMB_REALLOC(
1391 extra_data, sizeof(fstring) * total_entries);
1392
1393 if (!extra_data) {
1394 DEBUG(0,("failed to enlarge buffer!\n"));
1395 request_error(state);
1396 return;
1397 }
1398
1399 /* Pack group list into extra data fields */
1400 for (i = 0; i < groups.num_sam_entries; i++) {
1401 char *group_name = ((struct acct_info *)
1402 groups.sam_entries)[i].acct_name;
1403 fstring name;
1404
1405 fill_domain_username(name, domain->name, group_name, True);
1406 /* Append to extra data */
1407 memcpy(&extra_data[extra_data_len], name,
1408 strlen(name));
1409 extra_data_len += strlen(name);
1410 extra_data[extra_data_len++] = ',';
1411 }
1412
1413 SAFE_FREE(groups.sam_entries);
1414 }
1415
1416 /* Assign extra_data fields in response structure */
1417 if (extra_data) {
1418 extra_data[extra_data_len - 1] = '\0';
1419 state->response.extra_data.data = extra_data;
1420 state->response.length += extra_data_len;
1421 }
1422
1423 /* No domains may have responded but that's still OK so don't
1424 return an error. */
1425
1426 request_ok(state);
1427 }
1428
1429 /* Get user supplementary groups. This is much quicker than trying to
1430 invert the groups database. We merge the groups from the gids and
1431 other_sids info3 fields as trusted domain, universal group
1432 memberships, and nested groups (win2k native mode only) are not
1433 returned by the getgroups RPC call but are present in the info3. */
1434
1435 struct getgroups_state {
1436 struct winbindd_cli_state *state;
1437 struct winbindd_domain *domain;
1438 char *domname;
1439 char *username;
1440 DOM_SID user_sid;
1441
1442 const DOM_SID *token_sids;
1443 size_t i, num_token_sids;
1444
1445 gid_t *token_gids;
1446 size_t num_token_gids;
1447 };
1448
1449 static void getgroups_usersid_recv(void *private_data, bool success,
1450 const DOM_SID *sid, enum lsa_SidType type);
1451 static void getgroups_tokensids_recv(void *private_data, bool success,
1452 DOM_SID *token_sids, size_t num_token_sids);
1453 static void getgroups_sid2gid_recv(void *private_data, bool success, gid_t gid);
1454
1455 void winbindd_getgroups(struct winbindd_cli_state *state)
1456 {
1457 struct getgroups_state *s;
1458
1459 /* Ensure null termination */
1460 state->request.data.username
1461 [sizeof(state->request.data.username)-1]='\0';
1462
1463 DEBUG(3, ("[%5lu]: getgroups %s\n", (unsigned long)state->pid,
1464 state->request.data.username));
1465
1466 /* Parse domain and username */
1467
1468 s = TALLOC_P(state->mem_ctx, struct getgroups_state);
1469 if (s == NULL) {
1470 DEBUG(0, ("talloc failed\n"));
1471 request_error(state);
1472 return;
1473 }
1474
1475 s->state = state;
1476
1477 ws_name_return( state->request.data.username, WB_REPLACE_CHAR );
1478
1479 if (!parse_domain_user_talloc(state->mem_ctx,
1480 state->request.data.username,
1481 &s->domname, &s->username)) {
1482 DEBUG(5, ("Could not parse domain user: %s\n",
1483 state->request.data.username));
1484
1485 /* error out if we do not have nested group support */
1486
1487 if ( !lp_winbind_nested_groups() ) {
1488 request_error(state);
1489 return;
1490 }
1491
1492 s->domname = talloc_strdup( state->mem_ctx, get_global_sam_name() );
1493 s->username = talloc_strdup( state->mem_ctx, state->request.data.username );
1494 }
1495
1496 /* Get info for the domain (either by short domain name or
1497 DNS name in the case of a UPN) */
1498
1499 s->domain = find_domain_from_name_noinit(s->domname);
1500 if (!s->domain) {
1501 char *p = strchr(s->username, '@');
1502
1503 if (p) {
1504 s->domain = find_domain_from_name_noinit(p+1);
1505 }
1506
1507 }
1508
1509 if (s->domain == NULL) {
1510 DEBUG(7, ("could not find domain entry for domain %s\n",
1511 s->domname));
1512 request_error(state);
1513 return;
1514 }
1515
1516 if ( s->domain->primary && lp_winbind_trusted_domains_only()) {
1517 DEBUG(7,("winbindd_getgroups: My domain -- rejecting "
1518 "getgroups() for %s\\%s.\n", s->domname,
1519 s->username));
1520 request_error(state);
1521 return;
1522 }
1523
1524 /* Get rid and name type from name. The following costs 1 packet */
1525
1526 winbindd_lookupname_async(state->mem_ctx, s->domname, s->username,
1527 getgroups_usersid_recv, WINBINDD_GETGROUPS, s);
1528 }
1529
1530 static void getgroups_usersid_recv(void *private_data, bool success,
1531 const DOM_SID *sid, enum lsa_SidType type)
1532 {
1533 struct getgroups_state *s =
1534 (struct getgroups_state *)private_data;
1535
1536 if ((!success) ||
1537 ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER))) {
1538 request_error(s->state);
1539 return;
1540 }
1541
1542 sid_copy(&s->user_sid, sid);
1543
1544 winbindd_gettoken_async(s->state->mem_ctx, &s->user_sid,
1545 getgroups_tokensids_recv, s);
1546 }
1547
1548 static void getgroups_tokensids_recv(void *private_data, bool success,
1549 DOM_SID *token_sids, size_t num_token_sids)
1550 {
1551 struct getgroups_state *s =
1552 (struct getgroups_state *)private_data;
1553
1554 /* We need at least the user sid and the primary group in the token,
1555 * otherwise it's an error */
1556
1557 if ((!success) || (num_token_sids < 2)) {
1558 request_error(s->state);
1559 return;
1560 }
1561
1562 s->token_sids = token_sids;
1563 s->num_token_sids = num_token_sids;
1564 s->i = 0;
1565
1566 s->token_gids = NULL;
1567 s->num_token_gids = 0;
1568
1569 getgroups_sid2gid_recv(s, False, 0);
1570 }
1571
1572 static void getgroups_sid2gid_recv(void *private_data, bool success, gid_t gid)
1573 {
1574 struct getgroups_state *s =
1575 (struct getgroups_state *)private_data;
1576
1577 if (success) {
1578 if (!add_gid_to_array_unique(s->state->mem_ctx, gid,
1579 &s->token_gids,
1580 &s->num_token_gids)) {
1581 return;
1582 }
1583 }
1584
1585 if (s->i < s->num_token_sids) {
1586 const DOM_SID *sid = &s->token_sids[s->i];
1587 s->i += 1;
1588
1589 if (sid_equal(sid, &s->user_sid)) {
1590 getgroups_sid2gid_recv(s, False, 0);
1591 return;
1592 }
1593
1594 winbindd_sid2gid_async(s->state->mem_ctx, sid,
1595 getgroups_sid2gid_recv, s);
1596 return;
1597 }
1598
1599 s->state->response.data.num_entries = s->num_token_gids;
1600 if (s->num_token_gids) {
1601 /* s->token_gids are talloced */
1602 s->state->response.extra_data.data = smb_xmemdup(s->token_gids, s->num_token_gids * sizeof(gid_t));
1603 s->state->response.length += s->num_token_gids * sizeof(gid_t);
1604 }
1605 request_ok(s->state);
1606 }
1607
1608 /* Get user supplementary sids. This is equivalent to the
1609 winbindd_getgroups() function but it involves a SID->SIDs mapping
1610 rather than a NAME->SID->SIDS->GIDS mapping, which means we avoid
1611 idmap. This call is designed to be used with applications that need
1612 to do ACL evaluation themselves. Note that the cached info3 data is
1613 not used
1614
1615 this function assumes that the SID that comes in is a user SID. If
1616 you pass in another type of SID then you may get unpredictable
1617 results.
1618 */
1619
1620 static void getusersids_recv(void *private_data, bool success, DOM_SID *sids,
1621 size_t num_sids);
1622
1623 void winbindd_getusersids(struct winbindd_cli_state *state)
1624 {
1625 DOM_SID *user_sid;
1626
1627 /* Ensure null termination */
1628 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1629
1630 user_sid = TALLOC_P(state->mem_ctx, DOM_SID);
1631 if (user_sid == NULL) {
1632 DEBUG(1, ("talloc failed\n"));
1633 request_error(state);
1634 return;
1635 }
1636
1637 if (!string_to_sid(user_sid, state->request.data.sid)) {
1638 DEBUG(1, ("Could not get convert sid %s from string\n",
1639 state->request.data.sid));
1640 request_error(state);
1641 return;
1642 }
1643
1644 winbindd_gettoken_async(state->mem_ctx, user_sid, getusersids_recv,
1645 state);
1646 }
1647
1648 static void getusersids_recv(void *private_data, bool success, DOM_SID *sids,
1649 size_t num_sids)
1650 {
1651 struct winbindd_cli_state *state =
1652 (struct winbindd_cli_state *)private_data;
1653 char *ret = NULL;
1654 unsigned ofs, ret_size = 0;
1655 size_t i;
1656
1657 if (!success) {
1658 request_error(state);
1659 return;
1660 }
1661
1662 /* work out the response size */
1663 for (i = 0; i < num_sids; i++) {
1664 fstring s;
1665 sid_to_fstring(s, &sids[i]);
1666 ret_size += strlen(s) + 1;
1667 }
1668
1669 /* build the reply */
1670 ret = (char *)SMB_MALLOC(ret_size);
1671 if (!ret) {
1672 DEBUG(0, ("malloc failed\n"));
1673 request_error(state);
1674 return;
1675 }
1676 ofs = 0;
1677 for (i = 0; i < num_sids; i++) {
1678 fstring s;
1679 sid_to_fstring(s, &sids[i]);
1680 safe_strcpy(ret + ofs, s, ret_size - ofs - 1);
1681 ofs += strlen(ret+ofs) + 1;
1682 }
1683
1684 /* Send data back to client */
1685 state->response.data.num_entries = num_sids;
1686 state->response.extra_data.data = ret;
1687 state->response.length += ret_size;
1688 request_ok(state);
1689 }
1690
1691 void winbindd_getuserdomgroups(struct winbindd_cli_state *state)
1692 {
1693 DOM_SID user_sid;
1694 struct winbindd_domain *domain;
1695
1696 /* Ensure null termination */
1697 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1698
1699 if (!string_to_sid(&user_sid, state->request.data.sid)) {
1700 DEBUG(1, ("Could not get convert sid %s from string\n",
1701 state->request.data.sid));
1702 request_error(state);
1703 return;
1704 }
1705
1706 /* Get info for the domain */
1707 if ((domain = find_domain_from_sid_noinit(&user_sid)) == NULL) {
1708 DEBUG(0,("could not find domain entry for sid %s\n",
1709 sid_string_dbg(&user_sid)));
1710 request_error(state);
1711 return;
1712 }
1713
1714 sendto_domain(state, domain);
1715 }
1716
1717 enum winbindd_result winbindd_dual_getuserdomgroups(struct winbindd_domain *domain,
1718 struct winbindd_cli_state *state)
1719 {
1720 DOM_SID user_sid;
1721 NTSTATUS status;
1722
1723 char *sidstring;
1724 ssize_t len;
1725 DOM_SID *groups;
1726 uint32 num_groups;
1727
1728 /* Ensure null termination */
1729 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1730
1731 if (!string_to_sid(&user_sid, state->request.data.sid)) {
1732 DEBUG(1, ("Could not get convert sid %s from string\n",
1733 state->request.data.sid));
1734 return WINBINDD_ERROR;
1735 }
1736
1737 status = domain->methods->lookup_usergroups(domain, state->mem_ctx,
1738 &user_sid, &num_groups,
1739 &groups);
1740 if (!NT_STATUS_IS_OK(status))
1741 return WINBINDD_ERROR;
1742
1743 if (num_groups == 0) {
1744 state->response.data.num_entries = 0;
1745 state->response.extra_data.data = NULL;
1746 return WINBINDD_OK;
1747 }
1748
1749 if (!print_sidlist(state->mem_ctx, groups, num_groups, &sidstring, &len)) {
1750 DEBUG(0, ("talloc failed\n"));
1751 return WINBINDD_ERROR;
1752 }
1753
1754 state->response.extra_data.data = SMB_STRDUP(sidstring);
1755 if (!state->response.extra_data.data) {
1756 return WINBINDD_ERROR;
1757 }
1758 state->response.length += len+1;
1759 state->response.data.num_entries = num_groups;
1760
1761 return WINBINDD_OK;
1762 }
reg import