tevent: expose tevent_context_init_ops
[Samba/gebeck_regimport.git] / source3 / winbindd / winbindd_util.c
blob7dff138fc137b0a1381da743e024d8ebc5e0dad1
1 /*
2 Unix SMB/CIFS implementation.
4 Winbind daemon for ntdom nss module
6 Copyright (C) Tim Potter 2000-2001
7 Copyright (C) 2001 by Martin Pool <mbp@samba.org>
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "includes.h"
24 #include "winbindd.h"
25 #include "secrets.h"
26 #include "../libcli/security/security.h"
27 #include "../libcli/auth/pam_errors.h"
28 #include "passdb/machine_sid.h"
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
33 extern struct winbindd_methods cache_methods;
35 /**
36 * @file winbindd_util.cq
38 * Winbind daemon for NT domain authentication nss module.
39 **/
42 /* The list of trusted domains. Note that the list can be deleted and
43 recreated using the init_domain_list() function so pointers to
44 individual winbindd_domain structures cannot be made. Keep a copy of
45 the domain name instead. */
47 static struct winbindd_domain *_domain_list = NULL;
49 struct winbindd_domain *domain_list(void)
51 /* Initialise list */
53 if ((!_domain_list) && (!init_domain_list())) {
54 smb_panic("Init_domain_list failed");
57 return _domain_list;
60 /* Free all entries in the trusted domain list */
62 static void free_domain_list(void)
64 struct winbindd_domain *domain = _domain_list;
66 while(domain) {
67 struct winbindd_domain *next = domain->next;
69 DLIST_REMOVE(_domain_list, domain);
70 SAFE_FREE(domain);
71 domain = next;
75 static bool is_internal_domain(const struct dom_sid *sid)
77 if (sid == NULL)
78 return False;
80 return (sid_check_is_domain(sid) || sid_check_is_builtin(sid));
83 static bool is_in_internal_domain(const struct dom_sid *sid)
85 if (sid == NULL)
86 return False;
88 return (sid_check_is_in_our_domain(sid) || sid_check_is_in_builtin(sid));
92 /* Add a trusted domain to our list of domains */
93 static struct winbindd_domain *add_trusted_domain(const char *domain_name, const char *alt_name,
94 struct winbindd_methods *methods,
95 const struct dom_sid *sid)
97 struct winbindd_domain *domain;
98 const char *alternative_name = NULL;
99 char *idmap_config_option;
100 const char *param;
101 const char **ignored_domains, **dom;
103 ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL);
104 for (dom=ignored_domains; dom && *dom; dom++) {
105 if (gen_fnmatch(*dom, domain_name) == 0) {
106 DEBUG(2,("Ignoring domain '%s'\n", domain_name));
107 return NULL;
111 /* ignore alt_name if we are not in an AD domain */
113 if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
114 alternative_name = alt_name;
117 /* We can't call domain_list() as this function is called from
118 init_domain_list() and we'll get stuck in a loop. */
119 for (domain = _domain_list; domain; domain = domain->next) {
120 if (strequal(domain_name, domain->name) ||
121 strequal(domain_name, domain->alt_name))
123 break;
126 if (alternative_name && *alternative_name)
128 if (strequal(alternative_name, domain->name) ||
129 strequal(alternative_name, domain->alt_name))
131 break;
135 if (sid)
137 if (is_null_sid(sid)) {
138 continue;
141 if (dom_sid_equal(sid, &domain->sid)) {
142 break;
147 if (domain != NULL) {
149 * We found a match. Possibly update the SID
151 if ((sid != NULL)
152 && dom_sid_equal(&domain->sid, &global_sid_NULL)) {
153 sid_copy( &domain->sid, sid );
155 return domain;
158 /* Create new domain entry */
160 if ((domain = SMB_MALLOC_P(struct winbindd_domain)) == NULL)
161 return NULL;
163 /* Fill in fields */
165 ZERO_STRUCTP(domain);
167 domain->children = SMB_MALLOC_ARRAY(
168 struct winbindd_child, lp_winbind_max_domain_connections());
169 if (domain->children == NULL) {
170 SAFE_FREE(domain);
171 return NULL;
173 memset(domain->children, 0,
174 sizeof(struct winbindd_child)
175 * lp_winbind_max_domain_connections());
177 fstrcpy(domain->name, domain_name);
178 if (alternative_name) {
179 fstrcpy(domain->alt_name, alternative_name);
182 domain->methods = methods;
183 domain->backend = NULL;
184 domain->internal = is_internal_domain(sid);
185 domain->sequence_number = DOM_SEQUENCE_NONE;
186 domain->last_seq_check = 0;
187 domain->initialized = False;
188 domain->online = is_internal_domain(sid);
189 domain->check_online_timeout = 0;
190 domain->dc_probe_pid = (pid_t)-1;
191 if (sid) {
192 sid_copy(&domain->sid, sid);
195 /* Link to domain list */
196 DLIST_ADD_END(_domain_list, domain, struct winbindd_domain *);
198 wcache_tdc_add_domain( domain );
200 idmap_config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
201 domain->name);
202 if (idmap_config_option == NULL) {
203 DEBUG(0, ("talloc failed, not looking for idmap config\n"));
204 goto done;
207 param = lp_parm_const_string(-1, idmap_config_option, "range", NULL);
209 DEBUG(10, ("%s : range = %s\n", idmap_config_option,
210 param ? param : "not defined"));
212 if (param != NULL) {
213 unsigned low_id, high_id;
214 if (sscanf(param, "%u - %u", &low_id, &high_id) != 2) {
215 DEBUG(1, ("invalid range syntax in %s: %s\n",
216 idmap_config_option, param));
217 goto done;
219 if (low_id > high_id) {
220 DEBUG(1, ("invalid range in %s: %s\n",
221 idmap_config_option, param));
222 goto done;
224 domain->have_idmap_config = true;
225 domain->id_range_low = low_id;
226 domain->id_range_high = high_id;
229 done:
231 DEBUG(2,("Added domain %s %s %s\n",
232 domain->name, domain->alt_name,
233 &domain->sid?sid_string_dbg(&domain->sid):""));
235 return domain;
238 bool domain_is_forest_root(const struct winbindd_domain *domain)
240 const uint32_t fr_flags =
241 (NETR_TRUST_FLAG_TREEROOT|NETR_TRUST_FLAG_IN_FOREST);
243 return ((domain->domain_flags & fr_flags) == fr_flags);
246 /********************************************************************
247 rescan our domains looking for new trusted domains
248 ********************************************************************/
250 struct trustdom_state {
251 struct winbindd_domain *domain;
252 struct winbindd_request request;
255 static void trustdom_list_done(struct tevent_req *req);
256 static void rescan_forest_root_trusts( void );
257 static void rescan_forest_trusts( void );
259 static void add_trusted_domains( struct winbindd_domain *domain )
261 struct trustdom_state *state;
262 struct tevent_req *req;
264 state = talloc_zero(NULL, struct trustdom_state);
265 if (state == NULL) {
266 DEBUG(0, ("talloc failed\n"));
267 return;
269 state->domain = domain;
271 state->request.length = sizeof(state->request);
272 state->request.cmd = WINBINDD_LIST_TRUSTDOM;
274 req = wb_domain_request_send(state, winbind_event_context(),
275 domain, &state->request);
276 if (req == NULL) {
277 DEBUG(1, ("wb_domain_request_send failed\n"));
278 TALLOC_FREE(state);
279 return;
281 tevent_req_set_callback(req, trustdom_list_done, state);
284 static void trustdom_list_done(struct tevent_req *req)
286 struct trustdom_state *state = tevent_req_callback_data(
287 req, struct trustdom_state);
288 struct winbindd_response *response;
289 int res, err;
290 char *p;
292 res = wb_domain_request_recv(req, state, &response, &err);
293 if ((res == -1) || (response->result != WINBINDD_OK)) {
294 DEBUG(1, ("Could not receive trustdoms\n"));
295 TALLOC_FREE(state);
296 return;
299 p = (char *)response->extra_data.data;
301 while ((p != NULL) && (*p != '\0')) {
302 char *q, *sidstr, *alt_name;
303 struct dom_sid sid;
304 struct winbindd_domain *domain;
305 char *alternate_name = NULL;
307 alt_name = strchr(p, '\\');
308 if (alt_name == NULL) {
309 DEBUG(0, ("Got invalid trustdom response\n"));
310 break;
313 *alt_name = '\0';
314 alt_name += 1;
316 sidstr = strchr(alt_name, '\\');
317 if (sidstr == NULL) {
318 DEBUG(0, ("Got invalid trustdom response\n"));
319 break;
322 *sidstr = '\0';
323 sidstr += 1;
325 q = strchr(sidstr, '\n');
326 if (q != NULL)
327 *q = '\0';
329 if (!string_to_sid(&sid, sidstr)) {
330 DEBUG(0, ("Got invalid trustdom response\n"));
331 break;
334 /* use the real alt_name if we have one, else pass in NULL */
336 if ( !strequal( alt_name, "(null)" ) )
337 alternate_name = alt_name;
339 /* If we have an existing domain structure, calling
340 add_trusted_domain() will update the SID if
341 necessary. This is important because we need the
342 SID for sibling domains */
344 if ( find_domain_from_name_noinit(p) != NULL ) {
345 domain = add_trusted_domain(p, alternate_name,
346 &cache_methods,
347 &sid);
348 } else {
349 domain = add_trusted_domain(p, alternate_name,
350 &cache_methods,
351 &sid);
352 if (domain) {
353 setup_domain_child(domain);
356 p=q;
357 if (p != NULL)
358 p += 1;
362 Cases to consider when scanning trusts:
363 (a) we are calling from a child domain (primary && !forest_root)
364 (b) we are calling from the root of the forest (primary && forest_root)
365 (c) we are calling from a trusted forest domain (!primary
366 && !forest_root)
369 if (state->domain->primary) {
370 /* If this is our primary domain and we are not in the
371 forest root, we have to scan the root trusts first */
373 if (!domain_is_forest_root(state->domain))
374 rescan_forest_root_trusts();
375 else
376 rescan_forest_trusts();
378 } else if (domain_is_forest_root(state->domain)) {
379 /* Once we have done root forest trust search, we can
380 go on to search the trusted forests */
382 rescan_forest_trusts();
385 TALLOC_FREE(state);
387 return;
390 /********************************************************************
391 Scan the trusts of our forest root
392 ********************************************************************/
394 static void rescan_forest_root_trusts( void )
396 struct winbindd_tdc_domain *dom_list = NULL;
397 size_t num_trusts = 0;
398 int i;
400 /* The only transitive trusts supported by Windows 2003 AD are
401 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
402 first two are handled in forest and listed by
403 DsEnumerateDomainTrusts(). Forest trusts are not so we
404 have to do that ourselves. */
406 if ( !wcache_tdc_fetch_list( &dom_list, &num_trusts ) )
407 return;
409 for ( i=0; i<num_trusts; i++ ) {
410 struct winbindd_domain *d = NULL;
412 /* Find the forest root. Don't necessarily trust
413 the domain_list() as our primary domain may not
414 have been initialized. */
416 if ( !(dom_list[i].trust_flags & NETR_TRUST_FLAG_TREEROOT) ) {
417 continue;
420 /* Here's the forest root */
422 d = find_domain_from_name_noinit( dom_list[i].domain_name );
424 if ( !d ) {
425 d = add_trusted_domain( dom_list[i].domain_name,
426 dom_list[i].dns_name,
427 &cache_methods,
428 &dom_list[i].sid );
429 if (d != NULL) {
430 setup_domain_child(d);
434 if (d == NULL) {
435 continue;
438 DEBUG(10,("rescan_forest_root_trusts: Following trust path "
439 "for domain tree root %s (%s)\n",
440 d->name, d->alt_name ));
442 d->domain_flags = dom_list[i].trust_flags;
443 d->domain_type = dom_list[i].trust_type;
444 d->domain_trust_attribs = dom_list[i].trust_attribs;
446 add_trusted_domains( d );
448 break;
451 TALLOC_FREE( dom_list );
453 return;
456 /********************************************************************
457 scan the transitive forest trusts (not our own)
458 ********************************************************************/
461 static void rescan_forest_trusts( void )
463 struct winbindd_domain *d = NULL;
464 struct winbindd_tdc_domain *dom_list = NULL;
465 size_t num_trusts = 0;
466 int i;
468 /* The only transitive trusts supported by Windows 2003 AD are
469 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
470 first two are handled in forest and listed by
471 DsEnumerateDomainTrusts(). Forest trusts are not so we
472 have to do that ourselves. */
474 if ( !wcache_tdc_fetch_list( &dom_list, &num_trusts ) )
475 return;
477 for ( i=0; i<num_trusts; i++ ) {
478 uint32 flags = dom_list[i].trust_flags;
479 uint32 type = dom_list[i].trust_type;
480 uint32 attribs = dom_list[i].trust_attribs;
482 d = find_domain_from_name_noinit( dom_list[i].domain_name );
484 /* ignore our primary and internal domains */
486 if ( d && (d->internal || d->primary ) )
487 continue;
489 if ( (flags & NETR_TRUST_FLAG_INBOUND) &&
490 (type == NETR_TRUST_TYPE_UPLEVEL) &&
491 (attribs == NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) )
493 /* add the trusted domain if we don't know
494 about it */
496 if ( !d ) {
497 d = add_trusted_domain( dom_list[i].domain_name,
498 dom_list[i].dns_name,
499 &cache_methods,
500 &dom_list[i].sid );
501 if (d != NULL) {
502 setup_domain_child(d);
506 if (d == NULL) {
507 continue;
510 DEBUG(10,("Following trust path for domain %s (%s)\n",
511 d->name, d->alt_name ));
512 add_trusted_domains( d );
516 TALLOC_FREE( dom_list );
518 return;
521 /*********************************************************************
522 The process of updating the trusted domain list is a three step
523 async process:
524 (a) ask our domain
525 (b) ask the root domain in our forest
526 (c) ask the a DC in any Win2003 trusted forests
527 *********************************************************************/
529 void rescan_trusted_domains(struct tevent_context *ev, struct tevent_timer *te,
530 struct timeval now, void *private_data)
532 TALLOC_FREE(te);
534 /* I use to clear the cache here and start over but that
535 caused problems in child processes that needed the
536 trust dom list early on. Removing it means we
537 could have some trusted domains listed that have been
538 removed from our primary domain's DC until a full
539 restart. This should be ok since I think this is what
540 Windows does as well. */
542 /* this will only add new domains we didn't already know about
543 in the domain_list()*/
545 add_trusted_domains( find_our_domain() );
547 te = tevent_add_timer(
548 ev, NULL, timeval_current_ofs(WINBINDD_RESCAN_FREQ, 0),
549 rescan_trusted_domains, NULL);
551 * If te == NULL, there's not much we can do here. Don't fail, the
552 * only thing we miss is new trusted domains.
555 return;
558 enum winbindd_result winbindd_dual_init_connection(struct winbindd_domain *domain,
559 struct winbindd_cli_state *state)
561 /* Ensure null termination */
562 state->request->domain_name
563 [sizeof(state->request->domain_name)-1]='\0';
564 state->request->data.init_conn.dcname
565 [sizeof(state->request->data.init_conn.dcname)-1]='\0';
567 if (strlen(state->request->data.init_conn.dcname) > 0) {
568 fstrcpy(domain->dcname, state->request->data.init_conn.dcname);
571 if (domain->internal) {
572 domain->initialized = true;
573 } else {
574 init_dc_connection(domain);
577 if (!domain->initialized) {
578 /* If we return error here we can't do any cached authentication,
579 but we may be in disconnected mode and can't initialize correctly.
580 Do what the previous code did and just return without initialization,
581 once we go online we'll re-initialize.
583 DEBUG(5, ("winbindd_dual_init_connection: %s returning without initialization "
584 "online = %d\n", domain->name, (int)domain->online ));
587 fstrcpy(state->response->data.domain_info.name, domain->name);
588 fstrcpy(state->response->data.domain_info.alt_name, domain->alt_name);
589 sid_to_fstring(state->response->data.domain_info.sid, &domain->sid);
591 state->response->data.domain_info.native_mode
592 = domain->native_mode;
593 state->response->data.domain_info.active_directory
594 = domain->active_directory;
595 state->response->data.domain_info.primary
596 = domain->primary;
598 return WINBINDD_OK;
601 /* Look up global info for the winbind daemon */
602 bool init_domain_list(void)
604 struct winbindd_domain *domain;
605 int role = lp_server_role();
607 /* Free existing list */
608 free_domain_list();
610 /* BUILTIN domain */
612 domain = add_trusted_domain("BUILTIN", NULL, &cache_methods,
613 &global_sid_Builtin);
614 if (domain) {
615 setup_domain_child(domain);
618 /* Local SAM */
620 domain = add_trusted_domain(get_global_sam_name(), NULL,
621 &cache_methods, get_global_sam_sid());
622 if (domain) {
623 if ( role != ROLE_DOMAIN_MEMBER ) {
624 domain->primary = True;
626 setup_domain_child(domain);
629 /* Add ourselves as the first entry. */
631 if ( role == ROLE_DOMAIN_MEMBER ) {
632 struct dom_sid our_sid;
634 if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid)) {
635 DEBUG(0, ("Could not fetch our SID - did we join?\n"));
636 return False;
639 domain = add_trusted_domain( lp_workgroup(), lp_realm(),
640 &cache_methods, &our_sid);
641 if (domain) {
642 domain->primary = True;
643 setup_domain_child(domain);
645 /* Even in the parent winbindd we'll need to
646 talk to the DC, so try and see if we can
647 contact it. Theoretically this isn't neccessary
648 as the init_dc_connection() in init_child_recv()
649 will do this, but we can start detecting the DC
650 early here. */
651 set_domain_online_request(domain);
655 return True;
659 * Given a domain name, return the struct winbindd domain info for it
661 * @note Do *not* pass lp_workgroup() to this function. domain_list
662 * may modify it's value, and free that pointer. Instead, our local
663 * domain may be found by calling find_our_domain().
664 * directly.
667 * @return The domain structure for the named domain, if it is working.
670 struct winbindd_domain *find_domain_from_name_noinit(const char *domain_name)
672 struct winbindd_domain *domain;
674 /* Search through list */
676 for (domain = domain_list(); domain != NULL; domain = domain->next) {
677 if (strequal(domain_name, domain->name) ||
678 (domain->alt_name[0] &&
679 strequal(domain_name, domain->alt_name))) {
680 return domain;
684 /* Not found */
686 return NULL;
689 struct winbindd_domain *find_domain_from_name(const char *domain_name)
691 struct winbindd_domain *domain;
693 domain = find_domain_from_name_noinit(domain_name);
695 if (domain == NULL)
696 return NULL;
698 if (!domain->initialized)
699 init_dc_connection(domain);
701 return domain;
704 /* Given a domain sid, return the struct winbindd domain info for it */
706 struct winbindd_domain *find_domain_from_sid_noinit(const struct dom_sid *sid)
708 struct winbindd_domain *domain;
710 /* Search through list */
712 for (domain = domain_list(); domain != NULL; domain = domain->next) {
713 if (dom_sid_compare_domain(sid, &domain->sid) == 0)
714 return domain;
717 /* Not found */
719 return NULL;
722 /* Given a domain sid, return the struct winbindd domain info for it */
724 struct winbindd_domain *find_domain_from_sid(const struct dom_sid *sid)
726 struct winbindd_domain *domain;
728 domain = find_domain_from_sid_noinit(sid);
730 if (domain == NULL)
731 return NULL;
733 if (!domain->initialized)
734 init_dc_connection(domain);
736 return domain;
739 struct winbindd_domain *find_our_domain(void)
741 struct winbindd_domain *domain;
743 /* Search through list */
745 for (domain = domain_list(); domain != NULL; domain = domain->next) {
746 if (domain->primary)
747 return domain;
750 smb_panic("Could not find our domain");
751 return NULL;
754 struct winbindd_domain *find_root_domain(void)
756 struct winbindd_domain *ours = find_our_domain();
758 if (ours->forest_name[0] == '\0') {
759 return NULL;
762 return find_domain_from_name( ours->forest_name );
765 struct winbindd_domain *find_builtin_domain(void)
767 struct winbindd_domain *domain;
769 domain = find_domain_from_sid(&global_sid_Builtin);
770 if (domain == NULL) {
771 smb_panic("Could not find BUILTIN domain");
774 return domain;
777 /* Find the appropriate domain to lookup a name or SID */
779 struct winbindd_domain *find_lookup_domain_from_sid(const struct dom_sid *sid)
781 /* SIDs in the S-1-22-{1,2} domain should be handled by our passdb */
783 if ( sid_check_is_in_unix_groups(sid) ||
784 sid_check_is_unix_groups(sid) ||
785 sid_check_is_in_unix_users(sid) ||
786 sid_check_is_unix_users(sid) )
788 return find_domain_from_sid(get_global_sam_sid());
791 /* A DC can't ask the local smbd for remote SIDs, here winbindd is the
792 * one to contact the external DC's. On member servers the internal
793 * domains are different: These are part of the local SAM. */
795 DEBUG(10, ("find_lookup_domain_from_sid(%s)\n", sid_string_dbg(sid)));
797 if (IS_DC || is_internal_domain(sid) || is_in_internal_domain(sid)) {
798 DEBUG(10, ("calling find_domain_from_sid\n"));
799 return find_domain_from_sid(sid);
802 /* On a member server a query for SID or name can always go to our
803 * primary DC. */
805 DEBUG(10, ("calling find_our_domain\n"));
806 return find_our_domain();
809 struct winbindd_domain *find_lookup_domain_from_name(const char *domain_name)
811 if ( strequal(domain_name, unix_users_domain_name() ) ||
812 strequal(domain_name, unix_groups_domain_name() ) )
815 * The "Unix User" and "Unix Group" domain our handled by
816 * passdb
818 return find_domain_from_name_noinit( get_global_sam_name() );
821 if (IS_DC || strequal(domain_name, "BUILTIN") ||
822 strequal(domain_name, get_global_sam_name()))
823 return find_domain_from_name_noinit(domain_name);
826 return find_our_domain();
829 /* Is this a domain which we may assume no DOMAIN\ prefix? */
831 static bool assume_domain(const char *domain)
833 /* never assume the domain on a standalone server */
835 if ( lp_server_role() == ROLE_STANDALONE )
836 return False;
838 /* domain member servers may possibly assume for the domain name */
840 if ( lp_server_role() == ROLE_DOMAIN_MEMBER ) {
841 if ( !strequal(lp_workgroup(), domain) )
842 return False;
844 if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() )
845 return True;
848 /* only left with a domain controller */
850 if ( strequal(get_global_sam_name(), domain) ) {
851 return True;
854 return False;
857 /* Parse a string of the form DOMAIN\user into a domain and a user */
859 bool parse_domain_user(const char *domuser, fstring domain, fstring user)
861 char *p = strchr(domuser,*lp_winbind_separator());
863 if ( !p ) {
864 fstrcpy(user, domuser);
866 if ( assume_domain(lp_workgroup())) {
867 fstrcpy(domain, lp_workgroup());
868 } else if ((p = strchr(domuser, '@')) != NULL) {
869 fstrcpy(domain, p + 1);
870 user[PTR_DIFF(p, domuser)] = 0;
871 } else {
872 return False;
874 } else {
875 fstrcpy(user, p+1);
876 fstrcpy(domain, domuser);
877 domain[PTR_DIFF(p, domuser)] = 0;
880 strupper_m(domain);
882 return True;
885 bool parse_domain_user_talloc(TALLOC_CTX *mem_ctx, const char *domuser,
886 char **domain, char **user)
888 fstring fstr_domain, fstr_user;
889 if (!parse_domain_user(domuser, fstr_domain, fstr_user)) {
890 return False;
892 *domain = talloc_strdup(mem_ctx, fstr_domain);
893 *user = talloc_strdup(mem_ctx, fstr_user);
894 return ((*domain != NULL) && (*user != NULL));
897 /* Ensure an incoming username from NSS is fully qualified. Replace the
898 incoming fstring with DOMAIN <separator> user. Returns the same
899 values as parse_domain_user() but also replaces the incoming username.
900 Used to ensure all names are fully qualified within winbindd.
901 Used by the NSS protocols of auth, chauthtok, logoff and ccache_ntlm_auth.
902 The protocol definitions of auth_crap, chng_pswd_auth_crap
903 really should be changed to use this instead of doing things
904 by hand. JRA. */
906 bool canonicalize_username(fstring username_inout, fstring domain, fstring user)
908 if (!parse_domain_user(username_inout, domain, user)) {
909 return False;
911 slprintf(username_inout, sizeof(fstring) - 1, "%s%c%s",
912 domain, *lp_winbind_separator(),
913 user);
914 return True;
918 Fill DOMAIN\\USERNAME entry accounting 'winbind use default domain' and
919 'winbind separator' options.
920 This means:
921 - omit DOMAIN when 'winbind use default domain = true' and DOMAIN is
922 lp_workgroup()
924 If we are a PDC or BDC, and this is for our domain, do likewise.
926 Also, if omit DOMAIN if 'winbind trusted domains only = true', as the
927 username is then unqualified in unix
929 We always canonicalize as UPPERCASE DOMAIN, lowercase username.
931 void fill_domain_username(fstring name, const char *domain, const char *user, bool can_assume)
933 fstring tmp_user;
935 fstrcpy(tmp_user, user);
936 strlower_m(tmp_user);
938 if (can_assume && assume_domain(domain)) {
939 strlcpy(name, tmp_user, sizeof(fstring));
940 } else {
941 slprintf(name, sizeof(fstring) - 1, "%s%c%s",
942 domain, *lp_winbind_separator(),
943 tmp_user);
948 * talloc version of fill_domain_username()
949 * return NULL on talloc failure.
951 char *fill_domain_username_talloc(TALLOC_CTX *mem_ctx,
952 const char *domain,
953 const char *user,
954 bool can_assume)
956 char *tmp_user, *name;
958 tmp_user = talloc_strdup(mem_ctx, user);
959 strlower_m(tmp_user);
961 if (can_assume && assume_domain(domain)) {
962 name = tmp_user;
963 } else {
964 name = talloc_asprintf(mem_ctx, "%s%c%s",
965 domain,
966 *lp_winbind_separator(),
967 tmp_user);
968 TALLOC_FREE(tmp_user);
971 return name;
975 * Client list accessor functions
978 static struct winbindd_cli_state *_client_list;
979 static int _num_clients;
981 /* Return list of all connected clients */
983 struct winbindd_cli_state *winbindd_client_list(void)
985 return _client_list;
988 /* Add a connection to the list */
990 void winbindd_add_client(struct winbindd_cli_state *cli)
992 DLIST_ADD(_client_list, cli);
993 _num_clients++;
996 /* Remove a client from the list */
998 void winbindd_remove_client(struct winbindd_cli_state *cli)
1000 DLIST_REMOVE(_client_list, cli);
1001 _num_clients--;
1004 /* Return number of open clients */
1006 int winbindd_num_clients(void)
1008 return _num_clients;
1011 NTSTATUS lookup_usergroups_cached(struct winbindd_domain *domain,
1012 TALLOC_CTX *mem_ctx,
1013 const struct dom_sid *user_sid,
1014 uint32_t *p_num_groups, struct dom_sid **user_sids)
1016 struct netr_SamInfo3 *info3 = NULL;
1017 NTSTATUS status = NT_STATUS_NO_MEMORY;
1018 uint32_t num_groups = 0;
1020 DEBUG(3,(": lookup_usergroups_cached\n"));
1022 *user_sids = NULL;
1023 *p_num_groups = 0;
1025 info3 = netsamlogon_cache_get(mem_ctx, user_sid);
1027 if (info3 == NULL) {
1028 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1031 if (info3->base.groups.count == 0) {
1032 TALLOC_FREE(info3);
1033 return NT_STATUS_UNSUCCESSFUL;
1036 /* Skip Domain local groups outside our domain.
1037 We'll get these from the getsidaliases() RPC call. */
1038 status = sid_array_from_info3(mem_ctx, info3,
1039 user_sids,
1040 &num_groups,
1041 false, true);
1043 if (!NT_STATUS_IS_OK(status)) {
1044 TALLOC_FREE(info3);
1045 return status;
1048 TALLOC_FREE(info3);
1049 *p_num_groups = num_groups;
1050 status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1052 DEBUG(3,(": lookup_usergroups_cached succeeded\n"));
1054 return status;
1057 /*********************************************************************
1058 We use this to remove spaces from user and group names
1059 ********************************************************************/
1061 NTSTATUS normalize_name_map(TALLOC_CTX *mem_ctx,
1062 struct winbindd_domain *domain,
1063 const char *name,
1064 char **normalized)
1066 NTSTATUS nt_status;
1068 if (!name || !normalized) {
1069 return NT_STATUS_INVALID_PARAMETER;
1072 if (!lp_winbind_normalize_names()) {
1073 return NT_STATUS_PROCEDURE_NOT_FOUND;
1076 /* Alias support and whitespace replacement are mutually
1077 exclusive */
1079 nt_status = resolve_username_to_alias(mem_ctx, domain,
1080 name, normalized );
1081 if (NT_STATUS_IS_OK(nt_status)) {
1082 /* special return code to let the caller know we
1083 mapped to an alias */
1084 return NT_STATUS_FILE_RENAMED;
1087 /* check for an unreachable domain */
1089 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1090 DEBUG(5,("normalize_name_map: Setting domain %s offline\n",
1091 domain->name));
1092 set_domain_offline(domain);
1093 return nt_status;
1096 /* deal with whitespace */
1098 *normalized = talloc_strdup(mem_ctx, name);
1099 if (!(*normalized)) {
1100 return NT_STATUS_NO_MEMORY;
1103 all_string_sub( *normalized, " ", "_", 0 );
1105 return NT_STATUS_OK;
1108 /*********************************************************************
1109 We use this to do the inverse of normalize_name_map()
1110 ********************************************************************/
1112 NTSTATUS normalize_name_unmap(TALLOC_CTX *mem_ctx,
1113 char *name,
1114 char **normalized)
1116 NTSTATUS nt_status;
1117 struct winbindd_domain *domain = find_our_domain();
1119 if (!name || !normalized) {
1120 return NT_STATUS_INVALID_PARAMETER;
1123 if (!lp_winbind_normalize_names()) {
1124 return NT_STATUS_PROCEDURE_NOT_FOUND;
1127 /* Alias support and whitespace replacement are mutally
1128 exclusive */
1130 /* When mapping from an alias to a username, we don't know the
1131 domain. But we only need a domain structure to cache
1132 a successful lookup , so just our own domain structure for
1133 the seqnum. */
1135 nt_status = resolve_alias_to_username(mem_ctx, domain,
1136 name, normalized);
1137 if (NT_STATUS_IS_OK(nt_status)) {
1138 /* Special return code to let the caller know we mapped
1139 from an alias */
1140 return NT_STATUS_FILE_RENAMED;
1143 /* check for an unreachable domain */
1145 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1146 DEBUG(5,("normalize_name_unmap: Setting domain %s offline\n",
1147 domain->name));
1148 set_domain_offline(domain);
1149 return nt_status;
1152 /* deal with whitespace */
1154 *normalized = talloc_strdup(mem_ctx, name);
1155 if (!(*normalized)) {
1156 return NT_STATUS_NO_MEMORY;
1159 all_string_sub(*normalized, "_", " ", 0);
1161 return NT_STATUS_OK;
1164 /*********************************************************************
1165 ********************************************************************/
1167 bool winbindd_can_contact_domain(struct winbindd_domain *domain)
1169 struct winbindd_tdc_domain *tdc = NULL;
1170 TALLOC_CTX *frame = talloc_stackframe();
1171 bool ret = false;
1173 /* We can contact the domain if it is our primary domain */
1175 if (domain->primary) {
1176 return true;
1179 /* Trust the TDC cache and not the winbindd_domain flags */
1181 if ((tdc = wcache_tdc_fetch_domain(frame, domain->name)) == NULL) {
1182 DEBUG(10,("winbindd_can_contact_domain: %s not found in cache\n",
1183 domain->name));
1184 return false;
1187 /* Can always contact a domain that is in out forest */
1189 if (tdc->trust_flags & NETR_TRUST_FLAG_IN_FOREST) {
1190 ret = true;
1191 goto done;
1195 * On a _member_ server, we cannot contact the domain if it
1196 * is running AD and we have no inbound trust.
1199 if (!IS_DC &&
1200 domain->active_directory &&
1201 ((tdc->trust_flags & NETR_TRUST_FLAG_INBOUND) != NETR_TRUST_FLAG_INBOUND))
1203 DEBUG(10, ("winbindd_can_contact_domain: %s is an AD domain "
1204 "and we have no inbound trust.\n", domain->name));
1205 goto done;
1208 /* Assume everything else is ok (probably not true but what
1209 can you do?) */
1211 ret = true;
1213 done:
1214 talloc_destroy(frame);
1216 return ret;
1219 /*********************************************************************
1220 ********************************************************************/
1222 bool winbindd_internal_child(struct winbindd_child *child)
1224 if ((child == idmap_child()) || (child == locator_child())) {
1225 return True;
1228 return False;
1231 #ifdef HAVE_KRB5_LOCATE_PLUGIN_H
1233 /*********************************************************************
1234 ********************************************************************/
1236 static void winbindd_set_locator_kdc_env(const struct winbindd_domain *domain)
1238 char *var = NULL;
1239 char addr[INET6_ADDRSTRLEN];
1240 const char *kdc = NULL;
1241 int lvl = 11;
1243 if (!domain || !domain->alt_name || !*domain->alt_name) {
1244 return;
1247 if (domain->initialized && !domain->active_directory) {
1248 DEBUG(lvl,("winbindd_set_locator_kdc_env: %s not AD\n",
1249 domain->alt_name));
1250 return;
1253 print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
1254 kdc = addr;
1255 if (!*kdc) {
1256 DEBUG(lvl,("winbindd_set_locator_kdc_env: %s no DC IP\n",
1257 domain->alt_name));
1258 kdc = domain->dcname;
1261 if (!kdc || !*kdc) {
1262 DEBUG(lvl,("winbindd_set_locator_kdc_env: %s no DC at all\n",
1263 domain->alt_name));
1264 return;
1267 if (asprintf_strupper_m(&var, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS,
1268 domain->alt_name) == -1) {
1269 return;
1272 DEBUG(lvl,("winbindd_set_locator_kdc_env: setting var: %s to: %s\n",
1273 var, kdc));
1275 setenv(var, kdc, 1);
1276 free(var);
1279 /*********************************************************************
1280 ********************************************************************/
1282 void winbindd_set_locator_kdc_envs(const struct winbindd_domain *domain)
1284 struct winbindd_domain *our_dom = find_our_domain();
1286 winbindd_set_locator_kdc_env(domain);
1288 if (domain != our_dom) {
1289 winbindd_set_locator_kdc_env(our_dom);
1293 /*********************************************************************
1294 ********************************************************************/
1296 void winbindd_unset_locator_kdc_env(const struct winbindd_domain *domain)
1298 char *var = NULL;
1300 if (!domain || !domain->alt_name || !*domain->alt_name) {
1301 return;
1304 if (asprintf_strupper_m(&var, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS,
1305 domain->alt_name) == -1) {
1306 return;
1309 unsetenv(var);
1310 free(var);
1312 #else
1314 void winbindd_set_locator_kdc_envs(const struct winbindd_domain *domain)
1316 return;
1319 void winbindd_unset_locator_kdc_env(const struct winbindd_domain *domain)
1321 return;
1324 #endif /* HAVE_KRB5_LOCATE_PLUGIN_H */
1326 void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
1328 resp->data.auth.nt_status = NT_STATUS_V(result);
1329 fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
1331 /* we might have given a more useful error above */
1332 if (*resp->data.auth.error_string == '\0')
1333 fstrcpy(resp->data.auth.error_string,
1334 get_friendly_nt_error_msg(result));
1335 resp->data.auth.pam_error = nt_status_to_pam(result);
1338 bool is_domain_offline(const struct winbindd_domain *domain)
1340 if (!lp_winbind_offline_logon()) {
1341 return false;
1343 if (get_global_winbindd_state_offline()) {
1344 return true;
1346 return !domain->online;
1349 bool is_domain_online(const struct winbindd_domain *domain)
1351 return !is_domain_offline(domain);
1354 bool parse_sidlist(TALLOC_CTX *mem_ctx, const char *sidstr,
1355 struct dom_sid **sids, uint32_t *num_sids)
1357 const char *p;
1359 p = sidstr;
1360 if (p == NULL)
1361 return False;
1363 while (p[0] != '\0') {
1364 struct dom_sid sid;
1365 const char *q = NULL;
1367 if (!dom_sid_parse_endp(p, &sid, &q)) {
1368 DEBUG(1, ("Could not parse sid %s\n", p));
1369 return false;
1371 if ((q == NULL) || (q[0] != '\n')) {
1372 DEBUG(1, ("Got invalid sidstr: %s\n", p));
1373 return false;
1375 if (!NT_STATUS_IS_OK(add_sid_to_array(mem_ctx, &sid, sids,
1376 num_sids)))
1378 return False;
1380 p = q+1;
1382 return True;