/*
- Unix SMB/Netbios implementation.
+ Unix SMB/CIFS implementation.
Winbind rpc backend functions
#include "winbindd.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_WINBIND
+
/* Query display info for a domain. This returns enough information plus a
bit extra to give an overview of domain users for the User Manager
application. */
static NTSTATUS query_user_list(struct winbindd_domain *domain,
TALLOC_CTX *mem_ctx,
- uint32 *start_ndx, uint32 *num_entries,
+ uint32 *num_entries,
WINBIND_USERINFO **info)
{
CLI_POLICY_HND *hnd;
POLICY_HND dom_pol;
BOOL got_dom_pol = False;
uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
- SAM_DISPINFO_CTR ctr;
- SAM_DISPINFO_1 info1;
int i;
+ DEBUG(3,("rpc: query_user_list\n"));
+
+ *num_entries = 0;
+ *info = NULL;
+
/* Get sam handle */
if (!(hnd = cm_get_sam_handle(domain->name)))
got_dom_pol = True;
- ctr.sam.info1 = &info1;
-
- /* Query display info level 1 */
- result = cli_samr_query_dispinfo(hnd->cli, mem_ctx,
- &dom_pol, start_ndx, 1,
- num_entries, 0xffff, &ctr);
-
- /* now map the result into the WINBIND_USERINFO structure */
- (*info) = (WINBIND_USERINFO *)talloc(mem_ctx, (*num_entries)*sizeof(WINBIND_USERINFO));
- if (!(*info)) {
- return NT_STATUS_NO_MEMORY;
- }
-
- for (i=0;i<*num_entries;i++) {
- (*info)[i].acct_name = unistr2_tdup(mem_ctx, &info1.str[i].uni_acct_name);
- (*info)[i].full_name = unistr2_tdup(mem_ctx, &info1.str[i].uni_full_name);
- (*info)[i].user_rid = info1.sam[i].rid_user;
- /* For the moment we set the primary group for every user to be the
- Domain Users group. There are serious problems with determining
- the actual primary group for large domains. This should really
- be made into a 'winbind force group' smb.conf parameter or
- something like that. */
- (*info)[i].group_rid = DOMAIN_GROUP_RID_USERS;
- }
+ i = 0;
+ do {
+ SAM_DISPINFO_CTR ctr;
+ SAM_DISPINFO_1 info1;
+ uint32 count = 0, start=i;
+ int j;
+ TALLOC_CTX *ctx2;
+
+ ctr.sam.info1 = &info1;
+
+ ctx2 = talloc_init_named("winbindd dispinfo");
+ if (!ctx2) {
+ result = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ /* Query display info level 1 */
+ result = cli_samr_query_dispinfo(hnd->cli, ctx2,
+ &dom_pol, &start, 1,
+ &count, 0xFFFF, &ctr);
+
+ if (!NT_STATUS_IS_OK(result) &&
+ !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) break;
+
+ (*num_entries) += count;
+
+ /* now map the result into the WINBIND_USERINFO structure */
+ (*info) = talloc_realloc(mem_ctx, *info,
+ (*num_entries)*sizeof(WINBIND_USERINFO));
+ if (!(*info)) {
+ result = NT_STATUS_NO_MEMORY;
+ talloc_destroy(ctx2);
+ goto done;
+ }
+
+ for (j=0;j<count;i++, j++) {
+ (*info)[i].acct_name = unistr2_tdup(mem_ctx, &info1.str[j].uni_acct_name);
+ (*info)[i].full_name = unistr2_tdup(mem_ctx, &info1.str[j].uni_full_name);
+ (*info)[i].user_rid = info1.sam[j].rid_user;
+ /* For the moment we set the primary group for
+ every user to be the Domain Users group.
+ There are serious problems with determining
+ the actual primary group for large domains.
+ This should really be made into a 'winbind
+ force group' smb.conf parameter or
+ something like that. */
+ (*info)[i].group_rid = DOMAIN_GROUP_RID_USERS;
+ }
+
+ talloc_destroy(ctx2);
+ } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
done:
/* list all domain groups */
static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
TALLOC_CTX *mem_ctx,
- uint32 *start_ndx, uint32 *num_entries,
+ uint32 *num_entries,
struct acct_info **info)
{
uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
NTSTATUS status;
*num_entries = 0;
+ *info = NULL;
+
+ DEBUG(3,("rpc: enum_dom_groups\n"));
if (!(hnd = cm_get_sam_handle(domain->name))) {
return NT_STATUS_UNSUCCESSFUL;
return status;
}
- status = cli_samr_enum_dom_groups(hnd->cli, mem_ctx, &dom_pol,
- start_ndx,
- 0x8000, /* buffer size? */
- info, num_entries);
+ do {
+ struct acct_info *info2 = NULL;
+ uint32 count = 0, start = *num_entries;
+ TALLOC_CTX *mem_ctx2;
+
+ mem_ctx2 = talloc_init_named("enum_dom_groups[rpc]");
+
+ status = cli_samr_enum_dom_groups(hnd->cli, mem_ctx2, &dom_pol,
+ &start,
+ 0xFFFF, /* buffer size? */
+ &info2, &count);
+
+ if (!NT_STATUS_IS_OK(status) &&
+ !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
+ talloc_destroy(mem_ctx2);
+ break;
+ }
+
+ (*info) = talloc_realloc(mem_ctx, *info,
+ sizeof(**info) * ((*num_entries) + count));
+ if (! *info) {
+ talloc_destroy(mem_ctx2);
+ cli_samr_close(hnd->cli, mem_ctx, &dom_pol);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ memcpy(&(*info)[*num_entries], info2, count*sizeof(*info2));
+ (*num_entries) += count;
+ talloc_destroy(mem_ctx2);
+ } while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
cli_samr_close(hnd->cli, mem_ctx, &dom_pol);
NTSTATUS status;
DOM_SID *sids = NULL;
uint32 *types = NULL;
- int num_sids;
+ const char *full_name;
+
+ DEBUG(3,("rpc: name_to_sid name=%s\n", name));
- if (!(mem_ctx = talloc_init()))
+ if (!(mem_ctx = talloc_init_named("name_to_sid[rpc] for [%s]\\[%s]", domain->name, name))) {
+ DEBUG(0, ("talloc_init failed!\n"));
return NT_STATUS_NO_MEMORY;
+ }
- if (!(hnd = cm_get_lsa_handle(domain->name)))
+ if (!(hnd = cm_get_lsa_handle(domain->name))) {
+ talloc_destroy(mem_ctx);
return NT_STATUS_UNSUCCESSFUL;
+ }
- status = cli_lsa_lookup_names(hnd->cli, mem_ctx, &hnd->pol, 1, &name,
- &sids, &types, &num_sids);
+ full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain->name, name);
+
+ if (!full_name) {
+ DEBUG(0, ("talloc_asprintf failed!\n"));
+ talloc_destroy(mem_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ status = cli_lsa_lookup_names(hnd->cli, mem_ctx, &hnd->pol, 1,
+ &full_name, &sids, &types);
- /* Return rid and type if lookup successful */
+ /* Return rid and type if lookup successful */
+
if (NT_STATUS_IS_OK(status)) {
sid_copy(sid, &sids[0]);
*type = types[0];
enum SID_NAME_USE *type)
{
CLI_POLICY_HND *hnd;
+ char **domains;
char **names;
uint32 *types;
- int num_names;
NTSTATUS status;
+ DEBUG(3,("rpc: sid_to_name\n"));
+
if (!(hnd = cm_get_lsa_handle(domain->name)))
return NT_STATUS_UNSUCCESSFUL;
status = cli_lsa_lookup_sids(hnd->cli, mem_ctx, &hnd->pol,
- 1, sid, &names, &types,
- &num_names);
+ 1, sid, &domains, &names, &types);
if (NT_STATUS_IS_OK(status)) {
*type = types[0];
*name = names[0];
- DEBUG(5,("Mapped sid to %s\n", *name));
- }
+ DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
+ /* Paranoia */
+ if (strcasecmp(domain->name, domains[0]) != 0) {
+ DEBUG(1, ("domain name from domain param and PDC lookup return differ! (%s vs %s)\n", domain->name, domains[0]));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+ }
return status;
}
BOOL got_dom_pol = False, got_user_pol = False;
SAM_USERINFO_CTR *ctr;
+ DEBUG(3,("rpc: query_user rid=%u\n", user_rid));
+
/* Get sam handle */
if (!(hnd = cm_get_sam_handle(domain->name)))
goto done;
if (!NT_STATUS_IS_OK(result))
goto done;
+ got_user_pol = True;
+
/* Get user info */
result = cli_samr_query_userinfo(hnd->cli, mem_ctx, &user_pol,
0x15, &ctr);
+ if (!NT_STATUS_IS_OK(result))
+ goto done;
+
cli_samr_close(hnd->cli, mem_ctx, &user_pol);
+ got_user_pol = False;
+ user_info->user_rid = user_rid;
user_info->group_rid = ctr->info.id21->group_rid;
user_info->acct_name = unistr2_tdup(mem_ctx,
&ctr->info.id21->uni_user_name);
DOM_GID *user_groups;
int i;
+ DEBUG(3,("rpc: lookup_usergroups rid=%u\n", user_rid));
+
+ *num_groups = 0;
+
+ /* First try cached universal groups from logon */
+ *user_gids = uni_group_cache_fetch(&domain->sid, user_rid, mem_ctx, num_groups);
+ if((*num_groups > 0) && *user_gids) {
+ return NT_STATUS_OK;
+ } else {
+ *user_gids = NULL;
+ *num_groups = 0;
+ }
+
/* Get sam handle */
if (!(hnd = cm_get_sam_handle(domain->name)))
goto done;
uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
BOOL got_dom_pol = False, got_group_pol = False;
+ DEBUG(10,("rpc: lookup_groupmem %s rid=%u\n", domain->name, group_rid));
+
+ *num_names = 0;
+
/* Get sam handle */
if (!(hnd = cm_get_sam_handle(domain->name)))
#define MAX_LOOKUP_RIDS 900
- *names = talloc(mem_ctx, *num_names * sizeof(char *));
- *name_types = talloc(mem_ctx, *num_names * sizeof(uint32));
+ *names = talloc_zero(mem_ctx, *num_names * sizeof(char *));
+ *name_types = talloc_zero(mem_ctx, *num_names * sizeof(uint32));
for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
}
/* find the sequence number for a domain */
-static uint32 sequence_number(struct winbindd_domain *domain)
+static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
{
TALLOC_CTX *mem_ctx;
CLI_POLICY_HND *hnd;
BOOL got_dom_pol = False;
uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
- if (!(mem_ctx = talloc_init()))
- return DOM_SEQUENCE_NONE;
+ DEBUG(10,("rpc: fetch sequence_number for %s\n", domain->name));
+
+ *seq = DOM_SEQUENCE_NONE;
+
+ if (!(mem_ctx = talloc_init_named("sequence_number[rpc]")))
+ return NT_STATUS_NO_MEMORY;
/* Get sam handle */
/* Get domain handle */
result = cli_samr_open_domain(hnd->cli, mem_ctx, &hnd->pol,
- des_access, &domain->sid, &dom_pol);
+ des_access, &domain->sid, &dom_pol);
if (!NT_STATUS_IS_OK(result))
goto done;
/* Query domain info */
result = cli_samr_query_dom_info(hnd->cli, mem_ctx, &dom_pol,
- switch_value, &ctr);
+ switch_value, &ctr);
if (NT_STATUS_IS_OK(result)) {
seqnum = ctr.info.inf2.seq_num;
talloc_destroy(mem_ctx);
- return seqnum;
+ *seq = seqnum;
+
+ return result;
+}
+
+/* get a list of trusted domains */
+static NTSTATUS trusted_domains(struct winbindd_domain *domain,
+ TALLOC_CTX *mem_ctx,
+ uint32 *num_domains,
+ char ***names,
+ char ***alt_names,
+ DOM_SID **dom_sids)
+{
+ CLI_POLICY_HND *hnd;
+ NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+ uint32 enum_ctx = 0;
+
+ DEBUG(3,("rpc: trusted_domains\n"));
+
+ *num_domains = 0;
+ *alt_names = NULL;
+
+ if (!(hnd = cm_get_lsa_handle(lp_workgroup())))
+ goto done;
+
+ result = cli_lsa_enum_trust_dom(hnd->cli, mem_ctx,
+ &hnd->pol, &enum_ctx,
+ num_domains, names, dom_sids);
+done:
+ return result;
+}
+
+/* find the domain sid for a domain */
+static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid)
+{
+ NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+ TALLOC_CTX *mem_ctx;
+ CLI_POLICY_HND *hnd;
+ fstring level5_dom;
+
+ DEBUG(3,("rpc: domain_sid\n"));
+
+ if (!(mem_ctx = talloc_init_named("domain_sid[rpc]")))
+ return NT_STATUS_NO_MEMORY;
+
+ /* Get sam handle */
+ if (!(hnd = cm_get_lsa_handle(domain->name)))
+ goto done;
+
+ status = cli_lsa_query_info_policy(hnd->cli, mem_ctx,
+ &hnd->pol, 0x05, level5_dom, sid);
+
+done:
+ talloc_destroy(mem_ctx);
+ return status;
+}
+
+/* find alternate names list for the domain - none for rpc */
+static NTSTATUS alternate_name(struct winbindd_domain *domain)
+{
+ return NT_STATUS_OK;
}
/* the rpc backend methods are exposed via this structure */
struct winbindd_methods msrpc_methods = {
+ False,
query_user_list,
enum_dom_groups,
name_to_sid,
query_user,
lookup_usergroups,
lookup_groupmem,
- sequence_number
+ sequence_number,
+ trusted_domains,
+ domain_sid,
+ alternate_name
};
-
git.samba.org / abartlet / samba.git / .git / blobdiff