#include "includes.h"
#include "winbindd.h"
+#include "secrets.h"
+#include "../libcli/security/security.h"
+#include "../libcli/auth/pam_errors.h"
+#include "passdb/machine_sid.h"
+#include "passdb.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_WINBIND
extern struct winbindd_methods cache_methods;
-extern struct winbindd_methods builtin_passdb_methods;
-extern struct winbindd_methods sam_passdb_methods;
-
/**
- * @file winbindd_util.c
+ * @file winbindd_util.cq
*
* Winbind daemon for NT domain authentication nss module.
**/
static struct winbindd_domain *_domain_list = NULL;
-/**
- When was the last scan of trusted domains done?
-
- 0 == not ever
-*/
-
-static time_t last_trustdom_scan;
-
struct winbindd_domain *domain_list(void)
{
/* Initialise list */
/* Free all entries in the trusted domain list */
-void free_domain_list(void)
+static void free_domain_list(void)
{
struct winbindd_domain *domain = _domain_list;
struct winbindd_domain *next = domain->next;
DLIST_REMOVE(_domain_list, domain);
- SAFE_FREE(domain);
+ TALLOC_FREE(domain);
domain = next;
}
}
-static bool is_internal_domain(const DOM_SID *sid)
+static bool is_internal_domain(const struct dom_sid *sid)
{
if (sid == NULL)
return False;
- if ( IS_DC )
- return sid_check_is_builtin(sid);
-
- return (sid_check_is_domain(sid) || sid_check_is_builtin(sid));
+ return (sid_check_is_our_sam(sid) || sid_check_is_builtin(sid));
}
-static bool is_in_internal_domain(const DOM_SID *sid)
+static bool is_in_internal_domain(const struct dom_sid *sid)
{
if (sid == NULL)
return False;
- if ( IS_DC )
- return sid_check_is_in_builtin(sid);
-
- return (sid_check_is_in_our_domain(sid) || sid_check_is_in_builtin(sid));
+ return (sid_check_is_in_our_sam(sid) || sid_check_is_in_builtin(sid));
}
-/* Add a trusted domain to our list of domains */
+/* Add a trusted domain to our list of domains.
+ If the domain already exists in the list,
+ return it and don't re-initialize. */
+
static struct winbindd_domain *add_trusted_domain(const char *domain_name, const char *alt_name,
struct winbindd_methods *methods,
- const DOM_SID *sid)
+ const struct dom_sid *sid)
{
struct winbindd_domain *domain;
const char *alternative_name = NULL;
char *idmap_config_option;
const char *param;
const char **ignored_domains, **dom;
+ int role = lp_server_role();
ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL);
for (dom=ignored_domains; dom && *dom; dom++) {
}
}
- /* ignore alt_name if we are not in an AD domain */
+ /* use alt_name if available to allow DNS lookups */
- if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
+ if (alt_name && *alt_name) {
alternative_name = alt_name;
}
continue;
}
- if (sid_equal(sid, &domain->sid)) {
+ if (dom_sid_equal(sid, &domain->sid)) {
break;
}
}
}
- /* See if we found a match. Check if we need to update the
- SID. */
-
- if ( domain && sid) {
- if ( sid_equal( &domain->sid, &global_sid_NULL ) )
+ if (domain != NULL) {
+ /*
+ * We found a match on domain->name or
+ * domain->alt_name. Possibly update the SID
+ * if the stored SID was the NULL SID
+ * and return the matching entry.
+ */
+ if ((sid != NULL)
+ && dom_sid_equal(&domain->sid, &global_sid_NULL)) {
sid_copy( &domain->sid, sid );
-
+ }
return domain;
}
/* Create new domain entry */
-
- if ((domain = SMB_MALLOC_P(struct winbindd_domain)) == NULL)
+ domain = talloc_zero(NULL, struct winbindd_domain);
+ if (domain == NULL) {
return NULL;
+ }
- /* Fill in fields */
+ domain->children = talloc_zero_array(domain,
+ struct winbindd_child,
+ lp_winbind_max_domain_connections());
+ if (domain->children == NULL) {
+ TALLOC_FREE(domain);
+ return NULL;
+ }
- ZERO_STRUCTP(domain);
+ domain->name = talloc_strdup(domain, domain_name);
+ if (domain->name == NULL) {
+ TALLOC_FREE(domain);
+ return NULL;
+ }
- fstrcpy(domain->name, domain_name);
if (alternative_name) {
- fstrcpy(domain->alt_name, alternative_name);
+ domain->alt_name = talloc_strdup(domain, alternative_name);
+ if (domain->alt_name == NULL) {
+ TALLOC_FREE(domain);
+ return NULL;
+ }
}
domain->methods = methods;
sid_copy(&domain->sid, sid);
}
+ /* Is this our primary domain ? */
+ if (strequal(domain_name, get_global_sam_name()) &&
+ (role != ROLE_DOMAIN_MEMBER)) {
+ domain->primary = true;
+ } else if (strequal(domain_name, lp_workgroup()) &&
+ (role == ROLE_DOMAIN_MEMBER)) {
+ domain->primary = true;
+ }
+
/* Link to domain list */
DLIST_ADD_END(_domain_list, domain, struct winbindd_domain *);
done:
+ setup_domain_child(domain);
+
DEBUG(2,("Added domain %s %s %s\n",
domain->name, domain->alt_name,
&domain->sid?sid_string_dbg(&domain->sid):""));
return domain;
}
+bool domain_is_forest_root(const struct winbindd_domain *domain)
+{
+ const uint32_t fr_flags =
+ (NETR_TRUST_FLAG_TREEROOT|NETR_TRUST_FLAG_IN_FOREST);
+
+ return ((domain->domain_flags & fr_flags) == fr_flags);
+}
+
/********************************************************************
rescan our domains looking for new trusted domains
********************************************************************/
struct trustdom_state {
- TALLOC_CTX *mem_ctx;
- bool primary;
- bool forest_root;
- struct winbindd_response *response;
+ struct winbindd_domain *domain;
+ struct winbindd_request request;
};
-static void trustdom_recv(void *private_data, bool success);
+static void trustdom_list_done(struct tevent_req *req);
static void rescan_forest_root_trusts( void );
static void rescan_forest_trusts( void );
static void add_trusted_domains( struct winbindd_domain *domain )
{
- TALLOC_CTX *mem_ctx;
- struct winbindd_request *request;
- struct winbindd_response *response;
- uint32 fr_flags = (NETR_TRUST_FLAG_TREEROOT|NETR_TRUST_FLAG_IN_FOREST);
-
struct trustdom_state *state;
+ struct tevent_req *req;
- mem_ctx = talloc_init("add_trusted_domains");
- if (mem_ctx == NULL) {
- DEBUG(0, ("talloc_init failed\n"));
+ state = talloc_zero(NULL, struct trustdom_state);
+ if (state == NULL) {
+ DEBUG(0, ("talloc failed\n"));
return;
}
+ state->domain = domain;
- request = TALLOC_ZERO_P(mem_ctx, struct winbindd_request);
- response = TALLOC_P(mem_ctx, struct winbindd_response);
- state = TALLOC_P(mem_ctx, struct trustdom_state);
+ state->request.length = sizeof(state->request);
+ state->request.cmd = WINBINDD_LIST_TRUSTDOM;
- if ((request == NULL) || (response == NULL) || (state == NULL)) {
- DEBUG(0, ("talloc failed\n"));
- talloc_destroy(mem_ctx);
+ req = wb_domain_request_send(state, winbind_event_context(),
+ domain, &state->request);
+ if (req == NULL) {
+ DEBUG(1, ("wb_domain_request_send failed\n"));
+ TALLOC_FREE(state);
return;
}
-
- state->mem_ctx = mem_ctx;
- state->response = response;
-
- /* Flags used to know how to continue the forest trust search */
-
- state->primary = domain->primary;
- state->forest_root = ((domain->domain_flags & fr_flags) == fr_flags );
-
- request->length = sizeof(*request);
- request->cmd = WINBINDD_LIST_TRUSTDOM;
-
- async_domain_request(mem_ctx, domain, request, response,
- trustdom_recv, state);
+ tevent_req_set_callback(req, trustdom_list_done, state);
}
-static void trustdom_recv(void *private_data, bool success)
+static void trustdom_list_done(struct tevent_req *req)
{
- struct trustdom_state *state =
- talloc_get_type_abort(private_data, struct trustdom_state);
- struct winbindd_response *response = state->response;
+ struct trustdom_state *state = tevent_req_callback_data(
+ req, struct trustdom_state);
+ struct winbindd_response *response;
+ int res, err;
char *p;
- if ((!success) || (response->result != WINBINDD_OK)) {
+ res = wb_domain_request_recv(req, state, &response, &err);
+ if ((res == -1) || (response->result != WINBINDD_OK)) {
DEBUG(1, ("Could not receive trustdoms\n"));
- talloc_destroy(state->mem_ctx);
+ TALLOC_FREE(state);
return;
}
while ((p != NULL) && (*p != '\0')) {
char *q, *sidstr, *alt_name;
- DOM_SID sid;
- struct winbindd_domain *domain;
+ struct dom_sid sid;
char *alternate_name = NULL;
alt_name = strchr(p, '\\');
*q = '\0';
if (!string_to_sid(&sid, sidstr)) {
- /* Allow NULL sid for sibling domains */
- if ( strcmp(sidstr,"S-0-0") == 0) {
- sid_copy( &sid, &global_sid_NULL);
- } else {
- DEBUG(0, ("Got invalid trustdom response\n"));
- break;
- }
+ DEBUG(0, ("Got invalid trustdom response\n"));
+ break;
}
/* use the real alt_name if we have one, else pass in NULL */
if ( !strequal( alt_name, "(null)" ) )
alternate_name = alt_name;
- /* If we have an existing domain structure, calling
- add_trusted_domain() will update the SID if
- necessary. This is important because we need the
- SID for sibling domains */
+ /*
+ * We always call add_trusted_domain() cause on an existing
+ * domain structure, it will update the SID if necessary.
+ * This is important because we need the SID for sibling
+ * domains.
+ */
+ (void)add_trusted_domain(p, alternate_name,
+ &cache_methods,
+ &sid);
- if ( find_domain_from_name_noinit(p) != NULL ) {
- domain = add_trusted_domain(p, alternate_name,
- &cache_methods,
- &sid);
- } else {
- domain = add_trusted_domain(p, alternate_name,
- &cache_methods,
- &sid);
- if (domain) {
- setup_domain_child(domain,
- &domain->child);
- }
- }
p=q;
if (p != NULL)
p += 1;
}
- SAFE_FREE(response->extra_data.data);
-
/*
Cases to consider when scanning trusts:
(a) we are calling from a child domain (primary && !forest_root)
&& !forest_root)
*/
- if ( state->primary ) {
+ if (state->domain->primary) {
/* If this is our primary domain and we are not in the
forest root, we have to scan the root trusts first */
- if ( !state->forest_root )
+ if (!domain_is_forest_root(state->domain))
rescan_forest_root_trusts();
else
rescan_forest_trusts();
- } else if ( state->forest_root ) {
+ } else if (domain_is_forest_root(state->domain)) {
/* Once we have done root forest trust search, we can
go on to search the trusted forests */
rescan_forest_trusts();
}
- talloc_destroy(state->mem_ctx);
+ TALLOC_FREE(state);
return;
}
continue;
if ( (flags & NETR_TRUST_FLAG_INBOUND) &&
- (type == NETR_TRUST_TYPE_UPLEVEL) &&
- (attribs == NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) )
+ (type == LSA_TRUST_TYPE_UPLEVEL) &&
+ (attribs == LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) )
{
/* add the trusted domain if we don't know
about it */
(c) ask the a DC in any Win2003 trusted forests
*********************************************************************/
-void rescan_trusted_domains( void )
+void rescan_trusted_domains(struct tevent_context *ev, struct tevent_timer *te,
+ struct timeval now, void *private_data)
{
- time_t now = time(NULL);
-
- /* Check that we allow trusted domains at all */
- if (!lp_allow_trusted_domains())
- return;
-
- /* see if the time has come... */
-
- if ((now >= last_trustdom_scan) &&
- ((now-last_trustdom_scan) < WINBINDD_RESCAN_FREQ) )
- return;
+ TALLOC_FREE(te);
/* I use to clear the cache here and start over but that
caused problems in child processes that needed the
add_trusted_domains( find_our_domain() );
- last_trustdom_scan = now;
+ te = tevent_add_timer(
+ ev, NULL, timeval_current_ofs(WINBINDD_RESCAN_FREQ, 0),
+ rescan_trusted_domains, NULL);
+ /*
+ * If te == NULL, there's not much we can do here. Don't fail, the
+ * only thing we miss is new trusted domains.
+ */
return;
}
-struct init_child_state {
- TALLOC_CTX *mem_ctx;
- struct winbindd_domain *domain;
- struct winbindd_request *request;
- struct winbindd_response *response;
- void (*continuation)(void *private_data, bool success);
- void *private_data;
-};
-
-static void init_child_recv(void *private_data, bool success);
-static void init_child_getdc_recv(void *private_data, bool success);
-
-enum winbindd_result init_child_connection(struct winbindd_domain *domain,
- void (*continuation)(void *private_data,
- bool success),
- void *private_data)
-{
- TALLOC_CTX *mem_ctx;
- struct winbindd_request *request;
- struct winbindd_response *response;
- struct init_child_state *state;
- struct winbindd_domain *request_domain;
-
- mem_ctx = talloc_init("init_child_connection");
- if (mem_ctx == NULL) {
- DEBUG(0, ("talloc_init failed\n"));
- return WINBINDD_ERROR;
- }
-
- request = TALLOC_ZERO_P(mem_ctx, struct winbindd_request);
- response = TALLOC_P(mem_ctx, struct winbindd_response);
- state = TALLOC_P(mem_ctx, struct init_child_state);
-
- if ((request == NULL) || (response == NULL) || (state == NULL)) {
- DEBUG(0, ("talloc failed\n"));
- TALLOC_FREE(mem_ctx);
- continuation(private_data, False);
- return WINBINDD_ERROR;
- }
-
- request->length = sizeof(*request);
-
- state->mem_ctx = mem_ctx;
- state->domain = domain;
- state->request = request;
- state->response = response;
- state->continuation = continuation;
- state->private_data = private_data;
-
- if (IS_DC || domain->primary || domain->internal ) {
- /* The primary domain has to find the DC name itself */
- request->cmd = WINBINDD_INIT_CONNECTION;
- fstrcpy(request->domain_name, domain->name);
- request->data.init_conn.is_primary = domain->primary ? true : false;
- fstrcpy(request->data.init_conn.dcname, "");
- async_request(mem_ctx, &domain->child, request, response,
- init_child_recv, state);
- return WINBINDD_PENDING;
- }
-
- /* This is *not* the primary domain, let's ask our DC about a DC
- * name */
-
- request->cmd = WINBINDD_GETDCNAME;
- fstrcpy(request->domain_name, domain->name);
-
- request_domain = find_our_domain();
- async_domain_request(mem_ctx, request_domain, request, response,
- init_child_getdc_recv, state);
- return WINBINDD_PENDING;
-}
-
-static void init_child_getdc_recv(void *private_data, bool success)
-{
- struct init_child_state *state =
- talloc_get_type_abort(private_data, struct init_child_state);
- const char *dcname = "";
-
- DEBUG(10, ("Received getdcname response\n"));
-
- if (success && (state->response->result == WINBINDD_OK)) {
- dcname = state->response->data.dc_name;
- }
-
- state->request->cmd = WINBINDD_INIT_CONNECTION;
- fstrcpy(state->request->domain_name, state->domain->name);
- state->request->data.init_conn.is_primary = False;
- fstrcpy(state->request->data.init_conn.dcname, dcname);
-
- async_request(state->mem_ctx, &state->domain->child,
- state->request, state->response,
- init_child_recv, state);
-}
-
-static void init_child_recv(void *private_data, bool success)
-{
- struct init_child_state *state =
- talloc_get_type_abort(private_data, struct init_child_state);
-
- DEBUG(5, ("Received child initialization response for domain %s\n",
- state->domain->name));
-
- if ((!success) || (state->response->result != WINBINDD_OK)) {
- DEBUG(3, ("Could not init child\n"));
- state->continuation(state->private_data, False);
- talloc_destroy(state->mem_ctx);
- return;
- }
-
- fstrcpy(state->domain->name,
- state->response->data.domain_info.name);
- fstrcpy(state->domain->alt_name,
- state->response->data.domain_info.alt_name);
- if (!string_to_sid(&state->domain->sid,
- state->response->data.domain_info.sid)) {
- DEBUG(1,("init_child_recv: Could not convert sid %s "
- "from string\n",
- state->response->data.domain_info.sid));
- state->continuation(state->private_data, False);
- talloc_destroy(state->mem_ctx);
- return;
- }
-
- state->domain->native_mode =
- state->response->data.domain_info.native_mode;
- state->domain->active_directory =
- state->response->data.domain_info.active_directory;
-
- init_dc_connection(state->domain);
-
- if (state->continuation != NULL)
- state->continuation(state->private_data, True);
- talloc_destroy(state->mem_ctx);
-}
-
enum winbindd_result winbindd_dual_init_connection(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
{
/* Ensure null termination */
- state->request.domain_name
- [sizeof(state->request.domain_name)-1]='\0';
- state->request.data.init_conn.dcname
- [sizeof(state->request.data.init_conn.dcname)-1]='\0';
+ state->request->domain_name
+ [sizeof(state->request->domain_name)-1]='\0';
+ state->request->data.init_conn.dcname
+ [sizeof(state->request->data.init_conn.dcname)-1]='\0';
- if (strlen(state->request.data.init_conn.dcname) > 0) {
- fstrcpy(domain->dcname, state->request.data.init_conn.dcname);
+ if (strlen(state->request->data.init_conn.dcname) > 0) {
+ fstrcpy(domain->dcname, state->request->data.init_conn.dcname);
}
- init_dc_connection(domain);
+ init_dc_connection(domain, false);
if (!domain->initialized) {
/* If we return error here we can't do any cached authentication,
"online = %d\n", domain->name, (int)domain->online ));
}
- fstrcpy(state->response.data.domain_info.name, domain->name);
- fstrcpy(state->response.data.domain_info.alt_name, domain->alt_name);
- sid_to_fstring(state->response.data.domain_info.sid, &domain->sid);
+ fstrcpy(state->response->data.domain_info.name, domain->name);
+ fstrcpy(state->response->data.domain_info.alt_name, domain->alt_name);
+ sid_to_fstring(state->response->data.domain_info.sid, &domain->sid);
- state->response.data.domain_info.native_mode
+ state->response->data.domain_info.native_mode
= domain->native_mode;
- state->response.data.domain_info.active_directory
+ state->response->data.domain_info.active_directory
= domain->active_directory;
- state->response.data.domain_info.primary
+ state->response->data.domain_info.primary
= domain->primary;
return WINBINDD_OK;
/* Look up global info for the winbind daemon */
bool init_domain_list(void)
{
- struct winbindd_domain *domain;
int role = lp_server_role();
/* Free existing list */
/* BUILTIN domain */
- domain = add_trusted_domain("BUILTIN", NULL, &builtin_passdb_methods,
+ (void)add_trusted_domain("BUILTIN", NULL, &cache_methods,
&global_sid_Builtin);
- if (domain) {
- setup_domain_child(domain,
- &domain->child);
- }
/* Local SAM */
- domain = add_trusted_domain(get_global_sam_name(), NULL,
- &sam_passdb_methods, get_global_sam_sid());
- if (domain) {
- if ( role != ROLE_DOMAIN_MEMBER ) {
- domain->primary = True;
+ if ( role == ROLE_ACTIVE_DIRECTORY_DC ) {
+ struct winbindd_domain *domain;
+ enum netr_SchannelType sec_chan_type;
+ const char *account_name;
+ struct samr_Password current_nt_hash;
+ bool ok;
+
+ domain = add_trusted_domain(get_global_sam_name(), lp_dnsdomain(),
+ &cache_methods, get_global_sam_sid());
+ if (domain == NULL) {
+ DEBUG(0, ("Failed to add our own, local AD domain to winbindd's internal list\n"));
+ return false;
+ }
+
+ /*
+ * We need to call this to find out if we are an RODC
+ */
+ ok = get_trust_pw_hash(domain->name,
+ current_nt_hash.hash,
+ &account_name,
+ &sec_chan_type);
+ if (!ok) {
+ DEBUG(0, ("Failed to fetch our own, local AD domain join password for winbindd's internal use\n"));
+ return false;
+ }
+ if (sec_chan_type == SEC_CHAN_RODC) {
+ domain->rodc = true;
}
- setup_domain_child(domain,
- &domain->child);
- }
+ } else {
+ (void)add_trusted_domain(get_global_sam_name(), NULL,
+ &cache_methods, get_global_sam_sid());
+ }
/* Add ourselves as the first entry. */
if ( role == ROLE_DOMAIN_MEMBER ) {
- DOM_SID our_sid;
+ struct winbindd_domain *domain;
+ struct dom_sid our_sid;
if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid)) {
DEBUG(0, ("Could not fetch our SID - did we join?\n"));
domain = add_trusted_domain( lp_workgroup(), lp_realm(),
&cache_methods, &our_sid);
if (domain) {
- domain->primary = True;
- setup_domain_child(domain,
- &domain->child);
-
/* Even in the parent winbindd we'll need to
talk to the DC, so try and see if we can
contact it. Theoretically this isn't neccessary
return True;
}
-void check_domain_trusted( const char *name, const DOM_SID *user_sid )
-{
- struct winbindd_domain *domain;
- DOM_SID dom_sid;
- uint32 rid;
-
- /* Check if we even care */
-
- if (!lp_allow_trusted_domains())
- return;
-
- domain = find_domain_from_name_noinit( name );
- if ( domain )
- return;
-
- sid_copy( &dom_sid, user_sid );
- if ( !sid_split_rid( &dom_sid, &rid ) )
- return;
-
- /* add the newly discovered trusted domain */
-
- domain = add_trusted_domain( name, NULL, &cache_methods,
- &dom_sid);
-
- if ( !domain )
- return;
-
- /* assume this is a trust from a one-way transitive
- forest trust */
-
- domain->active_directory = True;
- domain->domain_flags = NETR_TRUST_FLAG_OUTBOUND;
- domain->domain_type = NETR_TRUST_TYPE_UPLEVEL;
- domain->internal = False;
- domain->online = True;
-
- setup_domain_child(domain,
- &domain->child);
-
- wcache_tdc_add_domain( domain );
-
- return;
-}
-
/**
* Given a domain name, return the struct winbindd domain info for it
*
for (domain = domain_list(); domain != NULL; domain = domain->next) {
if (strequal(domain_name, domain->name) ||
- (domain->alt_name[0] &&
+ (domain->alt_name != NULL &&
strequal(domain_name, domain->alt_name))) {
return domain;
}
return NULL;
if (!domain->initialized)
- init_dc_connection(domain);
+ init_dc_connection(domain, false);
return domain;
}
/* Given a domain sid, return the struct winbindd domain info for it */
-struct winbindd_domain *find_domain_from_sid_noinit(const DOM_SID *sid)
+struct winbindd_domain *find_domain_from_sid_noinit(const struct dom_sid *sid)
{
struct winbindd_domain *domain;
/* Search through list */
for (domain = domain_list(); domain != NULL; domain = domain->next) {
- if (sid_compare_domain(sid, &domain->sid) == 0)
+ if (dom_sid_compare_domain(sid, &domain->sid) == 0)
return domain;
}
/* Given a domain sid, return the struct winbindd domain info for it */
-struct winbindd_domain *find_domain_from_sid(const DOM_SID *sid)
+struct winbindd_domain *find_domain_from_sid(const struct dom_sid *sid)
{
struct winbindd_domain *domain;
return NULL;
if (!domain->initialized)
- init_dc_connection(domain);
+ init_dc_connection(domain, false);
return domain;
}
{
struct winbindd_domain *ours = find_our_domain();
- if ( !ours )
- return NULL;
-
- if ( strlen(ours->forest_name) == 0 )
+ if (ours->forest_name == NULL) {
return NULL;
+ }
return find_domain_from_name( ours->forest_name );
}
struct winbindd_domain *find_builtin_domain(void)
{
- DOM_SID sid;
struct winbindd_domain *domain;
- string_to_sid(&sid, "S-1-5-32");
- domain = find_domain_from_sid(&sid);
-
+ domain = find_domain_from_sid(&global_sid_Builtin);
if (domain == NULL) {
smb_panic("Could not find BUILTIN domain");
}
/* Find the appropriate domain to lookup a name or SID */
-struct winbindd_domain *find_lookup_domain_from_sid(const DOM_SID *sid)
+struct winbindd_domain *find_lookup_domain_from_sid(const struct dom_sid *sid)
{
/* SIDs in the S-1-22-{1,2} domain should be handled by our passdb */
if ( strequal(domain_name, unix_users_domain_name() ) ||
strequal(domain_name, unix_groups_domain_name() ) )
{
+ /*
+ * The "Unix User" and "Unix Group" domain our handled by
+ * passdb
+ */
return find_domain_from_name_noinit( get_global_sam_name() );
}
strequal(domain_name, get_global_sam_name()))
return find_domain_from_name_noinit(domain_name);
- /* The "Unix User" and "Unix Group" domain our handled by passdb */
return find_our_domain();
}
-/* Lookup a sid in a domain from a name */
-
-bool winbindd_lookup_sid_by_name(TALLOC_CTX *mem_ctx,
- enum winbindd_cmd orig_cmd,
- struct winbindd_domain *domain,
- const char *domain_name,
- const char *name, DOM_SID *sid,
- enum lsa_SidType *type)
-{
- NTSTATUS result;
-
- /* Lookup name */
- result = domain->methods->name_to_sid(domain, mem_ctx, orig_cmd,
- domain_name, name, sid, type);
-
- /* Return sid and type if lookup successful */
- if (!NT_STATUS_IS_OK(result)) {
- *type = SID_NAME_UNKNOWN;
- }
-
- return NT_STATUS_IS_OK(result);
-}
-
-/**
- * @brief Lookup a name in a domain from a sid.
- *
- * @param sid Security ID you want to look up.
- * @param name On success, set to the name corresponding to @p sid.
- * @param dom_name On success, set to the 'domain name' corresponding to @p sid.
- * @param type On success, contains the type of name: alias, group or
- * user.
- * @retval True if the name exists, in which case @p name and @p type
- * are set, otherwise False.
- **/
-bool winbindd_lookup_name_by_sid(TALLOC_CTX *mem_ctx,
- struct winbindd_domain *domain,
- DOM_SID *sid,
- char **dom_name,
- char **name,
- enum lsa_SidType *type)
-{
- NTSTATUS result;
-
- *dom_name = NULL;
- *name = NULL;
-
- /* Lookup name */
-
- result = domain->methods->sid_to_name(domain, mem_ctx, sid, dom_name, name, type);
-
- /* Return name and type if successful */
-
- if (NT_STATUS_IS_OK(result)) {
- return True;
- }
-
- *type = SID_NAME_UNKNOWN;
-
- return False;
-}
-
-/* Free state information held for {set,get,end}{pw,gr}ent() functions */
-
-void free_getent_state(struct getent_state *state)
-{
- struct getent_state *temp;
-
- /* Iterate over state list */
-
- temp = state;
-
- while(temp != NULL) {
- struct getent_state *next = temp->next;
-
- /* Free sam entries then list entry */
-
- SAFE_FREE(state->sam_entries);
- DLIST_REMOVE(state, state);
-
- SAFE_FREE(temp);
- temp = next;
- }
-}
-
/* Is this a domain which we may assume no DOMAIN\ prefix? */
static bool assume_domain(const char *domain)
if ( assume_domain(lp_workgroup())) {
fstrcpy(domain, lp_workgroup());
} else if ((p = strchr(domuser, '@')) != NULL) {
- fstrcpy(domain, "");
+ fstrcpy(domain, p + 1);
+ user[PTR_DIFF(p, domuser)] = 0;
} else {
return False;
}
domain[PTR_DIFF(p, domuser)] = 0;
}
- strupper_m(domain);
-
- return True;
+ return strupper_m(domain);
}
bool parse_domain_user_talloc(TALLOC_CTX *mem_ctx, const char *domuser,
return ((*domain != NULL) && (*user != NULL));
}
-/* add a domain user name to a buffer */
-void parse_add_domuser(void *buf, char *domuser, int *len)
-{
- fstring domain;
- char *p, *user;
-
- user = domuser;
- p = strchr(domuser, *lp_winbind_separator());
-
- if (p) {
-
- fstrcpy(domain, domuser);
- domain[PTR_DIFF(p, domuser)] = 0;
- p++;
-
- if (assume_domain(domain)) {
-
- user = p;
- *len -= (PTR_DIFF(p, domuser));
- }
- }
-
- safe_strcpy((char *)buf, user, *len);
-}
-
/* Ensure an incoming username from NSS is fully qualified. Replace the
incoming fstring with DOMAIN <separator> user. Returns the same
values as parse_domain_user() but also replaces the incoming username.
fstring tmp_user;
fstrcpy(tmp_user, user);
- strlower_m(tmp_user);
+ (void)strlower_m(tmp_user);
if (can_assume && assume_domain(domain)) {
strlcpy(name, tmp_user, sizeof(fstring));
char *tmp_user, *name;
tmp_user = talloc_strdup(mem_ctx, user);
- strlower_m(tmp_user);
+ if (!strlower_m(tmp_user)) {
+ TALLOC_FREE(tmp_user);
+ return NULL;
+ }
if (can_assume && assume_domain(domain)) {
name = tmp_user;
return name;
}
-/*
- * Winbindd socket accessor functions
- */
-
-const char *get_winbind_pipe_dir(void)
-{
- return lp_parm_const_string(-1, "winbindd", "socket dir", WINBINDD_SOCKET_DIR);
-}
-
-char *get_winbind_priv_pipe_dir(void)
-{
- return lock_path(WINBINDD_PRIV_SOCKET_SUBDIR);
-}
-
-/* Open the winbindd socket */
-
-static int _winbindd_socket = -1;
-static int _winbindd_priv_socket = -1;
-
-int open_winbindd_socket(void)
-{
- if (_winbindd_socket == -1) {
- _winbindd_socket = create_pipe_sock(
- get_winbind_pipe_dir(), WINBINDD_SOCKET_NAME, 0755);
- DEBUG(10, ("open_winbindd_socket: opened socket fd %d\n",
- _winbindd_socket));
- }
-
- return _winbindd_socket;
-}
-
-int open_winbindd_priv_socket(void)
-{
- if (_winbindd_priv_socket == -1) {
- _winbindd_priv_socket = create_pipe_sock(
- get_winbind_priv_pipe_dir(), WINBINDD_SOCKET_NAME, 0750);
- DEBUG(10, ("open_winbindd_priv_socket: opened socket fd %d\n",
- _winbindd_priv_socket));
- }
-
- return _winbindd_priv_socket;
-}
-
/*
* Client list accessor functions
*/
_num_clients--;
}
-/* Close all open clients */
-
-void winbindd_kill_all_clients(void)
-{
- struct winbindd_cli_state *cl = winbindd_client_list();
-
- DEBUG(10, ("winbindd_kill_all_clients: going postal\n"));
-
- while (cl) {
- struct winbindd_cli_state *next;
-
- next = cl->next;
- winbindd_remove_client(cl);
- cl = next;
- }
-}
-
/* Return number of open clients */
int winbindd_num_clients(void)
NTSTATUS lookup_usergroups_cached(struct winbindd_domain *domain,
TALLOC_CTX *mem_ctx,
- const DOM_SID *user_sid,
- uint32 *p_num_groups, DOM_SID **user_sids)
+ const struct dom_sid *user_sid,
+ uint32_t *p_num_groups, struct dom_sid **user_sids)
{
struct netr_SamInfo3 *info3 = NULL;
NTSTATUS status = NT_STATUS_NO_MEMORY;
- size_t num_groups = 0;
+ uint32_t num_groups = 0;
DEBUG(3,(": lookup_usergroups_cached\n"));
return NT_STATUS_UNSUCCESSFUL;
}
- /* Skip Domain local groups outside our domain.
- We'll get these from the getsidaliases() RPC call. */
+ /*
+ * Before bug #7843 the "Domain Local" groups were added with a
+ * lookupuseraliases call, but this isn't done anymore for our domain
+ * so we need to resolve resource groups here.
+ *
+ * When to use Resource Groups:
+ * http://technet.microsoft.com/en-us/library/cc753670%28v=WS.10%29.aspx
+ */
status = sid_array_from_info3(mem_ctx, info3,
user_sids,
&num_groups,
- false, true);
+ false);
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(info3);
NTSTATUS normalize_name_map(TALLOC_CTX *mem_ctx,
struct winbindd_domain *domain,
- char *name,
+ const char *name,
char **normalized)
{
NTSTATUS nt_status;
/* We can contact the domain if it is our primary domain */
if (domain->primary) {
- return true;
+ ret = true;
+ goto done;
}
/* Trust the TDC cache and not the winbindd_domain flags */
if ((tdc = wcache_tdc_fetch_domain(frame, domain->name)) == NULL) {
DEBUG(10,("winbindd_can_contact_domain: %s not found in cache\n",
domain->name));
- return false;
+ ret = false;
+ goto done;
}
/* Can always contact a domain that is in out forest */
get_friendly_nt_error_msg(result));
resp->data.auth.pam_error = nt_status_to_pam(result);
}
+
+bool is_domain_offline(const struct winbindd_domain *domain)
+{
+ if (!lp_winbind_offline_logon()) {
+ return false;
+ }
+ if (get_global_winbindd_state_offline()) {
+ return true;
+ }
+ return !domain->online;
+}
+
+bool is_domain_online(const struct winbindd_domain *domain)
+{
+ return !is_domain_offline(domain);
+}
+
+/**
+ * Parse an char array into a list of sids.
+ *
+ * The input sidstr should consist of 0-terminated strings
+ * representing sids, separated by newline characters '\n'.
+ * The list is terminated by an empty string, i.e.
+ * character '\0' directly following a character '\n'
+ * (or '\0' right at the start of sidstr).
+ */
+bool parse_sidlist(TALLOC_CTX *mem_ctx, const char *sidstr,
+ struct dom_sid **sids, uint32_t *num_sids)
+{
+ const char *p;
+
+ p = sidstr;
+ if (p == NULL)
+ return False;
+
+ while (p[0] != '\0') {
+ struct dom_sid sid;
+ const char *q = NULL;
+
+ if (!dom_sid_parse_endp(p, &sid, &q)) {
+ DEBUG(1, ("Could not parse sid %s\n", p));
+ return false;
+ }
+ if ((q == NULL) || (q[0] != '\n')) {
+ DEBUG(1, ("Got invalid sidstr: %s\n", p));
+ return false;
+ }
+ if (!NT_STATUS_IS_OK(add_sid_to_array(mem_ctx, &sid, sids,
+ num_sids)))
+ {
+ return False;
+ }
+ p = q+1;
+ }
+ return True;
+}
git.samba.org / amitay / samba.git / blobdiff