/*
Unix SMB/Netbios implementation.
- Version 2.0
+ Version 3.0
Winbind daemon for ntdom nss module
{ WINBINDD_ENDPWENT, winbindd_endpwent },
{ WINBINDD_GETPWENT, winbindd_getpwent },
-#if 0
-
{ WINBINDD_GETGROUPS, winbindd_getgroups },
/* Group functions */
+#if 0
{ WINBINDD_GETGRNAM_FROM_GROUP, winbindd_getgrnam_from_group },
{ WINBINDD_GETGRNAM_FROM_GID, winbindd_getgrnam_from_gid },
+#endif
{ WINBINDD_SETGRENT, winbindd_setgrent },
{ WINBINDD_ENDGRENT, winbindd_endgrent },
{ WINBINDD_GETGRENT, winbindd_getgrent },
+#if 0
+
/* PAM auth functions */
{ WINBINDD_PAM_AUTH, winbindd_pam_auth },
/* Enumeration functions */
+#endif
+
{ WINBINDD_LIST_USERS, winbindd_list_users },
{ WINBINDD_LIST_GROUPS, winbindd_list_groups },
{ WINBINDD_LIST_TRUSTDOM, winbindd_list_trusted_domains },
+#if 0
/* SID related functions */
{ WINBINDD_LOOKUPSID, winbindd_lookupsid },
/* Specific pipe stuff - move into a union? */
enum sam_pipe_type sam_pipe_type; /* Domain, user, group etc */
- uint32 user_rid;
+ uint32 user_rid, group_rid;
};
/* Global list of connections. Initially a DLIST but can become a hash
/* Return a SAM policy handle on a domain group */
-CLI_POLICY_HND *cm_get_sam_group_handle(char *domain, char *group)
+CLI_POLICY_HND *cm_get_sam_group_handle(char *domain, DOM_SID *domain_sid,
+ uint32 group_rid)
{
- DEBUG(0, ("get_sam_group_handle(): not implemented\n"));
- return NULL;
+ struct winbindd_cm_conn *conn, *basic_conn = NULL;
+ static CLI_POLICY_HND hnd;
+ NTSTATUS result;
+ uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
+
+ /* Look for existing connections */
+
+ for (conn = cm_conns; conn; conn = conn->next) {
+ if (strequal(conn->domain, domain) &&
+ strequal(conn->pipe_name, PIPE_SAMR) &&
+ conn->sam_pipe_type == SAM_PIPE_GROUP &&
+ conn->group_rid == group_rid)
+ goto ok;
+ }
+
+ /* Create a domain handle to open a user handle from */
+
+ if (!cm_get_sam_dom_handle(domain, domain_sid))
+ return NULL;
+
+ for (conn = cm_conns; conn; conn = conn->next) {
+ if (strequal(conn->domain, domain) &&
+ strequal(conn->pipe_name, PIPE_SAMR) &&
+ conn->sam_pipe_type == SAM_PIPE_DOM)
+ basic_conn = conn;
+ }
+
+ if (!basic_conn) {
+ DEBUG(0, ("No domain sam handle was created!\n"));
+ return NULL;
+ }
+
+ if (!(conn = (struct winbindd_cm_conn *)
+ malloc(sizeof(struct winbindd_cm_conn))))
+ return NULL;
+
+ ZERO_STRUCTP(conn);
+
+ fstrcpy(conn->domain, basic_conn->domain);
+ fstrcpy(conn->controller, basic_conn->controller);
+ fstrcpy(conn->pipe_name, basic_conn->pipe_name);
+
+ conn->sam_pipe_type = SAM_PIPE_GROUP;
+ conn->cli = basic_conn->cli;
+ conn->group_rid = group_rid;
+
+ result = cli_samr_open_group(conn->cli, conn->cli->mem_ctx,
+ &basic_conn->pol, des_access, group_rid,
+ &conn->pol);
+
+ if (!NT_STATUS_IS_OK(result))
+ return NULL;
+
+ /* Add to list */
+
+ DLIST_ADD(cm_conns, conn);
+
+ ok:
+ hnd.pol = conn->pol;
+ hnd.cli = conn->cli;
+
+ return &hnd;
}
#include "winbindd.h"
-#if 0
-
/* Fill a grent structure from various other information */
static BOOL fill_grent(struct winbindd_gr *gr, char *gr_name,
return result;
}
+#if 0
+
/* Return a group structure from a group name */
enum winbindd_result winbindd_getgrnam_from_group(struct winbindd_cli_state
return WINBINDD_OK;
}
+#endif
+
/*
* set/get/endgrent functions
*/
DEBUG(3, ("[%5d]: setgrent\n", state->pid));
- if (state == NULL) return WINBINDD_ERROR;
-
/* Check user has enabled this */
- if (!lp_winbind_enum_groups()) {
+ if (!lp_winbind_enum_groups())
return WINBINDD_ERROR;
- }
/* Free old static data if it exists */
variable */
if ((strcmp(state->request.domain, "") != 0) &&
- !check_domain_env(state->request.domain, tmp->name)) {
+ !check_domain_env(state->request.domain, tmp->name))
continue;
- }
/* Create a state record for this domain */
if ((domain_state = (struct getent_state *)
- malloc(sizeof(struct getent_state))) == NULL) {
-
+ malloc(sizeof(struct getent_state))) == NULL)
return WINBINDD_ERROR;
- }
ZERO_STRUCTP(domain_state);
uint32 num_entries;
struct acct_info *name_list = NULL, *tnl;
- if (ent->got_all_sam_entries) {
+ if (ent->got_all_sam_entries)
return False;
- }
#if 0
if (winbindd_fetch_group_cache(ent->domain->name,
&ent->sam_entries,
- &ent->num_sam_entries)) {
+ &ent->num_sam_entries))
return True;
- }
#endif
- /* Fetch group entries */
-
- if (!domain_handles_open(ent->domain)) {
- return False;
- }
-
/* Free any existing group info */
SAFE_FREE(ent->sam_entries);
num_entries = 0;
- if (!(hnd = cm_get_sam_dom_handle(ent->domain->name)))
+ if (!(hnd = cm_get_sam_dom_handle(ent->domain->name,
+ &ent->domain->sid)))
break;
status = cli_samr_enum_dom_groups(
- hnd->cli, hnd->cli->mem_ctx, hnd->pol,
+ hnd->cli, hnd->cli->mem_ctx, &hnd->pol,
&ent->grp_query_start_ndx,
0x8000, /* buffer size? */
(struct acct_info **) &sam_grp_entries, &num_entries);
sizeof(struct acct_info) *
(ent->num_sam_entries +
num_entries));
- if(tnl == NULL)
- {
- DEBUG(0,("get_sam_group_entries: unable ro realloc a structure!\n"));
+
+ if (tnl == NULL) {
+ DEBUG(0,("get_sam_group_entries: unable to "
+ "realloc a structure!\n"));
SAFE_FREE(name_list);
- return False;
- }
- else name_list = tnl;
+
+ return False;
+ } else
+ name_list = tnl;
memcpy(&name_list[ent->num_sam_entries],
sam_grp_entries,
ent->sam_entries = name_list;
ent->sam_entry_index = 0;
- ent->got_all_sam_entries = (NT_STATUS_V(status) != NT_STATUS_V(STATUS_MORE_ENTRIES));
+ ent->got_all_sam_entries = (NT_STATUS_V(status) !=
+ NT_STATUS_V(STATUS_MORE_ENTRIES));
return ent->num_sam_entries > 0;
}
DEBUG(3, ("[%5d]: getgrent\n", state->pid));
- if (state == NULL) return WINBINDD_ERROR;
-
/* Check user has enabled this */
- if (!lp_winbind_enum_groups()) {
+ if (!lp_winbind_enum_groups())
return WINBINDD_ERROR;
- }
num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);
if ((state->response.extra_data =
- malloc(num_groups * sizeof(struct winbindd_gr))) == NULL) {
+ malloc(num_groups * sizeof(struct winbindd_gr))) == NULL)
return WINBINDD_ERROR;
- }
state->response.data.num_entries = 0;
group_list = (struct winbindd_gr *)state->response.extra_data;
sep = lp_winbind_separator();
- if (!(ent = state->getgrent_state)) {
+ if (!(ent = state->getgrent_state))
return WINBINDD_ERROR;
- }
/* Start sending back groups */
/* No more domains */
- if (!ent) break;
+ if (!ent)
+ break;
}
name_list = ent->sam_entries;
/* Copy the list of group memberships to the end of the extra data */
- if (group_list_ndx == 0) {
+ if (group_list_ndx == 0)
goto done;
- }
new_extra_data = Realloc(
state->response.extra_data,
DEBUG(3, ("[%5d]: list groups\n", state->pid));
/* Enumerate over trusted domains */
+
ZERO_STRUCT(groups);
+
for (domain = domain_list; domain; domain = domain->next) {
/* Skip domains other than WINBINDD_DOMAIN environment
variable */
if ((strcmp(state->request.domain, "") != 0) &&
- !check_domain_env(state->request.domain, domain->name)) {
+ !check_domain_env(state->request.domain, domain->name))
continue;
- }
/* Get list of sam groups */
/*
* iterate through all groups
- * total_entries : maintains a total count over **all domains**
- * num_domain_entries : is the running count for this domain
+ * total_entries: maintains a total count over **all domains**
+ * num_domain_entries: is the running count for this domain
*/
num_domain_entries = 0;
- while (get_sam_group_entries(&groups))
- {
+
+ while (get_sam_group_entries(&groups)) {
int new_size;
int offset;
return WINBINDD_ERROR;
num_domain_entries += groups.num_sam_entries;
- memcpy (((char *)sam_entries)+offset, groups.sam_entries,
- sizeof(struct acct_info) * groups.num_sam_entries);
+ memcpy (((char *)sam_entries)+offset,
+ groups.sam_entries,
+ sizeof(struct acct_info) *
+ groups.num_sam_entries);
groups.sam_entries = NULL;
groups.num_sam_entries = 0;
ted = Realloc(extra_data, sizeof(fstring) * total_entries);
if (!ted) {
- DEBUG(0,("winbindd_list_groups: failed to enlarge buffer!\n"));
+ DEBUG(0,("winbindd_list_groups: failed to enlarge "
+ "buffer!\n"));
SAFE_FREE(extra_data);
return WINBINDD_ERROR;
} else
/* Append to extra data */
- memcpy(&extra_data[extra_data_len], name, strlen(name));
+ memcpy(&extra_data[extra_data_len], name,
+ strlen(name));
+
extra_data_len += strlen(name);
extra_data[extra_data_len++] = ',';
DEBUG(3, ("[%5d]: getgroups %s\n", state->pid,
state->request.data.username));
- if (state == NULL) return WINBINDD_ERROR;
-
/* Parse domain and username */
parse_domain_user(state->request.data.username, name_domain,
/* Reject names that don't have a domain - i.e name_domain contains
the entire name. */
- if (strequal(name_domain, "")) {
+ if (strequal(name_domain, ""))
return WINBINDD_ERROR;
- }
/* Get info for the domain */
return WINBINDD_ERROR;
}
- if (!domain_handles_open(domain)) {
- return WINBINDD_ERROR;
- }
-
slprintf(name, sizeof(name) - 1, "%s\\%s", name_domain, name_user);
/* Get rid and name type from name. The following costs 1 packet */
sid_split_rid(&user_sid, &user_rid);
if (!winbindd_lookup_usergroups(domain, user_rid, &num_groups,
- &user_groups)) {
+ &user_groups))
return WINBINDD_ERROR;
- }
/* Copy data back to client */
return result;
}
-
-#endif
CLI_POLICY_HND *cm_get_sam_dom_handle(char *domain, DOM_SID *domain_sid);
CLI_POLICY_HND *cm_get_sam_user_handle(char *domain, DOM_SID *domain_sid,
uint32 user_rid);
-CLI_POLICY_HND *cm_get_sam_group_handle(char *domain, char *group);
+CLI_POLICY_HND *cm_get_sam_group_handle(char *domain, DOM_SID *domain_sid,
+ uint32 group_rid);
/* The following definitions come from nsswitch/winbindd_group.c */
enum SID_NAME_USE *type);
BOOL winbindd_lookup_name_by_sid(DOM_SID *sid, fstring name,
enum SID_NAME_USE *type);
-BOOL winbindd_lookup_userinfo(char *domain, uint32 user_rid,
+BOOL winbindd_lookup_userinfo(struct winbindd_domain *domain, uint32 user_rid,
SAM_USERINFO_CTR **user_info);
BOOL winbindd_lookup_usergroups(struct winbindd_domain *domain,
uint32 user_rid, uint32 *num_groups,
DOM_SID user_sid;
fstring name_domain, name_user, name, gecos_name;
enum SID_NAME_USE name_type;
+ struct winbindd_domain *domain;
DEBUG(3, ("[%5d]: getpwnam %s\n", state->pid,
state->request.data.username));
return WINBINDD_ERROR;
}
+ if ((domain = find_domain_from_name(name_domain)) == NULL) {
+ DEBUG(5, ("No such domain: %s\n", name_domain));
+ return WINBINDD_ERROR;
+ }
+
/* Check for cached user entry */
if (winbindd_fetch_user_cache_entry(name_domain, name_user,
slprintf(name, sizeof(name) - 1, "%s\\%s", name_domain, name_user);
- /* Get rid and name type from name. The following costs 1 packet */
+ /* Get rid and name type from name */
if (!winbindd_lookup_sid_by_name(name, &user_sid, &name_type)) {
DEBUG(1, ("user '%s' does not exist\n", name_user));
sid_split_rid(&user_sid, &user_rid);
- /* The following costs 3 packets */
-
- if (!winbindd_lookup_userinfo(name_domain, user_rid, &user_info)) {
+ if (!winbindd_lookup_userinfo(domain, user_rid, &user_info)) {
DEBUG(1, ("pwnam_from_user(): error getting user info for "
"user '%s'\n", name_user));
return WINBINDD_ERROR;
/* Get some user info */
- if (!winbindd_lookup_userinfo(domain->name, user_rid, &user_info)) {
+ if (!winbindd_lookup_userinfo(domain, user_rid, &user_info)) {
DEBUG(1, ("pwnam_from_uid(): error getting user info for "
"user '%s'\n", user_name));
return WINBINDD_ERROR;
/* Lookup user information from a rid */
-BOOL winbindd_lookup_userinfo(char *domain_name, uint32 user_rid,
+BOOL winbindd_lookup_userinfo(struct winbindd_domain *domain, uint32 user_rid,
SAM_USERINFO_CTR **user_info)
{
CLI_POLICY_HND *hnd;
uint16 info_level = 0x15;
NTSTATUS result;
- struct winbindd_domain *domain;
- if (!(domain = find_domain_from_name(domain_name)))
- return False;
-
- if (!(hnd = cm_get_sam_user_handle(domain_name, &domain->sid,
+ if (!(hnd = cm_get_sam_user_handle(domain->name, &domain->sid,
user_rid)))
return False;
return NT_STATUS_IS_OK(result);
}
-#if 0
-
/* Lookup groups a user is a member of. I wish Unix had a call like this! */
BOOL winbindd_lookup_usergroups(struct winbindd_domain *domain,
uint32 user_rid, uint32 *num_groups,
DOM_GID **user_groups)
{
- POLICY_HND user_pol;
- BOOL result;
+ CLI_POLICY_HND *hnd;
+ NTSTATUS result;
- if (!wb_samr_open_user(&domain->sam_dom_handle,
- SEC_RIGHTS_MAXIMUM_ALLOWED,
- user_rid, &user_pol)) {
- return False;
- }
-
- if (!NT_STATUS_IS_OK(cli_samr_query_usergroups(domain->sam_dom_handle.cli,
- domain->sam_dom_handle.mem_ctx,
- &user_pol, num_groups, user_groups))) {
- result = False;
- goto done;
- }
-
- result = True;
+ if (!(hnd = cm_get_sam_user_handle(domain->name, &domain->sid,
+ user_rid)))
+ return False;
-done:
- cli_samr_close(domain->sam_dom_handle.cli,
- domain->sam_dom_handle.mem_ctx, &user_pol);
+ result = cli_samr_query_usergroups(hnd->cli, hnd->cli->mem_ctx,
+ &hnd->pol, num_groups,
+ user_groups);
- return True;
+ return NT_STATUS_IS_OK(result);
}
-/* Lookup group membership given a rid */
+/* Lookup group membership given a rid. */
BOOL winbindd_lookup_groupmem(struct winbindd_domain *domain,
uint32 group_rid, uint32 *num_names,
uint32 **rid_mem, char ***names,
uint32 **name_types)
{
- return wb_sam_query_groupmem(&domain->sam_dom_handle, group_rid,
- num_names, rid_mem, names, name_types);
-}
+ CLI_POLICY_HND *group_hnd, *dom_hnd;
+ NTSTATUS result;
+ uint32 i, total_names = 0;
-#endif
+ if (!(group_hnd = cm_get_sam_group_handle(domain->name, &domain->sid,
+ group_rid)))
+ return False;
+
+ /* Get group membership. This is a list of rids. */
+
+ result = cli_samr_query_groupmem(group_hnd->cli,
+ group_hnd->cli->mem_ctx,
+ &group_hnd->pol, num_names, rid_mem,
+ name_types);
+
+ if (!NT_STATUS_IS_OK(result))
+ return NT_STATUS_IS_OK(result);
+
+ /* Convert list of rids into list of names. Do this in bunches of
+ ~1000 to avoid crashing NT4. It looks like there is a buffer
+ overflow or something like that lurking around somewhere. */
+
+ if (!(dom_hnd = cm_get_sam_dom_handle(domain->name, &domain->sid)))
+ return False;
+
+#define MAX_LOOKUP_RIDS 900
+
+ *names = talloc(dom_hnd->cli->mem_ctx, *num_names * sizeof(char *));
+ *name_types = talloc(dom_hnd->cli->mem_ctx, *num_names *
+ sizeof(uint32));
+
+ for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
+ int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
+ uint32 tmp_num_names = 0;
+ char **tmp_names = NULL;
+ uint32 *tmp_types = NULL;
+
+ /* Lookup a chunk of rids */
+
+ result = cli_samr_lookup_rids(dom_hnd->cli,
+ dom_hnd->cli->mem_ctx,
+ &dom_hnd->pol, 1000, /* flags */
+ num_lookup_rids,
+ &(*rid_mem)[i],
+ &tmp_num_names,
+ &tmp_names, &tmp_types);
+
+ if (!NT_STATUS_IS_OK(result))
+ return False;
+
+ /* Copy result into array. The talloc system will take
+ care of freeing the temporary arrays later on. */
+
+ memcpy(&(*names)[i], tmp_names, sizeof(char *) *
+ tmp_num_names);
+
+ memcpy(&(*name_types)[i], tmp_types, sizeof(uint32) *
+ tmp_num_names);
+
+ total_names += tmp_num_names;
+ }
+
+ *num_names = total_names;
+
+ return NT_STATUS_IS_OK(result);
+}
/* Globals for domain list stuff */
git.samba.org / ira / wip.git / commitdiff