source3/winbindd/wb_lookupsids.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    async lookupsids
   4    Copyright (C) Volker Lendecke 2011
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "lib/util_unixsids.h"
  23 #include "librpc/gen_ndr/ndr_winbind_c.h"
  24 #include "../libcli/security/security.h"
  25 #include "passdb/machine_sid.h"
  26 #include "lsa.h"
  27
  28 struct wb_lookupsids_domain {
  29         struct winbindd_domain *domain;
  30
  31         /*
  32          * Array of sids to be passed into wbint_LookupSids. Preallocated with
  33          * num_sids.
  34          */
  35         struct lsa_SidArray sids;
  36
  37         /*
  38          * Indexes into wb_lookupsids_state->sids and thus
  39          * wb_lookupsids_state->res_names. Preallocated with num_sids.
  40          */
  41         uint32_t *sid_indexes;
  42 };
  43
  44 struct wb_translated_name {
  45         const char *domain_name;
  46         const char *name;
  47         enum lsa_SidType type;
  48 };
  49
  50 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
  51         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
  52         struct wb_lookupsids_domain **domains, uint32_t num_sids);
  53
  54 struct wb_lookupsids_state {
  55         struct tevent_context *ev;
  56
  57         /*
  58          * SIDs passed in
  59          */
  60         struct dom_sid *sids;
  61         uint32_t num_sids;
  62
  63         /*
  64          * The domains we're using for bulk lookup via wbint_LookupRids or
  65          * wbint_LookupSids. We expect very few domains, so we do a
  66          * talloc_realloc and rely on talloc_array_length.
  67          */
  68         struct wb_lookupsids_domain *domains;
  69         uint32_t domains_done;
  70
  71         /*
  72          * These SIDs are looked up individually via
  73          * wbint_LookupSid. Preallocated with num_sids.
  74          */
  75         uint32_t *single_sids;
  76         uint32_t num_single_sids;
  77         uint32_t single_sids_done;
  78
  79         /*
  80          * Intermediate store for wbint_LookupRids to passdb. These are
  81          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  82          */
  83         struct wbint_RidArray rids;
  84         const char *domain_name;
  85         struct wbint_Principals rid_names;
  86
  87         /*
  88          * Intermediate results for wbint_LookupSids. These results are
  89          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  90          */
  91         struct lsa_RefDomainList tmp_domains;
  92         struct lsa_TransNameArray tmp_names;
  93
  94         /*
  95          * Results
  96          */
  97         struct lsa_RefDomainList *res_domains;
  98         /*
  99          * Indexed as "sids" in this structure
 100          */
 101         struct lsa_TransNameArray *res_names;
 102 };
 103
 104 static bool wb_lookupsids_next(struct tevent_req *req,
 105                                struct wb_lookupsids_state *state);
 106 static void wb_lookupsids_single_done(struct tevent_req *subreq);
 107 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq);
 108 static void wb_lookupsids_done(struct tevent_req *subreq);
 109
 110 struct tevent_req *wb_lookupsids_send(TALLOC_CTX *mem_ctx,
 111                                       struct tevent_context *ev,
 112                                       struct dom_sid *sids,
 113                                       uint32_t num_sids)
 114 {
 115         struct tevent_req *req;
 116         struct wb_lookupsids_state *state;
 117         uint32_t i;
 118
 119         req = tevent_req_create(mem_ctx, &state, struct wb_lookupsids_state);
 120         if (req == NULL) {
 121                 return NULL;
 122         }
 123         state->ev = ev;
 124         state->sids = sids;
 125         state->num_sids = num_sids;
 126
 127         state->single_sids = talloc_array(state, uint32_t, num_sids);
 128         if (tevent_req_nomem(state->single_sids, req)) {
 129                 return tevent_req_post(req, ev);
 130         }
 131
 132         state->res_domains = talloc_zero(state, struct lsa_RefDomainList);
 133         if (tevent_req_nomem(state->res_domains, req)) {
 134                 return tevent_req_post(req, ev);
 135         }
 136         state->res_domains->domains = talloc_array(
 137                 state->res_domains, struct lsa_DomainInfo, num_sids);
 138         if (tevent_req_nomem(state->res_domains->domains, req)) {
 139                 return tevent_req_post(req, ev);
 140         }
 141
 142         state->res_names = talloc_zero(state, struct lsa_TransNameArray);
 143         if (tevent_req_nomem(state->res_names, req)) {
 144                 return tevent_req_post(req, ev);
 145         }
 146         state->res_names->names = talloc_array(
 147                 state->res_names, struct lsa_TranslatedName, num_sids);
 148         if (tevent_req_nomem(state->res_names->names, req)) {
 149                 return tevent_req_post(req, ev);
 150         }
 151
 152         if (num_sids == 0) {
 153                 tevent_req_done(req);
 154                 return tevent_req_post(req, ev);
 155         }
 156
 157         for (i=0; i<num_sids; i++) {
 158                 struct wb_lookupsids_domain *d;
 159
 160                 d = wb_lookupsids_get_domain(&sids[i], state, &state->domains,
 161                                              num_sids);
 162                 if (d != NULL) {
 163                         d->sids.sids[d->sids.num_sids].sid = &sids[i];
 164                         d->sid_indexes[d->sids.num_sids] = i;
 165                         d->sids.num_sids += 1;
 166                 } else {
 167                         state->single_sids[state->num_single_sids] = i;
 168                         state->num_single_sids += 1;
 169                 }
 170         }
 171
 172         if (!wb_lookupsids_next(req, state)) {
 173                 return tevent_req_post(req, ev);
 174         }
 175         return req;
 176 }
 177
 178 static bool wb_lookupsids_next(struct tevent_req *req,
 179                                struct wb_lookupsids_state *state)
 180 {
 181         struct tevent_req *subreq;
 182
 183         if (state->domains_done < talloc_array_length(state->domains)) {
 184                 struct wb_lookupsids_domain *d;
 185                 uint32_t i;
 186
 187                 d = &state->domains[state->domains_done];
 188
 189                 if (d->domain->internal) {
 190                         /*
 191                          * This is only our local SAM,
 192                          * see wb_lookupsids_bulk() and
 193                          * wb_lookupsids_get_domain().
 194                          */
 195                         state->rids.num_rids = d->sids.num_sids;
 196                         state->rids.rids = talloc_array(state, uint32_t,
 197                                                         state->rids.num_rids);
 198                         if (tevent_req_nomem(state->rids.rids, req)) {
 199                                 return false;
 200                         }
 201                         for (i=0; i<state->rids.num_rids; i++) {
 202                                 sid_peek_rid(d->sids.sids[i].sid,
 203                                              &state->rids.rids[i]);
 204                         }
 205                         subreq = dcerpc_wbint_LookupRids_send(
 206                                 state, state->ev, dom_child_handle(d->domain),
 207                                 &d->domain->sid, &state->rids, &state->domain_name,
 208                                 &state->rid_names);
 209                         if (tevent_req_nomem(subreq, req)) {
 210                                 return false;
 211                         }
 212                         tevent_req_set_callback(
 213                                 subreq, wb_lookupsids_lookuprids_done, req);
 214                         return true;
 215                 }
 216
 217                 subreq = dcerpc_wbint_LookupSids_send(
 218                         state, state->ev, dom_child_handle(d->domain),
 219                         &d->sids, &state->tmp_domains,  &state->tmp_names);
 220                 if (tevent_req_nomem(subreq, req)) {
 221                         return false;
 222                 }
 223                 tevent_req_set_callback(subreq, wb_lookupsids_done, req);
 224                 return true;
 225         }
 226
 227         if (state->single_sids_done < state->num_single_sids) {
 228                 uint32_t sid_idx;
 229                 const struct dom_sid *sid;
 230
 231                 sid_idx = state->single_sids[state->single_sids_done];
 232                 sid = &state->sids[sid_idx];
 233
 234                 subreq = wb_lookupsid_send(state, state->ev, sid);
 235                 if (tevent_req_nomem(subreq, req)) {
 236                         return false;
 237                 }
 238                 tevent_req_set_callback(subreq, wb_lookupsids_single_done,
 239                                         req);
 240                 return true;
 241         }
 242
 243         tevent_req_done(req);
 244         return false;
 245 }
 246
 247 /*
 248  * Decide whether to do bulk lookupsids. We have optimizations for
 249  * passdb via lookuprids and to remote DCs via lookupsids.
 250  */
 251
 252 static bool wb_lookupsids_bulk(const struct dom_sid *sid)
 253 {
 254         if (sid->num_auths != 5) {
 255                 /*
 256                  * Only do "S-1-5-21-x-y-z-rid" domains via bulk
 257                  * lookup
 258                  */
 259                 DEBUG(10, ("No bulk setup for SID %s with %d subauths\n",
 260                            sid_string_dbg(sid), sid->num_auths));
 261                 return false;
 262         }
 263
 264         if (sid_check_is_in_our_sam(sid)) {
 265                 /*
 266                  * Passdb lookup via lookuprids
 267                  */
 268                 DEBUG(10, ("%s is in our domain\n", sid_string_tos(sid)));
 269                 return true;
 270         }
 271
 272         if (IS_DC) {
 273                 /*
 274                  * Bulk lookups to trusted DCs
 275                  */
 276                 return (find_domain_from_sid_noinit(sid) != NULL);
 277         }
 278
 279         if (lp_server_role() != ROLE_DOMAIN_MEMBER) {
 280                 /*
 281                  * Don't do bulk lookups as standalone, the only bulk
 282                  * lookup left is for domain members.
 283                  */
 284                 return false;
 285         }
 286
 287         if (sid_check_is_in_unix_groups(sid) ||
 288             sid_check_is_unix_groups(sid) ||
 289             sid_check_is_in_unix_users(sid) ||
 290             sid_check_is_unix_users(sid) ||
 291             sid_check_is_in_builtin(sid) ||
 292             sid_check_is_builtin(sid) ||
 293             sid_check_is_wellknown_domain(sid, NULL) ||
 294             sid_check_is_in_wellknown_domain(sid))
 295         {
 296                 /*
 297                  * These are locally done piece by piece anyway, no
 298                  * need for bulk optimizations.
 299                  */
 300                 return false;
 301         }
 302
 303         /*
 304          * All other SIDs are sent to the DC we're connected to as
 305          * member via a single lsa_lookupsids call.
 306          */
 307         return true;
 308 }
 309
 310 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
 311         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
 312         struct wb_lookupsids_domain **pdomains, uint32_t num_sids)
 313 {
 314         struct wb_lookupsids_domain *domains, *domain;
 315         struct winbindd_domain *wb_domain;
 316         uint32_t i, num_domains;
 317
 318         if (!wb_lookupsids_bulk(sid)) {
 319                 return NULL;
 320         }
 321
 322         domains = *pdomains;
 323         num_domains = talloc_array_length(domains);
 324
 325         wb_domain = find_lookup_domain_from_sid(sid);
 326         if (wb_domain == NULL) {
 327                 return NULL;
 328         }
 329
 330         for (i=0; i<num_domains; i++) {
 331                 if (domains[i].domain != wb_domain) {
 332                         continue;
 333                 }
 334
 335                 if (!domains[i].domain->internal) {
 336                         /*
 337                          * If it's not our local sam,
 338                          * we can re-use the domain without
 339                          * checking the sid.
 340                          *
 341                          * Note the wb_lookupsids_bulk() above
 342                          * already catched special SIDs,
 343                          * e.g. the unix and builtin domains.
 344                          */
 345                         return &domains[i];
 346                 }
 347
 348                 if (dom_sid_compare_domain(sid, &domains[i].domain->sid) == 0) {
 349                         /*
 350                          * If it's out local sam we can also use it.
 351                          */
 352                         return &domains[i];
 353                 }
 354
 355                 /*
 356                  * I'm not sure if this can be triggered,
 357                  * as wb_lookupsids_bulk() should also catch this,
 358                  * but we need to make sure that we don't use
 359                  * wbint_LookupRids() without a SID match.
 360                  */
 361                 return NULL;
 362         }
 363
 364         domains = talloc_realloc(
 365                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains+1);
 366         if (domains == NULL) {
 367                 return NULL;
 368         }
 369         *pdomains = domains;
 370
 371         domain = &domains[num_domains];
 372         domain->domain = wb_domain;
 373
 374         domain->sids.sids = talloc_array(domains, struct lsa_SidPtr, num_sids);
 375         if (domains->sids.sids == NULL) {
 376                 goto fail;
 377         }
 378         domain->sids.num_sids = 0;
 379
 380         domain->sid_indexes = talloc_array(domains, uint32_t, num_sids);
 381         if (domain->sid_indexes == NULL) {
 382                 TALLOC_FREE(domain->sids.sids);
 383                 goto fail;
 384         }
 385         return domain;
 386
 387 fail:
 388         /*
 389          * Realloc to the state it was in before
 390          */
 391         *pdomains = talloc_realloc(
 392                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains);
 393         return NULL;
 394 }
 395
 396 static bool wb_lookupsids_find_dom_idx(struct lsa_DomainInfo *domain,
 397                                        struct lsa_RefDomainList *list,
 398                                        uint32_t *idx)
 399 {
 400         uint32_t i;
 401         struct lsa_DomainInfo *new_domain;
 402
 403         for (i=0; i<list->count; i++) {
 404                 if (dom_sid_equal(domain->sid, list->domains[i].sid)) {
 405                         *idx = i;
 406                         return true;
 407                 }
 408         }
 409
 410         new_domain = &list->domains[list->count];
 411
 412         new_domain->name.string = talloc_strdup(
 413                 list->domains, domain->name.string);
 414         if (new_domain->name.string == NULL) {
 415                 return false;
 416         }
 417
 418         new_domain->sid = dom_sid_dup(list->domains, domain->sid);
 419         if (new_domain->sid == NULL) {
 420                 return false;
 421         }
 422
 423         *idx = list->count;
 424         list->count += 1;
 425         return true;
 426 }
 427
 428 static bool wb_lookupsids_move_name(struct lsa_RefDomainList *src_domains,
 429                                     struct lsa_TranslatedName *src_name,
 430                                     struct lsa_RefDomainList *dst_domains,
 431                                     struct lsa_TransNameArray *dst_names,
 432                                     uint32_t dst_name_index)
 433 {
 434         struct lsa_TranslatedName *dst_name;
 435         struct lsa_DomainInfo *src_domain;
 436         uint32_t src_domain_index;
 437         uint32_t dst_domain_index = UINT32_MAX;
 438         bool ok;
 439
 440         src_domain_index = src_name->sid_index;
 441         if ((src_domain_index != UINT32_MAX) && (src_domains != NULL)) {
 442                 if (src_domain_index >= src_domains->count) {
 443                         return false;
 444                 }
 445                 src_domain = &src_domains->domains[src_domain_index];
 446
 447                 ok = wb_lookupsids_find_dom_idx(src_domain,
 448                                                 dst_domains,
 449                                                 &dst_domain_index);
 450                 if (!ok) {
 451                         return false;
 452                 }
 453         }
 454
 455         dst_name = &dst_names->names[dst_name_index];
 456
 457         dst_name->sid_type = src_name->sid_type;
 458         dst_name->name.string = talloc_move(dst_names->names,
 459                                             &src_name->name.string);
 460         dst_name->sid_index = dst_domain_index;
 461         dst_names->count += 1;
 462
 463         return true;
 464 }
 465
 466 static void wb_lookupsids_done(struct tevent_req *subreq)
 467 {
 468         struct tevent_req *req = tevent_req_callback_data(
 469                 subreq, struct tevent_req);
 470         struct wb_lookupsids_state *state = tevent_req_data(
 471                 req, struct wb_lookupsids_state);
 472         struct wb_lookupsids_domain *d;
 473         uint32_t i;
 474
 475         NTSTATUS status, result;
 476
 477         status = dcerpc_wbint_LookupSids_recv(subreq, state, &result);
 478         TALLOC_FREE(subreq);
 479         if (tevent_req_nterror(req, status)) {
 480                 return;
 481         }
 482         if (NT_STATUS_LOOKUP_ERR(result)) {
 483                 tevent_req_nterror(req, result);
 484                 return;
 485         }
 486
 487         /*
 488          * Look at the individual states in the translated names.
 489          */
 490
 491         d = &state->domains[state->domains_done];
 492
 493         for (i=0; i<state->tmp_names.count; i++) {
 494                 uint32_t res_sid_index = d->sid_indexes[i];
 495
 496                 if (!wb_lookupsids_move_name(
 497                             &state->tmp_domains, &state->tmp_names.names[i],
 498                             state->res_domains, state->res_names,
 499                             res_sid_index)) {
 500                         tevent_req_oom(req);
 501                         return;
 502                 }
 503         }
 504         state->domains_done += 1;
 505         wb_lookupsids_next(req, state);
 506 }
 507
 508 static void wb_lookupsids_single_done(struct tevent_req *subreq)
 509 {
 510         struct tevent_req *req = tevent_req_callback_data(
 511                 subreq, struct tevent_req);
 512         struct wb_lookupsids_state *state = tevent_req_data(
 513                 req, struct wb_lookupsids_state);
 514         const char *domain_name = NULL;
 515         const char *name = NULL;
 516         enum lsa_SidType type;
 517         uint32_t res_sid_index;
 518         uint32_t src_rid;
 519
 520         struct dom_sid src_domain_sid;
 521         struct lsa_DomainInfo src_domain;
 522         struct lsa_RefDomainList src_domains;
 523         struct lsa_RefDomainList *psrc_domains = NULL;
 524         struct lsa_TranslatedName src_name;
 525
 526         uint32_t domain_idx = UINT32_MAX;
 527         NTSTATUS status;
 528         bool ok;
 529
 530         status = wb_lookupsid_recv(subreq, talloc_tos(), &type,
 531                                    &domain_name, &name);
 532         TALLOC_FREE(subreq);
 533         if (NT_STATUS_LOOKUP_ERR(status)) {
 534                 tevent_req_nterror(req, status);
 535                 return;
 536         }
 537
 538         res_sid_index = state->single_sids[state->single_sids_done];
 539
 540         if ((domain_name != NULL) && (domain_name[0] != '\0')) {
 541                 /*
 542                  * Build structs with the domain name for
 543                  * wb_lookupsids_move_name(). If we didn't get a name, we will
 544                  * pass NULL and UINT32_MAX.
 545                  */
 546
 547                 sid_copy(&src_domain_sid, &state->sids[res_sid_index]);
 548                 sid_split_rid(&src_domain_sid, &src_rid);
 549
 550                 src_domain.name.string = domain_name;
 551                 src_domain.sid = &src_domain_sid;
 552
 553                 src_domains.count = 1;
 554                 src_domains.domains = &src_domain;
 555                 psrc_domains = &src_domains;
 556
 557                 domain_idx = 0;
 558         }
 559
 560         src_name.sid_type = type;
 561         src_name.name.string = name;
 562         src_name.sid_index = domain_idx;
 563
 564         ok = wb_lookupsids_move_name(psrc_domains,
 565                                      &src_name,
 566                                      state->res_domains,
 567                                      state->res_names,
 568                                      res_sid_index);
 569         if (!ok) {
 570                 tevent_req_oom(req);
 571                 return;
 572         }
 573         state->single_sids_done += 1;
 574         wb_lookupsids_next(req, state);
 575 }
 576
 577 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq)
 578 {
 579         struct tevent_req *req = tevent_req_callback_data(
 580                 subreq, struct tevent_req);
 581         struct wb_lookupsids_state *state = tevent_req_data(
 582                 req, struct wb_lookupsids_state);
 583         struct dom_sid src_domain_sid;
 584         struct lsa_DomainInfo src_domain;
 585         struct lsa_RefDomainList src_domains;
 586         NTSTATUS status, result;
 587         struct wb_lookupsids_domain *d;
 588         uint32_t i;
 589         bool fallback = false;
 590
 591         status = dcerpc_wbint_LookupRids_recv(subreq, state, &result);
 592         TALLOC_FREE(subreq);
 593         if (tevent_req_nterror(req, status)) {
 594                 return;
 595         }
 596
 597         d = &state->domains[state->domains_done];
 598
 599         if (NT_STATUS_IS_ERR(result)) {
 600                 fallback = true;
 601         } else if (state->rid_names.num_principals != d->sids.num_sids) {
 602                 fallback = true;
 603         }
 604
 605         if (fallback) {
 606                 for (i=0; i < d->sids.num_sids; i++) {
 607                         uint32_t res_sid_index = d->sid_indexes[i];
 608
 609                         state->single_sids[state->num_single_sids] =
 610                                 res_sid_index;
 611                         state->num_single_sids += 1;
 612                 }
 613                 state->domains_done += 1;
 614                 wb_lookupsids_next(req, state);
 615                 return;
 616         }
 617
 618         /*
 619          * Look at the individual states in the translated names.
 620          */
 621
 622         sid_copy(&src_domain_sid, get_global_sam_sid());
 623         src_domain.name.string = get_global_sam_name();
 624         src_domain.sid = &src_domain_sid;
 625         src_domains.count = 1;
 626         src_domains.domains = &src_domain;
 627
 628         for (i=0; i<state->rid_names.num_principals; i++) {
 629                 struct lsa_TranslatedName src_name;
 630                 uint32_t res_sid_index;
 631
 632                 /*
 633                  * Fake up structs for wb_lookupsids_move_name
 634                  */
 635                 res_sid_index = d->sid_indexes[i];
 636
 637                 src_name.sid_type = state->rid_names.principals[i].type;
 638                 src_name.name.string = state->rid_names.principals[i].name;
 639                 src_name.sid_index = 0;
 640
 641                 if (!wb_lookupsids_move_name(
 642                             &src_domains, &src_name,
 643                             state->res_domains, state->res_names,
 644                             res_sid_index)) {
 645                         tevent_req_oom(req);
 646                         return;
 647                 }
 648         }
 649
 650         state->domains_done += 1;
 651         wb_lookupsids_next(req, state);
 652 }
 653
 654 NTSTATUS wb_lookupsids_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 655                             struct lsa_RefDomainList **domains,
 656                             struct lsa_TransNameArray **names)
 657 {
 658         struct wb_lookupsids_state *state = tevent_req_data(
 659                 req, struct wb_lookupsids_state);
 660         NTSTATUS status;
 661
 662         if (tevent_req_is_nterror(req, &status)) {
 663                 return status;
 664         }
 665
 666         /*
 667          * The returned names need to match the given sids,
 668          * if not we have a bug in the code!
 669          *
 670          */
 671         if (state->res_names->count != state->num_sids) {
 672                 DEBUG(0, ("res_names->count = %d, expected %d\n",
 673                           state->res_names->count, state->num_sids));
 674                 return NT_STATUS_INTERNAL_ERROR;
 675         }
 676
 677         /*
 678          * Not strictly needed, but it might make debugging in the callers
 679          * easier in future, if the talloc_array_length() returns the
 680          * expected result...
 681          */
 682         state->res_domains->domains = talloc_realloc(state->res_domains,
 683                                                      state->res_domains->domains,
 684                                                      struct lsa_DomainInfo,
 685                                                      state->res_domains->count);
 686
 687         *domains = talloc_move(mem_ctx, &state->res_domains);
 688         *names = talloc_move(mem_ctx, &state->res_names);
 689         return NT_STATUS_OK;
 690 }