source3/winbindd/wb_queryuser.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    async queryuser
   4    Copyright (C) Volker Lendecke 2009
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "util/debug.h"
  22 #include "winbindd.h"
  23 #include "librpc/gen_ndr/ndr_winbind_c.h"
  24 #include "../libcli/security/security.h"
  25 #include "libsmb/samlogon_cache.h"
  26 #include "librpc/gen_ndr/ndr_winbind.h"
  27
  28 struct wb_queryuser_state {
  29         struct tevent_context *ev;
  30         struct wbint_userinfo *info;
  31         const struct wb_parent_idmap_config *idmap_cfg;
  32         bool tried_dclookup;
  33 };
  34
  35 static void wb_queryuser_idmap_setup_done(struct tevent_req *subreq);
  36 static void wb_queryuser_got_uid(struct tevent_req *subreq);
  37 static void wb_queryuser_got_domain(struct tevent_req *subreq);
  38 static void wb_queryuser_got_dc(struct tevent_req *subreq);
  39 static void wb_queryuser_got_gid(struct tevent_req *subreq);
  40 static void wb_queryuser_got_group_name(struct tevent_req *subreq);
  41 static void wb_queryuser_done(struct tevent_req *subreq);
  42
  43 struct tevent_req *wb_queryuser_send(TALLOC_CTX *mem_ctx,
  44                                      struct tevent_context *ev,
  45                                      const struct dom_sid *user_sid)
  46 {
  47         struct tevent_req *req, *subreq;
  48         struct wb_queryuser_state *state;
  49         struct wbint_userinfo *info;
  50         struct dom_sid_buf buf;
  51
  52         req = tevent_req_create(mem_ctx, &state, struct wb_queryuser_state);
  53         if (req == NULL) {
  54                 return NULL;
  55         }
  56         D_INFO("WB command queryuser start.\nQuery user sid %s\n",
  57                dom_sid_str_buf(user_sid, &buf));
  58         state->ev = ev;
  59
  60         state->info = talloc_zero(state, struct wbint_userinfo);
  61         if (tevent_req_nomem(state->info, req)) {
  62                 return tevent_req_post(req, ev);
  63         }
  64         info = state->info;
  65
  66         info->primary_gid = (gid_t)-1;
  67
  68         sid_copy(&info->user_sid, user_sid);
  69
  70         subreq = wb_parent_idmap_setup_send(state, state->ev);
  71         if (tevent_req_nomem(subreq, req)) {
  72                 return tevent_req_post(req, ev);
  73         }
  74         tevent_req_set_callback(subreq, wb_queryuser_idmap_setup_done, req);
  75         return req;
  76 }
  77
  78 static void wb_queryuser_idmap_setup_done(struct tevent_req *subreq)
  79 {
  80         struct tevent_req *req = tevent_req_callback_data(
  81                 subreq, struct tevent_req);
  82         struct wb_queryuser_state *state = tevent_req_data(
  83                 req, struct wb_queryuser_state);
  84         NTSTATUS status;
  85         struct dom_sid_buf buf;
  86
  87         status = wb_parent_idmap_setup_recv(subreq, &state->idmap_cfg);
  88         TALLOC_FREE(subreq);
  89         if (tevent_req_nterror(req, status)) {
  90                 D_WARNING("wb_parent_idmap_setup_recv() failed with %s.\n",
  91                           nt_errstr(status));
  92                 return;
  93         }
  94
  95         D_DEBUG("Convert the user SID %s to XID.\n",
  96                 dom_sid_str_buf(&state->info->user_sid, &buf));
  97         subreq = wb_sids2xids_send(
  98                 state, state->ev, &state->info->user_sid, 1);
  99         if (tevent_req_nomem(subreq, req)) {
 100                 return;
 101         }
 102         tevent_req_set_callback(subreq, wb_queryuser_got_uid, req);
 103         return;
 104 }
 105
 106 static void wb_queryuser_got_uid(struct tevent_req *subreq)
 107 {
 108         struct tevent_req *req = tevent_req_callback_data(
 109                 subreq, struct tevent_req);
 110         struct wb_queryuser_state *state = tevent_req_data(
 111                 req, struct wb_queryuser_state);
 112         struct wbint_userinfo *info = state->info;
 113         struct netr_SamInfo3 *info3;
 114         struct dcerpc_binding_handle *child_binding_handle = NULL;
 115         struct unixid xid;
 116         uint32_t user_rid = 0;
 117         NTSTATUS status;
 118         struct dom_sid_buf buf, buf1;
 119
 120         status = wb_sids2xids_recv(subreq, &xid, 1);
 121         TALLOC_FREE(subreq);
 122         if (tevent_req_nterror(req, status)) {
 123                 D_WARNING("wb_sids2xids_recv() failed with %s.\n",
 124                           nt_errstr(status));
 125                 return;
 126         }
 127
 128         if ((xid.type != ID_TYPE_UID) && (xid.type != ID_TYPE_BOTH)) {
 129                 D_WARNING("XID type is %d, should be ID_TYPE_UID or ID_TYPE_BOTH.\n",
 130                           xid.type);
 131                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
 132                 return;
 133         }
 134
 135         D_DEBUG("Received XID %"PRIu32" for SID %s.\n",
 136                 xid.id,
 137                 dom_sid_str_buf(&info->user_sid, &buf1));
 138         info->uid = xid.id;
 139
 140         /*
 141          * Default the group sid to "Domain Users" in the user's
 142          * domain. The samlogon cache or the query_user call later on
 143          * can override this.
 144          * TODO: There is still missing functionality to set the correct group
 145          * sid using samlogon cache (needs to use S4USelf).
 146          * Once this is done, remove the workaround in test_membership_user() in
 147          * source4/torture/local/nss_tests.c
 148          */
 149         sid_copy(&info->group_sid, &info->user_sid);
 150         sid_split_rid(&info->group_sid, &user_rid);
 151         sid_append_rid(&info->group_sid,
 152                        user_rid == DOMAIN_RID_GUEST ? DOMAIN_RID_GUESTS
 153                                                     : DOMAIN_RID_USERS);
 154
 155         D_DEBUG("Preconfigured 'Domain Users' RID %u was used to create group SID %s from user SID %s.\n",
 156                 DOMAIN_RID_USERS,
 157                 dom_sid_str_buf(&info->group_sid, &buf),
 158                 dom_sid_str_buf(&info->user_sid, &buf1));
 159
 160         info->homedir = talloc_strdup(info, lp_template_homedir());
 161         D_DEBUG("Setting 'homedir' to the template '%s'.\n", info->homedir);
 162         if (tevent_req_nomem(info->homedir, req)) {
 163                 return;
 164         }
 165
 166         info->shell = talloc_strdup(info, lp_template_shell());
 167         D_DEBUG("Setting 'shell' to the template '%s'.\n", info->shell);
 168         if (tevent_req_nomem(info->shell, req)) {
 169                 return;
 170         }
 171
 172         info3 = netsamlogon_cache_get(state, &info->user_sid);
 173         if (info3 != NULL) {
 174                 D_DEBUG("Filling data received from netsamlogon_cache\n");
 175                 sid_compose(&info->group_sid, info3->base.domain_sid,
 176                             info3->base.primary_gid);
 177                 info->acct_name = talloc_move(
 178                         info, &info3->base.account_name.string);
 179                 info->full_name = talloc_move(
 180                         info, &info3->base.full_name.string);
 181
 182                 info->domain_name = talloc_move(
 183                         state, &info3->base.logon_domain.string);
 184
 185                 TALLOC_FREE(info3);
 186         }
 187
 188         NDR_PRINT_DEBUG_LEVEL(DBGLVL_DEBUG, wbint_userinfo, state->info);
 189         if (info->domain_name == NULL) {
 190                 D_DEBUG("Domain name is empty, calling wb_lookupsid_send() to get it.\n");
 191                 subreq = wb_lookupsid_send(state, state->ev, &info->user_sid);
 192                 if (tevent_req_nomem(subreq, req)) {
 193                         return;
 194                 }
 195                 tevent_req_set_callback(subreq, wb_queryuser_got_domain, req);
 196                 return;
 197         }
 198
 199         /*
 200          * Note wb_sids2xids_send/recv was called before,
 201          * so we're sure that wb_parent_idmap_setup_send/recv
 202          * was already called.
 203          */
 204         child_binding_handle = idmap_child_handle();
 205         D_DEBUG("Domain name is set, calling dcerpc_wbint_GetNssInfo_send()\n");
 206         subreq = dcerpc_wbint_GetNssInfo_send(
 207                 state, state->ev, child_binding_handle, info);
 208         if (tevent_req_nomem(subreq, req)) {
 209                 return;
 210         }
 211         tevent_req_set_callback(subreq, wb_queryuser_done, req);
 212 }
 213
 214 static void wb_queryuser_got_domain(struct tevent_req *subreq)
 215 {
 216         struct tevent_req *req = tevent_req_callback_data(
 217                 subreq, struct tevent_req);
 218         struct wb_queryuser_state *state = tevent_req_data(
 219                 req, struct wb_queryuser_state);
 220         struct wbint_userinfo *info = state->info;
 221         enum lsa_SidType type;
 222         struct dcerpc_binding_handle *child_binding_handle = NULL;
 223         NTSTATUS status;
 224
 225         status = wb_lookupsid_recv(subreq, state, &type,
 226                                    &info->domain_name, &info->acct_name);
 227         TALLOC_FREE(subreq);
 228         if (tevent_req_nterror(req, status)) {
 229                 D_WARNING("wb_lookupsid_recv failed with %s.\n",
 230                           nt_errstr(status));
 231                 return;
 232         }
 233
 234         NDR_PRINT_DEBUG_LEVEL(DBGLVL_DEBUG, wbint_userinfo, state->info);
 235         switch (type) {
 236         case SID_NAME_USER:
 237         case SID_NAME_COMPUTER:
 238                 /*
 239                  * user case: we only need the account name from lookup_sids
 240                  */
 241                 break;
 242         case SID_NAME_DOM_GRP:
 243         case SID_NAME_ALIAS:
 244         case SID_NAME_WKN_GRP:
 245                 /*
 246                  * also treat group-type SIDs (they might map to ID_TYPE_BOTH)
 247                  */
 248                 sid_copy(&info->group_sid, &info->user_sid);
 249                 break;
 250         default:
 251                 D_WARNING("Unknown type:%d, return NT_STATUS_NO_SUCH_USER.\n",
 252                           type);
 253                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
 254                 return;
 255         }
 256
 257         /*
 258          * Note wb_sids2xids_send/recv was called before,
 259          * so we're sure that wb_parent_idmap_setup_send/recv
 260          * was already called.
 261          */
 262         child_binding_handle = idmap_child_handle();
 263         D_DEBUG("About to call dcerpc_wbint_GetNssInfo_send()\n");
 264         subreq = dcerpc_wbint_GetNssInfo_send(
 265                 state, state->ev, child_binding_handle, info);
 266         if (tevent_req_nomem(subreq, req)) {
 267                 return;
 268         }
 269         tevent_req_set_callback(subreq, wb_queryuser_done, req);
 270 }
 271
 272 static void wb_queryuser_done(struct tevent_req *subreq)
 273 {
 274         struct tevent_req *req = tevent_req_callback_data(
 275                 subreq, struct tevent_req);
 276         struct wb_queryuser_state *state = tevent_req_data(
 277                 req, struct wb_queryuser_state);
 278         struct wbint_userinfo *info = state->info;
 279         NTSTATUS status, result;
 280         bool need_group_name = false;
 281         const char *tmpl = NULL;
 282
 283         status = dcerpc_wbint_GetNssInfo_recv(subreq, info, &result);
 284         TALLOC_FREE(subreq);
 285         if (tevent_req_nterror(req, status)) {
 286                 D_WARNING("GetNssInfo failed with %s.\n", nt_errstr(status));
 287                 return;
 288         }
 289
 290         if (NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) &&
 291             !state->tried_dclookup) {
 292                 D_DEBUG("GetNssInfo got DOMAIN_CONTROLLER_NOT_FOUND, calling wb_dsgetdcname_send()\n");
 293                 subreq = wb_dsgetdcname_send(
 294                         state, state->ev, state->info->domain_name, NULL, NULL,
 295                         DS_RETURN_DNS_NAME);
 296                 if (tevent_req_nomem(subreq, req)) {
 297                         return;
 298                 }
 299                 tevent_req_set_callback(subreq, wb_queryuser_got_dc, req);
 300                 return;
 301         }
 302
 303         /*
 304          * Ignore failure in "result" here. We'll try to fill in stuff
 305          * that misses further down.
 306          */
 307
 308         if (state->info->primary_gid == (gid_t)-1) {
 309                 D_DEBUG("Calling wb_sids2xids_send() to resolve primary gid.\n");
 310                 subreq = wb_sids2xids_send(
 311                         state, state->ev, &info->group_sid, 1);
 312                 if (tevent_req_nomem(subreq, req)) {
 313                         return;
 314                 }
 315                 tevent_req_set_callback(subreq, wb_queryuser_got_gid, req);
 316                 return;
 317         }
 318
 319         tmpl = lp_template_homedir();
 320         if(strstr_m(tmpl, "%g") || strstr_m(tmpl, "%G")) {
 321                 need_group_name = true;
 322         }
 323         tmpl = lp_template_shell();
 324         if(strstr_m(tmpl, "%g") || strstr_m(tmpl, "%G")) {
 325                 need_group_name = true;
 326         }
 327
 328         if (need_group_name && state->info->primary_group_name == NULL) {
 329                 D_DEBUG("Calling wb_lookupsid_send() to resolve primary group name.\n");
 330                 subreq = wb_lookupsid_send(state, state->ev, &info->group_sid);
 331                 if (tevent_req_nomem(subreq, req)) {
 332                         return;
 333                 }
 334                 tevent_req_set_callback(subreq, wb_queryuser_got_group_name,
 335                                         req);
 336                 return;
 337         }
 338
 339         NDR_PRINT_DEBUG_LEVEL(DBGLVL_DEBUG, wbint_userinfo, state->info);
 340         tevent_req_done(req);
 341 }
 342
 343 static void wb_queryuser_got_dc(struct tevent_req *subreq)
 344 {
 345         struct tevent_req *req = tevent_req_callback_data(
 346                 subreq, struct tevent_req);
 347         struct wb_queryuser_state *state = tevent_req_data(
 348                 req, struct wb_queryuser_state);
 349         struct wbint_userinfo *info = state->info;
 350         struct netr_DsRGetDCNameInfo *dcinfo;
 351         struct dcerpc_binding_handle *child_binding_handle = NULL;
 352         NTSTATUS status;
 353
 354         status = wb_dsgetdcname_recv(subreq, state, &dcinfo);
 355         TALLOC_FREE(subreq);
 356         if (tevent_req_nterror(req, status)) {
 357                 D_WARNING("wb_dsgetdcname_recv() failed with %s.\n",
 358                           nt_errstr(status));
 359                 return;
 360         }
 361
 362         state->tried_dclookup = true;
 363
 364         D_DEBUG("Got DC name, calling wb_dsgetdcname_gencache_set().\n");
 365         status = wb_dsgetdcname_gencache_set(info->domain_name, dcinfo);
 366         if (tevent_req_nterror(req, status)) {
 367                 D_WARNING("wb_dsgetdcname_gencache_set() failed with %s.\n",
 368                           nt_errstr(status));
 369                 return;
 370         }
 371         NDR_PRINT_DEBUG_LEVEL(DBGLVL_DEBUG, wbint_userinfo, state->info);
 372
 373         /*
 374          * Note wb_sids2xids_send/recv was called before,
 375          * so we're sure that wb_parent_idmap_setup_send/recv
 376          * was already called.
 377          */
 378         child_binding_handle = idmap_child_handle();
 379         subreq = dcerpc_wbint_GetNssInfo_send(
 380                 state, state->ev, child_binding_handle, info);
 381         if (tevent_req_nomem(subreq, req)) {
 382                 return;
 383         }
 384         tevent_req_set_callback(subreq, wb_queryuser_done, req);
 385 }
 386
 387 static void wb_queryuser_got_gid(struct tevent_req *subreq)
 388 {
 389         struct tevent_req *req = tevent_req_callback_data(
 390                 subreq, struct tevent_req);
 391         struct wb_queryuser_state *state = tevent_req_data(
 392                 req, struct wb_queryuser_state);
 393         struct unixid xid;
 394         NTSTATUS status;
 395         bool need_group_name = false;
 396         const char *tmpl = NULL;
 397         struct dom_sid_buf buf;
 398
 399         status = wb_sids2xids_recv(subreq, &xid, 1);
 400         TALLOC_FREE(subreq);
 401         if (tevent_req_nterror(req, status)) {
 402                 D_WARNING("wb_sids2xids_recv() failed with %s.\n",
 403                           nt_errstr(status));
 404                 return;
 405         }
 406
 407         D_DEBUG("Got XID %"PRIu32" with type %d.\n", xid.id, xid.type);
 408         if ((xid.type != ID_TYPE_GID) && (xid.type != ID_TYPE_BOTH)) {
 409                 D_WARNING("Returning NT_STATUS_NO_SUCH_USER\n"
 410                           "xid.type must be ID_TYPE_UID or ID_TYPE_BOTH.\n");
 411                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
 412                 return;
 413         }
 414
 415         state->info->primary_gid = xid.id;
 416
 417         tmpl = lp_template_homedir();
 418         if(strstr_m(tmpl, "%g") || strstr_m(tmpl, "%G")) {
 419                 need_group_name = true;
 420         }
 421         tmpl = lp_template_shell();
 422         if(strstr_m(tmpl, "%g") || strstr_m(tmpl, "%G")) {
 423                 need_group_name = true;
 424         }
 425
 426         NDR_PRINT_DEBUG_LEVEL(DBGLVL_DEBUG, wbint_userinfo, state->info);
 427
 428         if (need_group_name && state->info->primary_group_name == NULL) {
 429                 D_DEBUG("Calling wb_lookupsid_send for group SID %s.\n",
 430                           dom_sid_str_buf(&state->info->group_sid, &buf));
 431                 subreq = wb_lookupsid_send(state, state->ev,
 432                                            &state->info->group_sid);
 433                 if (tevent_req_nomem(subreq, req)) {
 434                         return;
 435                 }
 436                 tevent_req_set_callback(subreq, wb_queryuser_got_group_name,
 437                                         req);
 438                 return;
 439         }
 440
 441         D_DEBUG("No need to lookup primary group name. Request is done!\n");
 442         tevent_req_done(req);
 443 }
 444
 445 static void wb_queryuser_got_group_name(struct tevent_req *subreq)
 446 {
 447         struct tevent_req *req = tevent_req_callback_data(
 448                 subreq, struct tevent_req);
 449         struct wb_queryuser_state *state = tevent_req_data(
 450                 req, struct wb_queryuser_state);
 451         enum lsa_SidType type;
 452         NTSTATUS status;
 453         const char *domain_name;
 454
 455         status = wb_lookupsid_recv(subreq, state->info, &type, &domain_name,
 456                                    &state->info->primary_group_name);
 457         TALLOC_FREE(subreq);
 458         if (tevent_req_nterror(req, status)) {
 459                 D_WARNING("wb_lookupsid_recv() failed with %s.\n",
 460                           nt_errstr(status));
 461                 return;
 462         }
 463         tevent_req_done(req);
 464 }
 465
 466 NTSTATUS wb_queryuser_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 467                            struct wbint_userinfo **pinfo)
 468 {
 469         struct wb_queryuser_state *state = tevent_req_data(
 470                 req, struct wb_queryuser_state);
 471         NTSTATUS status;
 472
 473         D_INFO("WB command queryuser end.\n");
 474         NDR_PRINT_DEBUG_LEVEL(DBGLVL_INFO, wbint_userinfo, state->info);
 475         if (tevent_req_is_nterror(req, &status)) {
 476                 return status;
 477         }
 478         *pinfo = talloc_move(mem_ctx, &state->info);
 479         return NT_STATUS_OK;
 480 }