python/samba/emulate: PY3 port of samba.tests.emulate.traffic_packet

[samba.git] / source3 / winbindd / wb_getgrsid.c

diff --git a/source3/winbindd/wb_getgrsid.c b/source3/winbindd/wb_getgrsid.c
index 2097539e29cc5d614731daa12e2c0bd0db2c0798..fa26ea805ee1d600e63abc64bf747d218b97face 100644 (file)
--- a/source3/winbindd/wb_getgrsid.c
+++ b/source3/winbindd/wb_getgrsid.c
@@ -19,8 +19,9 @@
 
 #include "includes.h"
 #include "winbindd.h"
-#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "../libcli/security/security.h"
+#include "lib/dbwrap/dbwrap_rbt.h"
 
 struct wb_getgrsid_state {
        struct tevent_context *ev;
@@ -30,7 +31,7 @@ struct wb_getgrsid_state {
        const char *name;
        enum lsa_SidType type;
        gid_t gid;
-       struct talloc_dict *members;
+       struct db_context *members;
 };
 
 static void wb_getgrsid_lookupsid_done(struct tevent_req *subreq);
@@ -53,15 +54,10 @@ struct tevent_req *wb_getgrsid_send(TALLOC_CTX *mem_ctx,
        state->ev = ev;
        state->max_nesting = max_nesting;
 
-       if (lp_winbind_trusted_domains_only()) {
-               struct winbindd_domain *our_domain = find_our_domain();
-
-               if (dom_sid_compare_domain(group_sid, &our_domain->sid) == 0) {
-                       DEBUG(7, ("winbindd_getgrsid: My domain -- rejecting "
-                                 "getgrsid() for %s\n", sid_string_tos(group_sid)));
-                       tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
-                       return tevent_req_post(req, ev);
-               }
+       if (dom_sid_in_domain(&global_sid_Unix_Groups, group_sid)) {
+               /* unmapped Unix groups must be resolved locally */
+               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               return tevent_req_post(req, ev);
        }
 
        subreq = wb_lookupsid_send(state, ev, &state->sid);
@@ -91,6 +87,11 @@ static void wb_getgrsid_lookupsid_done(struct tevent_req *subreq)
        case SID_NAME_DOM_GRP:
        case SID_NAME_ALIAS:
        case SID_NAME_WKN_GRP:
+       /*
+        * also treat user-type SIDS (they might map to ID_TYPE_BOTH)
+        */
+       case SID_NAME_USER:
+       case SID_NAME_COMPUTER:
                break;
        default:
                tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
@@ -111,9 +112,9 @@ static void wb_getgrsid_sid2gid_done(struct tevent_req *subreq)
        struct wb_getgrsid_state *state = tevent_req_data(
                req, struct wb_getgrsid_state);
        NTSTATUS status;
-       struct unixid xid;
+       struct unixid xids[1];
 
-       status = wb_sids2xids_recv(subreq, &xid);
+       status = wb_sids2xids_recv(subreq, xids, ARRAY_SIZE(xids));
        TALLOC_FREE(subreq);
        if (tevent_req_nterror(req, status)) {
                return;
@@ -125,12 +126,52 @@ static void wb_getgrsid_sid2gid_done(struct tevent_req *subreq)
         * by lookupsids). Here we need to filter for the type of object
         * actually requested, in this case uid.
         */
-       if (!(xid.type == ID_TYPE_GID || xid.type == ID_TYPE_BOTH)) {
+       if (!(xids[0].type == ID_TYPE_GID || xids[0].type == ID_TYPE_BOTH)) {
                tevent_req_nterror(req, NT_STATUS_NONE_MAPPED);
                return;
        }
 
-       state->gid = (gid_t)xid.id;
+       state->gid = (gid_t)xids[0].id;
+
+       if (state->type == SID_NAME_USER || state->type == SID_NAME_COMPUTER) {
+               /*
+                * special treatment for a user sid that is
+                * mapped to ID_TYPE_BOTH:
+                * create a group with the sid/xid as only member
+                */
+               const char *name;
+
+               if (xids[0].type != ID_TYPE_BOTH) {
+                       tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
+                       return;
+               }
+
+               state->members = db_open_rbt(state);
+               if (tevent_req_nomem(state->members, req)) {
+                       return;
+               }
+
+               name = fill_domain_username_talloc(talloc_tos(),
+                                                  state->domname,
+                                                  state->name,
+                                                  true /* can_assume */);
+               if (tevent_req_nomem(name, req)) {
+                       return;
+               }
+
+               status = add_member_to_db(state->members, &state->sid, name);
+               if (!NT_STATUS_IS_OK(status)) {
+                       tevent_req_nterror(req, status);
+                       return;
+               }
+
+               tevent_req_done(req);
+               return;
+       }
+
+       /*
+        * the "regular" case of a group type sid.
+        */
 
        subreq = wb_group_members_send(state, state->ev, &state->sid,
                                       state->type, state->max_nesting);
@@ -158,7 +199,7 @@ static void wb_getgrsid_got_members(struct tevent_req *subreq)
 
 NTSTATUS wb_getgrsid_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
                          const char **domname, const char **name, gid_t *gid,
-                         struct talloc_dict **members)
+                         struct db_context **members)
 {
        struct wb_getgrsid_state *state = tevent_req_data(
                req, struct wb_getgrsid_state);