"good" : "bad"));
done:
- state->response.data.auth.nt_status = NT_STATUS_V(result);
- fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
- fstrcpy(state->response.data.auth.error_string, nt_errstr(result));
- state->response.data.auth.pam_error = nt_status_to_pam(result);
+ set_auth_errors(&state->response, result);
DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Checking the trust account password returned %s\n",
state->response.data.auth.nt_status_string));
return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
}
+/* Helpers for listing user and group names */
+
+const char *ent_type_strings[] = {"users",
+ "groups"};
+
+static const char *get_ent_type_string(enum ent_type type)
+{
+ return ent_type_strings[type];
+}
+
+struct listent_state {
+ TALLOC_CTX *mem_ctx;
+ struct winbindd_cli_state *cli_state;
+ enum ent_type type;
+ int domain_count;
+ char *extra_data;
+ uint32_t extra_data_len;
+};
+
+static void listent_recv(void *private_data, bool success, fstring dom_name,
+ char *extra_data);
+
+/* List domain users/groups without mapping to unix ids */
+void winbindd_list_ent(struct winbindd_cli_state *state, enum ent_type type)
+{
+ struct winbindd_domain *domain;
+ const char *which_domain;
+ struct listent_state *ent_state;
+
+ DEBUG(3, ("[%5lu]: list %s\n", (unsigned long)state->pid,
+ get_ent_type_string(type)));
+
+ /* Ensure null termination */
+ state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
+ which_domain = state->request.domain_name;
+
+ /* Initialize listent_state */
+ ent_state = TALLOC_P(state->mem_ctx, struct listent_state);
+ if (ent_state == NULL) {
+ DEBUG(0, ("talloc failed\n"));
+ request_error(state);
+ return;
+ }
+
+ ent_state->mem_ctx = state->mem_ctx;
+ ent_state->cli_state = state;
+ ent_state->type = type;
+ ent_state->domain_count = 0;
+ ent_state->extra_data = NULL;
+ ent_state->extra_data_len = 0;
+
+ /* Must count the full list of expected domains before we request data
+ * from any of them. Otherwise it's possible for a connection to the
+ * first domain to fail, call listent_recv(), and return to the
+ * client without checking any other domains. */
+ for (domain = domain_list(); domain; domain = domain->next) {
+ /* if we have a domain name restricting the request and this
+ one in the list doesn't match, then just bypass the remainder
+ of the loop */
+ if ( *which_domain && !strequal(which_domain, domain->name) )
+ continue;
+
+ ent_state->domain_count++;
+ }
+
+ /* Make sure we're enumerating at least one domain */
+ if (!ent_state->domain_count) {
+ request_ok(state);
+ return;
+ }
+
+ /* Enumerate list of trusted domains and request user/group list from
+ * each */
+ for (domain = domain_list(); domain; domain = domain->next) {
+ if ( *which_domain && !strequal(which_domain, domain->name) )
+ continue;
+
+ winbindd_listent_async(state->mem_ctx, domain,
+ listent_recv, ent_state, type);
+ }
+}
+
+static void listent_recv(void *private_data, bool success, fstring dom_name,
+ char *extra_data)
+{
+ /* extra_data comes to us as a '\0' terminated string of comma
+ separated users or groups */
+ struct listent_state *state = talloc_get_type_abort(
+ private_data, struct listent_state);
+
+ /* Append users/groups from one domain onto the whole list */
+ if (extra_data) {
+ DEBUG(5, ("listent_recv: %s returned %s.\n",
+ dom_name, get_ent_type_string(state->type)));
+ if (!state->extra_data)
+ state->extra_data = talloc_asprintf(state->mem_ctx,
+ "%s", extra_data);
+ else
+ state->extra_data = talloc_asprintf_append(
+ state->extra_data,
+ ",%s", extra_data);
+ /* Add one for the '\0' and each additional ',' */
+ state->extra_data_len += strlen(extra_data) + 1;
+ }
+ else {
+ DEBUG(5, ("listent_recv: %s returned no %s.\n",
+ dom_name, get_ent_type_string(state->type)));
+ }
+
+ if (--state->domain_count)
+ /* Still waiting for some child domains to return */
+ return;
+
+ /* Return list of all users/groups to the client */
+ if (state->extra_data) {
+ state->cli_state->response.extra_data.data =
+ SMB_STRDUP(state->extra_data);
+ state->cli_state->response.length += state->extra_data_len;
+ }
+
+ request_ok(state->cli_state);
+}
+
+/* Constants and helper functions for determining domain trust types */
+
+enum trust_type {
+ EXTERNAL = 0,
+ FOREST,
+ IN_FOREST,
+ NONE,
+};
+
+const char *trust_type_strings[] = {"External",
+ "Forest",
+ "In Forest",
+ "None"};
+
+static enum trust_type get_trust_type(struct winbindd_tdc_domain *domain)
+{
+ if (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN)
+ return EXTERNAL;
+ else if (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)
+ return FOREST;
+ else if (((domain->trust_flags & NETR_TRUST_FLAG_IN_FOREST) == NETR_TRUST_FLAG_IN_FOREST) &&
+ ((domain->trust_flags & NETR_TRUST_FLAG_PRIMARY) == 0x0))
+ return IN_FOREST;
+ return NONE;
+}
+
+static const char *get_trust_type_string(struct winbindd_tdc_domain *domain)
+{
+ return trust_type_strings[get_trust_type(domain)];
+}
+
+static bool trust_is_inbound(struct winbindd_tdc_domain *domain)
+{
+ return (domain->trust_flags == 0x0) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_IN_FOREST) ==
+ NETR_TRUST_FLAG_IN_FOREST) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_INBOUND) ==
+ NETR_TRUST_FLAG_INBOUND);
+}
+
+static bool trust_is_outbound(struct winbindd_tdc_domain *domain)
+{
+ return (domain->trust_flags == 0x0) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_IN_FOREST) ==
+ NETR_TRUST_FLAG_IN_FOREST) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_OUTBOUND) ==
+ NETR_TRUST_FLAG_OUTBOUND);
+}
+
+static bool trust_is_transitive(struct winbindd_tdc_domain *domain)
+{
+ if ((domain->trust_attribs == NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE) ||
+ (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) ||
+ (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL))
+ return False;
+ return True;
+}
+
void winbindd_list_trusted_domains(struct winbindd_cli_state *state)
{
- struct winbindd_domain *d = NULL;
+ struct winbindd_tdc_domain *dom_list = NULL;
+ struct winbindd_tdc_domain *d = NULL;
+ size_t num_domains = 0;
int extra_data_len = 0;
char *extra_data = NULL;
+ int i = 0;
DEBUG(3, ("[%5lu]: list trusted domains\n",
(unsigned long)state->pid));
- for ( d=domain_list(); d; d=d->next ) {
+ if( !wcache_tdc_fetch_list( &dom_list, &num_domains )) {
+ request_error(state);
+ goto done;
+ }
+
+ for ( i = 0; i < num_domains; i++ ) {
+ struct winbindd_domain *domain;
+ bool is_online = true;
+
+ d = &dom_list[i];
+ domain = find_domain_from_name_noinit(d->domain_name);
+ if (domain) {
+ is_online = domain->online;
+ }
+
if ( !extra_data ) {
- extra_data = talloc_asprintf(state->mem_ctx, "%s\\%s\\%s",
- d->name,
- d->alt_name ? d->alt_name : d->name,
- sid_string_static(&d->sid));
+ extra_data = talloc_asprintf(state->mem_ctx,
+ "%s\\%s\\%s\\%s\\%s\\%s\\%s\\%s",
+ d->domain_name,
+ d->dns_name ? d->dns_name : d->domain_name,
+ sid_string_talloc(state->mem_ctx, &d->sid),
+ get_trust_type_string(d),
+ trust_is_transitive(d) ? "Yes" : "No",
+ trust_is_inbound(d) ? "Yes" : "No",
+ trust_is_outbound(d) ? "Yes" : "No",
+ is_online ? "Online" : "Offline" );
} else {
- extra_data = talloc_asprintf(state->mem_ctx, "%s\n%s\\%s\\%s",
+ extra_data = talloc_asprintf(state->mem_ctx,
+ "%s\n%s\\%s\\%s\\%s\\%s\\%s\\%s\\%s",
extra_data,
- d->name,
- d->alt_name ? d->alt_name : d->name,
- sid_string_static(&d->sid));
+ d->domain_name,
+ d->dns_name ? d->dns_name : d->domain_name,
+ sid_string_talloc(state->mem_ctx, &d->sid),
+ get_trust_type_string(d),
+ trust_is_transitive(d) ? "Yes" : "No",
+ trust_is_inbound(d) ? "Yes" : "No",
+ trust_is_outbound(d) ? "Yes" : "No",
+ is_online ? "Online" : "Offline" );
}
}
state->response.length += extra_data_len+1;
}
- TALLOC_FREE( extra_data );
-
request_ok(state);
+done:
+ TALLOC_FREE( dom_list );
+ TALLOC_FREE( extra_data );
}
enum winbindd_result winbindd_dual_list_trusted_domains(struct winbindd_domain *domain,
int extra_data_len = 0;
char *extra_data;
NTSTATUS result;
- BOOL have_own_domain = False;
+ bool have_own_domain = False;
DEBUG(3, ("[%5lu]: list trusted domains\n",
(unsigned long)state->pid));
extra_data = talloc_strdup(state->mem_ctx, "");
if (num_domains > 0)
- extra_data = talloc_asprintf(state->mem_ctx, "%s\\%s\\%s",
- names[0],
- alt_names[0] ? alt_names[0] : names[0],
- sid_string_static(&sids[0]));
+ extra_data = talloc_asprintf(
+ state->mem_ctx, "%s\\%s\\%s",
+ names[0], alt_names[0] ? alt_names[0] : names[0],
+ sid_string_talloc(state->mem_ctx, &sids[0]));
for (i=1; i<num_domains; i++)
- extra_data = talloc_asprintf(state->mem_ctx, "%s\n%s\\%s\\%s",
- extra_data,
- names[i],
- alt_names[i] ? alt_names[i] : names[i],
- sid_string_static(&sids[i]));
+ extra_data = talloc_asprintf(
+ state->mem_ctx, "%s\n%s\\%s\\%s",
+ extra_data, names[i],
+ alt_names[i] ? alt_names[i] : names[i],
+ sid_string_talloc(state->mem_ctx, &sids[i]));
+
/* add our primary domain */
for (i=0; i<num_domains; i++) {
}
if (state->request.data.list_all_domains && !have_own_domain) {
- extra_data = talloc_asprintf(state->mem_ctx, "%s\n%s\\%s\\%s",
- extra_data,
- domain->name,
- domain->alt_name ? domain->alt_name : domain->name,
- sid_string_static(&domain->sid));
+ extra_data = talloc_asprintf(
+ state->mem_ctx, "%s\n%s\\%s\\%s",
+ extra_data, domain->name,
+ domain->alt_name ? domain->alt_name : domain->name,
+ sid_string_talloc(state->mem_ctx, &domain->sid));
}
/* This is a bit excessive, but the extra data sooner or later will be
void winbindd_getdcname(struct winbindd_cli_state *state)
{
+ struct winbindd_domain *domain;
+
state->request.domain_name
[sizeof(state->request.domain_name)-1] = '\0';
DEBUG(3, ("[%5lu]: Get DC name for %s\n", (unsigned long)state->pid,
state->request.domain_name));
+ domain = find_domain_from_name_noinit(state->request.domain_name);
+ if (domain && domain->internal) {
+ fstrcpy(state->response.data.dc_name, global_myname());
+ request_ok(state);
+ return;
+ }
+
sendto_domain(state, find_our_domain());
}
enum winbindd_result winbindd_dual_getdcname(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
{
- fstring dcname_slash;
- char *p;
+ const char *dcname_slash = NULL;
+ const char *p;
struct rpc_pipe_client *netlogon_pipe;
NTSTATUS result;
WERROR werr;
unsigned int orig_timeout;
+ struct winbindd_domain *req_domain;
state->request.domain_name
[sizeof(state->request.domain_name)-1] = '\0';
/* This call can take a long time - allow the server to time out.
35 seconds should do it. */
- orig_timeout = cli_set_timeout(netlogon_pipe->cli, 35000);
+ orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
- werr = rpccli_netlogon_getanydcname(netlogon_pipe, state->mem_ctx, domain->dcname,
- state->request.domain_name,
- dcname_slash);
+ req_domain = find_domain_from_name_noinit(state->request.domain_name);
+ if (req_domain == domain) {
+ result = rpccli_netr_GetDcName(netlogon_pipe,
+ state->mem_ctx,
+ domain->dcname,
+ state->request.domain_name,
+ &dcname_slash,
+ &werr);
+ } else {
+ result = rpccli_netr_GetAnyDCName(netlogon_pipe,
+ state->mem_ctx,
+ domain->dcname,
+ state->request.domain_name,
+ &dcname_slash,
+ &werr);
+ }
/* And restore our original timeout. */
- cli_set_timeout(netlogon_pipe->cli, orig_timeout);
+ rpccli_set_timeout(netlogon_pipe, orig_timeout);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ DEBUG(5,("Error requesting DCname for domain %s: %s\n",
+ state->request.domain_name, nt_errstr(result)));
+ return WINBINDD_ERROR;
+ }
if (!W_ERROR_IS_OK(werr)) {
DEBUG(5, ("Error requesting DCname for domain %s: %s\n",
- state->request.domain_name, dos_errstr(werr)));
+ state->request.domain_name, win_errstr(werr)));
return WINBINDD_ERROR;
}
return WINBINDD_OK;
}
-static struct winbindd_child static_locator_child;
-
-void init_locator_child(void)
-{
- setup_domain_child(NULL, &static_locator_child, "locator");
-}
-
-struct winbindd_child *locator_child(void)
-{
- return &static_locator_child;
-}
-
-void winbindd_dsgetdcname(struct winbindd_cli_state *state)
-{
- state->request.domain_name
- [sizeof(state->request.domain_name)-1] = '\0';
-
- DEBUG(3, ("[%5lu]: DsGetDcName for %s\n", (unsigned long)state->pid,
- state->request.domain_name));
-
- sendto_child(state, locator_child());
-}
-
-enum winbindd_result winbindd_dual_dsgetdcname(struct winbindd_domain *domain,
- struct winbindd_cli_state *state)
-{
- NTSTATUS result;
- struct DS_DOMAIN_CONTROLLER_INFO *info = NULL;
- const char *dc = NULL;
-
- state->request.domain_name
- [sizeof(state->request.domain_name)-1] = '\0';
-
- DEBUG(3, ("[%5lu]: DsGetDcName for %s\n", (unsigned long)state->pid,
- state->request.domain_name));
-
- result = DsGetDcName(state->mem_ctx, NULL, state->request.domain_name,
- NULL, NULL, state->request.flags, &info);
-
- if (!NT_STATUS_IS_OK(result)) {
- return WINBINDD_ERROR;
- }
-
- if (info->domain_controller_address) {
- dc = info->domain_controller_address;
- if ((dc[0] == '\\') && (dc[1] == '\\')) {
- dc += 2;
- }
- }
-
- if ((!dc || !is_ipaddress(dc)) && info->domain_controller_name) {
- dc = info->domain_controller_name;
- }
-
- if (!dc || !*dc) {
- return WINBINDD_ERROR;
- }
-
- fstrcpy(state->response.data.dc_name, dc);
-
- return WINBINDD_OK;
-}
-
-
struct sequence_state {
TALLOC_CTX *mem_ctx;
struct winbindd_cli_state *cli_state;
char *extra_data;
};
-static void sequence_recv(void *private_data, BOOL success);
+static void sequence_recv(void *private_data, bool success);
void winbindd_show_sequence(struct winbindd_cli_state *state)
{
sequence_recv, seq);
}
-static void sequence_recv(void *private_data, BOOL success)
+static void sequence_recv(void *private_data, bool success)
{
struct sequence_state *state =
(struct sequence_state *)private_data;
uint32 seq = DOM_SEQUENCE_NONE;
if ((success) && (state->response->result == WINBINDD_OK))
- seq = state->response->data.domain_info.sequence_number;
+ seq = state->response->data.sequence_number;
if (seq == DOM_SEQUENCE_NONE) {
state->extra_data = talloc_asprintf(state->mem_ctx,
domain->methods->sequence_number(domain, &domain->sequence_number);
- state->response.data.domain_info.sequence_number =
+ state->response.data.sequence_number =
domain->sequence_number;
return WINBINDD_OK;
struct winbindd_cli_state *cli_state;
};
-static void domain_info_init_recv(void *private_data, BOOL success);
+static void domain_info_init_recv(void *private_data, bool success);
void winbindd_domain_info(struct winbindd_cli_state *state)
{
domain->name);
fstrcpy(state->response.data.domain_info.alt_name,
domain->alt_name);
- fstrcpy(state->response.data.domain_info.sid,
- sid_string_static(&domain->sid));
+ sid_to_fstring(state->response.data.domain_info.sid, &domain->sid);
state->response.data.domain_info.native_mode =
domain->native_mode;
domain->active_directory;
state->response.data.domain_info.primary =
domain->primary;
- state->response.data.domain_info.sequence_number =
- domain->sequence_number;
request_ok(state);
}
-static void domain_info_init_recv(void *private_data, BOOL success)
+static void domain_info_init_recv(void *private_data, bool success)
{
struct domain_info_state *istate =
(struct domain_info_state *)private_data;
domain->name);
fstrcpy(state->response.data.domain_info.alt_name,
domain->alt_name);
- fstrcpy(state->response.data.domain_info.sid,
- sid_string_static(&domain->sid));
+ sid_to_fstring(state->response.data.domain_info.sid, &domain->sid);
state->response.data.domain_info.native_mode =
domain->native_mode;
domain->active_directory;
state->response.data.domain_info.primary =
domain->primary;
- state->response.data.domain_info.sequence_number =
- domain->sequence_number;
request_ok(state);
}
DEBUG(3, ("[%5lu]: request misc info\n", (unsigned long)state->pid));
state->response.data.info.winbind_separator = *lp_winbind_separator();
- fstrcpy(state->response.data.info.samba_version, SAMBA_VERSION_STRING);
+ fstrcpy(state->response.data.info.samba_version, samba_version_string());
request_ok(state);
}
git.samba.org / metze / samba / wip.git / blobdiff