#include "includes.h"
#include "winbindd.h"
#include "secrets.h"
-#include "../libcli/security/dom_sid.h"
+#include "../libcli/security/security.h"
+#include "../libcli/auth/pam_errors.h"
+#include "passdb/machine_sid.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_WINBIND
extern struct winbindd_methods cache_methods;
/**
- * @file winbindd_util.c
+ * @file winbindd_util.cq
*
* Winbind daemon for NT domain authentication nss module.
**/
if (sid == NULL)
return False;
- return (sid_check_is_domain(sid) || sid_check_is_builtin(sid));
+ return (sid_check_is_our_sam(sid) || sid_check_is_builtin(sid));
}
static bool is_in_internal_domain(const struct dom_sid *sid)
if (sid == NULL)
return False;
- return (sid_check_is_in_our_domain(sid) || sid_check_is_in_builtin(sid));
+ return (sid_check_is_in_our_sam(sid) || sid_check_is_in_builtin(sid));
}
}
}
- /* ignore alt_name if we are not in an AD domain */
+ /* use alt_name if available to allow DNS lookups */
- if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
+ if (alt_name && *alt_name) {
alternative_name = alt_name;
}
ZERO_STRUCTP(domain);
+ domain->children = SMB_MALLOC_ARRAY(
+ struct winbindd_child, lp_winbind_max_domain_connections());
+ if (domain->children == NULL) {
+ SAFE_FREE(domain);
+ return NULL;
+ }
+ memset(domain->children, 0,
+ sizeof(struct winbindd_child)
+ * lp_winbind_max_domain_connections());
+
fstrcpy(domain->name, domain_name);
if (alternative_name) {
fstrcpy(domain->alt_name, alternative_name);
struct trustdom_state *state;
struct tevent_req *req;
- state = TALLOC_ZERO_P(NULL, struct trustdom_state);
+ state = talloc_zero(NULL, struct trustdom_state);
if (state == NULL) {
DEBUG(0, ("talloc failed\n"));
return;
return True;
}
-void check_domain_trusted( const char *name, const struct dom_sid *user_sid )
-{
- struct winbindd_domain *domain;
- struct dom_sid dom_sid;
- uint32 rid;
-
- /* Check if we even care */
-
- if (!lp_allow_trusted_domains())
- return;
-
- domain = find_domain_from_name_noinit( name );
- if ( domain )
- return;
-
- sid_copy( &dom_sid, user_sid );
- if ( !sid_split_rid( &dom_sid, &rid ) )
- return;
-
- /* add the newly discovered trusted domain */
-
- domain = add_trusted_domain( name, NULL, &cache_methods,
- &dom_sid);
-
- if ( !domain )
- return;
-
- /* assume this is a trust from a one-way transitive
- forest trust */
-
- domain->active_directory = True;
- domain->domain_flags = NETR_TRUST_FLAG_OUTBOUND;
- domain->domain_type = NETR_TRUST_TYPE_UPLEVEL;
- domain->internal = False;
- domain->online = True;
-
- setup_domain_child(domain);
-
- wcache_tdc_add_domain( domain );
-
- return;
-}
-
/**
* Given a domain name, return the struct winbindd domain info for it
*
domain[PTR_DIFF(p, domuser)] = 0;
}
- strupper_m(domain);
-
- return True;
+ return strupper_m(domain);
}
bool parse_domain_user_talloc(TALLOC_CTX *mem_ctx, const char *domuser,
return ((*domain != NULL) && (*user != NULL));
}
-/* add a domain user name to a buffer */
-void parse_add_domuser(void *buf, char *domuser, int *len)
-{
- fstring domain;
- char *p, *user;
-
- user = domuser;
- p = strchr(domuser, *lp_winbind_separator());
-
- if (p) {
-
- fstrcpy(domain, domuser);
- domain[PTR_DIFF(p, domuser)] = 0;
- p++;
-
- if (assume_domain(domain)) {
-
- user = p;
- *len -= (PTR_DIFF(p, domuser));
- }
- }
-
- safe_strcpy((char *)buf, user, *len);
-}
-
/* Ensure an incoming username from NSS is fully qualified. Replace the
incoming fstring with DOMAIN <separator> user. Returns the same
values as parse_domain_user() but also replaces the incoming username.
fstring tmp_user;
fstrcpy(tmp_user, user);
- strlower_m(tmp_user);
+ (void)strlower_m(tmp_user);
if (can_assume && assume_domain(domain)) {
strlcpy(name, tmp_user, sizeof(fstring));
char *tmp_user, *name;
tmp_user = talloc_strdup(mem_ctx, user);
- strlower_m(tmp_user);
+ if (!strlower_m(tmp_user)) {
+ TALLOC_FREE(tmp_user);
+ return NULL;
+ }
if (can_assume && assume_domain(domain)) {
name = tmp_user;
return NT_STATUS_UNSUCCESSFUL;
}
- /* Skip Domain local groups outside our domain.
- We'll get these from the getsidaliases() RPC call. */
+ /*
+ * Before bug #7843 the "Domain Local" groups were added with a
+ * lookupuseraliases call, but this isn't done anymore for our domain
+ * so we need to resolve resource groups here.
+ *
+ * When to use Resource Groups:
+ * http://technet.microsoft.com/en-us/library/cc753670%28v=WS.10%29.aspx
+ */
status = sid_array_from_info3(mem_ctx, info3,
user_sids,
&num_groups,
- false, true);
+ false);
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(info3);
/* We can contact the domain if it is our primary domain */
if (domain->primary) {
- return true;
+ ret = true;
+ goto done;
}
/* Trust the TDC cache and not the winbindd_domain flags */
if ((tdc = wcache_tdc_fetch_domain(frame, domain->name)) == NULL) {
DEBUG(10,("winbindd_can_contact_domain: %s not found in cache\n",
domain->name));
- return false;
+ ret = false;
+ goto done;
}
/* Can always contact a domain that is in out forest */
}
return !domain->online;
}
+
+bool is_domain_online(const struct winbindd_domain *domain)
+{
+ return !is_domain_offline(domain);
+}
+
+/**
+ * Parse an char array into a list of sids.
+ *
+ * The input sidstr should consist of 0-terminated strings
+ * representing sids, separated by newline characters '\n'.
+ * The list is terminated by an empty string, i.e.
+ * character '\0' directly following a character '\n'
+ * (or '\0' right at the start of sidstr).
+ */
+bool parse_sidlist(TALLOC_CTX *mem_ctx, const char *sidstr,
+ struct dom_sid **sids, uint32_t *num_sids)
+{
+ const char *p;
+
+ p = sidstr;
+ if (p == NULL)
+ return False;
+
+ while (p[0] != '\0') {
+ struct dom_sid sid;
+ const char *q = NULL;
+
+ if (!dom_sid_parse_endp(p, &sid, &q)) {
+ DEBUG(1, ("Could not parse sid %s\n", p));
+ return false;
+ }
+ if ((q == NULL) || (q[0] != '\n')) {
+ DEBUG(1, ("Got invalid sidstr: %s\n", p));
+ return false;
+ }
+ if (!NT_STATUS_IS_OK(add_sid_to_array(mem_ctx, &sid, sids,
+ num_sids)))
+ {
+ return False;
+ }
+ p = q+1;
+ }
+ return True;
+}
git.samba.org / samba.git / blobdiff