source3/winbindd/winbindd_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon for ntdom nss module
   5
   6    Copyright (C) Tim Potter 2000-2001
   7    Copyright (C) 2001 by Martin Pool <mbp@samba.org>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "winbindd.h"
  25 #include "secrets.h"
  26 #include "../libcli/security/security.h"
  27 #include "../libcli/auth/pam_errors.h"
  28 #include "passdb/machine_sid.h"
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_WINBIND
  32
  33 extern struct winbindd_methods cache_methods;
  34
  35 /**
  36  * @file winbindd_util.cq
  37  *
  38  * Winbind daemon for NT domain authentication nss module.
  39  **/
  40
  41
  42 /* The list of trusted domains.  Note that the list can be deleted and
  43    recreated using the init_domain_list() function so pointers to
  44    individual winbindd_domain structures cannot be made.  Keep a copy of
  45    the domain name instead. */
  46
  47 static struct winbindd_domain *_domain_list = NULL;
  48
  49 struct winbindd_domain *domain_list(void)
  50 {
  51         /* Initialise list */
  52
  53         if ((!_domain_list) && (!init_domain_list())) {
  54                 smb_panic("Init_domain_list failed");
  55         }
  56
  57         return _domain_list;
  58 }
  59
  60 /* Free all entries in the trusted domain list */
  61
  62 static void free_domain_list(void)
  63 {
  64         struct winbindd_domain *domain = _domain_list;
  65
  66         while(domain) {
  67                 struct winbindd_domain *next = domain->next;
  68
  69                 DLIST_REMOVE(_domain_list, domain);
  70                 SAFE_FREE(domain);
  71                 domain = next;
  72         }
  73 }
  74
  75 static bool is_internal_domain(const struct dom_sid *sid)
  76 {
  77         if (sid == NULL)
  78                 return False;
  79
  80         return (sid_check_is_domain(sid) || sid_check_is_builtin(sid));
  81 }
  82
  83 static bool is_in_internal_domain(const struct dom_sid *sid)
  84 {
  85         if (sid == NULL)
  86                 return False;
  87
  88         return (sid_check_is_in_our_domain(sid) || sid_check_is_in_builtin(sid));
  89 }
  90
  91
  92 /* Add a trusted domain to our list of domains */
  93 static struct winbindd_domain *add_trusted_domain(const char *domain_name, const char *alt_name,
  94                                                   struct winbindd_methods *methods,
  95                                                   const struct dom_sid *sid)
  96 {
  97         struct winbindd_domain *domain;
  98         const char *alternative_name = NULL;
  99         char *idmap_config_option;
 100         const char *param;
 101         const char **ignored_domains, **dom;
 102
 103         ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL);
 104         for (dom=ignored_domains; dom && *dom; dom++) {
 105                 if (gen_fnmatch(*dom, domain_name) == 0) {
 106                         DEBUG(2,("Ignoring domain '%s'\n", domain_name));
 107                         return NULL;
 108                 }
 109         }
 110
 111         /* ignore alt_name if we are not in an AD domain */
 112
 113         if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
 114                 alternative_name = alt_name;
 115         }
 116
 117         /* We can't call domain_list() as this function is called from
 118            init_domain_list() and we'll get stuck in a loop. */
 119         for (domain = _domain_list; domain; domain = domain->next) {
 120                 if (strequal(domain_name, domain->name) ||
 121                     strequal(domain_name, domain->alt_name))
 122                 {
 123                         break;
 124                 }
 125
 126                 if (alternative_name && *alternative_name)
 127                 {
 128                         if (strequal(alternative_name, domain->name) ||
 129                             strequal(alternative_name, domain->alt_name))
 130                         {
 131                                 break;
 132                         }
 133                 }
 134
 135                 if (sid)
 136                 {
 137                         if (is_null_sid(sid)) {
 138                                 continue;
 139                         }
 140
 141                         if (dom_sid_equal(sid, &domain->sid)) {
 142                                 break;
 143                         }
 144                 }
 145         }
 146
 147         if (domain != NULL) {
 148                 /*
 149                  * We found a match. Possibly update the SID
 150                  */
 151                 if ((sid != NULL)
 152                     && dom_sid_equal(&domain->sid, &global_sid_NULL)) {
 153                         sid_copy( &domain->sid, sid );
 154                 }
 155                 return domain;
 156         }
 157
 158         /* Create new domain entry */
 159
 160         if ((domain = SMB_MALLOC_P(struct winbindd_domain)) == NULL)
 161                 return NULL;
 162
 163         /* Fill in fields */
 164
 165         ZERO_STRUCTP(domain);
 166
 167         domain->children = SMB_MALLOC_ARRAY(
 168                 struct winbindd_child, lp_winbind_max_domain_connections());
 169         if (domain->children == NULL) {
 170                 SAFE_FREE(domain);
 171                 return NULL;
 172         }
 173         memset(domain->children, 0,
 174                sizeof(struct winbindd_child)
 175                * lp_winbind_max_domain_connections());
 176
 177         fstrcpy(domain->name, domain_name);
 178         if (alternative_name) {
 179                 fstrcpy(domain->alt_name, alternative_name);
 180         }
 181
 182         domain->methods = methods;
 183         domain->backend = NULL;
 184         domain->internal = is_internal_domain(sid);
 185         domain->sequence_number = DOM_SEQUENCE_NONE;
 186         domain->last_seq_check = 0;
 187         domain->initialized = False;
 188         domain->online = is_internal_domain(sid);
 189         domain->check_online_timeout = 0;
 190         domain->dc_probe_pid = (pid_t)-1;
 191         if (sid) {
 192                 sid_copy(&domain->sid, sid);
 193         }
 194
 195         /* Link to domain list */
 196         DLIST_ADD_END(_domain_list, domain, struct winbindd_domain *);
 197
 198         wcache_tdc_add_domain( domain );
 199
 200         idmap_config_option = talloc_asprintf(talloc_tos(), "idmap config %s",
 201                                               domain->name);
 202         if (idmap_config_option == NULL) {
 203                 DEBUG(0, ("talloc failed, not looking for idmap config\n"));
 204                 goto done;
 205         }
 206
 207         param = lp_parm_const_string(-1, idmap_config_option, "range", NULL);
 208
 209         DEBUG(10, ("%s : range = %s\n", idmap_config_option,
 210                    param ? param : "not defined"));
 211
 212         if (param != NULL) {
 213                 unsigned low_id, high_id;
 214                 if (sscanf(param, "%u - %u", &low_id, &high_id) != 2) {
 215                         DEBUG(1, ("invalid range syntax in %s: %s\n",
 216                                   idmap_config_option, param));
 217                         goto done;
 218                 }
 219                 if (low_id > high_id) {
 220                         DEBUG(1, ("invalid range in %s: %s\n",
 221                                   idmap_config_option, param));
 222                         goto done;
 223                 }
 224                 domain->have_idmap_config = true;
 225                 domain->id_range_low = low_id;
 226                 domain->id_range_high = high_id;
 227         }
 228
 229 done:
 230
 231         DEBUG(2,("Added domain %s %s %s\n",
 232                  domain->name, domain->alt_name,
 233                  &domain->sid?sid_string_dbg(&domain->sid):""));
 234
 235         return domain;
 236 }
 237
 238 bool domain_is_forest_root(const struct winbindd_domain *domain)
 239 {
 240         const uint32_t fr_flags =
 241                 (NETR_TRUST_FLAG_TREEROOT|NETR_TRUST_FLAG_IN_FOREST);
 242
 243         return ((domain->domain_flags & fr_flags) == fr_flags);
 244 }
 245
 246 /********************************************************************
 247   rescan our domains looking for new trusted domains
 248 ********************************************************************/
 249
 250 struct trustdom_state {
 251         struct winbindd_domain *domain;
 252         struct winbindd_request request;
 253 };
 254
 255 static void trustdom_list_done(struct tevent_req *req);
 256 static void rescan_forest_root_trusts( void );
 257 static void rescan_forest_trusts( void );
 258
 259 static void add_trusted_domains( struct winbindd_domain *domain )
 260 {
 261         struct trustdom_state *state;
 262         struct tevent_req *req;
 263
 264         state = TALLOC_ZERO_P(NULL, struct trustdom_state);
 265         if (state == NULL) {
 266                 DEBUG(0, ("talloc failed\n"));
 267                 return;
 268         }
 269         state->domain = domain;
 270
 271         state->request.length = sizeof(state->request);
 272         state->request.cmd = WINBINDD_LIST_TRUSTDOM;
 273
 274         req = wb_domain_request_send(state, winbind_event_context(),
 275                                      domain, &state->request);
 276         if (req == NULL) {
 277                 DEBUG(1, ("wb_domain_request_send failed\n"));
 278                 TALLOC_FREE(state);
 279                 return;
 280         }
 281         tevent_req_set_callback(req, trustdom_list_done, state);
 282 }
 283
 284 static void trustdom_list_done(struct tevent_req *req)
 285 {
 286         struct trustdom_state *state = tevent_req_callback_data(
 287                 req, struct trustdom_state);
 288         struct winbindd_response *response;
 289         int res, err;
 290         char *p;
 291
 292         res = wb_domain_request_recv(req, state, &response, &err);
 293         if ((res == -1) || (response->result != WINBINDD_OK)) {
 294                 DEBUG(1, ("Could not receive trustdoms\n"));
 295                 TALLOC_FREE(state);
 296                 return;
 297         }
 298
 299         p = (char *)response->extra_data.data;
 300
 301         while ((p != NULL) && (*p != '\0')) {
 302                 char *q, *sidstr, *alt_name;
 303                 struct dom_sid sid;
 304                 struct winbindd_domain *domain;
 305                 char *alternate_name = NULL;
 306
 307                 alt_name = strchr(p, '\\');
 308                 if (alt_name == NULL) {
 309                         DEBUG(0, ("Got invalid trustdom response\n"));
 310                         break;
 311                 }
 312
 313                 *alt_name = '\0';
 314                 alt_name += 1;
 315
 316                 sidstr = strchr(alt_name, '\\');
 317                 if (sidstr == NULL) {
 318                         DEBUG(0, ("Got invalid trustdom response\n"));
 319                         break;
 320                 }
 321
 322                 *sidstr = '\0';
 323                 sidstr += 1;
 324
 325                 q = strchr(sidstr, '\n');
 326                 if (q != NULL)
 327                         *q = '\0';
 328
 329                 if (!string_to_sid(&sid, sidstr)) {
 330                         DEBUG(0, ("Got invalid trustdom response\n"));
 331                         break;
 332                 }
 333
 334                 /* use the real alt_name if we have one, else pass in NULL */
 335
 336                 if ( !strequal( alt_name, "(null)" ) )
 337                         alternate_name = alt_name;
 338
 339                 /* If we have an existing domain structure, calling
 340                    add_trusted_domain() will update the SID if
 341                    necessary.  This is important because we need the
 342                    SID for sibling domains */
 343
 344                 if ( find_domain_from_name_noinit(p) != NULL ) {
 345                         domain = add_trusted_domain(p, alternate_name,
 346                                                     &cache_methods,
 347                                                     &sid);
 348                 } else {
 349                         domain = add_trusted_domain(p, alternate_name,
 350                                                     &cache_methods,
 351                                                     &sid);
 352                         if (domain) {
 353                                 setup_domain_child(domain);
 354                         }
 355                 }
 356                 p=q;
 357                 if (p != NULL)
 358                         p += 1;
 359         }
 360
 361         /*
 362            Cases to consider when scanning trusts:
 363            (a) we are calling from a child domain (primary && !forest_root)
 364            (b) we are calling from the root of the forest (primary && forest_root)
 365            (c) we are calling from a trusted forest domain (!primary
 366                && !forest_root)
 367         */
 368
 369         if (state->domain->primary) {
 370                 /* If this is our primary domain and we are not in the
 371                    forest root, we have to scan the root trusts first */
 372
 373                 if (!domain_is_forest_root(state->domain))
 374                         rescan_forest_root_trusts();
 375                 else
 376                         rescan_forest_trusts();
 377
 378         } else if (domain_is_forest_root(state->domain)) {
 379                 /* Once we have done root forest trust search, we can
 380                    go on to search the trusted forests */
 381
 382                 rescan_forest_trusts();
 383         }
 384
 385         TALLOC_FREE(state);
 386
 387         return;
 388 }
 389
 390 /********************************************************************
 391  Scan the trusts of our forest root
 392 ********************************************************************/
 393
 394 static void rescan_forest_root_trusts( void )
 395 {
 396         struct winbindd_tdc_domain *dom_list = NULL;
 397         size_t num_trusts = 0;
 398         int i;
 399
 400         /* The only transitive trusts supported by Windows 2003 AD are
 401            (a) Parent-Child, (b) Tree-Root, and (c) Forest.   The
 402            first two are handled in forest and listed by
 403            DsEnumerateDomainTrusts().  Forest trusts are not so we
 404            have to do that ourselves. */
 405
 406         if ( !wcache_tdc_fetch_list( &dom_list, &num_trusts ) )
 407                 return;
 408
 409         for ( i=0; i<num_trusts; i++ ) {
 410                 struct winbindd_domain *d = NULL;
 411
 412                 /* Find the forest root.  Don't necessarily trust
 413                    the domain_list() as our primary domain may not
 414                    have been initialized. */
 415
 416                 if ( !(dom_list[i].trust_flags & NETR_TRUST_FLAG_TREEROOT) ) {
 417                         continue;
 418                 }
 419
 420                 /* Here's the forest root */
 421
 422                 d = find_domain_from_name_noinit( dom_list[i].domain_name );
 423
 424                 if ( !d ) {
 425                         d = add_trusted_domain( dom_list[i].domain_name,
 426                                                 dom_list[i].dns_name,
 427                                                 &cache_methods,
 428                                                 &dom_list[i].sid );
 429                         if (d != NULL) {
 430                                 setup_domain_child(d);
 431                         }
 432                 }
 433
 434                 if (d == NULL) {
 435                         continue;
 436                 }
 437
 438                 DEBUG(10,("rescan_forest_root_trusts: Following trust path "
 439                           "for domain tree root %s (%s)\n",
 440                           d->name, d->alt_name ));
 441
 442                 d->domain_flags = dom_list[i].trust_flags;
 443                 d->domain_type  = dom_list[i].trust_type;
 444                 d->domain_trust_attribs = dom_list[i].trust_attribs;
 445
 446                 add_trusted_domains( d );
 447
 448                 break;
 449         }
 450
 451         TALLOC_FREE( dom_list );
 452
 453         return;
 454 }
 455
 456 /********************************************************************
 457  scan the transitive forest trusts (not our own)
 458 ********************************************************************/
 459
 460
 461 static void rescan_forest_trusts( void )
 462 {
 463         struct winbindd_domain *d = NULL;
 464         struct winbindd_tdc_domain *dom_list = NULL;
 465         size_t num_trusts = 0;
 466         int i;
 467
 468         /* The only transitive trusts supported by Windows 2003 AD are
 469            (a) Parent-Child, (b) Tree-Root, and (c) Forest.   The
 470            first two are handled in forest and listed by
 471            DsEnumerateDomainTrusts().  Forest trusts are not so we
 472            have to do that ourselves. */
 473
 474         if ( !wcache_tdc_fetch_list( &dom_list, &num_trusts ) )
 475                 return;
 476
 477         for ( i=0; i<num_trusts; i++ ) {
 478                 uint32 flags   = dom_list[i].trust_flags;
 479                 uint32 type    = dom_list[i].trust_type;
 480                 uint32 attribs = dom_list[i].trust_attribs;
 481
 482                 d = find_domain_from_name_noinit( dom_list[i].domain_name );
 483
 484                 /* ignore our primary and internal domains */
 485
 486                 if ( d && (d->internal || d->primary ) )
 487                         continue;
 488
 489                 if ( (flags & NETR_TRUST_FLAG_INBOUND) &&
 490                      (type == NETR_TRUST_TYPE_UPLEVEL) &&
 491                      (attribs == NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) )
 492                 {
 493                         /* add the trusted domain if we don't know
 494                            about it */
 495
 496                         if ( !d ) {
 497                                 d = add_trusted_domain( dom_list[i].domain_name,
 498                                                         dom_list[i].dns_name,
 499                                                         &cache_methods,
 500                                                         &dom_list[i].sid );
 501                                 if (d != NULL) {
 502                                         setup_domain_child(d);
 503                                 }
 504                         }
 505
 506                         if (d == NULL) {
 507                                 continue;
 508                         }
 509
 510                         DEBUG(10,("Following trust path for domain %s (%s)\n",
 511                                   d->name, d->alt_name ));
 512                         add_trusted_domains( d );
 513                 }
 514         }
 515
 516         TALLOC_FREE( dom_list );
 517
 518         return;
 519 }
 520
 521 /*********************************************************************
 522  The process of updating the trusted domain list is a three step
 523  async process:
 524  (a) ask our domain
 525  (b) ask the root domain in our forest
 526  (c) ask the a DC in any Win2003 trusted forests
 527 *********************************************************************/
 528
 529 void rescan_trusted_domains(struct tevent_context *ev, struct tevent_timer *te,
 530                             struct timeval now, void *private_data)
 531 {
 532         TALLOC_FREE(te);
 533
 534         /* I use to clear the cache here and start over but that
 535            caused problems in child processes that needed the
 536            trust dom list early on.  Removing it means we
 537            could have some trusted domains listed that have been
 538            removed from our primary domain's DC until a full
 539            restart.  This should be ok since I think this is what
 540            Windows does as well. */
 541
 542         /* this will only add new domains we didn't already know about
 543            in the domain_list()*/
 544
 545         add_trusted_domains( find_our_domain() );
 546
 547         te = tevent_add_timer(
 548                 ev, NULL, timeval_current_ofs(WINBINDD_RESCAN_FREQ, 0),
 549                 rescan_trusted_domains, NULL);
 550         /*
 551          * If te == NULL, there's not much we can do here. Don't fail, the
 552          * only thing we miss is new trusted domains.
 553          */
 554
 555         return;
 556 }
 557
 558 enum winbindd_result winbindd_dual_init_connection(struct winbindd_domain *domain,
 559                                                    struct winbindd_cli_state *state)
 560 {
 561         /* Ensure null termination */
 562         state->request->domain_name
 563                 [sizeof(state->request->domain_name)-1]='\0';
 564         state->request->data.init_conn.dcname
 565                 [sizeof(state->request->data.init_conn.dcname)-1]='\0';
 566
 567         if (strlen(state->request->data.init_conn.dcname) > 0) {
 568                 fstrcpy(domain->dcname, state->request->data.init_conn.dcname);
 569         }
 570
 571         if (domain->internal) {
 572                 domain->initialized = true;
 573         } else {
 574                 init_dc_connection(domain);
 575         }
 576
 577         if (!domain->initialized) {
 578                 /* If we return error here we can't do any cached authentication,
 579                    but we may be in disconnected mode and can't initialize correctly.
 580                    Do what the previous code did and just return without initialization,
 581                    once we go online we'll re-initialize.
 582                 */
 583                 DEBUG(5, ("winbindd_dual_init_connection: %s returning without initialization "
 584                         "online = %d\n", domain->name, (int)domain->online ));
 585         }
 586
 587         fstrcpy(state->response->data.domain_info.name, domain->name);
 588         fstrcpy(state->response->data.domain_info.alt_name, domain->alt_name);
 589         sid_to_fstring(state->response->data.domain_info.sid, &domain->sid);
 590
 591         state->response->data.domain_info.native_mode
 592                 = domain->native_mode;
 593         state->response->data.domain_info.active_directory
 594                 = domain->active_directory;
 595         state->response->data.domain_info.primary
 596                 = domain->primary;
 597
 598         return WINBINDD_OK;
 599 }
 600
 601 /* Look up global info for the winbind daemon */
 602 bool init_domain_list(void)
 603 {
 604         struct winbindd_domain *domain;
 605         int role = lp_server_role();
 606
 607         /* Free existing list */
 608         free_domain_list();
 609
 610         /* BUILTIN domain */
 611
 612         domain = add_trusted_domain("BUILTIN", NULL, &cache_methods,
 613                                     &global_sid_Builtin);
 614         if (domain) {
 615                 setup_domain_child(domain);
 616         }
 617
 618         /* Local SAM */
 619
 620         domain = add_trusted_domain(get_global_sam_name(), NULL,
 621                                     &cache_methods, get_global_sam_sid());
 622         if (domain) {
 623                 if ( role != ROLE_DOMAIN_MEMBER ) {
 624                         domain->primary = True;
 625                 }
 626                 setup_domain_child(domain);
 627         }
 628
 629         /* Add ourselves as the first entry. */
 630
 631         if ( role == ROLE_DOMAIN_MEMBER ) {
 632                 struct dom_sid our_sid;
 633
 634                 if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid)) {
 635                         DEBUG(0, ("Could not fetch our SID - did we join?\n"));
 636                         return False;
 637                 }
 638
 639                 domain = add_trusted_domain( lp_workgroup(), lp_realm(),
 640                                              &cache_methods, &our_sid);
 641                 if (domain) {
 642                         domain->primary = True;
 643                         setup_domain_child(domain);
 644
 645                         /* Even in the parent winbindd we'll need to
 646                            talk to the DC, so try and see if we can
 647                            contact it. Theoretically this isn't neccessary
 648                            as the init_dc_connection() in init_child_recv()
 649                            will do this, but we can start detecting the DC
 650                            early here. */
 651                         set_domain_online_request(domain);
 652                 }
 653         }
 654
 655         return True;
 656 }
 657
 658 /**
 659  * Given a domain name, return the struct winbindd domain info for it
 660  *
 661  * @note Do *not* pass lp_workgroup() to this function.  domain_list
 662  *       may modify it's value, and free that pointer.  Instead, our local
 663  *       domain may be found by calling find_our_domain().
 664  *       directly.
 665  *
 666  *
 667  * @return The domain structure for the named domain, if it is working.
 668  */
 669
 670 struct winbindd_domain *find_domain_from_name_noinit(const char *domain_name)
 671 {
 672         struct winbindd_domain *domain;
 673
 674         /* Search through list */
 675
 676         for (domain = domain_list(); domain != NULL; domain = domain->next) {
 677                 if (strequal(domain_name, domain->name) ||
 678                     (domain->alt_name[0] &&
 679                      strequal(domain_name, domain->alt_name))) {
 680                         return domain;
 681                 }
 682         }
 683
 684         /* Not found */
 685
 686         return NULL;
 687 }
 688
 689 struct winbindd_domain *find_domain_from_name(const char *domain_name)
 690 {
 691         struct winbindd_domain *domain;
 692
 693         domain = find_domain_from_name_noinit(domain_name);
 694
 695         if (domain == NULL)
 696                 return NULL;
 697
 698         if (!domain->initialized)
 699                 init_dc_connection(domain);
 700
 701         return domain;
 702 }
 703
 704 /* Given a domain sid, return the struct winbindd domain info for it */
 705
 706 struct winbindd_domain *find_domain_from_sid_noinit(const struct dom_sid *sid)
 707 {
 708         struct winbindd_domain *domain;
 709
 710         /* Search through list */
 711
 712         for (domain = domain_list(); domain != NULL; domain = domain->next) {
 713                 if (dom_sid_compare_domain(sid, &domain->sid) == 0)
 714                         return domain;
 715         }
 716
 717         /* Not found */
 718
 719         return NULL;
 720 }
 721
 722 /* Given a domain sid, return the struct winbindd domain info for it */
 723
 724 struct winbindd_domain *find_domain_from_sid(const struct dom_sid *sid)
 725 {
 726         struct winbindd_domain *domain;
 727
 728         domain = find_domain_from_sid_noinit(sid);
 729
 730         if (domain == NULL)
 731                 return NULL;
 732
 733         if (!domain->initialized)
 734                 init_dc_connection(domain);
 735
 736         return domain;
 737 }
 738
 739 struct winbindd_domain *find_our_domain(void)
 740 {
 741         struct winbindd_domain *domain;
 742
 743         /* Search through list */
 744
 745         for (domain = domain_list(); domain != NULL; domain = domain->next) {
 746                 if (domain->primary)
 747                         return domain;
 748         }
 749
 750         smb_panic("Could not find our domain");
 751         return NULL;
 752 }
 753
 754 struct winbindd_domain *find_root_domain(void)
 755 {
 756         struct winbindd_domain *ours = find_our_domain();
 757
 758         if (ours->forest_name[0] == '\0') {
 759                 return NULL;
 760         }
 761
 762         return find_domain_from_name( ours->forest_name );
 763 }
 764
 765 struct winbindd_domain *find_builtin_domain(void)
 766 {
 767         struct winbindd_domain *domain;
 768
 769         domain = find_domain_from_sid(&global_sid_Builtin);
 770         if (domain == NULL) {
 771                 smb_panic("Could not find BUILTIN domain");
 772         }
 773
 774         return domain;
 775 }
 776
 777 /* Find the appropriate domain to lookup a name or SID */
 778
 779 struct winbindd_domain *find_lookup_domain_from_sid(const struct dom_sid *sid)
 780 {
 781         /* SIDs in the S-1-22-{1,2} domain should be handled by our passdb */
 782
 783         if ( sid_check_is_in_unix_groups(sid) ||
 784              sid_check_is_unix_groups(sid) ||
 785              sid_check_is_in_unix_users(sid) ||
 786              sid_check_is_unix_users(sid) )
 787         {
 788                 return find_domain_from_sid(get_global_sam_sid());
 789         }
 790
 791         /* A DC can't ask the local smbd for remote SIDs, here winbindd is the
 792          * one to contact the external DC's. On member servers the internal
 793          * domains are different: These are part of the local SAM. */
 794
 795         DEBUG(10, ("find_lookup_domain_from_sid(%s)\n", sid_string_dbg(sid)));
 796
 797         if (IS_DC || is_internal_domain(sid) || is_in_internal_domain(sid)) {
 798                 DEBUG(10, ("calling find_domain_from_sid\n"));
 799                 return find_domain_from_sid(sid);
 800         }
 801
 802         /* On a member server a query for SID or name can always go to our
 803          * primary DC. */
 804
 805         DEBUG(10, ("calling find_our_domain\n"));
 806         return find_our_domain();
 807 }
 808
 809 struct winbindd_domain *find_lookup_domain_from_name(const char *domain_name)
 810 {
 811         if ( strequal(domain_name, unix_users_domain_name() ) ||
 812              strequal(domain_name, unix_groups_domain_name() ) )
 813         {
 814                 /*
 815                  * The "Unix User" and "Unix Group" domain our handled by
 816                  * passdb
 817                  */
 818                 return find_domain_from_name_noinit( get_global_sam_name() );
 819         }
 820
 821         if (IS_DC || strequal(domain_name, "BUILTIN") ||
 822             strequal(domain_name, get_global_sam_name()))
 823                 return find_domain_from_name_noinit(domain_name);
 824
 825
 826         return find_our_domain();
 827 }
 828
 829 /* Is this a domain which we may assume no DOMAIN\ prefix? */
 830
 831 static bool assume_domain(const char *domain)
 832 {
 833         /* never assume the domain on a standalone server */
 834
 835         if ( lp_server_role() == ROLE_STANDALONE )
 836                 return False;
 837
 838         /* domain member servers may possibly assume for the domain name */
 839
 840         if ( lp_server_role() == ROLE_DOMAIN_MEMBER ) {
 841                 if ( !strequal(lp_workgroup(), domain) )
 842                         return False;
 843
 844                 if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() )
 845                         return True;
 846         }
 847
 848         /* only left with a domain controller */
 849
 850         if ( strequal(get_global_sam_name(), domain) )  {
 851                 return True;
 852         }
 853
 854         return False;
 855 }
 856
 857 /* Parse a string of the form DOMAIN\user into a domain and a user */
 858
 859 bool parse_domain_user(const char *domuser, fstring domain, fstring user)
 860 {
 861         char *p = strchr(domuser,*lp_winbind_separator());
 862
 863         if ( !p ) {
 864                 fstrcpy(user, domuser);
 865
 866                 if ( assume_domain(lp_workgroup())) {
 867                         fstrcpy(domain, lp_workgroup());
 868                 } else if ((p = strchr(domuser, '@')) != NULL) {
 869                         fstrcpy(domain, p + 1);
 870                         user[PTR_DIFF(p, domuser)] = 0;
 871                 } else {
 872                         return False;
 873                 }
 874         } else {
 875                 fstrcpy(user, p+1);
 876                 fstrcpy(domain, domuser);
 877                 domain[PTR_DIFF(p, domuser)] = 0;
 878         }
 879
 880         strupper_m(domain);
 881
 882         return True;
 883 }
 884
 885 bool parse_domain_user_talloc(TALLOC_CTX *mem_ctx, const char *domuser,
 886                               char **domain, char **user)
 887 {
 888         fstring fstr_domain, fstr_user;
 889         if (!parse_domain_user(domuser, fstr_domain, fstr_user)) {
 890                 return False;
 891         }
 892         *domain = talloc_strdup(mem_ctx, fstr_domain);
 893         *user = talloc_strdup(mem_ctx, fstr_user);
 894         return ((*domain != NULL) && (*user != NULL));
 895 }
 896
 897 /* Ensure an incoming username from NSS is fully qualified. Replace the
 898    incoming fstring with DOMAIN <separator> user. Returns the same
 899    values as parse_domain_user() but also replaces the incoming username.
 900    Used to ensure all names are fully qualified within winbindd.
 901    Used by the NSS protocols of auth, chauthtok, logoff and ccache_ntlm_auth.
 902    The protocol definitions of auth_crap, chng_pswd_auth_crap
 903    really should be changed to use this instead of doing things
 904    by hand. JRA. */
 905
 906 bool canonicalize_username(fstring username_inout, fstring domain, fstring user)
 907 {
 908         if (!parse_domain_user(username_inout, domain, user)) {
 909                 return False;
 910         }
 911         slprintf(username_inout, sizeof(fstring) - 1, "%s%c%s",
 912                  domain, *lp_winbind_separator(),
 913                  user);
 914         return True;
 915 }
 916
 917 /*
 918     Fill DOMAIN\\USERNAME entry accounting 'winbind use default domain' and
 919     'winbind separator' options.
 920     This means:
 921         - omit DOMAIN when 'winbind use default domain = true' and DOMAIN is
 922         lp_workgroup()
 923
 924     If we are a PDC or BDC, and this is for our domain, do likewise.
 925
 926     Also, if omit DOMAIN if 'winbind trusted domains only = true', as the
 927     username is then unqualified in unix
 928
 929     We always canonicalize as UPPERCASE DOMAIN, lowercase username.
 930 */
 931 void fill_domain_username(fstring name, const char *domain, const char *user, bool can_assume)
 932 {
 933         fstring tmp_user;
 934
 935         fstrcpy(tmp_user, user);
 936         strlower_m(tmp_user);
 937
 938         if (can_assume && assume_domain(domain)) {
 939                 strlcpy(name, tmp_user, sizeof(fstring));
 940         } else {
 941                 slprintf(name, sizeof(fstring) - 1, "%s%c%s",
 942                          domain, *lp_winbind_separator(),
 943                          tmp_user);
 944         }
 945 }
 946
 947 /**
 948  * talloc version of fill_domain_username()
 949  * return NULL on talloc failure.
 950  */
 951 char *fill_domain_username_talloc(TALLOC_CTX *mem_ctx,
 952                                   const char *domain,
 953                                   const char *user,
 954                                   bool can_assume)
 955 {
 956         char *tmp_user, *name;
 957
 958         tmp_user = talloc_strdup(mem_ctx, user);
 959         strlower_m(tmp_user);
 960
 961         if (can_assume && assume_domain(domain)) {
 962                 name = tmp_user;
 963         } else {
 964                 name = talloc_asprintf(mem_ctx, "%s%c%s",
 965                                        domain,
 966                                        *lp_winbind_separator(),
 967                                        tmp_user);
 968                 TALLOC_FREE(tmp_user);
 969         }
 970
 971         return name;
 972 }
 973
 974 /*
 975  * Client list accessor functions
 976  */
 977
 978 static struct winbindd_cli_state *_client_list;
 979 static int _num_clients;
 980
 981 /* Return list of all connected clients */
 982
 983 struct winbindd_cli_state *winbindd_client_list(void)
 984 {
 985         return _client_list;
 986 }
 987
 988 /* Add a connection to the list */
 989
 990 void winbindd_add_client(struct winbindd_cli_state *cli)
 991 {
 992         DLIST_ADD(_client_list, cli);
 993         _num_clients++;
 994 }
 995
 996 /* Remove a client from the list */
 997
 998 void winbindd_remove_client(struct winbindd_cli_state *cli)
 999 {
1000         DLIST_REMOVE(_client_list, cli);
1001         _num_clients--;
1002 }
1003
1004 /* Return number of open clients */
1005
1006 int winbindd_num_clients(void)
1007 {
1008         return _num_clients;
1009 }
1010
1011 NTSTATUS lookup_usergroups_cached(struct winbindd_domain *domain,
1012                                   TALLOC_CTX *mem_ctx,
1013                                   const struct dom_sid *user_sid,
1014                                   uint32_t *p_num_groups, struct dom_sid **user_sids)
1015 {
1016         struct netr_SamInfo3 *info3 = NULL;
1017         NTSTATUS status = NT_STATUS_NO_MEMORY;
1018         uint32_t num_groups = 0;
1019
1020         DEBUG(3,(": lookup_usergroups_cached\n"));
1021
1022         *user_sids = NULL;
1023         *p_num_groups = 0;
1024
1025         info3 = netsamlogon_cache_get(mem_ctx, user_sid);
1026
1027         if (info3 == NULL) {
1028                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1029         }
1030
1031         if (info3->base.groups.count == 0) {
1032                 TALLOC_FREE(info3);
1033                 return NT_STATUS_UNSUCCESSFUL;
1034         }
1035
1036         /* Skip Domain local groups outside our domain.
1037            We'll get these from the getsidaliases() RPC call. */
1038         status = sid_array_from_info3(mem_ctx, info3,
1039                                       user_sids,
1040                                       &num_groups,
1041                                       false, true);
1042
1043         if (!NT_STATUS_IS_OK(status)) {
1044                 TALLOC_FREE(info3);
1045                 return status;
1046         }
1047
1048         TALLOC_FREE(info3);
1049         *p_num_groups = num_groups;
1050         status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1051
1052         DEBUG(3,(": lookup_usergroups_cached succeeded\n"));
1053
1054         return status;
1055 }
1056
1057 /*********************************************************************
1058  We use this to remove spaces from user and group names
1059 ********************************************************************/
1060
1061 NTSTATUS normalize_name_map(TALLOC_CTX *mem_ctx,
1062                              struct winbindd_domain *domain,
1063                              const char *name,
1064                              char **normalized)
1065 {
1066         NTSTATUS nt_status;
1067
1068         if (!name || !normalized) {
1069                 return NT_STATUS_INVALID_PARAMETER;
1070         }
1071
1072         if (!lp_winbind_normalize_names()) {
1073                 return NT_STATUS_PROCEDURE_NOT_FOUND;
1074         }
1075
1076         /* Alias support and whitespace replacement are mutually
1077            exclusive */
1078
1079         nt_status = resolve_username_to_alias(mem_ctx, domain,
1080                                               name, normalized );
1081         if (NT_STATUS_IS_OK(nt_status)) {
1082                 /* special return code to let the caller know we
1083                    mapped to an alias */
1084                 return NT_STATUS_FILE_RENAMED;
1085         }
1086
1087         /* check for an unreachable domain */
1088
1089         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1090                 DEBUG(5,("normalize_name_map: Setting domain %s offline\n",
1091                          domain->name));
1092                 set_domain_offline(domain);
1093                 return nt_status;
1094         }
1095
1096         /* deal with whitespace */
1097
1098         *normalized = talloc_strdup(mem_ctx, name);
1099         if (!(*normalized)) {
1100                 return NT_STATUS_NO_MEMORY;
1101         }
1102
1103         all_string_sub( *normalized, " ", "_", 0 );
1104
1105         return NT_STATUS_OK;
1106 }
1107
1108 /*********************************************************************
1109  We use this to do the inverse of normalize_name_map()
1110 ********************************************************************/
1111
1112 NTSTATUS normalize_name_unmap(TALLOC_CTX *mem_ctx,
1113                               char *name,
1114                               char **normalized)
1115 {
1116         NTSTATUS nt_status;
1117         struct winbindd_domain *domain = find_our_domain();
1118
1119         if (!name || !normalized) {
1120                 return NT_STATUS_INVALID_PARAMETER;
1121         }
1122
1123         if (!lp_winbind_normalize_names()) {
1124                 return NT_STATUS_PROCEDURE_NOT_FOUND;
1125         }
1126
1127         /* Alias support and whitespace replacement are mutally
1128            exclusive */
1129
1130         /* When mapping from an alias to a username, we don't know the
1131            domain.  But we only need a domain structure to cache
1132            a successful lookup , so just our own domain structure for
1133            the seqnum. */
1134
1135         nt_status = resolve_alias_to_username(mem_ctx, domain,
1136                                               name, normalized);
1137         if (NT_STATUS_IS_OK(nt_status)) {
1138                 /* Special return code to let the caller know we mapped
1139                    from an alias */
1140                 return NT_STATUS_FILE_RENAMED;
1141         }
1142
1143         /* check for an unreachable domain */
1144
1145         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1146                 DEBUG(5,("normalize_name_unmap: Setting domain %s offline\n",
1147                          domain->name));
1148                 set_domain_offline(domain);
1149                 return nt_status;
1150         }
1151
1152         /* deal with whitespace */
1153
1154         *normalized = talloc_strdup(mem_ctx, name);
1155         if (!(*normalized)) {
1156                 return NT_STATUS_NO_MEMORY;
1157         }
1158
1159         all_string_sub(*normalized, "_", " ", 0);
1160
1161         return NT_STATUS_OK;
1162 }
1163
1164 /*********************************************************************
1165  ********************************************************************/
1166
1167 bool winbindd_can_contact_domain(struct winbindd_domain *domain)
1168 {
1169         struct winbindd_tdc_domain *tdc = NULL;
1170         TALLOC_CTX *frame = talloc_stackframe();
1171         bool ret = false;
1172
1173         /* We can contact the domain if it is our primary domain */
1174
1175         if (domain->primary) {
1176                 return true;
1177         }
1178
1179         /* Trust the TDC cache and not the winbindd_domain flags */
1180
1181         if ((tdc = wcache_tdc_fetch_domain(frame, domain->name)) == NULL) {
1182                 DEBUG(10,("winbindd_can_contact_domain: %s not found in cache\n",
1183                           domain->name));
1184                 return false;
1185         }
1186
1187         /* Can always contact a domain that is in out forest */
1188
1189         if (tdc->trust_flags & NETR_TRUST_FLAG_IN_FOREST) {
1190                 ret = true;
1191                 goto done;
1192         }
1193
1194         /*
1195          * On a _member_ server, we cannot contact the domain if it
1196          * is running AD and we have no inbound trust.
1197          */
1198
1199         if (!IS_DC &&
1200              domain->active_directory &&
1201             ((tdc->trust_flags & NETR_TRUST_FLAG_INBOUND) != NETR_TRUST_FLAG_INBOUND))
1202         {
1203                 DEBUG(10, ("winbindd_can_contact_domain: %s is an AD domain "
1204                            "and we have no inbound trust.\n", domain->name));
1205                 goto done;
1206         }
1207
1208         /* Assume everything else is ok (probably not true but what
1209            can you do?) */
1210
1211         ret = true;
1212
1213 done:
1214         talloc_destroy(frame);
1215
1216         return ret;
1217 }
1218
1219 /*********************************************************************
1220  ********************************************************************/
1221
1222 bool winbindd_internal_child(struct winbindd_child *child)
1223 {
1224         if ((child == idmap_child()) || (child == locator_child())) {
1225                 return True;
1226         }
1227
1228         return False;
1229 }
1230
1231 #ifdef HAVE_KRB5_LOCATE_PLUGIN_H
1232
1233 /*********************************************************************
1234  ********************************************************************/
1235
1236 static void winbindd_set_locator_kdc_env(const struct winbindd_domain *domain)
1237 {
1238         char *var = NULL;
1239         char addr[INET6_ADDRSTRLEN];
1240         const char *kdc = NULL;
1241         int lvl = 11;
1242
1243         if (!domain || !domain->alt_name || !*domain->alt_name) {
1244                 return;
1245         }
1246
1247         if (domain->initialized && !domain->active_directory) {
1248                 DEBUG(lvl,("winbindd_set_locator_kdc_env: %s not AD\n",
1249                         domain->alt_name));
1250                 return;
1251         }
1252
1253         print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
1254         kdc = addr;
1255         if (!*kdc) {
1256                 DEBUG(lvl,("winbindd_set_locator_kdc_env: %s no DC IP\n",
1257                         domain->alt_name));
1258                 kdc = domain->dcname;
1259         }
1260
1261         if (!kdc || !*kdc) {
1262                 DEBUG(lvl,("winbindd_set_locator_kdc_env: %s no DC at all\n",
1263                         domain->alt_name));
1264                 return;
1265         }
1266
1267         if (asprintf_strupper_m(&var, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS,
1268                                 domain->alt_name) == -1) {
1269                 return;
1270         }
1271
1272         DEBUG(lvl,("winbindd_set_locator_kdc_env: setting var: %s to: %s\n",
1273                 var, kdc));
1274
1275         setenv(var, kdc, 1);
1276         free(var);
1277 }
1278
1279 /*********************************************************************
1280  ********************************************************************/
1281
1282 void winbindd_set_locator_kdc_envs(const struct winbindd_domain *domain)
1283 {
1284         struct winbindd_domain *our_dom = find_our_domain();
1285
1286         winbindd_set_locator_kdc_env(domain);
1287
1288         if (domain != our_dom) {
1289                 winbindd_set_locator_kdc_env(our_dom);
1290         }
1291 }
1292
1293 /*********************************************************************
1294  ********************************************************************/
1295
1296 void winbindd_unset_locator_kdc_env(const struct winbindd_domain *domain)
1297 {
1298         char *var = NULL;
1299
1300         if (!domain || !domain->alt_name || !*domain->alt_name) {
1301                 return;
1302         }
1303
1304         if (asprintf_strupper_m(&var, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS,
1305                                 domain->alt_name) == -1) {
1306                 return;
1307         }
1308
1309         unsetenv(var);
1310         free(var);
1311 }
1312 #else
1313
1314 void winbindd_set_locator_kdc_envs(const struct winbindd_domain *domain)
1315 {
1316         return;
1317 }
1318
1319 void winbindd_unset_locator_kdc_env(const struct winbindd_domain *domain)
1320 {
1321         return;
1322 }
1323
1324 #endif /* HAVE_KRB5_LOCATE_PLUGIN_H */
1325
1326 void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
1327 {
1328         resp->data.auth.nt_status = NT_STATUS_V(result);
1329         fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
1330
1331         /* we might have given a more useful error above */
1332         if (*resp->data.auth.error_string == '\0')
1333                 fstrcpy(resp->data.auth.error_string,
1334                         get_friendly_nt_error_msg(result));
1335         resp->data.auth.pam_error = nt_status_to_pam(result);
1336 }
1337
1338 bool is_domain_offline(const struct winbindd_domain *domain)
1339 {
1340         if (!lp_winbind_offline_logon()) {
1341                 return false;
1342         }
1343         if (get_global_winbindd_state_offline()) {
1344                 return true;
1345         }
1346         return !domain->online;
1347 }
1348
1349 bool is_domain_online(const struct winbindd_domain *domain)
1350 {
1351         return !is_domain_offline(domain);
1352 }
1353
1354 bool parse_sidlist(TALLOC_CTX *mem_ctx, const char *sidstr,
1355                    struct dom_sid **sids, uint32_t *num_sids)
1356 {
1357         const char *p;
1358
1359         p = sidstr;
1360         if (p == NULL)
1361                 return False;
1362
1363         while (p[0] != '\0') {
1364                 struct dom_sid sid;
1365                 const char *q = NULL;
1366
1367                 if (!dom_sid_parse_endp(p, &sid, &q)) {
1368                         DEBUG(1, ("Could not parse sid %s\n", p));
1369                         return false;
1370                 }
1371                 if ((q == NULL) || (q[0] != '\n')) {
1372                         DEBUG(1, ("Got invalid sidstr: %s\n", p));
1373                         return false;
1374                 }
1375                 if (!NT_STATUS_IS_OK(add_sid_to_array(mem_ctx, &sid, sids,
1376                                                       num_sids)))
1377                 {
1378                         return False;
1379                 }
1380                 p = q+1;
1381         }
1382         return True;
1383 }