This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
to do guesswork.
*****************************************************************/
-BOOL lookup_name(TALLOC_CTX *mem_ctx,
+bool lookup_name(TALLOC_CTX *mem_ctx,
const char *full_name, int flags,
const char **ret_domain, const char **ret_name,
- DOM_SID *ret_sid, enum SID_NAME_USE *ret_type)
+ DOM_SID *ret_sid, enum lsa_SidType *ret_type)
{
char *p;
const char *tmp;
const char *name = NULL;
uint32 rid;
DOM_SID sid;
- enum SID_NAME_USE type;
+ enum lsa_SidType type;
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
- struct group *grp;
if (tmp_ctx == NULL) {
DEBUG(0, ("talloc_new failed\n"));
- return False;
+ return false;
}
p = strchr_m(full_name, '\\');
name = talloc_strdup(tmp_ctx, full_name);
}
+ DEBUG(10,("lookup_name: %s => %s (domain), %s (name)\n",
+ full_name, domain, name));
+
if ((domain == NULL) || (name == NULL)) {
DEBUG(0, ("talloc failed\n"));
- return False;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
if (strequal(domain, get_global_sam_name())) {
sid_append_rid(&sid, rid);
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
if (strequal(domain, builtin_domain_name())) {
type = SID_NAME_ALIAS;
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
/* Try the explicit winbind lookup first, don't let it guess the
goto ok;
}
- if (strequal(domain, unix_users_domain_name())) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && strequal(domain, unix_users_domain_name())) {
if (lookup_unix_user_name(name, &sid)) {
type = SID_NAME_USER;
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
- if (strequal(domain, unix_groups_domain_name())) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && strequal(domain, unix_groups_domain_name())) {
if (lookup_unix_group_name(name, &sid)) {
type = SID_NAME_DOM_GRP;
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
if ((domain[0] == '\0') && (!(flags & LOOKUP_NAME_ISOLATED))) {
- goto failed;
- }
-
- /*
- * Nasty hack necessary for too common scenarios:
- *
- * For 'valid users = +users' we know "users" is most probably not
- * BUILTIN\users but the unix group users. This hack requires the
- * admin to explicitly qualify BUILTIN if BUILTIN\users is meant.
- *
- * Please note that LOOKUP_NAME_GROUP can not be requested via for
- * example lsa_lookupnames, it only comes into this routine via
- * the expansion of group names coming in from smb.conf
- */
-
- if ((flags & LOOKUP_NAME_GROUP) && ((grp = getgrnam(name)) != NULL)) {
-
- GROUP_MAP map;
-
- if (pdb_getgrgid(&map, grp->gr_gid)) {
- /* The hack gets worse. Handle the case where we have
- * 'force group = +unixgroup' but "unixgroup" has a
- * group mapping */
-
- if (sid_check_is_in_builtin(&map.sid)) {
- domain = talloc_strdup(
- tmp_ctx, builtin_domain_name());
- } else {
- domain = talloc_strdup(
- tmp_ctx, get_global_sam_name());
- }
-
- sid_copy(&sid, &map.sid);
- type = map.sid_name_use;
- goto ok;
- }
-
- /* If we are using the smbpasswd backend, we need to use the
- * algorithmic mapping for the unix group we find. This is
- * necessary because when creating the NT token from the unix
- * gid list we got from initgroups() we use gid_to_sid() that
- * uses algorithmic mapping if pdb_rid_algorithm() is true. */
-
- if (pdb_rid_algorithm() &&
- (grp->gr_gid < max_algorithmic_gid())) {
- domain = talloc_strdup(tmp_ctx, get_global_sam_name());
- sid_compose(&sid, get_global_sam_sid(),
- pdb_gid_to_group_rid(grp->gr_gid));
- type = SID_NAME_DOM_GRP;
- goto ok;
- }
-
- if (lookup_unix_group_name(name, &sid)) {
- domain = talloc_strdup(tmp_ctx,
- unix_groups_domain_name());
- type = SID_NAME_DOM_GRP;
- goto ok;
- }
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
/* Now the guesswork begins, we haven't been given an explicit
if (strequal(name, get_global_sam_name())) {
if (!secrets_fetch_domain_sid(name, &sid)) {
DEBUG(3, ("Could not fetch my SID\n"));
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
/* Swap domain and name */
tmp = name; name = domain; domain = tmp;
if (!IS_DC && strequal(name, lp_workgroup())) {
if (!secrets_fetch_domain_sid(name, &sid)) {
DEBUG(3, ("Could not fetch the domain SID\n"));
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
/* Swap domain and name */
tmp = name; name = domain; domain = tmp;
/* 5. Trusted domains as such, to me it looks as if members don't do
this, tested an XP workstation in a NT domain -- vl */
- if (IS_DC && (secrets_fetch_trusted_domain_password(name, NULL,
- &sid, NULL))) {
+ if (IS_DC && (pdb_get_trusteddom_pw(name, NULL, &sid, NULL))) {
/* Swap domain and name */
tmp = name; name = domain; domain = tmp;
type = SID_NAME_DOMAIN;
/* Now our local possibilities are exhausted. */
if (!(flags & LOOKUP_NAME_REMOTE)) {
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
/* If we are not a DC, we have to ask in our primary domain. Let
if (IS_DC && winbind_lookup_name("", name, &sid, &type)) {
DOM_SID dom_sid;
uint32 tmp_rid;
- enum SID_NAME_USE domain_type;
+ enum lsa_SidType domain_type;
if (type == SID_NAME_DOMAIN) {
/* Swap name and type */
(domain_type != SID_NAME_DOMAIN)) {
DEBUG(2, ("winbind could not find the domain's name "
"it just looked up for us\n"));
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
goto ok;
}
/* 11. Ok, windows would end here. Samba has two more options:
Unmapped users and unmapped groups */
- if (lookup_unix_user_name(name, &sid)) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && lookup_unix_user_name(name, &sid)) {
domain = talloc_strdup(tmp_ctx, unix_users_domain_name());
type = SID_NAME_USER;
goto ok;
}
- if (lookup_unix_group_name(name, &sid)) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && lookup_unix_group_name(name, &sid)) {
domain = talloc_strdup(tmp_ctx, unix_groups_domain_name());
type = SID_NAME_DOM_GRP;
goto ok;
}
- failed:
+ /*
+ * Ok, all possibilities tried. Fail.
+ */
+
TALLOC_FREE(tmp_ctx);
- return False;
+ return false;
ok:
if ((domain == NULL) || (name == NULL)) {
DEBUG(0, ("talloc failed\n"));
TALLOC_FREE(tmp_ctx);
- return False;
+ return false;
}
- if (ret_name != NULL) {
- *ret_name = talloc_steal(mem_ctx, name);
+ /*
+ * Hand over the results to the talloc context we've been given.
+ */
+
+ if ((ret_name != NULL) &&
+ !(*ret_name = talloc_strdup(mem_ctx, name))) {
+ DEBUG(0, ("talloc failed\n"));
+ TALLOC_FREE(tmp_ctx);
+ return false;
}
if (ret_domain != NULL) {
- char *tmp_dom = talloc_strdup(tmp_ctx, domain);
+ char *tmp_dom;
+ if (!(tmp_dom = talloc_strdup(mem_ctx, domain))) {
+ DEBUG(0, ("talloc failed\n"));
+ TALLOC_FREE(tmp_ctx);
+ return false;
+ }
strupper_m(tmp_dom);
- *ret_domain = talloc_steal(mem_ctx, tmp_dom);
+ *ret_domain = tmp_dom;
}
if (ret_sid != NULL) {
}
TALLOC_FREE(tmp_ctx);
- return True;
+ return true;
}
-static BOOL winbind_lookup_rids(TALLOC_CTX *mem_ctx,
- const DOM_SID *domain_sid,
- int num_rids, uint32 *rids,
- const char **domain_name,
- const char **names, enum SID_NAME_USE *types)
+/************************************************************************
+ Names from smb.conf can be unqualified. eg. valid users = foo
+ These names should never map to a remote name. Try global_sam_name()\foo,
+ and then "Unix Users"\foo (or "Unix Groups"\foo).
+************************************************************************/
+
+bool lookup_name_smbconf(TALLOC_CTX *mem_ctx,
+ const char *full_name, int flags,
+ const char **ret_domain, const char **ret_name,
+ DOM_SID *ret_sid, enum lsa_SidType *ret_type)
{
- /* Unless the winbind interface is upgraded, fall back to ask for
- * individual sids. I imagine introducing a lookuprids operation that
- * directly proxies to lsa_lookupsids to the correct DC. -- vl */
+ char *qualified_name;
+ const char *p;
- int i;
- for (i=0; i<num_rids; i++) {
- DOM_SID sid;
+ /* NB. No winbindd_separator here as lookup_name needs \\' */
+ if ((p = strchr_m(full_name, *lp_winbind_separator())) != NULL) {
+
+ /* The name is already qualified with a domain. */
- sid_copy(&sid, domain_sid);
- sid_append_rid(&sid, rids[i]);
+ if (*lp_winbind_separator() != '\\') {
+ char *tmp;
- if (winbind_lookup_sid(mem_ctx, &sid,
- *domain_name == NULL ?
- domain_name : NULL,
- &names[i], &types[i])) {
- if ((names[i] == NULL) || ((*domain_name) == NULL)) {
- return False;
+ /* lookup_name() needs '\\' as a separator */
+
+ tmp = talloc_strdup(mem_ctx, full_name);
+ if (!tmp) {
+ return false;
}
- } else {
+ tmp[p - full_name] = '\\';
+ full_name = tmp;
+ }
+
+ return lookup_name(mem_ctx, full_name, flags,
+ ret_domain, ret_name,
+ ret_sid, ret_type);
+ }
+
+ /* Try with our own SAM name. */
+ qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
+ get_global_sam_name(),
+ full_name );
+ if (!qualified_name) {
+ return false;
+ }
+
+ if (lookup_name(mem_ctx, qualified_name, flags,
+ ret_domain, ret_name,
+ ret_sid, ret_type)) {
+ return true;
+ }
+
+ /* Finally try with "Unix Users" or "Unix Group" */
+ qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
+ flags & LOOKUP_NAME_GROUP ?
+ unix_groups_domain_name() :
+ unix_users_domain_name(),
+ full_name );
+ if (!qualified_name) {
+ return false;
+ }
+
+ return lookup_name(mem_ctx, qualified_name, flags,
+ ret_domain, ret_name,
+ ret_sid, ret_type);
+}
+
+static bool wb_lookup_rids(TALLOC_CTX *mem_ctx,
+ const DOM_SID *domain_sid,
+ int num_rids, uint32 *rids,
+ const char **domain_name,
+ const char **names, enum lsa_SidType *types)
+{
+ int i;
+ const char **my_names;
+ enum lsa_SidType *my_types;
+ TALLOC_CTX *tmp_ctx;
+
+ if (!(tmp_ctx = talloc_init("wb_lookup_rids"))) {
+ return false;
+ }
+
+ if (!winbind_lookup_rids(tmp_ctx, domain_sid, num_rids, rids,
+ domain_name, &my_names, &my_types)) {
+ *domain_name = "";
+ for (i=0; i<num_rids; i++) {
+ names[i] = "";
types[i] = SID_NAME_UNKNOWN;
}
+ TALLOC_FREE(tmp_ctx);
+ return true;
+ }
+
+ if (!(*domain_name = talloc_strdup(mem_ctx, *domain_name))) {
+ TALLOC_FREE(tmp_ctx);
+ return false;
+ }
+
+ /*
+ * winbind_lookup_rids allocates its own array. We've been given the
+ * array, so copy it over
+ */
+
+ for (i=0; i<num_rids; i++) {
+ if (my_names[i] == NULL) {
+ TALLOC_FREE(tmp_ctx);
+ return false;
+ }
+ if (!(names[i] = talloc_strdup(names, my_names[i]))) {
+ TALLOC_FREE(tmp_ctx);
+ return false;
+ }
+ types[i] = my_types[i];
}
- return True;
+ TALLOC_FREE(tmp_ctx);
+ return true;
}
-static BOOL lookup_rids(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
+static bool lookup_rids(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
int num_rids, uint32_t *rids,
const char **domain_name,
- const char ***names, enum SID_NAME_USE **types)
+ const char ***names, enum lsa_SidType **types)
{
int i;
- *names = TALLOC_ARRAY(mem_ctx, const char *, num_rids);
- *types = TALLOC_ARRAY(mem_ctx, enum SID_NAME_USE, num_rids);
+ if (num_rids) {
+ *names = TALLOC_ARRAY(mem_ctx, const char *, num_rids);
+ *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
- if ((*names == NULL) || (*types == NULL)) {
- return False;
+ if ((*names == NULL) || (*types == NULL)) {
+ return false;
+ }
+ } else {
+ *names = NULL;
+ *types = NULL;
}
if (sid_check_is_domain(domain_sid)) {
}
if (*domain_name == NULL) {
- return False;
+ return false;
}
become_root();
}
if (*domain_name == NULL) {
- return False;
+ return false;
}
for (i=0; i<num_rids; i++) {
if (lookup_builtin_rid(*names, rids[i],
&(*names)[i])) {
if ((*names)[i] == NULL) {
- return False;
+ return false;
}
(*types)[i] = SID_NAME_ALIAS;
} else {
(*types)[i] = SID_NAME_UNKNOWN;
}
}
- return True;
+ return true;
}
if (sid_check_is_wellknown_domain(domain_sid, NULL)) {
if (lookup_wellknown_sid(mem_ctx, &sid,
domain_name, &(*names)[i])) {
if ((*names)[i] == NULL) {
- return False;
+ return false;
}
(*types)[i] = SID_NAME_WKN_GRP;
} else {
(*types)[i] = SID_NAME_UNKNOWN;
}
}
- return True;
+ return true;
}
if (sid_check_is_unix_users(domain_sid)) {
(*names), uidtoname(rids[i]));
(*types)[i] = SID_NAME_USER;
}
- return True;
+ return true;
}
if (sid_check_is_unix_groups(domain_sid)) {
(*names), gidtoname(rids[i]));
(*types)[i] = SID_NAME_DOM_GRP;
}
- return True;
+ return true;
}
- return winbind_lookup_rids(mem_ctx, domain_sid, num_rids, rids,
- domain_name, *names, *types);
+ return wb_lookup_rids(mem_ctx, domain_sid, num_rids, rids,
+ domain_name, *names, *types);
}
/*
* Is the SID a domain as such? If yes, lookup its name.
*/
-static BOOL lookup_as_domain(const DOM_SID *sid, TALLOC_CTX *mem_ctx,
+static bool lookup_as_domain(const DOM_SID *sid, TALLOC_CTX *mem_ctx,
const char **name)
{
const char *tmp;
- enum SID_NAME_USE type;
+ enum lsa_SidType type;
if (sid_check_is_domain(sid)) {
*name = talloc_strdup(mem_ctx, get_global_sam_name());
- return True;
+ return true;
}
if (sid_check_is_builtin(sid)) {
*name = talloc_strdup(mem_ctx, builtin_domain_name());
- return True;
+ return true;
}
if (sid_check_is_wellknown_domain(sid, &tmp)) {
*name = talloc_strdup(mem_ctx, tmp);
- return True;
+ return true;
}
if (sid->num_auths != 4) {
/* This can't be a domain */
- return False;
+ return false;
}
if (IS_DC) {
* and for SIDs that have 4 sub-authorities and thus look like
* domains */
- if (!NT_STATUS_IS_OK(secrets_trusted_domains(mem_ctx,
- &num_domains,
- &domains))) {
- return False;
+ if (!NT_STATUS_IS_OK(pdb_enum_trusteddoms(mem_ctx,
+ &num_domains,
+ &domains))) {
+ return false;
}
for (i=0; i<num_domains; i++) {
if (sid_equal(sid, &domains[i]->sid)) {
*name = talloc_strdup(mem_ctx,
domains[i]->name);
- return True;
+ return true;
}
}
- return False;
+ return false;
}
if (winbind_lookup_sid(mem_ctx, sid, &tmp, NULL, &type) &&
(type == SID_NAME_DOMAIN)) {
*name = tmp;
- return True;
+ return true;
}
- return False;
+ return false;
}
/*
* Level 2: Ask domain and trusted domains, no builtin and wkn
* Level 3: Only ask domain
* Level 4: W2k3ad: Only ask AD trusts
- * Level 5: Don't lookup anything
+ * Level 5: Only ask transitive forest trusts
* Level 6: Like 4
*/
-static BOOL check_dom_sid_to_level(const DOM_SID *sid, int level)
+static bool check_dom_sid_to_level(const DOM_SID *sid, int level)
{
- int ret = False;
+ int ret = false;
switch(level) {
case 1:
- ret = True;
+ ret = true;
break;
case 2:
ret = (!sid_check_is_builtin(sid) &&
ret = sid_check_is_domain(sid);
break;
case 5:
- ret = False;
+ ret = false;
break;
}
DEBUG(10, ("%s SID %s in level %d\n",
ret ? "Accepting" : "Rejecting",
- sid_string_static(sid), level));
+ sid_string_dbg(sid), level));
return ret;
}
TALLOC_CTX *tmp_ctx;
NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
struct lsa_name_info *name_infos;
- struct lsa_dom_info *dom_infos;
+ struct lsa_dom_info *dom_infos = NULL;
int i, j;
- tmp_ctx = talloc_new(mem_ctx);
- if (tmp_ctx == NULL) {
+ if (!(tmp_ctx = talloc_new(mem_ctx))) {
DEBUG(0, ("talloc_new failed\n"));
return NT_STATUS_NO_MEMORY;
}
- name_infos = TALLOC_ARRAY(tmp_ctx, struct lsa_name_info, num_sids);
- dom_infos = TALLOC_ZERO_ARRAY(tmp_ctx, struct lsa_dom_info,
+ if (num_sids) {
+ name_infos = TALLOC_ARRAY(mem_ctx, struct lsa_name_info, num_sids);
+ if (name_infos == NULL) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
+ } else {
+ name_infos = NULL;
+ }
+
+ dom_infos = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_dom_info,
MAX_REF_DOMAINS);
- if ((name_infos == NULL) || (dom_infos == NULL)) {
+ if (dom_infos == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
/* First build up the data structures:
*/
if (domain_name == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
name_infos[i].rid = 0;
name_infos, builtin_domain_name());
if (name_infos[i].name == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
}
} else {
/* This is a normal SID with rid component */
if (!sid_split_rid(&sid, &rid)) {
result = NT_STATUS_INVALID_PARAMETER;
- goto done;
+ goto fail;
}
}
if (j == MAX_REF_DOMAINS) {
/* TODO: What's the right error message here? */
result = NT_STATUS_NONE_MAPPED;
- goto done;
+ goto fail;
}
if (!dom_infos[j].valid) {
/* We found a domain not yet referenced, create a new
* ref. */
- dom_infos[j].valid = True;
+ dom_infos[j].valid = true;
sid_copy(&dom_infos[j].sid, &sid);
if (domain_name != NULL) {
/* This name was being found above in the case
* when we found a domain SID */
dom_infos[j].name =
- talloc_steal(dom_infos, domain_name);
+ talloc_strdup(dom_infos, domain_name);
+ if (dom_infos[j].name == NULL) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
} else {
/* lookup_rids will take care of this */
dom_infos[j].name = NULL;
if (dom_infos[j].idxs == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
}
}
for (i=0; i<MAX_REF_DOMAINS; i++) {
uint32_t *rids;
+ const char *domain_name = NULL;
const char **names;
- enum SID_NAME_USE *types;
+ enum lsa_SidType *types;
struct lsa_dom_info *dom = &dom_infos[i];
if (!dom->valid) {
break;
}
- rids = TALLOC_ARRAY(tmp_ctx, uint32, dom->num_idxs);
-
- if (rids == NULL) {
- result = NT_STATUS_NO_MEMORY;
- goto done;
+ if (dom->num_idxs) {
+ if (!(rids = TALLOC_ARRAY(tmp_ctx, uint32, dom->num_idxs))) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
+ } else {
+ rids = NULL;
}
for (j=0; j<dom->num_idxs; j++) {
}
if (!lookup_rids(tmp_ctx, &dom->sid,
- dom->num_idxs, rids, &dom->name,
+ dom->num_idxs, rids, &domain_name,
&names, &types)) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
- talloc_steal(dom_infos, dom->name);
-
+ if (!(dom->name = talloc_strdup(dom_infos, domain_name))) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
+
for (j=0; j<dom->num_idxs; j++) {
int idx = dom->idxs[j];
name_infos[idx].type = types[j];
if (types[j] != SID_NAME_UNKNOWN) {
name_infos[idx].name =
- talloc_steal(name_infos, names[j]);
+ talloc_strdup(name_infos, names[j]);
+ if (name_infos[idx].name == NULL) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
} else {
name_infos[idx].name = NULL;
}
}
}
- *ret_domains = talloc_steal(mem_ctx, dom_infos);
- *ret_names = talloc_steal(mem_ctx, name_infos);
- result = NT_STATUS_OK;
+ *ret_domains = dom_infos;
+ *ret_names = name_infos;
+ TALLOC_FREE(tmp_ctx);
+ return NT_STATUS_OK;
- done:
+ fail:
+ TALLOC_FREE(dom_infos);
+ TALLOC_FREE(name_infos);
TALLOC_FREE(tmp_ctx);
return result;
}
*THE CANONICAL* convert SID to name function.
*****************************************************************/
-BOOL lookup_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
+bool lookup_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
const char **ret_domain, const char **ret_name,
- enum SID_NAME_USE *ret_type)
+ enum lsa_SidType *ret_type)
{
struct lsa_dom_info *domain;
struct lsa_name_info *name;
TALLOC_CTX *tmp_ctx;
- BOOL ret = False;
+ bool ret = false;
- tmp_ctx = talloc_new(mem_ctx);
-
- if (tmp_ctx == NULL) {
+ if (!(tmp_ctx = talloc_new(mem_ctx))) {
DEBUG(0, ("talloc_new failed\n"));
- return False;
+ return false;
}
if (!NT_STATUS_IS_OK(lookup_sids(tmp_ctx, 1, &sid, 1,
goto done;
}
- if (ret_domain != NULL) {
- *ret_domain = talloc_steal(mem_ctx, domain->name);
+ if ((ret_domain != NULL) &&
+ !(*ret_domain = talloc_strdup(mem_ctx, domain->name))) {
+ goto done;
}
- if (ret_name != NULL) {
- *ret_name = talloc_steal(mem_ctx, name->name);
+ if ((ret_name != NULL) &&
+ !(*ret_name = talloc_strdup(mem_ctx, name->name))) {
+ goto done;
}
if (ret_type != NULL) {
*ret_type = name->type;
}
- ret = True;
+ ret = true;
done:
if (ret) {
- DEBUG(10, ("Sid %s -> %s\\%s(%d)\n",
- sid_string_static(sid), domain->name,
- name->name, name->type));
+ DEBUG(10, ("Sid %s -> %s\\%s(%d)\n", sid_string_dbg(sid),
+ domain->name, name->name, name->type));
} else {
- DEBUG(10, ("failed to lookup sid %s\n",
- sid_string_static(sid)));
+ DEBUG(10, ("failed to lookup sid %s\n", sid_string_dbg(sid)));
}
TALLOC_FREE(tmp_ctx);
return ret;
struct uid_sid_cache *next, *prev;
uid_t uid;
DOM_SID sid;
- enum SID_NAME_USE sidtype;
+ enum lsa_SidType sidtype;
} *uid_sid_cache_head;
static struct gid_sid_cache {
struct gid_sid_cache *next, *prev;
gid_t gid;
DOM_SID sid;
- enum SID_NAME_USE sidtype;
+ enum lsa_SidType sidtype;
} *gid_sid_cache_head;
/*****************************************************************
Find a SID given a uid.
*****************************************************************/
-static BOOL fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid)
+static bool fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid)
{
struct uid_sid_cache *pc;
if (pc->uid == uid) {
*psid = pc->sid;
DEBUG(3,("fetch sid from uid cache %u -> %s\n",
- (unsigned int)uid, sid_string_static(psid)));
+ (unsigned int)uid, sid_string_dbg(psid)));
DLIST_PROMOTE(uid_sid_cache_head, pc);
- return True;
+ return true;
}
}
- return False;
+ return false;
}
/*****************************************************************
Find a uid given a SID.
*****************************************************************/
-static BOOL fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
+static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
{
struct uid_sid_cache *pc;
if (sid_compare(&pc->sid, psid) == 0) {
*puid = pc->uid;
DEBUG(3,("fetch uid from cache %u -> %s\n",
- (unsigned int)*puid, sid_string_static(psid)));
+ (unsigned int)*puid, sid_string_dbg(psid)));
DLIST_PROMOTE(uid_sid_cache_head, pc);
- return True;
+ return true;
}
}
- return False;
+ return false;
}
/*****************************************************************
{
struct uid_sid_cache *pc;
+ /* do not store SIDs in the "Unix Group" domain */
+
+ if ( sid_check_is_in_unix_users( psid ) )
+ return;
+
if (n_uid_sid_cache >= MAX_UID_SID_CACHE_SIZE && n_uid_sid_cache > TURNOVER_UID_SID_CACHE_SIZE) {
/* Delete the last TURNOVER_UID_SID_CACHE_SIZE entries. */
struct uid_sid_cache *pc_next;
Find a SID given a gid.
*****************************************************************/
-static BOOL fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid)
+static bool fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid)
{
struct gid_sid_cache *pc;
if (pc->gid == gid) {
*psid = pc->sid;
DEBUG(3,("fetch sid from gid cache %u -> %s\n",
- (unsigned int)gid, sid_string_static(psid)));
+ (unsigned int)gid, sid_string_dbg(psid)));
DLIST_PROMOTE(gid_sid_cache_head, pc);
- return True;
+ return true;
}
}
- return False;
+ return false;
}
/*****************************************************************
Find a gid given a SID.
*****************************************************************/
-static BOOL fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
+static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
{
struct gid_sid_cache *pc;
if (sid_compare(&pc->sid, psid) == 0) {
*pgid = pc->gid;
DEBUG(3,("fetch gid from cache %u -> %s\n",
- (unsigned int)*pgid, sid_string_static(psid)));
+ (unsigned int)*pgid, sid_string_dbg(psid)));
DLIST_PROMOTE(gid_sid_cache_head, pc);
- return True;
+ return true;
}
}
- return False;
+ return false;
}
/*****************************************************************
void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
{
struct gid_sid_cache *pc;
+
+ /* do not store SIDs in the "Unix Group" domain */
+
+ if ( sid_check_is_in_unix_groups( psid ) )
+ return;
if (n_gid_sid_cache >= MAX_GID_SID_CACHE_SIZE && n_gid_sid_cache > TURNOVER_GID_SID_CACHE_SIZE) {
/* Delete the last TURNOVER_GID_SID_CACHE_SIZE entries. */
sid_copy(&pc->sid, psid);
DLIST_ADD(gid_sid_cache_head, pc);
- DEBUG(3,("store_gid_sid_cache: gid %u in cache -> %s\n", (unsigned int)gid,
- sid_string_static(psid)));
+ DEBUG(3,("store_gid_sid_cache: gid %u in cache -> %s\n",
+ (unsigned int)gid, sid_string_dbg(psid)));
n_gid_sid_cache++;
}
/*****************************************************************
- *THE CANONICAL* convert uid_t to SID function.
+ *THE LEGACY* convert uid_t to SID function.
*****************************************************************/
-void uid_to_sid(DOM_SID *psid, uid_t uid)
+static void legacy_uid_to_sid(DOM_SID *psid, uid_t uid)
{
- uid_t low, high;
uint32 rid;
+ bool ret;
ZERO_STRUCTP(psid);
- if (fetch_sid_from_uid_cache(psid, uid))
- return;
-
- if (lp_idmap_uid(&low, &high) && (uid >= low) && (uid <= high) &&
- winbind_uid_to_sid(psid, uid)) {
+ become_root();
+ ret = pdb_uid_to_rid(uid, &rid);
+ unbecome_root();
- DEBUG(10,("uid_to_sid: winbindd %u -> %s\n",
- (unsigned int)uid, sid_string_static(psid)));
- goto done;
- }
-
- if (pdb_uid_to_rid(uid, &rid)) {
+ if (ret) {
/* This is a mapped user */
sid_copy(psid, get_global_sam_sid());
sid_append_rid(psid, rid);
goto done;
}
- if (pdb_rid_algorithm() && (uid < max_algorithmic_uid())) {
- sid_copy(psid, get_global_sam_sid());
- sid_append_rid(psid, algorithmic_pdb_uid_to_user_rid(uid));
- goto done;
- } else {
- sid_copy(psid, &global_sid_Unix_Users);
- sid_append_rid(psid, uid);
- goto done;
- }
+ /* This is an unmapped user */
+
+ uid_to_unix_users_sid(uid, psid);
done:
- DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid,
- sid_string_static(psid)));
+ DEBUG(10,("LEGACY: uid %u -> sid %s\n", (unsigned int)uid,
+ sid_string_dbg(psid)));
store_uid_sid_cache(psid, uid);
return;
}
/*****************************************************************
- *THE CANONICAL* convert gid_t to SID function.
+ *THE LEGACY* convert gid_t to SID function.
*****************************************************************/
-void gid_to_sid(DOM_SID *psid, gid_t gid)
+static void legacy_gid_to_sid(DOM_SID *psid, gid_t gid)
{
- gid_t low, high;
+ bool ret;
ZERO_STRUCTP(psid);
- if (fetch_sid_from_gid_cache(psid, gid))
- return;
-
- if (lp_idmap_gid(&low, &high) && (gid >= low) && (gid <= high) &&
- winbind_gid_to_sid(psid, gid)) {
-
- DEBUG(10,("gid_to_sid: winbindd %u -> %s\n",
- (unsigned int)gid, sid_string_static(psid)));
- goto done;
- }
+ become_root();
+ ret = pdb_gid_to_sid(gid, psid);
+ unbecome_root();
- if (pdb_gid_to_sid(gid, psid)) {
+ if (ret) {
/* This is a mapped group */
goto done;
}
+
+ /* This is an unmapped group */
- if (pdb_rid_algorithm() && (gid < max_algorithmic_gid())) {
- sid_copy(psid, get_global_sam_sid());
- sid_append_rid(psid, pdb_gid_to_group_rid(gid));
- goto done;
- } else {
- sid_copy(psid, &global_sid_Unix_Groups);
- sid_append_rid(psid, gid);
- goto done;
- }
+ gid_to_unix_groups_sid(gid, psid);
done:
- DEBUG(10,("gid_to_sid: local %u -> %s\n", (unsigned int)gid,
- sid_string_static(psid)));
+ DEBUG(10,("LEGACY: gid %u -> sid %s\n", (unsigned int)gid,
+ sid_string_dbg(psid)));
store_gid_sid_cache(psid, gid);
return;
}
/*****************************************************************
- *THE CANONICAL* convert SID to uid function.
+ *THE LEGACY* convert SID to uid function.
*****************************************************************/
-BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid)
+static bool legacy_sid_to_uid(const DOM_SID *psid, uid_t *puid)
{
- enum SID_NAME_USE type;
+ enum lsa_SidType type;
uint32 rid;
- gid_t gid;
-
- if (fetch_uid_from_cache(puid, psid))
- return True;
-
- if (fetch_gid_from_cache(&gid, psid)) {
- return False;
- }
-
- if (sid_peek_check_rid(&global_sid_Unix_Users, psid, &rid)) {
- uid_t uid = rid;
- *puid = uid;
- goto done;
- }
if (sid_peek_check_rid(get_global_sam_sid(), psid, &rid)) {
union unid_t id;
+ bool ret;
- if (pdb_sid_to_id(psid, &id, &type)) {
+ become_root();
+ ret = pdb_sid_to_id(psid, &id, &type);
+ unbecome_root();
+
+ if (ret) {
if (type != SID_NAME_USER) {
DEBUG(5, ("sid %s is a %s, expected a user\n",
- sid_string_static(psid),
+ sid_string_dbg(psid),
sid_type_lookup(type)));
- return False;
+ return false;
}
*puid = id.uid;
goto done;
}
- if (pdb_rid_algorithm() &&
- algorithmic_pdb_rid_is_user(rid)) {
- *puid = algorithmic_pdb_user_rid_to_uid(rid);
- goto done;
- }
-
- /* This was ours, but it was neither mapped nor
- * algorithmic. Fail */
- return False;
- }
-
- if (winbind_lookup_sid(NULL, psid, NULL, NULL, &type)) {
-
- if (type != SID_NAME_USER) {
- DEBUG(10, ("sid_to_uid: sid %s is a %s\n",
- sid_string_static(psid),
- sid_type_lookup(type)));
- return False;
- }
- if (!winbind_sid_to_uid(puid, psid)) {
- DEBUG(5, ("sid_to_uid: winbind failed to allocate a "
- "new uid for sid %s\n",
- sid_string_static(psid)));
- return False;
- }
- goto done;
+ /* This was ours, but it was not mapped. Fail */
}
- /* TODO: Here would be the place to allocate both a gid and a uid for
- * the SID in question */
-
- return False;
+ DEBUG(10,("LEGACY: mapping failed for sid %s\n",
+ sid_string_dbg(psid)));
+ return false;
- done:
- DEBUG(10,("sid_to_uid: %s -> %u\n", sid_string_static(psid),
- (unsigned int)*puid ));
+done:
+ DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_dbg(psid),
+ (unsigned int)*puid ));
store_uid_sid_cache(psid, *puid);
- return True;
+ return true;
}
/*****************************************************************
- *THE CANONICAL* convert SID to gid function.
+ *THE LEGACY* convert SID to gid function.
Group mapping is used for gids that maps to Wellknown SIDs
*****************************************************************/
-BOOL sid_to_gid(const DOM_SID *psid, gid_t *pgid)
+static bool legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
{
uint32 rid;
GROUP_MAP map;
union unid_t id;
- enum SID_NAME_USE type;
- uid_t uid;
-
- if (fetch_gid_from_cache(pgid, psid))
- return True;
-
- if (fetch_uid_from_cache(&uid, psid))
- return False;
-
- if (sid_peek_check_rid(&global_sid_Unix_Groups, psid, &rid)) {
- gid_t gid = rid;
- *pgid = gid;
- goto done;
- }
+ enum lsa_SidType type;
if ((sid_check_is_in_builtin(psid) ||
sid_check_is_in_wellknown_domain(psid))) {
- if (pdb_getgrsid(&map, *psid)) {
+ bool ret;
+
+ become_root();
+ ret = pdb_getgrsid(&map, *psid);
+ unbecome_root();
+
+ if (ret) {
*pgid = map.gid;
goto done;
}
- return False;
+ DEBUG(10,("LEGACY: mapping failed for sid %s\n",
+ sid_string_dbg(psid)));
+ return false;
}
if (sid_peek_check_rid(get_global_sam_sid(), psid, &rid)) {
- if (pdb_sid_to_id(psid, &id, &type)) {
+ bool ret;
+
+ become_root();
+ ret = pdb_sid_to_id(psid, &id, &type);
+ unbecome_root();
+
+ if (ret) {
if ((type != SID_NAME_DOM_GRP) &&
(type != SID_NAME_ALIAS)) {
- DEBUG(5, ("sid %s is a %s, expected a group\n",
- sid_string_static(psid),
+ DEBUG(5, ("LEGACY: sid %s is a %s, expected "
+ "a group\n", sid_string_dbg(psid),
sid_type_lookup(type)));
- return False;
+ return false;
}
*pgid = id.gid;
goto done;
}
- if (pdb_rid_algorithm() &&
- !algorithmic_pdb_rid_is_user(rid)) {
- /* This must be a group, presented as alias */
- *pgid = pdb_group_rid_to_gid(rid);
- goto done;
- }
- /* This was ours, but it was neither mapped nor
- * algorithmic. Fail. */
- return False;
+
+ /* This was ours, but it was not mapped. Fail */
}
+
+ DEBUG(10,("LEGACY: mapping failed for sid %s\n",
+ sid_string_dbg(psid)));
+ return false;
- if (!winbind_lookup_sid(NULL, psid, NULL, NULL, &type)) {
- DEBUG(11,("sid_to_gid: no one knows the SID %s (tried local, "
- "then winbind)\n", sid_string_static(psid)));
-
- return False;
+ done:
+ DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_dbg(psid),
+ (unsigned int)*pgid ));
+
+ store_gid_sid_cache(psid, *pgid);
+
+ return true;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert uid_t to SID function.
+*****************************************************************/
+
+void uid_to_sid(DOM_SID *psid, uid_t uid)
+{
+ ZERO_STRUCTP(psid);
+
+ if (fetch_sid_from_uid_cache(psid, uid))
+ return;
+
+ if (!winbind_uid_to_sid(psid, uid)) {
+ if (!winbind_ping()) {
+ legacy_uid_to_sid(psid, uid);
+ return;
+ }
+
+ DEBUG(5, ("uid_to_sid: winbind failed to find a sid for uid %u\n",
+ uid));
+ return;
}
- /* winbindd knows it; Ensure this is a group sid */
+ DEBUG(10,("uid %u -> sid %s\n", (unsigned int)uid,
+ sid_string_dbg(psid)));
+
+ store_uid_sid_cache(psid, uid);
+ return;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert gid_t to SID function.
+*****************************************************************/
- if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
- (type != SID_NAME_WKN_GRP)) {
- DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is "
- "a %s\n", sid_type_lookup(type)));
- return False;
+void gid_to_sid(DOM_SID *psid, gid_t gid)
+{
+ ZERO_STRUCTP(psid);
+
+ if (fetch_sid_from_gid_cache(psid, gid))
+ return;
+
+ if (!winbind_gid_to_sid(psid, gid)) {
+ if (!winbind_ping()) {
+ legacy_gid_to_sid(psid, gid);
+ return;
+ }
+
+ DEBUG(5, ("gid_to_sid: winbind failed to find a sid for gid %u\n",
+ gid));
+ return;
}
+
+ DEBUG(10,("gid %u -> sid %s\n", (unsigned int)gid,
+ sid_string_dbg(psid)));
- /* winbindd knows it and it is a type of group; sid_to_gid must succeed
- or we are dead in the water */
+ store_gid_sid_cache(psid, gid);
+ return;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert SID to uid function.
+*****************************************************************/
+
+bool sid_to_uid(const DOM_SID *psid, uid_t *puid)
+{
+ uint32 rid;
+ gid_t gid;
+
+ if (fetch_uid_from_cache(puid, psid))
+ return true;
+
+ if (fetch_gid_from_cache(&gid, psid)) {
+ return false;
+ }
+
+ /* Optimize for the Unix Users Domain
+ * as the conversion is straightforward */
+ if (sid_peek_check_rid(&global_sid_Unix_Users, psid, &rid)) {
+ uid_t uid = rid;
+ *puid = uid;
+
+ /* return here, don't cache */
+ DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid),
+ (unsigned int)*puid ));
+ return true;
+ }
+
+ if (!winbind_sid_to_uid(puid, psid)) {
+ if (!winbind_ping()) {
+ return legacy_sid_to_uid(psid, puid);
+ }
+
+ DEBUG(5, ("winbind failed to find a uid for sid %s\n",
+ sid_string_dbg(psid)));
+ return false;
+ }
+
+ /* TODO: Here would be the place to allocate both a gid and a uid for
+ * the SID in question */
+
+ DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid),
+ (unsigned int)*puid ));
+
+ store_uid_sid_cache(psid, *puid);
+ return true;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert SID to gid function.
+ Group mapping is used for gids that maps to Wellknown SIDs
+*****************************************************************/
+
+bool sid_to_gid(const DOM_SID *psid, gid_t *pgid)
+{
+ uint32 rid;
+ uid_t uid;
+
+ if (fetch_gid_from_cache(pgid, psid))
+ return true;
+
+ if (fetch_uid_from_cache(&uid, psid))
+ return false;
+
+ /* Optimize for the Unix Groups Domain
+ * as the conversion is straightforward */
+ if (sid_peek_check_rid(&global_sid_Unix_Groups, psid, &rid)) {
+ gid_t gid = rid;
+ *pgid = gid;
+
+ /* return here, don't cache */
+ DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid),
+ (unsigned int)*pgid ));
+ return true;
+ }
+
+ /* Ask winbindd if it can map this sid to a gid.
+ * (Idmap will check it is a valid SID and of the right type) */
if ( !winbind_sid_to_gid(pgid, psid) ) {
- DEBUG(10,("sid_to_gid: winbind failed to allocate a new gid "
- "for sid %s\n", sid_string_static(psid)));
- return False;
+ if (!winbind_ping()) {
+ return legacy_sid_to_gid(psid, pgid);
+ }
+
+ DEBUG(10,("winbind failed to find a gid for sid %s\n",
+ sid_string_dbg(psid)));
+ return false;
}
- done:
- DEBUG(10,("sid_to_gid: %s -> %u\n", sid_string_static(psid),
+ DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid),
(unsigned int)*pgid ));
store_gid_sid_cache(psid, *pgid);
- return True;
+ return true;
}
git.samba.org / tprouty / samba.git / blobdiff