s3-winbindd: libwbclient: implement secure channel verification for specific domains...

[bbaumbach/samba-autobuild/.git] / source3 / winbindd / winbindd_dual_srv.c

diff --git a/source3/winbindd/winbindd_dual_srv.c b/source3/winbindd/winbindd_dual_srv.c
index 0f0802109a831ed3ba9b990c2475efdb95599d0d..337486107f6dfa6067e600e270e0369b01f070b8 100644 (file)
--- a/source3/winbindd/winbindd_dual_srv.c
+++ b/source3/winbindd/winbindd_dual_srv.c
@@ -106,6 +106,32 @@ NTSTATUS _wbint_Gid2Sid(pipes_struct *p, struct wbint_Gid2Sid *r)
                                r->out.sid, r->in.gid);
 }
 
+NTSTATUS _wbint_AllocateUid(pipes_struct *p, struct wbint_AllocateUid *r)
+{
+       struct unixid xid;
+       NTSTATUS status;
+
+       status = idmap_allocate_uid(&xid);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+       *r->out.uid = xid.id;
+       return NT_STATUS_OK;
+}
+
+NTSTATUS _wbint_AllocateGid(pipes_struct *p, struct wbint_AllocateGid *r)
+{
+       struct unixid xid;
+       NTSTATUS status;
+
+       status = idmap_allocate_gid(&xid);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+       *r->out.gid = xid.id;
+       return NT_STATUS_OK;
+}
+
 NTSTATUS _wbint_QueryUser(pipes_struct *p, struct wbint_QueryUser *r)
 {
        struct winbindd_domain *domain = wb_child_domain();
@@ -369,3 +395,122 @@ NTSTATUS _wbint_LookupRids(pipes_struct *p, struct wbint_LookupRids *r)
        r->out.names->principals = result;
        return NT_STATUS_OK;
 }
+
+NTSTATUS _wbint_CheckMachineAccount(pipes_struct *p,
+                                   struct wbint_CheckMachineAccount *r)
+{
+       struct winbindd_domain *domain;
+       int num_retries = 0;
+       NTSTATUS status;
+
+again:
+       domain = wb_child_domain();
+       if (domain == NULL) {
+               return NT_STATUS_REQUEST_NOT_ACCEPTED;
+       }
+
+       invalidate_cm_connection(&domain->conn);
+
+       {
+               struct rpc_pipe_client *netlogon_pipe;
+               status = cm_connect_netlogon(domain, &netlogon_pipe);
+       }
+
+        /* There is a race condition between fetching the trust account
+           password and the periodic machine password change.  So it's
+          possible that the trust account password has been changed on us.
+          We are returned NT_STATUS_ACCESS_DENIED if this happens. */
+
+#define MAX_RETRIES 3
+
+        if ((num_retries < MAX_RETRIES)
+           && NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+                num_retries++;
+                goto again;
+        }
+
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
+                goto done;
+        }
+
+       /* Pass back result code - zero for success, other values for
+          specific failures. */
+
+       DEBUG(3,("domain %s secret is %s\n", domain->name,
+               NT_STATUS_IS_OK(status) ? "good" : "bad"));
+
+ done:
+       DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
+             ("Checking the trust account password for domain %s returned %s\n",
+              domain->name, nt_errstr(status)));
+
+       return status;
+}
+
+NTSTATUS _wbint_SetMapping(pipes_struct *p, struct wbint_SetMapping *r)
+{
+       struct id_map map;
+
+       map.sid = r->in.sid;
+       map.xid.id = r->in.id;
+       map.status = ID_MAPPED;
+
+       switch (r->in.type) {
+       case WBINT_ID_TYPE_UID:
+               map.xid.type = ID_TYPE_UID;
+               break;
+       case WBINT_ID_TYPE_GID:
+               map.xid.type = ID_TYPE_GID;
+               break;
+       default:
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       return idmap_set_mapping(&map);
+}
+
+NTSTATUS _wbint_RemoveMapping(pipes_struct *p, struct wbint_RemoveMapping *r)
+{
+       struct id_map map;
+
+       map.sid = r->in.sid;
+       map.xid.id = r->in.id;
+       map.status = ID_MAPPED;
+
+       switch (r->in.type) {
+       case WBINT_ID_TYPE_UID:
+               map.xid.type = ID_TYPE_UID;
+               break;
+       case WBINT_ID_TYPE_GID:
+               map.xid.type = ID_TYPE_GID;
+               break;
+       default:
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       return idmap_remove_mapping(&map);
+}
+
+NTSTATUS _wbint_SetHWM(pipes_struct *p, struct wbint_SetHWM *r)
+{
+       struct unixid id;
+       NTSTATUS status;
+
+       id.id = r->in.id;
+
+       switch (id.type) {
+       case WBINT_ID_TYPE_UID:
+               id.type = ID_TYPE_UID;
+               status = idmap_set_uid_hwm(&id);
+               break;
+       case ID_TYPE_GID:
+               id.type = ID_TYPE_GID;
+               status = idmap_set_gid_hwm(&id);
+               break;
+       default:
+               status = NT_STATUS_INVALID_PARAMETER;
+               break;
+       }
+       return status;
+}