winbindd: Use dom_sid_str_buf
[nivanova/samba-autobuild/.git] / source3 / winbindd / wb_xids2sids.c
1 /*
2  * Unix SMB/CIFS implementation.
3  * async xids2sids
4  * Copyright (C) Volker Lendecke 2015
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "winbindd.h"
22 #include "../libcli/security/security.h"
23 #include "idmap_cache.h"
24 #include "librpc/gen_ndr/ndr_winbind_c.h"
25 #include "librpc/gen_ndr/ndr_netlogon.h"
26 #include "passdb/lookup_sid.h"
27
28 struct wb_xids2sids_dom_map {
29         unsigned low_id;
30         unsigned high_id;
31         const char *name;
32         struct dom_sid sid;
33 };
34
35 /*
36  * Map idmap ranges to domain names, taken from smb.conf. This is
37  * stored in the parent winbind and used to assemble xid2sid calls
38  * into per-idmap-domain chunks.
39  */
40 static struct wb_xids2sids_dom_map *dom_maps;
41
42 static bool wb_xids2sids_add_dom(const char *domname,
43                                  void *private_data)
44 {
45         struct wb_xids2sids_dom_map *map = NULL;
46         size_t num_maps = talloc_array_length(dom_maps);
47         size_t i;
48         const char *range;
49         unsigned low_id, high_id;
50         int ret;
51
52         range = idmap_config_const_string(domname, "range", NULL);
53         if (range == NULL) {
54                 DBG_DEBUG("No range for domain %s found\n", domname);
55                 return false;
56         }
57
58         ret = sscanf(range, "%u - %u", &low_id, &high_id);
59         if (ret != 2) {
60                 DBG_DEBUG("Invalid range spec \"%s\" for domain %s\n",
61                           range, domname);
62                 return false;
63         }
64
65         if (low_id > high_id) {
66                 DBG_DEBUG("Invalid range %u - %u for domain %s\n",
67                           low_id, high_id, domname);
68                 return false;
69         }
70
71         for (i=0; i<num_maps; i++) {
72                 if (strequal(domname, dom_maps[i].name)) {
73                         map = &dom_maps[i];
74                         break;
75                 }
76         }
77
78         if (map == NULL) {
79                 struct wb_xids2sids_dom_map *tmp;
80                 char *name;
81
82                 name = talloc_strdup(talloc_tos(), domname);
83                 if (name == NULL) {
84                         DBG_DEBUG("talloc failed\n");
85                         return false;
86                 }
87
88                 tmp = talloc_realloc(
89                         NULL, dom_maps, struct wb_xids2sids_dom_map,
90                         num_maps+1);
91                 if (tmp == NULL) {
92                         TALLOC_FREE(name);
93                         return false;
94                 }
95                 dom_maps = tmp;
96
97                 map = &dom_maps[num_maps];
98                 ZERO_STRUCTP(map);
99                 map->name = talloc_move(dom_maps, &name);
100         }
101
102         map->low_id = low_id;
103         map->high_id = high_id;
104
105         return false;
106 }
107
108 struct wb_xids2sids_init_dom_maps_state {
109         struct tevent_context *ev;
110         struct tevent_req *req;
111         size_t dom_idx;
112 };
113
114 static void wb_xids2sids_init_dom_maps_lookupname_next(
115         struct wb_xids2sids_init_dom_maps_state *state);
116
117 static void wb_xids2sids_init_dom_maps_lookupname_done(
118         struct tevent_req *subreq);
119
120 static struct tevent_req *wb_xids2sids_init_dom_maps_send(
121         TALLOC_CTX *mem_ctx, struct tevent_context *ev)
122 {
123         struct tevent_req *req = NULL;
124         struct wb_xids2sids_init_dom_maps_state *state = NULL;
125
126         req = tevent_req_create(mem_ctx, &state,
127                                 struct wb_xids2sids_init_dom_maps_state);
128         if (req == NULL) {
129                 return NULL;
130         }
131         *state = (struct wb_xids2sids_init_dom_maps_state) {
132                 .ev = ev,
133                 .req = req,
134                 .dom_idx = 0,
135         };
136
137         if (dom_maps != NULL) {
138                 tevent_req_done(req);
139                 return tevent_req_post(req, ev);
140         }
141         /*
142          * Put the passdb idmap domain first. We always need to try
143          * there first.
144          */
145
146         dom_maps = talloc_zero_array(NULL, struct wb_xids2sids_dom_map, 1);
147         if (tevent_req_nomem(dom_maps, req)) {
148                 return tevent_req_post(req, ev);
149         }
150         dom_maps[0].low_id = 0;
151         dom_maps[0].high_id = UINT_MAX;
152         dom_maps[0].name = talloc_strdup(dom_maps, get_global_sam_name());
153         if (tevent_req_nomem(dom_maps[0].name, req)) {
154                 TALLOC_FREE(dom_maps);
155                 return tevent_req_post(req, ev);
156         }
157
158         lp_scan_idmap_domains(wb_xids2sids_add_dom, NULL);
159
160         wb_xids2sids_init_dom_maps_lookupname_next(state);
161         if (!tevent_req_is_in_progress(req)) {
162                 tevent_req_post(req, ev);
163         }
164         return req;
165 }
166
167 static void wb_xids2sids_init_dom_maps_lookupname_next(
168         struct wb_xids2sids_init_dom_maps_state *state)
169 {
170         struct tevent_req *subreq = NULL;
171
172         if (state->dom_idx == talloc_array_length(dom_maps)) {
173                 tevent_req_done(state->req);
174                 return;
175         }
176
177         if (strequal(dom_maps[state->dom_idx].name, "*")) {
178                 state->dom_idx++;
179                 if (state->dom_idx == talloc_array_length(dom_maps)) {
180                         tevent_req_done(state->req);
181                         return;
182                 }
183         }
184
185         subreq = wb_lookupname_send(state,
186                                     state->ev,
187                                     dom_maps[state->dom_idx].name,
188                                     dom_maps[state->dom_idx].name,
189                                     "",
190                                     LOOKUP_NAME_NO_NSS);
191         if (tevent_req_nomem(subreq, state->req)) {
192                 return;
193         }
194         tevent_req_set_callback(subreq,
195                                 wb_xids2sids_init_dom_maps_lookupname_done,
196                                 state->req);
197 }
198
199 static void wb_xids2sids_init_dom_maps_lookupname_done(
200         struct tevent_req *subreq)
201 {
202         struct tevent_req *req = tevent_req_callback_data(
203                 subreq, struct tevent_req);
204         struct wb_xids2sids_init_dom_maps_state *state = tevent_req_data(
205                 req, struct wb_xids2sids_init_dom_maps_state);
206         enum lsa_SidType type;
207         NTSTATUS status;
208
209         status = wb_lookupname_recv(subreq,
210                                     &dom_maps[state->dom_idx].sid,
211                                     &type);
212         TALLOC_FREE(subreq);
213         if (!NT_STATUS_IS_OK(status)) {
214                 DBG_WARNING("Lookup domain name '%s' failed '%s'\n",
215                             dom_maps[state->dom_idx].name,
216                             nt_errstr(status));
217
218                 state->dom_idx++;
219                 wb_xids2sids_init_dom_maps_lookupname_next(state);
220                 return;
221         }
222
223         if (type != SID_NAME_DOMAIN) {
224                 struct dom_sid_buf buf;
225
226                 DBG_WARNING("SID %s for idmap domain name '%s' "
227                             "not a domain SID\n",
228                             dom_sid_str_buf(&dom_maps[state->dom_idx].sid,
229                                             &buf),
230                             dom_maps[state->dom_idx].name);
231
232                 ZERO_STRUCT(dom_maps[state->dom_idx].sid);
233         }
234
235         state->dom_idx++;
236         wb_xids2sids_init_dom_maps_lookupname_next(state);
237
238         return;
239 }
240
241 static NTSTATUS wb_xids2sids_init_dom_maps_recv(struct tevent_req *req)
242 {
243         return tevent_req_simple_recv_ntstatus(req);
244 }
245
246 struct wb_xids2sids_dom_state {
247         struct tevent_context *ev;
248         struct unixid *all_xids;
249         size_t num_all_xids;
250         struct dom_sid *all_sids;
251         struct wb_xids2sids_dom_map *dom_map;
252         bool tried_dclookup;
253
254         size_t num_dom_xids;
255         struct unixid *dom_xids;
256         struct dom_sid *dom_sids;
257 };
258
259 static void wb_xids2sids_dom_done(struct tevent_req *subreq);
260 static void wb_xids2sids_dom_gotdc(struct tevent_req *subreq);
261
262 static struct tevent_req *wb_xids2sids_dom_send(
263         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
264         struct wb_xids2sids_dom_map *dom_map,
265         struct unixid *xids, size_t num_xids, struct dom_sid *sids)
266 {
267         struct tevent_req *req, *subreq;
268         struct wb_xids2sids_dom_state *state;
269         struct winbindd_child *child;
270         size_t i;
271
272         req = tevent_req_create(mem_ctx, &state,
273                                 struct wb_xids2sids_dom_state);
274         if (req == NULL) {
275                 return NULL;
276         }
277         state->ev = ev;
278         state->all_xids = xids;
279         state->num_all_xids = num_xids;
280         state->all_sids = sids;
281         state->dom_map = dom_map;
282
283         state->dom_xids = talloc_array(state, struct unixid, num_xids);
284         if (tevent_req_nomem(state->dom_xids, req)) {
285                 return tevent_req_post(req, ev);
286         }
287         state->dom_sids = talloc_array(state, struct dom_sid, num_xids);
288         if (tevent_req_nomem(state->dom_sids, req)) {
289                 return tevent_req_post(req, ev);
290         }
291
292         for (i=0; i<num_xids; i++) {
293                 struct unixid id = state->all_xids[i];
294
295                 if ((id.id < dom_map->low_id) || (id.id > dom_map->high_id)) {
296                         /* out of range */
297                         continue;
298                 }
299                 if (!is_null_sid(&state->all_sids[i])) {
300                         /* already mapped */
301                         continue;
302                 }
303                 state->dom_xids[state->num_dom_xids++] = id;
304         }
305
306         if (state->num_dom_xids == 0) {
307                 tevent_req_done(req);
308                 return tevent_req_post(req, ev);
309         }
310
311         child = idmap_child();
312         subreq = dcerpc_wbint_UnixIDs2Sids_send(
313                 state, ev, child->binding_handle, dom_map->name, dom_map->sid,
314                 state->num_dom_xids, state->dom_xids, state->dom_sids);
315         if (tevent_req_nomem(subreq, req)) {
316                 return tevent_req_post(req, ev);
317         }
318         tevent_req_set_callback(subreq, wb_xids2sids_dom_done, req);
319         return req;
320 }
321
322 static void wb_xids2sids_dom_done(struct tevent_req *subreq)
323 {
324         struct tevent_req *req = tevent_req_callback_data(
325                 subreq, struct tevent_req);
326         struct wb_xids2sids_dom_state *state = tevent_req_data(
327                 req, struct wb_xids2sids_dom_state);
328         struct wb_xids2sids_dom_map *dom_map = state->dom_map;
329         NTSTATUS status, result;
330         size_t i;
331         size_t dom_sid_idx;
332
333         status = dcerpc_wbint_UnixIDs2Sids_recv(subreq, state, &result);
334         TALLOC_FREE(subreq);
335         if (tevent_req_nterror(req, status)) {
336                 return;
337         }
338
339         if (NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) &&
340             !state->tried_dclookup) {
341
342                 subreq = wb_dsgetdcname_send(
343                         state, state->ev, state->dom_map->name, NULL, NULL,
344                         DS_RETURN_DNS_NAME);
345                 if (tevent_req_nomem(subreq, req)) {
346                         return;
347                 }
348                 tevent_req_set_callback(subreq, wb_xids2sids_dom_gotdc, req);
349                 return;
350         }
351
352         if (!NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
353             tevent_req_nterror(req, result)) {
354                 return;
355         }
356
357         dom_sid_idx = 0;
358
359         for (i=0; i<state->num_all_xids; i++) {
360                 struct unixid id = state->all_xids[i];
361
362                 if ((id.id < dom_map->low_id) || (id.id > dom_map->high_id)) {
363                         /* out of range */
364                         continue;
365                 }
366                 if (!is_null_sid(&state->all_sids[i])) {
367                         /* already mapped */
368                         continue;
369                 }
370
371                 sid_copy(&state->all_sids[i], &state->dom_sids[dom_sid_idx]);
372
373                 /*
374                  * Prime the cache after an xid2sid call. It's
375                  * important that we use state->dom_xids for the xid
376                  * value, not state->all_xids: state->all_xids carries
377                  * what we asked for, e.g. a
378                  * ID_TYPE_UID. state->dom_xids holds something the
379                  * idmap child possibly changed to ID_TYPE_BOTH.
380                  */
381                 idmap_cache_set_sid2unixid(
382                         &state->all_sids[i], &state->dom_xids[dom_sid_idx]);
383
384                 dom_sid_idx += 1;
385         }
386
387         tevent_req_done(req);
388 }
389
390 static void wb_xids2sids_dom_gotdc(struct tevent_req *subreq)
391 {
392         struct tevent_req *req = tevent_req_callback_data(
393                 subreq, struct tevent_req);
394         struct wb_xids2sids_dom_state *state = tevent_req_data(
395                 req, struct wb_xids2sids_dom_state);
396         struct winbindd_child *child = idmap_child();
397         struct netr_DsRGetDCNameInfo *dcinfo;
398         NTSTATUS status;
399
400         status = wb_dsgetdcname_recv(subreq, state, &dcinfo);
401         TALLOC_FREE(subreq);
402         if (tevent_req_nterror(req, status)) {
403                 return;
404         }
405
406         state->tried_dclookup = true;
407
408         status = wb_dsgetdcname_gencache_set(state->dom_map->name, dcinfo);
409         if (tevent_req_nterror(req, status)) {
410                 return;
411         }
412
413         child = idmap_child();
414         subreq = dcerpc_wbint_UnixIDs2Sids_send(
415                 state, state->ev, child->binding_handle, state->dom_map->name,
416                 state->dom_map->sid, state->num_dom_xids,
417                 state->dom_xids, state->dom_sids);
418         if (tevent_req_nomem(subreq, req)) {
419                 return;
420         }
421         tevent_req_set_callback(subreq, wb_xids2sids_dom_done, req);
422 }
423
424 static NTSTATUS wb_xids2sids_dom_recv(struct tevent_req *req)
425 {
426         return tevent_req_simple_recv_ntstatus(req);
427 }
428
429 struct wb_xids2sids_state {
430         struct tevent_context *ev;
431         struct unixid *xids;
432         size_t num_xids;
433         struct dom_sid *sids;
434
435         size_t dom_idx;
436 };
437
438 static void wb_xids2sids_done(struct tevent_req *subreq);
439 static void wb_xids2sids_init_dom_maps_done(struct tevent_req *subreq);
440
441 struct tevent_req *wb_xids2sids_send(TALLOC_CTX *mem_ctx,
442                                      struct tevent_context *ev,
443                                      struct unixid *xids,
444                                      uint32_t num_xids)
445 {
446         struct tevent_req *req, *subreq;
447         struct wb_xids2sids_state *state;
448
449         req = tevent_req_create(mem_ctx, &state,
450                                 struct wb_xids2sids_state);
451         if (req == NULL) {
452                 return NULL;
453         }
454         state->ev = ev;
455         state->xids = xids;
456         state->num_xids = num_xids;
457
458         state->sids = talloc_zero_array(state, struct dom_sid, num_xids);
459         if (tevent_req_nomem(state->sids, req)) {
460                 return tevent_req_post(req, ev);
461         }
462
463         if (winbindd_use_idmap_cache()) {
464                 uint32_t i;
465
466                 for (i=0; i<num_xids; i++) {
467                         struct dom_sid sid;
468                         bool ok, expired;
469
470                         switch (xids[i].type) {
471                             case ID_TYPE_UID:
472                                     ok = idmap_cache_find_uid2sid(
473                                             xids[i].id, &sid, &expired);
474                                     break;
475                             case ID_TYPE_GID:
476                                     ok = idmap_cache_find_gid2sid(
477                                             xids[i].id, &sid, &expired);
478                                     break;
479                             default:
480                                     ok = false;
481                         }
482
483                         if (ok && !expired) {
484                                 sid_copy(&state->sids[i], &sid);
485                         }
486                 }
487         }
488
489         subreq = wb_xids2sids_init_dom_maps_send(
490                 state, state->ev);
491         if (tevent_req_nomem(subreq, req)) {
492                 return tevent_req_post(req, ev);
493         }
494         tevent_req_set_callback(subreq, wb_xids2sids_init_dom_maps_done, req);
495         return req;
496 }
497
498 static void wb_xids2sids_init_dom_maps_done(struct tevent_req *subreq)
499 {
500         struct tevent_req *req = tevent_req_callback_data(
501                 subreq, struct tevent_req);
502         struct wb_xids2sids_state *state = tevent_req_data(
503                 req, struct wb_xids2sids_state);
504         size_t num_domains;
505         NTSTATUS status;
506
507         status = wb_xids2sids_init_dom_maps_recv(subreq);
508         TALLOC_FREE(subreq);
509         if (tevent_req_nterror(req, status)) {
510                 return;
511         }
512
513         num_domains = talloc_array_length(dom_maps);
514         if (num_domains == 0) {
515                 tevent_req_done(req);
516                 return;
517         }
518
519         subreq = wb_xids2sids_dom_send(
520                 state, state->ev, &dom_maps[state->dom_idx],
521                 state->xids, state->num_xids, state->sids);
522         if (tevent_req_nomem(subreq, req)) {
523                 return;
524         }
525         tevent_req_set_callback(subreq, wb_xids2sids_done, req);
526         return;
527 }
528
529 static void wb_xids2sids_done(struct tevent_req *subreq)
530 {
531         struct tevent_req *req = tevent_req_callback_data(
532                 subreq, struct tevent_req);
533         struct wb_xids2sids_state *state = tevent_req_data(
534                 req, struct wb_xids2sids_state);
535         size_t num_domains = talloc_array_length(dom_maps);
536         NTSTATUS status;
537
538         status = wb_xids2sids_dom_recv(subreq);
539         TALLOC_FREE(subreq);
540         if (tevent_req_nterror(req, status)) {
541                 return;
542         }
543
544         state->dom_idx += 1;
545
546         if (state->dom_idx >= num_domains) {
547                 tevent_req_done(req);
548                 return;
549         }
550
551         subreq = wb_xids2sids_dom_send(
552                 state, state->ev, &dom_maps[state->dom_idx],
553                 state->xids, state->num_xids, state->sids);
554         if (tevent_req_nomem(subreq, req)) {
555                 return;
556         }
557         tevent_req_set_callback(subreq, wb_xids2sids_done, req);
558 }
559
560 NTSTATUS wb_xids2sids_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
561                            struct dom_sid **sids)
562 {
563         struct wb_xids2sids_state *state = tevent_req_data(
564                 req, struct wb_xids2sids_state);
565         NTSTATUS status;
566
567         if (tevent_req_is_nterror(req, &status)) {
568                 DEBUG(5, ("wb_sids_to_xids failed: %s\n", nt_errstr(status)));
569                 return status;
570         }
571
572         *sids = talloc_move(mem_ctx, &state->sids);
573         return NT_STATUS_OK;
574 }