diff options
Diffstat (limited to 'source4/winbind')
| -rw-r--r-- | source4/winbind/config.mk | 4 | ||||
| -rw-r--r-- | source4/winbind/wb_async_helpers.c | 158 | ||||
| -rw-r--r-- | source4/winbind/wb_async_helpers.h | 5 | ||||
| -rw-r--r-- | source4/winbind/wb_cmd_getdcname.c | 33 | ||||
| -rw-r--r-- | source4/winbind/wb_cmd_list_trustdom.c | 124 | ||||
| -rw-r--r-- | source4/winbind/wb_cmd_lookupname.c | 49 | ||||
| -rw-r--r-- | source4/winbind/wb_cmd_lookupsid.c | 107 | ||||
| -rw-r--r-- | source4/winbind/wb_cmd_userdomgroups.c | 72 | ||||
| -rw-r--r-- | source4/winbind/wb_cmd_usersids.c | 333 | ||||
| -rw-r--r-- | source4/winbind/wb_connect_lsa.c | 14 | ||||
| -rw-r--r-- | source4/winbind/wb_domain_request.c | 157 | ||||
| -rw-r--r-- | source4/winbind/wb_init_domain.c | 162 | ||||
| -rw-r--r-- | source4/winbind/wb_pam_auth.c | 32 | ||||
| -rw-r--r-- | source4/winbind/wb_samba3_cmd.c | 165 | ||||
| -rw-r--r-- | source4/winbind/wb_samba3_protocol.c | 14 | ||||
| -rw-r--r-- | source4/winbind/wb_server.c | 2 | ||||
| -rw-r--r-- | source4/winbind/wb_server.h | 4 | ||||
| -rw-r--r-- | source4/winbind/wb_sid2domain.c | 223 |
18 files changed, 1418 insertions, 240 deletions
diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk index d071dd1604..551f5c47bb 100644 --- a/source4/winbind/config.mk +++ b/source4/winbind/config.mk @@ -10,11 +10,15 @@ INIT_OBJ_FILES = \ winbind/wb_samba3_protocol.o \ winbind/wb_samba3_cmd.o \ winbind/wb_init_domain.o \ + winbind/wb_sid2domain.o \ + winbind/wb_domain_request.o \ winbind/wb_connect_lsa.o \ winbind/wb_connect_sam.o \ winbind/wb_cmd_lookupname.o \ + winbind/wb_cmd_lookupsid.o \ winbind/wb_cmd_getdcname.o \ winbind/wb_cmd_userdomgroups.o \ + winbind/wb_cmd_usersids.o \ winbind/wb_pam_auth.o \ winbind/wb_async_helpers.o REQUIRED_SUBSYSTEMS = RPC_NDR_LSA diff --git a/source4/winbind/wb_async_helpers.c b/source4/winbind/wb_async_helpers.c index c8749896df..35f3ec3bb7 100644 --- a/source4/winbind/wb_async_helpers.c +++ b/source4/winbind/wb_async_helpers.c @@ -360,6 +360,163 @@ NTSTATUS wb_get_schannel_creds(struct cli_credentials *wks_creds, return wb_get_schannel_creds_recv(c, mem_ctx, netlogon_pipe); } +struct lsa_lookupsids_state { + struct composite_context *ctx; + int num_sids; + struct lsa_LookupSids r; + struct lsa_SidArray sids; + struct lsa_TransNameArray names; + uint32_t count; + struct wb_sid_object **result; +}; + +static void lsa_lookupsids_recv_names(struct rpc_request *req); + +struct composite_context *wb_lsa_lookupsids_send(struct dcerpc_pipe *lsa_pipe, + struct policy_handle *handle, + int num_sids, + const struct dom_sid **sids) +{ + struct composite_context *result; + struct rpc_request *req; + struct lsa_lookupsids_state *state; + int i; + + result = talloc_zero(NULL, struct composite_context); + if (result == NULL) goto failed; + result->state = COMPOSITE_STATE_IN_PROGRESS; + result->async.fn = NULL; + result->event_ctx = lsa_pipe->conn->event_ctx; + + state = talloc(result, struct lsa_lookupsids_state); + if (state == NULL) goto failed; + result->private_data = state; + state->ctx = result; + + state->sids.num_sids = num_sids; + state->sids.sids = talloc_array(state, struct lsa_SidPtr, num_sids); + if (state->sids.sids == NULL) goto failed; + + for (i=0; i<num_sids; i++) { + state->sids.sids[i].sid = dom_sid_dup(state->sids.sids, + sids[i]); + if (state->sids.sids[i].sid == NULL) goto failed; + } + + state->count = 0; + state->num_sids = num_sids; + state->names.count = 0; + state->names.names = NULL; + + state->r.in.handle = handle; + state->r.in.sids = &state->sids; + state->r.in.names = &state->names; + state->r.in.level = 1; + state->r.in.count = &state->count; + state->r.out.names = &state->names; + state->r.out.count = &state->count; + + req = dcerpc_lsa_LookupSids_send(lsa_pipe, state, &state->r); + if (req == NULL) goto failed; + + req->async.callback = lsa_lookupsids_recv_names; + req->async.private = state; + return result; + + failed: + talloc_free(result); + return NULL; +} + +static void lsa_lookupsids_recv_names(struct rpc_request *req) +{ + struct lsa_lookupsids_state *state = + talloc_get_type(req->async.private, + struct lsa_lookupsids_state); + int i; + + state->ctx->status = dcerpc_ndr_request_recv(req); + if (!composite_is_ok(state->ctx)) return; + state->ctx->status = state->r.out.result; + if (!NT_STATUS_IS_OK(state->ctx->status) && + !NT_STATUS_EQUAL(state->ctx->status, STATUS_SOME_UNMAPPED)) { + composite_error(state->ctx, state->ctx->status); + return; + } + + state->result = talloc_array(state, struct wb_sid_object *, + state->num_sids); + if (composite_nomem(state->result, state->ctx)) return; + + for (i=0; i<state->num_sids; i++) { + struct lsa_TranslatedName *name = + &state->r.out.names->names[i]; + struct lsa_TrustInformation *dom; + + state->result[i] = talloc_zero(state->result, + struct wb_sid_object); + if (composite_nomem(state->result[i], state->ctx)) return; + + state->result[i]->type = name->sid_type; + if (state->result[i]->type == SID_NAME_UNKNOWN) { + continue; + } + + if (name->sid_index >= state->r.out.domains->count) { + composite_error(state->ctx, + NT_STATUS_INVALID_PARAMETER); + return; + } + + dom = &state->r.out.domains->domains[name->sid_index]; + state->result[i]->domain = talloc_reference(state->result[i], + dom->name.string); + if ((name->sid_type == SID_NAME_DOMAIN) || + (name->name.string == NULL)) { + state->result[i]->name = + talloc_strdup(state->result[i], ""); + } else { + state->result[i]->name = + talloc_steal(state->result[i], + name->name.string); + } + + if (composite_nomem(state->result[i]->name, state->ctx)) { + return; + } + } + + composite_done(state->ctx); +} + +NTSTATUS wb_lsa_lookupsids_recv(struct composite_context *c, + TALLOC_CTX *mem_ctx, + struct wb_sid_object ***names) +{ + NTSTATUS status = composite_wait(c); + if (NT_STATUS_IS_OK(status)) { + struct lsa_lookupsids_state *state = + talloc_get_type(c->private_data, + struct lsa_lookupsids_state); + *names = talloc_steal(mem_ctx, state->result); + } + talloc_free(c); + return status; +} + +NTSTATUS wb_lsa_lookupsids(struct dcerpc_pipe *lsa_pipe, + struct policy_handle *handle, + int num_sids, const struct dom_sid **sids, + TALLOC_CTX *mem_ctx, + struct wb_sid_object ***names) +{ + struct composite_context *c = + wb_lsa_lookupsids_send(lsa_pipe, handle, num_sids, sids); + return wb_lsa_lookupnames_recv(c, mem_ctx, names); +} + + + struct lsa_lookupnames_state { struct composite_context *ctx; uint32_t num_names; @@ -747,4 +904,3 @@ NTSTATUS wb_samr_userdomgroups_recv(struct composite_context *ctx, talloc_free(ctx); return status; } - diff --git a/source4/winbind/wb_async_helpers.h b/source4/winbind/wb_async_helpers.h index 1bf1c78ca8..413747090c 100644 --- a/source4/winbind/wb_async_helpers.h +++ b/source4/winbind/wb_async_helpers.h @@ -33,3 +33,8 @@ struct wb_sid_object { const char *domain; const char *name; }; + +struct wb_dom_info { + const char *name; + const struct dom_sid *sid; +}; diff --git a/source4/winbind/wb_cmd_getdcname.c b/source4/winbind/wb_cmd_getdcname.c index 3ddcbc8962..72e0ba0efd 100644 --- a/source4/winbind/wb_cmd_getdcname.c +++ b/source4/winbind/wb_cmd_getdcname.c @@ -24,6 +24,7 @@ #include "libcli/composite/composite.h" #include "winbind/wb_server.h" #include "smbd/service_stream.h" +#include "smbd/service_task.h" #include "librpc/gen_ndr/ndr_netlogon.h" @@ -63,7 +64,7 @@ static void composite_netr_GetAnyDCName_recv_rpc(struct rpc_request *req) composite_done(ctx); } -NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx) +static NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx) { NTSTATUS status = composite_wait(ctx); talloc_free(ctx); @@ -72,30 +73,28 @@ NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx) struct cmd_getdcname_state { struct composite_context *ctx; - struct wbsrv_domain *domain; const char *domain_name; struct netr_GetAnyDCName g; }; -static struct composite_context *getdcname_send_req(void *p); +static struct composite_context *getdcname_send_req(struct wbsrv_domain *domain, + void *p); static NTSTATUS getdcname_recv_req(struct composite_context *ctx, void *p); -struct composite_context *wb_cmd_getdcname_send(struct wbsrv_call *call, - const char *domain) +struct composite_context *wb_cmd_getdcname_send(struct wbsrv_service *service, + struct wbsrv_domain *domain, + const char *domain_name) { struct cmd_getdcname_state *state; - struct wbsrv_service *service = call->wbconn->listen_socket->service; state = talloc(NULL, struct cmd_getdcname_state); - state->domain = service->domains; - state->domain_name = talloc_strdup(state, domain); - state->ctx = wb_queue_domain_send(state, state->domain, - call->event_ctx, - call->wbconn->conn->msg_ctx, - getdcname_send_req, - getdcname_recv_req, - state); + state->domain_name = talloc_strdup(state, domain_name); + state->ctx = wb_domain_request_send(state, service, + service->primary_sid, + getdcname_send_req, + getdcname_recv_req, + state); if (state->ctx == NULL) { talloc_free(state); return NULL; @@ -104,17 +103,17 @@ struct composite_context *wb_cmd_getdcname_send(struct wbsrv_call *call, return state->ctx; } -static struct composite_context *getdcname_send_req(void *p) +static struct composite_context *getdcname_send_req(struct wbsrv_domain *domain, void *p) { struct cmd_getdcname_state *state = talloc_get_type(p, struct cmd_getdcname_state); state->g.in.logon_server = talloc_asprintf( state, "\\\\%s", - dcerpc_server_name(state->domain->netlogon_pipe)); + dcerpc_server_name(domain->netlogon_pipe)); state->g.in.domainname = state->domain_name; - return composite_netr_GetAnyDCName_send(state->domain->netlogon_pipe, + return composite_netr_GetAnyDCName_send(domain->netlogon_pipe, state, &state->g); } diff --git a/source4/winbind/wb_cmd_list_trustdom.c b/source4/winbind/wb_cmd_list_trustdom.c new file mode 100644 index 0000000000..1f3ba267d0 --- /dev/null +++ b/source4/winbind/wb_cmd_list_trustdom.c @@ -0,0 +1,124 @@ +/* + Unix SMB/CIFS implementation. + + Command backend for wbinfo -m + + Copyright (C) Volker Lendecke 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "winbind/wb_server.h" +#include "smbd/service_stream.h" +#include "smbd/service_task.h" + +/* List trusted domains. To avoid the trouble with having to wait for other + * conflicting requests waiting for the lsa pipe we're opening our own lsa + * pipe here. */ + +struct cmd_list_trustdom_state { + struct composite_context *ctx; + struct dcerpc_pipe *lsa_pipe; + struct policy_handle *lsa_policy; + int num_domains; + struct wb_dom_info *domains; + + uint32_t resume_handle; + struct lsa_DomainList domains; + struct lsa_EnumTrustDom r; +}; + +static void cmd_list_trustdoms_recv_domain(struct composite_context *ctx); +static void cmd_list_trustdoms_recv_lsa(struct composite_context *ctx); +static void cmd_list_trustdoms_recv_doms(struct rpc_request *req); + +struct composite_context *wb_cmd_list_trustdoms_send(struct wbsrv_service *service) +{ + struct composite_context *result, *ctx; + struct cmd_list_trustdom_state *state; + + result = talloc_zero(NULL, struct composite_context); + if (result == NULL) goto failed; + result->state = COMPOSITE_STATE_IN_PROGRESS; + result->async.fn = NULL; + result->event_ctx = service->task->event_ctx; + + state = talloc(result, struct cmd_list_trustdom_state); + if (state == NULL) goto failed; + state->ctx = result; + result->private_data = state; + + state->service = service; + + ctx = wb_sid2domain_send(service, service->primary_sid); + if (ctx == NULL) goto failed; + ctx->async.fn = cmd_list_trustdoms_recv_domain; + ctx->async.private_data = state; + return result; + + failed: + talloc_free(result); + return NULL; +} + +static void cmd_list_trustdoms_recv_domain(struct composite_context *ctx) +{ + struct cmd_list_trustdom_state *state = + talloc_get_type(ctx->async.private_data, + struct cmd_list_trustdom_state); + struct wbsrv_domain *domain; + struct smbcli_tree *tree; + + state->ctx->status = wb_sid2domain_recv(ctx, &domain); + if (!composite_is_ok(state->ctx)) return; + + tree = dcerpc_smb_tree(domain->lsa_pipe); + if (composite_nomem(tree, state->tree)) return; + + ctx = wb_init_lsa_send(tree, domain->lsa_auth_type, + domain->schannel_creds); + composite_continue(state->ctx, ctx, cmd_list_trustdoms_recv_lsa, + state); +} + +static void cmd_list_trustdoms_recv_lsa(struct composite_context *ctx) +{ + struct cmd_list_trustdom_state *state = + talloc_get_type(ctx->async.private_data, + struct cmd_list_trustdom_state); + struct rpc_request *req; + + state->ctx->status = wb_init_lsa_recv(ctx, state, + &state->lsa_pipe, + &state->lsa_policy); + if (!composite_is_ok(state->ctx)) return; + + state->resume_handle = 0; + state->r.in.policy_handle = state->lsa_policy; + state->r.in.resume_handle = &state->resume_handle; + state->r.in.max_size = 1000; + state->r.out.resume_handle = &state->resume_handle; + + req = dcerpc_lsa_EnumTrustDom_send(state->lsa_pipe, state, &state->r); + composite_continue_rpc(state->ctx, req, cmd_list_trustdoms_recv_doms, + state); +} + +static void cmd_list_trustdoms_recv_doms(struct rpc_request *req) +{ + +} diff --git a/source4/winbind/wb_cmd_lookupname.c b/source4/winbind/wb_cmd_lookupname.c index 9889b70d84..abdcaad02d 100644 --- a/source4/winbind/wb_cmd_lookupname.c +++ b/source4/winbind/wb_cmd_lookupname.c @@ -24,49 +24,49 @@ #include "libcli/composite/composite.h" #include "winbind/wb_server.h" #include "smbd/service_stream.h" +#include "smbd/service_task.h" struct cmd_lookupname_state { struct composite_context *ctx; - struct wbsrv_call *call; - struct wbsrv_domain *domain; const char *name; struct wb_sid_object *result; }; -static struct composite_context *lookupname_send_req(void *p); +static struct composite_context *lookupname_send_req(struct wbsrv_domain *domain, void *p); static NTSTATUS lookupname_recv_req(struct composite_context *ctx, void *p); -struct composite_context *wb_cmd_lookupname_send(struct wbsrv_call *call, +struct composite_context *wb_cmd_lookupname_send(struct wbsrv_service *service, + struct wbsrv_domain *domain, + const char *dom_name, const char *name) { struct cmd_lookupname_state *state; - struct wbsrv_service *service = call->wbconn->listen_socket->service; state = talloc(NULL, struct cmd_lookupname_state); - state->domain = service->domains; - state->call = call; - state->name = talloc_strdup(state, name); - state->ctx = wb_queue_domain_send(state, state->domain, - call->event_ctx, - call->wbconn->conn->msg_ctx, - lookupname_send_req, - lookupname_recv_req, - state); - if (state->ctx == NULL) { - talloc_free(state); - return NULL; - } + state->name = talloc_asprintf(state, "%s\\%s", dom_name, name); + if (state->name == NULL) goto failed; + state->ctx = wb_domain_request_send(state, service, + service->primary_sid, + lookupname_send_req, + lookupname_recv_req, + state); + if (state->ctx == NULL) goto failed; state->ctx->private_data = state; return state->ctx; + + failed: + talloc_free(state); + return NULL; } -static struct composite_context *lookupname_send_req(void *p) +static struct composite_context *lookupname_send_req(struct wbsrv_domain *domain, + void *p) { struct cmd_lookupname_state *state = talloc_get_type(p, struct cmd_lookupname_state); - return wb_lsa_lookupnames_send(state->domain->lsa_pipe, - state->domain->lsa_policy, + return wb_lsa_lookupnames_send(domain->lsa_pipe, + domain->lsa_policy, 1, &state->name); } @@ -98,10 +98,13 @@ NTSTATUS wb_cmd_lookupname_recv(struct composite_context *c, return status; } -NTSTATUS wb_cmd_lookupname(struct wbsrv_call *call, const char *name, +NTSTATUS wb_cmd_lookupname(struct wbsrv_service *service, + struct wbsrv_domain *domain, + const char *dom_name, + const char *name, TALLOC_CTX *mem_ctx, struct wb_sid_object **sid) { struct composite_context *c = - wb_cmd_lookupname_send(call, name); + wb_cmd_lookupname_send(service, domain, dom_name, name); return wb_cmd_lookupname_recv(c, mem_ctx, sid); } diff --git a/source4/winbind/wb_cmd_lookupsid.c b/source4/winbind/wb_cmd_lookupsid.c new file mode 100644 index 0000000000..c189f0329a --- /dev/null +++ b/source4/winbind/wb_cmd_lookupsid.c @@ -0,0 +1,107 @@ +/* + Unix SMB/CIFS implementation. + + Command backend for wbinfo -s + + Copyright (C) Volker Lendecke 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "winbind/wb_server.h" +#include "smbd/service_stream.h" +#include "smbd/service_task.h" + +struct cmd_lookupsid_state { + struct composite_context *ctx; + const struct dom_sid *sid; + struct wb_sid_object *result; +}; + +static struct composite_context *lookupsid_send_req(struct wbsrv_domain *domain, void *p); +static NTSTATUS lookupsid_recv_req(struct composite_context *ctx, void *p); + +struct composite_context *wb_cmd_lookupsid_send(struct wbsrv_service *service, + struct wbsrv_domain *domain, + const struct dom_sid *sid) +{ + struct cmd_lookupsid_state *state; + + state = talloc(NULL, struct cmd_lookupsid_state); + state->sid = dom_sid_dup(state, sid); + if (state->sid == NULL) goto failed; + state->ctx = wb_domain_request_send(state, service, + service->primary_sid, + lookupsid_send_req, + lookupsid_recv_req, + state); + if (state->ctx == NULL) goto failed; + state->ctx->private_data = state; + return state->ctx; + + failed: + talloc_free(state); + return NULL; +} + +static struct composite_context *lookupsid_send_req(struct wbsrv_domain *domain, void *p) +{ + struct cmd_lookupsid_state *state = + talloc_get_type(p, struct cmd_lookupsid_state); + + return wb_lsa_lookupsids_send(domain->lsa_pipe, + domain->lsa_policy, + 1, &state->sid); +} + +static NTSTATUS lookupsid_recv_req(struct composite_context *ctx, void *p) +{ + struct cmd_lookupsid_state *state = + talloc_get_type(p, struct cmd_lookupsid_state); + struct wb_sid_object **names; + NTSTATUS status; + + status = wb_lsa_lookupsids_recv(ctx, state, &names); + if (NT_STATUS_IS_OK(status)) { + state->result = names[0]; + } + return status; +} + +NTSTATUS wb_cmd_lookupsid_recv(struct composite_context *c, + TALLOC_CTX *mem_ctx, + struct wb_sid_object **sid) +{ + struct cmd_lookupsid_state *state = + talloc_get_type(c->private_data, struct cmd_lookupsid_state); + NTSTATUS status = composite_wait(c); + if (NT_STATUS_IS_OK(status)) { + *sid = talloc_steal(mem_ctx, state->result); + } + talloc_free(state); + return status; +} + +NTSTATUS wb_cmd_lookupsid(struct wbsrv_service *service, + struct wbsrv_domain *domain, + const struct dom_sid *sid, + TALLOC_CTX *mem_ctx, struct wb_sid_object **name) +{ + struct composite_context *c = + wb_cmd_lookupsid_send(service, domain, sid); + return wb_cmd_lookupsid_recv(c, mem_ctx, name); +} diff --git a/source4/winbind/wb_cmd_userdomgroups.c b/source4/winbind/wb_cmd_userdomgroups.c index ea2db9877f..b69547b3e4 100644 --- a/source4/winbind/wb_cmd_userdomgroups.c +++ b/source4/winbind/wb_cmd_userdomgroups.c @@ -29,70 +29,29 @@ struct cmd_userdomgroups_state { struct composite_context *ctx; - struct wbsrv_domain *domain; + struct dom_sid *dom_sid; uint32_t user_rid; int num_rids; uint32_t *rids; }; -static void composite_trigger_now(struct event_context *ev, - struct timed_event *te, - struct timeval t, void *ptr) -{ - struct composite_context *c = - talloc_get_type(ptr, struct composite_context); - if (NT_STATUS_IS_OK(c->status)) { - c->state = COMPOSITE_STATE_ERROR; - } else { - c->state = COMPOSITE_STATE_DONE; - } - - if (c->async.fn) { - c->async.fn(c); - } -} - - -static struct composite_context *userdomgroups_send_req(void *p); +static struct composite_context *userdomgroups_send_req(struct wbsrv_domain *domain, void *p); static NTSTATUS userdomgroups_recv_req(struct composite_context *ctx, void *p); -struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_call *call, +struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_service *service, const struct dom_sid *sid) { struct cmd_userdomgroups_state *state; - struct wbsrv_service *service = call->wbconn->listen_socket->service; state = talloc(NULL, struct cmd_userdomgroups_state); - state->domain = service->domains; - - if (dom_sid_in_domain(state->domain->sid, sid)) { - state->user_rid = sid->sub_auths[sid->num_auths-1]; - state->ctx = wb_queue_domain_send(state, state->domain, - call->event_ctx, - call->wbconn->conn->msg_ctx, - userdomgroups_send_req, - userdomgroups_recv_req, - state); - if (state->ctx == NULL) goto failed; - state->ctx->private_data = state; - return state->ctx; - } - state->ctx = talloc(state, struct composite_context); + state->user_rid = sid->sub_auths[sid->num_auths-1]; + state->ctx = wb_domain_request_send(state, service, sid, + userdomgroups_send_req, + userdomgroups_recv_req, + state); if (state->ctx == NULL) goto failed; - state->ctx->state = COMPOSITE_STATE_IN_PROGRESS; - state->ctx->async.fn = NULL; - state->ctx->event_ctx = call->event_ctx; - state->ctx->status = NT_STATUS_NO_SUCH_USER; state->ctx->private_data = state; - - /* Using composite_trigger_error here causes problems with the client - * socket. Linux 2.6.8 gives me a ECONNRESET on the next read after - * writing the reply when I don't wait the 100 milliseconds. */ - - event_add_timed(state->ctx->event_ctx, state->ctx, - timeval_current_ofs(0, 100000), - composite_trigger_now, state->ctx); return state->ctx; failed: @@ -100,13 +59,16 @@ struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_call *call, return NULL; } -static struct composite_context *userdomgroups_send_req(void *p) +static struct composite_context *userdomgroups_send_req(struct wbsrv_domain *domain, + void *p) { struct cmd_userdomgroups_state *state = talloc_get_type(p, struct cmd_userdomgroups_state); - return wb_samr_userdomgroups_send(state->domain->samr_pipe, - state->domain->domain_handle, + state->dom_sid = talloc_reference(state, domain->sid); + if (state->dom_sid == NULL) return NULL; + return wb_samr_userdomgroups_send(domain->samr_pipe, + domain->domain_handle, state->user_rid); } @@ -140,7 +102,7 @@ NTSTATUS wb_cmd_userdomgroups_recv(struct composite_context *c, } for (i=0; i<state->num_rids; i++) { - (*sids)[i] = dom_sid_add_rid((*sids), state->domain->sid, + (*sids)[i] = dom_sid_add_rid((*sids), state->dom_sid, state->rids[i]); if ((*sids)[i] == NULL) { status = NT_STATUS_NO_MEMORY; @@ -153,12 +115,12 @@ done: return status; } -NTSTATUS wb_cmd_userdomgroups(struct wbsrv_call *call, +NTSTATUS wb_cmd_userdomgroups(struct wbsrv_service *service, const struct dom_sid *sid, TALLOC_CTX *mem_ctx, int *num_sids, struct dom_sid ***sids) { struct composite_context *c = - wb_cmd_userdomgroups_send(call, sid); + wb_cmd_userdomgroups_send(service, sid); return wb_cmd_userdomgroups_recv(c, mem_ctx, num_sids, sids); } diff --git a/source4/winbind/wb_cmd_usersids.c b/source4/winbind/wb_cmd_usersids.c new file mode 100644 index 0000000000..47c69fffc8 --- /dev/null +++ b/source4/winbind/wb_cmd_usersids.c @@ -0,0 +1,333 @@ +/* + Unix SMB/CIFS implementation. + + Command backend for wbinfo --user-sids + + Copyright (C) Volker Lendecke 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "winbind/wb_server.h" +#include "smbd/service_stream.h" +#include "smbd/service_task.h" +#include "lib/events/events.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "librpc/gen_ndr/ndr_samr.h" + +/* Calculate the token in two steps: Go the user's originating domain, asking + * for the user's domain groups. Then with the resulting list of sids go to + * our own domain, expanding the aliases aka domain local groups. Two helpers + * are needed: composite_samr_GetAliasMembership and wb_sidaliases. The core + * function this file supplies is wb_cmd_usersids somewhere down. */ + + +/* composite_context wrapper around dcerpc_samr_GetAliasMembership */ + +static void composite_samr_GetAliasMembership_recv_rpc(struct rpc_request *req); + +static struct composite_context *composite_samr_GetAliasMembership_send(struct dcerpc_pipe *p, + TALLOC_CTX *mem_ctx, + struct samr_GetAliasMembership *r) +{ + struct composite_context *result; + struct rpc_request *req; + + result = talloc(mem_ctx, struct composite_context); + if (result == NULL) goto failed; + result->state = COMPOSITE_STATE_IN_PROGRESS; + result->async.fn = NULL; + result->event_ctx = p->conn->event_ctx; + + req = dcerpc_samr_GetAliasMembership_send(p, mem_ctx, r); + if (req == NULL) goto failed; + req->async.callback = composite_samr_GetAliasMembership_recv_rpc; + req->async.private = result; + return result; + + failed: + talloc_free(result); + return NULL; +} + +static void composite_samr_GetAliasMembership_recv_rpc(struct rpc_request *req) +{ + struct composite_context *ctx = + talloc_get_type(req->async.private, struct composite_context); + + ctx->status = dcerpc_ndr_request_recv(req); + if (!composite_is_ok(ctx)) return; + composite_done(ctx); +} + +static NTSTATUS composite_samr_GetAliasMembership_recv(struct composite_context *ctx) +{ + NTSTATUS status = composite_wait(ctx); + talloc_free(ctx); + return status; +} + +/* Composite wrapper including domain selection and domain queueing around + * GetAliasMemberships */ + +struct sidaliases_state { + struct composite_context *ctx; + int num_sids; + const struct dom_sid *domain_sid; + const struct dom_sid *sids; + + struct lsa_SidArray lsa_sids; + struct samr_Ids rids; + struct samr_GetAliasMembership r; +}; + +static struct composite_context *sidaliases_send_req(struct wbsrv_domain *domain, + void *p); +static NTSTATUS sidaliases_recv_req(struct composite_context *ctx, void *p); + +static struct composite_context *wb_sidaliases_send(struct wbsrv_service *service, + int num_sids, + struct dom_sid **sids) +{ + struct sidaliases_state *state; + int i; + + state = talloc(NULL, struct sidaliases_state); + + state->domain_sid = talloc_reference(state, service->primary_sid); + if (state->domain_sid == NULL) goto failed; + + state->lsa_sids.num_sids = num_sids; + state->lsa_sids.sids = talloc_array(state, struct lsa_SidPtr, + num_sids); + if (state->lsa_sids.sids == NULL) goto failed; + + for (i=0; i<state->lsa_sids.num_sids; i++) { + state->lsa_sids.sids[i].sid = + talloc_reference(state->lsa_sids.sids, sids[i]); + if (state->lsa_sids.sids[i].sid == NULL) goto failed; + } + + state->rids.count = 0; + state->rids.ids = NULL; + + state->ctx = wb_domain_request_send(state, service, + service->primary_sid, + sidaliases_send_req, + sidaliases_recv_req, + state); + if (state->ctx == NULL) goto failed; + state->ctx->private_data = state; + return state->ctx; + + failed: + talloc_free(state); + return NULL; +} + +static struct composite_context *sidaliases_send_req(struct wbsrv_domain *domain, + void *p) +{ + struct sidaliases_state *state = + talloc_get_type(p, struct sidaliases_state); + + state->r.in.domain_handle = domain->domain_handle; + state->r.in.sids = &state->lsa_sids; + state->r.out.rids = &state->rids; + + return composite_samr_GetAliasMembership_send(domain->samr_pipe, + state, &state->r); +} + +static NTSTATUS sidaliases_recv_req(struct composite_context *ctx, void *p) +{ + struct sidaliases_state *state = + talloc_get_type(p, struct sidaliases_state); + NTSTATUS status; + + status = composite_samr_GetAliasMembership_recv(ctx); + NT_STATUS_NOT_OK_RETURN(status); + return state->r.out.result; +} + +static NTSTATUS wb_sidaliases_recv(struct composite_context *ctx, + TALLOC_CTX *mem_ctx, + int *num_sids, + struct dom_sid ***sids) +{ + struct sidaliases_state *state = + talloc_get_type(ctx->private_data, + struct sidaliases_state); + NTSTATUS status; + int i; + + status = composite_wait(ctx); + if (!NT_STATUS_IS_OK(status)) goto done; + + *num_sids = state->r.out.rids->count; + *sids = talloc_array(mem_ctx, struct dom_sid *, *num_sids); + if (*sids == NULL) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + for (i=0; i<*num_sids; i++) { + (*sids)[i] = dom_sid_add_rid((*sids), state->domain_sid, + state->r.out.rids->ids[i]); + if ((*sids)[i] == NULL) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + } + + done: + talloc_free(state); + return status; +} + +/* Supplied a SID, go to the user's DC, ask it for the user's domain + * groups. Then go to our DC, ask it for the domain local groups. */ + +struct cmd_usersids_state { + struct composite_context *ctx; + struct wbsrv_service *service; + struct dom_sid *user_sid; + int num_domgroups; + struct dom_sid **domgroups; + int num_sids; + struct dom_sid **sids; +}; + +static void cmd_usersids_recv_domgroups(struct composite_context *ctx); +static void cmd_usersids_recv_aliases(struct composite_context *ctx); + +struct composite_context *wb_cmd_usersids_send(struct wbsrv_service *service, + const struct dom_sid *sid) +{ + struct composite_context *result, *ctx; + struct cmd_usersids_state *state; + + result = talloc_zero(NULL, struct composite_context); + if (result == NULL) goto failed; + result->state = COMPOSITE_STATE_IN_PROGRESS; + result->async.fn = NULL; + result->event_ctx = service->task->event_ctx; + + state = talloc(result, struct cmd_usersids_state); + if (state == NULL) goto failed; + state->ctx = result; + result->private_data = state; + + state->service = service; + state->user_sid = dom_sid_dup(state, sid); + if (state->user_sid == NULL) goto failed; + + ctx = wb_cmd_userdomgroups_send(service, sid); + if (ctx == NULL) goto failed; + + ctx->async.fn = cmd_usersids_recv_domgroups; + ctx->async.private_data = state; + return result; + + failed: + talloc_free(result); + return NULL; +} + +static void cmd_usersids_recv_domgroups(struct composite_context *ctx) +{ + struct cmd_usersids_state *state = + talloc_get_type(ctx->async.private_data, + struct cmd_usersids_state); + + int i; + struct dom_sid **sids; + + state->ctx->status = wb_cmd_userdomgroups_recv(ctx, state, + &state->num_domgroups, + &state->domgroups); + if (!composite_is_ok(state->ctx)) return; + + sids = talloc_array(state, struct dom_sid *, state->num_domgroups+1); + if (composite_nomem(sids, state->ctx)) return; + + sids[0] = state->user_sid; + for (i=0; i<state->num_domgroups; i++) { + sids[i+1] = state->domgroups[i]; + } + + ctx = wb_sidaliases_send(state->service, state->num_domgroups+1, + sids); + composite_continue(state->ctx, ctx, cmd_usersids_recv_aliases, state); +} + +static void cmd_usersids_recv_aliases(struct composite_context *ctx) +{ + struct cmd_usersids_state *state = + talloc_get_type(ctx->async.private_data, + struct cmd_usersids_state); + int i, num_aliases; + struct dom_sid **aliases; + + state->ctx->status = wb_sidaliases_recv(ctx, state, &num_aliases, + &aliases); + if (!composite_is_ok(state->ctx)) return; + + state->num_sids = 1 + state->num_domgroups + num_aliases; + state->sids = talloc_array(state, struct dom_sid *, state->num_sids); + if (composite_nomem(state->sids, state->ctx)) return; + + state->sids[0] = talloc_steal(state->sids, state->user_sid); + + for (i=0; i<state->num_domgroups; i++) { + state->sids[1+i] = + talloc_steal(state->sids, state->domgroups[i]); + } + + for (i=0; i<num_aliases; i++) { + state->sids[1+i+state->num_domgroups] = + talloc_steal(state->sids, aliases[i]); + } + + composite_done(state->ctx); +} + +NTSTATUS wb_cmd_usersids_recv(struct composite_context *ctx, + TALLOC_CTX *mem_ctx, + int *num_sids, struct dom_sid ***sids) +{ + NTSTATUS status = composite_wait(ctx); + if (NT_STATUS_IS_OK(status)) { + struct cmd_usersids_state *state = + talloc_get_type(ctx->private_data, + struct cmd_usersids_state); + *num_sids = state->num_sids; + *sids = talloc_steal(mem_ctx, state->sids); + } + talloc_free(ctx); + return status; +} + +NTSTATUS wb_cmd_usersids(struct wbsrv_service *service, + const struct dom_sid *sid, + TALLOC_CTX *mem_ctx, int *num_sids, + struct dom_sid ***sids) +{ + struct composite_context *c = + wb_cmd_usersids_send(service, sid); + return wb_cmd_usersids_recv(c, mem_ctx, num_sids, sids); +} + diff --git a/source4/winbind/wb_connect_lsa.c b/source4/winbind/wb_connect_lsa.c index 82fe3b2e74..ada510a22c 100644 --- a/source4/winbind/wb_connect_lsa.c +++ b/source4/winbind/wb_connect_lsa.c @@ -45,9 +45,9 @@ struct init_lsa_state { static void init_lsa_recv_pipe(struct composite_context *ctx); static void init_lsa_recv_openpol(struct rpc_request *req); -static struct composite_context *wb_init_lsa_send(struct smbcli_tree *tree, - uint8_t auth_type, - struct cli_credentials *creds) +struct composite_context *wb_init_lsa_send(struct smbcli_tree *tree, + uint8_t auth_type, + struct cli_credentials *creds) { struct composite_context *result, *ctx; struct init_lsa_state *state; @@ -147,10 +147,10 @@ static void init_lsa_recv_openpol(struct rpc_request *req) composite_done(state->ctx); } -static NTSTATUS wb_init_lsa_recv(struct composite_context *c, - TALLOC_CTX *mem_ctx, - struct dcerpc_pipe **lsa_pipe, - struct policy_handle **lsa_policy) +NTSTATUS wb_init_lsa_recv(struct composite_context *c, + TALLOC_CTX *mem_ctx, + struct dcerpc_pipe **lsa_pipe, + struct policy_handle **lsa_policy) { NTSTATUS status = composite_wait(c); if (NT_STATUS_IS_OK(status)) { diff --git a/source4/winbind/wb_domain_request.c b/source4/winbind/wb_domain_request.c new file mode 100644 index 0000000000..b516331f8a --- /dev/null +++ b/source4/winbind/wb_domain_request.c @@ -0,0 +1,157 @@ +/* + Unix SMB/CIFS implementation. + + A composite API for initializing a domain + + Copyright (C) Volker Lendecke 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "winbind/wb_server.h" +#include "smbd/service_stream.h" +#include "smbd/service_task.h" +#include "dlinklist.h" + +struct domain_request_state { + struct domain_request_state *prev, *next; + struct composite_context *ctx; + struct wbsrv_service *service; + struct wbsrv_domain *domain; + struct composite_context *(*send_fn)(struct wbsrv_domain *domain, + void *p); + NTSTATUS (*recv_fn)(struct composite_context *c, + void *p); + void *private_data; +}; + +static void domain_request_recv_domain(struct composite_context *ctx); +static void domain_request_recv_init(struct composite_context *ctx); +static void domain_request_recv_sub(struct composite_context *ctx); + +struct composite_context *wb_domain_request_send(TALLOC_CTX *mem_ctx, + struct wbsrv_service *service, + const struct dom_sid *sid, + struct composite_context *(*send_fn)(struct wbsrv_domain *domain, void *p), + NTSTATUS (*recv_fn)(struct composite_context *c, + void *p), + void *private_data) + +{ + struct composite_context *result, *ctx; + struct domain_request_state *state; + + result = talloc(mem_ctx, struct composite_context); + if (result == NULL) goto failed; + result->state = COMPOSITE_STATE_IN_PROGRESS; + result->async.fn = NULL; + result->event_ctx = service->task->event_ctx; + + state = talloc_zero(result, struct domain_request_state); + if (state == NULL) goto failed; + state->ctx = result; + result->private_data = state; + + state->service = service; + state->send_fn = send_fn; + state->recv_fn = recv_fn; + state->private_data = private_data; + + ctx = wb_sid2domain_send(service, sid); + if (ctx == NULL) goto failed; + + ctx->async.fn = domain_request_recv_domain; + ctx->async.private_data = state; + return result; + + failed: + talloc_free(result); + return NULL; +} + +static void domain_request_recv_domain(struct composite_context *ctx) +{ + struct domain_request_state *state = + talloc_get_type(ctx->async.private_data, + struct domain_request_state); + + state->ctx->status = wb_sid2domain_recv(ctx, &state->domain); + if (!composite_is_ok(state->ctx)) return; + + if (state->domain->busy) { + DEBUG(3, ("Domain %s busy\n", state->domain->name)); + DLIST_ADD_END(state->domain->request_queue, state, + struct domain_request_state *); + return; + } + + state->domain->busy = True; + + if (!state->domain->initialized) { + ctx = wb_init_domain_send(state->domain, + state->service->task->event_ctx, + state->service->task->msg_ctx); + composite_continue(state->ctx, ctx, domain_request_recv_init, + state); + return; + } + + ctx = state->send_fn(state->domain, state->private_data); + composite_continue(state->ctx, ctx, domain_request_recv_sub, state); +} + +static void domain_request_recv_init(struct composite_context *ctx) +{ + struct domain_request_state *state = + talloc_get_type(ctx->async.private_data, + struct domain_request_state); + + state->ctx->status = wb_init_domain_recv(ctx); + if (!composite_is_ok(state->ctx)) return; + + ctx = state->send_fn(state->domain, state->private_data); + composite_continue(state->ctx, ctx, domain_request_recv_sub, state); +} + +static void domain_request_recv_sub(struct composite_context *ctx) +{ + struct domain_request_state *state = + talloc_get_type(ctx->async.private_data, + struct domain_request_state); + + state->ctx->status = state->recv_fn(ctx, state->private_data); + state->domain->busy = False; + + if (state->domain->request_queue != NULL) { + struct domain_request_state *s2; + s2 = state->domain->request_queue; + DLIST_REMOVE(state->domain->request_queue, s2); + ctx = s2->send_fn(state->domain, s2->private_data); + composite_continue(s2->ctx, ctx, domain_request_recv_sub, s2); + state->domain->busy = True; + } + + if (!composite_is_ok(state->ctx)) return; + composite_done(state->ctx); +} + +NTSTATUS wb_domain_request_recv(struct composite_context *ctx) +{ + NTSTATUS status = composite_wait(ctx); + talloc_free(ctx); + return status; +} diff --git a/source4/winbind/wb_init_domain.c b/source4/winbind/wb_init_domain.c index e89d70d5c6..7bed7e47ba 100644 --- a/source4/winbind/wb_init_domain.c +++ b/source4/winbind/wb_init_domain.c @@ -26,6 +26,7 @@ #include "winbind/wb_async_helpers.h" #include "winbind/wb_server.h" #include "smbd/service_stream.h" +#include "smbd/service_task.h" #include "dlinklist.h" #include "librpc/gen_ndr/nbt.h" @@ -84,6 +85,7 @@ struct init_domain_state { }; static void init_domain_recv_dcs(struct composite_context *ctx); +static void init_domain_recv_dcip(struct composite_context *ctx); static void init_domain_recv_tree(struct composite_context *ctx); static void init_domain_recv_netlogoncreds(struct composite_context *ctx); static void init_domain_recv_netlogonpipe(struct composite_context *ctx); @@ -111,6 +113,17 @@ struct composite_context *wb_init_domain_send(struct wbsrv_domain *domain, state->domain = domain; + if (domain->dcname != NULL) { + struct nbt_name name; + make_nbt_name(&name, domain->dcname, 0x20); + ctx = resolve_name_send(&name, result->event_ctx, + lp_name_resolve_order()); + if (ctx == NULL) goto failed; + ctx->async.fn = init_domain_recv_dcip; + ctx->async.private_data = state; + return result; + } + if (state->domain->schannel_creds != NULL) { talloc_free(state->domain->schannel_creds); } @@ -175,6 +188,31 @@ static void init_domain_recv_dcs(struct composite_context *ctx) composite_continue(state->ctx, ctx, init_domain_recv_tree, state); } +static void init_domain_recv_dcip(struct composite_context *ctx) +{ + struct init_domain_state *state = + talloc_get_type(ctx->async.private_data, + struct init_domain_state); + const char *dcaddr; + + state->ctx->status = resolve_name_recv(ctx, state, &dcaddr); + if (!composite_is_ok(state->ctx)) return; + + state->conn.in.dest_host = dcaddr; + state->conn.in.port = 0; + state->conn.in.called_name = state->domain->dcname; + state->conn.in.service = "IPC$"; + state->conn.in.service_type = "IPC"; + state->conn.in.workgroup = state->domain->name; + state->conn.in.credentials = state->domain->schannel_creds; + + state->conn.in.fallback_to_anonymous = True; + + ctx = smb_composite_connect_send(&state->conn, state, + state->ctx->event_ctx); + composite_continue(state->ctx, ctx, init_domain_recv_tree, state); +} + static void init_domain_recv_tree(struct composite_context *ctx) { struct init_domain_state *state = @@ -184,7 +222,8 @@ static void init_domain_recv_tree(struct composite_context *ctx) state->ctx->status = smb_composite_connect_recv(ctx, state); if (!composite_is_ok(state->ctx)) return; - if (state->domain->schannel_creds == NULL) { + if ((state->domain->schannel_creds == NULL) || + cli_credentials_is_anonymous(state->domain->schannel_creds)) { /* No chance to open netlogon */ ctx = wb_connect_lsa_send(state->conn.out.tree, NULL); composite_continue(state->ctx, ctx, @@ -212,6 +251,15 @@ static void init_domain_recv_netlogoncreds(struct composite_context *ctx) talloc_unlink(state, state->conn.out.tree); /* The pipe owns it now */ + if (!lp_winbind_sealed_pipes()) { + state->netlogon_pipe = talloc_reference(state, + state->auth2_pipe); + ctx = wb_connect_lsa_send(state->conn.out.tree, NULL); + composite_continue(state->ctx, ctx, init_domain_recv_lsa, + state); + return; + } + state->netlogon_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx); if (composite_nomem(state->netlogon_pipe, state->ctx)) return; @@ -272,7 +320,6 @@ static void init_domain_recv_lsa(struct composite_context *ctx) /* Give the tree to the LSA pipe. If auth2_pipe exists we have * given it to that already */ talloc_unlink(state, state->conn.out.tree); - state->conn.out.tree = NULL; } state->queryinfo.in.handle = state->lsa_policy; @@ -392,114 +439,3 @@ NTSTATUS wb_init_domain(struct wbsrv_domain *domain, wb_init_domain_send(domain, event_ctx, messaging_ctx); return wb_init_domain_recv(c); } - -struct queue_domain_state { - struct queue_domain_state *prev, *next; - struct composite_context *ctx; - struct wbsrv_domain *domain; - struct composite_context *(*send_fn)(void *p); - NTSTATUS (*recv_fn)(struct composite_context *c, - void *p); - void *private_data; -}; - -static void queue_domain_recv_init(struct composite_context *ctx); -static void queue_domain_recv_sub(struct composite_context *ctx); - -struct composite_context *wb_queue_domain_send(TALLOC_CTX *mem_ctx, - struct wbsrv_domain *domain, - struct event_context *event_ctx, - struct messaging_context *msg_ctx, - struct composite_context *(*send_fn)(void *p), - NTSTATUS (*recv_fn)(struct composite_context *c, - void *p), - void *private_data) -{ - struct composite_context *result, *ctx; - struct queue_domain_state *state; - - result = talloc(mem_ctx, struct composite_context); - if (result == NULL) goto failed; - result->state = COMPOSITE_STATE_IN_PROGRESS; - result->async.fn = NULL; - result->event_ctx = event_ctx; - - state = talloc(result, struct queue_domain_state); - if (state == NULL) goto failed; - state->ctx = result; - result->private_data = state; - - state->send_fn = send_fn; - state->recv_fn = recv_fn; - state->private_data = private_data; - state->domain = domain; - - if (domain->busy) { - DEBUG(0, ("Domain %s busy\n", domain->name)); - DLIST_ADD_END(domain->request_queue, state, - struct queue_domain_state *); - return result; - } - - domain->busy = True; - - if (!domain->initialized) { - ctx = wb_init_domain_send(domain, result->event_ctx, msg_ctx); - if (ctx == NULL) goto failed; - ctx->async.fn = queue_domain_recv_init; - ctx->async.private_data = state; - return result; - } - - ctx = state->send_fn(state->private_data); - if (ctx == NULL) goto failed; - ctx->async.fn = queue_domain_recv_sub; - ctx->async.private_data = state; - return result; - - failed: - talloc_free(result); - return NULL; -} - -static void queue_domain_recv_init(struct composite_context *ctx) -{ - struct queue_domain_state *state = - talloc_get_type(ctx->async.private_data, - struct queue_domain_state); - - state->ctx->status = wb_init_domain_recv(ctx); - if (!composite_is_ok(state->ctx)) return; - - ctx = state->send_fn(state->private_data); - composite_continue(state->ctx, ctx, queue_domain_recv_sub, state); -} - -static void queue_domain_recv_sub(struct composite_context *ctx) -{ - struct queue_domain_state *state = - talloc_get_type(ctx->async.private_data, - struct queue_domain_state); - - state->ctx->status = state->recv_fn(ctx, state->private_data); - state->domain->busy = False; - - if (state->domain->request_queue != NULL) { - struct queue_domain_state *s2; - s2 = state->domain->request_queue; - DLIST_REMOVE(state->domain->request_queue, s2); - ctx = s2->send_fn(s2->private_data); - composite_continue(s2->ctx, ctx, queue_domain_recv_sub, s2); - state->domain->busy = True; - } - - if (!composite_is_ok(state->ctx)) return; - composite_done(state->ctx); -} - -NTSTATUS wb_queue_domain_recv(struct composite_context *ctx) -{ - NTSTATUS status = composite_wait(ctx); - talloc_free(ctx); - return status; -} diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c index ef43aededd..b6864a39cc 100644 --- a/source4/winbind/wb_pam_auth.c +++ b/source4/winbind/wb_pam_auth.c @@ -30,7 +30,6 @@ struct pam_auth_crap_state { struct composite_context *ctx; struct event_context *event_ctx; - struct wbsrv_domain *domain; const char *domain_name; const char *user_name; const char *workstation; @@ -46,7 +45,8 @@ struct pam_auth_crap_state { DATA_BLOB info3; }; -static struct composite_context *crap_samlogon_send_req(void *p); +static struct composite_context *crap_samlogon_send_req(struct wbsrv_domain *domain, + void *p); static NTSTATUS crap_samlogon_recv_req(struct composite_context *ctx, void *p); struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call, @@ -63,7 +63,6 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call, state = talloc(NULL, struct pam_auth_crap_state); if (state == NULL) goto failed; - state->domain = service->domains; state->event_ctx = call->event_ctx; state->domain_name = talloc_strdup(state, domain); @@ -86,12 +85,11 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call, if ((lm_resp.data != NULL) && (state->lm_resp.data == NULL)) goto failed; - state->ctx = wb_queue_domain_send(state, state->domain, - call->event_ctx, - call->wbconn->conn->msg_ctx, - crap_samlogon_send_req, - crap_samlogon_recv_req, - state); + state->ctx = wb_domain_request_send(state, service, + service->primary_sid, + crap_samlogon_send_req, + crap_samlogon_recv_req, + state); if (state->ctx == NULL) goto failed; state->ctx->private_data = state; return state->ctx; @@ -101,12 +99,13 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call, return NULL; } -static struct composite_context *crap_samlogon_send_req(void *p) +static struct composite_context *crap_samlogon_send_req(struct wbsrv_domain *domain, + void *p) { struct pam_auth_crap_state *state = talloc_get_type(p, struct pam_auth_crap_state); - state->creds_state = cli_credentials_get_netlogon_creds( - state->domain->schannel_creds); + state->creds_state = + cli_credentials_get_netlogon_creds(domain->schannel_creds); creds_client_authenticator(state->creds_state, &state->auth); @@ -127,12 +126,11 @@ static struct composite_context *crap_samlogon_send_req(void *p) state->ninfo.lm.data = state->lm_resp.data; state->r.in.server_name = talloc_asprintf( - state, "\\\\%s", - dcerpc_server_name(state->domain->netlogon_pipe)); + state, "\\\\%s", dcerpc_server_name(domain->netlogon_pipe)); if (state->r.in.server_name == NULL) return NULL; - state->r.in.workstation = cli_credentials_get_workstation( - state->domain->schannel_creds); + state->r.in.workstation = + cli_credentials_get_workstation(domain->schannel_creds); state->r.in.credential = &state->auth; state->r.in.return_authenticator = &state->auth2; state->r.in.logon_level = 2; @@ -140,7 +138,7 @@ static struct composite_context *crap_samlogon_send_req(void *p) state->r.in.logon.network = &state->ninfo; state->r.out.return_authenticator = NULL; - return composite_netr_LogonSamLogon_send(state->domain->netlogon_pipe, + return composite_netr_LogonSamLogon_send(domain->netlogon_pipe, state, &state->r); } diff --git a/source4/winbind/wb_samba3_cmd.c b/source4/winbind/wb_samba3_cmd.c index a53b06ae4e..2eb1c1f5a3 100644 --- a/source4/winbind/wb_samba3_cmd.c +++ b/source4/winbind/wb_samba3_cmd.c @@ -128,10 +128,12 @@ static void getdcname_recv_dc(struct composite_context *ctx); NTSTATUS wbsrv_samba3_getdcname(struct wbsrv_samba3_call *s3call) { struct composite_context *ctx; + struct wbsrv_service *service = + s3call->call->wbconn->listen_socket->service; DEBUG(5, ("wbsrv_samba3_getdcname called\n")); - ctx = wb_cmd_getdcname_send(s3call->call, + ctx = wb_cmd_getdcname_send(service, service->domains, s3call->request.domain_name); NT_STATUS_HAVE_NO_MEMORY(ctx); @@ -190,7 +192,9 @@ NTSTATUS wbsrv_samba3_userdomgroups(struct wbsrv_samba3_call *s3call) return NT_STATUS_NO_MEMORY; } - ctx = wb_cmd_userdomgroups_send(s3call->call, sid); + ; + ctx = wb_cmd_userdomgroups_send( + s3call->call->wbconn->listen_socket->service, sid); NT_STATUS_HAVE_NO_MEMORY(ctx); ctx->async.fn = userdomgroups_recv_groups; @@ -252,15 +256,106 @@ static void userdomgroups_recv_groups(struct composite_context *ctx) } } +static void usersids_recv_sids(struct composite_context *ctx); + +NTSTATUS wbsrv_samba3_usersids(struct wbsrv_samba3_call *s3call) +{ + struct composite_context *ctx; + struct dom_sid *sid; + + DEBUG(5, ("wbsrv_samba3_usersids called\n")); + + sid = dom_sid_parse_talloc(s3call, s3call->request.data.sid); + if (sid == NULL) { + DEBUG(5, ("Could not parse sid %s\n", + s3call->request.data.sid)); + return NT_STATUS_NO_MEMORY; + } + + ctx = wb_cmd_usersids_send( + s3call->call->wbconn->listen_socket->service, sid); + NT_STATUS_HAVE_NO_MEMORY(ctx); + + ctx->async.fn = usersids_recv_sids; + ctx->async.private_data = s3call; + s3call->call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC; + return NT_STATUS_OK; +} + +static void usersids_recv_sids(struct composite_context *ctx) +{ + struct wbsrv_samba3_call *s3call = + talloc_get_type(ctx->async.private_data, + struct wbsrv_samba3_call); + int i, num_sids; + struct dom_sid **sids; + char *sids_string; + NTSTATUS status; + + status = wb_cmd_usersids_recv(ctx, s3call, &num_sids, &sids); + if (!NT_STATUS_IS_OK(status)) goto done; + + sids_string = talloc_strdup(s3call, ""); + if (sids_string == NULL) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + + for (i=0; i<num_sids; i++) { + sids_string = talloc_asprintf_append( + sids_string, "%s\n", dom_sid_string(s3call, sids[i])); + if (sids_string == NULL) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + } + + s3call->response.result = WINBINDD_OK; + s3call->response.extra_data = sids_string; + s3call->response.length += strlen(sids_string); + s3call->response.data.num_entries = num_sids; + + /* Hmmmm. Nasty protocol -- who invented the zeros between the + * SIDs? Hmmm. Could have been me -- vl */ + + while (*sids_string != '\0') { + if ((*sids_string) == '\n') { + *sids_string = '\0'; + } + sids_string += 1; + } + + done: + if (!NT_STATUS_IS_OK(status)) { + struct winbindd_response *resp = &s3call->response; + resp->result = WINBINDD_ERROR; + WBSRV_SAMBA3_SET_STRING(resp->data.auth.nt_status_string, + nt_errstr(status)); + WBSRV_SAMBA3_SET_STRING(resp->data.auth.error_string, + nt_errstr(status)); + resp->data.auth.pam_error = nt_status_to_pam(status); + } + + status = wbsrv_send_reply(s3call->call); + if (!NT_STATUS_IS_OK(status)) { + wbsrv_terminate_connection(s3call->call->wbconn, + "wbsrv_queue_reply() failed"); + return; + } +} + static void lookupname_recv_sid(struct composite_context *ctx); NTSTATUS wbsrv_samba3_lookupname(struct wbsrv_samba3_call *s3call) { struct composite_context *ctx; + struct wbsrv_service *service = + s3call->call->wbconn->listen_socket->service; DEBUG(5, ("wbsrv_samba3_lookupname called\n")); - ctx = wb_cmd_lookupname_send(s3call->call, + ctx = wb_cmd_lookupname_send(service, service->domains, + s3call->request.data.name.dom_name, s3call->request.data.name.name); NT_STATUS_HAVE_NO_MEMORY(ctx); @@ -306,6 +401,70 @@ static void lookupname_recv_sid(struct composite_context *ctx) } } +static void lookupsid_recv_name(struct composite_context *ctx); + +NTSTATUS wbsrv_samba3_lookupsid(struct wbsrv_samba3_call *s3call) +{ + struct composite_context *ctx; + struct wbsrv_service *service = + s3call->call->wbconn->listen_socket->service; + struct dom_sid *sid; + + DEBUG(5, ("wbsrv_samba3_lookupsid called\n")); + + sid = dom_sid_parse_talloc(s3call, s3call->request.data.sid); + if (sid == NULL) { + DEBUG(5, ("Could not parse sid %s\n", + s3call->request.data.sid)); + return NT_STATUS_NO_MEMORY; + } + + ctx = wb_cmd_lookupsid_send(service, service->domains, sid); + NT_STATUS_HAVE_NO_MEMORY(ctx); + + /* setup the callbacks */ + ctx->async.fn = lookupsid_recv_name; + ctx->async.private_data = s3call; + s3call->call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC; + return NT_STATUS_OK; +} + +static void lookupsid_recv_name(struct composite_context *ctx) +{ + struct wbsrv_samba3_call *s3call = + talloc_get_type(ctx->async.private_data, + struct wbsrv_samba3_call); + struct wb_sid_object *sid; + NTSTATUS status; + + status = wb_cmd_lookupsid_recv(ctx, s3call, &sid); + if (!NT_STATUS_IS_OK(status)) goto done; + + s3call->response.result = WINBINDD_OK; + s3call->response.data.name.type = sid->type; + WBSRV_SAMBA3_SET_STRING(s3call->response.data.name.dom_name, + sid->domain); + WBSRV_SAMBA3_SET_STRING(s3call->response.data.name.name, sid->name); + + done: + if (!NT_STATUS_IS_OK(status)) { + struct winbindd_response *resp = &s3call->response; + resp->result = WINBINDD_ERROR; + WBSRV_SAMBA3_SET_STRING(resp->data.auth.nt_status_string, + nt_errstr(status)); + WBSRV_SAMBA3_SET_STRING(resp->data.auth.error_string, + nt_errstr(status)); + resp->data.auth.pam_error = nt_status_to_pam(status); + } + + status = wbsrv_send_reply(s3call->call); + if (!NT_STATUS_IS_OK(status)) { + wbsrv_terminate_connection(s3call->call->wbconn, + "wbsrv_queue_reply() failed"); + return; + } +} + NTSTATUS wbsrv_samba3_pam_auth(struct wbsrv_samba3_call *s3call) { s3call->response.result = WINBINDD_ERROR; diff --git a/source4/winbind/wb_samba3_protocol.c b/source4/winbind/wb_samba3_protocol.c index 2c99aa63c9..fa2225a5c3 100644 --- a/source4/winbind/wb_samba3_protocol.c +++ b/source4/winbind/wb_samba3_protocol.c @@ -69,6 +69,8 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call) DEBUG(10, ("Got winbind samba3 request %d\n", s3call->request.cmd)); + s3call->response.length = sizeof(s3call->response); + switch(s3call->request.cmd) { case WINBINDD_INTERFACE_VERSION: return wbsrv_samba3_interface_version(s3call); @@ -94,6 +96,9 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call) case WINBINDD_LOOKUPNAME: return wbsrv_samba3_lookupname(s3call); + case WINBINDD_LOOKUPSID: + return wbsrv_samba3_lookupsid(s3call); + case WINBINDD_PAM_AUTH: return wbsrv_samba3_pam_auth(s3call); @@ -105,6 +110,9 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call) case WINBINDD_GETUSERDOMGROUPS: return wbsrv_samba3_userdomgroups(s3call); + + case WINBINDD_GETUSERSIDS: + return wbsrv_samba3_usersids(s3call); } s3call->response.result = WINBINDD_ERROR; @@ -121,17 +129,17 @@ NTSTATUS wbsrv_samba3_push_reply(struct wbsrv_call *call, TALLOC_CTX *mem_ctx, D extra_data = s3call->response.extra_data; if (extra_data) { - extra_data_len = strlen((char *)s3call->response.extra_data) + 1; + extra_data_len = s3call->response.length - + sizeof(s3call->response); } - blob = data_blob_talloc(mem_ctx, NULL, sizeof(s3call->response) + extra_data_len); + blob = data_blob_talloc(mem_ctx, NULL, s3call->response.length); NT_STATUS_HAVE_NO_MEMORY(blob.data); /* don't push real pointer values into sockets */ if (extra_data) { s3call->response.extra_data = (void *)0xFFFFFFFF; } - s3call->response.length = sizeof(s3call->response) + extra_data_len; memcpy(blob.data, &s3call->response, sizeof(s3call->response)); /* set back the pointer */ s3call->response.extra_data = extra_data; diff --git a/source4/winbind/wb_server.c b/source4/winbind/wb_server.c index a835067dd0..d12adfc9d4 100644 --- a/source4/winbind/wb_server.c +++ b/source4/winbind/wb_server.c @@ -312,6 +312,8 @@ static void winbind_task_init(struct task_server *task) return; } + service->primary_sid = talloc_reference(service, service->domains->sid); + /* setup the unprivileged samba3 socket */ listen_socket = talloc(service, struct wbsrv_listen_socket); if (!listen_socket) goto nomem; diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h index e511325c72..30737bccbf 100644 --- a/source4/winbind/wb_server.h +++ b/source4/winbind/wb_server.h @@ -33,6 +33,7 @@ struct wbsrv_service { struct task_server *task; + const struct dom_sid *primary_sid; struct wbsrv_domain *domains; }; @@ -51,6 +52,7 @@ struct wbsrv_domain { const char *name; const struct dom_sid *sid; + const char *dcname; struct dcerpc_pipe *lsa_pipe; struct policy_handle *lsa_policy; @@ -65,7 +67,7 @@ struct wbsrv_domain { struct cli_credentials *schannel_creds; BOOL busy; - struct queue_domain_state *request_queue; + struct domain_request_state *request_queue; }; /* diff --git a/source4/winbind/wb_sid2domain.c b/source4/winbind/wb_sid2domain.c new file mode 100644 index 0000000000..1d15fa20c3 --- /dev/null +++ b/source4/winbind/wb_sid2domain.c @@ -0,0 +1,223 @@ +/* + Unix SMB/CIFS implementation. + + Find and init a domain struct for a SID + + Copyright (C) Volker Lendecke 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "winbind/wb_server.h" +#include "smbd/service_stream.h" +#include "smbd/service_task.h" +#include "lib/events/events.h" +#include "librpc/gen_ndr/nbt.h" +#include "librpc/gen_ndr/ndr_netlogon.h" +#include "winbind/wb_async_helpers.h" +#include "include/dlinklist.h" + +static const char *sam_name(void) +{ + if (lp_server_role() == ROLE_STANDALONE) { + return lp_netbios_name(); + } + return lp_workgroup(); +} + +static struct wbsrv_domain *find_primary_domain(struct wbsrv_service *service) +{ + const char *my_domain_name = sam_name(); + struct wbsrv_domain *domain; + + for (domain = service->domains; domain!=NULL; domain = domain->next) { + if (strcasecmp(domain->name, my_domain_name) == 0) { + break; + } + } + return domain; +} + +static struct wbsrv_domain *find_domain_from_sid(struct wbsrv_service *service, + const struct dom_sid *sid) +{ + struct wbsrv_domain *domain; + + for (domain = service->domains; domain!=NULL; domain = domain->next) { + if (dom_sid_equal(domain->sid, sid)) { + break; + } + if (dom_sid_in_domain(domain->sid, sid)) { + break; + } + } + return domain; +} + +struct sid2domain_state { + struct composite_context *ctx; + struct wbsrv_service *service; + const struct dom_sid *sid; + + const char *domain_name; + const char *dc_name; + struct dom_sid *domain_sid; + + struct wbsrv_domain *my_domain; + struct wbsrv_domain *result; +}; + +static void sid2domain_recv_name(struct composite_context *ctx); +static void sid2domain_recv_dcname(struct composite_context *ctx); +static void sid2domain_recv_init(struct composite_context *ctx); + +struct composite_context *wb_sid2domain_send(struct wbsrv_service *service, + const struct dom_sid *sid) +{ + struct composite_context *result, *ctx; + struct sid2domain_state *state; + + result = talloc_zero(NULL, struct composite_context); + if (result == NULL) goto failed; + result->state = COMPOSITE_STATE_IN_PROGRESS; + result->async.fn = NULL; + result->event_ctx = service->task->event_ctx; + + state = talloc(result, struct sid2domain_state); + if (state == NULL) goto failed; + state->ctx = result; + result->private_data = state; + + state->service = service; + state->sid = dom_sid_dup(state, sid); + if (state->sid == NULL) goto failed; + + state->result = find_domain_from_sid(service, sid); + if (state->result != NULL) { + result->status = NT_STATUS_OK; + composite_trigger_done(result); + return result; + } + + state->my_domain = find_primary_domain(service); + if (state->my_domain == NULL) { + result->status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + composite_trigger_error(result); + return result; + } + + ctx = wb_cmd_lookupsid_send(service, state->my_domain, state->sid); + if (ctx == NULL) goto failed; + ctx->async.fn = sid2domain_recv_name; + ctx->async.private_data = state; + return result; + + failed: + talloc_free(result); + return NULL; +} + +static void sid2domain_recv_name(struct composite_context *ctx) +{ + struct sid2domain_state *state = + talloc_get_type(ctx->async.private_data, + struct sid2domain_state); + struct wb_sid_object *name; + + state->ctx->status = wb_cmd_lookupsid_recv(ctx, state, &name); + if (!composite_is_ok(state->ctx)) return; + + if (name->type == SID_NAME_UNKNOWN) { + composite_error(state->ctx, NT_STATUS_NO_SUCH_DOMAIN); + return; + } + + state->domain_name = name->domain; + state->domain_sid = dom_sid_dup(state, state->sid); + if (name->type != SID_NAME_DOMAIN) { + state->domain_sid->num_auths -= 1; + } + + ctx = wb_cmd_getdcname_send(state->service, state->my_domain, + state->domain_name); + composite_continue(state->ctx, ctx, sid2domain_recv_dcname, state); +} + +static void sid2domain_recv_dcname(struct composite_context *ctx) +{ + struct sid2domain_state *state = + talloc_get_type(ctx->async.private_data, + struct sid2domain_state); + + state->ctx->status = wb_cmd_getdcname_recv(ctx, state, + &state->dc_name); + if (!composite_is_ok(state->ctx)) return; + + state->result = talloc_zero(state, struct wbsrv_domain); + if (composite_nomem(state->result, state->ctx)) return; + + state->result->name = talloc_steal(state->result, state->domain_name); + state->result->sid = talloc_steal(state->result, state->domain_sid); + state->result->dcname = talloc_steal(state->result, state->dc_name); + + state->result->schannel_creds = cli_credentials_init(state->result); + if (composite_nomem(state->result->schannel_creds, state->ctx)) return; + cli_credentials_set_conf(state->result->schannel_creds); + cli_credentials_set_anonymous(state->result->schannel_creds); + + talloc_steal(state->service, state->result); + DLIST_ADD(state->service->domains, state->result); + + ctx = wb_init_domain_send(state->result, + state->service->task->event_ctx, + state->service->task->msg_ctx); + composite_continue(state->ctx, ctx, sid2domain_recv_init, state); +} + +static void sid2domain_recv_init(struct composite_context *ctx) +{ + struct sid2domain_state *state = + talloc_get_type(ctx->async.private_data, + struct sid2domain_state); + + state->ctx->status = wb_init_domain_recv(state->ctx); + if (!composite_is_ok(state->ctx)) return; + + composite_done(state->ctx); +} + +NTSTATUS wb_sid2domain_recv(struct composite_context *ctx, + struct wbsrv_domain **result) +{ + NTSTATUS status = composite_wait(ctx); + if (NT_STATUS_IS_OK(status)) { + struct sid2domain_state *state = + talloc_get_type(ctx->private_data, + struct sid2domain_state); + *result = state->result; + } + talloc_free(ctx); + return status; +} + +NTSTATUS wb_sid2domain(struct wbsrv_service *service, + const struct dom_sid *sid, + struct wbsrv_domain **result) +{ + struct composite_context *c = wb_sid2domain_send(service, sid); + return wb_sid2domain_recv(c, result); +} |