Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : async getgrsid
4 : Copyright (C) Volker Lendecke 2009
5 :
6 : This program is free software; you can redistribute it and/or modify
7 : it under the terms of the GNU General Public License as published by
8 : the Free Software Foundation; either version 3 of the License, or
9 : (at your option) any later version.
10 :
11 : This program is distributed in the hope that it will be useful,
12 : but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : GNU General Public License for more details.
15 :
16 : You should have received a copy of the GNU General Public License
17 : along with this program. If not, see <http://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include "includes.h"
21 : #include "winbindd.h"
22 : #include "librpc/gen_ndr/ndr_winbind_c.h"
23 : #include "../libcli/security/security.h"
24 : #include "lib/dbwrap/dbwrap_rbt.h"
25 : #include "lib/dbwrap/dbwrap.h"
26 :
27 : struct wb_getgrsid_state {
28 : struct tevent_context *ev;
29 : struct dom_sid sid;
30 : int max_nesting;
31 : const char *domname;
32 : const char *name;
33 : enum lsa_SidType type;
34 : gid_t gid;
35 : struct db_context *members;
36 : uint32_t num_sids;
37 : struct dom_sid *sids;
38 : };
39 :
40 : static void wb_getgrsid_lookupsid_done(struct tevent_req *subreq);
41 : static void wb_getgrsid_sid2gid_done(struct tevent_req *subreq);
42 : static void wb_getgrsid_got_members(struct tevent_req *subreq);
43 : static void wb_getgrsid_got_alias_members(struct tevent_req *subreq);
44 :
45 5718 : struct tevent_req *wb_getgrsid_send(TALLOC_CTX *mem_ctx,
46 : struct tevent_context *ev,
47 : const struct dom_sid *group_sid,
48 : int max_nesting)
49 : {
50 0 : struct tevent_req *req, *subreq;
51 0 : struct wb_getgrsid_state *state;
52 0 : struct dom_sid_buf buf;
53 :
54 5718 : req = tevent_req_create(mem_ctx, &state, struct wb_getgrsid_state);
55 5718 : if (req == NULL) {
56 0 : return NULL;
57 : }
58 :
59 5718 : D_INFO("WB command getgrsid start.\nLooking up group SID %s.\n", dom_sid_str_buf(group_sid, &buf));
60 :
61 5718 : sid_copy(&state->sid, group_sid);
62 5718 : state->ev = ev;
63 5718 : state->max_nesting = max_nesting;
64 :
65 5718 : if (dom_sid_in_domain(&global_sid_Unix_Groups, group_sid)) {
66 : /* unmapped Unix groups must be resolved locally */
67 0 : tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
68 0 : return tevent_req_post(req, ev);
69 : }
70 :
71 5718 : subreq = wb_lookupsid_send(state, ev, &state->sid);
72 5718 : if (tevent_req_nomem(subreq, req)) {
73 0 : return tevent_req_post(req, ev);
74 : }
75 5718 : tevent_req_set_callback(subreq, wb_getgrsid_lookupsid_done, req);
76 5718 : return req;
77 : }
78 :
79 5718 : static void wb_getgrsid_lookupsid_done(struct tevent_req *subreq)
80 : {
81 5718 : struct tevent_req *req = tevent_req_callback_data(
82 : subreq, struct tevent_req);
83 5718 : struct wb_getgrsid_state *state = tevent_req_data(
84 : req, struct wb_getgrsid_state);
85 0 : NTSTATUS status;
86 :
87 5718 : status = wb_lookupsid_recv(subreq, state, &state->type,
88 : &state->domname, &state->name);
89 5718 : TALLOC_FREE(subreq);
90 5718 : if (tevent_req_nterror(req, status)) {
91 0 : return;
92 : }
93 :
94 5718 : switch (state->type) {
95 5718 : case SID_NAME_DOM_GRP:
96 : case SID_NAME_ALIAS:
97 : case SID_NAME_WKN_GRP:
98 : /*
99 : * also treat user-type SIDS (they might map to ID_TYPE_BOTH)
100 : */
101 : case SID_NAME_USER:
102 : case SID_NAME_COMPUTER:
103 5718 : break;
104 0 : default:
105 0 : tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
106 0 : return;
107 : }
108 :
109 5718 : subreq = wb_sids2xids_send(state, state->ev, &state->sid, 1);
110 5718 : if (tevent_req_nomem(subreq, req)) {
111 0 : return;
112 : }
113 5718 : tevent_req_set_callback(subreq, wb_getgrsid_sid2gid_done, req);
114 : }
115 :
116 5718 : static void wb_getgrsid_sid2gid_done(struct tevent_req *subreq)
117 : {
118 5718 : struct tevent_req *req = tevent_req_callback_data(
119 : subreq, struct tevent_req);
120 5718 : struct wb_getgrsid_state *state = tevent_req_data(
121 : req, struct wb_getgrsid_state);
122 0 : NTSTATUS status;
123 0 : struct unixid xids[1];
124 :
125 5718 : status = wb_sids2xids_recv(subreq, xids, ARRAY_SIZE(xids));
126 5718 : TALLOC_FREE(subreq);
127 5718 : if (tevent_req_nterror(req, status)) {
128 78 : return;
129 : }
130 :
131 : /*
132 : * We are filtering further down in sids2xids, but that filtering
133 : * depends on the actual type of the sid handed in (as determined
134 : * by lookupsids). Here we need to filter for the type of object
135 : * actually requested, in this case uid.
136 : */
137 5718 : if (!(xids[0].type == ID_TYPE_GID || xids[0].type == ID_TYPE_BOTH)) {
138 0 : tevent_req_nterror(req, NT_STATUS_NONE_MAPPED);
139 0 : return;
140 : }
141 :
142 5718 : state->gid = (gid_t)xids[0].id;
143 :
144 5718 : switch (state->type) {
145 8 : case SID_NAME_USER:
146 : case SID_NAME_COMPUTER: {
147 : /*
148 : * special treatment for a user sid that is
149 : * mapped to ID_TYPE_BOTH:
150 : * create a group with the sid/xid as only member
151 : */
152 0 : const char *name;
153 :
154 8 : if (xids[0].type != ID_TYPE_BOTH) {
155 0 : tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
156 0 : return;
157 : }
158 :
159 8 : state->members = db_open_rbt(state);
160 8 : if (tevent_req_nomem(state->members, req)) {
161 0 : return;
162 : }
163 :
164 8 : name = fill_domain_username_talloc(talloc_tos(),
165 : state->domname,
166 : state->name,
167 : true /* can_assume */);
168 8 : if (tevent_req_nomem(name, req)) {
169 0 : return;
170 : }
171 :
172 8 : status = add_member_to_db(state->members, &state->sid, name);
173 8 : if (!NT_STATUS_IS_OK(status)) {
174 0 : tevent_req_nterror(req, status);
175 0 : return;
176 : }
177 :
178 8 : tevent_req_done(req);
179 8 : return;
180 : }
181 640 : case SID_NAME_ALIAS:
182 640 : subreq = wb_alias_members_send(state,
183 : state->ev,
184 640 : &state->sid,
185 : state->type,
186 : state->max_nesting);
187 640 : if (tevent_req_nomem(subreq, req)) {
188 0 : return;
189 : }
190 : /* Decrement the depth based on 'winbind expand groups' */
191 640 : state->max_nesting--;
192 640 : tevent_req_set_callback(subreq,
193 : wb_getgrsid_got_alias_members,
194 : req);
195 5640 : break;
196 5000 : case SID_NAME_DOM_GRP:
197 5000 : subreq = wb_group_members_send(state,
198 : state->ev,
199 5000 : &state->sid,
200 : 1,
201 : &state->type,
202 : state->max_nesting);
203 5000 : if (tevent_req_nomem(subreq, req)) {
204 0 : return;
205 : }
206 5000 : tevent_req_set_callback(subreq, wb_getgrsid_got_members, req);
207 5000 : break;
208 70 : case SID_NAME_WKN_GRP:
209 70 : state->members = db_open_rbt(state);
210 70 : if (tevent_req_nomem(state->members, req)) {
211 0 : return;
212 : }
213 70 : tevent_req_done(req);
214 70 : return;
215 0 : default:
216 0 : tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
217 0 : break;
218 : }
219 : }
220 :
221 640 : static void wb_getgrsid_got_alias_members_names(struct tevent_req *subreq)
222 : {
223 0 : struct tevent_req *req =
224 640 : tevent_req_callback_data(subreq, struct tevent_req);
225 0 : struct wb_getgrsid_state *state =
226 640 : tevent_req_data(req, struct wb_getgrsid_state);
227 640 : struct lsa_RefDomainList *domains = NULL;
228 640 : struct lsa_TransNameArray *names = NULL;
229 0 : NTSTATUS status;
230 0 : uint32_t li;
231 640 : uint32_t num_sids = 0;
232 640 : struct dom_sid *sids = NULL;
233 640 : enum lsa_SidType *types = NULL;
234 :
235 640 : status = wb_lookupsids_recv(subreq, state, &domains, &names);
236 :
237 640 : TALLOC_FREE(subreq);
238 640 : if (tevent_req_nterror(req, status)) {
239 0 : D_WARNING("Failed with %s.\n", nt_errstr(status));
240 638 : return;
241 : }
242 :
243 640 : if (domains == NULL) {
244 0 : tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
245 0 : D_WARNING("Failed with NT_STATUS_INTERNAL_ERROR.\n");
246 0 : return;
247 : }
248 :
249 640 : if (names == NULL) {
250 0 : tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
251 0 : D_WARNING("Failed with NT_STATUS_INTERNAL_ERROR.\n");
252 0 : return;
253 : }
254 :
255 640 : state->members = db_open_rbt(state);
256 640 : if (tevent_req_nomem(state->members, req)) {
257 0 : return;
258 : }
259 :
260 650 : for (li = 0; li < state->num_sids; li++) {
261 10 : struct lsa_TranslatedName *n = &names->names[li];
262 :
263 10 : if (n->sid_type == SID_NAME_USER ||
264 10 : n->sid_type == SID_NAME_COMPUTER) {
265 4 : const char *name = fill_domain_username_talloc(
266 : talloc_tos(),
267 4 : domains->domains[n->sid_index].name.string,
268 : n->name.string,
269 : false /* can_assume */);
270 4 : if (tevent_req_nomem(name, req)) {
271 0 : return;
272 : }
273 :
274 4 : status = add_member_to_db(state->members,
275 4 : &state->sids[li],
276 : name);
277 4 : if (!NT_STATUS_IS_OK(status)) {
278 0 : tevent_req_nterror(req, status);
279 0 : return;
280 : }
281 6 : } else if (n->sid_type == SID_NAME_DOM_GRP) {
282 6 : sids = talloc_realloc(talloc_tos(),
283 : sids,
284 : struct dom_sid,
285 : num_sids + 1);
286 6 : if (tevent_req_nomem(sids, req)) {
287 0 : return;
288 : }
289 6 : sids[num_sids] = state->sids[li];
290 6 : types = talloc_realloc(talloc_tos(),
291 : types,
292 : enum lsa_SidType,
293 : num_sids + 1);
294 6 : if (tevent_req_nomem(types, req)) {
295 0 : return;
296 : }
297 6 : types[num_sids] = n->sid_type;
298 6 : num_sids++;
299 : } else {
300 0 : struct dom_sid_buf buf;
301 0 : D_DEBUG("SID %s with sid_type=%d is ignored!\n",
302 : dom_sid_str_buf(&state->sids[li], &buf),
303 : n->sid_type);
304 : }
305 : }
306 :
307 640 : TALLOC_FREE(names);
308 640 : TALLOC_FREE(domains);
309 :
310 640 : if (num_sids == 0) {
311 638 : tevent_req_done(req);
312 638 : return;
313 : }
314 2 : subreq = wb_group_members_send(state,
315 : state->ev,
316 : sids,
317 : num_sids,
318 : types,
319 : state->max_nesting);
320 2 : if (tevent_req_nomem(subreq, req)) {
321 0 : return;
322 : }
323 2 : tevent_req_set_callback(subreq, wb_getgrsid_got_members, req);
324 : }
325 :
326 640 : static void wb_getgrsid_got_alias_members(struct tevent_req *subreq)
327 : {
328 0 : struct tevent_req *req =
329 640 : tevent_req_callback_data(subreq, struct tevent_req);
330 0 : struct wb_getgrsid_state *state =
331 640 : tevent_req_data(req, struct wb_getgrsid_state);
332 0 : NTSTATUS status;
333 :
334 640 : status = wb_alias_members_recv(subreq,
335 : state,
336 : &state->num_sids,
337 : &state->sids);
338 640 : TALLOC_FREE(subreq);
339 640 : if (tevent_req_nterror(req, status)) {
340 0 : return;
341 : }
342 :
343 640 : subreq = wb_lookupsids_send(state,
344 : state->ev,
345 : state->sids,
346 : state->num_sids);
347 640 : if (tevent_req_nomem(subreq, req)) {
348 0 : return;
349 : }
350 640 : tevent_req_set_callback(subreq,
351 : wb_getgrsid_got_alias_members_names,
352 : req);
353 : }
354 :
355 5002 : static void wb_getgrsid_got_members(struct tevent_req *subreq)
356 : {
357 5002 : struct tevent_req *req = tevent_req_callback_data(
358 : subreq, struct tevent_req);
359 5002 : struct wb_getgrsid_state *state = tevent_req_data(
360 : req, struct wb_getgrsid_state);
361 0 : NTSTATUS status;
362 5002 : struct db_context *members_prev = state->members;
363 :
364 5002 : status = wb_group_members_recv(subreq, state, &state->members);
365 5002 : TALLOC_FREE(subreq);
366 5002 : if (tevent_req_nterror(req, status)) {
367 0 : return;
368 : }
369 : /*
370 : * If we have called wb_alias_members_send(), members_prev
371 : * might already contain users that are direct members of alias,
372 : * add to them the users from nested groups.
373 : */
374 5002 : if (members_prev != NULL) {
375 2 : status = dbwrap_merge_dbs(state->members,
376 : members_prev,
377 : TDB_REPLACE);
378 2 : if (tevent_req_nterror(req, status)) {
379 0 : return;
380 : }
381 : }
382 5002 : tevent_req_done(req);
383 : }
384 :
385 5718 : NTSTATUS wb_getgrsid_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
386 : const char **domname, const char **name, gid_t *gid,
387 : struct db_context **members)
388 : {
389 5718 : struct wb_getgrsid_state *state = tevent_req_data(
390 : req, struct wb_getgrsid_state);
391 0 : NTSTATUS status;
392 :
393 5718 : D_INFO("WB command getgrsid end.\n");
394 5718 : if (tevent_req_is_nterror(req, &status)) {
395 0 : D_WARNING("Failed with %s.\n", nt_errstr(status));
396 0 : return status;
397 : }
398 5718 : *domname = talloc_move(mem_ctx, &state->domname);
399 5718 : *name = talloc_move(mem_ctx, &state->name);
400 5718 : *gid = state->gid;
401 5718 : *members = talloc_move(mem_ctx, &state->members);
402 5718 : return NT_STATUS_OK;
403 : }
|
