source: vendor/current/source3/winbindd/winbindd_getgroups.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 6.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 async implementation of WINBINDD_GETGROUPS
4 Copyright (C) Volker Lendecke 2009
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20#include "includes.h"
21#include "winbindd.h"
22#include "passdb/lookup_sid.h" /* only for LOOKUP_NAME_NO_NSS flag */
23
24struct winbindd_getgroups_state {
25 struct tevent_context *ev;
26 fstring domname;
27 fstring username;
28 struct dom_sid sid;
29 enum lsa_SidType type;
30 int num_sids;
31 struct dom_sid *sids;
32 int num_gids;
33 gid_t *gids;
34};
35
36static void winbindd_getgroups_lookupname_done(struct tevent_req *subreq);
37static void winbindd_getgroups_gettoken_done(struct tevent_req *subreq);
38static void winbindd_getgroups_sid2gid_done(struct tevent_req *subreq);
39
40struct tevent_req *winbindd_getgroups_send(TALLOC_CTX *mem_ctx,
41 struct tevent_context *ev,
42 struct winbindd_cli_state *cli,
43 struct winbindd_request *request)
44{
45 struct tevent_req *req, *subreq;
46 struct winbindd_getgroups_state *state;
47 char *domuser, *mapped_user;
48 NTSTATUS status;
49
50 req = tevent_req_create(mem_ctx, &state,
51 struct winbindd_getgroups_state);
52 if (req == NULL) {
53 return NULL;
54 }
55 state->ev = ev;
56
57 /* Ensure null termination */
58 request->data.username[sizeof(request->data.username)-1]='\0';
59
60 DEBUG(3, ("getgroups %s\n", request->data.username));
61
62 domuser = request->data.username;
63
64 status = normalize_name_unmap(state, domuser, &mapped_user);
65
66 if (NT_STATUS_IS_OK(status)
67 || NT_STATUS_EQUAL(status, NT_STATUS_FILE_RENAMED)) {
68 /* normalize_name_unmapped did something */
69 domuser = mapped_user;
70 }
71
72 if (!parse_domain_user(domuser, state->domname, state->username)) {
73 DEBUG(5, ("Could not parse domain user: %s\n", domuser));
74 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
75 return tevent_req_post(req, ev);
76 }
77
78 subreq = wb_lookupname_send(state, ev, state->domname, state->username,
79 LOOKUP_NAME_NO_NSS);
80 if (tevent_req_nomem(subreq, req)) {
81 return tevent_req_post(req, ev);
82 }
83 tevent_req_set_callback(subreq, winbindd_getgroups_lookupname_done,
84 req);
85 return req;
86}
87
88static void winbindd_getgroups_lookupname_done(struct tevent_req *subreq)
89{
90 struct tevent_req *req = tevent_req_callback_data(
91 subreq, struct tevent_req);
92 struct winbindd_getgroups_state *state = tevent_req_data(
93 req, struct winbindd_getgroups_state);
94 NTSTATUS status;
95
96 status = wb_lookupname_recv(subreq, &state->sid, &state->type);
97 TALLOC_FREE(subreq);
98 if (tevent_req_nterror(req, status)) {
99 return;
100 }
101
102 subreq = wb_gettoken_send(state, state->ev, &state->sid);
103 if (tevent_req_nomem(subreq, req)) {
104 return;
105 }
106 tevent_req_set_callback(subreq, winbindd_getgroups_gettoken_done, req);
107}
108
109static void winbindd_getgroups_gettoken_done(struct tevent_req *subreq)
110{
111 struct tevent_req *req = tevent_req_callback_data(
112 subreq, struct tevent_req);
113 struct winbindd_getgroups_state *state = tevent_req_data(
114 req, struct winbindd_getgroups_state);
115 NTSTATUS status;
116
117 status = wb_gettoken_recv(subreq, state, &state->num_sids,
118 &state->sids);
119 TALLOC_FREE(subreq);
120 if (tevent_req_nterror(req, status)) {
121 return;
122 }
123
124 /*
125 * Convert the group SIDs to gids. state->sids[0] contains the user
126 * sid. If the idmap backend uses ID_TYPE_BOTH, we might need the
127 * the id of the user sid in the list of group sids, so map the
128 * complete token.
129 */
130
131 subreq = wb_sids2xids_send(state, state->ev,
132 state->sids, state->num_sids);
133 if (tevent_req_nomem(subreq, req)) {
134 return;
135 }
136 tevent_req_set_callback(subreq, winbindd_getgroups_sid2gid_done, req);
137}
138
139static void winbindd_getgroups_sid2gid_done(struct tevent_req *subreq)
140{
141 struct tevent_req *req = tevent_req_callback_data(
142 subreq, struct tevent_req);
143 struct winbindd_getgroups_state *state = tevent_req_data(
144 req, struct winbindd_getgroups_state);
145 NTSTATUS status;
146 struct unixid *xids;
147 int i;
148
149 xids = talloc_array(state, struct unixid, state->num_sids);
150 if (tevent_req_nomem(xids, req)) {
151 return;
152 }
153 for (i=0; i < state->num_sids; i++) {
154 xids[i].type = ID_TYPE_NOT_SPECIFIED;
155 xids[i].id = UINT32_MAX;
156 }
157
158 status = wb_sids2xids_recv(subreq, xids, state->num_sids);
159 TALLOC_FREE(subreq);
160 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) ||
161 NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED))
162 {
163 status = NT_STATUS_OK;
164 }
165 if (tevent_req_nterror(req, status)) {
166 return;
167 }
168
169 state->gids = talloc_array(state, gid_t, state->num_sids);
170 if (tevent_req_nomem(state->gids, req)) {
171 return;
172 }
173 state->num_gids = 0;
174
175 for (i=0; i < state->num_sids; i++) {
176 bool include_gid = false;
177 const char *debug_missing = NULL;
178
179 switch (xids[i].type) {
180 case ID_TYPE_NOT_SPECIFIED:
181 debug_missing = "not specified";
182 break;
183 case ID_TYPE_UID:
184 if (i != 0) {
185 debug_missing = "uid";
186 }
187 break;
188 case ID_TYPE_GID:
189 case ID_TYPE_BOTH:
190 include_gid = true;
191 break;
192 }
193
194 if (!include_gid) {
195 if (debug_missing == NULL) {
196 continue;
197 }
198
199 DEBUG(10, ("WARNING: skipping unix id (%u) for sid %s "
200 "from group list because the idmap type "
201 "is %s. "
202 "This might be a security problem when ACLs "
203 "contain DENY ACEs!\n",
204 (unsigned)xids[i].id,
205 sid_string_tos(&state->sids[i]),
206 debug_missing));
207 continue;
208 }
209
210 state->gids[state->num_gids] = (gid_t)xids[i].id;
211 state->num_gids += 1;
212 }
213
214 /*
215 * This should not fail, as it does not do any reallocation,
216 * just updating the talloc size.
217 */
218 state->gids = talloc_realloc(state, state->gids, gid_t, state->num_gids);
219 if (tevent_req_nomem(state->gids, req)) {
220 return;
221 }
222
223 tevent_req_done(req);
224}
225
226NTSTATUS winbindd_getgroups_recv(struct tevent_req *req,
227 struct winbindd_response *response)
228{
229 struct winbindd_getgroups_state *state = tevent_req_data(
230 req, struct winbindd_getgroups_state);
231 NTSTATUS status;
232
233 if (tevent_req_is_nterror(req, &status)) {
234 DEBUG(5, ("Could not convert sid %s: %s\n",
235 sid_string_dbg(&state->sid), nt_errstr(status)));
236 return status;
237 }
238
239 response->data.num_entries = state->num_gids;
240
241 if (state->num_gids > 0) {
242 response->extra_data.data = talloc_move(response,
243 &state->gids);
244 response->length += state->num_gids * sizeof(gid_t);
245 }
246 return NT_STATUS_OK;
247}
Note: See TracBrowser for help on using the repository browser.