sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-23 09:57:40 +03:00
Code

r11181: Implement wbinfo -s and wbinfo --user-sids. The patch is so large because

Browse Source 
--user-sids required the extension to trusted domains.

Implement "winbind sealed pipes" parameter for debugging purposes.

Volker
(This used to be commit 3821a17bdb68b2f1389b5a150502c057d28569d2)
This commit is contained in:
Volker Lendecke 2005-10-19 13:45:44 +00:00 committed by Gerald (Jerry) Carter
parent ba97ac6b96
commit 0f51ae83f0
19 changed files with 1422 additions and 240 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source4/param/loadparm.c
View File

@ -140,6 +140,7 @@ typedef struct
char **server_services;
char *ntptr_providor;
char *szWinbindSeparator;
BOOL bWinbindSealedPipes;
char *swat_directory;
BOOL tls_enabled;
char *tls_keyfile;
@ -550,6 +551,7 @@ static struct parm_struct parm_table[] = {
{"msdfs root", P_BOOL, P_LOCAL, &sDefault.bMSDfsRoot, NULL, NULL, FLAG_SHARE},
{"host msdfs", P_BOOL, P_GLOBAL, &Globals.bHostMSDfs, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER},
{"winbind separator", P_STRING, P_GLOBAL, &Globals.szWinbindSeparator, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER },
{"winbind sealed pipes", P_BOOL, P_GLOBAL, &Globals.bWinbindSealedPipes, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER },
{NULL, P_BOOL, P_NONE, NULL, NULL, NULL, 0}
};
@ -671,6 +673,7 @@ static void init_globals(void)
do_parameter("WINSsupport", "False", NULL);
do_parameter("winbind separator", "\\", NULL);
do_parameter("winbind sealed pipes", "True", NULL);
do_parameter("client signing", "Yes", NULL);
do_parameter("server signing", "auto", NULL);
@ -812,6 +815,7 @@ FN_GLOBAL_STRING(lp_sam_url, &Globals.szSAM_URL)
FN_GLOBAL_STRING(lp_spoolss_url, &Globals.szSPOOLSS_URL)
FN_GLOBAL_STRING(lp_wins_url, &Globals.szWINS_URL)
FN_GLOBAL_CONST_STRING(lp_winbind_separator, &Globals.szWinbindSeparator)
FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
FN_GLOBAL_STRING(lp_private_dir, &Globals.szPrivateDir)
FN_GLOBAL_STRING(lp_serverstring, &Globals.szServerString)
FN_GLOBAL_STRING(lp_lockdir, &Globals.szLockDir)

4
source4/winbind/config.mk
View File

@ -10,11 +10,15 @@ INIT_OBJ_FILES = \
winbind/wb_samba3_protocol.o \
winbind/wb_samba3_cmd.o \
winbind/wb_init_domain.o \
winbind/wb_sid2domain.o \
winbind/wb_domain_request.o \
winbind/wb_connect_lsa.o \
winbind/wb_connect_sam.o \
winbind/wb_cmd_lookupname.o \
winbind/wb_cmd_lookupsid.o \
winbind/wb_cmd_getdcname.o \
winbind/wb_cmd_userdomgroups.o \
winbind/wb_cmd_usersids.o \
winbind/wb_pam_auth.o \
winbind/wb_async_helpers.o
REQUIRED_SUBSYSTEMS = RPC_NDR_LSA

158
source4/winbind/wb_async_helpers.c
View File

@ -360,6 +360,163 @@ NTSTATUS wb_get_schannel_creds(struct cli_credentials *wks_creds,
return wb_get_schannel_creds_recv(c, mem_ctx, netlogon_pipe);
}
struct lsa_lookupsids_state {
struct composite_context *ctx;
int num_sids;
struct lsa_LookupSids r;
struct lsa_SidArray sids;
struct lsa_TransNameArray names;
uint32_t count;
struct wb_sid_object **result;
};
static void lsa_lookupsids_recv_names(struct rpc_request *req);
struct composite_context *wb_lsa_lookupsids_send(struct dcerpc_pipe *lsa_pipe,
struct policy_handle *handle,
int num_sids,
const struct dom_sid **sids)
{
struct composite_context *result;
struct rpc_request *req;
struct lsa_lookupsids_state *state;
int i;
result = talloc_zero(NULL, struct composite_context);
if (result == NULL) goto failed;
result->state = COMPOSITE_STATE_IN_PROGRESS;
result->async.fn = NULL;
result->event_ctx = lsa_pipe->conn->event_ctx;
state = talloc(result, struct lsa_lookupsids_state);
if (state == NULL) goto failed;
result->private_data = state;
state->ctx = result;
state->sids.num_sids = num_sids;
state->sids.sids = talloc_array(state, struct lsa_SidPtr, num_sids);
if (state->sids.sids == NULL) goto failed;
for (i=0; i<num_sids; i++) {
state->sids.sids[i].sid = dom_sid_dup(state->sids.sids,
sids[i]);
if (state->sids.sids[i].sid == NULL) goto failed;
}
state->count = 0;
state->num_sids = num_sids;
state->names.count = 0;
state->names.names = NULL;
state->r.in.handle = handle;
state->r.in.sids = &state->sids;
state->r.in.names = &state->names;
state->r.in.level = 1;
state->r.in.count = &state->count;
state->r.out.names = &state->names;
state->r.out.count = &state->count;
req = dcerpc_lsa_LookupSids_send(lsa_pipe, state, &state->r);
if (req == NULL) goto failed;
req->async.callback = lsa_lookupsids_recv_names;
req->async.private = state;
return result;
failed:
talloc_free(result);
return NULL;
}
static void lsa_lookupsids_recv_names(struct rpc_request *req)
{
struct lsa_lookupsids_state *state =
talloc_get_type(req->async.private,
struct lsa_lookupsids_state);
int i;
state->ctx->status = dcerpc_ndr_request_recv(req);
if (!composite_is_ok(state->ctx)) return;
state->ctx->status = state->r.out.result;
if (!NT_STATUS_IS_OK(state->ctx->status) &&
!NT_STATUS_EQUAL(state->ctx->status, STATUS_SOME_UNMAPPED)) {
composite_error(state->ctx, state->ctx->status);
return;
}
state->result = talloc_array(state, struct wb_sid_object *,
state->num_sids);
if (composite_nomem(state->result, state->ctx)) return;
for (i=0; i<state->num_sids; i++) {
struct lsa_TranslatedName *name =
&state->r.out.names->names[i];
struct lsa_TrustInformation *dom;
state->result[i] = talloc_zero(state->result,
struct wb_sid_object);
if (composite_nomem(state->result[i], state->ctx)) return;
state->result[i]->type = name->sid_type;
if (state->result[i]->type == SID_NAME_UNKNOWN) {
continue;
}
if (name->sid_index >= state->r.out.domains->count) {
composite_error(state->ctx,
NT_STATUS_INVALID_PARAMETER);
return;
}
dom = &state->r.out.domains->domains[name->sid_index];
state->result[i]->domain = talloc_reference(state->result[i],
dom->name.string);
if ((name->sid_type == SID_NAME_DOMAIN) ||
(name->name.string == NULL)) {
state->result[i]->name =
talloc_strdup(state->result[i], "");
} else {
state->result[i]->name =
talloc_steal(state->result[i],
name->name.string);
}
if (composite_nomem(state->result[i]->name, state->ctx)) {
return;
}
}
composite_done(state->ctx);
}
NTSTATUS wb_lsa_lookupsids_recv(struct composite_context *c,
TALLOC_CTX *mem_ctx,
struct wb_sid_object ***names)
{
NTSTATUS status = composite_wait(c);
if (NT_STATUS_IS_OK(status)) {
struct lsa_lookupsids_state *state =
talloc_get_type(c->private_data,
struct lsa_lookupsids_state);
*names = talloc_steal(mem_ctx, state->result);
}
talloc_free(c);
return status;
}
NTSTATUS wb_lsa_lookupsids(struct dcerpc_pipe *lsa_pipe,
struct policy_handle *handle,
int num_sids, const struct dom_sid **sids,
TALLOC_CTX *mem_ctx,
struct wb_sid_object ***names)
{
struct composite_context *c =
wb_lsa_lookupsids_send(lsa_pipe, handle, num_sids, sids);
return wb_lsa_lookupnames_recv(c, mem_ctx, names);
}
struct lsa_lookupnames_state {
struct composite_context *ctx;
uint32_t num_names;
@ -747,4 +904,3 @@ NTSTATUS wb_samr_userdomgroups_recv(struct composite_context *ctx,
talloc_free(ctx);
return status;
}

5
source4/winbind/wb_async_helpers.h
View File

@ -33,3 +33,8 @@ struct wb_sid_object {
const char *domain;
const char *name;
};
struct wb_dom_info {
const char *name;
const struct dom_sid *sid;
};

33
source4/winbind/wb_cmd_getdcname.c
View File

@ -24,6 +24,7 @@
#include "libcli/composite/composite.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
#include "librpc/gen_ndr/ndr_netlogon.h"
@ -63,7 +64,7 @@ static void composite_netr_GetAnyDCName_recv_rpc(struct rpc_request *req)
composite_done(ctx);
}
NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx)
static NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx)
{
NTSTATUS status = composite_wait(ctx);
talloc_free(ctx);
@ -72,30 +73,28 @@ NTSTATUS composite_netr_GetAnyDCName_recv(struct composite_context *ctx)
struct cmd_getdcname_state {
struct composite_context *ctx;
struct wbsrv_domain *domain;
const char *domain_name;
struct netr_GetAnyDCName g;
};
static struct composite_context *getdcname_send_req(void *p);
static struct composite_context *getdcname_send_req(struct wbsrv_domain *domain,
void *p);
static NTSTATUS getdcname_recv_req(struct composite_context *ctx, void *p);
struct composite_context *wb_cmd_getdcname_send(struct wbsrv_call *call,
const char *domain)
struct composite_context *wb_cmd_getdcname_send(struct wbsrv_service *service,
struct wbsrv_domain *domain,
const char *domain_name)
{
struct cmd_getdcname_state *state;
struct wbsrv_service *service = call->wbconn->listen_socket->service;
state = talloc(NULL, struct cmd_getdcname_state);
state->domain = service->domains;
state->domain_name = talloc_strdup(state, domain);
state->ctx = wb_queue_domain_send(state, state->domain,
call->event_ctx,
call->wbconn->conn->msg_ctx,
getdcname_send_req,
getdcname_recv_req,
state);
state->domain_name = talloc_strdup(state, domain_name);
state->ctx = wb_domain_request_send(state, service,
service->primary_sid,
getdcname_send_req,
getdcname_recv_req,
state);
if (state->ctx == NULL) {
talloc_free(state);
return NULL;
@ -104,17 +103,17 @@ struct composite_context *wb_cmd_getdcname_send(struct wbsrv_call *call,
return state->ctx;
}
static struct composite_context *getdcname_send_req(void *p)
static struct composite_context *getdcname_send_req(struct wbsrv_domain *domain, void *p)
{
struct cmd_getdcname_state *state =
talloc_get_type(p, struct cmd_getdcname_state);
state->g.in.logon_server = talloc_asprintf(
state, "\\\\%s",
dcerpc_server_name(state->domain->netlogon_pipe));
dcerpc_server_name(domain->netlogon_pipe));
state->g.in.domainname = state->domain_name;
return composite_netr_GetAnyDCName_send(state->domain->netlogon_pipe,
return composite_netr_GetAnyDCName_send(domain->netlogon_pipe,
state, &state->g);
}

124
source4/winbind/wb_cmd_list_trustdom.c Normal file
View File

@ -0,0 +1,124 @@
/*
Unix SMB/CIFS implementation.
Command backend for wbinfo -m
Copyright (C) Volker Lendecke 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/composite/composite.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
/* List trusted domains. To avoid the trouble with having to wait for other
* conflicting requests waiting for the lsa pipe we're opening our own lsa
* pipe here. */
struct cmd_list_trustdom_state {
struct composite_context *ctx;
struct dcerpc_pipe *lsa_pipe;
struct policy_handle *lsa_policy;
int num_domains;
struct wb_dom_info *domains;
uint32_t resume_handle;
struct lsa_DomainList domains;
struct lsa_EnumTrustDom r;
};
static void cmd_list_trustdoms_recv_domain(struct composite_context *ctx);
static void cmd_list_trustdoms_recv_lsa(struct composite_context *ctx);
static void cmd_list_trustdoms_recv_doms(struct rpc_request *req);
struct composite_context *wb_cmd_list_trustdoms_send(struct wbsrv_service *service)
{
struct composite_context *result, *ctx;
struct cmd_list_trustdom_state *state;
result = talloc_zero(NULL, struct composite_context);
if (result == NULL) goto failed;
result->state = COMPOSITE_STATE_IN_PROGRESS;
result->async.fn = NULL;
result->event_ctx = service->task->event_ctx;
state = talloc(result, struct cmd_list_trustdom_state);
if (state == NULL) goto failed;
state->ctx = result;
result->private_data = state;
state->service = service;
ctx = wb_sid2domain_send(service, service->primary_sid);
if (ctx == NULL) goto failed;
ctx->async.fn = cmd_list_trustdoms_recv_domain;
ctx->async.private_data = state;
return result;
failed:
talloc_free(result);
return NULL;
}
static void cmd_list_trustdoms_recv_domain(struct composite_context *ctx)
{
struct cmd_list_trustdom_state *state =
talloc_get_type(ctx->async.private_data,
struct cmd_list_trustdom_state);
struct wbsrv_domain *domain;
struct smbcli_tree *tree;
state->ctx->status = wb_sid2domain_recv(ctx, &domain);
if (!composite_is_ok(state->ctx)) return;
tree = dcerpc_smb_tree(domain->lsa_pipe);
if (composite_nomem(tree, state->tree)) return;
ctx = wb_init_lsa_send(tree, domain->lsa_auth_type,
domain->schannel_creds);
composite_continue(state->ctx, ctx, cmd_list_trustdoms_recv_lsa,
state);
}
static void cmd_list_trustdoms_recv_lsa(struct composite_context *ctx)
{
struct cmd_list_trustdom_state *state =
talloc_get_type(ctx->async.private_data,
struct cmd_list_trustdom_state);
struct rpc_request *req;
state->ctx->status = wb_init_lsa_recv(ctx, state,
&state->lsa_pipe,
&state->lsa_policy);
if (!composite_is_ok(state->ctx)) return;
state->resume_handle = 0;
state->r.in.policy_handle = state->lsa_policy;
state->r.in.resume_handle = &state->resume_handle;
state->r.in.max_size = 1000;
state->r.out.resume_handle = &state->resume_handle;
req = dcerpc_lsa_EnumTrustDom_send(state->lsa_pipe, state, &state->r);
composite_continue_rpc(state->ctx, req, cmd_list_trustdoms_recv_doms,
state);
}
static void cmd_list_trustdoms_recv_doms(struct rpc_request *req)
{
}

49
source4/winbind/wb_cmd_lookupname.c
View File

@ -24,49 +24,49 @@
#include "libcli/composite/composite.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
struct cmd_lookupname_state {
struct composite_context *ctx;
struct wbsrv_call *call;
struct wbsrv_domain *domain;
const char *name;
struct wb_sid_object *result;
};
static struct composite_context *lookupname_send_req(void *p);
static struct composite_context *lookupname_send_req(struct wbsrv_domain *domain, void *p);
static NTSTATUS lookupname_recv_req(struct composite_context *ctx, void *p);
struct composite_context *wb_cmd_lookupname_send(struct wbsrv_call *call,
struct composite_context *wb_cmd_lookupname_send(struct wbsrv_service *service,
struct wbsrv_domain *domain,
const char *dom_name,
const char *name)
{
struct cmd_lookupname_state *state;
struct wbsrv_service *service = call->wbconn->listen_socket->service;
state = talloc(NULL, struct cmd_lookupname_state);
state->domain = service->domains;
state->call = call;
state->name = talloc_strdup(state, name);
state->ctx = wb_queue_domain_send(state, state->domain,
call->event_ctx,
call->wbconn->conn->msg_ctx,
lookupname_send_req,
lookupname_recv_req,
state);
if (state->ctx == NULL) {
talloc_free(state);
return NULL;
}
state->name = talloc_asprintf(state, "%s\\%s", dom_name, name);
if (state->name == NULL) goto failed;
state->ctx = wb_domain_request_send(state, service,
service->primary_sid,
lookupname_send_req,
lookupname_recv_req,
state);
if (state->ctx == NULL) goto failed;
state->ctx->private_data = state;
return state->ctx;
failed:
talloc_free(state);
return NULL;
}
static struct composite_context *lookupname_send_req(void *p)
static struct composite_context *lookupname_send_req(struct wbsrv_domain *domain,
void *p)
{
struct cmd_lookupname_state *state =
talloc_get_type(p, struct cmd_lookupname_state);
return wb_lsa_lookupnames_send(state->domain->lsa_pipe,
state->domain->lsa_policy,
return wb_lsa_lookupnames_send(domain->lsa_pipe,
domain->lsa_policy,
1, &state->name);
}
@ -98,10 +98,13 @@ NTSTATUS wb_cmd_lookupname_recv(struct composite_context *c,
return status;
}
NTSTATUS wb_cmd_lookupname(struct wbsrv_call *call, const char *name,
NTSTATUS wb_cmd_lookupname(struct wbsrv_service *service,
struct wbsrv_domain *domain,
const char *dom_name,
const char *name,
TALLOC_CTX *mem_ctx, struct wb_sid_object **sid)
{
struct composite_context *c =
wb_cmd_lookupname_send(call, name);
wb_cmd_lookupname_send(service, domain, dom_name, name);
return wb_cmd_lookupname_recv(c, mem_ctx, sid);
}

107
source4/winbind/wb_cmd_lookupsid.c Normal file
View File

@ -0,0 +1,107 @@
/*
Unix SMB/CIFS implementation.
Command backend for wbinfo -s
Copyright (C) Volker Lendecke 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/composite/composite.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
struct cmd_lookupsid_state {
struct composite_context *ctx;
const struct dom_sid *sid;
struct wb_sid_object *result;
};
static struct composite_context *lookupsid_send_req(struct wbsrv_domain *domain, void *p);
static NTSTATUS lookupsid_recv_req(struct composite_context *ctx, void *p);
struct composite_context *wb_cmd_lookupsid_send(struct wbsrv_service *service,
struct wbsrv_domain *domain,
const struct dom_sid *sid)
{
struct cmd_lookupsid_state *state;
state = talloc(NULL, struct cmd_lookupsid_state);
state->sid = dom_sid_dup(state, sid);
if (state->sid == NULL) goto failed;
state->ctx = wb_domain_request_send(state, service,
service->primary_sid,
lookupsid_send_req,
lookupsid_recv_req,
state);
if (state->ctx == NULL) goto failed;
state->ctx->private_data = state;
return state->ctx;
failed:
talloc_free(state);
return NULL;
}
static struct composite_context *lookupsid_send_req(struct wbsrv_domain *domain, void *p)
{
struct cmd_lookupsid_state *state =
talloc_get_type(p, struct cmd_lookupsid_state);
return wb_lsa_lookupsids_send(domain->lsa_pipe,
domain->lsa_policy,
1, &state->sid);
}
static NTSTATUS lookupsid_recv_req(struct composite_context *ctx, void *p)
{
struct cmd_lookupsid_state *state =
talloc_get_type(p, struct cmd_lookupsid_state);
struct wb_sid_object **names;
NTSTATUS status;
status = wb_lsa_lookupsids_recv(ctx, state, &names);
if (NT_STATUS_IS_OK(status)) {
state->result = names[0];
}
return status;
}
NTSTATUS wb_cmd_lookupsid_recv(struct composite_context *c,
TALLOC_CTX *mem_ctx,
struct wb_sid_object **sid)
{
struct cmd_lookupsid_state *state =
talloc_get_type(c->private_data, struct cmd_lookupsid_state);
NTSTATUS status = composite_wait(c);
if (NT_STATUS_IS_OK(status)) {
*sid = talloc_steal(mem_ctx, state->result);
}
talloc_free(state);
return status;
}
NTSTATUS wb_cmd_lookupsid(struct wbsrv_service *service,
struct wbsrv_domain *domain,
const struct dom_sid *sid,
TALLOC_CTX *mem_ctx, struct wb_sid_object **name)
{
struct composite_context *c =
wb_cmd_lookupsid_send(service, domain, sid);
return wb_cmd_lookupsid_recv(c, mem_ctx, name);
}

72
source4/winbind/wb_cmd_userdomgroups.c
View File

@ -29,70 +29,29 @@
struct cmd_userdomgroups_state {
struct composite_context *ctx;
struct wbsrv_domain *domain;
struct dom_sid *dom_sid;
uint32_t user_rid;
int num_rids;
uint32_t *rids;
};
static void composite_trigger_now(struct event_context *ev,
struct timed_event *te,
struct timeval t, void *ptr)
{
struct composite_context *c =
talloc_get_type(ptr, struct composite_context);
if (NT_STATUS_IS_OK(c->status)) {
c->state = COMPOSITE_STATE_ERROR;
} else {
c->state = COMPOSITE_STATE_DONE;
}
if (c->async.fn) {
c->async.fn(c);
}
}
static struct composite_context *userdomgroups_send_req(void *p);
static struct composite_context *userdomgroups_send_req(struct wbsrv_domain *domain, void *p);
static NTSTATUS userdomgroups_recv_req(struct composite_context *ctx, void *p);
struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_call *call,
struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_service *service,
const struct dom_sid *sid)
{
struct cmd_userdomgroups_state *state;
struct wbsrv_service *service = call->wbconn->listen_socket->service;
state = talloc(NULL, struct cmd_userdomgroups_state);
state->domain = service->domains;
if (dom_sid_in_domain(state->domain->sid, sid)) {
state->user_rid = sid->sub_auths[sid->num_auths-1];
state->ctx = wb_queue_domain_send(state, state->domain,
call->event_ctx,
call->wbconn->conn->msg_ctx,
userdomgroups_send_req,
userdomgroups_recv_req,
state);
if (state->ctx == NULL) goto failed;
state->ctx->private_data = state;
return state->ctx;
}
state->ctx = talloc(state, struct composite_context);
state->user_rid = sid->sub_auths[sid->num_auths-1];
state->ctx = wb_domain_request_send(state, service, sid,
userdomgroups_send_req,
userdomgroups_recv_req,
state);
if (state->ctx == NULL) goto failed;
state->ctx->state = COMPOSITE_STATE_IN_PROGRESS;
state->ctx->async.fn = NULL;
state->ctx->event_ctx = call->event_ctx;
state->ctx->status = NT_STATUS_NO_SUCH_USER;
state->ctx->private_data = state;
/* Using composite_trigger_error here causes problems with the client
* socket. Linux 2.6.8 gives me a ECONNRESET on the next read after
* writing the reply when I don't wait the 100 milliseconds. */
event_add_timed(state->ctx->event_ctx, state->ctx,
timeval_current_ofs(0, 100000),
composite_trigger_now, state->ctx);
return state->ctx;
failed:
@ -100,13 +59,16 @@ struct composite_context *wb_cmd_userdomgroups_send(struct wbsrv_call *call,
return NULL;
}
static struct composite_context *userdomgroups_send_req(void *p)
static struct composite_context *userdomgroups_send_req(struct wbsrv_domain *domain,
void *p)
{
struct cmd_userdomgroups_state *state =
talloc_get_type(p, struct cmd_userdomgroups_state);
return wb_samr_userdomgroups_send(state->domain->samr_pipe,
state->domain->domain_handle,
state->dom_sid = talloc_reference(state, domain->sid);
if (state->dom_sid == NULL) return NULL;
return wb_samr_userdomgroups_send(domain->samr_pipe,
domain->domain_handle,
state->user_rid);
}
@ -140,7 +102,7 @@ NTSTATUS wb_cmd_userdomgroups_recv(struct composite_context *c,
}
for (i=0; i<state->num_rids; i++) {
(*sids)[i] = dom_sid_add_rid((*sids), state->domain->sid,
(*sids)[i] = dom_sid_add_rid((*sids), state->dom_sid,
state->rids[i]);
if ((*sids)[i] == NULL) {
status = NT_STATUS_NO_MEMORY;
@ -153,12 +115,12 @@ done:
return status;
}
NTSTATUS wb_cmd_userdomgroups(struct wbsrv_call *call,
NTSTATUS wb_cmd_userdomgroups(struct wbsrv_service *service,
const struct dom_sid *sid,
TALLOC_CTX *mem_ctx, int *num_sids,
struct dom_sid ***sids)
{
struct composite_context *c =
wb_cmd_userdomgroups_send(call, sid);
wb_cmd_userdomgroups_send(service, sid);
return wb_cmd_userdomgroups_recv(c, mem_ctx, num_sids, sids);
}

333
source4/winbind/wb_cmd_usersids.c Normal file
View File

@ -0,0 +1,333 @@
/*
Unix SMB/CIFS implementation.
Command backend for wbinfo --user-sids
Copyright (C) Volker Lendecke 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/composite/composite.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
#include "lib/events/events.h"
#include "librpc/gen_ndr/ndr_security.h"
#include "librpc/gen_ndr/ndr_samr.h"
/* Calculate the token in two steps: Go the user's originating domain, asking
* for the user's domain groups. Then with the resulting list of sids go to
* our own domain, expanding the aliases aka domain local groups. Two helpers
* are needed: composite_samr_GetAliasMembership and wb_sidaliases. The core
* function this file supplies is wb_cmd_usersids somewhere down. */
/* composite_context wrapper around dcerpc_samr_GetAliasMembership */
static void composite_samr_GetAliasMembership_recv_rpc(struct rpc_request *req);
static struct composite_context *composite_samr_GetAliasMembership_send(struct dcerpc_pipe *p,
TALLOC_CTX *mem_ctx,
struct samr_GetAliasMembership *r)
{
struct composite_context *result;
struct rpc_request *req;
result = talloc(mem_ctx, struct composite_context);
if (result == NULL) goto failed;
result->state = COMPOSITE_STATE_IN_PROGRESS;
result->async.fn = NULL;
result->event_ctx = p->conn->event_ctx;
req = dcerpc_samr_GetAliasMembership_send(p, mem_ctx, r);
if (req == NULL) goto failed;
req->async.callback = composite_samr_GetAliasMembership_recv_rpc;
req->async.private = result;
return result;
failed:
talloc_free(result);
return NULL;
}
static void composite_samr_GetAliasMembership_recv_rpc(struct rpc_request *req)
{
struct composite_context *ctx =
talloc_get_type(req->async.private, struct composite_context);
ctx->status = dcerpc_ndr_request_recv(req);
if (!composite_is_ok(ctx)) return;
composite_done(ctx);
}
static NTSTATUS composite_samr_GetAliasMembership_recv(struct composite_context *ctx)
{
NTSTATUS status = composite_wait(ctx);
talloc_free(ctx);
return status;
}
/* Composite wrapper including domain selection and domain queueing around
* GetAliasMemberships */
struct sidaliases_state {
struct composite_context *ctx;
int num_sids;
const struct dom_sid *domain_sid;
const struct dom_sid *sids;
struct lsa_SidArray lsa_sids;
struct samr_Ids rids;
struct samr_GetAliasMembership r;
};
static struct composite_context *sidaliases_send_req(struct wbsrv_domain *domain,
void *p);
static NTSTATUS sidaliases_recv_req(struct composite_context *ctx, void *p);
static struct composite_context *wb_sidaliases_send(struct wbsrv_service *service,
int num_sids,
struct dom_sid **sids)
{
struct sidaliases_state *state;
int i;
state = talloc(NULL, struct sidaliases_state);
state->domain_sid = talloc_reference(state, service->primary_sid);
if (state->domain_sid == NULL) goto failed;
state->lsa_sids.num_sids = num_sids;
state->lsa_sids.sids = talloc_array(state, struct lsa_SidPtr,
num_sids);
if (state->lsa_sids.sids == NULL) goto failed;
for (i=0; i<state->lsa_sids.num_sids; i++) {
state->lsa_sids.sids[i].sid =
talloc_reference(state->lsa_sids.sids, sids[i]);
if (state->lsa_sids.sids[i].sid == NULL) goto failed;
}
state->rids.count = 0;
state->rids.ids = NULL;
state->ctx = wb_domain_request_send(state, service,
service->primary_sid,
sidaliases_send_req,
sidaliases_recv_req,
state);
if (state->ctx == NULL) goto failed;
state->ctx->private_data = state;
return state->ctx;
failed:
talloc_free(state);
return NULL;
}
static struct composite_context *sidaliases_send_req(struct wbsrv_domain *domain,
void *p)
{
struct sidaliases_state *state =
talloc_get_type(p, struct sidaliases_state);
state->r.in.domain_handle = domain->domain_handle;
state->r.in.sids = &state->lsa_sids;
state->r.out.rids = &state->rids;
return composite_samr_GetAliasMembership_send(domain->samr_pipe,
state, &state->r);
}
static NTSTATUS sidaliases_recv_req(struct composite_context *ctx, void *p)
{
struct sidaliases_state *state =
talloc_get_type(p, struct sidaliases_state);
NTSTATUS status;
status = composite_samr_GetAliasMembership_recv(ctx);
NT_STATUS_NOT_OK_RETURN(status);
return state->r.out.result;
}
static NTSTATUS wb_sidaliases_recv(struct composite_context *ctx,
TALLOC_CTX *mem_ctx,
int *num_sids,
struct dom_sid ***sids)
{
struct sidaliases_state *state =
talloc_get_type(ctx->private_data,
struct sidaliases_state);
NTSTATUS status;
int i;
status = composite_wait(ctx);
if (!NT_STATUS_IS_OK(status)) goto done;
*num_sids = state->r.out.rids->count;
*sids = talloc_array(mem_ctx, struct dom_sid *, *num_sids);
if (*sids == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;
}
for (i=0; i<*num_sids; i++) {
(*sids)[i] = dom_sid_add_rid((*sids), state->domain_sid,
state->r.out.rids->ids[i]);
if ((*sids)[i] == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;
}
}
done:
talloc_free(state);
return status;
}
/* Supplied a SID, go to the user's DC, ask it for the user's domain
* groups. Then go to our DC, ask it for the domain local groups. */
struct cmd_usersids_state {
struct composite_context *ctx;
struct wbsrv_service *service;
struct dom_sid *user_sid;
int num_domgroups;
struct dom_sid **domgroups;
int num_sids;
struct dom_sid **sids;
};
static void cmd_usersids_recv_domgroups(struct composite_context *ctx);
static void cmd_usersids_recv_aliases(struct composite_context *ctx);
struct composite_context *wb_cmd_usersids_send(struct wbsrv_service *service,
const struct dom_sid *sid)
{
struct composite_context *result, *ctx;
struct cmd_usersids_state *state;
result = talloc_zero(NULL, struct composite_context);
if (result == NULL) goto failed;
result->state = COMPOSITE_STATE_IN_PROGRESS;
result->async.fn = NULL;
result->event_ctx = service->task->event_ctx;
state = talloc(result, struct cmd_usersids_state);
if (state == NULL) goto failed;
state->ctx = result;
result->private_data = state;
state->service = service;
state->user_sid = dom_sid_dup(state, sid);
if (state->user_sid == NULL) goto failed;
ctx = wb_cmd_userdomgroups_send(service, sid);
if (ctx == NULL) goto failed;
ctx->async.fn = cmd_usersids_recv_domgroups;
ctx->async.private_data = state;
return result;
failed:
talloc_free(result);
return NULL;
}
static void cmd_usersids_recv_domgroups(struct composite_context *ctx)
{
struct cmd_usersids_state *state =
talloc_get_type(ctx->async.private_data,
struct cmd_usersids_state);
int i;
struct dom_sid **sids;
state->ctx->status = wb_cmd_userdomgroups_recv(ctx, state,
&state->num_domgroups,
&state->domgroups);
if (!composite_is_ok(state->ctx)) return;
sids = talloc_array(state, struct dom_sid *, state->num_domgroups+1);
if (composite_nomem(sids, state->ctx)) return;
sids[0] = state->user_sid;
for (i=0; i<state->num_domgroups; i++) {
sids[i+1] = state->domgroups[i];
}
ctx = wb_sidaliases_send(state->service, state->num_domgroups+1,
sids);
composite_continue(state->ctx, ctx, cmd_usersids_recv_aliases, state);
}
static void cmd_usersids_recv_aliases(struct composite_context *ctx)
{
struct cmd_usersids_state *state =
talloc_get_type(ctx->async.private_data,
struct cmd_usersids_state);
int i, num_aliases;
struct dom_sid **aliases;
state->ctx->status = wb_sidaliases_recv(ctx, state, &num_aliases,
&aliases);
if (!composite_is_ok(state->ctx)) return;
state->num_sids = 1 + state->num_domgroups + num_aliases;
state->sids = talloc_array(state, struct dom_sid *, state->num_sids);
if (composite_nomem(state->sids, state->ctx)) return;
state->sids[0] = talloc_steal(state->sids, state->user_sid);
for (i=0; i<state->num_domgroups; i++) {
state->sids[1+i] =
talloc_steal(state->sids, state->domgroups[i]);
}
for (i=0; i<num_aliases; i++) {
state->sids[1+i+state->num_domgroups] =
talloc_steal(state->sids, aliases[i]);
}
composite_done(state->ctx);
}
NTSTATUS wb_cmd_usersids_recv(struct composite_context *ctx,
TALLOC_CTX *mem_ctx,
int *num_sids, struct dom_sid ***sids)
{
NTSTATUS status = composite_wait(ctx);
if (NT_STATUS_IS_OK(status)) {
struct cmd_usersids_state *state =
talloc_get_type(ctx->private_data,
struct cmd_usersids_state);
*num_sids = state->num_sids;
*sids = talloc_steal(mem_ctx, state->sids);
}
talloc_free(ctx);
return status;
}
NTSTATUS wb_cmd_usersids(struct wbsrv_service *service,
const struct dom_sid *sid,
TALLOC_CTX *mem_ctx, int *num_sids,
struct dom_sid ***sids)
{
struct composite_context *c =
wb_cmd_usersids_send(service, sid);
return wb_cmd_usersids_recv(c, mem_ctx, num_sids, sids);
}

14
source4/winbind/wb_connect_lsa.c
View File

@ -45,9 +45,9 @@ struct init_lsa_state {
static void init_lsa_recv_pipe(struct composite_context *ctx);
static void init_lsa_recv_openpol(struct rpc_request *req);
static struct composite_context *wb_init_lsa_send(struct smbcli_tree *tree,
uint8_t auth_type,
struct cli_credentials *creds)
struct composite_context *wb_init_lsa_send(struct smbcli_tree *tree,
uint8_t auth_type,
struct cli_credentials *creds)
{
struct composite_context *result, *ctx;
struct init_lsa_state *state;
@ -147,10 +147,10 @@ static void init_lsa_recv_openpol(struct rpc_request *req)
composite_done(state->ctx);
}
static NTSTATUS wb_init_lsa_recv(struct composite_context *c,
TALLOC_CTX *mem_ctx,
struct dcerpc_pipe **lsa_pipe,
struct policy_handle **lsa_policy)
NTSTATUS wb_init_lsa_recv(struct composite_context *c,
TALLOC_CTX *mem_ctx,
struct dcerpc_pipe **lsa_pipe,
struct policy_handle **lsa_policy)
{
NTSTATUS status = composite_wait(c);
if (NT_STATUS_IS_OK(status)) {

157
source4/winbind/wb_domain_request.c Normal file
View File

@ -0,0 +1,157 @@
/*
Unix SMB/CIFS implementation.
A composite API for initializing a domain
Copyright (C) Volker Lendecke 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/composite/composite.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
#include "dlinklist.h"
struct domain_request_state {
struct domain_request_state *prev, *next;
struct composite_context *ctx;
struct wbsrv_service *service;
struct wbsrv_domain *domain;
struct composite_context *(*send_fn)(struct wbsrv_domain *domain,
void *p);
NTSTATUS (*recv_fn)(struct composite_context *c,
void *p);
void *private_data;
};
static void domain_request_recv_domain(struct composite_context *ctx);
static void domain_request_recv_init(struct composite_context *ctx);
static void domain_request_recv_sub(struct composite_context *ctx);
struct composite_context *wb_domain_request_send(TALLOC_CTX *mem_ctx,
struct wbsrv_service *service,
const struct dom_sid *sid,
struct composite_context *(*send_fn)(struct wbsrv_domain *domain, void *p),
NTSTATUS (*recv_fn)(struct composite_context *c,
void *p),
void *private_data)
{
struct composite_context *result, *ctx;
struct domain_request_state *state;
result = talloc(mem_ctx, struct composite_context);
if (result == NULL) goto failed;
result->state = COMPOSITE_STATE_IN_PROGRESS;
result->async.fn = NULL;
result->event_ctx = service->task->event_ctx;
state = talloc_zero(result, struct domain_request_state);
if (state == NULL) goto failed;
state->ctx = result;
result->private_data = state;
state->service = service;
state->send_fn = send_fn;
state->recv_fn = recv_fn;
state->private_data = private_data;
ctx = wb_sid2domain_send(service, sid);
if (ctx == NULL) goto failed;
ctx->async.fn = domain_request_recv_domain;
ctx->async.private_data = state;
return result;
failed:
talloc_free(result);
return NULL;
}
static void domain_request_recv_domain(struct composite_context *ctx)
{
struct domain_request_state *state =
talloc_get_type(ctx->async.private_data,
struct domain_request_state);
state->ctx->status = wb_sid2domain_recv(ctx, &state->domain);
if (!composite_is_ok(state->ctx)) return;
if (state->domain->busy) {
DEBUG(3, ("Domain %s busy\n", state->domain->name));
DLIST_ADD_END(state->domain->request_queue, state,
struct domain_request_state *);
return;
}
state->domain->busy = True;
if (!state->domain->initialized) {
ctx = wb_init_domain_send(state->domain,
state->service->task->event_ctx,
state->service->task->msg_ctx);
composite_continue(state->ctx, ctx, domain_request_recv_init,
state);
return;
}
ctx = state->send_fn(state->domain, state->private_data);
composite_continue(state->ctx, ctx, domain_request_recv_sub, state);
}
static void domain_request_recv_init(struct composite_context *ctx)
{
struct domain_request_state *state =
talloc_get_type(ctx->async.private_data,
struct domain_request_state);
state->ctx->status = wb_init_domain_recv(ctx);
if (!composite_is_ok(state->ctx)) return;
ctx = state->send_fn(state->domain, state->private_data);
composite_continue(state->ctx, ctx, domain_request_recv_sub, state);
}
static void domain_request_recv_sub(struct composite_context *ctx)
{
struct domain_request_state *state =
talloc_get_type(ctx->async.private_data,
struct domain_request_state);
state->ctx->status = state->recv_fn(ctx, state->private_data);
state->domain->busy = False;
if (state->domain->request_queue != NULL) {
struct domain_request_state *s2;
s2 = state->domain->request_queue;
DLIST_REMOVE(state->domain->request_queue, s2);
ctx = s2->send_fn(state->domain, s2->private_data);
composite_continue(s2->ctx, ctx, domain_request_recv_sub, s2);
state->domain->busy = True;
}
if (!composite_is_ok(state->ctx)) return;
composite_done(state->ctx);
}
NTSTATUS wb_domain_request_recv(struct composite_context *ctx)
{
NTSTATUS status = composite_wait(ctx);
talloc_free(ctx);
return status;
}

162
source4/winbind/wb_init_domain.c
View File

@ -26,6 +26,7 @@
#include "winbind/wb_async_helpers.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
#include "dlinklist.h"
#include "librpc/gen_ndr/nbt.h"
@ -84,6 +85,7 @@ struct init_domain_state {
};
static void init_domain_recv_dcs(struct composite_context *ctx);
static void init_domain_recv_dcip(struct composite_context *ctx);
static void init_domain_recv_tree(struct composite_context *ctx);
static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
@ -111,6 +113,17 @@ struct composite_context *wb_init_domain_send(struct wbsrv_domain *domain,
state->domain = domain;
if (domain->dcname != NULL) {
struct nbt_name name;
make_nbt_name(&name, domain->dcname, 0x20);
ctx = resolve_name_send(&name, result->event_ctx,
lp_name_resolve_order());
if (ctx == NULL) goto failed;
ctx->async.fn = init_domain_recv_dcip;
ctx->async.private_data = state;
return result;
}
if (state->domain->schannel_creds != NULL) {
talloc_free(state->domain->schannel_creds);
}
@ -175,6 +188,31 @@ static void init_domain_recv_dcs(struct composite_context *ctx)
composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
}
static void init_domain_recv_dcip(struct composite_context *ctx)
{
struct init_domain_state *state =
talloc_get_type(ctx->async.private_data,
struct init_domain_state);
const char *dcaddr;
state->ctx->status = resolve_name_recv(ctx, state, &dcaddr);
if (!composite_is_ok(state->ctx)) return;
state->conn.in.dest_host = dcaddr;
state->conn.in.port = 0;
state->conn.in.called_name = state->domain->dcname;
state->conn.in.service = "IPC$";
state->conn.in.service_type = "IPC";
state->conn.in.workgroup = state->domain->name;
state->conn.in.credentials = state->domain->schannel_creds;
state->conn.in.fallback_to_anonymous = True;
ctx = smb_composite_connect_send(&state->conn, state,
state->ctx->event_ctx);
composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
}
static void init_domain_recv_tree(struct composite_context *ctx)
{
struct init_domain_state *state =
@ -184,7 +222,8 @@ static void init_domain_recv_tree(struct composite_context *ctx)
state->ctx->status = smb_composite_connect_recv(ctx, state);
if (!composite_is_ok(state->ctx)) return;
if (state->domain->schannel_creds == NULL) {
if ((state->domain->schannel_creds == NULL) ||
cli_credentials_is_anonymous(state->domain->schannel_creds)) {
/* No chance to open netlogon */
ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
composite_continue(state->ctx, ctx,
@ -212,6 +251,15 @@ static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
talloc_unlink(state, state->conn.out.tree); /* The pipe owns it now */
if (!lp_winbind_sealed_pipes()) {
state->netlogon_pipe = talloc_reference(state,
state->auth2_pipe);
ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
composite_continue(state->ctx, ctx, init_domain_recv_lsa,
state);
return;
}
state->netlogon_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
if (composite_nomem(state->netlogon_pipe, state->ctx)) return;
@ -272,7 +320,6 @@ static void init_domain_recv_lsa(struct composite_context *ctx)
/* Give the tree to the LSA pipe. If auth2_pipe exists we have
* given it to that already */
talloc_unlink(state, state->conn.out.tree);
state->conn.out.tree = NULL;
}
state->queryinfo.in.handle = state->lsa_policy;
@ -392,114 +439,3 @@ NTSTATUS wb_init_domain(struct wbsrv_domain *domain,
wb_init_domain_send(domain, event_ctx, messaging_ctx);
return wb_init_domain_recv(c);
}
struct queue_domain_state {
struct queue_domain_state *prev, *next;
struct composite_context *ctx;
struct wbsrv_domain *domain;
struct composite_context *(*send_fn)(void *p);
NTSTATUS (*recv_fn)(struct composite_context *c,
void *p);
void *private_data;
};
static void queue_domain_recv_init(struct composite_context *ctx);
static void queue_domain_recv_sub(struct composite_context *ctx);
struct composite_context *wb_queue_domain_send(TALLOC_CTX *mem_ctx,
struct wbsrv_domain *domain,
struct event_context *event_ctx,
struct messaging_context *msg_ctx,
struct composite_context *(*send_fn)(void *p),
NTSTATUS (*recv_fn)(struct composite_context *c,
void *p),
void *private_data)
{
struct composite_context *result, *ctx;
struct queue_domain_state *state;
result = talloc(mem_ctx, struct composite_context);
if (result == NULL) goto failed;
result->state = COMPOSITE_STATE_IN_PROGRESS;
result->async.fn = NULL;
result->event_ctx = event_ctx;
state = talloc(result, struct queue_domain_state);
if (state == NULL) goto failed;
state->ctx = result;
result->private_data = state;
state->send_fn = send_fn;
state->recv_fn = recv_fn;
state->private_data = private_data;
state->domain = domain;
if (domain->busy) {
DEBUG(0, ("Domain %s busy\n", domain->name));
DLIST_ADD_END(domain->request_queue, state,
struct queue_domain_state *);
return result;
}
domain->busy = True;
if (!domain->initialized) {
ctx = wb_init_domain_send(domain, result->event_ctx, msg_ctx);
if (ctx == NULL) goto failed;
ctx->async.fn = queue_domain_recv_init;
ctx->async.private_data = state;
return result;
}
ctx = state->send_fn(state->private_data);
if (ctx == NULL) goto failed;
ctx->async.fn = queue_domain_recv_sub;
ctx->async.private_data = state;
return result;
failed:
talloc_free(result);
return NULL;
}
static void queue_domain_recv_init(struct composite_context *ctx)
{
struct queue_domain_state *state =
talloc_get_type(ctx->async.private_data,
struct queue_domain_state);
state->ctx->status = wb_init_domain_recv(ctx);
if (!composite_is_ok(state->ctx)) return;
ctx = state->send_fn(state->private_data);
composite_continue(state->ctx, ctx, queue_domain_recv_sub, state);
}
static void queue_domain_recv_sub(struct composite_context *ctx)
{
struct queue_domain_state *state =
talloc_get_type(ctx->async.private_data,
struct queue_domain_state);
state->ctx->status = state->recv_fn(ctx, state->private_data);
state->domain->busy = False;
if (state->domain->request_queue != NULL) {
struct queue_domain_state *s2;
s2 = state->domain->request_queue;
DLIST_REMOVE(state->domain->request_queue, s2);
ctx = s2->send_fn(s2->private_data);
composite_continue(s2->ctx, ctx, queue_domain_recv_sub, s2);
state->domain->busy = True;
}
if (!composite_is_ok(state->ctx)) return;
composite_done(state->ctx);
}
NTSTATUS wb_queue_domain_recv(struct composite_context *ctx)
{
NTSTATUS status = composite_wait(ctx);
talloc_free(ctx);
return status;
}

32
source4/winbind/wb_pam_auth.c
View File

@ -30,7 +30,6 @@
struct pam_auth_crap_state {
struct composite_context *ctx;
struct event_context *event_ctx;
struct wbsrv_domain *domain;
const char *domain_name;
const char *user_name;
const char *workstation;
@ -46,7 +45,8 @@ struct pam_auth_crap_state {
DATA_BLOB info3;
};
static struct composite_context *crap_samlogon_send_req(void *p);
static struct composite_context *crap_samlogon_send_req(struct wbsrv_domain *domain,
void *p);
static NTSTATUS crap_samlogon_recv_req(struct composite_context *ctx, void *p);
struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
@ -63,7 +63,6 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
state = talloc(NULL, struct pam_auth_crap_state);
if (state == NULL) goto failed;
state->domain = service->domains;
state->event_ctx = call->event_ctx;
state->domain_name = talloc_strdup(state, domain);
@ -86,12 +85,11 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
if ((lm_resp.data != NULL) &&
(state->lm_resp.data == NULL)) goto failed;
state->ctx = wb_queue_domain_send(state, state->domain,
call->event_ctx,
call->wbconn->conn->msg_ctx,
crap_samlogon_send_req,
crap_samlogon_recv_req,
state);
state->ctx = wb_domain_request_send(state, service,
service->primary_sid,
crap_samlogon_send_req,
crap_samlogon_recv_req,
state);
if (state->ctx == NULL) goto failed;
state->ctx->private_data = state;
return state->ctx;
@ -101,12 +99,13 @@ struct composite_context *wb_cmd_pam_auth_crap_send(struct wbsrv_call *call,
return NULL;
}
static struct composite_context *crap_samlogon_send_req(void *p)
static struct composite_context *crap_samlogon_send_req(struct wbsrv_domain *domain,
void *p)
{
struct pam_auth_crap_state *state =
talloc_get_type(p, struct pam_auth_crap_state);
state->creds_state = cli_credentials_get_netlogon_creds(
state->domain->schannel_creds);
state->creds_state =
cli_credentials_get_netlogon_creds(domain->schannel_creds);
creds_client_authenticator(state->creds_state, &state->auth);
@ -127,12 +126,11 @@ static struct composite_context *crap_samlogon_send_req(void *p)
state->ninfo.lm.data = state->lm_resp.data;
state->r.in.server_name = talloc_asprintf(
state, "\\\\%s",
dcerpc_server_name(state->domain->netlogon_pipe));
state, "\\\\%s", dcerpc_server_name(domain->netlogon_pipe));
if (state->r.in.server_name == NULL) return NULL;
state->r.in.workstation = cli_credentials_get_workstation(
state->domain->schannel_creds);
state->r.in.workstation =
cli_credentials_get_workstation(domain->schannel_creds);
state->r.in.credential = &state->auth;
state->r.in.return_authenticator = &state->auth2;
state->r.in.logon_level = 2;
@ -140,7 +138,7 @@ static struct composite_context *crap_samlogon_send_req(void *p)
state->r.in.logon.network = &state->ninfo;
state->r.out.return_authenticator = NULL;
return composite_netr_LogonSamLogon_send(state->domain->netlogon_pipe,
return composite_netr_LogonSamLogon_send(domain->netlogon_pipe,
state, &state->r);
}

165
source4/winbind/wb_samba3_cmd.c
View File

@ -128,10 +128,12 @@ static void getdcname_recv_dc(struct composite_context *ctx);
NTSTATUS wbsrv_samba3_getdcname(struct wbsrv_samba3_call *s3call)
{
struct composite_context *ctx;
struct wbsrv_service *service =
s3call->call->wbconn->listen_socket->service;
DEBUG(5, ("wbsrv_samba3_getdcname called\n"));
ctx = wb_cmd_getdcname_send(s3call->call,
ctx = wb_cmd_getdcname_send(service, service->domains,
s3call->request.domain_name);
NT_STATUS_HAVE_NO_MEMORY(ctx);
@ -190,7 +192,9 @@ NTSTATUS wbsrv_samba3_userdomgroups(struct wbsrv_samba3_call *s3call)
return NT_STATUS_NO_MEMORY;
}
ctx = wb_cmd_userdomgroups_send(s3call->call, sid);
;
ctx = wb_cmd_userdomgroups_send(
s3call->call->wbconn->listen_socket->service, sid);
NT_STATUS_HAVE_NO_MEMORY(ctx);
ctx->async.fn = userdomgroups_recv_groups;
@ -252,15 +256,106 @@ static void userdomgroups_recv_groups(struct composite_context *ctx)
}
}
static void usersids_recv_sids(struct composite_context *ctx);
NTSTATUS wbsrv_samba3_usersids(struct wbsrv_samba3_call *s3call)
{
struct composite_context *ctx;
struct dom_sid *sid;
DEBUG(5, ("wbsrv_samba3_usersids called\n"));
sid = dom_sid_parse_talloc(s3call, s3call->request.data.sid);
if (sid == NULL) {
DEBUG(5, ("Could not parse sid %s\n",
s3call->request.data.sid));
return NT_STATUS_NO_MEMORY;
}
ctx = wb_cmd_usersids_send(
s3call->call->wbconn->listen_socket->service, sid);
NT_STATUS_HAVE_NO_MEMORY(ctx);
ctx->async.fn = usersids_recv_sids;
ctx->async.private_data = s3call;
s3call->call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC;
return NT_STATUS_OK;
}
static void usersids_recv_sids(struct composite_context *ctx)
{
struct wbsrv_samba3_call *s3call =
talloc_get_type(ctx->async.private_data,
struct wbsrv_samba3_call);
int i, num_sids;
struct dom_sid **sids;
char *sids_string;
NTSTATUS status;
status = wb_cmd_usersids_recv(ctx, s3call, &num_sids, &sids);
if (!NT_STATUS_IS_OK(status)) goto done;
sids_string = talloc_strdup(s3call, "");
if (sids_string == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;
}
for (i=0; i<num_sids; i++) {
sids_string = talloc_asprintf_append(
sids_string, "%s\n", dom_sid_string(s3call, sids[i]));
if (sids_string == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;
}
}
s3call->response.result = WINBINDD_OK;
s3call->response.extra_data = sids_string;
s3call->response.length += strlen(sids_string);
s3call->response.data.num_entries = num_sids;
/* Hmmmm. Nasty protocol -- who invented the zeros between the
* SIDs? Hmmm. Could have been me -- vl */
while (*sids_string != '\0') {
if ((*sids_string) == '\n') {
*sids_string = '\0';
}
sids_string += 1;
}
done:
if (!NT_STATUS_IS_OK(status)) {
struct winbindd_response *resp = &s3call->response;
resp->result = WINBINDD_ERROR;
WBSRV_SAMBA3_SET_STRING(resp->data.auth.nt_status_string,
nt_errstr(status));
WBSRV_SAMBA3_SET_STRING(resp->data.auth.error_string,
nt_errstr(status));
resp->data.auth.pam_error = nt_status_to_pam(status);
}
status = wbsrv_send_reply(s3call->call);
if (!NT_STATUS_IS_OK(status)) {
wbsrv_terminate_connection(s3call->call->wbconn,
"wbsrv_queue_reply() failed");
return;
}
}
static void lookupname_recv_sid(struct composite_context *ctx);
NTSTATUS wbsrv_samba3_lookupname(struct wbsrv_samba3_call *s3call)
{
struct composite_context *ctx;
struct wbsrv_service *service =
s3call->call->wbconn->listen_socket->service;
DEBUG(5, ("wbsrv_samba3_lookupname called\n"));
ctx = wb_cmd_lookupname_send(s3call->call,
ctx = wb_cmd_lookupname_send(service, service->domains,
s3call->request.data.name.dom_name,
s3call->request.data.name.name);
NT_STATUS_HAVE_NO_MEMORY(ctx);
@ -306,6 +401,70 @@ static void lookupname_recv_sid(struct composite_context *ctx)
}
}
static void lookupsid_recv_name(struct composite_context *ctx);
NTSTATUS wbsrv_samba3_lookupsid(struct wbsrv_samba3_call *s3call)
{
struct composite_context *ctx;
struct wbsrv_service *service =
s3call->call->wbconn->listen_socket->service;
struct dom_sid *sid;
DEBUG(5, ("wbsrv_samba3_lookupsid called\n"));
sid = dom_sid_parse_talloc(s3call, s3call->request.data.sid);
if (sid == NULL) {
DEBUG(5, ("Could not parse sid %s\n",
s3call->request.data.sid));
return NT_STATUS_NO_MEMORY;
}
ctx = wb_cmd_lookupsid_send(service, service->domains, sid);
NT_STATUS_HAVE_NO_MEMORY(ctx);
/* setup the callbacks */
ctx->async.fn = lookupsid_recv_name;
ctx->async.private_data = s3call;
s3call->call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC;
return NT_STATUS_OK;
}
static void lookupsid_recv_name(struct composite_context *ctx)
{
struct wbsrv_samba3_call *s3call =
talloc_get_type(ctx->async.private_data,
struct wbsrv_samba3_call);
struct wb_sid_object *sid;
NTSTATUS status;
status = wb_cmd_lookupsid_recv(ctx, s3call, &sid);
if (!NT_STATUS_IS_OK(status)) goto done;
s3call->response.result = WINBINDD_OK;
s3call->response.data.name.type = sid->type;
WBSRV_SAMBA3_SET_STRING(s3call->response.data.name.dom_name,
sid->domain);
WBSRV_SAMBA3_SET_STRING(s3call->response.data.name.name, sid->name);
done:
if (!NT_STATUS_IS_OK(status)) {
struct winbindd_response *resp = &s3call->response;
resp->result = WINBINDD_ERROR;
WBSRV_SAMBA3_SET_STRING(resp->data.auth.nt_status_string,
nt_errstr(status));
WBSRV_SAMBA3_SET_STRING(resp->data.auth.error_string,
nt_errstr(status));
resp->data.auth.pam_error = nt_status_to_pam(status);
}
status = wbsrv_send_reply(s3call->call);
if (!NT_STATUS_IS_OK(status)) {
wbsrv_terminate_connection(s3call->call->wbconn,
"wbsrv_queue_reply() failed");
return;
}
}
NTSTATUS wbsrv_samba3_pam_auth(struct wbsrv_samba3_call *s3call)
{
s3call->response.result = WINBINDD_ERROR;

14
source4/winbind/wb_samba3_protocol.c
View File

@ -69,6 +69,8 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call)
DEBUG(10, ("Got winbind samba3 request %d\n", s3call->request.cmd));
s3call->response.length = sizeof(s3call->response);
switch(s3call->request.cmd) {
case WINBINDD_INTERFACE_VERSION:
return wbsrv_samba3_interface_version(s3call);
@ -94,6 +96,9 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call)
case WINBINDD_LOOKUPNAME:
return wbsrv_samba3_lookupname(s3call);
case WINBINDD_LOOKUPSID:
return wbsrv_samba3_lookupsid(s3call);
case WINBINDD_PAM_AUTH:
return wbsrv_samba3_pam_auth(s3call);
@ -105,6 +110,9 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call)
case WINBINDD_GETUSERDOMGROUPS:
return wbsrv_samba3_userdomgroups(s3call);
case WINBINDD_GETUSERSIDS:
return wbsrv_samba3_usersids(s3call);
}
s3call->response.result = WINBINDD_ERROR;
@ -121,17 +129,17 @@ NTSTATUS wbsrv_samba3_push_reply(struct wbsrv_call *call, TALLOC_CTX *mem_ctx, D
extra_data = s3call->response.extra_data;
if (extra_data) {
extra_data_len = strlen((char *)s3call->response.extra_data) + 1;
extra_data_len = s3call->response.length -
sizeof(s3call->response);
}
blob = data_blob_talloc(mem_ctx, NULL, sizeof(s3call->response) + extra_data_len);
blob = data_blob_talloc(mem_ctx, NULL, s3call->response.length);
NT_STATUS_HAVE_NO_MEMORY(blob.data);
/* don't push real pointer values into sockets */
if (extra_data) {
s3call->response.extra_data = (void *)0xFFFFFFFF;
}
s3call->response.length = sizeof(s3call->response) + extra_data_len;
memcpy(blob.data, &s3call->response, sizeof(s3call->response));
/* set back the pointer */
s3call->response.extra_data = extra_data;

2
source4/winbind/wb_server.c
View File

@ -312,6 +312,8 @@ static void winbind_task_init(struct task_server *task)
return;
}
service->primary_sid = talloc_reference(service, service->domains->sid);
/* setup the unprivileged samba3 socket */
listen_socket = talloc(service, struct wbsrv_listen_socket);
if (!listen_socket) goto nomem;

4
source4/winbind/wb_server.h
View File

@ -33,6 +33,7 @@
struct wbsrv_service {
struct task_server *task;
const struct dom_sid *primary_sid;
struct wbsrv_domain *domains;
};
@ -51,6 +52,7 @@ struct wbsrv_domain {
const char *name;
const struct dom_sid *sid;
const char *dcname;
struct dcerpc_pipe *lsa_pipe;
struct policy_handle *lsa_policy;
@ -65,7 +67,7 @@ struct wbsrv_domain {
struct cli_credentials *schannel_creds;
BOOL busy;
struct queue_domain_state *request_queue;
struct domain_request_state *request_queue;
};
/*

223
source4/winbind/wb_sid2domain.c Normal file
View File

@ -0,0 +1,223 @@
/*
Unix SMB/CIFS implementation.
Find and init a domain struct for a SID
Copyright (C) Volker Lendecke 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/composite/composite.h"
#include "winbind/wb_server.h"
#include "smbd/service_stream.h"
#include "smbd/service_task.h"
#include "lib/events/events.h"
#include "librpc/gen_ndr/nbt.h"
#include "librpc/gen_ndr/ndr_netlogon.h"
#include "winbind/wb_async_helpers.h"
#include "include/dlinklist.h"
static const char *sam_name(void)
{
if (lp_server_role() == ROLE_STANDALONE) {
return lp_netbios_name();
}
return lp_workgroup();
}
static struct wbsrv_domain *find_primary_domain(struct wbsrv_service *service)
{
const char *my_domain_name = sam_name();
struct wbsrv_domain *domain;
for (domain = service->domains; domain!=NULL; domain = domain->next) {
if (strcasecmp(domain->name, my_domain_name) == 0) {
break;
}
}
return domain;
}
static struct wbsrv_domain *find_domain_from_sid(struct wbsrv_service *service,
const struct dom_sid *sid)
{
struct wbsrv_domain *domain;
for (domain = service->domains; domain!=NULL; domain = domain->next) {
if (dom_sid_equal(domain->sid, sid)) {
break;
}
if (dom_sid_in_domain(domain->sid, sid)) {
break;
}
}
return domain;
}
struct sid2domain_state {
struct composite_context *ctx;
struct wbsrv_service *service;
const struct dom_sid *sid;
const char *domain_name;
const char *dc_name;
struct dom_sid *domain_sid;
struct wbsrv_domain *my_domain;
struct wbsrv_domain *result;
};
static void sid2domain_recv_name(struct composite_context *ctx);
static void sid2domain_recv_dcname(struct composite_context *ctx);
static void sid2domain_recv_init(struct composite_context *ctx);
struct composite_context *wb_sid2domain_send(struct wbsrv_service *service,
const struct dom_sid *sid)
{
struct composite_context *result, *ctx;
struct sid2domain_state *state;
result = talloc_zero(NULL, struct composite_context);
if (result == NULL) goto failed;
result->state = COMPOSITE_STATE_IN_PROGRESS;
result->async.fn = NULL;
result->event_ctx = service->task->event_ctx;
state = talloc(result, struct sid2domain_state);
if (state == NULL) goto failed;
state->ctx = result;
result->private_data = state;
state->service = service;
state->sid = dom_sid_dup(state, sid);
if (state->sid == NULL) goto failed;
state->result = find_domain_from_sid(service, sid);
if (state->result != NULL) {
result->status = NT_STATUS_OK;
composite_trigger_done(result);
return result;
}
state->my_domain = find_primary_domain(service);
if (state->my_domain == NULL) {
result->status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
composite_trigger_error(result);
return result;
}
ctx = wb_cmd_lookupsid_send(service, state->my_domain, state->sid);
if (ctx == NULL) goto failed;
ctx->async.fn = sid2domain_recv_name;
ctx->async.private_data = state;
return result;
failed:
talloc_free(result);
return NULL;
}
static void sid2domain_recv_name(struct composite_context *ctx)
{
struct sid2domain_state *state =
talloc_get_type(ctx->async.private_data,
struct sid2domain_state);
struct wb_sid_object *name;
state->ctx->status = wb_cmd_lookupsid_recv(ctx, state, &name);
if (!composite_is_ok(state->ctx)) return;
if (name->type == SID_NAME_UNKNOWN) {
composite_error(state->ctx, NT_STATUS_NO_SUCH_DOMAIN);
return;
}
state->domain_name = name->domain;
state->domain_sid = dom_sid_dup(state, state->sid);
if (name->type != SID_NAME_DOMAIN) {
state->domain_sid->num_auths -= 1;
}
ctx = wb_cmd_getdcname_send(state->service, state->my_domain,
state->domain_name);
composite_continue(state->ctx, ctx, sid2domain_recv_dcname, state);
}
static void sid2domain_recv_dcname(struct composite_context *ctx)
{
struct sid2domain_state *state =
talloc_get_type(ctx->async.private_data,
struct sid2domain_state);
state->ctx->status = wb_cmd_getdcname_recv(ctx, state,
&state->dc_name);
if (!composite_is_ok(state->ctx)) return;
state->result = talloc_zero(state, struct wbsrv_domain);
if (composite_nomem(state->result, state->ctx)) return;
state->result->name = talloc_steal(state->result, state->domain_name);
state->result->sid = talloc_steal(state->result, state->domain_sid);
state->result->dcname = talloc_steal(state->result, state->dc_name);
state->result->schannel_creds = cli_credentials_init(state->result);
if (composite_nomem(state->result->schannel_creds, state->ctx)) return;
cli_credentials_set_conf(state->result->schannel_creds);
cli_credentials_set_anonymous(state->result->schannel_creds);
talloc_steal(state->service, state->result);
DLIST_ADD(state->service->domains, state->result);
ctx = wb_init_domain_send(state->result,
state->service->task->event_ctx,
state->service->task->msg_ctx);
composite_continue(state->ctx, ctx, sid2domain_recv_init, state);
}
static void sid2domain_recv_init(struct composite_context *ctx)
{
struct sid2domain_state *state =
talloc_get_type(ctx->async.private_data,
struct sid2domain_state);
state->ctx->status = wb_init_domain_recv(state->ctx);
if (!composite_is_ok(state->ctx)) return;
composite_done(state->ctx);
}
NTSTATUS wb_sid2domain_recv(struct composite_context *ctx,
struct wbsrv_domain **result)
{
NTSTATUS status = composite_wait(ctx);
if (NT_STATUS_IS_OK(status)) {
struct sid2domain_state *state =
talloc_get_type(ctx->private_data,
struct sid2domain_state);
*result = state->result;
}
talloc_free(ctx);
return status;
}
NTSTATUS wb_sid2domain(struct wbsrv_service *service,
const struct dom_sid *sid,
struct wbsrv_domain **result)
{
struct composite_context *c = wb_sid2domain_send(service, sid);
return wb_sid2domain_recv(c, result);
}