util:datablob: data_blob_pad checks its alignment assumption
[samba.git] / source3 / winbindd / wb_lookupsids.c
blob828e79ee3c8ecb3f2209a9f34efa8103422c6643
1 /*
2 Unix SMB/CIFS implementation.
3 async lookupsids
4 Copyright (C) Volker Lendecke 2011
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "includes.h"
21 #include "winbindd.h"
22 #include "lib/util_unixsids.h"
23 #include "librpc/gen_ndr/ndr_winbind_c.h"
24 #include "../libcli/security/security.h"
25 #include "passdb/machine_sid.h"
26 #include "lsa.h"
28 struct wb_lookupsids_domain {
29 struct winbindd_domain *domain;
32 * Array of sids to be passed into wbint_LookupSids. Preallocated with
33 * num_sids.
35 struct lsa_SidArray sids;
38 * Indexes into wb_lookupsids_state->sids and thus
39 * wb_lookupsids_state->res_names. Preallocated with num_sids.
41 uint32_t *sid_indexes;
44 struct wb_translated_name {
45 const char *domain_name;
46 const char *name;
47 enum lsa_SidType type;
50 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
51 const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
52 struct wb_lookupsids_domain **domains, uint32_t num_sids);
54 struct wb_lookupsids_state {
55 struct tevent_context *ev;
58 * SIDs passed in
60 struct dom_sid *sids;
61 uint32_t num_sids;
64 * The domains we're using for bulk lookup via wbint_LookupRids or
65 * wbint_LookupSids. We expect very few domains, so we do a
66 * talloc_realloc and rely on talloc_array_length.
68 struct wb_lookupsids_domain *domains;
69 uint32_t domains_done;
72 * These SIDs are looked up individually via
73 * wbint_LookupSid. Preallocated with num_sids.
75 uint32_t *single_sids;
76 uint32_t num_single_sids;
77 uint32_t single_sids_done;
80 * Intermediate store for wbint_LookupRids to passdb. These are
81 * spliced into res_domains/res_names in wb_lookupsids_move_name.
83 struct wbint_RidArray rids;
84 const char *domain_name;
85 struct wbint_Principals rid_names;
88 * Intermediate results for wbint_LookupSids. These results are
89 * spliced into res_domains/res_names in wb_lookupsids_move_name.
91 struct lsa_RefDomainList tmp_domains;
92 struct lsa_TransNameArray tmp_names;
95 * Results
97 struct lsa_RefDomainList *res_domains;
99 * Indexed as "sids" in this structure
101 struct lsa_TransNameArray *res_names;
104 static bool wb_lookupsids_next(struct tevent_req *req,
105 struct wb_lookupsids_state *state);
106 static void wb_lookupsids_single_done(struct tevent_req *subreq);
107 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq);
108 static void wb_lookupsids_done(struct tevent_req *subreq);
110 struct tevent_req *wb_lookupsids_send(TALLOC_CTX *mem_ctx,
111 struct tevent_context *ev,
112 struct dom_sid *sids,
113 uint32_t num_sids)
115 struct tevent_req *req;
116 struct wb_lookupsids_state *state;
117 uint32_t i;
119 req = tevent_req_create(mem_ctx, &state, struct wb_lookupsids_state);
120 if (req == NULL) {
121 return NULL;
124 D_INFO("WB command lookupsids start.\nLooking up %"PRIu32" SID(s)\n",
125 num_sids);
126 if (CHECK_DEBUGLVL(DBGLVL_INFO)) {
127 for (i = 0; i < num_sids; i++) {
128 struct dom_sid_buf buf;
129 D_INFO("%"PRIu32": %s\n",
130 i, dom_sid_str_buf(&sids[i], &buf));
134 state->ev = ev;
135 state->sids = sids;
136 state->num_sids = num_sids;
138 state->single_sids = talloc_zero_array(state, uint32_t, num_sids);
139 if (tevent_req_nomem(state->single_sids, req)) {
140 return tevent_req_post(req, ev);
143 state->res_domains = talloc_zero(state, struct lsa_RefDomainList);
144 if (tevent_req_nomem(state->res_domains, req)) {
145 return tevent_req_post(req, ev);
147 state->res_domains->domains = talloc_zero_array(
148 state->res_domains, struct lsa_DomainInfo, num_sids);
149 if (tevent_req_nomem(state->res_domains->domains, req)) {
150 return tevent_req_post(req, ev);
153 state->res_names = talloc_zero(state, struct lsa_TransNameArray);
154 if (tevent_req_nomem(state->res_names, req)) {
155 return tevent_req_post(req, ev);
157 state->res_names->names = talloc_zero_array(
158 state->res_names, struct lsa_TranslatedName, num_sids);
159 if (tevent_req_nomem(state->res_names->names, req)) {
160 return tevent_req_post(req, ev);
163 if (num_sids == 0) {
164 tevent_req_done(req);
165 return tevent_req_post(req, ev);
168 for (i=0; i<num_sids; i++) {
169 struct wb_lookupsids_domain *d;
171 d = wb_lookupsids_get_domain(&sids[i], state, &state->domains,
172 num_sids);
173 if (d != NULL) {
174 d->sids.sids[d->sids.num_sids].sid = &sids[i];
175 d->sid_indexes[d->sids.num_sids] = i;
176 d->sids.num_sids += 1;
177 } else {
178 state->single_sids[state->num_single_sids] = i;
179 state->num_single_sids += 1;
183 if (!wb_lookupsids_next(req, state)) {
184 return tevent_req_post(req, ev);
186 return req;
189 static bool wb_lookupsids_next(struct tevent_req *req,
190 struct wb_lookupsids_state *state)
192 struct tevent_req *subreq;
194 if (state->domains_done < talloc_array_length(state->domains)) {
195 struct wb_lookupsids_domain *d;
196 uint32_t i;
198 d = &state->domains[state->domains_done];
200 if (d->domain->internal) {
202 * This is only our local SAM,
203 * see wb_lookupsids_bulk() and
204 * wb_lookupsids_get_domain().
206 state->rids.num_rids = d->sids.num_sids;
207 state->rids.rids = talloc_array(state, uint32_t,
208 state->rids.num_rids);
209 if (tevent_req_nomem(state->rids.rids, req)) {
210 return false;
212 for (i=0; i<state->rids.num_rids; i++) {
213 sid_peek_rid(d->sids.sids[i].sid,
214 &state->rids.rids[i]);
216 subreq = dcerpc_wbint_LookupRids_send(
217 state, state->ev, dom_child_handle(d->domain),
218 &d->domain->sid, &state->rids, &state->domain_name,
219 &state->rid_names);
220 if (tevent_req_nomem(subreq, req)) {
221 return false;
223 tevent_req_set_callback(
224 subreq, wb_lookupsids_lookuprids_done, req);
225 return true;
228 subreq = dcerpc_wbint_LookupSids_send(
229 state, state->ev, dom_child_handle(d->domain),
230 &d->sids, &state->tmp_domains, &state->tmp_names);
231 if (tevent_req_nomem(subreq, req)) {
232 return false;
234 tevent_req_set_callback(subreq, wb_lookupsids_done, req);
235 return true;
238 if (state->single_sids_done < state->num_single_sids) {
239 uint32_t sid_idx;
240 const struct dom_sid *sid;
242 sid_idx = state->single_sids[state->single_sids_done];
243 sid = &state->sids[sid_idx];
245 subreq = wb_lookupsid_send(state, state->ev, sid);
246 if (tevent_req_nomem(subreq, req)) {
247 return false;
249 tevent_req_set_callback(subreq, wb_lookupsids_single_done,
250 req);
251 return true;
254 tevent_req_done(req);
255 return false;
259 * Decide whether to do bulk lookupsids. We have optimizations for
260 * passdb via lookuprids and to remote DCs via lookupsids.
263 static bool wb_lookupsids_bulk(const struct dom_sid *sid)
265 struct dom_sid_buf sidbuf;
267 if (sid->num_auths != 5) {
269 * Only do "S-1-5-21-x-y-z-rid" domains via bulk
270 * lookup
272 DBG_DEBUG("No bulk setup for SID %s with %"PRIi8" subauths\n",
273 dom_sid_str_buf(sid, &sidbuf),
274 sid->num_auths);
275 return false;
278 if (sid_check_is_in_our_sam(sid)) {
280 * Passdb lookup via lookuprids
282 DBG_DEBUG("%s is in our domain\n",
283 dom_sid_str_buf(sid, &sidbuf));
284 return true;
287 if (IS_DC) {
289 * Bulk lookups to trusted DCs
291 return (find_domain_from_sid_noinit(sid) != NULL);
294 if (lp_server_role() != ROLE_DOMAIN_MEMBER) {
296 * Don't do bulk lookups as standalone, the only bulk
297 * lookup left is for domain members.
299 return false;
302 if (sid_check_is_in_unix_groups(sid) ||
303 sid_check_is_unix_groups(sid) ||
304 sid_check_is_in_unix_users(sid) ||
305 sid_check_is_unix_users(sid) ||
306 sid_check_is_in_builtin(sid) ||
307 sid_check_is_builtin(sid) ||
308 sid_check_is_wellknown_domain(sid, NULL) ||
309 sid_check_is_in_wellknown_domain(sid))
312 * These are locally done piece by piece anyway, no
313 * need for bulk optimizations.
315 return false;
319 * All other SIDs are sent to the DC we're connected to as
320 * member via a single lsa_lookupsids call.
322 return true;
325 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
326 const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
327 struct wb_lookupsids_domain **pdomains, uint32_t num_sids)
329 struct wb_lookupsids_domain *domains, *domain;
330 struct winbindd_domain *wb_domain;
331 uint32_t i, num_domains;
333 if (!wb_lookupsids_bulk(sid)) {
334 D_DEBUG("wb_lookupsids_bulk() is FALSE\n");
335 return NULL;
337 D_DEBUG("wb_lookupsids_bulk() is TRUE\n");
339 domains = *pdomains;
340 num_domains = talloc_array_length(domains);
342 wb_domain = find_lookup_domain_from_sid(sid);
343 if (wb_domain == NULL) {
344 return NULL;
347 D_DEBUG("Searching %"PRIu32" domain(s) for domain '%s'\n",
348 num_domains, wb_domain->name);
349 for (i=0; i<num_domains; i++) {
350 if (domains[i].domain != wb_domain) {
351 continue;
354 if (!domains[i].domain->internal) {
356 * If it's not our local sam,
357 * we can re-use the domain without
358 * checking the sid.
360 * Note the wb_lookupsids_bulk() above
361 * already caught special SIDs,
362 * e.g. the unix and builtin domains.
364 return &domains[i];
367 if (dom_sid_compare_domain(sid, &domains[i].domain->sid) == 0) {
369 * If it's out local sam we can also use it.
371 return &domains[i];
375 * I'm not sure if this can be triggered,
376 * as wb_lookupsids_bulk() should also catch this,
377 * but we need to make sure that we don't use
378 * wbint_LookupRids() without a SID match.
380 return NULL;
383 domains = talloc_realloc(
384 mem_ctx, domains, struct wb_lookupsids_domain, num_domains+1);
385 if (domains == NULL) {
386 return NULL;
388 *pdomains = domains;
390 domain = &domains[num_domains];
391 domain->domain = wb_domain;
393 domain->sids.sids = talloc_zero_array(domains, struct lsa_SidPtr, num_sids);
394 if (domains->sids.sids == NULL) {
395 goto fail;
397 domain->sids.num_sids = 0;
399 domain->sid_indexes = talloc_zero_array(domains, uint32_t, num_sids);
400 if (domain->sid_indexes == NULL) {
401 TALLOC_FREE(domain->sids.sids);
402 goto fail;
404 return domain;
406 fail:
408 * Realloc to the state it was in before
410 *pdomains = talloc_realloc(
411 mem_ctx, domains, struct wb_lookupsids_domain, num_domains);
412 return NULL;
415 static bool wb_lookupsids_find_dom_idx(struct lsa_DomainInfo *domain,
416 struct lsa_RefDomainList *list,
417 uint32_t *idx)
419 uint32_t i;
420 struct lsa_DomainInfo *new_domain;
422 for (i=0; i<list->count; i++) {
423 if (dom_sid_equal(domain->sid, list->domains[i].sid)) {
424 *idx = i;
425 return true;
429 new_domain = &list->domains[list->count];
431 new_domain->name.string = talloc_strdup(
432 list->domains, domain->name.string);
433 if (new_domain->name.string == NULL) {
434 return false;
437 new_domain->sid = dom_sid_dup(list->domains, domain->sid);
438 if (new_domain->sid == NULL) {
439 return false;
442 *idx = list->count;
443 list->count += 1;
444 return true;
447 static bool wb_lookupsids_move_name(struct lsa_RefDomainList *src_domains,
448 struct lsa_TranslatedName *src_name,
449 struct lsa_RefDomainList *dst_domains,
450 struct lsa_TransNameArray *dst_names,
451 uint32_t dst_name_index)
453 struct lsa_TranslatedName *dst_name;
454 struct lsa_DomainInfo *src_domain;
455 uint32_t src_domain_index;
456 uint32_t dst_domain_index = UINT32_MAX;
457 bool ok;
459 src_domain_index = src_name->sid_index;
460 if ((src_domain_index != UINT32_MAX) && (src_domains != NULL)) {
461 if (src_domain_index >= src_domains->count) {
462 return false;
464 src_domain = &src_domains->domains[src_domain_index];
466 ok = wb_lookupsids_find_dom_idx(src_domain,
467 dst_domains,
468 &dst_domain_index);
469 if (!ok) {
470 return false;
474 dst_name = &dst_names->names[dst_name_index];
476 dst_name->sid_type = src_name->sid_type;
477 dst_name->name.string = talloc_move(dst_names->names,
478 &src_name->name.string);
479 dst_name->sid_index = dst_domain_index;
480 dst_names->count += 1;
482 return true;
485 static void wb_lookupsids_done(struct tevent_req *subreq)
487 struct tevent_req *req = tevent_req_callback_data(
488 subreq, struct tevent_req);
489 struct wb_lookupsids_state *state = tevent_req_data(
490 req, struct wb_lookupsids_state);
491 struct wb_lookupsids_domain *d;
492 uint32_t i;
494 NTSTATUS status, result;
496 status = dcerpc_wbint_LookupSids_recv(subreq, state, &result);
497 TALLOC_FREE(subreq);
498 if (tevent_req_nterror(req, status)) {
499 return;
501 if (NT_STATUS_LOOKUP_ERR(result)) {
502 tevent_req_nterror(req, result);
503 return;
507 * Look at the individual states in the translated names.
510 d = &state->domains[state->domains_done];
512 for (i=0; i<state->tmp_names.count; i++) {
513 uint32_t res_sid_index = d->sid_indexes[i];
515 if (!wb_lookupsids_move_name(
516 &state->tmp_domains, &state->tmp_names.names[i],
517 state->res_domains, state->res_names,
518 res_sid_index)) {
519 tevent_req_oom(req);
520 return;
523 state->domains_done += 1;
524 wb_lookupsids_next(req, state);
527 static void wb_lookupsids_single_done(struct tevent_req *subreq)
529 struct tevent_req *req = tevent_req_callback_data(
530 subreq, struct tevent_req);
531 struct wb_lookupsids_state *state = tevent_req_data(
532 req, struct wb_lookupsids_state);
533 const char *domain_name = NULL;
534 const char *name = NULL;
535 enum lsa_SidType type = SID_NAME_UNKNOWN;
536 uint32_t res_sid_index;
537 uint32_t src_rid;
539 struct dom_sid src_domain_sid;
540 struct lsa_DomainInfo src_domain;
541 struct lsa_RefDomainList src_domains;
542 struct lsa_RefDomainList *psrc_domains = NULL;
543 struct lsa_TranslatedName src_name;
545 uint32_t domain_idx = UINT32_MAX;
546 NTSTATUS status;
547 bool ok;
549 status = wb_lookupsid_recv(subreq, talloc_tos(), &type,
550 &domain_name, &name);
551 TALLOC_FREE(subreq);
552 if (NT_STATUS_LOOKUP_ERR(status)) {
553 tevent_req_nterror(req, status);
554 return;
557 res_sid_index = state->single_sids[state->single_sids_done];
559 if ((domain_name != NULL) && (domain_name[0] != '\0')) {
561 * Build structs with the domain name for
562 * wb_lookupsids_move_name(). If we didn't get a name, we will
563 * pass NULL and UINT32_MAX.
566 sid_copy(&src_domain_sid, &state->sids[res_sid_index]);
567 if (type != SID_NAME_DOMAIN) {
568 sid_split_rid(&src_domain_sid, &src_rid);
571 src_domain.name.string = domain_name;
572 src_domain.sid = &src_domain_sid;
574 src_domains.count = 1;
575 src_domains.domains = &src_domain;
576 psrc_domains = &src_domains;
578 domain_idx = 0;
581 src_name.sid_type = type;
582 src_name.name.string = name;
583 src_name.sid_index = domain_idx;
585 ok = wb_lookupsids_move_name(psrc_domains,
586 &src_name,
587 state->res_domains,
588 state->res_names,
589 res_sid_index);
590 if (!ok) {
591 tevent_req_oom(req);
592 return;
594 state->single_sids_done += 1;
595 wb_lookupsids_next(req, state);
598 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq)
600 struct tevent_req *req = tevent_req_callback_data(
601 subreq, struct tevent_req);
602 struct wb_lookupsids_state *state = tevent_req_data(
603 req, struct wb_lookupsids_state);
604 struct dom_sid src_domain_sid;
605 struct lsa_DomainInfo src_domain;
606 struct lsa_RefDomainList src_domains;
607 NTSTATUS status, result;
608 struct wb_lookupsids_domain *d;
609 uint32_t i;
611 status = dcerpc_wbint_LookupRids_recv(subreq, state, &result);
612 TALLOC_FREE(subreq);
613 if (tevent_req_nterror(req, status)) {
614 return;
616 if (NT_STATUS_LOOKUP_ERR(result)) {
617 tevent_req_nterror(req, result);
618 return;
622 * Look at the individual states in the translated names.
625 d = &state->domains[state->domains_done];
627 sid_copy(&src_domain_sid, get_global_sam_sid());
628 src_domain.name.string = get_global_sam_name();
629 src_domain.sid = &src_domain_sid;
630 src_domains.count = 1;
631 src_domains.domains = &src_domain;
633 for (i=0; i<state->rid_names.num_principals; i++) {
634 struct lsa_TranslatedName src_name;
635 uint32_t res_sid_index;
638 * Fake up structs for wb_lookupsids_move_name
640 res_sid_index = d->sid_indexes[i];
642 src_name.sid_type = state->rid_names.principals[i].type;
643 src_name.name.string = state->rid_names.principals[i].name;
644 src_name.sid_index = 0;
646 if (!wb_lookupsids_move_name(
647 &src_domains, &src_name,
648 state->res_domains, state->res_names,
649 res_sid_index)) {
650 tevent_req_oom(req);
651 return;
655 state->domains_done += 1;
656 wb_lookupsids_next(req, state);
659 NTSTATUS wb_lookupsids_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
660 struct lsa_RefDomainList **domains,
661 struct lsa_TransNameArray **names)
663 struct wb_lookupsids_state *state = tevent_req_data(
664 req, struct wb_lookupsids_state);
665 NTSTATUS status;
667 D_INFO("WB command lookupsids end.\n");
668 if (tevent_req_is_nterror(req, &status)) {
669 D_WARNING("Failed with %s.\n", nt_errstr(status));
670 return status;
674 * The returned names need to match the given sids,
675 * if not we have a bug in the code!
677 if (state->res_names->count != state->num_sids) {
678 D_WARNING("Got %"PRIu32" returned name(s), but expected %"PRIu32"!\n",
679 state->res_names->count, state->num_sids);
680 return NT_STATUS_INTERNAL_ERROR;
684 * Not strictly needed, but it might make debugging in the callers
685 * easier in future, if the talloc_array_length() returns the
686 * expected result...
688 state->res_domains->domains = talloc_realloc(state->res_domains,
689 state->res_domains->domains,
690 struct lsa_DomainInfo,
691 state->res_domains->count);
693 *domains = talloc_move(mem_ctx, &state->res_domains);
694 *names = talloc_move(mem_ctx, &state->res_names);
695 D_INFO("Returning %"PRIu32" domain(s) and %"PRIu32" name(s).\n",
696 (*domains)->count,
697 (*names)->count);
698 return NT_STATUS_OK;