source3/winbindd/winbindd_reconnect_ads.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Wrapper around winbindd_ads.c to centralize retry logic.
   5    Copyright (C) Christof Schmitt 2016
   6
   7    Based on winbindd_reconnect.c
   8    Copyright (C) Volker Lendecke 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26
  27 #ifdef HAVE_ADS
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_WINBIND
  31
  32 extern struct winbindd_methods ads_methods;
  33
  34 static bool ldap_reconnect_need_retry(NTSTATUS status,
  35                                       struct winbindd_domain *domain)
  36 {
  37         if (NT_STATUS_IS_OK(status)) {
  38                 return false;
  39         }
  40
  41         if (!NT_STATUS_IS_ERR(status)) {
  42                 return false;
  43         }
  44
  45         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
  46                 return false;
  47         }
  48
  49         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
  50                 return false;
  51         }
  52
  53         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_GROUP)) {
  54                 return false;
  55         }
  56
  57         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_ALIAS)) {
  58                 return false;
  59         }
  60
  61         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_MEMBER)) {
  62                 return false;
  63         }
  64
  65         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_DOMAIN)) {
  66                 return false;
  67         }
  68
  69         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_PRIVILEGE)) {
  70                 return false;
  71         }
  72
  73         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY)) {
  74                 return false;
  75         }
  76
  77         return true;
  78 }
  79
  80 /* List all users */
  81 static NTSTATUS query_user_list(struct winbindd_domain *domain,
  82                                 TALLOC_CTX *mem_ctx,
  83                                 uint32_t **rids)
  84 {
  85         NTSTATUS result;
  86
  87         result = ads_methods.query_user_list(domain, mem_ctx, rids);
  88
  89         if (ldap_reconnect_need_retry(result, domain)) {
  90                 result = ads_methods.query_user_list(domain, mem_ctx, rids);
  91         }
  92
  93         return result;
  94 }
  95
  96 /* list all domain groups */
  97 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
  98                                 TALLOC_CTX *mem_ctx,
  99                                 uint32_t *num_entries,
 100                                 struct wb_acct_info **info)
 101 {
 102         NTSTATUS result;
 103
 104         result = ads_methods.enum_dom_groups(domain, mem_ctx,
 105                                              num_entries, info);
 106
 107         if (ldap_reconnect_need_retry(result, domain)) {
 108                 result = ads_methods.enum_dom_groups(domain, mem_ctx,
 109                                                      num_entries, info);
 110         }
 111
 112         return result;
 113 }
 114
 115 /* List all domain groups */
 116 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
 117                                   TALLOC_CTX *mem_ctx,
 118                                   uint32_t *num_entries,
 119                                   struct wb_acct_info **info)
 120 {
 121         NTSTATUS result;
 122
 123         result = ads_methods.enum_local_groups(domain, mem_ctx,
 124                                                num_entries, info);
 125
 126         if (ldap_reconnect_need_retry(result, domain)) {
 127                 result = ads_methods.enum_local_groups(domain, mem_ctx,
 128                                                        num_entries, info);
 129         }
 130
 131         return result;
 132 }
 133
 134 /* convert a single name to a sid in a domain */
 135 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
 136                             TALLOC_CTX *mem_ctx,
 137                             const char *domain_name,
 138                             const char *name,
 139                             uint32_t flags,
 140                             const char **pdom_name,
 141                             struct dom_sid *sid,
 142                             enum lsa_SidType *type)
 143 {
 144         NTSTATUS result;
 145
 146         result = ads_methods.name_to_sid(domain, mem_ctx, domain_name, name,
 147                                          flags, pdom_name, sid, type);
 148
 149         if (reconnect_need_retry(result, domain)) {
 150                 result = ads_methods.name_to_sid(domain, mem_ctx,
 151                                                  domain_name, name, flags,
 152                                                  pdom_name, sid, type);
 153         }
 154
 155         return result;
 156 }
 157
 158 /*
 159   convert a domain SID to a user or group name
 160 */
 161 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 162                             TALLOC_CTX *mem_ctx,
 163                             const struct dom_sid *sid,
 164                             char **domain_name,
 165                             char **name,
 166                             enum lsa_SidType *type)
 167 {
 168         NTSTATUS result;
 169
 170         result = ads_methods.sid_to_name(domain, mem_ctx, sid,
 171                                          domain_name, name, type);
 172
 173         if (reconnect_need_retry(result, domain))
 174                 result = ads_methods.sid_to_name(domain, mem_ctx, sid,
 175                                                  domain_name, name, type);
 176
 177         return result;
 178 }
 179
 180 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
 181                               TALLOC_CTX *mem_ctx,
 182                               const struct dom_sid *sid,
 183                               uint32_t *rids,
 184                               size_t num_rids,
 185                               char **domain_name,
 186                               char ***names,
 187                               enum lsa_SidType **types)
 188 {
 189         NTSTATUS result;
 190
 191         result = ads_methods.rids_to_names(domain, mem_ctx, sid,
 192                                            rids, num_rids,
 193                                            domain_name, names, types);
 194         if (reconnect_need_retry(result, domain)) {
 195                 result = ads_methods.rids_to_names(domain, mem_ctx, sid,
 196                                                    rids, num_rids, domain_name,
 197                                                    names, types);
 198         }
 199
 200         return result;
 201 }
 202
 203 /* Lookup groups a user is a member of.  I wish Unix had a call like this! */
 204 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 205                                   TALLOC_CTX *mem_ctx,
 206                                   const struct dom_sid *user_sid,
 207                                   uint32_t *num_groups,
 208                                   struct dom_sid **user_gids)
 209 {
 210         NTSTATUS result;
 211
 212         result = ads_methods.lookup_usergroups(domain, mem_ctx, user_sid,
 213                                                num_groups, user_gids);
 214
 215         if (ldap_reconnect_need_retry(result, domain)) {
 216                 result = ads_methods.lookup_usergroups(domain, mem_ctx,
 217                                                        user_sid, num_groups,
 218                                                        user_gids);
 219         }
 220
 221         return result;
 222 }
 223
 224 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
 225                                    TALLOC_CTX *mem_ctx,
 226                                    uint32_t num_sids,
 227                                    const struct dom_sid *sids,
 228                                    uint32_t *num_aliases, uint32_t **alias_rids)
 229 {
 230         NTSTATUS result;
 231
 232         result = ads_methods.lookup_useraliases(domain, mem_ctx, num_sids, sids,
 233                                                 num_aliases, alias_rids);
 234
 235         if (reconnect_need_retry(result, domain)) {
 236                 result = ads_methods.lookup_useraliases(domain, mem_ctx,
 237                                                         num_sids, sids,
 238                                                         num_aliases,
 239                                                         alias_rids);
 240         }
 241
 242         return result;
 243 }
 244
 245 /* Lookup group membership given a rid.   */
 246 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 247                                 TALLOC_CTX *mem_ctx,
 248                                 const struct dom_sid *group_sid,
 249                                 enum lsa_SidType type,
 250                                 uint32_t *num_names,
 251                                 struct dom_sid **sid_mem, char ***names,
 252                                 uint32_t **name_types)
 253 {
 254         NTSTATUS result;
 255
 256         result = ads_methods.lookup_groupmem(domain, mem_ctx, group_sid, type,
 257                                              num_names, sid_mem, names,
 258                                              name_types);
 259
 260         if (ldap_reconnect_need_retry(result, domain)) {
 261                 result = ads_methods.lookup_groupmem(domain, mem_ctx, group_sid,
 262                                                      type, num_names, sid_mem,
 263                                                      names, name_types);
 264         }
 265
 266         return result;
 267 }
 268
 269 static NTSTATUS lookup_aliasmem(struct winbindd_domain *domain,
 270                                 TALLOC_CTX *mem_ctx,
 271                                 const struct dom_sid *group_sid,
 272                                 enum lsa_SidType type,
 273                                 uint32_t *num_names,
 274                                 struct dom_sid **sid_mem)
 275 {
 276         NTSTATUS result = NT_STATUS_OK;
 277
 278         result = ads_methods.lookup_aliasmem(domain,
 279                                              mem_ctx,
 280                                              group_sid,
 281                                              type,
 282                                              num_names,
 283                                              sid_mem);
 284
 285         if (ldap_reconnect_need_retry(result, domain)) {
 286                 result = ads_methods.lookup_aliasmem(domain,
 287                                                      mem_ctx,
 288                                                      group_sid,
 289                                                      type,
 290                                                      num_names,
 291                                                      sid_mem);
 292         }
 293         return result;
 294 }
 295
 296 /* find the lockout policy of a domain */
 297 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
 298                                TALLOC_CTX *mem_ctx,
 299                                struct samr_DomInfo12 *policy)
 300 {
 301         NTSTATUS result;
 302
 303         result = ads_methods.lockout_policy(domain, mem_ctx, policy);
 304
 305         if (reconnect_need_retry(result, domain)) {
 306                 result = ads_methods.lockout_policy(domain, mem_ctx, policy);
 307         }
 308
 309         return result;
 310 }
 311
 312 /* find the password policy of a domain */
 313 static NTSTATUS password_policy(struct winbindd_domain *domain,
 314                                 TALLOC_CTX *mem_ctx,
 315                                 struct samr_DomInfo1 *policy)
 316 {
 317         NTSTATUS result;
 318
 319         result = ads_methods.password_policy(domain, mem_ctx, policy);
 320
 321         if (reconnect_need_retry(result, domain)) {
 322                 result = ads_methods.password_policy(domain, mem_ctx, policy);
 323         }
 324
 325         return result;
 326 }
 327
 328 /* get a list of trusted domains */
 329 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
 330                                 TALLOC_CTX *mem_ctx,
 331                                 struct netr_DomainTrustList *trusts)
 332 {
 333         NTSTATUS result;
 334
 335         result = ads_methods.trusted_domains(domain, mem_ctx, trusts);
 336
 337         if (reconnect_need_retry(result, domain)) {
 338                 result = ads_methods.trusted_domains(domain, mem_ctx, trusts);
 339         }
 340
 341         return result;
 342 }
 343
 344 /* the rpc backend methods are exposed via this structure */
 345 struct winbindd_methods reconnect_ads_methods = {
 346         .consistent             = true,
 347
 348         .query_user_list        = query_user_list,
 349         .enum_dom_groups        = enum_dom_groups,
 350         .enum_local_groups      = enum_local_groups,
 351         .name_to_sid            = name_to_sid,
 352         .sid_to_name            = sid_to_name,
 353         .rids_to_names          = rids_to_names,
 354         .lookup_usergroups      = lookup_usergroups,
 355         .lookup_useraliases     = lookup_useraliases,
 356         .lookup_groupmem        = lookup_groupmem,
 357         .lookup_aliasmem        = lookup_aliasmem,
 358         .lockout_policy         = lockout_policy,
 359         .password_policy        = password_policy,
 360         .trusted_domains        = trusted_domains,
 361 };
 362
 363 #endif