source/nsswitch/libwbclient/wbc_sid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind client API
   5
   6    Copyright (C) Gerald (Jerry) Carter 2007
   7
   8
   9    This library is free software; you can redistribute it and/or
  10    modify it under the terms of the GNU Lesser General Public
  11    License as published by the Free Software Foundation; either
  12    version 3 of the License, or (at your option) any later version.
  13
  14    This library is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17    Library General Public License for more details.
  18
  19    You should have received a copy of the GNU Lesser General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 /* Required Headers */
  24
  25 #include "libwbclient.h"
  26
  27
  28 /** @brief Convert a binary SID to a character string
  29  *
  30  * @param sid           Binary Security Identifier
  31  * @param **sid_string  Resulting character string
  32  *
  33  * @return #wbcErr
  34  **/
  35
  36 wbcErr wbcSidToString(const struct wbcDomainSid *sid,
  37                       char **sid_string)
  38 {
  39         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
  40         uint32_t id_auth;
  41         int i;
  42         char *tmp = NULL;
  43         TALLOC_CTX *ctx = NULL;
  44
  45         if (!sid) {
  46                 wbc_status = WBC_ERR_INVALID_SID;
  47                 BAIL_ON_WBC_ERROR(wbc_status);
  48         }
  49
  50         ctx = talloc_init("wbcSidToString");
  51         BAIL_ON_PTR_ERROR(ctx, wbc_status);
  52
  53         id_auth = sid->id_auth[5] +
  54                 (sid->id_auth[4] << 8) +
  55                 (sid->id_auth[3] << 16) +
  56                 (sid->id_auth[2] << 24);
  57
  58         tmp = talloc_asprintf(ctx, "S-%d-%d", sid->sid_rev_num, id_auth);
  59         BAIL_ON_PTR_ERROR(tmp, wbc_status);
  60
  61         for (i=0; i<sid->num_auths; i++) {
  62                 char *tmp2;
  63                 tmp2 = talloc_asprintf_append(tmp, "-%u", sid->sub_auths[i]);
  64                 BAIL_ON_PTR_ERROR(tmp2, wbc_status);
  65
  66                 tmp = tmp2;
  67         }
  68
  69         *sid_string=talloc_strdup(NULL, tmp);
  70         BAIL_ON_PTR_ERROR((*sid_string), wbc_status);
  71
  72         wbc_status = WBC_ERR_SUCCESS;
  73
  74 done:
  75         talloc_free(ctx);
  76
  77         return wbc_status;
  78 }
  79
  80 /** @brief Convert a character string to a binary SID
  81  *
  82  * @param *str          Character string in the form of S-...
  83  * @param sid           Resulting binary SID
  84  *
  85  * @return #wbcErr
  86  **/
  87
  88 wbcErr wbcStringToSid(const char *str,
  89                       struct wbcDomainSid *sid)
  90 {
  91         const char *p;
  92         char *q;
  93         uint32_t x;
  94         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
  95
  96         if (!sid) {
  97                 wbc_status = WBC_ERR_INVALID_PARAM;
  98                 BAIL_ON_WBC_ERROR(wbc_status);
  99         }
 100
 101         /* Sanity check for either "S-" or "s-" */
 102
 103         if (!str
 104             || (str[0]!='S' && str[0]!='s')
 105             || (str[1]!='-')
 106             || (strlen(str)<2))
 107         {
 108                 wbc_status = WBC_ERR_INVALID_PARAM;
 109                 BAIL_ON_WBC_ERROR(wbc_status);
 110         }
 111
 112         /* Get the SID revision number */
 113
 114         p = str+2;
 115         x = (uint32_t)strtol(p, &q, 10);
 116         if (x==0 || !q || *q!='-') {
 117                 wbc_status = WBC_ERR_INVALID_SID;
 118                 BAIL_ON_WBC_ERROR(wbc_status);
 119         }
 120         sid->sid_rev_num = (uint8_t)x;
 121
 122         /* Next the Identifier Authority.  This is stored in big-endian
 123            in a 6 byte array. */
 124
 125         p = q+1;
 126         x = (uint32_t)strtol(p, &q, 10);
 127         if (x==0 || !q || *q!='-') {
 128                 wbc_status = WBC_ERR_INVALID_SID;
 129                 BAIL_ON_WBC_ERROR(wbc_status);
 130         }
 131         sid->id_auth[5] = (x & 0x000000ff);
 132         sid->id_auth[4] = (x & 0x0000ff00) >> 8;
 133         sid->id_auth[3] = (x & 0x00ff0000) >> 16;
 134         sid->id_auth[2] = (x & 0xff000000) >> 24;
 135         sid->id_auth[1] = 0;
 136         sid->id_auth[0] = 0;
 137
 138         /* now read the the subauthorities */
 139
 140         p = q +1;
 141         sid->num_auths = 0;
 142         while (sid->num_auths < WBC_MAXSUBAUTHS) {
 143                 if ((x=(uint32_t)strtoul(p, &q, 10)) == 0)
 144                         break;
 145                 sid->sub_auths[sid->num_auths++] = x;
 146
 147                 if (q && ((*q!='-') || (*q=='\0')))
 148                         break;
 149                 p = q + 1;
 150         }
 151
 152         /* IF we ended early, then the SID could not be converted */
 153
 154         if (q && *q!='\0') {
 155                 wbc_status = WBC_ERR_INVALID_SID;
 156                 BAIL_ON_WBC_ERROR(wbc_status);
 157         }
 158
 159         wbc_status = WBC_ERR_SUCCESS;
 160
 161 done:
 162         return wbc_status;
 163
 164 }
 165
 166 /** @brief Convert a domain and name to SID
 167  *
 168  * @param domain      Domain name (possibly "")
 169  * @param name        User or group name
 170  * @param *sid        Pointer to the resolved domain SID
 171  * @param *name_type  Pointet to the SID type
 172  *
 173  * @return #wbcErr
 174  *
 175  **/
 176
 177 wbcErr wbcLookupName(const char *domain,
 178                      const char *name,
 179                      struct wbcDomainSid *sid,
 180                      enum wbcSidType *name_type)
 181 {
 182         struct winbindd_request request;
 183         struct winbindd_response response;
 184         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 185
 186         if (!sid || !name_type) {
 187                 wbc_status = WBC_ERR_INVALID_PARAM;
 188                 BAIL_ON_WBC_ERROR(wbc_status);
 189         }
 190
 191         /* Initialize request */
 192
 193         ZERO_STRUCT(request);
 194         ZERO_STRUCT(response);
 195
 196         /* dst is already null terminated from the memset above */
 197
 198         strncpy(request.data.name.dom_name, domain,
 199                 sizeof(request.data.name.dom_name)-1);
 200         strncpy(request.data.name.name, name,
 201                 sizeof(request.data.name.name)-1);
 202
 203         wbc_status = wbcRequestResponse(WINBINDD_LOOKUPNAME,
 204                                         &request,
 205                                         &response);
 206         BAIL_ON_WBC_ERROR(wbc_status);
 207
 208         wbc_status = wbcStringToSid(response.data.sid.sid, sid);
 209         BAIL_ON_WBC_ERROR(wbc_status);
 210
 211         *name_type = (enum wbcSidType)response.data.sid.type;
 212
 213         wbc_status = WBC_ERR_SUCCESS;
 214
 215  done:
 216         return wbc_status;
 217 }
 218
 219 /** @brief Convert a SID to a domain and name
 220  *
 221  * @param *sid        Pointer to the domain SID to be resolved
 222  * @param domain      Resolved Domain name (possibly "")
 223  * @param name        Resolved User or group name
 224  * @param *name_type  Pointet to the resolved SID type
 225  *
 226  * @return #wbcErr
 227  *
 228  **/
 229
 230 wbcErr wbcLookupSid(const struct wbcDomainSid *sid,
 231                     char **pdomain,
 232                     char **pname,
 233                     enum wbcSidType *pname_type)
 234 {
 235         struct winbindd_request request;
 236         struct winbindd_response response;
 237         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 238         char *sid_string = NULL;
 239         char *domain = NULL;
 240         char *name = NULL;
 241         enum wbcSidType name_type;
 242
 243         if (!sid) {
 244                 wbc_status = WBC_ERR_INVALID_PARAM;
 245                 BAIL_ON_WBC_ERROR(wbc_status);
 246         }
 247
 248         /* Initialize request */
 249
 250         ZERO_STRUCT(request);
 251         ZERO_STRUCT(response);
 252
 253         /* dst is already null terminated from the memset above */
 254
 255         wbc_status = wbcSidToString(sid, &sid_string);
 256         BAIL_ON_WBC_ERROR(wbc_status);
 257
 258         strncpy(request.data.sid, sid_string, sizeof(request.data.sid)-1);
 259         wbcFreeMemory(sid_string);
 260
 261         /* Make request */
 262
 263         wbc_status = wbcRequestResponse(WINBINDD_LOOKUPSID,
 264                                            &request,
 265                                            &response);
 266         BAIL_ON_WBC_ERROR(wbc_status);
 267
 268         /* Copy out result */
 269
 270         domain = talloc_strdup(NULL, response.data.name.dom_name);
 271         BAIL_ON_PTR_ERROR(domain, wbc_status);
 272
 273         name = talloc_strdup(NULL, response.data.name.name);
 274         BAIL_ON_PTR_ERROR(name, wbc_status);
 275
 276         name_type = (enum wbcSidType)response.data.name.type;
 277
 278         wbc_status = WBC_ERR_SUCCESS;
 279
 280  done:
 281         if (WBC_ERROR_IS_OK(wbc_status)) {
 282                 if (pdomain != NULL) {
 283                         *pdomain = domain;
 284                 }
 285                 if (pname != NULL) {
 286                         *pname = name;
 287                 }
 288                 if (pname_type != NULL) {
 289                         *pname_type = name_type;
 290                 }
 291         }
 292         else {
 293                 if (name != NULL) {
 294                         talloc_free(name);
 295                 }
 296                 if (domain != NULL) {
 297                         talloc_free(domain);
 298                 }
 299         }
 300
 301         return wbc_status;
 302 }
 303
 304 /** @brief Translate a collection of RIDs within a domain to names
 305  *
 306  **/
 307
 308 wbcErr wbcLookupRids(struct wbcDomainSid *dom_sid,
 309                      int num_rids,
 310                      uint32_t *rids,
 311                      const char **pp_domain_name,
 312                      const char ***pnames,
 313                      enum wbcSidType **ptypes)
 314 {
 315         size_t i, len, ridbuf_size;
 316         char *ridlist;
 317         char *p;
 318         struct winbindd_request request;
 319         struct winbindd_response response;
 320         char *sid_string = NULL;
 321         char *domain_name = NULL;
 322         const char **names = NULL;
 323         enum wbcSidType *types = NULL;
 324         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 325
 326         /* Initialise request */
 327
 328         ZERO_STRUCT(request);
 329         ZERO_STRUCT(response);
 330
 331         if (!dom_sid || (num_rids == 0)) {
 332                 wbc_status = WBC_ERR_INVALID_PARAM;
 333                 BAIL_ON_WBC_ERROR(wbc_status);
 334         }
 335
 336         wbc_status = wbcSidToString(dom_sid, &sid_string);
 337         BAIL_ON_WBC_ERROR(wbc_status);
 338
 339         strncpy(request.data.sid, sid_string, sizeof(request.data.sid)-1);
 340         wbcFreeMemory(sid_string);
 341
 342         /* Even if all the Rids were of maximum 32bit values,
 343            we would only have 11 bytes per rid in the final array
 344            ("4294967296" + \n).  Add one more byte for the
 345            terminating '\0' */
 346
 347         ridbuf_size = (sizeof(char)*11) * num_rids + 1;
 348
 349         ridlist = talloc_zero_array(NULL, char, ridbuf_size);
 350         BAIL_ON_PTR_ERROR(ridlist, wbc_status);
 351
 352         len = 0;
 353         for (i=0; i<num_rids && (len-1)>0; i++) {
 354                 char ridstr[12];
 355
 356                 len = strlen(ridlist);
 357                 p = ridlist + len;
 358
 359                 snprintf( ridstr, sizeof(ridstr)-1, "%u\n", rids[i]);
 360                 strncat(p, ridstr, ridbuf_size-len-1);
 361         }
 362
 363         request.extra_data.data = ridlist;
 364         request.extra_len = strlen(ridlist)+1;
 365
 366         wbc_status = wbcRequestResponse(WINBINDD_LOOKUPRIDS,
 367                                         &request,
 368                                         &response);
 369         talloc_free(ridlist);
 370         BAIL_ON_WBC_ERROR(wbc_status);
 371
 372         domain_name = talloc_strdup(NULL, response.data.domain_name);
 373         BAIL_ON_PTR_ERROR(domain_name, wbc_status);
 374
 375         names = talloc_array(NULL, const char*, num_rids);
 376         BAIL_ON_PTR_ERROR(names, wbc_status);
 377
 378         types = talloc_array(NULL, enum wbcSidType, num_rids);
 379         BAIL_ON_PTR_ERROR(types, wbc_status);
 380
 381         p = (char *)response.extra_data.data;
 382
 383         for (i=0; i<num_rids; i++) {
 384                 char *q;
 385
 386                 if (*p == '\0') {
 387                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 388                         BAIL_ON_WBC_ERROR(wbc_status);
 389                 }
 390
 391                 types[i] = (enum wbcSidType)strtoul(p, &q, 10);
 392
 393                 if (*q != ' ') {
 394                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 395                         BAIL_ON_WBC_ERROR(wbc_status);
 396                 }
 397
 398                 p = q+1;
 399
 400                 if ((q = strchr(p, '\n')) == NULL) {
 401                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 402                         BAIL_ON_WBC_ERROR(wbc_status);
 403                 }
 404
 405                 *q = '\0';
 406
 407                 names[i] = talloc_strdup(names, p);
 408                 BAIL_ON_PTR_ERROR(names[i], wbc_status);
 409
 410                 p = q+1;
 411         }
 412
 413         if (*p != '\0') {
 414                 wbc_status = WBC_ERR_INVALID_RESPONSE;
 415                 BAIL_ON_WBC_ERROR(wbc_status);
 416         }
 417
 418         wbc_status = WBC_ERR_SUCCESS;
 419
 420  done:
 421         if (response.extra_data.data) {
 422                 free(response.extra_data.data);
 423         }
 424
 425         if (WBC_ERROR_IS_OK(wbc_status)) {
 426                 *pp_domain_name = domain_name;
 427                 *pnames = names;
 428                 *ptypes = types;
 429         }
 430         else {
 431                 if (domain_name)
 432                         talloc_free(domain_name);
 433                 if (names)
 434                         talloc_free(names);
 435                 if (types)
 436                         talloc_free(types);
 437         }
 438
 439         return wbc_status;
 440 }
 441
 442 /** @brief Get the groups a user belongs to
 443  *
 444  **/
 445
 446 wbcErr wbcLookupUserSids(const struct wbcDomainSid *user_sid,
 447                          bool domain_groups_only,
 448                          uint32_t *num_sids,
 449                          struct wbcDomainSid **_sids)
 450 {
 451         uint32_t i;
 452         const char *s;
 453         struct winbindd_request request;
 454         struct winbindd_response response;
 455         char *sid_string = NULL;
 456         struct wbcDomainSid *sids = NULL;
 457         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 458         int cmd;
 459
 460         /* Initialise request */
 461
 462         ZERO_STRUCT(request);
 463         ZERO_STRUCT(response);
 464
 465         if (!user_sid) {
 466                 wbc_status = WBC_ERR_INVALID_PARAM;
 467                 BAIL_ON_WBC_ERROR(wbc_status);
 468         }
 469
 470         wbc_status = wbcSidToString(user_sid, &sid_string);
 471         BAIL_ON_WBC_ERROR(wbc_status);
 472
 473         strncpy(request.data.sid, sid_string, sizeof(request.data.sid)-1);
 474         wbcFreeMemory(sid_string);
 475
 476         if (domain_groups_only) {
 477                 cmd = WINBINDD_GETUSERDOMGROUPS;
 478         } else {
 479                 cmd = WINBINDD_GETUSERSIDS;
 480         }
 481
 482         wbc_status = wbcRequestResponse(cmd,
 483                                         &request,
 484                                         &response);
 485         BAIL_ON_WBC_ERROR(wbc_status);
 486
 487         if (response.data.num_entries &&
 488             !response.extra_data.data) {
 489                 wbc_status = WBC_ERR_INVALID_RESPONSE;
 490                 BAIL_ON_WBC_ERROR(wbc_status);
 491         }
 492
 493         sids = talloc_array(NULL, struct wbcDomainSid,
 494                             response.data.num_entries);
 495         BAIL_ON_PTR_ERROR(sids, wbc_status);
 496
 497         s = (const char *)response.extra_data.data;
 498         for (i = 0; i < response.data.num_entries; i++) {
 499                 char *n = strchr(s, '\n');
 500                 if (n) {
 501                         *n = '\0';
 502                 }
 503                 wbc_status = wbcStringToSid(s, &sids[i]);
 504                 BAIL_ON_WBC_ERROR(wbc_status);
 505                 s += strlen(s) + 1;
 506         }
 507
 508         *num_sids = response.data.num_entries;
 509         *_sids = sids;
 510         sids = NULL;
 511         wbc_status = WBC_ERR_SUCCESS;
 512
 513  done:
 514         if (response.extra_data.data) {
 515                 free(response.extra_data.data);
 516         }
 517         if (sids) {
 518                 talloc_free(sids);
 519         }
 520
 521         return wbc_status;
 522 }
 523
 524 /** @brief Lists Users
 525  *
 526  **/
 527
 528 wbcErr wbcListUsers(const char *domain_name,
 529                     uint32_t *_num_users,
 530                     const char ***_users)
 531 {
 532         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 533         struct winbindd_request request;
 534         struct winbindd_response response;
 535         uint32_t num_users = 0;
 536         const char **users = NULL;
 537         const char *next;
 538
 539         /* Initialise request */
 540
 541         ZERO_STRUCT(request);
 542         ZERO_STRUCT(response);
 543
 544         if (domain_name) {
 545                 strncpy(request.domain_name, domain_name,
 546                         sizeof(request.domain_name)-1);
 547         }
 548
 549         wbc_status = wbcRequestResponse(WINBINDD_LIST_USERS,
 550                                         &request,
 551                                         &response);
 552         BAIL_ON_WBC_ERROR(wbc_status);
 553
 554         /* Look through extra data */
 555
 556         next = (const char *)response.extra_data.data;
 557         while (next) {
 558                 const char **tmp;
 559                 const char *current = next;
 560                 char *k = strchr(next, ',');
 561                 if (k) {
 562                         k[0] = '\0';
 563                         next = k+1;
 564                 } else {
 565                         next = NULL;
 566                 }
 567
 568                 tmp = talloc_realloc(NULL, users,
 569                                      const char *,
 570                                      num_users+1);
 571                 BAIL_ON_PTR_ERROR(tmp, wbc_status);
 572                 users = tmp;
 573
 574                 users[num_users] = talloc_strdup(users, current);
 575                 BAIL_ON_PTR_ERROR(users[num_users], wbc_status);
 576
 577                 num_users++;
 578         }
 579
 580         *_num_users = num_users;
 581         *_users = users;
 582         users = NULL;
 583         wbc_status = WBC_ERR_SUCCESS;
 584
 585  done:
 586         if (response.extra_data.data) {
 587                 free(response.extra_data.data);
 588         }
 589         if (users) {
 590                 talloc_free(users);
 591         }
 592         return wbc_status;
 593 }
 594
 595 /** @brief Lists Groups
 596  *
 597  **/
 598
 599 wbcErr wbcListGroups(const char *domain_name,
 600                      uint32_t *_num_groups,
 601                      const char ***_groups)
 602 {
 603         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 604         struct winbindd_request request;
 605         struct winbindd_response response;
 606         uint32_t num_groups = 0;
 607         const char **groups = NULL;
 608         const char *next;
 609
 610         /* Initialise request */
 611
 612         ZERO_STRUCT(request);
 613         ZERO_STRUCT(response);
 614
 615         if (domain_name) {
 616                 strncpy(request.domain_name, domain_name,
 617                         sizeof(request.domain_name)-1);
 618         }
 619
 620         wbc_status = wbcRequestResponse(WINBINDD_LIST_GROUPS,
 621                                         &request,
 622                                         &response);
 623         BAIL_ON_WBC_ERROR(wbc_status);
 624
 625         /* Look through extra data */
 626
 627         next = (const char *)response.extra_data.data;
 628         while (next) {
 629                 const char **tmp;
 630                 const char *current = next;
 631                 char *k = strchr(next, ',');
 632                 if (k) {
 633                         k[0] = '\0';
 634                         next = k+1;
 635                 } else {
 636                         next = NULL;
 637                 }
 638
 639                 tmp = talloc_realloc(NULL, groups,
 640                                      const char *,
 641                                      num_groups+1);
 642                 BAIL_ON_PTR_ERROR(tmp, wbc_status);
 643                 groups = tmp;
 644
 645                 groups[num_groups] = talloc_strdup(groups, current);
 646                 BAIL_ON_PTR_ERROR(groups[num_groups], wbc_status);
 647
 648                 num_groups++;
 649         }
 650
 651         *_num_groups = num_groups;
 652         *_groups = groups;
 653         groups = NULL;
 654         wbc_status = WBC_ERR_SUCCESS;
 655
 656  done:
 657         if (response.extra_data.data) {
 658                 free(response.extra_data.data);
 659         }
 660         if (groups) {
 661                 talloc_free(groups);
 662         }
 663         return wbc_status;
 664 }