X-Git-Url: http://git.samba.org/?a=blobdiff_plain;f=source3%2Fwinbindd%2Fwinbindd.h;h=081722f6a901bb9317f6a837af2b55e7ce710096;hb=7f2d45a6c2a88dd8833fc66d314ec21507dd52c3;hp=c4c1278d739868899b457189e44e2e6ada4ec558;hpb=2763b90d242119d25d9f5afa91a403e85425da06;p=samba.git diff --git a/source3/winbindd/winbindd.h b/source3/winbindd/winbindd.h index c4c1278d739..081722f6a90 100644 --- a/source3/winbindd/winbindd.h +++ b/source3/winbindd/winbindd.h @@ -5,17 +5,17 @@ Copyright (C) Tim Potter 2000 Copyright (C) Jim McDonough 2003 - + This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. - + This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public License for more details. - + You should have received a copy of the GNU Lesser General Public License along with this program. If not, see . */ @@ -24,6 +24,11 @@ #define _WINBINDD_H #include "nsswitch/winbind_struct_protocol.h" +#include "nsswitch/libwbclient/wbclient.h" +#include "librpc/gen_ndr/dcerpc.h" +#include "librpc/gen_ndr/winbind.h" + +#include "../lib/util/tevent_ntstatus.h" #ifdef HAVE_LIBNSCD #include @@ -38,23 +43,8 @@ #define WB_REPLACE_CHAR '_' -/* bits for fd_event.flags */ -#define EVENT_FD_READ 1 -#define EVENT_FD_WRITE 2 - -struct fd_event { - struct fd_event *next, *prev; - int fd; - int flags; /* see EVENT_FD_* flags */ - void (*handler)(struct fd_event *fde, int flags); - void *data; - size_t length, done; - void (*finished)(void *private_data, bool success); - void *private_data; -}; - struct sid_ctr { - DOM_SID *sid; + struct dom_sid *sid; bool finished; const char *domain; const char *name; @@ -64,74 +54,55 @@ struct sid_ctr { struct winbindd_cli_state { struct winbindd_cli_state *prev, *next; /* Linked list pointers */ int sock; /* Open socket from client */ - struct fd_event fd_event; pid_t pid; /* pid of client */ - bool finished; /* Can delete from list */ - bool write_extra_data; /* Write extra_data field */ time_t last_access; /* Time of last access (read or write) */ bool privileged; /* Is the client 'privileged' */ TALLOC_CTX *mem_ctx; /* memory per request */ - struct winbindd_request request; /* Request from client */ - struct winbindd_response response; /* Respose to client */ - bool getpwent_initialized; /* Has getpwent_state been - * initialized? */ - bool getgrent_initialized; /* Has getgrent_state been - * initialized? */ - struct getent_state *getpwent_state; /* State for getpwent() */ - struct getent_state *getgrent_state; /* State for getgrent() */ + const char *cmd_name; + NTSTATUS (*recv_fn)(struct tevent_req *req, + struct winbindd_response *presp); + struct winbindd_request *request; /* Request from client */ + struct tevent_queue *out_queue; + struct winbindd_response *response; /* Respose to client */ + struct tevent_req *io_req; /* wb_req_read_* or wb_resp_write_* */ + + struct getpwent_state *pwent_state; /* State for getpwent() */ + struct getgrent_state *grent_state; /* State for getgrent() */ }; -/* State between get{pw,gr}ent() calls */ - -struct getent_state { - struct getent_state *prev, *next; - void *sam_entries; - uint32 sam_entry_index, num_sam_entries; - bool got_sam_entries; - fstring domain_name; +struct getpwent_state { + struct winbindd_domain *domain; + uint32_t next_user; + struct wbint_RidArray rids; }; -/* Storage for cached getpwent() user entries */ - -struct getpwent_user { - fstring name; /* Account name */ - fstring gecos; /* User information */ - fstring homedir; /* User Home Directory */ - fstring shell; /* User Login Shell */ - DOM_SID user_sid; /* NT user and primary group SIDs */ - DOM_SID group_sid; +struct getgrent_state { + struct winbindd_domain *domain; + int next_group; + int num_groups; + struct wbint_Principal *groups; }; -/* Server state structure */ - -typedef struct { - char *acct_name; - char *full_name; - char *homedir; - char *shell; - gid_t primary_gid; /* allow the nss_info - backend to set the primary group */ - DOM_SID user_sid; /* NT user and primary group SIDs */ - DOM_SID group_sid; -} WINBIND_USERINFO; - /* Our connection to the DC */ struct winbindd_cm_conn { struct cli_state *cli; + enum dcerpc_AuthLevel auth_level; + struct rpc_pipe_client *samr_pipe; - POLICY_HND sam_connect_handle, sam_domain_handle; + struct policy_handle sam_connect_handle, sam_domain_handle; struct rpc_pipe_client *lsa_pipe; - POLICY_HND lsa_policy; + struct rpc_pipe_client *lsa_pipe_tcp; + struct policy_handle lsa_policy; struct rpc_pipe_client *netlogon_pipe; + struct netlogon_creds_cli_context *netlogon_creds_ctx; + bool netlogon_force_reauth; }; -struct winbindd_async_request; - /* Async child */ struct winbindd_domain; @@ -150,9 +121,12 @@ struct winbindd_child { struct winbindd_domain *domain; char *logfilename; - struct fd_event event; - struct timed_event *lockout_policy_event; - struct winbindd_async_request *requests; + int sock; + struct tevent_queue *queue; + struct dcerpc_binding_handle *binding_handle; + + struct tevent_timer *lockout_policy_event; + struct tevent_timer *machine_password_change_event; const struct winbindd_child_dispatch_table *table; }; @@ -160,27 +134,31 @@ struct winbindd_child { /* Structures to hold per domain information */ struct winbindd_domain { - fstring name; /* Domain name (NetBIOS) */ - fstring alt_name; /* alt Domain name, if any (FQDN for ADS) */ - fstring forest_name; /* Name of the AD forest we're in */ - DOM_SID sid; /* SID for this domain */ - uint32 domain_flags; /* Domain flags from netlogon.h */ - uint32 domain_type; /* Domain type from netlogon.h */ - uint32 domain_trust_attribs; /* Trust attribs from netlogon.h */ + char *name; /* Domain name (NetBIOS) */ + char *alt_name; /* alt Domain name, if any (FQDN for ADS) */ + char *forest_name; /* Name of the AD forest we're in */ + struct dom_sid sid; /* SID for this domain */ + enum netr_SchannelType secure_channel_type; + uint32_t domain_flags; /* Domain flags from netlogon.h */ + uint32_t domain_type; /* Domain type from netlogon.h */ + uint32_t domain_trust_attribs; /* Trust attribs from netlogon.h */ + struct winbindd_domain *routing_domain; bool initialized; /* Did we already ask for the domain mode? */ bool native_mode; /* is this a win2k domain in native mode ? */ bool active_directory; /* is this a win2k active directory ? */ bool primary; /* is this our primary domain ? */ bool internal; /* BUILTIN and member SAM */ + bool rodc; /* Are we an RODC for this AD domain? (do some operations locally) */ bool online; /* is this domain available ? */ - time_t startup_time; /* When we set "startup" true. */ + time_t startup_time; /* When we set "startup" true. monotonic clock */ bool startup; /* are we in the first 30 seconds after startup_time ? */ - /* Lookup methods for this domain (LDAP or RPC) */ - struct winbindd_methods *methods; + bool can_do_ncacn_ip_tcp; - /* the backend methods are used by the cache layer to find the right - backend */ + /* + * Lookup methods for this domain (LDAP or RPC). The backend + * methods are used by the cache layer. + */ struct winbindd_methods *backend; /* Private data for the backends (used for connection cache) */ @@ -188,13 +166,14 @@ struct winbindd_domain { void *private_data; /* A working DC */ - fstring dcname; + pid_t dc_probe_pid; /* Child we're using to detect the DC. */ + char *dcname; struct sockaddr_storage dcaddr; /* Sequence number stuff */ time_t last_seq_check; - uint32 sequence_number; + uint32_t sequence_number; NTSTATUS last_status; /* The smb connection */ @@ -203,18 +182,27 @@ struct winbindd_domain { /* The child pid we're talking to */ - struct winbindd_child child; + struct winbindd_child *children; + + struct tevent_queue *queue; + struct dcerpc_binding_handle *binding_handle; /* Callback we use to try put us back online. */ - uint32 check_online_timeout; - struct timed_event *check_online_event; + uint32_t check_online_timeout; + struct tevent_timer *check_online_event; /* Linked list info */ struct winbindd_domain *prev, *next; }; +struct wb_acct_info { + fstring acct_name; /* account name */ + fstring acct_desc; /* account name */ + uint32_t rid; /* domain-relative RID */ +}; + /* per-domain methods. This is how LDAP vs RPC is selected */ struct winbindd_methods { @@ -222,120 +210,104 @@ struct winbindd_methods { always correct) */ bool consistent; - /* get a list of users, returning a WINBIND_USERINFO for each one */ + /* get a list of users, returning a wbint_userinfo for each one */ NTSTATUS (*query_user_list)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - uint32 *num_entries, - WINBIND_USERINFO **info); + uint32_t **rids); /* get a list of domain groups */ NTSTATUS (*enum_dom_groups)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - uint32 *num_entries, - struct acct_info **info); + uint32_t *num_entries, + struct wb_acct_info **info); /* get a list of domain local groups */ NTSTATUS (*enum_local_groups)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - uint32 *num_entries, - struct acct_info **info); - + uint32_t *num_entries, + struct wb_acct_info **info); + /* convert one user or group name to a sid */ NTSTATUS (*name_to_sid)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - enum winbindd_cmd orig_cmd, const char *domain_name, const char *name, - DOM_SID *sid, + uint32_t flags, + struct dom_sid *sid, enum lsa_SidType *type); /* convert a sid to a user or group name */ NTSTATUS (*sid_to_name)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - const DOM_SID *sid, + const struct dom_sid *sid, char **domain_name, char **name, enum lsa_SidType *type); NTSTATUS (*rids_to_names)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - const DOM_SID *domain_sid, - uint32 *rids, + const struct dom_sid *domain_sid, + uint32_t *rids, size_t num_rids, char **domain_name, char ***names, enum lsa_SidType **types); - /* lookup user info for a given SID */ - NTSTATUS (*query_user)(struct winbindd_domain *domain, - TALLOC_CTX *mem_ctx, - const DOM_SID *user_sid, - WINBIND_USERINFO *user_info); - /* lookup all groups that a user is a member of. The backend can also choose to lookup by username or rid for this function */ NTSTATUS (*lookup_usergroups)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - const DOM_SID *user_sid, - uint32 *num_groups, DOM_SID **user_gids); + const struct dom_sid *user_sid, + uint32_t *num_groups, struct dom_sid **user_gids); /* Lookup all aliases that the sids delivered are member of. This is * to implement 'domain local groups' correctly */ NTSTATUS (*lookup_useraliases)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - uint32 num_sids, - const DOM_SID *sids, - uint32 *num_aliases, - uint32 **alias_rids); + uint32_t num_sids, + const struct dom_sid *sids, + uint32_t *num_aliases, + uint32_t **alias_rids); /* find all members of the group with the specified group_rid */ NTSTATUS (*lookup_groupmem)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - const DOM_SID *group_sid, - uint32 *num_names, - DOM_SID **sid_mem, char ***names, - uint32 **name_types); + const struct dom_sid *group_sid, + enum lsa_SidType type, + uint32_t *num_names, + struct dom_sid **sid_mem, char ***names, + uint32_t **name_types); /* return the current global sequence number */ - NTSTATUS (*sequence_number)(struct winbindd_domain *domain, uint32 *seq); + NTSTATUS (*sequence_number)(struct winbindd_domain *domain, uint32_t *seq); /* return the lockout policy */ - NTSTATUS (*lockout_policy)(struct winbindd_domain *domain, + NTSTATUS (*lockout_policy)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - SAM_UNK_INFO_12 *lockout_policy); - + struct samr_DomInfo12 *lockout_policy); + /* return the lockout policy */ - NTSTATUS (*password_policy)(struct winbindd_domain *domain, + NTSTATUS (*password_policy)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - SAM_UNK_INFO_1 *password_policy); - + struct samr_DomInfo1 *password_policy); + /* enumerate trusted domains */ NTSTATUS (*trusted_domains)(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, - uint32 *num_domains, - char ***names, - char ***alt_names, - DOM_SID **dom_sids); + struct netr_DomainTrustList *trusts); }; -/* Used to glue a policy handle and cli_state together */ - -typedef struct { - struct cli_state *cli; - POLICY_HND pol; -} CLI_POLICY_HND; - /* Filled out by IDMAP backends */ struct winbindd_idmap_methods { /* Called when backend is first loaded */ bool (*init)(void); - bool (*get_sid_from_uid)(uid_t uid, DOM_SID *sid); - bool (*get_sid_from_gid)(gid_t gid, DOM_SID *sid); + bool (*get_sid_from_uid)(uid_t uid, struct dom_sid *sid); + bool (*get_sid_from_gid)(gid_t gid, struct dom_sid *sid); - bool (*get_uid_from_sid)(DOM_SID *sid, uid_t *uid); - bool (*get_gid_from_sid)(DOM_SID *sid, gid_t *gid); + bool (*get_uid_from_sid)(struct dom_sid *sid, uid_t *uid); + bool (*get_gid_from_sid)(struct dom_sid *sid, gid_t *gid); /* Called when backend is unloaded */ bool (*close)(void); @@ -348,21 +320,44 @@ struct winbindd_idmap_methods { struct winbindd_tdc_domain { const char *domain_name; const char *dns_name; - DOM_SID sid; - uint32 trust_flags; - uint32 trust_attribs; - uint32 trust_type; + struct dom_sid sid; + uint32_t trust_flags; + uint32_t trust_attribs; + uint32_t trust_type; }; +struct WINBINDD_MEMORY_CREDS { + struct WINBINDD_MEMORY_CREDS *next, *prev; + const char *username; /* lookup key. */ + uid_t uid; + int ref_count; + size_t len; + uint8_t *nt_hash; /* Base pointer for the following 2 */ + uint8_t *lm_hash; + char *pass; +}; + +struct WINBINDD_CCACHE_ENTRY { + struct WINBINDD_CCACHE_ENTRY *next, *prev; + const char *principal_name; + const char *ccname; + const char *service; + const char *username; + const char *realm; + struct WINBINDD_MEMORY_CREDS *cred_ptr; + int ref_count; + uid_t uid; + time_t create_time; + time_t renew_until; + time_t refresh_time; + struct tevent_timer *event; +}; #include "winbindd/winbindd_proto.h" #define WINBINDD_ESTABLISH_LOOP 30 #define WINBINDD_RESCAN_FREQ lp_winbind_cache_time() #define WINBINDD_PAM_AUTH_KRB5_RENEW_TIME 2592000 /* one month */ -#define DOM_SEQUENCE_NONE ((uint32)-1) +#define DOM_SEQUENCE_NONE ((uint32_t)-1) -#define IS_DOMAIN_OFFLINE(x) ( lp_winbind_offline_logon() && \ - ( get_global_winbindd_state_offline() \ - || !(x)->online ) ) #endif /* _WINBINDD_H */