source3/winbindd/wb_group_members.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    async lookupgroupmembers
   4    Copyright (C) Volker Lendecke 2009
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "librpc/gen_ndr/cli_wbint.h"
  23
  24 /*
  25  * We have 3 sets of routines here:
  26  *
  27  * wb_lookupgroupmem is the low-level one-group routine
  28  *
  29  * wb_groups_members walks a list of groups
  30  *
  31  * wb_group_members finally is the high-level routine expanding groups
  32  * recursively
  33  */
  34
  35 /*
  36  * Look up members of a single group. Essentially a wrapper around the
  37  * lookup_groupmem winbindd_methods routine.
  38  */
  39
  40 struct wb_lookupgroupmem_state {
  41         struct dom_sid sid;
  42         struct wbint_GroupMembers members;
  43 };
  44
  45 static void wb_lookupgroupmem_done(struct tevent_req *subreq);
  46
  47 static struct tevent_req *wb_lookupgroupmem_send(TALLOC_CTX *mem_ctx,
  48                                                  struct tevent_context *ev,
  49                                                  const struct dom_sid *group_sid,
  50                                                  enum lsa_SidType type)
  51 {
  52         struct tevent_req *req, *subreq;
  53         struct wb_lookupgroupmem_state *state;
  54         struct winbindd_domain *domain;
  55         uint32_t num_names;
  56         struct dom_sid *sid_mem;
  57         char **names;
  58         uint32_t *name_types;
  59         NTSTATUS status;
  60
  61         req = tevent_req_create(mem_ctx, &state,
  62                                 struct wb_lookupgroupmem_state);
  63         if (req == NULL) {
  64                 return NULL;
  65         }
  66         sid_copy(&state->sid, group_sid);
  67
  68         domain = find_domain_from_sid_noinit(group_sid);
  69         if (domain == NULL) {
  70                 tevent_req_nterror(req, NT_STATUS_NO_SUCH_GROUP);
  71                 return tevent_req_post(req, ev);
  72         }
  73
  74         status = wcache_lookup_groupmem(domain, state, &state->sid, &num_names,
  75                                         &sid_mem, &names, &name_types);
  76         if (NT_STATUS_IS_OK(status)) {
  77                 int i;
  78                 state->members.members = talloc_array(
  79                         state, struct wbint_GroupMember, num_names);
  80                 if (tevent_req_nomem(state->members.members, req)) {
  81                         return tevent_req_post(req, ev);
  82                 }
  83                 state->members.num_members = num_names;
  84                 for (i=0; i<num_names; i++) {
  85                         struct wbint_GroupMember *m;
  86                         const char *name;
  87                         m = &state->members.members[i];
  88                         sid_copy(&m->sid, &sid_mem[i]);
  89                         name = names[i];
  90                         m->name = talloc_move(state->members.members, &name);
  91                         m->type = (enum lsa_SidType)name_types[i];
  92                 }
  93                 TALLOC_FREE(sid_mem);
  94                 TALLOC_FREE(names);
  95                 TALLOC_FREE(name_types);
  96                 tevent_req_done(req);
  97                 return tevent_req_post(req, ev);
  98         }
  99
 100         subreq = rpccli_wbint_LookupGroupMembers_send(
 101                 state, ev, domain->child.rpccli, &state->sid, type,
 102                 &state->members);
 103         if (tevent_req_nomem(subreq, req)) {
 104                 return tevent_req_post(req, ev);
 105         }
 106         tevent_req_set_callback(subreq, wb_lookupgroupmem_done, req);
 107         return req;
 108 }
 109
 110 static void wb_lookupgroupmem_done(struct tevent_req *subreq)
 111 {
 112         struct tevent_req *req = tevent_req_callback_data(
 113                 subreq, struct tevent_req);
 114         struct wb_lookupgroupmem_state *state = tevent_req_data(
 115                 req, struct wb_lookupgroupmem_state);
 116         NTSTATUS status, result;
 117
 118         status = rpccli_wbint_LookupGroupMembers_recv(subreq, state, &result);
 119         TALLOC_FREE(subreq);
 120         if (!NT_STATUS_IS_OK(status)) {
 121                 tevent_req_nterror(req, status);
 122                 return;
 123         }
 124         if (!NT_STATUS_IS_OK(result)) {
 125                 tevent_req_nterror(req, result);
 126                 return;
 127         }
 128         tevent_req_done(req);
 129 }
 130
 131 static NTSTATUS wb_lookupgroupmem_recv(struct tevent_req *req,
 132                                            TALLOC_CTX *mem_ctx,
 133                                            int *num_members,
 134                                            struct wbint_GroupMember **members)
 135 {
 136         struct wb_lookupgroupmem_state *state = tevent_req_data(
 137                 req, struct wb_lookupgroupmem_state);
 138         NTSTATUS status;
 139
 140         if (tevent_req_is_nterror(req, &status)) {
 141                 return status;
 142         }
 143
 144         *num_members = state->members.num_members;
 145         *members = talloc_move(mem_ctx, &state->members.members);
 146         return NT_STATUS_OK;
 147 }
 148
 149 /*
 150  * Same as wb_lookupgroupmem for a list of groups
 151  */
 152
 153 struct wb_groups_members_state {
 154         struct tevent_context *ev;
 155         struct wbint_GroupMember *groups;
 156         int num_groups;
 157         int next_group;
 158         struct wbint_GroupMember *all_members;
 159 };
 160
 161 static NTSTATUS wb_groups_members_next_subreq(
 162         struct wb_groups_members_state *state,
 163         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq);
 164 static void wb_groups_members_done(struct tevent_req *subreq);
 165
 166 static struct tevent_req *wb_groups_members_send(TALLOC_CTX *mem_ctx,
 167                                                  struct tevent_context *ev,
 168                                                  int num_groups,
 169                                                  struct wbint_GroupMember *groups)
 170 {
 171         struct tevent_req *req, *subreq;
 172         struct wb_groups_members_state *state;
 173         NTSTATUS status;
 174
 175         req = tevent_req_create(mem_ctx, &state,
 176                                 struct wb_groups_members_state);
 177         if (req == NULL) {
 178                 return NULL;
 179         }
 180         state->ev = ev;
 181         state->groups = groups;
 182         state->num_groups = num_groups;
 183         state->next_group = 0;
 184         state->all_members = NULL;
 185
 186         status = wb_groups_members_next_subreq(state, state, &subreq);
 187         if (!NT_STATUS_IS_OK(status)) {
 188                 tevent_req_nterror(req, status);
 189                 return tevent_req_post(req, ev);
 190         }
 191         if (subreq == NULL) {
 192                 tevent_req_done(req);
 193                 return tevent_req_post(req, ev);
 194         }
 195         tevent_req_set_callback(subreq, wb_groups_members_done, req);
 196         return req;
 197 }
 198
 199 static NTSTATUS wb_groups_members_next_subreq(
 200         struct wb_groups_members_state *state,
 201         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq)
 202 {
 203         struct tevent_req *subreq;
 204         struct wbint_GroupMember *g;
 205
 206         if (state->next_group >= state->num_groups) {
 207                 *psubreq = NULL;
 208                 return NT_STATUS_OK;
 209         }
 210
 211         g = &state->groups[state->next_group];
 212         state->next_group += 1;
 213
 214         subreq = wb_lookupgroupmem_send(mem_ctx, state->ev, &g->sid,
 215                                             g->type);
 216         if (subreq == NULL) {
 217                 return NT_STATUS_NO_MEMORY;
 218         }
 219         *psubreq = subreq;
 220         return NT_STATUS_OK;
 221 }
 222
 223 static void wb_groups_members_done(struct tevent_req *subreq)
 224 {
 225         struct tevent_req *req = tevent_req_callback_data(
 226                 subreq, struct tevent_req);
 227         struct wb_groups_members_state *state = tevent_req_data(
 228                 req, struct wb_groups_members_state);
 229         int i, num_all_members;
 230         int num_members = 0;
 231         struct wbint_GroupMember *members = NULL;
 232         NTSTATUS status;
 233
 234         status = wb_lookupgroupmem_recv(subreq, state, &num_members,
 235                                             &members);
 236         TALLOC_FREE(subreq);
 237
 238         /*
 239          * In this error handling here we might have to be a bit more generous
 240          * and just continue if an error occured.
 241          */
 242
 243         if (!NT_STATUS_IS_OK(status)) {
 244                 tevent_req_nterror(req, status);
 245                 return;
 246         }
 247
 248         num_all_members = talloc_array_length(state->all_members);
 249
 250         state->all_members = talloc_realloc(
 251                 state, state->all_members, struct wbint_GroupMember,
 252                 num_all_members + num_members);
 253         if ((num_all_members + num_members != 0)
 254             && tevent_req_nomem(state->all_members, req)) {
 255                 return;
 256         }
 257         for (i=0; i<num_members; i++) {
 258                 struct wbint_GroupMember *src, *dst;
 259                 src = &members[i];
 260                 dst = &state->all_members[num_all_members + i];
 261                 sid_copy(&dst->sid, &src->sid);
 262                 dst->name = talloc_move(state->all_members, &src->name);
 263                 dst->type = src->type;
 264         }
 265         TALLOC_FREE(members);
 266
 267         status = wb_groups_members_next_subreq(state, state, &subreq);
 268         if (!NT_STATUS_IS_OK(status)) {
 269                 tevent_req_nterror(req, status);
 270                 return;
 271         }
 272         if (subreq == NULL) {
 273                 tevent_req_done(req);
 274                 return;
 275         }
 276         tevent_req_set_callback(subreq, wb_groups_members_done, req);
 277 }
 278
 279 static NTSTATUS wb_groups_members_recv(struct tevent_req *req,
 280                                        TALLOC_CTX *mem_ctx,
 281                                        int *num_members,
 282                                        struct wbint_GroupMember **members)
 283 {
 284         struct wb_groups_members_state *state = tevent_req_data(
 285                 req, struct wb_groups_members_state);
 286         NTSTATUS status;
 287
 288         if (tevent_req_is_nterror(req, &status)) {
 289                 return status;
 290         }
 291         *num_members = talloc_array_length(state->all_members);
 292         *members = talloc_move(mem_ctx, &state->all_members);
 293         return NT_STATUS_OK;
 294 }
 295
 296
 297 /*
 298  * This is the routine expanding a list of groups up to a certain level. We
 299  * collect the users in a talloc_dict: We have to add them without duplicates,
 300  * and and talloc_dict is an indexed (here indexed by SID) data structure.
 301  */
 302
 303 struct wb_group_members_state {
 304         struct tevent_context *ev;
 305         int depth;
 306         struct talloc_dict *users;
 307         struct wbint_GroupMember *groups;
 308 };
 309
 310 static NTSTATUS wb_group_members_next_subreq(
 311         struct wb_group_members_state *state,
 312         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq);
 313 static void wb_group_members_done(struct tevent_req *subreq);
 314
 315 struct tevent_req *wb_group_members_send(TALLOC_CTX *mem_ctx,
 316                                          struct tevent_context *ev,
 317                                          const struct dom_sid *sid,
 318                                          enum lsa_SidType type,
 319                                          int max_depth)
 320 {
 321         struct tevent_req *req, *subreq;
 322         struct wb_group_members_state *state;
 323         NTSTATUS status;
 324
 325         req = tevent_req_create(mem_ctx, &state,
 326                                 struct wb_group_members_state);
 327         if (req == NULL) {
 328                 return NULL;
 329         }
 330         state->ev = ev;
 331         state->depth = max_depth;
 332         state->users = talloc_dict_init(state);
 333         if (tevent_req_nomem(state->users, req)) {
 334                 return tevent_req_post(req, ev);
 335         }
 336
 337         state->groups = talloc(state, struct wbint_GroupMember);
 338         if (tevent_req_nomem(state->groups, req)) {
 339                 return tevent_req_post(req, ev);
 340         }
 341         state->groups->name = NULL;
 342         sid_copy(&state->groups->sid, sid);
 343         state->groups->type = type;
 344
 345         status = wb_group_members_next_subreq(state, state, &subreq);
 346         if (!NT_STATUS_IS_OK(status)) {
 347                 tevent_req_nterror(req, status);
 348                 return tevent_req_post(req, ev);
 349         }
 350         if (subreq == NULL) {
 351                 tevent_req_done(req);
 352                 return tevent_req_post(req, ev);
 353         }
 354         tevent_req_set_callback(subreq, wb_group_members_done, req);
 355         return req;
 356 }
 357
 358 static NTSTATUS wb_group_members_next_subreq(
 359         struct wb_group_members_state *state,
 360         TALLOC_CTX *mem_ctx, struct tevent_req **psubreq)
 361 {
 362         struct tevent_req *subreq;
 363
 364         if ((talloc_array_length(state->groups) == 0)
 365             || (state->depth <= 0)) {
 366                 *psubreq = NULL;
 367                 return NT_STATUS_OK;
 368         }
 369         state->depth -= 1;
 370
 371         subreq = wb_groups_members_send(
 372                 mem_ctx, state->ev, talloc_array_length(state->groups),
 373                 state->groups);
 374         if (subreq == NULL) {
 375                 return NT_STATUS_NO_MEMORY;
 376         }
 377         *psubreq = subreq;
 378         return NT_STATUS_OK;
 379 }
 380
 381 static void wb_group_members_done(struct tevent_req *subreq)
 382 {
 383         struct tevent_req *req = tevent_req_callback_data(
 384                 subreq, struct tevent_req);
 385         struct wb_group_members_state *state = tevent_req_data(
 386                 req, struct wb_group_members_state);
 387         int i, num_groups, new_users, new_groups;
 388         int num_members = 0;
 389         struct wbint_GroupMember *members = NULL;
 390         NTSTATUS status;
 391
 392         status = wb_groups_members_recv(subreq, state, &num_members, &members);
 393         TALLOC_FREE(subreq);
 394         if (!NT_STATUS_IS_OK(status)) {
 395                 tevent_req_nterror(req, status);
 396                 return;
 397         }
 398
 399         new_users = new_groups = 0;
 400         for (i=0; i<num_members; i++) {
 401                 switch (members[i].type) {
 402                 case SID_NAME_DOM_GRP:
 403                 case SID_NAME_ALIAS:
 404                 case SID_NAME_WKN_GRP:
 405                         new_groups += 1;
 406                         break;
 407                 default:
 408                         /* Ignore everything else */
 409                         break;
 410                 }
 411         }
 412
 413         num_groups = 0;
 414         TALLOC_FREE(state->groups);
 415         state->groups = talloc_array(state, struct wbint_GroupMember,
 416                                      new_groups);
 417
 418         /*
 419          * Collect the users into state->users and the groups into
 420          * state->groups for the next iteration.
 421          */
 422
 423         for (i=0; i<num_members; i++) {
 424                 switch (members[i].type) {
 425                 case SID_NAME_USER:
 426                 case SID_NAME_COMPUTER: {
 427                         /*
 428                          * Add a copy of members[i] to state->users
 429                          */
 430                         struct wbint_GroupMember *m;
 431                         struct dom_sid *sid;
 432                         DATA_BLOB key;
 433
 434                         m = talloc(talloc_tos(), struct wbint_GroupMember);
 435                         if (tevent_req_nomem(m, req)) {
 436                                 return;
 437                         }
 438                         sid_copy(&m->sid, &members[i].sid);
 439                         m->name = talloc_move(m, &members[i].name);
 440                         m->type = members[i].type;
 441
 442                         sid = &members[i].sid;
 443                         key = data_blob_const(
 444                                 sid, ndr_size_dom_sid(sid, NULL, 0));
 445
 446                         if (!talloc_dict_set(state->users, key, &m)) {
 447                                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 448                                 return;
 449                         }
 450                         break;
 451                 }
 452                 case SID_NAME_DOM_GRP:
 453                 case SID_NAME_ALIAS:
 454                 case SID_NAME_WKN_GRP: {
 455                         struct wbint_GroupMember *g;
 456                         /*
 457                          * Save members[i] for the next round
 458                          */
 459                         g = &state->groups[num_groups];
 460                         sid_copy(&g->sid, &members[i].sid);
 461                         g->name = talloc_move(state->groups, &members[i].name);
 462                         g->type = members[i].type;
 463                         num_groups += 1;
 464                         break;
 465                 }
 466                 default:
 467                         /* Ignore everything else */
 468                         break;
 469                 }
 470         }
 471
 472         status = wb_group_members_next_subreq(state, state, &subreq);
 473         if (!NT_STATUS_IS_OK(status)) {
 474                 tevent_req_nterror(req, status);
 475                 return;
 476         }
 477         if (subreq == NULL) {
 478                 tevent_req_done(req);
 479                 return;
 480         }
 481         tevent_req_set_callback(subreq, wb_group_members_done, req);
 482 }
 483
 484 NTSTATUS wb_group_members_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 485                                struct talloc_dict **members)
 486 {
 487         struct wb_group_members_state *state = tevent_req_data(
 488                 req, struct wb_group_members_state);
 489         NTSTATUS status;
 490
 491         if (tevent_req_is_nterror(req, &status)) {
 492                 return status;
 493         }
 494         *members = talloc_move(mem_ctx, &state->users);
 495         return NT_STATUS_OK;
 496 }