source/winbindd/winbindd_group.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon for ntdom nss module
   5
   6    Copyright (C) Tim Potter 2000
   7    Copyright (C) Jeremy Allison 2001.
   8    Copyright (C) Gerald (Jerry) Carter 2003.
   9    Copyright (C) Volker Lendecke 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27
  28 extern bool opt_nocache;
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_WINBIND
  32
  33 static void add_member(const char *domain, const char *user,
  34            char **pp_members, size_t *p_num_members)
  35 {
  36         fstring name;
  37
  38         fill_domain_username(name, domain, user, True);
  39         safe_strcat(name, ",", sizeof(name)-1);
  40         string_append(pp_members, name);
  41         *p_num_members += 1;
  42 }
  43
  44 /**********************************************************************
  45  Add member users resulting from sid. Expand if it is a domain group.
  46 **********************************************************************/
  47
  48 static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_num_members)
  49 {
  50         DOM_SID dom_sid;
  51         uint32 rid;
  52         struct winbindd_domain *domain;
  53         size_t i;
  54
  55         char *domain_name = NULL;
  56         char *name = NULL;
  57         enum lsa_SidType type;
  58
  59         uint32 num_names;
  60         DOM_SID *sid_mem;
  61         char **names;
  62         uint32 *types;
  63
  64         NTSTATUS result;
  65
  66         TALLOC_CTX *mem_ctx = talloc_init("add_expanded_sid");
  67
  68         if (mem_ctx == NULL) {
  69                 DEBUG(1, ("talloc_init failed\n"));
  70                 return;
  71         }
  72
  73         sid_copy(&dom_sid, sid);
  74         sid_split_rid(&dom_sid, &rid);
  75
  76         domain = find_lookup_domain_from_sid(sid);
  77
  78         if (domain == NULL) {
  79                 DEBUG(3, ("Could not find domain for sid %s\n",
  80                           sid_string_dbg(sid)));
  81                 goto done;
  82         }
  83
  84         result = domain->methods->sid_to_name(domain, mem_ctx, sid,
  85                                               &domain_name, &name, &type);
  86
  87         if (!NT_STATUS_IS_OK(result)) {
  88                 DEBUG(3, ("sid_to_name failed for sid %s\n",
  89                           sid_string_dbg(sid)));
  90                 goto done;
  91         }
  92
  93         DEBUG(10, ("Found name %s, type %d\n", name, type));
  94
  95         if (type == SID_NAME_USER) {
  96                 add_member(domain_name, name, pp_members, p_num_members);
  97                 goto done;
  98         }
  99
 100         if (type != SID_NAME_DOM_GRP) {
 101                 DEBUG(10, ("Alias member %s neither user nor group, ignore\n",
 102                            name));
 103                 goto done;
 104         }
 105
 106         /* Expand the domain group, this must be done via the target domain */
 107
 108         domain = find_domain_from_sid(sid);
 109
 110         if (domain == NULL) {
 111                 DEBUG(3, ("Could not find domain from SID %s\n",
 112                           sid_string_dbg(sid)));
 113                 goto done;
 114         }
 115
 116         result = domain->methods->lookup_groupmem(domain, mem_ctx,
 117                                                   sid, &num_names,
 118                                                   &sid_mem, &names,
 119                                                   &types);
 120
 121         if (!NT_STATUS_IS_OK(result)) {
 122                 DEBUG(10, ("Could not lookup group members for %s: %s\n",
 123                            name, nt_errstr(result)));
 124                 goto done;
 125         }
 126
 127         for (i=0; i<num_names; i++) {
 128                 DEBUG(10, ("Adding group member SID %s\n",
 129                            sid_string_dbg(&sid_mem[i])));
 130
 131                 if (types[i] != SID_NAME_USER) {
 132                         DEBUG(1, ("Hmmm. Member %s of group %s is no user. "
 133                                   "Ignoring.\n", names[i], name));
 134                         continue;
 135                 }
 136
 137                 add_member(domain->name, names[i], pp_members, p_num_members);
 138         }
 139
 140  done:
 141         talloc_destroy(mem_ctx);
 142         return;
 143 }
 144
 145 static bool fill_passdb_alias_grmem(struct winbindd_domain *domain,
 146                              DOM_SID *group_sid,
 147                              size_t *num_gr_mem, char **gr_mem, size_t *gr_mem_len)
 148 {
 149         DOM_SID *members;
 150         size_t i, num_members;
 151
 152         *num_gr_mem = 0;
 153         *gr_mem = NULL;
 154         *gr_mem_len = 0;
 155
 156         if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(group_sid, &members,
 157                                                &num_members)))
 158                 return True;
 159
 160         for (i=0; i<num_members; i++) {
 161                 add_expanded_sid(&members[i], gr_mem, num_gr_mem);
 162         }
 163
 164         TALLOC_FREE(members);
 165
 166         if (*gr_mem != NULL) {
 167                 size_t len;
 168
 169                 /* We have at least one member, strip off the last "," */
 170                 len = strlen(*gr_mem);
 171                 (*gr_mem)[len-1] = '\0';
 172                 *gr_mem_len = len;
 173         }
 174
 175         return True;
 176 }
 177
 178 /* Fill a grent structure from various other information */
 179
 180 static bool fill_grent(struct winbindd_gr *gr, const char *dom_name,
 181                        const char *gr_name, gid_t unix_gid)
 182 {
 183         fstring full_group_name;
 184
 185         fill_domain_username( full_group_name, dom_name, gr_name, True );
 186
 187         gr->gr_gid = unix_gid;
 188
 189         /* Group name and password */
 190
 191         safe_strcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name) - 1);
 192         safe_strcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd) - 1);
 193
 194         return True;
 195 }
 196
 197 /***********************************************************************
 198  If "enum users" is set to false, and the group being looked
 199  up is the Domain Users SID: S-1-5-domain-513, then for the
 200  list of members check if the querying user is in that group,
 201  and if so only return that user as the gr_mem array.
 202  We can change this to a different parameter than "enum users"
 203  if neccessaey, or parameterize the group list we do this for.
 204 ***********************************************************************/
 205
 206 static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
 207                                      struct winbindd_domain *domain,
 208                                      struct winbindd_cli_state *state,
 209                                      DOM_SID *group_sid,
 210                                      enum lsa_SidType group_name_type,
 211                                      size_t *num_gr_mem, char **gr_mem,
 212                                      size_t *gr_mem_len)
 213 {
 214         DOM_SID querying_user_sid;
 215         DOM_SID *pquerying_user_sid = NULL;
 216         uint32 num_groups = 0;
 217         DOM_SID *user_sids = NULL;
 218         bool u_in_group = False;
 219         NTSTATUS status;
 220         int i;
 221         unsigned int buf_len = 0;
 222         char *buf = NULL;
 223
 224         DEBUG(10,("fill_grent_mem_domain_users: domain %s\n",
 225                   domain->name ));
 226
 227         if (state) {
 228                 uid_t ret_uid = (uid_t)-1;
 229                 if (sys_getpeereid(state->sock, &ret_uid)==0) {
 230                         /* We know who's asking - look up their SID if
 231                            it's one we've mapped before. */
 232                         status = idmap_uid_to_sid(&querying_user_sid, ret_uid);
 233                         if (NT_STATUS_IS_OK(status)) {
 234                                 pquerying_user_sid = &querying_user_sid;
 235                                 DEBUG(10,("fill_grent_mem_domain_users: querying uid %u -> %s\n",
 236                                           (unsigned int)ret_uid,
 237                                           sid_string_dbg(pquerying_user_sid)));
 238                         }
 239                 }
 240         }
 241
 242         /* Only look up if it was a winbindd user in this domain. */
 243         if (pquerying_user_sid &&
 244             (sid_compare_domain(pquerying_user_sid, &domain->sid) == 0)) {
 245
 246                 DEBUG(10,("fill_grent_mem_domain_users: querying user = %s\n",
 247                           sid_string_dbg(pquerying_user_sid) ));
 248
 249                 status = domain->methods->lookup_usergroups(domain,
 250                                                             mem_ctx,
 251                                                             pquerying_user_sid,
 252                                                             &num_groups,
 253                                                             &user_sids);
 254                 if (!NT_STATUS_IS_OK(status)) {
 255                         DEBUG(1, ("fill_grent_mem_domain_users: lookup_usergroups failed "
 256                                   "for sid %s in domain %s (error: %s)\n",
 257                                   sid_string_dbg(pquerying_user_sid),
 258                                   domain->name,
 259                                   nt_errstr(status)));
 260                         return False;
 261                 }
 262
 263                 for (i = 0; i < num_groups; i++) {
 264                         if (sid_equal(group_sid, &user_sids[i])) {
 265                                 /* User is in Domain Users, add their name
 266                                    as the only group member. */
 267                                 u_in_group = True;
 268                                 break;
 269                         }
 270                 }
 271         }
 272
 273         if (u_in_group) {
 274                 size_t len = 0;
 275                 char *domainname = NULL;
 276                 char *username = NULL;
 277                 fstring name;
 278                 enum lsa_SidType type;
 279
 280                 DEBUG(10,("fill_grent_mem_domain_users: sid %s in 'Domain Users' in domain %s\n",
 281                           sid_string_dbg(pquerying_user_sid),
 282                           domain->name ));
 283
 284                 status = domain->methods->sid_to_name(domain, mem_ctx,
 285                                                       pquerying_user_sid,
 286                                                       &domainname,
 287                                                       &username,
 288                                                       &type);
 289                 if (!NT_STATUS_IS_OK(status)) {
 290                         DEBUG(1, ("could not lookup username for user "
 291                                   "sid %s in domain %s (error: %s)\n",
 292                                   sid_string_dbg(pquerying_user_sid),
 293                                   domain->name,
 294                                   nt_errstr(status)));
 295                         return False;
 296                 }
 297                 fill_domain_username(name, domain->name, username, True);
 298                 len = strlen(name);
 299                 buf_len = len + 1;
 300                 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
 301                         DEBUG(1, ("out of memory\n"));
 302                         return False;
 303                 }
 304                 memcpy(buf, name, buf_len);
 305
 306                 DEBUG(10,("fill_grent_mem_domain_users: user %s in "
 307                           "'Domain Users' in domain %s\n",
 308                           name, domain->name ));
 309
 310                 /* user is the only member */
 311                 *num_gr_mem = 1;
 312         }
 313
 314         *gr_mem = buf;
 315         *gr_mem_len = buf_len;
 316
 317         DEBUG(10, ("fill_grent_mem_domain_users: num_mem = %u, len = %u, mem = %s\n",
 318                    (unsigned int)*num_gr_mem,
 319                    (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
 320
 321         return True;
 322 }
 323
 324 /***********************************************************************
 325  Add names to a list.  Assumes  a canonical version of the string
 326  in DOMAIN\user
 327 ***********************************************************************/
 328
 329 static int namecmp( const void *a, const void *b )
 330 {
 331         return StrCaseCmp( * (char * const *) a, * (char * const *) b);
 332 }
 333
 334 static NTSTATUS add_names_to_list( TALLOC_CTX *ctx,
 335                                    char ***list, uint32 *n_list,
 336                                    char **names, uint32 n_names )
 337 {
 338         char **new_list = NULL;
 339         uint32 n_new_list = 0;
 340         int i, j;
 341
 342         if ( !names || (n_names == 0) )
 343                 return NT_STATUS_OK;
 344
 345         /* Alloc the maximum size we'll need */
 346
 347         if ( *list == NULL ) {
 348                 if ( (new_list = TALLOC_ARRAY( ctx, char *, n_names )) == NULL )
 349                         return NT_STATUS_NO_MEMORY;
 350                 n_new_list = n_names;
 351         } else {
 352                 new_list = TALLOC_REALLOC_ARRAY( ctx, *list, char *,
 353                                                  (*n_list) + n_names );
 354                 if ( !new_list )
 355                         return NT_STATUS_NO_MEMORY;
 356                 n_new_list = (*n_list) + n_names;
 357         }
 358
 359         /* Add all names */
 360
 361         for ( i=*n_list, j=0; i<n_new_list; i++, j++ ) {
 362                 new_list[i] = talloc_strdup( new_list, names[j] );
 363         }
 364
 365         /* search for duplicates for sorting and looking for matching
 366            neighbors */
 367
 368         qsort( new_list, n_new_list, sizeof(char*), QSORT_CAST namecmp );
 369
 370         for ( i=1; i<n_new_list; i++ ) {
 371                 if ( strcmp( new_list[i-1], new_list[i] ) == 0 ) {
 372                         memmove( &new_list[i-1], &new_list[i],
 373                                  sizeof(char*)*(n_new_list-i) );
 374                         n_new_list--;
 375                 }
 376         }
 377
 378         *list = new_list;
 379         *n_list = n_new_list;
 380
 381         return NT_STATUS_OK;
 382 }
 383
 384 /***********************************************************************
 385 ***********************************************************************/
 386
 387 static NTSTATUS expand_groups( TALLOC_CTX *ctx,
 388                                struct winbindd_domain *d,
 389                                DOM_SID *glist, uint32 n_glist,
 390                                DOM_SID **new_glist, uint32 *n_new_glist,
 391                                char ***members, uint32 *n_members )
 392 {
 393         int i, j;
 394         NTSTATUS status = NT_STATUS_OK;
 395         uint32 num_names = 0;
 396         uint32 *name_types = NULL;
 397         char **names = NULL;
 398         DOM_SID *sid_mem = NULL;
 399         TALLOC_CTX *tmp_ctx = NULL;
 400         DOM_SID *new_groups = NULL;
 401         size_t new_groups_size = 0;
 402
 403         *members = NULL;
 404         *n_members = 0;
 405         *new_glist = NULL;
 406         *n_new_glist = 0;
 407
 408         for ( i=0; i<n_glist; i++ ) {
 409                 tmp_ctx = talloc_new( ctx );
 410
 411                 /* Lookup the group membership */
 412
 413                 status = d->methods->lookup_groupmem(d, tmp_ctx,
 414                                                      &glist[i], &num_names,
 415                                                      &sid_mem, &names,
 416                                                      &name_types);
 417                 if ( !NT_STATUS_IS_OK(status) )
 418                         goto out;
 419
 420                 /* Separate users and groups into two lists */
 421
 422                 for ( j=0; j<num_names; j++ ) {
 423
 424                         /* Users */
 425                         if ( name_types[j] == SID_NAME_USER ||
 426                              name_types[j] == SID_NAME_COMPUTER )
 427                         {
 428                                 status = add_names_to_list( ctx, members,
 429                                                             n_members,
 430                                                             names+j, 1 );
 431                                 if ( !NT_STATUS_IS_OK(status) )
 432                                         goto out;
 433
 434                                 continue;
 435                         }
 436
 437                         /* Groups */
 438                         if ( name_types[j] == SID_NAME_DOM_GRP ||
 439                              name_types[j] == SID_NAME_ALIAS )
 440                         {
 441                                 status = add_sid_to_array_unique(ctx,
 442                                                                  &sid_mem[j],
 443                                                                  &new_groups,
 444                                                                  &new_groups_size);
 445                                 if (!NT_STATUS_IS_OK(status)) {
 446                                         goto out;
 447                                 }
 448
 449                                 continue;
 450                         }
 451                 }
 452
 453                 TALLOC_FREE( tmp_ctx );
 454         }
 455
 456         *new_glist = new_groups;
 457         *n_new_glist = (uint32)new_groups_size;
 458
 459  out:
 460         TALLOC_FREE( tmp_ctx );
 461
 462         return status;
 463 }
 464
 465 /***********************************************************************
 466  Fill in the group membership field of a NT group given by group_sid
 467 ***********************************************************************/
 468
 469 static bool fill_grent_mem(struct winbindd_domain *domain,
 470                            struct winbindd_cli_state *state,
 471                            DOM_SID *group_sid,
 472                            enum lsa_SidType group_name_type,
 473                            size_t *num_gr_mem, char **gr_mem, size_t *gr_mem_len)
 474 {
 475         uint32 num_names = 0;
 476         unsigned int buf_len = 0, buf_ndx = 0, i;
 477         char **names = NULL, *buf = NULL;
 478         bool result = False;
 479         TALLOC_CTX *mem_ctx;
 480         uint32 group_rid;
 481         DOM_SID *glist = NULL;
 482         DOM_SID *new_glist = NULL;
 483         uint32 n_glist, n_new_glist;
 484         int max_depth = lp_winbind_expand_groups();
 485
 486         if (!(mem_ctx = talloc_init("fill_grent_mem(%s)", domain->name)))
 487                 return False;
 488
 489         DEBUG(10, ("group SID %s\n", sid_string_dbg(group_sid)));
 490
 491         /* Initialize with no members */
 492
 493         *num_gr_mem = 0;
 494
 495         /* HACK ALERT!! This whole routine does not cope with group members
 496          * from more than one domain, ie aliases. Thus we have to work it out
 497          * ourselves in a special routine. */
 498
 499         if (domain->internal) {
 500                 result = fill_passdb_alias_grmem(domain, group_sid,
 501                                                num_gr_mem,
 502                                                gr_mem, gr_mem_len);
 503                 goto done;
 504         }
 505
 506         /* Verify name type */
 507
 508         if ( !((group_name_type==SID_NAME_DOM_GRP) ||
 509                ((group_name_type==SID_NAME_ALIAS) && domain->primary)) )
 510         {
 511                 DEBUG(1, ("SID %s in domain %s isn't a domain group (%d)\n",
 512                           sid_string_dbg(group_sid),
 513                           domain->name, group_name_type));
 514                 goto done;
 515         }
 516
 517         /* OPTIMIZATION / HACK. See comment in
 518            fill_grent_mem_domusers() */
 519
 520         sid_peek_rid( group_sid, &group_rid );
 521         if (!lp_winbind_enum_users() && group_rid == DOMAIN_GROUP_RID_USERS) {
 522                 result = fill_grent_mem_domusers( mem_ctx, domain, state,
 523                                                   group_sid, group_name_type,
 524                                                   num_gr_mem, gr_mem,
 525                                                   gr_mem_len );
 526                 goto done;
 527         }
 528
 529         /* Real work goes here.  Create a list of group names to
 530            expand startign with the initial one.  Pass that to
 531            expand_groups() which returns a list of more group names
 532            to expand.  Do this up to the max search depth. */
 533
 534         if ( (glist = TALLOC_ARRAY(mem_ctx, DOM_SID, 1 )) == NULL ) {
 535                 result = False;
 536                 DEBUG(0,("fill_grent_mem: talloc failure!\n"));
 537                 goto done;
 538         }
 539         sid_copy( &glist[0], group_sid );
 540         n_glist = 1;
 541
 542         for ( i=0; i<max_depth && glist; i++ ) {
 543                 uint32 n_members = 0;
 544                 char **members = NULL;
 545                 NTSTATUS nt_status;
 546
 547                 nt_status = expand_groups( mem_ctx, domain,
 548                                            glist, n_glist,
 549                                            &new_glist, &n_new_glist,
 550                                            &members, &n_members);
 551                 if ( !NT_STATUS_IS_OK(nt_status) ) {
 552                         result = False;
 553                         goto done;
 554                 }
 555
 556                 /* Add new group members to list */
 557
 558                 nt_status = add_names_to_list( mem_ctx, &names, &num_names,
 559                                                members, n_members );
 560                 if ( !NT_STATUS_IS_OK(nt_status) ) {
 561                         result = False;
 562                         goto done;
 563                 }
 564
 565                 TALLOC_FREE( members );
 566
 567                 /* If we have no more groups to expand, break out
 568                    early */
 569
 570                 if (new_glist == NULL)
 571                         break;
 572
 573                 /* One more round */
 574                 TALLOC_FREE(glist);
 575                 glist = new_glist;
 576                 n_glist = n_new_glist;
 577         }
 578         TALLOC_FREE( glist );
 579
 580         DEBUG(10, ("looked up %d names\n", num_names));
 581
 582  again:
 583         /* Add members to list */
 584
 585         for (i = 0; i < num_names; i++) {
 586                 int len;
 587
 588                 DEBUG(10, ("processing name %s\n", names[i]));
 589
 590                 len = strlen(names[i]);
 591
 592                 /* Add to list or calculate buffer length */
 593
 594                 if (!buf) {
 595                         buf_len += len + 1; /* List is comma separated */
 596                         (*num_gr_mem)++;
 597                         DEBUG(10, ("buf_len + %d = %d\n", len + 1, buf_len));
 598                 } else {
 599                         DEBUG(10, ("appending %s at ndx %d\n", names[i], buf_ndx));
 600                         safe_strcpy(&buf[buf_ndx], names[i], len);
 601                         buf_ndx += len;
 602                         buf[buf_ndx] = ',';
 603                         buf_ndx++;
 604                 }
 605         }
 606
 607         /* Allocate buffer */
 608
 609         if (!buf && buf_len != 0) {
 610                 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
 611                         DEBUG(1, ("out of memory\n"));
 612                         result = False;
 613                         goto done;
 614                 }
 615                 memset(buf, 0, buf_len);
 616                 goto again;
 617         }
 618
 619         /* Now we're done */
 620
 621         if (buf && buf_ndx > 0) {
 622                 buf[buf_ndx - 1] = '\0';
 623         }
 624
 625         *gr_mem = buf;
 626         *gr_mem_len = buf_len;
 627
 628         DEBUG(10, ("num_mem = %u, len = %u, mem = %s\n", (unsigned int)*num_gr_mem,
 629                    (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
 630         result = True;
 631
 632 done:
 633
 634         talloc_destroy(mem_ctx);
 635
 636         DEBUG(10, ("fill_grent_mem returning %d\n", result));
 637
 638         return result;
 639 }
 640
 641 static void winbindd_getgrsid( struct winbindd_cli_state *state, DOM_SID group_sid );
 642
 643 static void getgrnam_recv( void *private_data, bool success, const DOM_SID *sid,
 644                            enum lsa_SidType type )
 645 {
 646         struct winbindd_cli_state *state = (struct winbindd_cli_state*)private_data;
 647
 648         if (!success) {
 649                 DEBUG(5,("getgrnam_recv: lookupname failed!\n"));
 650                 request_error(state);
 651                 return;
 652         }
 653
 654         if ( (type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) ) {
 655                 DEBUG(5,("getgrnam_recv: not a group!\n"));
 656                 request_error(state);
 657                 return;
 658         }
 659
 660         winbindd_getgrsid( state, *sid );
 661 }
 662
 663
 664 /* Return a group structure from a group name */
 665
 666 void winbindd_getgrnam(struct winbindd_cli_state *state)
 667 {
 668         struct winbindd_domain *domain;
 669         fstring name_domain, name_group;
 670         char *tmp;
 671
 672         /* Ensure null termination */
 673         state->request.data.groupname[sizeof(state->request.data.groupname)-1]='\0';
 674
 675         DEBUG(3, ("[%5lu]: getgrnam %s\n", (unsigned long)state->pid,
 676                   state->request.data.groupname));
 677
 678         /* Parse domain and groupname */
 679
 680         memset(name_group, 0, sizeof(fstring));
 681
 682         tmp = state->request.data.groupname;
 683
 684         name_domain[0] = '\0';
 685         name_group[0] = '\0';
 686
 687         parse_domain_user(tmp, name_domain, name_group);
 688
 689         /* if no domain or our local domain and no local tdb group, default to
 690          * our local domain for aliases */
 691
 692         if ( !*name_domain || strequal(name_domain, get_global_sam_name()) ) {
 693                 fstrcpy(name_domain, get_global_sam_name());
 694         }
 695
 696         /* Get info for the domain */
 697
 698         if ((domain = find_domain_from_name(name_domain)) == NULL) {
 699                 DEBUG(3, ("could not get domain sid for domain %s\n",
 700                           name_domain));
 701                 request_error(state);
 702                 return;
 703         }
 704         /* should we deal with users for our domain? */
 705
 706         if ( lp_winbind_trusted_domains_only() && domain->primary) {
 707                 DEBUG(7,("winbindd_getgrnam: My domain -- rejecting "
 708                          "getgrnam() for %s\\%s.\n", name_domain, name_group));
 709                 request_error(state);
 710                 return;
 711         }
 712
 713         /* Get rid and name type from name */
 714
 715         ws_name_replace( name_group, WB_REPLACE_CHAR );
 716
 717         winbindd_lookupname_async( state->mem_ctx, domain->name, name_group,
 718                                    getgrnam_recv, WINBINDD_GETGRNAM, state );
 719 }
 720
 721 struct getgrsid_state {
 722         struct winbindd_cli_state *state;
 723         struct winbindd_domain *domain;
 724         char *group_name;
 725         enum lsa_SidType group_type;
 726         uid_t gid;
 727         DOM_SID group_sid;
 728 };
 729
 730 static void getgrsid_sid2gid_recv(void *private_data, bool success, gid_t gid)
 731         {
 732         struct getgrsid_state *s =
 733                 (struct getgrsid_state *)private_data;
 734         struct winbindd_domain *domain;
 735         size_t gr_mem_len;
 736         size_t num_gr_mem;
 737         char *gr_mem;
 738         fstring dom_name, group_name;
 739
 740         if (!success) {
 741                 DEBUG(5,("getgrsid_sid2gid_recv: sid2gid failed!\n"));
 742                 request_error(s->state);
 743                 return;
 744         }
 745
 746         s->gid = gid;
 747
 748         if ( !parse_domain_user( s->group_name, dom_name, group_name ) ) {
 749                 DEBUG(5,("getgrsid_sid2gid_recv: parse_domain_user() failed!\n"));
 750                 request_error(s->state);
 751                 return;
 752         }
 753
 754
 755         /* Fill in group structure */
 756
 757         if ( (domain = find_domain_from_name_noinit(dom_name)) == NULL ) {
 758                 DEBUG(1,("Can't find domain from name (%s)\n", dom_name));
 759                 request_error(s->state);
 760                 return;
 761         }
 762
 763         if (!fill_grent(&s->state->response.data.gr, dom_name, group_name, gid) ||
 764             !fill_grent_mem(domain, s->state, &s->group_sid, s->group_type,
 765                             &num_gr_mem, &gr_mem, &gr_mem_len))
 766         {
 767                 request_error(s->state);
 768                 return;
 769         }
 770
 771         s->state->response.data.gr.num_gr_mem = (uint32)num_gr_mem;
 772
 773         /* Group membership lives at start of extra data */
 774
 775         s->state->response.data.gr.gr_mem_ofs = 0;
 776
 777         s->state->response.length += gr_mem_len;
 778         s->state->response.extra_data.data = gr_mem;
 779
 780         request_ok(s->state);
 781         }
 782
 783 static void getgrsid_lookupsid_recv( void *private_data, bool success,
 784                                      const char *dom_name, const char *name,
 785                                      enum lsa_SidType name_type )
 786 {
 787         struct getgrsid_state *s = (struct getgrsid_state *)private_data;
 788
 789         if (!success) {
 790                 DEBUG(5,("getgrsid_lookupsid_recv: lookupsid failed!\n"));
 791                 request_error(s->state);
 792                 return;
 793         }
 794
 795         /* either it's a domain group, a domain local group, or a
 796            local group in an internal domain */
 797
 798         if ( !( (name_type==SID_NAME_DOM_GRP) ||
 799                 ((name_type==SID_NAME_ALIAS) &&
 800                  (s->domain->primary || s->domain->internal)) ) )
 801         {
 802                 DEBUG(1, ("name '%s\\%s' is not a local or domain group: %d\n",
 803                           dom_name, name, name_type));
 804                 request_error(s->state);
 805                 return;
 806 }
 807
 808         if ( (s->group_name = talloc_asprintf( s->state->mem_ctx,
 809                                                "%s%c%s",
 810                                                dom_name,
 811                                                *lp_winbind_separator(),
 812                                                name)) == NULL )
 813 {
 814                 DEBUG(1, ("getgrsid_lookupsid_recv: talloc_asprintf() Failed!\n"));
 815                 request_error(s->state);
 816                 return;
 817         }
 818
 819         s->group_type = name_type;
 820
 821         winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
 822                                getgrsid_sid2gid_recv, s);
 823         }
 824
 825 static void winbindd_getgrsid( struct winbindd_cli_state *state, const DOM_SID group_sid )
 826         {
 827         struct getgrsid_state *s;
 828
 829         if ( (s = TALLOC_ZERO_P(state->mem_ctx, struct getgrsid_state)) == NULL ) {
 830                 DEBUG(0, ("talloc failed\n"));
 831                 request_error(state);
 832                 return;
 833         }
 834
 835         s->state = state;
 836
 837         if ( (s->domain = find_domain_from_sid_noinit(&group_sid)) == NULL ) {
 838                 DEBUG(3, ("Could not find domain for sid %s\n",
 839                           sid_string_dbg(&group_sid)));
 840                 request_error(state);
 841                 return;
 842         }
 843
 844         sid_copy(&s->group_sid, &group_sid);
 845
 846         winbindd_lookupsid_async( s->state->mem_ctx,  &group_sid,
 847                                   getgrsid_lookupsid_recv, s );
 848 }
 849
 850
 851 static void getgrgid_recv(void *private_data, bool success, const char *sid)
 852 {
 853         struct winbindd_cli_state *state = talloc_get_type_abort(private_data, struct winbindd_cli_state);
 854         enum lsa_SidType name_type;
 855         DOM_SID group_sid;
 856
 857         if (success) {
 858                 DEBUG(10,("getgrgid_recv: gid %lu has sid %s\n",
 859                           (unsigned long)(state->request.data.gid), sid));
 860
 861                 string_to_sid(&group_sid, sid);
 862                 winbindd_getgrsid(state, group_sid);
 863                 return;
 864         }
 865
 866         /* Ok, this might be "ours", i.e. an alias */
 867         if (pdb_gid_to_sid(state->request.data.gid, &group_sid) &&
 868             lookup_sid(state->mem_ctx, &group_sid, NULL, NULL, &name_type) &&
 869             (name_type == SID_NAME_ALIAS)) {
 870                 /* Hey, got an alias */
 871                 DEBUG(10,("getgrgid_recv: we have an alias with gid %lu and sid %s\n",
 872                           (unsigned long)(state->request.data.gid), sid));
 873                 winbindd_getgrsid(state, group_sid);
 874                 return;
 875         }
 876
 877         DEBUG(1, ("could not convert gid %lu to sid\n",
 878                   (unsigned long)state->request.data.gid));
 879         request_error(state);
 880 }
 881
 882 /* Return a group structure from a gid number */
 883 void winbindd_getgrgid(struct winbindd_cli_state *state)
 884 {
 885         DEBUG(3, ("[%5lu]: getgrgid %lu\n", (unsigned long)state->pid,
 886                   (unsigned long)state->request.data.gid));
 887
 888         /* always use the async interface */
 889         winbindd_gid2sid_async(state->mem_ctx, state->request.data.gid, getgrgid_recv, state);
 890 }
 891
 892 /*
 893  * set/get/endgrent functions
 894  */
 895
 896 /* "Rewind" file pointer for group database enumeration */
 897
 898 static bool winbindd_setgrent_internal(struct winbindd_cli_state *state)
 899 {
 900         struct winbindd_domain *domain;
 901
 902         DEBUG(3, ("[%5lu]: setgrent\n", (unsigned long)state->pid));
 903
 904         /* Check user has enabled this */
 905
 906         if (!lp_winbind_enum_groups()) {
 907                 return False;
 908         }
 909
 910         /* Free old static data if it exists */
 911
 912         if (state->getgrent_state != NULL) {
 913                 free_getent_state(state->getgrent_state);
 914                 state->getgrent_state = NULL;
 915         }
 916
 917         /* Create sam pipes for each domain we know about */
 918
 919         for (domain = domain_list(); domain != NULL; domain = domain->next) {
 920                 struct getent_state *domain_state;
 921
 922                 /* Create a state record for this domain */
 923
 924                 /* don't add our domaina if we are a PDC or if we
 925                    are a member of a Samba domain */
 926
 927                 if ( lp_winbind_trusted_domains_only() && domain->primary )
 928                 {
 929                         continue;
 930                 }
 931
 932
 933                 if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL) {
 934                         DEBUG(1, ("winbindd_setgrent: malloc failed for domain_state!\n"));
 935                         return False;
 936                 }
 937
 938                 ZERO_STRUCTP(domain_state);
 939
 940                 fstrcpy(domain_state->domain_name, domain->name);
 941
 942                 /* Add to list of open domains */
 943
 944                 DLIST_ADD(state->getgrent_state, domain_state);
 945         }
 946
 947         state->getgrent_initialized = True;
 948         return True;
 949 }
 950
 951 void winbindd_setgrent(struct winbindd_cli_state *state)
 952 {
 953         if (winbindd_setgrent_internal(state)) {
 954                 request_ok(state);
 955         } else {
 956                 request_error(state);
 957         }
 958 }
 959
 960 /* Close file pointer to ntdom group database */
 961
 962 void winbindd_endgrent(struct winbindd_cli_state *state)
 963 {
 964         DEBUG(3, ("[%5lu]: endgrent\n", (unsigned long)state->pid));
 965
 966         free_getent_state(state->getgrent_state);
 967         state->getgrent_initialized = False;
 968         state->getgrent_state = NULL;
 969         request_ok(state);
 970 }
 971
 972 /* Get the list of domain groups and domain aliases for a domain.  We fill in
 973    the sam_entries and num_sam_entries fields with domain group information.
 974    The dispinfo_ndx field is incremented to the index of the next group to
 975    fetch. Return True if some groups were returned, False otherwise. */
 976
 977 static bool get_sam_group_entries(struct getent_state *ent)
 978 {
 979         NTSTATUS status;
 980         uint32 num_entries;
 981         struct acct_info *name_list = NULL;
 982         TALLOC_CTX *mem_ctx;
 983         bool result = False;
 984         struct acct_info *sam_grp_entries = NULL;
 985         struct winbindd_domain *domain;
 986
 987         if (ent->got_sam_entries)
 988                 return False;
 989
 990         if (!(mem_ctx = talloc_init("get_sam_group_entries(%s)",
 991                                           ent->domain_name))) {
 992                 DEBUG(1, ("get_sam_group_entries: could not create talloc context!\n"));
 993                 return False;
 994         }
 995
 996         /* Free any existing group info */
 997
 998         SAFE_FREE(ent->sam_entries);
 999         ent->num_sam_entries = 0;
1000         ent->got_sam_entries = True;
1001
1002         /* Enumerate domain groups */
1003
1004         num_entries = 0;
1005
1006         if (!(domain = find_domain_from_name(ent->domain_name))) {
1007                 DEBUG(3, ("no such domain %s in get_sam_group_entries\n", ent->domain_name));
1008                 goto done;
1009         }
1010
1011         /* always get the domain global groups */
1012
1013         status = domain->methods->enum_dom_groups(domain, mem_ctx, &num_entries, &sam_grp_entries);
1014
1015         if (!NT_STATUS_IS_OK(status)) {
1016                 DEBUG(3, ("get_sam_group_entries: could not enumerate domain groups! Error: %s\n", nt_errstr(status)));
1017                 result = False;
1018                 goto done;
1019         }
1020
1021         /* Copy entries into return buffer */
1022
1023         if (num_entries) {
1024                 if ( !(name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries)) ) {
1025                         DEBUG(0,("get_sam_group_entries: Failed to malloc memory for %d domain groups!\n",
1026                                 num_entries));
1027                         result = False;
1028                         goto done;
1029                 }
1030                 memcpy( name_list, sam_grp_entries, num_entries * sizeof(struct acct_info) );
1031         }
1032
1033         ent->num_sam_entries = num_entries;
1034
1035         /* get the domain local groups if we are a member of a native win2k domain
1036            and are not using LDAP to get the groups */
1037
1038         if ( ( lp_security() != SEC_ADS && domain->native_mode
1039                 && domain->primary) || domain->internal )
1040         {
1041                 DEBUG(4,("get_sam_group_entries: %s domain; enumerating local groups as well\n",
1042                         domain->native_mode ? "Native Mode 2k":"BUILTIN or local"));
1043
1044                 status = domain->methods->enum_local_groups(domain, mem_ctx, &num_entries, &sam_grp_entries);
1045
1046                 if ( !NT_STATUS_IS_OK(status) ) {
1047                         DEBUG(3,("get_sam_group_entries: "
1048                                 "Failed to enumerate "
1049                                 "domain local groups with error %s!\n",
1050                                 nt_errstr(status)));
1051                         num_entries = 0;
1052                 }
1053                 else
1054                         DEBUG(4,("get_sam_group_entries: Returned %d local groups\n", num_entries));
1055
1056                 /* Copy entries into return buffer */
1057
1058                 if ( num_entries ) {
1059                         if ( !(name_list = SMB_REALLOC_ARRAY( name_list, struct acct_info, ent->num_sam_entries+num_entries)) )
1060                         {
1061                                 DEBUG(0,("get_sam_group_entries: Failed to realloc more memory for %d local groups!\n",
1062                                         num_entries));
1063                                 result = False;
1064                                 goto done;
1065                         }
1066
1067                         memcpy( &name_list[ent->num_sam_entries], sam_grp_entries,
1068                                 num_entries * sizeof(struct acct_info) );
1069                 }
1070
1071                 ent->num_sam_entries += num_entries;
1072         }
1073
1074
1075         /* Fill in remaining fields */
1076
1077         ent->sam_entries = name_list;
1078         ent->sam_entry_index = 0;
1079
1080         result = (ent->num_sam_entries > 0);
1081
1082  done:
1083         talloc_destroy(mem_ctx);
1084
1085         return result;
1086 }
1087
1088 /* Fetch next group entry from ntdom database */
1089
1090 #define MAX_GETGRENT_GROUPS 500
1091
1092 void winbindd_getgrent(struct winbindd_cli_state *state)
1093 {
1094         struct getent_state *ent;
1095         struct winbindd_gr *group_list = NULL;
1096         int num_groups, group_list_ndx, gr_mem_list_len = 0;
1097         char *gr_mem_list = NULL;
1098
1099         DEBUG(3, ("[%5lu]: getgrent\n", (unsigned long)state->pid));
1100
1101         /* Check user has enabled this */
1102
1103         if (!lp_winbind_enum_groups()) {
1104                 request_error(state);
1105                 return;
1106         }
1107
1108         num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);
1109
1110         if (num_groups == 0) {
1111                 request_error(state);
1112                 return;
1113         }
1114
1115         if ((state->response.extra_data.data = SMB_MALLOC_ARRAY(struct winbindd_gr, num_groups)) == NULL) {
1116                 request_error(state);
1117                 return;
1118         }
1119
1120         memset(state->response.extra_data.data, '\0',
1121                 num_groups * sizeof(struct winbindd_gr) );
1122
1123         state->response.data.num_entries = 0;
1124
1125         group_list = (struct winbindd_gr *)state->response.extra_data.data;
1126
1127         if (!state->getgrent_initialized)
1128                 winbindd_setgrent_internal(state);
1129
1130         if (!(ent = state->getgrent_state)) {
1131                 request_error(state);
1132                 return;
1133         }
1134
1135         /* Start sending back groups */
1136
1137         for (group_list_ndx = 0; group_list_ndx < num_groups; ) {
1138                 struct acct_info *name_list = NULL;
1139                 fstring domain_group_name;
1140                 uint32 result;
1141                 gid_t group_gid;
1142                 size_t gr_mem_len;
1143                 char *gr_mem;
1144                 DOM_SID group_sid;
1145                 struct winbindd_domain *domain;
1146
1147                 /* Do we need to fetch another chunk of groups? */
1148
1149         tryagain:
1150
1151                 DEBUG(10, ("entry_index = %d, num_entries = %d\n",
1152                            ent->sam_entry_index, ent->num_sam_entries));
1153
1154                 if (ent->num_sam_entries == ent->sam_entry_index) {
1155
1156                         while(ent && !get_sam_group_entries(ent)) {
1157                                 struct getent_state *next_ent;
1158
1159                                 DEBUG(10, ("freeing state info for domain %s\n", ent->domain_name));
1160
1161                                 /* Free state information for this domain */
1162
1163                                 SAFE_FREE(ent->sam_entries);
1164
1165                                 next_ent = ent->next;
1166                                 DLIST_REMOVE(state->getgrent_state, ent);
1167
1168                                 SAFE_FREE(ent);
1169                                 ent = next_ent;
1170                         }
1171
1172                         /* No more domains */
1173
1174                         if (!ent)
1175                                 break;
1176                 }
1177
1178                 name_list = (struct acct_info *)ent->sam_entries;
1179
1180                 if (!(domain =
1181                       find_domain_from_name(ent->domain_name))) {
1182                         DEBUG(3, ("No such domain %s in winbindd_getgrent\n", ent->domain_name));
1183                         result = False;
1184                         goto done;
1185                 }
1186
1187                 /* Lookup group info */
1188
1189                 sid_copy(&group_sid, &domain->sid);
1190                 sid_append_rid(&group_sid, name_list[ent->sam_entry_index].rid);
1191
1192                 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid, &group_gid))) {
1193                         union unid_t id;
1194                         enum lsa_SidType type;
1195
1196                         DEBUG(10, ("SID %s not in idmap\n",
1197                                    sid_string_dbg(&group_sid)));
1198
1199                         if (!pdb_sid_to_id(&group_sid, &id, &type)) {
1200                                 DEBUG(1, ("could not look up gid for group "
1201                                           "%s\n",
1202                                           name_list[ent->sam_entry_index].acct_name));
1203                                 ent->sam_entry_index++;
1204                                 goto tryagain;
1205                         }
1206
1207                         if ((type != SID_NAME_DOM_GRP) &&
1208                             (type != SID_NAME_ALIAS) &&
1209                             (type != SID_NAME_WKN_GRP)) {
1210                                 DEBUG(1, ("Group %s is a %s, not a group\n",
1211                                           sid_type_lookup(type),
1212                                           name_list[ent->sam_entry_index].acct_name));
1213                                 ent->sam_entry_index++;
1214                                 goto tryagain;
1215                         }
1216                         group_gid = id.gid;
1217                 }
1218
1219                 DEBUG(10, ("got gid %lu for group %lu\n", (unsigned long)group_gid,
1220                            (unsigned long)name_list[ent->sam_entry_index].rid));
1221
1222                 /* Fill in group entry */
1223
1224                 fill_domain_username(domain_group_name, ent->domain_name,
1225                          name_list[ent->sam_entry_index].acct_name, True);
1226
1227                 result = fill_grent(&group_list[group_list_ndx],
1228                                     ent->domain_name,
1229                                     name_list[ent->sam_entry_index].acct_name,
1230                                     group_gid);
1231
1232                 /* Fill in group membership entry */
1233
1234                 if (result) {
1235                         size_t num_gr_mem = 0;
1236                         DOM_SID member_sid;
1237                         group_list[group_list_ndx].num_gr_mem = 0;
1238                         gr_mem = NULL;
1239                         gr_mem_len = 0;
1240
1241                         /* Get group membership */
1242                         if (state->request.cmd == WINBINDD_GETGRLST) {
1243                                 result = True;
1244                         } else {
1245                                 sid_copy(&member_sid, &domain->sid);
1246                                 sid_append_rid(&member_sid, name_list[ent->sam_entry_index].rid);
1247                                 result = fill_grent_mem(
1248                                         domain,
1249                                         NULL,
1250                                         &member_sid,
1251                                         SID_NAME_DOM_GRP,
1252                                         &num_gr_mem,
1253                                         &gr_mem, &gr_mem_len);
1254
1255                                 group_list[group_list_ndx].num_gr_mem = (uint32)num_gr_mem;
1256                         }
1257                 }
1258
1259                 if (result) {
1260                         /* Append to group membership list */
1261                         gr_mem_list = (char *)SMB_REALLOC(
1262                                 gr_mem_list, gr_mem_list_len + gr_mem_len);
1263
1264                         if (!gr_mem_list && (group_list[group_list_ndx].num_gr_mem != 0)) {
1265                                 DEBUG(0, ("out of memory\n"));
1266                                 gr_mem_list_len = 0;
1267                                 break;
1268                         }
1269
1270                         DEBUG(10, ("list_len = %d, mem_len = %u\n",
1271                                    gr_mem_list_len, (unsigned int)gr_mem_len));
1272
1273                         memcpy(&gr_mem_list[gr_mem_list_len], gr_mem,
1274                                gr_mem_len);
1275
1276                         SAFE_FREE(gr_mem);
1277
1278                         group_list[group_list_ndx].gr_mem_ofs =
1279                                 gr_mem_list_len;
1280
1281                         gr_mem_list_len += gr_mem_len;
1282                 }
1283
1284                 ent->sam_entry_index++;
1285
1286                 /* Add group to return list */
1287
1288                 if (result) {
1289
1290                         DEBUG(10, ("adding group num_entries = %d\n",
1291                                    state->response.data.num_entries));
1292
1293                         group_list_ndx++;
1294                         state->response.data.num_entries++;
1295
1296                         state->response.length +=
1297                                 sizeof(struct winbindd_gr);
1298
1299                 } else {
1300                         DEBUG(0, ("could not lookup domain group %s\n",
1301                                   domain_group_name));
1302                 }
1303         }
1304
1305         /* Copy the list of group memberships to the end of the extra data */
1306
1307         if (group_list_ndx == 0)
1308                 goto done;
1309
1310         state->response.extra_data.data = SMB_REALLOC(
1311                 state->response.extra_data.data,
1312                 group_list_ndx * sizeof(struct winbindd_gr) + gr_mem_list_len);
1313
1314         if (!state->response.extra_data.data) {
1315                 DEBUG(0, ("out of memory\n"));
1316                 group_list_ndx = 0;
1317                 SAFE_FREE(gr_mem_list);
1318                 request_error(state);
1319                 return;
1320         }
1321
1322         memcpy(&((char *)state->response.extra_data.data)
1323                [group_list_ndx * sizeof(struct winbindd_gr)],
1324                gr_mem_list, gr_mem_list_len);
1325
1326         state->response.length += gr_mem_list_len;
1327
1328         DEBUG(10, ("returning %d groups, length = %d\n",
1329                    group_list_ndx, gr_mem_list_len));
1330
1331         /* Out of domains */
1332
1333  done:
1334
1335         SAFE_FREE(gr_mem_list);
1336
1337         if (group_list_ndx > 0)
1338                 request_ok(state);
1339         else
1340                 request_error(state);
1341 }
1342
1343 /* List domain groups without mapping to unix ids */
1344
1345 void winbindd_list_groups(struct winbindd_cli_state *state)
1346 {
1347         uint32 total_entries = 0;
1348         struct winbindd_domain *domain;
1349         const char *which_domain;
1350         char *extra_data = NULL;
1351         unsigned int extra_data_len = 0, i;
1352
1353         DEBUG(3, ("[%5lu]: list groups\n", (unsigned long)state->pid));
1354
1355         /* Ensure null termination */
1356         state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
1357         which_domain = state->request.domain_name;
1358
1359         /* Enumerate over trusted domains */
1360
1361         for (domain = domain_list(); domain; domain = domain->next) {
1362                 struct getent_state groups;
1363
1364                 /* if we have a domain name restricting the request and this
1365                    one in the list doesn't match, then just bypass the remainder
1366                    of the loop */
1367
1368                 if ( *which_domain && !strequal(which_domain, domain->name) )
1369                         continue;
1370
1371                 ZERO_STRUCT(groups);
1372
1373                 /* Get list of sam groups */
1374
1375                 fstrcpy(groups.domain_name, domain->name);
1376
1377                 get_sam_group_entries(&groups);
1378
1379                 if (groups.num_sam_entries == 0) {
1380                         /* this domain is empty or in an error state */
1381                         continue;
1382                 }
1383
1384                 /* keep track the of the total number of groups seen so
1385                    far over all domains */
1386                 total_entries += groups.num_sam_entries;
1387
1388                 /* Allocate some memory for extra data.  Note that we limit
1389                    account names to sizeof(fstring) = 128 characters.  */
1390                 extra_data = (char *)SMB_REALLOC(
1391                         extra_data, sizeof(fstring) * total_entries);
1392
1393                 if (!extra_data) {
1394                         DEBUG(0,("failed to enlarge buffer!\n"));
1395                         request_error(state);
1396                         return;
1397                 }
1398
1399                 /* Pack group list into extra data fields */
1400                 for (i = 0; i < groups.num_sam_entries; i++) {
1401                         char *group_name = ((struct acct_info *)
1402                                             groups.sam_entries)[i].acct_name;
1403                         fstring name;
1404
1405                         fill_domain_username(name, domain->name, group_name, True);
1406                         /* Append to extra data */
1407                         memcpy(&extra_data[extra_data_len], name,
1408                                strlen(name));
1409                         extra_data_len += strlen(name);
1410                         extra_data[extra_data_len++] = ',';
1411                 }
1412
1413                 SAFE_FREE(groups.sam_entries);
1414         }
1415
1416         /* Assign extra_data fields in response structure */
1417         if (extra_data) {
1418                 extra_data[extra_data_len - 1] = '\0';
1419                 state->response.extra_data.data = extra_data;
1420                 state->response.length += extra_data_len;
1421         }
1422
1423         /* No domains may have responded but that's still OK so don't
1424            return an error. */
1425
1426         request_ok(state);
1427 }
1428
1429 /* Get user supplementary groups.  This is much quicker than trying to
1430    invert the groups database.  We merge the groups from the gids and
1431    other_sids info3 fields as trusted domain, universal group
1432    memberships, and nested groups (win2k native mode only) are not
1433    returned by the getgroups RPC call but are present in the info3. */
1434
1435 struct getgroups_state {
1436         struct winbindd_cli_state *state;
1437         struct winbindd_domain *domain;
1438         char *domname;
1439         char *username;
1440         DOM_SID user_sid;
1441
1442         const DOM_SID *token_sids;
1443         size_t i, num_token_sids;
1444
1445         gid_t *token_gids;
1446         size_t num_token_gids;
1447 };
1448
1449 static void getgroups_usersid_recv(void *private_data, bool success,
1450                                    const DOM_SID *sid, enum lsa_SidType type);
1451 static void getgroups_tokensids_recv(void *private_data, bool success,
1452                                      DOM_SID *token_sids, size_t num_token_sids);
1453 static void getgroups_sid2gid_recv(void *private_data, bool success, gid_t gid);
1454
1455 void winbindd_getgroups(struct winbindd_cli_state *state)
1456 {
1457         struct getgroups_state *s;
1458
1459         /* Ensure null termination */
1460         state->request.data.username
1461                 [sizeof(state->request.data.username)-1]='\0';
1462
1463         DEBUG(3, ("[%5lu]: getgroups %s\n", (unsigned long)state->pid,
1464                   state->request.data.username));
1465
1466         /* Parse domain and username */
1467
1468         s = TALLOC_P(state->mem_ctx, struct getgroups_state);
1469         if (s == NULL) {
1470                 DEBUG(0, ("talloc failed\n"));
1471                 request_error(state);
1472                 return;
1473         }
1474
1475         s->state = state;
1476
1477         ws_name_return( state->request.data.username, WB_REPLACE_CHAR );
1478
1479         if (!parse_domain_user_talloc(state->mem_ctx,
1480                                       state->request.data.username,
1481                                       &s->domname, &s->username)) {
1482                 DEBUG(5, ("Could not parse domain user: %s\n",
1483                           state->request.data.username));
1484
1485                 /* error out if we do not have nested group support */
1486
1487                 if ( !lp_winbind_nested_groups() ) {
1488                         request_error(state);
1489                         return;
1490                 }
1491
1492                 s->domname = talloc_strdup( state->mem_ctx, get_global_sam_name() );
1493                 s->username = talloc_strdup( state->mem_ctx, state->request.data.username );
1494         }
1495
1496         /* Get info for the domain (either by short domain name or
1497            DNS name in the case of a UPN) */
1498
1499         s->domain = find_domain_from_name_noinit(s->domname);
1500         if (!s->domain) {
1501                 char *p = strchr(s->username, '@');
1502
1503                 if (p) {
1504                         s->domain = find_domain_from_name_noinit(p+1);
1505                 }
1506
1507         }
1508
1509         if (s->domain == NULL) {
1510                 DEBUG(7, ("could not find domain entry for domain %s\n",
1511                           s->domname));
1512                 request_error(state);
1513                 return;
1514         }
1515
1516         if ( s->domain->primary && lp_winbind_trusted_domains_only()) {
1517                 DEBUG(7,("winbindd_getgroups: My domain -- rejecting "
1518                          "getgroups() for %s\\%s.\n", s->domname,
1519                          s->username));
1520                 request_error(state);
1521                 return;
1522         }
1523
1524         /* Get rid and name type from name.  The following costs 1 packet */
1525
1526         winbindd_lookupname_async(state->mem_ctx, s->domname, s->username,
1527                                   getgroups_usersid_recv, WINBINDD_GETGROUPS, s);
1528 }
1529
1530 static void getgroups_usersid_recv(void *private_data, bool success,
1531                                    const DOM_SID *sid, enum lsa_SidType type)
1532 {
1533         struct getgroups_state *s =
1534                 (struct getgroups_state *)private_data;
1535
1536         if ((!success) ||
1537             ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER))) {
1538                 request_error(s->state);
1539                 return;
1540         }
1541
1542         sid_copy(&s->user_sid, sid);
1543
1544         winbindd_gettoken_async(s->state->mem_ctx, &s->user_sid,
1545                                 getgroups_tokensids_recv, s);
1546 }
1547
1548 static void getgroups_tokensids_recv(void *private_data, bool success,
1549                                      DOM_SID *token_sids, size_t num_token_sids)
1550 {
1551         struct getgroups_state *s =
1552                 (struct getgroups_state *)private_data;
1553
1554         /* We need at least the user sid and the primary group in the token,
1555          * otherwise it's an error */
1556
1557         if ((!success) || (num_token_sids < 2)) {
1558                 request_error(s->state);
1559                 return;
1560         }
1561
1562         s->token_sids = token_sids;
1563         s->num_token_sids = num_token_sids;
1564         s->i = 0;
1565
1566         s->token_gids = NULL;
1567         s->num_token_gids = 0;
1568
1569         getgroups_sid2gid_recv(s, False, 0);
1570 }
1571
1572 static void getgroups_sid2gid_recv(void *private_data, bool success, gid_t gid)
1573 {
1574         struct getgroups_state *s =
1575                 (struct getgroups_state *)private_data;
1576
1577         if (success) {
1578                 if (!add_gid_to_array_unique(s->state->mem_ctx, gid,
1579                                         &s->token_gids,
1580                                         &s->num_token_gids)) {
1581                         return;
1582                 }
1583         }
1584
1585         if (s->i < s->num_token_sids) {
1586                 const DOM_SID *sid = &s->token_sids[s->i];
1587                 s->i += 1;
1588
1589                 if (sid_equal(sid, &s->user_sid)) {
1590                         getgroups_sid2gid_recv(s, False, 0);
1591                         return;
1592                 }
1593
1594                 winbindd_sid2gid_async(s->state->mem_ctx, sid,
1595                                        getgroups_sid2gid_recv, s);
1596                 return;
1597         }
1598
1599         s->state->response.data.num_entries = s->num_token_gids;
1600         if (s->num_token_gids) {
1601                 /* s->token_gids are talloced */
1602                 s->state->response.extra_data.data = smb_xmemdup(s->token_gids, s->num_token_gids * sizeof(gid_t));
1603                 s->state->response.length += s->num_token_gids * sizeof(gid_t);
1604         }
1605         request_ok(s->state);
1606 }
1607
1608 /* Get user supplementary sids. This is equivalent to the
1609    winbindd_getgroups() function but it involves a SID->SIDs mapping
1610    rather than a NAME->SID->SIDS->GIDS mapping, which means we avoid
1611    idmap. This call is designed to be used with applications that need
1612    to do ACL evaluation themselves. Note that the cached info3 data is
1613    not used
1614
1615    this function assumes that the SID that comes in is a user SID. If
1616    you pass in another type of SID then you may get unpredictable
1617    results.
1618 */
1619
1620 static void getusersids_recv(void *private_data, bool success, DOM_SID *sids,
1621                              size_t num_sids);
1622
1623 void winbindd_getusersids(struct winbindd_cli_state *state)
1624 {
1625         DOM_SID *user_sid;
1626
1627         /* Ensure null termination */
1628         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1629
1630         user_sid = TALLOC_P(state->mem_ctx, DOM_SID);
1631         if (user_sid == NULL) {
1632                 DEBUG(1, ("talloc failed\n"));
1633                 request_error(state);
1634                 return;
1635         }
1636
1637         if (!string_to_sid(user_sid, state->request.data.sid)) {
1638                 DEBUG(1, ("Could not get convert sid %s from string\n",
1639                           state->request.data.sid));
1640                 request_error(state);
1641                 return;
1642         }
1643
1644         winbindd_gettoken_async(state->mem_ctx, user_sid, getusersids_recv,
1645                                 state);
1646 }
1647
1648 static void getusersids_recv(void *private_data, bool success, DOM_SID *sids,
1649                              size_t num_sids)
1650 {
1651         struct winbindd_cli_state *state =
1652                 (struct winbindd_cli_state *)private_data;
1653         char *ret = NULL;
1654         unsigned ofs, ret_size = 0;
1655         size_t i;
1656
1657         if (!success) {
1658                 request_error(state);
1659                 return;
1660         }
1661
1662         /* work out the response size */
1663         for (i = 0; i < num_sids; i++) {
1664                 fstring s;
1665                 sid_to_fstring(s, &sids[i]);
1666                 ret_size += strlen(s) + 1;
1667         }
1668
1669         /* build the reply */
1670         ret = (char *)SMB_MALLOC(ret_size);
1671         if (!ret) {
1672                 DEBUG(0, ("malloc failed\n"));
1673                 request_error(state);
1674                 return;
1675         }
1676         ofs = 0;
1677         for (i = 0; i < num_sids; i++) {
1678                 fstring s;
1679                 sid_to_fstring(s, &sids[i]);
1680                 safe_strcpy(ret + ofs, s, ret_size - ofs - 1);
1681                 ofs += strlen(ret+ofs) + 1;
1682         }
1683
1684         /* Send data back to client */
1685         state->response.data.num_entries = num_sids;
1686         state->response.extra_data.data = ret;
1687         state->response.length += ret_size;
1688         request_ok(state);
1689 }
1690
1691 void winbindd_getuserdomgroups(struct winbindd_cli_state *state)
1692 {
1693         DOM_SID user_sid;
1694         struct winbindd_domain *domain;
1695
1696         /* Ensure null termination */
1697         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1698
1699         if (!string_to_sid(&user_sid, state->request.data.sid)) {
1700                 DEBUG(1, ("Could not get convert sid %s from string\n",
1701                           state->request.data.sid));
1702                 request_error(state);
1703                 return;
1704         }
1705
1706         /* Get info for the domain */
1707         if ((domain = find_domain_from_sid_noinit(&user_sid)) == NULL) {
1708                 DEBUG(0,("could not find domain entry for sid %s\n",
1709                          sid_string_dbg(&user_sid)));
1710                 request_error(state);
1711                 return;
1712         }
1713
1714         sendto_domain(state, domain);
1715 }
1716
1717 enum winbindd_result winbindd_dual_getuserdomgroups(struct winbindd_domain *domain,
1718                                                     struct winbindd_cli_state *state)
1719 {
1720         DOM_SID user_sid;
1721         NTSTATUS status;
1722
1723         char *sidstring;
1724         ssize_t len;
1725         DOM_SID *groups;
1726         uint32 num_groups;
1727
1728         /* Ensure null termination */
1729         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1730
1731         if (!string_to_sid(&user_sid, state->request.data.sid)) {
1732                 DEBUG(1, ("Could not get convert sid %s from string\n",
1733                           state->request.data.sid));
1734                 return WINBINDD_ERROR;
1735         }
1736
1737         status = domain->methods->lookup_usergroups(domain, state->mem_ctx,
1738                                                     &user_sid, &num_groups,
1739                                                     &groups);
1740         if (!NT_STATUS_IS_OK(status))
1741                 return WINBINDD_ERROR;
1742
1743         if (num_groups == 0) {
1744                 state->response.data.num_entries = 0;
1745                 state->response.extra_data.data = NULL;
1746                 return WINBINDD_OK;
1747         }
1748
1749         if (!print_sidlist(state->mem_ctx, groups, num_groups, &sidstring, &len)) {
1750                 DEBUG(0, ("talloc failed\n"));
1751                 return WINBINDD_ERROR;
1752         }
1753
1754         state->response.extra_data.data = SMB_STRDUP(sidstring);
1755         if (!state->response.extra_data.data) {
1756                 return WINBINDD_ERROR;
1757         }
1758         state->response.length += len+1;
1759         state->response.data.num_entries = num_groups;
1760
1761         return WINBINDD_OK;
1762 }