From 8daa83a594a2e98f39d764422bfbdbc62c9efd44 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:20:00 +0200 Subject: Adding upstream version 2:4.20.0+dfsg. Signed-off-by: Daniel Baumann --- source3/winbindd/wb_lookupsids.c | 699 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 699 insertions(+) create mode 100644 source3/winbindd/wb_lookupsids.c (limited to 'source3/winbindd/wb_lookupsids.c') diff --git a/source3/winbindd/wb_lookupsids.c b/source3/winbindd/wb_lookupsids.c new file mode 100644 index 0000000..828e79e --- /dev/null +++ b/source3/winbindd/wb_lookupsids.c @@ -0,0 +1,699 @@ +/* + Unix SMB/CIFS implementation. + async lookupsids + Copyright (C) Volker Lendecke 2011 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "winbindd.h" +#include "lib/util_unixsids.h" +#include "librpc/gen_ndr/ndr_winbind_c.h" +#include "../libcli/security/security.h" +#include "passdb/machine_sid.h" +#include "lsa.h" + +struct wb_lookupsids_domain { + struct winbindd_domain *domain; + + /* + * Array of sids to be passed into wbint_LookupSids. Preallocated with + * num_sids. + */ + struct lsa_SidArray sids; + + /* + * Indexes into wb_lookupsids_state->sids and thus + * wb_lookupsids_state->res_names. Preallocated with num_sids. + */ + uint32_t *sid_indexes; +}; + +struct wb_translated_name { + const char *domain_name; + const char *name; + enum lsa_SidType type; +}; + +static struct wb_lookupsids_domain *wb_lookupsids_get_domain( + const struct dom_sid *sid, TALLOC_CTX *mem_ctx, + struct wb_lookupsids_domain **domains, uint32_t num_sids); + +struct wb_lookupsids_state { + struct tevent_context *ev; + + /* + * SIDs passed in + */ + struct dom_sid *sids; + uint32_t num_sids; + + /* + * The domains we're using for bulk lookup via wbint_LookupRids or + * wbint_LookupSids. We expect very few domains, so we do a + * talloc_realloc and rely on talloc_array_length. + */ + struct wb_lookupsids_domain *domains; + uint32_t domains_done; + + /* + * These SIDs are looked up individually via + * wbint_LookupSid. Preallocated with num_sids. + */ + uint32_t *single_sids; + uint32_t num_single_sids; + uint32_t single_sids_done; + + /* + * Intermediate store for wbint_LookupRids to passdb. These are + * spliced into res_domains/res_names in wb_lookupsids_move_name. + */ + struct wbint_RidArray rids; + const char *domain_name; + struct wbint_Principals rid_names; + + /* + * Intermediate results for wbint_LookupSids. These results are + * spliced into res_domains/res_names in wb_lookupsids_move_name. + */ + struct lsa_RefDomainList tmp_domains; + struct lsa_TransNameArray tmp_names; + + /* + * Results + */ + struct lsa_RefDomainList *res_domains; + /* + * Indexed as "sids" in this structure + */ + struct lsa_TransNameArray *res_names; +}; + +static bool wb_lookupsids_next(struct tevent_req *req, + struct wb_lookupsids_state *state); +static void wb_lookupsids_single_done(struct tevent_req *subreq); +static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq); +static void wb_lookupsids_done(struct tevent_req *subreq); + +struct tevent_req *wb_lookupsids_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct dom_sid *sids, + uint32_t num_sids) +{ + struct tevent_req *req; + struct wb_lookupsids_state *state; + uint32_t i; + + req = tevent_req_create(mem_ctx, &state, struct wb_lookupsids_state); + if (req == NULL) { + return NULL; + } + + D_INFO("WB command lookupsids start.\nLooking up %"PRIu32" SID(s)\n", + num_sids); + if (CHECK_DEBUGLVL(DBGLVL_INFO)) { + for (i = 0; i < num_sids; i++) { + struct dom_sid_buf buf; + D_INFO("%"PRIu32": %s\n", + i, dom_sid_str_buf(&sids[i], &buf)); + } + } + + state->ev = ev; + state->sids = sids; + state->num_sids = num_sids; + + state->single_sids = talloc_zero_array(state, uint32_t, num_sids); + if (tevent_req_nomem(state->single_sids, req)) { + return tevent_req_post(req, ev); + } + + state->res_domains = talloc_zero(state, struct lsa_RefDomainList); + if (tevent_req_nomem(state->res_domains, req)) { + return tevent_req_post(req, ev); + } + state->res_domains->domains = talloc_zero_array( + state->res_domains, struct lsa_DomainInfo, num_sids); + if (tevent_req_nomem(state->res_domains->domains, req)) { + return tevent_req_post(req, ev); + } + + state->res_names = talloc_zero(state, struct lsa_TransNameArray); + if (tevent_req_nomem(state->res_names, req)) { + return tevent_req_post(req, ev); + } + state->res_names->names = talloc_zero_array( + state->res_names, struct lsa_TranslatedName, num_sids); + if (tevent_req_nomem(state->res_names->names, req)) { + return tevent_req_post(req, ev); + } + + if (num_sids == 0) { + tevent_req_done(req); + return tevent_req_post(req, ev); + } + + for (i=0; idomains, + num_sids); + if (d != NULL) { + d->sids.sids[d->sids.num_sids].sid = &sids[i]; + d->sid_indexes[d->sids.num_sids] = i; + d->sids.num_sids += 1; + } else { + state->single_sids[state->num_single_sids] = i; + state->num_single_sids += 1; + } + } + + if (!wb_lookupsids_next(req, state)) { + return tevent_req_post(req, ev); + } + return req; +} + +static bool wb_lookupsids_next(struct tevent_req *req, + struct wb_lookupsids_state *state) +{ + struct tevent_req *subreq; + + if (state->domains_done < talloc_array_length(state->domains)) { + struct wb_lookupsids_domain *d; + uint32_t i; + + d = &state->domains[state->domains_done]; + + if (d->domain->internal) { + /* + * This is only our local SAM, + * see wb_lookupsids_bulk() and + * wb_lookupsids_get_domain(). + */ + state->rids.num_rids = d->sids.num_sids; + state->rids.rids = talloc_array(state, uint32_t, + state->rids.num_rids); + if (tevent_req_nomem(state->rids.rids, req)) { + return false; + } + for (i=0; irids.num_rids; i++) { + sid_peek_rid(d->sids.sids[i].sid, + &state->rids.rids[i]); + } + subreq = dcerpc_wbint_LookupRids_send( + state, state->ev, dom_child_handle(d->domain), + &d->domain->sid, &state->rids, &state->domain_name, + &state->rid_names); + if (tevent_req_nomem(subreq, req)) { + return false; + } + tevent_req_set_callback( + subreq, wb_lookupsids_lookuprids_done, req); + return true; + } + + subreq = dcerpc_wbint_LookupSids_send( + state, state->ev, dom_child_handle(d->domain), + &d->sids, &state->tmp_domains, &state->tmp_names); + if (tevent_req_nomem(subreq, req)) { + return false; + } + tevent_req_set_callback(subreq, wb_lookupsids_done, req); + return true; + } + + if (state->single_sids_done < state->num_single_sids) { + uint32_t sid_idx; + const struct dom_sid *sid; + + sid_idx = state->single_sids[state->single_sids_done]; + sid = &state->sids[sid_idx]; + + subreq = wb_lookupsid_send(state, state->ev, sid); + if (tevent_req_nomem(subreq, req)) { + return false; + } + tevent_req_set_callback(subreq, wb_lookupsids_single_done, + req); + return true; + } + + tevent_req_done(req); + return false; +} + +/* + * Decide whether to do bulk lookupsids. We have optimizations for + * passdb via lookuprids and to remote DCs via lookupsids. + */ + +static bool wb_lookupsids_bulk(const struct dom_sid *sid) +{ + struct dom_sid_buf sidbuf; + + if (sid->num_auths != 5) { + /* + * Only do "S-1-5-21-x-y-z-rid" domains via bulk + * lookup + */ + DBG_DEBUG("No bulk setup for SID %s with %"PRIi8" subauths\n", + dom_sid_str_buf(sid, &sidbuf), + sid->num_auths); + return false; + } + + if (sid_check_is_in_our_sam(sid)) { + /* + * Passdb lookup via lookuprids + */ + DBG_DEBUG("%s is in our domain\n", + dom_sid_str_buf(sid, &sidbuf)); + return true; + } + + if (IS_DC) { + /* + * Bulk lookups to trusted DCs + */ + return (find_domain_from_sid_noinit(sid) != NULL); + } + + if (lp_server_role() != ROLE_DOMAIN_MEMBER) { + /* + * Don't do bulk lookups as standalone, the only bulk + * lookup left is for domain members. + */ + return false; + } + + if (sid_check_is_in_unix_groups(sid) || + sid_check_is_unix_groups(sid) || + sid_check_is_in_unix_users(sid) || + sid_check_is_unix_users(sid) || + sid_check_is_in_builtin(sid) || + sid_check_is_builtin(sid) || + sid_check_is_wellknown_domain(sid, NULL) || + sid_check_is_in_wellknown_domain(sid)) + { + /* + * These are locally done piece by piece anyway, no + * need for bulk optimizations. + */ + return false; + } + + /* + * All other SIDs are sent to the DC we're connected to as + * member via a single lsa_lookupsids call. + */ + return true; +} + +static struct wb_lookupsids_domain *wb_lookupsids_get_domain( + const struct dom_sid *sid, TALLOC_CTX *mem_ctx, + struct wb_lookupsids_domain **pdomains, uint32_t num_sids) +{ + struct wb_lookupsids_domain *domains, *domain; + struct winbindd_domain *wb_domain; + uint32_t i, num_domains; + + if (!wb_lookupsids_bulk(sid)) { + D_DEBUG("wb_lookupsids_bulk() is FALSE\n"); + return NULL; + } + D_DEBUG("wb_lookupsids_bulk() is TRUE\n"); + + domains = *pdomains; + num_domains = talloc_array_length(domains); + + wb_domain = find_lookup_domain_from_sid(sid); + if (wb_domain == NULL) { + return NULL; + } + + D_DEBUG("Searching %"PRIu32" domain(s) for domain '%s'\n", + num_domains, wb_domain->name); + for (i=0; iinternal) { + /* + * If it's not our local sam, + * we can re-use the domain without + * checking the sid. + * + * Note the wb_lookupsids_bulk() above + * already caught special SIDs, + * e.g. the unix and builtin domains. + */ + return &domains[i]; + } + + if (dom_sid_compare_domain(sid, &domains[i].domain->sid) == 0) { + /* + * If it's out local sam we can also use it. + */ + return &domains[i]; + } + + /* + * I'm not sure if this can be triggered, + * as wb_lookupsids_bulk() should also catch this, + * but we need to make sure that we don't use + * wbint_LookupRids() without a SID match. + */ + return NULL; + } + + domains = talloc_realloc( + mem_ctx, domains, struct wb_lookupsids_domain, num_domains+1); + if (domains == NULL) { + return NULL; + } + *pdomains = domains; + + domain = &domains[num_domains]; + domain->domain = wb_domain; + + domain->sids.sids = talloc_zero_array(domains, struct lsa_SidPtr, num_sids); + if (domains->sids.sids == NULL) { + goto fail; + } + domain->sids.num_sids = 0; + + domain->sid_indexes = talloc_zero_array(domains, uint32_t, num_sids); + if (domain->sid_indexes == NULL) { + TALLOC_FREE(domain->sids.sids); + goto fail; + } + return domain; + +fail: + /* + * Realloc to the state it was in before + */ + *pdomains = talloc_realloc( + mem_ctx, domains, struct wb_lookupsids_domain, num_domains); + return NULL; +} + +static bool wb_lookupsids_find_dom_idx(struct lsa_DomainInfo *domain, + struct lsa_RefDomainList *list, + uint32_t *idx) +{ + uint32_t i; + struct lsa_DomainInfo *new_domain; + + for (i=0; icount; i++) { + if (dom_sid_equal(domain->sid, list->domains[i].sid)) { + *idx = i; + return true; + } + } + + new_domain = &list->domains[list->count]; + + new_domain->name.string = talloc_strdup( + list->domains, domain->name.string); + if (new_domain->name.string == NULL) { + return false; + } + + new_domain->sid = dom_sid_dup(list->domains, domain->sid); + if (new_domain->sid == NULL) { + return false; + } + + *idx = list->count; + list->count += 1; + return true; +} + +static bool wb_lookupsids_move_name(struct lsa_RefDomainList *src_domains, + struct lsa_TranslatedName *src_name, + struct lsa_RefDomainList *dst_domains, + struct lsa_TransNameArray *dst_names, + uint32_t dst_name_index) +{ + struct lsa_TranslatedName *dst_name; + struct lsa_DomainInfo *src_domain; + uint32_t src_domain_index; + uint32_t dst_domain_index = UINT32_MAX; + bool ok; + + src_domain_index = src_name->sid_index; + if ((src_domain_index != UINT32_MAX) && (src_domains != NULL)) { + if (src_domain_index >= src_domains->count) { + return false; + } + src_domain = &src_domains->domains[src_domain_index]; + + ok = wb_lookupsids_find_dom_idx(src_domain, + dst_domains, + &dst_domain_index); + if (!ok) { + return false; + } + } + + dst_name = &dst_names->names[dst_name_index]; + + dst_name->sid_type = src_name->sid_type; + dst_name->name.string = talloc_move(dst_names->names, + &src_name->name.string); + dst_name->sid_index = dst_domain_index; + dst_names->count += 1; + + return true; +} + +static void wb_lookupsids_done(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data( + subreq, struct tevent_req); + struct wb_lookupsids_state *state = tevent_req_data( + req, struct wb_lookupsids_state); + struct wb_lookupsids_domain *d; + uint32_t i; + + NTSTATUS status, result; + + status = dcerpc_wbint_LookupSids_recv(subreq, state, &result); + TALLOC_FREE(subreq); + if (tevent_req_nterror(req, status)) { + return; + } + if (NT_STATUS_LOOKUP_ERR(result)) { + tevent_req_nterror(req, result); + return; + } + + /* + * Look at the individual states in the translated names. + */ + + d = &state->domains[state->domains_done]; + + for (i=0; itmp_names.count; i++) { + uint32_t res_sid_index = d->sid_indexes[i]; + + if (!wb_lookupsids_move_name( + &state->tmp_domains, &state->tmp_names.names[i], + state->res_domains, state->res_names, + res_sid_index)) { + tevent_req_oom(req); + return; + } + } + state->domains_done += 1; + wb_lookupsids_next(req, state); +} + +static void wb_lookupsids_single_done(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data( + subreq, struct tevent_req); + struct wb_lookupsids_state *state = tevent_req_data( + req, struct wb_lookupsids_state); + const char *domain_name = NULL; + const char *name = NULL; + enum lsa_SidType type = SID_NAME_UNKNOWN; + uint32_t res_sid_index; + uint32_t src_rid; + + struct dom_sid src_domain_sid; + struct lsa_DomainInfo src_domain; + struct lsa_RefDomainList src_domains; + struct lsa_RefDomainList *psrc_domains = NULL; + struct lsa_TranslatedName src_name; + + uint32_t domain_idx = UINT32_MAX; + NTSTATUS status; + bool ok; + + status = wb_lookupsid_recv(subreq, talloc_tos(), &type, + &domain_name, &name); + TALLOC_FREE(subreq); + if (NT_STATUS_LOOKUP_ERR(status)) { + tevent_req_nterror(req, status); + return; + } + + res_sid_index = state->single_sids[state->single_sids_done]; + + if ((domain_name != NULL) && (domain_name[0] != '\0')) { + /* + * Build structs with the domain name for + * wb_lookupsids_move_name(). If we didn't get a name, we will + * pass NULL and UINT32_MAX. + */ + + sid_copy(&src_domain_sid, &state->sids[res_sid_index]); + if (type != SID_NAME_DOMAIN) { + sid_split_rid(&src_domain_sid, &src_rid); + } + + src_domain.name.string = domain_name; + src_domain.sid = &src_domain_sid; + + src_domains.count = 1; + src_domains.domains = &src_domain; + psrc_domains = &src_domains; + + domain_idx = 0; + } + + src_name.sid_type = type; + src_name.name.string = name; + src_name.sid_index = domain_idx; + + ok = wb_lookupsids_move_name(psrc_domains, + &src_name, + state->res_domains, + state->res_names, + res_sid_index); + if (!ok) { + tevent_req_oom(req); + return; + } + state->single_sids_done += 1; + wb_lookupsids_next(req, state); +} + +static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data( + subreq, struct tevent_req); + struct wb_lookupsids_state *state = tevent_req_data( + req, struct wb_lookupsids_state); + struct dom_sid src_domain_sid; + struct lsa_DomainInfo src_domain; + struct lsa_RefDomainList src_domains; + NTSTATUS status, result; + struct wb_lookupsids_domain *d; + uint32_t i; + + status = dcerpc_wbint_LookupRids_recv(subreq, state, &result); + TALLOC_FREE(subreq); + if (tevent_req_nterror(req, status)) { + return; + } + if (NT_STATUS_LOOKUP_ERR(result)) { + tevent_req_nterror(req, result); + return; + } + + /* + * Look at the individual states in the translated names. + */ + + d = &state->domains[state->domains_done]; + + sid_copy(&src_domain_sid, get_global_sam_sid()); + src_domain.name.string = get_global_sam_name(); + src_domain.sid = &src_domain_sid; + src_domains.count = 1; + src_domains.domains = &src_domain; + + for (i=0; irid_names.num_principals; i++) { + struct lsa_TranslatedName src_name; + uint32_t res_sid_index; + + /* + * Fake up structs for wb_lookupsids_move_name + */ + res_sid_index = d->sid_indexes[i]; + + src_name.sid_type = state->rid_names.principals[i].type; + src_name.name.string = state->rid_names.principals[i].name; + src_name.sid_index = 0; + + if (!wb_lookupsids_move_name( + &src_domains, &src_name, + state->res_domains, state->res_names, + res_sid_index)) { + tevent_req_oom(req); + return; + } + } + + state->domains_done += 1; + wb_lookupsids_next(req, state); +} + +NTSTATUS wb_lookupsids_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx, + struct lsa_RefDomainList **domains, + struct lsa_TransNameArray **names) +{ + struct wb_lookupsids_state *state = tevent_req_data( + req, struct wb_lookupsids_state); + NTSTATUS status; + + D_INFO("WB command lookupsids end.\n"); + if (tevent_req_is_nterror(req, &status)) { + D_WARNING("Failed with %s.\n", nt_errstr(status)); + return status; + } + + /* + * The returned names need to match the given sids, + * if not we have a bug in the code! + */ + if (state->res_names->count != state->num_sids) { + D_WARNING("Got %"PRIu32" returned name(s), but expected %"PRIu32"!\n", + state->res_names->count, state->num_sids); + return NT_STATUS_INTERNAL_ERROR; + } + + /* + * Not strictly needed, but it might make debugging in the callers + * easier in future, if the talloc_array_length() returns the + * expected result... + */ + state->res_domains->domains = talloc_realloc(state->res_domains, + state->res_domains->domains, + struct lsa_DomainInfo, + state->res_domains->count); + + *domains = talloc_move(mem_ctx, &state->res_domains); + *names = talloc_move(mem_ctx, &state->res_names); + D_INFO("Returning %"PRIu32" domain(s) and %"PRIu32" name(s).\n", + (*domains)->count, + (*names)->count); + return NT_STATUS_OK; +} -- cgit v1.2.3