diff options
| -rw-r--r-- | source3/lib/util_sid.c | 18 | ||||
| -rw-r--r-- | source3/lib/util_str.c | 18 | ||||
| -rw-r--r-- | source3/libads/ads_ldap.c | 104 | ||||
| -rw-r--r-- | source3/libads/ldap_utils.c | 25 | ||||
| -rw-r--r-- | source3/nsswitch/winbindd_ads.c | 22 | ||||
| -rw-r--r-- | source3/utils/net_ads.c | 68 |
6 files changed, 144 insertions, 111 deletions
diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c index 0710337637..307f3e3415 100644 --- a/source3/lib/util_sid.c +++ b/source3/lib/util_sid.c @@ -535,6 +535,24 @@ char *sid_binstring(const DOM_SID *sid) if (!buf) return NULL; sid_linearize(buf, len, sid); + s = binary_string_rfc2254(buf, len); + free(buf); + return s; +} + +/***************************************************************** + Return the binary string representation of a DOM_SID. + Caller must free. +*****************************************************************/ + +char *sid_binstring_hex(const DOM_SID *sid) +{ + char *buf, *s; + int len = sid_size(sid); + buf = SMB_MALLOC(len); + if (!buf) + return NULL; + sid_linearize(buf, len, sid); s = binary_string(buf, len); free(buf); return s; diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c index 439cbea6d9..df84fa90a5 100644 --- a/source3/lib/util_str.c +++ b/source3/lib/util_str.c @@ -1566,7 +1566,7 @@ void strupper_m(char *s) Caller must free. **/ -char *binary_string(char *buf, int len) +char *binary_string_rfc2254(char *buf, int len) { char *s; int i, j; @@ -1584,6 +1584,22 @@ char *binary_string(char *buf, int len) return s; } +char *binary_string(char *buf, int len) +{ + char *s; + int i, j; + const char *hex = "0123456789ABCDEF"; + s = SMB_MALLOC(len * 2 + 1); + if (!s) + return NULL; + for (j=i=0;i<len;i++) { + s[j] = hex[((unsigned char)buf[i]) >> 4]; + s[j+1] = hex[((unsigned char)buf[i]) & 0xF]; + j += 2; + } + s[j] = 0; + return s; +} /** Just a typesafety wrapper for snprintf into a pstring. **/ diff --git a/source3/libads/ads_ldap.c b/source3/libads/ads_ldap.c deleted file mode 100644 index 42821496c3..0000000000 --- a/source3/libads/ads_ldap.c +++ /dev/null @@ -1,104 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Winbind ADS backend functions - - Copyright (C) Andrew Tridgell 2001 - Copyright (C) Andrew Bartlett 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" -#ifdef HAVE_LDAP - -/* convert a sid to a DN */ - -ADS_STATUS ads_sid_to_dn(ADS_STRUCT *ads, - TALLOC_CTX *mem_ctx, - const DOM_SID *sid, - char **dn) -{ - ADS_STATUS rc; - LDAPMessage *msg = NULL; - LDAPMessage *entry = NULL; - char *ldap_exp; - char *sidstr = NULL; - int count; - char *dn2 = NULL; - - const char *attr[] = { - "dn", - NULL - }; - - if (!(sidstr = sid_binstring(sid))) { - DEBUG(1,("ads_sid_to_dn: sid_binstring failed!\n")); - rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if(!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr))) { - DEBUG(1,("ads_sid_to_dn: talloc_asprintf failed!\n")); - rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - rc = ads_search_retry(ads, (void **)(void *)&msg, ldap_exp, attr); - - if (!ADS_ERR_OK(rc)) { - DEBUG(1,("ads_sid_to_dn ads_search: %s\n", ads_errstr(rc))); - goto done; - } - - if ((count = ads_count_replies(ads, msg)) != 1) { - fstring sid_string; - DEBUG(1,("ads_sid_to_dn (sid=%s): Not found (count=%d)\n", - sid_to_string(sid_string, sid), count)); - rc = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - goto done; - } - - entry = ads_first_entry(ads, msg); - - dn2 = ads_get_dn(ads, entry); - - if (!dn2) { - rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - *dn = talloc_strdup(mem_ctx, dn2); - - if (!*dn) { - rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - rc = ADS_ERROR_NT(NT_STATUS_OK); - - DEBUG(3,("ads sid_to_dn mapped %s\n", dn2)); - - SAFE_FREE(dn2); -done: - if (msg) ads_msgfree(ads, msg); - if (dn2) ads_memfree(ads, dn2); - - SAFE_FREE(sidstr); - - return rc; -} - -#endif diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c index 18caa2c63a..105fd2e5b9 100644 --- a/source3/libads/ldap_utils.c +++ b/source3/libads/ldap_utils.c @@ -105,4 +105,29 @@ ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, void **res, return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE, "(objectclass=*)", attrs, res); } + +ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, void **res, + const DOM_SID *sid, + const char **attrs) +{ + char *dn, *sid_string; + ADS_STATUS status; + + sid_string = sid_binstring_hex(sid); + if (sid_string == NULL) { + return ADS_ERROR_NT(NT_STATUS_NO_MEMORY); + } + + if (!asprintf(&dn, "<SID=%s>", sid_string)) { + SAFE_FREE(sid_string); + return ADS_ERROR_NT(NT_STATUS_NO_MEMORY); + } + + status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE, + "(objectclass=*)", attrs, res); + SAFE_FREE(dn); + SAFE_FREE(sid_string); + return status; +} + #endif diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c index 5e0d4cfe8e..336f27e6a1 100644 --- a/source3/nsswitch/winbindd_ads.c +++ b/source3/nsswitch/winbindd_ads.c @@ -634,13 +634,8 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, goto done; } - rc = ads_sid_to_dn(ads, mem_ctx, sid, &user_dn); - if (!ADS_ERR_OK(rc)) { - status = ads_ntstatus(rc); - goto done; - } + rc = ads_search_retry_sid(ads, (void**)(void *)&msg, sid, attrs); - rc = ads_search_retry_dn(ads, (void**)(void *)&msg, user_dn, attrs); if (!ADS_ERR_OK(rc)) { status = ads_ntstatus(rc); DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n", @@ -648,6 +643,15 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, goto done; } + count = ads_count_replies(ads, msg); + if (count != 1) { + status = NT_STATUS_UNSUCCESSFUL; + DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: " + "invalid number of results (count=%d)\n", + sid_to_string(sid_string, sid), count)); + goto done; + } + if (!msg) { DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n", sid_to_string(sid_string, sid))); @@ -655,6 +659,12 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, goto done; } + user_dn = ads_get_dn(ads, msg); + if (user_dn == NULL) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) { DEBUG(1,("%s: No primary group for sid=%s !?\n", domain->name, sid_to_string(sid_string, sid))); diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c index 538a269614..c7e9529c97 100644 --- a/source3/utils/net_ads.c +++ b/source3/utils/net_ads.c @@ -55,6 +55,8 @@ int net_ads_usage(int argc, const char **argv) "\n\tperform a raw LDAP search and dump the results\n" "\nnet ads dn"\ "\n\tperform a raw LDAP search and dump attributes of a particular DN\n" +"\nnet ads sid"\ +"\n\tperform a raw LDAP search and dump attributes of a particular SID\n" "\nnet ads keytab"\ "\n\tcreates and updates the kerberos system keytab file\n" ); @@ -1387,6 +1389,71 @@ static int net_ads_dn(int argc, const char **argv) return 0; } +/* + help for net ads sid search +*/ +static int net_ads_sid_usage(int argc, const char **argv) +{ + d_printf( + "\nnet ads sid <sid> <attributes...>\n"\ + "\nperform a raw LDAP search on a ADS server and dump the results\n"\ + "The SID is in string format, and the attributes are a list of LDAP fields \n"\ + "to show in the results\n\n"\ + "Example: net ads sid 'S-1-5-32' distinguishedName\n\n" + ); + net_common_flags_usage(argc, argv); + return -1; +} + + +/* + general ADS search function. Useful in diagnosing problems in ADS +*/ +static int net_ads_sid(int argc, const char **argv) +{ + ADS_STRUCT *ads; + ADS_STATUS rc; + const char *sid_string; + const char **attrs; + void *res = NULL; + DOM_SID sid; + + if (argc < 1) { + return net_ads_sid_usage(argc, argv); + } + + if (!(ads = ads_startup())) { + return -1; + } + + sid_string = argv[0]; + attrs = (argv + 1); + + if (!string_to_sid(&sid, sid_string)) { + d_fprintf(stderr, "could not convert sid\ņ"); + ads_destroy(&ads); + return -1; + } + + rc = ads_search_retry_sid(ads, &res, &sid, attrs); + if (!ADS_ERR_OK(rc)) { + d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc)); + ads_destroy(&ads); + return -1; + } + + d_printf("Got %d replies\n\n", ads_count_replies(ads, res)); + + /* dump the results */ + ads_dump(ads, res); + + ads_msgfree(ads, res); + ads_destroy(&ads); + + return 0; +} + + static int net_ads_keytab_usage(int argc, const char **argv) { d_printf( @@ -1504,6 +1571,7 @@ int net_ads(int argc, const char **argv) {"PRINTER", net_ads_printer}, {"SEARCH", net_ads_search}, {"DN", net_ads_dn}, + {"SID", net_ads_sid}, {"WORKGROUP", net_ads_workgroup}, {"LOOKUP", net_ads_lookup}, {"KEYTAB", net_ads_keytab}, |