Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : In-Child server implementation of the routines defined in wbint.idl
5 :
6 : Copyright (C) Volker Lendecke 2009
7 : Copyright (C) Guenther Deschner 2009
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "winbindd/winbindd.h"
25 : #include "winbindd/winbindd_proto.h"
26 : #include "rpc_client/cli_pipe.h"
27 : #include "ntdomain.h"
28 : #include "librpc/rpc/dcesrv_core.h"
29 : #include "librpc/gen_ndr/ndr_winbind.h"
30 : #include "librpc/gen_ndr/ndr_winbind_scompat.h"
31 : #include "../librpc/gen_ndr/ndr_netlogon_c.h"
32 : #include "../librpc/gen_ndr/ndr_lsa_c.h"
33 : #include "idmap.h"
34 : #include "../libcli/security/security.h"
35 : #include "../libcli/auth/netlogon_creds_cli.h"
36 : #include "passdb.h"
37 : #include "../source4/dsdb/samdb/samdb.h"
38 : #include "rpc_client/cli_netlogon.h"
39 : #include "rpc_client/util_netlogon.h"
40 : #include "libsmb/dsgetdcname.h"
41 : #include "lib/global_contexts.h"
42 :
43 0 : NTSTATUS _wbint_Ping(struct pipes_struct *p, struct wbint_Ping *r)
44 : {
45 0 : *r->out.out_data = r->in.in_data;
46 0 : return NT_STATUS_OK;
47 : }
48 :
49 0 : NTSTATUS _wbint_InitConnection(struct pipes_struct *p,
50 : struct wbint_InitConnection *r)
51 : {
52 0 : struct winbindd_domain *domain = wb_child_domain();
53 :
54 0 : if (r->in.dcname != NULL && strlen(r->in.dcname) > 0) {
55 0 : TALLOC_FREE(domain->dcname);
56 0 : domain->dcname = talloc_strdup(domain, r->in.dcname);
57 0 : if (domain->dcname == NULL) {
58 0 : return NT_STATUS_NO_MEMORY;
59 : }
60 : }
61 :
62 0 : init_dc_connection(domain, false);
63 :
64 0 : if (!domain->initialized) {
65 : /*
66 : * If we return error here we can't do any cached
67 : * authentication, but we may be in disconnected mode and can't
68 : * initialize correctly. Do what the previous code did and just
69 : * return without initialization, once we go online we'll
70 : * re-initialize.
71 : */
72 0 : DBG_INFO("%s returning without initialization online = %d\n",
73 : domain->name, (int)domain->online);
74 : }
75 :
76 0 : *r->out.name = talloc_strdup(p->mem_ctx, domain->name);
77 0 : if (*r->out.name == NULL) {
78 0 : return NT_STATUS_NO_MEMORY;
79 : }
80 :
81 0 : if (domain->alt_name != NULL) {
82 0 : *r->out.alt_name = talloc_strdup(p->mem_ctx, domain->alt_name);
83 0 : if (*r->out.alt_name == NULL) {
84 0 : return NT_STATUS_NO_MEMORY;
85 : }
86 : }
87 :
88 0 : r->out.sid = dom_sid_dup(p->mem_ctx, &domain->sid);
89 0 : if (r->out.sid == NULL) {
90 0 : return NT_STATUS_NO_MEMORY;
91 : }
92 :
93 0 : *r->out.flags = 0;
94 0 : if (domain->native_mode) {
95 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_NATIVE;
96 : }
97 0 : if (domain->active_directory) {
98 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_AD;
99 : }
100 0 : if (domain->primary) {
101 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_PRIMARY;
102 : }
103 :
104 0 : return NT_STATUS_OK;
105 : }
106 :
107 0 : bool reset_cm_connection_on_error(struct winbindd_domain *domain,
108 : struct dcerpc_binding_handle *b,
109 : NTSTATUS status)
110 : {
111 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
112 0 : NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
113 0 : NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
114 0 : invalidate_cm_connection(domain);
115 0 : domain->conn.netlogon_force_reauth = true;
116 0 : return true;
117 : }
118 :
119 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
120 0 : NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR))
121 : {
122 0 : invalidate_cm_connection(domain);
123 : /* We invalidated the connection. */
124 0 : return true;
125 : }
126 :
127 0 : if (b != NULL && !dcerpc_binding_handle_is_connected(b)) {
128 0 : invalidate_cm_connection(domain);
129 0 : return true;
130 : }
131 :
132 0 : return false;
133 : }
134 :
135 0 : NTSTATUS _wbint_LookupSid(struct pipes_struct *p, struct wbint_LookupSid *r)
136 : {
137 0 : struct winbindd_domain *domain = wb_child_domain();
138 : char *dom_name;
139 : char *name;
140 : enum lsa_SidType type;
141 : NTSTATUS status;
142 :
143 0 : if (domain == NULL) {
144 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
145 : }
146 :
147 0 : status = wb_cache_sid_to_name(domain, p->mem_ctx, r->in.sid,
148 : &dom_name, &name, &type);
149 0 : reset_cm_connection_on_error(domain, NULL, status);
150 0 : if (!NT_STATUS_IS_OK(status)) {
151 0 : return status;
152 : }
153 :
154 0 : *r->out.domain = dom_name;
155 0 : *r->out.name = name;
156 0 : *r->out.type = type;
157 0 : return NT_STATUS_OK;
158 : }
159 :
160 0 : NTSTATUS _wbint_LookupSids(struct pipes_struct *p, struct wbint_LookupSids *r)
161 : {
162 0 : struct winbindd_domain *domain = wb_child_domain();
163 0 : struct lsa_RefDomainList *domains = r->out.domains;
164 : NTSTATUS status;
165 0 : bool retry = false;
166 :
167 0 : if (domain == NULL) {
168 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
169 : }
170 :
171 : /*
172 : * This breaks the winbindd_domain->methods abstraction: This
173 : * is only called for remote domains, and both winbindd_msrpc
174 : * and winbindd_ad call into lsa_lookupsids anyway. Caching is
175 : * done at the wbint RPC layer.
176 : */
177 0 : again:
178 0 : status = rpc_lookup_sids(p->mem_ctx, domain, r->in.sids,
179 : &domains, &r->out.names);
180 :
181 0 : if (domains != NULL) {
182 0 : r->out.domains = domains;
183 : }
184 :
185 0 : if (!retry && reset_cm_connection_on_error(domain, NULL, status)) {
186 0 : retry = true;
187 0 : goto again;
188 : }
189 :
190 0 : return status;
191 : }
192 :
193 0 : NTSTATUS _wbint_LookupName(struct pipes_struct *p, struct wbint_LookupName *r)
194 : {
195 0 : struct winbindd_domain *domain = wb_child_domain();
196 : NTSTATUS status;
197 :
198 0 : if (domain == NULL) {
199 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
200 : }
201 :
202 0 : status = wb_cache_name_to_sid(domain, p->mem_ctx, r->in.domain,
203 : r->in.name, r->in.flags,
204 : r->out.sid, r->out.type);
205 0 : reset_cm_connection_on_error(domain, NULL, status);
206 0 : return status;
207 : }
208 :
209 0 : NTSTATUS _wbint_Sids2UnixIDs(struct pipes_struct *p,
210 : struct wbint_Sids2UnixIDs *r)
211 : {
212 : uint32_t i;
213 :
214 : struct lsa_DomainInfo *d;
215 : struct wbint_TransID *ids;
216 : uint32_t num_ids;
217 :
218 0 : struct id_map **id_map_ptrs = NULL;
219 : struct idmap_domain *dom;
220 0 : NTSTATUS status = NT_STATUS_NO_MEMORY;
221 :
222 0 : if (r->in.domains->count != 1) {
223 0 : return NT_STATUS_INVALID_PARAMETER;
224 : }
225 :
226 0 : d = &r->in.domains->domains[0];
227 0 : ids = r->in.ids->ids;
228 0 : num_ids = r->in.ids->num_ids;
229 :
230 0 : dom = idmap_find_domain_with_sid(d->name.string, d->sid);
231 0 : if (dom == NULL) {
232 : struct dom_sid_buf buf;
233 0 : DEBUG(10, ("idmap domain %s:%s not found\n",
234 : d->name.string,
235 : dom_sid_str_buf(d->sid, &buf)));
236 :
237 0 : for (i=0; i<num_ids; i++) {
238 :
239 0 : ids[i].xid = (struct unixid) {
240 : .id = UINT32_MAX,
241 : .type = ID_TYPE_NOT_SPECIFIED
242 : };
243 : }
244 :
245 0 : return NT_STATUS_OK;
246 : }
247 :
248 0 : id_map_ptrs = id_map_ptrs_init(talloc_tos(), num_ids);
249 0 : if (id_map_ptrs == NULL) {
250 0 : goto nomem;
251 : }
252 :
253 : /*
254 : * Convert the input data into a list of id_map structs
255 : * suitable for handing in to the idmap sids_to_unixids
256 : * method.
257 : */
258 :
259 0 : for (i=0; i<num_ids; i++) {
260 0 : struct id_map *m = id_map_ptrs[i];
261 :
262 0 : sid_compose(m->sid, d->sid, ids[i].rid);
263 0 : m->status = ID_UNKNOWN;
264 0 : m->xid = (struct unixid) { .type = ids[i].type_hint };
265 : }
266 :
267 0 : status = dom->methods->sids_to_unixids(dom, id_map_ptrs);
268 :
269 0 : if (NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
270 : /*
271 : * This is okay. We need to transfer the mapped ones
272 : * up to our caller. The individual mappings carry the
273 : * information whether they are mapped or not.
274 : */
275 0 : status = NT_STATUS_OK;
276 : }
277 :
278 0 : if (!NT_STATUS_IS_OK(status)) {
279 0 : DEBUG(10, ("sids_to_unixids returned %s\n",
280 : nt_errstr(status)));
281 0 : goto done;
282 : }
283 :
284 : /*
285 : * Extract the results for handing them back to the caller.
286 : */
287 :
288 0 : for (i=0; i<num_ids; i++) {
289 0 : struct id_map *m = id_map_ptrs[i];
290 :
291 0 : if (m->status == ID_REQUIRE_TYPE) {
292 0 : ids[i].xid.id = UINT32_MAX;
293 0 : ids[i].xid.type = ID_TYPE_WB_REQUIRE_TYPE;
294 0 : continue;
295 : }
296 :
297 0 : if (!idmap_unix_id_is_in_range(m->xid.id, dom)) {
298 0 : DBG_DEBUG("id %"PRIu32" is out of range "
299 : "%"PRIu32"-%"PRIu32" for domain %s\n",
300 : m->xid.id, dom->low_id, dom->high_id,
301 : dom->name);
302 0 : m->status = ID_UNMAPPED;
303 : }
304 :
305 0 : if (m->status == ID_MAPPED) {
306 0 : ids[i].xid = m->xid;
307 : } else {
308 0 : ids[i].xid.id = UINT32_MAX;
309 0 : ids[i].xid.type = ID_TYPE_NOT_SPECIFIED;
310 : }
311 : }
312 :
313 0 : goto done;
314 0 : nomem:
315 0 : status = NT_STATUS_NO_MEMORY;
316 0 : done:
317 0 : TALLOC_FREE(id_map_ptrs);
318 0 : return status;
319 : }
320 :
321 0 : NTSTATUS _wbint_UnixIDs2Sids(struct pipes_struct *p,
322 : struct wbint_UnixIDs2Sids *r)
323 : {
324 : struct id_map **maps;
325 : NTSTATUS status;
326 : uint32_t i;
327 :
328 0 : maps = id_map_ptrs_init(talloc_tos(), r->in.num_ids);
329 0 : if (maps == NULL) {
330 0 : return NT_STATUS_NO_MEMORY;
331 : }
332 :
333 0 : for (i=0; i<r->in.num_ids; i++) {
334 0 : maps[i]->status = ID_UNKNOWN;
335 0 : maps[i]->xid = r->in.xids[i];
336 : }
337 :
338 0 : status = idmap_backend_unixids_to_sids(maps, r->in.domain_name,
339 : r->in.domain_sid);
340 0 : if (!NT_STATUS_IS_OK(status)) {
341 0 : TALLOC_FREE(maps);
342 0 : return status;
343 : }
344 :
345 0 : for (i=0; i<r->in.num_ids; i++) {
346 0 : if (maps[i]->status == ID_MAPPED) {
347 0 : r->out.xids[i] = maps[i]->xid;
348 0 : sid_copy(&r->out.sids[i], maps[i]->sid);
349 : } else {
350 0 : r->out.sids[i] = (struct dom_sid) { 0 };
351 : }
352 : }
353 :
354 0 : TALLOC_FREE(maps);
355 :
356 0 : return NT_STATUS_OK;
357 : }
358 :
359 0 : NTSTATUS _wbint_AllocateUid(struct pipes_struct *p, struct wbint_AllocateUid *r)
360 : {
361 : struct unixid xid;
362 : NTSTATUS status;
363 :
364 0 : status = idmap_allocate_uid(&xid);
365 0 : if (!NT_STATUS_IS_OK(status)) {
366 0 : return status;
367 : }
368 0 : *r->out.uid = xid.id;
369 0 : return NT_STATUS_OK;
370 : }
371 :
372 0 : NTSTATUS _wbint_AllocateGid(struct pipes_struct *p, struct wbint_AllocateGid *r)
373 : {
374 : struct unixid xid;
375 : NTSTATUS status;
376 :
377 0 : status = idmap_allocate_gid(&xid);
378 0 : if (!NT_STATUS_IS_OK(status)) {
379 0 : return status;
380 : }
381 0 : *r->out.gid = xid.id;
382 0 : return NT_STATUS_OK;
383 : }
384 :
385 0 : NTSTATUS _wbint_GetNssInfo(struct pipes_struct *p, struct wbint_GetNssInfo *r)
386 : {
387 : struct idmap_domain *domain;
388 : NTSTATUS status;
389 :
390 0 : domain = idmap_find_domain(r->in.info->domain_name);
391 0 : if ((domain == NULL) || (domain->query_user == NULL)) {
392 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
393 : }
394 :
395 0 : status = domain->query_user(domain, r->in.info);
396 0 : return status;
397 : }
398 :
399 0 : NTSTATUS _wbint_LookupUserAliases(struct pipes_struct *p,
400 : struct wbint_LookupUserAliases *r)
401 : {
402 0 : struct winbindd_domain *domain = wb_child_domain();
403 : NTSTATUS status;
404 :
405 0 : if (domain == NULL) {
406 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
407 : }
408 :
409 0 : status = wb_cache_lookup_useraliases(domain, p->mem_ctx,
410 0 : r->in.sids->num_sids,
411 0 : r->in.sids->sids,
412 0 : &r->out.rids->num_rids,
413 0 : &r->out.rids->rids);
414 0 : reset_cm_connection_on_error(domain, NULL, status);
415 0 : return status;
416 : }
417 :
418 0 : NTSTATUS _wbint_LookupUserGroups(struct pipes_struct *p,
419 : struct wbint_LookupUserGroups *r)
420 : {
421 0 : struct winbindd_domain *domain = wb_child_domain();
422 : NTSTATUS status;
423 :
424 0 : if (domain == NULL) {
425 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
426 : }
427 :
428 0 : status = wb_cache_lookup_usergroups(domain, p->mem_ctx, r->in.sid,
429 0 : &r->out.sids->num_sids,
430 0 : &r->out.sids->sids);
431 0 : reset_cm_connection_on_error(domain, NULL, status);
432 0 : return status;
433 : }
434 :
435 0 : NTSTATUS _wbint_QuerySequenceNumber(struct pipes_struct *p,
436 : struct wbint_QuerySequenceNumber *r)
437 : {
438 0 : struct winbindd_domain *domain = wb_child_domain();
439 : NTSTATUS status;
440 :
441 0 : if (domain == NULL) {
442 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
443 : }
444 :
445 0 : status = wb_cache_sequence_number(domain, r->out.sequence);
446 0 : reset_cm_connection_on_error(domain, NULL, status);
447 0 : return status;
448 : }
449 :
450 0 : NTSTATUS _wbint_LookupGroupMembers(struct pipes_struct *p,
451 : struct wbint_LookupGroupMembers *r)
452 : {
453 0 : struct winbindd_domain *domain = wb_child_domain();
454 : uint32_t i, num_names;
455 : struct dom_sid *sid_mem;
456 : char **names;
457 : uint32_t *name_types;
458 : NTSTATUS status;
459 :
460 0 : if (domain == NULL) {
461 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
462 : }
463 :
464 0 : status = wb_cache_lookup_groupmem(domain, p->mem_ctx, r->in.sid,
465 : r->in.type, &num_names, &sid_mem,
466 : &names, &name_types);
467 0 : reset_cm_connection_on_error(domain, NULL, status);
468 0 : if (!NT_STATUS_IS_OK(status)) {
469 0 : return status;
470 : }
471 :
472 0 : r->out.members->num_principals = num_names;
473 0 : r->out.members->principals = talloc_array(
474 : r->out.members, struct wbint_Principal, num_names);
475 0 : if (r->out.members->principals == NULL) {
476 0 : return NT_STATUS_NO_MEMORY;
477 : }
478 :
479 0 : for (i=0; i<num_names; i++) {
480 0 : struct wbint_Principal *m = &r->out.members->principals[i];
481 0 : sid_copy(&m->sid, &sid_mem[i]);
482 0 : m->name = talloc_move(r->out.members->principals, &names[i]);
483 0 : m->type = (enum lsa_SidType)name_types[i];
484 : }
485 :
486 0 : return NT_STATUS_OK;
487 : }
488 :
489 0 : NTSTATUS _wbint_QueryGroupList(struct pipes_struct *p,
490 : struct wbint_QueryGroupList *r)
491 : {
492 0 : TALLOC_CTX *frame = NULL;
493 0 : struct winbindd_domain *domain = wb_child_domain();
494 : uint32_t i;
495 0 : uint32_t num_local_groups = 0;
496 0 : struct wb_acct_info *local_groups = NULL;
497 0 : uint32_t num_dom_groups = 0;
498 0 : struct wb_acct_info *dom_groups = NULL;
499 0 : uint32_t ti = 0;
500 0 : uint64_t num_total = 0;
501 : struct wbint_Principal *result;
502 0 : NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
503 0 : bool include_local_groups = false;
504 :
505 0 : if (domain == NULL) {
506 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
507 : }
508 :
509 0 : frame = talloc_stackframe();
510 :
511 0 : switch (lp_server_role()) {
512 0 : case ROLE_ACTIVE_DIRECTORY_DC:
513 0 : if (domain->internal) {
514 : /*
515 : * we want to include local groups
516 : * for BUILTIN and WORKGROUP
517 : */
518 0 : include_local_groups = true;
519 : }
520 0 : break;
521 0 : default:
522 : /*
523 : * We might include local groups in more
524 : * setups later, but that requires more work
525 : * elsewhere.
526 : */
527 0 : break;
528 : }
529 :
530 0 : if (include_local_groups) {
531 0 : status = wb_cache_enum_local_groups(domain, frame,
532 : &num_local_groups,
533 : &local_groups);
534 0 : reset_cm_connection_on_error(domain, NULL, status);
535 0 : if (!NT_STATUS_IS_OK(status)) {
536 0 : goto out;
537 : }
538 : }
539 :
540 0 : status = wb_cache_enum_dom_groups(domain, frame,
541 : &num_dom_groups,
542 : &dom_groups);
543 0 : reset_cm_connection_on_error(domain, NULL, status);
544 0 : if (!NT_STATUS_IS_OK(status)) {
545 0 : goto out;
546 : }
547 :
548 0 : num_total = num_local_groups + num_dom_groups;
549 0 : if (num_total > UINT32_MAX) {
550 0 : status = NT_STATUS_INTERNAL_ERROR;
551 0 : goto out;
552 : }
553 :
554 0 : result = talloc_array(frame, struct wbint_Principal, num_total);
555 0 : if (result == NULL) {
556 0 : status = NT_STATUS_NO_MEMORY;
557 0 : goto out;
558 : }
559 :
560 0 : for (i = 0; i < num_local_groups; i++) {
561 0 : struct wb_acct_info *lg = &local_groups[i];
562 0 : struct wbint_Principal *rg = &result[ti++];
563 :
564 0 : sid_compose(&rg->sid, &domain->sid, lg->rid);
565 0 : rg->type = SID_NAME_ALIAS;
566 0 : rg->name = talloc_strdup(result, lg->acct_name);
567 0 : if (rg->name == NULL) {
568 0 : status = NT_STATUS_NO_MEMORY;
569 0 : goto out;
570 : }
571 : }
572 0 : num_local_groups = 0;
573 :
574 0 : for (i = 0; i < num_dom_groups; i++) {
575 0 : struct wb_acct_info *dg = &dom_groups[i];
576 0 : struct wbint_Principal *rg = &result[ti++];
577 :
578 0 : sid_compose(&rg->sid, &domain->sid, dg->rid);
579 0 : rg->type = SID_NAME_DOM_GRP;
580 0 : rg->name = talloc_strdup(result, dg->acct_name);
581 0 : if (rg->name == NULL) {
582 0 : status = NT_STATUS_NO_MEMORY;
583 0 : goto out;
584 : }
585 : }
586 0 : num_dom_groups = 0;
587 :
588 0 : r->out.groups->num_principals = ti;
589 0 : r->out.groups->principals = talloc_move(r->out.groups, &result);
590 :
591 0 : status = NT_STATUS_OK;
592 0 : out:
593 0 : TALLOC_FREE(frame);
594 0 : return status;
595 : }
596 :
597 0 : NTSTATUS _wbint_QueryUserRidList(struct pipes_struct *p,
598 : struct wbint_QueryUserRidList *r)
599 : {
600 0 : struct winbindd_domain *domain = wb_child_domain();
601 : NTSTATUS status;
602 :
603 0 : if (domain == NULL) {
604 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
605 : }
606 :
607 : /*
608 : * Right now this is overkill. We should add a backend call
609 : * just querying the rids.
610 : */
611 :
612 0 : status = wb_cache_query_user_list(domain, p->mem_ctx,
613 0 : &r->out.rids->rids);
614 0 : reset_cm_connection_on_error(domain, NULL, status);
615 :
616 0 : if (!NT_STATUS_IS_OK(status)) {
617 0 : return status;
618 : }
619 :
620 0 : r->out.rids->num_rids = talloc_array_length(r->out.rids->rids);
621 :
622 0 : return NT_STATUS_OK;
623 : }
624 :
625 0 : NTSTATUS _wbint_DsGetDcName(struct pipes_struct *p, struct wbint_DsGetDcName *r)
626 : {
627 0 : return dsgetdcname(p->mem_ctx, global_messaging_context(),
628 0 : r->in.domain_name, r->in.domain_guid,
629 0 : r->in.site_name ? r->in.site_name : "",
630 : r->in.flags,
631 : r->out.dc_info);
632 : }
633 :
634 0 : NTSTATUS _wbint_LookupRids(struct pipes_struct *p, struct wbint_LookupRids *r)
635 : {
636 0 : struct winbindd_domain *domain = wb_child_domain();
637 : char *domain_name;
638 : char **names;
639 : enum lsa_SidType *types;
640 : struct wbint_Principal *result;
641 : NTSTATUS status;
642 : uint32_t i;
643 :
644 0 : if (domain == NULL) {
645 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
646 : }
647 :
648 0 : status = wb_cache_rids_to_names(domain, talloc_tos(), r->in.domain_sid,
649 0 : r->in.rids->rids, r->in.rids->num_rids,
650 : &domain_name, &names, &types);
651 0 : reset_cm_connection_on_error(domain, NULL, status);
652 0 : if (!NT_STATUS_IS_OK(status) &&
653 0 : !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
654 0 : return status;
655 : }
656 :
657 0 : *r->out.domain_name = talloc_move(r->out.domain_name, &domain_name);
658 :
659 0 : result = talloc_array(p->mem_ctx, struct wbint_Principal,
660 : r->in.rids->num_rids);
661 0 : if (result == NULL) {
662 0 : return NT_STATUS_NO_MEMORY;
663 : }
664 :
665 0 : for (i=0; i<r->in.rids->num_rids; i++) {
666 0 : sid_compose(&result[i].sid, r->in.domain_sid,
667 0 : r->in.rids->rids[i]);
668 0 : result[i].type = types[i];
669 0 : result[i].name = talloc_move(result, &names[i]);
670 : }
671 0 : TALLOC_FREE(types);
672 0 : TALLOC_FREE(names);
673 :
674 0 : r->out.names->num_principals = r->in.rids->num_rids;
675 0 : r->out.names->principals = result;
676 0 : return NT_STATUS_OK;
677 : }
678 :
679 0 : NTSTATUS _wbint_CheckMachineAccount(struct pipes_struct *p,
680 : struct wbint_CheckMachineAccount *r)
681 : {
682 : struct winbindd_domain *domain;
683 0 : int num_retries = 0;
684 : NTSTATUS status;
685 :
686 0 : domain = wb_child_domain();
687 0 : if (domain == NULL) {
688 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
689 : }
690 :
691 0 : again:
692 0 : invalidate_cm_connection(domain);
693 0 : domain->conn.netlogon_force_reauth = true;
694 :
695 : {
696 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
697 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
698 0 : status = cm_connect_netlogon_secure(domain,
699 : &netlogon_pipe,
700 : &netlogon_creds_ctx);
701 : }
702 :
703 : /* There is a race condition between fetching the trust account
704 : password and the periodic machine password change. So it's
705 : possible that the trust account password has been changed on us.
706 : We are returned NT_STATUS_ACCESS_DENIED if this happens. */
707 :
708 : #define MAX_RETRIES 3
709 :
710 0 : if ((num_retries < MAX_RETRIES)
711 0 : && NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
712 0 : num_retries++;
713 0 : goto again;
714 : }
715 :
716 0 : if (!NT_STATUS_IS_OK(status)) {
717 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
718 0 : goto done;
719 : }
720 :
721 : /* Pass back result code - zero for success, other values for
722 : specific failures. */
723 :
724 0 : DEBUG(3,("domain %s secret is %s\n", domain->name,
725 : NT_STATUS_IS_OK(status) ? "good" : "bad"));
726 :
727 0 : done:
728 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
729 : ("Checking the trust account password for domain %s returned %s\n",
730 : domain->name, nt_errstr(status)));
731 :
732 0 : return status;
733 : }
734 :
735 0 : NTSTATUS _wbint_ChangeMachineAccount(struct pipes_struct *p,
736 : struct wbint_ChangeMachineAccount *r)
737 : {
738 0 : struct messaging_context *msg_ctx = global_messaging_context();
739 : struct winbindd_domain *domain;
740 : NTSTATUS status;
741 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
742 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
743 :
744 0 : domain = wb_child_domain();
745 0 : if (domain == NULL) {
746 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
747 : }
748 :
749 0 : status = cm_connect_netlogon_secure(domain,
750 : &netlogon_pipe,
751 : &netlogon_creds_ctx);
752 0 : if (!NT_STATUS_IS_OK(status)) {
753 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
754 0 : goto done;
755 : }
756 :
757 0 : status = trust_pw_change(netlogon_creds_ctx,
758 : msg_ctx,
759 0 : netlogon_pipe->binding_handle,
760 0 : domain->name,
761 0 : domain->dcname,
762 : true); /* force */
763 :
764 : /* Pass back result code - zero for success, other values for
765 : specific failures. */
766 :
767 0 : DEBUG(3,("domain %s secret %s\n", domain->name,
768 : NT_STATUS_IS_OK(status) ? "changed" : "unchanged"));
769 :
770 0 : done:
771 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
772 : ("Changing the trust account password for domain %s returned %s\n",
773 : domain->name, nt_errstr(status)));
774 :
775 0 : return status;
776 : }
777 :
778 0 : NTSTATUS _wbint_PingDc(struct pipes_struct *p, struct wbint_PingDc *r)
779 : {
780 : NTSTATUS status;
781 : struct winbindd_domain *domain;
782 : struct rpc_pipe_client *netlogon_pipe;
783 : union netr_CONTROL_QUERY_INFORMATION info;
784 : WERROR werr;
785 : fstring logon_server;
786 : struct dcerpc_binding_handle *b;
787 0 : bool retry = false;
788 :
789 0 : domain = wb_child_domain();
790 0 : if (domain == NULL) {
791 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
792 : }
793 :
794 0 : reconnect:
795 0 : status = cm_connect_netlogon(domain, &netlogon_pipe);
796 0 : reset_cm_connection_on_error(domain, NULL, status);
797 0 : if (!NT_STATUS_IS_OK(status)) {
798 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
799 : nt_errstr(status)));
800 0 : return status;
801 : }
802 :
803 0 : b = netlogon_pipe->binding_handle;
804 :
805 0 : fstr_sprintf(logon_server, "\\\\%s", domain->dcname);
806 0 : *r->out.dcname = talloc_strdup(p->mem_ctx, domain->dcname);
807 0 : if (*r->out.dcname == NULL) {
808 0 : DEBUG(2, ("Could not allocate memory\n"));
809 0 : return NT_STATUS_NO_MEMORY;
810 : }
811 :
812 : /*
813 : * This provokes a WERR_NOT_SUPPORTED error message. This is
814 : * documented in the wspp docs. I could not get a successful
815 : * call to work, but the main point here is testing that the
816 : * netlogon pipe works.
817 : */
818 0 : status = dcerpc_netr_LogonControl(b, p->mem_ctx,
819 : logon_server, NETLOGON_CONTROL_QUERY,
820 : 2, &info, &werr);
821 :
822 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
823 0 : retry = true;
824 0 : goto reconnect;
825 : }
826 :
827 0 : if (!NT_STATUS_IS_OK(status)) {
828 0 : DEBUG(2, ("dcerpc_netr_LogonControl failed: %s\n",
829 : nt_errstr(status)));
830 0 : return status;
831 : }
832 :
833 0 : if (!W_ERROR_EQUAL(werr, WERR_NOT_SUPPORTED)) {
834 0 : DEBUG(2, ("dcerpc_netr_LogonControl returned %s, expected "
835 : "WERR_NOT_SUPPORTED\n",
836 : win_errstr(werr)));
837 0 : return werror_to_ntstatus(werr);
838 : }
839 :
840 0 : DEBUG(5, ("winbindd_dual_ping_dc succeeded\n"));
841 0 : return NT_STATUS_OK;
842 : }
843 :
844 0 : NTSTATUS _winbind_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p,
845 : struct winbind_DsrUpdateReadOnlyServerDnsRecords *r)
846 : {
847 : struct winbindd_domain *domain;
848 : NTSTATUS status;
849 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
850 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
851 0 : struct dcerpc_binding_handle *b = NULL;
852 0 : bool retry = false;
853 :
854 0 : domain = wb_child_domain();
855 0 : if (domain == NULL) {
856 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
857 : }
858 :
859 0 : reconnect:
860 0 : status = cm_connect_netlogon_secure(domain,
861 : &netlogon_pipe,
862 : &netlogon_creds_ctx);
863 0 : if (!NT_STATUS_IS_OK(status)) {
864 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
865 0 : goto done;
866 : }
867 :
868 0 : b = netlogon_pipe->binding_handle;
869 :
870 0 : status = netlogon_creds_cli_DsrUpdateReadOnlyServerDnsRecords(netlogon_creds_ctx,
871 0 : netlogon_pipe->binding_handle,
872 : r->in.site_name,
873 : r->in.dns_ttl,
874 : r->in.dns_names);
875 :
876 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
877 0 : retry = true;
878 0 : goto reconnect;
879 : }
880 :
881 : /* Pass back result code - zero for success, other values for
882 : specific failures. */
883 :
884 0 : DEBUG(3,("DNS records for domain %s %s\n", domain->name,
885 : NT_STATUS_IS_OK(status) ? "changed" : "unchanged"));
886 :
887 0 : done:
888 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
889 : ("Update of DNS records via RW DC %s returned %s\n",
890 : domain->name, nt_errstr(status)));
891 :
892 0 : return status;
893 : }
894 :
895 0 : NTSTATUS _winbind_SamLogon(struct pipes_struct *p,
896 : struct winbind_SamLogon *r)
897 : {
898 0 : struct dcesrv_call_state *dce_call = p->dce_call;
899 0 : struct dcesrv_connection *dcesrv_conn = dce_call->conn;
900 0 : const struct tsocket_address *local_address =
901 0 : dcesrv_connection_get_local_address(dcesrv_conn);
902 0 : const struct tsocket_address *remote_address =
903 0 : dcesrv_connection_get_remote_address(dcesrv_conn);
904 : struct winbindd_domain *domain;
905 : NTSTATUS status;
906 0 : struct netr_IdentityInfo *identity_info = NULL;
907 : DATA_BLOB lm_response, nt_response;
908 0 : DATA_BLOB challenge = data_blob_null;
909 0 : uint32_t flags = 0;
910 : uint16_t validation_level;
911 0 : union netr_Validation *validation = NULL;
912 0 : bool interactive = false;
913 :
914 : /*
915 : * Make sure we start with authoritative=true,
916 : * it will only set to false if we don't know the
917 : * domain.
918 : */
919 0 : r->out.authoritative = true;
920 :
921 0 : domain = wb_child_domain();
922 0 : if (domain == NULL) {
923 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
924 : }
925 :
926 0 : switch (r->in.validation_level) {
927 0 : case 3:
928 : case 6:
929 0 : break;
930 0 : default:
931 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
932 : }
933 :
934 0 : switch (r->in.logon_level) {
935 0 : case NetlogonInteractiveInformation:
936 : case NetlogonServiceInformation:
937 : case NetlogonInteractiveTransitiveInformation:
938 : case NetlogonServiceTransitiveInformation:
939 0 : if (r->in.logon.password == NULL) {
940 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
941 : }
942 :
943 0 : interactive = true;
944 0 : identity_info = &r->in.logon.password->identity_info;
945 :
946 0 : challenge = data_blob_null;
947 0 : lm_response = data_blob_talloc(p->mem_ctx,
948 : r->in.logon.password->lmpassword.hash,
949 : sizeof(r->in.logon.password->lmpassword.hash));
950 0 : nt_response = data_blob_talloc(p->mem_ctx,
951 : r->in.logon.password->ntpassword.hash,
952 : sizeof(r->in.logon.password->ntpassword.hash));
953 0 : break;
954 :
955 0 : case NetlogonNetworkInformation:
956 : case NetlogonNetworkTransitiveInformation:
957 0 : if (r->in.logon.network == NULL) {
958 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
959 : }
960 :
961 0 : interactive = false;
962 0 : identity_info = &r->in.logon.network->identity_info;
963 :
964 0 : challenge = data_blob_talloc(p->mem_ctx,
965 : r->in.logon.network->challenge,
966 : 8);
967 0 : lm_response = data_blob_talloc(p->mem_ctx,
968 : r->in.logon.network->lm.data,
969 : r->in.logon.network->lm.length);
970 0 : nt_response = data_blob_talloc(p->mem_ctx,
971 : r->in.logon.network->nt.data,
972 : r->in.logon.network->nt.length);
973 0 : break;
974 :
975 0 : case NetlogonGenericInformation:
976 0 : if (r->in.logon.generic == NULL) {
977 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
978 : }
979 :
980 0 : identity_info = &r->in.logon.generic->identity_info;
981 : /*
982 : * Not implemented here...
983 : */
984 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
985 :
986 0 : default:
987 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
988 : }
989 :
990 0 : status = winbind_dual_SamLogon(domain, p->mem_ctx,
991 : interactive,
992 : identity_info->parameter_control,
993 : identity_info->account_name.string,
994 : identity_info->domain_name.string,
995 : identity_info->workstation.string,
996 : identity_info->logon_id,
997 : "SamLogon",
998 : 0,
999 : challenge,
1000 : lm_response, nt_response,
1001 : remote_address,
1002 : local_address,
1003 : &r->out.authoritative,
1004 : true, /* skip_sam */
1005 : &flags,
1006 : &validation_level,
1007 : &validation);
1008 0 : if (!NT_STATUS_IS_OK(status)) {
1009 0 : return status;
1010 : }
1011 0 : switch (r->in.validation_level) {
1012 0 : case 3:
1013 0 : status = map_validation_to_info3(p->mem_ctx,
1014 : validation_level,
1015 : validation,
1016 : &r->out.validation.sam3);
1017 0 : TALLOC_FREE(validation);
1018 0 : if (!NT_STATUS_IS_OK(status)) {
1019 0 : return status;
1020 : }
1021 0 : return NT_STATUS_OK;
1022 0 : case 6:
1023 0 : status = map_validation_to_info6(p->mem_ctx,
1024 : validation_level,
1025 : validation,
1026 : &r->out.validation.sam6);
1027 0 : TALLOC_FREE(validation);
1028 0 : if (!NT_STATUS_IS_OK(status)) {
1029 0 : return status;
1030 : }
1031 0 : return NT_STATUS_OK;
1032 : }
1033 :
1034 0 : smb_panic(__location__);
1035 : return NT_STATUS_INTERNAL_ERROR;
1036 : }
1037 :
1038 0 : static WERROR _winbind_LogonControl_REDISCOVER(struct pipes_struct *p,
1039 : struct winbindd_domain *domain,
1040 : struct winbind_LogonControl *r)
1041 : {
1042 : NTSTATUS status;
1043 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1044 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1045 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1046 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1047 :
1048 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1049 0 : if (info2 == NULL) {
1050 0 : return WERR_NOT_ENOUGH_MEMORY;
1051 : }
1052 :
1053 0 : if (domain->internal) {
1054 0 : check_result = WERR_OK;
1055 0 : goto check_return;
1056 : }
1057 :
1058 : /*
1059 : * For now we just force a reconnect
1060 : *
1061 : * TODO: take care of the optional '\dcname'
1062 : */
1063 0 : invalidate_cm_connection(domain);
1064 0 : domain->conn.netlogon_force_reauth = true;
1065 0 : status = cm_connect_netlogon_secure(domain,
1066 : &netlogon_pipe,
1067 : &netlogon_creds_ctx);
1068 0 : reset_cm_connection_on_error(domain, NULL, status);
1069 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1070 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1071 : }
1072 0 : if (!NT_STATUS_IS_OK(status)) {
1073 0 : DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
1074 : __func__, domain->name, domain->alt_name,
1075 : nt_errstr(status)));
1076 : /*
1077 : * Here we return a top level error!
1078 : * This is different than TC_QUERY or TC_VERIFY.
1079 : */
1080 0 : return ntstatus_to_werror(status);
1081 : }
1082 0 : check_result = WERR_OK;
1083 :
1084 0 : check_return:
1085 0 : info2->pdc_connection_status = WERR_OK;
1086 0 : if (domain->dcname != NULL) {
1087 0 : info2->flags |= NETLOGON_HAS_IP;
1088 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1089 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1090 : domain->dcname);
1091 0 : if (info2->trusted_dc_name == NULL) {
1092 0 : return WERR_NOT_ENOUGH_MEMORY;
1093 : }
1094 : } else {
1095 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1096 0 : if (info2->trusted_dc_name == NULL) {
1097 0 : return WERR_NOT_ENOUGH_MEMORY;
1098 : }
1099 : }
1100 0 : info2->tc_connection_status = check_result;
1101 :
1102 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1103 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1104 : "pdc_connection[%s] tc_connection[%s]\n",
1105 : __func__, domain->name, domain->alt_name,
1106 : domain->dcname,
1107 : win_errstr(info2->pdc_connection_status),
1108 : win_errstr(info2->tc_connection_status)));
1109 : }
1110 :
1111 0 : r->out.query->info2 = info2;
1112 :
1113 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1114 0 : return WERR_OK;
1115 : }
1116 :
1117 0 : static WERROR _winbind_LogonControl_TC_QUERY(struct pipes_struct *p,
1118 : struct winbindd_domain *domain,
1119 : struct winbind_LogonControl *r)
1120 : {
1121 : NTSTATUS status;
1122 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1123 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1124 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1125 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1126 :
1127 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1128 0 : if (info2 == NULL) {
1129 0 : return WERR_NOT_ENOUGH_MEMORY;
1130 : }
1131 :
1132 0 : if (domain->internal) {
1133 0 : check_result = WERR_OK;
1134 0 : goto check_return;
1135 : }
1136 :
1137 0 : status = cm_connect_netlogon_secure(domain,
1138 : &netlogon_pipe,
1139 : &netlogon_creds_ctx);
1140 0 : reset_cm_connection_on_error(domain, NULL, status);
1141 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1142 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1143 : }
1144 0 : if (!NT_STATUS_IS_OK(status)) {
1145 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1146 : nt_errstr(status)));
1147 0 : check_result = ntstatus_to_werror(status);
1148 0 : goto check_return;
1149 : }
1150 0 : check_result = WERR_OK;
1151 :
1152 0 : check_return:
1153 0 : info2->pdc_connection_status = WERR_OK;
1154 0 : if (domain->dcname != NULL) {
1155 0 : info2->flags |= NETLOGON_HAS_IP;
1156 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1157 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1158 : domain->dcname);
1159 0 : if (info2->trusted_dc_name == NULL) {
1160 0 : return WERR_NOT_ENOUGH_MEMORY;
1161 : }
1162 : } else {
1163 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1164 0 : if (info2->trusted_dc_name == NULL) {
1165 0 : return WERR_NOT_ENOUGH_MEMORY;
1166 : }
1167 : }
1168 0 : info2->tc_connection_status = check_result;
1169 :
1170 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1171 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1172 : "pdc_connection[%s] tc_connection[%s]\n",
1173 : __func__, domain->name, domain->alt_name,
1174 : domain->dcname,
1175 : win_errstr(info2->pdc_connection_status),
1176 : win_errstr(info2->tc_connection_status)));
1177 : }
1178 :
1179 0 : r->out.query->info2 = info2;
1180 :
1181 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1182 0 : return WERR_OK;
1183 : }
1184 :
1185 0 : static WERROR _winbind_LogonControl_TC_VERIFY(struct pipes_struct *p,
1186 : struct winbindd_domain *domain,
1187 : struct winbind_LogonControl *r)
1188 : {
1189 0 : TALLOC_CTX *frame = talloc_stackframe();
1190 : NTSTATUS status;
1191 : NTSTATUS result;
1192 0 : struct lsa_String trusted_domain_name = {};
1193 0 : struct lsa_StringLarge trusted_domain_name_l = {};
1194 0 : struct rpc_pipe_client *local_lsa_pipe = NULL;
1195 0 : struct policy_handle local_lsa_policy = {};
1196 0 : struct dcerpc_binding_handle *local_lsa = NULL;
1197 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1198 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1199 0 : struct cli_credentials *creds = NULL;
1200 0 : struct samr_Password *cur_nt_hash = NULL;
1201 0 : uint32_t trust_attributes = 0;
1202 0 : struct samr_Password new_owf_password = {};
1203 0 : bool cmp_new = false;
1204 0 : struct samr_Password old_owf_password = {};
1205 0 : bool cmp_old = false;
1206 0 : const struct lsa_TrustDomainInfoInfoEx *local_tdo = NULL;
1207 0 : bool fetch_fti = false;
1208 0 : struct lsa_ForestTrustInformation *new_fti = NULL;
1209 0 : struct netr_TrustInfo *trust_info = NULL;
1210 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1211 0 : struct dcerpc_binding_handle *b = NULL;
1212 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1213 0 : WERROR verify_result = WERR_INTERNAL_ERROR;
1214 0 : bool retry = false;
1215 :
1216 0 : trusted_domain_name.string = domain->name;
1217 0 : trusted_domain_name_l.string = domain->name;
1218 :
1219 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1220 0 : if (info2 == NULL) {
1221 0 : TALLOC_FREE(frame);
1222 0 : return WERR_NOT_ENOUGH_MEMORY;
1223 : }
1224 :
1225 0 : if (domain->internal) {
1226 0 : check_result = WERR_OK;
1227 0 : goto check_return;
1228 : }
1229 :
1230 0 : status = pdb_get_trust_credentials(domain->name,
1231 0 : domain->alt_name,
1232 : frame,
1233 : &creds);
1234 0 : if (NT_STATUS_IS_OK(status)) {
1235 0 : cur_nt_hash = cli_credentials_get_nt_hash(creds, frame);
1236 0 : TALLOC_FREE(creds);
1237 : }
1238 :
1239 0 : if (!domain->primary) {
1240 0 : union lsa_TrustedDomainInfo *tdi = NULL;
1241 :
1242 0 : status = open_internal_lsa_conn(frame, &local_lsa_pipe,
1243 : &local_lsa_policy);
1244 0 : if (!NT_STATUS_IS_OK(status)) {
1245 0 : DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
1246 : __location__, __func__, nt_errstr(status)));
1247 0 : TALLOC_FREE(frame);
1248 0 : return WERR_INTERNAL_ERROR;
1249 : }
1250 0 : local_lsa = local_lsa_pipe->binding_handle;
1251 :
1252 0 : status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
1253 : &local_lsa_policy,
1254 : &trusted_domain_name,
1255 : LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
1256 : &tdi, &result);
1257 0 : if (!NT_STATUS_IS_OK(status)) {
1258 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
1259 : __location__, __func__, domain->name, nt_errstr(status)));
1260 0 : TALLOC_FREE(frame);
1261 0 : return WERR_INTERNAL_ERROR;
1262 : }
1263 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1264 0 : DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
1265 : __location__, __func__, domain->name));
1266 0 : TALLOC_FREE(frame);
1267 0 : return WERR_NO_SUCH_DOMAIN;
1268 : }
1269 0 : if (!NT_STATUS_IS_OK(result)) {
1270 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
1271 : __location__, __func__, domain->name, nt_errstr(result)));
1272 0 : TALLOC_FREE(frame);
1273 0 : return WERR_INTERNAL_ERROR;
1274 : }
1275 0 : if (tdi == NULL) {
1276 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
1277 : "returned no trusted domain information\n",
1278 : __location__, __func__));
1279 0 : TALLOC_FREE(frame);
1280 0 : return WERR_INTERNAL_ERROR;
1281 : }
1282 :
1283 0 : local_tdo = &tdi->info_ex;
1284 0 : trust_attributes = local_tdo->trust_attributes;
1285 : }
1286 :
1287 0 : if (trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1288 0 : struct lsa_ForestTrustInformation *old_fti = NULL;
1289 :
1290 0 : status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
1291 : &local_lsa_policy,
1292 : &trusted_domain_name,
1293 : LSA_FOREST_TRUST_DOMAIN_INFO,
1294 : &old_fti, &result);
1295 0 : if (!NT_STATUS_IS_OK(status)) {
1296 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
1297 : __location__, __func__, domain->name, nt_errstr(status)));
1298 0 : TALLOC_FREE(frame);
1299 0 : return WERR_INTERNAL_ERROR;
1300 : }
1301 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
1302 0 : DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
1303 : __func__, domain->name));
1304 0 : old_fti = NULL;
1305 0 : fetch_fti = true;
1306 0 : result = NT_STATUS_OK;
1307 : }
1308 0 : if (!NT_STATUS_IS_OK(result)) {
1309 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
1310 : __location__, __func__, domain->name, nt_errstr(result)));
1311 0 : TALLOC_FREE(frame);
1312 0 : return WERR_INTERNAL_ERROR;
1313 : }
1314 :
1315 0 : TALLOC_FREE(old_fti);
1316 : }
1317 :
1318 0 : reconnect:
1319 0 : status = cm_connect_netlogon_secure(domain,
1320 : &netlogon_pipe,
1321 : &netlogon_creds_ctx);
1322 0 : reset_cm_connection_on_error(domain, NULL, status);
1323 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1324 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1325 : }
1326 0 : if (!NT_STATUS_IS_OK(status)) {
1327 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1328 : nt_errstr(status)));
1329 0 : check_result = ntstatus_to_werror(status);
1330 0 : goto check_return;
1331 : }
1332 0 : check_result = WERR_OK;
1333 0 : b = netlogon_pipe->binding_handle;
1334 :
1335 0 : if (cur_nt_hash == NULL) {
1336 0 : verify_result = WERR_NO_TRUST_LSA_SECRET;
1337 0 : goto verify_return;
1338 : }
1339 :
1340 0 : if (fetch_fti) {
1341 0 : status = netlogon_creds_cli_GetForestTrustInformation(netlogon_creds_ctx,
1342 : b, frame,
1343 : &new_fti);
1344 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1345 0 : status = NT_STATUS_NOT_SUPPORTED;
1346 : }
1347 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1348 0 : new_fti = NULL;
1349 0 : status = NT_STATUS_OK;
1350 : }
1351 0 : if (!NT_STATUS_IS_OK(status)) {
1352 0 : if (!retry &&
1353 0 : reset_cm_connection_on_error(domain, b, status))
1354 : {
1355 0 : retry = true;
1356 0 : goto reconnect;
1357 : }
1358 0 : DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s)"
1359 : "failed: %s\n",
1360 : domain->name, nt_errstr(status)));
1361 0 : check_result = ntstatus_to_werror(status);
1362 0 : goto check_return;
1363 : }
1364 : }
1365 :
1366 0 : if (new_fti != NULL) {
1367 0 : struct lsa_ForestTrustInformation old_fti = {};
1368 0 : struct lsa_ForestTrustInformation *merged_fti = NULL;
1369 0 : struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
1370 :
1371 0 : status = dsdb_trust_merge_forest_info(frame, local_tdo,
1372 : &old_fti, new_fti,
1373 : &merged_fti);
1374 0 : if (!NT_STATUS_IS_OK(status)) {
1375 0 : DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
1376 : __location__, __func__,
1377 : domain->name, nt_errstr(status)));
1378 0 : TALLOC_FREE(frame);
1379 0 : return ntstatus_to_werror(status);
1380 : }
1381 :
1382 0 : status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
1383 : &local_lsa_policy,
1384 : &trusted_domain_name_l,
1385 : LSA_FOREST_TRUST_DOMAIN_INFO,
1386 : merged_fti,
1387 : 0, /* check_only=0 => store it! */
1388 : &collision_info,
1389 : &result);
1390 0 : if (!NT_STATUS_IS_OK(status)) {
1391 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
1392 : __location__, __func__, domain->name, nt_errstr(status)));
1393 0 : TALLOC_FREE(frame);
1394 0 : return WERR_INTERNAL_ERROR;
1395 : }
1396 0 : if (!NT_STATUS_IS_OK(result)) {
1397 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
1398 : __location__, __func__, domain->name, nt_errstr(result)));
1399 0 : TALLOC_FREE(frame);
1400 0 : return ntstatus_to_werror(result);
1401 : }
1402 : }
1403 :
1404 0 : status = netlogon_creds_cli_ServerGetTrustInfo(netlogon_creds_ctx,
1405 : b, frame,
1406 : &new_owf_password,
1407 : &old_owf_password,
1408 : &trust_info);
1409 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1410 0 : status = NT_STATUS_NOT_SUPPORTED;
1411 : }
1412 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1413 0 : DEBUG(5, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
1414 : nt_errstr(status)));
1415 0 : verify_result = WERR_OK;
1416 0 : goto verify_return;
1417 : }
1418 0 : if (!NT_STATUS_IS_OK(status)) {
1419 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1420 0 : retry = true;
1421 0 : goto reconnect;
1422 : }
1423 0 : DEBUG(2, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
1424 : nt_errstr(status)));
1425 :
1426 0 : if (!dcerpc_binding_handle_is_connected(b)) {
1427 0 : check_result = ntstatus_to_werror(status);
1428 0 : goto check_return;
1429 : } else {
1430 0 : verify_result = ntstatus_to_werror(status);
1431 0 : goto verify_return;
1432 : }
1433 : }
1434 :
1435 0 : if (trust_info != NULL && trust_info->count >= 1) {
1436 0 : uint32_t diff = trust_info->data[0] ^ trust_attributes;
1437 :
1438 0 : if (diff & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1439 0 : verify_result = WERR_DOMAIN_TRUST_INCONSISTENT;
1440 0 : goto verify_return;
1441 : }
1442 : }
1443 :
1444 0 : cmp_new = mem_equal_const_time(new_owf_password.hash,
1445 0 : cur_nt_hash->hash,
1446 : sizeof(cur_nt_hash->hash));
1447 0 : cmp_old = mem_equal_const_time(old_owf_password.hash,
1448 0 : cur_nt_hash->hash,
1449 : sizeof(cur_nt_hash->hash));
1450 0 : if (!cmp_new && !cmp_old) {
1451 0 : DEBUG(1,("%s:Error: credentials for domain[%s/%s] doesn't match "
1452 : "any password known to dcname[%s]\n",
1453 : __func__, domain->name, domain->alt_name,
1454 : domain->dcname));
1455 0 : verify_result = WERR_WRONG_PASSWORD;
1456 0 : goto verify_return;
1457 : }
1458 :
1459 0 : if (!cmp_new) {
1460 0 : DEBUG(2,("%s:Warning: credentials for domain[%s/%s] only match "
1461 : "against the old password known to dcname[%s]\n",
1462 : __func__, domain->name, domain->alt_name,
1463 : domain->dcname));
1464 : }
1465 :
1466 0 : verify_result = WERR_OK;
1467 0 : goto verify_return;
1468 :
1469 0 : check_return:
1470 0 : verify_result = check_result;
1471 0 : verify_return:
1472 0 : info2->flags |= NETLOGON_VERIFY_STATUS_RETURNED;
1473 0 : info2->pdc_connection_status = verify_result;
1474 0 : if (domain->dcname != NULL) {
1475 0 : info2->flags |= NETLOGON_HAS_IP;
1476 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1477 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1478 : domain->dcname);
1479 0 : if (info2->trusted_dc_name == NULL) {
1480 0 : TALLOC_FREE(frame);
1481 0 : return WERR_NOT_ENOUGH_MEMORY;
1482 : }
1483 : } else {
1484 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1485 0 : if (info2->trusted_dc_name == NULL) {
1486 0 : TALLOC_FREE(frame);
1487 0 : return WERR_NOT_ENOUGH_MEMORY;
1488 : }
1489 : }
1490 0 : info2->tc_connection_status = check_result;
1491 :
1492 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1493 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1494 : "pdc_connection[%s] tc_connection[%s]\n",
1495 : __func__, domain->name, domain->alt_name,
1496 : domain->dcname,
1497 : win_errstr(info2->pdc_connection_status),
1498 : win_errstr(info2->tc_connection_status)));
1499 : }
1500 :
1501 0 : r->out.query->info2 = info2;
1502 :
1503 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1504 0 : TALLOC_FREE(frame);
1505 0 : return WERR_OK;
1506 : }
1507 :
1508 0 : static WERROR _winbind_LogonControl_CHANGE_PASSWORD(struct pipes_struct *p,
1509 : struct winbindd_domain *domain,
1510 : struct winbind_LogonControl *r)
1511 : {
1512 0 : struct messaging_context *msg_ctx = global_messaging_context();
1513 : NTSTATUS status;
1514 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1515 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1516 0 : struct cli_credentials *creds = NULL;
1517 0 : struct samr_Password *cur_nt_hash = NULL;
1518 0 : struct netr_NETLOGON_INFO_1 *info1 = NULL;
1519 : struct dcerpc_binding_handle *b;
1520 0 : WERROR change_result = WERR_OK;
1521 0 : bool retry = false;
1522 :
1523 0 : info1 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_1);
1524 0 : if (info1 == NULL) {
1525 0 : return WERR_NOT_ENOUGH_MEMORY;
1526 : }
1527 :
1528 0 : if (domain->internal) {
1529 0 : return WERR_NOT_SUPPORTED;
1530 : }
1531 :
1532 0 : status = pdb_get_trust_credentials(domain->name,
1533 0 : domain->alt_name,
1534 : p->mem_ctx,
1535 : &creds);
1536 0 : if (NT_STATUS_IS_OK(status)) {
1537 0 : cur_nt_hash = cli_credentials_get_nt_hash(creds, p->mem_ctx);
1538 0 : TALLOC_FREE(creds);
1539 : }
1540 :
1541 0 : reconnect:
1542 0 : status = cm_connect_netlogon_secure(domain,
1543 : &netlogon_pipe,
1544 : &netlogon_creds_ctx);
1545 0 : reset_cm_connection_on_error(domain, NULL, status);
1546 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1547 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1548 : }
1549 0 : if (!NT_STATUS_IS_OK(status)) {
1550 0 : DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
1551 : __func__, domain->name, domain->alt_name,
1552 : nt_errstr(status)));
1553 : /*
1554 : * Here we return a top level error!
1555 : * This is different than TC_QUERY or TC_VERIFY.
1556 : */
1557 0 : return ntstatus_to_werror(status);
1558 : }
1559 0 : b = netlogon_pipe->binding_handle;
1560 :
1561 0 : if (cur_nt_hash == NULL) {
1562 0 : change_result = WERR_NO_TRUST_LSA_SECRET;
1563 0 : goto change_return;
1564 : }
1565 0 : TALLOC_FREE(cur_nt_hash);
1566 :
1567 0 : status = trust_pw_change(netlogon_creds_ctx,
1568 0 : msg_ctx, b, domain->name,
1569 0 : domain->dcname,
1570 : true); /* force */
1571 0 : if (!NT_STATUS_IS_OK(status)) {
1572 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1573 0 : retry = true;
1574 0 : goto reconnect;
1575 : }
1576 :
1577 0 : DEBUG(1, ("trust_pw_change(%s): %s\n",
1578 : domain->name, nt_errstr(status)));
1579 :
1580 0 : change_result = ntstatus_to_werror(status);
1581 0 : goto change_return;
1582 : }
1583 :
1584 0 : change_result = WERR_OK;
1585 :
1586 0 : change_return:
1587 0 : info1->pdc_connection_status = change_result;
1588 :
1589 0 : if (!W_ERROR_IS_OK(info1->pdc_connection_status)) {
1590 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1591 : "pdc_connection[%s]\n",
1592 : __func__, domain->name, domain->alt_name,
1593 : domain->dcname,
1594 : win_errstr(info1->pdc_connection_status)));
1595 : }
1596 :
1597 0 : r->out.query->info1 = info1;
1598 :
1599 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1600 0 : return WERR_OK;
1601 : }
1602 :
1603 0 : WERROR _winbind_LogonControl(struct pipes_struct *p,
1604 : struct winbind_LogonControl *r)
1605 : {
1606 : struct winbindd_domain *domain;
1607 :
1608 0 : domain = wb_child_domain();
1609 0 : if (domain == NULL) {
1610 0 : return WERR_NO_SUCH_DOMAIN;
1611 : }
1612 :
1613 0 : switch (r->in.function_code) {
1614 0 : case NETLOGON_CONTROL_REDISCOVER:
1615 0 : if (r->in.level != 2) {
1616 0 : return WERR_INVALID_PARAMETER;
1617 : }
1618 0 : return _winbind_LogonControl_REDISCOVER(p, domain, r);
1619 0 : case NETLOGON_CONTROL_TC_QUERY:
1620 0 : if (r->in.level != 2) {
1621 0 : return WERR_INVALID_PARAMETER;
1622 : }
1623 0 : return _winbind_LogonControl_TC_QUERY(p, domain, r);
1624 0 : case NETLOGON_CONTROL_TC_VERIFY:
1625 0 : if (r->in.level != 2) {
1626 0 : return WERR_INVALID_PARAMETER;
1627 : }
1628 0 : return _winbind_LogonControl_TC_VERIFY(p, domain, r);
1629 0 : case NETLOGON_CONTROL_CHANGE_PASSWORD:
1630 0 : if (r->in.level != 1) {
1631 0 : return WERR_INVALID_PARAMETER;
1632 : }
1633 0 : return _winbind_LogonControl_CHANGE_PASSWORD(p, domain, r);
1634 0 : default:
1635 0 : break;
1636 : }
1637 :
1638 0 : DEBUG(4, ("%s: function_code[0x%x] not supported\n",
1639 : __func__, r->in.function_code));
1640 0 : return WERR_NOT_SUPPORTED;
1641 : }
1642 :
1643 0 : WERROR _winbind_GetForestTrustInformation(struct pipes_struct *p,
1644 : struct winbind_GetForestTrustInformation *r)
1645 : {
1646 0 : TALLOC_CTX *frame = talloc_stackframe();
1647 : NTSTATUS status, result;
1648 : struct winbindd_domain *domain;
1649 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1650 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1651 : struct dcerpc_binding_handle *b;
1652 0 : bool retry = false;
1653 0 : struct lsa_String trusted_domain_name = {};
1654 0 : struct lsa_StringLarge trusted_domain_name_l = {};
1655 0 : union lsa_TrustedDomainInfo *tdi = NULL;
1656 0 : const struct lsa_TrustDomainInfoInfoEx *tdo = NULL;
1657 0 : struct lsa_ForestTrustInformation _old_fti = {};
1658 0 : struct lsa_ForestTrustInformation *old_fti = NULL;
1659 0 : struct lsa_ForestTrustInformation *new_fti = NULL;
1660 0 : struct lsa_ForestTrustInformation *merged_fti = NULL;
1661 0 : struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
1662 0 : bool update_fti = false;
1663 : struct rpc_pipe_client *local_lsa_pipe;
1664 : struct policy_handle local_lsa_policy;
1665 0 : struct dcerpc_binding_handle *local_lsa = NULL;
1666 :
1667 0 : domain = wb_child_domain();
1668 0 : if (domain == NULL) {
1669 0 : TALLOC_FREE(frame);
1670 0 : return WERR_NO_SUCH_DOMAIN;
1671 : }
1672 :
1673 : /*
1674 : * checking for domain->internal and domain->primary
1675 : * makes sure we only do some work when running as DC.
1676 : */
1677 :
1678 0 : if (domain->internal) {
1679 0 : TALLOC_FREE(frame);
1680 0 : return WERR_NO_SUCH_DOMAIN;
1681 : }
1682 :
1683 0 : if (domain->primary) {
1684 0 : TALLOC_FREE(frame);
1685 0 : return WERR_NO_SUCH_DOMAIN;
1686 : }
1687 :
1688 0 : trusted_domain_name.string = domain->name;
1689 0 : trusted_domain_name_l.string = domain->name;
1690 :
1691 0 : status = open_internal_lsa_conn(frame, &local_lsa_pipe,
1692 : &local_lsa_policy);
1693 0 : if (!NT_STATUS_IS_OK(status)) {
1694 0 : DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
1695 : __location__, __func__, nt_errstr(status)));
1696 0 : TALLOC_FREE(frame);
1697 0 : return WERR_INTERNAL_ERROR;
1698 : }
1699 0 : local_lsa = local_lsa_pipe->binding_handle;
1700 :
1701 0 : status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
1702 : &local_lsa_policy,
1703 : &trusted_domain_name,
1704 : LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
1705 : &tdi, &result);
1706 0 : if (!NT_STATUS_IS_OK(status)) {
1707 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
1708 : __location__, __func__, domain->name, nt_errstr(status)));
1709 0 : TALLOC_FREE(frame);
1710 0 : return WERR_INTERNAL_ERROR;
1711 : }
1712 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1713 0 : DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
1714 : __location__, __func__, domain->name));
1715 0 : TALLOC_FREE(frame);
1716 0 : return WERR_NO_SUCH_DOMAIN;
1717 : }
1718 0 : if (!NT_STATUS_IS_OK(result)) {
1719 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
1720 : __location__, __func__, domain->name, nt_errstr(result)));
1721 0 : TALLOC_FREE(frame);
1722 0 : return WERR_INTERNAL_ERROR;
1723 : }
1724 0 : if (tdi == NULL) {
1725 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
1726 : "returned no trusted domain information\n",
1727 : __location__, __func__));
1728 0 : TALLOC_FREE(frame);
1729 0 : return WERR_INTERNAL_ERROR;
1730 : }
1731 :
1732 0 : tdo = &tdi->info_ex;
1733 :
1734 0 : if (!(tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)) {
1735 0 : DEBUG(2,("%s: tdo[%s/%s] is no forest trust attributes[0x%08X]\n",
1736 : __func__, tdo->netbios_name.string,
1737 : tdo->domain_name.string,
1738 : (unsigned)tdo->trust_attributes));
1739 0 : TALLOC_FREE(frame);
1740 0 : return WERR_NO_SUCH_DOMAIN;
1741 : }
1742 :
1743 0 : if (r->in.flags & ~DS_GFTI_UPDATE_TDO) {
1744 0 : TALLOC_FREE(frame);
1745 0 : return WERR_INVALID_FLAGS;
1746 : }
1747 :
1748 0 : reconnect:
1749 0 : status = cm_connect_netlogon_secure(domain,
1750 : &netlogon_pipe,
1751 : &netlogon_creds_ctx);
1752 0 : reset_cm_connection_on_error(domain, NULL, status);
1753 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1754 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1755 : }
1756 0 : if (!NT_STATUS_IS_OK(status)) {
1757 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1758 : nt_errstr(status)));
1759 0 : TALLOC_FREE(frame);
1760 0 : return ntstatus_to_werror(status);
1761 : }
1762 0 : b = netlogon_pipe->binding_handle;
1763 :
1764 0 : status = netlogon_creds_cli_GetForestTrustInformation(netlogon_creds_ctx,
1765 : b, p->mem_ctx,
1766 : &new_fti);
1767 0 : if (!NT_STATUS_IS_OK(status)) {
1768 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1769 0 : retry = true;
1770 0 : goto reconnect;
1771 : }
1772 0 : DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s) failed: %s\n",
1773 : domain->name, nt_errstr(status)));
1774 0 : TALLOC_FREE(frame);
1775 0 : return ntstatus_to_werror(status);
1776 : }
1777 :
1778 0 : *r->out.forest_trust_info = new_fti;
1779 :
1780 0 : if (r->in.flags & DS_GFTI_UPDATE_TDO) {
1781 0 : update_fti = true;
1782 : }
1783 :
1784 0 : status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
1785 : &local_lsa_policy,
1786 : &trusted_domain_name,
1787 : LSA_FOREST_TRUST_DOMAIN_INFO,
1788 : &old_fti, &result);
1789 0 : if (!NT_STATUS_IS_OK(status)) {
1790 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
1791 : __location__, __func__, domain->name, nt_errstr(status)));
1792 0 : TALLOC_FREE(frame);
1793 0 : return WERR_INTERNAL_ERROR;
1794 : }
1795 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
1796 0 : DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
1797 : __func__, domain->name));
1798 0 : update_fti = true;
1799 0 : old_fti = &_old_fti;
1800 0 : result = NT_STATUS_OK;
1801 : }
1802 0 : if (!NT_STATUS_IS_OK(result)) {
1803 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
1804 : __location__, __func__, domain->name, nt_errstr(result)));
1805 0 : TALLOC_FREE(frame);
1806 0 : return WERR_INTERNAL_ERROR;
1807 : }
1808 :
1809 0 : if (old_fti == NULL) {
1810 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation() "
1811 : "returned success without returning forest trust information\n",
1812 : __location__, __func__));
1813 0 : TALLOC_FREE(frame);
1814 0 : return WERR_INTERNAL_ERROR;
1815 : }
1816 :
1817 0 : if (!update_fti) {
1818 0 : goto done;
1819 : }
1820 :
1821 0 : status = dsdb_trust_merge_forest_info(frame, tdo, old_fti, new_fti,
1822 : &merged_fti);
1823 0 : if (!NT_STATUS_IS_OK(status)) {
1824 0 : DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
1825 : __location__, __func__, domain->name, nt_errstr(status)));
1826 0 : TALLOC_FREE(frame);
1827 0 : return ntstatus_to_werror(status);
1828 : }
1829 :
1830 0 : status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
1831 : &local_lsa_policy,
1832 : &trusted_domain_name_l,
1833 : LSA_FOREST_TRUST_DOMAIN_INFO,
1834 : merged_fti,
1835 : 0, /* check_only=0 => store it! */
1836 : &collision_info,
1837 : &result);
1838 0 : if (!NT_STATUS_IS_OK(status)) {
1839 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
1840 : __location__, __func__, domain->name, nt_errstr(status)));
1841 0 : TALLOC_FREE(frame);
1842 0 : return WERR_INTERNAL_ERROR;
1843 : }
1844 0 : if (!NT_STATUS_IS_OK(result)) {
1845 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
1846 : __location__, __func__, domain->name, nt_errstr(result)));
1847 0 : TALLOC_FREE(frame);
1848 0 : return ntstatus_to_werror(result);
1849 : }
1850 :
1851 0 : done:
1852 0 : DEBUG(5, ("_winbind_GetForestTrustInformation succeeded\n"));
1853 0 : TALLOC_FREE(frame);
1854 0 : return WERR_OK;
1855 : }
1856 :
1857 0 : NTSTATUS _winbind_SendToSam(struct pipes_struct *p, struct winbind_SendToSam *r)
1858 : {
1859 : struct winbindd_domain *domain;
1860 : NTSTATUS status;
1861 : struct rpc_pipe_client *netlogon_pipe;
1862 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1863 0 : struct dcerpc_binding_handle *b = NULL;
1864 0 : bool retry = false;
1865 :
1866 0 : DEBUG(5, ("_winbind_SendToSam received\n"));
1867 0 : domain = wb_child_domain();
1868 0 : if (domain == NULL) {
1869 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1870 : }
1871 :
1872 0 : reconnect:
1873 0 : status = cm_connect_netlogon_secure(domain,
1874 : &netlogon_pipe,
1875 : &netlogon_creds_ctx);
1876 0 : reset_cm_connection_on_error(domain, NULL, status);
1877 0 : if (!NT_STATUS_IS_OK(status)) {
1878 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1879 0 : return status;
1880 : }
1881 :
1882 0 : b = netlogon_pipe->binding_handle;
1883 :
1884 0 : status = netlogon_creds_cli_SendToSam(netlogon_creds_ctx,
1885 : b,
1886 : &r->in.message);
1887 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1888 0 : retry = true;
1889 0 : goto reconnect;
1890 : }
1891 :
1892 0 : return status;
1893 : }
1894 :
1895 0 : NTSTATUS _wbint_ListTrustedDomains(struct pipes_struct *p,
1896 : struct wbint_ListTrustedDomains *r)
1897 : {
1898 0 : struct winbindd_domain *domain = wb_child_domain();
1899 : uint32_t i, n;
1900 : NTSTATUS result;
1901 : struct netr_DomainTrustList trusts;
1902 0 : struct netr_DomainTrustList *out = NULL;
1903 : pid_t client_pid;
1904 :
1905 0 : if (domain == NULL) {
1906 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1907 : }
1908 :
1909 : /* Cut client_pid to 32bit */
1910 0 : client_pid = r->in.client_pid;
1911 0 : if ((uint64_t)client_pid != r->in.client_pid) {
1912 0 : DBG_DEBUG("pid out of range\n");
1913 0 : return NT_STATUS_INVALID_PARAMETER;
1914 : }
1915 :
1916 0 : DBG_NOTICE("[%s %"PRIu32"]: list trusted domains\n",
1917 : r->in.client_name, client_pid);
1918 :
1919 0 : result = wb_cache_trusted_domains(domain, p->mem_ctx, &trusts);
1920 0 : if (!NT_STATUS_IS_OK(result)) {
1921 0 : DBG_NOTICE("wb_cache_trusted_domains returned %s\n",
1922 : nt_errstr(result));
1923 0 : return result;
1924 : }
1925 :
1926 0 : out = talloc_zero(p->mem_ctx, struct netr_DomainTrustList);
1927 0 : if (out == NULL) {
1928 0 : return NT_STATUS_NO_MEMORY;
1929 : }
1930 :
1931 0 : r->out.domains = out;
1932 :
1933 0 : for (i=0; i<trusts.count; i++) {
1934 0 : if (trusts.array[i].sid == NULL) {
1935 0 : continue;
1936 : }
1937 0 : if (dom_sid_equal(trusts.array[i].sid, &global_sid_NULL)) {
1938 0 : continue;
1939 : }
1940 :
1941 0 : n = out->count;
1942 0 : out->array = talloc_realloc(out, out->array,
1943 : struct netr_DomainTrust,
1944 : n + 1);
1945 0 : if (out->array == NULL) {
1946 0 : return NT_STATUS_NO_MEMORY;
1947 : }
1948 0 : out->count = n + 1;
1949 :
1950 0 : out->array[n].netbios_name = talloc_steal(
1951 : out->array, trusts.array[i].netbios_name);
1952 0 : if (out->array[n].netbios_name == NULL) {
1953 0 : return NT_STATUS_NO_MEMORY;
1954 : }
1955 :
1956 0 : out->array[n].dns_name = talloc_steal(
1957 : out->array, trusts.array[i].dns_name);
1958 0 : if (out->array[n].dns_name == NULL) {
1959 0 : return NT_STATUS_NO_MEMORY;
1960 : }
1961 :
1962 0 : out->array[n].sid = dom_sid_dup(out->array,
1963 0 : trusts.array[i].sid);
1964 0 : if (out->array[n].sid == NULL) {
1965 0 : return NT_STATUS_NO_MEMORY;
1966 : }
1967 :
1968 0 : out->array[n].trust_flags = trusts.array[i].trust_flags;
1969 0 : out->array[n].trust_type = trusts.array[i].trust_type;
1970 0 : out->array[n].trust_attributes = trusts.array[i].trust_attributes;
1971 : }
1972 :
1973 0 : return NT_STATUS_OK;
1974 : }
1975 :
1976 : #include "librpc/gen_ndr/ndr_winbind_scompat.c"
|
