Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : In-Child server implementation of the routines defined in wbint.idl
5 :
6 : Copyright (C) Volker Lendecke 2009
7 : Copyright (C) Guenther Deschner 2009
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "winbindd/winbindd.h"
25 : #include "winbindd/winbindd_proto.h"
26 : #include "rpc_client/cli_pipe.h"
27 : #include "ntdomain.h"
28 : #include "librpc/rpc/dcesrv_core.h"
29 : #include "librpc/gen_ndr/ndr_winbind.h"
30 : #include "librpc/gen_ndr/ndr_winbind_scompat.h"
31 : #include "../librpc/gen_ndr/ndr_netlogon_c.h"
32 : #include "../librpc/gen_ndr/ndr_lsa_c.h"
33 : #include "idmap.h"
34 : #include "../libcli/security/security.h"
35 : #include "../libcli/auth/netlogon_creds_cli.h"
36 : #include "passdb.h"
37 : #include "../source4/dsdb/samdb/samdb.h"
38 : #include "rpc_client/cli_netlogon.h"
39 : #include "rpc_client/util_netlogon.h"
40 : #include "libsmb/dsgetdcname.h"
41 : #include "lib/global_contexts.h"
42 :
43 0 : NTSTATUS _wbint_Ping(struct pipes_struct *p, struct wbint_Ping *r)
44 : {
45 0 : *r->out.out_data = r->in.in_data;
46 0 : return NT_STATUS_OK;
47 : }
48 :
49 0 : NTSTATUS _wbint_InitConnection(struct pipes_struct *p,
50 : struct wbint_InitConnection *r)
51 : {
52 0 : struct winbindd_domain *domain = wb_child_domain();
53 :
54 0 : if (r->in.dcname != NULL && strlen(r->in.dcname) > 0) {
55 0 : TALLOC_FREE(domain->dcname);
56 0 : domain->dcname = talloc_strdup(domain, r->in.dcname);
57 0 : if (domain->dcname == NULL) {
58 0 : return NT_STATUS_NO_MEMORY;
59 : }
60 : }
61 :
62 0 : init_dc_connection(domain, false);
63 :
64 0 : if (!domain->initialized) {
65 : /*
66 : * If we return error here we can't do any cached
67 : * authentication, but we may be in disconnected mode and can't
68 : * initialize correctly. Do what the previous code did and just
69 : * return without initialization, once we go online we'll
70 : * re-initialize.
71 : */
72 0 : DBG_INFO("%s returning without initialization online = %d\n",
73 : domain->name, (int)domain->online);
74 : }
75 :
76 0 : *r->out.name = talloc_strdup(p->mem_ctx, domain->name);
77 0 : if (*r->out.name == NULL) {
78 0 : return NT_STATUS_NO_MEMORY;
79 : }
80 :
81 0 : if (domain->alt_name != NULL) {
82 0 : *r->out.alt_name = talloc_strdup(p->mem_ctx, domain->alt_name);
83 0 : if (*r->out.alt_name == NULL) {
84 0 : return NT_STATUS_NO_MEMORY;
85 : }
86 : }
87 :
88 0 : r->out.sid = dom_sid_dup(p->mem_ctx, &domain->sid);
89 0 : if (r->out.sid == NULL) {
90 0 : return NT_STATUS_NO_MEMORY;
91 : }
92 :
93 0 : *r->out.flags = 0;
94 0 : if (domain->native_mode) {
95 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_NATIVE;
96 : }
97 0 : if (domain->active_directory) {
98 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_AD;
99 : }
100 0 : if (domain->primary) {
101 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_PRIMARY;
102 : }
103 :
104 0 : return NT_STATUS_OK;
105 : }
106 :
107 0 : bool reset_cm_connection_on_error(struct winbindd_domain *domain,
108 : struct dcerpc_binding_handle *b,
109 : NTSTATUS status)
110 : {
111 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
112 0 : NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
113 0 : NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
114 0 : invalidate_cm_connection(domain);
115 0 : domain->conn.netlogon_force_reauth = true;
116 0 : return true;
117 : }
118 :
119 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
120 0 : NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR))
121 : {
122 0 : invalidate_cm_connection(domain);
123 : /* We invalidated the connection. */
124 0 : return true;
125 : }
126 :
127 0 : if (b != NULL && !dcerpc_binding_handle_is_connected(b)) {
128 0 : invalidate_cm_connection(domain);
129 0 : return true;
130 : }
131 :
132 0 : return false;
133 : }
134 :
135 0 : NTSTATUS _wbint_LookupSid(struct pipes_struct *p, struct wbint_LookupSid *r)
136 : {
137 0 : struct winbindd_domain *domain = wb_child_domain();
138 : char *dom_name;
139 : char *name;
140 : enum lsa_SidType type;
141 : NTSTATUS status;
142 :
143 0 : if (domain == NULL) {
144 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
145 : }
146 :
147 0 : status = wb_cache_sid_to_name(domain, p->mem_ctx, r->in.sid,
148 : &dom_name, &name, &type);
149 0 : reset_cm_connection_on_error(domain, NULL, status);
150 0 : if (!NT_STATUS_IS_OK(status)) {
151 0 : return status;
152 : }
153 :
154 0 : *r->out.domain = dom_name;
155 0 : *r->out.name = name;
156 0 : *r->out.type = type;
157 0 : return NT_STATUS_OK;
158 : }
159 :
160 0 : NTSTATUS _wbint_LookupSids(struct pipes_struct *p, struct wbint_LookupSids *r)
161 : {
162 0 : struct winbindd_domain *domain = wb_child_domain();
163 0 : struct lsa_RefDomainList *domains = r->out.domains;
164 : NTSTATUS status;
165 0 : bool retry = false;
166 :
167 0 : if (domain == NULL) {
168 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
169 : }
170 :
171 : /*
172 : * This breaks the winbindd_domain->methods abstraction: This
173 : * is only called for remote domains, and both winbindd_msrpc
174 : * and winbindd_ad call into lsa_lookupsids anyway. Caching is
175 : * done at the wbint RPC layer.
176 : */
177 0 : again:
178 0 : status = rpc_lookup_sids(p->mem_ctx, domain, r->in.sids,
179 : &domains, &r->out.names);
180 :
181 0 : if (domains != NULL) {
182 0 : r->out.domains = domains;
183 : }
184 :
185 0 : if (!retry && reset_cm_connection_on_error(domain, NULL, status)) {
186 0 : retry = true;
187 0 : goto again;
188 : }
189 :
190 0 : return status;
191 : }
192 :
193 0 : NTSTATUS _wbint_LookupName(struct pipes_struct *p, struct wbint_LookupName *r)
194 : {
195 0 : struct winbindd_domain *domain = wb_child_domain();
196 : NTSTATUS status;
197 :
198 0 : if (domain == NULL) {
199 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
200 : }
201 :
202 0 : status = wb_cache_name_to_sid(domain, p->mem_ctx, r->in.domain,
203 : r->in.name, r->in.flags,
204 : r->out.sid, r->out.type);
205 0 : reset_cm_connection_on_error(domain, NULL, status);
206 0 : return status;
207 : }
208 :
209 0 : NTSTATUS _wbint_Sids2UnixIDs(struct pipes_struct *p,
210 : struct wbint_Sids2UnixIDs *r)
211 : {
212 : uint32_t i;
213 :
214 : struct lsa_DomainInfo *d;
215 : struct wbint_TransID *ids;
216 : uint32_t num_ids;
217 :
218 0 : struct id_map **id_map_ptrs = NULL;
219 : struct idmap_domain *dom;
220 0 : NTSTATUS status = NT_STATUS_NO_MEMORY;
221 :
222 0 : if (r->in.domains->count != 1) {
223 0 : return NT_STATUS_INVALID_PARAMETER;
224 : }
225 :
226 0 : d = &r->in.domains->domains[0];
227 0 : ids = r->in.ids->ids;
228 0 : num_ids = r->in.ids->num_ids;
229 :
230 0 : dom = idmap_find_domain_with_sid(d->name.string, d->sid);
231 0 : if (dom == NULL) {
232 : struct dom_sid_buf buf;
233 0 : DEBUG(10, ("idmap domain %s:%s not found\n",
234 : d->name.string,
235 : dom_sid_str_buf(d->sid, &buf)));
236 :
237 0 : for (i=0; i<num_ids; i++) {
238 :
239 0 : ids[i].xid = (struct unixid) {
240 : .id = UINT32_MAX,
241 : .type = ID_TYPE_NOT_SPECIFIED
242 : };
243 : }
244 :
245 0 : return NT_STATUS_OK;
246 : }
247 :
248 0 : id_map_ptrs = id_map_ptrs_init(talloc_tos(), num_ids);
249 0 : if (id_map_ptrs == NULL) {
250 0 : goto nomem;
251 : }
252 :
253 : /*
254 : * Convert the input data into a list of id_map structs
255 : * suitable for handing in to the idmap sids_to_unixids
256 : * method.
257 : */
258 :
259 0 : for (i=0; i<num_ids; i++) {
260 0 : struct id_map *m = id_map_ptrs[i];
261 :
262 0 : sid_compose(m->sid, d->sid, ids[i].rid);
263 0 : m->status = ID_UNKNOWN;
264 0 : m->xid = (struct unixid) { .type = ids[i].type_hint };
265 : }
266 :
267 0 : status = dom->methods->sids_to_unixids(dom, id_map_ptrs);
268 :
269 0 : if (NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
270 : /*
271 : * This is okay. We need to transfer the mapped ones
272 : * up to our caller. The individual mappings carry the
273 : * information whether they are mapped or not.
274 : */
275 0 : status = NT_STATUS_OK;
276 : }
277 :
278 0 : if (!NT_STATUS_IS_OK(status)) {
279 0 : DEBUG(10, ("sids_to_unixids returned %s\n",
280 : nt_errstr(status)));
281 0 : goto done;
282 : }
283 :
284 : /*
285 : * Extract the results for handing them back to the caller.
286 : */
287 :
288 0 : for (i=0; i<num_ids; i++) {
289 0 : struct id_map *m = id_map_ptrs[i];
290 :
291 0 : if (m->status == ID_REQUIRE_TYPE) {
292 0 : ids[i].xid.id = UINT32_MAX;
293 0 : ids[i].xid.type = ID_TYPE_WB_REQUIRE_TYPE;
294 0 : continue;
295 : }
296 :
297 0 : if (!idmap_unix_id_is_in_range(m->xid.id, dom)) {
298 0 : DBG_DEBUG("id %"PRIu32" is out of range "
299 : "%"PRIu32"-%"PRIu32" for domain %s\n",
300 : m->xid.id, dom->low_id, dom->high_id,
301 : dom->name);
302 0 : m->status = ID_UNMAPPED;
303 : }
304 :
305 0 : if (m->status == ID_MAPPED) {
306 0 : ids[i].xid = m->xid;
307 : } else {
308 0 : ids[i].xid.id = UINT32_MAX;
309 0 : ids[i].xid.type = ID_TYPE_NOT_SPECIFIED;
310 : }
311 : }
312 :
313 0 : goto done;
314 0 : nomem:
315 0 : status = NT_STATUS_NO_MEMORY;
316 0 : done:
317 0 : TALLOC_FREE(id_map_ptrs);
318 0 : return status;
319 : }
320 :
321 0 : NTSTATUS _wbint_UnixIDs2Sids(struct pipes_struct *p,
322 : struct wbint_UnixIDs2Sids *r)
323 : {
324 : struct id_map **maps;
325 : NTSTATUS status;
326 : uint32_t i;
327 :
328 0 : maps = id_map_ptrs_init(talloc_tos(), r->in.num_ids);
329 0 : if (maps == NULL) {
330 0 : return NT_STATUS_NO_MEMORY;
331 : }
332 :
333 0 : for (i=0; i<r->in.num_ids; i++) {
334 0 : maps[i]->status = ID_UNKNOWN;
335 0 : maps[i]->xid = r->in.xids[i];
336 : }
337 :
338 0 : status = idmap_backend_unixids_to_sids(maps, r->in.domain_name,
339 : r->in.domain_sid);
340 0 : if (!NT_STATUS_IS_OK(status)) {
341 0 : TALLOC_FREE(maps);
342 0 : return status;
343 : }
344 :
345 0 : for (i=0; i<r->in.num_ids; i++) {
346 0 : if (maps[i]->status == ID_MAPPED) {
347 0 : r->out.xids[i] = maps[i]->xid;
348 0 : sid_copy(&r->out.sids[i], maps[i]->sid);
349 : } else {
350 0 : r->out.sids[i] = (struct dom_sid) { 0 };
351 : }
352 : }
353 :
354 0 : TALLOC_FREE(maps);
355 :
356 0 : return NT_STATUS_OK;
357 : }
358 :
359 0 : NTSTATUS _wbint_AllocateUid(struct pipes_struct *p, struct wbint_AllocateUid *r)
360 : {
361 : struct unixid xid;
362 : NTSTATUS status;
363 :
364 0 : status = idmap_allocate_uid(&xid);
365 0 : if (!NT_STATUS_IS_OK(status)) {
366 0 : return status;
367 : }
368 0 : *r->out.uid = xid.id;
369 0 : return NT_STATUS_OK;
370 : }
371 :
372 0 : NTSTATUS _wbint_AllocateGid(struct pipes_struct *p, struct wbint_AllocateGid *r)
373 : {
374 : struct unixid xid;
375 : NTSTATUS status;
376 :
377 0 : status = idmap_allocate_gid(&xid);
378 0 : if (!NT_STATUS_IS_OK(status)) {
379 0 : return status;
380 : }
381 0 : *r->out.gid = xid.id;
382 0 : return NT_STATUS_OK;
383 : }
384 :
385 0 : NTSTATUS _wbint_GetNssInfo(struct pipes_struct *p, struct wbint_GetNssInfo *r)
386 : {
387 : struct idmap_domain *domain;
388 : NTSTATUS status;
389 :
390 0 : domain = idmap_find_domain(r->in.info->domain_name);
391 0 : if ((domain == NULL) || (domain->query_user == NULL)) {
392 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
393 : }
394 :
395 0 : status = domain->query_user(domain, r->in.info);
396 0 : return status;
397 : }
398 :
399 0 : NTSTATUS _wbint_LookupUserAliases(struct pipes_struct *p,
400 : struct wbint_LookupUserAliases *r)
401 : {
402 0 : struct winbindd_domain *domain = wb_child_domain();
403 : NTSTATUS status;
404 :
405 0 : if (domain == NULL) {
406 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
407 : }
408 :
409 0 : status = wb_cache_lookup_useraliases(domain, p->mem_ctx,
410 0 : r->in.sids->num_sids,
411 0 : r->in.sids->sids,
412 0 : &r->out.rids->num_rids,
413 0 : &r->out.rids->rids);
414 0 : reset_cm_connection_on_error(domain, NULL, status);
415 0 : return status;
416 : }
417 :
418 0 : NTSTATUS _wbint_LookupUserGroups(struct pipes_struct *p,
419 : struct wbint_LookupUserGroups *r)
420 : {
421 0 : struct winbindd_domain *domain = wb_child_domain();
422 : NTSTATUS status;
423 :
424 0 : if (domain == NULL) {
425 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
426 : }
427 :
428 0 : status = wb_cache_lookup_usergroups(domain, p->mem_ctx, r->in.sid,
429 0 : &r->out.sids->num_sids,
430 0 : &r->out.sids->sids);
431 0 : reset_cm_connection_on_error(domain, NULL, status);
432 0 : return status;
433 : }
434 :
435 0 : NTSTATUS _wbint_QuerySequenceNumber(struct pipes_struct *p,
436 : struct wbint_QuerySequenceNumber *r)
437 : {
438 0 : struct winbindd_domain *domain = wb_child_domain();
439 : NTSTATUS status;
440 :
441 0 : if (domain == NULL) {
442 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
443 : }
444 :
445 0 : status = wb_cache_sequence_number(domain, r->out.sequence);
446 0 : reset_cm_connection_on_error(domain, NULL, status);
447 0 : return status;
448 : }
449 :
450 0 : NTSTATUS _wbint_LookupGroupMembers(struct pipes_struct *p,
451 : struct wbint_LookupGroupMembers *r)
452 : {
453 0 : struct winbindd_domain *domain = wb_child_domain();
454 : uint32_t i, num_names;
455 : struct dom_sid *sid_mem;
456 : char **names;
457 : uint32_t *name_types;
458 : NTSTATUS status;
459 :
460 0 : if (domain == NULL) {
461 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
462 : }
463 :
464 0 : status = wb_cache_lookup_groupmem(domain, p->mem_ctx, r->in.sid,
465 : r->in.type, &num_names, &sid_mem,
466 : &names, &name_types);
467 0 : reset_cm_connection_on_error(domain, NULL, status);
468 0 : if (!NT_STATUS_IS_OK(status)) {
469 0 : return status;
470 : }
471 :
472 0 : r->out.members->num_principals = num_names;
473 0 : r->out.members->principals = talloc_array(
474 : r->out.members, struct wbint_Principal, num_names);
475 0 : if (r->out.members->principals == NULL) {
476 0 : return NT_STATUS_NO_MEMORY;
477 : }
478 :
479 0 : for (i=0; i<num_names; i++) {
480 0 : struct wbint_Principal *m = &r->out.members->principals[i];
481 0 : sid_copy(&m->sid, &sid_mem[i]);
482 0 : m->name = talloc_move(r->out.members->principals, &names[i]);
483 0 : m->type = (enum lsa_SidType)name_types[i];
484 : }
485 :
486 0 : return NT_STATUS_OK;
487 : }
488 :
489 0 : NTSTATUS _wbint_QueryGroupList(struct pipes_struct *p,
490 : struct wbint_QueryGroupList *r)
491 : {
492 0 : TALLOC_CTX *frame = NULL;
493 0 : struct winbindd_domain *domain = wb_child_domain();
494 : uint32_t i;
495 0 : uint32_t num_local_groups = 0;
496 0 : struct wb_acct_info *local_groups = NULL;
497 0 : uint32_t num_dom_groups = 0;
498 0 : struct wb_acct_info *dom_groups = NULL;
499 0 : uint32_t ti = 0;
500 0 : uint64_t num_total = 0;
501 : struct wbint_Principal *result;
502 0 : NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
503 0 : bool include_local_groups = false;
504 :
505 0 : if (domain == NULL) {
506 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
507 : }
508 :
509 0 : frame = talloc_stackframe();
510 :
511 0 : switch (lp_server_role()) {
512 0 : case ROLE_ACTIVE_DIRECTORY_DC:
513 0 : if (domain->internal) {
514 : /*
515 : * we want to include local groups
516 : * for BUILTIN and WORKGROUP
517 : */
518 0 : include_local_groups = true;
519 : }
520 0 : break;
521 0 : default:
522 : /*
523 : * We might include local groups in more
524 : * setups later, but that requires more work
525 : * elsewhere.
526 : */
527 0 : break;
528 : }
529 :
530 0 : if (include_local_groups) {
531 0 : status = wb_cache_enum_local_groups(domain, frame,
532 : &num_local_groups,
533 : &local_groups);
534 0 : reset_cm_connection_on_error(domain, NULL, status);
535 0 : if (!NT_STATUS_IS_OK(status)) {
536 0 : goto out;
537 : }
538 : }
539 :
540 0 : status = wb_cache_enum_dom_groups(domain, frame,
541 : &num_dom_groups,
542 : &dom_groups);
543 0 : reset_cm_connection_on_error(domain, NULL, status);
544 0 : if (!NT_STATUS_IS_OK(status)) {
545 0 : goto out;
546 : }
547 :
548 0 : num_total = num_local_groups + num_dom_groups;
549 0 : if (num_total > UINT32_MAX) {
550 0 : status = NT_STATUS_INTERNAL_ERROR;
551 0 : goto out;
552 : }
553 :
554 0 : result = talloc_array(frame, struct wbint_Principal, num_total);
555 0 : if (result == NULL) {
556 0 : status = NT_STATUS_NO_MEMORY;
557 0 : goto out;
558 : }
559 :
560 0 : for (i = 0; i < num_local_groups; i++) {
561 0 : struct wb_acct_info *lg = &local_groups[i];
562 0 : struct wbint_Principal *rg = &result[ti++];
563 :
564 0 : sid_compose(&rg->sid, &domain->sid, lg->rid);
565 0 : rg->type = SID_NAME_ALIAS;
566 0 : rg->name = talloc_strdup(result, lg->acct_name);
567 0 : if (rg->name == NULL) {
568 0 : status = NT_STATUS_NO_MEMORY;
569 0 : goto out;
570 : }
571 : }
572 0 : num_local_groups = 0;
573 :
574 0 : for (i = 0; i < num_dom_groups; i++) {
575 0 : struct wb_acct_info *dg = &dom_groups[i];
576 0 : struct wbint_Principal *rg = &result[ti++];
577 :
578 0 : sid_compose(&rg->sid, &domain->sid, dg->rid);
579 0 : rg->type = SID_NAME_DOM_GRP;
580 0 : rg->name = talloc_strdup(result, dg->acct_name);
581 0 : if (rg->name == NULL) {
582 0 : status = NT_STATUS_NO_MEMORY;
583 0 : goto out;
584 : }
585 : }
586 0 : num_dom_groups = 0;
587 :
588 0 : r->out.groups->num_principals = ti;
589 0 : r->out.groups->principals = talloc_move(r->out.groups, &result);
590 :
591 0 : status = NT_STATUS_OK;
592 0 : out:
593 0 : TALLOC_FREE(frame);
594 0 : return status;
595 : }
596 :
597 0 : NTSTATUS _wbint_QueryUserRidList(struct pipes_struct *p,
598 : struct wbint_QueryUserRidList *r)
599 : {
600 0 : struct winbindd_domain *domain = wb_child_domain();
601 : NTSTATUS status;
602 :
603 0 : if (domain == NULL) {
604 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
605 : }
606 :
607 : /*
608 : * Right now this is overkill. We should add a backend call
609 : * just querying the rids.
610 : */
611 :
612 0 : status = wb_cache_query_user_list(domain, p->mem_ctx,
613 0 : &r->out.rids->rids);
614 0 : reset_cm_connection_on_error(domain, NULL, status);
615 :
616 0 : if (!NT_STATUS_IS_OK(status)) {
617 0 : return status;
618 : }
619 :
620 0 : r->out.rids->num_rids = talloc_array_length(r->out.rids->rids);
621 :
622 0 : return NT_STATUS_OK;
623 : }
624 :
625 0 : NTSTATUS _wbint_DsGetDcName(struct pipes_struct *p, struct wbint_DsGetDcName *r)
626 : {
627 0 : struct winbindd_domain *domain = wb_child_domain();
628 : struct rpc_pipe_client *netlogon_pipe;
629 : struct netr_DsRGetDCNameInfo *dc_info;
630 : NTSTATUS status;
631 : WERROR werr;
632 : unsigned int orig_timeout;
633 : struct dcerpc_binding_handle *b;
634 0 : bool retry = false;
635 0 : bool try_dsrgetdcname = false;
636 :
637 0 : if (domain == NULL) {
638 0 : return dsgetdcname(p->mem_ctx, global_messaging_context(),
639 0 : r->in.domain_name, r->in.domain_guid,
640 0 : r->in.site_name ? r->in.site_name : "",
641 : r->in.flags,
642 : r->out.dc_info);
643 : }
644 :
645 0 : if (domain->active_directory) {
646 0 : try_dsrgetdcname = true;
647 : }
648 :
649 0 : reconnect:
650 0 : status = cm_connect_netlogon(domain, &netlogon_pipe);
651 :
652 0 : reset_cm_connection_on_error(domain, NULL, status);
653 0 : if (!NT_STATUS_IS_OK(status)) {
654 0 : DEBUG(10, ("Can't contact the NETLOGON pipe\n"));
655 0 : return status;
656 : }
657 :
658 0 : b = netlogon_pipe->binding_handle;
659 :
660 : /* This call can take a long time - allow the server to time out.
661 : 35 seconds should do it. */
662 :
663 0 : orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
664 :
665 0 : if (try_dsrgetdcname) {
666 0 : status = dcerpc_netr_DsRGetDCName(b,
667 0 : p->mem_ctx, domain->dcname,
668 : r->in.domain_name, NULL, r->in.domain_guid,
669 : r->in.flags, r->out.dc_info, &werr);
670 0 : if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(werr)) {
671 0 : goto done;
672 : }
673 0 : if (!retry &&
674 0 : reset_cm_connection_on_error(domain, NULL, status))
675 : {
676 0 : retry = true;
677 0 : goto reconnect;
678 : }
679 0 : try_dsrgetdcname = false;
680 0 : retry = false;
681 : }
682 :
683 : /*
684 : * Fallback to less capable methods
685 : */
686 :
687 0 : dc_info = talloc_zero(r->out.dc_info, struct netr_DsRGetDCNameInfo);
688 0 : if (dc_info == NULL) {
689 0 : status = NT_STATUS_NO_MEMORY;
690 0 : goto done;
691 : }
692 :
693 0 : if (r->in.flags & DS_PDC_REQUIRED) {
694 0 : status = dcerpc_netr_GetDcName(b,
695 0 : p->mem_ctx, domain->dcname,
696 : r->in.domain_name, &dc_info->dc_unc, &werr);
697 : } else {
698 0 : status = dcerpc_netr_GetAnyDCName(b,
699 0 : p->mem_ctx, domain->dcname,
700 : r->in.domain_name, &dc_info->dc_unc, &werr);
701 : }
702 :
703 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
704 0 : retry = true;
705 0 : goto reconnect;
706 : }
707 0 : if (!NT_STATUS_IS_OK(status)) {
708 0 : DEBUG(10, ("dcerpc_netr_Get[Any]DCName failed: %s\n",
709 : nt_errstr(status)));
710 0 : goto done;
711 : }
712 0 : if (!W_ERROR_IS_OK(werr)) {
713 0 : DEBUG(10, ("dcerpc_netr_Get[Any]DCName failed: %s\n",
714 : win_errstr(werr)));
715 0 : status = werror_to_ntstatus(werr);
716 0 : goto done;
717 : }
718 :
719 0 : *r->out.dc_info = dc_info;
720 0 : status = NT_STATUS_OK;
721 :
722 0 : done:
723 : /* And restore our original timeout. */
724 0 : rpccli_set_timeout(netlogon_pipe, orig_timeout);
725 :
726 0 : return status;
727 : }
728 :
729 0 : NTSTATUS _wbint_LookupRids(struct pipes_struct *p, struct wbint_LookupRids *r)
730 : {
731 0 : struct winbindd_domain *domain = wb_child_domain();
732 : char *domain_name;
733 : char **names;
734 : enum lsa_SidType *types;
735 : struct wbint_Principal *result;
736 : NTSTATUS status;
737 : uint32_t i;
738 :
739 0 : if (domain == NULL) {
740 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
741 : }
742 :
743 0 : status = wb_cache_rids_to_names(domain, talloc_tos(), r->in.domain_sid,
744 0 : r->in.rids->rids, r->in.rids->num_rids,
745 : &domain_name, &names, &types);
746 0 : reset_cm_connection_on_error(domain, NULL, status);
747 0 : if (!NT_STATUS_IS_OK(status) &&
748 0 : !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
749 0 : return status;
750 : }
751 :
752 0 : *r->out.domain_name = talloc_move(r->out.domain_name, &domain_name);
753 :
754 0 : result = talloc_array(p->mem_ctx, struct wbint_Principal,
755 : r->in.rids->num_rids);
756 0 : if (result == NULL) {
757 0 : return NT_STATUS_NO_MEMORY;
758 : }
759 :
760 0 : for (i=0; i<r->in.rids->num_rids; i++) {
761 0 : sid_compose(&result[i].sid, r->in.domain_sid,
762 0 : r->in.rids->rids[i]);
763 0 : result[i].type = types[i];
764 0 : result[i].name = talloc_move(result, &names[i]);
765 : }
766 0 : TALLOC_FREE(types);
767 0 : TALLOC_FREE(names);
768 :
769 0 : r->out.names->num_principals = r->in.rids->num_rids;
770 0 : r->out.names->principals = result;
771 0 : return NT_STATUS_OK;
772 : }
773 :
774 0 : NTSTATUS _wbint_CheckMachineAccount(struct pipes_struct *p,
775 : struct wbint_CheckMachineAccount *r)
776 : {
777 : struct winbindd_domain *domain;
778 0 : int num_retries = 0;
779 : NTSTATUS status;
780 :
781 0 : domain = wb_child_domain();
782 0 : if (domain == NULL) {
783 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
784 : }
785 :
786 0 : again:
787 0 : invalidate_cm_connection(domain);
788 0 : domain->conn.netlogon_force_reauth = true;
789 :
790 : {
791 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
792 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
793 0 : status = cm_connect_netlogon_secure(domain,
794 : &netlogon_pipe,
795 : &netlogon_creds_ctx);
796 : }
797 :
798 : /* There is a race condition between fetching the trust account
799 : password and the periodic machine password change. So it's
800 : possible that the trust account password has been changed on us.
801 : We are returned NT_STATUS_ACCESS_DENIED if this happens. */
802 :
803 : #define MAX_RETRIES 3
804 :
805 0 : if ((num_retries < MAX_RETRIES)
806 0 : && NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
807 0 : num_retries++;
808 0 : goto again;
809 : }
810 :
811 0 : if (!NT_STATUS_IS_OK(status)) {
812 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
813 0 : goto done;
814 : }
815 :
816 : /* Pass back result code - zero for success, other values for
817 : specific failures. */
818 :
819 0 : DEBUG(3,("domain %s secret is %s\n", domain->name,
820 : NT_STATUS_IS_OK(status) ? "good" : "bad"));
821 :
822 0 : done:
823 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
824 : ("Checking the trust account password for domain %s returned %s\n",
825 : domain->name, nt_errstr(status)));
826 :
827 0 : return status;
828 : }
829 :
830 0 : NTSTATUS _wbint_ChangeMachineAccount(struct pipes_struct *p,
831 : struct wbint_ChangeMachineAccount *r)
832 : {
833 0 : struct messaging_context *msg_ctx = global_messaging_context();
834 : struct winbindd_domain *domain;
835 : NTSTATUS status;
836 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
837 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
838 :
839 0 : domain = wb_child_domain();
840 0 : if (domain == NULL) {
841 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
842 : }
843 :
844 0 : status = cm_connect_netlogon_secure(domain,
845 : &netlogon_pipe,
846 : &netlogon_creds_ctx);
847 0 : if (!NT_STATUS_IS_OK(status)) {
848 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
849 0 : goto done;
850 : }
851 :
852 0 : status = trust_pw_change(netlogon_creds_ctx,
853 : msg_ctx,
854 0 : netlogon_pipe->binding_handle,
855 0 : domain->name,
856 0 : domain->dcname,
857 : true); /* force */
858 :
859 : /* Pass back result code - zero for success, other values for
860 : specific failures. */
861 :
862 0 : DEBUG(3,("domain %s secret %s\n", domain->name,
863 : NT_STATUS_IS_OK(status) ? "changed" : "unchanged"));
864 :
865 0 : done:
866 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
867 : ("Changing the trust account password for domain %s returned %s\n",
868 : domain->name, nt_errstr(status)));
869 :
870 0 : return status;
871 : }
872 :
873 0 : NTSTATUS _wbint_PingDc(struct pipes_struct *p, struct wbint_PingDc *r)
874 : {
875 : NTSTATUS status;
876 : struct winbindd_domain *domain;
877 : struct rpc_pipe_client *netlogon_pipe;
878 : union netr_CONTROL_QUERY_INFORMATION info;
879 : WERROR werr;
880 : fstring logon_server;
881 : struct dcerpc_binding_handle *b;
882 0 : bool retry = false;
883 :
884 0 : domain = wb_child_domain();
885 0 : if (domain == NULL) {
886 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
887 : }
888 :
889 0 : reconnect:
890 0 : status = cm_connect_netlogon(domain, &netlogon_pipe);
891 0 : reset_cm_connection_on_error(domain, NULL, status);
892 0 : if (!NT_STATUS_IS_OK(status)) {
893 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
894 : nt_errstr(status)));
895 0 : return status;
896 : }
897 :
898 0 : b = netlogon_pipe->binding_handle;
899 :
900 0 : fstr_sprintf(logon_server, "\\\\%s", domain->dcname);
901 0 : *r->out.dcname = talloc_strdup(p->mem_ctx, domain->dcname);
902 0 : if (*r->out.dcname == NULL) {
903 0 : DEBUG(2, ("Could not allocate memory\n"));
904 0 : return NT_STATUS_NO_MEMORY;
905 : }
906 :
907 : /*
908 : * This provokes a WERR_NOT_SUPPORTED error message. This is
909 : * documented in the wspp docs. I could not get a successful
910 : * call to work, but the main point here is testing that the
911 : * netlogon pipe works.
912 : */
913 0 : status = dcerpc_netr_LogonControl(b, p->mem_ctx,
914 : logon_server, NETLOGON_CONTROL_QUERY,
915 : 2, &info, &werr);
916 :
917 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
918 0 : retry = true;
919 0 : goto reconnect;
920 : }
921 :
922 0 : if (!NT_STATUS_IS_OK(status)) {
923 0 : DEBUG(2, ("dcerpc_netr_LogonControl failed: %s\n",
924 : nt_errstr(status)));
925 0 : return status;
926 : }
927 :
928 0 : if (!W_ERROR_EQUAL(werr, WERR_NOT_SUPPORTED)) {
929 0 : DEBUG(2, ("dcerpc_netr_LogonControl returned %s, expected "
930 : "WERR_NOT_SUPPORTED\n",
931 : win_errstr(werr)));
932 0 : return werror_to_ntstatus(werr);
933 : }
934 :
935 0 : DEBUG(5, ("winbindd_dual_ping_dc succeeded\n"));
936 0 : return NT_STATUS_OK;
937 : }
938 :
939 0 : NTSTATUS _winbind_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p,
940 : struct winbind_DsrUpdateReadOnlyServerDnsRecords *r)
941 : {
942 : struct winbindd_domain *domain;
943 : NTSTATUS status;
944 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
945 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
946 0 : struct dcerpc_binding_handle *b = NULL;
947 0 : bool retry = false;
948 :
949 0 : domain = wb_child_domain();
950 0 : if (domain == NULL) {
951 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
952 : }
953 :
954 0 : reconnect:
955 0 : status = cm_connect_netlogon_secure(domain,
956 : &netlogon_pipe,
957 : &netlogon_creds_ctx);
958 0 : if (!NT_STATUS_IS_OK(status)) {
959 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
960 0 : goto done;
961 : }
962 :
963 0 : b = netlogon_pipe->binding_handle;
964 :
965 0 : status = netlogon_creds_cli_DsrUpdateReadOnlyServerDnsRecords(netlogon_creds_ctx,
966 0 : netlogon_pipe->binding_handle,
967 : r->in.site_name,
968 : r->in.dns_ttl,
969 : r->in.dns_names);
970 :
971 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
972 0 : retry = true;
973 0 : goto reconnect;
974 : }
975 :
976 : /* Pass back result code - zero for success, other values for
977 : specific failures. */
978 :
979 0 : DEBUG(3,("DNS records for domain %s %s\n", domain->name,
980 : NT_STATUS_IS_OK(status) ? "changed" : "unchanged"));
981 :
982 0 : done:
983 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
984 : ("Update of DNS records via RW DC %s returned %s\n",
985 : domain->name, nt_errstr(status)));
986 :
987 0 : return status;
988 : }
989 :
990 0 : NTSTATUS _winbind_SamLogon(struct pipes_struct *p,
991 : struct winbind_SamLogon *r)
992 : {
993 0 : struct dcesrv_call_state *dce_call = p->dce_call;
994 0 : struct dcesrv_connection *dcesrv_conn = dce_call->conn;
995 0 : const struct tsocket_address *local_address =
996 0 : dcesrv_connection_get_local_address(dcesrv_conn);
997 0 : const struct tsocket_address *remote_address =
998 0 : dcesrv_connection_get_remote_address(dcesrv_conn);
999 : struct winbindd_domain *domain;
1000 : NTSTATUS status;
1001 0 : struct netr_IdentityInfo *identity_info = NULL;
1002 : DATA_BLOB lm_response, nt_response;
1003 0 : DATA_BLOB challenge = data_blob_null;
1004 0 : uint32_t flags = 0;
1005 : uint16_t validation_level;
1006 0 : union netr_Validation *validation = NULL;
1007 0 : bool interactive = false;
1008 :
1009 : /*
1010 : * Make sure we start with authoritative=true,
1011 : * it will only set to false if we don't know the
1012 : * domain.
1013 : */
1014 0 : r->out.authoritative = true;
1015 :
1016 0 : domain = wb_child_domain();
1017 0 : if (domain == NULL) {
1018 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1019 : }
1020 :
1021 0 : switch (r->in.validation_level) {
1022 0 : case 3:
1023 : case 6:
1024 0 : break;
1025 0 : default:
1026 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1027 : }
1028 :
1029 0 : switch (r->in.logon_level) {
1030 0 : case NetlogonInteractiveInformation:
1031 : case NetlogonServiceInformation:
1032 : case NetlogonInteractiveTransitiveInformation:
1033 : case NetlogonServiceTransitiveInformation:
1034 0 : if (r->in.logon.password == NULL) {
1035 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1036 : }
1037 :
1038 0 : interactive = true;
1039 0 : identity_info = &r->in.logon.password->identity_info;
1040 :
1041 0 : challenge = data_blob_null;
1042 0 : lm_response = data_blob_talloc(p->mem_ctx,
1043 : r->in.logon.password->lmpassword.hash,
1044 : sizeof(r->in.logon.password->lmpassword.hash));
1045 0 : nt_response = data_blob_talloc(p->mem_ctx,
1046 : r->in.logon.password->ntpassword.hash,
1047 : sizeof(r->in.logon.password->ntpassword.hash));
1048 0 : break;
1049 :
1050 0 : case NetlogonNetworkInformation:
1051 : case NetlogonNetworkTransitiveInformation:
1052 0 : if (r->in.logon.network == NULL) {
1053 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1054 : }
1055 :
1056 0 : interactive = false;
1057 0 : identity_info = &r->in.logon.network->identity_info;
1058 :
1059 0 : challenge = data_blob_talloc(p->mem_ctx,
1060 : r->in.logon.network->challenge,
1061 : 8);
1062 0 : lm_response = data_blob_talloc(p->mem_ctx,
1063 : r->in.logon.network->lm.data,
1064 : r->in.logon.network->lm.length);
1065 0 : nt_response = data_blob_talloc(p->mem_ctx,
1066 : r->in.logon.network->nt.data,
1067 : r->in.logon.network->nt.length);
1068 0 : break;
1069 :
1070 0 : case NetlogonGenericInformation:
1071 0 : if (r->in.logon.generic == NULL) {
1072 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1073 : }
1074 :
1075 0 : identity_info = &r->in.logon.generic->identity_info;
1076 : /*
1077 : * Not implemented here...
1078 : */
1079 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1080 :
1081 0 : default:
1082 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1083 : }
1084 :
1085 0 : status = winbind_dual_SamLogon(domain, p->mem_ctx,
1086 : interactive,
1087 : identity_info->parameter_control,
1088 : identity_info->account_name.string,
1089 : identity_info->domain_name.string,
1090 : identity_info->workstation.string,
1091 : identity_info->logon_id,
1092 : "SamLogon",
1093 : 0,
1094 : challenge,
1095 : lm_response, nt_response,
1096 : remote_address,
1097 : local_address,
1098 : &r->out.authoritative,
1099 : true, /* skip_sam */
1100 : &flags,
1101 : &validation_level,
1102 : &validation);
1103 0 : if (!NT_STATUS_IS_OK(status)) {
1104 0 : return status;
1105 : }
1106 0 : switch (r->in.validation_level) {
1107 0 : case 3:
1108 0 : status = map_validation_to_info3(p->mem_ctx,
1109 : validation_level,
1110 : validation,
1111 : &r->out.validation.sam3);
1112 0 : TALLOC_FREE(validation);
1113 0 : if (!NT_STATUS_IS_OK(status)) {
1114 0 : return status;
1115 : }
1116 0 : return NT_STATUS_OK;
1117 0 : case 6:
1118 0 : status = map_validation_to_info6(p->mem_ctx,
1119 : validation_level,
1120 : validation,
1121 : &r->out.validation.sam6);
1122 0 : TALLOC_FREE(validation);
1123 0 : if (!NT_STATUS_IS_OK(status)) {
1124 0 : return status;
1125 : }
1126 0 : return NT_STATUS_OK;
1127 : }
1128 :
1129 0 : smb_panic(__location__);
1130 : return NT_STATUS_INTERNAL_ERROR;
1131 : }
1132 :
1133 0 : static WERROR _winbind_LogonControl_REDISCOVER(struct pipes_struct *p,
1134 : struct winbindd_domain *domain,
1135 : struct winbind_LogonControl *r)
1136 : {
1137 : NTSTATUS status;
1138 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1139 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1140 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1141 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1142 :
1143 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1144 0 : if (info2 == NULL) {
1145 0 : return WERR_NOT_ENOUGH_MEMORY;
1146 : }
1147 :
1148 0 : if (domain->internal) {
1149 0 : check_result = WERR_OK;
1150 0 : goto check_return;
1151 : }
1152 :
1153 : /*
1154 : * For now we just force a reconnect
1155 : *
1156 : * TODO: take care of the optional '\dcname'
1157 : */
1158 0 : invalidate_cm_connection(domain);
1159 0 : domain->conn.netlogon_force_reauth = true;
1160 0 : status = cm_connect_netlogon_secure(domain,
1161 : &netlogon_pipe,
1162 : &netlogon_creds_ctx);
1163 0 : reset_cm_connection_on_error(domain, NULL, status);
1164 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1165 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1166 : }
1167 0 : if (!NT_STATUS_IS_OK(status)) {
1168 0 : DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
1169 : __func__, domain->name, domain->alt_name,
1170 : nt_errstr(status)));
1171 : /*
1172 : * Here we return a top level error!
1173 : * This is different than TC_QUERY or TC_VERIFY.
1174 : */
1175 0 : return ntstatus_to_werror(status);
1176 : }
1177 0 : check_result = WERR_OK;
1178 :
1179 0 : check_return:
1180 0 : info2->pdc_connection_status = WERR_OK;
1181 0 : if (domain->dcname != NULL) {
1182 0 : info2->flags |= NETLOGON_HAS_IP;
1183 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1184 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1185 : domain->dcname);
1186 0 : if (info2->trusted_dc_name == NULL) {
1187 0 : return WERR_NOT_ENOUGH_MEMORY;
1188 : }
1189 : } else {
1190 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1191 0 : if (info2->trusted_dc_name == NULL) {
1192 0 : return WERR_NOT_ENOUGH_MEMORY;
1193 : }
1194 : }
1195 0 : info2->tc_connection_status = check_result;
1196 :
1197 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1198 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1199 : "pdc_connection[%s] tc_connection[%s]\n",
1200 : __func__, domain->name, domain->alt_name,
1201 : domain->dcname,
1202 : win_errstr(info2->pdc_connection_status),
1203 : win_errstr(info2->tc_connection_status)));
1204 : }
1205 :
1206 0 : r->out.query->info2 = info2;
1207 :
1208 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1209 0 : return WERR_OK;
1210 : }
1211 :
1212 0 : static WERROR _winbind_LogonControl_TC_QUERY(struct pipes_struct *p,
1213 : struct winbindd_domain *domain,
1214 : struct winbind_LogonControl *r)
1215 : {
1216 : NTSTATUS status;
1217 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1218 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1219 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1220 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1221 :
1222 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1223 0 : if (info2 == NULL) {
1224 0 : return WERR_NOT_ENOUGH_MEMORY;
1225 : }
1226 :
1227 0 : if (domain->internal) {
1228 0 : check_result = WERR_OK;
1229 0 : goto check_return;
1230 : }
1231 :
1232 0 : status = cm_connect_netlogon_secure(domain,
1233 : &netlogon_pipe,
1234 : &netlogon_creds_ctx);
1235 0 : reset_cm_connection_on_error(domain, NULL, status);
1236 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1237 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1238 : }
1239 0 : if (!NT_STATUS_IS_OK(status)) {
1240 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1241 : nt_errstr(status)));
1242 0 : check_result = ntstatus_to_werror(status);
1243 0 : goto check_return;
1244 : }
1245 0 : check_result = WERR_OK;
1246 :
1247 0 : check_return:
1248 0 : info2->pdc_connection_status = WERR_OK;
1249 0 : if (domain->dcname != NULL) {
1250 0 : info2->flags |= NETLOGON_HAS_IP;
1251 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1252 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1253 : domain->dcname);
1254 0 : if (info2->trusted_dc_name == NULL) {
1255 0 : return WERR_NOT_ENOUGH_MEMORY;
1256 : }
1257 : } else {
1258 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1259 0 : if (info2->trusted_dc_name == NULL) {
1260 0 : return WERR_NOT_ENOUGH_MEMORY;
1261 : }
1262 : }
1263 0 : info2->tc_connection_status = check_result;
1264 :
1265 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1266 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1267 : "pdc_connection[%s] tc_connection[%s]\n",
1268 : __func__, domain->name, domain->alt_name,
1269 : domain->dcname,
1270 : win_errstr(info2->pdc_connection_status),
1271 : win_errstr(info2->tc_connection_status)));
1272 : }
1273 :
1274 0 : r->out.query->info2 = info2;
1275 :
1276 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1277 0 : return WERR_OK;
1278 : }
1279 :
1280 0 : static WERROR _winbind_LogonControl_TC_VERIFY(struct pipes_struct *p,
1281 : struct winbindd_domain *domain,
1282 : struct winbind_LogonControl *r)
1283 : {
1284 0 : TALLOC_CTX *frame = talloc_stackframe();
1285 : NTSTATUS status;
1286 : NTSTATUS result;
1287 0 : struct lsa_String trusted_domain_name = {};
1288 0 : struct lsa_StringLarge trusted_domain_name_l = {};
1289 0 : struct rpc_pipe_client *local_lsa_pipe = NULL;
1290 0 : struct policy_handle local_lsa_policy = {};
1291 0 : struct dcerpc_binding_handle *local_lsa = NULL;
1292 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1293 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1294 0 : struct cli_credentials *creds = NULL;
1295 0 : struct samr_Password *cur_nt_hash = NULL;
1296 0 : uint32_t trust_attributes = 0;
1297 0 : struct samr_Password new_owf_password = {};
1298 0 : bool cmp_new = false;
1299 0 : struct samr_Password old_owf_password = {};
1300 0 : bool cmp_old = false;
1301 0 : const struct lsa_TrustDomainInfoInfoEx *local_tdo = NULL;
1302 0 : bool fetch_fti = false;
1303 0 : struct lsa_ForestTrustInformation *new_fti = NULL;
1304 0 : struct netr_TrustInfo *trust_info = NULL;
1305 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1306 0 : struct dcerpc_binding_handle *b = NULL;
1307 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1308 0 : WERROR verify_result = WERR_INTERNAL_ERROR;
1309 0 : bool retry = false;
1310 :
1311 0 : trusted_domain_name.string = domain->name;
1312 0 : trusted_domain_name_l.string = domain->name;
1313 :
1314 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1315 0 : if (info2 == NULL) {
1316 0 : TALLOC_FREE(frame);
1317 0 : return WERR_NOT_ENOUGH_MEMORY;
1318 : }
1319 :
1320 0 : if (domain->internal) {
1321 0 : check_result = WERR_OK;
1322 0 : goto check_return;
1323 : }
1324 :
1325 0 : status = pdb_get_trust_credentials(domain->name,
1326 0 : domain->alt_name,
1327 : frame,
1328 : &creds);
1329 0 : if (NT_STATUS_IS_OK(status)) {
1330 0 : cur_nt_hash = cli_credentials_get_nt_hash(creds, frame);
1331 0 : TALLOC_FREE(creds);
1332 : }
1333 :
1334 0 : if (!domain->primary) {
1335 0 : union lsa_TrustedDomainInfo *tdi = NULL;
1336 :
1337 0 : status = open_internal_lsa_conn(frame, &local_lsa_pipe,
1338 : &local_lsa_policy);
1339 0 : if (!NT_STATUS_IS_OK(status)) {
1340 0 : DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
1341 : __location__, __func__, nt_errstr(status)));
1342 0 : TALLOC_FREE(frame);
1343 0 : return WERR_INTERNAL_ERROR;
1344 : }
1345 0 : local_lsa = local_lsa_pipe->binding_handle;
1346 :
1347 0 : status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
1348 : &local_lsa_policy,
1349 : &trusted_domain_name,
1350 : LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
1351 : &tdi, &result);
1352 0 : if (!NT_STATUS_IS_OK(status)) {
1353 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
1354 : __location__, __func__, domain->name, nt_errstr(status)));
1355 0 : TALLOC_FREE(frame);
1356 0 : return WERR_INTERNAL_ERROR;
1357 : }
1358 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1359 0 : DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
1360 : __location__, __func__, domain->name));
1361 0 : TALLOC_FREE(frame);
1362 0 : return WERR_NO_SUCH_DOMAIN;
1363 : }
1364 0 : if (!NT_STATUS_IS_OK(result)) {
1365 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
1366 : __location__, __func__, domain->name, nt_errstr(result)));
1367 0 : TALLOC_FREE(frame);
1368 0 : return WERR_INTERNAL_ERROR;
1369 : }
1370 0 : if (tdi == NULL) {
1371 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
1372 : "returned no trusted domain information\n",
1373 : __location__, __func__));
1374 0 : TALLOC_FREE(frame);
1375 0 : return WERR_INTERNAL_ERROR;
1376 : }
1377 :
1378 0 : local_tdo = &tdi->info_ex;
1379 0 : trust_attributes = local_tdo->trust_attributes;
1380 : }
1381 :
1382 0 : if (trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1383 0 : struct lsa_ForestTrustInformation *old_fti = NULL;
1384 :
1385 0 : status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
1386 : &local_lsa_policy,
1387 : &trusted_domain_name,
1388 : LSA_FOREST_TRUST_DOMAIN_INFO,
1389 : &old_fti, &result);
1390 0 : if (!NT_STATUS_IS_OK(status)) {
1391 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
1392 : __location__, __func__, domain->name, nt_errstr(status)));
1393 0 : TALLOC_FREE(frame);
1394 0 : return WERR_INTERNAL_ERROR;
1395 : }
1396 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
1397 0 : DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
1398 : __func__, domain->name));
1399 0 : old_fti = NULL;
1400 0 : fetch_fti = true;
1401 0 : result = NT_STATUS_OK;
1402 : }
1403 0 : if (!NT_STATUS_IS_OK(result)) {
1404 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
1405 : __location__, __func__, domain->name, nt_errstr(result)));
1406 0 : TALLOC_FREE(frame);
1407 0 : return WERR_INTERNAL_ERROR;
1408 : }
1409 :
1410 0 : TALLOC_FREE(old_fti);
1411 : }
1412 :
1413 0 : reconnect:
1414 0 : status = cm_connect_netlogon_secure(domain,
1415 : &netlogon_pipe,
1416 : &netlogon_creds_ctx);
1417 0 : reset_cm_connection_on_error(domain, NULL, status);
1418 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1419 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1420 : }
1421 0 : if (!NT_STATUS_IS_OK(status)) {
1422 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1423 : nt_errstr(status)));
1424 0 : check_result = ntstatus_to_werror(status);
1425 0 : goto check_return;
1426 : }
1427 0 : check_result = WERR_OK;
1428 0 : b = netlogon_pipe->binding_handle;
1429 :
1430 0 : if (cur_nt_hash == NULL) {
1431 0 : verify_result = WERR_NO_TRUST_LSA_SECRET;
1432 0 : goto verify_return;
1433 : }
1434 :
1435 0 : if (fetch_fti) {
1436 0 : status = netlogon_creds_cli_GetForestTrustInformation(netlogon_creds_ctx,
1437 : b, frame,
1438 : &new_fti);
1439 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1440 0 : status = NT_STATUS_NOT_SUPPORTED;
1441 : }
1442 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1443 0 : new_fti = NULL;
1444 0 : status = NT_STATUS_OK;
1445 : }
1446 0 : if (!NT_STATUS_IS_OK(status)) {
1447 0 : if (!retry &&
1448 0 : reset_cm_connection_on_error(domain, b, status))
1449 : {
1450 0 : retry = true;
1451 0 : goto reconnect;
1452 : }
1453 0 : DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s)"
1454 : "failed: %s\n",
1455 : domain->name, nt_errstr(status)));
1456 0 : check_result = ntstatus_to_werror(status);
1457 0 : goto check_return;
1458 : }
1459 : }
1460 :
1461 0 : if (new_fti != NULL) {
1462 0 : struct lsa_ForestTrustInformation old_fti = {};
1463 0 : struct lsa_ForestTrustInformation *merged_fti = NULL;
1464 0 : struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
1465 :
1466 0 : status = dsdb_trust_merge_forest_info(frame, local_tdo,
1467 : &old_fti, new_fti,
1468 : &merged_fti);
1469 0 : if (!NT_STATUS_IS_OK(status)) {
1470 0 : DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
1471 : __location__, __func__,
1472 : domain->name, nt_errstr(status)));
1473 0 : TALLOC_FREE(frame);
1474 0 : return ntstatus_to_werror(status);
1475 : }
1476 :
1477 0 : status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
1478 : &local_lsa_policy,
1479 : &trusted_domain_name_l,
1480 : LSA_FOREST_TRUST_DOMAIN_INFO,
1481 : merged_fti,
1482 : 0, /* check_only=0 => store it! */
1483 : &collision_info,
1484 : &result);
1485 0 : if (!NT_STATUS_IS_OK(status)) {
1486 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
1487 : __location__, __func__, domain->name, nt_errstr(status)));
1488 0 : TALLOC_FREE(frame);
1489 0 : return WERR_INTERNAL_ERROR;
1490 : }
1491 0 : if (!NT_STATUS_IS_OK(result)) {
1492 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
1493 : __location__, __func__, domain->name, nt_errstr(result)));
1494 0 : TALLOC_FREE(frame);
1495 0 : return ntstatus_to_werror(result);
1496 : }
1497 : }
1498 :
1499 0 : status = netlogon_creds_cli_ServerGetTrustInfo(netlogon_creds_ctx,
1500 : b, frame,
1501 : &new_owf_password,
1502 : &old_owf_password,
1503 : &trust_info);
1504 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1505 0 : status = NT_STATUS_NOT_SUPPORTED;
1506 : }
1507 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1508 0 : DEBUG(5, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
1509 : nt_errstr(status)));
1510 0 : verify_result = WERR_OK;
1511 0 : goto verify_return;
1512 : }
1513 0 : if (!NT_STATUS_IS_OK(status)) {
1514 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1515 0 : retry = true;
1516 0 : goto reconnect;
1517 : }
1518 0 : DEBUG(2, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
1519 : nt_errstr(status)));
1520 :
1521 0 : if (!dcerpc_binding_handle_is_connected(b)) {
1522 0 : check_result = ntstatus_to_werror(status);
1523 0 : goto check_return;
1524 : } else {
1525 0 : verify_result = ntstatus_to_werror(status);
1526 0 : goto verify_return;
1527 : }
1528 : }
1529 :
1530 0 : if (trust_info != NULL && trust_info->count >= 1) {
1531 0 : uint32_t diff = trust_info->data[0] ^ trust_attributes;
1532 :
1533 0 : if (diff & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1534 0 : verify_result = WERR_DOMAIN_TRUST_INCONSISTENT;
1535 0 : goto verify_return;
1536 : }
1537 : }
1538 :
1539 0 : cmp_new = mem_equal_const_time(new_owf_password.hash,
1540 0 : cur_nt_hash->hash,
1541 : sizeof(cur_nt_hash->hash));
1542 0 : cmp_old = mem_equal_const_time(old_owf_password.hash,
1543 0 : cur_nt_hash->hash,
1544 : sizeof(cur_nt_hash->hash));
1545 0 : if (!cmp_new && !cmp_old) {
1546 0 : DEBUG(1,("%s:Error: credentials for domain[%s/%s] doesn't match "
1547 : "any password known to dcname[%s]\n",
1548 : __func__, domain->name, domain->alt_name,
1549 : domain->dcname));
1550 0 : verify_result = WERR_WRONG_PASSWORD;
1551 0 : goto verify_return;
1552 : }
1553 :
1554 0 : if (!cmp_new) {
1555 0 : DEBUG(2,("%s:Warning: credentials for domain[%s/%s] only match "
1556 : "against the old password known to dcname[%s]\n",
1557 : __func__, domain->name, domain->alt_name,
1558 : domain->dcname));
1559 : }
1560 :
1561 0 : verify_result = WERR_OK;
1562 0 : goto verify_return;
1563 :
1564 0 : check_return:
1565 0 : verify_result = check_result;
1566 0 : verify_return:
1567 0 : info2->flags |= NETLOGON_VERIFY_STATUS_RETURNED;
1568 0 : info2->pdc_connection_status = verify_result;
1569 0 : if (domain->dcname != NULL) {
1570 0 : info2->flags |= NETLOGON_HAS_IP;
1571 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1572 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1573 : domain->dcname);
1574 0 : if (info2->trusted_dc_name == NULL) {
1575 0 : TALLOC_FREE(frame);
1576 0 : return WERR_NOT_ENOUGH_MEMORY;
1577 : }
1578 : } else {
1579 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1580 0 : if (info2->trusted_dc_name == NULL) {
1581 0 : TALLOC_FREE(frame);
1582 0 : return WERR_NOT_ENOUGH_MEMORY;
1583 : }
1584 : }
1585 0 : info2->tc_connection_status = check_result;
1586 :
1587 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1588 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1589 : "pdc_connection[%s] tc_connection[%s]\n",
1590 : __func__, domain->name, domain->alt_name,
1591 : domain->dcname,
1592 : win_errstr(info2->pdc_connection_status),
1593 : win_errstr(info2->tc_connection_status)));
1594 : }
1595 :
1596 0 : r->out.query->info2 = info2;
1597 :
1598 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1599 0 : TALLOC_FREE(frame);
1600 0 : return WERR_OK;
1601 : }
1602 :
1603 0 : static WERROR _winbind_LogonControl_CHANGE_PASSWORD(struct pipes_struct *p,
1604 : struct winbindd_domain *domain,
1605 : struct winbind_LogonControl *r)
1606 : {
1607 0 : struct messaging_context *msg_ctx = global_messaging_context();
1608 : NTSTATUS status;
1609 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1610 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1611 0 : struct cli_credentials *creds = NULL;
1612 0 : struct samr_Password *cur_nt_hash = NULL;
1613 0 : struct netr_NETLOGON_INFO_1 *info1 = NULL;
1614 : struct dcerpc_binding_handle *b;
1615 0 : WERROR change_result = WERR_OK;
1616 0 : bool retry = false;
1617 :
1618 0 : info1 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_1);
1619 0 : if (info1 == NULL) {
1620 0 : return WERR_NOT_ENOUGH_MEMORY;
1621 : }
1622 :
1623 0 : if (domain->internal) {
1624 0 : return WERR_NOT_SUPPORTED;
1625 : }
1626 :
1627 0 : status = pdb_get_trust_credentials(domain->name,
1628 0 : domain->alt_name,
1629 : p->mem_ctx,
1630 : &creds);
1631 0 : if (NT_STATUS_IS_OK(status)) {
1632 0 : cur_nt_hash = cli_credentials_get_nt_hash(creds, p->mem_ctx);
1633 0 : TALLOC_FREE(creds);
1634 : }
1635 :
1636 0 : reconnect:
1637 0 : status = cm_connect_netlogon_secure(domain,
1638 : &netlogon_pipe,
1639 : &netlogon_creds_ctx);
1640 0 : reset_cm_connection_on_error(domain, NULL, status);
1641 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1642 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1643 : }
1644 0 : if (!NT_STATUS_IS_OK(status)) {
1645 0 : DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
1646 : __func__, domain->name, domain->alt_name,
1647 : nt_errstr(status)));
1648 : /*
1649 : * Here we return a top level error!
1650 : * This is different than TC_QUERY or TC_VERIFY.
1651 : */
1652 0 : return ntstatus_to_werror(status);
1653 : }
1654 0 : b = netlogon_pipe->binding_handle;
1655 :
1656 0 : if (cur_nt_hash == NULL) {
1657 0 : change_result = WERR_NO_TRUST_LSA_SECRET;
1658 0 : goto change_return;
1659 : }
1660 0 : TALLOC_FREE(cur_nt_hash);
1661 :
1662 0 : status = trust_pw_change(netlogon_creds_ctx,
1663 0 : msg_ctx, b, domain->name,
1664 0 : domain->dcname,
1665 : true); /* force */
1666 0 : if (!NT_STATUS_IS_OK(status)) {
1667 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1668 0 : retry = true;
1669 0 : goto reconnect;
1670 : }
1671 :
1672 0 : DEBUG(1, ("trust_pw_change(%s): %s\n",
1673 : domain->name, nt_errstr(status)));
1674 :
1675 0 : change_result = ntstatus_to_werror(status);
1676 0 : goto change_return;
1677 : }
1678 :
1679 0 : change_result = WERR_OK;
1680 :
1681 0 : change_return:
1682 0 : info1->pdc_connection_status = change_result;
1683 :
1684 0 : if (!W_ERROR_IS_OK(info1->pdc_connection_status)) {
1685 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1686 : "pdc_connection[%s]\n",
1687 : __func__, domain->name, domain->alt_name,
1688 : domain->dcname,
1689 : win_errstr(info1->pdc_connection_status)));
1690 : }
1691 :
1692 0 : r->out.query->info1 = info1;
1693 :
1694 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1695 0 : return WERR_OK;
1696 : }
1697 :
1698 0 : WERROR _winbind_LogonControl(struct pipes_struct *p,
1699 : struct winbind_LogonControl *r)
1700 : {
1701 : struct winbindd_domain *domain;
1702 :
1703 0 : domain = wb_child_domain();
1704 0 : if (domain == NULL) {
1705 0 : return WERR_NO_SUCH_DOMAIN;
1706 : }
1707 :
1708 0 : switch (r->in.function_code) {
1709 0 : case NETLOGON_CONTROL_REDISCOVER:
1710 0 : if (r->in.level != 2) {
1711 0 : return WERR_INVALID_PARAMETER;
1712 : }
1713 0 : return _winbind_LogonControl_REDISCOVER(p, domain, r);
1714 0 : case NETLOGON_CONTROL_TC_QUERY:
1715 0 : if (r->in.level != 2) {
1716 0 : return WERR_INVALID_PARAMETER;
1717 : }
1718 0 : return _winbind_LogonControl_TC_QUERY(p, domain, r);
1719 0 : case NETLOGON_CONTROL_TC_VERIFY:
1720 0 : if (r->in.level != 2) {
1721 0 : return WERR_INVALID_PARAMETER;
1722 : }
1723 0 : return _winbind_LogonControl_TC_VERIFY(p, domain, r);
1724 0 : case NETLOGON_CONTROL_CHANGE_PASSWORD:
1725 0 : if (r->in.level != 1) {
1726 0 : return WERR_INVALID_PARAMETER;
1727 : }
1728 0 : return _winbind_LogonControl_CHANGE_PASSWORD(p, domain, r);
1729 0 : default:
1730 0 : break;
1731 : }
1732 :
1733 0 : DEBUG(4, ("%s: function_code[0x%x] not supported\n",
1734 : __func__, r->in.function_code));
1735 0 : return WERR_NOT_SUPPORTED;
1736 : }
1737 :
1738 0 : WERROR _winbind_GetForestTrustInformation(struct pipes_struct *p,
1739 : struct winbind_GetForestTrustInformation *r)
1740 : {
1741 0 : TALLOC_CTX *frame = talloc_stackframe();
1742 : NTSTATUS status, result;
1743 : struct winbindd_domain *domain;
1744 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1745 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1746 : struct dcerpc_binding_handle *b;
1747 0 : bool retry = false;
1748 0 : struct lsa_String trusted_domain_name = {};
1749 0 : struct lsa_StringLarge trusted_domain_name_l = {};
1750 0 : union lsa_TrustedDomainInfo *tdi = NULL;
1751 0 : const struct lsa_TrustDomainInfoInfoEx *tdo = NULL;
1752 0 : struct lsa_ForestTrustInformation _old_fti = {};
1753 0 : struct lsa_ForestTrustInformation *old_fti = NULL;
1754 0 : struct lsa_ForestTrustInformation *new_fti = NULL;
1755 0 : struct lsa_ForestTrustInformation *merged_fti = NULL;
1756 0 : struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
1757 0 : bool update_fti = false;
1758 : struct rpc_pipe_client *local_lsa_pipe;
1759 : struct policy_handle local_lsa_policy;
1760 0 : struct dcerpc_binding_handle *local_lsa = NULL;
1761 :
1762 0 : domain = wb_child_domain();
1763 0 : if (domain == NULL) {
1764 0 : TALLOC_FREE(frame);
1765 0 : return WERR_NO_SUCH_DOMAIN;
1766 : }
1767 :
1768 : /*
1769 : * checking for domain->internal and domain->primary
1770 : * makes sure we only do some work when running as DC.
1771 : */
1772 :
1773 0 : if (domain->internal) {
1774 0 : TALLOC_FREE(frame);
1775 0 : return WERR_NO_SUCH_DOMAIN;
1776 : }
1777 :
1778 0 : if (domain->primary) {
1779 0 : TALLOC_FREE(frame);
1780 0 : return WERR_NO_SUCH_DOMAIN;
1781 : }
1782 :
1783 0 : trusted_domain_name.string = domain->name;
1784 0 : trusted_domain_name_l.string = domain->name;
1785 :
1786 0 : status = open_internal_lsa_conn(frame, &local_lsa_pipe,
1787 : &local_lsa_policy);
1788 0 : if (!NT_STATUS_IS_OK(status)) {
1789 0 : DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
1790 : __location__, __func__, nt_errstr(status)));
1791 0 : TALLOC_FREE(frame);
1792 0 : return WERR_INTERNAL_ERROR;
1793 : }
1794 0 : local_lsa = local_lsa_pipe->binding_handle;
1795 :
1796 0 : status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
1797 : &local_lsa_policy,
1798 : &trusted_domain_name,
1799 : LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
1800 : &tdi, &result);
1801 0 : if (!NT_STATUS_IS_OK(status)) {
1802 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
1803 : __location__, __func__, domain->name, nt_errstr(status)));
1804 0 : TALLOC_FREE(frame);
1805 0 : return WERR_INTERNAL_ERROR;
1806 : }
1807 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1808 0 : DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
1809 : __location__, __func__, domain->name));
1810 0 : TALLOC_FREE(frame);
1811 0 : return WERR_NO_SUCH_DOMAIN;
1812 : }
1813 0 : if (!NT_STATUS_IS_OK(result)) {
1814 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
1815 : __location__, __func__, domain->name, nt_errstr(result)));
1816 0 : TALLOC_FREE(frame);
1817 0 : return WERR_INTERNAL_ERROR;
1818 : }
1819 0 : if (tdi == NULL) {
1820 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
1821 : "returned no trusted domain information\n",
1822 : __location__, __func__));
1823 0 : TALLOC_FREE(frame);
1824 0 : return WERR_INTERNAL_ERROR;
1825 : }
1826 :
1827 0 : tdo = &tdi->info_ex;
1828 :
1829 0 : if (!(tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)) {
1830 0 : DEBUG(2,("%s: tdo[%s/%s] is no forest trust attributes[0x%08X]\n",
1831 : __func__, tdo->netbios_name.string,
1832 : tdo->domain_name.string,
1833 : (unsigned)tdo->trust_attributes));
1834 0 : TALLOC_FREE(frame);
1835 0 : return WERR_NO_SUCH_DOMAIN;
1836 : }
1837 :
1838 0 : if (r->in.flags & ~DS_GFTI_UPDATE_TDO) {
1839 0 : TALLOC_FREE(frame);
1840 0 : return WERR_INVALID_FLAGS;
1841 : }
1842 :
1843 0 : reconnect:
1844 0 : status = cm_connect_netlogon_secure(domain,
1845 : &netlogon_pipe,
1846 : &netlogon_creds_ctx);
1847 0 : reset_cm_connection_on_error(domain, NULL, status);
1848 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1849 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1850 : }
1851 0 : if (!NT_STATUS_IS_OK(status)) {
1852 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1853 : nt_errstr(status)));
1854 0 : TALLOC_FREE(frame);
1855 0 : return ntstatus_to_werror(status);
1856 : }
1857 0 : b = netlogon_pipe->binding_handle;
1858 :
1859 0 : status = netlogon_creds_cli_GetForestTrustInformation(netlogon_creds_ctx,
1860 : b, p->mem_ctx,
1861 : &new_fti);
1862 0 : if (!NT_STATUS_IS_OK(status)) {
1863 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1864 0 : retry = true;
1865 0 : goto reconnect;
1866 : }
1867 0 : DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s) failed: %s\n",
1868 : domain->name, nt_errstr(status)));
1869 0 : TALLOC_FREE(frame);
1870 0 : return ntstatus_to_werror(status);
1871 : }
1872 :
1873 0 : *r->out.forest_trust_info = new_fti;
1874 :
1875 0 : if (r->in.flags & DS_GFTI_UPDATE_TDO) {
1876 0 : update_fti = true;
1877 : }
1878 :
1879 0 : status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
1880 : &local_lsa_policy,
1881 : &trusted_domain_name,
1882 : LSA_FOREST_TRUST_DOMAIN_INFO,
1883 : &old_fti, &result);
1884 0 : if (!NT_STATUS_IS_OK(status)) {
1885 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
1886 : __location__, __func__, domain->name, nt_errstr(status)));
1887 0 : TALLOC_FREE(frame);
1888 0 : return WERR_INTERNAL_ERROR;
1889 : }
1890 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
1891 0 : DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
1892 : __func__, domain->name));
1893 0 : update_fti = true;
1894 0 : old_fti = &_old_fti;
1895 0 : result = NT_STATUS_OK;
1896 : }
1897 0 : if (!NT_STATUS_IS_OK(result)) {
1898 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
1899 : __location__, __func__, domain->name, nt_errstr(result)));
1900 0 : TALLOC_FREE(frame);
1901 0 : return WERR_INTERNAL_ERROR;
1902 : }
1903 :
1904 0 : if (old_fti == NULL) {
1905 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation() "
1906 : "returned success without returning forest trust information\n",
1907 : __location__, __func__));
1908 0 : TALLOC_FREE(frame);
1909 0 : return WERR_INTERNAL_ERROR;
1910 : }
1911 :
1912 0 : if (!update_fti) {
1913 0 : goto done;
1914 : }
1915 :
1916 0 : status = dsdb_trust_merge_forest_info(frame, tdo, old_fti, new_fti,
1917 : &merged_fti);
1918 0 : if (!NT_STATUS_IS_OK(status)) {
1919 0 : DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
1920 : __location__, __func__, domain->name, nt_errstr(status)));
1921 0 : TALLOC_FREE(frame);
1922 0 : return ntstatus_to_werror(status);
1923 : }
1924 :
1925 0 : status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
1926 : &local_lsa_policy,
1927 : &trusted_domain_name_l,
1928 : LSA_FOREST_TRUST_DOMAIN_INFO,
1929 : merged_fti,
1930 : 0, /* check_only=0 => store it! */
1931 : &collision_info,
1932 : &result);
1933 0 : if (!NT_STATUS_IS_OK(status)) {
1934 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
1935 : __location__, __func__, domain->name, nt_errstr(status)));
1936 0 : TALLOC_FREE(frame);
1937 0 : return WERR_INTERNAL_ERROR;
1938 : }
1939 0 : if (!NT_STATUS_IS_OK(result)) {
1940 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
1941 : __location__, __func__, domain->name, nt_errstr(result)));
1942 0 : TALLOC_FREE(frame);
1943 0 : return ntstatus_to_werror(result);
1944 : }
1945 :
1946 0 : done:
1947 0 : DEBUG(5, ("_winbind_GetForestTrustInformation succeeded\n"));
1948 0 : TALLOC_FREE(frame);
1949 0 : return WERR_OK;
1950 : }
1951 :
1952 0 : NTSTATUS _winbind_SendToSam(struct pipes_struct *p, struct winbind_SendToSam *r)
1953 : {
1954 : struct winbindd_domain *domain;
1955 : NTSTATUS status;
1956 : struct rpc_pipe_client *netlogon_pipe;
1957 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1958 0 : struct dcerpc_binding_handle *b = NULL;
1959 0 : bool retry = false;
1960 :
1961 0 : DEBUG(5, ("_winbind_SendToSam received\n"));
1962 0 : domain = wb_child_domain();
1963 0 : if (domain == NULL) {
1964 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1965 : }
1966 :
1967 0 : reconnect:
1968 0 : status = cm_connect_netlogon_secure(domain,
1969 : &netlogon_pipe,
1970 : &netlogon_creds_ctx);
1971 0 : reset_cm_connection_on_error(domain, NULL, status);
1972 0 : if (!NT_STATUS_IS_OK(status)) {
1973 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1974 0 : return status;
1975 : }
1976 :
1977 0 : b = netlogon_pipe->binding_handle;
1978 :
1979 0 : status = netlogon_creds_cli_SendToSam(netlogon_creds_ctx,
1980 : b,
1981 : &r->in.message);
1982 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1983 0 : retry = true;
1984 0 : goto reconnect;
1985 : }
1986 :
1987 0 : return status;
1988 : }
1989 :
1990 0 : NTSTATUS _wbint_ListTrustedDomains(struct pipes_struct *p,
1991 : struct wbint_ListTrustedDomains *r)
1992 : {
1993 0 : struct winbindd_domain *domain = wb_child_domain();
1994 : uint32_t i, n;
1995 : NTSTATUS result;
1996 : struct netr_DomainTrustList trusts;
1997 0 : struct netr_DomainTrustList *out = NULL;
1998 : pid_t client_pid;
1999 :
2000 0 : if (domain == NULL) {
2001 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
2002 : }
2003 :
2004 : /* Cut client_pid to 32bit */
2005 0 : client_pid = r->in.client_pid;
2006 0 : if ((uint64_t)client_pid != r->in.client_pid) {
2007 0 : DBG_DEBUG("pid out of range\n");
2008 0 : return NT_STATUS_INVALID_PARAMETER;
2009 : }
2010 :
2011 0 : DBG_NOTICE("[%s %"PRIu32"]: list trusted domains\n",
2012 : r->in.client_name, client_pid);
2013 :
2014 0 : result = wb_cache_trusted_domains(domain, p->mem_ctx, &trusts);
2015 0 : if (!NT_STATUS_IS_OK(result)) {
2016 0 : DBG_NOTICE("wb_cache_trusted_domains returned %s\n",
2017 : nt_errstr(result));
2018 0 : return result;
2019 : }
2020 :
2021 0 : out = talloc_zero(p->mem_ctx, struct netr_DomainTrustList);
2022 0 : if (out == NULL) {
2023 0 : return NT_STATUS_NO_MEMORY;
2024 : }
2025 :
2026 0 : r->out.domains = out;
2027 :
2028 0 : for (i=0; i<trusts.count; i++) {
2029 0 : if (trusts.array[i].sid == NULL) {
2030 0 : continue;
2031 : }
2032 0 : if (dom_sid_equal(trusts.array[i].sid, &global_sid_NULL)) {
2033 0 : continue;
2034 : }
2035 :
2036 0 : n = out->count;
2037 0 : out->array = talloc_realloc(out, out->array,
2038 : struct netr_DomainTrust,
2039 : n + 1);
2040 0 : if (out->array == NULL) {
2041 0 : return NT_STATUS_NO_MEMORY;
2042 : }
2043 0 : out->count = n + 1;
2044 :
2045 0 : out->array[n].netbios_name = talloc_steal(
2046 : out->array, trusts.array[i].netbios_name);
2047 0 : if (out->array[n].netbios_name == NULL) {
2048 0 : return NT_STATUS_NO_MEMORY;
2049 : }
2050 :
2051 0 : out->array[n].dns_name = talloc_steal(
2052 : out->array, trusts.array[i].dns_name);
2053 0 : if (out->array[n].dns_name == NULL) {
2054 0 : return NT_STATUS_NO_MEMORY;
2055 : }
2056 :
2057 0 : out->array[n].sid = dom_sid_dup(out->array,
2058 0 : trusts.array[i].sid);
2059 0 : if (out->array[n].sid == NULL) {
2060 0 : return NT_STATUS_NO_MEMORY;
2061 : }
2062 :
2063 0 : out->array[n].trust_flags = trusts.array[i].trust_flags;
2064 0 : out->array[n].trust_type = trusts.array[i].trust_type;
2065 0 : out->array[n].trust_attributes = trusts.array[i].trust_attributes;
2066 : }
2067 :
2068 0 : return NT_STATUS_OK;
2069 : }
2070 :
2071 : #include "librpc/gen_ndr/ndr_winbind_scompat.c"
|
