Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : In-Child server implementation of the routines defined in wbint.idl
5 :
6 : Copyright (C) Volker Lendecke 2009
7 : Copyright (C) Guenther Deschner 2009
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "winbindd/winbindd.h"
25 : #include "winbindd/winbindd_proto.h"
26 : #include "rpc_client/cli_pipe.h"
27 : #include "ntdomain.h"
28 : #include "librpc/rpc/dcesrv_core.h"
29 : #include "librpc/gen_ndr/ndr_winbind.h"
30 : #include "librpc/gen_ndr/ndr_winbind_scompat.h"
31 : #include "../librpc/gen_ndr/ndr_netlogon_c.h"
32 : #include "../librpc/gen_ndr/ndr_lsa_c.h"
33 : #include "idmap.h"
34 : #include "../libcli/security/security.h"
35 : #include "../libcli/auth/netlogon_creds_cli.h"
36 : #include "passdb.h"
37 : #include "../source4/dsdb/samdb/samdb.h"
38 : #include "rpc_client/cli_netlogon.h"
39 : #include "rpc_client/util_netlogon.h"
40 : #include "libsmb/dsgetdcname.h"
41 : #include "lib/global_contexts.h"
42 :
43 0 : NTSTATUS _wbint_Ping(struct pipes_struct *p, struct wbint_Ping *r)
44 : {
45 0 : *r->out.out_data = r->in.in_data;
46 0 : return NT_STATUS_OK;
47 : }
48 :
49 0 : NTSTATUS _wbint_InitConnection(struct pipes_struct *p,
50 : struct wbint_InitConnection *r)
51 : {
52 0 : struct winbindd_domain *domain = wb_child_domain();
53 :
54 0 : if (r->in.dcname != NULL && strlen(r->in.dcname) > 0) {
55 0 : TALLOC_FREE(domain->dcname);
56 0 : domain->dcname = talloc_strdup(domain, r->in.dcname);
57 0 : if (domain->dcname == NULL) {
58 0 : return NT_STATUS_NO_MEMORY;
59 : }
60 : }
61 :
62 0 : init_dc_connection(domain, false);
63 :
64 0 : if (!domain->initialized) {
65 : /*
66 : * If we return error here we can't do any cached
67 : * authentication, but we may be in disconnected mode and can't
68 : * initialize correctly. Do what the previous code did and just
69 : * return without initialization, once we go online we'll
70 : * re-initialize.
71 : */
72 0 : DBG_INFO("%s returning without initialization online = %d\n",
73 : domain->name, (int)domain->online);
74 : }
75 :
76 0 : *r->out.name = talloc_strdup(p->mem_ctx, domain->name);
77 0 : if (*r->out.name == NULL) {
78 0 : return NT_STATUS_NO_MEMORY;
79 : }
80 :
81 0 : if (domain->alt_name != NULL) {
82 0 : *r->out.alt_name = talloc_strdup(p->mem_ctx, domain->alt_name);
83 0 : if (*r->out.alt_name == NULL) {
84 0 : return NT_STATUS_NO_MEMORY;
85 : }
86 : }
87 :
88 0 : r->out.sid = dom_sid_dup(p->mem_ctx, &domain->sid);
89 0 : if (r->out.sid == NULL) {
90 0 : return NT_STATUS_NO_MEMORY;
91 : }
92 :
93 0 : *r->out.flags = 0;
94 0 : if (domain->native_mode) {
95 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_NATIVE;
96 : }
97 0 : if (domain->active_directory) {
98 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_AD;
99 : }
100 0 : if (domain->primary) {
101 0 : *r->out.flags |= WB_DOMINFO_DOMAIN_PRIMARY;
102 : }
103 :
104 0 : return NT_STATUS_OK;
105 : }
106 :
107 0 : bool reset_cm_connection_on_error(struct winbindd_domain *domain,
108 : struct dcerpc_binding_handle *b,
109 : NTSTATUS status)
110 : {
111 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
112 0 : NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
113 0 : NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
114 0 : invalidate_cm_connection(domain);
115 0 : domain->conn.netlogon_force_reauth = true;
116 0 : return true;
117 : }
118 :
119 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
120 0 : NT_STATUS_EQUAL(status, NT_STATUS_IO_DEVICE_ERROR))
121 : {
122 0 : invalidate_cm_connection(domain);
123 : /* We invalidated the connection. */
124 0 : return true;
125 : }
126 :
127 0 : if (b != NULL && !dcerpc_binding_handle_is_connected(b)) {
128 0 : invalidate_cm_connection(domain);
129 0 : return true;
130 : }
131 :
132 0 : return false;
133 : }
134 :
135 0 : NTSTATUS _wbint_LookupSid(struct pipes_struct *p, struct wbint_LookupSid *r)
136 : {
137 0 : struct winbindd_domain *domain = wb_child_domain();
138 : char *dom_name;
139 : char *name;
140 : enum lsa_SidType type;
141 : NTSTATUS status;
142 :
143 0 : if (domain == NULL) {
144 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
145 : }
146 :
147 0 : status = wb_cache_sid_to_name(domain, p->mem_ctx, r->in.sid,
148 : &dom_name, &name, &type);
149 0 : reset_cm_connection_on_error(domain, NULL, status);
150 0 : if (!NT_STATUS_IS_OK(status)) {
151 0 : return status;
152 : }
153 :
154 0 : *r->out.domain = dom_name;
155 0 : *r->out.name = name;
156 0 : *r->out.type = type;
157 0 : return NT_STATUS_OK;
158 : }
159 :
160 0 : NTSTATUS _wbint_LookupSids(struct pipes_struct *p, struct wbint_LookupSids *r)
161 : {
162 0 : struct winbindd_domain *domain = wb_child_domain();
163 0 : struct lsa_RefDomainList *domains = r->out.domains;
164 : NTSTATUS status;
165 0 : bool retry = false;
166 :
167 0 : if (domain == NULL) {
168 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
169 : }
170 :
171 : /*
172 : * This breaks the winbindd_domain->methods abstraction: This
173 : * is only called for remote domains, and both winbindd_msrpc
174 : * and winbindd_ad call into lsa_lookupsids anyway. Caching is
175 : * done at the wbint RPC layer.
176 : */
177 0 : again:
178 0 : status = rpc_lookup_sids(p->mem_ctx, domain, r->in.sids,
179 : &domains, &r->out.names);
180 :
181 0 : if (domains != NULL) {
182 0 : r->out.domains = domains;
183 : }
184 :
185 0 : if (!retry && reset_cm_connection_on_error(domain, NULL, status)) {
186 0 : retry = true;
187 0 : goto again;
188 : }
189 :
190 0 : return status;
191 : }
192 :
193 0 : NTSTATUS _wbint_LookupName(struct pipes_struct *p, struct wbint_LookupName *r)
194 : {
195 0 : struct winbindd_domain *domain = wb_child_domain();
196 : NTSTATUS status;
197 :
198 0 : if (domain == NULL) {
199 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
200 : }
201 :
202 0 : status = wb_cache_name_to_sid(domain, p->mem_ctx, r->in.domain,
203 : r->in.name, r->in.flags,
204 : r->out.sid, r->out.type);
205 0 : reset_cm_connection_on_error(domain, NULL, status);
206 0 : return status;
207 : }
208 :
209 0 : NTSTATUS _wbint_Sids2UnixIDs(struct pipes_struct *p,
210 : struct wbint_Sids2UnixIDs *r)
211 : {
212 : uint32_t i;
213 :
214 : struct lsa_DomainInfo *d;
215 : struct wbint_TransID *ids;
216 : uint32_t num_ids;
217 :
218 0 : struct id_map **id_map_ptrs = NULL;
219 : struct idmap_domain *dom;
220 0 : NTSTATUS status = NT_STATUS_NO_MEMORY;
221 :
222 0 : if (r->in.domains->count != 1) {
223 0 : return NT_STATUS_INVALID_PARAMETER;
224 : }
225 :
226 0 : d = &r->in.domains->domains[0];
227 0 : ids = r->in.ids->ids;
228 0 : num_ids = r->in.ids->num_ids;
229 :
230 0 : dom = idmap_find_domain_with_sid(d->name.string, d->sid);
231 0 : if (dom == NULL) {
232 : struct dom_sid_buf buf;
233 0 : DEBUG(10, ("idmap domain %s:%s not found\n",
234 : d->name.string,
235 : dom_sid_str_buf(d->sid, &buf)));
236 :
237 0 : for (i=0; i<num_ids; i++) {
238 :
239 0 : ids[i].xid = (struct unixid) {
240 : .id = UINT32_MAX,
241 : .type = ID_TYPE_NOT_SPECIFIED
242 : };
243 : }
244 :
245 0 : return NT_STATUS_OK;
246 : }
247 :
248 0 : id_map_ptrs = id_map_ptrs_init(talloc_tos(), num_ids);
249 0 : if (id_map_ptrs == NULL) {
250 0 : goto nomem;
251 : }
252 :
253 : /*
254 : * Convert the input data into a list of id_map structs
255 : * suitable for handing in to the idmap sids_to_unixids
256 : * method.
257 : */
258 :
259 0 : for (i=0; i<num_ids; i++) {
260 0 : struct id_map *m = id_map_ptrs[i];
261 :
262 0 : sid_compose(m->sid, d->sid, ids[i].rid);
263 0 : m->status = ID_UNKNOWN;
264 0 : m->xid = (struct unixid) { .type = ids[i].type_hint };
265 : }
266 :
267 0 : status = dom->methods->sids_to_unixids(dom, id_map_ptrs);
268 :
269 0 : if (NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
270 : /*
271 : * This is okay. We need to transfer the mapped ones
272 : * up to our caller. The individual mappings carry the
273 : * information whether they are mapped or not.
274 : */
275 0 : status = NT_STATUS_OK;
276 : }
277 :
278 0 : if (!NT_STATUS_IS_OK(status)) {
279 0 : DEBUG(10, ("sids_to_unixids returned %s\n",
280 : nt_errstr(status)));
281 0 : goto done;
282 : }
283 :
284 : /*
285 : * Extract the results for handing them back to the caller.
286 : */
287 :
288 0 : for (i=0; i<num_ids; i++) {
289 0 : struct id_map *m = id_map_ptrs[i];
290 :
291 0 : if (m->status == ID_REQUIRE_TYPE) {
292 0 : ids[i].xid.id = UINT32_MAX;
293 0 : ids[i].xid.type = ID_TYPE_WB_REQUIRE_TYPE;
294 0 : continue;
295 : }
296 :
297 0 : if (!idmap_unix_id_is_in_range(m->xid.id, dom)) {
298 0 : DBG_DEBUG("id %"PRIu32" is out of range "
299 : "%"PRIu32"-%"PRIu32" for domain %s\n",
300 : m->xid.id, dom->low_id, dom->high_id,
301 : dom->name);
302 0 : m->status = ID_UNMAPPED;
303 : }
304 :
305 0 : if (m->status == ID_MAPPED) {
306 0 : ids[i].xid = m->xid;
307 : } else {
308 0 : ids[i].xid.id = UINT32_MAX;
309 0 : ids[i].xid.type = ID_TYPE_NOT_SPECIFIED;
310 : }
311 : }
312 :
313 0 : goto done;
314 0 : nomem:
315 0 : status = NT_STATUS_NO_MEMORY;
316 0 : done:
317 0 : TALLOC_FREE(id_map_ptrs);
318 0 : return status;
319 : }
320 :
321 0 : NTSTATUS _wbint_UnixIDs2Sids(struct pipes_struct *p,
322 : struct wbint_UnixIDs2Sids *r)
323 : {
324 : struct id_map **maps;
325 : NTSTATUS status;
326 : uint32_t i;
327 :
328 0 : maps = id_map_ptrs_init(talloc_tos(), r->in.num_ids);
329 0 : if (maps == NULL) {
330 0 : return NT_STATUS_NO_MEMORY;
331 : }
332 :
333 0 : for (i=0; i<r->in.num_ids; i++) {
334 0 : maps[i]->status = ID_UNKNOWN;
335 0 : maps[i]->xid = r->in.xids[i];
336 : }
337 :
338 0 : status = idmap_backend_unixids_to_sids(maps, r->in.domain_name,
339 : r->in.domain_sid);
340 0 : if (!NT_STATUS_IS_OK(status)) {
341 0 : TALLOC_FREE(maps);
342 0 : return status;
343 : }
344 :
345 0 : for (i=0; i<r->in.num_ids; i++) {
346 0 : if (maps[i]->status == ID_MAPPED) {
347 0 : r->out.xids[i] = maps[i]->xid;
348 0 : sid_copy(&r->out.sids[i], maps[i]->sid);
349 : } else {
350 0 : r->out.sids[i] = (struct dom_sid) { 0 };
351 : }
352 : }
353 :
354 0 : TALLOC_FREE(maps);
355 :
356 0 : return NT_STATUS_OK;
357 : }
358 :
359 0 : NTSTATUS _wbint_AllocateUid(struct pipes_struct *p, struct wbint_AllocateUid *r)
360 : {
361 : struct unixid xid;
362 : NTSTATUS status;
363 :
364 0 : status = idmap_allocate_uid(&xid);
365 0 : if (!NT_STATUS_IS_OK(status)) {
366 0 : return status;
367 : }
368 0 : *r->out.uid = xid.id;
369 0 : return NT_STATUS_OK;
370 : }
371 :
372 0 : NTSTATUS _wbint_AllocateGid(struct pipes_struct *p, struct wbint_AllocateGid *r)
373 : {
374 : struct unixid xid;
375 : NTSTATUS status;
376 :
377 0 : status = idmap_allocate_gid(&xid);
378 0 : if (!NT_STATUS_IS_OK(status)) {
379 0 : return status;
380 : }
381 0 : *r->out.gid = xid.id;
382 0 : return NT_STATUS_OK;
383 : }
384 :
385 0 : NTSTATUS _wbint_GetNssInfo(struct pipes_struct *p, struct wbint_GetNssInfo *r)
386 : {
387 : struct idmap_domain *domain;
388 : NTSTATUS status;
389 :
390 0 : domain = idmap_find_domain(r->in.info->domain_name);
391 0 : if ((domain == NULL) || (domain->query_user == NULL)) {
392 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
393 : }
394 :
395 0 : status = domain->query_user(domain, r->in.info);
396 0 : return status;
397 : }
398 :
399 0 : NTSTATUS _wbint_LookupUserAliases(struct pipes_struct *p,
400 : struct wbint_LookupUserAliases *r)
401 : {
402 0 : struct winbindd_domain *domain = wb_child_domain();
403 : NTSTATUS status;
404 :
405 0 : if (domain == NULL) {
406 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
407 : }
408 :
409 0 : status = wb_cache_lookup_useraliases(domain, p->mem_ctx,
410 0 : r->in.sids->num_sids,
411 0 : r->in.sids->sids,
412 0 : &r->out.rids->num_rids,
413 0 : &r->out.rids->rids);
414 0 : reset_cm_connection_on_error(domain, NULL, status);
415 0 : return status;
416 : }
417 :
418 0 : NTSTATUS _wbint_LookupUserGroups(struct pipes_struct *p,
419 : struct wbint_LookupUserGroups *r)
420 : {
421 0 : struct winbindd_domain *domain = wb_child_domain();
422 : NTSTATUS status;
423 :
424 0 : if (domain == NULL) {
425 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
426 : }
427 :
428 0 : status = wb_cache_lookup_usergroups(domain, p->mem_ctx, r->in.sid,
429 0 : &r->out.sids->num_sids,
430 0 : &r->out.sids->sids);
431 0 : reset_cm_connection_on_error(domain, NULL, status);
432 0 : return status;
433 : }
434 :
435 0 : NTSTATUS _wbint_QuerySequenceNumber(struct pipes_struct *p,
436 : struct wbint_QuerySequenceNumber *r)
437 : {
438 0 : struct winbindd_domain *domain = wb_child_domain();
439 : NTSTATUS status;
440 :
441 0 : if (domain == NULL) {
442 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
443 : }
444 :
445 0 : status = wb_cache_sequence_number(domain, r->out.sequence);
446 0 : reset_cm_connection_on_error(domain, NULL, status);
447 0 : return status;
448 : }
449 :
450 0 : NTSTATUS _wbint_LookupGroupMembers(struct pipes_struct *p,
451 : struct wbint_LookupGroupMembers *r)
452 : {
453 0 : struct winbindd_domain *domain = wb_child_domain();
454 : uint32_t i, num_names;
455 : struct dom_sid *sid_mem;
456 : char **names;
457 : uint32_t *name_types;
458 : NTSTATUS status;
459 :
460 0 : if (domain == NULL) {
461 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
462 : }
463 :
464 0 : status = wb_cache_lookup_groupmem(domain, p->mem_ctx, r->in.sid,
465 : r->in.type, &num_names, &sid_mem,
466 : &names, &name_types);
467 0 : reset_cm_connection_on_error(domain, NULL, status);
468 0 : if (!NT_STATUS_IS_OK(status)) {
469 0 : return status;
470 : }
471 :
472 0 : r->out.members->num_principals = num_names;
473 0 : r->out.members->principals = talloc_array(
474 : r->out.members, struct wbint_Principal, num_names);
475 0 : if (r->out.members->principals == NULL) {
476 0 : return NT_STATUS_NO_MEMORY;
477 : }
478 :
479 0 : for (i=0; i<num_names; i++) {
480 0 : struct wbint_Principal *m = &r->out.members->principals[i];
481 0 : sid_copy(&m->sid, &sid_mem[i]);
482 0 : m->name = talloc_move(r->out.members->principals, &names[i]);
483 0 : m->type = (enum lsa_SidType)name_types[i];
484 : }
485 :
486 0 : return NT_STATUS_OK;
487 : }
488 :
489 0 : NTSTATUS _wbint_QueryGroupList(struct pipes_struct *p,
490 : struct wbint_QueryGroupList *r)
491 : {
492 0 : TALLOC_CTX *frame = NULL;
493 0 : struct winbindd_domain *domain = wb_child_domain();
494 : uint32_t i;
495 0 : uint32_t num_local_groups = 0;
496 0 : struct wb_acct_info *local_groups = NULL;
497 0 : uint32_t num_dom_groups = 0;
498 0 : struct wb_acct_info *dom_groups = NULL;
499 0 : uint32_t ti = 0;
500 0 : uint64_t num_total = 0;
501 : struct wbint_Principal *result;
502 0 : NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
503 0 : bool include_local_groups = false;
504 :
505 0 : if (domain == NULL) {
506 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
507 : }
508 :
509 0 : frame = talloc_stackframe();
510 :
511 0 : switch (lp_server_role()) {
512 0 : case ROLE_ACTIVE_DIRECTORY_DC:
513 0 : if (domain->internal) {
514 : /*
515 : * we want to include local groups
516 : * for BUILTIN and WORKGROUP
517 : */
518 0 : include_local_groups = true;
519 : }
520 0 : break;
521 0 : default:
522 : /*
523 : * We might include local groups in more
524 : * setups later, but that requires more work
525 : * elsewhere.
526 : */
527 0 : break;
528 : }
529 :
530 0 : if (include_local_groups) {
531 0 : status = wb_cache_enum_local_groups(domain, frame,
532 : &num_local_groups,
533 : &local_groups);
534 0 : reset_cm_connection_on_error(domain, NULL, status);
535 0 : if (!NT_STATUS_IS_OK(status)) {
536 0 : goto out;
537 : }
538 : }
539 :
540 0 : status = wb_cache_enum_dom_groups(domain, frame,
541 : &num_dom_groups,
542 : &dom_groups);
543 0 : reset_cm_connection_on_error(domain, NULL, status);
544 0 : if (!NT_STATUS_IS_OK(status)) {
545 0 : goto out;
546 : }
547 :
548 0 : num_total = num_local_groups + num_dom_groups;
549 0 : if (num_total > UINT32_MAX) {
550 0 : status = NT_STATUS_INTERNAL_ERROR;
551 0 : goto out;
552 : }
553 :
554 0 : result = talloc_array(frame, struct wbint_Principal, num_total);
555 0 : if (result == NULL) {
556 0 : status = NT_STATUS_NO_MEMORY;
557 0 : goto out;
558 : }
559 :
560 0 : for (i = 0; i < num_local_groups; i++) {
561 0 : struct wb_acct_info *lg = &local_groups[i];
562 0 : struct wbint_Principal *rg = &result[ti++];
563 :
564 0 : sid_compose(&rg->sid, &domain->sid, lg->rid);
565 0 : rg->type = SID_NAME_ALIAS;
566 0 : rg->name = talloc_strdup(result, lg->acct_name);
567 0 : if (rg->name == NULL) {
568 0 : status = NT_STATUS_NO_MEMORY;
569 0 : goto out;
570 : }
571 : }
572 0 : num_local_groups = 0;
573 :
574 0 : for (i = 0; i < num_dom_groups; i++) {
575 0 : struct wb_acct_info *dg = &dom_groups[i];
576 0 : struct wbint_Principal *rg = &result[ti++];
577 :
578 0 : sid_compose(&rg->sid, &domain->sid, dg->rid);
579 0 : rg->type = SID_NAME_DOM_GRP;
580 0 : rg->name = talloc_strdup(result, dg->acct_name);
581 0 : if (rg->name == NULL) {
582 0 : status = NT_STATUS_NO_MEMORY;
583 0 : goto out;
584 : }
585 : }
586 0 : num_dom_groups = 0;
587 :
588 0 : r->out.groups->num_principals = ti;
589 0 : r->out.groups->principals = talloc_move(r->out.groups, &result);
590 :
591 0 : status = NT_STATUS_OK;
592 0 : out:
593 0 : TALLOC_FREE(frame);
594 0 : return status;
595 : }
596 :
597 0 : NTSTATUS _wbint_QueryUserRidList(struct pipes_struct *p,
598 : struct wbint_QueryUserRidList *r)
599 : {
600 0 : struct winbindd_domain *domain = wb_child_domain();
601 : NTSTATUS status;
602 :
603 0 : if (domain == NULL) {
604 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
605 : }
606 :
607 : /*
608 : * Right now this is overkill. We should add a backend call
609 : * just querying the rids.
610 : */
611 :
612 0 : status = wb_cache_query_user_list(domain, p->mem_ctx,
613 0 : &r->out.rids->rids);
614 0 : reset_cm_connection_on_error(domain, NULL, status);
615 :
616 0 : if (!NT_STATUS_IS_OK(status)) {
617 0 : return status;
618 : }
619 :
620 0 : r->out.rids->num_rids = talloc_array_length(r->out.rids->rids);
621 :
622 0 : return NT_STATUS_OK;
623 : }
624 :
625 0 : NTSTATUS _wbint_DsGetDcName(struct pipes_struct *p, struct wbint_DsGetDcName *r)
626 : {
627 0 : struct winbindd_domain *domain = wb_child_domain();
628 : struct rpc_pipe_client *netlogon_pipe;
629 : struct netr_DsRGetDCNameInfo *dc_info;
630 : NTSTATUS status;
631 : WERROR werr;
632 : unsigned int orig_timeout;
633 : struct dcerpc_binding_handle *b;
634 0 : bool retry = false;
635 0 : bool try_dsrgetdcname = false;
636 :
637 0 : if (domain == NULL) {
638 0 : return dsgetdcname(p->mem_ctx, global_messaging_context(),
639 0 : r->in.domain_name, r->in.domain_guid,
640 0 : r->in.site_name ? r->in.site_name : "",
641 : r->in.flags,
642 : r->out.dc_info);
643 : }
644 :
645 0 : if (domain->active_directory) {
646 0 : try_dsrgetdcname = true;
647 : }
648 :
649 0 : reconnect:
650 0 : status = cm_connect_netlogon(domain, &netlogon_pipe);
651 :
652 0 : reset_cm_connection_on_error(domain, NULL, status);
653 0 : if (!NT_STATUS_IS_OK(status)) {
654 0 : DEBUG(10, ("Can't contact the NETLOGON pipe\n"));
655 0 : return status;
656 : }
657 :
658 0 : b = netlogon_pipe->binding_handle;
659 :
660 : /* This call can take a long time - allow the server to time out.
661 : 35 seconds should do it. */
662 :
663 0 : orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
664 :
665 0 : if (try_dsrgetdcname) {
666 0 : status = dcerpc_netr_DsRGetDCName(b,
667 0 : p->mem_ctx, domain->dcname,
668 : r->in.domain_name, NULL, r->in.domain_guid,
669 : r->in.flags, r->out.dc_info, &werr);
670 0 : if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(werr)) {
671 0 : goto done;
672 : }
673 0 : if (!retry &&
674 0 : reset_cm_connection_on_error(domain, NULL, status))
675 : {
676 0 : retry = true;
677 0 : goto reconnect;
678 : }
679 0 : try_dsrgetdcname = false;
680 0 : retry = false;
681 : }
682 :
683 : /*
684 : * Fallback to less capable methods
685 : */
686 :
687 0 : dc_info = talloc_zero(r->out.dc_info, struct netr_DsRGetDCNameInfo);
688 0 : if (dc_info == NULL) {
689 0 : status = NT_STATUS_NO_MEMORY;
690 0 : goto done;
691 : }
692 :
693 0 : if (r->in.flags & DS_PDC_REQUIRED) {
694 0 : status = dcerpc_netr_GetDcName(b,
695 0 : p->mem_ctx, domain->dcname,
696 : r->in.domain_name, &dc_info->dc_unc, &werr);
697 : } else {
698 0 : status = dcerpc_netr_GetAnyDCName(b,
699 0 : p->mem_ctx, domain->dcname,
700 : r->in.domain_name, &dc_info->dc_unc, &werr);
701 : }
702 :
703 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
704 0 : retry = true;
705 0 : goto reconnect;
706 : }
707 0 : if (!NT_STATUS_IS_OK(status)) {
708 0 : DEBUG(10, ("dcerpc_netr_Get[Any]DCName failed: %s\n",
709 : nt_errstr(status)));
710 0 : goto done;
711 : }
712 0 : if (!W_ERROR_IS_OK(werr)) {
713 0 : DEBUG(10, ("dcerpc_netr_Get[Any]DCName failed: %s\n",
714 : win_errstr(werr)));
715 0 : status = werror_to_ntstatus(werr);
716 0 : goto done;
717 : }
718 :
719 0 : *r->out.dc_info = dc_info;
720 0 : status = NT_STATUS_OK;
721 :
722 0 : done:
723 : /* And restore our original timeout. */
724 0 : rpccli_set_timeout(netlogon_pipe, orig_timeout);
725 :
726 0 : return status;
727 : }
728 :
729 0 : NTSTATUS _wbint_LookupRids(struct pipes_struct *p, struct wbint_LookupRids *r)
730 : {
731 0 : struct winbindd_domain *domain = wb_child_domain();
732 : char *domain_name;
733 : char **names;
734 : enum lsa_SidType *types;
735 : struct wbint_Principal *result;
736 : NTSTATUS status;
737 : uint32_t i;
738 :
739 0 : if (domain == NULL) {
740 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
741 : }
742 :
743 0 : status = wb_cache_rids_to_names(domain, talloc_tos(), r->in.domain_sid,
744 0 : r->in.rids->rids, r->in.rids->num_rids,
745 : &domain_name, &names, &types);
746 0 : reset_cm_connection_on_error(domain, NULL, status);
747 0 : if (!NT_STATUS_IS_OK(status) &&
748 0 : !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
749 0 : return status;
750 : }
751 :
752 0 : *r->out.domain_name = talloc_move(r->out.domain_name, &domain_name);
753 :
754 0 : result = talloc_array(p->mem_ctx, struct wbint_Principal,
755 : r->in.rids->num_rids);
756 0 : if (result == NULL) {
757 0 : return NT_STATUS_NO_MEMORY;
758 : }
759 :
760 0 : for (i=0; i<r->in.rids->num_rids; i++) {
761 0 : sid_compose(&result[i].sid, r->in.domain_sid,
762 0 : r->in.rids->rids[i]);
763 0 : result[i].type = types[i];
764 0 : result[i].name = talloc_move(result, &names[i]);
765 : }
766 0 : TALLOC_FREE(types);
767 0 : TALLOC_FREE(names);
768 :
769 0 : r->out.names->num_principals = r->in.rids->num_rids;
770 0 : r->out.names->principals = result;
771 0 : return NT_STATUS_OK;
772 : }
773 :
774 0 : NTSTATUS _wbint_CheckMachineAccount(struct pipes_struct *p,
775 : struct wbint_CheckMachineAccount *r)
776 : {
777 : struct winbindd_domain *domain;
778 0 : int num_retries = 0;
779 : NTSTATUS status;
780 :
781 0 : domain = wb_child_domain();
782 0 : if (domain == NULL) {
783 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
784 : }
785 :
786 0 : again:
787 0 : invalidate_cm_connection(domain);
788 0 : domain->conn.netlogon_force_reauth = true;
789 :
790 : {
791 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
792 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
793 0 : status = cm_connect_netlogon_secure(domain,
794 : &netlogon_pipe,
795 : &netlogon_creds_ctx);
796 : }
797 :
798 : /* There is a race condition between fetching the trust account
799 : password and the periodic machine password change. So it's
800 : possible that the trust account password has been changed on us.
801 : We are returned NT_STATUS_ACCESS_DENIED if this happens. */
802 :
803 : #define MAX_RETRIES 3
804 :
805 0 : if ((num_retries < MAX_RETRIES)
806 0 : && NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
807 0 : num_retries++;
808 0 : goto again;
809 : }
810 :
811 0 : if (!NT_STATUS_IS_OK(status)) {
812 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
813 0 : goto done;
814 : }
815 :
816 : /* Pass back result code - zero for success, other values for
817 : specific failures. */
818 :
819 0 : DEBUG(3,("domain %s secret is %s\n", domain->name,
820 : NT_STATUS_IS_OK(status) ? "good" : "bad"));
821 :
822 0 : done:
823 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
824 : ("Checking the trust account password for domain %s returned %s\n",
825 : domain->name, nt_errstr(status)));
826 :
827 0 : return status;
828 : }
829 :
830 0 : NTSTATUS _wbint_ChangeMachineAccount(struct pipes_struct *p,
831 : struct wbint_ChangeMachineAccount *r)
832 : {
833 0 : struct messaging_context *msg_ctx = global_messaging_context();
834 : struct winbindd_domain *domain;
835 : NTSTATUS status;
836 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
837 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
838 :
839 0 : domain = wb_child_domain();
840 0 : if (domain == NULL) {
841 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
842 : }
843 :
844 0 : if (r->in.dcname != NULL && r->in.dcname[0] != '\0') {
845 0 : invalidate_cm_connection(domain);
846 0 : TALLOC_FREE(domain->dcname);
847 :
848 0 : domain->dcname = talloc_strdup(domain, r->in.dcname);
849 0 : if (domain->dcname == NULL) {
850 0 : status = NT_STATUS_NO_MEMORY;
851 0 : goto done;
852 : }
853 0 : domain->force_dc = true;
854 :
855 0 : DBG_NOTICE("attempt connection to change trust account "
856 : "password for %s at %s\n",
857 : domain->name, domain->dcname);
858 : }
859 :
860 0 : status = cm_connect_netlogon_secure(domain,
861 : &netlogon_pipe,
862 : &netlogon_creds_ctx);
863 0 : if (!NT_STATUS_IS_OK(status)) {
864 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
865 0 : goto done;
866 : }
867 :
868 0 : status = trust_pw_change(netlogon_creds_ctx,
869 : msg_ctx,
870 0 : netlogon_pipe->binding_handle,
871 0 : domain->name,
872 0 : domain->dcname,
873 : true); /* force */
874 :
875 : /* Pass back result code - zero for success, other values for
876 : specific failures. */
877 :
878 0 : DEBUG(3,("domain %s secret %s\n", domain->name,
879 : NT_STATUS_IS_OK(status) ? "changed" : "unchanged"));
880 :
881 0 : done:
882 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 :
883 : domain->force_dc ? 0 : 2,
884 : ("Changing the trust account password for domain %s at %s "
885 : "(forced: %s) returned %s\n",
886 : domain->name, domain->dcname, domain->force_dc ? "yes" : "no",
887 : nt_errstr(status)));
888 0 : domain->force_dc = false;
889 :
890 0 : return status;
891 : }
892 :
893 0 : NTSTATUS _wbint_PingDc(struct pipes_struct *p, struct wbint_PingDc *r)
894 : {
895 : NTSTATUS status;
896 : struct winbindd_domain *domain;
897 : struct rpc_pipe_client *netlogon_pipe;
898 : union netr_CONTROL_QUERY_INFORMATION info;
899 : WERROR werr;
900 : fstring logon_server;
901 : struct dcerpc_binding_handle *b;
902 0 : bool retry = false;
903 :
904 0 : domain = wb_child_domain();
905 0 : if (domain == NULL) {
906 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
907 : }
908 :
909 0 : reconnect:
910 0 : status = cm_connect_netlogon(domain, &netlogon_pipe);
911 0 : reset_cm_connection_on_error(domain, NULL, status);
912 0 : if (!NT_STATUS_IS_OK(status)) {
913 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
914 : nt_errstr(status)));
915 0 : return status;
916 : }
917 :
918 0 : b = netlogon_pipe->binding_handle;
919 :
920 0 : fstr_sprintf(logon_server, "\\\\%s", domain->dcname);
921 0 : *r->out.dcname = talloc_strdup(p->mem_ctx, domain->dcname);
922 0 : if (*r->out.dcname == NULL) {
923 0 : DEBUG(2, ("Could not allocate memory\n"));
924 0 : return NT_STATUS_NO_MEMORY;
925 : }
926 :
927 : /*
928 : * This provokes a WERR_NOT_SUPPORTED error message. This is
929 : * documented in the wspp docs. I could not get a successful
930 : * call to work, but the main point here is testing that the
931 : * netlogon pipe works.
932 : */
933 0 : status = dcerpc_netr_LogonControl(b, p->mem_ctx,
934 : logon_server, NETLOGON_CONTROL_QUERY,
935 : 2, &info, &werr);
936 :
937 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
938 0 : retry = true;
939 0 : goto reconnect;
940 : }
941 :
942 0 : if (!NT_STATUS_IS_OK(status)) {
943 0 : DEBUG(2, ("dcerpc_netr_LogonControl failed: %s\n",
944 : nt_errstr(status)));
945 0 : return status;
946 : }
947 :
948 0 : if (!W_ERROR_EQUAL(werr, WERR_NOT_SUPPORTED)) {
949 0 : DEBUG(2, ("dcerpc_netr_LogonControl returned %s, expected "
950 : "WERR_NOT_SUPPORTED\n",
951 : win_errstr(werr)));
952 0 : return werror_to_ntstatus(werr);
953 : }
954 :
955 0 : DEBUG(5, ("winbindd_dual_ping_dc succeeded\n"));
956 0 : return NT_STATUS_OK;
957 : }
958 :
959 0 : NTSTATUS _winbind_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p,
960 : struct winbind_DsrUpdateReadOnlyServerDnsRecords *r)
961 : {
962 : struct winbindd_domain *domain;
963 : NTSTATUS status;
964 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
965 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
966 0 : struct dcerpc_binding_handle *b = NULL;
967 0 : bool retry = false;
968 :
969 0 : domain = wb_child_domain();
970 0 : if (domain == NULL) {
971 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
972 : }
973 :
974 0 : reconnect:
975 0 : status = cm_connect_netlogon_secure(domain,
976 : &netlogon_pipe,
977 : &netlogon_creds_ctx);
978 0 : if (!NT_STATUS_IS_OK(status)) {
979 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
980 0 : goto done;
981 : }
982 :
983 0 : b = netlogon_pipe->binding_handle;
984 :
985 0 : status = netlogon_creds_cli_DsrUpdateReadOnlyServerDnsRecords(netlogon_creds_ctx,
986 0 : netlogon_pipe->binding_handle,
987 : r->in.site_name,
988 : r->in.dns_ttl,
989 : r->in.dns_names);
990 :
991 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
992 0 : retry = true;
993 0 : goto reconnect;
994 : }
995 :
996 : /* Pass back result code - zero for success, other values for
997 : specific failures. */
998 :
999 0 : DEBUG(3,("DNS records for domain %s %s\n", domain->name,
1000 : NT_STATUS_IS_OK(status) ? "changed" : "unchanged"));
1001 :
1002 0 : done:
1003 0 : DEBUG(NT_STATUS_IS_OK(status) ? 5 : 2,
1004 : ("Update of DNS records via RW DC %s returned %s\n",
1005 : domain->name, nt_errstr(status)));
1006 :
1007 0 : return status;
1008 : }
1009 :
1010 0 : NTSTATUS _winbind_SamLogon(struct pipes_struct *p,
1011 : struct winbind_SamLogon *r)
1012 : {
1013 0 : struct dcesrv_call_state *dce_call = p->dce_call;
1014 0 : struct dcesrv_connection *dcesrv_conn = dce_call->conn;
1015 : const struct tsocket_address *local_address =
1016 0 : dcesrv_connection_get_local_address(dcesrv_conn);
1017 : const struct tsocket_address *remote_address =
1018 0 : dcesrv_connection_get_remote_address(dcesrv_conn);
1019 : struct winbindd_domain *domain;
1020 : NTSTATUS status;
1021 0 : struct netr_IdentityInfo *identity_info = NULL;
1022 : DATA_BLOB lm_response, nt_response;
1023 0 : DATA_BLOB challenge = data_blob_null;
1024 0 : uint32_t flags = 0;
1025 : uint16_t validation_level;
1026 0 : union netr_Validation *validation = NULL;
1027 0 : bool interactive = false;
1028 :
1029 : /*
1030 : * Make sure we start with authoritative=true,
1031 : * it will only set to false if we don't know the
1032 : * domain.
1033 : */
1034 0 : r->out.authoritative = true;
1035 :
1036 0 : domain = wb_child_domain();
1037 0 : if (domain == NULL) {
1038 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1039 : }
1040 :
1041 0 : switch (r->in.validation_level) {
1042 0 : case 3:
1043 : case 6:
1044 0 : break;
1045 0 : default:
1046 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1047 : }
1048 :
1049 0 : switch (r->in.logon_level) {
1050 0 : case NetlogonInteractiveInformation:
1051 : case NetlogonServiceInformation:
1052 : case NetlogonInteractiveTransitiveInformation:
1053 : case NetlogonServiceTransitiveInformation:
1054 0 : if (r->in.logon.password == NULL) {
1055 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1056 : }
1057 :
1058 0 : interactive = true;
1059 0 : identity_info = &r->in.logon.password->identity_info;
1060 :
1061 0 : challenge = data_blob_null;
1062 0 : lm_response = data_blob_talloc(p->mem_ctx,
1063 : r->in.logon.password->lmpassword.hash,
1064 : sizeof(r->in.logon.password->lmpassword.hash));
1065 0 : nt_response = data_blob_talloc(p->mem_ctx,
1066 : r->in.logon.password->ntpassword.hash,
1067 : sizeof(r->in.logon.password->ntpassword.hash));
1068 0 : break;
1069 :
1070 0 : case NetlogonNetworkInformation:
1071 : case NetlogonNetworkTransitiveInformation:
1072 0 : if (r->in.logon.network == NULL) {
1073 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1074 : }
1075 :
1076 0 : interactive = false;
1077 0 : identity_info = &r->in.logon.network->identity_info;
1078 :
1079 0 : challenge = data_blob_talloc(p->mem_ctx,
1080 : r->in.logon.network->challenge,
1081 : 8);
1082 0 : lm_response = data_blob_talloc(p->mem_ctx,
1083 : r->in.logon.network->lm.data,
1084 : r->in.logon.network->lm.length);
1085 0 : nt_response = data_blob_talloc(p->mem_ctx,
1086 : r->in.logon.network->nt.data,
1087 : r->in.logon.network->nt.length);
1088 0 : break;
1089 :
1090 0 : case NetlogonGenericInformation:
1091 0 : if (r->in.logon.generic == NULL) {
1092 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1093 : }
1094 :
1095 0 : identity_info = &r->in.logon.generic->identity_info;
1096 : /*
1097 : * Not implemented here...
1098 : */
1099 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1100 :
1101 0 : default:
1102 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1103 : }
1104 :
1105 0 : status = winbind_dual_SamLogon(domain, p->mem_ctx,
1106 : interactive,
1107 : identity_info->parameter_control,
1108 : identity_info->account_name.string,
1109 : identity_info->domain_name.string,
1110 : identity_info->workstation.string,
1111 : identity_info->logon_id,
1112 : "SamLogon",
1113 : 0,
1114 : challenge,
1115 : lm_response, nt_response,
1116 : remote_address,
1117 : local_address,
1118 : &r->out.authoritative,
1119 : true, /* skip_sam */
1120 : &flags,
1121 : &validation_level,
1122 : &validation);
1123 0 : if (!NT_STATUS_IS_OK(status)) {
1124 0 : return status;
1125 : }
1126 0 : switch (r->in.validation_level) {
1127 0 : case 3:
1128 0 : status = map_validation_to_info3(p->mem_ctx,
1129 : validation_level,
1130 : validation,
1131 : &r->out.validation.sam3);
1132 0 : TALLOC_FREE(validation);
1133 0 : if (!NT_STATUS_IS_OK(status)) {
1134 0 : return status;
1135 : }
1136 0 : return NT_STATUS_OK;
1137 0 : case 6:
1138 0 : status = map_validation_to_info6(p->mem_ctx,
1139 : validation_level,
1140 : validation,
1141 : &r->out.validation.sam6);
1142 0 : TALLOC_FREE(validation);
1143 0 : if (!NT_STATUS_IS_OK(status)) {
1144 0 : return status;
1145 : }
1146 0 : return NT_STATUS_OK;
1147 : }
1148 :
1149 0 : smb_panic(__location__);
1150 : return NT_STATUS_INTERNAL_ERROR;
1151 : }
1152 :
1153 0 : static WERROR _winbind_LogonControl_REDISCOVER(struct pipes_struct *p,
1154 : struct winbindd_domain *domain,
1155 : struct winbind_LogonControl *r)
1156 : {
1157 : NTSTATUS status;
1158 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1159 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1160 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1161 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1162 :
1163 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1164 0 : if (info2 == NULL) {
1165 0 : return WERR_NOT_ENOUGH_MEMORY;
1166 : }
1167 :
1168 0 : if (domain->internal) {
1169 0 : check_result = WERR_OK;
1170 0 : goto check_return;
1171 : }
1172 :
1173 : /*
1174 : * For now we just force a reconnect
1175 : *
1176 : * TODO: take care of the optional '\dcname'
1177 : */
1178 0 : invalidate_cm_connection(domain);
1179 0 : domain->conn.netlogon_force_reauth = true;
1180 0 : status = cm_connect_netlogon_secure(domain,
1181 : &netlogon_pipe,
1182 : &netlogon_creds_ctx);
1183 0 : reset_cm_connection_on_error(domain, NULL, status);
1184 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1185 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1186 : }
1187 0 : if (!NT_STATUS_IS_OK(status)) {
1188 0 : DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
1189 : __func__, domain->name, domain->alt_name,
1190 : nt_errstr(status)));
1191 : /*
1192 : * Here we return a top level error!
1193 : * This is different than TC_QUERY or TC_VERIFY.
1194 : */
1195 0 : return ntstatus_to_werror(status);
1196 : }
1197 0 : check_result = WERR_OK;
1198 :
1199 0 : check_return:
1200 0 : info2->pdc_connection_status = WERR_OK;
1201 0 : if (domain->dcname != NULL) {
1202 0 : info2->flags |= NETLOGON_HAS_IP;
1203 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1204 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1205 : domain->dcname);
1206 0 : if (info2->trusted_dc_name == NULL) {
1207 0 : return WERR_NOT_ENOUGH_MEMORY;
1208 : }
1209 : } else {
1210 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1211 0 : if (info2->trusted_dc_name == NULL) {
1212 0 : return WERR_NOT_ENOUGH_MEMORY;
1213 : }
1214 : }
1215 0 : info2->tc_connection_status = check_result;
1216 :
1217 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1218 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1219 : "pdc_connection[%s] tc_connection[%s]\n",
1220 : __func__, domain->name, domain->alt_name,
1221 : domain->dcname,
1222 : win_errstr(info2->pdc_connection_status),
1223 : win_errstr(info2->tc_connection_status)));
1224 : }
1225 :
1226 0 : r->out.query->info2 = info2;
1227 :
1228 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1229 0 : return WERR_OK;
1230 : }
1231 :
1232 0 : static WERROR _winbind_LogonControl_TC_QUERY(struct pipes_struct *p,
1233 : struct winbindd_domain *domain,
1234 : struct winbind_LogonControl *r)
1235 : {
1236 : NTSTATUS status;
1237 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1238 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1239 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1240 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1241 :
1242 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1243 0 : if (info2 == NULL) {
1244 0 : return WERR_NOT_ENOUGH_MEMORY;
1245 : }
1246 :
1247 0 : if (domain->internal) {
1248 0 : check_result = WERR_OK;
1249 0 : goto check_return;
1250 : }
1251 :
1252 0 : status = cm_connect_netlogon_secure(domain,
1253 : &netlogon_pipe,
1254 : &netlogon_creds_ctx);
1255 0 : reset_cm_connection_on_error(domain, NULL, status);
1256 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1257 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1258 : }
1259 0 : if (!NT_STATUS_IS_OK(status)) {
1260 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1261 : nt_errstr(status)));
1262 0 : check_result = ntstatus_to_werror(status);
1263 0 : goto check_return;
1264 : }
1265 0 : check_result = WERR_OK;
1266 :
1267 0 : check_return:
1268 0 : info2->pdc_connection_status = WERR_OK;
1269 0 : if (domain->dcname != NULL) {
1270 0 : info2->flags |= NETLOGON_HAS_IP;
1271 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1272 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1273 : domain->dcname);
1274 0 : if (info2->trusted_dc_name == NULL) {
1275 0 : return WERR_NOT_ENOUGH_MEMORY;
1276 : }
1277 : } else {
1278 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1279 0 : if (info2->trusted_dc_name == NULL) {
1280 0 : return WERR_NOT_ENOUGH_MEMORY;
1281 : }
1282 : }
1283 0 : info2->tc_connection_status = check_result;
1284 :
1285 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1286 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1287 : "pdc_connection[%s] tc_connection[%s]\n",
1288 : __func__, domain->name, domain->alt_name,
1289 : domain->dcname,
1290 : win_errstr(info2->pdc_connection_status),
1291 : win_errstr(info2->tc_connection_status)));
1292 : }
1293 :
1294 0 : r->out.query->info2 = info2;
1295 :
1296 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1297 0 : return WERR_OK;
1298 : }
1299 :
1300 0 : static WERROR _winbind_LogonControl_TC_VERIFY(struct pipes_struct *p,
1301 : struct winbindd_domain *domain,
1302 : struct winbind_LogonControl *r)
1303 : {
1304 0 : TALLOC_CTX *frame = talloc_stackframe();
1305 : NTSTATUS status;
1306 : NTSTATUS result;
1307 0 : struct lsa_String trusted_domain_name = {};
1308 0 : struct lsa_StringLarge trusted_domain_name_l = {};
1309 0 : struct rpc_pipe_client *local_lsa_pipe = NULL;
1310 0 : struct policy_handle local_lsa_policy = {};
1311 0 : struct dcerpc_binding_handle *local_lsa = NULL;
1312 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1313 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1314 0 : struct cli_credentials *creds = NULL;
1315 0 : struct samr_Password *cur_nt_hash = NULL;
1316 0 : uint32_t trust_attributes = 0;
1317 0 : struct samr_Password new_owf_password = {};
1318 0 : bool cmp_new = false;
1319 0 : struct samr_Password old_owf_password = {};
1320 0 : bool cmp_old = false;
1321 0 : const struct lsa_TrustDomainInfoInfoEx *local_tdo = NULL;
1322 0 : bool fetch_fti = false;
1323 0 : struct lsa_ForestTrustInformation *new_fti = NULL;
1324 0 : struct netr_TrustInfo *trust_info = NULL;
1325 0 : struct netr_NETLOGON_INFO_2 *info2 = NULL;
1326 0 : struct dcerpc_binding_handle *b = NULL;
1327 0 : WERROR check_result = WERR_INTERNAL_ERROR;
1328 0 : WERROR verify_result = WERR_INTERNAL_ERROR;
1329 0 : bool retry = false;
1330 :
1331 0 : trusted_domain_name.string = domain->name;
1332 0 : trusted_domain_name_l.string = domain->name;
1333 :
1334 0 : info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
1335 0 : if (info2 == NULL) {
1336 0 : TALLOC_FREE(frame);
1337 0 : return WERR_NOT_ENOUGH_MEMORY;
1338 : }
1339 :
1340 0 : if (domain->internal) {
1341 0 : check_result = WERR_OK;
1342 0 : goto check_return;
1343 : }
1344 :
1345 0 : status = pdb_get_trust_credentials(domain->name,
1346 0 : domain->alt_name,
1347 : frame,
1348 : &creds);
1349 0 : if (NT_STATUS_IS_OK(status)) {
1350 0 : cur_nt_hash = cli_credentials_get_nt_hash(creds, frame);
1351 0 : TALLOC_FREE(creds);
1352 : }
1353 :
1354 0 : if (!domain->primary) {
1355 0 : union lsa_TrustedDomainInfo *tdi = NULL;
1356 :
1357 0 : status = open_internal_lsa_conn(frame, &local_lsa_pipe,
1358 : &local_lsa_policy);
1359 0 : if (!NT_STATUS_IS_OK(status)) {
1360 0 : DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
1361 : __location__, __func__, nt_errstr(status)));
1362 0 : TALLOC_FREE(frame);
1363 0 : return WERR_INTERNAL_ERROR;
1364 : }
1365 0 : local_lsa = local_lsa_pipe->binding_handle;
1366 :
1367 0 : status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
1368 : &local_lsa_policy,
1369 : &trusted_domain_name,
1370 : LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
1371 : &tdi, &result);
1372 0 : if (!NT_STATUS_IS_OK(status)) {
1373 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
1374 : __location__, __func__, domain->name, nt_errstr(status)));
1375 0 : TALLOC_FREE(frame);
1376 0 : return WERR_INTERNAL_ERROR;
1377 : }
1378 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1379 0 : DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
1380 : __location__, __func__, domain->name));
1381 0 : TALLOC_FREE(frame);
1382 0 : return WERR_NO_SUCH_DOMAIN;
1383 : }
1384 0 : if (!NT_STATUS_IS_OK(result)) {
1385 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
1386 : __location__, __func__, domain->name, nt_errstr(result)));
1387 0 : TALLOC_FREE(frame);
1388 0 : return WERR_INTERNAL_ERROR;
1389 : }
1390 0 : if (tdi == NULL) {
1391 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
1392 : "returned no trusted domain information\n",
1393 : __location__, __func__));
1394 0 : TALLOC_FREE(frame);
1395 0 : return WERR_INTERNAL_ERROR;
1396 : }
1397 :
1398 0 : local_tdo = &tdi->info_ex;
1399 0 : trust_attributes = local_tdo->trust_attributes;
1400 : }
1401 :
1402 0 : if (trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1403 0 : struct lsa_ForestTrustInformation *old_fti = NULL;
1404 :
1405 0 : status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
1406 : &local_lsa_policy,
1407 : &trusted_domain_name,
1408 : LSA_FOREST_TRUST_DOMAIN_INFO,
1409 : &old_fti, &result);
1410 0 : if (!NT_STATUS_IS_OK(status)) {
1411 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
1412 : __location__, __func__, domain->name, nt_errstr(status)));
1413 0 : TALLOC_FREE(frame);
1414 0 : return WERR_INTERNAL_ERROR;
1415 : }
1416 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
1417 0 : DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
1418 : __func__, domain->name));
1419 0 : old_fti = NULL;
1420 0 : fetch_fti = true;
1421 0 : result = NT_STATUS_OK;
1422 : }
1423 0 : if (!NT_STATUS_IS_OK(result)) {
1424 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
1425 : __location__, __func__, domain->name, nt_errstr(result)));
1426 0 : TALLOC_FREE(frame);
1427 0 : return WERR_INTERNAL_ERROR;
1428 : }
1429 :
1430 0 : TALLOC_FREE(old_fti);
1431 : }
1432 :
1433 0 : reconnect:
1434 0 : status = cm_connect_netlogon_secure(domain,
1435 : &netlogon_pipe,
1436 : &netlogon_creds_ctx);
1437 0 : reset_cm_connection_on_error(domain, NULL, status);
1438 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1439 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1440 : }
1441 0 : if (!NT_STATUS_IS_OK(status)) {
1442 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1443 : nt_errstr(status)));
1444 0 : check_result = ntstatus_to_werror(status);
1445 0 : goto check_return;
1446 : }
1447 0 : check_result = WERR_OK;
1448 0 : b = netlogon_pipe->binding_handle;
1449 :
1450 0 : if (cur_nt_hash == NULL) {
1451 0 : verify_result = WERR_NO_TRUST_LSA_SECRET;
1452 0 : goto verify_return;
1453 : }
1454 :
1455 0 : if (fetch_fti) {
1456 0 : status = netlogon_creds_cli_GetForestTrustInformation(netlogon_creds_ctx,
1457 : b, frame,
1458 : &new_fti);
1459 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1460 0 : status = NT_STATUS_NOT_SUPPORTED;
1461 : }
1462 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1463 0 : new_fti = NULL;
1464 0 : status = NT_STATUS_OK;
1465 : }
1466 0 : if (!NT_STATUS_IS_OK(status)) {
1467 0 : if (!retry &&
1468 0 : reset_cm_connection_on_error(domain, b, status))
1469 : {
1470 0 : retry = true;
1471 0 : goto reconnect;
1472 : }
1473 0 : DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s)"
1474 : "failed: %s\n",
1475 : domain->name, nt_errstr(status)));
1476 0 : check_result = ntstatus_to_werror(status);
1477 0 : goto check_return;
1478 : }
1479 : }
1480 :
1481 0 : if (new_fti != NULL) {
1482 0 : struct lsa_ForestTrustInformation old_fti = {};
1483 0 : struct lsa_ForestTrustInformation *merged_fti = NULL;
1484 0 : struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
1485 :
1486 0 : status = dsdb_trust_merge_forest_info(frame, local_tdo,
1487 : &old_fti, new_fti,
1488 : &merged_fti);
1489 0 : if (!NT_STATUS_IS_OK(status)) {
1490 0 : DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
1491 : __location__, __func__,
1492 : domain->name, nt_errstr(status)));
1493 0 : TALLOC_FREE(frame);
1494 0 : return ntstatus_to_werror(status);
1495 : }
1496 :
1497 0 : status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
1498 : &local_lsa_policy,
1499 : &trusted_domain_name_l,
1500 : LSA_FOREST_TRUST_DOMAIN_INFO,
1501 : merged_fti,
1502 : 0, /* check_only=0 => store it! */
1503 : &collision_info,
1504 : &result);
1505 0 : if (!NT_STATUS_IS_OK(status)) {
1506 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
1507 : __location__, __func__, domain->name, nt_errstr(status)));
1508 0 : TALLOC_FREE(frame);
1509 0 : return WERR_INTERNAL_ERROR;
1510 : }
1511 0 : if (!NT_STATUS_IS_OK(result)) {
1512 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
1513 : __location__, __func__, domain->name, nt_errstr(result)));
1514 0 : TALLOC_FREE(frame);
1515 0 : return ntstatus_to_werror(result);
1516 : }
1517 : }
1518 :
1519 0 : status = netlogon_creds_cli_ServerGetTrustInfo(netlogon_creds_ctx,
1520 : b, frame,
1521 : &new_owf_password,
1522 : &old_owf_password,
1523 : &trust_info);
1524 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1525 0 : status = NT_STATUS_NOT_SUPPORTED;
1526 : }
1527 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
1528 0 : DEBUG(5, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
1529 : nt_errstr(status)));
1530 0 : verify_result = WERR_OK;
1531 0 : goto verify_return;
1532 : }
1533 0 : if (!NT_STATUS_IS_OK(status)) {
1534 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1535 0 : retry = true;
1536 0 : goto reconnect;
1537 : }
1538 0 : DEBUG(2, ("netlogon_creds_cli_ServerGetTrustInfo failed: %s\n",
1539 : nt_errstr(status)));
1540 :
1541 0 : if (!dcerpc_binding_handle_is_connected(b)) {
1542 0 : check_result = ntstatus_to_werror(status);
1543 0 : goto check_return;
1544 : } else {
1545 0 : verify_result = ntstatus_to_werror(status);
1546 0 : goto verify_return;
1547 : }
1548 : }
1549 :
1550 0 : if (trust_info != NULL && trust_info->count >= 1) {
1551 0 : uint32_t diff = trust_info->data[0] ^ trust_attributes;
1552 :
1553 0 : if (diff & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1554 0 : verify_result = WERR_DOMAIN_TRUST_INCONSISTENT;
1555 0 : goto verify_return;
1556 : }
1557 : }
1558 :
1559 0 : cmp_new = mem_equal_const_time(new_owf_password.hash,
1560 0 : cur_nt_hash->hash,
1561 : sizeof(cur_nt_hash->hash));
1562 0 : cmp_old = mem_equal_const_time(old_owf_password.hash,
1563 0 : cur_nt_hash->hash,
1564 : sizeof(cur_nt_hash->hash));
1565 0 : if (!cmp_new && !cmp_old) {
1566 0 : DEBUG(1,("%s:Error: credentials for domain[%s/%s] doesn't match "
1567 : "any password known to dcname[%s]\n",
1568 : __func__, domain->name, domain->alt_name,
1569 : domain->dcname));
1570 0 : verify_result = WERR_WRONG_PASSWORD;
1571 0 : goto verify_return;
1572 : }
1573 :
1574 0 : if (!cmp_new) {
1575 0 : DEBUG(2,("%s:Warning: credentials for domain[%s/%s] only match "
1576 : "against the old password known to dcname[%s]\n",
1577 : __func__, domain->name, domain->alt_name,
1578 : domain->dcname));
1579 : }
1580 :
1581 0 : verify_result = WERR_OK;
1582 0 : goto verify_return;
1583 :
1584 0 : check_return:
1585 0 : verify_result = check_result;
1586 0 : verify_return:
1587 0 : info2->flags |= NETLOGON_VERIFY_STATUS_RETURNED;
1588 0 : info2->pdc_connection_status = verify_result;
1589 0 : if (domain->dcname != NULL) {
1590 0 : info2->flags |= NETLOGON_HAS_IP;
1591 0 : info2->flags |= NETLOGON_HAS_TIMESERV;
1592 0 : info2->trusted_dc_name = talloc_asprintf(info2, "\\\\%s",
1593 : domain->dcname);
1594 0 : if (info2->trusted_dc_name == NULL) {
1595 0 : TALLOC_FREE(frame);
1596 0 : return WERR_NOT_ENOUGH_MEMORY;
1597 : }
1598 : } else {
1599 0 : info2->trusted_dc_name = talloc_strdup(info2, "");
1600 0 : if (info2->trusted_dc_name == NULL) {
1601 0 : TALLOC_FREE(frame);
1602 0 : return WERR_NOT_ENOUGH_MEMORY;
1603 : }
1604 : }
1605 0 : info2->tc_connection_status = check_result;
1606 :
1607 0 : if (!W_ERROR_IS_OK(info2->pdc_connection_status)) {
1608 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1609 : "pdc_connection[%s] tc_connection[%s]\n",
1610 : __func__, domain->name, domain->alt_name,
1611 : domain->dcname,
1612 : win_errstr(info2->pdc_connection_status),
1613 : win_errstr(info2->tc_connection_status)));
1614 : }
1615 :
1616 0 : r->out.query->info2 = info2;
1617 :
1618 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1619 0 : TALLOC_FREE(frame);
1620 0 : return WERR_OK;
1621 : }
1622 :
1623 0 : static WERROR _winbind_LogonControl_CHANGE_PASSWORD(struct pipes_struct *p,
1624 : struct winbindd_domain *domain,
1625 : struct winbind_LogonControl *r)
1626 : {
1627 0 : struct messaging_context *msg_ctx = global_messaging_context();
1628 : NTSTATUS status;
1629 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1630 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1631 0 : struct cli_credentials *creds = NULL;
1632 0 : struct samr_Password *cur_nt_hash = NULL;
1633 0 : struct netr_NETLOGON_INFO_1 *info1 = NULL;
1634 : struct dcerpc_binding_handle *b;
1635 0 : WERROR change_result = WERR_OK;
1636 0 : bool retry = false;
1637 :
1638 0 : info1 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_1);
1639 0 : if (info1 == NULL) {
1640 0 : return WERR_NOT_ENOUGH_MEMORY;
1641 : }
1642 :
1643 0 : if (domain->internal) {
1644 0 : return WERR_NOT_SUPPORTED;
1645 : }
1646 :
1647 0 : status = pdb_get_trust_credentials(domain->name,
1648 0 : domain->alt_name,
1649 : p->mem_ctx,
1650 : &creds);
1651 0 : if (NT_STATUS_IS_OK(status)) {
1652 0 : cur_nt_hash = cli_credentials_get_nt_hash(creds, p->mem_ctx);
1653 0 : TALLOC_FREE(creds);
1654 : }
1655 :
1656 0 : reconnect:
1657 0 : status = cm_connect_netlogon_secure(domain,
1658 : &netlogon_pipe,
1659 : &netlogon_creds_ctx);
1660 0 : reset_cm_connection_on_error(domain, NULL, status);
1661 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1662 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1663 : }
1664 0 : if (!NT_STATUS_IS_OK(status)) {
1665 0 : DEBUG(2, ("%s: domain[%s/%s] cm_connect_netlogon() returned %s\n",
1666 : __func__, domain->name, domain->alt_name,
1667 : nt_errstr(status)));
1668 : /*
1669 : * Here we return a top level error!
1670 : * This is different than TC_QUERY or TC_VERIFY.
1671 : */
1672 0 : return ntstatus_to_werror(status);
1673 : }
1674 0 : b = netlogon_pipe->binding_handle;
1675 :
1676 0 : if (cur_nt_hash == NULL) {
1677 0 : change_result = WERR_NO_TRUST_LSA_SECRET;
1678 0 : goto change_return;
1679 : }
1680 0 : TALLOC_FREE(cur_nt_hash);
1681 :
1682 0 : status = trust_pw_change(netlogon_creds_ctx,
1683 0 : msg_ctx, b, domain->name,
1684 0 : domain->dcname,
1685 : true); /* force */
1686 0 : if (!NT_STATUS_IS_OK(status)) {
1687 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1688 0 : retry = true;
1689 0 : goto reconnect;
1690 : }
1691 :
1692 0 : DEBUG(1, ("trust_pw_change(%s): %s\n",
1693 : domain->name, nt_errstr(status)));
1694 :
1695 0 : change_result = ntstatus_to_werror(status);
1696 0 : goto change_return;
1697 : }
1698 :
1699 0 : change_result = WERR_OK;
1700 :
1701 0 : change_return:
1702 0 : info1->pdc_connection_status = change_result;
1703 :
1704 0 : if (!W_ERROR_IS_OK(info1->pdc_connection_status)) {
1705 0 : DEBUG(2, ("%s: domain[%s/%s] dcname[%s] "
1706 : "pdc_connection[%s]\n",
1707 : __func__, domain->name, domain->alt_name,
1708 : domain->dcname,
1709 : win_errstr(info1->pdc_connection_status)));
1710 : }
1711 :
1712 0 : r->out.query->info1 = info1;
1713 :
1714 0 : DEBUG(5, ("%s: succeeded.\n", __func__));
1715 0 : return WERR_OK;
1716 : }
1717 :
1718 0 : WERROR _winbind_LogonControl(struct pipes_struct *p,
1719 : struct winbind_LogonControl *r)
1720 : {
1721 : struct winbindd_domain *domain;
1722 :
1723 0 : domain = wb_child_domain();
1724 0 : if (domain == NULL) {
1725 0 : return WERR_NO_SUCH_DOMAIN;
1726 : }
1727 :
1728 0 : switch (r->in.function_code) {
1729 0 : case NETLOGON_CONTROL_REDISCOVER:
1730 0 : if (r->in.level != 2) {
1731 0 : return WERR_INVALID_PARAMETER;
1732 : }
1733 0 : return _winbind_LogonControl_REDISCOVER(p, domain, r);
1734 0 : case NETLOGON_CONTROL_TC_QUERY:
1735 0 : if (r->in.level != 2) {
1736 0 : return WERR_INVALID_PARAMETER;
1737 : }
1738 0 : return _winbind_LogonControl_TC_QUERY(p, domain, r);
1739 0 : case NETLOGON_CONTROL_TC_VERIFY:
1740 0 : if (r->in.level != 2) {
1741 0 : return WERR_INVALID_PARAMETER;
1742 : }
1743 0 : return _winbind_LogonControl_TC_VERIFY(p, domain, r);
1744 0 : case NETLOGON_CONTROL_CHANGE_PASSWORD:
1745 0 : if (r->in.level != 1) {
1746 0 : return WERR_INVALID_PARAMETER;
1747 : }
1748 0 : return _winbind_LogonControl_CHANGE_PASSWORD(p, domain, r);
1749 0 : default:
1750 0 : break;
1751 : }
1752 :
1753 0 : DEBUG(4, ("%s: function_code[0x%x] not supported\n",
1754 : __func__, r->in.function_code));
1755 0 : return WERR_NOT_SUPPORTED;
1756 : }
1757 :
1758 0 : WERROR _winbind_GetForestTrustInformation(struct pipes_struct *p,
1759 : struct winbind_GetForestTrustInformation *r)
1760 : {
1761 0 : TALLOC_CTX *frame = talloc_stackframe();
1762 : NTSTATUS status, result;
1763 : struct winbindd_domain *domain;
1764 0 : struct rpc_pipe_client *netlogon_pipe = NULL;
1765 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1766 : struct dcerpc_binding_handle *b;
1767 0 : bool retry = false;
1768 0 : struct lsa_String trusted_domain_name = {};
1769 0 : struct lsa_StringLarge trusted_domain_name_l = {};
1770 0 : union lsa_TrustedDomainInfo *tdi = NULL;
1771 0 : const struct lsa_TrustDomainInfoInfoEx *tdo = NULL;
1772 0 : struct lsa_ForestTrustInformation _old_fti = {};
1773 0 : struct lsa_ForestTrustInformation *old_fti = NULL;
1774 0 : struct lsa_ForestTrustInformation *new_fti = NULL;
1775 0 : struct lsa_ForestTrustInformation *merged_fti = NULL;
1776 0 : struct lsa_ForestTrustCollisionInfo *collision_info = NULL;
1777 0 : bool update_fti = false;
1778 : struct rpc_pipe_client *local_lsa_pipe;
1779 : struct policy_handle local_lsa_policy;
1780 0 : struct dcerpc_binding_handle *local_lsa = NULL;
1781 :
1782 0 : domain = wb_child_domain();
1783 0 : if (domain == NULL) {
1784 0 : TALLOC_FREE(frame);
1785 0 : return WERR_NO_SUCH_DOMAIN;
1786 : }
1787 :
1788 : /*
1789 : * checking for domain->internal and domain->primary
1790 : * makes sure we only do some work when running as DC.
1791 : */
1792 :
1793 0 : if (domain->internal) {
1794 0 : TALLOC_FREE(frame);
1795 0 : return WERR_NO_SUCH_DOMAIN;
1796 : }
1797 :
1798 0 : if (domain->primary) {
1799 0 : TALLOC_FREE(frame);
1800 0 : return WERR_NO_SUCH_DOMAIN;
1801 : }
1802 :
1803 0 : trusted_domain_name.string = domain->name;
1804 0 : trusted_domain_name_l.string = domain->name;
1805 :
1806 0 : status = open_internal_lsa_conn(frame, &local_lsa_pipe,
1807 : &local_lsa_policy);
1808 0 : if (!NT_STATUS_IS_OK(status)) {
1809 0 : DEBUG(0,("%s:%s: open_internal_lsa_conn() failed - %s\n",
1810 : __location__, __func__, nt_errstr(status)));
1811 0 : TALLOC_FREE(frame);
1812 0 : return WERR_INTERNAL_ERROR;
1813 : }
1814 0 : local_lsa = local_lsa_pipe->binding_handle;
1815 :
1816 0 : status = dcerpc_lsa_QueryTrustedDomainInfoByName(local_lsa, frame,
1817 : &local_lsa_policy,
1818 : &trusted_domain_name,
1819 : LSA_TRUSTED_DOMAIN_INFO_INFO_EX,
1820 : &tdi, &result);
1821 0 : if (!NT_STATUS_IS_OK(status)) {
1822 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) failed - %s\n",
1823 : __location__, __func__, domain->name, nt_errstr(status)));
1824 0 : TALLOC_FREE(frame);
1825 0 : return WERR_INTERNAL_ERROR;
1826 : }
1827 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1828 0 : DEBUG(1,("%s:%s: domain[%s] not found via LSA, might be removed already.\n",
1829 : __location__, __func__, domain->name));
1830 0 : TALLOC_FREE(frame);
1831 0 : return WERR_NO_SUCH_DOMAIN;
1832 : }
1833 0 : if (!NT_STATUS_IS_OK(result)) {
1834 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName(%s) returned %s\n",
1835 : __location__, __func__, domain->name, nt_errstr(result)));
1836 0 : TALLOC_FREE(frame);
1837 0 : return WERR_INTERNAL_ERROR;
1838 : }
1839 0 : if (tdi == NULL) {
1840 0 : DEBUG(0,("%s:%s: local_lsa.QueryTrustedDomainInfoByName() "
1841 : "returned no trusted domain information\n",
1842 : __location__, __func__));
1843 0 : TALLOC_FREE(frame);
1844 0 : return WERR_INTERNAL_ERROR;
1845 : }
1846 :
1847 0 : tdo = &tdi->info_ex;
1848 :
1849 0 : if (!(tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)) {
1850 0 : DEBUG(2,("%s: tdo[%s/%s] is no forest trust attributes[0x%08X]\n",
1851 : __func__, tdo->netbios_name.string,
1852 : tdo->domain_name.string,
1853 : (unsigned)tdo->trust_attributes));
1854 0 : TALLOC_FREE(frame);
1855 0 : return WERR_NO_SUCH_DOMAIN;
1856 : }
1857 :
1858 0 : if (r->in.flags & ~DS_GFTI_UPDATE_TDO) {
1859 0 : TALLOC_FREE(frame);
1860 0 : return WERR_INVALID_FLAGS;
1861 : }
1862 :
1863 0 : reconnect:
1864 0 : status = cm_connect_netlogon_secure(domain,
1865 : &netlogon_pipe,
1866 : &netlogon_creds_ctx);
1867 0 : reset_cm_connection_on_error(domain, NULL, status);
1868 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1869 0 : status = NT_STATUS_NO_LOGON_SERVERS;
1870 : }
1871 0 : if (!NT_STATUS_IS_OK(status)) {
1872 0 : DEBUG(3, ("could not open handle to NETLOGON pipe: %s\n",
1873 : nt_errstr(status)));
1874 0 : TALLOC_FREE(frame);
1875 0 : return ntstatus_to_werror(status);
1876 : }
1877 0 : b = netlogon_pipe->binding_handle;
1878 :
1879 0 : status = netlogon_creds_cli_GetForestTrustInformation(netlogon_creds_ctx,
1880 : b, p->mem_ctx,
1881 : &new_fti);
1882 0 : if (!NT_STATUS_IS_OK(status)) {
1883 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
1884 0 : retry = true;
1885 0 : goto reconnect;
1886 : }
1887 0 : DEBUG(2, ("netlogon_creds_cli_GetForestTrustInformation(%s) failed: %s\n",
1888 : domain->name, nt_errstr(status)));
1889 0 : TALLOC_FREE(frame);
1890 0 : return ntstatus_to_werror(status);
1891 : }
1892 :
1893 0 : *r->out.forest_trust_info = new_fti;
1894 :
1895 0 : if (r->in.flags & DS_GFTI_UPDATE_TDO) {
1896 0 : update_fti = true;
1897 : }
1898 :
1899 0 : status = dcerpc_lsa_lsaRQueryForestTrustInformation(local_lsa, frame,
1900 : &local_lsa_policy,
1901 : &trusted_domain_name,
1902 : LSA_FOREST_TRUST_DOMAIN_INFO,
1903 : &old_fti, &result);
1904 0 : if (!NT_STATUS_IS_OK(status)) {
1905 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) failed %s\n",
1906 : __location__, __func__, domain->name, nt_errstr(status)));
1907 0 : TALLOC_FREE(frame);
1908 0 : return WERR_INTERNAL_ERROR;
1909 : }
1910 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_FOUND)) {
1911 0 : DEBUG(2,("%s: no forest trust information available for domain[%s] yet.\n",
1912 : __func__, domain->name));
1913 0 : update_fti = true;
1914 0 : old_fti = &_old_fti;
1915 0 : result = NT_STATUS_OK;
1916 : }
1917 0 : if (!NT_STATUS_IS_OK(result)) {
1918 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation(%s) returned %s\n",
1919 : __location__, __func__, domain->name, nt_errstr(result)));
1920 0 : TALLOC_FREE(frame);
1921 0 : return WERR_INTERNAL_ERROR;
1922 : }
1923 :
1924 0 : if (old_fti == NULL) {
1925 0 : DEBUG(0,("%s:%s: local_lsa.lsaRQueryForestTrustInformation() "
1926 : "returned success without returning forest trust information\n",
1927 : __location__, __func__));
1928 0 : TALLOC_FREE(frame);
1929 0 : return WERR_INTERNAL_ERROR;
1930 : }
1931 :
1932 0 : if (!update_fti) {
1933 0 : goto done;
1934 : }
1935 :
1936 0 : status = dsdb_trust_merge_forest_info(frame, tdo, old_fti, new_fti,
1937 : &merged_fti);
1938 0 : if (!NT_STATUS_IS_OK(status)) {
1939 0 : DEBUG(0,("%s:%s: dsdb_trust_merge_forest_info(%s) failed %s\n",
1940 : __location__, __func__, domain->name, nt_errstr(status)));
1941 0 : TALLOC_FREE(frame);
1942 0 : return ntstatus_to_werror(status);
1943 : }
1944 :
1945 0 : status = dcerpc_lsa_lsaRSetForestTrustInformation(local_lsa, frame,
1946 : &local_lsa_policy,
1947 : &trusted_domain_name_l,
1948 : LSA_FOREST_TRUST_DOMAIN_INFO,
1949 : merged_fti,
1950 : 0, /* check_only=0 => store it! */
1951 : &collision_info,
1952 : &result);
1953 0 : if (!NT_STATUS_IS_OK(status)) {
1954 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) failed %s\n",
1955 : __location__, __func__, domain->name, nt_errstr(status)));
1956 0 : TALLOC_FREE(frame);
1957 0 : return WERR_INTERNAL_ERROR;
1958 : }
1959 0 : if (!NT_STATUS_IS_OK(result)) {
1960 0 : DEBUG(0,("%s:%s: local_lsa.lsaRSetForestTrustInformation(%s) returned %s\n",
1961 : __location__, __func__, domain->name, nt_errstr(result)));
1962 0 : TALLOC_FREE(frame);
1963 0 : return ntstatus_to_werror(result);
1964 : }
1965 :
1966 0 : done:
1967 0 : DEBUG(5, ("_winbind_GetForestTrustInformation succeeded\n"));
1968 0 : TALLOC_FREE(frame);
1969 0 : return WERR_OK;
1970 : }
1971 :
1972 0 : NTSTATUS _winbind_SendToSam(struct pipes_struct *p, struct winbind_SendToSam *r)
1973 : {
1974 : struct winbindd_domain *domain;
1975 : NTSTATUS status;
1976 : struct rpc_pipe_client *netlogon_pipe;
1977 0 : struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1978 0 : struct dcerpc_binding_handle *b = NULL;
1979 0 : bool retry = false;
1980 :
1981 0 : DEBUG(5, ("_winbind_SendToSam received\n"));
1982 0 : domain = wb_child_domain();
1983 0 : if (domain == NULL) {
1984 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
1985 : }
1986 :
1987 0 : reconnect:
1988 0 : status = cm_connect_netlogon_secure(domain,
1989 : &netlogon_pipe,
1990 : &netlogon_creds_ctx);
1991 0 : reset_cm_connection_on_error(domain, NULL, status);
1992 0 : if (!NT_STATUS_IS_OK(status)) {
1993 0 : DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1994 0 : return status;
1995 : }
1996 :
1997 0 : b = netlogon_pipe->binding_handle;
1998 :
1999 0 : status = netlogon_creds_cli_SendToSam(netlogon_creds_ctx,
2000 : b,
2001 : &r->in.message);
2002 0 : if (!retry && reset_cm_connection_on_error(domain, b, status)) {
2003 0 : retry = true;
2004 0 : goto reconnect;
2005 : }
2006 :
2007 0 : return status;
2008 : }
2009 :
2010 0 : NTSTATUS _wbint_ListTrustedDomains(struct pipes_struct *p,
2011 : struct wbint_ListTrustedDomains *r)
2012 : {
2013 0 : struct winbindd_domain *domain = wb_child_domain();
2014 : uint32_t i, n;
2015 : NTSTATUS result;
2016 : struct netr_DomainTrustList trusts;
2017 0 : struct netr_DomainTrustList *out = NULL;
2018 : pid_t client_pid;
2019 :
2020 0 : if (domain == NULL) {
2021 0 : return NT_STATUS_REQUEST_NOT_ACCEPTED;
2022 : }
2023 :
2024 : /* Cut client_pid to 32bit */
2025 0 : client_pid = r->in.client_pid;
2026 0 : if ((uint64_t)client_pid != r->in.client_pid) {
2027 0 : DBG_DEBUG("pid out of range\n");
2028 0 : return NT_STATUS_INVALID_PARAMETER;
2029 : }
2030 :
2031 0 : DBG_NOTICE("[%s %"PRIu32"]: list trusted domains\n",
2032 : r->in.client_name, client_pid);
2033 :
2034 0 : result = wb_cache_trusted_domains(domain, p->mem_ctx, &trusts);
2035 0 : if (!NT_STATUS_IS_OK(result)) {
2036 0 : DBG_NOTICE("wb_cache_trusted_domains returned %s\n",
2037 : nt_errstr(result));
2038 0 : return result;
2039 : }
2040 :
2041 0 : out = talloc_zero(p->mem_ctx, struct netr_DomainTrustList);
2042 0 : if (out == NULL) {
2043 0 : return NT_STATUS_NO_MEMORY;
2044 : }
2045 :
2046 0 : r->out.domains = out;
2047 :
2048 0 : for (i=0; i<trusts.count; i++) {
2049 0 : if (trusts.array[i].sid == NULL) {
2050 0 : continue;
2051 : }
2052 0 : if (dom_sid_equal(trusts.array[i].sid, &global_sid_NULL)) {
2053 0 : continue;
2054 : }
2055 :
2056 0 : n = out->count;
2057 0 : out->array = talloc_realloc(out, out->array,
2058 : struct netr_DomainTrust,
2059 : n + 1);
2060 0 : if (out->array == NULL) {
2061 0 : return NT_STATUS_NO_MEMORY;
2062 : }
2063 0 : out->count = n + 1;
2064 :
2065 0 : out->array[n].netbios_name = talloc_steal(
2066 : out->array, trusts.array[i].netbios_name);
2067 0 : if (out->array[n].netbios_name == NULL) {
2068 0 : return NT_STATUS_NO_MEMORY;
2069 : }
2070 :
2071 0 : out->array[n].dns_name = talloc_steal(
2072 : out->array, trusts.array[i].dns_name);
2073 0 : if (out->array[n].dns_name == NULL) {
2074 0 : return NT_STATUS_NO_MEMORY;
2075 : }
2076 :
2077 0 : out->array[n].sid = dom_sid_dup(out->array,
2078 0 : trusts.array[i].sid);
2079 0 : if (out->array[n].sid == NULL) {
2080 0 : return NT_STATUS_NO_MEMORY;
2081 : }
2082 :
2083 0 : out->array[n].trust_flags = trusts.array[i].trust_flags;
2084 0 : out->array[n].trust_type = trusts.array[i].trust_type;
2085 0 : out->array[n].trust_attributes = trusts.array[i].trust_attributes;
2086 : }
2087 :
2088 0 : return NT_STATUS_OK;
2089 : }
2090 :
2091 : #include "librpc/gen_ndr/ndr_winbind_scompat.c"
|
