/* [<][>][^][v][top][bottom][index][help] */
DEFINITIONS
This source file includes following definitions.
- msg_failed_to_go_online
- msg_try_to_go_online
- fork_child_dc_connect
- check_domain_online_handler
- calc_new_online_timeout_check
- set_domain_offline
- set_domain_online
- set_domain_online_request
- winbind_add_failed_connection_entry
- cm_get_ipc_userpass
- get_dc_name_via_netlogon
- get_trust_creds
- cm_prepare_connection
- add_one_dc_unique
- add_sockaddr_to_array
- dcip_to_name
- get_dcs
- find_new_dc
- cm_open_connection
- invalidate_cm_connection
- close_conns_after_fork
- connection_ok
- init_dc_connection_network
- init_dc_connection
- set_dc_type_and_flags_trustinfo
- set_dc_type_and_flags_connect
- set_dc_type_and_flags
- cm_get_schannel_dcinfo
- cm_connect_sam
- cm_connect_lsa_tcp
- cm_connect_lsa
- cm_connect_netlogon
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon connection manager
5
6 Copyright (C) Tim Potter 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Gerald (Jerry) Carter 2003-2005.
9 Copyright (C) Volker Lendecke 2004-2005
10 Copyright (C) Jeremy Allison 2006
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 /*
27 We need to manage connections to domain controllers without having to
28 mess up the main winbindd code with other issues. The aim of the
29 connection manager is to:
30
31 - make connections to domain controllers and cache them
32 - re-establish connections when networks or servers go down
33 - centralise the policy on connection timeouts, domain controller
34 selection etc
35 - manage re-entrancy for when winbindd becomes able to handle
36 multiple outstanding rpc requests
37
38 Why not have connection management as part of the rpc layer like tng?
39 Good question. This code may morph into libsmb/rpc_cache.c or something
40 like that but at the moment it's simply staying as part of winbind. I
41 think the TNG architecture of forcing every user of the rpc layer to use
42 the connection caching system is a bad idea. It should be an optional
43 method of using the routines.
44
45 The TNG design is quite good but I disagree with some aspects of the
46 implementation. -tpot
47
48 */
49
50 /*
51 TODO:
52
53 - I'm pretty annoyed by all the make_nmb_name() stuff. It should be
54 moved down into another function.
55
56 - Take care when destroying cli_structs as they can be shared between
57 various sam handles.
58
59 */
60
61 #include "includes.h"
62 #include "winbindd.h"
63
64 #undef DBGC_CLASS
65 #define DBGC_CLASS DBGC_WINBIND
66
67 struct dc_name_ip {
68 fstring name;
69 struct sockaddr_storage ss;
70 };
71
72 extern struct winbindd_methods reconnect_methods;
73 extern bool override_logfile;
74
75 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
76 static void set_dc_type_and_flags( struct winbindd_domain *domain );
77 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
78 struct dc_name_ip **dcs, int *num_dcs);
79
80 /****************************************************************
81 Child failed to find DC's. Reschedule check.
82 ****************************************************************/
83
84 static void msg_failed_to_go_online(struct messaging_context *msg,
/* [<][>][^][v][top][bottom][index][help] */
85 void *private_data,
86 uint32_t msg_type,
87 struct server_id server_id,
88 DATA_BLOB *data)
89 {
90 struct winbindd_domain *domain;
91 const char *domainname = (const char *)data->data;
92
93 if (data->data == NULL || data->length == 0) {
94 return;
95 }
96
97 DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
98
99 for (domain = domain_list(); domain; domain = domain->next) {
100 if (domain->internal) {
101 continue;
102 }
103
104 if (strequal(domain->name, domainname)) {
105 if (domain->online) {
106 /* We're already online, ignore. */
107 DEBUG(5,("msg_fail_to_go_online: domain %s "
108 "already online.\n", domainname));
109 continue;
110 }
111
112 /* Reschedule the online check. */
113 set_domain_offline(domain);
114 break;
115 }
116 }
117 }
118
119 /****************************************************************
120 Actually cause a reconnect from a message.
121 ****************************************************************/
122
123 static void msg_try_to_go_online(struct messaging_context *msg,
/* [<][>][^][v][top][bottom][index][help] */
124 void *private_data,
125 uint32_t msg_type,
126 struct server_id server_id,
127 DATA_BLOB *data)
128 {
129 struct winbindd_domain *domain;
130 const char *domainname = (const char *)data->data;
131
132 if (data->data == NULL || data->length == 0) {
133 return;
134 }
135
136 DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
137
138 for (domain = domain_list(); domain; domain = domain->next) {
139 if (domain->internal) {
140 continue;
141 }
142
143 if (strequal(domain->name, domainname)) {
144
145 if (domain->online) {
146 /* We're already online, ignore. */
147 DEBUG(5,("msg_try_to_go_online: domain %s "
148 "already online.\n", domainname));
149 continue;
150 }
151
152 /* This call takes care of setting the online
153 flag to true if we connected, or re-adding
154 the offline handler if false. Bypasses online
155 check so always does network calls. */
156
157 init_dc_connection_network(domain);
158 break;
159 }
160 }
161 }
162
163 /****************************************************************
164 Fork a child to try and contact a DC. Do this as contacting a
165 DC requires blocking lookups and we don't want to block our
166 parent.
167 ****************************************************************/
168
169 static bool fork_child_dc_connect(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
170 {
171 struct dc_name_ip *dcs = NULL;
172 int num_dcs = 0;
173 TALLOC_CTX *mem_ctx = NULL;
174 pid_t parent_pid = sys_getpid();
175 char *lfile = NULL;
176
177 /* Stop zombies */
178 CatchChild();
179
180 if (domain->dc_probe_pid != (pid_t)-1) {
181 /*
182 * We might already have a DC probe
183 * child working, check.
184 */
185 if (process_exists_by_pid(domain->dc_probe_pid)) {
186 DEBUG(10,("fork_child_dc_connect: pid %u already "
187 "checking for DC's.\n",
188 (unsigned int)domain->dc_probe_pid));
189 return true;
190 }
191 domain->dc_probe_pid = (pid_t)-1;
192 }
193
194 domain->dc_probe_pid = sys_fork();
195
196 if (domain->dc_probe_pid == (pid_t)-1) {
197 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
198 return False;
199 }
200
201 if (domain->dc_probe_pid != (pid_t)0) {
202 /* Parent */
203 messaging_register(winbind_messaging_context(), NULL,
204 MSG_WINBIND_TRY_TO_GO_ONLINE,
205 msg_try_to_go_online);
206 messaging_register(winbind_messaging_context(), NULL,
207 MSG_WINBIND_FAILED_TO_GO_ONLINE,
208 msg_failed_to_go_online);
209 return True;
210 }
211
212 /* Child. */
213
214 /* Leave messages blocked - we will never process one. */
215
216 if (!override_logfile) {
217 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
218 DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
219 _exit(1);
220 }
221 }
222
223 if (!winbindd_reinit_after_fork(lfile)) {
224 messaging_send_buf(winbind_messaging_context(),
225 pid_to_procid(parent_pid),
226 MSG_WINBIND_FAILED_TO_GO_ONLINE,
227 (uint8 *)domain->name,
228 strlen(domain->name)+1);
229 _exit(1);
230 }
231 SAFE_FREE(lfile);
232
233 mem_ctx = talloc_init("fork_child_dc_connect");
234 if (!mem_ctx) {
235 DEBUG(0,("talloc_init failed.\n"));
236 messaging_send_buf(winbind_messaging_context(),
237 pid_to_procid(parent_pid),
238 MSG_WINBIND_FAILED_TO_GO_ONLINE,
239 (uint8 *)domain->name,
240 strlen(domain->name)+1);
241 _exit(1);
242 }
243
244 if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
245 /* Still offline ? Can't find DC's. */
246 messaging_send_buf(winbind_messaging_context(),
247 pid_to_procid(parent_pid),
248 MSG_WINBIND_FAILED_TO_GO_ONLINE,
249 (uint8 *)domain->name,
250 strlen(domain->name)+1);
251 _exit(0);
252 }
253
254 /* We got a DC. Send a message to our parent to get it to
255 try and do the same. */
256
257 messaging_send_buf(winbind_messaging_context(),
258 pid_to_procid(parent_pid),
259 MSG_WINBIND_TRY_TO_GO_ONLINE,
260 (uint8 *)domain->name,
261 strlen(domain->name)+1);
262 _exit(0);
263 }
264
265 /****************************************************************
266 Handler triggered if we're offline to try and detect a DC.
267 ****************************************************************/
268
269 static void check_domain_online_handler(struct event_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
270 struct timed_event *te,
271 struct timeval now,
272 void *private_data)
273 {
274 struct winbindd_domain *domain =
275 (struct winbindd_domain *)private_data;
276
277 DEBUG(10,("check_domain_online_handler: called for domain "
278 "%s (online = %s)\n", domain->name,
279 domain->online ? "True" : "False" ));
280
281 TALLOC_FREE(domain->check_online_event);
282
283 /* Are we still in "startup" mode ? */
284
285 if (domain->startup && (now.tv_sec > domain->startup_time + 30)) {
286 /* No longer in "startup" mode. */
287 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
288 domain->name ));
289 domain->startup = False;
290 }
291
292 /* We've been told to stay offline, so stay
293 that way. */
294
295 if (get_global_winbindd_state_offline()) {
296 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
297 domain->name ));
298 return;
299 }
300
301 /* Fork a child to test if it can contact a DC.
302 If it can then send ourselves a message to
303 cause a reconnect. */
304
305 fork_child_dc_connect(domain);
306 }
307
308 /****************************************************************
309 If we're still offline setup the timeout check.
310 ****************************************************************/
311
312 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
313 {
314 int wbr = lp_winbind_reconnect_delay();
315
316 if (domain->startup) {
317 domain->check_online_timeout = 10;
318 } else if (domain->check_online_timeout < wbr) {
319 domain->check_online_timeout = wbr;
320 }
321 }
322
323 /****************************************************************
324 Set domain offline and also add handler to put us back online
325 if we detect a DC.
326 ****************************************************************/
327
328 void set_domain_offline(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
329 {
330 DEBUG(10,("set_domain_offline: called for domain %s\n",
331 domain->name ));
332
333 TALLOC_FREE(domain->check_online_event);
334
335 if (domain->internal) {
336 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
337 domain->name ));
338 return;
339 }
340
341 domain->online = False;
342
343 /* Offline domains are always initialized. They're
344 re-initialized when they go back online. */
345
346 domain->initialized = True;
347
348 /* We only add the timeout handler that checks and
349 allows us to go back online when we've not
350 been told to remain offline. */
351
352 if (get_global_winbindd_state_offline()) {
353 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
354 domain->name ));
355 return;
356 }
357
358 /* If we're in statup mode, check again in 10 seconds, not in
359 lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
360
361 calc_new_online_timeout_check(domain);
362
363 domain->check_online_event = event_add_timed(winbind_event_context(),
364 NULL,
365 timeval_current_ofs(domain->check_online_timeout,0),
366 check_domain_online_handler,
367 domain);
368
369 /* The above *has* to succeed for winbindd to work. */
370 if (!domain->check_online_event) {
371 smb_panic("set_domain_offline: failed to add online handler");
372 }
373
374 DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
375 domain->name ));
376
377 /* Send an offline message to the idmap child when our
378 primary domain goes offline */
379
380 if ( domain->primary ) {
381 struct winbindd_child *idmap = idmap_child();
382
383 if ( idmap->pid != 0 ) {
384 messaging_send_buf(winbind_messaging_context(),
385 pid_to_procid(idmap->pid),
386 MSG_WINBIND_OFFLINE,
387 (uint8 *)domain->name,
388 strlen(domain->name)+1);
389 }
390 }
391
392 return;
393 }
394
395 /****************************************************************
396 Set domain online - if allowed.
397 ****************************************************************/
398
399 static void set_domain_online(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
400 {
401 DEBUG(10,("set_domain_online: called for domain %s\n",
402 domain->name ));
403
404 if (domain->internal) {
405 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
406 domain->name ));
407 return;
408 }
409
410 if (get_global_winbindd_state_offline()) {
411 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
412 domain->name ));
413 return;
414 }
415
416 winbindd_set_locator_kdc_envs(domain);
417
418 /* If we are waiting to get a krb5 ticket, trigger immediately. */
419 ccache_regain_all_now();
420
421 /* Ok, we're out of any startup mode now... */
422 domain->startup = False;
423
424 if (domain->online == False) {
425 /* We were offline - now we're online. We default to
426 using the MS-RPC backend if we started offline,
427 and if we're going online for the first time we
428 should really re-initialize the backends and the
429 checks to see if we're talking to an AD or NT domain.
430 */
431
432 domain->initialized = False;
433
434 /* 'reconnect_methods' is the MS-RPC backend. */
435 if (domain->backend == &reconnect_methods) {
436 domain->backend = NULL;
437 }
438 }
439
440 /* Ensure we have no online timeout checks. */
441 domain->check_online_timeout = 0;
442 TALLOC_FREE(domain->check_online_event);
443
444 /* Ensure we ignore any pending child messages. */
445 messaging_deregister(winbind_messaging_context(),
446 MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
447 messaging_deregister(winbind_messaging_context(),
448 MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
449
450 domain->online = True;
451
452 /* Send an online message to the idmap child when our
453 primary domain comes online */
454
455 if ( domain->primary ) {
456 struct winbindd_child *idmap = idmap_child();
457
458 if ( idmap->pid != 0 ) {
459 messaging_send_buf(winbind_messaging_context(),
460 pid_to_procid(idmap->pid),
461 MSG_WINBIND_ONLINE,
462 (uint8 *)domain->name,
463 strlen(domain->name)+1);
464 }
465 }
466
467 return;
468 }
469
470 /****************************************************************
471 Requested to set a domain online.
472 ****************************************************************/
473
474 void set_domain_online_request(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
475 {
476 struct timeval tev;
477
478 DEBUG(10,("set_domain_online_request: called for domain %s\n",
479 domain->name ));
480
481 if (get_global_winbindd_state_offline()) {
482 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
483 domain->name ));
484 return;
485 }
486
487 /* We've been told it's safe to go online and
488 try and connect to a DC. But I don't believe it
489 because network manager seems to lie.
490 Wait at least 5 seconds. Heuristics suck... */
491
492
493 GetTimeOfDay(&tev);
494
495 /* Go into "startup" mode again. */
496 domain->startup_time = tev.tv_sec;
497 domain->startup = True;
498
499 tev.tv_sec += 5;
500
501 if (!domain->check_online_event) {
502 /* If we've come from being globally offline we
503 don't have a check online event handler set.
504 We need to add one now we're trying to go
505 back online. */
506
507 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
508 domain->name ));
509 }
510
511 TALLOC_FREE(domain->check_online_event);
512
513 domain->check_online_event = event_add_timed(winbind_event_context(),
514 NULL,
515 tev,
516 check_domain_online_handler,
517 domain);
518
519 /* The above *has* to succeed for winbindd to work. */
520 if (!domain->check_online_event) {
521 smb_panic("set_domain_online_request: failed to add online handler");
522 }
523 }
524
525 /****************************************************************
526 Add -ve connection cache entries for domain and realm.
527 ****************************************************************/
528
529 void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
530 const char *server,
531 NTSTATUS result)
532 {
533 add_failed_connection_entry(domain->name, server, result);
534 /* If this was the saf name for the last thing we talked to,
535 remove it. */
536 saf_delete(domain->name);
537 if (*domain->alt_name) {
538 add_failed_connection_entry(domain->alt_name, server, result);
539 saf_delete(domain->alt_name);
540 }
541 winbindd_unset_locator_kdc_env(domain);
542 }
543
544 /* Choose between anonymous or authenticated connections. We need to use
545 an authenticated connection if DCs have the RestrictAnonymous registry
546 entry set > 0, or the "Additional restrictions for anonymous
547 connections" set in the win2k Local Security Policy.
548
549 Caller to free() result in domain, username, password
550 */
551
552 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
/* [<][>][^][v][top][bottom][index][help] */
553 {
554 *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
555 *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
556 *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
557
558 if (*username && **username) {
559
560 if (!*domain || !**domain)
561 *domain = smb_xstrdup(lp_workgroup());
562
563 if (!*password || !**password)
564 *password = smb_xstrdup("");
565
566 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
567 *domain, *username));
568
569 } else {
570 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
571 *username = smb_xstrdup("");
572 *domain = smb_xstrdup("");
573 *password = smb_xstrdup("");
574 }
575 }
576
577 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
578 fstring dcname,
579 struct sockaddr_storage *dc_ss)
580 {
581 struct winbindd_domain *our_domain = NULL;
582 struct rpc_pipe_client *netlogon_pipe = NULL;
583 NTSTATUS result;
584 WERROR werr;
585 TALLOC_CTX *mem_ctx;
586 unsigned int orig_timeout;
587 const char *tmp = NULL;
588 const char *p;
589
590 /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
591 * moment.... */
592
593 if (IS_DC) {
594 return False;
595 }
596
597 if (domain->primary) {
598 return False;
599 }
600
601 our_domain = find_our_domain();
602
603 if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
604 return False;
605 }
606
607 result = cm_connect_netlogon(our_domain, &netlogon_pipe);
608 if (!NT_STATUS_IS_OK(result)) {
609 talloc_destroy(mem_ctx);
610 return False;
611 }
612
613 /* This call can take a long time - allow the server to time out.
614 35 seconds should do it. */
615
616 orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
617
618 if (our_domain->active_directory) {
619 struct netr_DsRGetDCNameInfo *domain_info = NULL;
620
621 result = rpccli_netr_DsRGetDCName(netlogon_pipe,
622 mem_ctx,
623 our_domain->dcname,
624 domain->name,
625 NULL,
626 NULL,
627 DS_RETURN_DNS_NAME,
628 &domain_info,
629 &werr);
630 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
631 tmp = talloc_strdup(
632 mem_ctx, domain_info->dc_unc);
633 if (tmp == NULL) {
634 DEBUG(0, ("talloc_strdup failed\n"));
635 talloc_destroy(mem_ctx);
636 return false;
637 }
638 if (strlen(domain->alt_name) == 0) {
639 fstrcpy(domain->alt_name,
640 domain_info->domain_name);
641 }
642 if (strlen(domain->forest_name) == 0) {
643 fstrcpy(domain->forest_name,
644 domain_info->forest_name);
645 }
646 }
647 } else {
648 result = rpccli_netr_GetAnyDCName(netlogon_pipe, mem_ctx,
649 our_domain->dcname,
650 domain->name,
651 &tmp,
652 &werr);
653 }
654
655 /* And restore our original timeout. */
656 rpccli_set_timeout(netlogon_pipe, orig_timeout);
657
658 if (!NT_STATUS_IS_OK(result)) {
659 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
660 nt_errstr(result)));
661 talloc_destroy(mem_ctx);
662 return false;
663 }
664
665 if (!W_ERROR_IS_OK(werr)) {
666 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
667 win_errstr(werr)));
668 talloc_destroy(mem_ctx);
669 return false;
670 }
671
672 /* rpccli_netr_GetAnyDCName gives us a name with \\ */
673 p = strip_hostname(tmp);
674
675 fstrcpy(dcname, p);
676
677 talloc_destroy(mem_ctx);
678
679 DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname));
680
681 if (!resolve_name(dcname, dc_ss, 0x20)) {
682 return False;
683 }
684
685 return True;
686 }
687
688 /**
689 * Helper function to assemble trust password and account name
690 */
691 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
692 char **machine_password,
693 char **machine_account,
694 char **machine_krb5_principal)
695 {
696 const char *account_name;
697 const char *name = NULL;
698
699 /* If we are a DC and this is not our own domain */
700
701 if (IS_DC) {
702 name = domain->name;
703 } else {
704 struct winbindd_domain *our_domain = find_our_domain();
705
706 if (!our_domain)
707 return NT_STATUS_INVALID_SERVER_STATE;
708
709 name = our_domain->name;
710 }
711
712 if (!get_trust_pw_clear(name, machine_password,
713 &account_name, NULL))
714 {
715 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
716 }
717
718 if ((machine_account != NULL) &&
719 (asprintf(machine_account, "%s$", account_name) == -1))
720 {
721 return NT_STATUS_NO_MEMORY;
722 }
723
724 /* For now assume our machine account only exists in our domain */
725
726 if (machine_krb5_principal != NULL)
727 {
728 struct winbindd_domain *our_domain = find_our_domain();
729
730 if (!our_domain) {
731 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
732 }
733
734 if (asprintf(machine_krb5_principal, "%s$@%s",
735 account_name, our_domain->alt_name) == -1)
736 {
737 return NT_STATUS_NO_MEMORY;
738 }
739
740 strupper_m(*machine_krb5_principal);
741 }
742
743 return NT_STATUS_OK;
744 }
745
746 /************************************************************************
747 Given a fd with a just-connected TCP connection to a DC, open a connection
748 to the pipe.
749 ************************************************************************/
750
751 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
752 const int sockfd,
753 const char *controller,
754 struct cli_state **cli,
755 bool *retry)
756 {
757 char *machine_password = NULL;
758 char *machine_krb5_principal = NULL;
759 char *machine_account = NULL;
760 char *ipc_username = NULL;
761 char *ipc_domain = NULL;
762 char *ipc_password = NULL;
763
764 struct named_mutex *mutex;
765
766 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
767
768 struct sockaddr peeraddr;
769 socklen_t peeraddr_len;
770
771 struct sockaddr_in *peeraddr_in = (struct sockaddr_in *)&peeraddr;
772
773 DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
774 controller, domain->name ));
775
776 *retry = True;
777
778 mutex = grab_named_mutex(talloc_tos(), controller,
779 WINBIND_SERVER_MUTEX_WAIT_TIME);
780 if (mutex == NULL) {
781 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
782 controller));
783 result = NT_STATUS_POSSIBLE_DEADLOCK;
784 goto done;
785 }
786
787 if ((*cli = cli_initialise()) == NULL) {
788 DEBUG(1, ("Could not cli_initialize\n"));
789 result = NT_STATUS_NO_MEMORY;
790 goto done;
791 }
792
793 (*cli)->timeout = 10000; /* 10 seconds */
794 (*cli)->fd = sockfd;
795 fstrcpy((*cli)->desthost, controller);
796 (*cli)->use_kerberos = True;
797
798 peeraddr_len = sizeof(peeraddr);
799
800 if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0) ||
801 (peeraddr_len != sizeof(struct sockaddr_in)) ||
802 (peeraddr_in->sin_family != PF_INET))
803 {
804 DEBUG(0,("cm_prepare_connection: %s\n", strerror(errno)));
805 result = NT_STATUS_UNSUCCESSFUL;
806 goto done;
807 }
808
809 if (ntohs(peeraddr_in->sin_port) == 139) {
810 struct nmb_name calling;
811 struct nmb_name called;
812
813 make_nmb_name(&calling, global_myname(), 0x0);
814 make_nmb_name(&called, "*SMBSERVER", 0x20);
815
816 if (!cli_session_request(*cli, &calling, &called)) {
817 DEBUG(8, ("cli_session_request failed for %s\n",
818 controller));
819 result = NT_STATUS_UNSUCCESSFUL;
820 goto done;
821 }
822 }
823
824 result = cli_negprot(*cli);
825
826 if (!NT_STATUS_IS_OK(result)) {
827 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
828 goto done;
829 }
830
831 if (!is_dc_trusted_domain_situation(domain->name) &&
832 (*cli)->protocol >= PROTOCOL_NT1 &&
833 (*cli)->capabilities & CAP_EXTENDED_SECURITY)
834 {
835 ADS_STATUS ads_status;
836
837 result = get_trust_creds(domain, &machine_password,
838 &machine_account,
839 &machine_krb5_principal);
840 if (!NT_STATUS_IS_OK(result)) {
841 goto anon_fallback;
842 }
843
844 if (lp_security() == SEC_ADS) {
845
846 /* Try a krb5 session */
847
848 (*cli)->use_kerberos = True;
849 DEBUG(5, ("connecting to %s from %s with kerberos principal "
850 "[%s] and realm [%s]\n", controller, global_myname(),
851 machine_krb5_principal, domain->alt_name));
852
853 winbindd_set_locator_kdc_envs(domain);
854
855 ads_status = cli_session_setup_spnego(*cli,
856 machine_krb5_principal,
857 machine_password,
858 lp_workgroup(),
859 domain->alt_name);
860
861 if (!ADS_ERR_OK(ads_status)) {
862 DEBUG(4,("failed kerberos session setup with %s\n",
863 ads_errstr(ads_status)));
864 }
865
866 result = ads_ntstatus(ads_status);
867 if (NT_STATUS_IS_OK(result)) {
868 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
869 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
870 if (!NT_STATUS_IS_OK(result)) {
871 goto done;
872 }
873 goto session_setup_done;
874 }
875 }
876
877 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
878 (*cli)->use_kerberos = False;
879
880 DEBUG(5, ("connecting to %s from %s with username "
881 "[%s]\\[%s]\n", controller, global_myname(),
882 lp_workgroup(), machine_account));
883
884 ads_status = cli_session_setup_spnego(*cli,
885 machine_account,
886 machine_password,
887 lp_workgroup(),
888 NULL);
889 if (!ADS_ERR_OK(ads_status)) {
890 DEBUG(4, ("authenticated session setup failed with %s\n",
891 ads_errstr(ads_status)));
892 }
893
894 result = ads_ntstatus(ads_status);
895 if (NT_STATUS_IS_OK(result)) {
896 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
897 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
898 if (!NT_STATUS_IS_OK(result)) {
899 goto done;
900 }
901 goto session_setup_done;
902 }
903 }
904
905 /* Fall back to non-kerberos session setup with auth_user */
906
907 (*cli)->use_kerberos = False;
908
909 cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
910
911 if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
912 (strlen(ipc_username) > 0)) {
913
914 /* Only try authenticated if we have a username */
915
916 DEBUG(5, ("connecting to %s from %s with username "
917 "[%s]\\[%s]\n", controller, global_myname(),
918 ipc_domain, ipc_username));
919
920 if (NT_STATUS_IS_OK(cli_session_setup(
921 *cli, ipc_username,
922 ipc_password, strlen(ipc_password)+1,
923 ipc_password, strlen(ipc_password)+1,
924 ipc_domain))) {
925 /* Successful logon with given username. */
926 result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
927 if (!NT_STATUS_IS_OK(result)) {
928 goto done;
929 }
930 goto session_setup_done;
931 } else {
932 DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
933 ipc_domain, ipc_username ));
934 }
935 }
936
937 anon_fallback:
938
939 /* Fall back to anonymous connection, this might fail later */
940 DEBUG(10,("cm_prepare_connection: falling back to anonymous "
941 "connection for DC %s\n",
942 controller ));
943
944 if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
945 NULL, 0, ""))) {
946 DEBUG(5, ("Connected anonymously\n"));
947 result = cli_init_creds(*cli, "", "", "");
948 if (!NT_STATUS_IS_OK(result)) {
949 goto done;
950 }
951 goto session_setup_done;
952 }
953
954 result = cli_nt_error(*cli);
955
956 if (NT_STATUS_IS_OK(result))
957 result = NT_STATUS_UNSUCCESSFUL;
958
959 /* We can't session setup */
960
961 goto done;
962
963 session_setup_done:
964
965 /* cache the server name for later connections */
966
967 saf_store( domain->name, (*cli)->desthost );
968 if (domain->alt_name && (*cli)->use_kerberos) {
969 saf_store( domain->alt_name, (*cli)->desthost );
970 }
971
972 winbindd_set_locator_kdc_envs(domain);
973
974 result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
975
976 if (!NT_STATUS_IS_OK(result)) {
977 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
978 goto done;
979 }
980
981 TALLOC_FREE(mutex);
982 *retry = False;
983
984 /* set the domain if empty; needed for schannel connections */
985 if ( !(*cli)->domain[0] ) {
986 result = cli_set_domain((*cli), domain->name);
987 if (!NT_STATUS_IS_OK(result)) {
988 return result;
989 }
990 }
991
992 result = NT_STATUS_OK;
993
994 done:
995 TALLOC_FREE(mutex);
996 SAFE_FREE(machine_account);
997 SAFE_FREE(machine_password);
998 SAFE_FREE(machine_krb5_principal);
999 SAFE_FREE(ipc_username);
1000 SAFE_FREE(ipc_domain);
1001 SAFE_FREE(ipc_password);
1002
1003 if (!NT_STATUS_IS_OK(result)) {
1004 winbind_add_failed_connection_entry(domain, controller, result);
1005 if ((*cli) != NULL) {
1006 cli_shutdown(*cli);
1007 *cli = NULL;
1008 }
1009 }
1010
1011 return result;
1012 }
1013
1014 /*******************************************************************
1015 Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1016 array.
1017
1018 Keeps the list unique by not adding duplicate entries.
1019
1020 @param[in] mem_ctx talloc memory context to allocate from
1021 @param[in] domain_name domain of the DC
1022 @param[in] dcname name of the DC to add to the list
1023 @param[in] pss Internet address and port pair to add to the list
1024 @param[in,out] dcs array of dc_name_ip structures to add to
1025 @param[in,out] num_dcs number of dcs returned in the dcs array
1026 @return true if the list was added to, false otherwise
1027 *******************************************************************/
1028
1029 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
/* [<][>][^][v][top][bottom][index][help] */
1030 const char *dcname, struct sockaddr_storage *pss,
1031 struct dc_name_ip **dcs, int *num)
1032 {
1033 int i = 0;
1034
1035 if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1036 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1037 return False;
1038 }
1039
1040 /* Make sure there's no duplicates in the list */
1041 for (i=0; i<*num; i++)
1042 if (sockaddr_equal((struct sockaddr *)&(*dcs)[i].ss, (struct sockaddr *)pss))
1043 return False;
1044
1045 *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1046
1047 if (*dcs == NULL)
1048 return False;
1049
1050 fstrcpy((*dcs)[*num].name, dcname);
1051 (*dcs)[*num].ss = *pss;
1052 *num += 1;
1053 return True;
1054 }
1055
1056 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
1057 struct sockaddr_storage *pss, uint16 port,
1058 struct sockaddr_storage **addrs, int *num)
1059 {
1060 *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1061
1062 if (*addrs == NULL) {
1063 *num = 0;
1064 return False;
1065 }
1066
1067 (*addrs)[*num] = *pss;
1068 set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1069
1070 *num += 1;
1071 return True;
1072 }
1073
1074 /*******************************************************************
1075 convert an ip to a name
1076 *******************************************************************/
1077
1078 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
1079 const struct winbindd_domain *domain,
1080 struct sockaddr_storage *pss,
1081 fstring name )
1082 {
1083 struct ip_service ip_list;
1084 uint32_t nt_version = NETLOGON_NT_VERSION_1;
1085
1086 ip_list.ss = *pss;
1087 ip_list.port = 0;
1088
1089 #ifdef WITH_ADS
1090 /* For active directory servers, try to get the ldap server name.
1091 None of these failures should be considered critical for now */
1092
1093 if (lp_security() == SEC_ADS) {
1094 ADS_STRUCT *ads;
1095 ADS_STATUS ads_status;
1096 char addr[INET6_ADDRSTRLEN];
1097
1098 print_sockaddr(addr, sizeof(addr), pss);
1099
1100 ads = ads_init(domain->alt_name, domain->name, addr);
1101 ads->auth.flags |= ADS_AUTH_NO_BIND;
1102
1103 ads_status = ads_connect(ads);
1104 if (ADS_ERR_OK(ads_status)) {
1105 /* We got a cldap packet. */
1106 fstrcpy(name, ads->config.ldap_server_name);
1107 namecache_store(name, 0x20, 1, &ip_list);
1108
1109 DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1110
1111 if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1112 if (ads_closest_dc(ads)) {
1113 char *sitename = sitename_fetch(ads->config.realm);
1114
1115 /* We're going to use this KDC for this realm/domain.
1116 If we are using sites, then force the krb5 libs
1117 to use this KDC. */
1118
1119 create_local_private_krb5_conf_for_domain(domain->alt_name,
1120 domain->name,
1121 sitename,
1122 pss);
1123
1124 SAFE_FREE(sitename);
1125 } else {
1126 /* use an off site KDC */
1127 create_local_private_krb5_conf_for_domain(domain->alt_name,
1128 domain->name,
1129 NULL,
1130 pss);
1131 }
1132 winbindd_set_locator_kdc_envs(domain);
1133
1134 /* Ensure we contact this DC also. */
1135 saf_store( domain->name, name);
1136 saf_store( domain->alt_name, name);
1137 }
1138
1139 ads_destroy( &ads );
1140 return True;
1141 }
1142
1143 ads_destroy( &ads );
1144 }
1145 #endif
1146
1147 /* try GETDC requests next */
1148
1149 if (send_getdc_request(mem_ctx, winbind_messaging_context(),
1150 pss, domain->name, &domain->sid,
1151 nt_version)) {
1152 const char *dc_name = NULL;
1153 int i;
1154 smb_msleep(100);
1155 for (i=0; i<5; i++) {
1156 if (receive_getdc_response(mem_ctx, pss, domain->name,
1157 &nt_version,
1158 &dc_name, NULL)) {
1159 fstrcpy(name, dc_name);
1160 namecache_store(name, 0x20, 1, &ip_list);
1161 return True;
1162 }
1163 smb_msleep(500);
1164 }
1165 }
1166
1167 /* try node status request */
1168
1169 if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1170 namecache_store(name, 0x20, 1, &ip_list);
1171 return True;
1172 }
1173 return False;
1174 }
1175
1176 /*******************************************************************
1177 Retrieve a list of IP addresses for domain controllers.
1178
1179 The array is sorted in the preferred connection order.
1180
1181 @param[in] mem_ctx talloc memory context to allocate from
1182 @param[in] domain domain to retrieve DCs for
1183 @param[out] dcs array of dcs that will be returned
1184 @param[out] num_dcs number of dcs returned in the dcs array
1185 @return always true
1186 *******************************************************************/
1187
1188 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
1189 struct dc_name_ip **dcs, int *num_dcs)
1190 {
1191 fstring dcname;
1192 struct sockaddr_storage ss;
1193 struct ip_service *ip_list = NULL;
1194 int iplist_size = 0;
1195 int i;
1196 bool is_our_domain;
1197 enum security_types sec = (enum security_types)lp_security();
1198
1199 is_our_domain = strequal(domain->name, lp_workgroup());
1200
1201 /* If not our domain, get the preferred DC, by asking our primary DC */
1202 if ( !is_our_domain
1203 && get_dc_name_via_netlogon(domain, dcname, &ss)
1204 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1205 num_dcs) )
1206 {
1207 char addr[INET6_ADDRSTRLEN];
1208 print_sockaddr(addr, sizeof(addr), &ss);
1209 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1210 dcname, addr));
1211 return True;
1212 }
1213
1214 if (sec == SEC_ADS) {
1215 char *sitename = NULL;
1216
1217 /* We need to make sure we know the local site before
1218 doing any DNS queries, as this will restrict the
1219 get_sorted_dc_list() call below to only fetching
1220 DNS records for the correct site. */
1221
1222 /* Find any DC to get the site record.
1223 We deliberately don't care about the
1224 return here. */
1225
1226 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1227
1228 sitename = sitename_fetch(domain->alt_name);
1229 if (sitename) {
1230
1231 /* Do the site-specific AD dns lookup first. */
1232 get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1233 &iplist_size, True);
1234
1235 /* Add ips to the DC array. We don't look up the name
1236 of the DC in this function, but we fill in the char*
1237 of the ip now to make the failed connection cache
1238 work */
1239 for ( i=0; i<iplist_size; i++ ) {
1240 char addr[INET6_ADDRSTRLEN];
1241 print_sockaddr(addr, sizeof(addr),
1242 &ip_list[i].ss);
1243 add_one_dc_unique(mem_ctx,
1244 domain->name,
1245 addr,
1246 &ip_list[i].ss,
1247 dcs,
1248 num_dcs);
1249 }
1250
1251 SAFE_FREE(ip_list);
1252 SAFE_FREE(sitename);
1253 iplist_size = 0;
1254 }
1255
1256 /* Now we add DCs from the main AD DNS lookup. */
1257 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1258 &iplist_size, True);
1259
1260 for ( i=0; i<iplist_size; i++ ) {
1261 char addr[INET6_ADDRSTRLEN];
1262 print_sockaddr(addr, sizeof(addr),
1263 &ip_list[i].ss);
1264 add_one_dc_unique(mem_ctx,
1265 domain->name,
1266 addr,
1267 &ip_list[i].ss,
1268 dcs,
1269 num_dcs);
1270 }
1271
1272 SAFE_FREE(ip_list);
1273 iplist_size = 0;
1274 }
1275
1276 /* Try standard netbios queries if no ADS */
1277 if (*num_dcs == 0) {
1278 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1279 False);
1280
1281 for ( i=0; i<iplist_size; i++ ) {
1282 char addr[INET6_ADDRSTRLEN];
1283 print_sockaddr(addr, sizeof(addr),
1284 &ip_list[i].ss);
1285 add_one_dc_unique(mem_ctx,
1286 domain->name,
1287 addr,
1288 &ip_list[i].ss,
1289 dcs,
1290 num_dcs);
1291 }
1292
1293 SAFE_FREE(ip_list);
1294 iplist_size = 0;
1295 }
1296
1297 return True;
1298 }
1299
1300 /*******************************************************************
1301 Find and make a connection to a DC in the given domain.
1302
1303 @param[in] mem_ctx talloc memory context to allocate from
1304 @param[in] domain domain to find a dc in
1305 @param[out] dcname NetBIOS or FQDN of DC that's connected to
1306 @param[out] pss DC Internet address and port
1307 @param[out] fd fd of the open socket connected to the newly found dc
1308 @return true when a DC connection is made, false otherwise
1309 *******************************************************************/
1310
1311 static bool find_new_dc(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
1312 struct winbindd_domain *domain,
1313 fstring dcname, struct sockaddr_storage *pss, int *fd)
1314 {
1315 struct dc_name_ip *dcs = NULL;
1316 int num_dcs = 0;
1317
1318 const char **dcnames = NULL;
1319 int num_dcnames = 0;
1320
1321 struct sockaddr_storage *addrs = NULL;
1322 int num_addrs = 0;
1323
1324 int i, fd_index;
1325
1326 *fd = -1;
1327
1328 again:
1329 if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1330 return False;
1331
1332 for (i=0; i<num_dcs; i++) {
1333
1334 if (!add_string_to_array(mem_ctx, dcs[i].name,
1335 &dcnames, &num_dcnames)) {
1336 return False;
1337 }
1338 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
1339 &addrs, &num_addrs)) {
1340 return False;
1341 }
1342
1343 if (!add_string_to_array(mem_ctx, dcs[i].name,
1344 &dcnames, &num_dcnames)) {
1345 return False;
1346 }
1347 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 139,
1348 &addrs, &num_addrs)) {
1349 return False;
1350 }
1351 }
1352
1353 if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1354 return False;
1355
1356 if ((addrs == NULL) || (dcnames == NULL))
1357 return False;
1358
1359 /* 5 second timeout. */
1360 if (!open_any_socket_out(addrs, num_addrs, 5000, &fd_index, fd) ) {
1361 for (i=0; i<num_dcs; i++) {
1362 char ab[INET6_ADDRSTRLEN];
1363 print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1364 DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1365 "domain %s address %s. Error was %s\n",
1366 domain->name, ab, strerror(errno) ));
1367 winbind_add_failed_connection_entry(domain,
1368 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1369 }
1370 return False;
1371 }
1372
1373 *pss = addrs[fd_index];
1374
1375 if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1376 /* Ok, we've got a name for the DC */
1377 fstrcpy(dcname, dcnames[fd_index]);
1378 return True;
1379 }
1380
1381 /* Try to figure out the name */
1382 if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1383 return True;
1384 }
1385
1386 /* We can not continue without the DC's name */
1387 winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1388 NT_STATUS_UNSUCCESSFUL);
1389
1390 /* Throw away all arrays as we're doing this again. */
1391 TALLOC_FREE(dcs);
1392 num_dcs = 0;
1393
1394 TALLOC_FREE(dcnames);
1395 num_dcnames = 0;
1396
1397 TALLOC_FREE(addrs);
1398 num_addrs = 0;
1399
1400 close(*fd);
1401 *fd = -1;
1402
1403 goto again;
1404 }
1405
1406 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
1407 struct winbindd_cm_conn *new_conn)
1408 {
1409 TALLOC_CTX *mem_ctx;
1410 NTSTATUS result;
1411 char *saf_servername = saf_fetch( domain->name );
1412 int retries;
1413
1414 if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1415 SAFE_FREE(saf_servername);
1416 set_domain_offline(domain);
1417 return NT_STATUS_NO_MEMORY;
1418 }
1419
1420 /* we have to check the server affinity cache here since
1421 later we selecte a DC based on response time and not preference */
1422
1423 /* Check the negative connection cache
1424 before talking to it. It going down may have
1425 triggered the reconnection. */
1426
1427 if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1428
1429 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1430 saf_servername, domain->name ));
1431
1432 /* convert an ip address to a name */
1433 if (is_ipaddress( saf_servername ) ) {
1434 fstring saf_name;
1435 struct sockaddr_storage ss;
1436
1437 if (!interpret_string_addr(&ss, saf_servername,
1438 AI_NUMERICHOST)) {
1439 return NT_STATUS_UNSUCCESSFUL;
1440 }
1441 if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1442 fstrcpy( domain->dcname, saf_name );
1443 } else {
1444 winbind_add_failed_connection_entry(
1445 domain, saf_servername,
1446 NT_STATUS_UNSUCCESSFUL);
1447 }
1448 } else {
1449 fstrcpy( domain->dcname, saf_servername );
1450 }
1451
1452 SAFE_FREE( saf_servername );
1453 }
1454
1455 for (retries = 0; retries < 3; retries++) {
1456 int fd = -1;
1457 bool retry = False;
1458
1459 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1460
1461 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1462 domain->dcname, domain->name ));
1463
1464 if (*domain->dcname
1465 && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1466 && (resolve_name(domain->dcname, &domain->dcaddr, 0x20)))
1467 {
1468 struct sockaddr_storage *addrs = NULL;
1469 int num_addrs = 0;
1470 int dummy = 0;
1471
1472 if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 445, &addrs, &num_addrs)) {
1473 set_domain_offline(domain);
1474 talloc_destroy(mem_ctx);
1475 return NT_STATUS_NO_MEMORY;
1476 }
1477 if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 139, &addrs, &num_addrs)) {
1478 set_domain_offline(domain);
1479 talloc_destroy(mem_ctx);
1480 return NT_STATUS_NO_MEMORY;
1481 }
1482
1483 /* 5 second timeout. */
1484 if (!open_any_socket_out(addrs, num_addrs, 5000, &dummy, &fd)) {
1485 fd = -1;
1486 }
1487 }
1488
1489 if ((fd == -1)
1490 && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1491 {
1492 /* This is the one place where we will
1493 set the global winbindd offline state
1494 to true, if a "WINBINDD_OFFLINE" entry
1495 is found in the winbindd cache. */
1496 set_global_winbindd_state_offline();
1497 break;
1498 }
1499
1500 new_conn->cli = NULL;
1501
1502 result = cm_prepare_connection(domain, fd, domain->dcname,
1503 &new_conn->cli, &retry);
1504
1505 if (!retry)
1506 break;
1507 }
1508
1509 if (NT_STATUS_IS_OK(result)) {
1510
1511 winbindd_set_locator_kdc_envs(domain);
1512
1513 if (domain->online == False) {
1514 /* We're changing state from offline to online. */
1515 set_global_winbindd_state_online();
1516 }
1517 set_domain_online(domain);
1518 } else {
1519 /* Ensure we setup the retry handler. */
1520 set_domain_offline(domain);
1521 }
1522
1523 talloc_destroy(mem_ctx);
1524 return result;
1525 }
1526
1527 /* Close down all open pipes on a connection. */
1528
1529 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
/* [<][>][^][v][top][bottom][index][help] */
1530 {
1531 /* We're closing down a possibly dead
1532 connection. Don't have impossibly long (10s) timeouts. */
1533
1534 if (conn->cli) {
1535 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1536 }
1537
1538 if (conn->samr_pipe != NULL) {
1539 TALLOC_FREE(conn->samr_pipe);
1540 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1541 if (conn->cli) {
1542 cli_set_timeout(conn->cli, 500);
1543 }
1544 }
1545
1546 if (conn->lsa_pipe != NULL) {
1547 TALLOC_FREE(conn->lsa_pipe);
1548 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1549 if (conn->cli) {
1550 cli_set_timeout(conn->cli, 500);
1551 }
1552 }
1553
1554 if (conn->lsa_pipe_tcp != NULL) {
1555 TALLOC_FREE(conn->lsa_pipe_tcp);
1556 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1557 if (conn->cli) {
1558 cli_set_timeout(conn->cli, 500);
1559 }
1560 }
1561
1562 if (conn->netlogon_pipe != NULL) {
1563 TALLOC_FREE(conn->netlogon_pipe);
1564 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1565 if (conn->cli) {
1566 cli_set_timeout(conn->cli, 500);
1567 }
1568 }
1569
1570 if (conn->cli) {
1571 cli_shutdown(conn->cli);
1572 }
1573
1574 conn->cli = NULL;
1575 }
1576
1577 void close_conns_after_fork(void)
/* [<][>][^][v][top][bottom][index][help] */
1578 {
1579 struct winbindd_domain *domain;
1580
1581 for (domain = domain_list(); domain; domain = domain->next) {
1582 if (domain->conn.cli == NULL)
1583 continue;
1584
1585 if (domain->conn.cli->fd == -1)
1586 continue;
1587
1588 close(domain->conn.cli->fd);
1589 domain->conn.cli->fd = -1;
1590 }
1591 }
1592
1593 static bool connection_ok(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
1594 {
1595 if (domain->conn.cli == NULL) {
1596 DEBUG(8, ("connection_ok: Connection to %s for domain %s has NULL "
1597 "cli!\n", domain->dcname, domain->name));
1598 return False;
1599 }
1600
1601 if (!domain->conn.cli->initialised) {
1602 DEBUG(3, ("connection_ok: Connection to %s for domain %s was never "
1603 "initialised!\n", domain->dcname, domain->name));
1604 return False;
1605 }
1606
1607 if (domain->conn.cli->fd == -1) {
1608 DEBUG(3, ("connection_ok: Connection to %s for domain %s has died or was "
1609 "never started (fd == -1)\n",
1610 domain->dcname, domain->name));
1611 return False;
1612 }
1613
1614 if (domain->online == False) {
1615 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1616 return False;
1617 }
1618
1619 return True;
1620 }
1621
1622 /* Initialize a new connection up to the RPC BIND.
1623 Bypass online status check so always does network calls. */
1624
1625 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
1626 {
1627 NTSTATUS result;
1628
1629 /* Internal connections never use the network. */
1630 if (domain->internal) {
1631 domain->initialized = True;
1632 return NT_STATUS_OK;
1633 }
1634
1635 if (connection_ok(domain)) {
1636 if (!domain->initialized) {
1637 set_dc_type_and_flags(domain);
1638 }
1639 return NT_STATUS_OK;
1640 }
1641
1642 invalidate_cm_connection(&domain->conn);
1643
1644 result = cm_open_connection(domain, &domain->conn);
1645
1646 if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1647 set_dc_type_and_flags(domain);
1648 }
1649
1650 return result;
1651 }
1652
1653 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
/* [<][>][^][v][top][bottom][index][help] */
1654 {
1655 if (domain->initialized && !domain->online) {
1656 /* We check for online status elsewhere. */
1657 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1658 }
1659
1660 return init_dc_connection_network(domain);
1661 }
1662
1663 /******************************************************************************
1664 Set the trust flags (direction and forest location) for a domain
1665 ******************************************************************************/
1666
1667 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
/* [<][>][^][v][top][bottom][index][help] */
1668 {
1669 struct winbindd_domain *our_domain;
1670 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1671 struct netr_DomainTrustList trusts;
1672 int i;
1673 uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1674 NETR_TRUST_FLAG_OUTBOUND |
1675 NETR_TRUST_FLAG_INBOUND);
1676 struct rpc_pipe_client *cli;
1677 TALLOC_CTX *mem_ctx = NULL;
1678
1679 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1680
1681 /* Our primary domain doesn't need to worry about trust flags.
1682 Force it to go through the network setup */
1683 if ( domain->primary ) {
1684 return False;
1685 }
1686
1687 our_domain = find_our_domain();
1688
1689 if ( !connection_ok(our_domain) ) {
1690 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1691 return False;
1692 }
1693
1694 /* This won't work unless our domain is AD */
1695
1696 if ( !our_domain->active_directory ) {
1697 return False;
1698 }
1699
1700 /* Use DsEnumerateDomainTrusts to get us the trust direction
1701 and type */
1702
1703 result = cm_connect_netlogon(our_domain, &cli);
1704
1705 if (!NT_STATUS_IS_OK(result)) {
1706 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1707 "a connection to %s for PIPE_NETLOGON (%s)\n",
1708 domain->name, nt_errstr(result)));
1709 return False;
1710 }
1711
1712 if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1713 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1714 return False;
1715 }
1716
1717 result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1718 cli->desthost,
1719 flags,
1720 &trusts,
1721 NULL);
1722 if (!NT_STATUS_IS_OK(result)) {
1723 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1724 "failed to query trusted domain list: %s\n",
1725 nt_errstr(result)));
1726 talloc_destroy(mem_ctx);
1727 return false;
1728 }
1729
1730 /* Now find the domain name and get the flags */
1731
1732 for ( i=0; i<trusts.count; i++ ) {
1733 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1734 domain->domain_flags = trusts.array[i].trust_flags;
1735 domain->domain_type = trusts.array[i].trust_type;
1736 domain->domain_trust_attribs = trusts.array[i].trust_attributes;
1737
1738 if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1739 domain->active_directory = True;
1740
1741 /* This flag is only set if the domain is *our*
1742 primary domain and the primary domain is in
1743 native mode */
1744
1745 domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1746
1747 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1748 "native mode.\n", domain->name,
1749 domain->native_mode ? "" : "NOT "));
1750
1751 DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1752 "running active directory.\n", domain->name,
1753 domain->active_directory ? "" : "NOT "));
1754
1755
1756 domain->initialized = True;
1757
1758 if ( !winbindd_can_contact_domain( domain) )
1759 domain->internal = True;
1760
1761 break;
1762 }
1763 }
1764
1765 talloc_destroy( mem_ctx );
1766
1767 return domain->initialized;
1768 }
1769
1770 /******************************************************************************
1771 We can 'sense' certain things about the DC by it's replies to certain
1772 questions.
1773
1774 This tells us if this particular remote server is Active Directory, and if it
1775 is native mode.
1776 ******************************************************************************/
1777
1778 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
/* [<][>][^][v][top][bottom][index][help] */
1779 {
1780 NTSTATUS result;
1781 WERROR werr;
1782 TALLOC_CTX *mem_ctx = NULL;
1783 struct rpc_pipe_client *cli = NULL;
1784 struct policy_handle pol;
1785 union dssetup_DsRoleInfo info;
1786 union lsa_PolicyInformation *lsa_info = NULL;
1787
1788 if (!connection_ok(domain)) {
1789 return;
1790 }
1791
1792 mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1793 domain->name);
1794 if (!mem_ctx) {
1795 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1796 return;
1797 }
1798
1799 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1800
1801 result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1802 &ndr_table_dssetup.syntax_id,
1803 &cli);
1804
1805 if (!NT_STATUS_IS_OK(result)) {
1806 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1807 "PI_DSSETUP on domain %s: (%s)\n",
1808 domain->name, nt_errstr(result)));
1809
1810 /* if this is just a non-AD domain we need to continue
1811 * identifying so that we can in the end return with
1812 * domain->initialized = True - gd */
1813
1814 goto no_dssetup;
1815 }
1816
1817 result = rpccli_dssetup_DsRoleGetPrimaryDomainInformation(cli, mem_ctx,
1818 DS_ROLE_BASIC_INFORMATION,
1819 &info,
1820 &werr);
1821 TALLOC_FREE(cli);
1822
1823 if (!NT_STATUS_IS_OK(result)) {
1824 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1825 "on domain %s failed: (%s)\n",
1826 domain->name, nt_errstr(result)));
1827
1828 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1829 * every opcode on the DSSETUP pipe, continue with
1830 * no_dssetup mode here as well to get domain->initialized
1831 * set - gd */
1832
1833 if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
1834 goto no_dssetup;
1835 }
1836
1837 TALLOC_FREE(mem_ctx);
1838 return;
1839 }
1840
1841 if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
1842 !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
1843 domain->native_mode = True;
1844 } else {
1845 domain->native_mode = False;
1846 }
1847
1848 no_dssetup:
1849 result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1850 &ndr_table_lsarpc.syntax_id, &cli);
1851
1852 if (!NT_STATUS_IS_OK(result)) {
1853 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1854 "PI_LSARPC on domain %s: (%s)\n",
1855 domain->name, nt_errstr(result)));
1856 TALLOC_FREE(cli);
1857 TALLOC_FREE(mem_ctx);
1858 return;
1859 }
1860
1861 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1862 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
1863
1864 if (NT_STATUS_IS_OK(result)) {
1865 /* This particular query is exactly what Win2k clients use
1866 to determine that the DC is active directory */
1867 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
1868 &pol,
1869 LSA_POLICY_INFO_DNS,
1870 &lsa_info);
1871 }
1872
1873 if (NT_STATUS_IS_OK(result)) {
1874 domain->active_directory = True;
1875
1876 if (lsa_info->dns.name.string) {
1877 fstrcpy(domain->name, lsa_info->dns.name.string);
1878 }
1879
1880 if (lsa_info->dns.dns_domain.string) {
1881 fstrcpy(domain->alt_name,
1882 lsa_info->dns.dns_domain.string);
1883 }
1884
1885 /* See if we can set some domain trust flags about
1886 ourself */
1887
1888 if (lsa_info->dns.dns_forest.string) {
1889 fstrcpy(domain->forest_name,
1890 lsa_info->dns.dns_forest.string);
1891
1892 if (strequal(domain->forest_name, domain->alt_name)) {
1893 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
1894 }
1895 }
1896
1897 if (lsa_info->dns.sid) {
1898 sid_copy(&domain->sid, lsa_info->dns.sid);
1899 }
1900 } else {
1901 domain->active_directory = False;
1902
1903 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
1904 SEC_FLAG_MAXIMUM_ALLOWED,
1905 &pol);
1906
1907 if (!NT_STATUS_IS_OK(result)) {
1908 goto done;
1909 }
1910
1911 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
1912 &pol,
1913 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1914 &lsa_info);
1915
1916 if (NT_STATUS_IS_OK(result)) {
1917
1918 if (lsa_info->account_domain.name.string) {
1919 fstrcpy(domain->name,
1920 lsa_info->account_domain.name.string);
1921 }
1922
1923 if (lsa_info->account_domain.sid) {
1924 sid_copy(&domain->sid, lsa_info->account_domain.sid);
1925 }
1926 }
1927 }
1928 done:
1929
1930 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1931 domain->name, domain->native_mode ? "" : "NOT "));
1932
1933 DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1934 domain->name, domain->active_directory ? "" : "NOT "));
1935
1936 domain->can_do_ncacn_ip_tcp = domain->active_directory;
1937
1938 TALLOC_FREE(cli);
1939
1940 TALLOC_FREE(mem_ctx);
1941
1942 domain->initialized = True;
1943 }
1944
1945 /**********************************************************************
1946 Set the domain_flags (trust attributes, domain operating modes, etc...
1947 ***********************************************************************/
1948
1949 static void set_dc_type_and_flags( struct winbindd_domain *domain )
/* [<][>][^][v][top][bottom][index][help] */
1950 {
1951 /* we always have to contact our primary domain */
1952
1953 if ( domain->primary ) {
1954 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1955 "primary domain\n"));
1956 set_dc_type_and_flags_connect( domain );
1957 return;
1958 }
1959
1960 /* Use our DC to get the information if possible */
1961
1962 if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
1963 /* Otherwise, fallback to contacting the
1964 domain directly */
1965 set_dc_type_and_flags_connect( domain );
1966 }
1967
1968 return;
1969 }
1970
1971
1972
1973 /**********************************************************************
1974 ***********************************************************************/
1975
1976 static bool cm_get_schannel_dcinfo(struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
1977 struct dcinfo **ppdc)
1978 {
1979 NTSTATUS result;
1980 struct rpc_pipe_client *netlogon_pipe;
1981
1982 if (lp_client_schannel() == False) {
1983 return False;
1984 }
1985
1986 result = cm_connect_netlogon(domain, &netlogon_pipe);
1987 if (!NT_STATUS_IS_OK(result)) {
1988 return False;
1989 }
1990
1991 /* Return a pointer to the struct dcinfo from the
1992 netlogon pipe. */
1993
1994 if (!domain->conn.netlogon_pipe->dc) {
1995 return false;
1996 }
1997
1998 *ppdc = domain->conn.netlogon_pipe->dc;
1999 return True;
2000 }
2001
2002 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
2003 struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2004 {
2005 struct winbindd_cm_conn *conn;
2006 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2007 struct dcinfo *p_dcinfo;
2008 char *machine_password = NULL;
2009 char *machine_account = NULL;
2010 char *domain_name = NULL;
2011
2012 result = init_dc_connection(domain);
2013 if (!NT_STATUS_IS_OK(result)) {
2014 return result;
2015 }
2016
2017 conn = &domain->conn;
2018
2019 if (conn->samr_pipe != NULL) {
2020 goto done;
2021 }
2022
2023
2024 /*
2025 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2026 * sign and sealed pipe using the machine account password by
2027 * preference. If we can't - try schannel, if that fails, try
2028 * anonymous.
2029 */
2030
2031 if ((conn->cli->user_name[0] == '\0') ||
2032 (conn->cli->domain[0] == '\0') ||
2033 (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2034 {
2035 result = get_trust_creds(domain, &machine_password,
2036 &machine_account, NULL);
2037 if (!NT_STATUS_IS_OK(result)) {
2038 DEBUG(10, ("cm_connect_sam: No no user available for "
2039 "domain %s, trying schannel\n", conn->cli->domain));
2040 goto schannel;
2041 }
2042 domain_name = domain->name;
2043 } else {
2044 machine_password = SMB_STRDUP(conn->cli->password);
2045 machine_account = SMB_STRDUP(conn->cli->user_name);
2046 domain_name = conn->cli->domain;
2047 }
2048
2049 if (!machine_password || !machine_account) {
2050 result = NT_STATUS_NO_MEMORY;
2051 goto done;
2052 }
2053
2054 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2055 authenticated SAMR pipe with sign & seal. */
2056 result = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
2057 &ndr_table_samr.syntax_id,
2058 NCACN_NP,
2059 PIPE_AUTH_LEVEL_PRIVACY,
2060 domain_name,
2061 machine_account,
2062 machine_password,
2063 &conn->samr_pipe);
2064
2065 if (!NT_STATUS_IS_OK(result)) {
2066 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2067 "pipe for domain %s using NTLMSSP "
2068 "authenticated pipe: user %s\\%s. Error was "
2069 "%s\n", domain->name, domain_name,
2070 machine_account, nt_errstr(result)));
2071 goto schannel;
2072 }
2073
2074 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2075 "domain %s using NTLMSSP authenticated "
2076 "pipe: user %s\\%s\n", domain->name,
2077 domain_name, machine_account));
2078
2079 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2080 conn->samr_pipe->desthost,
2081 SEC_FLAG_MAXIMUM_ALLOWED,
2082 &conn->sam_connect_handle);
2083 if (NT_STATUS_IS_OK(result)) {
2084 goto open_domain;
2085 }
2086 DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2087 "failed for domain %s, error was %s. Trying schannel\n",
2088 domain->name, nt_errstr(result) ));
2089 TALLOC_FREE(conn->samr_pipe);
2090
2091 schannel:
2092
2093 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2094
2095 if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2096 /* If this call fails - conn->cli can now be NULL ! */
2097 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2098 "for domain %s, trying anon\n", domain->name));
2099 goto anonymous;
2100 }
2101 result = cli_rpc_pipe_open_schannel_with_key
2102 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2103 PIPE_AUTH_LEVEL_PRIVACY,
2104 domain->name, p_dcinfo, &conn->samr_pipe);
2105
2106 if (!NT_STATUS_IS_OK(result)) {
2107 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2108 "domain %s using schannel. Error was %s\n",
2109 domain->name, nt_errstr(result) ));
2110 goto anonymous;
2111 }
2112 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2113 "schannel.\n", domain->name ));
2114
2115 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2116 conn->samr_pipe->desthost,
2117 SEC_FLAG_MAXIMUM_ALLOWED,
2118 &conn->sam_connect_handle);
2119 if (NT_STATUS_IS_OK(result)) {
2120 goto open_domain;
2121 }
2122 DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2123 "for domain %s, error was %s. Trying anonymous\n",
2124 domain->name, nt_errstr(result) ));
2125 TALLOC_FREE(conn->samr_pipe);
2126
2127 anonymous:
2128
2129 /* Finally fall back to anonymous. */
2130 result = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2131 &conn->samr_pipe);
2132
2133 if (!NT_STATUS_IS_OK(result)) {
2134 goto done;
2135 }
2136
2137 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2138 conn->samr_pipe->desthost,
2139 SEC_FLAG_MAXIMUM_ALLOWED,
2140 &conn->sam_connect_handle);
2141 if (!NT_STATUS_IS_OK(result)) {
2142 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2143 "for domain %s Error was %s\n",
2144 domain->name, nt_errstr(result) ));
2145 goto done;
2146 }
2147
2148 open_domain:
2149 result = rpccli_samr_OpenDomain(conn->samr_pipe,
2150 mem_ctx,
2151 &conn->sam_connect_handle,
2152 SEC_FLAG_MAXIMUM_ALLOWED,
2153 &domain->sid,
2154 &conn->sam_domain_handle);
2155
2156 done:
2157
2158 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
2159 /*
2160 * if we got access denied, we might just have no access rights
2161 * to talk to the remote samr server server (e.g. when we are a
2162 * PDC and we are connecting a w2k8 pdc via an interdomain
2163 * trust). In that case do not invalidate the whole connection
2164 * stack
2165 */
2166 TALLOC_FREE(conn->samr_pipe);
2167 ZERO_STRUCT(conn->sam_domain_handle);
2168 return result;
2169 } else if (!NT_STATUS_IS_OK(result)) {
2170 invalidate_cm_connection(conn);
2171 return result;
2172 }
2173
2174 *cli = conn->samr_pipe;
2175 *sam_handle = conn->sam_domain_handle;
2176 SAFE_FREE(machine_password);
2177 SAFE_FREE(machine_account);
2178 return result;
2179 }
2180
2181 /**********************************************************************
2182 open an schanneld ncacn_ip_tcp connection to LSA
2183 ***********************************************************************/
2184
2185 NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
2186 TALLOC_CTX *mem_ctx,
2187 struct rpc_pipe_client **cli)
2188 {
2189 struct winbindd_cm_conn *conn;
2190 NTSTATUS status;
2191
2192 DEBUG(10,("cm_connect_lsa_tcp\n"));
2193
2194 status = init_dc_connection(domain);
2195 if (!NT_STATUS_IS_OK(status)) {
2196 return status;
2197 }
2198
2199 conn = &domain->conn;
2200
2201 if (conn->lsa_pipe_tcp &&
2202 conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2203 conn->lsa_pipe_tcp->auth->auth_level == PIPE_AUTH_LEVEL_PRIVACY &&
2204 rpc_pipe_tcp_connection_ok(conn->lsa_pipe_tcp)) {
2205 goto done;
2206 }
2207
2208 TALLOC_FREE(conn->lsa_pipe_tcp);
2209
2210 status = cli_rpc_pipe_open_schannel(conn->cli,
2211 &ndr_table_lsarpc.syntax_id,
2212 NCACN_IP_TCP,
2213 PIPE_AUTH_LEVEL_PRIVACY,
2214 domain->name,
2215 &conn->lsa_pipe_tcp);
2216 if (!NT_STATUS_IS_OK(status)) {
2217 DEBUG(10,("cli_rpc_pipe_open_schannel failed: %s\n",
2218 nt_errstr(status)));
2219 goto done;
2220 }
2221
2222 done:
2223 if (!NT_STATUS_IS_OK(status)) {
2224 TALLOC_FREE(conn->lsa_pipe_tcp);
2225 return status;
2226 }
2227
2228 *cli = conn->lsa_pipe_tcp;
2229
2230 return status;
2231 }
2232
2233 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
2234 struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2235 {
2236 struct winbindd_cm_conn *conn;
2237 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2238 struct dcinfo *p_dcinfo;
2239
2240 result = init_dc_connection(domain);
2241 if (!NT_STATUS_IS_OK(result))
2242 return result;
2243
2244 conn = &domain->conn;
2245
2246 if (conn->lsa_pipe != NULL) {
2247 goto done;
2248 }
2249
2250 if ((conn->cli->user_name[0] == '\0') ||
2251 (conn->cli->domain[0] == '\0') ||
2252 (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2253 DEBUG(10, ("cm_connect_lsa: No no user available for "
2254 "domain %s, trying schannel\n", conn->cli->domain));
2255 goto schannel;
2256 }
2257
2258 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2259 * authenticated LSA pipe with sign & seal. */
2260 result = cli_rpc_pipe_open_spnego_ntlmssp
2261 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2262 PIPE_AUTH_LEVEL_PRIVACY,
2263 conn->cli->domain, conn->cli->user_name, conn->cli->password,
2264 &conn->lsa_pipe);
2265
2266 if (!NT_STATUS_IS_OK(result)) {
2267 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2268 "domain %s using NTLMSSP authenticated pipe: user "
2269 "%s\\%s. Error was %s. Trying schannel.\n",
2270 domain->name, conn->cli->domain,
2271 conn->cli->user_name, nt_errstr(result)));
2272 goto schannel;
2273 }
2274
2275 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2276 "NTLMSSP authenticated pipe: user %s\\%s\n",
2277 domain->name, conn->cli->domain, conn->cli->user_name ));
2278
2279 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2280 SEC_FLAG_MAXIMUM_ALLOWED,
2281 &conn->lsa_policy);
2282 if (NT_STATUS_IS_OK(result)) {
2283 goto done;
2284 }
2285
2286 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2287 "schannel\n"));
2288
2289 TALLOC_FREE(conn->lsa_pipe);
2290
2291 schannel:
2292
2293 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2294
2295 if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2296 /* If this call fails - conn->cli can now be NULL ! */
2297 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2298 "for domain %s, trying anon\n", domain->name));
2299 goto anonymous;
2300 }
2301 result = cli_rpc_pipe_open_schannel_with_key
2302 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2303 PIPE_AUTH_LEVEL_PRIVACY,
2304 domain->name, p_dcinfo, &conn->lsa_pipe);
2305
2306 if (!NT_STATUS_IS_OK(result)) {
2307 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2308 "domain %s using schannel. Error was %s\n",
2309 domain->name, nt_errstr(result) ));
2310 goto anonymous;
2311 }
2312 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2313 "schannel.\n", domain->name ));
2314
2315 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2316 SEC_FLAG_MAXIMUM_ALLOWED,
2317 &conn->lsa_policy);
2318 if (NT_STATUS_IS_OK(result)) {
2319 goto done;
2320 }
2321
2322 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2323 "anonymous\n"));
2324
2325 TALLOC_FREE(conn->lsa_pipe);
2326
2327 anonymous:
2328
2329 result = cli_rpc_pipe_open_noauth(conn->cli,
2330 &ndr_table_lsarpc.syntax_id,
2331 &conn->lsa_pipe);
2332 if (!NT_STATUS_IS_OK(result)) {
2333 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2334 goto done;
2335 }
2336
2337 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2338 SEC_FLAG_MAXIMUM_ALLOWED,
2339 &conn->lsa_policy);
2340 done:
2341 if (!NT_STATUS_IS_OK(result)) {
2342 invalidate_cm_connection(conn);
2343 return result;
2344 }
2345
2346 *cli = conn->lsa_pipe;
2347 *lsa_policy = conn->lsa_policy;
2348 return result;
2349 }
2350
2351 /****************************************************************************
2352 Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2353 session key stored in conn->netlogon_pipe->dc->sess_key.
2354 ****************************************************************************/
2355
2356 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
/* [<][>][^][v][top][bottom][index][help] */
2357 struct rpc_pipe_client **cli)
2358 {
2359 struct winbindd_cm_conn *conn;
2360 NTSTATUS result;
2361
2362 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2363 uint8 mach_pwd[16];
2364 uint32 sec_chan_type;
2365 const char *account_name;
2366 struct rpc_pipe_client *netlogon_pipe = NULL;
2367
2368 *cli = NULL;
2369
2370 result = init_dc_connection(domain);
2371 if (!NT_STATUS_IS_OK(result)) {
2372 return result;
2373 }
2374
2375 conn = &domain->conn;
2376
2377 if (conn->netlogon_pipe != NULL) {
2378 *cli = conn->netlogon_pipe;
2379 return NT_STATUS_OK;
2380 }
2381
2382 result = cli_rpc_pipe_open_noauth(conn->cli,
2383 &ndr_table_netlogon.syntax_id,
2384 &netlogon_pipe);
2385 if (!NT_STATUS_IS_OK(result)) {
2386 return result;
2387 }
2388
2389 if ((!IS_DC) && (!domain->primary)) {
2390 /* Clear the schannel request bit and drop down */
2391 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2392 goto no_schannel;
2393 }
2394
2395 if (lp_client_schannel() != False) {
2396 neg_flags |= NETLOGON_NEG_SCHANNEL;
2397 }
2398
2399 if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2400 &sec_chan_type))
2401 {
2402 TALLOC_FREE(netlogon_pipe);
2403 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2404 }
2405
2406 result = rpccli_netlogon_setup_creds(
2407 netlogon_pipe,
2408 domain->dcname, /* server name. */
2409 domain->name, /* domain name */
2410 global_myname(), /* client name */
2411 account_name, /* machine account */
2412 mach_pwd, /* machine password */
2413 sec_chan_type, /* from get_trust_pw */
2414 &neg_flags);
2415
2416 if (!NT_STATUS_IS_OK(result)) {
2417 TALLOC_FREE(netlogon_pipe);
2418 return result;
2419 }
2420
2421 if ((lp_client_schannel() == True) &&
2422 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2423 DEBUG(3, ("Server did not offer schannel\n"));
2424 TALLOC_FREE(netlogon_pipe);
2425 return NT_STATUS_ACCESS_DENIED;
2426 }
2427
2428 no_schannel:
2429 if ((lp_client_schannel() == False) ||
2430 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2431 /*
2432 * NetSamLogonEx only works for schannel
2433 */
2434 domain->can_do_samlogon_ex = False;
2435
2436 /* We're done - just keep the existing connection to NETLOGON
2437 * open */
2438 conn->netlogon_pipe = netlogon_pipe;
2439 *cli = conn->netlogon_pipe;
2440 return NT_STATUS_OK;
2441 }
2442
2443 /* Using the credentials from the first pipe, open a signed and sealed
2444 second netlogon pipe. The session key is stored in the schannel
2445 part of the new pipe auth struct.
2446 */
2447
2448 result = cli_rpc_pipe_open_schannel_with_key(
2449 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2450 PIPE_AUTH_LEVEL_PRIVACY, domain->name, netlogon_pipe->dc,
2451 &conn->netlogon_pipe);
2452
2453 /* We can now close the initial netlogon pipe. */
2454 TALLOC_FREE(netlogon_pipe);
2455
2456 if (!NT_STATUS_IS_OK(result)) {
2457 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2458 "was %s\n", nt_errstr(result)));
2459
2460 /* make sure we return something besides OK */
2461 return !NT_STATUS_IS_OK(result) ? result : NT_STATUS_PIPE_NOT_AVAILABLE;
2462 }
2463
2464 /*
2465 * Try NetSamLogonEx for AD domains
2466 */
2467 domain->can_do_samlogon_ex = domain->active_directory;
2468
2469 *cli = conn->netlogon_pipe;
2470 return NT_STATUS_OK;
2471 }