root/source3/winbindd/winbindd_cm.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. msg_failed_to_go_online
  2. msg_try_to_go_online
  3. fork_child_dc_connect
  4. check_domain_online_handler
  5. calc_new_online_timeout_check
  6. set_domain_offline
  7. set_domain_online
  8. set_domain_online_request
  9. winbind_add_failed_connection_entry
  10. cm_get_ipc_userpass
  11. get_dc_name_via_netlogon
  12. get_trust_creds
  13. cm_prepare_connection
  14. add_one_dc_unique
  15. add_sockaddr_to_array
  16. dcip_to_name
  17. get_dcs
  18. find_new_dc
  19. cm_open_connection
  20. invalidate_cm_connection
  21. close_conns_after_fork
  22. connection_ok
  23. init_dc_connection_network
  24. init_dc_connection
  25. set_dc_type_and_flags_trustinfo
  26. set_dc_type_and_flags_connect
  27. set_dc_type_and_flags
  28. cm_get_schannel_dcinfo
  29. cm_connect_sam
  30. cm_connect_lsa_tcp
  31. cm_connect_lsa
  32. cm_connect_netlogon

   1 /* 
   2    Unix SMB/CIFS implementation.
   3 
   4    Winbind daemon connection manager
   5 
   6    Copyright (C) Tim Potter                2001
   7    Copyright (C) Andrew Bartlett           2002
   8    Copyright (C) Gerald (Jerry) Carter     2003-2005.
   9    Copyright (C) Volker Lendecke           2004-2005
  10    Copyright (C) Jeremy Allison            2006
  11 
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16 
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21 
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25 
  26 /*
  27    We need to manage connections to domain controllers without having to
  28    mess up the main winbindd code with other issues.  The aim of the
  29    connection manager is to:
  30 
  31        - make connections to domain controllers and cache them
  32        - re-establish connections when networks or servers go down
  33        - centralise the policy on connection timeouts, domain controller
  34          selection etc
  35        - manage re-entrancy for when winbindd becomes able to handle
  36          multiple outstanding rpc requests
  37 
  38    Why not have connection management as part of the rpc layer like tng?
  39    Good question.  This code may morph into libsmb/rpc_cache.c or something
  40    like that but at the moment it's simply staying as part of winbind.  I
  41    think the TNG architecture of forcing every user of the rpc layer to use
  42    the connection caching system is a bad idea.  It should be an optional
  43    method of using the routines.
  44 
  45    The TNG design is quite good but I disagree with some aspects of the
  46    implementation. -tpot
  47 
  48  */
  49 
  50 /*
  51    TODO:
  52 
  53      - I'm pretty annoyed by all the make_nmb_name() stuff.  It should be
  54        moved down into another function.
  55 
  56      - Take care when destroying cli_structs as they can be shared between
  57        various sam handles.
  58 
  59  */
  60 
  61 #include "includes.h"
  62 #include "winbindd.h"
  63 
  64 #undef DBGC_CLASS
  65 #define DBGC_CLASS DBGC_WINBIND
  66 
  67 struct dc_name_ip {
  68         fstring name;
  69         struct sockaddr_storage ss;
  70 };
  71 
  72 extern struct winbindd_methods reconnect_methods;
  73 extern bool override_logfile;
  74 
  75 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
  76 static void set_dc_type_and_flags( struct winbindd_domain *domain );
  77 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
  78                     struct dc_name_ip **dcs, int *num_dcs);
  79 
  80 /****************************************************************
  81  Child failed to find DC's. Reschedule check.
  82 ****************************************************************/
  83 
  84 static void msg_failed_to_go_online(struct messaging_context *msg,
     /* [<][>][^][v][top][bottom][index][help] */
  85                                     void *private_data,
  86                                     uint32_t msg_type,
  87                                     struct server_id server_id,
  88                                     DATA_BLOB *data)
  89 {
  90         struct winbindd_domain *domain;
  91         const char *domainname = (const char *)data->data;
  92 
  93         if (data->data == NULL || data->length == 0) {
  94                 return;
  95         }
  96 
  97         DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
  98 
  99         for (domain = domain_list(); domain; domain = domain->next) {
 100                 if (domain->internal) {
 101                         continue;
 102                 }
 103 
 104                 if (strequal(domain->name, domainname)) {
 105                         if (domain->online) {
 106                                 /* We're already online, ignore. */
 107                                 DEBUG(5,("msg_fail_to_go_online: domain %s "
 108                                         "already online.\n", domainname));
 109                                 continue;
 110                         }
 111 
 112                         /* Reschedule the online check. */
 113                         set_domain_offline(domain);
 114                         break;
 115                 }
 116         }
 117 }
 118 
 119 /****************************************************************
 120  Actually cause a reconnect from a message.
 121 ****************************************************************/
 122 
 123 static void msg_try_to_go_online(struct messaging_context *msg,
     /* [<][>][^][v][top][bottom][index][help] */
 124                                  void *private_data,
 125                                  uint32_t msg_type,
 126                                  struct server_id server_id,
 127                                  DATA_BLOB *data)
 128 {
 129         struct winbindd_domain *domain;
 130         const char *domainname = (const char *)data->data;
 131 
 132         if (data->data == NULL || data->length == 0) {
 133                 return;
 134         }
 135 
 136         DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
 137 
 138         for (domain = domain_list(); domain; domain = domain->next) {
 139                 if (domain->internal) {
 140                         continue;
 141                 }
 142 
 143                 if (strequal(domain->name, domainname)) {
 144 
 145                         if (domain->online) {
 146                                 /* We're already online, ignore. */
 147                                 DEBUG(5,("msg_try_to_go_online: domain %s "
 148                                         "already online.\n", domainname));
 149                                 continue;
 150                         }
 151 
 152                         /* This call takes care of setting the online
 153                            flag to true if we connected, or re-adding
 154                            the offline handler if false. Bypasses online
 155                            check so always does network calls. */
 156 
 157                         init_dc_connection_network(domain);
 158                         break;
 159                 }
 160         }
 161 }
 162 
 163 /****************************************************************
 164  Fork a child to try and contact a DC. Do this as contacting a
 165  DC requires blocking lookups and we don't want to block our
 166  parent.
 167 ****************************************************************/
 168 
 169 static bool fork_child_dc_connect(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
 170 {
 171         struct dc_name_ip *dcs = NULL;
 172         int num_dcs = 0;
 173         TALLOC_CTX *mem_ctx = NULL;
 174         pid_t parent_pid = sys_getpid();
 175         char *lfile = NULL;
 176 
 177         /* Stop zombies */
 178         CatchChild();
 179 
 180         if (domain->dc_probe_pid != (pid_t)-1) {
 181                 /*
 182                  * We might already have a DC probe
 183                  * child working, check.
 184                  */
 185                 if (process_exists_by_pid(domain->dc_probe_pid)) {
 186                         DEBUG(10,("fork_child_dc_connect: pid %u already "
 187                                 "checking for DC's.\n",
 188                                 (unsigned int)domain->dc_probe_pid));
 189                         return true;
 190                 }
 191                 domain->dc_probe_pid = (pid_t)-1;
 192         }
 193 
 194         domain->dc_probe_pid = sys_fork();
 195 
 196         if (domain->dc_probe_pid == (pid_t)-1) {
 197                 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 198                 return False;
 199         }
 200 
 201         if (domain->dc_probe_pid != (pid_t)0) {
 202                 /* Parent */
 203                 messaging_register(winbind_messaging_context(), NULL,
 204                                    MSG_WINBIND_TRY_TO_GO_ONLINE,
 205                                    msg_try_to_go_online);
 206                 messaging_register(winbind_messaging_context(), NULL,
 207                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 208                                    msg_failed_to_go_online);
 209                 return True;
 210         }
 211 
 212         /* Child. */
 213 
 214         /* Leave messages blocked - we will never process one. */
 215 
 216         if (!override_logfile) {
 217                 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
 218                         DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
 219                         _exit(1);
 220                 }
 221         }
 222 
 223         if (!winbindd_reinit_after_fork(lfile)) {
 224                 messaging_send_buf(winbind_messaging_context(),
 225                                    pid_to_procid(parent_pid),
 226                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 227                                    (uint8 *)domain->name,
 228                                    strlen(domain->name)+1);
 229                 _exit(1);
 230         }
 231         SAFE_FREE(lfile);
 232 
 233         mem_ctx = talloc_init("fork_child_dc_connect");
 234         if (!mem_ctx) {
 235                 DEBUG(0,("talloc_init failed.\n"));
 236                 messaging_send_buf(winbind_messaging_context(),
 237                                    pid_to_procid(parent_pid),
 238                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 239                                    (uint8 *)domain->name,
 240                                    strlen(domain->name)+1);
 241                 _exit(1);
 242         }
 243 
 244         if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
 245                 /* Still offline ? Can't find DC's. */
 246                 messaging_send_buf(winbind_messaging_context(),
 247                                    pid_to_procid(parent_pid),
 248                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 249                                    (uint8 *)domain->name,
 250                                    strlen(domain->name)+1);
 251                 _exit(0);
 252         }
 253 
 254         /* We got a DC. Send a message to our parent to get it to
 255            try and do the same. */
 256 
 257         messaging_send_buf(winbind_messaging_context(),
 258                            pid_to_procid(parent_pid),
 259                            MSG_WINBIND_TRY_TO_GO_ONLINE,
 260                            (uint8 *)domain->name,
 261                            strlen(domain->name)+1);
 262         _exit(0);
 263 }
 264 
 265 /****************************************************************
 266  Handler triggered if we're offline to try and detect a DC.
 267 ****************************************************************/
 268 
 269 static void check_domain_online_handler(struct event_context *ctx,
     /* [<][>][^][v][top][bottom][index][help] */
 270                                         struct timed_event *te,
 271                                         struct timeval now,
 272                                         void *private_data)
 273 {
 274         struct winbindd_domain *domain =
 275                 (struct winbindd_domain *)private_data;
 276 
 277         DEBUG(10,("check_domain_online_handler: called for domain "
 278                   "%s (online = %s)\n", domain->name, 
 279                   domain->online ? "True" : "False" ));
 280 
 281         TALLOC_FREE(domain->check_online_event);
 282 
 283         /* Are we still in "startup" mode ? */
 284 
 285         if (domain->startup && (now.tv_sec > domain->startup_time + 30)) {
 286                 /* No longer in "startup" mode. */
 287                 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 288                         domain->name ));
 289                 domain->startup = False;
 290         }
 291 
 292         /* We've been told to stay offline, so stay
 293            that way. */
 294 
 295         if (get_global_winbindd_state_offline()) {
 296                 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
 297                         domain->name ));
 298                 return;
 299         }
 300 
 301         /* Fork a child to test if it can contact a DC. 
 302            If it can then send ourselves a message to
 303            cause a reconnect. */
 304 
 305         fork_child_dc_connect(domain);
 306 }
 307 
 308 /****************************************************************
 309  If we're still offline setup the timeout check.
 310 ****************************************************************/
 311 
 312 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
 313 {
 314         int wbr = lp_winbind_reconnect_delay();
 315 
 316         if (domain->startup) {
 317                 domain->check_online_timeout = 10;
 318         } else if (domain->check_online_timeout < wbr) {
 319                 domain->check_online_timeout = wbr;
 320         }
 321 }
 322 
 323 /****************************************************************
 324  Set domain offline and also add handler to put us back online
 325  if we detect a DC.
 326 ****************************************************************/
 327 
 328 void set_domain_offline(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
 329 {
 330         DEBUG(10,("set_domain_offline: called for domain %s\n",
 331                 domain->name ));
 332 
 333         TALLOC_FREE(domain->check_online_event);
 334 
 335         if (domain->internal) {
 336                 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
 337                         domain->name ));
 338                 return;
 339         }
 340 
 341         domain->online = False;
 342 
 343         /* Offline domains are always initialized. They're
 344            re-initialized when they go back online. */
 345 
 346         domain->initialized = True;
 347 
 348         /* We only add the timeout handler that checks and
 349            allows us to go back online when we've not
 350            been told to remain offline. */
 351 
 352         if (get_global_winbindd_state_offline()) {
 353                 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
 354                         domain->name ));
 355                 return;
 356         }
 357 
 358         /* If we're in statup mode, check again in 10 seconds, not in
 359            lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 360 
 361         calc_new_online_timeout_check(domain);
 362 
 363         domain->check_online_event = event_add_timed(winbind_event_context(),
 364                                                 NULL,
 365                                                 timeval_current_ofs(domain->check_online_timeout,0),
 366                                                 check_domain_online_handler,
 367                                                 domain);
 368 
 369         /* The above *has* to succeed for winbindd to work. */
 370         if (!domain->check_online_event) {
 371                 smb_panic("set_domain_offline: failed to add online handler");
 372         }
 373 
 374         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
 375                 domain->name ));
 376 
 377         /* Send an offline message to the idmap child when our
 378            primary domain goes offline */
 379 
 380         if ( domain->primary ) {
 381                 struct winbindd_child *idmap = idmap_child();
 382 
 383                 if ( idmap->pid != 0 ) {
 384                         messaging_send_buf(winbind_messaging_context(),
 385                                            pid_to_procid(idmap->pid), 
 386                                            MSG_WINBIND_OFFLINE, 
 387                                            (uint8 *)domain->name, 
 388                                            strlen(domain->name)+1);
 389                 }                       
 390         }
 391 
 392         return; 
 393 }
 394 
 395 /****************************************************************
 396  Set domain online - if allowed.
 397 ****************************************************************/
 398 
 399 static void set_domain_online(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
 400 {
 401         DEBUG(10,("set_domain_online: called for domain %s\n",
 402                 domain->name ));
 403 
 404         if (domain->internal) {
 405                 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
 406                         domain->name ));
 407                 return;
 408         }
 409 
 410         if (get_global_winbindd_state_offline()) {
 411                 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
 412                         domain->name ));
 413                 return;
 414         }
 415 
 416         winbindd_set_locator_kdc_envs(domain);
 417 
 418         /* If we are waiting to get a krb5 ticket, trigger immediately. */
 419         ccache_regain_all_now();
 420 
 421         /* Ok, we're out of any startup mode now... */
 422         domain->startup = False;
 423 
 424         if (domain->online == False) {
 425                 /* We were offline - now we're online. We default to
 426                    using the MS-RPC backend if we started offline,
 427                    and if we're going online for the first time we
 428                    should really re-initialize the backends and the
 429                    checks to see if we're talking to an AD or NT domain.
 430                 */
 431 
 432                 domain->initialized = False;
 433 
 434                 /* 'reconnect_methods' is the MS-RPC backend. */
 435                 if (domain->backend == &reconnect_methods) {
 436                         domain->backend = NULL;
 437                 }
 438         }
 439 
 440         /* Ensure we have no online timeout checks. */
 441         domain->check_online_timeout = 0;
 442         TALLOC_FREE(domain->check_online_event);
 443 
 444         /* Ensure we ignore any pending child messages. */
 445         messaging_deregister(winbind_messaging_context(),
 446                              MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
 447         messaging_deregister(winbind_messaging_context(),
 448                              MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
 449 
 450         domain->online = True;
 451 
 452         /* Send an online message to the idmap child when our
 453            primary domain comes online */
 454 
 455         if ( domain->primary ) {
 456                 struct winbindd_child *idmap = idmap_child();
 457 
 458                 if ( idmap->pid != 0 ) {
 459                         messaging_send_buf(winbind_messaging_context(),
 460                                            pid_to_procid(idmap->pid), 
 461                                            MSG_WINBIND_ONLINE, 
 462                                            (uint8 *)domain->name, 
 463                                            strlen(domain->name)+1);
 464                 }                       
 465         }
 466 
 467         return; 
 468 }
 469 
 470 /****************************************************************
 471  Requested to set a domain online.
 472 ****************************************************************/
 473 
 474 void set_domain_online_request(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
 475 {
 476         struct timeval tev;
 477 
 478         DEBUG(10,("set_domain_online_request: called for domain %s\n",
 479                 domain->name ));
 480 
 481         if (get_global_winbindd_state_offline()) {
 482                 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
 483                         domain->name ));
 484                 return;
 485         }
 486 
 487         /* We've been told it's safe to go online and
 488            try and connect to a DC. But I don't believe it
 489            because network manager seems to lie.
 490            Wait at least 5 seconds. Heuristics suck... */
 491 
 492 
 493         GetTimeOfDay(&tev);
 494 
 495         /* Go into "startup" mode again. */
 496         domain->startup_time = tev.tv_sec;
 497         domain->startup = True;
 498 
 499         tev.tv_sec += 5;
 500 
 501         if (!domain->check_online_event) {
 502                 /* If we've come from being globally offline we
 503                    don't have a check online event handler set.
 504                    We need to add one now we're trying to go
 505                    back online. */
 506 
 507                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 508                         domain->name ));
 509         }
 510 
 511         TALLOC_FREE(domain->check_online_event);
 512 
 513         domain->check_online_event = event_add_timed(winbind_event_context(),
 514                                                      NULL,
 515                                                      tev,
 516                                                      check_domain_online_handler,
 517                                                      domain);
 518 
 519         /* The above *has* to succeed for winbindd to work. */
 520         if (!domain->check_online_event) {
 521                 smb_panic("set_domain_online_request: failed to add online handler");
 522         }
 523 }
 524 
 525 /****************************************************************
 526  Add -ve connection cache entries for domain and realm.
 527 ****************************************************************/
 528 
 529 void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
 530                                         const char *server,
 531                                         NTSTATUS result)
 532 {
 533         add_failed_connection_entry(domain->name, server, result);
 534         /* If this was the saf name for the last thing we talked to,
 535            remove it. */
 536         saf_delete(domain->name);
 537         if (*domain->alt_name) {
 538                 add_failed_connection_entry(domain->alt_name, server, result);
 539                 saf_delete(domain->alt_name);
 540         }
 541         winbindd_unset_locator_kdc_env(domain);
 542 }
 543 
 544 /* Choose between anonymous or authenticated connections.  We need to use
 545    an authenticated connection if DCs have the RestrictAnonymous registry
 546    entry set > 0, or the "Additional restrictions for anonymous
 547    connections" set in the win2k Local Security Policy. 
 548 
 549    Caller to free() result in domain, username, password
 550 */
 551 
 552 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
     /* [<][>][^][v][top][bottom][index][help] */
 553 {
 554         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 555         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 556         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 557 
 558         if (*username && **username) {
 559 
 560                 if (!*domain || !**domain)
 561                         *domain = smb_xstrdup(lp_workgroup());
 562 
 563                 if (!*password || !**password)
 564                         *password = smb_xstrdup("");
 565 
 566                 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n", 
 567                           *domain, *username));
 568 
 569         } else {
 570                 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 571                 *username = smb_xstrdup("");
 572                 *domain = smb_xstrdup("");
 573                 *password = smb_xstrdup("");
 574         }
 575 }
 576 
 577 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
 578                                      fstring dcname,
 579                                      struct sockaddr_storage *dc_ss)
 580 {
 581         struct winbindd_domain *our_domain = NULL;
 582         struct rpc_pipe_client *netlogon_pipe = NULL;
 583         NTSTATUS result;
 584         WERROR werr;
 585         TALLOC_CTX *mem_ctx;
 586         unsigned int orig_timeout;
 587         const char *tmp = NULL;
 588         const char *p;
 589 
 590         /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
 591          * moment.... */
 592 
 593         if (IS_DC) {
 594                 return False;
 595         }
 596 
 597         if (domain->primary) {
 598                 return False;
 599         }
 600 
 601         our_domain = find_our_domain();
 602 
 603         if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
 604                 return False;
 605         }
 606 
 607         result = cm_connect_netlogon(our_domain, &netlogon_pipe);
 608         if (!NT_STATUS_IS_OK(result)) {
 609                 talloc_destroy(mem_ctx);
 610                 return False;
 611         }
 612 
 613         /* This call can take a long time - allow the server to time out.
 614            35 seconds should do it. */
 615 
 616         orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
 617 
 618         if (our_domain->active_directory) {
 619                 struct netr_DsRGetDCNameInfo *domain_info = NULL;
 620 
 621                 result = rpccli_netr_DsRGetDCName(netlogon_pipe,
 622                                                   mem_ctx,
 623                                                   our_domain->dcname,
 624                                                   domain->name,
 625                                                   NULL,
 626                                                   NULL,
 627                                                   DS_RETURN_DNS_NAME,
 628                                                   &domain_info,
 629                                                   &werr);
 630                 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 631                         tmp = talloc_strdup(
 632                                 mem_ctx, domain_info->dc_unc);
 633                         if (tmp == NULL) {
 634                                 DEBUG(0, ("talloc_strdup failed\n"));
 635                                 talloc_destroy(mem_ctx);
 636                                 return false;
 637                         }
 638                         if (strlen(domain->alt_name) == 0) {
 639                                 fstrcpy(domain->alt_name,
 640                                         domain_info->domain_name);
 641                         }
 642                         if (strlen(domain->forest_name) == 0) {
 643                                 fstrcpy(domain->forest_name,
 644                                         domain_info->forest_name);
 645                         }
 646                 }
 647         } else {
 648                 result = rpccli_netr_GetAnyDCName(netlogon_pipe, mem_ctx,
 649                                                   our_domain->dcname,
 650                                                   domain->name,
 651                                                   &tmp,
 652                                                   &werr);
 653         }
 654 
 655         /* And restore our original timeout. */
 656         rpccli_set_timeout(netlogon_pipe, orig_timeout);
 657 
 658         if (!NT_STATUS_IS_OK(result)) {
 659                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 660                         nt_errstr(result)));
 661                 talloc_destroy(mem_ctx);
 662                 return false;
 663         }
 664 
 665         if (!W_ERROR_IS_OK(werr)) {
 666                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 667                            win_errstr(werr)));
 668                 talloc_destroy(mem_ctx);
 669                 return false;
 670         }
 671 
 672         /* rpccli_netr_GetAnyDCName gives us a name with \\ */
 673         p = strip_hostname(tmp);
 674 
 675         fstrcpy(dcname, p);
 676 
 677         talloc_destroy(mem_ctx);
 678 
 679         DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname));
 680 
 681         if (!resolve_name(dcname, dc_ss, 0x20)) {
 682                 return False;
 683         }
 684 
 685         return True;
 686 }
 687 
 688 /**
 689  * Helper function to assemble trust password and account name
 690  */
 691 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
 692                                 char **machine_password,
 693                                 char **machine_account,
 694                                 char **machine_krb5_principal)
 695 {
 696         const char *account_name;
 697         const char *name = NULL;
 698 
 699         /* If we are a DC and this is not our own domain */
 700 
 701         if (IS_DC) {
 702                 name = domain->name;
 703         } else {
 704                 struct winbindd_domain *our_domain = find_our_domain();
 705 
 706                 if (!our_domain)
 707                         return NT_STATUS_INVALID_SERVER_STATE;          
 708 
 709                 name = our_domain->name;                
 710         }       
 711 
 712         if (!get_trust_pw_clear(name, machine_password,
 713                                 &account_name, NULL))
 714         {
 715                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 716         }
 717 
 718         if ((machine_account != NULL) &&
 719             (asprintf(machine_account, "%s$", account_name) == -1))
 720         {
 721                 return NT_STATUS_NO_MEMORY;
 722         }
 723 
 724         /* For now assume our machine account only exists in our domain */
 725 
 726         if (machine_krb5_principal != NULL)
 727         {
 728                 struct winbindd_domain *our_domain = find_our_domain();
 729 
 730                 if (!our_domain) {
 731                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;                       
 732                 }
 733 
 734                 if (asprintf(machine_krb5_principal, "%s$@%s",
 735                              account_name, our_domain->alt_name) == -1)
 736                 {
 737                         return NT_STATUS_NO_MEMORY;
 738                 }
 739 
 740                 strupper_m(*machine_krb5_principal);
 741         }
 742 
 743         return NT_STATUS_OK;
 744 }
 745 
 746 /************************************************************************
 747  Given a fd with a just-connected TCP connection to a DC, open a connection
 748  to the pipe.
 749 ************************************************************************/
 750 
 751 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
 752                                       const int sockfd,
 753                                       const char *controller,
 754                                       struct cli_state **cli,
 755                                       bool *retry)
 756 {
 757         char *machine_password = NULL;
 758         char *machine_krb5_principal = NULL;
 759         char *machine_account = NULL;
 760         char *ipc_username = NULL;
 761         char *ipc_domain = NULL;
 762         char *ipc_password = NULL;
 763 
 764         struct named_mutex *mutex;
 765 
 766         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 767 
 768         struct sockaddr peeraddr;
 769         socklen_t peeraddr_len;
 770 
 771         struct sockaddr_in *peeraddr_in = (struct sockaddr_in *)&peeraddr;
 772 
 773         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
 774                 controller, domain->name ));
 775 
 776         *retry = True;
 777 
 778         mutex = grab_named_mutex(talloc_tos(), controller,
 779                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
 780         if (mutex == NULL) {
 781                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
 782                          controller));
 783                 result = NT_STATUS_POSSIBLE_DEADLOCK;
 784                 goto done;
 785         }
 786 
 787         if ((*cli = cli_initialise()) == NULL) {
 788                 DEBUG(1, ("Could not cli_initialize\n"));
 789                 result = NT_STATUS_NO_MEMORY;
 790                 goto done;
 791         }
 792 
 793         (*cli)->timeout = 10000;        /* 10 seconds */
 794         (*cli)->fd = sockfd;
 795         fstrcpy((*cli)->desthost, controller);
 796         (*cli)->use_kerberos = True;
 797 
 798         peeraddr_len = sizeof(peeraddr);
 799 
 800         if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0) ||
 801             (peeraddr_len != sizeof(struct sockaddr_in)) ||
 802             (peeraddr_in->sin_family != PF_INET))
 803         {
 804                 DEBUG(0,("cm_prepare_connection: %s\n", strerror(errno)));
 805                 result = NT_STATUS_UNSUCCESSFUL;
 806                 goto done;
 807         }
 808 
 809         if (ntohs(peeraddr_in->sin_port) == 139) {
 810                 struct nmb_name calling;
 811                 struct nmb_name called;
 812 
 813                 make_nmb_name(&calling, global_myname(), 0x0);
 814                 make_nmb_name(&called, "*SMBSERVER", 0x20);
 815 
 816                 if (!cli_session_request(*cli, &calling, &called)) {
 817                         DEBUG(8, ("cli_session_request failed for %s\n",
 818                                   controller));
 819                         result = NT_STATUS_UNSUCCESSFUL;
 820                         goto done;
 821                 }
 822         }
 823 
 824         result = cli_negprot(*cli);
 825 
 826         if (!NT_STATUS_IS_OK(result)) {
 827                 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
 828                 goto done;
 829         }
 830 
 831         if (!is_dc_trusted_domain_situation(domain->name) &&
 832             (*cli)->protocol >= PROTOCOL_NT1 &&
 833             (*cli)->capabilities & CAP_EXTENDED_SECURITY)
 834         {
 835                 ADS_STATUS ads_status;
 836 
 837                 result = get_trust_creds(domain, &machine_password,
 838                                          &machine_account,
 839                                          &machine_krb5_principal);
 840                 if (!NT_STATUS_IS_OK(result)) {
 841                         goto anon_fallback;
 842                 }
 843 
 844                 if (lp_security() == SEC_ADS) {
 845 
 846                         /* Try a krb5 session */
 847 
 848                         (*cli)->use_kerberos = True;
 849                         DEBUG(5, ("connecting to %s from %s with kerberos principal "
 850                                   "[%s] and realm [%s]\n", controller, global_myname(),
 851                                   machine_krb5_principal, domain->alt_name));
 852 
 853                         winbindd_set_locator_kdc_envs(domain);
 854 
 855                         ads_status = cli_session_setup_spnego(*cli,
 856                                                               machine_krb5_principal, 
 857                                                               machine_password,
 858                                                               lp_workgroup(),
 859                                                               domain->alt_name);
 860 
 861                         if (!ADS_ERR_OK(ads_status)) {
 862                                 DEBUG(4,("failed kerberos session setup with %s\n",
 863                                          ads_errstr(ads_status)));
 864                         }
 865 
 866                         result = ads_ntstatus(ads_status);
 867                         if (NT_STATUS_IS_OK(result)) {
 868                                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 869                                 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 870                                 if (!NT_STATUS_IS_OK(result)) {
 871                                         goto done;
 872                                 }
 873                                 goto session_setup_done;
 874                         }
 875                 }
 876 
 877                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
 878                 (*cli)->use_kerberos = False;
 879 
 880                 DEBUG(5, ("connecting to %s from %s with username "
 881                           "[%s]\\[%s]\n",  controller, global_myname(),
 882                           lp_workgroup(), machine_account));
 883 
 884                 ads_status = cli_session_setup_spnego(*cli,
 885                                                       machine_account, 
 886                                                       machine_password, 
 887                                                       lp_workgroup(),
 888                                                       NULL);
 889                 if (!ADS_ERR_OK(ads_status)) {
 890                         DEBUG(4, ("authenticated session setup failed with %s\n",
 891                                 ads_errstr(ads_status)));
 892                 }
 893 
 894                 result = ads_ntstatus(ads_status);
 895                 if (NT_STATUS_IS_OK(result)) {
 896                         /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 897                         result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 898                         if (!NT_STATUS_IS_OK(result)) {
 899                                 goto done;
 900                         }
 901                         goto session_setup_done;
 902                 }
 903         }
 904 
 905         /* Fall back to non-kerberos session setup with auth_user */
 906 
 907         (*cli)->use_kerberos = False;
 908 
 909         cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
 910 
 911         if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
 912             (strlen(ipc_username) > 0)) {
 913 
 914                 /* Only try authenticated if we have a username */
 915 
 916                 DEBUG(5, ("connecting to %s from %s with username "
 917                           "[%s]\\[%s]\n",  controller, global_myname(),
 918                           ipc_domain, ipc_username));
 919 
 920                 if (NT_STATUS_IS_OK(cli_session_setup(
 921                                             *cli, ipc_username,
 922                                             ipc_password, strlen(ipc_password)+1,
 923                                             ipc_password, strlen(ipc_password)+1,
 924                                             ipc_domain))) {
 925                         /* Successful logon with given username. */
 926                         result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
 927                         if (!NT_STATUS_IS_OK(result)) {
 928                                 goto done;
 929                         }
 930                         goto session_setup_done;
 931                 } else {
 932                         DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
 933                                 ipc_domain, ipc_username ));
 934                 }
 935         }
 936 
 937  anon_fallback:
 938 
 939         /* Fall back to anonymous connection, this might fail later */
 940         DEBUG(10,("cm_prepare_connection: falling back to anonymous "
 941                 "connection for DC %s\n",
 942                 controller ));
 943 
 944         if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
 945                                               NULL, 0, ""))) {
 946                 DEBUG(5, ("Connected anonymously\n"));
 947                 result = cli_init_creds(*cli, "", "", "");
 948                 if (!NT_STATUS_IS_OK(result)) {
 949                         goto done;
 950                 }
 951                 goto session_setup_done;
 952         }
 953 
 954         result = cli_nt_error(*cli);
 955 
 956         if (NT_STATUS_IS_OK(result))
 957                 result = NT_STATUS_UNSUCCESSFUL;
 958 
 959         /* We can't session setup */
 960 
 961         goto done;
 962 
 963  session_setup_done:
 964 
 965         /* cache the server name for later connections */
 966 
 967         saf_store( domain->name, (*cli)->desthost );
 968         if (domain->alt_name && (*cli)->use_kerberos) {
 969                 saf_store( domain->alt_name, (*cli)->desthost );
 970         }
 971 
 972         winbindd_set_locator_kdc_envs(domain);
 973 
 974         result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
 975 
 976         if (!NT_STATUS_IS_OK(result)) {
 977                 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
 978                 goto done;
 979         }
 980 
 981         TALLOC_FREE(mutex);
 982         *retry = False;
 983 
 984         /* set the domain if empty; needed for schannel connections */
 985         if ( !(*cli)->domain[0] ) {
 986                 result = cli_set_domain((*cli), domain->name);
 987                 if (!NT_STATUS_IS_OK(result)) {
 988                         return result;
 989                 }
 990         }
 991 
 992         result = NT_STATUS_OK;
 993 
 994  done:
 995         TALLOC_FREE(mutex);
 996         SAFE_FREE(machine_account);
 997         SAFE_FREE(machine_password);
 998         SAFE_FREE(machine_krb5_principal);
 999         SAFE_FREE(ipc_username);
1000         SAFE_FREE(ipc_domain);
1001         SAFE_FREE(ipc_password);
1002 
1003         if (!NT_STATUS_IS_OK(result)) {
1004                 winbind_add_failed_connection_entry(domain, controller, result);
1005                 if ((*cli) != NULL) {
1006                         cli_shutdown(*cli);
1007                         *cli = NULL;
1008                 }
1009         }
1010 
1011         return result;
1012 }
1013 
1014 /*******************************************************************
1015  Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1016  array.
1017 
1018  Keeps the list unique by not adding duplicate entries.
1019 
1020  @param[in] mem_ctx talloc memory context to allocate from
1021  @param[in] domain_name domain of the DC
1022  @param[in] dcname name of the DC to add to the list
1023  @param[in] pss Internet address and port pair to add to the list
1024  @param[in,out] dcs array of dc_name_ip structures to add to
1025  @param[in,out] num_dcs number of dcs returned in the dcs array
1026  @return true if the list was added to, false otherwise
1027 *******************************************************************/
1028 
1029 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
     /* [<][>][^][v][top][bottom][index][help] */
1030                               const char *dcname, struct sockaddr_storage *pss,
1031                               struct dc_name_ip **dcs, int *num)
1032 {
1033         int i = 0;
1034 
1035         if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1036                 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1037                 return False;
1038         }
1039 
1040         /* Make sure there's no duplicates in the list */
1041         for (i=0; i<*num; i++)
1042                 if (sockaddr_equal((struct sockaddr *)&(*dcs)[i].ss, (struct sockaddr *)pss))
1043                         return False;
1044 
1045         *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1046 
1047         if (*dcs == NULL)
1048                 return False;
1049 
1050         fstrcpy((*dcs)[*num].name, dcname);
1051         (*dcs)[*num].ss = *pss;
1052         *num += 1;
1053         return True;
1054 }
1055 
1056 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
     /* [<][>][^][v][top][bottom][index][help] */
1057                                   struct sockaddr_storage *pss, uint16 port,
1058                                   struct sockaddr_storage **addrs, int *num)
1059 {
1060         *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1061 
1062         if (*addrs == NULL) {
1063                 *num = 0;
1064                 return False;
1065         }
1066 
1067         (*addrs)[*num] = *pss;
1068         set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1069 
1070         *num += 1;
1071         return True;
1072 }
1073 
1074 /*******************************************************************
1075  convert an ip to a name
1076 *******************************************************************/
1077 
1078 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
     /* [<][>][^][v][top][bottom][index][help] */
1079                 const struct winbindd_domain *domain,
1080                 struct sockaddr_storage *pss,
1081                 fstring name )
1082 {
1083         struct ip_service ip_list;
1084         uint32_t nt_version = NETLOGON_NT_VERSION_1;
1085 
1086         ip_list.ss = *pss;
1087         ip_list.port = 0;
1088 
1089 #ifdef WITH_ADS
1090         /* For active directory servers, try to get the ldap server name.
1091            None of these failures should be considered critical for now */
1092 
1093         if (lp_security() == SEC_ADS) {
1094                 ADS_STRUCT *ads;
1095                 ADS_STATUS ads_status;
1096                 char addr[INET6_ADDRSTRLEN];
1097 
1098                 print_sockaddr(addr, sizeof(addr), pss);
1099 
1100                 ads = ads_init(domain->alt_name, domain->name, addr);
1101                 ads->auth.flags |= ADS_AUTH_NO_BIND;
1102 
1103                 ads_status = ads_connect(ads);
1104                 if (ADS_ERR_OK(ads_status)) {
1105                         /* We got a cldap packet. */
1106                         fstrcpy(name, ads->config.ldap_server_name);
1107                         namecache_store(name, 0x20, 1, &ip_list);
1108 
1109                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1110 
1111                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1112                                 if (ads_closest_dc(ads)) {
1113                                         char *sitename = sitename_fetch(ads->config.realm);
1114 
1115                                         /* We're going to use this KDC for this realm/domain.
1116                                            If we are using sites, then force the krb5 libs
1117                                            to use this KDC. */
1118 
1119                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1120                                                                         domain->name,
1121                                                                         sitename,
1122                                                                         pss);
1123 
1124                                         SAFE_FREE(sitename);
1125                                 } else {
1126                                         /* use an off site KDC */
1127                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1128                                                                         domain->name,
1129                                                                         NULL,
1130                                                                         pss);
1131                                 }
1132                                 winbindd_set_locator_kdc_envs(domain);
1133 
1134                                 /* Ensure we contact this DC also. */
1135                                 saf_store( domain->name, name);
1136                                 saf_store( domain->alt_name, name);
1137                         }
1138 
1139                         ads_destroy( &ads );
1140                         return True;
1141                 }
1142 
1143                 ads_destroy( &ads );
1144         }
1145 #endif
1146 
1147         /* try GETDC requests next */
1148 
1149         if (send_getdc_request(mem_ctx, winbind_messaging_context(),
1150                                pss, domain->name, &domain->sid,
1151                                nt_version)) {
1152                 const char *dc_name = NULL;
1153                 int i;
1154                 smb_msleep(100);
1155                 for (i=0; i<5; i++) {
1156                         if (receive_getdc_response(mem_ctx, pss, domain->name,
1157                                                    &nt_version,
1158                                                    &dc_name, NULL)) {
1159                                 fstrcpy(name, dc_name);
1160                                 namecache_store(name, 0x20, 1, &ip_list);
1161                                 return True;
1162                         }
1163                         smb_msleep(500);
1164                 }
1165         }
1166 
1167         /* try node status request */
1168 
1169         if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1170                 namecache_store(name, 0x20, 1, &ip_list);
1171                 return True;
1172         }
1173         return False;
1174 }
1175 
1176 /*******************************************************************
1177  Retrieve a list of IP addresses for domain controllers.
1178 
1179  The array is sorted in the preferred connection order.
1180 
1181  @param[in] mem_ctx talloc memory context to allocate from
1182  @param[in] domain domain to retrieve DCs for
1183  @param[out] dcs array of dcs that will be returned
1184  @param[out] num_dcs number of dcs returned in the dcs array
1185  @return always true
1186 *******************************************************************/
1187 
1188 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
1189                     struct dc_name_ip **dcs, int *num_dcs)
1190 {
1191         fstring dcname;
1192         struct  sockaddr_storage ss;
1193         struct  ip_service *ip_list = NULL;
1194         int     iplist_size = 0;
1195         int     i;
1196         bool    is_our_domain;
1197         enum security_types sec = (enum security_types)lp_security();
1198 
1199         is_our_domain = strequal(domain->name, lp_workgroup());
1200 
1201         /* If not our domain, get the preferred DC, by asking our primary DC */
1202         if ( !is_our_domain
1203                 && get_dc_name_via_netlogon(domain, dcname, &ss)
1204                 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1205                        num_dcs) )
1206         {
1207                 char addr[INET6_ADDRSTRLEN];
1208                 print_sockaddr(addr, sizeof(addr), &ss);
1209                 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1210                            dcname, addr));
1211                 return True;
1212         }
1213 
1214         if (sec == SEC_ADS) {
1215                 char *sitename = NULL;
1216 
1217                 /* We need to make sure we know the local site before
1218                    doing any DNS queries, as this will restrict the
1219                    get_sorted_dc_list() call below to only fetching
1220                    DNS records for the correct site. */
1221 
1222                 /* Find any DC to get the site record.
1223                    We deliberately don't care about the
1224                    return here. */
1225 
1226                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1227 
1228                 sitename = sitename_fetch(domain->alt_name);
1229                 if (sitename) {
1230 
1231                         /* Do the site-specific AD dns lookup first. */
1232                         get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1233                                &iplist_size, True);
1234 
1235                         /* Add ips to the DC array.  We don't look up the name
1236                            of the DC in this function, but we fill in the char*
1237                            of the ip now to make the failed connection cache
1238                            work */
1239                         for ( i=0; i<iplist_size; i++ ) {
1240                                 char addr[INET6_ADDRSTRLEN];
1241                                 print_sockaddr(addr, sizeof(addr),
1242                                                 &ip_list[i].ss);
1243                                 add_one_dc_unique(mem_ctx,
1244                                                 domain->name,
1245                                                 addr,
1246                                                 &ip_list[i].ss,
1247                                                 dcs,
1248                                                 num_dcs);
1249                         }
1250 
1251                         SAFE_FREE(ip_list);
1252                         SAFE_FREE(sitename);
1253                         iplist_size = 0;
1254                 }
1255 
1256                 /* Now we add DCs from the main AD DNS lookup. */
1257                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1258                         &iplist_size, True);
1259 
1260                 for ( i=0; i<iplist_size; i++ ) {
1261                         char addr[INET6_ADDRSTRLEN];
1262                         print_sockaddr(addr, sizeof(addr),
1263                                         &ip_list[i].ss);
1264                         add_one_dc_unique(mem_ctx,
1265                                         domain->name,
1266                                         addr,
1267                                         &ip_list[i].ss,
1268                                         dcs,
1269                                         num_dcs);
1270                 }
1271 
1272                 SAFE_FREE(ip_list);
1273                 iplist_size = 0;
1274         }
1275 
1276         /* Try standard netbios queries if no ADS */
1277         if (*num_dcs == 0) {
1278                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1279                        False);
1280 
1281                 for ( i=0; i<iplist_size; i++ ) {
1282                         char addr[INET6_ADDRSTRLEN];
1283                         print_sockaddr(addr, sizeof(addr),
1284                                         &ip_list[i].ss);
1285                         add_one_dc_unique(mem_ctx,
1286                                         domain->name,
1287                                         addr,
1288                                         &ip_list[i].ss,
1289                                         dcs,
1290                                         num_dcs);
1291                 }
1292 
1293                 SAFE_FREE(ip_list);
1294                 iplist_size = 0;
1295         }
1296 
1297         return True;
1298 }
1299 
1300 /*******************************************************************
1301  Find and make a connection to a DC in the given domain.
1302 
1303  @param[in] mem_ctx talloc memory context to allocate from
1304  @param[in] domain domain to find a dc in
1305  @param[out] dcname NetBIOS or FQDN of DC that's connected to
1306  @param[out] pss DC Internet address and port
1307  @param[out] fd fd of the open socket connected to the newly found dc
1308  @return true when a DC connection is made, false otherwise
1309 *******************************************************************/
1310 
1311 static bool find_new_dc(TALLOC_CTX *mem_ctx,
     /* [<][>][^][v][top][bottom][index][help] */
1312                         struct winbindd_domain *domain,
1313                         fstring dcname, struct sockaddr_storage *pss, int *fd)
1314 {
1315         struct dc_name_ip *dcs = NULL;
1316         int num_dcs = 0;
1317 
1318         const char **dcnames = NULL;
1319         int num_dcnames = 0;
1320 
1321         struct sockaddr_storage *addrs = NULL;
1322         int num_addrs = 0;
1323 
1324         int i, fd_index;
1325 
1326         *fd = -1;
1327 
1328  again:
1329         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1330                 return False;
1331 
1332         for (i=0; i<num_dcs; i++) {
1333 
1334                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1335                                     &dcnames, &num_dcnames)) {
1336                         return False;
1337                 }
1338                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
1339                                       &addrs, &num_addrs)) {
1340                         return False;
1341                 }
1342 
1343                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1344                                     &dcnames, &num_dcnames)) {
1345                         return False;
1346                 }
1347                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 139,
1348                                       &addrs, &num_addrs)) {
1349                         return False;
1350                 }
1351         }
1352 
1353         if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1354                 return False;
1355 
1356         if ((addrs == NULL) || (dcnames == NULL))
1357                 return False;
1358 
1359         /* 5 second timeout. */
1360         if (!open_any_socket_out(addrs, num_addrs, 5000, &fd_index, fd) ) {
1361                 for (i=0; i<num_dcs; i++) {
1362                         char ab[INET6_ADDRSTRLEN];
1363                         print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1364                         DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1365                                 "domain %s address %s. Error was %s\n",
1366                                 domain->name, ab, strerror(errno) ));
1367                         winbind_add_failed_connection_entry(domain,
1368                                 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1369                 }
1370                 return False;
1371         }
1372 
1373         *pss = addrs[fd_index];
1374 
1375         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1376                 /* Ok, we've got a name for the DC */
1377                 fstrcpy(dcname, dcnames[fd_index]);
1378                 return True;
1379         }
1380 
1381         /* Try to figure out the name */
1382         if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1383                 return True;
1384         }
1385 
1386         /* We can not continue without the DC's name */
1387         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1388                                     NT_STATUS_UNSUCCESSFUL);
1389 
1390         /* Throw away all arrays as we're doing this again. */
1391         TALLOC_FREE(dcs);
1392         num_dcs = 0;
1393 
1394         TALLOC_FREE(dcnames);
1395         num_dcnames = 0;
1396 
1397         TALLOC_FREE(addrs);
1398         num_addrs = 0;
1399 
1400         close(*fd);
1401         *fd = -1;
1402 
1403         goto again;
1404 }
1405 
1406 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
1407                                    struct winbindd_cm_conn *new_conn)
1408 {
1409         TALLOC_CTX *mem_ctx;
1410         NTSTATUS result;
1411         char *saf_servername = saf_fetch( domain->name );
1412         int retries;
1413 
1414         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1415                 SAFE_FREE(saf_servername);
1416                 set_domain_offline(domain);
1417                 return NT_STATUS_NO_MEMORY;
1418         }
1419 
1420         /* we have to check the server affinity cache here since 
1421            later we selecte a DC based on response time and not preference */
1422 
1423         /* Check the negative connection cache
1424            before talking to it. It going down may have
1425            triggered the reconnection. */
1426 
1427         if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1428 
1429                 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1430                         saf_servername, domain->name ));
1431 
1432                 /* convert an ip address to a name */
1433                 if (is_ipaddress( saf_servername ) ) {
1434                         fstring saf_name;
1435                         struct sockaddr_storage ss;
1436 
1437                         if (!interpret_string_addr(&ss, saf_servername,
1438                                                 AI_NUMERICHOST)) {
1439                                 return NT_STATUS_UNSUCCESSFUL;
1440                         }
1441                         if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1442                                 fstrcpy( domain->dcname, saf_name );
1443                         } else {
1444                                 winbind_add_failed_connection_entry(
1445                                         domain, saf_servername,
1446                                         NT_STATUS_UNSUCCESSFUL);
1447                         }
1448                 } else {
1449                         fstrcpy( domain->dcname, saf_servername );
1450                 }
1451 
1452                 SAFE_FREE( saf_servername );
1453         }
1454 
1455         for (retries = 0; retries < 3; retries++) {
1456                 int fd = -1;
1457                 bool retry = False;
1458 
1459                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1460 
1461                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1462                         domain->dcname, domain->name ));
1463 
1464                 if (*domain->dcname 
1465                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1466                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20)))
1467                 {
1468                         struct sockaddr_storage *addrs = NULL;
1469                         int num_addrs = 0;
1470                         int dummy = 0;
1471 
1472                         if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 445, &addrs, &num_addrs)) {
1473                                 set_domain_offline(domain);
1474                                 talloc_destroy(mem_ctx);
1475                                 return NT_STATUS_NO_MEMORY;
1476                         }
1477                         if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 139, &addrs, &num_addrs)) {
1478                                 set_domain_offline(domain);
1479                                 talloc_destroy(mem_ctx);
1480                                 return NT_STATUS_NO_MEMORY;
1481                         }
1482 
1483                         /* 5 second timeout. */
1484                         if (!open_any_socket_out(addrs, num_addrs, 5000, &dummy, &fd)) {
1485                                 fd = -1;
1486                         }
1487                 }
1488 
1489                 if ((fd == -1) 
1490                         && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1491                 {
1492                         /* This is the one place where we will
1493                            set the global winbindd offline state
1494                            to true, if a "WINBINDD_OFFLINE" entry
1495                            is found in the winbindd cache. */
1496                         set_global_winbindd_state_offline();
1497                         break;
1498                 }
1499 
1500                 new_conn->cli = NULL;
1501 
1502                 result = cm_prepare_connection(domain, fd, domain->dcname,
1503                         &new_conn->cli, &retry);
1504 
1505                 if (!retry)
1506                         break;
1507         }
1508 
1509         if (NT_STATUS_IS_OK(result)) {
1510 
1511                 winbindd_set_locator_kdc_envs(domain);
1512 
1513                 if (domain->online == False) {
1514                         /* We're changing state from offline to online. */
1515                         set_global_winbindd_state_online();
1516                 }
1517                 set_domain_online(domain);
1518         } else {
1519                 /* Ensure we setup the retry handler. */
1520                 set_domain_offline(domain);
1521         }
1522 
1523         talloc_destroy(mem_ctx);
1524         return result;
1525 }
1526 
1527 /* Close down all open pipes on a connection. */
1528 
1529 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
     /* [<][>][^][v][top][bottom][index][help] */
1530 {
1531         /* We're closing down a possibly dead
1532            connection. Don't have impossibly long (10s) timeouts. */
1533 
1534         if (conn->cli) {
1535                 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1536         }
1537 
1538         if (conn->samr_pipe != NULL) {
1539                 TALLOC_FREE(conn->samr_pipe);
1540                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1541                 if (conn->cli) {
1542                         cli_set_timeout(conn->cli, 500);
1543                 }
1544         }
1545 
1546         if (conn->lsa_pipe != NULL) {
1547                 TALLOC_FREE(conn->lsa_pipe);
1548                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1549                 if (conn->cli) {
1550                         cli_set_timeout(conn->cli, 500);
1551                 }
1552         }
1553 
1554         if (conn->lsa_pipe_tcp != NULL) {
1555                 TALLOC_FREE(conn->lsa_pipe_tcp);
1556                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1557                 if (conn->cli) {
1558                         cli_set_timeout(conn->cli, 500);
1559                 }
1560         }
1561 
1562         if (conn->netlogon_pipe != NULL) {
1563                 TALLOC_FREE(conn->netlogon_pipe);
1564                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1565                 if (conn->cli) {
1566                         cli_set_timeout(conn->cli, 500);
1567                 }
1568         }
1569 
1570         if (conn->cli) {
1571                 cli_shutdown(conn->cli);
1572         }
1573 
1574         conn->cli = NULL;
1575 }
1576 
1577 void close_conns_after_fork(void)
     /* [<][>][^][v][top][bottom][index][help] */
1578 {
1579         struct winbindd_domain *domain;
1580 
1581         for (domain = domain_list(); domain; domain = domain->next) {
1582                 if (domain->conn.cli == NULL)
1583                         continue;
1584 
1585                 if (domain->conn.cli->fd == -1)
1586                         continue;
1587 
1588                 close(domain->conn.cli->fd);
1589                 domain->conn.cli->fd = -1;
1590         }
1591 }
1592 
1593 static bool connection_ok(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
1594 {
1595         if (domain->conn.cli == NULL) {
1596                 DEBUG(8, ("connection_ok: Connection to %s for domain %s has NULL "
1597                           "cli!\n", domain->dcname, domain->name));
1598                 return False;
1599         }
1600 
1601         if (!domain->conn.cli->initialised) {
1602                 DEBUG(3, ("connection_ok: Connection to %s for domain %s was never "
1603                           "initialised!\n", domain->dcname, domain->name));
1604                 return False;
1605         }
1606 
1607         if (domain->conn.cli->fd == -1) {
1608                 DEBUG(3, ("connection_ok: Connection to %s for domain %s has died or was "
1609                           "never started (fd == -1)\n", 
1610                           domain->dcname, domain->name));
1611                 return False;
1612         }
1613 
1614         if (domain->online == False) {
1615                 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1616                 return False;
1617         }
1618 
1619         return True;
1620 }
1621 
1622 /* Initialize a new connection up to the RPC BIND.
1623    Bypass online status check so always does network calls. */
1624 
1625 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
1626 {
1627         NTSTATUS result;
1628 
1629         /* Internal connections never use the network. */
1630         if (domain->internal) {
1631                 domain->initialized = True;
1632                 return NT_STATUS_OK;
1633         }
1634 
1635         if (connection_ok(domain)) {
1636                 if (!domain->initialized) {
1637                         set_dc_type_and_flags(domain);
1638                 }
1639                 return NT_STATUS_OK;
1640         }
1641 
1642         invalidate_cm_connection(&domain->conn);
1643 
1644         result = cm_open_connection(domain, &domain->conn);
1645 
1646         if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1647                 set_dc_type_and_flags(domain);
1648         }
1649 
1650         return result;
1651 }
1652 
1653 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
     /* [<][>][^][v][top][bottom][index][help] */
1654 {
1655         if (domain->initialized && !domain->online) {
1656                 /* We check for online status elsewhere. */
1657                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1658         }
1659 
1660         return init_dc_connection_network(domain);
1661 }
1662 
1663 /******************************************************************************
1664  Set the trust flags (direction and forest location) for a domain
1665 ******************************************************************************/
1666 
1667 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
     /* [<][>][^][v][top][bottom][index][help] */
1668 {
1669         struct winbindd_domain *our_domain;
1670         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1671         struct netr_DomainTrustList trusts;
1672         int i;
1673         uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1674                         NETR_TRUST_FLAG_OUTBOUND |
1675                         NETR_TRUST_FLAG_INBOUND);
1676         struct rpc_pipe_client *cli;
1677         TALLOC_CTX *mem_ctx = NULL;
1678 
1679         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1680 
1681         /* Our primary domain doesn't need to worry about trust flags.
1682            Force it to go through the network setup */
1683         if ( domain->primary ) {                
1684                 return False;           
1685         }
1686 
1687         our_domain = find_our_domain();
1688 
1689         if ( !connection_ok(our_domain) ) {
1690                 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));           
1691                 return False;
1692         }
1693 
1694         /* This won't work unless our domain is AD */
1695 
1696         if ( !our_domain->active_directory ) {
1697                 return False;
1698         }
1699 
1700         /* Use DsEnumerateDomainTrusts to get us the trust direction
1701            and type */
1702 
1703         result = cm_connect_netlogon(our_domain, &cli);
1704 
1705         if (!NT_STATUS_IS_OK(result)) {
1706                 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1707                           "a connection to %s for PIPE_NETLOGON (%s)\n", 
1708                           domain->name, nt_errstr(result)));
1709                 return False;
1710         }
1711 
1712         if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1713                 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1714                 return False;
1715         }       
1716 
1717         result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1718                                                       cli->desthost,
1719                                                       flags,
1720                                                       &trusts,
1721                                                       NULL);
1722         if (!NT_STATUS_IS_OK(result)) {
1723                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1724                         "failed to query trusted domain list: %s\n",
1725                         nt_errstr(result)));
1726                 talloc_destroy(mem_ctx);
1727                 return false;
1728         }
1729 
1730         /* Now find the domain name and get the flags */
1731 
1732         for ( i=0; i<trusts.count; i++ ) {
1733                 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1734                         domain->domain_flags          = trusts.array[i].trust_flags;
1735                         domain->domain_type           = trusts.array[i].trust_type;
1736                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
1737 
1738                         if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1739                                 domain->active_directory = True;
1740 
1741                         /* This flag is only set if the domain is *our* 
1742                            primary domain and the primary domain is in
1743                            native mode */
1744 
1745                         domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1746 
1747                         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1748                                   "native mode.\n", domain->name, 
1749                                   domain->native_mode ? "" : "NOT "));
1750 
1751                         DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1752                                  "running active directory.\n", domain->name, 
1753                                  domain->active_directory ? "" : "NOT "));
1754 
1755 
1756                         domain->initialized = True;
1757 
1758                         if ( !winbindd_can_contact_domain( domain) )
1759                                 domain->internal = True;
1760 
1761                         break;
1762                 }               
1763         }
1764 
1765         talloc_destroy( mem_ctx );
1766 
1767         return domain->initialized;     
1768 }
1769 
1770 /******************************************************************************
1771  We can 'sense' certain things about the DC by it's replies to certain
1772  questions.
1773 
1774  This tells us if this particular remote server is Active Directory, and if it
1775  is native mode.
1776 ******************************************************************************/
1777 
1778 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
     /* [<][>][^][v][top][bottom][index][help] */
1779 {
1780         NTSTATUS                result;
1781         WERROR werr;
1782         TALLOC_CTX              *mem_ctx = NULL;
1783         struct rpc_pipe_client  *cli = NULL;
1784         struct policy_handle pol;
1785         union dssetup_DsRoleInfo info;
1786         union lsa_PolicyInformation *lsa_info = NULL;
1787 
1788         if (!connection_ok(domain)) {
1789                 return;
1790         }
1791 
1792         mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1793                               domain->name);
1794         if (!mem_ctx) {
1795                 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1796                 return;
1797         }
1798 
1799         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1800 
1801         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1802                                           &ndr_table_dssetup.syntax_id,
1803                                           &cli);
1804 
1805         if (!NT_STATUS_IS_OK(result)) {
1806                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1807                           "PI_DSSETUP on domain %s: (%s)\n",
1808                           domain->name, nt_errstr(result)));
1809 
1810                 /* if this is just a non-AD domain we need to continue
1811                  * identifying so that we can in the end return with
1812                  * domain->initialized = True - gd */
1813 
1814                 goto no_dssetup;
1815         }
1816 
1817         result = rpccli_dssetup_DsRoleGetPrimaryDomainInformation(cli, mem_ctx,
1818                                                                   DS_ROLE_BASIC_INFORMATION,
1819                                                                   &info,
1820                                                                   &werr);
1821         TALLOC_FREE(cli);
1822 
1823         if (!NT_STATUS_IS_OK(result)) {
1824                 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1825                           "on domain %s failed: (%s)\n",
1826                           domain->name, nt_errstr(result)));
1827 
1828                 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1829                  * every opcode on the DSSETUP pipe, continue with
1830                  * no_dssetup mode here as well to get domain->initialized
1831                  * set - gd */
1832 
1833                 if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
1834                         goto no_dssetup;
1835                 }
1836 
1837                 TALLOC_FREE(mem_ctx);
1838                 return;
1839         }
1840 
1841         if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
1842             !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
1843                 domain->native_mode = True;
1844         } else {
1845                 domain->native_mode = False;
1846         }
1847 
1848 no_dssetup:
1849         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1850                                           &ndr_table_lsarpc.syntax_id, &cli);
1851 
1852         if (!NT_STATUS_IS_OK(result)) {
1853                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1854                           "PI_LSARPC on domain %s: (%s)\n",
1855                           domain->name, nt_errstr(result)));
1856                 TALLOC_FREE(cli);
1857                 TALLOC_FREE(mem_ctx);
1858                 return;
1859         }
1860 
1861         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, 
1862                                          SEC_FLAG_MAXIMUM_ALLOWED, &pol);
1863 
1864         if (NT_STATUS_IS_OK(result)) {
1865                 /* This particular query is exactly what Win2k clients use 
1866                    to determine that the DC is active directory */
1867                 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
1868                                                      &pol,
1869                                                      LSA_POLICY_INFO_DNS,
1870                                                      &lsa_info);
1871         }
1872 
1873         if (NT_STATUS_IS_OK(result)) {
1874                 domain->active_directory = True;
1875 
1876                 if (lsa_info->dns.name.string) {
1877                         fstrcpy(domain->name, lsa_info->dns.name.string);
1878                 }
1879 
1880                 if (lsa_info->dns.dns_domain.string) {
1881                         fstrcpy(domain->alt_name,
1882                                 lsa_info->dns.dns_domain.string);
1883                 }
1884 
1885                 /* See if we can set some domain trust flags about
1886                    ourself */
1887 
1888                 if (lsa_info->dns.dns_forest.string) {
1889                         fstrcpy(domain->forest_name,
1890                                 lsa_info->dns.dns_forest.string);
1891 
1892                         if (strequal(domain->forest_name, domain->alt_name)) {
1893                                 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
1894                         }
1895                 }
1896 
1897                 if (lsa_info->dns.sid) {
1898                         sid_copy(&domain->sid, lsa_info->dns.sid);
1899                 }
1900         } else {
1901                 domain->active_directory = False;
1902 
1903                 result = rpccli_lsa_open_policy(cli, mem_ctx, True, 
1904                                                 SEC_FLAG_MAXIMUM_ALLOWED,
1905                                                 &pol);
1906 
1907                 if (!NT_STATUS_IS_OK(result)) {
1908                         goto done;
1909                 }
1910 
1911                 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
1912                                                     &pol,
1913                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1914                                                     &lsa_info);
1915 
1916                 if (NT_STATUS_IS_OK(result)) {
1917 
1918                         if (lsa_info->account_domain.name.string) {
1919                                 fstrcpy(domain->name,
1920                                         lsa_info->account_domain.name.string);
1921                         }
1922 
1923                         if (lsa_info->account_domain.sid) {
1924                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
1925                         }
1926                 }
1927         }
1928 done:
1929 
1930         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1931                   domain->name, domain->native_mode ? "" : "NOT "));
1932 
1933         DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1934                   domain->name, domain->active_directory ? "" : "NOT "));
1935 
1936         domain->can_do_ncacn_ip_tcp = domain->active_directory;
1937 
1938         TALLOC_FREE(cli);
1939 
1940         TALLOC_FREE(mem_ctx);
1941 
1942         domain->initialized = True;
1943 }
1944 
1945 /**********************************************************************
1946  Set the domain_flags (trust attributes, domain operating modes, etc... 
1947 ***********************************************************************/
1948 
1949 static void set_dc_type_and_flags( struct winbindd_domain *domain )
     /* [<][>][^][v][top][bottom][index][help] */
1950 {
1951         /* we always have to contact our primary domain */
1952 
1953         if ( domain->primary ) {
1954                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1955                           "primary domain\n"));
1956                 set_dc_type_and_flags_connect( domain );
1957                 return;         
1958         }
1959 
1960         /* Use our DC to get the information if possible */
1961 
1962         if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
1963                 /* Otherwise, fallback to contacting the 
1964                    domain directly */
1965                 set_dc_type_and_flags_connect( domain );
1966         }
1967 
1968         return;
1969 }
1970 
1971 
1972 
1973 /**********************************************************************
1974 ***********************************************************************/
1975 
1976 static bool cm_get_schannel_dcinfo(struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
1977                                    struct dcinfo **ppdc)
1978 {
1979         NTSTATUS result;
1980         struct rpc_pipe_client *netlogon_pipe;
1981 
1982         if (lp_client_schannel() == False) {
1983                 return False;
1984         }
1985 
1986         result = cm_connect_netlogon(domain, &netlogon_pipe);
1987         if (!NT_STATUS_IS_OK(result)) {
1988                 return False;
1989         }
1990 
1991         /* Return a pointer to the struct dcinfo from the
1992            netlogon pipe. */
1993 
1994         if (!domain->conn.netlogon_pipe->dc) {
1995                 return false;
1996         }
1997 
1998         *ppdc = domain->conn.netlogon_pipe->dc;
1999         return True;
2000 }
2001 
2002 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
     /* [<][>][^][v][top][bottom][index][help] */
2003                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2004 {
2005         struct winbindd_cm_conn *conn;
2006         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2007         struct dcinfo *p_dcinfo;
2008         char *machine_password = NULL;
2009         char *machine_account = NULL;
2010         char *domain_name = NULL;
2011 
2012         result = init_dc_connection(domain);
2013         if (!NT_STATUS_IS_OK(result)) {
2014                 return result;
2015         }
2016 
2017         conn = &domain->conn;
2018 
2019         if (conn->samr_pipe != NULL) {
2020                 goto done;
2021         }
2022 
2023 
2024         /*
2025          * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2026          * sign and sealed pipe using the machine account password by
2027          * preference. If we can't - try schannel, if that fails, try
2028          * anonymous.
2029          */
2030 
2031         if ((conn->cli->user_name[0] == '\0') ||
2032             (conn->cli->domain[0] == '\0') || 
2033             (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2034         {
2035                 result = get_trust_creds(domain, &machine_password,
2036                                          &machine_account, NULL);
2037                 if (!NT_STATUS_IS_OK(result)) {
2038                         DEBUG(10, ("cm_connect_sam: No no user available for "
2039                                    "domain %s, trying schannel\n", conn->cli->domain));
2040                         goto schannel;
2041                 }
2042                 domain_name = domain->name;
2043         } else {
2044                 machine_password = SMB_STRDUP(conn->cli->password);
2045                 machine_account = SMB_STRDUP(conn->cli->user_name);
2046                 domain_name = conn->cli->domain;
2047         }
2048 
2049         if (!machine_password || !machine_account) {
2050                 result = NT_STATUS_NO_MEMORY;
2051                 goto done;
2052         }
2053 
2054         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2055            authenticated SAMR pipe with sign & seal. */
2056         result = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
2057                                                   &ndr_table_samr.syntax_id,
2058                                                   NCACN_NP,
2059                                                   PIPE_AUTH_LEVEL_PRIVACY,
2060                                                   domain_name,
2061                                                   machine_account,
2062                                                   machine_password,
2063                                                   &conn->samr_pipe);
2064 
2065         if (!NT_STATUS_IS_OK(result)) {
2066                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2067                           "pipe for domain %s using NTLMSSP "
2068                           "authenticated pipe: user %s\\%s. Error was "
2069                           "%s\n", domain->name, domain_name,
2070                           machine_account, nt_errstr(result)));
2071                 goto schannel;
2072         }
2073 
2074         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2075                   "domain %s using NTLMSSP authenticated "
2076                   "pipe: user %s\\%s\n", domain->name,
2077                   domain_name, machine_account));
2078 
2079         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2080                                       conn->samr_pipe->desthost,
2081                                       SEC_FLAG_MAXIMUM_ALLOWED,
2082                                       &conn->sam_connect_handle);
2083         if (NT_STATUS_IS_OK(result)) {
2084                 goto open_domain;
2085         }
2086         DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2087                   "failed for domain %s, error was %s. Trying schannel\n",
2088                   domain->name, nt_errstr(result) ));
2089         TALLOC_FREE(conn->samr_pipe);
2090 
2091  schannel:
2092 
2093         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2094 
2095         if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2096                 /* If this call fails - conn->cli can now be NULL ! */
2097                 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2098                            "for domain %s, trying anon\n", domain->name));
2099                 goto anonymous;
2100         }
2101         result = cli_rpc_pipe_open_schannel_with_key
2102                 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2103                 PIPE_AUTH_LEVEL_PRIVACY,
2104                  domain->name, p_dcinfo, &conn->samr_pipe);
2105 
2106         if (!NT_STATUS_IS_OK(result)) {
2107                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2108                           "domain %s using schannel. Error was %s\n",
2109                           domain->name, nt_errstr(result) ));
2110                 goto anonymous;
2111         }
2112         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2113                   "schannel.\n", domain->name ));
2114 
2115         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2116                                       conn->samr_pipe->desthost,
2117                                       SEC_FLAG_MAXIMUM_ALLOWED,
2118                                       &conn->sam_connect_handle);
2119         if (NT_STATUS_IS_OK(result)) {
2120                 goto open_domain;
2121         }
2122         DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2123                   "for domain %s, error was %s. Trying anonymous\n",
2124                   domain->name, nt_errstr(result) ));
2125         TALLOC_FREE(conn->samr_pipe);
2126 
2127  anonymous:
2128 
2129         /* Finally fall back to anonymous. */
2130         result = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2131                                           &conn->samr_pipe);
2132 
2133         if (!NT_STATUS_IS_OK(result)) {
2134                 goto done;
2135         }
2136 
2137         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2138                                       conn->samr_pipe->desthost,
2139                                       SEC_FLAG_MAXIMUM_ALLOWED,
2140                                       &conn->sam_connect_handle);
2141         if (!NT_STATUS_IS_OK(result)) {
2142                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2143                           "for domain %s Error was %s\n",
2144                           domain->name, nt_errstr(result) ));
2145                 goto done;
2146         }
2147 
2148  open_domain:
2149         result = rpccli_samr_OpenDomain(conn->samr_pipe,
2150                                         mem_ctx,
2151                                         &conn->sam_connect_handle,
2152                                         SEC_FLAG_MAXIMUM_ALLOWED,
2153                                         &domain->sid,
2154                                         &conn->sam_domain_handle);
2155 
2156  done:
2157 
2158         if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
2159                 /*
2160                  * if we got access denied, we might just have no access rights
2161                  * to talk to the remote samr server server (e.g. when we are a
2162                  * PDC and we are connecting a w2k8 pdc via an interdomain
2163                  * trust). In that case do not invalidate the whole connection
2164                  * stack
2165                  */
2166                 TALLOC_FREE(conn->samr_pipe);
2167                 ZERO_STRUCT(conn->sam_domain_handle);
2168                 return result;
2169         } else if (!NT_STATUS_IS_OK(result)) {
2170                 invalidate_cm_connection(conn);
2171                 return result;
2172         }
2173 
2174         *cli = conn->samr_pipe;
2175         *sam_handle = conn->sam_domain_handle;
2176         SAFE_FREE(machine_password);
2177         SAFE_FREE(machine_account);
2178         return result;
2179 }
2180 
2181 /**********************************************************************
2182  open an schanneld ncacn_ip_tcp connection to LSA
2183 ***********************************************************************/
2184 
2185 NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
2186                             TALLOC_CTX *mem_ctx,
2187                             struct rpc_pipe_client **cli)
2188 {
2189         struct winbindd_cm_conn *conn;
2190         NTSTATUS status;
2191 
2192         DEBUG(10,("cm_connect_lsa_tcp\n"));
2193 
2194         status = init_dc_connection(domain);
2195         if (!NT_STATUS_IS_OK(status)) {
2196                 return status;
2197         }
2198 
2199         conn = &domain->conn;
2200 
2201         if (conn->lsa_pipe_tcp &&
2202             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2203             conn->lsa_pipe_tcp->auth->auth_level == PIPE_AUTH_LEVEL_PRIVACY &&
2204             rpc_pipe_tcp_connection_ok(conn->lsa_pipe_tcp)) {
2205                 goto done;
2206         }
2207 
2208         TALLOC_FREE(conn->lsa_pipe_tcp);
2209 
2210         status = cli_rpc_pipe_open_schannel(conn->cli,
2211                                             &ndr_table_lsarpc.syntax_id,
2212                                             NCACN_IP_TCP,
2213                                             PIPE_AUTH_LEVEL_PRIVACY,
2214                                             domain->name,
2215                                             &conn->lsa_pipe_tcp);
2216         if (!NT_STATUS_IS_OK(status)) {
2217                 DEBUG(10,("cli_rpc_pipe_open_schannel failed: %s\n",
2218                         nt_errstr(status)));
2219                 goto done;
2220         }
2221 
2222  done:
2223         if (!NT_STATUS_IS_OK(status)) {
2224                 TALLOC_FREE(conn->lsa_pipe_tcp);
2225                 return status;
2226         }
2227 
2228         *cli = conn->lsa_pipe_tcp;
2229 
2230         return status;
2231 }
2232 
2233 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
     /* [<][>][^][v][top][bottom][index][help] */
2234                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2235 {
2236         struct winbindd_cm_conn *conn;
2237         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2238         struct dcinfo *p_dcinfo;
2239 
2240         result = init_dc_connection(domain);
2241         if (!NT_STATUS_IS_OK(result))
2242                 return result;
2243 
2244         conn = &domain->conn;
2245 
2246         if (conn->lsa_pipe != NULL) {
2247                 goto done;
2248         }
2249 
2250         if ((conn->cli->user_name[0] == '\0') ||
2251             (conn->cli->domain[0] == '\0') || 
2252             (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2253                 DEBUG(10, ("cm_connect_lsa: No no user available for "
2254                            "domain %s, trying schannel\n", conn->cli->domain));
2255                 goto schannel;
2256         }
2257 
2258         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2259          * authenticated LSA pipe with sign & seal. */
2260         result = cli_rpc_pipe_open_spnego_ntlmssp
2261                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2262                  PIPE_AUTH_LEVEL_PRIVACY,
2263                  conn->cli->domain, conn->cli->user_name, conn->cli->password,
2264                  &conn->lsa_pipe);
2265 
2266         if (!NT_STATUS_IS_OK(result)) {
2267                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2268                           "domain %s using NTLMSSP authenticated pipe: user "
2269                           "%s\\%s. Error was %s. Trying schannel.\n",
2270                           domain->name, conn->cli->domain,
2271                           conn->cli->user_name, nt_errstr(result)));
2272                 goto schannel;
2273         }
2274 
2275         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2276                   "NTLMSSP authenticated pipe: user %s\\%s\n",
2277                   domain->name, conn->cli->domain, conn->cli->user_name ));
2278 
2279         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2280                                         SEC_FLAG_MAXIMUM_ALLOWED,
2281                                         &conn->lsa_policy);
2282         if (NT_STATUS_IS_OK(result)) {
2283                 goto done;
2284         }
2285 
2286         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2287                   "schannel\n"));
2288 
2289         TALLOC_FREE(conn->lsa_pipe);
2290 
2291  schannel:
2292 
2293         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2294 
2295         if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2296                 /* If this call fails - conn->cli can now be NULL ! */
2297                 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2298                            "for domain %s, trying anon\n", domain->name));
2299                 goto anonymous;
2300         }
2301         result = cli_rpc_pipe_open_schannel_with_key
2302                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2303                  PIPE_AUTH_LEVEL_PRIVACY,
2304                  domain->name, p_dcinfo, &conn->lsa_pipe);
2305 
2306         if (!NT_STATUS_IS_OK(result)) {
2307                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2308                           "domain %s using schannel. Error was %s\n",
2309                           domain->name, nt_errstr(result) ));
2310                 goto anonymous;
2311         }
2312         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2313                   "schannel.\n", domain->name ));
2314 
2315         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2316                                         SEC_FLAG_MAXIMUM_ALLOWED,
2317                                         &conn->lsa_policy);
2318         if (NT_STATUS_IS_OK(result)) {
2319                 goto done;
2320         }
2321 
2322         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2323                   "anonymous\n"));
2324 
2325         TALLOC_FREE(conn->lsa_pipe);
2326 
2327  anonymous:
2328 
2329         result = cli_rpc_pipe_open_noauth(conn->cli,
2330                                           &ndr_table_lsarpc.syntax_id,
2331                                           &conn->lsa_pipe);
2332         if (!NT_STATUS_IS_OK(result)) {
2333                 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2334                 goto done;
2335         }
2336 
2337         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2338                                         SEC_FLAG_MAXIMUM_ALLOWED,
2339                                         &conn->lsa_policy);
2340  done:
2341         if (!NT_STATUS_IS_OK(result)) {
2342                 invalidate_cm_connection(conn);
2343                 return result;
2344         }
2345 
2346         *cli = conn->lsa_pipe;
2347         *lsa_policy = conn->lsa_policy;
2348         return result;
2349 }
2350 
2351 /****************************************************************************
2352  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2353  session key stored in conn->netlogon_pipe->dc->sess_key.
2354 ****************************************************************************/
2355 
2356 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
     /* [<][>][^][v][top][bottom][index][help] */
2357                              struct rpc_pipe_client **cli)
2358 {
2359         struct winbindd_cm_conn *conn;
2360         NTSTATUS result;
2361 
2362         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2363         uint8  mach_pwd[16];
2364         uint32  sec_chan_type;
2365         const char *account_name;
2366         struct rpc_pipe_client *netlogon_pipe = NULL;
2367 
2368         *cli = NULL;
2369 
2370         result = init_dc_connection(domain);
2371         if (!NT_STATUS_IS_OK(result)) {
2372                 return result;
2373         }
2374 
2375         conn = &domain->conn;
2376 
2377         if (conn->netlogon_pipe != NULL) {
2378                 *cli = conn->netlogon_pipe;
2379                 return NT_STATUS_OK;
2380         }
2381 
2382         result = cli_rpc_pipe_open_noauth(conn->cli,
2383                                           &ndr_table_netlogon.syntax_id,
2384                                           &netlogon_pipe);
2385         if (!NT_STATUS_IS_OK(result)) {
2386                 return result;
2387         }
2388 
2389         if ((!IS_DC) && (!domain->primary)) {
2390                 /* Clear the schannel request bit and drop down */
2391                 neg_flags &= ~NETLOGON_NEG_SCHANNEL;            
2392                 goto no_schannel;
2393         }
2394 
2395         if (lp_client_schannel() != False) {
2396                 neg_flags |= NETLOGON_NEG_SCHANNEL;
2397         }
2398 
2399         if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2400                                &sec_chan_type))
2401         {
2402                 TALLOC_FREE(netlogon_pipe);
2403                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2404         }
2405 
2406         result = rpccli_netlogon_setup_creds(
2407                  netlogon_pipe,
2408                  domain->dcname, /* server name. */
2409                  domain->name,   /* domain name */
2410                  global_myname(), /* client name */
2411                  account_name,   /* machine account */
2412                  mach_pwd,       /* machine password */
2413                  sec_chan_type,  /* from get_trust_pw */
2414                  &neg_flags);
2415 
2416         if (!NT_STATUS_IS_OK(result)) {
2417                 TALLOC_FREE(netlogon_pipe);
2418                 return result;
2419         }
2420 
2421         if ((lp_client_schannel() == True) &&
2422                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2423                 DEBUG(3, ("Server did not offer schannel\n"));
2424                 TALLOC_FREE(netlogon_pipe);
2425                 return NT_STATUS_ACCESS_DENIED;
2426         }
2427 
2428  no_schannel:
2429         if ((lp_client_schannel() == False) ||
2430                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2431                 /*
2432                  * NetSamLogonEx only works for schannel
2433                  */
2434                 domain->can_do_samlogon_ex = False;
2435 
2436                 /* We're done - just keep the existing connection to NETLOGON
2437                  * open */
2438                 conn->netlogon_pipe = netlogon_pipe;
2439                 *cli = conn->netlogon_pipe;
2440                 return NT_STATUS_OK;
2441         }
2442 
2443         /* Using the credentials from the first pipe, open a signed and sealed
2444            second netlogon pipe. The session key is stored in the schannel
2445            part of the new pipe auth struct.
2446         */
2447 
2448         result = cli_rpc_pipe_open_schannel_with_key(
2449                 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2450                 PIPE_AUTH_LEVEL_PRIVACY, domain->name, netlogon_pipe->dc,
2451                 &conn->netlogon_pipe);
2452 
2453         /* We can now close the initial netlogon pipe. */
2454         TALLOC_FREE(netlogon_pipe);
2455 
2456         if (!NT_STATUS_IS_OK(result)) {
2457                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2458                           "was %s\n", nt_errstr(result)));
2459 
2460                 /* make sure we return something besides OK */
2461                 return !NT_STATUS_IS_OK(result) ? result : NT_STATUS_PIPE_NOT_AVAILABLE;
2462         }
2463 
2464         /*
2465          * Try NetSamLogonEx for AD domains
2466          */
2467         domain->can_do_samlogon_ex = domain->active_directory;
2468 
2469         *cli = conn->netlogon_pipe;
2470         return NT_STATUS_OK;
2471 }

/* [<][>][^][v][top][bottom][index][help] */