source: vendor/3.5.7/source3/winbindd/winbindd_cm.c

Last change on this file was 587, checked in by Herwig Bauernfeind, 14 years ago

Samba 3.5: Update vendor to version 3.5.6
File size: 69.4 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon connection manager
5
6 Copyright (C) Tim Potter 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Gerald (Jerry) Carter 2003-2005.
9 Copyright (C) Volker Lendecke 2004-2005
10 Copyright (C) Jeremy Allison 2006
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24*/
25
26/*
27 We need to manage connections to domain controllers without having to
28 mess up the main winbindd code with other issues. The aim of the
29 connection manager is to:
30
31 - make connections to domain controllers and cache them
32 - re-establish connections when networks or servers go down
33 - centralise the policy on connection timeouts, domain controller
34 selection etc
35 - manage re-entrancy for when winbindd becomes able to handle
36 multiple outstanding rpc requests
37
38 Why not have connection management as part of the rpc layer like tng?
39 Good question. This code may morph into libsmb/rpc_cache.c or something
40 like that but at the moment it's simply staying as part of winbind. I
41 think the TNG architecture of forcing every user of the rpc layer to use
42 the connection caching system is a bad idea. It should be an optional
43 method of using the routines.
44
45 The TNG design is quite good but I disagree with some aspects of the
46 implementation. -tpot
47
48 */
49
50/*
51 TODO:
52
53 - I'm pretty annoyed by all the make_nmb_name() stuff. It should be
54 moved down into another function.
55
56 - Take care when destroying cli_structs as they can be shared between
57 various sam handles.
58
59 */
60
61#include "includes.h"
62#include "winbindd.h"
63#include "../libcli/auth/libcli_auth.h"
64#include "../librpc/gen_ndr/cli_netlogon.h"
65#include "../librpc/gen_ndr/cli_samr.h"
66#include "../librpc/gen_ndr/cli_lsa.h"
67#include "../librpc/gen_ndr/cli_dssetup.h"
68
69#undef DBGC_CLASS
70#define DBGC_CLASS DBGC_WINBIND
71
72struct dc_name_ip {
73 fstring name;
74 struct sockaddr_storage ss;
75};
76
77extern struct winbindd_methods reconnect_methods;
78extern bool override_logfile;
79
80static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
81static void set_dc_type_and_flags( struct winbindd_domain *domain );
82static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
83 struct dc_name_ip **dcs, int *num_dcs);
84
85/****************************************************************
86 Child failed to find DC's. Reschedule check.
87****************************************************************/
88
89static void msg_failed_to_go_online(struct messaging_context *msg,
90 void *private_data,
91 uint32_t msg_type,
92 struct server_id server_id,
93 DATA_BLOB *data)
94{
95 struct winbindd_domain *domain;
96 const char *domainname = (const char *)data->data;
97
98 if (data->data == NULL || data->length == 0) {
99 return;
100 }
101
102 DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
103
104 for (domain = domain_list(); domain; domain = domain->next) {
105 if (domain->internal) {
106 continue;
107 }
108
109 if (strequal(domain->name, domainname)) {
110 if (domain->online) {
111 /* We're already online, ignore. */
112 DEBUG(5,("msg_fail_to_go_online: domain %s "
113 "already online.\n", domainname));
114 continue;
115 }
116
117 /* Reschedule the online check. */
118 set_domain_offline(domain);
119 break;
120 }
121 }
122}
123
124/****************************************************************
125 Actually cause a reconnect from a message.
126****************************************************************/
127
128static void msg_try_to_go_online(struct messaging_context *msg,
129 void *private_data,
130 uint32_t msg_type,
131 struct server_id server_id,
132 DATA_BLOB *data)
133{
134 struct winbindd_domain *domain;
135 const char *domainname = (const char *)data->data;
136
137 if (data->data == NULL || data->length == 0) {
138 return;
139 }
140
141 DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
142
143 for (domain = domain_list(); domain; domain = domain->next) {
144 if (domain->internal) {
145 continue;
146 }
147
148 if (strequal(domain->name, domainname)) {
149
150 if (domain->online) {
151 /* We're already online, ignore. */
152 DEBUG(5,("msg_try_to_go_online: domain %s "
153 "already online.\n", domainname));
154 continue;
155 }
156
157 /* This call takes care of setting the online
158 flag to true if we connected, or re-adding
159 the offline handler if false. Bypasses online
160 check so always does network calls. */
161
162 init_dc_connection_network(domain);
163 break;
164 }
165 }
166}
167
168/****************************************************************
169 Fork a child to try and contact a DC. Do this as contacting a
170 DC requires blocking lookups and we don't want to block our
171 parent.
172****************************************************************/
173
174static bool fork_child_dc_connect(struct winbindd_domain *domain)
175{
176 struct dc_name_ip *dcs = NULL;
177 int num_dcs = 0;
178 TALLOC_CTX *mem_ctx = NULL;
179 pid_t parent_pid = sys_getpid();
180 char *lfile = NULL;
181
182 if (domain->dc_probe_pid != (pid_t)-1) {
183 /*
184 * We might already have a DC probe
185 * child working, check.
186 */
187 if (process_exists_by_pid(domain->dc_probe_pid)) {
188 DEBUG(10,("fork_child_dc_connect: pid %u already "
189 "checking for DC's.\n",
190 (unsigned int)domain->dc_probe_pid));
191 return true;
192 }
193 domain->dc_probe_pid = (pid_t)-1;
194 }
195
196 domain->dc_probe_pid = sys_fork();
197
198 if (domain->dc_probe_pid == (pid_t)-1) {
199 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
200 return False;
201 }
202
203 if (domain->dc_probe_pid != (pid_t)0) {
204 /* Parent */
205 messaging_register(winbind_messaging_context(), NULL,
206 MSG_WINBIND_TRY_TO_GO_ONLINE,
207 msg_try_to_go_online);
208 messaging_register(winbind_messaging_context(), NULL,
209 MSG_WINBIND_FAILED_TO_GO_ONLINE,
210 msg_failed_to_go_online);
211 return True;
212 }
213
214 /* Child. */
215
216 /* Leave messages blocked - we will never process one. */
217
218 if (!override_logfile) {
219 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
220 DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
221 _exit(1);
222 }
223 }
224
225 if (!winbindd_reinit_after_fork(lfile)) {
226 messaging_send_buf(winbind_messaging_context(),
227 pid_to_procid(parent_pid),
228 MSG_WINBIND_FAILED_TO_GO_ONLINE,
229 (uint8 *)domain->name,
230 strlen(domain->name)+1);
231 _exit(1);
232 }
233 SAFE_FREE(lfile);
234
235 mem_ctx = talloc_init("fork_child_dc_connect");
236 if (!mem_ctx) {
237 DEBUG(0,("talloc_init failed.\n"));
238 messaging_send_buf(winbind_messaging_context(),
239 pid_to_procid(parent_pid),
240 MSG_WINBIND_FAILED_TO_GO_ONLINE,
241 (uint8 *)domain->name,
242 strlen(domain->name)+1);
243 _exit(1);
244 }
245
246 if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
247 /* Still offline ? Can't find DC's. */
248 messaging_send_buf(winbind_messaging_context(),
249 pid_to_procid(parent_pid),
250 MSG_WINBIND_FAILED_TO_GO_ONLINE,
251 (uint8 *)domain->name,
252 strlen(domain->name)+1);
253 _exit(0);
254 }
255
256 /* We got a DC. Send a message to our parent to get it to
257 try and do the same. */
258
259 messaging_send_buf(winbind_messaging_context(),
260 pid_to_procid(parent_pid),
261 MSG_WINBIND_TRY_TO_GO_ONLINE,
262 (uint8 *)domain->name,
263 strlen(domain->name)+1);
264 _exit(0);
265}
266
267/****************************************************************
268 Handler triggered if we're offline to try and detect a DC.
269****************************************************************/
270
271static void check_domain_online_handler(struct event_context *ctx,
272 struct timed_event *te,
273 struct timeval now,
274 void *private_data)
275{
276 struct winbindd_domain *domain =
277 (struct winbindd_domain *)private_data;
278
279 DEBUG(10,("check_domain_online_handler: called for domain "
280 "%s (online = %s)\n", domain->name,
281 domain->online ? "True" : "False" ));
282
283 TALLOC_FREE(domain->check_online_event);
284
285 /* Are we still in "startup" mode ? */
286
287 if (domain->startup && (now.tv_sec > domain->startup_time + 30)) {
288 /* No longer in "startup" mode. */
289 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
290 domain->name ));
291 domain->startup = False;
292 }
293
294 /* We've been told to stay offline, so stay
295 that way. */
296
297 if (get_global_winbindd_state_offline()) {
298 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
299 domain->name ));
300 return;
301 }
302
303 /* Fork a child to test if it can contact a DC.
304 If it can then send ourselves a message to
305 cause a reconnect. */
306
307 fork_child_dc_connect(domain);
308}
309
310/****************************************************************
311 If we're still offline setup the timeout check.
312****************************************************************/
313
314static void calc_new_online_timeout_check(struct winbindd_domain *domain)
315{
316 int wbr = lp_winbind_reconnect_delay();
317
318 if (domain->startup) {
319 domain->check_online_timeout = 10;
320 } else if (domain->check_online_timeout < wbr) {
321 domain->check_online_timeout = wbr;
322 }
323}
324
325/****************************************************************
326 Set domain offline and also add handler to put us back online
327 if we detect a DC.
328****************************************************************/
329
330void set_domain_offline(struct winbindd_domain *domain)
331{
332 DEBUG(10,("set_domain_offline: called for domain %s\n",
333 domain->name ));
334
335 TALLOC_FREE(domain->check_online_event);
336
337 if (domain->internal) {
338 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
339 domain->name ));
340 return;
341 }
342
343 domain->online = False;
344
345 /* Offline domains are always initialized. They're
346 re-initialized when they go back online. */
347
348 domain->initialized = True;
349
350 /* We only add the timeout handler that checks and
351 allows us to go back online when we've not
352 been told to remain offline. */
353
354 if (get_global_winbindd_state_offline()) {
355 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
356 domain->name ));
357 return;
358 }
359
360 /* If we're in startup mode, check again in 10 seconds, not in
361 lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
362
363 calc_new_online_timeout_check(domain);
364
365 domain->check_online_event = event_add_timed(winbind_event_context(),
366 NULL,
367 timeval_current_ofs(domain->check_online_timeout,0),
368 check_domain_online_handler,
369 domain);
370
371 /* The above *has* to succeed for winbindd to work. */
372 if (!domain->check_online_event) {
373 smb_panic("set_domain_offline: failed to add online handler");
374 }
375
376 DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
377 domain->name ));
378
379 /* Send an offline message to the idmap child when our
380 primary domain goes offline */
381
382 if ( domain->primary ) {
383 struct winbindd_child *idmap = idmap_child();
384
385 if ( idmap->pid != 0 ) {
386 messaging_send_buf(winbind_messaging_context(),
387 pid_to_procid(idmap->pid),
388 MSG_WINBIND_OFFLINE,
389 (uint8 *)domain->name,
390 strlen(domain->name)+1);
391 }
392 }
393
394 return;
395}
396
397/****************************************************************
398 Set domain online - if allowed.
399****************************************************************/
400
401static void set_domain_online(struct winbindd_domain *domain)
402{
403 DEBUG(10,("set_domain_online: called for domain %s\n",
404 domain->name ));
405
406 if (domain->internal) {
407 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
408 domain->name ));
409 return;
410 }
411
412 if (get_global_winbindd_state_offline()) {
413 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
414 domain->name ));
415 return;
416 }
417
418 winbindd_set_locator_kdc_envs(domain);
419
420 /* If we are waiting to get a krb5 ticket, trigger immediately. */
421 ccache_regain_all_now();
422
423 /* Ok, we're out of any startup mode now... */
424 domain->startup = False;
425
426 if (domain->online == False) {
427 /* We were offline - now we're online. We default to
428 using the MS-RPC backend if we started offline,
429 and if we're going online for the first time we
430 should really re-initialize the backends and the
431 checks to see if we're talking to an AD or NT domain.
432 */
433
434 domain->initialized = False;
435
436 /* 'reconnect_methods' is the MS-RPC backend. */
437 if (domain->backend == &reconnect_methods) {
438 domain->backend = NULL;
439 }
440 }
441
442 /* Ensure we have no online timeout checks. */
443 domain->check_online_timeout = 0;
444 TALLOC_FREE(domain->check_online_event);
445
446 /* Ensure we ignore any pending child messages. */
447 messaging_deregister(winbind_messaging_context(),
448 MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
449 messaging_deregister(winbind_messaging_context(),
450 MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
451
452 domain->online = True;
453
454 /* Send an online message to the idmap child when our
455 primary domain comes online */
456
457 if ( domain->primary ) {
458 struct winbindd_child *idmap = idmap_child();
459
460 if ( idmap->pid != 0 ) {
461 messaging_send_buf(winbind_messaging_context(),
462 pid_to_procid(idmap->pid),
463 MSG_WINBIND_ONLINE,
464 (uint8 *)domain->name,
465 strlen(domain->name)+1);
466 }
467 }
468
469 return;
470}
471
472/****************************************************************
473 Requested to set a domain online.
474****************************************************************/
475
476void set_domain_online_request(struct winbindd_domain *domain)
477{
478 struct timeval tev;
479
480 DEBUG(10,("set_domain_online_request: called for domain %s\n",
481 domain->name ));
482
483 if (get_global_winbindd_state_offline()) {
484 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
485 domain->name ));
486 return;
487 }
488
489 if (domain->internal) {
490 DEBUG(10, ("set_domain_online_request: Internal domains are "
491 "always online\n"));
492 return;
493 }
494
495 /* We've been told it's safe to go online and
496 try and connect to a DC. But I don't believe it
497 because network manager seems to lie.
498 Wait at least 5 seconds. Heuristics suck... */
499
500
501 GetTimeOfDay(&tev);
502
503 /* Go into "startup" mode again. */
504 domain->startup_time = tev.tv_sec;
505 domain->startup = True;
506
507 tev.tv_sec += 5;
508
509 if (!domain->check_online_event) {
510 /* If we've come from being globally offline we
511 don't have a check online event handler set.
512 We need to add one now we're trying to go
513 back online. */
514
515 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
516 domain->name ));
517 }
518
519 TALLOC_FREE(domain->check_online_event);
520
521 domain->check_online_event = event_add_timed(winbind_event_context(),
522 NULL,
523 tev,
524 check_domain_online_handler,
525 domain);
526
527 /* The above *has* to succeed for winbindd to work. */
528 if (!domain->check_online_event) {
529 smb_panic("set_domain_online_request: failed to add online handler");
530 }
531}
532
533/****************************************************************
534 Add -ve connection cache entries for domain and realm.
535****************************************************************/
536
537void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
538 const char *server,
539 NTSTATUS result)
540{
541 add_failed_connection_entry(domain->name, server, result);
542 /* If this was the saf name for the last thing we talked to,
543 remove it. */
544 saf_delete(domain->name);
545 if (*domain->alt_name) {
546 add_failed_connection_entry(domain->alt_name, server, result);
547 saf_delete(domain->alt_name);
548 }
549 winbindd_unset_locator_kdc_env(domain);
550}
551
552/* Choose between anonymous or authenticated connections. We need to use
553 an authenticated connection if DCs have the RestrictAnonymous registry
554 entry set > 0, or the "Additional restrictions for anonymous
555 connections" set in the win2k Local Security Policy.
556
557 Caller to free() result in domain, username, password
558*/
559
560static void cm_get_ipc_userpass(char **username, char **domain, char **password)
561{
562 *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
563 *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
564 *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
565
566 if (*username && **username) {
567
568 if (!*domain || !**domain)
569 *domain = smb_xstrdup(lp_workgroup());
570
571 if (!*password || !**password)
572 *password = smb_xstrdup("");
573
574 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
575 *domain, *username));
576
577 } else {
578 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
579 *username = smb_xstrdup("");
580 *domain = smb_xstrdup("");
581 *password = smb_xstrdup("");
582 }
583}
584
585static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
586 fstring dcname,
587 struct sockaddr_storage *dc_ss)
588{
589 struct winbindd_domain *our_domain = NULL;
590 struct rpc_pipe_client *netlogon_pipe = NULL;
591 NTSTATUS result;
592 WERROR werr;
593 TALLOC_CTX *mem_ctx;
594 unsigned int orig_timeout;
595 const char *tmp = NULL;
596 const char *p;
597
598 /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
599 * moment.... */
600
601 if (IS_DC) {
602 return False;
603 }
604
605 if (domain->primary) {
606 return False;
607 }
608
609 our_domain = find_our_domain();
610
611 if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
612 return False;
613 }
614
615 result = cm_connect_netlogon(our_domain, &netlogon_pipe);
616 if (!NT_STATUS_IS_OK(result)) {
617 talloc_destroy(mem_ctx);
618 return False;
619 }
620
621 /* This call can take a long time - allow the server to time out.
622 35 seconds should do it. */
623
624 orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
625
626 if (our_domain->active_directory) {
627 struct netr_DsRGetDCNameInfo *domain_info = NULL;
628
629 result = rpccli_netr_DsRGetDCName(netlogon_pipe,
630 mem_ctx,
631 our_domain->dcname,
632 domain->name,
633 NULL,
634 NULL,
635 DS_RETURN_DNS_NAME,
636 &domain_info,
637 &werr);
638 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
639 tmp = talloc_strdup(
640 mem_ctx, domain_info->dc_unc);
641 if (tmp == NULL) {
642 DEBUG(0, ("talloc_strdup failed\n"));
643 talloc_destroy(mem_ctx);
644 return false;
645 }
646 if (strlen(domain->alt_name) == 0) {
647 fstrcpy(domain->alt_name,
648 domain_info->domain_name);
649 }
650 if (strlen(domain->forest_name) == 0) {
651 fstrcpy(domain->forest_name,
652 domain_info->forest_name);
653 }
654 }
655 } else {
656 result = rpccli_netr_GetAnyDCName(netlogon_pipe, mem_ctx,
657 our_domain->dcname,
658 domain->name,
659 &tmp,
660 &werr);
661 }
662
663 /* And restore our original timeout. */
664 rpccli_set_timeout(netlogon_pipe, orig_timeout);
665
666 if (!NT_STATUS_IS_OK(result)) {
667 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
668 nt_errstr(result)));
669 talloc_destroy(mem_ctx);
670 return false;
671 }
672
673 if (!W_ERROR_IS_OK(werr)) {
674 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
675 win_errstr(werr)));
676 talloc_destroy(mem_ctx);
677 return false;
678 }
679
680 /* rpccli_netr_GetAnyDCName gives us a name with \\ */
681 p = strip_hostname(tmp);
682
683 fstrcpy(dcname, p);
684
685 talloc_destroy(mem_ctx);
686
687 DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname));
688
689 if (!resolve_name(dcname, dc_ss, 0x20, true)) {
690 return False;
691 }
692
693 return True;
694}
695
696/**
697 * Helper function to assemble trust password and account name
698 */
699static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
700 char **machine_password,
701 char **machine_account,
702 char **machine_krb5_principal)
703{
704 const char *account_name;
705 const char *name = NULL;
706
707 /* If we are a DC and this is not our own domain */
708
709 if (IS_DC) {
710 name = domain->name;
711 } else {
712 struct winbindd_domain *our_domain = find_our_domain();
713
714 if (!our_domain)
715 return NT_STATUS_INVALID_SERVER_STATE;
716
717 name = our_domain->name;
718 }
719
720 if (!get_trust_pw_clear(name, machine_password,
721 &account_name, NULL))
722 {
723 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
724 }
725
726 if ((machine_account != NULL) &&
727 (asprintf(machine_account, "%s$", account_name) == -1))
728 {
729 return NT_STATUS_NO_MEMORY;
730 }
731
732 /* For now assume our machine account only exists in our domain */
733
734 if (machine_krb5_principal != NULL)
735 {
736 struct winbindd_domain *our_domain = find_our_domain();
737
738 if (!our_domain) {
739 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
740 }
741
742 if (asprintf(machine_krb5_principal, "%s$@%s",
743 account_name, our_domain->alt_name) == -1)
744 {
745 return NT_STATUS_NO_MEMORY;
746 }
747
748 strupper_m(*machine_krb5_principal);
749 }
750
751 return NT_STATUS_OK;
752}
753
754/************************************************************************
755 Given a fd with a just-connected TCP connection to a DC, open a connection
756 to the pipe.
757************************************************************************/
758
759static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
760 const int sockfd,
761 const char *controller,
762 struct cli_state **cli,
763 bool *retry)
764{
765 char *machine_password = NULL;
766 char *machine_krb5_principal = NULL;
767 char *machine_account = NULL;
768 char *ipc_username = NULL;
769 char *ipc_domain = NULL;
770 char *ipc_password = NULL;
771
772 struct named_mutex *mutex;
773
774 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
775
776 struct sockaddr peeraddr;
777 socklen_t peeraddr_len;
778
779 struct sockaddr_in *peeraddr_in =
780 (struct sockaddr_in *)(void *)&peeraddr;
781
782 DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
783 controller, domain->name ));
784
785 *retry = True;
786
787 mutex = grab_named_mutex(talloc_tos(), controller,
788 WINBIND_SERVER_MUTEX_WAIT_TIME);
789 if (mutex == NULL) {
790 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
791 controller));
792 result = NT_STATUS_POSSIBLE_DEADLOCK;
793 goto done;
794 }
795
796 if ((*cli = cli_initialise()) == NULL) {
797 DEBUG(1, ("Could not cli_initialize\n"));
798 result = NT_STATUS_NO_MEMORY;
799 goto done;
800 }
801
802 (*cli)->timeout = 10000; /* 10 seconds */
803 (*cli)->fd = sockfd;
804 fstrcpy((*cli)->desthost, controller);
805 (*cli)->use_kerberos = True;
806
807 peeraddr_len = sizeof(peeraddr);
808
809 if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0)) {
810 DEBUG(0,("cm_prepare_connection: getpeername failed with: %s\n",
811 strerror(errno)));
812 result = NT_STATUS_UNSUCCESSFUL;
813 goto done;
814 }
815
816 if ((peeraddr_len != sizeof(struct sockaddr_in))
817#ifdef HAVE_IPV6
818 && (peeraddr_len != sizeof(struct sockaddr_in6))
819#endif
820 ) {
821 DEBUG(0,("cm_prepare_connection: got unexpected peeraddr len %d\n",
822 peeraddr_len));
823 result = NT_STATUS_UNSUCCESSFUL;
824 goto done;
825 }
826
827 if ((peeraddr_in->sin_family != PF_INET)
828#ifdef HAVE_IPV6
829 && (peeraddr_in->sin_family != PF_INET6)
830#endif
831 ) {
832 DEBUG(0,("cm_prepare_connection: got unexpected family %d\n",
833 peeraddr_in->sin_family));
834 result = NT_STATUS_UNSUCCESSFUL;
835 goto done;
836 }
837
838 if (ntohs(peeraddr_in->sin_port) == 139) {
839 struct nmb_name calling;
840 struct nmb_name called;
841
842 make_nmb_name(&calling, global_myname(), 0x0);
843 make_nmb_name(&called, "*SMBSERVER", 0x20);
844
845 if (!cli_session_request(*cli, &calling, &called)) {
846 DEBUG(8, ("cli_session_request failed for %s\n",
847 controller));
848 result = NT_STATUS_UNSUCCESSFUL;
849 goto done;
850 }
851 }
852
853 result = cli_negprot(*cli);
854
855 if (!NT_STATUS_IS_OK(result)) {
856 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
857 goto done;
858 }
859
860 if (!is_dc_trusted_domain_situation(domain->name) &&
861 (*cli)->protocol >= PROTOCOL_NT1 &&
862 (*cli)->capabilities & CAP_EXTENDED_SECURITY)
863 {
864 ADS_STATUS ads_status;
865
866 result = get_trust_creds(domain, &machine_password,
867 &machine_account,
868 &machine_krb5_principal);
869 if (!NT_STATUS_IS_OK(result)) {
870 goto anon_fallback;
871 }
872
873 if (lp_security() == SEC_ADS) {
874
875 /* Try a krb5 session */
876
877 (*cli)->use_kerberos = True;
878 DEBUG(5, ("connecting to %s from %s with kerberos principal "
879 "[%s] and realm [%s]\n", controller, global_myname(),
880 machine_krb5_principal, domain->alt_name));
881
882 winbindd_set_locator_kdc_envs(domain);
883
884 ads_status = cli_session_setup_spnego(*cli,
885 machine_krb5_principal,
886 machine_password,
887 lp_workgroup(),
888 domain->alt_name);
889
890 if (!ADS_ERR_OK(ads_status)) {
891 DEBUG(4,("failed kerberos session setup with %s\n",
892 ads_errstr(ads_status)));
893 }
894
895 result = ads_ntstatus(ads_status);
896 if (NT_STATUS_IS_OK(result)) {
897 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
898 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
899 if (!NT_STATUS_IS_OK(result)) {
900 goto done;
901 }
902 goto session_setup_done;
903 }
904 }
905
906 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
907 (*cli)->use_kerberos = False;
908
909 DEBUG(5, ("connecting to %s from %s with username "
910 "[%s]\\[%s]\n", controller, global_myname(),
911 lp_workgroup(), machine_account));
912
913 ads_status = cli_session_setup_spnego(*cli,
914 machine_account,
915 machine_password,
916 lp_workgroup(),
917 NULL);
918 if (!ADS_ERR_OK(ads_status)) {
919 DEBUG(4, ("authenticated session setup failed with %s\n",
920 ads_errstr(ads_status)));
921 }
922
923 result = ads_ntstatus(ads_status);
924 if (NT_STATUS_IS_OK(result)) {
925 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
926 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
927 if (!NT_STATUS_IS_OK(result)) {
928 goto done;
929 }
930 goto session_setup_done;
931 }
932 }
933
934 /* Fall back to non-kerberos session setup with auth_user */
935
936 (*cli)->use_kerberos = False;
937
938 cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
939
940 if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
941 (strlen(ipc_username) > 0)) {
942
943 /* Only try authenticated if we have a username */
944
945 DEBUG(5, ("connecting to %s from %s with username "
946 "[%s]\\[%s]\n", controller, global_myname(),
947 ipc_domain, ipc_username));
948
949 if (NT_STATUS_IS_OK(cli_session_setup(
950 *cli, ipc_username,
951 ipc_password, strlen(ipc_password)+1,
952 ipc_password, strlen(ipc_password)+1,
953 ipc_domain))) {
954 /* Successful logon with given username. */
955 result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
956 if (!NT_STATUS_IS_OK(result)) {
957 goto done;
958 }
959 goto session_setup_done;
960 } else {
961 DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
962 ipc_domain, ipc_username ));
963 }
964 }
965
966 anon_fallback:
967
968 /* Fall back to anonymous connection, this might fail later */
969 DEBUG(10,("cm_prepare_connection: falling back to anonymous "
970 "connection for DC %s\n",
971 controller ));
972
973 if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
974 NULL, 0, ""))) {
975 DEBUG(5, ("Connected anonymously\n"));
976 result = cli_init_creds(*cli, "", "", "");
977 if (!NT_STATUS_IS_OK(result)) {
978 goto done;
979 }
980 goto session_setup_done;
981 }
982
983 result = cli_nt_error(*cli);
984
985 if (NT_STATUS_IS_OK(result))
986 result = NT_STATUS_UNSUCCESSFUL;
987
988 /* We can't session setup */
989
990 goto done;
991
992 session_setup_done:
993
994 /* cache the server name for later connections */
995
996 saf_store( domain->name, (*cli)->desthost );
997 if (domain->alt_name && (*cli)->use_kerberos) {
998 saf_store( domain->alt_name, (*cli)->desthost );
999 }
1000
1001 winbindd_set_locator_kdc_envs(domain);
1002
1003 result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
1004
1005 if (!NT_STATUS_IS_OK(result)) {
1006 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
1007 goto done;
1008 }
1009
1010 TALLOC_FREE(mutex);
1011 *retry = False;
1012
1013 /* set the domain if empty; needed for schannel connections */
1014 if ( !(*cli)->domain[0] ) {
1015 result = cli_set_domain((*cli), domain->name);
1016 if (!NT_STATUS_IS_OK(result)) {
1017 return result;
1018 }
1019 }
1020
1021 result = NT_STATUS_OK;
1022
1023 done:
1024 TALLOC_FREE(mutex);
1025 SAFE_FREE(machine_account);
1026 SAFE_FREE(machine_password);
1027 SAFE_FREE(machine_krb5_principal);
1028 SAFE_FREE(ipc_username);
1029 SAFE_FREE(ipc_domain);
1030 SAFE_FREE(ipc_password);
1031
1032 if (!NT_STATUS_IS_OK(result)) {
1033 winbind_add_failed_connection_entry(domain, controller, result);
1034 if ((*cli) != NULL) {
1035 cli_shutdown(*cli);
1036 *cli = NULL;
1037 }
1038 }
1039
1040 return result;
1041}
1042
1043/*******************************************************************
1044 Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1045 array.
1046
1047 Keeps the list unique by not adding duplicate entries.
1048
1049 @param[in] mem_ctx talloc memory context to allocate from
1050 @param[in] domain_name domain of the DC
1051 @param[in] dcname name of the DC to add to the list
1052 @param[in] pss Internet address and port pair to add to the list
1053 @param[in,out] dcs array of dc_name_ip structures to add to
1054 @param[in,out] num_dcs number of dcs returned in the dcs array
1055 @return true if the list was added to, false otherwise
1056*******************************************************************/
1057
1058static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1059 const char *dcname, struct sockaddr_storage *pss,
1060 struct dc_name_ip **dcs, int *num)
1061{
1062 int i = 0;
1063
1064 if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1065 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1066 return False;
1067 }
1068
1069 /* Make sure there's no duplicates in the list */
1070 for (i=0; i<*num; i++)
1071 if (sockaddr_equal(
1072 (struct sockaddr *)(void *)&(*dcs)[i].ss,
1073 (struct sockaddr *)(void *)pss))
1074 return False;
1075
1076 *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1077
1078 if (*dcs == NULL)
1079 return False;
1080
1081 fstrcpy((*dcs)[*num].name, dcname);
1082 (*dcs)[*num].ss = *pss;
1083 *num += 1;
1084 return True;
1085}
1086
1087static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1088 struct sockaddr_storage *pss, uint16 port,
1089 struct sockaddr_storage **addrs, int *num)
1090{
1091 *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1092
1093 if (*addrs == NULL) {
1094 *num = 0;
1095 return False;
1096 }
1097
1098 (*addrs)[*num] = *pss;
1099 set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1100
1101 *num += 1;
1102 return True;
1103}
1104
1105/*******************************************************************
1106 convert an ip to a name
1107*******************************************************************/
1108
1109static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1110 const struct winbindd_domain *domain,
1111 struct sockaddr_storage *pss,
1112 fstring name )
1113{
1114 struct ip_service ip_list;
1115 uint32_t nt_version = NETLOGON_NT_VERSION_1;
1116
1117 ip_list.ss = *pss;
1118 ip_list.port = 0;
1119
1120#ifdef WITH_ADS
1121 /* For active directory servers, try to get the ldap server name.
1122 None of these failures should be considered critical for now */
1123
1124 if (lp_security() == SEC_ADS) {
1125 ADS_STRUCT *ads;
1126 ADS_STATUS ads_status;
1127 char addr[INET6_ADDRSTRLEN];
1128
1129 print_sockaddr(addr, sizeof(addr), pss);
1130
1131 ads = ads_init(domain->alt_name, domain->name, addr);
1132 ads->auth.flags |= ADS_AUTH_NO_BIND;
1133
1134 ads_status = ads_connect(ads);
1135 if (ADS_ERR_OK(ads_status)) {
1136 /* We got a cldap packet. */
1137 fstrcpy(name, ads->config.ldap_server_name);
1138 namecache_store(name, 0x20, 1, &ip_list);
1139
1140 DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1141
1142 if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1143 if (ads_closest_dc(ads)) {
1144 char *sitename = sitename_fetch(ads->config.realm);
1145
1146 /* We're going to use this KDC for this realm/domain.
1147 If we are using sites, then force the krb5 libs
1148 to use this KDC. */
1149
1150 create_local_private_krb5_conf_for_domain(domain->alt_name,
1151 domain->name,
1152 sitename,
1153 pss,
1154 name);
1155
1156 SAFE_FREE(sitename);
1157 } else {
1158 /* use an off site KDC */
1159 create_local_private_krb5_conf_for_domain(domain->alt_name,
1160 domain->name,
1161 NULL,
1162 pss,
1163 name);
1164 }
1165 winbindd_set_locator_kdc_envs(domain);
1166
1167 /* Ensure we contact this DC also. */
1168 saf_store( domain->name, name);
1169 saf_store( domain->alt_name, name);
1170 }
1171
1172 ads_destroy( &ads );
1173 return True;
1174 }
1175
1176 ads_destroy( &ads );
1177 }
1178#endif
1179
1180 /* try GETDC requests next */
1181
1182 if (send_getdc_request(mem_ctx, winbind_messaging_context(),
1183 pss, domain->name, &domain->sid,
1184 nt_version)) {
1185 const char *dc_name = NULL;
1186 int i;
1187 smb_msleep(100);
1188 for (i=0; i<5; i++) {
1189 if (receive_getdc_response(mem_ctx, pss, domain->name,
1190 &nt_version,
1191 &dc_name, NULL)) {
1192 fstrcpy(name, dc_name);
1193 namecache_store(name, 0x20, 1, &ip_list);
1194 return True;
1195 }
1196 smb_msleep(500);
1197 }
1198 }
1199
1200 /* try node status request */
1201
1202 if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1203 namecache_store(name, 0x20, 1, &ip_list);
1204 return True;
1205 }
1206 return False;
1207}
1208
1209/*******************************************************************
1210 Retrieve a list of IP addresses for domain controllers.
1211
1212 The array is sorted in the preferred connection order.
1213
1214 @param[in] mem_ctx talloc memory context to allocate from
1215 @param[in] domain domain to retrieve DCs for
1216 @param[out] dcs array of dcs that will be returned
1217 @param[out] num_dcs number of dcs returned in the dcs array
1218 @return always true
1219*******************************************************************/
1220
1221static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1222 struct dc_name_ip **dcs, int *num_dcs)
1223{
1224 fstring dcname;
1225 struct sockaddr_storage ss;
1226 struct ip_service *ip_list = NULL;
1227 int iplist_size = 0;
1228 int i;
1229 bool is_our_domain;
1230 enum security_types sec = (enum security_types)lp_security();
1231
1232 is_our_domain = strequal(domain->name, lp_workgroup());
1233
1234 /* If not our domain, get the preferred DC, by asking our primary DC */
1235 if ( !is_our_domain
1236 && get_dc_name_via_netlogon(domain, dcname, &ss)
1237 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1238 num_dcs) )
1239 {
1240 char addr[INET6_ADDRSTRLEN];
1241 print_sockaddr(addr, sizeof(addr), &ss);
1242 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1243 dcname, addr));
1244 return True;
1245 }
1246
1247 if (sec == SEC_ADS) {
1248 char *sitename = NULL;
1249
1250 /* We need to make sure we know the local site before
1251 doing any DNS queries, as this will restrict the
1252 get_sorted_dc_list() call below to only fetching
1253 DNS records for the correct site. */
1254
1255 /* Find any DC to get the site record.
1256 We deliberately don't care about the
1257 return here. */
1258
1259 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1260
1261 sitename = sitename_fetch(domain->alt_name);
1262 if (sitename) {
1263
1264 /* Do the site-specific AD dns lookup first. */
1265 get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1266 &iplist_size, True);
1267
1268 /* Add ips to the DC array. We don't look up the name
1269 of the DC in this function, but we fill in the char*
1270 of the ip now to make the failed connection cache
1271 work */
1272 for ( i=0; i<iplist_size; i++ ) {
1273 char addr[INET6_ADDRSTRLEN];
1274 print_sockaddr(addr, sizeof(addr),
1275 &ip_list[i].ss);
1276 add_one_dc_unique(mem_ctx,
1277 domain->name,
1278 addr,
1279 &ip_list[i].ss,
1280 dcs,
1281 num_dcs);
1282 }
1283
1284 SAFE_FREE(ip_list);
1285 SAFE_FREE(sitename);
1286 iplist_size = 0;
1287 }
1288
1289 /* Now we add DCs from the main AD DNS lookup. */
1290 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1291 &iplist_size, True);
1292
1293 for ( i=0; i<iplist_size; i++ ) {
1294 char addr[INET6_ADDRSTRLEN];
1295 print_sockaddr(addr, sizeof(addr),
1296 &ip_list[i].ss);
1297 add_one_dc_unique(mem_ctx,
1298 domain->name,
1299 addr,
1300 &ip_list[i].ss,
1301 dcs,
1302 num_dcs);
1303 }
1304
1305 SAFE_FREE(ip_list);
1306 iplist_size = 0;
1307 }
1308
1309 /* Try standard netbios queries if no ADS */
1310 if (*num_dcs == 0) {
1311 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1312 False);
1313
1314 for ( i=0; i<iplist_size; i++ ) {
1315 char addr[INET6_ADDRSTRLEN];
1316 print_sockaddr(addr, sizeof(addr),
1317 &ip_list[i].ss);
1318 add_one_dc_unique(mem_ctx,
1319 domain->name,
1320 addr,
1321 &ip_list[i].ss,
1322 dcs,
1323 num_dcs);
1324 }
1325
1326 SAFE_FREE(ip_list);
1327 iplist_size = 0;
1328 }
1329
1330 return True;
1331}
1332
1333/*******************************************************************
1334 Find and make a connection to a DC in the given domain.
1335
1336 @param[in] mem_ctx talloc memory context to allocate from
1337 @param[in] domain domain to find a dc in
1338 @param[out] dcname NetBIOS or FQDN of DC that's connected to
1339 @param[out] pss DC Internet address and port
1340 @param[out] fd fd of the open socket connected to the newly found dc
1341 @return true when a DC connection is made, false otherwise
1342*******************************************************************/
1343
1344static bool find_new_dc(TALLOC_CTX *mem_ctx,
1345 struct winbindd_domain *domain,
1346 fstring dcname, struct sockaddr_storage *pss, int *fd)
1347{
1348 struct dc_name_ip *dcs = NULL;
1349 int num_dcs = 0;
1350
1351 const char **dcnames = NULL;
1352 int num_dcnames = 0;
1353
1354 struct sockaddr_storage *addrs = NULL;
1355 int num_addrs = 0;
1356
1357 int i, fd_index;
1358
1359 *fd = -1;
1360
1361 again:
1362 if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1363 return False;
1364
1365 for (i=0; i<num_dcs; i++) {
1366
1367 if (!add_string_to_array(mem_ctx, dcs[i].name,
1368 &dcnames, &num_dcnames)) {
1369 return False;
1370 }
1371 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
1372 &addrs, &num_addrs)) {
1373 return False;
1374 }
1375
1376 if (!add_string_to_array(mem_ctx, dcs[i].name,
1377 &dcnames, &num_dcnames)) {
1378 return False;
1379 }
1380 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 139,
1381 &addrs, &num_addrs)) {
1382 return False;
1383 }
1384 }
1385
1386 if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1387 return False;
1388
1389 if ((addrs == NULL) || (dcnames == NULL))
1390 return False;
1391
1392 /* 5 second timeout. */
1393 if (!open_any_socket_out(addrs, num_addrs, 5000, &fd_index, fd) ) {
1394 for (i=0; i<num_dcs; i++) {
1395 char ab[INET6_ADDRSTRLEN];
1396 print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1397 DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1398 "domain %s address %s. Error was %s\n",
1399 domain->name, ab, strerror(errno) ));
1400 winbind_add_failed_connection_entry(domain,
1401 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1402 }
1403 return False;
1404 }
1405
1406 *pss = addrs[fd_index];
1407
1408 if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1409 /* Ok, we've got a name for the DC */
1410 fstrcpy(dcname, dcnames[fd_index]);
1411 return True;
1412 }
1413
1414 /* Try to figure out the name */
1415 if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1416 return True;
1417 }
1418
1419 /* We can not continue without the DC's name */
1420 winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1421 NT_STATUS_UNSUCCESSFUL);
1422
1423 /* Throw away all arrays as we're doing this again. */
1424 TALLOC_FREE(dcs);
1425 num_dcs = 0;
1426
1427 TALLOC_FREE(dcnames);
1428 num_dcnames = 0;
1429
1430 TALLOC_FREE(addrs);
1431 num_addrs = 0;
1432
1433 close(*fd);
1434 *fd = -1;
1435
1436 goto again;
1437}
1438
1439static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1440 struct winbindd_cm_conn *new_conn)
1441{
1442 TALLOC_CTX *mem_ctx;
1443 NTSTATUS result;
1444 char *saf_servername = saf_fetch( domain->name );
1445 int retries;
1446
1447 if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1448 SAFE_FREE(saf_servername);
1449 set_domain_offline(domain);
1450 return NT_STATUS_NO_MEMORY;
1451 }
1452
1453 /* we have to check the server affinity cache here since
1454 later we selecte a DC based on response time and not preference */
1455
1456 /* Check the negative connection cache
1457 before talking to it. It going down may have
1458 triggered the reconnection. */
1459
1460 if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1461
1462 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1463 saf_servername, domain->name ));
1464
1465 /* convert an ip address to a name */
1466 if (is_ipaddress( saf_servername ) ) {
1467 fstring saf_name;
1468 struct sockaddr_storage ss;
1469
1470 if (!interpret_string_addr(&ss, saf_servername,
1471 AI_NUMERICHOST)) {
1472 return NT_STATUS_UNSUCCESSFUL;
1473 }
1474 if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1475 fstrcpy( domain->dcname, saf_name );
1476 } else {
1477 winbind_add_failed_connection_entry(
1478 domain, saf_servername,
1479 NT_STATUS_UNSUCCESSFUL);
1480 }
1481 } else {
1482 fstrcpy( domain->dcname, saf_servername );
1483 }
1484
1485 SAFE_FREE( saf_servername );
1486 }
1487
1488 for (retries = 0; retries < 3; retries++) {
1489 int fd = -1;
1490 bool retry = False;
1491
1492 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1493
1494 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1495 domain->dcname, domain->name ));
1496
1497 if (*domain->dcname
1498 && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1499 && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
1500 {
1501 struct sockaddr_storage *addrs = NULL;
1502 int num_addrs = 0;
1503 int dummy = 0;
1504
1505 if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 445, &addrs, &num_addrs)) {
1506 set_domain_offline(domain);
1507 talloc_destroy(mem_ctx);
1508 return NT_STATUS_NO_MEMORY;
1509 }
1510 if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 139, &addrs, &num_addrs)) {
1511 set_domain_offline(domain);
1512 talloc_destroy(mem_ctx);
1513 return NT_STATUS_NO_MEMORY;
1514 }
1515
1516 /* 5 second timeout. */
1517 if (!open_any_socket_out(addrs, num_addrs, 5000, &dummy, &fd)) {
1518 fd = -1;
1519 }
1520 }
1521
1522 if ((fd == -1)
1523 && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1524 {
1525 /* This is the one place where we will
1526 set the global winbindd offline state
1527 to true, if a "WINBINDD_OFFLINE" entry
1528 is found in the winbindd cache. */
1529 set_global_winbindd_state_offline();
1530 break;
1531 }
1532
1533 new_conn->cli = NULL;
1534
1535 result = cm_prepare_connection(domain, fd, domain->dcname,
1536 &new_conn->cli, &retry);
1537
1538 if (!retry)
1539 break;
1540 }
1541
1542 if (NT_STATUS_IS_OK(result)) {
1543
1544 winbindd_set_locator_kdc_envs(domain);
1545
1546 if (domain->online == False) {
1547 /* We're changing state from offline to online. */
1548 set_global_winbindd_state_online();
1549 }
1550 set_domain_online(domain);
1551 } else {
1552 /* Ensure we setup the retry handler. */
1553 set_domain_offline(domain);
1554 }
1555
1556 talloc_destroy(mem_ctx);
1557 return result;
1558}
1559
1560/* Close down all open pipes on a connection. */
1561
1562void invalidate_cm_connection(struct winbindd_cm_conn *conn)
1563{
1564 /* We're closing down a possibly dead
1565 connection. Don't have impossibly long (10s) timeouts. */
1566
1567 if (conn->cli) {
1568 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1569 }
1570
1571 if (conn->samr_pipe != NULL) {
1572 TALLOC_FREE(conn->samr_pipe);
1573 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1574 if (conn->cli) {
1575 cli_set_timeout(conn->cli, 500);
1576 }
1577 }
1578
1579 if (conn->lsa_pipe != NULL) {
1580 TALLOC_FREE(conn->lsa_pipe);
1581 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1582 if (conn->cli) {
1583 cli_set_timeout(conn->cli, 500);
1584 }
1585 }
1586
1587 if (conn->lsa_pipe_tcp != NULL) {
1588 TALLOC_FREE(conn->lsa_pipe_tcp);
1589 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1590 if (conn->cli) {
1591 cli_set_timeout(conn->cli, 500);
1592 }
1593 }
1594
1595 if (conn->netlogon_pipe != NULL) {
1596 TALLOC_FREE(conn->netlogon_pipe);
1597 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1598 if (conn->cli) {
1599 cli_set_timeout(conn->cli, 500);
1600 }
1601 }
1602
1603 if (conn->cli) {
1604 cli_shutdown(conn->cli);
1605 }
1606
1607 conn->cli = NULL;
1608}
1609
1610void close_conns_after_fork(void)
1611{
1612 struct winbindd_domain *domain;
1613
1614 for (domain = domain_list(); domain; domain = domain->next) {
1615 if (domain->conn.cli == NULL)
1616 continue;
1617
1618 if (domain->conn.cli->fd == -1)
1619 continue;
1620
1621 close(domain->conn.cli->fd);
1622 domain->conn.cli->fd = -1;
1623 }
1624}
1625
1626static bool connection_ok(struct winbindd_domain *domain)
1627{
1628 bool ok;
1629
1630 ok = cli_state_is_connected(domain->conn.cli);
1631 if (!ok) {
1632 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
1633 domain->dcname, domain->name));
1634 return False;
1635 }
1636
1637 if (domain->online == False) {
1638 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1639 return False;
1640 }
1641
1642 return True;
1643}
1644
1645/* Initialize a new connection up to the RPC BIND.
1646 Bypass online status check so always does network calls. */
1647
1648static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
1649{
1650 NTSTATUS result;
1651
1652 /* Internal connections never use the network. */
1653 if (domain->internal) {
1654 domain->initialized = True;
1655 return NT_STATUS_OK;
1656 }
1657
1658 if (!winbindd_can_contact_domain(domain)) {
1659 invalidate_cm_connection(&domain->conn);
1660 domain->initialized = True;
1661 return NT_STATUS_OK;
1662 }
1663
1664 if (connection_ok(domain)) {
1665 if (!domain->initialized) {
1666 set_dc_type_and_flags(domain);
1667 }
1668 return NT_STATUS_OK;
1669 }
1670
1671 invalidate_cm_connection(&domain->conn);
1672
1673 result = cm_open_connection(domain, &domain->conn);
1674
1675 if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1676 set_dc_type_and_flags(domain);
1677 }
1678
1679 return result;
1680}
1681
1682NTSTATUS init_dc_connection(struct winbindd_domain *domain)
1683{
1684 if (domain->initialized && !domain->online) {
1685 /* We check for online status elsewhere. */
1686 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1687 }
1688
1689 return init_dc_connection_network(domain);
1690}
1691
1692static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain)
1693{
1694 NTSTATUS status;
1695
1696 status = init_dc_connection(domain);
1697 if (!NT_STATUS_IS_OK(status)) {
1698 return status;
1699 }
1700
1701 if (!domain->internal && domain->conn.cli == NULL) {
1702 /* happens for trusted domains without inbound trust */
1703 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
1704 }
1705
1706 return NT_STATUS_OK;
1707}
1708
1709/******************************************************************************
1710 Set the trust flags (direction and forest location) for a domain
1711******************************************************************************/
1712
1713static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
1714{
1715 struct winbindd_domain *our_domain;
1716 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1717 struct netr_DomainTrustList trusts;
1718 int i;
1719 uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1720 NETR_TRUST_FLAG_OUTBOUND |
1721 NETR_TRUST_FLAG_INBOUND);
1722 struct rpc_pipe_client *cli;
1723 TALLOC_CTX *mem_ctx = NULL;
1724
1725 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1726
1727 /* Our primary domain doesn't need to worry about trust flags.
1728 Force it to go through the network setup */
1729 if ( domain->primary ) {
1730 return False;
1731 }
1732
1733 our_domain = find_our_domain();
1734
1735 if ( !connection_ok(our_domain) ) {
1736 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1737 return False;
1738 }
1739
1740 /* This won't work unless our domain is AD */
1741
1742 if ( !our_domain->active_directory ) {
1743 return False;
1744 }
1745
1746 /* Use DsEnumerateDomainTrusts to get us the trust direction
1747 and type */
1748
1749 result = cm_connect_netlogon(our_domain, &cli);
1750
1751 if (!NT_STATUS_IS_OK(result)) {
1752 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1753 "a connection to %s for PIPE_NETLOGON (%s)\n",
1754 domain->name, nt_errstr(result)));
1755 return False;
1756 }
1757
1758 if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1759 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1760 return False;
1761 }
1762
1763 result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1764 cli->desthost,
1765 flags,
1766 &trusts,
1767 NULL);
1768 if (!NT_STATUS_IS_OK(result)) {
1769 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1770 "failed to query trusted domain list: %s\n",
1771 nt_errstr(result)));
1772 talloc_destroy(mem_ctx);
1773 return false;
1774 }
1775
1776 /* Now find the domain name and get the flags */
1777
1778 for ( i=0; i<trusts.count; i++ ) {
1779 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1780 domain->domain_flags = trusts.array[i].trust_flags;
1781 domain->domain_type = trusts.array[i].trust_type;
1782 domain->domain_trust_attribs = trusts.array[i].trust_attributes;
1783
1784 if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1785 domain->active_directory = True;
1786
1787 /* This flag is only set if the domain is *our*
1788 primary domain and the primary domain is in
1789 native mode */
1790
1791 domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1792
1793 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1794 "native mode.\n", domain->name,
1795 domain->native_mode ? "" : "NOT "));
1796
1797 DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1798 "running active directory.\n", domain->name,
1799 domain->active_directory ? "" : "NOT "));
1800
1801
1802 domain->initialized = True;
1803
1804 break;
1805 }
1806 }
1807
1808 talloc_destroy( mem_ctx );
1809
1810 return domain->initialized;
1811}
1812
1813/******************************************************************************
1814 We can 'sense' certain things about the DC by it's replies to certain
1815 questions.
1816
1817 This tells us if this particular remote server is Active Directory, and if it
1818 is native mode.
1819******************************************************************************/
1820
1821static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
1822{
1823 NTSTATUS result;
1824 WERROR werr;
1825 TALLOC_CTX *mem_ctx = NULL;
1826 struct rpc_pipe_client *cli = NULL;
1827 struct policy_handle pol;
1828 union dssetup_DsRoleInfo info;
1829 union lsa_PolicyInformation *lsa_info = NULL;
1830
1831 if (!connection_ok(domain)) {
1832 return;
1833 }
1834
1835 mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1836 domain->name);
1837 if (!mem_ctx) {
1838 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1839 return;
1840 }
1841
1842 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1843
1844 result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1845 &ndr_table_dssetup.syntax_id,
1846 &cli);
1847
1848 if (!NT_STATUS_IS_OK(result)) {
1849 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1850 "PI_DSSETUP on domain %s: (%s)\n",
1851 domain->name, nt_errstr(result)));
1852
1853 /* if this is just a non-AD domain we need to continue
1854 * identifying so that we can in the end return with
1855 * domain->initialized = True - gd */
1856
1857 goto no_dssetup;
1858 }
1859
1860 result = rpccli_dssetup_DsRoleGetPrimaryDomainInformation(cli, mem_ctx,
1861 DS_ROLE_BASIC_INFORMATION,
1862 &info,
1863 &werr);
1864 TALLOC_FREE(cli);
1865
1866 if (!NT_STATUS_IS_OK(result)) {
1867 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1868 "on domain %s failed: (%s)\n",
1869 domain->name, nt_errstr(result)));
1870
1871 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1872 * every opcode on the DSSETUP pipe, continue with
1873 * no_dssetup mode here as well to get domain->initialized
1874 * set - gd */
1875
1876 if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
1877 goto no_dssetup;
1878 }
1879
1880 TALLOC_FREE(mem_ctx);
1881 return;
1882 }
1883
1884 if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
1885 !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
1886 domain->native_mode = True;
1887 } else {
1888 domain->native_mode = False;
1889 }
1890
1891no_dssetup:
1892 result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1893 &ndr_table_lsarpc.syntax_id, &cli);
1894
1895 if (!NT_STATUS_IS_OK(result)) {
1896 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1897 "PI_LSARPC on domain %s: (%s)\n",
1898 domain->name, nt_errstr(result)));
1899 TALLOC_FREE(cli);
1900 TALLOC_FREE(mem_ctx);
1901 return;
1902 }
1903
1904 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1905 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
1906
1907 if (NT_STATUS_IS_OK(result)) {
1908 /* This particular query is exactly what Win2k clients use
1909 to determine that the DC is active directory */
1910 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
1911 &pol,
1912 LSA_POLICY_INFO_DNS,
1913 &lsa_info);
1914 }
1915
1916 if (NT_STATUS_IS_OK(result)) {
1917 domain->active_directory = True;
1918
1919 if (lsa_info->dns.name.string) {
1920 fstrcpy(domain->name, lsa_info->dns.name.string);
1921 }
1922
1923 if (lsa_info->dns.dns_domain.string) {
1924 fstrcpy(domain->alt_name,
1925 lsa_info->dns.dns_domain.string);
1926 }
1927
1928 /* See if we can set some domain trust flags about
1929 ourself */
1930
1931 if (lsa_info->dns.dns_forest.string) {
1932 fstrcpy(domain->forest_name,
1933 lsa_info->dns.dns_forest.string);
1934
1935 if (strequal(domain->forest_name, domain->alt_name)) {
1936 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
1937 }
1938 }
1939
1940 if (lsa_info->dns.sid) {
1941 sid_copy(&domain->sid, lsa_info->dns.sid);
1942 }
1943 } else {
1944 domain->active_directory = False;
1945
1946 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
1947 SEC_FLAG_MAXIMUM_ALLOWED,
1948 &pol);
1949
1950 if (!NT_STATUS_IS_OK(result)) {
1951 goto done;
1952 }
1953
1954 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
1955 &pol,
1956 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1957 &lsa_info);
1958
1959 if (NT_STATUS_IS_OK(result)) {
1960
1961 if (lsa_info->account_domain.name.string) {
1962 fstrcpy(domain->name,
1963 lsa_info->account_domain.name.string);
1964 }
1965
1966 if (lsa_info->account_domain.sid) {
1967 sid_copy(&domain->sid, lsa_info->account_domain.sid);
1968 }
1969 }
1970 }
1971done:
1972
1973 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1974 domain->name, domain->native_mode ? "" : "NOT "));
1975
1976 DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1977 domain->name, domain->active_directory ? "" : "NOT "));
1978
1979 domain->can_do_ncacn_ip_tcp = domain->active_directory;
1980
1981 TALLOC_FREE(cli);
1982
1983 TALLOC_FREE(mem_ctx);
1984
1985 domain->initialized = True;
1986}
1987
1988/**********************************************************************
1989 Set the domain_flags (trust attributes, domain operating modes, etc...
1990***********************************************************************/
1991
1992static void set_dc_type_and_flags( struct winbindd_domain *domain )
1993{
1994 /* we always have to contact our primary domain */
1995
1996 if ( domain->primary ) {
1997 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1998 "primary domain\n"));
1999 set_dc_type_and_flags_connect( domain );
2000 return;
2001 }
2002
2003 /* Use our DC to get the information if possible */
2004
2005 if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
2006 /* Otherwise, fallback to contacting the
2007 domain directly */
2008 set_dc_type_and_flags_connect( domain );
2009 }
2010
2011 return;
2012}
2013
2014
2015
2016/**********************************************************************
2017***********************************************************************/
2018
2019static NTSTATUS cm_get_schannel_creds(struct winbindd_domain *domain,
2020 struct netlogon_creds_CredentialState **ppdc)
2021{
2022 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2023 struct rpc_pipe_client *netlogon_pipe;
2024
2025 if (lp_client_schannel() == False) {
2026 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;;
2027 }
2028
2029 result = cm_connect_netlogon(domain, &netlogon_pipe);
2030 if (!NT_STATUS_IS_OK(result)) {
2031 return result;
2032 }
2033
2034 /* Return a pointer to the struct netlogon_creds_CredentialState from the
2035 netlogon pipe. */
2036
2037 if (!domain->conn.netlogon_pipe->dc) {
2038 return NT_STATUS_INTERNAL_ERROR; /* This shouldn't happen. */
2039 }
2040
2041 *ppdc = domain->conn.netlogon_pipe->dc;
2042 return NT_STATUS_OK;
2043}
2044
2045NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2046 struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2047{
2048 struct winbindd_cm_conn *conn;
2049 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2050 struct netlogon_creds_CredentialState *p_creds;
2051 char *machine_password = NULL;
2052 char *machine_account = NULL;
2053 char *domain_name = NULL;
2054
2055 result = init_dc_connection_rpc(domain);
2056 if (!NT_STATUS_IS_OK(result)) {
2057 return result;
2058 }
2059
2060 conn = &domain->conn;
2061
2062 if (rpccli_is_connected(conn->samr_pipe)) {
2063 goto done;
2064 }
2065
2066 TALLOC_FREE(conn->samr_pipe);
2067
2068 /*
2069 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2070 * sign and sealed pipe using the machine account password by
2071 * preference. If we can't - try schannel, if that fails, try
2072 * anonymous.
2073 */
2074
2075 if ((conn->cli->user_name[0] == '\0') ||
2076 (conn->cli->domain[0] == '\0') ||
2077 (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2078 {
2079 result = get_trust_creds(domain, &machine_password,
2080 &machine_account, NULL);
2081 if (!NT_STATUS_IS_OK(result)) {
2082 DEBUG(10, ("cm_connect_sam: No no user available for "
2083 "domain %s, trying schannel\n", conn->cli->domain));
2084 goto schannel;
2085 }
2086 domain_name = domain->name;
2087 } else {
2088 machine_password = SMB_STRDUP(conn->cli->password);
2089 machine_account = SMB_STRDUP(conn->cli->user_name);
2090 domain_name = conn->cli->domain;
2091 }
2092
2093 if (!machine_password || !machine_account) {
2094 result = NT_STATUS_NO_MEMORY;
2095 goto done;
2096 }
2097
2098 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2099 authenticated SAMR pipe with sign & seal. */
2100 result = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
2101 &ndr_table_samr.syntax_id,
2102 NCACN_NP,
2103 DCERPC_AUTH_LEVEL_PRIVACY,
2104 domain_name,
2105 machine_account,
2106 machine_password,
2107 &conn->samr_pipe);
2108
2109 if (!NT_STATUS_IS_OK(result)) {
2110 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2111 "pipe for domain %s using NTLMSSP "
2112 "authenticated pipe: user %s\\%s. Error was "
2113 "%s\n", domain->name, domain_name,
2114 machine_account, nt_errstr(result)));
2115 goto schannel;
2116 }
2117
2118 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2119 "domain %s using NTLMSSP authenticated "
2120 "pipe: user %s\\%s\n", domain->name,
2121 domain_name, machine_account));
2122
2123 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2124 conn->samr_pipe->desthost,
2125 SEC_FLAG_MAXIMUM_ALLOWED,
2126 &conn->sam_connect_handle);
2127 if (NT_STATUS_IS_OK(result)) {
2128 goto open_domain;
2129 }
2130 DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2131 "failed for domain %s, error was %s. Trying schannel\n",
2132 domain->name, nt_errstr(result) ));
2133 TALLOC_FREE(conn->samr_pipe);
2134
2135 schannel:
2136
2137 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2138
2139 result = cm_get_schannel_creds(domain, &p_creds);
2140 if (!NT_STATUS_IS_OK(result)) {
2141 /* If this call fails - conn->cli can now be NULL ! */
2142 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2143 "for domain %s (error %s), trying anon\n",
2144 domain->name,
2145 nt_errstr(result) ));
2146 goto anonymous;
2147 }
2148 result = cli_rpc_pipe_open_schannel_with_key
2149 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2150 DCERPC_AUTH_LEVEL_PRIVACY,
2151 domain->name, &p_creds, &conn->samr_pipe);
2152
2153 if (!NT_STATUS_IS_OK(result)) {
2154 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2155 "domain %s using schannel. Error was %s\n",
2156 domain->name, nt_errstr(result) ));
2157 goto anonymous;
2158 }
2159 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2160 "schannel.\n", domain->name ));
2161
2162 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2163 conn->samr_pipe->desthost,
2164 SEC_FLAG_MAXIMUM_ALLOWED,
2165 &conn->sam_connect_handle);
2166 if (NT_STATUS_IS_OK(result)) {
2167 goto open_domain;
2168 }
2169 DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2170 "for domain %s, error was %s. Trying anonymous\n",
2171 domain->name, nt_errstr(result) ));
2172 TALLOC_FREE(conn->samr_pipe);
2173
2174 anonymous:
2175
2176 /* Finally fall back to anonymous. */
2177 result = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2178 &conn->samr_pipe);
2179
2180 if (!NT_STATUS_IS_OK(result)) {
2181 goto done;
2182 }
2183
2184 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2185 conn->samr_pipe->desthost,
2186 SEC_FLAG_MAXIMUM_ALLOWED,
2187 &conn->sam_connect_handle);
2188 if (!NT_STATUS_IS_OK(result)) {
2189 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2190 "for domain %s Error was %s\n",
2191 domain->name, nt_errstr(result) ));
2192 goto done;
2193 }
2194
2195 open_domain:
2196 result = rpccli_samr_OpenDomain(conn->samr_pipe,
2197 mem_ctx,
2198 &conn->sam_connect_handle,
2199 SEC_FLAG_MAXIMUM_ALLOWED,
2200 &domain->sid,
2201 &conn->sam_domain_handle);
2202
2203 done:
2204
2205 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
2206 /*
2207 * if we got access denied, we might just have no access rights
2208 * to talk to the remote samr server server (e.g. when we are a
2209 * PDC and we are connecting a w2k8 pdc via an interdomain
2210 * trust). In that case do not invalidate the whole connection
2211 * stack
2212 */
2213 TALLOC_FREE(conn->samr_pipe);
2214 ZERO_STRUCT(conn->sam_domain_handle);
2215 return result;
2216 } else if (!NT_STATUS_IS_OK(result)) {
2217 invalidate_cm_connection(conn);
2218 return result;
2219 }
2220
2221 *cli = conn->samr_pipe;
2222 *sam_handle = conn->sam_domain_handle;
2223 SAFE_FREE(machine_password);
2224 SAFE_FREE(machine_account);
2225 return result;
2226}
2227
2228/**********************************************************************
2229 open an schanneld ncacn_ip_tcp connection to LSA
2230***********************************************************************/
2231
2232NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2233 TALLOC_CTX *mem_ctx,
2234 struct rpc_pipe_client **cli)
2235{
2236 struct winbindd_cm_conn *conn;
2237 struct netlogon_creds_CredentialState *creds;
2238 NTSTATUS status;
2239
2240 DEBUG(10,("cm_connect_lsa_tcp\n"));
2241
2242 status = init_dc_connection_rpc(domain);
2243 if (!NT_STATUS_IS_OK(status)) {
2244 return status;
2245 }
2246
2247 conn = &domain->conn;
2248
2249 if (conn->lsa_pipe_tcp &&
2250 conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2251 conn->lsa_pipe_tcp->auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY &&
2252 rpccli_is_connected(conn->lsa_pipe_tcp)) {
2253 goto done;
2254 }
2255
2256 TALLOC_FREE(conn->lsa_pipe_tcp);
2257
2258 status = cm_get_schannel_creds(domain, &creds);
2259 if (!NT_STATUS_IS_OK(status)) {
2260 goto done;
2261 }
2262
2263 status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
2264 &ndr_table_lsarpc.syntax_id,
2265 NCACN_IP_TCP,
2266 DCERPC_AUTH_LEVEL_PRIVACY,
2267 domain->name,
2268 &creds,
2269 &conn->lsa_pipe_tcp);
2270 if (!NT_STATUS_IS_OK(status)) {
2271 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2272 nt_errstr(status)));
2273 goto done;
2274 }
2275
2276 done:
2277 if (!NT_STATUS_IS_OK(status)) {
2278 TALLOC_FREE(conn->lsa_pipe_tcp);
2279 return status;
2280 }
2281
2282 *cli = conn->lsa_pipe_tcp;
2283
2284 return status;
2285}
2286
2287NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2288 struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2289{
2290 struct winbindd_cm_conn *conn;
2291 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2292 struct netlogon_creds_CredentialState *p_creds;
2293
2294 result = init_dc_connection_rpc(domain);
2295 if (!NT_STATUS_IS_OK(result))
2296 return result;
2297
2298 conn = &domain->conn;
2299
2300 if (rpccli_is_connected(conn->lsa_pipe)) {
2301 goto done;
2302 }
2303
2304 TALLOC_FREE(conn->lsa_pipe);
2305
2306 if ((conn->cli->user_name[0] == '\0') ||
2307 (conn->cli->domain[0] == '\0') ||
2308 (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2309 DEBUG(10, ("cm_connect_lsa: No no user available for "
2310 "domain %s, trying schannel\n", conn->cli->domain));
2311 goto schannel;
2312 }
2313
2314 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2315 * authenticated LSA pipe with sign & seal. */
2316 result = cli_rpc_pipe_open_spnego_ntlmssp
2317 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2318 DCERPC_AUTH_LEVEL_PRIVACY,
2319 conn->cli->domain, conn->cli->user_name, conn->cli->password,
2320 &conn->lsa_pipe);
2321
2322 if (!NT_STATUS_IS_OK(result)) {
2323 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2324 "domain %s using NTLMSSP authenticated pipe: user "
2325 "%s\\%s. Error was %s. Trying schannel.\n",
2326 domain->name, conn->cli->domain,
2327 conn->cli->user_name, nt_errstr(result)));
2328 goto schannel;
2329 }
2330
2331 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2332 "NTLMSSP authenticated pipe: user %s\\%s\n",
2333 domain->name, conn->cli->domain, conn->cli->user_name ));
2334
2335 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2336 SEC_FLAG_MAXIMUM_ALLOWED,
2337 &conn->lsa_policy);
2338 if (NT_STATUS_IS_OK(result)) {
2339 goto done;
2340 }
2341
2342 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2343 "schannel\n"));
2344
2345 TALLOC_FREE(conn->lsa_pipe);
2346
2347 schannel:
2348
2349 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2350
2351 result = cm_get_schannel_creds(domain, &p_creds);
2352 if (!NT_STATUS_IS_OK(result)) {
2353 /* If this call fails - conn->cli can now be NULL ! */
2354 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2355 "for domain %s (error %s), trying anon\n",
2356 domain->name,
2357 nt_errstr(result) ));
2358 goto anonymous;
2359 }
2360 result = cli_rpc_pipe_open_schannel_with_key
2361 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2362 DCERPC_AUTH_LEVEL_PRIVACY,
2363 domain->name, &p_creds, &conn->lsa_pipe);
2364
2365 if (!NT_STATUS_IS_OK(result)) {
2366 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2367 "domain %s using schannel. Error was %s\n",
2368 domain->name, nt_errstr(result) ));
2369 goto anonymous;
2370 }
2371 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2372 "schannel.\n", domain->name ));
2373
2374 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2375 SEC_FLAG_MAXIMUM_ALLOWED,
2376 &conn->lsa_policy);
2377 if (NT_STATUS_IS_OK(result)) {
2378 goto done;
2379 }
2380
2381 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2382 "anonymous\n"));
2383
2384 TALLOC_FREE(conn->lsa_pipe);
2385
2386 anonymous:
2387
2388 result = cli_rpc_pipe_open_noauth(conn->cli,
2389 &ndr_table_lsarpc.syntax_id,
2390 &conn->lsa_pipe);
2391 if (!NT_STATUS_IS_OK(result)) {
2392 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2393 goto done;
2394 }
2395
2396 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2397 SEC_FLAG_MAXIMUM_ALLOWED,
2398 &conn->lsa_policy);
2399 done:
2400 if (!NT_STATUS_IS_OK(result)) {
2401 invalidate_cm_connection(conn);
2402 return result;
2403 }
2404
2405 *cli = conn->lsa_pipe;
2406 *lsa_policy = conn->lsa_policy;
2407 return result;
2408}
2409
2410/****************************************************************************
2411 Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2412 session key stored in conn->netlogon_pipe->dc->sess_key.
2413****************************************************************************/
2414
2415NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
2416 struct rpc_pipe_client **cli)
2417{
2418 struct winbindd_cm_conn *conn;
2419 NTSTATUS result;
2420
2421 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2422 uint8 mach_pwd[16];
2423 enum netr_SchannelType sec_chan_type;
2424 const char *account_name;
2425 struct rpc_pipe_client *netlogon_pipe = NULL;
2426
2427 *cli = NULL;
2428
2429 result = init_dc_connection_rpc(domain);
2430 if (!NT_STATUS_IS_OK(result)) {
2431 return result;
2432 }
2433
2434 conn = &domain->conn;
2435
2436 if (rpccli_is_connected(conn->netlogon_pipe)) {
2437 *cli = conn->netlogon_pipe;
2438 return NT_STATUS_OK;
2439 }
2440
2441 TALLOC_FREE(conn->netlogon_pipe);
2442
2443 result = cli_rpc_pipe_open_noauth(conn->cli,
2444 &ndr_table_netlogon.syntax_id,
2445 &netlogon_pipe);
2446 if (!NT_STATUS_IS_OK(result)) {
2447 return result;
2448 }
2449
2450 if ((!IS_DC) && (!domain->primary)) {
2451 /* Clear the schannel request bit and drop down */
2452 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2453 goto no_schannel;
2454 }
2455
2456 if (lp_client_schannel() != False) {
2457 neg_flags |= NETLOGON_NEG_SCHANNEL;
2458 }
2459
2460 if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2461 &sec_chan_type))
2462 {
2463 TALLOC_FREE(netlogon_pipe);
2464 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2465 }
2466
2467 result = rpccli_netlogon_setup_creds(
2468 netlogon_pipe,
2469 domain->dcname, /* server name. */
2470 domain->name, /* domain name */
2471 global_myname(), /* client name */
2472 account_name, /* machine account */
2473 mach_pwd, /* machine password */
2474 sec_chan_type, /* from get_trust_pw */
2475 &neg_flags);
2476
2477 if (!NT_STATUS_IS_OK(result)) {
2478 TALLOC_FREE(netlogon_pipe);
2479 return result;
2480 }
2481
2482 if ((lp_client_schannel() == True) &&
2483 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2484 DEBUG(3, ("Server did not offer schannel\n"));
2485 TALLOC_FREE(netlogon_pipe);
2486 return NT_STATUS_ACCESS_DENIED;
2487 }
2488
2489 no_schannel:
2490 if ((lp_client_schannel() == False) ||
2491 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2492 /*
2493 * NetSamLogonEx only works for schannel
2494 */
2495 domain->can_do_samlogon_ex = False;
2496
2497 /* We're done - just keep the existing connection to NETLOGON
2498 * open */
2499 conn->netlogon_pipe = netlogon_pipe;
2500 *cli = conn->netlogon_pipe;
2501 return NT_STATUS_OK;
2502 }
2503
2504 /* Using the credentials from the first pipe, open a signed and sealed
2505 second netlogon pipe. The session key is stored in the schannel
2506 part of the new pipe auth struct.
2507 */
2508
2509 result = cli_rpc_pipe_open_schannel_with_key(
2510 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2511 DCERPC_AUTH_LEVEL_PRIVACY, domain->name, &netlogon_pipe->dc,
2512 &conn->netlogon_pipe);
2513
2514 /* We can now close the initial netlogon pipe. */
2515 TALLOC_FREE(netlogon_pipe);
2516
2517 if (!NT_STATUS_IS_OK(result)) {
2518 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2519 "was %s\n", nt_errstr(result)));
2520
2521 invalidate_cm_connection(conn);
2522 return result;
2523 }
2524
2525 /*
2526 * Always try netr_LogonSamLogonEx. We will fall back for NT4
2527 * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
2528 * supported). We used to only try SamLogonEx for AD, but
2529 * Samba DCs can also do it. And because we don't distinguish
2530 * between Samba and NT4, always try it once.
2531 */
2532 domain->can_do_samlogon_ex = true;
2533
2534 *cli = conn->netlogon_pipe;
2535 return NT_STATUS_OK;
2536}
Note: See TracBrowser for help on using the repository browser.