1 | /*
|
---|
2 | * Unix SMB/CIFS implementation.
|
---|
3 | * Helper routines for net
|
---|
4 | * Copyright (C) Volker Lendecke 2006
|
---|
5 | * Copyright (C) Kai Blin 2008
|
---|
6 | *
|
---|
7 | * This program is free software; you can redistribute it and/or modify
|
---|
8 | * it under the terms of the GNU General Public License as published by
|
---|
9 | * the Free Software Foundation; either version 3 of the License, or
|
---|
10 | * (at your option) any later version.
|
---|
11 | *
|
---|
12 | * This program is distributed in the hope that it will be useful,
|
---|
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
15 | * GNU General Public License for more details.
|
---|
16 | *
|
---|
17 | * You should have received a copy of the GNU General Public License
|
---|
18 | * along with this program; if not, see <http://www.gnu.org/licenses/>.
|
---|
19 | */
|
---|
20 |
|
---|
21 |
|
---|
22 | #include "includes.h"
|
---|
23 | #include "utils/net.h"
|
---|
24 | #include "rpc_client/cli_pipe.h"
|
---|
25 | #include "../librpc/gen_ndr/ndr_lsa_c.h"
|
---|
26 | #include "rpc_client/cli_lsarpc.h"
|
---|
27 | #include "../librpc/gen_ndr/ndr_dssetup_c.h"
|
---|
28 | #include "secrets.h"
|
---|
29 | #include "../libcli/security/security.h"
|
---|
30 | #include "libsmb/libsmb.h"
|
---|
31 |
|
---|
32 | NTSTATUS net_rpc_lookup_name(struct net_context *c,
|
---|
33 | TALLOC_CTX *mem_ctx, struct cli_state *cli,
|
---|
34 | const char *name, const char **ret_domain,
|
---|
35 | const char **ret_name, struct dom_sid *ret_sid,
|
---|
36 | enum lsa_SidType *ret_type)
|
---|
37 | {
|
---|
38 | struct rpc_pipe_client *lsa_pipe = NULL;
|
---|
39 | struct policy_handle pol;
|
---|
40 | NTSTATUS status, result;
|
---|
41 | const char **dom_names;
|
---|
42 | struct dom_sid *sids;
|
---|
43 | enum lsa_SidType *types;
|
---|
44 | struct dcerpc_binding_handle *b;
|
---|
45 |
|
---|
46 | ZERO_STRUCT(pol);
|
---|
47 |
|
---|
48 | status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
|
---|
49 | &lsa_pipe);
|
---|
50 | if (!NT_STATUS_IS_OK(status)) {
|
---|
51 | d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
|
---|
52 | return status;
|
---|
53 | }
|
---|
54 |
|
---|
55 | b = lsa_pipe->binding_handle;
|
---|
56 |
|
---|
57 | status = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
|
---|
58 | SEC_FLAG_MAXIMUM_ALLOWED,
|
---|
59 | &pol);
|
---|
60 | if (!NT_STATUS_IS_OK(status)) {
|
---|
61 | d_fprintf(stderr, "open_policy %s: %s\n", _("failed"),
|
---|
62 | nt_errstr(status));
|
---|
63 | return status;
|
---|
64 | }
|
---|
65 |
|
---|
66 | status = rpccli_lsa_lookup_names(lsa_pipe, mem_ctx, &pol, 1,
|
---|
67 | &name, &dom_names, 1, &sids, &types);
|
---|
68 |
|
---|
69 | if (!NT_STATUS_IS_OK(status)) {
|
---|
70 | /* This can happen easily, don't log an error */
|
---|
71 | goto done;
|
---|
72 | }
|
---|
73 |
|
---|
74 | if (ret_domain != NULL) {
|
---|
75 | *ret_domain = dom_names[0];
|
---|
76 | }
|
---|
77 | if (ret_name != NULL) {
|
---|
78 | *ret_name = talloc_strdup(mem_ctx, name);
|
---|
79 | }
|
---|
80 | if (ret_sid != NULL) {
|
---|
81 | sid_copy(ret_sid, &sids[0]);
|
---|
82 | }
|
---|
83 | if (ret_type != NULL) {
|
---|
84 | *ret_type = types[0];
|
---|
85 | }
|
---|
86 |
|
---|
87 | done:
|
---|
88 | if (is_valid_policy_hnd(&pol)) {
|
---|
89 | dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
|
---|
90 | }
|
---|
91 | TALLOC_FREE(lsa_pipe);
|
---|
92 |
|
---|
93 | return status;
|
---|
94 | }
|
---|
95 |
|
---|
96 | /****************************************************************************
|
---|
97 | Connect to \\server\service.
|
---|
98 | ****************************************************************************/
|
---|
99 |
|
---|
100 | NTSTATUS connect_to_service(struct net_context *c,
|
---|
101 | struct cli_state **cli_ctx,
|
---|
102 | struct sockaddr_storage *server_ss,
|
---|
103 | const char *server_name,
|
---|
104 | const char *service_name,
|
---|
105 | const char *service_type)
|
---|
106 | {
|
---|
107 | NTSTATUS nt_status;
|
---|
108 | int flags = 0;
|
---|
109 |
|
---|
110 | c->opt_password = net_prompt_pass(c, c->opt_user_name);
|
---|
111 |
|
---|
112 | if (c->opt_kerberos) {
|
---|
113 | flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
|
---|
114 | }
|
---|
115 |
|
---|
116 | if (c->opt_kerberos && c->opt_password) {
|
---|
117 | flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
|
---|
118 | }
|
---|
119 |
|
---|
120 | if (c->opt_ccache) {
|
---|
121 | flags |= CLI_FULL_CONNECTION_USE_CCACHE;
|
---|
122 | }
|
---|
123 |
|
---|
124 | nt_status = cli_full_connection(cli_ctx, NULL, server_name,
|
---|
125 | server_ss, c->opt_port,
|
---|
126 | service_name, service_type,
|
---|
127 | c->opt_user_name, c->opt_workgroup,
|
---|
128 | c->opt_password, flags, Undefined);
|
---|
129 | if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
130 | d_fprintf(stderr, _("Could not connect to server %s\n"),
|
---|
131 | server_name);
|
---|
132 |
|
---|
133 | /* Display a nicer message depending on the result */
|
---|
134 |
|
---|
135 | if (NT_STATUS_V(nt_status) ==
|
---|
136 | NT_STATUS_V(NT_STATUS_LOGON_FAILURE))
|
---|
137 | d_fprintf(stderr,
|
---|
138 | _("The username or password was not "
|
---|
139 | "correct.\n"));
|
---|
140 |
|
---|
141 | if (NT_STATUS_V(nt_status) ==
|
---|
142 | NT_STATUS_V(NT_STATUS_ACCOUNT_LOCKED_OUT))
|
---|
143 | d_fprintf(stderr, _("The account was locked out.\n"));
|
---|
144 |
|
---|
145 | if (NT_STATUS_V(nt_status) ==
|
---|
146 | NT_STATUS_V(NT_STATUS_ACCOUNT_DISABLED))
|
---|
147 | d_fprintf(stderr, _("The account was disabled.\n"));
|
---|
148 | return nt_status;
|
---|
149 | }
|
---|
150 |
|
---|
151 | if (c->smb_encrypt) {
|
---|
152 | nt_status = cli_force_encryption(*cli_ctx,
|
---|
153 | c->opt_user_name,
|
---|
154 | c->opt_password,
|
---|
155 | c->opt_workgroup);
|
---|
156 |
|
---|
157 | if (NT_STATUS_EQUAL(nt_status,NT_STATUS_NOT_SUPPORTED)) {
|
---|
158 | d_printf(_("Encryption required and "
|
---|
159 | "server that doesn't support "
|
---|
160 | "UNIX extensions - failing connect\n"));
|
---|
161 | } else if (NT_STATUS_EQUAL(nt_status,NT_STATUS_UNKNOWN_REVISION)) {
|
---|
162 | d_printf(_("Encryption required and "
|
---|
163 | "can't get UNIX CIFS extensions "
|
---|
164 | "version from server.\n"));
|
---|
165 | } else if (NT_STATUS_EQUAL(nt_status,NT_STATUS_UNSUPPORTED_COMPRESSION)) {
|
---|
166 | d_printf(_("Encryption required and "
|
---|
167 | "share %s doesn't support "
|
---|
168 | "encryption.\n"), service_name);
|
---|
169 | } else if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
170 | d_printf(_("Encryption required and "
|
---|
171 | "setup failed with error %s.\n"),
|
---|
172 | nt_errstr(nt_status));
|
---|
173 | }
|
---|
174 |
|
---|
175 | if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
176 | cli_shutdown(*cli_ctx);
|
---|
177 | *cli_ctx = NULL;
|
---|
178 | }
|
---|
179 | }
|
---|
180 |
|
---|
181 | return nt_status;
|
---|
182 | }
|
---|
183 |
|
---|
184 | /****************************************************************************
|
---|
185 | Connect to \\server\ipc$.
|
---|
186 | ****************************************************************************/
|
---|
187 |
|
---|
188 | NTSTATUS connect_to_ipc(struct net_context *c,
|
---|
189 | struct cli_state **cli_ctx,
|
---|
190 | struct sockaddr_storage *server_ss,
|
---|
191 | const char *server_name)
|
---|
192 | {
|
---|
193 | return connect_to_service(c, cli_ctx, server_ss, server_name, "IPC$",
|
---|
194 | "IPC");
|
---|
195 | }
|
---|
196 |
|
---|
197 | /****************************************************************************
|
---|
198 | Connect to \\server\ipc$ anonymously.
|
---|
199 | ****************************************************************************/
|
---|
200 |
|
---|
201 | NTSTATUS connect_to_ipc_anonymous(struct net_context *c,
|
---|
202 | struct cli_state **cli_ctx,
|
---|
203 | struct sockaddr_storage *server_ss,
|
---|
204 | const char *server_name)
|
---|
205 | {
|
---|
206 | NTSTATUS nt_status;
|
---|
207 |
|
---|
208 | nt_status = cli_full_connection(cli_ctx, c->opt_requester_name,
|
---|
209 | server_name, server_ss, c->opt_port,
|
---|
210 | "IPC$", "IPC",
|
---|
211 | "", "",
|
---|
212 | "", 0, Undefined);
|
---|
213 |
|
---|
214 | if (NT_STATUS_IS_OK(nt_status)) {
|
---|
215 | return nt_status;
|
---|
216 | } else {
|
---|
217 | DEBUG(1,("Cannot connect to server (anonymously). Error was %s\n", nt_errstr(nt_status)));
|
---|
218 | return nt_status;
|
---|
219 | }
|
---|
220 | }
|
---|
221 |
|
---|
222 | /****************************************************************************
|
---|
223 | Return malloced user@realm for krb5 login.
|
---|
224 | ****************************************************************************/
|
---|
225 |
|
---|
226 | static char *get_user_and_realm(const char *username)
|
---|
227 | {
|
---|
228 | char *user_and_realm = NULL;
|
---|
229 |
|
---|
230 | if (!username) {
|
---|
231 | return NULL;
|
---|
232 | }
|
---|
233 | if (strchr_m(username, '@')) {
|
---|
234 | user_and_realm = SMB_STRDUP(username);
|
---|
235 | } else {
|
---|
236 | if (asprintf(&user_and_realm, "%s@%s", username, lp_realm()) == -1) {
|
---|
237 | user_and_realm = NULL;
|
---|
238 | }
|
---|
239 | }
|
---|
240 | return user_and_realm;
|
---|
241 | }
|
---|
242 |
|
---|
243 | /****************************************************************************
|
---|
244 | Connect to \\server\ipc$ using KRB5.
|
---|
245 | ****************************************************************************/
|
---|
246 |
|
---|
247 | NTSTATUS connect_to_ipc_krb5(struct net_context *c,
|
---|
248 | struct cli_state **cli_ctx,
|
---|
249 | struct sockaddr_storage *server_ss,
|
---|
250 | const char *server_name)
|
---|
251 | {
|
---|
252 | NTSTATUS nt_status;
|
---|
253 | char *user_and_realm = NULL;
|
---|
254 |
|
---|
255 | /* FIXME: Should get existing kerberos ticket if possible. */
|
---|
256 | c->opt_password = net_prompt_pass(c, c->opt_user_name);
|
---|
257 | if (!c->opt_password) {
|
---|
258 | return NT_STATUS_NO_MEMORY;
|
---|
259 | }
|
---|
260 |
|
---|
261 | user_and_realm = get_user_and_realm(c->opt_user_name);
|
---|
262 | if (!user_and_realm) {
|
---|
263 | return NT_STATUS_NO_MEMORY;
|
---|
264 | }
|
---|
265 |
|
---|
266 | nt_status = cli_full_connection(cli_ctx, NULL, server_name,
|
---|
267 | server_ss, c->opt_port,
|
---|
268 | "IPC$", "IPC",
|
---|
269 | user_and_realm, c->opt_workgroup,
|
---|
270 | c->opt_password,
|
---|
271 | CLI_FULL_CONNECTION_USE_KERBEROS,
|
---|
272 | Undefined);
|
---|
273 |
|
---|
274 | SAFE_FREE(user_and_realm);
|
---|
275 |
|
---|
276 | if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
277 | DEBUG(1,("Cannot connect to server using kerberos. Error was %s\n", nt_errstr(nt_status)));
|
---|
278 | return nt_status;
|
---|
279 | }
|
---|
280 |
|
---|
281 | if (c->smb_encrypt) {
|
---|
282 | nt_status = cli_cm_force_encryption(*cli_ctx,
|
---|
283 | user_and_realm,
|
---|
284 | c->opt_password,
|
---|
285 | c->opt_workgroup,
|
---|
286 | "IPC$");
|
---|
287 | if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
288 | cli_shutdown(*cli_ctx);
|
---|
289 | *cli_ctx = NULL;
|
---|
290 | }
|
---|
291 | }
|
---|
292 |
|
---|
293 | return nt_status;
|
---|
294 | }
|
---|
295 |
|
---|
296 | /**
|
---|
297 | * Connect a server and open a given pipe
|
---|
298 | *
|
---|
299 | * @param cli_dst A cli_state
|
---|
300 | * @param pipe The pipe to open
|
---|
301 | * @param got_pipe boolean that stores if we got a pipe
|
---|
302 | *
|
---|
303 | * @return Normal NTSTATUS return.
|
---|
304 | **/
|
---|
305 | NTSTATUS connect_dst_pipe(struct net_context *c, struct cli_state **cli_dst,
|
---|
306 | struct rpc_pipe_client **pp_pipe_hnd,
|
---|
307 | const struct ndr_syntax_id *interface)
|
---|
308 | {
|
---|
309 | NTSTATUS nt_status;
|
---|
310 | char *server_name = SMB_STRDUP("127.0.0.1");
|
---|
311 | struct cli_state *cli_tmp = NULL;
|
---|
312 | struct rpc_pipe_client *pipe_hnd = NULL;
|
---|
313 |
|
---|
314 | if (server_name == NULL) {
|
---|
315 | return NT_STATUS_NO_MEMORY;
|
---|
316 | }
|
---|
317 |
|
---|
318 | if (c->opt_destination) {
|
---|
319 | SAFE_FREE(server_name);
|
---|
320 | if ((server_name = SMB_STRDUP(c->opt_destination)) == NULL) {
|
---|
321 | return NT_STATUS_NO_MEMORY;
|
---|
322 | }
|
---|
323 | }
|
---|
324 |
|
---|
325 | /* make a connection to a named pipe */
|
---|
326 | nt_status = connect_to_ipc(c, &cli_tmp, NULL, server_name);
|
---|
327 | if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
328 | SAFE_FREE(server_name);
|
---|
329 | return nt_status;
|
---|
330 | }
|
---|
331 |
|
---|
332 | nt_status = cli_rpc_pipe_open_noauth(cli_tmp, interface,
|
---|
333 | &pipe_hnd);
|
---|
334 | if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
335 | DEBUG(0, ("couldn't not initialize pipe\n"));
|
---|
336 | cli_shutdown(cli_tmp);
|
---|
337 | SAFE_FREE(server_name);
|
---|
338 | return nt_status;
|
---|
339 | }
|
---|
340 |
|
---|
341 | *cli_dst = cli_tmp;
|
---|
342 | *pp_pipe_hnd = pipe_hnd;
|
---|
343 | SAFE_FREE(server_name);
|
---|
344 |
|
---|
345 | return nt_status;
|
---|
346 | }
|
---|
347 |
|
---|
348 | /****************************************************************************
|
---|
349 | Use the local machine account (krb) and password for this session.
|
---|
350 | ****************************************************************************/
|
---|
351 |
|
---|
352 | int net_use_krb_machine_account(struct net_context *c)
|
---|
353 | {
|
---|
354 | char *user_name = NULL;
|
---|
355 |
|
---|
356 | if (!secrets_init()) {
|
---|
357 | d_fprintf(stderr,_("ERROR: Unable to open secrets database\n"));
|
---|
358 | exit(1);
|
---|
359 | }
|
---|
360 |
|
---|
361 | c->opt_password = secrets_fetch_machine_password(
|
---|
362 | c->opt_target_workgroup, NULL, NULL);
|
---|
363 | if (asprintf(&user_name, "%s$@%s", global_myname(), lp_realm()) == -1) {
|
---|
364 | return -1;
|
---|
365 | }
|
---|
366 | c->opt_user_name = user_name;
|
---|
367 | return 0;
|
---|
368 | }
|
---|
369 |
|
---|
370 | /****************************************************************************
|
---|
371 | Use the machine account name and password for this session.
|
---|
372 | ****************************************************************************/
|
---|
373 |
|
---|
374 | int net_use_machine_account(struct net_context *c)
|
---|
375 | {
|
---|
376 | char *user_name = NULL;
|
---|
377 |
|
---|
378 | if (!secrets_init()) {
|
---|
379 | d_fprintf(stderr,_("ERROR: Unable to open secrets database\n"));
|
---|
380 | exit(1);
|
---|
381 | }
|
---|
382 |
|
---|
383 | c->opt_password = secrets_fetch_machine_password(
|
---|
384 | c->opt_target_workgroup, NULL, NULL);
|
---|
385 | if (asprintf(&user_name, "%s$", global_myname()) == -1) {
|
---|
386 | return -1;
|
---|
387 | }
|
---|
388 | c->opt_user_name = user_name;
|
---|
389 | return 0;
|
---|
390 | }
|
---|
391 |
|
---|
392 | bool net_find_server(struct net_context *c,
|
---|
393 | const char *domain,
|
---|
394 | unsigned flags,
|
---|
395 | struct sockaddr_storage *server_ss,
|
---|
396 | char **server_name)
|
---|
397 | {
|
---|
398 | const char *d = domain ? domain : c->opt_target_workgroup;
|
---|
399 |
|
---|
400 | if (c->opt_host) {
|
---|
401 | *server_name = SMB_STRDUP(c->opt_host);
|
---|
402 | }
|
---|
403 |
|
---|
404 | if (c->opt_have_ip) {
|
---|
405 | *server_ss = c->opt_dest_ip;
|
---|
406 | if (!*server_name) {
|
---|
407 | char addr[INET6_ADDRSTRLEN];
|
---|
408 | print_sockaddr(addr, sizeof(addr), &c->opt_dest_ip);
|
---|
409 | *server_name = SMB_STRDUP(addr);
|
---|
410 | }
|
---|
411 | } else if (*server_name) {
|
---|
412 | /* resolve the IP address */
|
---|
413 | if (!resolve_name(*server_name, server_ss, 0x20, false)) {
|
---|
414 | DEBUG(1,("Unable to resolve server name\n"));
|
---|
415 | return false;
|
---|
416 | }
|
---|
417 | } else if (flags & NET_FLAGS_PDC) {
|
---|
418 | fstring dc_name;
|
---|
419 | struct sockaddr_storage pdc_ss;
|
---|
420 |
|
---|
421 | if (!get_pdc_ip(d, &pdc_ss)) {
|
---|
422 | DEBUG(1,("Unable to resolve PDC server address\n"));
|
---|
423 | return false;
|
---|
424 | }
|
---|
425 |
|
---|
426 | if (is_zero_addr(&pdc_ss)) {
|
---|
427 | return false;
|
---|
428 | }
|
---|
429 |
|
---|
430 | if (!name_status_find(d, 0x1b, 0x20, &pdc_ss, dc_name)) {
|
---|
431 | return false;
|
---|
432 | }
|
---|
433 |
|
---|
434 | *server_name = SMB_STRDUP(dc_name);
|
---|
435 | *server_ss = pdc_ss;
|
---|
436 | } else if (flags & NET_FLAGS_DMB) {
|
---|
437 | struct sockaddr_storage msbrow_ss;
|
---|
438 | char addr[INET6_ADDRSTRLEN];
|
---|
439 |
|
---|
440 | /* if (!resolve_name(MSBROWSE, &msbrow_ip, 1, false)) */
|
---|
441 | if (!resolve_name(d, &msbrow_ss, 0x1B, false)) {
|
---|
442 | DEBUG(1,("Unable to resolve domain browser via name lookup\n"));
|
---|
443 | return false;
|
---|
444 | }
|
---|
445 | *server_ss = msbrow_ss;
|
---|
446 | print_sockaddr(addr, sizeof(addr), server_ss);
|
---|
447 | *server_name = SMB_STRDUP(addr);
|
---|
448 | } else if (flags & NET_FLAGS_MASTER) {
|
---|
449 | struct sockaddr_storage brow_ss;
|
---|
450 | char addr[INET6_ADDRSTRLEN];
|
---|
451 | if (!resolve_name(d, &brow_ss, 0x1D, false)) {
|
---|
452 | /* go looking for workgroups */
|
---|
453 | DEBUG(1,("Unable to resolve master browser via name lookup\n"));
|
---|
454 | return false;
|
---|
455 | }
|
---|
456 | *server_ss = brow_ss;
|
---|
457 | print_sockaddr(addr, sizeof(addr), server_ss);
|
---|
458 | *server_name = SMB_STRDUP(addr);
|
---|
459 | } else if (!(flags & NET_FLAGS_LOCALHOST_DEFAULT_INSANE)) {
|
---|
460 | if (!interpret_string_addr(server_ss,
|
---|
461 | "127.0.0.1", AI_NUMERICHOST)) {
|
---|
462 | DEBUG(1,("Unable to resolve 127.0.0.1\n"));
|
---|
463 | return false;
|
---|
464 | }
|
---|
465 | *server_name = SMB_STRDUP("127.0.0.1");
|
---|
466 | }
|
---|
467 |
|
---|
468 | if (!*server_name) {
|
---|
469 | DEBUG(1,("no server to connect to\n"));
|
---|
470 | return false;
|
---|
471 | }
|
---|
472 |
|
---|
473 | return true;
|
---|
474 | }
|
---|
475 |
|
---|
476 | bool net_find_pdc(struct sockaddr_storage *server_ss,
|
---|
477 | fstring server_name,
|
---|
478 | const char *domain_name)
|
---|
479 | {
|
---|
480 | if (!get_pdc_ip(domain_name, server_ss)) {
|
---|
481 | return false;
|
---|
482 | }
|
---|
483 | if (is_zero_addr(server_ss)) {
|
---|
484 | return false;
|
---|
485 | }
|
---|
486 |
|
---|
487 | if (!name_status_find(domain_name, 0x1b, 0x20, server_ss, server_name)) {
|
---|
488 | return false;
|
---|
489 | }
|
---|
490 |
|
---|
491 | return true;
|
---|
492 | }
|
---|
493 |
|
---|
494 | NTSTATUS net_make_ipc_connection(struct net_context *c, unsigned flags,
|
---|
495 | struct cli_state **pcli)
|
---|
496 | {
|
---|
497 | return net_make_ipc_connection_ex(c, c->opt_workgroup, NULL, NULL, flags, pcli);
|
---|
498 | }
|
---|
499 |
|
---|
500 | NTSTATUS net_make_ipc_connection_ex(struct net_context *c ,const char *domain,
|
---|
501 | const char *server,
|
---|
502 | struct sockaddr_storage *pss,
|
---|
503 | unsigned flags, struct cli_state **pcli)
|
---|
504 | {
|
---|
505 | char *server_name = NULL;
|
---|
506 | struct sockaddr_storage server_ss;
|
---|
507 | struct cli_state *cli = NULL;
|
---|
508 | NTSTATUS nt_status;
|
---|
509 |
|
---|
510 | if ( !server || !pss ) {
|
---|
511 | if (!net_find_server(c, domain, flags, &server_ss,
|
---|
512 | &server_name)) {
|
---|
513 | d_fprintf(stderr, _("Unable to find a suitable server "
|
---|
514 | "for domain %s\n"), domain);
|
---|
515 | nt_status = NT_STATUS_UNSUCCESSFUL;
|
---|
516 | goto done;
|
---|
517 | }
|
---|
518 | } else {
|
---|
519 | server_name = SMB_STRDUP( server );
|
---|
520 | server_ss = *pss;
|
---|
521 | }
|
---|
522 |
|
---|
523 | if (flags & NET_FLAGS_ANONYMOUS) {
|
---|
524 | nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
|
---|
525 | server_name);
|
---|
526 | } else {
|
---|
527 | nt_status = connect_to_ipc(c, &cli, &server_ss,
|
---|
528 | server_name);
|
---|
529 | }
|
---|
530 |
|
---|
531 | /* store the server in the affinity cache if it was a PDC */
|
---|
532 |
|
---|
533 | if ( (flags & NET_FLAGS_PDC) && NT_STATUS_IS_OK(nt_status) )
|
---|
534 | saf_store( cli->server_domain, cli->desthost );
|
---|
535 |
|
---|
536 | SAFE_FREE(server_name);
|
---|
537 | if (!NT_STATUS_IS_OK(nt_status)) {
|
---|
538 | d_fprintf(stderr, _("Connection failed: %s\n"),
|
---|
539 | nt_errstr(nt_status));
|
---|
540 | cli = NULL;
|
---|
541 | } else if (c->opt_request_timeout) {
|
---|
542 | cli_set_timeout(cli, c->opt_request_timeout * 1000);
|
---|
543 | }
|
---|
544 |
|
---|
545 | done:
|
---|
546 | if (pcli != NULL) {
|
---|
547 | *pcli = cli;
|
---|
548 | }
|
---|
549 | return nt_status;
|
---|
550 | }
|
---|
551 |
|
---|
552 | /****************************************************************************
|
---|
553 | ****************************************************************************/
|
---|
554 |
|
---|
555 | const char *net_prompt_pass(struct net_context *c, const char *user)
|
---|
556 | {
|
---|
557 | char *prompt = NULL;
|
---|
558 | const char *pass = NULL;
|
---|
559 |
|
---|
560 | if (c->opt_password) {
|
---|
561 | return c->opt_password;
|
---|
562 | }
|
---|
563 |
|
---|
564 | if (c->opt_machine_pass) {
|
---|
565 | return NULL;
|
---|
566 | }
|
---|
567 |
|
---|
568 | if (c->opt_kerberos && !c->opt_user_specified) {
|
---|
569 | return NULL;
|
---|
570 | }
|
---|
571 |
|
---|
572 | if (asprintf(&prompt, _("Enter %s's password:"), user) == -1) {
|
---|
573 | return NULL;
|
---|
574 | }
|
---|
575 |
|
---|
576 | pass = getpass(prompt);
|
---|
577 | SAFE_FREE(prompt);
|
---|
578 |
|
---|
579 | return pass;
|
---|
580 | }
|
---|
581 |
|
---|
582 | int net_run_function(struct net_context *c, int argc, const char **argv,
|
---|
583 | const char *whoami, struct functable *table)
|
---|
584 | {
|
---|
585 | int i;
|
---|
586 |
|
---|
587 | if (argc != 0) {
|
---|
588 | for (i=0; table[i].funcname != NULL; i++) {
|
---|
589 | if (StrCaseCmp(argv[0], table[i].funcname) == 0)
|
---|
590 | return table[i].fn(c, argc-1, argv+1);
|
---|
591 | }
|
---|
592 | }
|
---|
593 |
|
---|
594 | if (c->display_usage == false) {
|
---|
595 | d_fprintf(stderr, _("Invalid command: %s %s\n"), whoami,
|
---|
596 | (argc > 0)?argv[0]:"");
|
---|
597 | }
|
---|
598 | d_printf(_("Usage:\n"));
|
---|
599 | for (i=0; table[i].funcname != NULL; i++) {
|
---|
600 | if(c->display_usage == false)
|
---|
601 | d_printf("%s %-15s %s\n", whoami, table[i].funcname,
|
---|
602 | _(table[i].description));
|
---|
603 | else
|
---|
604 | d_printf("%s\n", _(table[i].usage));
|
---|
605 | }
|
---|
606 |
|
---|
607 | return c->display_usage?0:-1;
|
---|
608 | }
|
---|
609 |
|
---|
610 | void net_display_usage_from_functable(struct functable *table)
|
---|
611 | {
|
---|
612 | int i;
|
---|
613 | for (i=0; table[i].funcname != NULL; i++) {
|
---|
614 | d_printf("%s\n", _(table[i].usage));
|
---|
615 | }
|
---|
616 | }
|
---|
617 |
|
---|
618 | const char *net_share_type_str(int num_type)
|
---|
619 | {
|
---|
620 | switch(num_type) {
|
---|
621 | case 0: return _("Disk");
|
---|
622 | case 1: return _("Print");
|
---|
623 | case 2: return _("Dev");
|
---|
624 | case 3: return _("IPC");
|
---|
625 | default: return _("Unknown");
|
---|
626 | }
|
---|
627 | }
|
---|
628 |
|
---|
629 | static NTSTATUS net_scan_dc_noad(struct net_context *c,
|
---|
630 | struct cli_state *cli,
|
---|
631 | struct net_dc_info *dc_info)
|
---|
632 | {
|
---|
633 | TALLOC_CTX *mem_ctx = talloc_tos();
|
---|
634 | struct rpc_pipe_client *pipe_hnd = NULL;
|
---|
635 | struct dcerpc_binding_handle *b;
|
---|
636 | NTSTATUS status, result;
|
---|
637 | struct policy_handle pol;
|
---|
638 | union lsa_PolicyInformation *info;
|
---|
639 |
|
---|
640 | ZERO_STRUCTP(dc_info);
|
---|
641 | ZERO_STRUCT(pol);
|
---|
642 |
|
---|
643 | status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
|
---|
644 | &pipe_hnd);
|
---|
645 | if (!NT_STATUS_IS_OK(status)) {
|
---|
646 | return status;
|
---|
647 | }
|
---|
648 |
|
---|
649 | b = pipe_hnd->binding_handle;
|
---|
650 |
|
---|
651 | status = dcerpc_lsa_open_policy(b, mem_ctx,
|
---|
652 | false,
|
---|
653 | SEC_FLAG_MAXIMUM_ALLOWED,
|
---|
654 | &pol,
|
---|
655 | &result);
|
---|
656 | if (!NT_STATUS_IS_OK(status)) {
|
---|
657 | goto done;
|
---|
658 | }
|
---|
659 | if (!NT_STATUS_IS_OK(result)) {
|
---|
660 | status = result;
|
---|
661 | goto done;
|
---|
662 | }
|
---|
663 |
|
---|
664 | status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
|
---|
665 | &pol,
|
---|
666 | LSA_POLICY_INFO_ACCOUNT_DOMAIN,
|
---|
667 | &info,
|
---|
668 | &result);
|
---|
669 | if (!NT_STATUS_IS_OK(status)) {
|
---|
670 | goto done;
|
---|
671 | }
|
---|
672 | if (!NT_STATUS_IS_OK(result)) {
|
---|
673 | status = result;
|
---|
674 | goto done;
|
---|
675 | }
|
---|
676 |
|
---|
677 | dc_info->netbios_domain_name = talloc_strdup(mem_ctx, info->account_domain.name.string);
|
---|
678 | if (dc_info->netbios_domain_name == NULL) {
|
---|
679 | status = NT_STATUS_NO_MEMORY;
|
---|
680 | goto done;
|
---|
681 | }
|
---|
682 |
|
---|
683 | done:
|
---|
684 | if (is_valid_policy_hnd(&pol)) {
|
---|
685 | dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
|
---|
686 | }
|
---|
687 |
|
---|
688 | TALLOC_FREE(pipe_hnd);
|
---|
689 |
|
---|
690 | return status;
|
---|
691 | }
|
---|
692 |
|
---|
693 | NTSTATUS net_scan_dc(struct net_context *c,
|
---|
694 | struct cli_state *cli,
|
---|
695 | struct net_dc_info *dc_info)
|
---|
696 | {
|
---|
697 | TALLOC_CTX *mem_ctx = talloc_tos();
|
---|
698 | struct rpc_pipe_client *dssetup_pipe = NULL;
|
---|
699 | struct dcerpc_binding_handle *dssetup_handle = NULL;
|
---|
700 | union dssetup_DsRoleInfo info;
|
---|
701 | NTSTATUS status;
|
---|
702 | WERROR werr;
|
---|
703 |
|
---|
704 | ZERO_STRUCTP(dc_info);
|
---|
705 |
|
---|
706 | status = cli_rpc_pipe_open_noauth(cli, &ndr_table_dssetup.syntax_id,
|
---|
707 | &dssetup_pipe);
|
---|
708 | if (!NT_STATUS_IS_OK(status)) {
|
---|
709 | DEBUG(10,("net_scan_dc: failed to open dssetup pipe with %s, "
|
---|
710 | "retrying with lsa pipe\n", nt_errstr(status)));
|
---|
711 | return net_scan_dc_noad(c, cli, dc_info);
|
---|
712 | }
|
---|
713 | dssetup_handle = dssetup_pipe->binding_handle;
|
---|
714 |
|
---|
715 | status = dcerpc_dssetup_DsRoleGetPrimaryDomainInformation(dssetup_handle, mem_ctx,
|
---|
716 | DS_ROLE_BASIC_INFORMATION,
|
---|
717 | &info,
|
---|
718 | &werr);
|
---|
719 | TALLOC_FREE(dssetup_pipe);
|
---|
720 |
|
---|
721 | if (NT_STATUS_IS_OK(status)) {
|
---|
722 | status = werror_to_ntstatus(werr);
|
---|
723 | }
|
---|
724 | if (!NT_STATUS_IS_OK(status)) {
|
---|
725 | return status;
|
---|
726 | }
|
---|
727 |
|
---|
728 | dc_info->is_dc = (info.basic.role & (DS_ROLE_PRIMARY_DC|DS_ROLE_BACKUP_DC));
|
---|
729 | dc_info->is_pdc = (info.basic.role & DS_ROLE_PRIMARY_DC);
|
---|
730 | dc_info->is_ad = (info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING);
|
---|
731 | dc_info->is_mixed_mode = (info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE);
|
---|
732 | dc_info->netbios_domain_name = talloc_strdup(mem_ctx, info.basic.domain);
|
---|
733 | dc_info->dns_domain_name = talloc_strdup(mem_ctx, info.basic.dns_domain);
|
---|
734 | dc_info->forest_name = talloc_strdup(mem_ctx, info.basic.forest);
|
---|
735 |
|
---|
736 | return NT_STATUS_OK;
|
---|
737 | }
|
---|